Embedded system and method for controlling non-volatile memory

Abstract

A method for controlling a non-volatile memory. The non-volatile memory includes a first block and a second block. The first block stores a first firmware program. The second block stores a second firmware program. The method includes comparing the version of the first firmware program with the version of the second firmware program, and if the comparison result of the first firmware program and the second firmware program shows that the second firmware program is newer than the first firmware program, booting the computer using the second firmware program, and if the booting is successful, copying a portion of an image file to the first block to update the first firmware program when a firmware update is required after booting.

Description

Technical Field

[0001] The present invention relates to firmware update, and in particular to a control method of a non-volatile memory. Background Art

[0002] An embedded system is a computing system that is embedded in a mechanical or electrical system to perform a specific function. Embedded systems cover a variety of microcomputer-controlled devices and can be driven by firmware to handle a variety of situations to meet a variety of different needs.

[0003] For embedded systems, firmware updates can not only fix bugs and provide new features, but also extend the life cycle of embedded systems, which is a very important function. However, if the upgrade fails, the embedded system may not be able to run and provide normal functions. Summary of the invention

[0004] An embodiment of the present invention provides a method for controlling a non-volatile memory. The non-volatile memory includes a first block and a second block, wherein the first block stores a first firmware program, and the second block stores a second firmware program. The method includes comparing a first version number of the first firmware program and a second version number of the second firmware program, and if the comparison result of the first version number and the second version number shows that the second firmware program is newer than the first firmware program, booting the computer using the second firmware program, and if the second firmware program boots successfully, copying a portion of an image file to the first block to update the first firmware program when a firmware update is required after booting the computer.

[0005] An embodiment of the present invention provides another method for controlling a non-volatile memory. The non-volatile memory includes a first block and a second block, the first block stores a first firmware program, and the second block stores a second firmware program. The method includes comparing a first version number of the first firmware program and a second version number of the second firmware program, if the comparison result of the first version number and the second version number shows that the second firmware program is newer than the first firmware program, then using the second firmware program to boot, and if the booting using the second firmware program fails, then using the first firmware program to boot.

[0006] An embodiment of the present invention provides an embedded system, comprising a non-volatile memory and a processor. The non-volatile memory comprises a first block for storing a first firmware program, and a second block for storing a second firmware program. The processor is coupled to the non-volatile memory, and is used to compare a first version number of the first firmware program with a second version number of the second firmware program. If the comparison result of the first version number and the second version number shows that the second firmware program is newer than the first firmware program, the second firmware program is used for booting, and if the second firmware program is successfully booted, a part of the image file is copied to the first block to update the first firmware program when a firmware update is required after booting.

[0007] An embodiment of the present invention provides another embedded system, comprising a non-volatile memory and a processor. The non-volatile memory comprises a first block for storing a first firmware program, and a second block for storing a second firmware program. The processor is coupled to the non-volatile memory, and is used to compare a first version number of the first firmware program with a second version number of the second firmware program, and if the comparison result of the first version number and the second version number shows that the second firmware program is newer than the first firmware program, the second firmware program is used for booting, and if the booting using the second firmware program fails, the first firmware program is used for booting. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 It is a block diagram of an embedded system in an embodiment of the present invention.

[0009] Figure 2A and Figure 2B yes Figure 1 Flow chart of a control method of a non-volatile memory in.

[0010] Figure 3 yes Figure 1 Schematic diagram of the firmware image file in .

[0011] Figure 4 show Figure 1 Schematic diagram of a firmware update method for a non-volatile memory in FIG.

[0012] Figure 5 show Figure 1 Schematic diagram of another firmware update method of the non-volatile memory in.

[0013] Figure 6 yes Figure 1 Schematic diagram of the linker generating the firmware image file. DETAILED DESCRIPTION

[0014] Figure 11 is a block diagram of an embedded system 1 in an embodiment of the present invention. The embedded system 1 may be a mobile phone, an audio and video player, a game console, a digital camera, a household device, a car device or a positioning device. The embedded system 1 stores a firmware program for driving the components of the embedded system 1 to start up. The embedded system 1 can provide services and update the firmware program at the same time after normal startup, and can restore the firmware program before the update when the update fails, thereby providing the firmware program update fault tolerance capability. In addition, the embedded system 1 can reduce the number of times the firmware program is written to the same memory location, thereby extending the life of the memory.

[0015] The embedded system 1 may include a processor 10 and a non-volatile memory 12. The non-volatile memory 12 may be a NOR-type flash memory, including blocks 120, 122, and 126. The memory sizes of blocks 122 and 126 may be equal. When shipped from the factory, blocks 122 and 126 may store the same version of firmware programs, respectively. When the firmware is updated, the processor 10 may update different versions of firmware programs alternately in blocks 122 and 126 in sequence. When booting, the processor 10 may first execute the newer firmware programs in blocks 122 and 126. Once an error occurs in the newer firmware program and causes a boot failure, the processor 10 may execute the older firmware programs in blocks 122 and 126 to reboot, ensuring that the embedded system 1 can boot.

[0016] Specifically, block 122 may store a first firmware program, including a firmware header 123, a firmware program code 124, and a correctness check code 125. Block 126 may store a second firmware program, including a firmware header 127, a firmware program code 128, and a correctness check code 129. The first firmware program and the second firmware program may be two identical or different versions of firmware programs, respectively, implemented using execution in place (XIP) code. When using XIP code, the processor 10 may access instructions directly from the non-volatile memory 12 without copying the firmware program to the internal memory. The firmware header 123 may include an update date, a version number, a firmware program size, a firmware identification code, and an address of the correctness check code 125 of the first firmware program. The correctness check code 125 may be a header signature or other error detection code of the first firmware program, such as a cyclic redundancy check code (CRC) or a digital signature signed by a certificate. The firmware header 127 may include the update date, version number, firmware size, firmware identification code, and address of the correctness check code 129 of the second firmware program. The correctness check code 129 may be a header signature or other error detection code of the second firmware program.

[0017] Block 120 may store a boot loader code 121. The processor 10 may execute the boot loader code 121 to select the first firmware program or the second firmware program to boot up. The boot loader code 121 may implement Figure 2A and Figure 2B Flowchart of the control method 200 of the non-volatile memory 12 in the embodiment. The control method 200 includes steps S202 to S228, wherein steps S202, S204, S206 and S208 are used to determine the correctness of the first firmware program and the second firmware program, step S205 is used to use the second firmware program to boot up after the first firmware program fails to pass the correctness check, step S209 is used to use the first firmware program to boot up after the second firmware program fails to pass the correctness check, step S210 is used to determine which of the first firmware program and the second firmware program is newer, when it is determined that the first firmware program is newer, steps S212 to S218 are used to boot up and update the firmware, and when it is determined that the second firmware program is newer, steps S222 to S228 are used to boot up and update the firmware. Any reasonable technical changes or step adjustments fall within the scope disclosed by the present invention. Steps S202 to S228 are as follows:

[0018] Step S202: the processor 10 checks the correctness of the first firmware program;

[0019] Step S204: The processor 10 determines whether the first firmware program passes the correctness check. If yes, execute step S206; if no, execute step S205;

[0020] Step S205: The processor 10 uses the firmware program code 128 to boot up.

[0021] Step S206: the processor 10 checks the correctness of the second firmware program;

[0022] Step S208: The processor 10 determines whether the second firmware program passes the correctness check. If yes, execute step S210; if no, execute step S209;

[0023] Step S209: The processor 10 uses the firmware program code 124 to boot up.

[0024] Step S210: The processor 10 compares the version number of the first firmware program and the version number of the second firmware program; if the first firmware program is newer or the two firmware programs are the same version, execute step S212; if the second firmware program is newer, execute step S222;

[0025] Step S212: The processor 10 uses the firmware program code 124 to start up;

[0026] Step S214: The processor 10 determines whether the boot is successful. If yes, execute step S216; if no, execute step S218;

[0027] Step S216: When the firmware needs to be updated, the processor 10 copies the second part of the firmware image file to the memory block 126.

[0028] Step S218: The processor 10 uses the firmware program code 128 to boot up.

[0029] Step S222: The processor 10 uses the firmware program code 128 to start up;

[0030] Step S224: The processor 10 determines whether the boot is successful. If yes, execute step S226; if no, execute step S228;

[0031] Step S226: When the firmware needs to be updated, the processor 10 copies the first part of the firmware image file to the memory block 122.

[0032] Step S228: The processor 10 uses the firmware program code 124 to boot up.

[0033] When the correctness check code 125 and the correctness check code 129 are header signatures, in step S202, the processor 10 reads the firmware header 123 from the block 122, uses a predetermined hash algorithm to calculate the hash value of the firmware header 123, reads the correctness check code 125 according to the address of the correctness check code 125 in the firmware header 123, and determines whether the hash value of the firmware header 123 and the correctness check code 125 match to check the correctness of the first firmware program. The hash algorithm can be a SHA-256 algorithm. In some embodiments, the correctness of the correctness check code 125 can also be checked by digital signature in step S202. In step S204, when the hash value of the firmware header 123 and the correctness check code 125 match each other, the processor 10 determines that the first firmware program passes the correctness check; and when the hash value of the firmware header 123 and the correctness check code 125 do not match, the processor 10 determines that the first firmware program fails the correctness check. Similarly, in step S206, the processor 10 reads the firmware header 127 from the block 126, uses a predetermined hash algorithm to calculate the hash value of the firmware header 127, reads the correctness check code 129 according to the address of the correctness check code 129 in the firmware header 127, and determines whether the hash value of the firmware header 127 and the correctness check code 129 match to check the correctness of the second firmware program. In some embodiments, the correctness of the correctness check code 129 can also be checked by digital signature in step S206. In step S208, when the hash value of the firmware header 127 and the correctness check code 129 match each other, the processor 10 determines that the second firmware program passes the correctness check; and when the hash value of the firmware header 127 and the correctness check code 129 do not match, the processor 10 determines that the second firmware program fails the correctness check. If the first firmware program fails the correctness check, the processor 10 uses the firmware program code 128 of the second firmware program to boot (step S205 ); if the second firmware program fails the correctness check, the processor 10 uses the firmware program code 124 of the first firmware program to boot (step S209 ).

[0034] If both the first firmware program and the second firmware program pass the correctness check, it means that both are correct. The processor 10 obtains the version number of the first firmware program from the firmware header 123 and the version number of the second firmware program from the firmware header 127, and then compares the version number of the first firmware program and the version number of the second firmware program to determine which one is newer (step S210). In some embodiments, a larger version number indicates a newer firmware program. The processor 10 can determine which of the version number of the first firmware program and the version number of the second firmware program is larger, and determine that the firmware program with the larger version is the newer firmware program. When the version number of the first firmware program and the version number of the second firmware program are the same, it means that the first firmware program and the second firmware program are firmware programs of the same version.

[0035] When the first firmware program is newer, the processor 10 uses the firmware program code 124 to boot up (step S212), and determines whether the boot up is successful (step S214). If the predetermined number of reboots is exceeded within the predetermined time, the processor 10 determines that the boot up has failed; if the predetermined number of reboots is not exceeded within the predetermined time, the processor 10 determines that the boot up has succeeded. For example, the predetermined time may be 10 minutes, and the predetermined number of reboots may be 3. If the actual number of reboots within 10 minutes is 4, the processor 10 determines that the boot up has failed; if the actual number of reboots within 10 minutes is 1, the processor 10 determines that the boot up has succeeded. In some embodiments, the processor 10 may use a watchdog timer to calculate the actual number of reboots. The initial value of the actual number of reboots is 0. The watchdog timer may be reset at a timeout, such as 20 seconds. The watchdog timer is reset after each boot up. If the boot is normal, the processor 10 will reset the watchdog timer within 20 seconds. If the boot is abnormal, the processor 10 cannot reset the watchdog timer within 20 seconds, and the watchdog timer will expire after 20 seconds. When the watchdog timer expires, the processor 10 will increase the actual number of restarts and restart the machine. If the boot using the firmware program code 124 fails, the processor 10 will use the firmware program code 128 to boot (step S218). If the boot using the firmware program code 124 is successful, when the firmware needs to be updated, the processor 10 will copy the second part of the firmware image file to the memory block 126 to update the second firmware program (step S216). The processor 10 can update the first firmware program in the background program.

[0036] Similarly, when the second firmware program is newer, the processor 10 uses the firmware program code 128 to boot up (step S222), and determines whether the boot up is successful (step S224). If the boot up fails using the firmware program code 128, the processor 10 uses the firmware program code 124 to boot up (step S228). If the boot up is successful using the firmware program code 128, when the firmware needs to be updated, the processor 10 copies the first part of the firmware image file to the memory block 122 to update the first firmware program (step S226). The processor 10 can update the second firmware program in the background program.

[0037] When the versions of the first firmware program and the second firmware program are the same, the processor 10 may preset the firmware program code 124 to boot up (step S212), and determine whether the boot up is successful (step S214). If the boot up fails using the firmware program code 124, the processor 10 will use the firmware program code 128 to boot up (step S218). If the boot up is successful using the firmware program code 124, when the firmware needs to be updated, the processor 10 will copy the second part of the firmware image file to the memory block 126 to update the second firmware program (step S216).

[0038] The embedded system 1 will update blocks 122 and 126 in turn, reducing the number of times the firmware program is written to the same memory location, thereby extending the life of the memory. The embedded system 1 will execute the new firmware to boot up, and when the new firmware fails to boot up, it will use the old firmware that was previously running normally to boot up again, thereby providing the ability to update the firmware program fault-tolerantly. Since the difference between executing the new firmware and executing the old firmware is only the switching of the firmware programs within the execution blocks 122 and 126, the boot time required for the embedded system 1 is the same, and no additional time is required to restore the firmware program, thereby reducing the boot time. In addition, since the firmware update occurs in a memory block that is not in use and can be executed in a background program, the embedded system 1 can continue to provide services without interruptions due to firmware updates, providing a better user experience.

[0039] refer to Figure 1 Before updating the firmware, an external device, such as a computer, generates a target code and loads a linker to generate a firmware image file 102. The firmware image file 102 is an executable file and may include a first part 104 and a second part 106, which are XIP codes of the same firmware program linked to different execution addresses and have the same version number. Figure 31 is a schematic diagram of a firmware image file 102, wherein a first portion 104 includes a new firmware header 303, a new firmware program code 304, and a new correctness check code 305, and a second portion 106 includes a new firmware header 307, a new firmware program code 308, and a new correctness check code 309. The new firmware program code 304 may correspond to an address in block 122, and the new firmware program code 308 may correspond to an address in block 126. When updating the firmware, if the first firmware program is successfully used to boot up the computer, the processor 10 may copy the second portion 106 to block 126 to update the second firmware program, such as Figure 4 If the second firmware program is successfully booted this time, the processor 10 may copy the first portion 104 to block 122 to update the first firmware program, such as Figure 5 The firmware update method of the non-volatile memory 12 is shown in FIG. Figure 4 The original firmware header 127 , firmware program code 128 and correctness check code 129 in the display block 126 are updated to a new firmware header 307 , a new firmware program code 308 and a new correctness check code 309 . Figure 5 The original firmware header 123 , firmware program code 124 and correctness check code 125 in the display block 122 are updated to a new firmware header 303 , a new firmware program code 304 and a new correctness check code 309 .

[0040] Figure 6 1 is a schematic diagram of a linker 600 generating a firmware image file 102. The linker 600 can be loaded by an external computer device to generate a first firmware and a second firmware. The computer device can also be used to generate the firmware image file 102. The linker 600 can receive a firmware object code 60, address parameters 62 and 64. The firmware object code 60 can be a machine code or other code close to a machine language, which is generated by a compiler or an assembler processing source code. The address parameter 62 can include the starting address and space size of the block 122, and the address parameter 64 can include the starting address and space size of the block 126. The linker 600 can generate a set of XIP addresses 66 corresponding to the block 122 according to the firmware object code 60 and the address parameter 62, and generate a set of XIP addresses 68 corresponding to the block 126 according to the firmware object code 60 and the address parameter 64. Next, the linker 600 may generate the first part 104 according to the firmware object code 60 and the set of XIP addresses 66, and may generate the second part 106 according to the firmware object code 60 and the set of XIP addresses 68. The first part 104 and the second part 106 may be executable files. Finally, the linker 600 may package the first part 104 and the second part 106 to generate the firmware image file 102.

[0041] Although Figure 1 , Figures 3 to 6The embodiment in the embodiment only divides the non-volatile memory 12 into blocks 120, 122 and 126. In some embodiments, the non-volatile memory 12 can also be divided into more blocks to store more firmware. When updating the firmware, the processor 10 can store the firmware to be updated in the non-using blocks in turn according to the aforementioned firmware update principle. When booting, the processor 10 can select the latest firmware program from multiple firmwares for booting according to the aforementioned firmware selection principle. If the boot fails, the processor 10 can select the next latest firmware program from multiple firmwares to continue booting until the boot is successful.

[0042] Figures 1 to 6 The embodiment provides a firmware upgrade method that can continuously provide services, is efficient and has fault tolerance, and effectively extends the life of the non-volatile memory 12.

[0043] The above description is only a preferred embodiment of the present invention. Any equivalent changes and improvements made within the scope of the patent application of the present invention shall fall within the protection scope of the present invention.

[0044] Description of Reference Numerals

[0045] 1: Embedded Systems

[0046] 10: Processor

[0047] 102: Firmware image file

[0048] 104: Part 1

[0049] 106: Part 2

[0050] 12: Non-volatile memory

[0051] 120,122,126: Blocks

[0052] 121: Boot program code

[0053] 123,127: Firmware header

[0054] 124,128: Firmware code

[0055] 125,129: Correctness check code

[0056] 200: Control Method

[0057] S202 to S228: Steps

[0058] 303,307: New firmware header

[0059] 304,308: New firmware code

[0060] 305,309: New correctness check code

[0061] 600: Linker

[0062] 60: Firmware target code

[0063] 62,64: Address parameters

[0064] 66,68:XIP address

Claims

1. A method for controlling a non-volatile memory, the non-volatile memory comprising a first block and a second block, the first block storing a first firmware program, the second block storing a second firmware program, the method comprising: generating a first portion of a firmware image file for updating a first firmware program; generating a second part of a firmware image file for updating a second firmware program, wherein the first part of the firmware image file and the second part of the firmware image file have the same version number; comparing a first version number of the first firmware program and a second version number of the second firmware program; If the comparison result of the first version number and the second version number shows that the second firmware program is newer than the first firmware program, using the second firmware program to boot up; If the comparison result of the first version number and the second version number shows that the first firmware program is newer than the second firmware program, the first firmware program is used to boot the computer; as well as If the second firmware program is successfully started, when a firmware update is required after the startup, the first part of the firmware image file is copied to the first block to update the first firmware program; If the first firmware program is successfully started, then when firmware update is required after startup, the second part of the firmware image file is copied to the second block to update the second firmware program. 2 . The method of claim 1 , wherein the first portion and the second portion of the image file are on-chip executable codes. The method of claim 1 , wherein the first firmware program is updated in a background program.

4. The method of claim 1, further comprising: determining the correctness of the first firmware program and the correctness of the second firmware program; Wherein comparing the first version number of the first firmware program and the second version number of the second firmware program comprises: When the first firmware program and the second firmware program are both correct, the first version number and the second version number are compared.

5. The method of claim 1 further comprises determining that the boot is successful if the number of reboots is not exceeded within a predetermined time.

6. The method of claim 1, further comprising determining that the booting has failed if the number of reboots is reached within a predetermined time.

7. An embedded system comprising: Non-volatile memory, including: The first block is used to store a first firmware program; and The second block is used to store a second firmware program; as well as a processor, coupled to the non-volatile memory, for comparing a first version number of the first firmware program with a second version number of the second firmware program; If the comparison result of the first version number and the second version number shows that the second firmware program is newer than the first firmware program, using the second firmware program to boot up; If the comparison result of the first version number and the second version number shows that the first firmware program is newer than the second firmware program, the first firmware program is used to boot the computer; as well as If the second firmware program is successfully started, then when a firmware update is required after the startup, the first part of the firmware image file is copied to the first block to update the first firmware program; If the first firmware program is successfully started, then when a firmware update is required after the startup, the second part of the firmware image file is copied to the second block to update the second firmware program; The first part of the firmware image file and the second part of the firmware image file are on-chip execution codes having the same version number.

8. The embedded system as claimed in claim 7, wherein the processor further determines the correctness of the first firmware program and the correctness of the second firmware program, and compares the first version number and the second version number when both the first firmware program and the second firmware program are correct.

9. The embedded system of claim 7, wherein the processor updates the first firmware program in a background program.

Images