Power-off data protection method and system based on NOR Flash chip

Abstract

The present invention discloses a power-off data protection method and system for erasing based on a NOR Flash chip, the method comprising the following steps: obtaining device configuration information and sub-region boundary information of a Flash chip, storing them in a device linked list node of the Flash chip, configuring the Flash to an independent block protection mode in a power-off volatile manner, and releasing the protection status of all regions of the Flash chip; receiving an erase / write request, pre-locking all regions, enabling full protection, obtaining a sub-region to be operated through regional analysis according to the erase / write request, sequentially unlocking each block or sector of the sub-region to be operated, and performing an erase / write operation according to the granularity of the unlocking protection of the sub-region to be operated; after the erase / write operation is completed, releasing the protection status of all regions, and feeding back the erase / write operation status information. The present invention can reduce the granularity of the protection region as much as possible without changing the user's erase / write expectations, thereby maximizing the protection region.

Description

Technical Field

[0001] The present invention relates to the technical field of power-off data protection for Flash chips, and in particular to a power-off data protection method and system based on a NOR Flash chip. Background Art

[0002] Flash memory, also known as flash memory, is a rewritable memory, which is divided into NOR Flash and NAND Flash. Since NOR Flash supports XIP (eXecute In Place), that is, the code can be executed directly on NOR Flash without being copied to the memory, it has a high cost-effectiveness and is widely used in IoT embedded devices.

[0003] For embedded devices without batteries, random power failures are prone to occur. For example, when modifying system files, there will be operations such as erasing and writing Flash. If the device loses power at this time, in addition to the data in the erased area not being consistent with expectations, there is a probability that the data in other areas of the Flash (especially the area storing code) will be tampered with.

[0004] Why does power failure during Flash erasing cause data in other areas to be altered? This is related to the working characteristics of Flash. For example, for Flash with a normal power supply of 3.3V, its normal working voltage is about 0.7*V. CC ~1*V CC (about 2.31~3.30V), the stop working voltage is generally 0.3*V CC Below (about 0.99V), there is a gray voltage area between these two ranges, which is 0.3*V CC ~0.7*V CC (about 0.99~2.31V), under this voltage, Flash is in abnormal working state, in this state, Flash may still work, but the working result is not guaranteed to be correct. CPU erases / writes Flash by sending commands, addresses, and data. If Flash receives a command to erase data at address A, Flash may actually parse the waveform of address A into address B, and then erase a small segment of data at address B.

[0005] Therefore, according to the above description, when the power is off during the erase process, the following process occurs:

[0006] 1) When the product loses power, it only takes a moment for the user to unplug the plug. However, for each device on the board, there is a power-off process, that is, the voltage drops from the normal value to 0, which is not completed instantly.

[0007] 2) If the abnormal voltage threshold of NOR Flash (about 2.31V in the above example) is higher than the abnormal voltage threshold of CPU (for example, 1.8V), when the whole device is powered off to the gray voltage area of ​​Flash, Flash is already in abnormal state. However, the main control can still work normally and still send erase / write commands and address data to Flash.

[0008] 3) When the Flash receives commands and address data under this abnormal operating voltage, it may parse them incorrectly, causing data in other areas to be modified incorrectly.

[0009] If the tampered area is the user data area, the next time the user uses the data, the wrong data will be retrieved from the Flash. Assuming that the data happens to be the key value used for local authentication / authorization, the most intuitive result is that the device authorization / authentication fails; if the tampered area is the boot code area, the embedded device will start abnormally after the next power-on. In the case of system damage and inability to start, the device can only be repaired, which greatly affects the user experience. Summary of the invention

[0010] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, the present invention proposes a power-off data protection method based on a NOR Flash chip, which can effectively prevent the data in the Flash chip from being tampered with.

[0011] The present invention also provides a NOR Flash chip-based erasable power-off data protection system having the above-mentioned NOR Flash chip-based erasable power-off data protection method.

[0012] The present invention also provides a computer-readable storage medium having the above-mentioned NOR Flash chip-based erase and write power-off data protection method.

[0013] According to the first aspect of the present invention, the power-off data protection method based on NOR Flash chip includes the following steps: obtaining device configuration information and sub-area boundary information of the Flash chip, storing them in the device list node of the Flash chip, configuring the Flash to an independent block protection mode in a power-off volatile manner, and releasing the protection status of all areas of the Flash chip; receiving an erase / write request, pre-locking all areas, enabling full protection, obtaining the sub-area to be operated through area analysis according to the erase / write request, unlocking each block or sector of the sub-area to be operated in turn, and performing an erase / write operation according to the granularity of the protection of the sub-area to be operated; after the erase / write operation is completed, releasing the protection status of all areas, and feeding back the erase / write operation status information.

[0014] The power-off data protection method for erasing and writing based on a NOR Flash chip according to an embodiment of the present invention has at least the following beneficial effects: the erasing / writing area is subdivided into sub-areas, and the encryption and unlocking protection granularity of the corresponding sub-areas is obtained, and the encryption and unlocking are performed while erasing / writing according to the minimum protection granularity of each sub-area as much as possible. The granularity of the protection area can be reduced as much as possible without changing the user's erasing expectations, thereby maximizing the protection area.

[0015] According to some embodiments of the present invention, obtaining the device configuration information of the Flash chip includes: when the system is initialized, obtaining the ID of the Flash chip, matching the chip parameter information according to the ID, and obtaining the block size, sector size, bottom area boundary address and top area address of the Flash chip, and storing them in the device linked list node of the Flash chip.

[0016] According to some embodiments of the present invention, an erase request is received, the erase request including: an erase mode, an erase address, an erase area size, and an erase Flash device number; if the erase mode is a whole-chip erase or the erase area size is equal to the size of the Flash chip corresponding to the erase Flash device number, the whole chip is directly erased; otherwise, an attempt is made to lock all blocks and sectors of the Flash chip, and the sub-area to be operated is unlocked according to the erase request, and an erase operation is performed.

[0017] According to some embodiments of the present invention, the sub-area to be operated is obtained through area resolution according to the erase request, the sub-area to be operated is unlocked in turn, and the erase operation is performed according to the encryption and unlock protection granularity of the sub-area to be operated, including: reading the corresponding device linked list node according to the erase Flash device number, and obtaining a number of sub-areas to be operated according to the erase address; obtaining the encryption and unlock protection granularity of the sub-area, and obtaining the erasable length of the sub-area to be operated according to the erase address and the erase area size; performing an erase operation on the sub-area to be operated according to the erase address, the encryption and unlock protection granularity, the erasable length and the first erase mode; wherein the first erase mode is the smaller of the erase mode and the encryption and unlock protection granularity.

[0018] According to some embodiments of the present invention, performing an erase operation on the sub-area to be operated according to the erase address, the encryption and unlocking protection granularity, the erasable length, and the first erase mode includes:

[0019] S110, based on the first erasure mode, the total number of sub-areas to be erased to be operated is obtained according to the erasable length; S120, if the total number of sub-areas to be erased is 0, the erasure of the sub-area to be operated is currently completed; otherwise, the first number of erase units when the encryption and unlocking protection granularity is erased according to the first erasure mode is calculated; S130, if the first erase number is greater than the total number of units to be erased, the first erase number is configured as the total number of units to be erased; S140, unlock the lock state of the block or sector to which the current erase address belongs, call the Flash general erase interface to erase the first erase number of units of the first erase mode from the current erase address backward; S150, lock the block or sector to which the current erase address belongs, subtract the first erase number from the total number of units to be erased, move the current erase address back to the next erase operation position, and return to the step S120.

[0020] According to some embodiments of the present invention, a write request is received, the write request including: a write address, a data cache address, a write data length, and a write Flash device number; if the write address does not exceed the maximum address of the Flash chip corresponding to the write Flash device number, an attempt is made to lock all blocks and sectors of the Flash chip, the sub-area to be operated is unlocked according to the write request, and the write operation is performed.

[0021] According to some embodiments of the present invention, the sub-area to be operated is obtained through area resolution according to the write request, the sub-area to be operated is unlocked in turn, and the write operation is performed according to the encryption and unlocking protection granularity of the sub-area to be operated, including: reading the corresponding device linked list node according to the write Flash device number, and obtaining a number of sub-areas to be operated according to the write address; obtaining the encryption and unlocking protection granularity of the sub-area, and obtaining the writable length of the sub-area to be operated according to the write address and the write data length; performing a write operation on the sub-area to be operated according to the write address, the encryption and unlocking protection granularity, the writable length and the data cache address.

[0022] According to some embodiments of the present invention, performing a write operation on the sub-area to be operated according to the write address, the encryption and unlocking protection granularity, the writable length and the data cache address includes: S210, determining that the current total remaining writable length of the sub-area to be operated is less than 0, then the writing of the current sub-area to be operated is completed; otherwise, executing step S220; S220, calculating the first length that the current block or sector can write, if the current total remaining writable length is less than the first length, configuring the first length as the current total remaining writable length; S230, releasing the locking state of the block or sector to which the current write address belongs, calling the Flash general page program interface, and writing the first length of the data to be written from the current write address; S240, locking the block or sector to which the current write address belongs, the current write address and the data cache address are both moved back by the first length, the current total remaining writable length is subtracted from the first length, and returning to step S210.

[0023] According to the second aspect of the present invention, the erasing power-off data protection system based on NOR Flash chip includes: a first module, which is used to obtain device configuration information and sub-area boundary information of the Flash chip, which are stored in the device list node of the Flash chip, and configure the Flash to an independent block protection mode in a power-off volatile manner, and release the protection status of all areas of the Flash chip; a second module, which is used to receive an erase / write request, pre-lock all areas, enable full protection, obtain the sub-area to be operated through area analysis according to the erase / write request, unlock each block or sector of the sub-area to be operated in turn, and perform erase / write operations according to the protection granularity of the sub-area to be operated; and, after the erase / write operation is completed, release the protection status of all areas, and feedback the erase / write operation status information.

[0024] The erasable power-off data protection system based on the NOR Flash chip according to the embodiment of the present invention has at least the same beneficial effects as the method of the embodiment of the first aspect of the present invention.

[0025] The computer-readable storage medium according to the third aspect of the present invention has a computer program stored thereon, and when the computer program is executed by a processor, the method according to the first aspect of the present invention is implemented.

[0026] The computer-readable storage medium according to the embodiment of the present invention has at least the same beneficial effects as the method of the embodiment of the first aspect of the present invention.

[0027] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0029] Figure 1 A schematic diagram of a method according to an embodiment of the present invention;

[0030] Figure 2 A schematic diagram of the erasing area and boundary points of Flash in the method of an embodiment of the present invention;

[0031] Figure 3 A schematic diagram of the division of the Flash area by the independent block protection function in the method of an embodiment of the present invention;

[0032] Figure 4 A schematic diagram of configuring a Flash device linked list node during system initialization in a method according to an embodiment of the present invention;

[0033] Figure 5 Schematic diagram of main steps of a Flash erasing method in an embodiment of the present invention;

[0034] Figure 6 A schematic diagram of a data erasure process for adaptive protection granularity in a method according to an embodiment of the present invention;

[0035] Figure 7 A schematic diagram of a sub-region secure erasure process in a method according to an embodiment of the present invention;

[0036] Figure 8 A schematic diagram of the main steps of the Flash writing method in the method of an embodiment of the present invention;

[0037] Fig. 9 A schematic diagram of a data writing process for protection granularity adaptation in a method according to an embodiment of the present invention;

[0038] Fig.10 A schematic diagram of a sub-region secure writing process in a method according to an embodiment of the present invention;

[0039] Fig.11 A schematic diagram of dividing the Flash test area in the test method of an embodiment of the present invention;

[0040] Fig.12 The module schematic block diagram of the system according to the embodiment of the present invention.

[0041] Reference numerals:

[0042] The first module 100 and the second module 200. DETAILED DESCRIPTION

[0043] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0044] In the description of the present invention, the meaning of "several" is one or more, the meaning of "more" is two or more, "greater than", "less than", "exceed" etc. are understood as not including the number itself, and "above", "below", "within" etc. are understood as including the number itself. If there is a description of the first and the second, it is only for the purpose of distinguishing the technical features, and it cannot be understood as indicating or implying the relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features. In the description of the present invention, the step numbers are only used for the convenience of description or citation. The size of the serial number of each step does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0045] Reference Figure 1 The method of the embodiment of the present invention includes: obtaining device configuration information and sub-area boundary information of the Flash chip, storing them in the device linked list node of the Flash chip, configuring the Flash to an independent block protection mode in a power-off volatile manner, and releasing the protection status of all areas of the Flash chip; receiving an erase / write request, pre-locking all areas, enabling full protection, obtaining the sub-area to be operated through area analysis according to the erase / write request, unlocking each block or sector of the sub-area to be operated in turn, and performing an erase / write operation according to the protection granularity of the sub-area to be operated; after the erase / write operation is completed, releasing the protection status of all areas, and feeding back the erase / write operation status information.

[0046] The write protection function of NOR Flash protects certain areas by configuring registers. If the protection is not unlocked, the master's write and erase commands to this area will be directly ignored by Flash.

[0047] For example, when the Flash is in an unstable working state, a command to write A is understood as writing B. At this time, if address B is in the write-protected area, the command will be ignored and will not cause substantial damage to the address B area.

[0048] Therefore, the basic idea of ​​the method of the present invention is as follows.

[0049] 1. Use Flash regional protection function

[0050] 1) Divide the Flash area according to the Flash characteristics (taking 2MByte Flash as an example), and mark multiple boundary points in the Flash area, 0, 4K, 8K, ..., 2M;

[0051] 2) The boundary points are mapped to serial numbers, 1, 2, 3, ..., 17, respectively, and the mapping information is stored in the device system. Any boundary point can be selected, and the left area and the right area thereof can be configured as a protection area, a non-protection area, or a non-protection area and a protection area respectively;

[0052] 3) After the device system is powered on, initialize the Flash and configure the Flash to be in a non-protected state in all areas;

[0053] 4) Each time an erase / write operation is performed, the erase / write area is first judged, the most appropriate boundary point is selected, and the areas on both sides of the boundary point are configured as protection area and non-protection area respectively, and the erase / write operation is performed;

[0054] 5) After the erase and write operation is completed, modify the Flash register configuration and restore the Flash to the non-protected state of the entire area.

[0055] The judgment of the area in step 4 above can be defined by the implementer. If the code area needs to be protected first, the largest serial number smaller than the starting address of the erase / write area can be directly selected as the boundary point, and its left side is configured as the protection area; if more areas are to be protected as much as possible, the side with more Flash space can be determined based on the first and last addresses of the erase / write area, and the nearest boundary point can be found for configuration. An example is as follows:

[0056] A) If Figure 2 As shown, when it is necessary to erase "erase area 1", find the most suitable boundary point near the current erase area, for example, configure the left side (0~128K size) of the boundary point of serial number 6 (128K) as the protection area, and the remaining right side (2048K-128K) as the non-protection area to prevent the first 128K data of the Flash from being tampered with when the power is off during erasing; you can also choose serial number 8 (512K), configure the 512K~2048K area of ​​the Flash as the protection area, and the front 0~512K range as the non-protection area. This option can protect as much Flash area as possible.

[0057] B) Same as above, if you want to erase "erase area 2", you can find the boundary point number 9 (1M), configure the left side of the number 9 as a non-protected area, and configure the right side of the number 9 boundary point as a protected area. Or select number 8, configure the left side of number 8 as a protected area to protect the code segment.

[0058] C) If you need to erase "erase area 3", you can also select the boundary point as serial number 11, configure the 0~1792K area as the protection area, and the 1792K~2048K area as the non-protection area.

[0059] The above-mentioned regional protection method can play a certain protective role, but the protection granularity is large. Due to the characteristics of Flash, only a continuous area starting from the bottom or top of the Flash storage space can be selected and configured as a protection state, which cannot achieve a more comprehensive protection of data. Therefore, the embodiment of the present invention proposes to adopt an erase / write strategy based on independent block protection, which will be mainly introduced below.

[0060] 2. Use Flash's independent block protection function

[0061] 1) Based on the independent block protection function of Flash, the Flash address space is divided into blocks and sectors. Taking a 2MByte Flash as an example, Figure 3 shown.

[0062] The block size is 64KB, the sector size is 4KB, the bottom area can be regarded as area 1, and protection and unlocking are performed according to the granularity of Sector (4KB) (hereinafter referred to as locking and unlocking descriptions);

[0063] The middle area can be regarded as area 2, which is locked and unlocked according to the granularity of Block (64KB);

[0064] The top area can be regarded as area 3, and is locked and unlocked according to the granularity of Sector (4KB).

[0065] Therefore, the entire Flash space is divided into multiple address areas. By individually locking and unlocking the blocks / sectors in each area, the minimum granularity of erase / write protection is achieved, and the data in other areas is protected from being tampered with when the Flash is powered off during erase / write.

[0066] 2) The main process of protecting data in other areas during power-off is as follows:

[0067] 2-1) The system is powered on to initialize the Flash, configure write protection related functions, and release the protection status of all areas;

[0068] 2-2) The upper layer application calls the Flash power-off safe erase / write interface, pre-locks all areas, and enables full protection;

[0069] 2-3) Calculate the sub-regions that need to be operated through regional analysis, and perform separate unlocking, erasing / writing and locking operations on each Block / Sector of the sub-region to be operated in turn until all sub-regions are operated;

[0070] 2-4) Release the protection status of all blocks / sectors and feedback the erase / write operation status information.

[0071] The Flash initialization process can refer to the description of step 3) below, and the erase and write strategies can refer to the descriptions of steps 4) and 5).

[0072] 3) When the system (Flash) is initialized, if Figure 4 As shown, the processing steps are as follows:

[0073] 3-1) Get the jedec(ID) of the current Flash through the command provided by Flash, and exit if the acquisition fails;

[0074] 3-2) Match the Flash parameter information of the Flash chip through the ID. If the match fails, use the default parameters;

[0075] 3-3) Create a Flash device linked list node based on the Flash device number used;

[0076] 3-4) The obtained configuration information such as Flash Block size, Sector size, bottom area (area 1) boundary address, top area boundary address (area 3) is stored in this Flash device linked list node;

[0077] 3-5) Use the power-off volatile method to configure the Flash to independent block protection mode (according to the Flash characteristics, the Flash will generally default to full lock of all areas at this time);

[0078] 3-6) Unlock all Blocks / Sectors to unprotected state;

[0079] 3-7) Feedback the protection status information of each Flash Block to the system console.

[0080] 4) The Flash data erasing method in the embodiment of the present invention, such as Figure 5 As shown, the processing steps are as follows:

[0081] 4-1) Get the erase mode blk_size, address addr, area size left, Flash device number and other information by calling and passing parameters;

[0082] 4-2) Determine whether the operated area exceeds the total size of the Flash. If so, execute step 4-3), otherwise execute step 4-4); Determine whether the start address of the operation has been aligned according to the erase mode. If not, execute step 4-3), otherwise execute step 4-4);

[0083] 4-3) Exit the erasure process and return an error message;

[0084] 4-4) Check whether the entire Flash is erased. If so, directly erase the entire Flash and exit the erase process; otherwise, execute step 4-5);

[0085] 4-5) Try to lock all blocks and sectors. Before erasing, put the Flash into full area protection state. If the lock is successful, go to step 4-6), otherwise go to step 4-3);

[0086] 4-6) Execute the deprotection granularity adaptive erasure process, cyclically check and process each sub-area that needs to be erased (calculate and process area 1, area 2, area 3, etc.), and execute step g after each sub-area is processed;

[0087] 4-7) Try to unlock all blocks and sectors. After erasing, put the Flash into the state of full area deprotection. If unlocking is successful, execute step 4-8), otherwise execute step 4-9);

[0088] 4-8) Exit the erase process and return to the security erase success;

[0089] 4-9) Exit the erasing process and warn that the unlocking failed.

[0090] Among them, step 4-6) is the erasure process of deprotection granularity adaptation, such as Figure 6 As shown, the sub-steps included are as follows:

[0091] 4-6-1) Determine whether the total remaining length left to be erased is greater than 0. If so, it means that the erasure is not complete, then execute step 4-6-3; otherwise, execute step 4-6-2;

[0092] 4-6-2) The remaining total length to be erased len is 0, the operation is completed, and the deprotection granularity adaptive erasing process is exited;

[0093] 4-6-3) According to the Flash device number being operated, the region boundary information of the Flash is obtained from the Flash device linked list node to distinguish region 1, region 2, region 3, etc.;

[0094] 4-6-4) According to the starting address addr of the current area to be erased, obtain the next sub-area to be erased from the erasing direction. If the sub-area is located in area i (i=1, 2, 3...), then according to the boundary information of area i (the bottom address of area i is bottom(i), and the top address is top_addr(i)), calculate the maximum erasable length len(i) of the area, len(i)=top_addr(i)-addr;

[0095] 4-6-5) Get the encryption and unlocking protection granularity corresponding to region i, recorded as wp_size(i);

[0096] 4-6-6) Compare the maximum erasable length len(i) of the sub-region with the total remaining length to be erased left. If len(i) is greater than left, execute step 4-6-7; otherwise, execute step 4-6-8;

[0097] 4-6-7) Assign the maximum erasable length len(i) of the sub-region to the actual erasable length len of the sub-region, and execute step 4-6-9;

[0098] 4-6-8) Assign the total remaining length to be erased left to the actual erase length len of the sub-area, and execute step 4-6-9;

[0099] 4-6-9) Compare the erase mode blk_size with the encryption / unlock protection granularity wp_size(i). If blk_size is greater than wp_size(i), execute step 4-6-10; otherwise, execute step 4-6-11.

[0100] 4-6-10) Assign the protection granularity wp_size(i) of the area to the actual erasure mode erz_mode of the sub-area to ensure that the protection granularity is minimized during erasure, and execute step 4-6-12;

[0101] 4-6-11) Assign the erase mode blk_size to the actual erase mode erz_mode of the sub-area, and execute step 4-6-12;

[0102] 4-6-12) Starting from address addr, erase the sub-area according to the configuration of erase mode erz_mode, protection granularity wp_size(i), and erase length len;

[0103] 4-6-13) Erase address addr and move backward by the number of bytes of length len, addr = addr + len;

[0104] 4-6-14) The total remaining length to be erased left is reduced by len bytes, left = left-len, jump to step 4-6-1 to continue execution.

[0105] In the above step description, 4-6-12) is the execution sub-area erase process, the erase address is addr, the length is len, the erase mode is erz_mode, and the unlock protection granularity is wp_size(i). Figure 7 As shown, the sub-steps included are as follows:

[0106] 4-6-12-1) Calculate the number of blocks / sectors to be erased in the sub-area blk_cnt, blk_cnt = len / erz_mode;

[0107] 4-6-12-2) Determine whether the number of remaining blocks / sectors to be erased blk_cnt is greater than 0. If so, it means that the erasure is not complete, and execute step 4-6-12-4; otherwise, execute 4-6-12-3;

[0108] 4-6-12-3) The sub-area erasing is completed, and the sub-area erasing process is exited and a success is returned;

[0109] 4-6-12-4) Determine the relationship between the encryption and unlocking protection granularity wp_size(i) and the erasure granularity erz_mode. If wp_size(i) is greater than erz_mode, execute step 4-6-12-5; if wp_size(i) is equal to erz_mode, execute step 4-6-12-6; otherwise, execute step 4-6-12-7;

[0110] 4-6-12-5) Calculate the number of Blocks / Sectors that need to be erased within this round of protection granularity, cnt = (wp_size(i)-addr%wp_size(i)) / erz_mode, and execute step 4-6-12-8;

[0111] 4-6-12-6) Assign the number of Blocks / Sectors that need to be erased in this round of protection granularity, cnt, to 1, and execute step 4-6-12-8;

[0112] 4-6-12-7) Exit the sub-area erase process and return an erase error (to achieve the minimum protection granularity, the erase granularity erz_mode is the smaller of the protection granularity wp_size(i) and the expected erase mode blk_size, so the current policy does not allow the situation where wp_size(i) is smaller than erz_mode);

[0113] 4-6-12-8) Determine whether the number of basic units to be erased in this round cnt exceeds the total number of basic units remaining to be erased blk_cnt. If so, execute step 4-6-12-9; otherwise, execute step 4-6-12-10;

[0114] 4-6-12-9) Assign the total remaining number of basic units to be erased blk_cnt to the number of basic units to be erased in this round cnt, and execute step 4-6-12-10;

[0115] 4-6-12-10) Unlock the Block / Sector corresponding to the current Flash address addr;

[0116] 4-6-12-11) Use the Flash general erase method, according to the erz_mode erase mode, starting from address addr, and erase cnt basic units backward;

[0117] 4-6-12-12) Lock the Block / Sector corresponding to the current operation address addr;

[0118] 4-6-12-13) The operation address addr is shifted back by erz_mode*cnt bytes, addr=addr+erz_mode*cnt;

[0119] 4-6-12-14) The number of remaining blocks / sectors to be erased blk_cnt is reduced by cnt, blk_cnt = blk_cnt-cnt;

[0120] 4-6-12-15) Jump to step 4-6-12-2) to determine whether the next Block / Sector unlock and erase operation is required.

[0121] 5) In the embodiment of the present invention, the Flash data writing method provided is as follows: Figure 8 , comprising the following steps.

[0122] 5-1) By calling and passing parameters, obtain the device number written to Flash, the physical address addr being operated, the data cache address data, the data length len and other information;

[0123] 5-2) Determine whether the operated area exceeds the total size of the Flash. If so, execute step 5-3), otherwise execute step 5-4);

[0124] 5-3) Exit the write process and return an error;

[0125] 5-4) Try to lock all blocks and sectors. Before writing, put the Flash into full area protection state. If the lock is successful, execute step 5-5), otherwise execute step 5-3);

[0126] 5-5) Execute the deprotection granularity adaptive writing process, cyclically check and process each sub-area that needs to be written (calculate and process area 1, area 2, area 3, etc.), and execute step 5-6) after each sub-area is processed;

[0127] 5-6) Try to unlock all blocks and sectors. After writing, put the Flash into the state of full area deprotection. If the unlocking is successful, execute step 5-7), otherwise execute step 5-8);

[0128] 5-7) Exit the write process and return to the safe write success;

[0129] 5-8) Exit the writing process and warn that the unlocking failed.

[0130] Among them, step 5-5) is the writing process of deprotection granularity adaptation, such as Fig. 9 As shown, the sub-steps included are as follows.

[0131] 5-5-1) According to the Flash device number being operated, the region boundary information of the Flash is obtained from the Flash device linked list node (the bottom address of region i (i=1, 2, 3...) is bottom(i), and the top address is top_addr(i)), which is used to distinguish region 1, region 2, region 3... etc.;

[0132] 5-5-2) Determine whether the total remaining length to be written is greater than 0. If so, it means that the writing is not completed, and then execute step 5-5-4); otherwise, execute step 5-5-3);

[0133] 5-5-3) The total remaining length to be written is 0, the operation is completed, and the deprotection granularity adaptive writing process is exited;

[0134] 5-5-4) According to the starting address addr of the current area to be written, obtain the next sub-area to be written from the writing direction. If the sub-area is located in area i, then according to the boundary information of area i (the bottom address of area i is bottom(i), and the top address is top_addr(i)), calculate the maximum writable length len(i) of the area, len(i) = top_addr(i)-addr;

[0135] 5-5-5) Get the encryption and unlocking protection granularity corresponding to region i, recorded as wp_size(i);

[0136] 5-5-6) Compare the maximum writable length len(i) of the sub-area with the total remaining length to be written size. If len(i) is greater than size, execute step 5-5-7); otherwise, execute step 5-5-8);

[0137] 5-5-7) Assign the maximum writable length len(i) of the sub-area to the actual writable length len of the sub-area, and execute step 5-5-9);

[0138] 5-5-8) Assign the total remaining length to be written (size) to the sub-area actual written length (len), and execute step 5-5-9);

[0139] 5-5-9) Starting from address addr, write operation is performed on the sub-area according to the configuration of protection granularity wp_size(i), write length len, and data cache address data;

[0140] 5-5-10) After the current sub-area is written, the write address addr moves backward by the number of bytes of length len, addr = addr + len;

[0141] 5-5-11) The total remaining length to be written is reduced by len bytes, size = size-len;

[0142] 5-5-12) The data cache address is moved back by len bytes, data = data + len, and jump to step 5-5-2) to continue execution.

[0143] In the above step description, 5-5-9) is the execution sub-area write process, the address to be written is addr, the length is len, the data cache address is data, and the encryption and unlocking protection granularity is wp_size(i). Fig.10 As shown, the sub-steps included are as follows.

[0144] 5-5-9-1) Determine whether the total remaining length len to be written in the sub-area is greater than 0. If so, it means that the writing is not completed, and execute step 5-5-9-3; otherwise, execute 5-5-9-2;

[0145] 5-5-9-2) After writing into the sub-area, exit the sub-area writing process and return success;

[0146] 5-5-9-3) According to the current operation address, calculate the writable length within the current protection granularity wp_size(i), recorded as ws, ws = wp_size(i) - (addr% wp_size(i));

[0147] 5-5-9-4) Determine whether the current round of writing length ws exceeds the total remaining length to be written len, if it exceeds, execute step 5-5-9-5, otherwise directly execute step 5-5-9-6;

[0148] 5-5-9-5) Assign the total remaining length to be written len to the current round of writing length ws, ws = len, and execute step 5-5-9-6;

[0149] 5-5-9-6) Release the Block / Sector lock status corresponding to the current Flash address addr;

[0150] 5-5-9-7) Using the Flash common page program method, starting from address addr, write ws bytes of data backward;

[0151] 5-5-9-8) Lock the Block / Sector corresponding to the current operation address addr;

[0152] 5-5-9-9) The operation address addr is shifted back by ws bytes, addr = addr + ws;

[0153] 5-5-9-10) The remaining data cache address data with write is shifted back by ws bytes, data = data + ws;

[0154] 5-5-9-11) The total length len to be written in the sub-area is reduced by ws bytes, len=len-ws, and the process jumps to step 5-5-9-2) to determine whether the next Block / Sector unlock write operation is required;

[0155] The beneficial effects of the method of the present invention are as follows:

[0156] 1) The protection area is adaptive and can achieve the minimum protection granularity. Whether erasing the Flash in 4K, 32K or 64K mode, or writing any byte of data to the Flash, it can be processed automatically. The basic process is to subdivide the erase / write area into sub-areas, and obtain the encryption and unlocking protection granularity of the corresponding sub-area, and perform encryption and unlocking while erasing / writing according to the minimum protection granularity of each sub-area as much as possible. Therefore, this method can ensure that the granularity of the protection area is reduced as much as possible without changing the user's erase and write expectations, thereby maximizing the protection area.

[0157] 2) When not in the erase / write process, the Flash is in a fully unlocked state, which is convenient for the maintenance of the IoT devices on board. In the above strategy, the system equipment is not fully protected after initialization, but is configured in a non-protected state. After the system is powered on, the entire Flash area is in a non-protected state. Only when erasing and writing, the entire area is locked, and then the operated area is unlocked separately for erasing and writing. After the erasing and writing are completed, the entire area is unlocked. When debugging, the equipment maintenance personnel do not need to perform additional operations to release the Flash write protection. After the system is powered on, the Flash is fully unlocked and can directly enter the BROM (firmware upgrade mode) to operate the Flash in the original way. It is more convenient for maintenance personnel to use and easier for mass production of equipment.

[0158] 3) It can adapt to different Flash operating voltages without increasing hardware costs. This method mainly uses the write protection function provided by Flash, and adds the unlocking strategy of Flash to the erase / write process to ensure the power-off safety of other areas of Flash. Since this method puts the operation of locking other areas of Flash before the erase / write process, the operation of locking other areas will be performed before the erase / write process at any voltage. Therefore, this method does not need to specifically adapt to different Flash operating voltages, nor does it need to add additional hardware monitoring circuits. It is a more cost-effective option.

[0159] In an embodiment of the present invention, a test method for abnormal data erasure during power-off is also provided. Taking 2MByte Flash as an example, the basic steps are as follows:

[0160] 1) Divide the 2M SiP Flash into four areas, including: code area, storage area, erase area, and comparison data area. The code area is used to burn the image, such as Fig.11 In the display, the area from 0 to 184K is the code area;

[0161] 2) The storage area is used to store the error code information and sysinfo information of the verification failure. In the example, the storage area size is 8KByte and the address area is 0x2e000~0x30000;

[0162] 3) The erase area is 0x30000~0x70000, occupying a total of 256KByte. After the system is initialized, it is erased according to the granularity of the block size (64K);

[0163] 4) The comparison data area is used for the main data comparison. The address area is 0x70000~0x200000. The content can be fixed to 0x5A to ensure that it can be seen whether any bit in this area is mistakenly written to '0', and whether the area is "mistakenly erased" (it will become 0xFF after erasure).

[0164] According to the above area division, after the system is powered on, operate the Flash to verify, erase, write, read, and verify the erasable area in a cycle test. During the process, use a relay to randomly power off the device for 3 to 15 seconds. After running for three days, read out the 2M Flash data to check whether the data in the code area (0x0 to 0x2e000) and the comparison data area (0x70000 to 0x200000) has been tampered with.

[0165] In order to more easily achieve the expected test results, the following points should be noted during the test:

[0166] 1) Each time the system is powered on, the 256K erase area is initialized first, and the magic numbers are written in sequence according to the granularity of the block size (64K): 0xe7, 0xaa, 0xbe, 0x3c. After initialization, the written magic numbers are checked. If an error occurs, the error code and error address information are written back to the storage area (0x2e000).

[0167] 2) After initialization, the erase area is tested. Each round is erased according to the block size (64K), and a fixed magic number (0x18, 0x55, 0x41, 0xc3, etc.) is written to the 64K area.

[0168] 3) Before each round of erasing, check whether the value of the current 64K (Block size) area is as expected. If it is not consistent with the expectation, write the error code and error address information back to the storage area (0x2e000). After each round of writing is completed, read the written 64K value and compare it to see if it is consistent with the expectation. If it is not consistent, write the error code and error address information back to the specified area of ​​the storage area (0x2e000).

[0169] 4) When writing data to Flash, use single bytes and write them one by one, which increases the proportion of pageprogram operations inside Flash per unit time.

[0170] 5) The data written into the Flash does not use random numbers, but magic numbers. The binary values ​​are selected to alternate between 0 and 1, and the number of 0 and 1 is equal. The number of bits written as "0" in each round of the "write" operation is balanced as much as possible. (For example, 0x18, 0x55, 0x41, 0xc3, their binary values ​​are: 1110 0111, 1010 1010, 1011 1110, 0011 1100). After each round of writing the magic number, the next round is written inversely to ensure that the magic number written each time is different. This approach can facilitate data dumping and backtracking.

[0171] In the system of the embodiment of the present invention, referring to Fig.12, including the following modules: a first module 100, for obtaining device configuration information and sub-area boundary information of a Flash chip, storing them in a device linked list node of the Flash chip, configuring the Flash to an independent block protection mode in a power-off volatile manner, and releasing the protection status of all areas of the Flash chip; a second module 200, for receiving an erase / write request, pre-locking all areas, enabling full protection, obtaining a sub-area to be operated through area analysis according to the erase / write request, unlocking each block or sector of the sub-area to be operated in turn, and performing an erase / write operation according to the granularity of the protection of the sub-area to be operated; and, after the erase / write operation is completed, releasing the protection status of all areas, and feeding back the erase / write operation status information

[0172] Although specific embodiments are described herein, those of ordinary skill in the art will recognize that many other modifications or alternative embodiments are also within the scope of the present disclosure. For example, any of the functions and / or processing capabilities described in conjunction with a particular device or component may be performed by any other device or component. In addition, although various exemplary implementations and architectures have been described according to embodiments of the present disclosure, those of ordinary skill in the art will recognize that many other modifications to the exemplary implementations and architectures described herein are also within the scope of the present disclosure.

[0173] Some aspects of the present disclosure are described above with reference to the block diagram and flow chart of the system, method, system and / or computer program product according to the exemplary embodiments.It should be understood that the combination of one or more blocks in the block diagram and the flow chart and the blocks in the block diagram and the flow chart can be realized by executing computer executable program instructions respectively.Equally, according to some embodiments, some blocks in the block diagram and the flow chart may not need to be executed in the order shown, or may not need to be executed in full.In addition, additional components and / or operations beyond those components and / or operations shown in the blocks in the block diagram and the flow chart may be present in certain embodiments.

[0174] Therefore, the blocks in the block diagrams and flow charts support the combination of devices for performing the specified functions, the combination of elements or steps for performing the specified functions, and the program instruction devices for performing the specified functions. It should also be understood that each block in the block diagrams and flow charts and the combination of blocks in the block diagrams and flow charts can be implemented by a special-purpose hardware computer system or a combination of special-purpose hardware and computer instructions that performs a specific function, element or step.

[0175] The program modules, applications, etc. described herein may include one or more software components, including, for example, software objects, methods, data structures, etc. Each such software component may include computer-executable instructions that, in response to execution, cause at least a portion of the functionality described herein (e.g., one or more operations of the illustrative methods described herein) to be performed.

[0176] Software components can be encoded with any of various programming languages. An exemplary programming language can be a low-level programming language, such as an assembly language associated with a specific hardware architecture and / or an operating system platform. The software component comprising assembly language instructions may need to be converted to executable machine code by an assembler before being executed by hardware architecture and / or platform. Another exemplary programming language can be a higher-level programming language, which can be transplanted across multiple architectures. The software component comprising a higher-level programming language may need to be converted to an intermediate representation by an interpreter or a compiler before execution. Other examples of programming languages ​​include but are not limited to macro languages, shells or command languages, job control languages, scripting languages, database queries or search languages ​​or report writing languages. In one or more exemplary embodiments, the software component comprising the instruction of one of the above-mentioned programming language examples can be directly executed by an operating system or other software components, without first being converted into another form.

[0177] Software components may be stored as files or other data storage structures. Software components of similar type or related functions may be stored together, such as in a specific directory, folder, or library. Software components may be static (e.g., preset or fixed) or dynamic (e.g., created or modified at execution time).

[0178] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the above embodiments, and various changes can be made within the knowledge scope of ordinary technicians in the relevant technical field without departing from the purpose of the present invention.

Claims

1. A power-off data protection method based on NOR Flash chip, characterized in that: The following steps are involved: Obtain device configuration information and sub-area boundary information of the Flash chip, store them in the device linked list node of the Flash chip, configure the Flash to an independent block protection mode in a power-off volatile manner, and release the protection status of all areas of the Flash chip; Upon receiving an erase / write request, pre-locking all areas, enabling full protection, obtaining a sub-area to be operated through area parsing according to the erase / write request, sequentially unlocking each block or sector of the sub-area to be operated, and performing an erase / write operation according to the granularity of the protection of the sub-area to be operated; After the erase operation is completed, the protection status of all areas is released and the erase operation status information is fed back.

2. The method for protecting NOR Flash chip from power failure according to claim 1, characterized in that: The obtaining of the device configuration information of the Flash chip includes: When the system is initialized, the ID of the Flash chip is obtained, the chip parameter information is matched according to the ID, and the block size, sector size, bottom area boundary address and top area address of the Flash chip are obtained and stored in the device linked list node of the Flash chip.

3. The method for protecting NOR Flash chip from power failure according to claim 1, characterized in that: An erase request is received, wherein the erase request includes: an erase mode, an erase address, an erase area size, and an erase Flash device number; If the erasing mode is full chip erasing or the erase area size is equal to the size of the Flash chip corresponding to the erase Flash device number, the full chip is directly erased; Otherwise, an attempt is made to lock all blocks and sectors of the Flash chip, and the sub-area to be operated is unlocked according to the erase request, and an erase operation is performed.

4. The method for protecting NOR Flash chip from power failure according to claim 3, characterized in that: Obtaining a sub-region to be operated through region resolution according to the erase request, unlocking the sub-regions to be operated in sequence, and performing an erase operation according to the encryption and unlocking protection granularity of the sub-region to be operated includes: Read the corresponding device linked list node according to the erased Flash device number, and obtain a plurality of sub-areas to be operated according to the erased address; Acquire the encryption and unlocking protection granularity of the sub-area, and acquire the erasable length of the sub-area to be operated according to the erase address and the erase area size; An erasing operation is performed on the sub-area to be operated according to the erasing address, the encryption / unlocking protection granularity, the erasable length, and the first erasing mode.

5. The method for protecting NOR Flash chip from power failure according to claim 4, characterized in that: Performing an erasing operation on the sub-area to be operated according to the erasing address, the encryption and unlocking protection granularity, the erasable length, and the first erasing mode includes: S110, based on the first erasing mode, deriving a total number of sub-areas to be erased according to the erasable length; S120, if the total number of items to be erased is 0, then erasure of the sub-area to be operated is completed; otherwise, calculating the number of first erasure units when erasing the encryption and unlocking protection granularity according to the first erasure mode; S130, if the first erase quantity is greater than the total number of items to be erased, configuring the first erase quantity to be the total number of items to be erased; S140, unlocking the lock state of the block or sector to which the current erase address belongs, calling the Flash universal erase interface to erase the first erase quantity of units of the first erase mode backward from the current erase address; S150, locking the block or sector to which the current erasing address belongs, subtracting the first erasing number from the total number to be erased, moving the current erasing address to the next erasing operation position, and returning to the step S120.

6. The method for protecting NOR Flash chip from power failure according to claim 1, characterized in that: A write request is received, wherein the write request includes: a write address, a data cache address, a write data length, and a write Flash device number; If the write address does not exceed the maximum address of the Flash chip corresponding to the write Flash device number, try to lock all blocks and sectors of the Flash chip, unlock the sub-area to be operated according to the write request, and perform the write operation.

7. The method for protecting NOR Flash chip from power failure according to claim 6, characterized in that: Obtaining a sub-region to be operated through region resolution according to the write request, unlocking the sub-region to be operated in sequence, and performing a write operation according to the granularity of encryption and unlocking protection of the sub-region to be operated includes: Read the corresponding device linked list node according to the written Flash device number, and obtain a number of sub-areas to be operated according to the written address; Acquire the encryption and unlocking protection granularity of the sub-area, and acquire the writable length of the sub-area to be operated according to the write address and the write data length; A write operation is performed on the sub-area to be operated according to the write address, the encryption and unlocking protection granularity, the writable length, and the data cache address.

8. The method for protecting NOR Flash chip from power failure according to claim 7, characterized in that: Performing a write operation on the sub-area to be operated according to the write address, the encryption and unlocking protection granularity, the writable length, and the data cache address includes: S210, if it is determined that the total remaining writable length of the sub-area to be operated is less than 0, then the writing of the sub-area to be operated is completed; otherwise, execute step S220; S220, calculating a first length that can be written to the current block or sector, and if the current total remaining writable length is less than the first length, configuring the first length as the current total remaining writable length; S230, releasing the lock state of the block or sector to which the current write address belongs, calling the Flash general page program interface, and writing the first length of the to-be-written data from the current write address; S240, lock the block or sector to which the current write address belongs, shift the current write address and the data cache address backward by the first length, subtract the first length from the current total remaining writable length, and return to step S210.

9. A power-off data protection system based on NOR Flash chip, using the method of any one of claims 1 to 8, characterized in that: include: The first module is used to obtain the device configuration information and sub-area boundary information of the Flash chip, store them in the device linked list node of the Flash chip, configure the Flash to an independent block protection mode in a power-off volatile manner, and release the protection status of all areas of the Flash chip; The second module is used to receive an erase / write request, pre-lock all areas, enable full protection, obtain a sub-area to be operated through area analysis according to the erase / write request, unlock each block or sector of the sub-area to be operated in turn, and perform an erase / write operation according to the granularity of the protection of the sub-area to be operated; And, after the erase operation is completed, the protection status of all areas is released, and the erase operation status information is fed back.

10. A computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the method of any one of claims 1 to 8 when executed by a processor.

Images