Chip hardware domain upgrading method and device, chip and vehicle

Abstract

The present application discloses a method, device, chip, and vehicle for upgrading the hardware domain of a chip. The method is applied to the chip and includes: if the first security domain determines that the chip enters the first upgrade mode, releasing the control of the first storage area of ​​the first security domain to the first application domain, where the first upgrade resource is stored; generating and storing first identification information used to indicate that the first upgrade resource has been released; in the first upgrade mode, the second security domain releases the control of its second storage area to the first application domain, where the second upgrade resource is stored; if the first application domain obtains the first upgrade resource and the second upgrade resource based on inter-core communication, performing an upgrade operation on the inactive partition of the first application domain based on the first upgrade resource, the second upgrade resource, and the third upgrade resource stored by the first application domain itself. This method implements the upgrade of a portion of the hardware domain.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of chip design, manufacturing and application, in particular to a chip hardware domain upgrading method and device, chip and vehicle. BACKGROUND

[0002] The use and upgrading of chips are technical problems often encountered in related application scenarios. For example, in the design and manufacturing scene of vehicles, over the air (OTA) is often applied to vehicles. OTA upgrading can make up for the short board of vehicle performance for the vehicle owner, increase various intelligent new functions, and continuously improve the vehicle experience. With the wide use of multi-core heterogeneous chips, especially in the vehicle cabin scene, supporting OTA has become a basic requirement in the entire system. However, the current upgrading operation usually requires complex software architecture, and cannot independently upgrade part of the hardware domain in the chip, so the upgrading efficiency is low. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a chip hardware domain upgrading method, which can efficiently upgrade part of the hardware domain in the chip.

[0004] To achieve this purpose, the chip hardware domain upgrading method provided by the embodiments of the present application is applied to a chip including at least two different processor cores. Each processor core and its corresponding hardware resource form a hardware domain. The hardware domains are hard isolated. The hardware domains include a first security domain, a second security domain and at least one application domain. The first security domain, the second security domain and the application domain have inter-core communication with each other. The method comprises the following steps:

[0005] If the first security domain determines that the chip enters a first upgrading mode, the control right of a first storage area of the first security domain is released to a first application domain. The first storage area stores first upgrading resources. The first upgrading mode is set through a global register of the chip.

[0006] First identification information for representing that the first upgrading resources have been released is generated and stored through the global register.

[0007] In the first upgrading mode, the second security domain releases the control right of a second storage area thereof to the first application domain. The second storage area stores second upgrading resources.

[0008] Second identification information for representing that the second upgrading resources have been released is generated and stored through the global register.

[0009] In a case that the first application domain is based on inter-core communication, and the first upgrade resource and the second upgrade resource are acquired, the inactive partition of the first application domain is upgraded based on the first upgrade resource, the second upgrade resource, and a third upgrade resource stored by the first application domain itself.

[0010] As an option, the releasing the control right of the first storage area of the first security domain to the first application domain if the first security domain determines that the chip enters the first upgrade mode comprises:

[0011] The boot information of the chip is acquired by the first security domain.

[0012] If the boot information indicates that the chip enters the first upgrade mode, the identity of the pre-upgrade application domain is determined based on the first upgrade mode.

[0013] In a case that the pre-upgrade application domain is determined to be the first application domain, the data access right of the first storage area is released to the first application domain.

[0014] As an option, the method further comprises:

[0015] The global register is accessed by a first operating system of the first application domain.

[0016] If the first operating system acquires the first identification information and / or the second identification information from the global register, the first upgrade resource is acquired from the first storage area of the first security domain, and / or the second upgrade resource is acquired from the second storage area of the second security domain.

[0017] As an option, the acquiring the first upgrade resource from the first storage area of the first security domain, and / or the acquiring the second upgrade resource from the second storage area of the second security domain comprises:

[0018] In a case that the first application domain acquires the control right of the first storage area and the second storage area, the first storage area and the second storage area are both initialized.

[0019] The first upgrade resource and the second upgrade resource are acquired from the first storage area and the second storage area after the initialization operation, respectively.

[0020] As an option, the upgrading the inactive partition of the first application domain based on the first upgrade resource, the second upgrade resource, and a third upgrade resource stored by the first application domain itself comprises:

[0021] The first upgrade resource, the second upgrade resource and the third upgrade resource are spliced based on a data association relationship to form an upgrade data package.

[0022] The inactive partition is selected in the first application domain, and the upgrade data package is used to perform an upgrade operation on data in the inactive partition.

[0023] Third identification information is generated based on a result of the upgrade operation, wherein the third identification information is used to represent whether the upgrade operation conforms to a preset upgrade result.

[0024] Optionally, before the chip enters the first upgrade mode, the method further comprises:

[0025] A preset upgrade data package is split to form the first upgrade resource, the second upgrade resource and the third upgrade resource, wherein the upgrade data package is a differential package with a data difference attribute.

[0026] The first upgrade resource, the second upgrade resource and the third upgrade resource are respectively stored in the first security domain, the second security domain and the first application domain of the chip.

[0027] Optionally, after the inactive partition of the first application domain is upgraded, the method further comprises:

[0028] The startup mode of the chip is adjusted from the first upgrade mode to a non-upgrade mode.

[0029] The chip is restarted.

[0030] Embodiments of the present application also provide a hardware domain upgrade device of a chip, which is applied to a chip including at least two different processor cores, each of the processor cores forms a hardware domain with a corresponding hardware resource, the hardware domains are hard-isolated, the hardware domain includes a first security domain, a second security domain and at least one application domain, the first security domain, the second security domain and the application domain have inter-core communication, and the hardware domain upgrade device of the chip includes:

[0031] A first control module is configured to release control right of a first storage area of the first security domain to a first application domain if the first security domain determines that the chip enters a first upgrade mode, wherein the first storage area stores a first upgrade resource, and the first upgrade mode is set through a global register of the chip.

[0032] A first generation module is configured to generate and store first identification information representing that the first upgrade resource has been released through the global register.

[0033] a second control module, configured to control the second security domain to release control of a second storage area of the second security domain to the first application domain in the first upgrade mode, wherein the second storage area stores second upgrade resources;

[0034] a second generation module, configured to generate and store second identification information for representing that the second upgrade resources have been released through the global register;

[0035] a processing module, configured to, in a case where the first application domain acquires the first upgrade resources and the second upgrade resources based on the inter-core communication, perform an upgrade operation on an inactive partition of the first application domain based on the first upgrade resources, the second upgrade resources, and third upgrade resources stored by the first application domain itself.

[0036] The embodiment of the present application further provides a chip, which comprises the hardware domain upgrade apparatus of the chip as described above, and is used for upgrading hardware domains of the chip.

[0037] The embodiment of the present application further provides a vehicle, which is installed with the chip as described above, and the chip can upgrade hardware domains inside the vehicle.

[0038] In the hardware domain upgrade method of the chip, the pre-upgrade first application domain can acquire upgrade resources stored in each hardware domain of the chip based on the inter-core communication, and then generate corresponding upgrade data packets, so that the first application domain itself is upgraded without affecting other hardware domains (including security domains and other application domains), and the upgrade efficiency is improved. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 a flowchart of the hardware domain upgrade method of the chip of the embodiment of the present application;

[0040] Figure 2 a flowchart of one embodiment of the hardware domain upgrade method of the embodiment of the present application; Figure 1 a flowchart of one embodiment of step S100 in the method;

[0041] Figure 3 a flowchart of one embodiment of the hardware domain upgrade method of the embodiment of the present application;

[0042] Figure 4 a flowchart of one embodiment of the hardware domain upgrade method of the embodiment of the present application; Figure 3 a flowchart of one embodiment of step S700 in the method;

[0043] Figure 5 a flowchart of one embodiment of the hardware domain upgrade method of the embodiment of the present application; Figure 1 a flowchart of one embodiment of step S500 in the method;

[0044] Figure 6 a flow chart of another embodiment of the hardware domain upgrade method of the embodiments of the present application;

[0045] Figure 7 a flow chart of the hardware domain of the embodiments of the present application during the upgrade process;

[0046] Figure 8 a structural block diagram of the hardware domain upgrade device of the chip of the embodiments of the present application. DETAILED DESCRIPTION

[0047] Various aspects of the application are now described with reference to the drawings. While specific configurations are described in detail below, it should be understood that various modifications can be made to the embodiments described herein.

[0048] It should be understood that various modifications can be made to the embodiments described herein. Therefore, the above description should not be construed as limiting, but merely as exemplification of the embodiments. Those skilled in the art will envision other modifications within the scope and spirit of the application.

[0049] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the application and, together with the general description of the application given above, and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0050] These and other characteristics of the present application will become apparent from the following description of the preferred forms given, by way of non-limiting example only, with reference to the attached drawings.

[0051] It should also be understood that, although the present application has been described in relation to certain specific examples, many other equivalents falling within the scope of the present application will be apparent to those skilled in the art.

[0052] The above and other aspects, features, and advantages of the present application will become apparent from the following detailed description, taken in conjunction with the accompanying drawings, when considered in conjunction with the following detailed description.

[0053] Specific embodiments of the present application are described hereinafter, by way of non-limiting example only, with reference to the accompanying drawings. It should be understood that the disclosed embodiments are merely representative of the application, which can be practiced in a variety of ways. Well-known and / or redundant functions and structures have not been described in detail in order to avoid obscuring the present application unnecessarily.

[0054] This description can use the phrases "in an embodiment," "in another embodiment," "in yet another embodiment," or "in at least one embodiment" which can refer to one or more embodiments of the present application.

[0055] The chip hardware domain upgrading method of the embodiment of the present application is applied to a chip including at least two different processor cores, and the chip can be a chip with multi-core heterogeneity, such as a system on chip (SOC) with multi-core heterogeneity. Multi-core heterogeneity refers to a chip architecture design that integrates multiple processor cores, and at least two of the cores are different in structure, function or performance. Some tasks can be more suitable for high-performance general-purpose processor cores, and other tasks can require more specialized cores to improve efficiency. A plurality of hardware resources, such as central processing units, memory controllers and graphics processing units, can be integrated on the chip. These hardware resources are configured as a plurality of different hardware component sets, referred to as hardware domains, and the hardware domains are hard-isolated, and each hardware domain works independently to prevent mutual interference or influence. The reliability, stability and anti-interference capability of the chip are improved. However, the hardware domains can communicate with each other, and the inter-core communication includes a plurality of communication mechanisms, specifically including asynchronous message passing through a mailbox mechanism and data sharing across hardware domains through a shared memory mechanism.

[0056] In the embodiment, the hardware domains include a first security domain, a second security domain and at least one application domain. The security domain includes at least one of the following features: an architecture with high functional safety, an operating system meeting the requirements of high functional safety, and a task meeting the requirements of high functional safety. The application domain is one or more of the hardware domains, and refers to the hardware domain having strong computing performance and being able to support an application program with high computing performance requirements.

[0057] The first security domain, the second security domain and the application domain have inter-core communication with each other, and the inter-core communication can be asynchronous message passing through a mailbox mechanism or communication between the first security domain, the second security domain and the application domain through a shared memory mechanism. The mailbox mechanism is a communication mechanism for processing communication between multiple devices through a message queue and an interrupt-driven signal. The shared memory mechanism can be implemented by releasing the storage area control of the hardware domain. The functions of the first security domain in the embodiment can be different from those of the second security domain, for example, the first security domain can be a safety domain, and the second security domain can be a secure domain. The specific roles of the first security domain and the second security domain can be different, and the two can work in coordination with each other, for example, they can work in coordination to provide services for other application domains.

[0058] The chip hardware domain upgrading method of the embodiment of the present application is described in detail below with reference to the accompanying drawings, Figure 1 The flowchart of the chip hardware domain upgrading method of the embodiment of the present application is shown in FIG. Figure 1 and is described in combination with Figure 6 and Figure 7 The method includes the following steps:

[0059] S100, if the first security domain determines that the chip enters a first upgrade mode, releasing control of a first storage area of the first security domain to a first application domain, wherein the first storage area stores a first upgrade resource, and the first upgrade mode is set through a global register of the chip.

[0060] Exemplarily, the hardware domains in the chip can be upgraded according to actual needs. For example, in the case of needing to improve the performance of the chip, part or all of the hardware domains of the chip need to be upgraded. For another example, in the case of needing to add new functions to the chip, part or all of the hardware domains of the chip need to be upgraded. In the embodiment, an upgrade data package for upgrading the hardware domains can be stored in a preset memory in the chip in advance, the upgrade data package is sent to the chip through a network, a transmission medium or the like, and then the upgrade data package is split and sent to each hardware domain of the chip for storage, such as storage in the update partition of the emmc of the hardware domain.

[0061] The chip has multiple modes, such as a working mode, a restart mode, an upgrade mode and the like. The mode of the chip can be set by using a global register of the chip. In an embodiment, the mode of the chip can be determined by setting a value corresponding to the global register. For example, if a value corresponding to the global register boot reason is set to 10, it indicates that the chip needs to be restarted for software upgrade. If the value corresponding to the global register boot reason is set to 5, it indicates that the chip detects an abnormal temperature of the chip, and a temperature abnormality event triggers the generation of a restart event.

[0062] After the chip is started, the first security domain determines the mode of the chip by using a value corresponding to the global register. If the first security domain determines that the chip enters a first upgrade mode, the first security domain releases control of a first storage area to a first application domain. The chip can include multiple application domains, and the first application domain can be one of them.

[0063] Under the premise of ensuring the safety of the data stored in the first security domain, the first application domain can operate the data in the first storage area of the first security domain, and since the first storage area pre-stores the first upgrade resource, the first application domain can obtain the first upgrade resource from the first storage area. The first upgrade resource can be part of an upgrade data package

[0064] S200, generating and storing first identification information for indicating that the first upgrade resource has been released by using the global register.

[0065] Exemplarily, the global register can be used by each hardware domain of the chip, which is a non-proprietary register. After the first security domain releases the control of the first storage area to the first application domain, first identification information is generated in the global register, which can represent that the first upgrade resource in the first storage area has been released. If other hardware domains request to obtain the first upgrade resource again, the first identification information will be identified, and the obtaining operation of the first upgrade resource will be temporarily abandoned.

[0066] In another embodiment, if the data access permission of the first storage area of the first security domain is re-limited and is no longer released to other hardware domains, including the first application domain. The first upgrade resource will recover to the limited state, and first indication information corresponding to the first identification information can be generated in the global register, which represents that the current state of the first upgrade resource is not released.

[0067] S300, in the first upgrade mode, the second security domain releases the control of the second storage area to the first application domain, wherein the second storage area stores a second upgrade resource.

[0068] Exemplarily, part or all of the functions of the second security domain can be similar to those of the first security domain, and the two can coordinate with each other to provide services for other hardware domains (such as other application domains). For example, when the first security domain is in a busy state, the second security domain can serve the corresponding hardware domain based on the instructions of the first security domain. The second security domain in the embodiment is provided with a second storage area, and the second storage area can pre-store a second upgrade resource. The second upgrade resource can be part of the upgrade data packet, and the data content thereof is different from that of the first upgrade resource.

[0069] In one embodiment, when the second security domain determines that the chip enters the first upgrade mode, the second security domain releases the control of the second storage area to the first application domain, such as releasing the emmc of the second security domain to the first application domain, so that the first application domain can obtain the second upgrade resource stored in the second storage area based on the inter-core communication. The second security domain can then enter its operating system.

[0070] In another embodiment, if the second security domain determines that the first security domain has released the control of the first storage area to the first application domain, the second security domain can also release the control of the second storage area to the first application domain, so that the first application domain can obtain the second upgrade resource stored in the second storage area.

[0071] In the embodiment, the first upgrade resource and the second upgrade resource are pre-stored in the first security domain and the second security domain respectively, so that the data security of the first upgrade resource and the second upgrade resource is improved, and meanwhile, the separately stored upgrade data packets are achieved, so that the flexible storage is realized and the related data is convenient to retrieve.

[0072] S400, generating and storing second identification information for representing that the second upgrade resource has been released through the global register.

[0073] For example, after the second security domain releases the control right of the second storage area to the first application domain, the second identification information is generated in the global register, and the second identification information can represent that the second upgrade resource in the second storage area has been released. If other hardware domains request to obtain the second upgrade resource again, the other hardware domains will temporarily give up the obtaining operation of the second upgrade resource after recognizing the second identification information.

[0074] If the data access right of the second storage area of the second security domain is restricted again and is not released to other hardware domains, including not released to the first application domain, the second upgrade resource will return to the limited state, and second indication information corresponding to the second identification information can be generated in the global register, and the second indication information represents that the current state of the second upgrade resource is not released.

[0075] S500, in the case that the first application domain obtains the first upgrade resource and the second upgrade resource based on the inter-core communication, performing an upgrade operation on the inactive partition of the first application domain based on the first upgrade resource, the second upgrade resource and a third upgrade resource stored in the first application domain.

[0076] For example, the first application domain is hard-isolated with the first security domain and the second security domain, and the first application domain, the first security domain and the second security domain can independently work and prevent mutual interference or influence, so that the reliability, stability and anti-interference ability of the chip are improved. The first application domain has inter-core communication with the first security domain and the second security domain, so that the first application domain can obtain the first upgrade resource and the second upgrade resource based on the inter-core communication.

[0077] The third upgrade resource is stored in the first application domain and is also part of the upgrade data package. On one hand, the first application domain can integrate the first upgrade resource, the second upgrade resource and the third upgrade resource stored by itself to form the upgrade data package; on the other hand, the first application domain can also use the similar method to obtain other upgrade resources from other hardware domains, and then integrate the first upgrade resource, the second upgrade resource, the third upgrade resource and the other upgrade resources to form the upgrade data package for upgrading the first application domain. Moreover, the process of using the upgrade data package to upgrade the first application domain will not affect other hardware domains of the chip.

[0078] In one embodiment, the first application domain includes an active partition and an inactive partition, and the active partition has data being used, such as data used by the first application domain in a working state. The data in the inactive partition can be temporarily not called. After obtaining the upgrade data package, the first application domain can determine the active partition and the inactive partition of itself, and can only perform the upgrade operation on the inactive partition. Of course, the inactive partition can also be adjusted and then upgraded. For example, the inactive partition that has been upgraded is converted into a new active partition, and the original active partition that has not been upgraded is converted into an inactive partition, and then the new inactive partition is upgraded. Thus, based on the upgrade data package, the first application domain can perform a complete upgrade operation.

[0079] The hardware domain upgrade method of the chip implemented in the present application can make the pre-upgraded first application domain obtain the upgrade resources stored in each hardware domain of the chip based on inter-core communication, and then generate corresponding upgrade data packages, so as to only perform the upgrade operation on the first application domain itself without affecting other hardware domains (including the security domain and other application domains), thereby improving the upgrade efficiency.

[0080] In one embodiment of the present application, if the first security domain determines that the chip enters the first upgrade mode, the first security domain releases the control right of the first storage area to the first application domain, such as Figure 2 as shown, comprising:

[0081] S110, obtaining boot information of the chip by the first security domain.

[0082] For example, the boot information of the chip is used to guide the start of the chip, and the boot process includes guiding the chip to one of multiple modes, such as a working mode, a standby mode, an upgrade mode, etc.

[0083] After the first security domain obtains the boot information, the first security domain can determine the boot content of the boot information. Thus, the first security domain can perform an adaptive action.

[0084] For example, the boot information of the chip can be represented by a global register boot reason. If the value stored in the global register boot reason is set to a value corresponding to an update mode (first upgrade mode) in advance, the chip system is restarted, and the first secure domain obtains the value stored in the global register boot reason to determine that the chip enters the update mode and enters an OTA upgrade start mode. In an embodiment, if the value stored in the global register boot reason does not correspond to the update mode, the operating system (such as Linux or android) of the first secure domain can be normally entered, or an error can be reported.

[0085] S120, if the boot information represents that the chip enters the first upgrade mode, determining the identity of the pre-upgrade application domain based on the first upgrade mode.

[0086] For example, the first secure domain determines that the chip enters the first upgrade mode according to the boot information. The first upgrade mode can only perform upgrade operations on part of the hardware domains (including secure domains and application domains). Without the need for all hardware domains to perform upgrade operations, the upgrade efficiency is effectively improved, and the first secure domain further determines which application domain in the chip will perform the upgrade operation, that is, determines the identity of the domain upgrade application domain.

[0087] S130, in a case where the pre-upgrade application domain is determined to be the first application domain, releasing the data access permission of the first storage area to the first application domain.

[0088] For example, in a case where the pre-upgrade application domain is determined to be the first application domain, it is indicated that only the first application domain needs to perform the upgrade operation, and other application domains can not need to perform the upgrade operation. The first secure domain can release the data access permission of the first storage area to only the first application domain, for example, release the emmc of the first secure domain to the first application domain, and will not release it to other application domains. After the first application domain obtains the data access permission of the first storage area, the first upgrade resource can be obtained from the first storage area. The first secure domain can then enter its operating system.

[0089] In an embodiment of the present application, as shown in Figure 3 The method further includes the following steps:

[0090] S600, accessing the global register by a first operating system of the first application domain.

[0091] For example, the first application domain has a first operating system, which can be used to operate the hardware resources of the first application domain. It should be noted that the first operating system can be of various types, such as a Linux system.

[0092] The first operating system accesses the global register of the chip, so as to quickly obtain the data in the global register.

[0093] S700, if the first operating system obtains the first identification information and / or the second identification information from the global register, the first upgrade resource is obtained from the first storage area of the first security domain, and / or the second upgrade resource is obtained from the second storage area of the second security domain.

[0094] For example, the first identification information indicates that the first upgrade resource in the first storage area has been released, and the second identification information indicates that the second upgrade resource in the second storage area has been released.

[0095] After the first operating system obtains the first identification information and / or the second identification information from the global register, it is determined that the first upgrade resource and / or the second upgrade resource can be obtained from the first storage area and / or the second storage area, respectively. Therefore, the first operating system will not be prohibited when obtaining the first upgrade resource and / or the second upgrade resource through the inter-core communication between the first application domain and the first security domain and the second security domain, respectively, and thus logical errors will not occur.

[0096] In an embodiment of the present application, the first upgrade resource is obtained from the first storage area of the first security domain, and / or the second upgrade resource is obtained from the second storage area of the second security domain, as shown in Figure 4 and in combination with Figure 7 , comprising:

[0097] S710, in the case where the first application domain obtains control over the first storage area and the second storage area, initializing operations are performed on the first storage area and the second storage area.

[0098] S720, the first upgrade resource and the second upgrade resource are obtained from the first storage area and the second storage area after the initialization operation, respectively.

[0099] Exemplarily, after the first application domain obtains the control right of the first storage area and the second storage area, in order to accurately obtain the first upgrade resource and the second upgrade resource, the first storage area and the second storage area can be initialized, the data paths between the first application domain and the first storage area and the second storage area are established, and then the first upgrade resource is obtained from the initialized first storage area and the second upgrade resource is obtained from the second storage area.

[0100] In an embodiment of the present application, the inactive partition of the first application domain is upgraded based on the first upgrade resource, the second upgrade resource and a third upgrade resource stored by the first application domain itself. Figure 5 As shown, the method comprises:

[0101] S510, based on a data association relationship, the first upgrade resource, the second upgrade resource and the third upgrade resource are spliced to form an upgrade data packet.

[0102] Exemplarily, the first upgrade resource, the second upgrade resource and the third upgrade resource have a data association relationship, which represents the logical relationship between the related data. Based on the data association relationship, the first application domain can accurately integrate the first upgrade resource, the second upgrade resource and the third upgrade resource to form a corresponding upgrade data packet. The upgrade data packet is used to upgrade the first application domain.

[0103] S520, in the first application domain, the inactive partition is selected, and the data in the inactive partition is upgraded by using the upgrade data packet.

[0104] Exemplarily, the first application domain can have an active partition and an inactive partition. The active partition is a partition currently used by the first application domain, and the inactive partition is a partition currently not used by the first application domain. The first application domain can determine the inactive partition according to the relevant identifier or data activity, and perform the upgrade operation on the data in the inactive partition by using the upgrade data packet, such as loading new data, repairing errors, etc.

[0105] S530, based on the result of the upgrade operation, corresponding third identification information is generated, wherein the third identification information is used to represent whether the upgrade operation conforms to a preset upgrade result.

[0106] Exemplarily, after the upgrading operation on the data in the inactive partition is completed, the result of the upgrading operation can or can not conform to the preset upgrading result. In this embodiment, the third identification information is generated according to the result of the upgrading operation, and is used to represent the result of the upgrading operation. If the third identification information represents that the result of the upgrading operation can conform to the preset upgrading result, the first application domain can no longer perform the upgrading operation, and can restart to enter the updated system. If the third identification information represents that the result of the upgrading operation can not conform to the preset upgrading result, the first application domain can perform the upgrading operation again, generate the third identification information again, and then perform corresponding operations based on the result of the upgrading operation represented by the third identification information.

[0107] In an embodiment of the present application, before the chip enters the first upgrading mode, the method further includes the following steps:

[0108] The preset upgrading data packet is split to form the first upgrading resource, the second upgrading resource and the third upgrading resource, wherein the upgrading data packet is a differential packet with data difference attribute;

[0109] The first upgrading resource, the second upgrading resource and the third upgrading resource are respectively stored in the first security domain, the second security domain and the first application domain of the chip.

[0110] Exemplarily, the preset upgrading packet can be split in advance to generate a plurality of upgrading resources, including the first upgrading resource, the second upgrading resource and the third upgrading resource. Each upgrading resource is respectively stored in different hardware domains. In this embodiment, the first upgrading resource is stored in the first security domain, the second upgrading resource is stored in the second security domain, and the third upgrading resource is stored in the first application domain. Since the security levels of the first security domain and the second security domain are high, the security of the first upgrading resource and the second upgrading resource is ensured. In addition, in an embodiment, since the first security domain and the second security domain can have high coordination with each other, it is more beneficial for the first application domain to quickly obtain the first upgrading resource and the second upgrading resource from the first security domain and the second security domain respectively.

[0111] In an embodiment, the upgrading data packet is a differential packet with data difference attribute. The differential packet can be a data packet that has difference with respect to the original data in the first application domain, which makes it possible to only upgrade the data that has difference with respect to the original data when the first application domain is upgraded by using the upgrading data packet, without upgrading the data that has no substantial update. At the same time, this makes the data amount of the upgrading data packet smaller, which is convenient for storage in multiple hardware domains.

[0112] In an embodiment of the present application, after the upgrading operation on the inactive partition of the first application domain is completed, the method further comprises the following steps:

[0113] adjusting the starting mode of the chip from the first upgrading mode to a non-upgrading mode;

[0114] restarting the chip.

[0115] For example, after the upgrading operation on the inactive partition of the first application domain is completed, the first application domain can not be upgraded for a short time, and thus the starting mode of the chip can be adjusted from the first upgrading mode to a non-upgrading mode, so that after the chip is restarted, each hardware domain detects that the starting mode of the chip is a normal starting mode and detects that the corresponding upgrading operation meets a preset upgrading result (successful upgrading), and can obtain data from the upgraded active partition of the first application domain to perform normal starting.

[0116] An embodiment of the present application further provides a hardware domain upgrading device of a chip, which is applied to a chip comprising at least two different processor cores, each of the processor cores forms a hardware domain together with corresponding hardware resources, the hardware domains are hard-isolated, the hardware domains comprise a first security domain, a second security domain and at least one application domain, the first security domain, the second security domain and the application domain have inter-core communication, the inter-core communication can be asynchronous message passing through a mailbox mechanism or can realize communication among the first security domain, the second security domain and the application domain through a shared memory mechanism, wherein the mailbox mechanism is a communication mechanism for processing communication among multiple devices through a message queue and an interrupt-driven signal, and the shared memory mechanism can be realized by releasing the control right of a storage area possessed by the hardware domain. Figure 8 As shown in the figure, the hardware domain upgrading device of the chip comprises:

[0117] a first control module configured to release the control right of a first storage area of the first security domain to a first application domain if the first security domain determines that the chip enters a first upgrading mode, wherein the first storage area stores first upgrading resources, and the first upgrading mode is set through a global register of the chip.

[0118] Exemplarily, the hardware domains in the chip can be upgraded according to actual needs. For example, in the case of needing to improve the performance of the chip, part or all of the hardware domains of the chip need to be upgraded. For another example, in the case of needing to add new functions to the chip, part or all of the hardware domains of the chip need to be upgraded. In the embodiment, the upgrade data package for upgrading the hardware domains can be stored in a preset memory in the chip in advance, the upgrade data package is sent to the chip through a network, a transmission medium or the like, and the upgrade data package is split and sent to each hardware domain of the chip for storage, such as storage in the update partition of the emmc of the hardware domain.

[0119] The chip has multiple modes, such as a working mode, a restart mode, an upgrade mode and the like. The mode of the chip can be set by using a global register of the chip. In an embodiment, the mode of the chip can be determined by setting the value corresponding to the global register. For example, if the value corresponding to the global register boot reason is set to 10, it means that the chip needs to be restarted for software upgrade. If the value corresponding to the global register boot reason is set to 5, it means that the chip detects an abnormal temperature of the chip, and the temperature abnormality triggers the generation of a restart event.

[0120] After the chip is started, the first control module judges the mode of the chip based on the value corresponding to the global register through the first security domain. If it is determined that the chip enters the first upgrade mode, the control right of the first storage area of the first security domain is released to the first application domain. The chip can include multiple application domains, and the first application domain can be one of them.

[0121] Under the premise of ensuring the safety of the data stored in the first security domain, the first application domain can operate the data in the first storage area of the first security domain, and since the first upgrade resource is pre-stored in the first storage area, the first application domain can obtain the first upgrade resource from the first storage area. The first upgrade resource can be part of the upgrade data package.

[0122] The first generation module is configured to generate and store first identification information for indicating that the first upgrade resource has been released through the global register.

[0123] Exemplarily, the global register can be used by each hardware domain of the chip, which is a non-proprietary register. After the first security domain releases the control right of the first storage area to the first application domain, the first generation module generates first identification information in the global register, which can represent that the first upgrade resource in the first storage area has been released. If other hardware domains request to obtain the first upgrade resource again, the first identification information will be identified, and the obtaining operation of the first upgrade resource will be temporarily abandoned.

[0124] In another embodiment, if the data access right of the first storage area of the first security domain is re-limited and is no longer released to other hardware domains, including the first application domain. The first upgrade resource will return to the limited state, and the first generation module can generate first indication information corresponding to the first identification information in the global register, which represents the current state of the first upgrade resource as not being released.

[0125] A second control module configured to control the second security domain to release the control right of the second storage area to the first application domain in the first upgrade mode, wherein the second storage area stores a second upgrade resource.

[0126] Exemplarily, part or all of the functions of the second security domain can be similar to the first security domain, and the two can coordinate with each other to provide services for other hardware domains (such as other application domains), such as when the first security domain is in a busy state. The second control module can control the second security domain to provide services to the corresponding hardware domain based on the instructions of the first security domain. The second storage area is provided in the second security domain in the embodiment, and the second storage area can pre-store a second upgrade resource, which can be part of the upgrade data packet, and the data content thereof is different from the first upgrade resource.

[0127] In one embodiment, in a case where it is determined that the chip enters the first upgrade mode, the second control module controls the second security domain to release the control right of the second storage area to the first application domain, so that the first application domain can obtain the second upgrade resource stored in the second storage area. The second security domain can then enter its operating system.

[0128] In another embodiment, if it is determined that the first security domain has released the control right of the first storage area to the first application domain, the second control module can control the second security domain to release the control right of the second storage area to the first application domain, so that the first application domain can obtain the second upgrade resource stored in the second storage area.

[0129] In the embodiment, the first upgrade resource and the second upgrade resource are pre-stored in the first security domain and the second security domain respectively, so that the data security of the first upgrade resource and the second upgrade resource is improved, and meanwhile, the separately stored upgrade data packets are realized, so that the flexible storage is realized and the related data is convenient to retrieve.

[0130] The second generation module is configured to generate and store second identification information for representing that the second upgrade resource has been released through the global register.

[0131] For example, after the second security domain releases the control right of the second storage area to the first application domain, the second generation module generates second identification information in the global register, and the second identification information can represent that the second upgrade resource in the second storage area has been released. If other hardware domains request to obtain the second upgrade resource again, the other hardware domains will temporarily give up the obtaining operation of the second upgrade resource after identifying the second identification information.

[0132] If the data access right of the second storage area of the second security domain is restricted again and is not released to other hardware domains, including not released to the first application domain, the second upgrade resource will return to the limited state, and second indication information corresponding to the second identification information can be generated in the global register, and the second indication information represents that the current state of the second upgrade resource is not released.

[0133] The processing module is configured to, when the first application domain obtains the first upgrade resource and the second upgrade resource based on the inter-core communication, perform an upgrade operation on the inactive partition of the first application domain based on the first upgrade resource, the second upgrade resource and a third upgrade resource stored in the first application domain.

[0134] For example, the first application domain, the first security domain and the second security domain are hard isolated from each other, and the first application domain, the first security domain and the second security domain can work independently and prevent mutual interference or influence, so that the reliability, stability and anti-interference ability of the chip are improved. The first application domain, the first security domain and the second security domain have inter-core communication, so that the first application domain can obtain the first upgrade resource and the second upgrade resource based on the inter-core communication.

[0135] The third upgrade resource is stored in the first application domain, and the third upgrade resource is also part of the upgrade data package. On one hand, the processing module can integrate the first upgrade resource, the second upgrade resource, and the third upgrade resource stored in the first application domain to form the upgrade data package. On the other hand, the first application domain can also use the similar method to obtain other upgrade resources from other hardware domains, and then the processing module integrates the first upgrade resource, the second upgrade resource, the third upgrade resource, and the other upgrade resources to form the upgrade data package for upgrading the first application domain. Moreover, the process of using the upgrade data package to upgrade the first application domain does not affect other hardware domains of the chip.

[0136] In one embodiment, the first application domain includes an active partition and an inactive partition, and the active partition has data being used, such as data used by the first application domain in a working state. The data in the inactive partition can be temporarily not called. After obtaining the upgrade data package, the first application domain can determine the active partition and the inactive partition thereof, and the processing module can perform an upgrade operation only on the inactive partition. Of course, the inactive partition can also be adjusted before the upgrade operation. For example, the inactive partition that has been subjected to the upgrade operation is converted into a new active partition, and the original active partition that has not been subjected to the upgrade operation is converted into an inactive partition, and then the processing module performs an upgrade operation on the new inactive partition. Thus, based on the upgrade data package, the first application domain can perform a complete upgrade operation.

[0137] In one embodiment of the present application, the first control module is further configured to:

[0138] obtain boot information of the chip through the first security domain;

[0139] if the boot information indicates that the chip enters the first upgrade mode, determine the identity of the pre-upgrade application domain based on the first upgrade mode;

[0140] in a case where the pre-upgrade application domain is determined to be the first application domain, release the data access permission of the first storage area to the first application domain.

[0141] In one embodiment of the present application, the first control module is further configured to:

[0142] access the global register through a first operating system of the first application domain;

[0143] if the first operating system obtains the first identification information and / or the second identification information from the global register, obtain the first upgrade resource from the first storage area of the first security domain, and / or obtain the second upgrade resource from the second storage area of the second security domain, respectively.

[0144] In an embodiment of the present application, the hardware domain upgrade device further comprises an acquisition module configured to:

[0145] In the case that the first application domain acquires control over the first storage area and the second storage area, performing initialization operations on both the first storage area and the second storage area;

[0146] Acquiring the first upgrade resource and the second upgrade resource from the first storage area and the second storage area after the initialization operations, respectively.

[0147] In an embodiment of the present application, the processing module is further configured to:

[0148] Based on the data association relationship, splicing the first upgrade resource, the second upgrade resource and the third upgrade resource to form an upgrade data packet;

[0149] Selecting the inactive partition in the first application domain and performing an upgrade operation on the data in the inactive partition using the upgrade data packet;

[0150] Based on the result of the upgrade operation, generating corresponding third identification information, wherein the third identification information is used to represent whether the upgrade operation conforms to a preset upgrade result.

[0151] In an embodiment of the present application, the hardware domain upgrade device further comprises a pre-storage module configured to:

[0152] Splitting a preset upgrade data packet to form the first upgrade resource, the second upgrade resource and the third upgrade resource, wherein the upgrade data packet is a differential packet with data difference attribute;

[0153] Storing the first upgrade resource, the second upgrade resource and the third upgrade resource in the first security domain, the second security domain and the first application domain of the chip, respectively.

[0154] In an embodiment of the present application, the processing module is further configured to:

[0155] After completing the upgrade operation on the inactive partition of the first application domain, adjusting the startup mode of the chip from the first upgrade mode to a non-upgrade mode;

[0156] Restarting the chip.

[0157] Embodiments of the present application also provide a chip comprising the hardware domain upgrade device of the chip as described above, for upgrading the hardware domain of the chip.

[0158] The embodiment of the present application further provides a vehicle, which is installed with the chip as described above, and the chip can upgrade the hardware domain inside the chip.

[0159] The embodiment of the present application further provides an electronic device, as shown in the figure, which comprises a processor and a memory, the memory stores an executable program, and the memory executes the executable program to perform the steps of the method as described above.

[0160] The embodiment of the present application further provides a storage medium, which carries one or more computer programs, and the one or more computer programs are executed by a processor to perform the steps of the method as described above.

[0161] It should be understood that, in the embodiment of the present application, the processor can be a central processing unit (CPU), and the processor can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.

[0162] It should also be understood that the memory referred to in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (Read Only Memory, ROM for short), a programmable read-only memory (Programmable ROM, PROM for short), an erasable programmable read-only memory (Erasable PROM, EPROM for short), an electrically erasable programmable read-only memory (Electrically EPROM, EEPROM for short) or a flash memory. The volatile memory can be a random access memory (Random Access Memory, RAM for short) used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (Static RAM, SRAM for short), dynamic random access memory (Dynamic RAM, DRAM for short), synchronous dynamic random access memory (Synchronous DRAM, SDRAM for short), double data rate synchronous dynamic random access memory (Double Data Rate SDRAM, DDR SDRAM for short), enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM for short), synchronous link dynamic random access memory (Synchlink DRAM, SLDRAM for short) and direct memory bus random access memory (Direct Rambus RAM, DR RAM for short).

[0163] It should be noted that when the processor is a general processor, a DSP, an ASIC, a FPGA or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, the memory (storage module) is integrated in the processor.

[0164] It should be noted that the memory described herein is intended to include, but not limited to, these and any other suitable types of memory.

[0165] It should also be understood that the first, second, third, fourth and various numerical references referred to herein are only for the convenience of differentiation for description, and do not limit the scope of the present application.

[0166] It should be understood that the term "and / or" described herein is only to describe the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A alone, A and B together, and B alone. In addition, the character " / " in this paper generally represents that the front and rear associated objects are a "or" relationship.

[0167] In the implementation process, each step of the above method can be completed by integrated logic circuits of hardware in the processor or instructions in the form of software. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as hardware processor execution completion, or executed by a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the art such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, register, etc. The storage medium is located in the memory, and the processor reads the information in the memory, and combines the hardware to complete the steps of the above method. To avoid repetition, it will not be described in detail here.

[0168] In various embodiments of the present application, the size of the serial number of each process described above does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0169] Those of ordinary skill in the art can realize that the various illustrative logical blocks (ILB) and steps described in combination with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether the functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0170] In several embodiments provided by the present application, it should be understood that the disclosed method, device and electronic equipment can be implemented in other ways. For example, the above-described device embodiments are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0171] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment of the present application.

[0172] In addition, each of the function units in each of the embodiments of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0173] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (for example, floppy disk, hard disk, magnetic tape), optical media (for example, DVD), or semiconductor media (for example, solid state disk) and the like.

[0174] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A chip hardware domain upgrade method, characterized in that: Applied to a chip including at least two different processor cores, each processor core and its corresponding hardware resources form a hardware domain, the hardware domains are hard-isolated, the hardware domains include a first security domain, a second security domain, and at least one application domain, the first security domain, the second security domain, and the application domain have inter-core communication with each other, the method comprising: If the first security domain determines that the chip enters a first upgrade mode, releasing control of a first storage area of ​​the first security domain to the first application domain, wherein the first storage area stores a first upgrade resource, and the first upgrade mode is set through a global register of the chip; generating and storing, through the global register, first identification information for indicating that the first upgrade resource has been released; In the first upgrade mode, the second security domain releases control of its second storage area to the first application domain, wherein the second storage area stores a second upgrade resource; generating and storing, through the global register, second identification information for indicating that the second upgrade resource has been released; When the first application domain obtains the first upgrade resource and the second upgrade resource based on inter-core communication, an upgrade operation is performed on the inactive partition of the first application domain based on the first upgrade resource, the second upgrade resource and the third upgrade resource stored in the first application domain itself.

2. The chip hardware domain upgrade method according to claim 1, characterized in that: If the first security domain determines that the chip enters the first upgrade mode, releasing the control right of the first storage area of ​​the first security domain to the first application domain includes: Acquire boot information of the chip through the first security domain; If the boot information indicates that the chip has entered a first upgrade mode, determining an identity of a pre-upgrade application domain based on the first upgrade mode; When it is determined that the pre-upgraded application domain is the first application domain, the data access permission of the first storage area is released to the first application domain.

3. The chip hardware domain upgrade method according to claim 1, characterized in that: The method further comprises: accessing the global register through the first operating system of the first application domain; If the first operating system obtains the first identification information and / or the second identification information from the global register, it obtains the first upgrade resource from the first storage area of ​​the first security domain and / or obtains the second upgrade resource from the second storage area of ​​the second security domain respectively.

4. The chip hardware domain upgrade method according to claim 3, characterized in that: The acquiring the first upgrade resource from the first storage area of ​​the first security domain, and / or acquiring the second upgrade resource from the second storage area of ​​the second security domain, includes: When the first application domain obtains control over the first storage area and the second storage area, initializing the first storage area and the second storage area; The first upgrade resource and the second upgrade resource are respectively acquired from the first storage area and the second storage area after the initialization operation.

5. The chip hardware domain upgrade method according to claim 1, characterized in that: The step of upgrading the inactive partition of the first application domain based on the first upgrade resource, the second upgrade resource, and the third upgrade resource stored in the first application domain itself includes: Based on the data association relationship, the first upgrade resource, the second upgrade resource, and the third upgrade resource are spliced ​​together to form an upgrade data packet; Selecting the inactive partition in the first application domain, and performing an upgrade operation on the data in the inactive partition using the upgrade data packet; Based on the result of the upgrade operation, corresponding third identification information is generated, wherein the third identification information is used to indicate whether the upgrade operation complies with a preset upgrade result.

6. The method for upgrading the hardware domain of a chip according to claim 5, characterized in that: Before the chip enters the first upgrade mode, the method further includes: Splitting a preset upgrade data packet to form the first upgrade resource, the second upgrade resource, and the third upgrade resource, wherein the upgrade data packet is a differential packet with a data difference attribute; The first upgrade resource, the second upgrade resource, and the third upgrade resource are respectively stored in the first security domain, the second security domain, and the first application domain of the chip.

7. The chip hardware domain upgrade method according to claim 1, characterized in that: After completing the upgrade operation on the inactive partition of the first application domain, the method further includes: Adjusting the startup mode of the chip from the first upgrade mode to a non-upgrade mode; Reboot the chip.

8. A chip hardware domain upgrade device, characterized in that: Applicable to a chip including at least two different processor cores, each processor core and its corresponding hardware resources respectively forming a hardware domain, the hardware domains being hard-isolated, the hardware domains including a first security domain, a second security domain, and at least one application domain, the first security domain, the second security domain, and the application domain having inter-core communication with each other, the hardware domain upgrade device of the chip comprising: a first control module configured to release control of a first storage area of ​​the first security domain to a first application domain if the first security domain determines that the chip enters a first upgrade mode, wherein the first storage area stores a first upgrade resource, and the first upgrade mode is set through a global register of the chip; A first generating module configured to generate and store, through the global register, first identification information indicating that the first upgrade resource has been released; a second control module configured to, in the first upgrade mode, control the second security domain to release control rights of its second storage area to the first application domain, wherein the second storage area stores a second upgrade resource; a second generating module configured to generate and store, through the global register, second identification information indicating that the second upgrade resource has been released; A processing module is configured to perform an upgrade operation on the inactive partition of the first application domain based on the first upgrade resource, the second upgrade resource and the third upgrade resource stored in the first application domain itself when the first application domain obtains the first upgrade resource and the second upgrade resource based on inter-core communication.

9. A chip, characterized in that: The chip hardware domain upgrade device according to claim 8 is used to upgrade the chip hardware domain.

10. A vehicle, characterized in that: The chip according to claim 9 is installed, and the chip can upgrade the hardware domain inside the chip.

Images