Firmware updates through logical address remapping

Abstract

The invention relates to firmware updates through logical address remapping. A system (105) includes a memory (130) having a first resource at a first physical address space including a first physical address and a second resource at a second physical address space including a second physical address. A memory mapper (120) is coupled to the memory (130). The memory mapper (120) is configured to translate a logical address to a physical address. A processor (110) is coupled to the memory mapper (120). The processor (110) is configured to execute the first resource from a first logical address mapped to the first physical address by the memory mapper (120). When executing a firmware update resource, the processor (110) may remap the first logical address to the second physical address using the memory mapper (120), and then execute the second resource from the first logical address.

Description

Background Art

[0001] Many systems have processors that execute resources, such as firmware. It may be desirable to update all or part of a device's resources. Some resource update processes are reset-based processes in which a device is reset to complete a switch from a currently executing copy of a resource to an updated copy of the resource. During the reset, a previous state (e.g., configuration parameters) may be saved, the previous version of the resource stops executing, a boot loader may initiate execution of a new version of the resource, and the previously saved state may be used to reconfigure the device to continue operation. During the reset process, because the device stops executing the previous version of the resource, the device is typically not able to be used to perform functions that it would have performed if the resource continued to be executed. Summary of the invention

[0002] In one example, a system includes a memory, the memory including: a first resource at a first physical address space including a first physical address and a second resource at a second physical address space including a second physical address. A memory mapper is coupled to the memory. The memory mapper is configured to convert a logical address to a physical address. A processor is coupled to the memory mapper. The processor is configured to execute the first resource from a first logical address mapped to the first physical address by the memory mapper. When executing a firmware update resource, the processor may use the memory mapper to remap the first logical address to the second physical address, and then execute the second resource from the first logical address.

[0003] In another example, an integrated circuit includes a memory mapper configured to convert a logical address to a physical address. A processor is coupled to the memory mapper. The processor is configured to execute a first resource from a first logical address mapped by the memory mapper to a first physical address of a memory. In addition, when executing a firmware update resource, the processor may use the memory mapper to remap the first logical address to a second physical address of a second resource, and execute the second resource from the first logical address.

[0004] In another example, a method includes executing, by a processor, a first resource from a first logical address mapped to a first physical address of a memory. When executing a firmware update resource by the processor, the method includes remapping the first logical address to a second physical address of the memory. The method also includes executing, by the processor, a second resource from the first logical address. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] Figure 1 is a schematic diagram of an exemplary integrated circuit including a memory mapper according to an example.

[0006] Figure 2is a schematic diagram of a memory mapper according to an example.

[0007] Figure 3 and Figure 4 is an exemplary logical to physical address mapping of an active resource's logical address space stored at the active resource's physical address space before and after being remapped to a candidate resource's physical address according to an example.

[0008] Figure 5 is a timing diagram illustrating switching of a logical address space mapped from one physical address space to another physical address space according to an example.

[0009] Figure 6 and Figure 7 are exemplary logical-to-physical address mappings before and after logical address spaces of a plurality of active resources are remapped to physical address spaces of candidate resources, according to an example.

[0010] Figures 8 to 10 is an exemplary logical-to-physical address mapping illustrating sequentially remapping the logical address space of each of a plurality of active resources to the physical address space of a corresponding candidate resource, according to an example.

[0011] Fig.11 is a flow chart illustrating an exemplary method for switching from execution of a first resource to a second resource according to an example.

[0012] Fig.12 is a flow chart illustrating an exemplary method according to an example that includes one or more checks performed on a candidate resource while remapping a logical address space of an active resource to the candidate resource. DETAILED DESCRIPTION

[0013] Unless otherwise stated, the same reference numerals or other reference numerals are used in the drawings to indicate the same or similar (in function and / or structure) features.

[0014] The making and use of the disclosed examples are discussed in detail below. However, it should be understood that the present disclosure provides many applicable inventive concepts that can be embodied in a variety of specific contexts. The specific examples discussed only illustrate specific ways to make and use the present invention and do not limit the scope of the present invention.

[0015] The following description shows various specific details to provide a deep understanding of several exemplary embodiments according to the description. Embodiments may be obtained without one or more specific details or by using other methods, components, materials, etc. In other cases, known structures, materials, or operations are not shown or described in detail to avoid blurring the different aspects of the embodiments. In this specification, reference to "embodiment" or "example" indicates that a specific configuration, structure, or feature described in connection with the embodiment is included in at least one embodiment. Therefore, phrases such as "in an example" that may appear at different points in this specification do not necessarily refer to the same embodiment completely. In addition, in one or more embodiments, specific configurations, structures, or features may be combined in any appropriate manner.

[0016] The exemplary systems described herein may implement a resource update process (e.g., a firmware update) that switches from a currently executing (e.g., by a processor) version of a resource (referred to as an "active" resource) to a new version of the resource (a "candidate" resource). The candidate resource may provide improved performance, fix bugs, etc. relative to the active resource. In another example, the system may implement redundancy including identical copies of the same resource, and if the active resource experiences unexpected behavior, a switch from the active resource to the same candidate resource may occur.

[0017] Some conventional systems require a cold start or a hot start to achieve the switch from the active resource to the candidate resource. A cold start includes a reset of the entire system, in which all state information about the system is lost, for example, similar to the restart of a personal computer. A hot start may not include a system reset, but does include a reset of one or more components or subsystems of the system to complete the switch from the active resource to the candidate resource. In either case (cold start or hot start), because a reset is performed, the system spends clock cycles to update its internal configuration (e.g., pointers, security parameters, etc.) to transition back to its fully operational state, which may render the system unusable until the system returns to its operational state.

[0018] As described herein, the system performs a resource update (a switch from an active resource to a candidate resource) without any type of reset. For example, in some examples, a system or subsystem / component reset need not be performed during a real-time resource update, thereby allowing the system to continue to perform its intended function. The resource update can be a "real-time" resource update (e.g., a real-time firmware update), in which one or more active resources are switched to corresponding candidate resources (e.g., the active firmware is switched to a new version of the firmware) while the system continues to operate. Because a reset is not performed, the reset-free resource update process described herein (e.g., a reset-free firmware update) can, for example, achieve a switch from an active resource to a candidate resource within one clock cycle of a clock used by a processor to execute instructions, which can be advantageous for many systems including high-availability systems (e.g., systems that should continue to operate without any significant interruptions).

[0019] As used herein, the term "resource" refers to an executable or non-executable resource. Executable resources may include, for example, any type of machine instructions that can be executed by a processor, such as software or firmware. Non-executable resources may include, for example, peripherals, interfaces, hardware accelerators, etc.

[0020] The executable resources of the system are stored at physical addresses in memory, but can be accessed using logical addresses (also called "virtual" addresses). The resources can be accessed at the physical address space using a corresponding logical address space. The physical address space may include a range of physical addresses starting from a first physical address. Similarly, the logical address space may include a range of logical addresses starting from a first logical address.

[0021] In one example of a resource update process, a system remaps a logical address space associated with an active resource from a physical address space where the active resource is stored in a memory or accessible to a different physical address space where a candidate resource is stored or accessible. In some examples, remapping the logical address space may include remapping a logical address of a first instruction of a resource to a first physical address of a different physical address space. After remapping, access to a candidate resource (now an active resource) may include continuing to use the same logical address associated with a previously active resource (now an inactive resource or a candidate resource). In some examples, the physical address space storing the previously active resource (now inactive) may be released (e.g., by an operating system) for storing other resources and / or data. In another example, access to the physical address space storing the previously active resource (now inactive) is blocked, thereby preventing, for example, malicious code from being stored therein. Blocking access to the physical address space may be achieved by not remapping the particular physical address space to another logical address space.

[0022] In addition, the process for updating a resource may include updating all or part of a resource executed on a processor within the device. For example, a system may include or have access to multiple separately executable functions, each of which is a resource. The machine instructions that implement any one or more of the functions may be updated.

[0023] Figure 1 1 is a diagram of an exemplary integrated circuit (IC) 100. IC 100 includes a system 105 having a processor 110, a memory mapper 120, and a memory 130. System 105 includes a reset (RST) input 107. When a reset signal is asserted to RST input 107, system 105 performs a reset of the entire system, which causes system 105 to transition to an initialized state. IC 100 may also include additional components. Memory mapper 120 is coupled between processor 110 and memory 130. Figure 1 In an example of the present invention, the processor 110 is coupled to the memory mapper 120 via a data (D) bus 111 and a code (C) bus 112. In another example, the processor 110 may be coupled to the memory mapper 120 via a unified bus (e.g., a bus in which data and code are on the same bus). In one example, the processor 110 may send a read command on the code bus 112 in one cycle of the clock that the processor 110 uses to execute instructions, and the read data may be returned on the data bus 111 in a subsequent clock cycle. For a write command, the processor 110 may send a write command on the code bus 112 in one clock cycle, and place the write data on the data bus 111 in a subsequent clock cycle. The memory mapper 120 is coupled to the memory 130 via a bus 121. In this example, the bus 121 includes both data and code, but may be implemented as a separate data bus and memory bus in other examples.

[0024] Processor 110 may include a single processor or multiple processors. Unless otherwise specified, any reference to a resource being executed or a function being performed by a processor broadly includes the resource being executed / accessed or the function being performed by a single processor or distributed across multiple processors. Figure 1In an example of the embodiment of the present invention, the processor 110 includes a RST input 113 and a SWAP output 114. The SWAP output 114 is coupled to the memory mapper 120. When a reset signal (which may be the same or different from the reset signal provided to the RST input 107 of the system) is asserted to the RST input 113 of the processor, the processor 110 (or a portion of the processor 110) is reset to an initialized state. The processor 110 may generate a SWAP signal 115 (its use is described below) at its SWAP output 114. In another example, the SWAP signal may be transmitted to the memory mapper 120 via a bus (e.g., the data bus 111 and / or the code bus 112). In some examples, the state of the SWAP signal 115 may be latched and stored in an internal register of the memory mapper 120.

[0025] The memory 130 includes one or more memory devices. The memory 130 may include any type of volatile memory device, such as a random access memory (RAM) (e.g., static RAM, dynamic RAM, etc.). The memory 130 may also or alternatively include a non-volatile memory device, such as an electrically erasable programmable read-only memory (EEPROM), a flash memory, etc.

[0026] The memory 130 may include resources 135 that may be executed or accessed by the processor 130. Figure 1 In an example, memory 130 is included on IC 100, and thus resource 135 is executed from memory inside the IC. In another example, some or all of memory 130 is located outside IC 100, and thus some or all of resource 135 is stored in external memory. As external memory, memory 130 may be directly coupled to IC 100 or may be coupled to IC 100 via one or more local area networks and / or wide area networks. Resource 135 may include a main system resource (e.g., an operating system) and one or more executable functional resources. Each functional resource may include executable code that performs one or more specific functions. When the function implemented by each such specific functional resource is needed, the main system resource may call each functional resource.

[0027] As described above, in some examples, resources 135 have unique physical addresses within a physical address space (e.g., in memory 130), which may be set during startup of IC 100. However, processor 110 generates logical addresses during execution of resources. For example, when an instruction in one resource 135 issues a call to another resource 135, the call instruction issues a call to a logical address associated with the called functional resource. After the called functional resource completes its execution, execution may jump back to the calling resource using the logical address associated with the next instruction to be executed. Memory mapper 120 receives the logical address from processor 110, for example, via address bus 112. Memory mapper 120 converts the logical address to a physical address and uses the physical address to access the called resource at its physical address in memory 130.

[0028] Figure 2 is a schematic diagram of an exemplary memory mapper 120. In this example, the memory mapper 120 includes one or more mapper circuits 205. Each mapper circuit 205 includes address mappers 210 and 220 and selection logic (eg, multiplexer) 250. Although in Figure 2 , but in other examples, each mapper circuit 205 may include more than two address mappers. Each address mapper 210 and 220 has an input terminal that receives a logical address and converts the logical address into a physical address. The selection logic 250 includes a first input terminal (“0”) and a second input terminal (“1”). The output terminal of the address mapper 210 is coupled to the 0 input terminal of the selection logic 250, and the output terminal of the address mapper 220 is coupled to the 1 input terminal. Based on the SWAP signal 115 (e.g., at the SWAP output terminal 114 or stored in an internal register of the memory mapper 120), the selection logic 250 provides the physical address at its 0 input terminal (e.g., when the SWAP signal 115 is deasserted) to its output terminal or provides the physical address at its 1 input terminal (e.g., when the SWAP signal 115 is asserted) to its output terminal as the output physical address from the memory mapper 120.

[0029] In some examples, each address mapper 210, 220 has a configuration input. Address mapper 210 has a configuration input 211, and address mapper 220 has a configuration input 221. Processor 110 may provide separate logical-to-physical address mapping configuration data to the configuration input of each address mapper. The logical-to-physical address mapping configuration data may include a logical address of a first address in a specific logical address space and a physical address of a first instruction in a specific physical address space. The logical-to-physical address mapping configuration data may be provided by processor 110 via data bus 111 and address bus 112 or via a control signal independent of buses 111 and 112. The logical-to-physical address mapping configuration data configures each address mapper 210 and 220 to convert a given input logical address into a specific physical address.

[0030] In some examples, address mappers 210 and 220 may be configured to convert the same logical address to two different physical addresses. That is, address mapper 210 may be configured to convert a particular logical address to a first physical address, and address mapper 220 may be configured to convert the same logical address to a second physical address. By being able to convert the same logical address to two different physical addresses, system 105 may switch execution from executing a first resource 135 stored or accessible at a first physical address space and accessible via the first logical space to a second resource 135 stored or accessible at a second physical address space while continuing to use the same logical address space.

[0031] Multiple logical address spaces may be converted to different physical address spaces using multiple mapper circuits 205. Such an architecture allows multiple resources (each with its own logical address) to be mapped to a unique physical address space and then remapped to a different physical address space, for example, if a resource is to be upgraded or replicated.

[0032] Figure 3 and Figure 4 is a diagram illustrating an exemplary process for switching execution from a first resource to a second resource while maintaining use of the same logical address space. Figure 3Includes a memory map 300 corresponding to a logical address space and a memory map 320 corresponding to a physical address space. Resources 135 accessible via the logical address space (e.g., stored in the memory 130) include logical address regions 311 and 312. Firmware update resources 315 (described below) may be stored in a physical address region (not specifically shown, such as in the memory 130) and may be accessed via the logical address region 311. The logical address region 312 corresponds to a resource that may be updated (or switched to a duplicate copy of the resource), which may include a plurality of executable instructions whose logical addresses may be continuous on the resource address region 312. The memory mapper 120 has been configured to convert the logical address region 312 corresponding to the resource to be updated into a physical address region 321 where the resource is actually stored in the memory 120. The resource stored in the physical address space 321 is the currently executed version of the resource (active resource).

[0033] Physical address region 322 may include candidate resources. As described above, the candidate resource may be an updated version or an identical copy of an active resource stored in physical address region 321. Firmware update resource 315 may include code that, when executed by processor 110 and as described below, configures memory mapper 120 to switch the mapping of logical address space 312 from physical address space 321 to physical address space 322. Processor 110 then continues to execute the candidate resource (now the active resource) from physical address space 322, but does so using the same logical address space 312.

[0034] Figure 4 2 shows the logical to physical address mapping after the memory mapper 120 is configured to switch to the candidate resource. Figure 4 As shown, the same logical address space 312 is now mapped to physical address space 322 instead of physical address space 321, and the resources in physical address space 322 become active resources. The resources in physical address space 321 are no longer active resources.

[0035] The configuration of the address mapper 220 to convert the logical address space 312 to the physical address space 322 may occur before or simultaneously with the processor 110 actively accessing the resources accessed by the logical address space 312. Then, in order to switch the mapping of the logical address space 312 to the physical address space 322, the processor 110 sends the SWAP signal 115 ( Figure 1) is asserted to an appropriate logic level to cause selection logic 250 to provide the physical address at its "1" input to its output. In some examples, the change in the logic state of SWAP signal 115 and the resulting change in selection logic 250 to provide the physical address at its "1" input to its output may occur in less than one clock cycle (or by otherwise ensuring that the logical address being swapped is not accessed during the swap operation), thereby resulting in "real-time" resource updates, i.e., switching from one resource to another without stopping the operation of the executable resource and without requiring a reset of processor 110.

[0036] No system reboot is required because the logical address space, privileged (e.g., secure) and non-privileged (e.g., non-secure) configurations, global and static variables, local variables, pointers, global and static pointers, function pointers, etc. are preserved after remapping from one physical address space to another. Therefore, no cold boot, warm boot, or reset of the system or subsystem is required.

[0037] Figure 5 1 is a timing diagram showing the switching of execution of a first resource to a second resource. The first resource is stored at a first physical address in the memory 130. The second resource is stored at a second physical address in the memory 130. Figure 5 The timing diagram of FIG. 1 includes a waveform 501 indicating whether the firmware update resource 315 is being executed, a system reset signal 510, a device reset signal 502, a waveform 503 indicating whether the logical address of the first resource or the second resource is actively mapped to the corresponding physical address of the first resource or the second resource, and an exemplary waveform of the SWAP signal 315. In this example, the waveform 501 is logic low at 505 indicating that the firmware update resource 315 is not being executed, and the logic high state 506 of the waveform 501 indicates that the firmware update resource 315 is being executed by the processor 110.

[0038] 105. The system reset signal 510 is a reset signal provided to the RST input 107 of the system 105. The device reset signal is a reset signal provided to the RST input 113 of the processor 110. The reset signals 510 and 502 can be generated by, for example, a power-on reset circuit, an interrupt, etc. During a time period 511, the reset signals 502 and 510 are maintained at a logic low, thereby forcing the processor 110 and the system 105 to be in their respective reset states. When the system 105 and / or the processor 110 are in the reset state, the processor 110 cannot access any resource 135. At a rising edge 513, the RST signal 502 transitions to a logic high state, thereby interrupting the reset state of the processor during a time period 512.

[0039] Prior to executing the firmware update resource 315, with the SWAP signal 315 at a first level (e.g., logic low), the logical address space of the first resource is mapped to the first physical address by the memory mapper 120, as indicated at 520. The processor 110 then executes the firmware update resource 315, as indicated by the waveform 501 being logic high 506. The firmware update resource 315 remaps the logical address by which the first resource is accessed to the physical address at which the second resource is stored, as indicated at 530. In some examples, the firmware update resource 315 causes the SWAP signal 315 to change logic state (e.g., from logic low to logic high) at 527 to cause the selection logic 250 to change usage between the mappers 210 and 220, as described above. Any resource in the system 105 that has been using the logical address to access (e.g., call) the first resource may then continue to use the same logical address to access the second resource.

[0040] Figure 6 is an exemplary logical to physical address mapping of active resources A, B, and C from their respective logical address spaces 611, 612, and 613 to current physical address spaces 621, 622, and 623. Logical address spaces 611-613 do not need to be as Figure 6 All are continuous as shown in the example. Figure 6 As shown, logical address space 611 is mapped to physical address space 621; logical address space 612 is mapped to physical address space 622; and logical address space 613 is mapped to physical address space 623. Physical address spaces 621-623 may be continuous or discontinuous. In this example, physical address spaces 622 and 623 are continuous, and the physical address space is discontinuous with physical address space 621 or 622. Active resources A, B, and C are resources stored in or accessed at physical address spaces 621-623, respectively, which are mapped to logical address spaces 611-613, as shown in FIG. Figure 6 As shown, physical address spaces 624, 625, and 626 may contain candidate resources A, B, and C, respectively.

[0041] Processor 110 may configure memory mapper 120 to remap logical address spaces 611, 612, and 613 to physical address spaces 624, 626, and 625, respectively, thereby causing candidate resources AC to be executed. Figure 7 The logical to physical address mappings of the logical address spaces 611, 612, and 613 to the corresponding physical address spaces 624, 626, and 625 are included after the memory mapper 120 is reconfigured. Figure 7As shown, after the remapping operation, the previous candidate resources AC at physical address spaces 624, 626, and 624 are shown as "active" resources AC, and the previous active resources AC at physical address spaces 621-623 are now shown as "inactive" resources.

[0042] As mentioned above Figure 2 As described, the memory mapper 120 may have multiple mapper circuits 205 to allow each of the multiple logical address spaces to be converted into (e.g., two) different physical address spaces. Before the processor 110 executes or accesses resources AC from the physical address spaces 621-623, the processor 110 may configure the address mapper (e.g., address mapper 210) in the corresponding mapper circuit 205 of the memory mapper 120 to convert the logical address spaces 611-613 into the physical address spaces 621-623. Before or while the processor 110 executes or accesses resources AC, the processor 110 may configure other address mappers (e.g., address mapper 220) in the corresponding mapper circuit 205 to convert the logical address spaces 611-613 into the physical address spaces 624, 626, and 625. Then, to switch the mapping of logical address spaces 611-613 to physical address spaces 624, 626, and 625, processor 110 asserts SWAP signal 115 to an appropriate logic level to cause select logic 250 of mapper circuit 205 to switch between its inputs to provide a physical address at its output. As described above, in some examples, the change in the logic state of SWAP signal 115 and the resulting change in each select logic 250 to switch the use of its inputs may occur in less than one clock cycle (or in a time period in which the corresponding resource is not accessed).

[0043] Figure 6 and Figure 7 Logical address spaces 611 - 613 are shown being remapped from physical address spaces 621 - 623 to physical address spaces 624 , 626 , and 625 in parallel (eg, within one clock cycle). Figures 8 to 10 The same logical to physical address remapping is shown, but performed in a sequential manner, where the mapper circuit 205 for each of the three logical address spaces 611-613 is sequentially reconfigured. Figure 66. In the embodiment of the present invention, and as described above, the memory mapper 120 has been configured to map the logical address spaces 611-613 to the physical address spaces 621-623. Before or while the processor 110 executes resource A from the physical address space 621, the processor 110 reconfigures the memory mapper 120 so that the address mapper 220 in the mapper circuit 205 associated with the logical address space 611 maps the logical address space 611 to the physical address space 624. The processor 110 then asserts the SWAP signal 115 to cause the multiplexer 250 coupled to that particular address mapper to switch to an input that receives the physical address of the physical address space 624. Figure 8 It is shown that logical address space 611 has been remapped to physical address space 624, while logical address spaces 612 and 613 remain mapped to physical address spaces 622 and 623, respectively. As described above, the switch of logical address space 611 from physical address space 621 to physical address space 624 may occur within one clock cycle.

[0044] This process is repeated sequentially to remap the logical address spaces 612 and 613 . Fig. 9 Logical address space 612 is shown to have been remapped from physical address space 622 to physical address space 626 (e.g., within one clock cycle), while logical address space 613 remains mapped to physical address space 623. Processor 110 may reconfigure the address mapper of mapper circuit 205 associated with logical address space 612 before or while processor 110 executes resource B. Fig.10 It is shown that logical address space 613 has been remapped from physical address space 623 to physical address space 625.

[0045] Fig.11 1 is a flow chart illustrating an exemplary method 1100 for switching execution from a first resource (eg, located at physical address region 321) to a second resource (eg, located at physical address region 322). For example, method 1100 may be performed to implement Figure 3-4 and / or Figure 6-7In one example, the first resource and the second resource are identical copies of each other and therefore have the same size, which can provide redundancy. For example, if one or more instructions of the active resource are damaged, such redundancy may be advantageous. In another example, the first resource and the second resource are not identical and therefore may have different sizes. For example, the second resource may be an upgraded version of the first resource, generally performing the same function but with an upgrade, for example, which resolves an error in the code of the first resource, improves the performance of the second resource relative to the first resource, etc. In some examples, the first resource is stored at a first physical address in the memory 135 or is accessible at the first physical address. The first resource can be accessed (e.g., executed) using a first logical address, which is mapped to the first physical address by the memory mapper 120.

[0046] At step 1101, method 110 includes, for example, executing, by processor 110, a first resource from its first logical address, which is mapped to a first physical address of memory 135. At step 1102, the method includes loading a second resource into memory 135 at a second physical address. In other examples, the second resource may have already been loaded into memory, for example, before executing method 1100 (e.g., into a read-only memory (ROM) during manufacturing). In some examples, a memory mapper (e.g., 120) may be reconfigured during step 1102. Then, at step 1103, while processor 110 is executing a firmware update resource, the method includes remapping the first logical address to the second physical address. For example, in some examples, SWAP signal 115 is asserted during step 1103. In some examples, the memory mapper may be reconfigured during step 1103. At step 1104, the method includes executing, by the processor, the second resource from the first logical address.

[0047] In some examples, before making the candidate resource available for execution by the processor 110 (e.g., before the SWAP signal 115 is asserted), for example, as a result of the resource update process (e.g., 1100) described herein, the processor 110 may perform one or more checks on the candidate resource. Such checks may include, for example, authenticating the source of the candidate resource, verifying the integrity of the candidate resource, or any combination of functionally verifying the candidate resource. If any such checks fail, the system 105 may refuse to switch from the currently executing resource to the candidate resource and may report an error. Otherwise, if all such checks pass, the system 105 may remap the logical address space of the active resource to the physical address space where the candidate resource is stored or accessible (e.g., by asserting the SWAP signal 115).

[0048] Fig.12is a flow chart illustrating an exemplary method 1200 including one or more checks on a candidate resource. For example, the method 1200 may be performed to implement Figure 3-4 and / or Figure 6-7 Example. Before the logical address space of the active resource is remapped to the physical address space storing the candidate resource, the checks at steps 1201-1203 may be performed on the candidate resource. The checks of steps 1201-1203 may be performed in the order shown or in a different order. One or more of the checks of steps 1201-1203 may be performed at any time before the logical address space of the active resource is remapped to the physical address space of the candidate resource. In some examples, any of the checks of steps 1201-1203 may be performed by a processor that executes a resource (e.g., an authentication or verification resource) at its own logical address to check the candidate resource. For example, the candidate resource may be loaded into the memory 135 one hour, one week, one month, one year, etc. before the system 105 switches from the active resource to the previously loaded candidate resource, or the candidate resource may have been preloaded into the memory from the factory (e.g., may be stored in ROM). In some examples, one or more checks of steps 1201-1203 may be performed when the candidate resource is loaded into memory 135, and thus relatively long before switching from execution of the active resource to the candidate resource. In some examples, one or more checks 1201-1203 may be performed during execution of the firmware update resource (e.g., during time period 506).

[0049] In some examples, resources stored in memory 135 may be executed by processor 110 to perform the checks of steps 1201 - 1203 .

[0050] In step 1201, processor 110 authenticates the candidate resource. The authentication process may include, for example, using a digital certificate and a digital signature to confirm that the digital "signer" of the candidate resource is correct. In some examples, the authentication process may include calculating a hash of the candidate resource and comparing the calculated hash to the digital signature.

[0051] In step 1202, processor 110 performs integrity verification on the candidate resource, which ensures that all bits of the candidate resource are present and not corrupted. The integrity verification process may include, for example, calculating a checksum and comparing the calculated checksum with a known checksum value, calculating a cyclic redundancy check (CRC) code, etc.

[0052] In step 1203, processor 110 performs functional verification on the candidate resource, which tests whether the candidate resource functions as expected. In one example, the candidate resource may be executed by processor 110 using test data, and the output value for the test data from the correctly executed candidate resource is known. The result of executing the candidate resource using the test data can be compared with the known result. If the results match, the candidate resource passes the functional verification. If any check of steps 1201-1203 fails, the process for updating the active resource to the candidate resource can be terminated without switching to the candidate resource (e.g., without asserting SWAP signal 115).

[0053] Additional or different checks that may be performed prior to executing step 1204 include rollback prevention (described below with respect to step 1209 ), verifying versions of firmware and hardware, and verifying the format of the candidate resource (e.g., confirming that all functionality exists for the candidate resource based on a manifest).

[0054] At step 1204, as described above, the processor 110 executes the firmware update resource 315, which may reconfigure the memory mapper 120 to switch the mapping between the logical address space of the physical address space of the active resource and the physical address space of the candidate resource. Step 1204 may include the processor 110 asserting the SWAP signal 115 to cause the memory mapper 120 to begin using the logical to physical address mapping of the candidate resource. In some examples, the processor 110 may have previously (e.g., before step 1204) configured the address mapper 210, 220 of the memory mapper 120 with information required to convert the logical address space to the corresponding physical address space of the candidate resource. Alternatively, step 1205 may include the processor 110 configuring the address mapper of the memory mapper 120 with information required to convert the logical address space to the corresponding physical address space of the candidate resource.

[0055] Step 1205 includes performing one or more (e.g., additional) validation checks on the candidate resource before it is submitted for use. The validation checks in step 1205 may include one or more (e.g., similar or identical) of the checks in steps 1201-1203 described above. If any validation check in step 1205 fails, control passes to step 1206, where processor 110 executes firmware update resource 315 again to switch the logical to physical address mapping back to the physical address of the active resource. For example, during step 1206, firmware update resource 315 may de-assert SWAP signal 115 to cause selection logic 250 to change the logical to physical address mapping back to the previous mapping implemented before executing step 1204.

[0056] If the validation check in step 1205 passes, steps 1207-1209 are performed, for example, in the order shown or in a different order. In step 1207, processor 110 commits the candidate resource as a new active resource to allow processor 110 to access it. Committing the candidate resource may include setting a status bit in a register, for example, to indicate that the new active resource has been successfully installed and is, for example, free to run. For example, in some examples, before executing step 1207, the new active resource may run in a reduced functionality mode (e.g., a safe mode). After executing step 1207, the new active resource may run in a normal (e.g., full functionality) mode.

[0057] The processor 110 may set one or more additional configurations in step 1208, such as firewall and security configurations, hardware accelerator activations, new configurations associated with new functionality introduced by the new active resource, and the like.

[0058] In step 1209, the processor 110 may update (e.g., increment) the rollback protection value. In some examples, each version of the resource may have, for example, a unique index number. The rollback protection value prevents the processor 110 from switching back to a previous version of the resource whose index number is less than the current rollback protection value. By updating the rollback protection value in step 1209, the firmware update resource 315 may be unable to switch the logical to physical address mapping of the newly active resource to the previous version of the resource. Another check that may be included before performing step 1204 is rollback prevention, in which the candidate's index number is compared to the rollback prevention value. If the candidate's index number is inconsistent with the rollback prevention value (e.g., is less than the rollback prevention value), the processor 110 may reject the conversion to the candidate resource.

[0059] Exemplary embodiments of the present disclosure are summarized here. Other embodiments may also be understood from the entire specification and claims submitted herein.

[0060] Example 1. A system comprising: a memory, the memory comprising: a first resource at a first physical address space including a first physical address and a second resource at a second physical address space including a second physical address; a memory mapper, the memory mapper coupled to the memory, the memory mapper configured to convert a logical address into a physical address; and a processor, the processor coupled to the memory mapper, the processor configured to: execute the first resource from a first logical address mapped by the memory mapper to the first physical address; when executing a firmware update resource, remap the first logical address to the second physical address using the memory mapper; and execute the second resource from the first logical address.

[0061] Example 2. The system of example 1, wherein the memory further comprises the firmware update resource at a third physical address.

[0062] Example 3. A system according to one of Examples 1 or 2, wherein the processor is configured to perform authentication of the second resource before remapping the first logical address to the second physical address.

[0063] Example 4. The system of one of Examples 1 to 3, wherein the processor is configured to perform integrity verification of the second resource before remapping the first logical address to the second physical address.

[0064] Example 5. The system of one of Examples 1 to 4, wherein the processor is configured to perform functional verification of the second resource before remapping the first logical address to the second physical address.

[0065] Example 6. A system according to one of Examples 1 to 5, wherein the processor is configured to: execute a verification resource at a second logical address to perform the functional verification of the second resource at the second physical address before remapping the first logical address to the second physical address; and remap the first logical address to the second physical address in response to successful functional verification of the second resource.

[0066] Example 7. The system of one of Examples 1 to 6, wherein the processor is configured to remap the first logical address from the second physical address back to the first physical address in response to a failure during execution of the second resource.

[0067] Example 8. The system of one of Examples 1 to 7, wherein the processor is configured to cause a memory location associated with the first resource to be released after remapping the first logical address to the second physical address.

[0068] Example 9. The system of one of Examples 1 to 8, wherein the first physical address corresponds to a first instruction of the first resource, and the second physical address corresponds to a first instruction of the second resource.

[0069] Example 10. The system of one of Examples 1 to 9, wherein a size of the first physical address space is different from a size of the second physical address space.

[0070] Example 11. The system of one of Examples 1 to 10, wherein the second resource is a copy of the first resource.

[0071] Example 12. A system according to one of Examples 1 to 11, wherein the processor includes a reset input, wherein the processor is configured to reset in response to assertion of the reset input, and wherein the processor is configured to remap the first logical address to the second physical address and use the second resource while the reset input remains deasserted.

[0072] Example 13. A system according to one of Examples 1 to 12, wherein the processor is configured to execute instructions based on a clock, and wherein the processor is configured to remap the first logical address to the second physical address within 1 clock cycle of the clock.

[0073] Example 14. The system of one of Examples 1 to 13, wherein the processor is configured to load the second resource into the second physical address space.

[0074] Example 15. The system of one of Examples 1 to 14, wherein the memory comprises a read-only memory storing the second resource at the second physical address space.

[0075] Example 16. A system according to one of Examples 1 to 15, wherein the processor is configured to remap the first logical address to the second physical address by: providing the second physical address to the memory mapper; and asserting a swap signal to cause the memory mapper to select a conversion of the first logical address to the second physical address rather than a conversion of the first logical address to the first physical address.

[0076] Example 17. An integrated circuit (IC) comprising: a memory mapper configured to convert a logical address into a physical address; and a processor coupled to the memory mapper, the processor configured to: execute a first resource from a first logical address mapped by the memory mapper to a first physical address of a memory; when executing a firmware update resource, remap the first logical address to a second physical address of a second resource using the memory mapper; and execute the second resource from the first logical address.

[0077] Example 18. The IC of Example 17, wherein the IC includes the memory coupled to the memory mapper.

[0078] Example 19. The IC of one of Examples 17 or 18, wherein the processor is configured to perform authentication, integrity verification, or functional verification of the second resource before remapping the first logical address to the second physical address.

[0079] Example 20. An IC according to one of Examples 17 to 19, wherein the processor is configured to: perform authentication, integrity verification, or functional verification of the second resource after configuring the memory mapper to remap the first logical address to the second physical address; when executing the firmware update resource, in response to a failure of the authentication, integrity verification, or functional verification of the second resource, remap the first logical address back to the first physical address; and execute the first resource from the first logical address.

[0080] Example 21. The IC of one of Examples 17 to 20, wherein in response to success of the authentication, integrity verification, or functional verification of the second resource, the processor is configured to change a rollback protection value.

[0081] Example 22. An IC according to one of Examples 17 to 21, wherein the processor includes a reset input, wherein the processor is configured to reset in response to assertion of the reset input, and wherein the processor is configured to remap the first logical address to the second physical address while the reset input of the processor remains deasserted.

[0082] Example 23. The IC of one of Examples 17 to 22, wherein the IC further comprises a reset input, and wherein the processor is configured to remap the first logical address to the second physical address while the reset input of the IC remains deasserted.

[0083] Example 24. A method comprising: executing, by a processor, a first resource from a first logical address mapped to a first physical address of a memory; when a firmware update resource is executed by the processor, remapping the first logical address to a second physical address of the memory; and executing, by the processor, a second resource from the first logical address.

[0084] Example 25. The method of Example 24, further comprising executing, by the processor, a third resource before remapping the first logical address to the second physical address, the third resource performing authentication, integrity verification, or functional verification of the second resource.

[0085] Example 26. The method according to one of Examples 24 or 25 further includes: after remapping the first logical address to the second physical address, executing a third resource by the processor, the third resource performing authentication, integrity verification or functional verification of the second resource; when the firmware update resource is executed by the processor, in response to a failure of the authentication, integrity verification or functional verification of the second resource, remapping the first logical address back to the first physical address; and executing the first resource from the first logical address by the processor.

[0086] Example 27. The method of one of Examples 24 to 26, wherein remapping the first logical address to the second physical address occurs within 1 clock cycle of a clock of the processor.

[0087] While certain elements of the described examples are included within an integrated circuit and other elements are external to the integrated circuit, in other example embodiments, additional or fewer features may be incorporated into the integrated circuit.

[0088] Modifications may be made in the described embodiments, and other embodiments are possible, within the scope of the claims.

Claims

1. A system comprising: a memory comprising: a first resource at a first physical address space including a first physical address and a second resource at a second physical address space including a second physical address; a memory mapper coupled to the memory, the memory mapper configured to convert a logical address to a physical address; and a processor, the processor being coupled to the memory mapper, the processor being configured to: executing the first resource from a first logical address mapped by the memory mapper to the first physical address; When executing a firmware update resource, remapping the first logical address to the second physical address using the memory mapper; and The second resource is executed from the first logical address. 2 . The system of claim 1 , wherein the memory further comprises the firmware update resource at a third physical address. 3 . The system of claim 1 , wherein the processor is configured to perform authentication of the second resource before remapping the first logical address to the second physical address. 4 . The system of claim 1 , wherein the processor is configured to perform integrity verification of the second resource before remapping the first logical address to the second physical address. 5 . The system of claim 1 , wherein the processor is configured to perform a functional verification of the second resource before remapping the first logical address to the second physical address.

6. The system of claim 5, wherein the processor is configured to: before remapping the first logical address to the second physical address, executing a verification resource at a second logical address to perform the functional verification of the second resource at the second physical address; and Responsive to successful functional verification of the second resource, the first logical address is remapped to the second physical address.

7. The system of claim 1, wherein the processor is configured to remap the first logical address from the second physical address back to the first physical address in response to a failure during execution of the second resource.

8. The system of claim 1, wherein the processor is configured to cause a memory location associated with the first resource to be released after remapping the first logical address to the second physical address.

9. The system of claim 1, wherein the first physical address corresponds to a first instruction of the first resource and the second physical address corresponds to a first instruction of the second resource.

10. The system of claim 1, wherein a size of the first physical address space is different from a size of the second physical address space.

11. The system of claim 1, wherein the second resource is a copy of the first resource.

12. The system of claim 1 , wherein the processor comprises a reset input, wherein the processor is configured to reset in response to assertion of the reset input, and wherein the processor is configured to remap the first logical address to the second physical address and use the second resource while the reset input of the processor remains deasserted.

13. The system of claim 1, wherein the processor is configured to execute instructions based on a clock, and wherein the processor is configured to remap the first logical address to the second physical address within 1 clock cycle of the clock.

14. The system of claim 1, wherein the processor is configured to load the second resource into the second physical address space.

15. The system of claim 1, wherein the memory comprises a read-only memory storing the second resource at the second physical address space.

16. The system of claim 1, wherein the processor is configured to remap the first logical address to the second physical address by: providing the second physical address to the memory mapper; and A swap signal is asserted to cause the memory mapper to select translation of the first logical address to the second physical address instead of translation of the first logical address to the first physical address.

17. An integrated circuit (IC), comprising: a memory mapper configured to convert a logical address to a physical address; and a processor, the processor being coupled to the memory mapper, the processor being configured to: executing a first resource from a first logical address mapped by the memory mapper to a first physical address of a memory; When executing a firmware update resource, remapping the first logical address to a second physical address of a second resource using the memory mapper; as well as The second resource is executed from the first logical address.

18. The IC of claim 17, wherein the IC comprises the memory coupled to the memory mapper.

19. The IC of claim 17, wherein the processor is configured to perform authentication, integrity verification, or functional verification of the second resource before remapping the first logical address to the second physical address.

20. The IC of claim 17, wherein the processor is configured to: performing authentication, integrity verification, or functional verification of the second resource after configuring the memory mapper to remap the first logical address to the second physical address; in response to a failure of the authentication, integrity verification, or functional verification of the second resource while executing the firmware update resource, remapping the first logical address back to the first physical address; as well as The first resource is executed from the first logical address.

21. The IC of claim 20, wherein in response to success of the authentication, integrity verification, or functional verification of the second resource, the processor is configured to change a rollback protection value.

22. The IC of claim 17, wherein the processor includes a reset input, wherein the processor is configured to reset in response to assertion of the reset input, and wherein the processor is configured to remap the first logical address to the second physical address while the reset input of the processor remains deasserted.

23. The IC of claim 22, wherein the IC further comprises a reset input, and wherein the processor is configured to remap the first logical address to the second physical address while the reset input of the IC remains de-asserted.

24. A method comprising: executing, by the processor, a first resource from a first logical address mapped to a first physical address of the memory; When the processor executes a firmware update resource, remapping the first logical address to a second physical address of the memory; as well as A second resource is executed by the processor from the first logical address.

25. The method of claim 24, further comprising executing, by the processor, a third resource before remapping the first logical address to the second physical address, the third resource performing authentication, integrity verification, or functional verification of the second resource.

26. The method of claim 24, further comprising: After remapping the first logical address to the second physical address, executing, by the processor, a third resource, the third resource performing authentication, integrity verification, or functional verification of the second resource; in response to a failure of the authentication, integrity verification, or functional verification of the second resource when the firmware update resource is executed by the processor, remapping the first logical address back to the first physical address; as well as The first resource is executed by the processor from the first logical address.

27. The method of claim 24, wherein remapping the first logical address to the second physical address occurs within 1 clock cycle of a clock of the processor.

Images