Brushing method for flashing Bootloader software

Abstract

The invention belongs to the technical field of program updating, and particularly relates to a method for flashing Bootloader software, which comprises the following steps of: judging the validity of an application program by an operation starting manager, judging the validity of a programming mark if the application program is valid, and skipping to the operation of the application program if the programming mark is invalid; flashing the software of the second version of the boot loader and the effective copy mark into the flash area, and resetting the micro-control unit; the application program judges whether the copy effective mark is effective or not, if yes, the software of the second-version boot loader is copied to the position where the software of the first-version boot loader is located, after copying is completed, the copy effective mark is removed, and the software of the second-version boot loader is copied. And starting a memory protection unit preset by the micro-control unit to perform write access protection of all memories except for using the EEPROM, and enabling the application program to wait for other tasks. According to the method, the problem that the brick is damaged due to power failure when the power failure occurs in the process of flashing the Bootloader by running the APP is solved.

Description

Technical Field

[0001] This invention belongs to the field of program update technology, specifically relating to a method for flashing Bootloader software. Background Technology

[0002] In embedded operating systems, the bootloader runs before the operating system kernel. It initializes hardware devices and establishes a memory space mapping, thus bringing the system's hardware and software environment to a suitable state to prepare the correct environment for the final call to the operating system kernel. In other words, the bootloader is responsible for loading and starting the entire system.

[0003] When developing a bootloader, it's necessary to meet the needs of app software updates and upgrades, as well as the different software upgrade specifications of various OEMs. Therefore, the bootloader itself also needs to have update and upgrade capabilities. One approach to bootloader self-update technology is to use a dedicated bootloader to switch to the controller (CB). This approach wastes flash space or has a high memory footprint. Another approach is to run the bootloader in RAM and then update its own flash area. This approach cannot be interrupted by power during the update process; if power is lost, the controller will become unusable and require replacement. Summary of the Invention

[0004] This invention addresses the technical problems of existing Bootloader self-update technologies, such as the occupation of flash space or the risk of damage during updates, and aims to provide a method for flashing Bootloader software.

[0005] To address the aforementioned technical problems, this invention provides a method for flashing Bootloader software, the method comprising:

[0006] After the microcontroller unit (MCU chip) starts up, the boot manager is run to determine the validity of the application (APP). If the application is invalid, it stays in the first version bootloader (Bootloader0) and waits for the flashing task. If the application is valid, the validity of the programming flag is determined. If the programming flag is valid, it stays in the first version bootloader and waits for the flashing task. If the programming flag is invalid, it jumps to run the application.

[0007] The software, copy validity flag, and application of the second version bootloader (Bootloader1) are flashed into the flash area of ​​the microcontroller. After the flashing is completed, the microcontroller is reset.

[0008] The application has a main task. After the application is launched, it determines whether the copy validity flag is valid. If it is invalid, the application waits for other tasks. If it is valid, it copies the software of the second version bootloader in the flash to the location of the software of the first version bootloader. After the copy is completed, it clears the copy validity flag and starts the memory protection unit (MPU) preset by the microcontroller to protect all memory write access except for EEPROM. The application then waits for other tasks.

[0009] Optionally, in the flashing method for flashing the Bootloader software as described above, the microcontroller unit is a microcontroller unit that does not have AB partitioning, does not have flash operation unlocking operation, and meets the boot time requirement.

[0010] Optionally, in the flashing method for flashing the Bootloader software as described above, copying the software of the second version of the bootloader in the flash to the location of the software of the first version of the bootloader includes:

[0011] The application uses a preset Flash erase / write driver to first erase the software of the first version of the bootloader and then write the software of the second version of the bootloader.

[0012] Optionally, in the flashing method for flashing the Bootloader software as described above, when the software of the second version of the bootloader and the copy validity flag are flashed to the flash area of ​​the microcontroller, the version information is also flashed to the flash area of ​​the microcontroller.

[0013] The application determines whether the version information of the second version of the bootloader is greater than the version information of the first version of the bootloader. If it is less, the application clears the copy valid flag and waits for other tasks. If it is greater, when the copy valid flag is valid, the application copies the software of the second version of the bootloader and the version information in the flash to the location of the software of the first version of the bootloader. After the copy is completed, the version information of the bootloader is updated.

[0014] Optionally, in the flashing method for flashing the Bootloader software as described above, before copying the software of the second version of the bootloader in the flash to the location of the software of the first version of the bootloader, the application also performs a compatibility judgment. If the second version of the bootloader determines that it is incompatible, then after clearing the copy valid flag, the application waits for other tasks. If the second version of the bootloader determines that it is compatible, then the application copies the software of the second version of the bootloader in the flash to the location of the software of the first version of the bootloader.

[0015] Optionally, in the flashing method for flashing the Bootloader software as described above, when the software of the second version of the bootloader and the copy validity flag are flashed to the flash area of ​​the microcontroller, the version information is also flashed to the flash area of ​​the microcontroller.

[0016] The application also performs a compatibility check. If the second version of the bootloader is determined to be incompatible, the application clears the copy validity flag and waits for other tasks. If the second version of the bootloader is determined to be compatible, the application checks whether the version information of the second version of the bootloader is greater than the version information of the first version of the bootloader. If it is less, the application clears the copy validity flag and waits for other tasks. If it is greater, when the copy validity flag is valid, the application copies the software of the second version of the bootloader and the version information in the flash to the location of the software of the first version of the bootloader. After the copy is completed, the version information of the bootloader is updated.

[0017] Optionally, in the flashing method for flashing the Bootloader software as described above, when the software of the second version of the bootloader and the copy validity flag are flashed to the flash area of ​​the microcontroller, the checksum is also flashed to the flash area of ​​the microcontroller.

[0018] After the application copies the software of the second version of the bootloader in the flash to the location of the software of the first version of the bootloader, it also performs a verification on the second version of the bootloader using a preset verification method and compares the verification result with the checksum. If the comparison is correct, the copying is complete. If the comparison is incorrect, the application copies the software of the second version of the bootloader in the flash to the location of the software of the first version of the bootloader again and performs the verification and comparison again until the comparison is correct.

[0019] Optionally, in the flashing method for flashing the Bootloader software as described above, if the preset verification comparison is incorrect, the verification comparison is stopped and a diagnostic fault code is set.

[0020] Optionally, in the flashing method for flashing the Bootloader software as described above, the application also has a diagnostic task. After the application is switched to run, the application simultaneously performs the diagnostic task:

[0021] Determine whether there is a flash request or reset request sent by the host computer. If not, the application waits for other tasks. If it is, determine whether the second version bootloader has been flashed into the flash area. If it has been flashed, the diagnostic result of executing the flash request or reset request is fed back to the host computer and waits for other tasks. If it has not been flashed, the diagnostic result of the negative response is fed back to the host computer and the process jumps to the step of running the startup manager to determine the validity of the application.

[0022] The positive and progressive effects of this invention are as follows:

[0023] 1. This invention does not affect the MCU startup time, and if the MCU is reset or powered on again during the process of running the APP to flash the Bootloader, the Bootloader copying function will be performed again. After the copying is completed, the MCU's memory protection unit will be directly activated to perform memory write protection.

[0024] 2. The process of flashing the Bootloader for the APP is done silently in the background so as not to affect the normal operation of the APP on the MCU. Attached Figure Description

[0025] The disclosure of this invention will become more apparent from the accompanying drawings. It should be understood that these drawings are for illustrative purposes only and are not intended to limit the scope of protection of this invention. In the drawings:

[0026] Figure 1 This is a schematic diagram of a process according to the present invention. Detailed Implementation

[0027] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention.

[0028] It should be noted that, unless otherwise specified, the following embodiments and features can be combined with each other.

[0029] In the description of this invention, it should be noted that the directional terms such as "outer side", "middle section", "inner", "outer" indicate the orientation and positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. They should not be construed as limiting the specific protection scope of this invention.

[0030] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features. Thus, the use of "first" and "second" to define a feature may explicitly or implicitly include one or more of that feature. In the description of this invention, "several" or "a number" means two or more, unless otherwise explicitly specified.

[0031] Reference Figure 1 This invention provides a method for flashing Bootloader software, which includes the following specific steps:

[0032] S1, Pre-flash judgment: After the microcontroller unit (MCU chip) is started, the boot manager (BootManager / Boot management) is run to judge the validity of the application (APP). If the application is invalid, it stays in the first version bootloader (Bootloader0) and waits for the flashing task. If the application is valid, the validity of the programming flag is judged. If the programming flag is valid, it stays in the first version bootloader and waits for the flashing task. If the programming flag is invalid, it jumps to the application to run.

[0033] In this step, the bootloader's flashing task is an APP upgrade (update) task, typically entering the programming session via 10 02. When the MCU is running the application, upon receiving the command to enter the programming session from the host computer, the MCU sets the programming flag to valid and performs an MCU restart. After restarting, the MCU follows the pre-flashing judgment steps described above. At this point, it does not jump to the APP but remains in the bootloader waiting for the corresponding APP upgrade flashing task. Once a valid programming flag is detected in the bootloader, it is immediately set to invalid. The programming flag in this step is the APP programming flag. If the programming flag is valid or present, it is considered that an APP upgrade task is required, and the bootloader execution step is entered. Otherwise, it is considered that there is no APP upgrade task.

[0034] In this step, the APP validity determination can be performed using existing technology. Only if the APP is valid and the programming flag is invalid will the process jump to application execution.

[0035] In some embodiments, the microcontroller unit employs a microcontroller unit without AB partitioning, without flash operation unlocking operation, and with sufficient startup time.

[0036] In some embodiments, the storage space of the microcontroller is pre-divided into a flash area, a bootloader area, and an application software area.

[0037] S2, Data Flashing: Flash the software, copy validity flag, and application of the second version bootloader (Bootloader1) to the flash area of ​​the microcontroller. After flashing is complete, reset the microcontroller.

[0038] After resetting the MCU, the MCU will perform a pre-judgment according to step S1. If no instruction to enter the programming session is received, the MCU will jump to the application program after the reset is completed.

[0039] S3, the main task of the APP in upgrading the bootloader: After the application jumps to run, the application determines whether the copy validity flag is valid. If it is invalid, the application waits for other tasks. If it is valid, the software of the second version bootloader in flash is copied to the location of the software of the first version bootloader. After the copy is completed, the copy validity flag is cleared, and the microcontroller's preset memory protection unit (MPU) is started to protect all memory write access except for the use of EEPROM. The application waits for other tasks.

[0040] Since the copy validity flag was written to the preset location in step S2, the APP can determine that the copy validity flag is valid in this step, thus achieving the purpose of upgrading the Bootloader from version 1 to version 2. After the upgrade is completed, the APP will also clear the copy validity flag so that the next time the APP is started or restarted, the Bootloader upgrade will not need to be performed again because the copy validity flag is invalid. If a power failure occurs during the APP's Bootloader writing process, the copy validity flag will remain valid because the copying process was not completed. Therefore, after the MCU is reset or powered on again, the Bootloader copying function will be performed again, preventing the device from becoming bricked due to a power failure during the Bootloader upgrade process.

[0041] In this step, after the Bootloader upgrade is complete, memory write protection is also implemented through the MPU to further protect the stability of the entire system.

[0042] In this step, other tasks refer to regular tasks other than the main task of bootloader upgrade and diagnostic tasks, such as memory management tasks, communication management tasks, or power management tasks.

[0043] In some embodiments, copying the software of the second version of the bootloader in flash to the location of the software of the first version of the bootloader includes:

[0044] The application uses a preset Flash erase / write driver to first erase the software of the first version of the bootloader, and then write the software of the second version of the bootloader.

[0045] In some embodiments, during step S2, when the software of the second version bootloader and the copy validity flag are written to the flash area of ​​the microcontroller, version information is also written to the flash area of ​​the microcontroller.

[0046] In step S3, the application determines whether the version information of the second version bootloader is greater than the version information of the first version bootloader. If it is less, the copy valid flag is cleared and the application waits for other tasks. If it is greater, the software and version information of the second version bootloader in flash are copied to the location of the software of the first version bootloader when the copy valid flag is valid. After the copy is completed, the version information of the bootloader is updated.

[0047] In this embodiment, a version information judgment process is performed before the Bootloader is copied. The Bootloader is copied only when the new Bootloader version information is greater than the old Bootloader version information and the copy validity flag is valid.

[0048] Version information should ideally be checked after the copy validity flag is checked. However, version information can also be checked before the copy validity flag is checked.

[0049] In some embodiments, before copying the software of the second version bootloader in flash to the location of the software of the first version bootloader, the application performs a compatibility check. If the second version bootloader determines that it is incompatible, it clears the copy valid flag and waits for other tasks. If the second version bootloader determines that it is compatible, the application copies the software of the second version bootloader in flash to the location of the software of the first version bootloader.

[0050] In this embodiment, a software compatibility judgment process is performed before the Bootloader is copied. The compatibility judgment is to check the compatibility parameters built into the software. The Bootloader is copied only when the new Bootloader software is compatible with the MCU chip and the copy validity flag is valid.

[0051] Software compatibility checks should ideally be performed after the copy validity check. However, software compatibility checks can also be performed before the copy validity check.

[0052] If the application also checks version information, software compatibility should preferably be checked before version information is checked. Of course, software compatibility can also be checked after version information is checked.

[0053] In some embodiments, during step S2, when the software of the second version bootloader and the copy validity flag are written to the flash area of ​​the microcontroller, version information is also written to the flash area of ​​the microcontroller.

[0054] In step S3, the application also performs a compatibility check. If the second version of the bootloader is determined to be incompatible, the application clears the copy validity flag and waits for other tasks. If the second version of the bootloader is determined to be compatible, the application checks whether the version information of the second version of the bootloader is greater than the version information of the first version of the bootloader. If it is less, the application clears the copy validity flag and waits for other tasks. If it is greater, when the copy validity flag is valid, the application copies the software and version information of the second version of the bootloader in flash to the location of the software of the first version of the bootloader. After the copy is completed, the version information of the bootloader is updated.

[0055] In some embodiments, in step S2, when writing the software of the second version bootloader and the copy validity flag to the flash area of ​​the microcontroller, the checksum is also written to the flash area of ​​the microcontroller.

[0056] In step S3, after the application copies the software of the second version of the bootloader in the flash to the location of the software of the first version of the bootloader, it also performs a verification on the second version of the bootloader using a preset verification method and compares the verification result with the checksum. If the comparison is correct, the copying is complete. If the comparison is incorrect, the application copies the software of the second version of the bootloader in the flash to the location of the software of the first version of the bootloader again and performs the verification and comparison again until the comparison is correct.

[0057] In this embodiment, a verification and comparison method is used to ensure the integrity of Bootloader1.

[0058] The preset verification method in this embodiment is the same as the existing verification method for software verification.

[0059] In this embodiment, the verification and comparison is a background task of the application and theoretically will not affect the application from performing other tasks. However, preferably, if the verification and comparison are all incorrect in the preset number of times, the verification and comparison will be stopped and a diagnostic fault code will be set.

[0060] In some embodiments, in step S2, the software, version information, checksum, and copy validity flag of the second version bootloader are written together to the flash area of ​​the microcontroller unit.

[0061] In step S3, refer to Figure 1 The application determines whether the copy validity flag is valid. If invalid, the application waits for other tasks. If valid, the application performs a compatibility check. If the second version bootloader determines it is incompatible, the copy validity flag is cleared, and the application waits for other tasks. If the second version bootloader determines it is compatible, the application continues to check if the version information of the second version bootloader is greater than that of the first version bootloader. If less, the copy validity flag is cleared, and the application waits for other tasks. If greater, when the copy validity flag is valid, the software and version information of the second version bootloader in flash memory are copied to the location of the software of the first version bootloader. The second version bootloader is verified using a preset verification method, and the verification result is compared with the checksum. If the comparison is correct, the copy is complete. If the comparison is incorrect, the application copies the software of the second version bootloader in flash memory to the location of the software of the first version bootloader again, and performs the verification comparison again until the comparison is correct. After the copy is complete, update the version information of the bootloader, clear the copy validity flag, and activate the microcontroller's preset memory protection unit to protect all memory write accesses except those using EEPROM. The application waits for other tasks.

[0062] In this embodiment, flashing using the RSA3072 will write the Bootloader1 software, version information, checksum, and copy validity flag to the MCU's flash memory. Immediately after flashing, the system will reset, and the application will be redirected. The public key of the RSA3072 is pre-stored in the second version of the bootloader.

[0063] In some embodiments, the application also has a diagnostic task, which is performed simultaneously after the application is redirected to run:

[0064] Determine whether there is a flash request or reset request sent by the host computer. If not, the application waits for other tasks. If there is, determine whether the second version bootloader has been flashed into the flash area. If it has been flashed, the diagnostic result of executing the flash request or reset request is fed back to the host computer and waits for other tasks. If it has not been flashed, the diagnostic result of the negative response is fed back to the host computer and the process jumps to step S1.

[0065] In this embodiment, the diagnostic task and the main task run simultaneously, belonging to parallel tasks, and both have the same priority. The application uses the diagnostic task to check commands such as diagnostic write requests or reset requests sent by the host computer and performs actions such as reset.

[0066] The present invention has been described in detail above with reference to the accompanying drawings and embodiments. Those skilled in the art can make various modifications to the present invention based on the above description. Therefore, certain details in the embodiments should not be construed as limiting the present invention, and the scope of protection of the present invention shall be defined by the appended claims.

Claims

1. A method for flashing bootloader software, characterized in that, The method for flashing the Bootloader software includes: After the microcontroller unit starts, the boot manager is run to determine the validity of the application. If the application is invalid, it stays in the first version bootloader and waits for the flashing task. If the application is valid, the validity of the programming flag is determined. If the programming flag is valid, it stays in the first version bootloader and waits for the flashing task. If the programming flag is invalid, it jumps to run the application. The software of the second version bootloader, the copy validity flag, and the application are written to the flash area of ​​the microcontroller. After the writing is completed, the microcontroller is reset. The application has a main task. After the application is launched, it determines whether the copy validity flag is valid. If it is invalid, the application waits for other tasks. If it is valid, it copies the software of the second version bootloader in the flash to the location of the software of the first version bootloader. After the copy is completed, it clears the copy validity flag and starts the memory protection unit preset by the microcontroller to protect all memory write access except for EEPROM. The application then waits for other tasks.

2. The flashing method for bootloader software as described in claim 1, characterized in that, The microcontroller unit is designed to be free of AB partitioning, flash operation unlocking / locking operations, and has a sufficient startup time.

3. The flashing method for bootloader software as described in claim 1, characterized in that, Copying the software of the second version of the bootloader in the flash memory to the location of the software of the first version of the bootloader includes: The application uses a preset Flash erase / write driver to first erase the software of the first version of the bootloader and then write the software of the second version of the bootloader.

4. The flashing method for bootloader software as described in claim 1, characterized in that, When the software of the second version bootloader and the copy validity flag are written to the flash area of ​​the microcontroller, the version information is also written to the flash area of ​​the microcontroller. The application determines whether the version information of the second version of the bootloader is greater than the version information of the first version of the bootloader. If it is less, the application clears the copy valid flag and waits for other tasks. If it is greater, when the copy valid flag is valid, the application copies the software of the second version of the bootloader and the version information in the flash to the location of the software of the first version of the bootloader. After the copy is completed, the version information of the bootloader is updated.

5. The flashing method for bootloader software as described in claim 1, characterized in that, Before copying the software of the second version of the bootloader in the flash to the location of the software of the first version of the bootloader, the application performs a compatibility check. If the second version of the bootloader determines that it is incompatible, the application clears the copy validity flag and waits for other tasks. If the second version of the bootloader determines that it is compatible, the application copies the software of the second version of the bootloader in the flash to the location of the software of the first version of the bootloader.

6. The flashing method for bootloader software as described in claim 1, characterized in that, When the software of the second version bootloader and the copy validity flag are written to the flash area of ​​the microcontroller, the version information is also written to the flash area of ​​the microcontroller. The application also performs a compatibility check. If the second version of the bootloader is determined to be incompatible, the application clears the copy validity flag and waits for other tasks. If the second version of the bootloader is determined to be compatible, the application checks whether the version information of the second version of the bootloader is greater than the version information of the first version of the bootloader. If it is less, the application clears the copy validity flag and waits for other tasks. If it is greater, when the copy validity flag is valid, the application copies the software of the second version of the bootloader and the version information in the flash to the location of the software of the first version of the bootloader. After the copy is completed, the version information of the bootloader is updated.

7. The method for flashing Bootloader software as described in any one of claims 1 to 6, characterized in that, When writing the second version of the bootloader software and the copy validity flag to the flash area of ​​the microcontroller, the checksum is also written to the flash area of ​​the microcontroller. After the application copies the software of the second version of the bootloader from the flash memory to the location of the software of the first version of the bootloader, it also performs a verification on the second version of the bootloader using a preset verification method and compares the verification result with the checksum. If the comparison is correct, the copying is complete. If the comparison is incorrect, the application copies the software of the second version of the bootloader from the flash memory to the location of the software of the first version of the bootloader again and performs the verification comparison again until the comparison is correct. Preferably, if the preset number of verification comparisons are all incorrect, the verification comparison is stopped and a diagnostic fault code is set.

8. The flashing method for bootloader software as described in claim 1, characterized in that, The application also has a diagnostic task, which is performed simultaneously after the user is redirected to run the application. Determine whether there is a flash request or reset request sent by the host computer. If not, the application waits for other tasks. If it is, determine whether the second version bootloader has been flashed into the flash area. If it has been flashed, the diagnostic result of executing the flash request or reset request is fed back to the host computer and waits for other tasks. If it has not been flashed, the diagnostic result of the negative response is fed back to the host computer and the process jumps to the step of running the startup manager to determine the validity of the application.

Images