TWI733279B - Server device and method for avoiding firmware cannot be updated again thereof - Google Patents

Abstract

A server device and a method for avoiding a firmware cannot be updated again thereof are provided. The method includes a firmware loading unit of a PLD loading a first firmware program, so that the sever device operating in a working mode and a functionality of an I2C interface being locked in a status of enable, a controlling unit of the PLD executing an initializing procedure for the firmware loading unit when receiving a firmware update command in the working mode, so that the sever device switching to a setting mode, and in the setting mode, the functionality still being locked in enable; the controlling unit further verifying a second firmware program that to be loaded into the firmware loading unit when receiving the firmware update command, when a verification result is “verifying failed”, the server device outputting a warning message in the setting mode to indicate that the second firmware program is not loaded into the firmware loading unit.

Description

Server device and its method to prevent firmware from being unable to update again

This case is about a server device, and especially a server device with programmable logic devices.

Generally speaking, a programmable logic device is set in the server device to control the power-on process, signal control, or parameter transmission during the boot process of the server device. Therefore, the programmable logic device Firmware programs are often updated. Generally, programmable logic devices have Joint Test Action Group (JTAG) interfaces and Serial Peripheral Interface (SPI) interfaces, and programmable logic devices The firmware program can be updated through the JTAG interface, I2C interface or SPI interface.

Among them, when the programmable logic device is connected to other units of the server device through the JTAG interface and the SPI interface, at least six pins are required to meet the specifications of the JTAG interface and the SPI interface, and the JTAG interface and the SPI interface are wired for the bus There are also certain restrictions on the length. Considering the layout space and connector cost in the server device, the JTAG interface and the SPI interface are difficult to meet the current demand for the price and lightness of the server device. Therefore, the current programmable logic device updates its firmware program The main bus interface is the I2C interface.

However, the I2C interface is disabled by default, and the server device needs to enable the I2C interface to enable the programmable logic device to update its firmware. When the firmware has an error or an error occurs during the firmware update process, if the power of the server device is restarted at this time, the I2C interface unit will be shut down after the server device is restarted or powered on. The maintainer of the server device The firmware of the programmable logic device cannot be updated again through the I2C interface, and the server device cannot be successfully booted. If you want to use the JTAG interface to update the firmware of the programmable logic device again, you must open the server In the case or cover of the device, the firmware of the programmable logic device can be updated only when the external device is directly connected to the pins of the JTAG interface, causing inconvenience to the maintainer of the server device.

In one embodiment, a server device includes a programmable logic device and a baseboard management controller. The programmable logic device includes a firmware load unit, an I2C interface unit, a non-volatile memory unit, and a control unit. The firmware loading unit is used to load a first firmware program to switch the programmable logic device from a setting mode to a working mode, and the I2C interface writing function of the programmable logic device is locked to be enabled. The firmware program contains the code that locks the writing function of the I2C interface. The I2C interface unit is coupled to the baseboard management controller, and the I2C interface unit is used to receive a second firmware program from the baseboard management controller according to the enabled I2C interface write function in the working mode. The non-volatile memory unit is coupled to the I2C interface unit, and the non-volatile memory unit is used for receiving the second firmware program through the I2C interface unit and storing the second firmware program. The control unit is coupled to the baseboard management controller, the firmware load unit and the non-volatile memory unit, and the control unit is used to execute the firmware load unit when receiving a firmware update command from the baseboard management controller in the working mode A clearing action to switch the programmable logic device from working mode to setting mode, and the I2C interface writing function is still locked in the setting mode but not switched to off, and the control unit receives the firmware update command Verify the second firmware program. When the second firmware program fails the verification, the server device outputs a warning message in the setting mode to indicate that the second firmware program is not loaded into the firmware loading unit.

In one embodiment, a method for preventing the firmware from being unable to be updated again includes loading a first firmware program into a firmware loading unit of the programmable logic device, so that the programmable logic device is switched from a setting mode to a Working mode and the I2C interface writing function is locked to enable, a baseboard management controller of the server device sends a second firmware program when the programmable logic device is in working mode, and a non-volatile memory of the programmable logic device The body unit receives and stores the second firmware program through the I2C interface unit of the programmable logic device according to the enabled I2C interface write function in the working mode, and the control unit of the programmable logic device determines whether or not in the working mode Upon receiving a firmware update command from the baseboard management controller, the control unit executes a clear operation of the firmware loading unit when receiving the firmware update command, so that the programmable logic device is switched from working mode to setting mode, I2C The interface writing function is still locked in the setting mode and is not switched to off. The control unit verifies the second firmware program when receiving the firmware update command. When the second firmware program fails the verification, the server device is A warning message is output in the setting mode to indicate that the second firmware program is not loaded into the firmware loading unit.

Please refer to FIG. 1. FIG. 1 is a block diagram of an embodiment of a server device according to the present invention. The server device 1 includes a Programmable Logic Device (PLD) 11 and a baseboard management controller 13. The baseboard management controller 13 is coupled to the programmable logic device 11. The programmable logic device 11 includes an inter-integrated circuit (I2C) interface unit 111, a non-volatile memory unit 113, a firmware loading unit 114, and a control unit 115. The non-volatile memory unit 113 is coupled between the I2C interface unit 111 and the firmware loading unit 114, the control unit 115 is coupled to the non-volatile memory unit 113 and the I2C interface unit 111, and the I2C interface unit 111 is coupled to Between the baseboard management controller 13 and the non-volatile memory unit 113.

In one embodiment, the programmable logic device 11 may be a complex programmable logic device (Complex Programmable Logic Device; CPLD), and the firmware loading unit 114 may be a hardware special function for the programmable logic device 11 (hardware feature), the hardware special function includes the I2C interface writing function of the corresponding I2C interface unit 111, and the firmware loading unit 114 can be a random access memory (Random Access Memory; RAM). The non-volatile memory unit 113 may be a flash memory.

The non-volatile memory unit 113 stores the firmware program to be executed by the programmable logic device 11, and the firmware loading unit 114 stores the firmware program currently executed by the programmable logic device 11. When the programmable logic device 11 is in the boot, reset or firmware update process, the programmable logic device 11 is operating in the setting mode, the firmware loading unit 114 does not load any firmware programs, and the control unit 115 controls The firmware program is loaded from the non-volatile memory unit 113 to the firmware loading unit 114, so that the programmable logic device 11 is switched from the setting mode to the working mode. In the working mode, the programmable logic device 11 is loaded according to the firmware. Enter the firmware code loaded in the unit 114 to operate. Therefore, when the firmware program to be updated is stored in the non-volatile memory unit 113, the control unit 115 can control the firmware program to be updated to be loaded into the firmware loading unit 114, so that the programmable logic device 11 is updated according to the updated firmware program. The firmware program runs to complete the update process of the firmware program.

The firmware program stored in the non-volatile memory unit 113 can come from the I2C interface unit 111. The programmable logic device 11 has an I2C interface writing function corresponding to the I2C interface unit 111. When the programmable logic device 11 is in working mode , The firmware program loaded into the firmware loading unit 114 includes the firmware code for enabling the I2C interface writing function, so that the non-volatile memory unit 113 is in the working mode according to the enabled I2C interface writing function by The I2C interface unit 111 receives the firmware program to be updated; furthermore, when the programmable logic device 11 is in working mode, the firmware program loaded into the firmware loading unit 114 includes the lock I2C interface writing function is enabled A lock function. After the firmware program to be updated is written into the non-volatile memory unit 113, the programmable logic device 11 enters the firmware update process, and the programmable logic device 11 switches from the working mode to the setting mode. The lock function will force the I2C interface write function not to be turned off but to be continuously locked to enable. When the firmware update fails, the non-volatile memory unit 113 can be activated by the I2C interface according to the I2C interface write function in the setting mode. The interface unit 111 receives the firmware program to be updated again or receives other firmware programs.

In operation, please refer to Fig. 1 and Fig. 2 together. Fig. 2 is a flowchart of an embodiment of the method for avoiding the failure to update the firmware according to this case. The logic device 11 can be programmed after the server device 1 is powered on. In the setting mode as an example, the firmware loading unit 114 first loads the unupdated first firmware program (step S01) to switch the programmable logic device 11 from the setting mode to the working mode (step S02), and the first firmware The body program includes the aforementioned lock function that locks the I2C interface writing function to be enabled, so that the I2C interface writing function is locked after the first firmware program is loaded into the firmware loading unit 114 (step S03), and then, when the program is programmable When the logic logic device 11 is in the working mode, the baseboard management controller 13 can send the second firmware program to be updated to the I2C interface unit 111 (step S04), and the I2C interface unit 111 transmits it according to the I2C interface write function locked to the activation The second firmware program, the non-volatile memory unit 113 receives the second firmware program from the I2C interface unit 111 and stores the second firmware program (step S05).

After the second firmware program is stored in the non-volatile memory unit 113, the baseboard management controller 13 can send a firmware update command to update the first firmware program to the second firmware program, and the control unit 115 is in the programmable state In the working mode of the logic logic device 11, it is judged whether the aforementioned firmware update command is received (step S06). When the control unit 115 receives the firmware update command (the judgment result is "Yes"), the control unit 115 executes firmware loading The clearing action of the unit 114 (step S07) causes the programmable logic device 11 to switch to the setting mode (step S08), and the I2C interface writing function is still locked to be enabled in the setting mode (step S10), that is, the I2C interface writing The input function is not switched from enabled to disabled because the programmable logic device 11 switches from the working mode to the setting mode.

Furthermore, after receiving the firmware update command, the control unit 115 verifies the second firmware program stored in the non-volatile memory unit 113 to determine whether an error occurs in the second firmware program (step S11). When the second firmware program is wrong, it means that the firmware update process cannot be completed, and the control unit 115 generates a load failure signal in the setting mode of the programmable logic device 11 (step S12), so that the server device 1 outputs a sound signal And/or a warning message of the image signal, indicating that the second firmware program has not been loaded into the firmware loading unit 114, that is, the programmable logic device 11 is still in the setting mode to warn the user of the server device 1 to prohibit Remove the power of the server device 1, that is, the server device 1 immediately informs the user to prohibit the system-level restart. The user cannot restart the server device 1 by removing its plug from the socket and then plugging it back into the socket. In order to prevent the server device 1 from being turned off due to restarting/repowering on the aforementioned lock function, turning off the lock function will cause the I2C interface unit 111 to be in the default closed state and the debugger cannot update the error through the I2C interface unit 111 The problem with the second firmware program.

Based on this, in the setting mode of the programmable logic device 11, although the code of the second firmware program is wrong, the activated I2C interface unit 111 can receive the firmware program again. The designer or debugger of the server device 1 You can burn the code after debugging to the non-volatile memory unit 113 through the I2C interface unit 111 in the setting mode to repair the error of the second firmware program; or, the firmware update failed due to the second A transmission error occurred during the firmware loading process from the non-volatile memory unit 113 to the firmware loading unit 114. The designer or debugger of the server device 1 can set the second firmware program in the setting mode to reload from I2C The interface unit 111 is re-burned to the non-volatile memory unit 113, and controls the second firmware program re-burned to the non-volatile memory unit 113 to be loaded into the firmware loading unit 114. In other words, the programmable logic device 11 will not turn off the I2C interface writing function due to the operation in the setting mode, so that when the firmware update fails, the I2C interface unit 111 cannot be re-programmed to the non-volatile memory unit. 113, and the designer or debugger of the server device 1 does not need to open the case of the server device 1 to use the JTAG interface unit 112 or the SPI interface unit 116 connected to the non-volatile memory unit 113 to transfer the firmware The program is re-burned to the non-volatile memory unit 113. (Among them, FIG. 1 is only for illustration, the JTAG interface unit 112 and the SPI interface unit 116 are connected to the non-volatile memory unit 113 through six pins).

In one embodiment, the control unit 115 is implemented by a finite state machine (Finite State Machine; FSM) of a hardware circuit. For example, the control unit 115 can be an Application-specific integrated circuit (ASIC), which controls The unit 115 executes the clearing action, verification action and signal output action in steps S07, S11, S12 according to the hardware behavior predefined by the hardware description language (for example, Verilog code), that is, the control unit 115 is not executing firmware When the firmware loading unit 114 does not load any firmware program, the control unit 115 can also perform the aforementioned cleanup action, verification action and signal output action.

In one embodiment, the user of the server device 1 can control the baseboard management controller 13 at the proximal end through the management interface (console) of the baseboard management controller 13, so that the baseboard management controller 13 sends the second Firmware program. Moreover, the user can control the baseboard management controller 13 to issue a firmware update command after the second firmware program is stored in the non-volatile memory unit 113, so that the control unit 115 determines that the firmware update command is received in step S06. In other embodiments, the user of the server device 1 can also operate the remote device to connect to the network interface of the baseboard management controller 13, and control the baseboard management controller 13 to send the aforementioned second Firmware program and firmware update commands. In other embodiments, the server device 1 can also automatically detect the firmware version, that is, the baseboard management controller 13 can automatically determine that the version of the second firmware program is newer and automatically change the version of the second firmware The program is sent to the programmable logic device 11 and automatically issues a firmware update command.

In one embodiment, as shown in FIG. 1, the programmable logic device 11 further includes a general-purpose input/output pin (General-purpose input/output; GPIO) 117 coupled between the baseboard management controller 13 and the control unit 115 between. In step S12, the control unit 115 can send a loading failure signal to the baseboard management controller 13 through the GPIO pin 117 after generating the loading failure signal, and the baseboard management controller 13 can generate the aforementioned warning message according to the loading failure signal , And the audio or video output unit of the aforementioned server device 1 outputs a warning message indicating that the second firmware program is not loaded into the firmware loading unit 114, and the programmable logic device 11 is in the setting mode to alert the server device The user of 1 cannot remove the power supply of the server device 1 to avoid the problem that the server device 1 is restarted and the aforementioned lock function is invalidated and the wrong second firmware program cannot be debugged or updated.

Furthermore, after the control unit 115 sends the load failure signal to the baseboard management controller 13, the baseboard management controller 13 can resend the same firmware program to the I2C interface unit 111 or the baseboard management controller according to the aforementioned load failure signal. The controller 13 also sends other debugged firmware programs to the I2C interface unit 111 after receiving the loading failure signal (hereinafter, the firmware program sent by the baseboard management controller 13 after receiving the loading failure signal is referred to as the first Third firmware program), the non-volatile memory unit 113 receives the third firmware sent by the baseboard management controller 13 from the I2C interface unit 111 according to the enabled I2C interface write function in the setting mode of the programmable logic device 11 Program, the baseboard management controller 13 then sends another firmware update command to the control unit 115, so that the control unit 115 generates a "Yes" judgment result in step S06 and executes the subsequent step S11. If the control unit 115 is in step S11 It is determined that the second firmware program re-sent by the baseboard management controller 13 or other firmware programs after debugging has no error (the judgment result is "No"), and the control unit 115 controls the re-sent second firmware program or After debugging, other firmware programs are loaded from the non-volatile memory unit 113 to the firmware loading unit 114 (step S13), so that the programmable logic device 11 is switched from the setting mode to the working mode, and the control unit 115 can generate A loading success signal is sent to the baseboard management controller 13 via the GPIO pin 117, so that the baseboard management controller 13 knows that the updated firmware program has been loaded into the firmware loading unit 114. Therefore, after the firmware loading unit 114 loads the resent second firmware program or the debugged other firmware program, the programmable logic device 11 is based on the resent second firmware program or debugged Other firmware programs operate.

In one embodiment, the load failure signal and the load success signal may have different logic levels. For example, the load success signal may have a high level, the load failure signal may have a low level, and the baseboard management controller 13 may determine that it comes from The signal level of the GPIO pin 117 is high or low, and it is judged as a loading failure signal or a loading success signal. Accordingly, the baseboard management controller 13 can know that the programmable logic device 11 is in the setting mode or working mode, that is, the baseboard management controller 13 can determine whether the firmware program has been loaded after issuing the firmware update command. Body loading unit 114.

In summary, according to an embodiment of the method for preventing the firmware from being updated again in this case, the programmable logic device does not cause the I2C interface writing function to be disabled due to firmware programming errors and operating in the setting mode, resulting in debugging The later firmware cannot be updated to the non-volatile memory unit through the I2C interface unit, and the control unit can issue an error message to prevent the user from restarting the power of the server device and causing the I2C interface unit to restart on the server device. It is closed after startup or power-on. The designer or debugger of programmable logic device does not need to open the case cover to update the firmware program through the JTAG interface when the firmware program error occurs. The designer or debugger can still repair the firmware through the I2C interface unit The program greatly improves the flexibility and convenience of debugging the firmware of programmable logic devices. In addition, the I2C interface unit only needs two pins, and the length of the bus trace of the I2C interface unit is longer. The I2C interface unit is more capable of meeting today's demand for stability and lightness of the server than the JTAG interface and the SPI interface.

Although this case has been disclosed by the examples above, it is not intended to limit the case. Anyone with ordinary knowledge in the technical field can make some changes and modifications without departing from the spirit and scope of the case. Therefore, the scope of protection of this case The scope of the patent application attached hereafter shall prevail.

1 Server device 11 Programmable logic device 111 I2C interface unit 112 JTAG interface unit 113 Non-volatile memory unit 114 Firmware load unit 115 Control unit 116 SPI interface unit 117 GPIO pins 13 Substrate management controller S01-S08 steps S10-S13 steps

[Figure 1] is a block diagram of an embodiment of the server device according to the present invention. [Fig. 2] is a flowchart of an embodiment of the method for preventing the firmware from being unable to be updated again according to the present invention.

1 Server device 11 Programmable logic device 111 I2C interface unit 112 JTAG interface unit 113 Non-volatile memory unit 114 Firmware load unit 115 Control unit 116 SPI interface unit 117 GPIO pins 13 Substrate management controller

Claims (8)

A server device includes: a baseboard management controller; and a programmable logic device, including: a firmware loading unit for loading a first firmware program, so that the programmable logic device is controlled by a The setting mode is switched to a working mode and an I2C interface writing function of the programmable logic device is locked to enable, the first firmware program includes a code for locking the writing function of the I2C interface; an I2C interface unit, coupled The baseboard management controller is used for receiving a second firmware program from the baseboard management controller according to the I2C interface write function enabled in the working mode; a non-volatile memory unit coupled to the I2C interface Unit for receiving the second firmware program via the I2C interface unit and storing the second firmware program; a control unit coupled to the baseboard management controller, the firmware loading unit and the non-volatile memory unit , For performing a clear operation of the firmware loading unit when a firmware update command is received from the baseboard management controller in the working mode, so that the programmable logic device is switched from the working mode to the setting Mode, and the I2C interface writing function is still locked in the setting mode and is not switched to disabled, and the control unit verifies the second firmware program when the firmware update command is received. When the second firmware When the firmware fails the verification, the server device outputs a warning message in the setting mode to indicate that the second firmware program is not loaded into the firmware load unit; and A general-purpose input and output pin is coupled between the control unit and the baseboard management controller. When the second firmware program fails the verification due to an error, the control unit generates a loading failure in the setting mode The load failure signal is output to the baseboard management controller through the universal input/output pin, and the baseboard management controller generates the warning message according to the load failure signal. The server device according to claim 1, wherein the control unit is implemented by a special application integrated circuit, and the control unit executes the cleaning action and verifies the second firmware according to a hardware behavior predefined in a hardware description language Body program. The server device according to claim 1, wherein the baseboard management controller further sends a third firmware program to the I2C interface unit according to the load failure signal, and the non-volatile memory unit in the setting mode is based on The enabled I2C interface writing function receives the third firmware program through the I2C interface unit. The server device according to claim 1, wherein the warning message includes an audio message or text message that prohibits removing the power of the server device. A method for preventing the firmware from being unable to be updated again is suitable for a programmable logic device of a server device. The programmable logic device has an I2C interface writing function corresponding to a firmware writing method. The method that the body cannot be updated again includes: a firmware load unit of the programmable logic device loads a first firmware program, so that the programmable logic device is switched from a setting mode to a working mode and the I2C interface The write function is locked to enable; a baseboard management controller of the server device sends a second firmware program when the programmable logic device is in the working mode; A non-volatile memory unit of the programmable logic device receives and stores the second firmware program through an I2C interface unit of the programmable logic device according to the enabled I2C interface write function in the working mode ; A control unit of the programmable logic device determines whether a firmware update command from the baseboard management controller is received in the working mode; the control unit executes the firmware load when receiving the firmware update command A clearing action of the input unit causes the programmable logic device to switch from the working mode to the setting mode; the I2C interface writing function is still locked in the setting mode and is not switched to off; the control unit is receiving Verify the second firmware program when the firmware update command is reached; when the second firmware program fails the verification, the server device outputs a warning message in the setting mode to indicate that the second firmware program is not loaded The firmware loading unit, the control unit generates a loading failure signal in the setting mode; the control unit sends the loading failure signal to the board management through the universal input and output pins of the programmable logic device Controller; and the baseboard management controller generates the warning message according to the load failure signal. The method for preventing the firmware from being unable to be updated again as described in claim 5, wherein the control unit is implemented by a special application integrated circuit, and the control unit executes the cleaning action and verification according to the hardware behavior predefined by the hardware description language The second firmware program. The method for preventing the firmware from being unable to be updated again as described in claim 5, wherein the warning message includes an audio message or a text message that prohibits removing the power of the server device. The method described in claim 5 to prevent the firmware from being updated again includes: The baseboard management controller sends a third firmware program to the I2C interface unit according to the load failure signal; and the non-volatile memory unit is in the setting mode according to the enabled I2C interface write function through the I2C interface The unit receives and stores the third firmware program.

Images