TWI826287B - Management platform system and image repairing and debug method thereof - Google Patents

Abstract

A management platform system and image repairing and debug method thereof. The management platform system includes a first storage circuit, a second storage circuit, a first control circuit, and a second control circuit. The first storage circuit includes an active storage area and a debugging storage area, wherein the active storage area is configured to store an active image. The second storage circuit includes a spare storage area, wherein the spare storage area is configured to store a spare image. The first control circuit is configured to determine whether the active image is valid. When the first control circuit determines the active image is invalid, the first control circuit is further configured to determine whether the spare image is valid. When the first control circuit determines the spare image is valid, the first control circuit is further configured to overwrite the active image with the spare image after copying the active image to the debugging storage area.

Description

Management platform system and image file repair and debugging methods

The present invention relates to a baseboard management controller and its image file, and in particular to a management platform system and its image file repair and debugging method.

In recent years, server security and stability have received more and more attention, and it has become increasingly popular to use auxiliary controllers to assist the Baseboard Management Controller (BMC) in the system to maintain stable operation, thereby ensuring that the BMC can run smoothly. BMC firmware file to perform various functions of BMC. When an error occurs in the BMC, the auxiliary controller downloads through the Internet or obtains a backup BMC image file from the platform to overwrite the BMC image file currently used by the BMC to operate, that is, the BMC that causes the BMC to operate with the error. image file, thereby allowing the BMC to execute the backup BMC image file to resume normal operation. However, since the BMC image file that caused the error was overwritten by the backup BMC image file, the maintenance personnel were unable to analyze the cause of the problem caused by the error and perform debug.

In view of this, the present invention proposes a management platform system. The management platform system includes: a first storage circuit, including an active storage area and a debug storage area, wherein the active storage area is used to store an active image file; a second storage circuit, including a spare storage area, wherein the spare storage area The area is used to store a backup image file; a first control circuit is electrically connected to the first storage circuit and the second storage circuit to determine whether the active image file is valid; and a second control circuit is electrically connected to the first storage circuit. A storage circuit and a second storage circuit are used to load and run the active image file according to a reset signal; wherein, when the first control circuit determines that the active image file is valid, the first control circuit generates a reset signal to trigger the second The second control circuit loads and runs the active image file according to the reset signal; when the first control circuit determines that the active image file is invalid, the first control circuit is further used to determine whether the backup image file is valid; when the first control circuit determines that the backup image file is valid, When the file is valid, the first control circuit is further used to copy the active image file to the debug storage area, and then overwrite the active image file with the backup image file.

In some embodiments, the first storage circuit further includes a first signature file storage area, and the first signature file storage area is used to store a first signature file.

In some embodiments, the first control circuit is further configured to check the first signature file to determine whether the active image file is valid.

In some embodiments, the second storage circuit further includes a second signature file storage area, and the second signature file storage area is used to store a second signature file.

In some embodiments, the first control circuit is further configured to check the second signature file to determine whether the backup image file is valid.

The present invention also provides an image file repair and debugging method. The image file repair and debugging method includes: checking a first signature file to determine whether an active image file is valid, wherein the first signature file is stored in a first signature file storage area of a first storage circuit, and the active image file is stored in In the active storage area of the first storage circuit; when the active image file is invalid, a second signature file is checked to determine whether a backup image file is valid, wherein the second signature file is stored in a second signature file of the second storage circuit In the area, the backup image file is stored in the spare storage area of the second storage circuit; when the backup image file is valid, the active image file is copied to the debug storage area of the first storage circuit; the backup image file is overwritten and stored in the active image file in the active storage area of the first storage circuit; and generate a reset signal to trigger the second control circuit to load and load and run the active image file according to the reset signal.

In some embodiments, the image file repair and debugging method further includes: when the active image file is valid, controlling a first selection circuit to select the transmission target of the first storage circuit as a second control circuit.

In some embodiments, the image file repair and debugging method further includes: when the active image file is invalid, controlling a second selection circuit to select the transmission target of the second storage circuit as a first control circuit, and checking the second signature file. To determine whether a backup image file is valid.

In some embodiments, the image file repair and debugging method further includes: when the backup image file is valid, controlling a first selection circuit to select the transmission target of the first storage circuit as a first control circuit, and copying the active image file to the debug storage area of the first storage circuit; control a second selection circuit to select the transmission target of the second storage circuit as a first control circuit, and overwrite and store the backup image file in the active storage area of the first storage circuit the active image file; and controlling the first selection circuit to select the transmission target of the first storage circuit as a second control circuit.

Please refer to FIG. 1 , which is a module block diagram of the management platform system 10 according to a first embodiment. The management platform system 10 includes a first storage circuit 100, a second storage circuit 110, a first control circuit 120 and a second control circuit 130. Among them, the first control circuit 120 is electrically connected to the first storage circuit 100 and the second storage circuit 110 , and the second control circuit 130 is electrically connected to the first storage circuit 100 and the second storage circuit 110 . The structure and function of each of the first storage circuit 100, the second storage circuit 110, the first control circuit 120 and the second control circuit 130 will be explained in detail below, and the arrangement of each other will be described.

In some embodiments, the management platform system 10 complies with a Platform Firmware Resiliency (PFR) specification.

Please refer to FIG. 2 , which is a circuit schematic diagram of the first storage circuit 100 according to some embodiments. In some embodiments, the first storage circuit 100 includes an active storage area 101, a debug storage area 102, a first signature file storage area 103, a configuration file storage area 104 and a log file storage area 105. The active storage area 101 is used to store an active image file Ia. Among them, the active image file Ia is used to be loaded and executed by the second control circuit 130, so that the second control circuit 130 can execute various functions by executing the active image file Ia. In some embodiments, the debug storage area 102 is used to store the invalid active image file Ia (ie, the debug image file Ib), so that the management platform system 10 can subsequently debug the debug image file Ib. In some embodiments, the capacity of the active storage area 101 is equal to the capacity of the debug storage area 102, but this is not a limitation. Among them, the capacity of the active storage area 101 and the capacity of the debug storage area 102 are not less than the file size of the active image file Ia, so that the active storage area 101 has enough space to store the active image file Ia, and the debug storage area 102 has Sufficient space to store invalid active image file Ia.

In some embodiments, the first signature file storage area 103 is used to store a first signature file Sig1. The first signature file Sig1 is used to ensure that the data stored in the first storage circuit 100 has not been modified. In some embodiments, since the first storage circuit 100 allows editing of the data stored in the first storage circuit 100 based on the first signature file Sig1, if the data stored in the first storage circuit 100 is to be edited without authorization, If the stored data is illegally edited, the first signature file Sig1 must be destroyed or removed. Therefore, when the first signature file Sig1 exists in the first signature file storage area 103 and its file is still complete, it means that the data (eg, the active image file Ia) stored in the first storage circuit 100 is safe and valid. When the first signature file Sig1 does not exist in the first signature file storage area 103 or its file is incomplete, it means that the data (such as the active image file Ia) stored in the first storage circuit 100 is unsafe and invalid.

In some embodiments, the configuration file storage area 104 is used to store a configuration file (Configuration). The configuration file is used to provide the preset parameters required by the second control circuit 130 during the initialization and operation process. In some embodiments, the log file storage area 105 is used to store a log file (Logs). The log file is used to record errors generated when the management platform system 10 performs various functions and errors generated during the operation of the computer system managed by the management platform system 10 . For example, when the computer system managed by the management platform system 10 executes the Basic Input/Output System (BIOS) during the boot process, an error generated is transmitted to the management platform system 10 , so the information in the log file storage area 105 In addition to recording what happens to the management platform system itself, the log file also records errors that occur when the computer system managed by the management platform system 10 executes the BIOS or the operating system (Operating System, OS). In some embodiments, the free storage area 106 is a storage space in the first storage circuit 100 that has not yet stored data.

Please refer to FIG. 3 , which is a circuit schematic diagram of the second storage circuit 110 according to some embodiments. In some embodiments, the second storage circuit 110 includes a spare storage area 111, a second signature file storage area 112 and an idle storage area 113. The spare storage area 111 is used to store a spare image file Is. Among them, the backup image file Is is the backup file of the active image file Ia. In some embodiments, when the active image file Ia is invalid, the management platform system 10 can restore the active image file Ia through the backup image file Is. That is to say, the management platform system 10 overwrites the active image file Ia originally stored in the first storage circuit 100 with the backup image file Is as the new active image file Ia.

In some embodiments, the second signature file storage area 112 is used to store a second signature file Sig2. The second signature file Sig2 is used to ensure that the data stored in the second storage circuit 110 has not been modified. Similarly, in some embodiments, since the second storage circuit 110 allows editing of the data stored in the second storage circuit 110 according to the second signature file Sig2, if you want to edit the second storage circuit without authorization, If the data stored in the circuit 110 is illegally edited, the second signature file Sig2 must be destroyed or removed. Therefore, when the second signature file Sig2 exists in the second signature file storage area 112 and its file is still complete, it means that the data (eg, the backup image file Is) stored in the second storage circuit 110 is safe and valid. When the second signature file Sig2 does not exist in the second signature file storage area 112 or its file is incomplete, it means that the data (such as the backup image file Is) stored in the second storage circuit 110 is unsafe and invalid. In some embodiments, the free storage area 113 is a storage space in the second storage circuit 110 that has not yet stored data.

In some embodiments, the first storage circuit 100 and the second storage circuit 110 are non-volatile memories (Non-volatile memory), such as flash memory (Flash memory), solid state disk (SSD). ) or hard drive/hard disk drive/traditional hard disk (Hard Disk Drive, HDD), etc., not limited to this. Among them, since the first storage circuit 100 and the second storage circuit 110 have the physical characteristics of non-volatile memory, the data stored in the first storage circuit 100 and the second storage circuit 110 will not be affected by the first storage circuit 100 and the second storage circuit 110. The power supply of the second storage circuit 110 is turned off and disappears.

The operation of the first storage circuit 100 and the second storage circuit 110 will be described below using a flash memory as an example. In some embodiments, flash memory has three basic operations, including write, read, and delete, where the write operation is used to write data into the flash memory, The read operation is used to read the data stored in the flash memory, and the delete operation is used to delete the data stored in the flash memory. In some embodiments, the flash memory system can implement a copy (Copy) operation through a write operation and a read operation. The process of the copy operation is: reading a first data stored in a first storage area; and Writing the first data into a second storage area; wherein the first storage area and the second storage area exist in the same flash memory or in different flash memories. middle. In some embodiments, the flash memory system can implement an overwrite operation through a write operation and a delete operation. The process of the overwrite operation is as follows: storing the first data in one of the storage areas of the flash memory. Data deletion; and writing a second data into the storage area.

In some embodiments, when the backup image file Is is valid, the management platform system 10 disables the writing function of the second storage circuit 110 to prevent any write operation from causing the backup image file stored in the second storage circuit 110 to Is something went wrong.

Please refer to Figure 4, which is a module block diagram of the management platform system 10' according to a second embodiment. In some embodiments, the management platform system 10' further includes a first selection circuit 140 and a second selection circuit 150. Among them, the first selection circuit 140 is disposed between the first storage circuit 100 and the first control circuit 120 and between the first storage circuit 100 and the second control circuit 130, and the second selection circuit 150 is disposed between the second storage circuit 100 and the second control circuit 130. between the circuit 110 and the first control circuit 120 and between the second storage circuit 110 and the second control circuit 130 .

In some embodiments, the first selection circuit 140 is used to select the transmission target of the first storage circuit 100 according to a first control signal C1. Among them, the transmission target of the first storage circuit 100 is one of the first control circuit 120 and the second control circuit 130 . Please refer to FIG. 5 , which is a circuit schematic diagram of an embodiment of the first selection circuit 140 in FIG. 4 . In some embodiments, the first selection circuit 140 is a multiplexer (MUX). Among them, the input terminal of the first selection circuit 140 is electrically connected to the first storage circuit 100, one output terminal of the first selection circuit 140 is electrically connected to the first control circuit 120, and the other output terminal of the first selection circuit 140 is electrically connected. is connected to the second control circuit 130.

In some embodiments, the first control signal C1 is generated by the first control circuit 120 . When the first control signal C1 is a first logic level, the transmission target of the first storage circuit 100 is the first control circuit 120. At this time, the first selection circuit 140 is electrically connected between the first storage circuit 100 and the first Control circuit 120. When the first control signal C1 is a second logic level, the transmission target of the first storage circuit 100 is the second control circuit 130. At this time, the first selection circuit 140 is electrically connected between the first storage circuit 100 and the second control circuit. 130. In some embodiments, the first logic level is a low voltage logic level representing a 0, and the second logic level is a high voltage logic level representing a 1. In other embodiments, the first logic level is a high voltage logic level representing a 1, and the second logic level is a low voltage logic level representing a 0.

In some embodiments, the first selection circuit 140 presets the transmission target of the first storage circuit 100 to the first control circuit 120 according to the corresponding first control signal C1. At this time, the first selection circuit 140 is electrically connected to The first storage circuit 100 and the first control circuit 120.

In some embodiments, the second selection circuit 150 is used to select the transmission target of the second storage circuit 110 according to a second control signal C2. The transmission target of the second storage circuit 110 is one of the first control circuit 120 and the second control circuit 130 . Please refer to FIG. 6 , which is a circuit schematic diagram of an embodiment of the second selection circuit 150 in FIG. 4 . In some embodiments, the second selection circuit 150 is a multiplexer (MUX). Among them, the input terminal of the second selection circuit 150 is electrically connected to the second storage circuit 110, one output terminal of the second selection circuit 150 is electrically connected to the first control circuit 120, and the other output terminal of the second selection circuit 150 is electrically connected. is connected to the second control circuit 130.

In some embodiments, the second control signal C2 is generated by the first control circuit 120 . When the second control signal C2 is a third logic level, the transmission target of the second storage circuit 110 is the first control circuit 120 . When the second control signal C2 is a fourth logic level, the transmission target of the second storage circuit 110 is the second control circuit 130 . In some embodiments, the third logic level is a low voltage logic level representing a 0, and the fourth logic level is a high voltage logic level representing a 1. In other embodiments, the third logic level is a high voltage logic level representing 1, and the fourth logic level is a low voltage logic level representing 0.

In some embodiments, the second selection circuit 150 presets the transmission target of the second storage circuit 110 to the first control circuit 120 according to the corresponding second control signal C2. At this time, the second selection circuit 150 is electrically connected to The second storage circuit 110 and the first control circuit 120.

In some embodiments, the first control circuit 120 is a root of trust (RoT) chip, a complex programmable logic device (CPLD), a field programmable gate array (Field Programmable Gate Array, FPGA) or a micro Controllers such as Microcontroller Unit (MCU) that can execute programming programs/firmware and operate. The RoT chip is a hardware device used to implement the three important principles of protection, detection and recovery in the PFR specification.

The first control circuit 120 is used to determine whether the active image file Ia is valid. In some embodiments, the first control circuit 120 is used to check the first signature file Sig1 to determine whether the active image file Ia is valid. If the active image file Ia is valid, it means that the function of the active image file Ia is normal and can be run; if the active image file Ia is invalid, it means that there is an error in the active image file Ia and it cannot be run.

When the first control circuit 120 determines that the active image file Ia is invalid, the first control circuit 120 is further used to determine whether the backup image file Is is valid. In some embodiments, the first control circuit 120 is further used to check the second signature file Sig2 to determine whether the backup image file Is is valid. When the first control circuit 120 determines that the backup image file Is is valid, the first control circuit 120 copies the invalid active image file Ia to the debug storage area 102 of the first storage circuit 100, and then overwrites and stores the backup image file Is. The active image file Ia in the active storage area 101 of the first storage circuit 100 serves as the new active image file Ia.

The second control circuit 130 is used to load and run the active image file Ia according to the reset signal Rs1, and the reset signal Rs1 is used to enable the second control circuit 130. Among them, before the second control circuit 130 receives the reset signal Rs1, the second control circuit 130 does not load and run the active image file Ia. In some embodiments, the reset signal Rs1 is generated by the first control circuit 120 . When the reset signal Rs1 is a fifth logic level signal, the second control circuit 130 is enabled and starts to operate. When the reset signal Rs1 is a sixth logic level, the second control circuit 130 is disabled and stops operating. In some embodiments, the fifth logic level is a low voltage logic level representing a 0, and the sixth logic level is a high voltage logic level representing a 1. In other embodiments, the fifth logic level is a high voltage logic level representing 1, and the sixth logic level is a low voltage logic level representing 0.

In some embodiments, the second control circuit 130 is a baseboard management controller (BMC). Among them, BMC is a small processor used for remote monitoring and management of host systems. It is usually located on the motherboard of a computer, server, network or storage device. In some embodiments, the BMC is used to remotely perform monitoring and management functions on a platform (such as a motherboard) when the platform is not powered on, such as firmware updates, power management, and system temperature monitoring.

Please refer to Figures 1 to 7. Figure 7 is an operation flow chart of a management platform system (including the management platform system 10 of Figure 1 and the management platform system 10' of Figure 4) according to some embodiments. The following will first take the management platform system 10 of Figure 1 as an example for explanation, and take the management platform system 10' of Figure 4 as an example for supplementary explanation. When the management platform system 10 is powered on to start operation, the first control circuit 120 checks a first signature file Sig1 stored in the first signature file storage area 103 of the first storage circuit 100 to determine whether it is stored in the first storage circuit. 100 whether an active image file Ia in the active storage area 101 is valid (step S100).

When the active image file Ia is valid, the first control circuit 120 generates a corresponding reset signal Rs1 to enable the second control circuit 130, so that the second control circuit 130 loads and runs the active image file Ia (step S110).

When the active image file Ia is invalid, the first control circuit 120 checks a second signature file Sig2 stored in the second signature file storage area 112 of the second storage circuit 110 to determine the backup storage stored in the second storage circuit 110 Whether a backup image file Is in the area 111 is valid (step S120). Among them, when the backup image file Is is invalid, it means that the second control circuit 130 cannot operate normally. At this time, the management platform system 10 turns off the power to end the operation, thereby preventing the management platform system 10 from generating errors.

Following step S120, when the backup image file Is is valid, the first control circuit 120 copies the invalid active image file Ia to the debug storage area 102 of the first storage circuit 100 (step S130), and copies the backup image file Is The active image file Ia stored in the active storage area 101 of the first storage circuit 100 is overwritten as a new active image file Ia (step S140). In some embodiments, the first control circuit 120 further checks whether step S140 is successful (step S150).

Among them, if step S140 is unsuccessful, it means that the second control circuit 130 cannot operate normally. At this time, the management platform system 10 turns off the power to end the operation, thereby preventing the management platform system 10 from generating errors. If step S140 is successful, the first control circuit 120 generates a corresponding reset signal Rs1 to trigger the second control circuit 130 to load and run the active image file Ia according to the reset signal Rs1 (step S110 ).

In some embodiments, when the active image file Ia is valid, the management platform system 10' in FIG. 4 further controls the first selection circuit 140 to select the first storage through the corresponding first control signal C1 generated by the first control circuit 120. The transmission target of the circuit 100 is the second control circuit 130 and generates the corresponding reset signal Rs1 to trigger the second control circuit 130 to load and run the active image file Ia according to the reset signal Rs1 (corresponding to step S110).

In some embodiments, when the active image file Ia is invalid, the management platform system 10' in FIG. 4 further controls the second selection circuit 150 to select the second storage through the corresponding second control signal C2 generated by the first control circuit 120. The transmission target of the circuit 110 is the first control circuit 120, and the second signature file Sig2 is checked to determine whether the backup image file Is is valid (corresponding to step S120).

In some embodiments, when the backup image file Is is valid, the management platform system 10' in FIG. 4 further controls the first selection circuit 140 to select the first storage through the corresponding first control signal C1 generated by the first control circuit 120. The transmission target of the circuit 100 is the first control circuit 120, and the invalid active image file Ia is copied to the debug storage area 102 of the first storage circuit 100 (corresponding to step S130). Then, the management platform system 10' in FIG. 4 further controls the second selection circuit 150 to select the transmission target of the second storage circuit 110 as the first control circuit 120 through the corresponding second control signal C2 generated by the first control circuit 120. And the backup image file Is overwrites the active image file Ia stored in the active storage area 101 of the first storage circuit 100 as a new active image file Ia (corresponding to step S140). Finally, the management platform system 10' in Figure 4 further controls the first selection circuit 140 to select the transmission target of the first storage circuit 100 as the second control circuit 130 through the corresponding first control signal C1 generated by the first control circuit 120. And generate a corresponding reset signal Rs1 to trigger the second control circuit 130 to load and run the active image file Ia according to the reset signal Rs1 (corresponding to step S110).

In summary, according to some embodiments, the management platform system 10, 10' copies the invalid active image file Ia (ie, the debug image file Ib) to the debug storage area 102 of the first storage circuit 100, and then uses The active image file Ia is restored from the spare image file Is stored in the spare storage area 111 of the second storage circuit 110 . Therefore, the management platform system 10, 10' can not only ensure its security, but also back up the invalid active image file 1a for debugging.

Although the present invention has been disclosed in the above embodiments, they are not intended to limit the creation of the present invention. Anyone with ordinary skill in the art may make slight modifications and modifications without departing from the spirit and scope of the disclosure. changes, but these slight modifications and changes are still within the patentable scope of the present invention.

10: Management platform system 10’: Management platform system 100: First storage circuit 101:Active storage area 102: Debug storage area 103: First signature file storage area 104: Configuration file storage area 105: Log file storage area 106:Idle storage area 110: Second storage circuit 111: Spare storage area 112: Second signature file storage area 113:Idle storage area 120: First control circuit 130: Second control circuit 140: First selection circuit 150: Second selection circuit C1: first control signal C2: Second control signal Ia: active image file Ib: Debug image file Is: Alternate image file Rs1: reset signal S100~S150: steps Sig1: first signature file Sig2: Second signature file

FIG. 1 is a module block diagram of a management platform system according to a first embodiment. FIG. 2 is a circuit schematic diagram of a first storage circuit according to some embodiments. FIG. 3 is a circuit schematic diagram of a second storage circuit according to some embodiments. Figure 4 is a module block diagram of a management platform system according to a second embodiment. FIG. 5 is a circuit schematic diagram of an embodiment of the first selection circuit in FIG. 4 . FIG. 6 is a circuit schematic diagram of an embodiment of the second selection circuit in FIG. 4 . Figure 7 is an operational flow chart of a management platform system according to some embodiments.

10: Management platform system

100: First storage circuit

110: Second storage circuit

120: First control circuit

130: Second control circuit

Rs1: reset signal

Claims (10)

A management platform system including: A first storage circuit, including an active storage area and a debug storage area, wherein the active storage area is used to store an active image file; a second storage circuit including a spare storage area, wherein the spare storage area is used to store a spare image file; a first control circuit electrically connected to the first storage circuit and the second storage circuit for determining whether the active image file is valid; and a second control circuit electrically connected to the first storage circuit and the second storage circuit for loading and running the active image file according to a reset signal; Wherein, when the first control circuit determines that the active image file is valid, the first control circuit generates the reset signal to trigger the second control circuit to load and run the active image file according to the reset signal; When the first control circuit determines that the active image file is invalid, the first control circuit is further used to determine whether the backup image file is valid; When the first control circuit determines that the backup image file is valid, the first control circuit is further used to copy the active image file to the debug storage area, and then overwrite the active image file with the backup image file. The management platform system of claim 1, wherein the first storage circuit further includes a first signature file storage area, and the first signature file storage area is used to store a first signature file. The management platform system of claim 2, wherein the first control circuit is further used to check the first signature file to determine whether the active image file is valid. The management platform system of claim 1, wherein the second storage circuit further includes a second signature file storage area, and the second signature file storage area is used to store a second signature file. The management platform system of claim 4, wherein the first control circuit is further used to check the second signature file to determine whether the backup image file is valid. The management platform system as described in request item 1 further includes: a first selection circuit, disposed between the first storage circuit and the first control circuit and between the first storage circuit and the second control circuit, for selecting the first storage according to a first control signal The transmission target of the circuit, wherein the transmission target of the first storage circuit is one of the first control circuit and the second control circuit; and a second selection circuit, disposed between the second storage circuit and the first control circuit and between the second storage circuit and the second control circuit, for selecting the second storage according to a second control signal The transmission target of the circuit, wherein the transmission target of the second storage circuit is one of the first control circuit and the second control circuit. An image file repair and debugging method, including: Checking a first signature file to determine whether an active image file is valid, wherein the first signature file is stored in a first signature file storage area of a first storage circuit, and the active image file is stored in an active image file of the first storage circuit in storage area; When the active image file is invalid, a second signature file is checked to determine whether a backup image file is valid, wherein the second signature file is stored in a second signature file storage area of a second storage circuit, and the backup image file is stored in the spare storage area of the second storage circuit; When the backup image file is valid, copy the active image file to the debug storage area of the first storage circuit; overwriting the active image file stored in the active storage area of the first storage circuit with the backup image file; and A reset signal is generated to trigger a second control circuit to load and run the active image file according to the reset signal. The image file repair and debugging method as described in request 7 also includes: When the active image file is valid, a first selection circuit is controlled to select the transmission target of the first storage circuit to be the second control circuit. The image file repair and debugging method as described in request 7 also includes: When the active image file is invalid, a second selection circuit is controlled to select the transmission target of the second storage circuit as a first control circuit, and the second signature file is checked to determine whether the backup image file is valid. The image file repair and debugging method as described in request 9 also includes: When the backup image file is valid, control a first selection circuit to select the transmission target of the first storage circuit as the first control circuit, and copy the active image file to the debug storage area of the first storage circuit; Control the second selection circuit to select the transmission target of the second storage circuit to be the first control circuit, and overwrite the active image file stored in the active storage area of the first storage circuit with the backup image file; and The first selection circuit is controlled to select the transmission target of the first storage circuit to be the second control circuit.

Images