CN115391090A

CN115391090A - Firmware double-mirror-image self-recovery method and device, electronic equipment and storage medium

Info

Publication number: CN115391090A
Application number: CN202210939033.7A
Authority: CN
Inventors: 方小明; 宋华彪; 黄启乐; 易利; 邓念勤
Original assignee: China Great Wall Technology Group Co ltd
Current assignee: China Great Wall Technology Group Co ltd
Priority date: 2022-08-05
Filing date: 2022-08-05
Publication date: 2022-11-25

Abstract

The application relates to a firmware double-mirror image self-recovery method, a device, electronic equipment and a storage medium, wherein the method comprises the following steps: sending a timer starting instruction after electrification, loading a first image file from a first memory, and sending a zero clearing instruction to the timer in stages so as to prevent the timer from triggering BMC reset when overtime; when the loading duration of the first image file exceeds a first time threshold, stopping sending a zero clearing instruction to the timer, and when the counting duration of the timer reaches a second time threshold, receiving a reset signal of the timer and restarting; after the power-on is restarted, loading a second mirror image file from a second memory, and sending a zero clearing instruction to the timer in stages; and after the second image file is loaded successfully, synchronizing the second image file into the first memory. The firmware double-mirror image self-recovery method, the device, the electronic equipment and the storage medium can run autonomously without manual intervention under general conditions, can reduce the operation and maintenance investment of BMC, and have higher stability and maintainability.

Description

Firmware double-mirror-image self-recovery method and device, electronic equipment and storage medium

Technical Field

The present application relates to the field of computer firmware technologies, and in particular, to a firmware double-mirror self-recovery method and apparatus, an electronic device, and a storage medium.

Background

With the rapid development of applications such as internet and AI artificial intelligence, the demand for servers is growing explosively, and the number of data center servers is also growing exponentially, so how to improve the operational reliability of the server core firmware becomes the direction of efforts of various manufacturers. The BMC (baseboard management controller) as a core component of the server is responsible for tasks such as startup management, operation monitoring, fault handling and the like of the server, so as to realize remote batch maintenance of the server, and once an abnormal problem occurs in the operation of the BMC firmware, the server loses the remote operation and maintenance function.

Currently, the commonly used schemes of the BMC firmware of the server products on the market are mainly 2, namely a double-mirror image BMC scheme and a single BMC scheme.

The single BMC scheme cannot start the BMC under the condition that the BMC firmware fails, the remediation mode can be only manually maintained in the field, flash ROM refreshing is carried out by taking a tool in, or a BMC ROM chip is taken down by a burner to update the ROM, and then the ROM is installed. This method is inefficient and costly to maintain.

However, in the existing maintenance method, through an alarm, a maintainer manually intervenes to trigger the FLASH ROM refresh, although the reliability and maintainability are greatly enhanced compared with the single mirror, under the condition that the manual intervention does not occur for a long time, once the backup mirror fails, the situation that the single mirror scene cannot be remotely restored can be caused.

Disclosure of Invention

In view of the foregoing, it is desirable to provide a firmware dual-image self-recovery method, apparatus, computer device and readable storage medium capable of autonomous operation and having higher stability and maintainability.

In a first aspect, the present application provides a firmware dual-image self-recovery method, used in a BMC, the method including:

sending a timer starting instruction after power-on, loading a first image file from a first memory, and sending a zero clearing instruction to the timer in stages to prevent the timer from triggering BMC reset when overtime;

when the loading duration of the first image file exceeds a first time threshold, stopping sending a zero clearing instruction to a timer, and when the counting duration of the timer reaches a second time threshold, receiving a reset signal of the timer and restarting;

after the power-on state is restarted, loading a second image file from a second memory, and sending a zero clearing instruction to the timer in stages;

and after the second image file is loaded successfully, synchronizing the second image file to the first memory.

In one embodiment, the method further comprises:

and monitoring whether update data is input, updating data according to the update data when the update data is input, and synchronizing the update data into the first memory and the second memory.

In one embodiment, the method further comprises:

judging whether the first mirror image file is loaded successfully or not; if not, then

And judging whether the loading duration of the first image file exceeds a first time threshold value.

In one embodiment, if the first image file is loaded successfully, a close instruction is sent to the timer.

In one embodiment, the synchronizing the second image file into the first storage includes:

comparing whether the file in the first memory is consistent with the second image file or not, and if not, copying the second image file to the first memory;

and checking whether the file in the first memory is consistent with the second mirror image file in the second memory, and if not, continuing to execute the synchronous instruction.

In one embodiment, the verifying whether the file in the first storage is consistent with the second image file in the second storage further includes:

and judging whether the data in the first memory is restored or not, if so, adjusting the first memory to enter a primary mirror image state, and the second memory to enter a backup mirror image state.

In a second aspect, the present application provides a firmware dual-image self-recovery device, applied to a BMC, the device including:

the first mirror image module is used for sending a timer starting instruction after being electrified, loading a first mirror image file from a first memory and sending a zero clearing instruction to the timer in stages so as to prevent the timer from triggering BMC reset when overtime occurs;

the timing control module stops sending a zero clearing instruction to the timer when the loading duration of the first mirror image file exceeds a first time threshold, and receives a reset signal of the timer and restarts the timer when the counting duration of the timer reaches a second time threshold;

the second mirror image module is used for loading a second mirror image file from a second memory after restarting and sending a zero clearing instruction to the timer in stages; and

and the synchronization recovery module synchronizes the second image file to the first memory after the second image file is loaded successfully.

In a third aspect, the present application provides a computer device comprising a memory and a processor, the memory storing a computer program, the processor implementing the following steps when executing the computer program:

sending a timer starting instruction after electrification, loading a first image file from a first memory, and sending a zero clearing instruction to the timer in stages to prevent the timer from triggering BMC reset when overtime;

after the power-on is restarted, loading a second mirror image file from a second memory, and sending a zero clearing instruction to the timer in stages;

In a fourth aspect, the present application provides a computer readable storage medium storing a computer program which when executed by a processor performs the steps of:

In a fifth aspect, the present application provides a computer program product comprising a computer program which, when executed by a processor, performs the steps of:

According to the firmware double-image self-recovery method, the device, the electronic equipment and the storage medium, the BMC is powered on to start the timer and send a zero clearing instruction to the timer in stages to enable the count of the timer to return to zero, the two memories are provided simultaneously, the two memories are provided with the same image files, when the loading duration of the BMC on the first image file in the first memory exceeds a first time threshold, the BMC does not send the zero clearing instruction to the timer any more, the count of the timer does not return to zero any more, when the counting duration of the timer reaches a second time threshold, a reset signal is sent to the BMC and the BMC is restarted, the restarted BMC loads the second image file in the second memory, and the second image file is synchronized into the first memory after being loaded, so that the recovery of the firmware is completed.

Drawings

FIG. 1 is a flowchart illustrating a firmware dual-image self-recovery method according to an embodiment of the present application;

FIG. 2 is a flowchart illustrating a firmware dual-image self-recovery method according to another embodiment of the present application;

FIG. 3 is a flowchart illustrating loading of an image file of a firmware dual-image self-recovery method according to an embodiment of the present application;

FIG. 4 is a diagram illustrating a recovery process of an image file of a firmware dual-image self-recovery method according to an embodiment of the present application;

FIG. 5 is a flowchart illustrating an embodiment of a firmware dual-image self-recovery method;

FIG. 6 is a block diagram of a firmware dual-image self-recovery apparatus according to an embodiment of the present application;

FIG. 7 is a block diagram of a firmware dual-image self-recovery apparatus according to another embodiment of the present application;

fig. 8 is an internal structural diagram of a computer device according to an embodiment of the present application.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are some embodiments of the present application, but not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

As shown in fig. 1, in an embodiment, a firmware dual-image self-recovery method is used in a BMC, and includes the following steps:

step S110, a timer starting instruction is sent after the power-on, the first image file is loaded from the first memory, and a zero clearing instruction is sent to the timer in stages to prevent the timer from overtime triggering BMC reset.

Specifically, the BMC starts the timer after being electrified, the timer can count continuously after being started, and meanwhile, the BMC sends a zero clearing instruction to the timer in a staged mode to enable the count of the timer to return to zero, so that the effect of enabling the timer to count again is achieved. Subsequently, the BMC loads the first image file from the first memory.

Step S120, when the loading duration of the first image file exceeds a first time threshold, stopping sending a zero clearing instruction to the timer, and when the counting duration of the timer reaches a second time threshold, receiving a reset signal of the timer and restarting the timer.

Specifically, the BMC has a first time threshold and a second time threshold, where the first time threshold is greater than a maximum time requirement for loading a mirror image file in the memory, and the second time threshold is a time required for triggering a reset signal by the timer. When the loading duration of the first image file exceeds a first time threshold, the BMC stops sending a zero clearing instruction to the timer, the count of the timer is not reset to zero and is continuously increased along with time, when the technical duration of the timer reaches a second time threshold, the timer triggers a reset signal and sends the reset signal to the BMC, and the BMC restarts after receiving the reset signal.

And step S130, loading a second image file from a second memory after the power-on is restarted, and sending a zero clearing instruction to the timer in stages.

Specifically, the BMC may still start the timer after the power is restarted, and may still send a zero clearing instruction to the timer in a periodic manner, so that the count of the timer is reset to zero, thereby achieving an effect of resetting the timer. Subsequently, the BMC loads a second image file from the second memory.

Step S140, after the second image file is successfully loaded, synchronizing the second image file to the first memory.

Specifically, the BMC synchronizes the second image file to the first memory, so that the image files in the first memory and the second memory are consistent, thereby completing the recovery of the firmware.

According to the firmware double-image self-recovery method, after being electrified, the BMC starts the timer and sends a zero clearing instruction to the timer in stages, so that the count of the timer is reset to zero, the two memories exist at the same time, the same image files are arranged in the two memories, when the loading time of the BMC to the first image file in the first memory exceeds a first time threshold, the BMC does not send the zero clearing instruction to the timer, the count of the timer is not reset to zero, when the counting time of the timer reaches a second time threshold, a reset signal is sent to the BMC and the BMC is restarted, the restarted BMC loads the second image file in the second memory, and the second image file is synchronized into the first memory after being loaded, so that the firmware is recovered.

As shown in fig. 2, in an embodiment, a firmware dual-image self-recovery method is used in the BMC, and includes the following steps:

step S210, a timer starting instruction is sent after the power is on, a first image file is loaded from a first memory, and a clear instruction is sent to the timer in stages to prevent the timer from triggering BMC reset when overtime occurs.

The Timer can adopt a WDT (Watchdog Timer), a BMC firmware SOC Chip (System-on-a-Chip, a Chip of an integrated circuit) can select AST2600 or AST2500, the Chip supports double-mirror ROM backup starting, when the loading of the main ROM1 fails, the Timer is triggered 22 seconds after being electrified, and the starting Chip is switched from Flash ROM1 to Flash ROM2, so that mirror physical redundancy starting is realized.

It should be noted that the BMC may also monitor whether update data is input after being powered on, update data according to the update data when the update data is input, and synchronize the update data to the first memory and the second memory.

Specifically, when the first memory and the second memory are in a normal use process, if the configuration of the BMC is modified or the BMC is upgraded, the content of the image file between the two memories is synchronized to maintain the consistency of the image file between the two memories, so that the situation that the user configuration or the upgraded content is lost during recovery is avoided.

Step S220, judging whether the first mirror image file is loaded successfully; and if so, sending a closing instruction to the timer. If not, judging whether the loading duration of the first image file exceeds a first time threshold value.

Specifically, when the first image file is loaded successfully, the BMC sends a count-off instruction to the timer, and the timer does not count any more, that is, the count duration does not reach the first time threshold and the second time threshold any more, and the timer does not send a reset signal any more, and the BMC is restarted.

Step S230, when the loading duration of the first image file exceeds a first time threshold, stopping sending a clear instruction to the timer, and when the counting duration of the timer reaches a second time threshold, receiving a reset signal of the timer and restarting the timer.

Specifically, when the loading duration of the first image file exceeds the first time threshold, it is determined that the first image file is lost, and the like, and therefore the BMC needs to stop sending the zero clearing instruction to the timer, so that the timer can count continuously until the counting duration reaches the second time threshold, and then sends a reset signal, and at this time, the BMC receives the reset signal and completes restarting.

Step S240, after the power-on is restarted, a second image file is loaded from the second memory, and a clear instruction is sent to the timer in stages.

Specifically, the loading process of the image file is shown in fig. 3, the BMC respectively loads a UBOOT (universal boot loader, a boot loader mainly used for an embedded system), a kernel (real-time operating system) and a file system, and in the loading process, the timer respectively counts each loading process, and if the phenomenon that the image file loading is affected by deadlocking and the like occurs in the loading process, the clear instruction cannot be sent, so that the count clear is executed, and if the timeout timer triggers the reset of the BMC.

Step S250, after the second image file is loaded successfully, comparing whether the file in the first memory is consistent with the second image file, if not, copying the second image file to the first memory.

Specifically, as shown in fig. 4, the mirror image file recovery process is performed by the BMC to synchronize the UBOOT, the kernel, the file system, and the user data, respectively. And during synchronization, firstly comparing whether UBOOT (or kernel, or a file system, or user data) is consistent, if so, entering the next step, if not, copying the second mirror image file into the first memory, and sending a timer zero clearing instruction while copying, so as to avoid resetting when overtime occurs.

Step S260, checking whether the file in the first storage is consistent with the second image file in the second storage, and if not, continuing to execute the synchronization instruction.

Specifically, when the UBOOT (or kernel, or file system, or user data) is completely copied, the verification is performed, if the verification is successful, the next step is performed, if the verification is unsuccessful, the synchronization is performed again, and the retry number and the synchronization process log are recorded.

In the synchronization process, if no error occurs, the timer is closed to count; if 3 times of recovery actions do not continuously occur within 30 minutes, triggering the BMC to reset to the first memory mirror image for starting, otherwise, enabling the second memory mirror image to enter a working state, alarming and prompting that manual intervention is needed.

Step S270, determining whether the data in the first memory is restored, if yes, adjusting the first memory to enter a primary mirroring state, and the second memory to enter a backup mirroring state.

Specifically, if the data in the first memory is not recovered, the BMC reenters the recovery process until the work is normal.

According to the firmware double-image self-recovery method, after being electrified, the BMC starts the timer, sends a zero clearing instruction to the timer in stages, enables the count of the timer to return to zero, simultaneously has two memories, and the two memories have the same image file, when the BMC loads the first image file in the first memory, if the loading is successful, the BMC sends a closing instruction to the timer, the timer stops counting, if the loading duration exceeds a first time threshold, the BMC stops sending the zero clearing instruction to the timer, the count of the timer does not return to zero any more, when the counting duration of the timer reaches a second time threshold, the timer sends a reset signal to the BMC, and the BMC restarts after receiving the reset signal. The restarted BMC loads a second image file in a second memory, compares whether the file in the first memory is consistent with the second image file or not after the loading is finished, enters verification if the file in the first memory is consistent with the second image file, copies the second image file into the first memory if the file in the first memory is inconsistent with the second image file, and then verifies the second image file; if the verification is successful, the first storage is adjusted to carry out a primary mirror image state, and the second storage enters a backup mirror image state; the overall flow is shown in fig. 5. Meanwhile, if the verification is unsuccessful, the synchronization action is carried out again, and if the recovery action continuously occurs for a plurality of times within a period of time, an alarm is given and manual intervention is prompted. The applicability is higher, and the stability and the maintainability are further improved.

As shown in fig. 6, in an embodiment, a firmware dual-mirror self-recovery apparatus applied in a BMC includes a first mirror module 610, a timing control module 620, a second mirror module 630, and a synchronization recovery module 640, wherein:

the first mirror module 610 is configured to issue a timer start instruction after being powered on, load a first mirror file from a first memory, and send a zero clearing instruction to the timer in stages, so as to prevent the timer from triggering BMC reset when the timer times out.

The timing control module 620 is configured to stop sending the zero clearing instruction to the timer when the loading duration of the first image file exceeds a first time threshold, and receive a reset signal of the timer and restart the timer when the counting duration of the timer reaches a second time threshold.

The second mirror module 630 is configured to load a second mirror file from the second memory after restarting the power-on, and send a clear instruction to the timer in stages.

After the second image file is successfully loaded, the synchronization restoring module 640 synchronizes the second image file to the first memory.

In the firmware double-mirror self-recovery device, the first mirror module 610 starts a timer after the BMC is powered on, and sends a zero clearing instruction to the timer in stages, so that the count of the timer is reset to zero, two memories exist at the same time, the two memories have the same mirror image file, when the timing control module 620 detects that the loading duration of the BMC on the first mirror image file in the first memory exceeds a first time threshold, the first mirror module 610 does not send the zero clearing instruction to the timer any more, the count of the timer is not reset to zero, when the counting duration of the timer reaches a second time threshold, a reset signal is sent to the timing control module 620, and the timing control module 620 is restarted after receiving the reset signal; the second mirror image module 630 loads the second mirror image file after the reboot, and after the second mirror image file is loaded, the synchronization recovery module 640 synchronizes the second mirror image file to the first memory, so as to complete the recovery of the firmware.

As shown in fig. 7, in an embodiment, a firmware dual-mirror self-recovery apparatus applied in a BMC includes a first mirror module 610, a first determining module 710, a timing control module 620, a second mirror module 630, a second determining module 720, a checking module 730, and a third determining module 740, wherein:

The first judging module 710 is configured to judge whether the first image file is successfully loaded; and if so, sending a closing instruction to the timer. If not, judging whether the loading duration of the first image file exceeds a first time threshold value.

The second determining module 720 is configured to compare whether a file in the first memory is consistent with the second image file after the second image file is successfully loaded, and if not, copy the second image file to the first memory.

The checking module 730 is configured to check whether the file in the first storage is consistent with the second image file in the second storage, and if not, continue to execute the synchronization instruction.

The third determining module 740 is configured to determine whether the data in the first memory is restored, and if so, adjust the first memory to enter a primary mirroring state, and the second memory to enter a backup mirroring state.

It should be noted that the firmware double-mirror image self-recovery device further includes a data updating module, configured to monitor whether update data is input, perform data updating according to the update data when the update data is input, and synchronize the update data to the first memory and the second memory.

In the firmware double-image self-recovery device, the first image module 610 starts a timer after the BMC is powered on, and sends a zero clearing instruction to the timer in stages to make the count of the timer return to zero, and there are two memories having the same image files therein, and in the process of loading the first image file by the first image module 610, the first judgment module 710 judges whether the first image file is loaded successfully, and if the first image file is loaded successfully, sends a close instruction to the timer to make the timer stop counting; when the timing control module 620 detects that the loading duration of the first image file in the first memory by the BMC exceeds the first time threshold, the first image module 610 does not send a clear instruction to the timer any longer, the count of the timer does not return to zero any longer, when the count duration of the timer reaches the second time threshold, a reset signal is sent to the timing control module 620, and the timing control module 620 is restarted after receiving the reset signal; after the reboot, the second mirror image module 630 loads the second mirror image file, after the second mirror image file is loaded, the second determining module 720 compares whether the file in the first memory is consistent with the second mirror image file, if so, the second mirror image file enters a state to be verified, and if not, the second mirror image file is copied to the first memory and then enters the state to be verified; the checking module 730 checks the image file entering the checking state, and if the checking is successful, the third determining module 740 adjusts the first storage to perform the primary image state, and the second storage enters the backup image state; meanwhile, if the verification is unsuccessful, the synchronization action is carried out again, and if the recovery action continuously occurs for a plurality of times within a period of time, an alarm is given and manual intervention is prompted. The applicability is higher, and the stability and the maintainability are further improved.

In one embodiment, a computer device, which may be an intelligent terminal, may have an internal structure as shown in fig. 8. The computer device includes a processor, a memory, and a network interface connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program to run on the non-volatile storage medium. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a firmware dual-image self-recovery method.

Those skilled in the art will appreciate that the architecture shown in fig. 8 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.

In an embodiment, a computer device comprises a memory and a processor, the memory storing a computer program, the processor implementing the steps of the above method embodiments when executing the computer program.

In one embodiment, a computer storage medium stores a computer program that, when executed by a processor, performs the steps in the above-described method embodiments.

In one embodiment, a computer program product or computer program is provided that includes computer instructions stored in a computer readable storage medium. The computer instructions are read by a processor of a computer device from a computer-readable storage medium, and the computer instructions are executed by the processor to cause the computer device to perform the steps in the above-mentioned method embodiments.

It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically Programmable ROM (EPROM), electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double Data Rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous Link DRAM (SLDRAM), rambus (Rambus) direct RAM (RDRAM), direct Rambus Dynamic RAM (DRDRAM), and Rambus Dynamic RAM (RDRAM), among others.

The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.

The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the present application. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.

Claims

1. A firmware double-image self-recovery method used in a BMC (baseboard management controller), the method comprising:

2. The firmware dual-image self-recovery method of claim 1, further comprising:

3. The firmware double-image self-recovery method according to claim 1, further comprising:

4. The firmware dual-image self-recovery method according to claim 3, wherein if the first image file is loaded successfully, a close instruction is sent to the timer.

5. The firmware dual-image self-recovery method of claim 1, wherein the synchronizing the second image file into the first memory comprises:

and checking whether the file in the first memory is consistent with the second mirror image file in the second memory, and if not, continuing to execute the synchronization instruction.

6. The firmware double-image self-recovery method according to claim 5, wherein the checking whether the file in the first memory is consistent with the second image file in the second memory further comprises:

7. A firmware double-image self-recovery device applied to BMC is characterized by comprising:

the timing control module stops sending a zero clearing instruction to the timer when the loading duration of the first image file exceeds a first time threshold, and receives a reset signal of the timer and restarts the timer when the counting duration of the timer reaches a second time threshold;

the second mirror image module is used for loading a second mirror image file from the second memory after restarting and sending a zero clearing instruction to the timer in stages; and

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor realizes the steps of the method of any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, in which a computer program is stored which, when being executed by a processor, carries out the steps of the method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that the computer program realizes the steps of the method of any one of claims 1 to 6 when executed by a processor.