Patent Description:
As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is information Handling Systems (IHSs). An IHS generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, IHSs may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in IHSs allow for IHSs to be general or configured for a specific user or specific use such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, IHSs may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.

Historically, the most common technique for customizing the operations of an IHS has been through software programs that are executed by the IHS. More recently, FPGA (Field Programmable Gate Array) cards are used to provide customized IHS functionality at hardware speeds, while doing so at an affordable price. FPGA cards operate based on firmware instructions. Corruption of the firmware used by an FPGA card can result in the operations of the FPGA card being compromised. <CIT> discloses a firmware upgrading method for an electronic device. The electronic device includes a storage section which stores a firmware image and a controller which executes a boot loader of the electronic device to determine whether the firmware image is damaged, performs a restoration function for the firmware image if the firmware image is damaged, and executes an operating system (OS) to perform normal operations if the firmware image is not damaged.

The invention is defined by the appended independent claims, of which claim <NUM> discloses a method for the recovery of firmware of a Field Programmable Gate Array (FPGA) card device using a security key that is generated and transferred by a remote access controller via a sideband management bus. Claim <NUM> discloses the system for said recovery including the FPGA device card, the remote access controller and their interaction, whereas claim <NUM> discloses said remote access controller within the system of claim <NUM>. Claim <NUM> discloses a computer program to cause a computer to carry out the steps of method claims <NUM> - <NUM>. The dependent claims define preferred embodiments.

The present invention(s) is/are illustrated by way of example and is/are not limited by the accompanying figures.

<FIG> is a block diagram illustrating certain components of a chassis <NUM> comprising one or more compute sleds 105a-n and one or more storage sleds 115a-n that may be configured to implement the systems and methods described herein. Chassis <NUM> may include one or more bays that each receive an individual sled (that may be additionally or alternatively referred to as a tray, blade, and/or node), such as compute sleds 105a-n and storage sleds 115a-n. Chassis <NUM> may support a variety of different numbers (e.g., <NUM>, <NUM>, <NUM>, <NUM>), sizes (e.g., single-width, double-width) and physical configurations of bays. Other embodiments may include additional types of sleds that provide various types of storage and/or processing capabilities. Other types of sleds may provide power management and networking functions. Sleds may be individually installed and removed from the chassis <NUM>, thus allowing the computing and storage capabilities of a chassis to be reconfigured by swapping the sleds with different types of sleds, in many cases without affecting the operations of the other sleds installed in the chassis <NUM>.

Multiple chassis <NUM> may be housed within a rack. Data centers may utilize large numbers of racks, with various different types of chassis installed in the various configurations of racks. The modular architecture provided by the sleds, chassis and rack allow for certain resources, such as cooling, power and network bandwidth, to be shared by the compute sleds 105a-n and storage sleds 115a-n, thus providing efficiency improvements and supporting greater computational loads.

Chassis <NUM> may be installed within a rack structure that provides all or part of the cooling utilized by chassis <NUM>. For airflow cooling, a rack may include one or more banks of cooling fans that may be operated to ventilate heated air from within the chassis <NUM> that is housed within the rack. The chassis <NUM> may alternatively or additionally include one or more cooling fans <NUM> that may be similarly operated to ventilate heated air from within the sleds 105a-n, 115a-n installed within the chassis. A rack and a chassis <NUM> installed within the rack may utilize various configurations and combinations of cooling fans to cool the sleds 105a-n, 115a-n and other components housed within chassis <NUM>.

The sleds 105a-n, 115a-n may be individually coupled to chassis <NUM> via connectors that correspond to the bays provided by the chassis <NUM> and that physically and electrically couple an individual sled to a backplane <NUM>. Chassis backplane <NUM> may be a printed circuit board that includes electrical traces and connectors that are configured to route signals between the various components of chassis <NUM> that are connected to the backplane <NUM>. In various embodiments, backplane <NUM> may include various additional components, such as cables, wires, midplanes, backplanes, connectors, expansion slots, and multiplexers. In certain embodiments, backplane <NUM> may be a motherboard that includes various electronic components installed thereon. Such components installed on a motherboard backplane <NUM> may include components that implement all or part of the functions described with regard to the SAS (Serial Attached SCSI) expander <NUM>, I/O controllers <NUM>, network controller <NUM> and power supply unit <NUM>.

In certain embodiments, a compute sled 105a-n may be an IHS such as described with regard to IHS <NUM> of <FIG>. A compute sled 105a-n may provide computational processing resources that may be used to support a variety of e-commerce, multimedia, business and scientific computing applications, such as services provided via a cloud implementation. Compute sleds 105a-n are typically configured with hardware and software that provide leading-edge computational capabilities. Accordingly, services provided using such computing capabilities are typically provided as high-availability systems that operate with minimum downtime. As described in additional detail with regard to <FIG>, compute sleds 105a-n may be configured for general-purpose computing or may be optimized for specific computing tasks.

As illustrated, each compute sled 105a-n includes a remote access controller (RAC) 110a-n. As described in additional detail with regard to <FIG>, remote access controller 110a-n provides capabilities for remote monitoring and management of compute sled 105a-n. In support of these monitoring and management functions, remote access controllers 110a-n may utilize both in-band and sideband (i.e., out-of-band) communications with various components of a compute sled 105a-n and chassis <NUM>. Remote access controller 110a-n may collect sensor data, such as temperature sensor readings, from components of the chassis <NUM> in support of airflow cooling of the chassis <NUM> and the sleds 105a-n, 115a-n. In addition, each remote access controller 110a-n may implement various monitoring and administrative functions related to compute sleds 105a-n that require sideband bus connections with various internal components of the respective compute sleds 105a-n.

As illustrated, chassis <NUM> also includes one or more storage sleds 115a-n that are coupled to the backplane <NUM> and installed within one or more bays of chassis <NUM> in a similar manner to compute sleds 105a-n. Each of the individual storage sleds 115a-n may include various different numbers and types of storage devices. For instance, storage sleds 115a-n may include SAS (Serial Attached SCSI) magnetic disk drives, SATA (Serial Advanced Technology Attachment) magnetic disk drives, solid-state drives (SSDs) and other types of storage drives in various combinations. The storage sleds 115a-n may be utilized in various storage configurations by the compute sleds 105a-n that are coupled to chassis <NUM>.

Each of the compute sleds 105a-n includes a storage controller 135a-n that may be utilized to access storage drives that are accessible via chassis <NUM>. Some of the individual storage controllers 135a-n may provide support for RAID (Redundant Array of Independent Disks) configurations of logical and physical storage drives, such as storage drives provided by storage sleds 115a-n. In some embodiments, some or all of the individual storage controllers 135a-n may be HBAs (Host Bus Adapters) that provide more limited capabilities in accessing physical storage drives provided via storage sleds 115a-n and/or via SAS expander <NUM>.

As illustrated, each of the compute sleds 105a-n also includes an FPGA card 160a-n that may be configured to customize the operations of compute sled 105a-n. As described in additional detail with regard to <FIG> and <FIG>, FPGA cards 160a-n may operate using firmware instructions that may be corrupted, thus rending an FPG card inoperable and potentially exposing the compute sleds 105a-n and the entire chassis <NUM> to security vulnerabilities. In various embodiments, remote access controllers 110a-n may be configured to monitor the firmware in use by an FPGA card and, in response to detecting a discrepancy in the firmware in use by the FPGA, replacing the firmware of an FPGA card with a master copy held by the remote access controller.

In addition to the data storage capabilities provided by storage sleds 115a-n, chassis <NUM> may provide access to other storage resources that may be installed components of chassis <NUM> and/or may be installed elsewhere within a rack housing the chassis <NUM>, such as within a storage blade. In certain scenarios, such storage resources <NUM> may be accessed via a SAS expander <NUM> that is coupled to the backplane <NUM> of the chassis <NUM>. The SAS expander <NUM> may support connections to a number of JBOD (Just a Bunch Of Disks) storage drives <NUM> that may be configured and managed individually and without implementing data redundancy across the various drives <NUM>. The additional storage resources <NUM> may also be at various other locations within a datacenter in which chassis <NUM> is installed. Such additional storage resources <NUM> may also be remotely located.

As illustrated, the chassis <NUM> of <FIG> includes a network controller <NUM> that provides network access to the sleds 105a-n, 115a-n installed within the chassis. Network controller <NUM> may include various switches, adapters, controllers and couplings used to connect chassis <NUM> to a network, either directly or via additional networking components and connections provided via a rack in which chassis <NUM> is installed. Chassis <NUM> may similarly include a power supply unit <NUM> that provides the components of the chassis with various levels of DC power from an AC power source or from power delivered via a power system provided by a rack within which chassis <NUM> may be installed. In certain embodiments, power supply unit <NUM> may be implemented within a sled that may provide chassis <NUM> with redundant, hot-swappable power supply units.

Chassis <NUM> may also include various I/O controllers <NUM> that may support various I/O ports, such as USB ports that may be used to support keyboard and mouse inputs and/or video display capabilities. Such I/O controllers <NUM> may be utilized by the chassis management controller <NUM> to support various KVM (Keyboard, Video and Mouse) 125a capabilities that provide administrators with the ability to interface with the chassis <NUM>. The chassis management controller <NUM> may also include a storage module 125c that provides capabilities for managing and configuring certain aspects of the storage devices of chassis <NUM>, such as the storage devices provided within storage sleds 115a-n and within the JBOD <NUM>.

In addition to providing support for KVM 125a capabilities for administering chassis <NUM>, chassis management controller <NUM> may support various additional functions for sharing the infrastructure resources of chassis <NUM>. In some scenarios, chassis management controller <NUM> may implement tools for managing the power <NUM>, network bandwidth <NUM> and airflow cooling <NUM> that are available via the chassis <NUM>. As described, the airflow cooling <NUM> utilized by chassis <NUM> may include an airflow cooling system that is provided by a rack in which the chassis <NUM> may be installed and managed by a cooling module 125b of the chassis management controller <NUM>.

For purposes of this disclosure, an IHS may include any instrumentality or aggregate of instrumentalities operable to compute, calculate, determine, classify, process, transmit, receive, retrieve, originate, switch, store, display, communicate, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, or other purposes. For example, an IHS may be a personal computer (e.g., desktop or laptop), tablet computer, mobile device (e.g., Personal Digital Assistant (PDA) or smart phone), server (e.g., blade server or rack server), a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. An IHS may include Random Access Memory (RAM), one or more processing resources such as a Central Processing Unit (CPU) or hardware or software control logic, Read-Only Memory (ROM), and/or other types of nonvolatile memory. Additional components of an IHS may include one or more disk drives, one or more network ports for communicating with external devices as well as various I/O devices, such as a keyboard, a mouse, touchscreen, and/or a video display. As described, an IHS may also include one or more buses operable to transmit communications between the various hardware components. An example of an IHS is described in more detail below.

<FIG> shows an example of an IHS <NUM> configured to implement systems and methods described herein. It should be appreciated that although the embodiments described herein may describe an IHS that is a compute sled or similar computing component that may be deployed within the bays of a chassis, other embodiments may be utilized with other types of IHSs. In the illustrative embodiment of <FIG>, IHS <NUM> may be a computing component, such as compute sled 105a-n, that is configured to share infrastructure resources provided by a chassis <NUM>.

The IHS <NUM> of <FIG> may be a compute sled, such as compute sleds 105a-n of <FIG>, that may be installed within a chassis, that may in turn be installed within a rack. Installed in this manner, IHS <NUM> may utilized shared power, network and cooling resources provided by the chassis and/or rack. IHS <NUM> may utilize one or more processors <NUM>. In some embodiments, processors <NUM> may include a main processor and a co-processor, each of which may include a plurality of processing cores that, in certain scenarios, may each be used to run an instance of a server process. In certain embodiments, one or all of processor(s) <NUM> may be graphics processing units (GPUs) in scenarios where IHS <NUM> has been configured to support functions such as multimedia services and graphics applications.

As illustrated, processor(s) <NUM> includes an integrated memory controller 205a that may be implemented directly within the circuitry of the processor <NUM>, or the memory controller 205a may be a separate integrated circuit that is located on the same die as the processor <NUM>. The memory controller 205a may be configured to manage the transfer of data to and from the system memory <NUM> of the IHS <NUM> via a high-speed memory interface 205b.

The system memory <NUM> is coupled to processor(s) <NUM> via a memory bus 205b that provides the processor(s) <NUM> with high-speed memory used in the execution of computer program instructions by the processor(s) <NUM>. Accordingly, system memory <NUM> may include memory components, such as such as static RAM (SRAM), dynamic RAM (DRAM), NAND Flash memory, suitable for supporting high-speed memory operations by the processor(s) <NUM>. In certain embodiments, system memory <NUM> may combine both persistent, non-volatile memory and volatile memory.

In certain embodiments, the system memory <NUM> may be comprised of multiple removable memory modules. The system memory <NUM> of the illustrated embodiment includes removable memory modules 210a-n. Each of the removable memory modules 210a-n may correspond to a printed circuit board memory socket that receives a removable memory module 210a-n, such as a DIMM (Dual In-line Memory Module), that can be coupled to the socket and then decoupled from the socket as needed, such as to upgrade memory capabilities or to replace faulty components. Other embodiments of IHS system memory <NUM> may be configured with memory socket interfaces that correspond to different types of removable memory module form factors, such as a Dual In-line Package (DIP) memory, a Single In-line Pin Package (SIPP) memory, a Single In-line Memory Module (SIMM), and/or a Ball Grid Array (BGA) memory.

IHS <NUM> may utilize a chipset that may be implemented by integrated circuits that are connected to each processor <NUM>. All or portions of the chipset may be implemented directly within the integrated circuitry of an individual processor <NUM>. The chipset may provide the processor(s) <NUM> with access to a variety of resources accessible via one or more buses <NUM>. Various embodiments may utilize any number of buses to provide the illustrated pathways served by bus <NUM>. In certain embodiments, bus <NUM> may include a PCIe (PCI Express) switch fabric that is accessed via a PCIe root complex. IHS <NUM> may also include one or more I/O ports <NUM>, such as PCIe ports, that may be used to couple the IHS <NUM> directly to other IHSs, storage resources or other peripheral components.

As illustrated, a variety of resources may be coupled to the processor(s) <NUM> of the IHS <NUM> via bus <NUM>. For instance, processor(s) <NUM> may be coupled to a network controller <NUM>, such as provided by a Network Interface Controller (NIC) that is coupled to the IHS <NUM> and allows the IHS <NUM> to communicate via an external network, such as the Internet or a LAN. Processor(s) <NUM> may also be coupled to a power management unit <NUM> that may interface with the power system unit <NUM> of the chassis <NUM> in which an IHS, such as a compute sled, may be installed. In certain embodiments, a graphics processor <NUM> may be comprised within one or more video or graphics cards, or an embedded controller, installed as components of the IHS <NUM>. In certain embodiments, graphics processor <NUM> may be an integrated of the remote access controller <NUM> and may be utilized to support the display of diagnostic and administrative interfaces related to IHS <NUM> via display devices that are coupled, either directly or remotely, to remote access controller <NUM>.

As illustrated, IHS <NUM> may include one or more FPGA (Field-Programmable Gate Array) card(s) <NUM>. Each of the FPGA card <NUM> supported by IHS <NUM> may include various processing and memory resources, in addition to an FPGA integrated circuit that may be reconfigured after deployment of IHS <NUM> through programming functions supported by the FPGA card <NUM>. Each individual FGPA card <NUM> may be optimized to perform specific processing tasks, such as specific signal processing, security, data mining, and artificial intelligence functions, and/or to support specific hardware coupled to IHS <NUM>.

As illustrated, an FPGA card <NUM> may include an FPGA integrated circuit 220b that may be reprogrammed in order to modify the internal circuitry of the FPGA 220b, thus modifying the operations performed by the FPGA card <NUM>. In certain embodiments, the operations of the FPGA circuit 220b may be based on firmware 220c instructions stored in a non-volatile memory of the FPGA card <NUM>. The firmware 220c may implement various aspects of the operation of the FPGA circuit 220b, such as initialization procedures, implementing security protocols and configuring input and output capabilities. In some scenarios, the firmware 220c may include bitstreams used in configuring the internal structure of the FPGA circuitry 220b. Accordingly, corruption of the firmware 220c may result in operations of the FPGA 220b being compromised. In certain instances, the corruption of the firmware 220c may render the FPGA 220b inoperable.

As illustrated, the firmware 220c of the FPGA 220b may be stored within an active partition 220d and a recovery partition 220e. The FPGA 220b may be configured to operate using the firmware instructions stored in the active partition 220d. In certain instances, the recovery partition 220e may include an identical version of the firmware instructions stored in the active partition 220d. However, in many instances, the recovery partition 220e may only be used to store prior versions of the firmware instructions in order to support rollback capabilities. In many instances, the storage space afforded to the recovery partition 220e may not accommodate both a backup copy of the active partition 220d and a prior version of the firmware to which to revert in support of a rollback operation.

In conventional scenarios, an FPGA may be configured to replace corrupted firmware in an active partition with the firmware stored in a recovery partition. In such scenarios, the firmware stored in the recovery partition may be used to reinitialize the FPGA, but only after FPGA has been reconfigured as a bus endpoint, now configured using the recovery partition firmware. This process of reconfiguring the FPGA on the device management bus results in a delay and may can trigger bus deadlocks that can have cascading effects. As described, in many scenarios, firmware stored in the recovery partition may not be identical to the firmware in an active partition. In such cases, the recovery partition firmware may expose the FPGA to security vulnerabilities that were addressed by the newer version of the firmware in the active partition. In such scenarios, reverting to use of the recovery partition firmware may result in the operations of the FPGA being subject to misuse by a malicious actor. As described in additional detail with regard to the below embodiments, the remote access controller <NUM> may be configured to detect corruption of the active firmware 220d of the FPGA 220b and to replace the corrupted firmware without reliance on the recovery firmware partition 220e of the FPGA card.

As illustrated, the FPGA card <NUM> includes a management controller 220a that supports interoperation with the remote access controller <NUM> via a sideband device management bus 275a. As described in additional detail with regard to the below embodiments, the management controller 220a is configured to interoperate with the remote access controller <NUM> in detecting the use of corrupted firmware by the FPGA card <NUM> and in replacing the corrupted firmware with a master copy of the FPGA card firmware maintained by the remote access controller <NUM>. In certain embodiments, the management controller 220a may be configured to detect any changes to the firmware 220d-e of the FPGA card.

Upon detecting such changes, the management controller 220a transmits a copy the firmware 220d-e to the remote access controller <NUM> for use in maintaining a master copy of the firmware. In certain embodiments, the remote access controller <NUM> may be configured to verity the authenticity of the received firmware before accepting it as the master copy. In certain embodiment, the remote access controller <NUM> may authenticate firmware based on checksum calculations. In certain embodiments, the remote access controller <NUM> may authenticate received firmware via a remote service that can verify the integrity and source of firmware.

In certain embodiments, IHS <NUM> may operate using a BIOS (Basic Input/Output System) that may be stored in a non-volatile memory accessible by the processor(s) <NUM>. The BIOS may provide an abstraction layer by which the operating system of the IHS <NUM> interfaces with the hardware components of the IHS. Upon powering or restarting IHS <NUM>, processor(s) <NUM> may utilize BIOS instructions to initialize and test hardware components coupled to the IHS, including both components permanently installed as components of the motherboard of IHS <NUM> and removable components installed within various expansion slots supported by the IHS <NUM>. The BIOS instructions may also load an operating system for use by the IHS <NUM>. In certain embodiments, IHS <NUM> may utilize Unified Extensible Firmware Interface (UEFI) in addition to or instead of a BIOS. In certain embodiments, the functions provided by a BIOS may be implemented, in full or in part, by the remote access controller <NUM>.

In certain embodiments, remote access controller <NUM> may operate from a different power plane from the processors <NUM> and other components of IHS <NUM>, thus allowing the remote access controller <NUM> to operate, and management tasks to proceed, while the processing cores of IHS <NUM> are powered off. As described, various functions provided by the BIOS, including launching the operating system of the IHS <NUM>, may be implemented by the remote access controller <NUM>. In some embodiments, the remote access controller <NUM> may perform various functions to verify the integrity of the IHS <NUM> and its hardware components prior to initialization of the IHS <NUM> (i.e., in a bare-metal state).

Remote access controller <NUM> may include a service processor 255a, or specialized microcontroller, that operates management software that supports remote monitoring and administration of IHS <NUM>. Remote access controller <NUM> may be installed on the motherboard of IHS <NUM> or may be coupled to IHS <NUM> via an expansion slot provided by the motherboard. In support of remote monitoring functions, network adapter 225c may support connections with remote access controller <NUM> using wired and/or wireless network connections via a variety of network technologies. As a non-limiting example of a remote access controller, the integrated Dell Remote Access Controller (iDRAC) from Dell® is embedded within Dell PowerEdge™ servers and provides functionality that helps information technology (IT) administrators deploy, update, monitor, and maintain servers remotely.

In some embodiments, remote access controller <NUM> may support monitoring and administration of various managed devices <NUM>, <NUM>, <NUM>, <NUM> of an IHS via a sideband bus interface. For instance, messages utilized in device management may be transmitted using I2C sideband bus connections 275a-d that may be individually established with each of the respective managed devices <NUM>, <NUM>, <NUM>, <NUM> through the operation of an I2C multiplexer 255d of the remote access controller. As illustrated, certain of the managed devices of IHS <NUM>, such as FPGA cards <NUM>, network controller <NUM> and storage controller <NUM>, are coupled to the IHS processor(s) <NUM> via an in-line bus <NUM>, such as a PCIe root complex, that is separate from the I2C sideband bus connections 275a-d used for device management. The management functions of the remote access controller <NUM> may utilize information collected by various managed sensors <NUM> located within the IHS. For instance, temperature data collected by sensors <NUM> may be utilized by the remote access controller <NUM> in support of closed-loop airflow cooling of the IHS <NUM>.

In certain embodiments, the service processor 255a of remote access controller <NUM> may rely on an I2C co-processor 255b to implement sideband I2C communications between the remote access controller <NUM> and managed components <NUM>, <NUM>, <NUM>, <NUM> of the IHS. The I2C co-processor 255b may be a specialized co-processor or micro-controller that is configured to interface via a sideband I2C bus interface with the managed hardware components <NUM>, <NUM>, <NUM>, <NUM> of IHS. In some embodiments, the I2C co-processor 255b may be an integrated component of the service processor 255a, such as a peripheral system-on-chip feature that may be provided by the service processor 255a. Each I2C bus 275a-d is illustrated as single line in <FIG>. However, each I2C bus 275a-d may be comprised of a clock line and data line that couple the remote access controller <NUM> to I2C endpoints 220a, 225a, 230a, 280a which may be designated as modular field replaceable units (FRUs).

As illustrated, the I2C co-processor 255b may interface with the individual managed devices <NUM>, <NUM>, <NUM>, <NUM> via individual sideband I2C buses 275a-d selected through the operation of an I2C multiplexer 255d. Via switching operations by the I2C multiplexer 255d, a sideband bus connection 275a-d may be established by a direct coupling between the I2C co-processor 255b and an individual managed device <NUM>, <NUM>, <NUM>, <NUM>.

In providing sideband management capabilities, the I2C co-processor 255b may each interoperate with corresponding endpoint I2C controllers 220a, 225a, 230a, 280a that implement the I2C communications of the respective managed devices <NUM>, <NUM>, <NUM>. The endpoint I2C controllers 220a, 225a, 230a, 280a may be implemented as a dedicated microcontroller for communicating sideband I2C messages with the remote access controller <NUM>, or endpoint I2C controllers 220a, 225a, 230a, 280a may be integrated SoC functions of a processor of the respective managed device endpoints <NUM>, <NUM>, <NUM>, <NUM>. In certain embodiments, the endpoint I2C controller 280a of the FPGA card <NUM> may correspond to the management controller 220a described above.

In various embodiments, an IHS <NUM> does not include each of the components shown in <FIG>. In various embodiments, an IHS <NUM> may include various additional components in addition to those that are shown in <FIG>. Furthermore, some components that are represented as separate components in <FIG> may in certain embodiments instead be integrated with other components. For example, in certain embodiments, all or a portion of the functionality provided by the illustrated components may instead be provided by components integrated into the one or more processor(s) <NUM> as a systems-on-a-chip.

<FIG> is a flowchart describing certain steps of a method, according to some embodiments, for recovery of FPGA card firmware via a sideband management bus. As described with regard to <FIG>, an FPGA card may be installed as a component of an IHS that is managed by a remote access controller via a sideband management bus. The illustrated embodiment begins at block <NUM> with the installation of an FPGA card as a component of the IHS such that the FPGA card is coupled via a sideband management bus to a remote access controller of the IHS.

Upon detecting the installed FPGA card, at block <NUM>, the service processor of the remote access controller generates a unique security key for the detected FPGA card. At block <NUM>, the security key is stored in a secured storage of the remote access controller, and a copy is transmitted to the FPGA card, where it may be maintained in a secure storage of the FPGA card management controller. In addition to this initialization process, the FPGA card may commence operations according to the firmware instructions stored within an active firmware partition, such as described above. In certain embodiments, upon the initial booting of the FPGA card, a copy of the current active and/or recovery partition firmware may be provided to the remote access controller, where the firmware may be stored as a master copy for use in replacement of corrupted FPGA card firmware. The FPGA card management controller may similarly provide a copy of the FPGA firmware, active and/or recovery, to the remote management controller upon detecting any modification to the firmware of the FPGA card. The FPGA card may commence operations until, at block <NUM>, the FPGA card and/or the IHS in which the FPGA card is installed are rebooted.

During initialization of the IHS and/or the FPGA card, the service processor of the remote access controller may issue a request, at block <NUM>, to the FPGA card via the sideband management bus for FPGA card to report the current version of the active partition firmware in use by the FPGA. As described with regard to <FIG>, the remote access controller may be configured to control various BIOS functions, such as booting the operating system of the IHS and initializing various components of the IHS. Accordingly, in certain embodiments, the remote access controller may be configured to pause the initialization of the FPGA card and/or the IHS until the process of <FIG> for recovery of corrupted FPGA card firmware has been completed.

While initialization remains paused, the request for firmware version information is received by the FPGA card, and at block <NUM>, the FPGA card generates a response that specifies the version of the firmware currently stored in the active firmware partition. In certain embodiments, the response to the firmware identification request may include a copy of the firmware, or of a portion of the firmware, that includes a header that specifies a version of the firmware. In certain embodiments, the FPGA card management controller may include in the firmware version response one or more hash values calculated based on the firmware instructions of the active and/or recovery partitions. In certain embodiments, the FPGA card may utilize the security key received from the remote access controller at block <NUM> to digitally sign the firmware version response. The signed response may then be transmitted to the remote access controller by the FPGA card management controller via the sideband management bus.

At block <NUM>, the service processor authenticates the response from the FPGA card. In certain embodiments, the service processor may authenticate the response by determining whether it has been digitally signed using the security key generated for the FPGA card at block <NUM>. If the response from the FPGA card cannot be authenticated by the service processor, at block <NUM>, the initialization of the FPGA card may be halted since the active firmware of the FPGA card is presumably corrupted. In certain scenarios, the initialization of the IHS may be allowed to resume without initialization of the FPGA card.

If the response from the FPGA card is properly authenticated, at block <NUM>, the service processor determines whether the firmware reported by the FPGA card matches the master copy of the firmware stored by the remote access controller. In embodiments where the response includes a firmware header, the version specified in the provided header is compared against firmware header information maintained in the master copy by the remote access controller. In certain embodiments, the integrity of the FPGA firmware may be determined based on comparison of hash values provided in the response against hash values calculated by the remote access controller based on the master copy of the firmware. If the firmware reported by the FPGA card matches the master copy of the firmware, initialization of the FPGA card and/or IHS resumes and the FPGA card operates using the firmware in the active partition.

If, at block <NUM>, the service processor detects a difference between the master copy of the firmware and the firmware reported by the FPGA card, at block <NUM>, the service processor suspends initialization of the FPGA card and/or the IHS. In such scenarios, the firmware is presumably corrupted. Accordingly, at block <NUM>, the service processor replaces the firmware stored in the active and recovery partitions of the FPGA card with the master copy version of the firmware stored by the remote access controller. Upon replacing the firmware, the booting of the FPGA card and/or IHS resumes using the master version of the firmware that is now stored in the active firmware partition of the FPGA card. As illustrated, upon booting, the process returns to block <NUM> where the service processor generates a new security key for the FPGA card, which is distributed to the FPGA card and used to digitally sign future firmware version responses.

It should be understood that various operations described herein may be implemented in software executed by logic or processing circuitry, hardware, or a combination thereof. The order in which each operation of a given method is performed may be changed, and various operations may be added, reordered, combined, omitted, modified, etc. It is intended that the invention(s) described herein embrace all such modifications and changes and, accordingly, the above description should be regarded in an illustrative rather than a restrictive sense. The dependent claims define preferred embodiments.

Although the invention(s) is/are described herein with reference to specific embodiments, various modifications and changes can be made without departing from the scope of the present invention(s), as set forth in the claims below. Accordingly, the specification and figures are to be regarded in an illustrative rather than a restrictive sense, and all such modifications are intended to be included within the scope of the present invention(s).

Claim 1:
A method for recovery of firmware of a device (<NUM>) installed within an Information Handling System (<NUM>), IHS (<NUM>), wherein the device (<NUM>) is a Field Programmable Gate Array, FPGA, card, the method comprising:
generating (<NUM>), by a remote access controller (<NUM>) installed within the IHS (<NUM>), a security key for the device (<NUM>), wherein the remote access controller (<NUM>) is coupled to the device (<NUM>) via a sideband management bus (275a) that provides a signalling pathway within the IHS between the remote access controller (<NUM>) and the device (<NUM>), and wherein the remote access controller (<NUM>) stores a master copy of the firmware of the device (<NUM>),
storing (<NUM>), by the remote access controller (<NUM>), a copy of the security key in a secure memory of the remote access controller (<NUM>);
transmitting (<NUM>), by the remote access controller (<NUM>) via the sideband management bus (275a), the security key to the device (<NUM>);
upon rebooting (<NUM>) of the device (<NUM>) and/or the IHS (<NUM>), requesting (<NUM>), by the remote access controller (<NUM>) via the sideband management bus (275a), the device (<NUM>) to report a version of firmware in use by the device (<NUM>);
authenticating (<NUM>), by the remote access controller (<NUM>), a firmware version response from the device (<NUM>) based on the copy of the security key stored in the secure memory of the remote access controller (<NUM>);
determining (<NUM>), by the remote access controller (<NUM>), if a version of the master copy of the firmware is consistent with the firmware version reported by the device (<NUM>); and
if the reported firmware version is inconsistent with the version of the master copy of the firmware:
halting (<NUM>), by the remote access controller (<NUM>), a booting operation of the device (<NUM>) and/or the IHS (<NUM>);
replacing (<NUM>), by the remote access controller (<NUM>), the firmware of the device (<NUM>) with the master copy of the firmware, causing the device (<NUM>) and/or the IHS (<NUM>) to resume (<NUM>) the booting operation using the updated firmware.