Bootloader safe jump method, system and device and storage medium

Abstract

The invention discloses a Bootloader safe jump method, system and device and a storage medium. In the scheme, a Flash memory of the single chip microcomputer is divided into a Bootloader area, an application program area, a program cache area and a simulated EEPROM (Electrically Erasable Programmable Read-Only Memory) data storage area. And when the Bootloader is started, the executable state value is read. And if the executable state value is equal to the maximum value of the numerical range, directly skipping to the application program to run. And if the executable state value is between the maximum value and the minimum value in the numerical value range, trying to jump to the application program to run, and monitoring the running state of the application program through a watchdog timer. And if the executable state value is equal to the minimum value of the numerical value range, keeping the executable state value in the Bootloader, and not executing jumping to the application program. The safe and flexible program jump of the Bootloader is realized, the reliability of the system is improved, and the cost is reduced at the same time.

Description

Technical Field

[0001] This application relates to the field of embedded system technology, and in particular to a bootloader safe jump method, system, device and storage medium. Background Technology

[0002] In the field of embedded system development, with the expansion of product application scenarios and the improvement of security requirements, the safe jump of the bootloader during program upgrades has become a key technical point.

[0003] The bootloader jump mechanism of traditional embedded products has significant flaws. In engineering applications, it mostly relies on the data verification value during program updates to determine whether to jump to run the application; if the verification passes, it jumps directly. However, in actual operation, the application may fail to run properly due to complex factors such as program logic vulnerabilities, hardware compatibility issues, or corrupted upgrade files. The existing mechanism lacks follow-up checks and remedial measures. When the application crashes, the system is prone to getting stuck in an infinite loop, leading to a system crash, which seriously affects the stability and reliability of the product.

[0004] Some solutions use large-capacity Flash microcontrollers to implement software rollback mechanisms to solve the downtime problem. However, this solution has high requirements for microcontroller Flash resources, increases hardware costs, and has complex logic, requiring more development costs. It is difficult to adapt to the product development needs of low cost and high timeliness. Summary of the Invention

[0005] To address the aforementioned issues, this application provides a Bootloader secure jump method, system, device, and storage medium, aiming to improve system stability and reliability while reducing product development costs.

[0006] The embodiments of this application disclose the following technical solutions:

[0007] The first aspect of this application provides a Bootloader safe jump method applied to a microcontroller, the method comprising:

[0008] The flash memory of the microcontroller is divided into a bootloader area, an application area, a program cache area, and a simulated EEPROM data storage area; the simulated EEPROM data storage area is used to store the executable status values ​​of the applications stored in the application area, and the executable status values ​​have a preset numerical range.

[0009] When the bootloader starts, it reads the executable state value stored in the simulated EEPROM data storage area;

[0010] If the executable status value is equal to the maximum value in the range, the application is determined to be executable, and the process is directly redirected to run the application.

[0011] If the executable state value is between the maximum and minimum values ​​of the numerical range, the application is determined to be in a quasi-execution state, and an attempt is made to jump to the application execution. The running status of the application is monitored by the watchdog timer of the microcontroller.

[0012] If the executable status value is equal to the minimum value of the numerical range, the application is determined to be in an unexecutable state, and it remains running in the Bootloader without performing a jump to the application.

[0013] In an optional implementation, after determining that the application is in a quasi-execution state, attempting to jump to the application's execution state, and monitoring the application's execution state through the microcontroller's watchdog timer, the method further includes:

[0014] If the jump fails, the microcontroller is reset by the watchdog timer and re-enter the Bootloader. At the same time, the executable status value is reduced by a first preset value to obtain an updated executable status value.

[0015] If the jump is successful, the executable status value is increased by a second preset value to obtain the updated executable status value.

[0016] In an optional implementation, before reading the executable state value stored in the simulated EEPROM data storage area, the method further includes:

[0017] Determine if there are any new applications that need to be updated to the application area;

[0018] If it exists, the new application will be received through the communication interface and stored in the program cache area;

[0019] Verify the new application stored in the program cache;

[0020] If the verification passes, erase the original content of the application area and copy the new application that has passed the verification from the program cache area to the application area.

[0021] After the copying is completed, the executable state value is set to the initial executable state value, and the initial executable state value is written into the simulated EEPROM data storage area; the initial executable state value is the executable state value corresponding to the quasi-execution state.

[0022] In an optional implementation, after reducing the executable state value by a first preset value to obtain the updated executable state value, the method further includes:

[0023] Determine whether the updated executable status value is equal to the minimum value of the numerical range;

[0024] If the value is equal to the minimum value in the range, the updated executable state value is written to the simulated EEPROM data storage area and kept running in the Bootloader without performing a jump to the application.

[0025] If the value is not equal to the minimum value of the specified range, the updated executable state value is written to the simulated EEPROM data storage area, and the application is jumped to run again based on the updated executable state value.

[0026] In an optional implementation, after adding a second preset value to the executable state value to obtain the updated executable state value, the method further includes:

[0027] Determine whether the updated executable status value is equal to the maximum value in the range of values;

[0028] If the value is equal to the maximum value of the range, the updated executable state value is written to the simulated EEPROM data storage area, and when the Bootloader starts later, it is determined to be executable and the application is directly jumped to run.

[0029] If the value is not equal to the maximum value in the range, the updated executable state value is written to the simulated EEPROM data storage area.

[0030] A second aspect of this application provides a bootloader safe jump system for use in a microcontroller, the system comprising:

[0031] The storage partitioning module is used to divide the Flash memory of the microcontroller into a Bootloader area, an application area, a program cache area, and a simulated EEPROM data storage area; the simulated EEPROM data storage area is used to store the executable status values ​​of the application stored in the application area, and the executable status values ​​have a preset numerical range;

[0032] The status value reading module is used to read the executable status value stored in the simulated EEPROM data storage area when the Bootloader starts.

[0033] The first execution module is used to determine that the application is executable if the executable state value is equal to the maximum value of the numerical range, and directly jump to the application to run;

[0034] The second execution module is used to determine that the application is in a quasi-execution state if the executable state value is between the maximum and minimum values ​​of the numerical range, attempt to jump to the application execution, and monitor the running status of the application through the watchdog timer of the microcontroller.

[0035] The third execution module is used to determine that the application is in an unexecutable state if the executable state value is equal to the minimum value of the numerical range, and to keep it running in the Bootloader without performing a jump to the application.

[0036] In optional implementations, the system also includes:

[0037] The first adjustment module is used to reset the microcontroller and re-enter the Bootloader through the watchdog timer if the second execution module fails to jump, and at the same time reduce the executable state value by a first preset value to obtain an updated executable state value.

[0038] The second adjustment module is used to increase the executable state value by a second preset value if the second execution module successfully attempts to jump, so as to obtain an updated executable state value.

[0039] In optional implementations, the system also includes:

[0040] The update judgment module is used to determine whether there are any new applications that need to be updated to the application area;

[0041] The program receiving module is used to receive and store a new application that needs to be updated to the application area through a communication interface into the program cache area if there is a new application.

[0042] The program verification module is used to verify the new application stored in the program cache area;

[0043] The program update module is used to erase the original content of the application area and copy the new application that has passed the verification in the program cache area to the application area if the verification by the program verification module passes.

[0044] The status value initialization module is used to set the executable status value to an initial executable status value after copying is completed, and to write the initial executable status value into the simulated EEPROM data storage area; the initial executable status value is the executable status value corresponding to the quasi-execution state.

[0045] A third aspect of this application provides a bootloader safe jump device, which includes: a processor and a memory.

[0046] The memory is used to store program code and transmit the program code to the processor;

[0047] The processor is configured to perform the steps of the Bootloader safe jump method as described in any implementation of the first aspect of the instructions in the program code.

[0048] The fourth aspect of this application provides a computer-readable storage medium for storing program code for executing the steps of the Bootloader safe jump method described in any implementation of the first aspect. Compared with the prior art, this application has the following advantages:

[0049] In this technical solution, the microcontroller's Flash memory is first divided into a Bootloader area, an application area, a program cache area, and a simulated EEPROM data storage area. When the Bootloader starts, it reads the executable state value stored in the simulated EEPROM data storage area. If the executable state value equals the maximum value of the range, the application is determined to be executable, and the process jumps directly to the application. If the executable state value is between the maximum and minimum values ​​of the range, the application is determined to be in a quasi-executable state, and an attempt is made to jump to the application, while the microcontroller's watchdog timer monitors the application's running status. If the executable state value equals the minimum value of the range, the application is determined to be non-executable, and it remains running in the Bootloader without attempting to jump to the application. Therefore, this technical solution utilizes the microcontroller's internal Flash memory to simulate an EEPROM for storing executable state values, saving on external memory costs and eliminating the risk of external device failure. Simultaneously, the microcontroller's built-in watchdog timer monitors the application's running status in real time, eliminating the need for additional hardware circuitry. This reduces design and component costs while avoiding the potential synchronization delays or hardware failures of external devices, ensuring reliable reset in the event of application crashes. The application's state is categorized into three types (quasi-executable, executable, and non-executable) based on executable status values, establishing differentiated jump strategies that make the jump mechanism more flexible and secure. This improves system stability and reliability while reducing product development costs. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 A flowchart of a Bootloader safe jump method provided in an embodiment of this application;

[0052] Figure 2 This application provides a schematic diagram of the Flash memory region partitioning for a microcontroller.

[0053] Figure 3 Flowchart of another Bootloader safe jump method provided in the embodiments of this application;

[0054] Figure 4 This is a schematic diagram of a Bootloader safe jump system provided in an embodiment of this application. Detailed Implementation

[0055] As described above, current bootloader jump methods are prone to system crashes due to hidden program defects or interference, and are costly and logically complex, making it difficult to meet the low-cost requirement.

[0056] The inventors have proposed a bootloader safe jump method, system, device and storage medium through research.

[0057] First, the microcontroller's Flash memory is divided into a Bootloader area, an application area, a program cache area, and a simulated EEPROM data storage area. When the Bootloader starts, it reads the executable status value stored in the simulated EEPROM data storage area. If the executable status value is equal to the maximum value of the range, the application is determined to be executable, and the system directly jumps to run the application. If the executable status value is between the maximum and minimum values ​​of the range, the application is determined to be in a quasi-executable state, and the system attempts to jump to run the application, while monitoring the application's running status through the microcontroller's watchdog timer. If the executable status value is equal to the minimum value of the range, the application is determined to be non-executable, and it remains running in the Bootloader without attempting to jump to the application.

[0058] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0059] See Figure 1 The figure is a flowchart of a Bootloader safe jump method provided in an embodiment of this application, which is applied to a microcontroller. Figure 1 As shown, the method includes the following steps:

[0060] S101. Divide the microcontroller's Flash memory into a Bootloader area, an application area, a program cache area, and a simulated EEPROM data storage area.

[0061] Flash memory is a non-volatile program storage medium used in embedded systems to store programs and data for a long time and can be erased and rewritten multiple times.

[0062] Electrically Erasable Programmable Read-Only Memory (EEPROM) is a type of memory chip that retains data even when power is off. EEPROM can be erased and reprogrammed on a computer or dedicated device.

[0063] Analog EEPROM refers to analog electrically erasable programmable read-only memory.

[0064] See Figure 2 This figure is a schematic diagram of the Flash memory region division of a microcontroller provided in an embodiment of this application. Figure 2 As shown, the microcontroller's Flash memory is divided into four functional areas:

[0065] Bootloader section 201 is used to store the bootloader program, which is responsible for hardware initialization, program jump control, and firmware upgrades.

[0066] Application area 202 is used to store applications, which are loaded and run by the bootloader.

[0067] The program cache 203 is used to temporarily store programs to be updated received through communication interfaces such as Controller Area Network (CAN) and Universal Asynchronous Receiver / Transmitter (UART), and supports in-application programming (IAP) online programming.

[0068] The simulated EEPROM data storage area 204 is used to store the executable state values ​​of the application stored in the application area.

[0069] In this embodiment of the application, the simulated EEPROM data storage area can simulate EEPROM function in Flash through software algorithms.

[0070] In this embodiment, the executable state value has a preset numerical range. The preset numerical range of the executable state value can be set according to actual needs, for example, 0x00-0x06.

[0071] S102. When the Bootloader starts, it reads the executable status value stored in the simulated EEPROM data storage area.

[0072] In this embodiment, when the Bootloader starts, it reads the executable state value corresponding to the application from the simulated EEPROM data storage area.

[0073] The executable state value can map to three states of an application: non-executable state, quasi-executable state, and executable state.

[0074] S103. Determine whether the executable status value is equal to the minimum value in the numerical range.

[0075] In this embodiment of the application, if the executable state value is equal to the minimum value of the numerical range, step S104 is performed; if the executable state value is not equal to the minimum value of the numerical range, step S105 is performed.

[0076] S104. Determine that the application is in an unexecutable state, keep it running in the Bootloader, and do not perform a jump to the application.

[0077] In one example implementation, the numerical range is 0x00-0x06. If the executable state value is the minimum value of the range, 0x00, the application is determined to be in an unexecutable state, remains running in the bootloader, and no jump to the application is performed.

[0078] S105. Determine whether the executable status value is equal to the maximum value in the numerical range.

[0079] In this embodiment of the application, if the executable state value is equal to the maximum value of the numerical range, step S106 is performed; if the executable state value is not equal to the maximum value of the numerical range, step S107 is performed.

[0080] S106. Determine that the application is executable and jump directly to the application execution state.

[0081] In one example implementation, the numerical range is 0x00-0x06. If the executable state value is the maximum value of the range, 0x06, then the application is determined to be executable, and the process jumps directly to application execution.

[0082] S107. Determine that the application is in a quasi-execution state, attempt to jump to the application running state, and monitor the running status of the application through the microcontroller's watchdog timer.

[0083] A watchdog timer is a hardware timer used to monitor the running status of an application program in a microcontroller. If the application crashes unexpectedly (such as in an infinite loop, crash, or hardware interference) and fails to reset the watchdog timer on time (i.e., "feeding the watchdog"), the watchdog timer will force a reset of the microcontroller, restoring the system to its initial state.

[0084] In this embodiment, the normal operation of the application is monitored by whether the watchdog timer is reset on time.

[0085] In one example implementation, the value range is 0x00-0x06. If the executable state value is any value between 0x01-0x05, such as 0x03, the application is determined to be in a quasi-executable state, and an attempt is made to jump to the application running state. The running status of the application is monitored by the microcontroller's watchdog timer.

[0086] In this embodiment, the microcontroller's internal Flash memory is used to simulate EEPROM for storing executable state values, saving the cost of external memory and eliminating the risk of external device failure. Simultaneously, the microcontroller's built-in watchdog timer is used to monitor the application's running status in real time, eliminating the need for additional hardware circuitry. This reduces design and component costs while avoiding potential synchronization delays or hardware failures associated with external devices, ensuring reliable reset in case of application crashes. The executable state values ​​are used to categorize the application's state into three types (quasi-executable, executable, and non-executable), establishing differentiated jump strategies that make the jump mechanism more flexible and secure. This improves system stability and reliability while reducing product development costs.

[0087] Optionally, such as Figure 3As shown in the flowchart, after step S107 above, the Bootloader safe jump method further includes the following steps:

[0088] S108. Determine if the jump was successful.

[0089] In this embodiment of the application, when the application attempts to jump while in the aforementioned quasi-execution state, it is determined whether the jump was successful.

[0090] If the application fails to send a reset signal to the watchdog timer within a preset time (i.e., fails to "feed the dog"), the watchdog timer triggers a microcontroller reset, and the jump is deemed to have failed; if the application runs normally and sends a reset signal to the watchdog timer on time, the jump is deemed to have succeeded.

[0091] In this embodiment of the application, if the jump fails, step S109 is performed; if the jump is successful, step S113 is performed.

[0092] S109. The microcontroller is reset by the watchdog timer and re-enter the bootloader. At the same time, the executable status value is reduced by the first preset value to obtain the updated executable status value.

[0093] In this embodiment, when the jump attempt fails, the watchdog timer resets the microcontroller, re-enters the bootloader, and reduces the current executable state value by a first preset value.

[0094] In this embodiment, the first preset value can be adjusted according to actual needs.

[0095] In one example implementation, the numerical range is 0x00-0x06, the current executable state value is 0x02, and the first preset value is 1. When the jump fails, the updated executable state value is:

[0096] 0x02-1 = 0x01.

[0097] S110. Determine whether the updated executable status value is equal to the minimum value in the numerical range.

[0098] In this embodiment of the application, if the updated executable state value is equal to the minimum value of the numerical range, step S111 is performed; if the updated executable state value is not equal to the minimum value of the numerical range, step S112 is performed.

[0099] S111. Write the updated executable state value to the simulated EEPROM data storage area and keep it running in the Bootloader without performing a jump to the application.

[0100] In this embodiment, when the attempt to jump fails, the executable status value is updated to the minimum value of the numerical range. At this time, the application status corresponding to the executable status value is unexecutable. The updated executable status value is written to the simulated EEPROM data storage area, and the jump operation to the application is no longer performed. The application remains running in the bootloader until the application is updated, so as to prevent frequent jumps from causing a crash.

[0101] S112. Write the updated executable status value to the simulated EEPROM data storage area, and try to jump to the application execution again based on the updated executable status value.

[0102] In this embodiment of the application, when the attempt to jump fails and the updated executable state value is not equal to the minimum value of the numerical range, the application state corresponding to the executable state value is quasi-execution. Then, the updated executable state value is written into the simulated EEPROM data storage area, and the aforementioned step S107 is performed again based on the updated executable state value to attempt to jump to the application running.

[0103] In one example implementation, the numerical range is 0x00-0x06, the updated executable status value is 0x01, and the first preset value is 1. If the executable status value is not equal to the minimum value in the range, and the corresponding application state is quasi-execution, then another attempt is made to jump to application execution. If the jump fails again, the executable status value is updated to:

[0104] 0x01-1 = 0x00.

[0105] Since 0x00 is equal to the minimum value of the range, step S111 is executed, 0x00 is written to the simulated EEPROM data storage area, and the jump operation to the application is no longer executed. The program stays in the Bootloader until the application is updated.

[0106] In this embodiment, by resetting the watchdog timer and reducing the initial state value to limit the maximum number of jump attempts, the system is prevented from crashing due to infinite jump attempts.

[0107] in,

[0108] Maximum number of jump attempts = initial executable state value / first preset value.

[0109] S113. Increase the executable status value by a second preset value to obtain the updated executable status value.

[0110] In this embodiment of the application, when the jump attempt is successful, the executable status value is increased by a second preset value to obtain an updated executable status value.

[0111] In this embodiment, the second preset value can be adjusted according to actual needs.

[0112] In one example implementation, the numerical range is 0x00-0x06, the current executable status value is 0x02, and the second preset value is 2. When the jump is successful, the updated executable status value is:

[0113] 0x02+2=0x04.

[0114] S114. Determine whether the updated executable status value is equal to the maximum value in the numerical range.

[0115] In this embodiment of the application, if the updated executable state value is equal to the maximum value of the numerical range, step S115 is performed; if the updated executable state value is not equal to the maximum value of the numerical range, step S116 is performed.

[0116] S115. Write the updated executable status value into the simulated EEPROM data storage area, and when the Bootloader starts later, determine that it is executable and directly jump to the application to run.

[0117] In this embodiment, when the jump attempt is successful, the executable status value is updated to the maximum value in the range. At this time, the application status corresponding to the executable status value is executable. The updated executable status value is written to the simulated EEPROM data storage area and is determined to be executable when the Bootloader starts. This indicates that the application can run stably and safely, and the process jumps directly to the application to run.

[0118] S116. Write the updated executable status value to the simulated EEPROM data storage area.

[0119] In this embodiment of the application, when the updated executable status value is not equal to the maximum value of the numerical range after a successful jump attempt, and the application status corresponding to the executable status value is quasi-execution, the updated executable status value is written to the simulated EEPROM data storage area.

[0120] Optionally, upon the next bootloader startup, the jump and verification are continued based on the updated executable status value until the status value reaches the maximum or minimum value within the numerical range.

[0121] In one example implementation, the numerical range is 0x00-0x06, the updated executable status value is 0x04, and the second preset value is 2. At this point, the executable status value is not equal to the maximum value in the range, and the corresponding application state is quasi-execution. The updated executable status value of 0x04 is written to the simulated EEPROM data storage area.

[0122] When the bootloader starts again, it attempts to jump to the executable status value 0x04 stored in the simulated EEPROM data storage area. If the jump is successful again, the executable status value is updated to:

[0123] 0x04+2=0x06.

[0124] Since 0x06 is equal to the maximum value in the range, step S115 is executed, whereby 0x06 is written into the simulated EEPROM data storage area. When the Bootloader starts up later, it is determined to be in an executable state and the process jumps directly to the application to run.

[0125] In this embodiment of the application, by adding an initial state value each time the jump is successful, the application is marked as executable only after it has run successfully multiple times in a row, which significantly reduces the probability of false positives.

[0126] Optionally, before performing step S102, which involves reading the executable state value stored in the simulated EEPROM data storage area, the method further includes the following steps:

[0127] Step 1: Determine if there are any new applications that need to be updated to the application area.

[0128] In this embodiment of the application, after the bootloader starts, it can determine whether there are new applications that need to be updated to the application area through hardware signals or communication protocols.

[0129] In one example implementation, an upgrade command (such as a specific frame ID or command code) sent by a host computer is received via a communication interface such as CAN or UART. If a valid command is received, it is determined that there is a program to be updated.

[0130] In this embodiment of the application, if it is determined that there is a program to be updated, then proceed to step two.

[0131] Step 2: Receive the new application through the communication interface and store it in the program cache.

[0132] In this embodiment of the application, if it is determined that there is a program to be updated, new application data can be received through a communication interface (such as a CAN bus) and stored in the program cache area.

[0133] Step 3: Verify the new application stored in the program cache.

[0134] In this embodiment of the application, integrity and format verification are performed on the new application stored in the program cache. The specific verification method is not limited here and can be selected according to actual needs.

[0135] If the verification passes, proceed to step four.

[0136] Optionally, if the verification fails, an error message is returned through the communication interface, and the Bootloader remains in the process of waiting to receive the program again.

[0137] Step 4: Erase the existing content in the application area and copy the new application that has passed verification in the application cache to the application area.

[0138] In this embodiment of the application, after the verification is passed, the entire application area is erased, and the new application that has passed the verification in the program cache area is copied page by page to the application area.

[0139] Step 5: After copying is completed, the executable state value is set to the initial executable state value, and the initial executable state value is written into the simulated EEPROM data storage area; the initial executable state value is the executable state value corresponding to the quasi-execution state.

[0140] In this embodiment of the application, after the new program is copied, the executable state value of the application is initialized to a value corresponding to the quasi-execution state (e.g., when the value range is 0x00-0x06, the initial executable state value can be 0x03), and written to the simulated EEPROM data storage area.

[0141] In this embodiment, a closed-loop operation involving detection updates, data reception, verification, program erasure, and state initialization ensures the safe and reliable deployment of new applications onto the microcontroller. The program cache serves as a temporary storage medium, avoiding the risk of accidental updates caused by direct manipulation of the application area. Initializing the executable state value provides initial conditions for subsequent jump verification, enabling the system to distinguish between transient anomalies and permanent defects through multiple rounds of attempts. Combined with the watchdog timer monitoring mechanism, a complete secure jump protection system is formed.

[0142] Based on the Bootloader safe jump method provided in the foregoing embodiments, this application also provides a Bootloader safe jump system. Figure 4 This is a schematic diagram of a Bootloader safe jump system provided in an embodiment of this application. Figure 4 As shown, the Bootloader safe jump system includes:

[0143] The storage partitioning module 401 is used to divide the Flash memory of the microcontroller into a Bootloader area, an application area, a program cache area, and a simulated EEPROM data storage area; the simulated EEPROM data storage area is used to store the executable status values ​​of the application stored in the application area, and the executable status values ​​have a preset numerical range.

[0144] The status value reading module 402 is used to read the executable status value stored in the simulated EEPROM data storage area when the Bootloader starts.

[0145] The first execution module 403 is used to determine that the application is executable if the executable state value is equal to the maximum value of the numerical range, and directly jump to the application to run;

[0146] The second execution module 404 is used to determine that the application is in a quasi-execution state if the executable state value is between the maximum and minimum values ​​of the numerical range, attempt to jump to the application to run, and monitor the running status of the application through the watchdog timer of the microcontroller.

[0147] The third execution module 405 is used to determine that the application is in an unexecutable state if the executable state value is equal to the minimum value of the numerical range, and to keep it running in the Bootloader without performing a jump to the application.

[0148] In the optional implementation, the Bootloader safe jump system also includes:

[0149] The first adjustment module is used to reset the microcontroller and re-enter the Bootloader through the watchdog timer if the second execution module 404 fails to jump, and at the same time reduce the executable state value by a first preset value to obtain an updated executable state value.

[0150] The second adjustment module is used to increase the executable state value by a second preset value if the second execution module 404 successfully attempts to jump, so as to obtain an updated executable state value.

[0151] In the optional implementation, the Bootloader safe jump system also includes:

[0152] The update judgment module is used to determine whether there are any new applications that need to be updated to the application area;

[0153] The program receiving module is used to receive and store a new application that needs to be updated to the application area through a communication interface into the program cache area if there is a new application.

[0154] The program verification module is used to verify the new application stored in the program cache area;

[0155] The program update module is used to erase the original content of the application area and copy the new application that has passed the verification in the program cache area to the application area if the verification by the program verification module passes.

[0156] The status value initialization module is used to set the executable status value to an initial executable status value after copying is completed, and to write the initial executable status value into the simulated EEPROM data storage area; the initial executable status value is the executable status value corresponding to the quasi-execution state.

[0157] In the optional implementation, the Bootloader safe jump system also includes:

[0158] The first judgment module is used to determine whether the executable status value updated by the first adjustment module is equal to the minimum value of the numerical range. If it is equal to the minimum value of the numerical range, the updated executable status value is written to the simulated EEPROM data storage area and kept running in the Bootloader without performing a jump to the application. If it is not equal to the minimum value of the numerical range, the updated executable status value is written to the simulated EEPROM data storage area, and a jump to the application is attempted again based on the updated executable status value.

[0159] The second judgment module is used to determine whether the executable status value updated by the first adjustment module is equal to the maximum value of the numerical range. If it is equal to the maximum value of the numerical range, the updated executable status value is written to the simulated EEPROM data storage area, and when the bootloader starts subsequently, it is determined to be executable and the application is directly jumped to run. If it is not equal to the maximum value of the numerical range, the updated executable status value is written to the simulated EEPROM data storage area.

[0160] In addition, this application embodiment also provides a Bootloader safe jump device, the device including a processor and a memory.

[0161] The memory is used to store program code and transmit the program code to the processor;

[0162] The processor is used to execute the steps of the Bootloader safe jump method described in any of the above method embodiments according to the instructions in the program code.

[0163] Furthermore, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the Bootloader safe jump method as described in any of the method embodiments.

[0164] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments. The device and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components indicated as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0165] The above description is merely one specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A bootloader safe jump method, characterized in that, Applied to microcontrollers, the method includes: The flash memory of the microcontroller is divided into a bootloader area, an application area, a program cache area, and a simulated EEPROM data storage area; the simulated EEPROM data storage area is used to store the executable status values ​​of the applications stored in the application area, and the executable status values ​​have a preset numerical range. When the bootloader starts, it reads the executable state value stored in the simulated EEPROM data storage area; If the executable status value is equal to the maximum value in the range, the application is determined to be executable, and the process is directly redirected to run the application. If the executable state value is between the maximum and minimum values ​​of the numerical range, the application is determined to be in a quasi-execution state, and an attempt is made to jump to the application execution. The running status of the application is monitored by the watchdog timer of the microcontroller. If the executable status value is equal to the minimum value of the numerical range, the application is determined to be in an unexecutable state, and it remains running in the Bootloader without performing a jump to the application.

2. The method according to claim 1, characterized in that, After determining that the application is in a quasi-execution state, attempting to jump to the application's execution state, and monitoring the application's execution state through the microcontroller's watchdog timer, the method further includes: If the jump fails, the microcontroller is reset by the watchdog timer and re-enter the Bootloader. At the same time, the executable status value is reduced by a first preset value to obtain an updated executable status value. If the jump is successful, the executable status value is increased by a second preset value to obtain the updated executable status value.

3. The method according to claim 1, characterized in that, Before reading the executable state value stored in the simulated EEPROM data storage area, the method further includes: Determine if there are any new applications that need to be updated to the application area; If it exists, the new application will be received through the communication interface and stored in the program cache area; Verify the new application stored in the program cache; If the verification passes, erase the original content of the application area and copy the new application that has passed the verification from the program cache area to the application area. After the copying is completed, the executable state value is set to the initial executable state value, and the initial executable state value is written into the simulated EEPROM data storage area; the initial executable state value is the executable state value corresponding to the quasi-execution state.

4. The method according to claim 2, characterized in that, After reducing the executable state value by a first preset value to obtain the updated executable state value, the method further includes: Determine whether the updated executable status value is equal to the minimum value of the numerical range; If the value is equal to the minimum value in the range, the updated executable state value is written to the simulated EEPROM data storage area and kept running in the Bootloader without performing a jump to the application. If the value is not equal to the minimum value of the specified range, the updated executable state value is written to the simulated EEPROM data storage area, and the application is jumped to run again based on the updated executable state value.

5. The method according to claim 2, characterized in that, After incrementing the executable state value by a second preset value to obtain the updated executable state value, the method further includes: Determine whether the updated executable status value is equal to the maximum value in the range of values; If the value is equal to the maximum value of the range, the updated executable state value is written to the simulated EEPROM data storage area, and when the Bootloader starts later, it is determined to be executable and the application is directly jumped to run. If the value is not equal to the maximum value in the range, the updated executable state value is written to the simulated EEPROM data storage area.

6. A bootloader safe jump system, characterized in that, The system, applied to a microcontroller, includes: The storage partitioning module is used to divide the Flash memory of the microcontroller into a Bootloader area, an application area, a program cache area, and a simulated EEPROM data storage area; the simulated EEPROM data storage area is used to store the executable status values ​​of the application stored in the application area, and the executable status values ​​have a preset numerical range; The status value reading module is used to read the executable status value stored in the simulated EEPROM data storage area when the Bootloader starts. The first execution module is used to determine that the application is executable if the executable state value is equal to the maximum value of the numerical range, and directly jump to the application to run; The second execution module is used to determine that the application is in a quasi-execution state if the executable state value is between the maximum and minimum values ​​of the numerical range, attempt to jump to the application execution, and monitor the running status of the application through the watchdog timer of the microcontroller. The third execution module is used to determine that the application is in an unexecutable state if the executable state value is equal to the minimum value of the numerical range, and to keep it running in the Bootloader without performing a jump to the application.

7. The system according to claim 6, characterized in that, The system also includes: The first adjustment module is used to reset the microcontroller and re-enter the Bootloader through the watchdog timer if the second execution module fails to jump, and at the same time reduce the executable state value by a first preset value to obtain an updated executable state value. The second adjustment module is used to increase the executable state value by a second preset value if the second execution module successfully attempts to jump, so as to obtain an updated executable state value.

8. The system according to claim 6, characterized in that, The system also includes: The update judgment module is used to determine whether there are any new applications that need to be updated to the application area; The program receiving module is used to receive and store a new application that needs to be updated to the application area through a communication interface into the program cache area if there is a new application. The program verification module is used to verify the new application stored in the program cache area; The program update module is used to erase the original content of the application area and copy the new application that has passed the verification in the program cache area to the application area if the verification by the program verification module passes. The status value initialization module is used to set the executable status value to an initial executable status value after copying is completed, and to write the initial executable status value into the simulated EEPROM data storage area; the initial executable status value is the executable status value corresponding to the quasi-execution state.

9. A bootloader safe jump device, characterized in that, include: Processor and memory: The memory is used to store program code and transmit the program code to the processor; The processor is configured to execute the steps of the Bootloader safe jump method according to any one of claims 1 to 5, based on the instructions in the program code.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code for performing the steps of the Bootloader safe jump method according to any one of claims 1 to 5.

Images