Method for processing programs of a domain controller

Abstract

The application discloses a program processing method of a domain controller. The method is applied to the domain controller, the domain controller comprises at least two M cores, at least one A core, a first storage medium and a second storage medium, the first storage medium comprises a boot program of the domain controller, the second storage medium comprises M core application programs, a configuration file of the domain controller and A core related programs, and the method comprises the following steps: the A core checks whether each program in the second storage medium can be read and written; if each program in the second storage medium can be read and written, the A core updates to-be-updated programs in the second storage medium based on the configuration file and a downloaded update file; and if at least one program cannot be read and written, a first M core in the at least two M cores executes the boot program of the domain controller, formats the damaged program through the boot program of the domain controller, and updates the to-be-updated programs based on the configuration file and the downloaded update file.

Description

Technical Field

[0001] This invention relates to the field of automotive technology, and more specifically, to a method for processing a domain controller. Background Technology

[0002] As car users' demands for vehicle functionality increase, traditional distributed automotive electronics products struggle to meet the rapidly changing and highly customized needs of car users, and also fail to satisfy OEMs' requirements for quick response to customer demands while limiting R&D costs. Domain controllers have emerged in this context. First, domain controllers can use high-performance multi-core MCUs (Microcontroller Units) to replace traditional single-core MCUs, improving product performance and enhancing the user experience. Second, domain controllers can simultaneously integrate multiple high-real-time vehicle control functions and multiple non-real-time functions, revolutionizing the traditional single-function design of electronic products, increasing integration, and reversing the trend of ever-increasing ECU numbers in vehicles. This allows OEMs to reduce vehicle wiring harness length and vehicle weight, achieving cost control goals. Finally, domain controllers support OTA (Over-the-Air Technology) updates and more customized designs, enabling OEMs to meet customers' high customization needs and improve the market competitiveness of their vehicles.

[0003] like Figure 1 As shown, in related technologies, a domain controller includes an MCU (Microcontroller Unit), which integrates multiple cores of different functions. These include at least one A-core (core with strong computing power, primarily responsible for data processing and computation), and at least one M-core (core that performs real-time control functions). The M-core's code is mainly stored in the MCU's internal Flash memory, which includes the domain controller's bootloader and M-core applications. The A-core's code is mainly stored in the external EMMC (Embedded Multi MediaCard Flash), which includes the A-core bootloader, A-core system program, A-core application set, and the domain controller's configuration file. During domain controller program updates, the A-core manages the update process. The A-core downloads update files from a diagnostic tool or remote server and then updates the programs of the M-core or A-core according to the update files. However, the A-core runs on a Linux operating system, which has certain software vulnerabilities. On the one hand, the system may malfunction after running for a certain period; on the other hand, it may be attacked by hackers, rendering it inoperable or allowing them to steal its information. Therefore, improving the security and reliability of domain controller program updates is an urgent problem to be solved. Summary of the Invention

[0004] This invention provides a method for processing the program of a domain controller, which can securely update the program of the domain controller, thereby improving the reliability of the program update of the domain controller.

[0005] The specific technical solution is as follows:

[0006] In a first aspect, embodiments of the present invention provide a program processing method for a domain controller. The method is applied to a domain controller, which includes at least two M-cores, at least one A-core, a first storage medium, and a second storage medium. Both the M-cores and the A-cores have read and write permissions to the second storage medium, and the M-cores have read and write permissions to the first storage medium. The first storage medium includes a bootloader for the domain controller, and the second storage medium includes an M-core application program, a configuration file for the domain controller, and related programs for the A-cores. The method includes:

[0007] The A core checks whether each program in the second storage medium can be read and written;

[0008] If all programs in the second storage medium can be read and written, then the A core updates the programs to be updated in the second storage medium based on the configuration file and the downloaded update file;

[0009] If at least one program cannot be read or written, the first M core of the at least two M cores executes the domain controller's bootloader, formats the corrupted program through the domain controller's bootloader, and updates the program to be updated based on the configuration file and the downloaded update file.

[0010] In one implementation, when each program in the second storage medium includes two copies of the program that are mutually backed up, the A core updates the program to be updated in the second storage medium based on the configuration file and the downloaded update file, including:

[0011] The A core obtains the program identifier of the valid program recorded in the target configuration file, and identifies another program that is backed up with the valid program as the program to be updated. The target configuration file is a configuration file with normal content, and the valid program includes at least one program in the second storage medium other than the configuration file.

[0012] Download the update file corresponding to the program to be updated from the preset update device, and replace the program to be updated with the update file at the storage location of the program to be updated.

[0013] In one implementation, when the first configuration file is the primary configuration file and the second configuration file is the backup configuration file, before the A core obtains the program identifier of the valid program recorded in the target configuration file, the method further includes:

[0014] If the first configuration file does not have any abnormalities, then the first configuration file will be used as the target configuration file;

[0015] If the first configuration file is abnormal and the second configuration file is not abnormal, then the contents of the second configuration file are copied into the first configuration file, and the copied first configuration file is determined as the target configuration file;

[0016] If both the first configuration file and the second configuration file are abnormal, then the first configuration file and the second configuration file are restored to their default values, and the first configuration file after restoring the default values ​​is determined as the target configuration file.

[0017] In one implementation, the corrupted program is formatted using the domain controller's bootloader, and the program to be updated is updated based on the configuration file and downloaded update files, including:

[0018] The domain controller's bootloader checks the damage status of each partition of the second storage medium, identifies the programs in the damaged partitions as damaged programs, and formats the damaged partitions.

[0019] If the second storage medium is fully formatted, the domain controller's bootloader restores the first configuration file and the second configuration file to their default values, and updates the program to be updated based on the first configuration file after restoring the default values ​​and the downloaded update file.

[0020] If the first configuration file is formatted and the second configuration file is not formatted, the bootloader of the domain controller copies the contents of the second configuration file into the first configuration file, and updates the program to be updated based on the copied first configuration file and the downloaded update file.

[0021] If the first configuration file is not formatted, the domain controller's bootloader updates the program to be updated based on the first configuration file and the downloaded update file.

[0022] In one implementation, after updating the program to be updated, the method further includes:

[0023] When the second storage medium is updated based on the A core, the A core checks the validity of the update file by running a code update program. If the update file is valid, the A core changes the program identifier of the valid program recorded in the target configuration file to the program identifier of the program corresponding to the update file by running the code update program. If the update file is invalid, the A core replaces the update file with the valid program at the storage location of the program to be updated by running the code update program.

[0024] When updating the second storage medium based on the first M-core, the first M-core checks the validity of the update file by running the domain controller's bootloader. If the update file is valid, the first M-core changes the program identifier of the valid program recorded in the target configuration file to the program identifier of the program corresponding to the update file by running the domain controller's bootloader. If the update file is invalid, the first M-core replaces the update file with the valid program at the storage location of the program to be updated by running the domain controller's bootloader.

[0025] In one implementation, after updating the program to be updated, the method further includes:

[0026] The update result is sent back to the device to be updated. The update result includes successful update, abnormal update file, or the program to be updated was successfully updated but was corrupted. At least one program was formatted and not updated.

[0027] In one implementation, the domain controller further includes a read-only storage area, the first storage medium further includes a backup of the M-core application, the A-core related programs include an A-core application set, an A-core bootloader, and an A-core system program, and before the A-core checks whether each program in the second storage medium is readable and writable, the method further includes:

[0028] After the preset secure boot process is successfully executed in the read-only storage area, the bootloader of the domain controller is loaded into the first M core, so that the first M core runs the bootloader of the domain controller.

[0029] The domain controller's bootloader determines whether the second storage medium can boot normally;

[0030] If the second storage medium fails to boot normally, the domain controller's bootloader loads the backed-up M-core application in the first storage medium and starts other M-cores to run the backed-up M-core application. The first M-core continues to run the domain controller's bootloader and enters a waiting-for-update state. The other M-cores include the M-cores other than the first M-core among the at least two M-cores.

[0031] If the second storage medium can boot normally, the domain controller's bootloader loads the M-core application, the A-core bootloader, and the A-core system program from the second storage medium according to the configuration file, and starts the other M-cores to run the M-core application from the second storage medium. Based on the A-core bootloader and the A-core system program, the A-core is started so that the A-core can run the A-core application set. After the A-core starts successfully, the first M-core stops running the domain controller's bootloader and runs the M-core application from the second storage medium in parallel with the other M-cores.

[0032] In one embodiment, the method further includes:

[0033] The domain controller's bootloader determines whether the version of the M-core application in the second storage medium is higher than that of the backed-up M-core application, and whether the M-core application in the second storage medium can start normally.

[0034] If all the judgment results are yes, the boot program of the domain controller will copy the M-core application in the second storage medium to the storage location of the backed-up M-core application in order to replace the original content of the backed-up M-core application.

[0035] If the M-core application in the second storage medium fails to start normally, the bootloader of the domain controller copies the backed-up M-core application to the storage location of the M-core application in the second storage medium in order to replace the original content of the M-core application in the second storage medium.

[0036] In one implementation, when each program in the second storage medium includes two copies of the program that are mutually backed up, the domain controller's bootloader loads the M-core application, the A-core bootloader, and the A-core system program from the second storage medium according to the configuration file, including:

[0037] The domain controller's bootloader obtains the program identifier of a valid program in the target program recorded in the target configuration file. The target configuration file is a normal configuration file, and the target program includes an M-core application, the A-core bootloader, or the A-core system program.

[0038] The domain controller's bootloader determines whether the program corresponding to the program identifier is abnormal;

[0039] If the program corresponding to the program identifier is normal, then the target program is loaded;

[0040] If the program corresponding to the program identifier is abnormal, then determine whether another copy of the target program is abnormal;

[0041] If the other copy of the target program is normal, then load the other copy of the target program;

[0042] If the other copy of the target program is abnormal, then when the target program is an M-core application, the M-core application backed up in the first storage medium is loaded; when the target program is an A-core bootloader or an A-core system program, loading the target program is stopped.

[0043] In one embodiment, the domain controller further includes a High-Speed ​​Network Link Encryption (HSE), and the first storage medium further includes a backup of the domain controller's bootloader, firmware of the HSE and a backup of the firmware, boot configuration data of the domain controller and a backup of the boot configuration data, and boot self-test configuration data of the domain controller and a backup of the boot self-test configuration data.

[0044] Secondly, embodiments of the present invention provide a program processing apparatus for a domain controller. The apparatus is applied to a domain controller, which includes at least two M-cores, at least one A-core, a first storage medium, and a second storage medium. Both the M-cores and the A-cores have read and write permissions to the second storage medium, and the M-cores have read and write permissions to the first storage medium. The first storage medium includes a bootloader for the domain controller, and the second storage medium includes an M-core application program, a configuration file for the domain controller, and A-core related programs. The apparatus includes:

[0045] A storage medium checking unit is used by the A core to check whether each program in the second storage medium can be read and written;

[0046] The first update unit is used to update the program to be updated in the second storage medium based on the configuration file and the downloaded update file when all programs in the second storage medium are readable and writable.

[0047] The second update unit is configured to, when at least one program cannot be read or written, have the first M core among the at least two M cores execute the domain controller's bootloader, format the corrupted program through the domain controller's bootloader, and update the program to be updated based on the configuration file and the downloaded update file.

[0048] In one implementation, the first updating unit includes:

[0049] The first acquisition module is used to acquire the program identifier of the valid program recorded in the target configuration file when each program in the second storage medium includes two mutually backed-up programs. The target configuration file is a configuration file with normal content, and the valid program includes at least one program in the second storage medium other than the configuration file.

[0050] The first determining module is used to determine another copy of the program that is mutually backed up with the effective program as the program to be updated.

[0051] The first download module downloads the update file corresponding to the program to be updated from a preset update device;

[0052] The first update module is used to replace the program to be updated with the update file at the storage location of the program to be updated.

[0053] In one embodiment, the first updating unit further includes:

[0054] The second determining module is used to determine the target configuration file if the first configuration file is not abnormal before the A core obtains the program identifier of the valid program recorded in the target configuration file when the first configuration file is the main configuration file and the second configuration file is the backup configuration file.

[0055] The first copy module is used to copy the contents of the second configuration file into the first configuration file when the first configuration file is abnormal and the second configuration file is not abnormal.

[0056] The second determining module is further configured to determine the copied first configuration file as the target configuration file;

[0057] The first recovery module is used to restore the first configuration file and the second configuration file to their default values ​​when both the first configuration file and the second configuration file are abnormal.

[0058] The second determining module is further configured to determine the first configuration file after restoring the default value as the target configuration file.

[0059] In one implementation, the second updating unit includes:

[0060] The inspection module is used to inspect the damage status of each partition of the second storage medium by the boot program of the domain controller;

[0061] The formatting module is used to identify the program in the damaged partition as a damaged program and to format the damaged partition.

[0062] The second recovery module is used to restore the first configuration file and the second configuration file to their default values ​​when the second storage medium is fully formatted.

[0063] The second update module is used to update the program to be updated based on the first configuration file after restoring the default values ​​and the downloaded update file;

[0064] The second copy module is used to copy the contents of the second configuration file into the first configuration file when the first configuration file is formatted and the second configuration file is not formatted;

[0065] The second update module is also used to update the program to be updated based on the copied first configuration file and the downloaded update file;

[0066] The second update module is further configured to update the program to be updated based on the first configuration file and the downloaded update file when the first configuration file is not formatted.

[0067] In one embodiment, the device further includes:

[0068] The update file checking unit is configured to, after updating the program to be updated, when updating the second storage medium based on the A core, have the A core check the legality of the update file by running a code update program, and when updating the second storage medium based on the first M core, have the first M core check the legality of the update file by running the boot program of the domain controller.

[0069] The modification unit is configured to, when the code updater determines that the update file is valid, change the program identifier of the valid program recorded in the target configuration file to the program identifier of the program corresponding to the update file; and when the bootloader of the domain controller determines that the update file is valid, change the program identifier of the valid program recorded in the target configuration file to the program identifier of the program corresponding to the update file.

[0070] The first update unit is further configured to, when the code updater determines that the update file is invalid, replace the program to be updated with the update file at the storage location of the program to be updated.

[0071] The second update unit is further configured to, when the bootloader of the domain controller determines that the update file is invalid, replace the program to be updated with the update file at the storage location of the program to be updated.

[0072] In one embodiment, the device further includes:

[0073] The feedback unit is used to provide feedback results to the device to be updated after updating the program to be updated. The update results include successful update, abnormal update file, or the program to be updated was successfully updated but was corrupted and formatted without being updated.

[0074] In one embodiment, the domain controller further includes a read-only storage area, the first storage medium further includes a backup of the M-core application, the A-core related programs include an A-core application set, an A-core bootloader, and an A-core system program, and the apparatus further includes:

[0075] The first loading unit is configured to load the domain controller's bootloader into the first M core after the preset secure boot process is successfully executed in the read-only storage area, before the A core checks whether each program in the second storage medium can be read and written, so that the first M core runs the domain controller's bootloader.

[0076] The first judgment unit is used to determine whether the second storage medium can be started normally through the boot program of the domain controller;

[0077] The second loading unit is used to load the M-core application backed up in the first storage medium by the boot program of the domain controller when the second storage medium fails to start normally.

[0078] The first startup unit is used to start other M-cores to run the backup M-core application;

[0079] The running unit is used for the first M-core to continuously run the boot program of the domain controller and enter a waiting update state, wherein the other M-cores include the M-cores other than the first M-core among the at least two M-cores;

[0080] The third loading unit is used to load the M-core application, the A-core boot program, and the A-core system program in the second storage medium according to the configuration file when the second storage medium can boot normally.

[0081] The second boot unit is used to start the other M cores to run the M core applications in the second storage medium, and to start the A core based on the A core boot program and the A core system program so that the A core can run the A core application set;

[0082] The running unit is also configured to, after the A core has successfully started, have the first M core stop running the boot program of the domain controller and run the M core application in the second storage medium in parallel with the other M cores.

[0083] In one embodiment, the device further includes:

[0084] The second judgment unit is used for the boot program of the domain controller to determine whether the version of the M-core application in the second storage medium is higher than that of the backed-up M-core application, and to determine whether the M-core application in the second storage medium can start normally.

[0085] The copy unit is used so that, when all judgment results are yes, the boot program of the domain controller copies the M-core application in the second storage medium to the storage location of the backed-up M-core application to replace the original content of the backed-up M-core application. If the M-core application in the second storage medium cannot start normally, the boot program of the domain controller copies the backed-up M-core application to the storage location of the M-core application in the second storage medium to replace the original content of the M-core application in the second storage medium.

[0086] In one embodiment, the third loading unit includes:

[0087] The second acquisition module is used to acquire the program identifier of the valid program in the target program recorded in the target configuration file when each program in the second storage medium includes two mutually backed-up programs. The target configuration file is a configuration file with normal content, and the target program includes the M-core application, the A-core boot program, or the A-core system program.

[0088] The judgment module is used by the bootloader of the domain controller to determine whether the program corresponding to the program identifier is abnormal;

[0089] A loading module is used to load the target program when the program corresponding to the program identifier is normal.

[0090] The judgment module is also used to determine whether another copy of the target program is abnormal when the program corresponding to the program identifier is abnormal.

[0091] The loading module is also configured to load another program of the target program when the other program of the target program is normal, and to load the backed-up M-core application in the first storage medium when the other program of the target program is abnormal, and to stop loading the target program when the target program is an M-core application and the target program is an A-core boot program or an A-core system program.

[0092] In one embodiment, the domain controller further includes a High-Speed ​​Network Link Encryption (HSE), and the first storage medium further includes a backup of the domain controller's bootloader, firmware of the HSE and a backup of the firmware, boot configuration data of the domain controller and a backup of the boot configuration data, and boot self-test configuration data of the domain controller and a backup of the boot self-test configuration data.

[0093] Thirdly, embodiments of the present invention provide a storage medium storing executable instructions thereon, which, when executed by a processor, cause the processor to implement the method described in any of the embodiments of the first aspect.

[0094] Fourthly, embodiments of the present invention provide an electronic device, comprising:

[0095] One or more processors;

[0096] Storage device for storing one or more programs.

[0097] Wherein, when the one or more programs are executed by the one or more processors, the one or more processors are made to implement the method described in any of the embodiments of the first aspect.

[0098] As can be seen from the above, the domain controller program processing method provided in this embodiment of the invention can deploy a more secure domain controller. Specifically, only the M core has read / write permissions to the first storage medium, while both the M core and the A core have read / write permissions to the second storage medium. The first storage medium includes the domain controller's bootloader, and the second storage medium includes the M core's application programs, the domain controller's configuration files, and related programs for the A core. Therefore, the second storage medium stores all programs related to updates for both the M core and the A core. Thus, when updating the domain controller's programs is required, only the second storage medium needs to be updated. Specifically, the A core checks whether each program in the second storage medium can be read / written. If all programs in the second storage medium can be read / written, the A core updates the programs to be updated in the second storage medium based on the configuration files and downloaded update files. If at least one program cannot be read / written, the first M core among at least two M cores executes the domain controller's bootloader, formats the damaged program using the domain controller's bootloader, and updates the programs to be updated based on the configuration files and downloaded update files. Therefore, compared with the related technologies that can only update related programs through the A core, the embodiments of the present invention can restore the program update process by executing the domain controller's boot program based on the first M core and formatting the damaged program when the second storage medium is abnormal. This can not only prevent the risk of domain controller abnormality or information leakage caused by using the A core for updating when the A core is attacked, but also improve the reliability of program updates in the second storage medium.

[0099] The technical effects that can also be achieved by the embodiments of the present invention include:

[0100] 1. In this embodiment of the invention, a read-only storage area can be deployed in the domain controller. A backup of the M-core application is deployed in the first storage medium, and an A-core application set, an A-core bootloader, and an A-core system program are deployed in the second storage medium. When the domain controller starts, the read-only storage area can execute a preset secure boot process, and then load the domain controller's bootloader into the first M-core, causing the first M-core to run the bootloader. The domain controller's bootloader can determine whether the second storage medium can boot normally. If it can boot normally, the domain controller's bootloader loads the program in the second storage medium for other M-cores or A-cores to run. If it cannot boot normally, the domain controller's bootloader can load the backup of the M-core application in the first storage medium for other M-cores to run. Therefore, regardless of whether the A-core is attacked and causes the second storage medium to malfunction, this embodiment of the invention can still execute the M-core application without affecting the users of the M-core application. Furthermore, when the second storage medium is not malfunctioning, the program in the second storage medium can still be successfully executed, thereby improving the security of the domain controller startup.

[0101] 2. When each program in the second storage medium includes two mutually backed-up copies, this embodiment of the invention can update the other program that is mutually backed up with the valid program without first updating the valid program recorded in the configuration file. Since the valid program is often executed upon startup, updating a program that is not currently running will not affect user operation, thus achieving an update effect that is imperceptible to the user. Furthermore, during the startup of the domain controller, if one program malfunctions, the other program can be loaded, thereby improving the success rate of the domain controller startup.

[0102] 3. When there are two configuration files, one can be set as the primary configuration file and the other as the backup configuration file. This way, when the domain controller starts up, runs, or updates, it will first verify and load the primary configuration file. As long as the primary configuration file is not abnormal, it can directly refer to the primary configuration file without having to pay attention to the backup configuration file, thereby improving the loading efficiency of the configuration file.

[0103] 4. To further improve update security, this embodiment of the invention can also verify the legality of the update file. The program will only be updated if the update file is legal.

[0104] 5. After the update is completed, by sending the update results back to the devices to be updated, the administrators of the devices to be updated can be informed of the domain controller update status in a timely and clear manner.

[0105] 6. The embodiments of the present invention can verify the M-core application versions of the two, thereby ensuring that the M-core application versions stored in the first storage medium and the second storage medium are consistent, and thus ensuring that the finally loaded M-core application is the latest and effective program.

[0106] 7. Deploying HSE (SafeNet High Speed ​​Encryption) in the domain controller can further improve the security of the domain controller.

[0107] Of course, implementing any product or method of the present invention does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0108] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0109] Figure 1 This is an architecture diagram of a domain controller provided in related technologies;

[0110] Figure 2 This is a diagram of a vehicle network architecture based on a domain controller, provided in related technologies.

[0111] Figure 3 An architecture diagram of a domain controller provided for an embodiment of the present invention;

[0112] Figure 4 A flowchart illustrating a program processing method for a domain controller provided in an embodiment of the present invention;

[0113] Figure 5 A flowchart illustrating a method for updating a domain controller according to an embodiment of the present invention;

[0114] Figure 6 A flowchart illustrating another domain controller program processing method provided in an embodiment of the present invention;

[0115] Figure 7 This is a block diagram of a program processing device for a domain controller provided in an embodiment of the present invention. Detailed Implementation

[0116] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0117] It should be noted that the terms "comprising" and "having," and any variations thereof, in the embodiments and drawings of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the steps or units listed, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0118] Figure 2 This diagram illustrates a vehicle network architecture based on domain controllers, assuming the vehicle is divided into a powertrain domain controller, a body domain controller, an infotainment domain controller, and a driver assistance domain controller. Domain controllers form a ring network via high-bandwidth buses (such as Ethernet), while internal communication within each domain controller uses lower-bandwidth buses (such as CAN (Controller Area Network) or LIN (Local Interconnect Network)). Each domain controller acts as both a gateway and the primary computing and control unit within its domain, acquiring sensor information and sending control commands to actuators via the domain's internal bus. Specifically, the powertrain domain controller controls sensors P1 to PN and actuators P1 to PN; the body domain controller controls sensors B1 to BN and actuators B1 to BN; the infotainment domain controller controls sensors I1 to IN and actuators I1 to IN; and the driver assistance domain controller controls sensors A1 to AN and actuators A1 to AN.

[0119] Figure 3This invention provides an architecture diagram of a domain controller. The domain controller includes an MCU 11, a first storage medium 12, and a second storage medium 13. The first and second storage media 12 can be located within or outside the MCU 11. The MCU 11 includes at least two M-cores 111 (only one M-core is schematically shown in the figure) and at least one A-core 112. That is, in this invention, both the M-core and the A-core are processors. Both the M-core 111 and the A-core 112 have read and write permissions to the second storage medium 13. The M-core 111 has read and write permissions to the first storage medium 12. The first storage medium 12 includes the domain controller's bootloader 121. The second storage medium 13 includes the M-core application program 131a, the domain controller's configuration file 132a, and A-core related programs. The first storage medium 12 can be an SPI-Flash (Serial Peripheral Interface Flash) memory, and the second storage medium 13 can be an eMMC-Flash memory. A bootloader is a program that boots the operating system. The bootloader 121 of the domain controller boots the operating system of the domain controller 11. The M-core application program is a program located at the application layer that runs on the M-core 111. The domain controller's configuration file includes configuration information such as the program identifiers of currently active programs. A-core related programs are those related to the startup and operation of the A-core 112.

[0120] In one implementation, such as Figure 3 As shown, the MCU 11 may further include a read-only memory area 113, and the first storage medium 12 may further include a backup M-core application program 122. The A-core related programs include an A-core application program set 133a, an A-core bootloader 134a, and an A-core system program 135a. Each program in the second storage medium 13 may include two copies of the program that are mutually backed up. That is, the second storage medium 13 also includes an M-core application program 131b, the domain controller configuration file 132b, the A-core application program set 133b, the A-core bootloader 134b, and the A-core system program 135b. The read-only memory area 113 may be a Boot-ROM (diskless boot ROM) for the chip manufacturer's built-in boot code, which cannot be modified.

[0121] In one implementation, such as Figure 3As shown, the MCU11 also includes HSE (i.e., HSE core in the figure) 114, and the first storage medium 12 also includes a backup 123 of the domain controller's boot program, firmware 124 and a backup 125 of the HSE, boot configuration data 126 and a backup 127 of the boot configuration data, boot self-test configuration data 128 and a backup 129 of the boot self-test configuration data.

[0122] The HSE114 features an accelerator for encryption algorithms and secure boot management capabilities for encryption / decryption operations and secure boot. The domain controller's boot configuration data 126 can be DCD (Device Configuration Data), and the domain controller's boot self-test configuration data 127 can be ST-DCD (Self Test Device Configuration Data).

[0123] Figure 4 This is a flowchart illustrating a program processing method for a domain controller. This method is mainly applied to domain controllers and may include the following steps:

[0124] S210: Core A checks whether each program in the second storage medium can be read and written; if each program in the second storage medium can be read and written, then proceed to step S220; if at least one program cannot be read and written, then proceed to step S230.

[0125] The A-core application set in the second storage medium includes a code update application. When the domain controller is started, the code update application is loaded into memory (such as SRAM (Static Random-Access Memory)). When an update is required, the necessary conditions for program update (such as voltage within the range of 9V to 16V) are checked before the update according to the requirements of the whole vehicle. If the update conditions are met, the A-core runs the code update application and checks whether each program in the second storage medium can be read and written.

[0126] S220: Core A updates the program to be updated in the second storage medium based on the configuration file and the downloaded update file.

[0127] If all programs in the second storage medium can be read and written, then the A core updates the program to be updated through the code update application. That is, the code update application updates the program to be updated in the second storage medium based on the configuration file and the downloaded update file.

[0128] To prevent updates from failing or programs from malfunctioning due to attacks on the second storage medium, a backup method can be used, ensuring that each program in the second storage medium has two copies that are mutually backed up. If one copy malfunctions, the other copy can be used.

[0129] When each program in the second storage medium includes two mutually backed-up copies, the A core obtains the program identifier of the valid program recorded in the target configuration file, and identifies the other mutually backed-up program as the program to be updated. The target configuration file is a normal configuration file, and the valid program includes at least one of the programs in the second storage medium other than the configuration file. The update file corresponding to the program to be updated is downloaded from a preset update device, and the update file replaces the program to be updated at the storage location of the program to be updated. Since the valid program generally runs after the domain controller starts, to avoid affecting user access to the vehicle, the valid program can be updated first, and only the mutually backed-up program can be updated.

[0130] Since the startup and updates of a domain controller often require a configuration file, when there are two configuration files, in order to improve loading efficiency, one configuration file can be used as the primary configuration file and the other as a backup configuration file. Each time the domain controller loads a configuration file, as long as the primary configuration file is free of errors, it can directly use the primary configuration file.

[0131] In one implementation, when the first configuration file is the primary configuration file and the second configuration file is the backup configuration file, before the A core obtains the program identifier of the valid program recorded in the target configuration file, if the first configuration file is not abnormal, then the first configuration file is used as the target configuration file; if the first configuration file is abnormal and the second configuration file is not abnormal, then the content of the second configuration file is copied into the first configuration file, and the copied first configuration file is determined as the target configuration file; if both the first configuration file and the second configuration file are abnormal, then the first configuration file and the second configuration file are restored to their default values, and the first configuration file after restoring the default values ​​is determined as the target configuration file.

[0132] S230: The first of at least two M-cores executes the domain controller's bootloader, formats the corrupted program using the domain controller's bootloader, and updates the program to be updated based on the configuration file and downloaded update files.

[0133] If at least one program cannot be read or written, the first M-core among the at least two M-cores executes the domain controller's boot program. The domain controller's boot program checks the damage status of each partition of the second storage medium, identifies the programs in the damaged partitions as damaged programs, and formats the damaged partitions. If the second storage medium is fully formatted, the domain controller's boot program restores the first configuration file and the second configuration file to their default values, and updates the program to be updated based on the restored first configuration file and the downloaded update file. If the first configuration file is formatted and the second configuration file is not formatted, the domain controller's boot program copies the contents of the second configuration file into the first configuration file, and updates the program to be updated based on the copied first configuration file and the downloaded update file. If the first configuration file is not formatted, the domain controller's boot program updates the program to be updated based on the first configuration file and the downloaded update file. The first M-core can be any one of the at least two M-cores, or it can be a specified M-core.

[0134] The domain controller program processing method provided in this invention enables the deployment of a more secure domain controller program processing system. Specifically, only the M-core has read / write permissions to the first storage medium, while both the M-core and A-core have read / write permissions to the second storage medium. The first storage medium includes the domain controller's bootloader, and the second storage medium includes M-core applications, the domain controller's configuration files, and related A-core programs. Therefore, the second storage medium stores all programs related to updates for both the M-core and A-core. Thus, when updating the domain controller's programs is required, only the second storage medium needs to be updated. Specifically, the A-core checks whether each program in the second storage medium can be read / written. If all programs in the second storage medium can be read / written, the A-core updates the programs to be updated in the second storage medium based on the configuration files and downloaded update files. If at least one program cannot be read / written, the first M-core among at least two M-cores executes the domain controller's bootloader, formats the corrupted program using the domain controller's bootloader, and updates the programs to be updated based on the configuration files and downloaded update files. Therefore, compared with the related technologies that can only update related programs through the A core, the embodiments of the present invention can restore the program update process by executing the domain controller's boot program based on the first M core and formatting the damaged program when the second storage medium is abnormal. This can not only prevent the risk of domain controller abnormality or information leakage caused by using the A core for updating when the A core is attacked, but also improve the reliability of program updates in the second storage medium.

[0135] In one implementation, to improve update security, after updating the program to be updated, the validity of the update file can be checked; if the update file is valid, the program identifier of the valid program recorded in the target configuration file is changed to the program identifier of the program corresponding to the update file; if the update file is invalid, the valid program is used to replace the update file at the storage location of the program to be updated.

[0136] When updating the second storage medium based on core A, core A can check the validity of the update file by running a code update application. If the update file is valid, core A changes the program identifier of the valid program recorded in the target configuration file to the program identifier of the program corresponding to the update file by running the code update application. If the update file is invalid, core A replaces the update file with the valid program at the program storage location to be updated by running the code update application. When updating the second storage medium based on core M, core M can check the validity of the update file by running the domain controller's bootloader. If the update file is valid, core M changes the program identifier of the valid program recorded in the target configuration file to the program identifier of the program corresponding to the update file by running the domain controller's bootloader. If the update file is invalid, core M replaces the update file with the valid program at the program storage location to be updated by running the domain controller's bootloader. Checking the validity of the update file includes checking its integrity and digital signature. If the update file is complete and the data signature is valid, the update file is determined to be valid; otherwise, the update file is determined to be invalid.

[0137] In one implementation, after updating the program to be updated, the update result can be fed back to the feedback device. The update result includes successful update, abnormal update file, or the program to be updated was successfully updated but at least one corrupted program was formatted and not updated. The feedback device includes a diagnostic instrument or a backend server.

[0138] In one implementation, a feasible process from program update preparation to feedback of update results is as follows: Figure 5 As shown.

[0139] S310: The A core first checks whether the vehicle is ready for a program update, i.e., whether it meets the necessary conditions for the update, such as the voltage being within the range of 9V to 16V. After the program update is ready, proceed with the subsequent steps.

[0140] S320: Core A checks whether all programs in the second storage medium can be read and written; if all programs in the second storage medium can be read and written, then proceed to step S331; if at least one program cannot be read or written, then proceed to step S341.

[0141] S331: Core A obtains the program identifier of the valid program recorded in the first configuration file, and identifies another program that is backed up with the valid program as the program to be updated.

[0142] In this embodiment of the invention, a first configuration file is used as the primary configuration file, and a second configuration file is used as a backup configuration file. When the content of the first configuration file is abnormal but the content of the second configuration file is normal, the content of the second configuration file will also be copied into the first configuration file.

[0143] S332: Core A downloads the update file corresponding to the program to be updated from the preset update device, and replaces the program to be updated with the update file at the storage location of the program to be updated.

[0144] S333: Core A checks the validity of the update file; if the update file is valid, proceed to step S334; if the update file is invalid, proceed to step S335.

[0145] S334: Core A changes the program identifier of the valid program recorded in the configuration file to the program identifier of the program corresponding to the updated file.

[0146] S335: Core A replaces the update file with the valid program at the location where the program to be updated is stored, and then Core A executes step S350.

[0147] S341: The first of at least two M-cores executes the bootloader for the domain controller.

[0148] S342: The first M-core formats the corrupted program through the domain controller's bootloader.

[0149] S343: If the second storage medium is fully formatted, the first M core restores the first and second configuration files to their default values ​​through the domain controller's bootloader; if the first configuration file is formatted and the second configuration file is not formatted, the first M core copies the contents of the second configuration file into the first configuration file through the domain controller's bootloader.

[0150] S344: The first M core obtains the program identifier of the valid program recorded in the first configuration file, and identifies another program that is backed up with the valid program as the program to be updated.

[0151] S345: The first M core downloads the update file corresponding to the program to be updated from the preset update device, and replaces the program to be updated with the update file at the storage location of the program to be updated.

[0152] S346: The first M core checks the validity of the update file; if the update file is valid, proceed to step S347; if the update file is invalid, proceed to step S348.

[0153] S347: The first M core changes the program identifier of the valid program recorded in the first configuration file to the program identifier of the program corresponding to the updated file.

[0154] S348: The first M-core replaces the update file with the valid program at the storage location of the program to be updated, and then the first M-core executes step S350.

[0155] S350: Send the update result back to the device to be fed back.

[0156] To further improve the startup security and success rate of domain controllers, another embodiment of the present invention provides a domain controller program processing method, which is mainly a domain controller startup method, such as... Figure 6 As shown, the method includes:

[0157] S410: After successfully executing the preset secure boot process in the read-only storage area, the domain controller's bootloader is loaded into the first M core, causing the first M core to run the domain controller's bootloader.

[0158] The read-only storage area executes a preset secure boot process, which includes booting based on the domain controller's boot configuration data and the domain controller's boot self-test configuration data.

[0159] S420: The domain controller's boot program determines whether the second storage medium can boot normally; if the second storage medium cannot boot normally, then proceed to step S430; if the second storage medium can boot normally, then proceed to step S440.

[0160] S430: The domain controller's bootloader loads the backed-up M-core application from the first storage medium and starts other M-cores to run the backed-up M-core application. The first M-core continues to run the domain controller's bootloader and enters a waiting-for-update state.

[0161] The other M-cores include the M-cores other than the first M-core among the at least two M-cores.

[0162] S440: The domain controller's bootloader loads the M-core application, A-core bootloader, and A-core system program from the second storage medium according to the configuration file, and starts other M-cores to run the M-core application from the second storage medium. Based on the A-core bootloader and A-core system program, the A-core is started so that the A-core can run the A-core application set. After the A-core starts successfully, the first M-core stops running the domain controller's bootloader and runs the M-core application from the second storage medium in parallel with other M-cores.

[0163] When each program in the second storage medium includes two mutually backed-up copies of the program, the specific implementation method of the domain controller's bootloader loading the M-core application, the A-core bootloader, and the A-core system program in the second storage medium according to the configuration file includes: the domain controller's bootloader obtaining the program identifier of a valid program in the target program recorded in the target configuration file, wherein the target configuration file is a normal configuration file, and the target program includes an M-core application, the A-core bootloader, or the A-core system program; the domain controller's bootloader determining whether the program corresponding to the program identifier is abnormal; if the program corresponding to the program identifier is normal, then loading the target program; if the program corresponding to the program identifier is abnormal, then determining whether the other copy of the target program is abnormal; if the other copy of the target program is normal, then loading the other copy of the target program; if the other copy of the target program is abnormal, then when the target program is an M-core application, loading the M-core application backed up in the first storage medium, and when the target program is an A-core bootloader or an A-core system program, stopping the loading of the target program.

[0164] The real-time control software (i.e., the M-core application) is backed up three times to prevent the real-time control function from failing due to network attacks. In addition to backups A and B on the second storage medium, the M-core application also has a backup on the first storage medium. Even if the A-core is attacked, causing an anomaly in the second storage medium, this embodiment of the invention can still ensure the normal operation of the M-core's real-time function, allowing the vehicle to reach a repair shop.

[0165] The domain controller's bootloader determines whether the program corresponding to the program identifier is abnormal by checking the integrity and digital signature of the program corresponding to the program identifier. If the integrity and digital signature are valid, the program corresponding to the program identifier is determined to be normal; otherwise, the program corresponding to the program identifier is determined to be abnormal.

[0166] Taking loading an M-core application as an example, assuming the M-core application in the first storage medium is represented by "M-core APP-Backup", and the M-core applications in the second storage medium are represented by "M-core APP-A" and "M-core APP-B", then if the configuration file determines that M-core APP-A needs to be loaded, but upon checking M-core APP-A, its content is found to be corrupted (integrity compromised, or digital signature verification fails), then the content of M-core APP-B is checked. If the content of M-core APP-B is normal, then M-core APP-B is loaded. If the configuration file determines that M-core APP-B needs to be loaded, but upon checking M-core APP-B, its content is found to be corrupted, then M-core APP-A is checked. If the content of M-core APP-A is normal, then M-core APP-A is loaded. If both M-core APP-A and M-core APP-B are abnormal, then M-core APP-Backup is loaded.

[0167] In one implementation, to ensure that the M-core application versions stored in the first and second storage media are consistent, thereby ensuring that the finally loaded M-core application is the latest and valid program, the domain controller's bootloader can determine whether the version of the M-core application in the second storage medium is higher than the backed-up M-core application, and whether the M-core application in the second storage medium can start normally. If both determinations are yes, the domain controller's bootloader copies the M-core application in the second storage medium to the storage location of the backed-up M-core application to replace the original content of the backed-up M-core application. If the M-core application in the second storage medium cannot start normally, the domain controller's bootloader copies the backed-up M-core application to the storage location of the M-core application in the second storage medium to replace the original content of the M-core application in the second storage medium.

[0168] Corresponding to the above method embodiments, this invention provides a program processing device for a domain controller. The device is applied to a domain controller, which includes at least two M-cores, at least one A-core, a first storage medium, and a second storage medium. Both the M-cores and the A-cores have read and write permissions to the second storage medium, and the M-cores have read and write permissions to the first storage medium. The first storage medium includes the domain controller's bootloader, and the second storage medium includes M-core applications, the domain controller's configuration files, and A-core related programs, such as... Figure 7 As shown, the device includes:

[0169] The storage medium checking unit 51 is used by the A core to check whether each program in the second storage medium can be read and written.

[0170] The first update unit 52 is used to update the program to be updated in the second storage medium based on the configuration file and the downloaded update file when all programs in the second storage medium are readable and writable.

[0171] The second update unit 53 is configured to, when at least one program cannot be read or written, have the first M core among the at least two M cores execute the boot program of the domain controller, format the damaged program through the boot program of the domain controller, and update the program to be updated based on the configuration file and the downloaded update file.

[0172] In one embodiment, the first updating unit 52 includes:

[0173] The first acquisition module is used to acquire the program identifier of the valid program recorded in the target configuration file when each program in the second storage medium includes two mutually backed-up programs. The target configuration file is a configuration file with normal content, and the valid program includes at least one program in the second storage medium other than the configuration file.

[0174] The first determining module is used to determine another copy of the program that is mutually backed up with the effective program as the program to be updated.

[0175] The first download module downloads the update file corresponding to the program to be updated from a preset update device;

[0176] The first update module is used to replace the program to be updated with the update file at the storage location of the program to be updated.

[0177] In one embodiment, the first updating unit 52 further includes:

[0178] The second determining module is used to determine the target configuration file if the first configuration file is not abnormal before the A core obtains the program identifier of the valid program recorded in the target configuration file when the first configuration file is the main configuration file and the second configuration file is the backup configuration file.

[0179] The first copy module is used to copy the contents of the second configuration file into the first configuration file when the first configuration file is abnormal and the second configuration file is not abnormal.

[0180] The second determining module is further configured to determine the copied first configuration file as the target configuration file;

[0181] The first recovery module is used to restore the first configuration file and the second configuration file to their default values ​​when both the first configuration file and the second configuration file are abnormal.

[0182] The second determining module is further configured to determine the first configuration file after restoring the default value as the target configuration file.

[0183] In one embodiment, the second updating unit 53 includes:

[0184] The inspection module is used to inspect the damage status of each partition of the second storage medium by the boot program of the domain controller;

[0185] The formatting module is used to identify the program in the damaged partition as a damaged program and to format the damaged partition.

[0186] The second recovery module is used to restore the first configuration file and the second configuration file to their default values ​​when the second storage medium is fully formatted.

[0187] The second update module is used to update the program to be updated based on the first configuration file after restoring the default values ​​and the downloaded update file;

[0188] The second copy module is used to copy the contents of the second configuration file into the first configuration file when the first configuration file is formatted and the second configuration file is not formatted;

[0189] The second update module is also used to update the program to be updated based on the copied first configuration file and the downloaded update file;

[0190] The second update module is further configured to update the program to be updated based on the first configuration file and the downloaded update file when the first configuration file is not formatted.

[0191] In one embodiment, the device further includes:

[0192] The update file checking unit is configured to, after updating the program to be updated, when updating the second storage medium based on the A core, have the A core check the legality of the update file by running a code update program, and when updating the second storage medium based on the first M core, have the first M core check the legality of the update file by running the boot program of the domain controller.

[0193] The modification unit is configured to, when the code updater determines that the update file is valid, change the program identifier of the valid program recorded in the target configuration file to the program identifier of the program corresponding to the update file; and when the bootloader of the domain controller determines that the update file is valid, change the program identifier of the valid program recorded in the target configuration file to the program identifier of the program corresponding to the update file.

[0194] The first update unit is further configured to, when the code updater determines that the update file is invalid, replace the program to be updated with the update file at the storage location of the program to be updated.

[0195] The second update unit is further configured to, when the bootloader of the domain controller determines that the update file is invalid, replace the program to be updated with the update file at the storage location of the program to be updated.

[0196] In one embodiment, the device further includes:

[0197] The feedback unit is used to provide feedback results to the device to be updated after updating the program to be updated. The update results include successful update, abnormal update file, or the program to be updated was successfully updated but was corrupted and formatted without being updated.

[0198] In one embodiment, the domain controller further includes a read-only storage area, the first storage medium further includes a backup of the M-core application, the A-core related programs include an A-core application set, an A-core bootloader, and an A-core system program, and the apparatus further includes:

[0199] The first loading unit is configured to load the domain controller's bootloader into the first M core after the preset secure boot process is successfully executed in the read-only storage area, before the A core checks whether each program in the second storage medium can be read and written, so that the first M core runs the domain controller's bootloader.

[0200] The first judgment unit is used to determine whether the second storage medium can be started normally through the boot program of the domain controller;

[0201] The second loading unit is used to load the M-core application backed up in the first storage medium by the boot program of the domain controller when the second storage medium fails to start normally.

[0202] The first startup unit is used to start other M-cores to run the backup M-core application;

[0203] The running unit is used for the first M-core to continuously run the boot program of the domain controller and enter a waiting update state, wherein the other M-cores include the M-cores other than the first M-core among the at least two M-cores;

[0204] The third loading unit is used to load the M-core application, the A-core boot program, and the A-core system program in the second storage medium according to the configuration file when the second storage medium can boot normally.

[0205] The second boot unit is used to start the other M cores to run the M core applications in the second storage medium, and to start the A core based on the A core boot program and the A core system program so that the A core can run the A core application set;

[0206] The running unit is also configured to, after the A core has successfully started, have the first M core stop running the boot program of the domain controller and run the M core application in the second storage medium in parallel with the other M cores.

[0207] In one embodiment, the device further includes:

[0208] The second judgment unit is used for the boot program of the domain controller to determine whether the version of the M-core application in the second storage medium is higher than that of the backed-up M-core application, and to determine whether the M-core application in the second storage medium can start normally.

[0209] The copy unit is used so that, when all judgment results are yes, the boot program of the domain controller copies the M-core application in the second storage medium to the storage location of the backed-up M-core application to replace the original content of the backed-up M-core application. If the M-core application in the second storage medium cannot start normally, the boot program of the domain controller copies the backed-up M-core application to the storage location of the M-core application in the second storage medium to replace the original content of the M-core application in the second storage medium.

[0210] In one embodiment, the third loading unit includes:

[0211] The second acquisition module is used to acquire the program identifier of the valid program in the target program recorded in the target configuration file when each program in the second storage medium includes two mutually backed-up programs. The target configuration file is a configuration file with normal content, and the target program includes the M-core application, the A-core boot program, or the A-core system program.

[0212] The judgment module is used by the bootloader of the domain controller to determine whether the program corresponding to the program identifier is abnormal;

[0213] A loading module is used to load the target program when the program corresponding to the program identifier is normal.

[0214] The judgment module is also used to determine whether another copy of the target program is abnormal when the program corresponding to the program identifier is abnormal.

[0215] The loading module is also configured to load another program of the target program when the other program of the target program is normal, and to load the backed-up M-core application in the first storage medium when the other program of the target program is abnormal, and to stop loading the target program when the target program is an M-core application and the target program is an A-core boot program or an A-core system program.

[0216] In one embodiment, the domain controller further includes a High-Speed ​​Network Link Encryption (HSE), and the first storage medium further includes a backup of the domain controller's bootloader, firmware of the HSE and a backup of the firmware, boot configuration data of the domain controller and a backup of the boot configuration data, and boot self-test configuration data of the domain controller and a backup of the boot self-test configuration data.

[0217] Based on the above method embodiments, another embodiment of the present invention provides a storage medium storing executable instructions that, when executed by a processor, cause the processor to implement the method described above.

[0218] Based on the above method embodiments, another embodiment of the present invention provides an electronic device, including:

[0219] One or more processors;

[0220] Storage device for storing one or more programs.

[0221] When the one or more programs are executed by the one or more processors, the one or more processors implement the method described above.

[0222] The above system and device embodiments correspond to the method embodiments and have the same technical effects. For detailed descriptions, please refer to the method embodiments. The device embodiments are derived based on the method embodiments; detailed descriptions can be found in the method embodiments section, and will not be repeated here. Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of one embodiment, and the modules or processes shown in the drawings are not necessarily essential for implementing the present invention.

[0223] Those skilled in the art will understand that the modules in the apparatus of the embodiments can be distributed in the apparatus of the embodiments as described in the embodiments, or they can be located in one or more devices different from this embodiment with corresponding changes. The modules of the above embodiments can be combined into one module, or they can be further divided into multiple sub-modules.

[0224] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for processing programs in a domain controller, characterized in that, The method is applied to a domain controller, which includes at least two M-cores, at least one A-core, a first storage medium, and a second storage medium. Both the M-cores and the A-cores have read and write permissions to the second storage medium, and the M-cores have read and write permissions to the first storage medium. The first storage medium includes the domain controller's bootloader, and the second storage medium includes M-core applications, the domain controller's configuration files, and A-core related programs. The method includes: The A core checks whether each program in the second storage medium can be read and written; If all programs in the second storage medium can be read and written, then the A core updates the programs to be updated in the second storage medium based on the configuration file and the downloaded update file; If at least one program cannot be read or written, the first M core of the at least two M cores executes the domain controller's boot program, formats the damaged program through the domain controller's boot program, and updates the program to be updated based on the configuration file and the downloaded update file. The domain controller's boot program checks the damage status of each partition of the second storage medium and identifies the programs in the damaged partitions as damaged programs.

2. The method according to claim 1, characterized in that, When each program in the second storage medium includes two copies of the program that are mutually backed up, the A core updates the program to be updated in the second storage medium based on the configuration file and the downloaded update file, including: The A core obtains the program identifier of the valid program recorded in the target configuration file, and identifies another program that is backed up with the valid program as the program to be updated. The target configuration file is a configuration file with normal content, and the valid program includes at least one of the programs in the second storage medium other than the configuration file. Download the update file corresponding to the program to be updated from the preset update device, and replace the program to be updated with the update file at the storage location of the program to be updated.

3. The method according to claim 2, characterized in that, When the first configuration file is the primary configuration file and the second configuration file is the backup configuration file, before the A core obtains the program identifier of the valid program recorded in the target configuration file, the method further includes: If the first configuration file does not have any abnormalities, then the first configuration file will be used as the target configuration file; If the first configuration file is abnormal and the second configuration file is not abnormal, then the contents of the second configuration file are copied into the first configuration file, and the copied first configuration file is determined as the target configuration file; If both the first configuration file and the second configuration file are abnormal, then the first configuration file and the second configuration file are restored to their default values, and the first configuration file after restoring the default values ​​is determined as the target configuration file.

4. The method according to claim 3, characterized in that, The corrupted program is formatted using the domain controller's bootloader, and the program to be updated is updated based on the configuration file and the downloaded update file, including: The domain controller's bootloader checks the damage status of each partition of the second storage medium, identifies the programs in the damaged partitions as damaged programs, and formats the damaged partitions. If the second storage medium is fully formatted, the domain controller's bootloader restores the first configuration file and the second configuration file to their default values, and updates the program to be updated based on the first configuration file after restoring the default values ​​and the downloaded update file. If the first configuration file is formatted and the second configuration file is not formatted, the bootloader of the domain controller copies the contents of the second configuration file into the first configuration file, and updates the program to be updated based on the copied first configuration file and the downloaded update file. If the first configuration file is not formatted, the domain controller's bootloader updates the program to be updated based on the first configuration file and the downloaded update file.

5. The method according to claim 2, characterized in that, After updating the program to be updated, the method further includes: When the second storage medium is updated based on the A core, the A core checks the validity of the update file by running a code update program. If the update file is valid, the A core changes the program identifier of the valid program recorded in the target configuration file to the program identifier of the program corresponding to the update file by running the code update program. If the update file is invalid, the A core replaces the update file with the valid program at the storage location of the program to be updated by running the code update program. When updating the second storage medium based on the first M-core, the first M-core checks the validity of the update file by running the domain controller's bootloader. If the update file is valid, the first M-core changes the program identifier of the valid program recorded in the target configuration file to the program identifier of the program corresponding to the update file by running the domain controller's bootloader. If the update file is invalid, the first M-core replaces the update file with the valid program at the storage location of the program to be updated by running the domain controller's bootloader.

6. The method according to claim 1, characterized in that, After updating the program to be updated, the method further includes: The update result is sent back to the device to be updated. The update result includes successful update, abnormal update file, or the program to be updated was successfully updated but was corrupted. At least one program was formatted and not updated.

7. The method according to claim 1, characterized in that, The domain controller further includes a read-only storage area, the first storage medium further includes a backup of the M-core application, the A-core related programs include an A-core application set, an A-core bootloader, and an A-core system program, and before the A-core checks whether each program in the second storage medium can be read and written, the method further includes: After the preset secure boot process is successfully executed in the read-only storage area, the bootloader of the domain controller is loaded into the first M core, so that the first M core runs the bootloader of the domain controller. The domain controller's bootloader determines whether the second storage medium can boot normally; If the second storage medium fails to boot normally, the domain controller's bootloader loads the backed-up M-core application in the first storage medium and starts other M-cores to run the backed-up M-core application. The first M-core continues to run the domain controller's bootloader and enters a waiting-for-update state. The other M-cores include the M-cores other than the first M-core among the at least two M-cores. If the second storage medium can boot normally, the domain controller's bootloader loads the M-core application, the A-core bootloader, and the A-core system program from the second storage medium according to the configuration file, and starts the other M-cores to run the M-core application from the second storage medium. Based on the A-core bootloader and the A-core system program, the A-core is started so that the A-core can run the A-core application set. After the A-core starts successfully, the first M-core stops running the domain controller's bootloader and runs the M-core application from the second storage medium in parallel with the other M-cores.

8. The method according to claim 7, characterized in that, The method further includes: The domain controller's bootloader determines whether the version of the M-core application in the second storage medium is higher than that of the backed-up M-core application, and whether the M-core application in the second storage medium can start normally. If all the judgment results are yes, the boot program of the domain controller will copy the M-core application in the second storage medium to the storage location of the backed-up M-core application in order to replace the original content of the backed-up M-core application. If the M-core application in the second storage medium fails to start normally, the bootloader of the domain controller copies the backed-up M-core application to the storage location of the M-core application in the second storage medium in order to replace the original content of the M-core application in the second storage medium.

9. The method according to claim 7, characterized in that, When each program in the second storage medium includes two copies of the program that are mutually backed up, the domain controller's bootloader loads the M-core application, the A-core bootloader, and the A-core system program from the second storage medium according to the configuration file, including: The domain controller's bootloader obtains the program identifier of a valid program in the target program recorded in the target configuration file. The target configuration file is a normal configuration file, and the target program includes an M-core application, the A-core bootloader, or the A-core system program. The domain controller's bootloader determines whether the program corresponding to the program identifier is abnormal; If the program corresponding to the program identifier is normal, then the target program is loaded; If the program corresponding to the program identifier is abnormal, then determine whether another copy of the target program is abnormal; If the other copy of the target program is normal, then load the other copy of the target program; If the other copy of the target program is abnormal, then when the target program is an M-core application, the M-core application backed up in the first storage medium is loaded; when the target program is an A-core bootloader or an A-core system program, loading the target program is stopped.

10. The method according to any one of claims 1-9, characterized in that, The domain controller further includes a High-Speed ​​Network Link Encryption (HSE), and the first storage medium further includes at least one of the following: a backup of the domain controller's bootloader, the firmware of the HSE and a backup of the firmware, the domain controller's startup configuration data and a backup of the startup configuration data, and the domain controller's startup self-test configuration data and a backup of the startup self-test configuration data.

Images