Method for secure boot of satellite operating system software

Abstract

The application discloses a method for safely starting satellite operating system software, and divides non-volatile memory data storage distribution into three bare disk storage areas and two file system storage areas, and the two are distributed at intervals. Through the redundant and independent distribution storage mode of the bare disk storage area and the file system storage area, and by adopting the inspection comparison and two-out-of-three data loading strategy, it is ensured that the system can be safely and reliably started and run even in the case of damage or single particle flip of a certain NorFlash chip. Through the startup path isolation of the safety mode system and the business mode system, it is ensured that the two systems are completely isolated and do not interfere with each other.

Description

Technical Field

[0001] This invention relates to the field of spaceborne computer software technology, and in particular to a method for securely booting satellite operating system software. Background Technology

[0002] The onboard operating system software is the core software on a satellite. However, the radiation in the space environment may cause the operating system software to fail to start normally. The purpose of this invention is to provide a method for the safe startup of onboard operating system software, so as to ensure that a low-cost onboard computer system can start up and run safely and reliably in the harsh space environment. Summary of the Invention

[0003] To overcome the shortcomings of existing technologies, this invention provides a method for securely booting satellite operating system software, ensuring that a low-cost onboard computer system can boot and run safely and reliably in harsh space environments.

[0004] To achieve the aforementioned objectives of the invention, the technical solution adopted to solve its technical problems is as follows:

[0005] A method for securely booting satellite operating system software includes the following steps:

[0006] Step S1: The onboard computer system powers on and loads the boot software to read the onboard operating system image from the first bare disk storage area. It calculates the CRC value of the read data and compares it with the CRC value stored in the image header. If they match, the onboard operating system image from the first bare disk storage area is loaded directly. If the CRC check of the onboard operating system image in the first bare disk storage area fails, the onboard operating system image from the second bare disk storage area is read and checked. If the check is successful, it is loaded and run. If the CRC check of the onboard operating system image in the second bare disk storage area fails, the onboard operating system image from the third bare disk storage area is read and checked. If the check is successful, it is loaded and run. If all three onboard operating system images fail to be checked, the onboard operating system images from the three bare disk storage areas are loaded using a two-out-of-three method.

[0007] Step S2: During the startup process, the onboard operating system mounts the memory file system as the root file system, and at the same time mounts the file system in the non-volatile memory to the directory of the root file system. The two file systems correspond to the two subdirectories under the mount directory.

[0008] Step S3: Read and write the onboard basic service software in the bare disk storage to the memory file system to form the corresponding APP file in the same way as loading the onboard operating system image, and start the APP. At this time, the entire running system is called the safe mode system.

[0009] Step S4: In the safe mode system, the files in the two file system storage areas of the non-volatile memory are checked for correctness. If file corruption is found, the files in the file system storage area can be repaired by on-orbit programming in the safe mode system.

[0010] Step S5: If the file verification is successful, perform a hot reset of the onboard operating system according to the ground instructions. The PC pointer jumps to the operating system entry address in memory to re-execute. Alternatively, in the safe mode system, a new onboard operating system image is directly injected into the file system storage area through the on-orbit programming function, and the onboard operating system image in the file system storage area is loaded.

[0011] Step S6: During the boot process, the onboard operating system loads the software in the first file system storage area according to the hot boot flag, and reads and writes the software and library files in the file system storage area corresponding to the non-volatile memory to the memory file system.

[0012] Step S7: The onboard operating system first starts and runs the onboard basic service software loaded into the memory file system. The onboard service software then starts the business software in the memory file system. At this point, the entire running system is called the business mode system.

[0013] Furthermore, in step S1, the verification method for the operating system image loaded by the bootloader is CRC verification, and the verification data is the loaded operating system image software, excluding software stored in other raw disk storage areas.

[0014] Furthermore, in step S1, the onboard operating system image and onboard basic service software in the bare disk storage area are stored in binary form.

[0015] Furthermore, in step S1, the onboard operating system image and onboard basic service software in the bare disk storage area are stored according to data size, data CRC check value and data content, respectively. Write protection is set in the bare disk storage area so that it will not be rewritten after on-orbit operation.

[0016] Furthermore, in step S3, when the onboard basic service software in the bare disk storage area is generated, the library files to be called are compiled together in a static linking manner.

[0017] Furthermore, in step S2, the non-volatile memory in the onboard computer can be a single memory or a group of non-volatile memory composed of multiple independent non-volatile memories. The arrangement of the non-volatile memories is as follows: if there is only one non-volatile memory, the three raw disk storage areas and the two file system storage areas are arranged alternately in the order of raw disk storage areas and file system storage areas; if it is a group of non-volatile memories composed of multiple independent non-volatile memories, the three raw disk storage areas and the two file system storage areas are distributed alternately in the independent non-volatile memories.

[0018] Furthermore, in step S4, in the safe mode system, the MD5 values ​​of software and library files in the file system storage area are calculated and compared with the corresponding MD5 files. If a file is found to have an MD5 check failure, the corresponding file can be repaired by ground commands using the on-orbit programming function.

[0019] Furthermore, in step S5, each file in the file system storage area has a corresponding file that records its MD5 checksum, and this file can be updated and upgraded on-orbit.

[0020] Furthermore, in step S5, under the security mode system, the system is directly started by entering the business mode system via a hot reset command.

[0021] Furthermore, in step S6, during the startup process of the onboard operating system under the business mode system, the memory file system is mounted according to step S2, and the software in the first file system storage area is loaded. The onboard basic service software, onboard business software and library files in the corresponding file system storage area are copied to the corresponding directories in the memory file system.

[0022] Furthermore, in step S7, the startup of the onboard basic service software under the business mode system includes:

[0023] The onboard basic service software in the copied memory file system first needs to undergo MD5 value verification to ensure the copying process is correct. The onboard operating system starts the onboard basic service software. If the start fails, it will start again after 500ms. If it fails again, it will switch to the second file system storage area to load the software data. If the basic service software in both file system storage areas fails to load, a hot reset of the business mode system will be performed. If the basic service software still cannot run after the hot reset of the business system mode, the system will return to the safe mode system and repair the basic service software in the file system storage area under the safe mode system.

[0024] Furthermore, in step S7, the startup of the onboard service software under the service mode system includes:

[0025] In the operational mode system, after the onboard basic service software runs, the onboard business software is started. If the onboard business software fails to start, it is restarted again after an interval of 500ms. If the startup still fails, the failure information is transmitted via telemetry, and the ground determines whether to start by loading software from another partition, perform a system hot reset, or repair it through on-orbit programming under the operational mode system.

[0026] By employing the above technical solutions, this invention has the following advantages and positive effects compared with the prior art:

[0027] This invention employs a rational data storage layout for non-volatile memory, with redundant backups of three raw disk storage areas and a file system storage area. This ensures that the system will not fail to boot due to damage to some non-volatile memory or a single-event upset during on-orbit operation. The safe mode system remains unchanged after on-orbit operation, while the operational mode system can be continuously updated and upgraded according to the overall satellite's operational needs. By isolating the safe mode system and the operational mode system, the boot paths are completely independent, ensuring that a crash in the operational mode system will not affect the safe mode system, and that the operational mode system can be repaired through the safe mode system. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0029] Figure 1 This is a data storage distribution diagram of a non-volatile memory according to an embodiment of the present invention;

[0030] Figure 2 This is a flowchart of the data loading process for the raw disk storage area according to an embodiment of the present invention;

[0031] Figure 3 This is a flowchart of the safe mode system startup process according to an embodiment of the present invention;

[0032] Figure 4 This is a flowchart of the business mode system startup process according to an embodiment of the present invention. Detailed Implementation

[0033] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] This embodiment discloses a method for securely booting satellite operating system software, comprising: dividing the non-volatile memory data storage distribution into three raw disk storage areas and two file system storage areas, wherein the raw disk storage areas and file system storage areas are distributed alternately on the non-volatile memory. Each raw disk storage area stores a satellite operating system image and satellite basic service software compiled using static linking; each file system storage area stores a set of dynamically compiled satellite basic service software, business software, and related library files. The steps of the method for securely booting satellite operating system software are as follows:

[0035] Step S1: The onboard computer system powers on and loads the boot software to read the onboard operating system image from the first bare disk storage area. It calculates the CRC value of the read data and compares it with the CRC value stored in the image header. If they match, the onboard operating system image from the first bare disk storage area is loaded directly. If the CRC check of the onboard operating system image in the first bare disk storage area fails, the onboard operating system image from the second bare disk storage area is read and checked. If the check is successful, it is loaded and run. If the CRC check of the onboard operating system image in the second bare disk storage area fails, the onboard operating system image from the third bare disk storage area is read and checked. If the check is successful, it is loaded and run. If all three onboard operating system images fail to be checked, the onboard operating system images from the three bare disk storage areas are loaded using a two-out-of-three method.

[0036] Step S2: During the startup process, the onboard operating system mounts the memory file system as the root file system, and at the same time mounts the file system in the non-volatile memory to the directory of the root file system. The two file systems correspond to two subdirectories under the mounted directory.

[0037] Step S3: Read and write the onboard basic service software in the raw disk storage to the memory file system to form the corresponding APP file in the same way as loading the onboard operating system image, and start the APP. At this time, the entire running system is called the safe mode system.

[0038] Step S4: In the safe mode system, the files in the two file system storage areas of the non-volatile memory are checked for correctness. If file corruption is found, the files in the file system storage area can be repaired by on-orbit programming in the safe mode system.

[0039] Step S5: If the file verification is successful, perform a hot reset of the onboard operating system according to the ground instructions. The PC pointer jumps to the operating system entry address in memory to re-execute. Alternatively, in the safe mode system, a new onboard operating system image is directly injected into the file system storage area through the on-orbit programming function, and the onboard operating system image in the file system storage area is loaded.

[0040] Step S6: During the boot process, the onboard operating system loads the software in the first file system storage area according to the hot boot flag, and reads and writes the software and library files in the file system storage area corresponding to the non-volatile memory to the memory file system.

[0041] Step S7: The onboard operating system first starts and runs the onboard basic service software loaded into the memory file system. The onboard service software then starts the business software in the memory file system. At this point, the entire running system is called the business mode system.

[0042] Furthermore, in step S1, the verification method for the operating system image loaded by the bootloader is CRC verification, and the verification data is the loaded operating system image software, excluding software stored in other raw disk storage areas.

[0043] Furthermore, in step S1, the onboard operating system image and onboard basic service software in the bare disk storage area are stored in binary form. The onboard operating system image and onboard basic service software in the bare disk storage area are stored according to data size, data CRC checksum, and data content, respectively. Write protection is set in the bare disk storage area, and it will not be rewritten after on-orbit operation.

[0044] Furthermore, in step S3, when the onboard basic service software in the bare disk storage area is generated, the library files to be called are compiled together in a static linking manner.

[0045] Furthermore, in step S2, the non-volatile memory in the onboard computer can be a single memory or a group of non-volatile memory composed of multiple independent non-volatile memories. The arrangement of the non-volatile memories is as follows: if there is only one non-volatile memory, the three raw disk storage areas and the two file system storage areas are arranged alternately in the order of raw disk storage areas and file system storage areas; if it is a group of non-volatile memories composed of multiple independent non-volatile memories, the three raw disk storage areas and the two file system storage areas are distributed alternately in the independent non-volatile memories.

[0046] Furthermore, in step S4, in the safe mode system, the MD5 values ​​of software and library files in the file system storage area are calculated and compared with the corresponding MD5 files. If a file is found to have an MD5 check failure, the corresponding file can be repaired by ground commands using the on-orbit programming function.

[0047] Furthermore, in step S5, each file in the file system storage area has a corresponding file that records its MD5 checksum, and this file can be updated and upgraded on-orbit.

[0048] Furthermore, in step S5, under the security mode system, the system is directly started by entering the business mode system via a hot reset command.

[0049] Furthermore, in step S6, during the startup process of the onboard operating system under the business mode system, the memory file system is mounted according to step S2, and the software in the first file system storage area is loaded. The onboard basic service software, onboard business software and library files in the corresponding file system storage area are copied to the corresponding directories in the memory file system.

[0050] Furthermore, in step S7, the startup of the onboard basic service software under the business mode system includes:

[0051] The onboard basic service software in the copied memory file system first needs to undergo MD5 value verification to ensure the copying process is correct. The onboard operating system starts the onboard basic service software. If the start fails, it will start again after 500ms. If it fails again, it will switch to the second file system storage area to load the software data. If the basic service software in both file system storage areas fails to load, a hot reset of the business mode system will be performed. If the basic service software still cannot run after the hot reset of the business system mode, the system will return to the safe mode system and repair the basic service software in the file system storage area under the safe mode system.

[0052] Furthermore, in step S7, the startup of the onboard service software under the service mode system includes:

[0053] In the operational mode system, after the onboard basic service software runs, the onboard business software is started. If the onboard business software fails to start, it is restarted again after an interval of 500ms. If the startup still fails, the failure information is transmitted via telemetry, and the ground determines whether to start by loading software from another partition, perform a system hot reset, or repair it through on-orbit programming under the operational mode system.

[0054] Example:

[0055] like Figures 1-4 As shown, this embodiment describes the software startup process based on the AIC-OS embedded operating system on a spaceborne integrated electronic computer platform.

[0056] In this embodiment, the non-volatile memory of the spaceborne integrated electronic computer platform consists of five 4MB NorFlash drives. NorFlash 1, 3, and 5 are configured as raw disk storage areas, storing the AIC-OS operating system image, management basic service software, integrated electronic basic service software, and attitude and orbit control basic service software. NorFlash 2 and 4 are configured as file system storage areas, using the yaffs2 file system, storing the AIC-OS file system image, management basic service software, integrated electronic basic service software, attitude and orbit control basic service software, autonomous mission planning business software, and related library files.

[0057] In this embodiment, after the onboard integrated electronic computer is powered on, the boot software is loaded according to... Figure 2 The process loads and boots the AIC-OS operating system image from the raw disk storage area into memory for execution. During the operating system startup process, a memory file system is established as the root file system, and two file systems are mounted under the yaffs directory of the root file system, in the flash1 and flash2 subdirectories. After the file system is successfully mounted, the operating system starts from the raw disk storage area... Figure 2 The process loads the management basic service software, integrated electronic basic service software, and attitude and orbit control basic service software one by one into the memory file system / apps directory, and finally starts the management basic service software, integrated electronic basic service software, and attitude and orbit control basic service software one by one from the / apps directory.

[0058] In this embodiment, after the safe mode system starts running, it verifies the correctness of files in the file system storage area according to ground instructions: by reading the MD5 values ​​of files in the / yaffs / flash1 and / yaffs / flash2 directories one by one and comparing them with the corresponding MD5 values ​​in the files, if an inconsistency is found, the corresponding file number is notified to the ground via downlink telemetry. The ground repairs the damaged files through on-orbit programming. Before entering the operational mode system, it is necessary to select the operating system and software loading source to be started in operational mode via ground injection instructions.

[0059] In this embodiment, the secure system mode performs a direct hot reset, and the PC pointer jumps to the entry address of the AIC-OS operating system image in memory to re-execute. Alternatively, the operating system image in the file system can be loaded into memory for startup. The operating system in the file system can be updated in secure system mode through on-orbit programming. During the AIC-SO boot process, a memory file system is established as the root file system, and two file systems are mounted in the flash1 and flash2 subdirectories under the / yaffs directory of the root file system.

[0060] In this embodiment, during the operating system startup process under the business mode system, the business mode flag in SRAM is read, and the management basic service software, integrated electronic basic service software, attitude and orbit control basic service software, autonomous task business planning software, and corresponding library files in flash1 are loaded into the memory file system / apps directory. The operating system starts the relevant basic service software from / apps, and the management basic service software starts the autonomous task planning business software.

[0061] In this embodiment, after the management basic service software, integrated electronic basic service software, and attitude and orbit control basic service software fail to start on the first time, they are restarted every 500ms. If they still fail to start, the system switches to the flash2 directory and reloads the management basic service software, integrated electronic basic service software, attitude and orbit control basic service software, autonomous task business planning software, and corresponding library files to the memory file system / apps directory. If the basic software in flash2 also fails to start, the business mode system is hot-reset once. If the system still fails to start after hot-reset, the dog-feeding operation is stopped, the system performs dog-dog biting, the boot software is loaded to clear the business mode flag, the operating system is loaded from the bare disk storage area, and the system enters safe mode.

[0062] In this embodiment, in the business mode system, software and library files can be updated via on-orbit programming. In the secure system mode, the operating system image and software are immutable, with NorFlash1, 3, and 5 all write-protected. In secure system mode, the operating system image and any software and library files in the file system area can be updated via on-orbit programming to repair and upgrade the business mode system.

[0063] Compared to current methods based on onboard operating system software startup, this embodiment utilizes redundant and independently distributed storage in the raw disk storage area and file system storage area, along with a verification and comparison and a 2 / 3 data loading strategy, to ensure safe and reliable system startup and operation even in the event of a NorFlash chip failure or single-event fault. By isolating the startup paths of the safe mode system and the operational mode system, complete isolation and non-interference between the two systems are guaranteed. The operating system and software in the safe mode system cannot be modified, ensuring system reliability; the operational mode system can be continuously updated and upgraded to meet the overall satellite operational needs. Furthermore, if the operational mode system encounters an error, reverting to the safe mode system allows for repair. The two systems complement each other, ensuring both system reliability and improved system flexibility.

[0064] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for securely booting satellite operating system software, comprising dividing non-volatile memory into three raw disk storage areas and two file system storage areas, wherein the two are spaced apart, characterized in that, Includes the following steps: Step S1: The onboard computer system powers on and loads the boot software to read the onboard operating system image from the first bare disk storage area. It calculates the CRC value of the read data and compares it with the CRC value stored in the image header. If they match, the onboard operating system image from the first bare disk storage area is loaded directly. If the CRC check of the onboard operating system image in the first bare disk storage area fails, the onboard operating system image from the second bare disk storage area is read and checked. If the check is successful, it is loaded and run. If the CRC check of the onboard operating system image in the second bare disk storage area fails, the onboard operating system image from the third bare disk storage area is read and checked. If the check is successful, it is loaded and run. If all three onboard operating system images fail to be checked, the onboard operating system images from the three bare disk storage areas are loaded using a two-out-of-three method. Step S2: During the startup process, the onboard operating system mounts the memory file system as the root file system, and at the same time mounts the file system in the non-volatile memory to the root file system directory in the volatile memory. The two file systems in the non-volatile memory correspond to the two subdirectories under the mount directory. Step S3: Write the onboard basic service software in the raw disk storage area into the memory file system to form the corresponding APP file in the same way as loading the onboard operating system image. Start the APP. At this time, the entire running system is called the safe mode system. Step S4: In the safe mode system, the files in the two file system storage areas of the non-volatile memory are checked for correctness. If file corruption is found, the files in the file system storage area can be repaired by on-orbit programming in the safe mode system. Step S5: If the file verification is successful, perform a hot reset of the onboard operating system according to the ground instructions. The PC pointer jumps to the operating system entry address in memory to re-execute. Alternatively, in the safe mode system, a new onboard operating system image is directly injected into the file system storage area through the on-orbit programming function, and the onboard operating system image in the file system storage area is loaded. Step S6: During the boot process, the onboard operating system loads the software in the first file system storage area according to the hot boot flag, and writes the software and library files in the file system storage area corresponding to the non-volatile memory into the memory file system. Step S7: The onboard operating system first starts and runs the onboard basic service software loaded into the memory file system. The onboard basic service software then starts the business software in the memory file system. At this point, the entire running system is called the business mode system.

2. The method for securely booting satellite operating system software according to claim 1, characterized in that, In step S1, the verification method for the operating system image loaded by the bootloader is CRC check, and the verification data is the loaded operating system image software, excluding software stored in other raw disk storage areas.

3. The method for securely booting satellite operating system software according to claim 1, characterized in that, In step S1, the onboard operating system image and onboard basic service software in the bare disk storage area are stored in binary form.

4. The method for securely booting satellite operating system software according to claim 3, characterized in that, In step S1, the onboard operating system image and onboard basic service software are stored in the bare disk storage area according to data size, data CRC check value and data content, respectively. Write protection is set in the bare disk storage area so that it will not be rewritten after on-orbit operation.

5. The method for securely booting satellite operating system software according to claim 3, characterized in that, In step S3, when the onboard basic service software in the bare disk storage area is generated, the library files to be called are compiled together in a static linking manner.

6. The method for securely booting satellite operating system software according to claim 1, characterized in that, In step S2, the non-volatile memory in the spaceborne computer can be a single memory or a group of non-volatile memory composed of multiple independent non-volatile memories. If there is only one non-volatile memory, the three raw disk storage areas and two file system storage areas are arranged alternately in the order of raw disk storage area and file system storage area. If the non-volatile memory group consists of multiple independent non-volatile memory units, then the non-volatile memory units are distributed in the independent non-volatile memory units according to the interval of three raw disk storage areas and two file system storage areas.

7. The method for securely booting satellite operating system software according to claim 1, characterized in that, In step S4, the safe mode system calculates the MD5 value of software and library files in the file system storage area and compares it with the corresponding MD5 checksum file. If a file is found to have an MD5 checksum that fails, the corresponding file can be repaired by ground commands using the on-orbit programming function.

8. The method for securely booting satellite operating system software according to claim 1, characterized in that, In step S5, each file in the file system storage area has a corresponding file that records its MD5 checksum, and this file can be updated and upgraded on track.

9. A method for securely booting satellite operating system software according to claim 1, characterized in that, In step S5, under the security mode system, the system is directly started by entering the service mode system through a hot reset command.

10. A method for securely booting satellite operating system software according to claim 1, characterized in that, In step S6, during the startup process of the onboard operating system under the business mode system, the memory file system is mounted in the manner of step S2, and the software in the first file system storage area is loaded. The onboard basic service software, onboard business software and library files in the corresponding file system storage area are copied to the corresponding directories in the memory file system.

11. The method for securely booting satellite operating system software according to claim 1, characterized in that, In step S7, the startup of the onboard basic service software under the business mode system includes: The onboard basic service software in the copied memory file system first needs to undergo MD5 value verification to ensure the copying process is correct. The onboard operating system starts the onboard basic service software. If the start fails, it will start again after 500ms. If it fails again, it will switch to the second file system storage area to load the software data. If the basic service software in both file system storage areas fails to load, a hot reset of the business mode system will be performed. If the basic service software still cannot run after the hot reset of the business mode system, the system will return to the safe mode system and run. The basic service software in the file system storage area will be repaired in the safe mode system.

12. The method for securely booting satellite operating system software according to claim 1, characterized in that, In step S7, the startup of the onboard service software under the service mode system includes: In the operational mode system, after the onboard basic service software runs, the onboard business software is started. If the onboard business software fails to start, it is restarted after an interval of 500ms. If the startup still fails, the failure information is transmitted via telemetry, and the ground configuration determines whether to start by loading software from another file system storage area, perform a system hot reset, or repair it through on-orbit programming under the operational mode system.

Images