Controller upgrading method and device, storage medium and electronic equipment

Abstract

The invention discloses a controller upgrading method and device, a storage medium and electronic equipment. The method comprises the steps that under the conditions that an upgrade data packet is received and a boot program indication bit indicates a first boot partition, a target boot program file is flashed to a second boot partition; under the condition that the target boot program file in the second boot partition passes the integrity verification, backing up a reference boot program file in the first boot partition to a file backup partition, processing the reference boot program file to obtain a candidate boot program file, and adjusting a boot program indication bit to indicate the second boot partition; starting a controller, and loading a target bootstrap program file in a second bootstrap partition under the condition that the program file in the first bootstrap partition does not pass the integrity verification; under the condition that loading of the target application program file is completed, it is confirmed that upgrading of the controller is completed. The technical problem that a controller upgrading method provided by the related technology is low in robustness is solved.

Description

Technical Field

[0001] The present application relates to the field of remote upgrade technology, and in particular to a controller upgrade method and device, a storage medium, and an electronic device. Background Art

[0002] In automobiles, for closed controllers, product software can be updated through remote upgrades (On The Air, OTA). In upgrading firmware, two programs are usually required, one is a boot loader, such as SBL (Secondary Bootloader), and the other is a functional program, such as APP (Application).

[0003] After the remote upgrade of the controller is completed, the controller will be restarted, the SBL program will initialize the hardware, and load and run the APP image. However, in the upgrade process, the related art directly updates the current SBL program of the controller. If the updated SBL image fails to be verified, the controller may fail to start. In other words, the controller upgrade method provided by the related art has the problem of low robustness.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a controller upgrade method and device, a storage medium, and an electronic device to at least solve the technical problem that the controller upgrade method provided by the related art has low robustness.

[0006] According to one aspect of an embodiment of the present application, a controller upgrade method is provided, comprising: upon receiving an upgrade data packet and a boot program indicator bit indicating a first boot partition, flashing a target boot program file in the upgrade data packet to a second boot partition, wherein the upgrade data packet includes a target boot program file and a target application program file, and the first boot partition is a storage partition having a first read timing after the controller is started; upon a target boot program file in the second boot partition passes an integrity check, backing up a reference boot program file in the first boot partition to a file backup partition, processing the reference boot program file in the first boot partition to obtain a candidate boot program file, and adjusting the boot program indicator bit to indicate the second boot partition, wherein the candidate boot program file is a file that cannot pass the integrity check; starting the controller, and loading the target boot program file in the second boot partition when the program file in the first boot partition fails the integrity check; jumping to the application partition, and upon completion of loading the target application program file, confirming completion of the controller upgrade.

[0007] According to another aspect of an embodiment of the present application, a controller upgrade device is also provided, including: a flash indication unit, for flashing a target boot program file in an upgrade data packet to a second boot partition when an upgrade data packet is received and a boot program indication bit indicates a first boot partition, wherein the upgrade data packet includes a target boot program file and a target application file, and the first boot partition is a storage partition with a first read timing after the controller is started; an indication bit adjustment unit, for backing up a reference boot program file in the first boot partition to a file backup partition when the target boot program file in the second boot partition passes the integrity check, processing the reference boot program file in the first boot partition to obtain a candidate boot program file, and adjusting the boot program indication bit to indicate the second boot partition, wherein the candidate boot program file is a file that cannot pass the integrity check; a program loading unit, for starting the controller, and loading the target boot program file in the second boot partition when the program file in the first boot partition fails the integrity check; an application upgrade unit, for jumping to the application partition, and confirming that the upgrade of the controller is completed when the target application file is loaded.

[0008] Optionally, the above-mentioned flash indication unit is also used to: when an upgrade data packet is received and the boot program indication bit indicates the second boot partition, flash the target boot program file in the upgrade data packet to the first boot partition; the above-mentioned indication bit adjustment unit is also used to: when the target boot program file in the first boot partition passes the integrity check, adjust the boot program indication bit to indicate the first boot partition; the above-mentioned program loading unit is also used to start the controller, and load the target boot program file in the first boot partition when the program file in the first boot partition passes the integrity check; the above-mentioned application upgrade unit is also used to: jump to the application partition, and when the target application program file is loaded, confirm that the upgrade of the controller is completed.

[0009] Optionally, the program loading unit includes: a first boot program loading module, which is used to process the target boot program file in the first boot partition to obtain a candidate boot program file when the controller initialization fails according to the target boot program file and the boot program indicator bit indicates the first boot partition, and adjust the boot program indicator bit to indicate the second boot partition; a second boot program loading module, which is used to flash the reference boot program file in the file backup partition to the first boot partition when the controller initialization fails according to the target boot program file and the boot program indicator bit indicates the second boot partition, and adjust the boot program indicator bit to indicate the first boot partition; and a first startup module, which is used to start the controller after adjusting the boot program indicator bit.

[0010] Optionally, the above-mentioned application upgrade unit includes: a first application upgrade module, which is used to flash the target application file to the second application partition when an upgrade data packet is received and the application indicator bit indicates the first application partition, and adjust the application indicator bit to indicate the second application partition when the target application file in the second application partition passes the integrity check, wherein the first application partition and the second application partition are used to store application files; a second application upgrade module, which is used to flash the target application file to the first application partition when an upgrade data packet is received and the application indicator bit indicates the second application partition, and adjust the application indicator bit to indicate the first application partition when the target application file in the first application partition passes the integrity check.

[0011] Optionally, the above-mentioned application upgrade unit also includes: an application loading module, used to load the target application file in the application partition indicated by the application indicator bit; a first application rollback module, used to adjust the application indicator bit to indicate the second application partition when the target application file after loading fails to pass the integrity check and the application indicator bit indicates the first application partition; a second application rollback module, used to adjust the application indicator bit to indicate the first application partition when the target application file after loading fails to pass the integrity check and the application indicator bit indicates the second application partition.

[0012] Optionally, the upgrade device of the above-mentioned controller also includes: a receiving unit, which is used to store the upgrade data packet in an external memory and notify the processor to be upgraded when the controller receives the upgrade data packet; a storage unit, which is used for the processor to be upgraded to store the upgrade data packet in a file storage area, wherein the file storage area includes a first boot partition, a second boot partition, a file backup partition and a boot program indicator bit storage area, and the boot program indicator bit storage area is used to store the boot program indicator bit.

[0013] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the upgrade method of the controller when running.

[0014] According to another aspect of the embodiment of the present application, a computer program product is provided, the computer program product includes a computer program / instruction, the computer instruction is stored in a computer-readable storage medium. A processor of a computer device reads the computer program / instruction from the computer-readable storage medium, and the processor executes the computer program / instruction, so that the computer device executes the upgrade method of the controller as described above.

[0015] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the controller upgrade method through the computer program.

[0016] In an embodiment of the present application, when an upgrade data packet is received and the boot program indicator indicates the first boot partition, the target boot program file in the upgrade data packet is flashed to the second boot partition, wherein the upgrade data packet includes the target boot program file and the target application file, and the first boot partition is a storage partition with a first read timing after the controller is started; when the target boot program file in the second boot partition passes the integrity check, after backing up the reference boot program file in the first boot partition to the file backup partition, the reference boot program file in the first boot partition is processed to obtain a candidate boot program file, and the boot program indicator is adjusted to indicate the second boot partition, wherein the candidate boot program file is a file that cannot pass the integrity check; the controller is started, and when the program file in the first boot partition fails to pass the integrity check, the target boot program file in the second boot partition is loaded; jump to the application partition, and when the target application file is loaded, confirm that the upgrade of the controller is completed. The first boot partition and the second boot partition have a read timing relationship, and when the file in the first boot partition passes the integrity check, the file in the first boot partition will be loaded first. In the process of upgrading the controller, when the upgrade package is received and the current indication bit indicates the first boot partition, the program can be flashed to the second boot partition, and the program in the first boot partition can be destroyed after the backup to realize active switching between the two partitions. The above method solves the technical problem that the controller upgrade method provided by the related art has low robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a schematic diagram of a hardware environment of an optional controller upgrade method according to an embodiment of the present application;

[0019] Figure 2 is a flow chart of an optional controller upgrade method according to an embodiment of the present application;

[0020] Figure 3 is a schematic diagram of an optional controller upgrade method according to an embodiment of the present application;

[0021] Figure 4is a schematic diagram of an optional file storage area according to an embodiment of the present application;

[0022] Figure 5 is a flow chart of an optional boot partition upgrade method according to an embodiment of the present application;

[0023] Figure 6 is a flowchart of an optional controller startup process according to an embodiment of the present application;

[0024] Figure 7 is a flowchart of an optional rollback process of a boot program partition according to an embodiment of the present application;

[0025] Figure 8 is a schematic diagram of an optional controller upgrade device according to an embodiment of the present application;

[0026] Fig. 9 is a schematic diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] According to one aspect of an embodiment of the present application, a controller upgrade method is provided. As an optional implementation, the controller upgrade method can be but is not limited to being applied to Figure 1 The controller upgrade system in the hardware environment shown. Optionally, the controller upgrade method can be applied to a vehicle terminal. Figure 1A side view of a vehicle terminal 101 is shown, which is disposed on a travel surface 113 and is capable of traversing the travel surface 113. The vehicle terminal 101 includes an onboard navigation system 103, a computer-readable storage device or medium (memory) 102 including a digitized road map 104, a spatial monitoring system 117, a vehicle controller 109, a GPS (global positioning system) sensor 110, an HMI (human / machine interface) device 111, and also includes an autonomous controller 112 and a telematics controller 114. The vehicle terminal 101 may include, but is not limited to, commercial vehicles, industrial vehicles, agricultural vehicles, passenger vehicles, all-terrain vehicles, personal mobile devices, robots, and similar forms of mobile platforms to achieve the purpose of the present application.

[0030] In one embodiment, the spatial monitoring system 117 includes: one or more spatial sensors and systems arranged to monitor the visible area 105 in front of the vehicle terminal 101; and a spatial monitoring controller 118. The spatial sensors used to monitor the visible area 105 include, for example, a lidar sensor 106, a radar sensor 107, a camera 108, and the like. The placement of the spatial sensors allows the spatial monitoring controller 118 to monitor traffic flow, including approaching vehicles, intersections, lane markings, and other objects around the vehicle terminal 101. The spatial sensors of the spatial monitoring system 117 may include object positioning sensing devices. The lidar sensor 106 uses pulsed and reflected laser beams to measure the range or distance to an object. The radar sensor 107 uses radio waves to determine the range, angle, and / or speed of an object. The camera 108 includes an image sensor, a lens, and a camera controller.

[0031] The camera 108 is advantageously mounted and positioned on the vehicle terminal 101 in a position that allows capturing images of the visible area 105, wherein at least a portion of the visible area 105 includes a portion of the travel surface 113 in front of the vehicle terminal 101 and including the trajectory of the vehicle terminal 101. The visible area 105 may also include the surrounding environment. Other cameras (not shown) may also be used, for example, including a second camera disposed on the rear or side portion of the vehicle terminal 101 to monitor the rear of the vehicle terminal 101 and one of the right or left sides of the vehicle terminal 101.

[0032] The autonomous controller 112 is configured to implement autonomous driving or advanced driver assistance system (ADAS) vehicle functionality. Such functionality may include a vehicle onboard control system capable of providing a certain level of driving automation. Driving automation may include a series of dynamic driving and vehicle operations. Driving automation may include simultaneous automatic control of vehicle driving functions (including steering, acceleration and braking), wherein the driver abandons control of the vehicle for a period of time during the trip. Driving automation may include simultaneous automatic control of vehicle driving functions (including steering, acceleration and braking), wherein the driver abandons control of the vehicle terminal 101 for the entire trip. Driving automation includes hardware and a controller, which is configured to monitor the spatial environment in various driving modes to perform various driving tasks during dynamic vehicle operations. By way of non-limiting example, autonomous vehicle functions include adaptive cruise control (ACC) operations, lane guidance and lane keeping operations, lane change operations, steering assistance operations, object avoidance operations, parking assistance operations, vehicle braking operations, vehicle speed and acceleration operations, vehicle lateral motion operations, for example, as part of lane guidance, lane keeping and lane change operations, etc.

[0033] The autonomous controller can be equipped with an operating system and an automatic driving system. The operating system can be responsible for the management of the hardware resources (including sensors, system buses, networks, etc.) of the vehicle terminal 101 and the scheduling of computing resources. The automatic driving system can implement various algorithms required for automatic driving, including positioning, environmental perception, path planning and control, etc., and can make decisions in situations such as driving on curves, driving in a straight line, driving on complex roads, and changing lanes.

[0034] The vehicle terminal 101 may include a telematics controller 114 including a wireless telematics communication system capable of performing off-vehicle communications (including communicating with a communication network 115 having wireless and wired communication capabilities). Alternatively or additionally, the telematics controller 114 directly performs off-vehicle communications by communicating with an off-board server 116 via the communication network 115. After the vehicle terminal 101 receives the upgrade package sent remotely, steps S1-S4 can be executed: when the upgrade data packet is received and the boot program indicator bit indicates the first boot partition, the target boot program file in the upgrade data packet is flashed to the second boot partition; when the target boot program file in the second boot partition passes the integrity check, the reference boot program file in the first boot partition is backed up to the file backup partition, the reference boot program file in the first boot partition is processed to obtain a candidate boot program file, and the boot program indicator bit is adjusted to indicate the second boot partition; the controller is started, and when the program file in the first boot partition does not pass the integrity check, the target boot program file in the second boot partition is loaded; jump to the application partition, and when the target application program file is loaded, confirm that the upgrade of the controller is completed.

[0035] In an embodiment of the present application, when an upgrade data packet is received and the boot program indicator indicates the first boot partition, the target boot program file in the upgrade data packet is flashed to the second boot partition, wherein the upgrade data packet includes the target boot program file and the target application file, and the first boot partition is a storage partition with a first read timing after the controller is started; when the target boot program file in the second boot partition passes the integrity check, after backing up the reference boot program file in the first boot partition to the file backup partition, the reference boot program file in the first boot partition is processed to obtain a candidate boot program file, and the boot program indicator is adjusted to indicate the second boot partition, wherein the candidate boot program file is a file that cannot pass the integrity check; the controller is started, and when the program file in the first boot partition fails to pass the integrity check, the target boot program file in the second boot partition is loaded; jump to the application partition, and when the target application file is loaded, confirm that the upgrade of the controller is completed. The first boot partition and the second boot partition have a read timing relationship, and when the file in the first boot partition passes the integrity check, the file in the first boot partition will be loaded first. In the process of upgrading the controller, when the upgrade package is received and the current indication bit indicates the first boot partition, the program can be flashed to the second boot partition, and the program in the first boot partition can be destroyed after the backup to realize active switching between the two partitions. The above method solves the technical problem that the controller upgrade method provided by the related art has low robustness.

[0036] In an optional embodiment, if Figure 2 As shown, the controller upgrade method includes the following steps:

[0037] S202, when an upgrade data packet is received and the boot program indication bit indicates the first boot partition, flashing the target boot program file in the upgrade data packet to the second boot partition, wherein the upgrade data packet includes the target boot program file and the target application file, and the first boot partition is a storage partition with a first read timing after the controller is started;

[0038] It should be noted that the upgrade data packet can be a data packet transmitted during the software upgrade process, which usually contains the files of the new version of the boot program (SBL) and the application program (App), which are used to update the program of the controller. Among them, the boot program is used to receive the new upgrade firmware and complete the replacement of the old and new firmware, and the application program is used for the normal program of the product function and is used to execute various application functions.

[0039] The boot program indicator bit can be a flag or bit setting that indicates the currently active boot partition. In a dual partition upgrade scheme, this is usually a binary bit, such as A indicates that the first boot partition is the active partition, and B indicates that the second boot partition is the active partition. The first boot partition can be the partition currently in use (such as partition A) in a dual partition system, that is, the partition that reads the boot program by default when the controller starts. When the boot program indicator bit points to this partition, it indicates that partition A is the active partition. The second boot partition can be a partition that acts as a backup in the case of a problem with the program file in the first partition in a dual partition system. When the boot program indicator bit points to the first boot partition, the second boot partition is ready to receive a new boot program file. The first read timing can be the partition that the controller reads first during the startup process. For a dual partition upgrade scheme, this usually means that the currently active partition has a priority read order.

[0040] In an optional implementation, when the controller receives an upgrade data packet containing a new version of the boot program and an application, and the current boot program indicator points to the first boot partition, the upgrade process flashes the new version of the boot program to the second boot partition. This is done so that when a problem occurs in the first boot partition, the system can be started from the second boot partition, thereby avoiding the situation where the system cannot be started.

[0041] In an optional implementation, the control system software can be safely upgraded without affecting the current system operation. By flashing the new version of the boot program to the currently inactive second boot partition, the system can safely switch to the new version at the next startup without encountering startup problems caused by software flashing or verification failures. This upgrade method not only enhances the robustness of the system, but also provides the ability to restore to a stable version through a rollback mechanism in the event of an upgrade failure.

[0042] Assume that a domain controller based on the TDA4 chip is being used. The MCU of the controller has two NorFlash storage partitions, SBL_A and SBL_B, and two App storage partitions, App_A and App_B. The current system uses the SBL_A and App_A partitions when it boots up, that is, the boot program indicator bit points to SBL_A, indicating that SBL_A is the first boot partition and has a priority read timing. When the domain controller receives an upgrade data packet, the data packet contains the target boot program file (SBL_new) and the target application file (App_new). At this time, since SBL_A is the first boot partition, according to the dual partition upgrade strategy, the upgrade will not be performed directly on SBL_A to prevent the controller from failing to start due to an upgrade failure. The system starts to flash the target boot program file (SBL_new) in the upgrade data packet to the second boot partition SBL_B.

[0043] S204, when the target boot program file in the second boot partition passes the integrity check, after backing up the reference boot program file in the first boot partition to the file backup partition, processing the reference boot program file in the first boot partition to obtain a candidate boot program file, and adjusting the boot program indication bit to indicate the second boot partition, wherein the candidate boot program file is a file that fails to pass the integrity check;

[0044] It should be noted that the boot program indicator bit can indicate the status bit of the current active boot partition, and is usually used in a dual-partition system to indicate which partition is the partition that the current controller starts reading. The file backup partition can be a backup area dedicated to storing important files in the first boot partition so that they can be restored when the upgrade fails. The integrity check is a verification process performed after the software is updated to ensure that the newly written boot program file has no errors or damage and can run normally. The candidate boot program file can be a file obtained by destroying the program file in the first boot partition.

[0045] In an optional implementation, if the newly written target boot program file passes the integrity check, the system will perform the following steps: back up the current reference boot program file from the first boot partition to the file backup partition, then process the reference boot program file in the first boot partition to make it a candidate boot program file that fails the integrity check. Finally, adjust the boot program indicator bit to point to the second boot partition to ensure that the boot program is read from the second boot partition at the next startup.

[0046] In an optional implementation, when the new boot program file in the second boot partition passes the integrity check, it means that the new version can be safely used for system startup. In order to implement the partition switch from the first boot partition to the second boot partition, the system first needs to back up the reference boot program file in the first boot partition to the file backup partition. This is to maintain the availability of the original program in the event of an upgrade failure or subsequent recovery. Next, the system will process the reference boot program file in the first boot partition and set it as a "candidate boot program file", which essentially makes it unable to pass the integrity check in some way, thereby achieving the purpose of forcing the system to select the second boot partition at the next startup. Finally, adjust the boot program indicator bit to point to the second boot partition to ensure that the system can smoothly transition to the new version.

[0047] As mentioned above, in the implementation of the TDA4 chip domain controller upgrade, it is assumed that SBL_A is the first boot partition, SBL_B is the second boot partition, and the current system is running the boot program of the SBL_A partition. Once the upgrade of the SBL_B partition is completed and passes the integrity check, the system will perform the following steps: Back up the current boot program file in the SBL_A partition to the file backup partition to ensure the integrity and recoverability of the original file. In the SBL_A partition, the system will process the current boot program file to make it a candidate boot program file, which means that by writing specific destructive content or changing the partition flag, it is ensured that the boot program file of the SBL_A partition cannot pass the integrity check at the next startup. Update the boot program indicator bit to point to the SBL_B partition, that is, switch from the current SBL_A partition to the SBL_B partition, which is usually achieved by modifying the partition flag stored in the ESS data block. The system waits for the next reset signal. When the reset occurs, since the boot program indicator bit has pointed to SBL_B, the controller will load the new version of the boot program from the SBL_B partition and start a new startup process.

[0048] S206, starting the controller, and loading the target boot program file in the second boot partition if the program file in the first boot partition fails the integrity check;

[0049] In an optional implementation, after the flashing of the file in the boot partition is completed, the controller needs to be restarted. When the controller starts to start, it will first check whether the program file in the first boot partition has passed the integrity check. If the program file in the first boot partition fails to pass the check, it indicates that the boot program file of the partition may be damaged, the update failed, or there is a security risk. At this time, the system will not start from the first partition, but will jump to load the verified target boot program file in the second boot partition to ensure that the controller can operate normally.

[0050] Under normal circumstances, when the controller starts up, it will first try to read and run the boot program from the first boot partition. However, if the program file in the first boot partition fails the integrity check, it usually means that the file may have been incorrectly flashed or has been damaged, and the system will not use this partition for startup. In order to avoid the failure of this partition causing the entire controller to fail to operate, the system will automatically switch to the second boot partition, load and run the target boot program file in it. This strategy ensures that when problems are encountered during the software upgrade process, the system can still be restored to a stable operating state, greatly improving the stability and security of the upgrade process.

[0051] Assume that the domain controller is based on the TDA4 chip, and has successfully written the new version of the boot program file to the second boot partition SBL_B, and this new version of the boot program file has passed the integrity check, while the currently running SBL_A partition boot program file failed the check at a certain moment. When the controller attempts to restart, the following steps will occur: When the controller starts, it first attempts to read the boot program file from the first boot partition SBL_A and perform an integrity check. Because the boot program file of the SBL_A partition failed to pass the integrity check, the system recognizes that there may be problems with the file and cannot guarantee the normal operation of the system. The system automatically switches to the second boot partition SBL_B and starts to read and load the target boot program file therein. The target boot program file of the SBL_B partition has passed the check and is considered to be a version that can be run safely. The controller starts from the SBL_B partition, loads and runs the target boot program file, and the system is able to start and run normally.

[0052] S208, jumping to the application partition, and confirming that the controller upgrade is completed when the target application program file is loaded.

[0053] It should be noted that the application partition can be an area for storing application files, which can be App_A or App_B in a dual-partition system, and is used to switch and store new versions of programs during the upgrade process. The target application file is an application file included in the upgrade data package, which is used to replace the old version of the program in the current application partition to ensure that the system runs the latest software version.

[0054] In an optional implementation, when the target application file has been successfully loaded from the upgrade data package into the application partition and passed the integrity check, the system will jump to the area where the new application file is located and start running. If this process is completed smoothly and the system runs without abnormalities, it can be confirmed that the controller upgrade has been successfully completed.

[0055] Taking the TDA4 chip domain controller as an example, assuming that the entire bootloader upgrade process has been completed and the target bootloader file in the SBL_B partition has passed the integrity check, the controller is now booting from the SBL_B partition and jumping to the application partition App_B to load the target application file. After the MCU boots from the SBL_B partition, the system will jump to the App_B partition and start loading the target application file. After the target application file is loaded into the App_B partition, the system will perform an image integrity check to confirm that the file is not damaged or incorrectly flashed. If the integrity check of the target application file passes, indicating that the file is complete and can run safely, the system will load and run the new version of the application file from the App_B partition. After running the new version of the application file, the system will perform a series of functional tests to ensure that the update of the application does not introduce new problems or cause incompatibility. If all tests pass and no anomalies or errors are detected, the system confirms that the controller upgrade process has been successfully completed. At this point, the controller has smoothly transitioned to a state containing the new version of the bootloader and application, and can run all the latest software functions normally, ensuring the improvement of system performance and security.

[0056] In an embodiment of the present application, when an upgrade data packet is received and the boot program indicator indicates the first boot partition, the target boot program file in the upgrade data packet is flashed to the second boot partition, wherein the upgrade data packet includes the target boot program file and the target application file, and the first boot partition is a storage partition with a first read timing after the controller is started; when the target boot program file in the second boot partition passes the integrity check, after backing up the reference boot program file in the first boot partition to the file backup partition, the reference boot program file in the first boot partition is processed to obtain a candidate boot program file, and the boot program indicator is adjusted to indicate the second boot partition, wherein the candidate boot program file is a file that cannot pass the integrity check; the controller is started, and when the program file in the first boot partition fails to pass the integrity check, the target boot program file in the second boot partition is loaded; jump to the application partition, and when the target application file is loaded, confirm that the upgrade of the controller is completed. The first boot partition and the second boot partition have a read timing relationship, and when the file in the first boot partition passes the integrity check, the file in the first boot partition will be loaded first. In the process of upgrading the controller, when the upgrade package is received and the current indication bit indicates the first boot partition, the program can be flashed to the second boot partition, and the program in the first boot partition can be destroyed after the backup to realize active switching between the two partitions. The above method solves the technical problem that the controller upgrade method provided by the related art has low robustness.

[0057] In an optional embodiment, when an upgrade data packet is received and the boot program indicator bit indicates the second boot partition, the target boot program file in the upgrade data packet is flashed to the first boot partition; when the target boot program file in the first boot partition passes the integrity check, the boot program indicator bit is adjusted to indicate the first boot partition; the controller is started, and when the program file in the first boot partition passes the integrity check, the target boot program file in the first boot partition is loaded; jump to the application partition, and when the target application program file is loaded, confirm that the upgrade of the controller is completed.

[0058] It should be noted that when the system receives an upgrade data packet containing a new version of the boot program and an application, and the current boot program indicator bit points to the second boot partition, the system will perform the operation. In this case, the system will flash the target boot program file in the package to the currently inactive first boot partition. This operation allows the boot program file of the standby partition to be updated without affecting the current system operation. After the new boot program file is flashed to the first boot partition, the system will perform an integrity check on it. If the check passes, indicating that the new version of the boot program file is complete and correct, the system will adjust the boot program indicator bit to point to the first boot partition, thereby preparing to start from the new partition. If the program file of the first boot partition has passed the integrity check, the system will load the target boot program file in the first boot partition, start executing the new version of the boot program, and prepare the system operating environment. After the boot program runs successfully, the system will jump to the application partition and load the target application program file. When the application program file is loaded and passes all necessary checks, the system confirms that the controller upgrade has been successfully completed and the new version of the application program can be started.

[0059] In an optional implementation, the controller receives an upgrade data packet containing a new version of the boot program and an application, and writes the target boot program file to the first boot partition without affecting the current operation. Subsequently, the system checks the integrity of the newly written boot program file, and only after confirming that the new file is complete and correct will it adjust the boot program indicator bit and prepare to start from the first boot partition. When the controller starts, if the program file of the first boot partition passes the integrity check, the system will load the new version of the boot program, and further jump to the application partition to load the target application file. Finally, after ensuring that the application file has been loaded and is correct, the system confirms that the controller's upgrade process has been completed and the new version of the software can be started.

[0060] Through the above-mentioned implementation of the present application, in the TDA4 chip environment, software upgrades can be safely performed without interrupting the current system operation, including updates of boot programs and applications, and the success of the upgrade and the stability of the system can be ensured through a checksum switching mechanism.

[0061] In an optional embodiment, after loading the target boot program file, it also includes: when the controller initialization fails according to the target boot program file and the boot program indicator bit indicates the first boot partition, processing the target boot program file in the first boot partition to obtain a candidate boot program file, and adjusting the boot program indicator bit to indicate the second boot partition; when the controller initialization fails according to the target boot program file and the boot program indicator bit indicates the second boot partition, flashing the reference boot program file in the file backup partition to the first boot partition, and adjusting the boot program indicator bit to indicate the first boot partition; after adjusting the boot program indicator bit, starting the controller.

[0062] It should be noted that controller initialization refers to the process of setting and configuring various hardware and software resources of the controller after the boot program is running to ensure that the system can run normally.

[0063] After loading the new version of the target boot program file, if the controller initialization based on the file fails and the current boot program indicator bit points to the first boot partition, the system will perform remedial measures. The system will process the target boot program file in the first boot partition to make it a candidate boot program file. This processing usually destroys the integrity of the file, thereby ensuring that the system will not start from the first boot partition. Then, the system adjusts the boot program indicator bit to indicate the second boot partition to try to start the controller from the second partition.

[0064] When the controller fails to initialize and the boot program indicator points to the second boot partition, the system will perform recovery operations. In this case, the system will find an old version or a verified reference boot program file from the file backup partition and flash it to the first boot partition. After the flash is completed, the boot program indicator will be adjusted to point to the first boot partition so that the boot program can be loaded from the first boot partition the next time the controller starts.

[0065] After the boot partition indicator bit adjustment is performed, the system will restart the controller to determine which partition to load the boot program file from based on the latest boot program indicator bit.

[0066] In an optional implementation, during the software upgrade process, if the controller fails to initialize, the system will take different remedial and recovery measures according to the partition pointed to by the current boot program indicator bit to ensure that the system can be started from a boot partition that can be initialized normally. If the boot program indicator bit points to the first boot partition and the initialization fails, the system will destroy the target boot program file of the first boot partition, making it a candidate boot program file, and adjust the indicator bit to point to the second boot partition. Conversely, if the boot program indicator bit points to the second boot partition, the system will flash the reference boot program file in the file backup partition to the first boot partition, and adjust the indicator bit to point to the first boot partition to restore the normal operation of the system. In either case, the ultimate goal is to ensure that the controller can be started from a boot partition that can operate normally by adjusting the boot program indicator bit, thereby maintaining the stability and functionality of the system.

[0067] Assume that the system is currently in the running state of the second boot partition (SBL_B, App_B), and the SBL_A partition is used as a file backup partition. During a software upgrade, the target boot program file SBL_new is flashed to the first boot partition SBL_A. However, when trying to boot from the SBL_A partition and initialize the controller, the system detects that the hardware initialization failed, indicating that there may be a problem with the SBL_new file. Since the SBL_new file initialization failed and the current boot program indicator bit points to SBL_A, the system will process the SBL_new file in the SBL_A partition to make it a candidate boot program file to ensure that the system will not attempt to boot from SBL_A. The system adjusts the boot program indicator bit to point to the SBL_B partition and prepares to boot from the second boot partition. The controller restarts, loads the boot program from the SBL_B partition, and attempts to initialize the system.

[0068] If the system is in the running state of the first boot partition (SBL_A, App_A) in the above steps, and the controller fails to initialize after trying to load the SBL_new file of the SBL_B partition, the system will read the reference boot program file from the file backup partition, for example, the old version of the boot program file SBL_old stored in the SBL_A partition. The system will flash the SBL_old file to the SBL_A partition. The system adjusts the boot program indicator bit to point to the SBL_A partition and prepares to start from the first boot partition. The controller restarts and loads the boot program from the SBL_A partition to ensure the normal operation of the system.

[0069] Through the above-mentioned implementation mode of the present application, in the TDA4 chip domain controller, when encountering an initialization failure, the system restores system operation and reduces risks by processing the target boot program file or restoring the reference boot program file from the file backup partition, and adjusting the boot program indication bit, thereby ensuring the stability and reliability of the system.

[0070] In an optional embodiment, before starting the controller, it also includes: when an upgrade data packet is received and the application indicator bit indicates the first application partition, the target application file is written to the second application partition, and when the target application file in the second application partition passes the integrity check, the application indicator bit is adjusted to indicate the second application partition, wherein the first application partition and the second application partition are used to store application files; when an upgrade data packet is received and the application indicator bit indicates the second application partition, the target application file is written to the first application partition, and when the target application file in the first application partition passes the integrity check, the application indicator bit is adjusted to indicate the first application partition.

[0071] It should be noted that the application indication bit is used to indicate the status flag of the currently active application partition. This flag bit determines which partition's application file is loaded when the system starts.

[0072] Before starting the controller, the application file upgrade process is performed. When the system receives the upgrade data packet and the application indicator bit points to the first application partition, the system will flash the target application file to the currently inactive second application partition. Only after the newly flashed target application file passes the integrity check, the application indicator bit will be adjusted to point to the second application partition, ensuring that the system will load the application from the second application partition at the next startup.

[0073] If the application indicator bit points to the second application partition, the new version of the target application file will be flashed to the first application partition. Similarly, after the target application file in the first application partition passes the integrity check, the system will adjust the application indicator bit to point to the first application partition, preparing to load the application from the first partition at the next startup.

[0074] In an optional implementation, during the upgrade process, the system will write the new version of the application file to the inactive partition according to the currently active application partition. After confirming the integrity of the newly written application file, the system will adjust the application indicator to point to the partition where the new version is located, thereby ensuring that the system starts from the safe and reliable new version of the application, while retaining the backup of the old version in case of rollback. This mechanism improves the robustness and flexibility of software upgrades and reduces the risk of the system failing to start after an upgrade failure.

[0075] For example, a dual-partition upgrade of application files is implemented in a domain controller based on a TDA4 chip. Assume that the current system is in the running state of the first application partition App_A, that is, the application indicator bit points to the App_A partition. The system receives an upgrade data packet, which contains the target application file App_new. The system starts to flash the App_new file to the inactive second application partition App_B. After the flashing of the App_new file in the App_B partition is completed, the system performs an integrity check on it. If the App_new file passes the check, the system adjusts the application indicator bit to point to the App_B partition. After the application indicator bit is adjusted, the system waits for the next reset signal and prepares to start from the App_B partition.

[0076] Assume the situation is reversed, and the application pointer currently points to the second application partition App_B. The system receives the upgrade data packet, which again contains the target application file App_new. The system writes the App_new file to the first application partition App_A, which is now an inactive partition. After the App_new file in the App_A partition is written, it is checked for integrity. If the App_new file passes the check, the system adjusts the application pointer to point to the App_A partition. After the application pointer is adjusted, the system waits for the next reset and prepares to boot from the App_A partition.

[0077] Through the above implementation of the present application, in the TDA4 chip domain controller, the upgrade of the application file can be safely executed without interrupting the current system operation, and the dual partition mechanism is adopted to ensure the stability and security of the upgrade process. No matter which partition the application indicator bit points to, the system can smoothly switch to the new version after confirming that the new version of the application file is complete and correct, while retaining the old version for emergency use, thereby improving the robustness of the entire upgrade process and the reliability of the system.

[0078] In an optional embodiment, jumping to the application partition includes: loading a target application file in the application partition indicated by an application indicator bit; if the loaded target application file fails the integrity check and the application indicator bit indicates the first application partition, adjusting the application indicator bit to indicate the second application partition; if the loaded target application file fails the integrity check and the application indicator bit indicates the second application partition, adjusting the application indicator bit to indicate the first application partition.

[0079] It should be noted that after completing the loading and verification of the boot program, the system will jump to the corresponding application partition according to the direction of the application indicator bit, and load the target application file therein to start running the new version of the application. After loading the target application file, if the file fails to pass the integrity check and the current indicator bit points to the first application partition, the system will automatically adjust the indicator bit to point to the second application partition, thereby preventing the use of unverified or damaged program files for running, and at the same time try to load the application from another partition to ensure the stability of system operation. If the target application file fails to pass the integrity check after being loaded in the second application partition, the system will adjust the application indicator bit to point to the first application partition as a recovery mechanism to ensure that the system can run from a known complete application partition and avoid potential operating errors or system crash risks.

[0080] In an optional implementation, after loading the target application file, the system will perform an integrity check on the file. If the check fails, the system will adjust the indicator bit to another application partition according to the direction of the current application indicator bit, and try to load the application file from the partition to ensure that the system can run stably. This mechanism provides an additional layer of security for the software upgrade process. Even if the application file upgrade fails, the normal operation of the system can be restored by switching partitions, thereby reducing the risk of system unavailability caused by upgrade failure.

[0081] Assume that a dual partition upgrade of application files is being implemented on a domain controller based on the TDA4 chip. The current system is in the running state of the first application partition (App_A), that is, the application indicator bit points to the App_A partition. After the system completes the loading and verification of the boot program, it jumps to the application partition and starts loading the target application file App_new in the App_B partition (inactive partition). After the App_new file in the App_B partition is loaded, the system performs an integrity check on it. If the App_new file fails the integrity check and the current indicator bit points to the first application partition (App_A), the system adjusts the application indicator bit to point to the reverse partition of the second application partition (App_B), that is, the first application partition (App_A). The system attempts to load the application from the first application partition (App_A), runs the old version of the application to maintain system functionality, and prepares to rewrite the damaged App_new file in the App_B partition.

[0082] Assume that the system is currently in the second application partition (App_B) running state. After completing the loading and verification of the boot program, the system attempts to load the target application file App_new from the App_A partition (inactive partition). After the App_new file of the App_A partition is loaded, an integrity check is performed. If the App_new file fails the integrity check, the system adjusts the application indicator bit to point to the reverse partition of the first application partition (App_A), that is, the second application partition (App_B). The system attempts to load the application from the second application partition (App_B) and run the old version of the application to ensure the stable operation of the system.

[0083] Through the above implementation of the present application, after the application file is loaded, the potential problems in the application file upgrade process are dealt with through integrity checking and adjustment of the application indicator bit. Regardless of the direction of the current application indicator bit, as long as a problem with the application file is found, the system will automatically adjust the direction to another partition and try to load the application file from the partition to ensure the continuity and security of the system operation.

[0084] In an optional embodiment, before receiving the upgrade data packet, it includes: when the controller receives the upgrade data packet, storing the upgrade data packet in an external memory and notifying the processor to be upgraded; the processor to be upgraded stores the upgrade data packet in a file storage area, wherein the file storage area includes a first boot partition, a second boot partition, a file backup partition and a boot program indication bit storage area, and the boot program indication bit storage area is used to store the boot program indication bit.

[0085] It should be noted that the external memory may be a storage device located outside the controller for storing upgrade data packets and other data. The processor to be upgraded may be a microcontroller unit on the MCU, which is responsible for executing the upgrade of the boot program and the application program. The file storage area may be an area divided out of the external memory, which is used to store different versions of boot programs and application program files, as well as a boot program indicator bit indicating the current active partition.

[0086] Before officially starting the software upgrade process, when the controller receives an upgrade data packet containing a new software version, it stores the data in an external memory and then notifies the microcontroller unit on the MCU domain, i.e. the processor to be upgraded, to start preparing for the upgrade process.

[0087] After receiving the notification, the processor (MCU) to be upgraded will store the files in the upgrade data package into the file storage area of ​​the external memory. The file storage area is subdivided into several important parts, including the first boot partition, the second boot partition, the file backup partition, and the boot program indication bit storage area. The boot program indication bit storage area is specifically used to store the boot program indication bit, that is, the flag bit that determines the current active boot partition, to ensure that the system can accurately identify and load the correct boot program version.

[0088] In an optional embodiment, when the controller receives an upgrade data packet, it is responsible for storing the data packet in an external memory, and then notifying the processor to be upgraded (such as an MCU) to start the upgrade process. The MCU will then store the files in the upgrade data packet in the file storage area of ​​the external memory, which is composed of multiple important partitions, including the first boot partition and the second boot partition for storing the new version of the boot program, the file backup partition that provides the system with software rollback capabilities, and the storage area for storing the boot program indicator bit to ensure that the system can correctly identify and load the currently active boot partition. The entire process ensures the safe storage of the upgrade data packet and prepares for subsequent software upgrades and partition switching.

[0089] In a domain controller based on the TDA4 chip, consider the actual operation process of a software upgrade. Assume that the controller (SOC) has received an upgrade data packet, which contains a new boot program file SBL_new and an application file App_new, as well as an upgrade instruction. The SOC stores the received upgrade data packet in an external memory, which can be a DDR. The SOC sends a notification to the MCU, indicating that it is ready to receive and process the upgrade data packet. The MCU begins to store the files in the upgrade data packet in the file storage area of ​​the external memory. If the current boot program indicator bit points to the first boot partition SBL_A, then SBL_new will be stored in the second boot partition SBL_B for subsequent switching; App_new will be stored in the inactive second application partition App_B or the first application partition App_A according to the partition pointed to by the current application indicator bit. At the same time, the MCU will ensure the correctness of the flag bit in the boot program indicator bit storage area to reflect the partition status of the current storage of the new version of the boot program. Once all files are successfully stored in the file storage area of ​​the external memory and the bootloader indicator bit is correctly updated, the MCU will be ready to perform subsequent upgrade steps, including integrity verification of the bootloader and application, and partition switching or rollback operations based on the verification results.

[0090] Through the above implementation of the present application, before the TDA4 chip domain controller is upgraded, the upgrade data packet is securely stored in the file storage area of ​​the external memory, and the processor (MCU) to be upgraded is notified and prepared for software upgrade. The entire process ensures the integrity and security of the upgrade data, as well as the stability and robustness of the system during the upgrade process.

[0091] The above method will be described again in conjunction with a specific embodiment below. Taking TDA4 as an example, TDA4 can be divided into a MAIN domain, an MCU domain, and a WKUP domain (DMSC). The MAIN domain includes the A72 processor.

[0092] Figure 3 is a schematic diagram of an optional controller upgrade method according to an embodiment of the present application; Figure 3 As shown, the controller 308 may be a TDA4 chip, the processor 302 may be an MPU (such as A72), the external memory 304 may be a DDR, and the processor 306 to be upgraded may be an MCU domain. Figure 3The data transmission in the TDA4 chip during OTA upgrade is shown, including the processor 302 that receives the update package, the external memory 304 of the file image, and the MCU domain that needs to be upgraded. TDA4 integrates many IP cores. After receiving the upgrade command and upgrade data packet, the main core (processor 302) of the MAIN domain puts the upgrade data packet into the specified external memory 304, and notifies the MCU domain (processor 306 to be upgraded) to complete the image reading and parsing of the upgrade data packet, and writes the upgrade package image content to the corresponding external NorFlash area (file storage area) according to the dual partition upgrade solution of the MCU.

[0093] Figure 4 is a schematic diagram of an optional file storage area according to an embodiment of the present application; Figure 4 As shown, the file storage area can be an external NorFlash storage. Figure 4 The area division method is shown in FIG. 4. It is mainly divided into the first boot partition 402, the first application partition 404, the second boot partition 406, the second application partition 408, the file backup partition 410, the boot program indicator 412, and the application program indicator 414. The first boot partition 402 and the second boot partition 406 are areas for storing the SBL partition image content (boot program file), and the first application partition 404 or the second application partition 408 is an area for storing the App partition image content (application program file). The file backup partition 410 is used as a data storage area, mainly for storing reference boot program files. When performing an SBL partition upgrade, the current running partition can be judged to implement SBL active partition switching based on the SBL running flag information (boot program indicator 412). When performing an App upgrade, the current running partition can be judged to load the corresponding App partition image based on the App running flag information (application program indicator 414).

[0094] Optionally, the loading addresses of the first boot partition 402, the first application partition 404, the second boot partition 406, the second application partition 408, and the file backup partition 410 may be 0x000000-0x07FFFF, 0x080000-0x3FFFFF, 0x400000-0x47FFFF, 0x480000-0x87FFFF, and 0x880000, respectively. The variable of the boot program indicator bit 412 may be set to sblActivitySector, and the variable of the application program indicator bit 414 may be set to appActivitySector. The variable of the file backup partition 410 may be set to sblBackupImage

[512] .

[0095] When the SBL active partition is identified as the first boot partition 402, the reference boot program file in the first boot partition 402 is backed up, the image content of the first boot partition 402 is destroyed, and a specific character of 512 bytes is used to replace it, and the SBL image content is written into the second boot partition 406, and the SBL running partition flag is updated to area B. After resetting the MCU, the SBL image loading address is 0x4000000. Similarly, when the SBL running partition is identified as the second boot partition 406, according to the chip characteristics, it is not necessary to destroy the image of the second boot partition 406, and the SBL image content is written into the first boot partition 402, and the SBL running partition flag is updated to area A. After resetting the MCU, the SBL image loading address is 0x0000000. If the SBL flashing process fails or the image verification fails, the SOC is notified that the SBL upgrade has failed; or after the flashing is completed and the MCU is reset, if there is a failure in the initialization of important peripherals or the failure to load the MCU image during the SBL operation process, it will trigger a rollback to restore the damaged partition and trigger a restart.

[0096] Figure 5 is a flowchart of an optional boot partition upgrade method according to an embodiment of the present application; Figure 5 As shown, in the process of upgrading the controller, steps S502 to S518 are performed, and the steps are as follows:

[0097] Step S502, receiving an upgrade data packet. Step S504, determining whether the boot program indicator is the first boot partition, if it is the first boot partition, executing step S506-1, flashing the target boot program file to the second boot partition; if it is not the first boot partition, executing step S506-2, flashing the target boot program file to the first boot partition. After steps S506-1 and S506-2, respectively executing steps S508-1 and S508-2, determining whether the flashing is completed. And then executing steps S510-1 and S510-2, respectively, determining whether the integrity check is passed. If steps S508-1, S508-2, S510-1 and S510-2 are judged as no, executing step S516, sending the result of the upgrade failure to the SOC. If step S510-1 is judged as passed, executing step S512, backing up the reference boot program file, and destroying the reference boot program file. Then, step S514 is executed to update the boot program indicator bit, and then S516 is executed to notify the SOC of the successful upgrade result. Finally, step S518 is executed to wait for the ECU to reset.

[0098] As mentioned above, the SBL image address space of the MCU can be divided into two partitions, AB. The currently running partition is the active partition, and the non-running partition is the inactive partition. The inactive partition image is updated each time the upgrade is performed. After the SBL is successfully flashed, it waits for the ECU to reset and take effect. During the upgrade process, after the TDA4 chip starts normally and the MCU runs the App, it receives the SBL upgrade command sent by the SOC, and the MCU starts to upgrade the SBL. The current active partition is judged by storing the SBL active partition flag (boot partition indicator bit). If the active partition flag is A, the SBL image content is flashed into the B partition (the second boot partition). If the SBL flashing process fails or the SBL flashing integrity check fails after the flashing is successful, the SoC is notified that the SBL upgrade has failed. If the running partition flag is B, it is flashed into the A partition (the first boot partition). After the integrity check passes, if the current active partition is partition A, the SBL image code (i.e., the reference boot program file) that needs to be destroyed in partition A is backed up to the file backup partition, the image content of partition A in the external NorFlah is destroyed, and the SBL running partition flag is updated to partition B; if the current active partition is partition B, due to the characteristics of the TDA4 chip, there is no need to destroy the image content of partition B, directly update the active partition flag to partition A, and notify the SoC that the SBL upgrade is successful. After flashing the SBL, you need to wait for the ECU to reset before it takes effect, and the entire flashing SBL process ends.

[0099] Optionally, during the upgrade process, after completing the update of the boot file, the application file can be updated. The process is as follows: When the MCU APP is running normally, it receives the SOC upgrade APP instruction: first read the App running partition flag (i.e., the application indicator bit), if the current active partition is area A (i.e., the first application partition), then flash the APP image into the App_B area (i.e., the second application partition), if the current active partition is area B, flash the APP image into the App_A area. If the App flashing process fails, the SOC is notified that the APP upgrade failed. If the flashing is successful, the App flashing integrity check is performed; if the integrity check fails, the SoC App flashing failure is notified. If the App flashing integrity check is successful, if the flashing is partition A, the App active partition flag is updated to B, if the flashing is partition B, the App active partition flag is updated to A, and the Soc App is notified that the flashing is successful; after flashing the App, wait for the ECU to restart to take effect.

[0100] Figure 6 is a flowchart of an optional controller startup process according to an embodiment of the present application; Figure 6 As shown in the figure, during the startup of the controller, the following processes can be performed:

[0101] Step S602, run the Rom program, then execute step S604, determine the integrity of the files in the first boot partition, if complete, execute step S606-1, load the files in the first boot partition, if incomplete, execute step S606-2, load the files in the second boot partition. Then execute step S608 to implement hardware initialization. Then execute step S610 to determine whether the application indicator bit indicates the first application partition. If it indicates the first application partition, execute step S612-1 to load the files in the first application partition. If it does not indicate the first application partition, execute step S612-2 to load the files in the second application partition. Then execute step S614 to load the application file. And execute step S616 to pull up the controller kernel.

[0102] Optionally, the boot process of the TDA4 chip involves the selection of SBL and App partitions. After the chip is powered on, the read-only ROM program will be run first and the hardware will be initialized. By verifying the integrity and legality of the image, it is decided to load the image content of area A (first boot partition) or area B (second boot partition) of the SBL. After the SBL image is loaded from NorFlash, the corresponding SBL program is run in the built-in RAM area. For the loading and running of the App, first select the active partition A or active partition B according to the App running partition flag in the ESS, then load the active partition App image content, then reset the MCU core, and finally run the App program in the built-in RAM and DDR. After the MCU runs the App, the MAIN domain core of the TDA4 is pulled up, and the entire boot process ends.

[0103] If the initialization of important peripherals fails during the SBL process, the SBL rollback mechanism will be triggered. Similarly, the App image information security integrity check is performed before loading the App image. Failure of the check will trigger the App rollback mechanism. The rollback strategy will be described in detail below.

[0104] Figure 7 is a flowchart of an optional boot program partition rollback process according to an embodiment of the present application; Figure 7 As shown, in the case of needing to roll back, step S702 can be executed to determine the legitimacy of the reference boot program file and the target boot program file. If the legitimacy is passed, step S704 is executed to determine whether the boot program indicator indicates the first boot partition. If it indicates the first boot partition, step S706-1 is executed to destroy the files in the first boot partition. If it indicates the second boot partition, step S706-2 is executed to restore the files in the first boot partition. Then step S708 is executed to update the boot program indicator, and step S710 is executed to wait for the ECU to reset.

[0105] Optionally, during the rollback process, first verify the legitimacy of the SBL inactive partition image. If the verification passes, rollback is performed. If it fails, rollback is not performed. During the rollback, first determine whether the current active partition is partition A. If the current SBL active partition is A, the SBL_A area image needs to be destroyed. If the current SBL active partition is B, the ESS backup SBL_A part image needs to be restored to the SBL_A area, and the SBL active partition flag needs to be updated. After waiting for the ECU to be reset, the SBL partition cut operation will be completed.

[0106] Through the above implementation of the present application, a complete dual partition upgrade solution for SBL and APP of TDA4 chip MCU is provided, which solves the problem that MCU cannot start after the failure of flashing or verifying SBL image, and improves the robustness of MCU upgrade. And the SBL active zone switching mechanism of TDA4 is provided, and the inherent characteristics of TDA4 chip are used to realize the SBL active zone switching and backup upgrade process.

[0107] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0108] According to another aspect of the embodiment of the present application, a controller upgrade device for implementing the controller upgrade method is also provided. Figure 8 As shown, the device comprises:

[0109] The flashing indication unit 802 is used to flash the target boot program file in the upgrade data packet to the second boot partition when the upgrade data packet is received and the boot program indication bit indicates the first boot partition, wherein the upgrade data packet includes the target boot program file and the target application file, and the first boot partition is a storage partition with a first read timing after the controller is started;

[0110] The indication bit adjustment unit 804 is used for, when the target boot program file in the second boot partition passes the integrity check, backing up the reference boot program file in the first boot partition to the file backup partition, processing the reference boot program file in the first boot partition to obtain a candidate boot program file, and adjusting the boot program indication bit to indicate the second boot partition, wherein the candidate boot program file is a file that fails to pass the integrity check;

[0111] A program loading unit 806 is used to start the controller and load a target boot program file in the second boot partition if the program file in the first boot partition fails the integrity check;

[0112] The application upgrade unit 808 is used to jump to the application partition and confirm the completion of the controller upgrade when the target application file is loaded.

[0113] Optionally, the above-mentioned flash indication unit 802 is also used to: when an upgrade data packet is received and the boot program indicator bit indicates the second boot partition, flash the target boot program file in the upgrade data packet to the first boot partition; the above-mentioned indicator bit adjustment unit 804 is also used to: when the target boot program file in the first boot partition passes the integrity check, adjust the boot program indicator bit to indicate the first boot partition; the above-mentioned program loading unit 806 is also used to start the controller, and when the program file in the first boot partition passes the integrity check, load the target boot program file in the first boot partition; the above-mentioned application upgrade unit 808 is also used to: jump to the application partition, and when the target application program file is loaded, confirm that the upgrade of the controller is completed.

[0114] Optionally, the program loading unit 806 includes: a first boot program loading module, which is used to process the target boot program file in the first boot partition to obtain a candidate boot program file when the controller initialization fails according to the target boot program file and the boot program indicator bit indicates the first boot partition, and adjust the boot program indicator bit to indicate the second boot partition; a second boot program loading module, which is used to flash the reference boot program file in the file backup partition to the first boot partition when the controller initialization fails according to the target boot program file and the boot program indicator bit indicates the second boot partition, and adjust the boot program indicator bit to indicate the first boot partition; and a first startup module, which is used to start the controller after adjusting the boot program indicator bit.

[0115] Optionally, the above-mentioned application upgrade unit 808 includes: a first application upgrade module, which is used to flash the target application file to the second application partition when an upgrade data packet is received and the application indicator bit indicates the first application partition, and adjust the application indicator bit to indicate the second application partition when the target application file in the second application partition passes the integrity check, wherein the first application partition and the second application partition are used to store application files; a second application upgrade module, which is used to flash the target application file to the first application partition when an upgrade data packet is received and the application indicator bit indicates the second application partition, and adjust the application indicator bit to indicate the first application partition when the target application file in the first application partition passes the integrity check.

[0116] Optionally, the above-mentioned application upgrade unit 808 also includes: an application loading module, which is used to load the target application file in the application partition indicated by the application indicator bit; a first application rollback module, which is used to adjust the application indicator bit to indicate the second application partition when the target application file after loading fails to pass the integrity check and the application indicator bit indicates the first application partition; a second application rollback module, which is used to adjust the application indicator bit to indicate the first application partition when the target application file after loading fails to pass the integrity check and the application indicator bit indicates the second application partition.

[0117] Optionally, the upgrade device of the above-mentioned controller also includes: a receiving unit, which is used to store the upgrade data packet in an external memory and notify the processor to be upgraded when the controller receives the upgrade data packet; a storage unit, which is used for the processor to be upgraded to store the upgrade data packet in a file storage area, wherein the file storage area includes a first boot partition, a second boot partition, a file backup partition and a boot program indicator bit storage area, and the boot program indicator bit storage area is used to store the boot program indicator bit.

[0118] Optionally, in this embodiment, the embodiments to be implemented by the above-mentioned various unit modules can refer to the above-mentioned various method embodiments, which will not be repeated here.

[0119] According to another aspect of the embodiment of the present application, an electronic device for implementing the upgrade method of the controller is also provided. The electronic device may be Fig. 9 The terminal device or server shown in the figure. This embodiment is described by taking the electronic device as a terminal device as an example. Fig. 9 As shown, the electronic device includes a memory 902 and a processor 904. The memory 902 stores a computer program, and the processor 904 is configured to execute the steps in any of the above method embodiments through the computer program.

[0120] Optionally, in this embodiment, the electronic device may be located in at least one network device among a plurality of network devices of a computer network.

[0121] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0122] S1, when an upgrade data packet is received and the boot program indication bit indicates the first boot partition, the target boot program file in the upgrade data packet is flashed to the second boot partition, wherein the upgrade data packet includes the target boot program file and the target application file, and the first boot partition is a storage partition with a first read timing after the controller is started;

[0123] S2, when the target boot program file in the second boot partition passes the integrity check, after backing up the reference boot program file in the first boot partition to the file backup partition, processing the reference boot program file in the first boot partition to obtain a candidate boot program file, and adjusting the boot program indication bit to indicate the second boot partition, wherein the candidate boot program file is a file that fails to pass the integrity check;

[0124] S3, starting the controller, and loading the target boot program file in the second boot partition if the program file in the first boot partition fails the integrity check;

[0125] S4, jumps to the application partition, and confirms that the controller upgrade is completed when the target application file is loaded.

[0126] Alternatively, a person skilled in the art may understand that: Fig. 9 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (MID), a PAD, and other terminal devices. Fig. 9 The electronic device and the electronic equipment described above are not limited in structure. Fig. 9 More or fewer components (such as network interfaces, etc.) as shown in, or with Fig. 9 Different configurations are shown.

[0127] Among them, the memory 902 can be used to store software programs and modules, such as the program instructions / modules corresponding to the controller upgrade method and device in the embodiment of the present application. The processor 904 executes various functional applications and data processing by running the software programs and modules stored in the memory 902, that is, realizing the above-mentioned controller upgrade method. The memory 902 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 902 may further include a memory remotely located relative to the processor 904, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Among them, the memory 902 can be specifically, but not limited to, used to store information such as indicator bits. As an example, such as Fig. 9 As shown, the memory 902 may include, but is not limited to, the flash indication unit 802, the indication bit adjustment unit 804, the program loading unit 806, and the application upgrade unit 808 in the upgrade device of the controller. In addition, other module units in the upgrade device of the controller may also be included but are not limited to, which will not be repeated in this example.

[0128] Optionally, the transmission device 906 is used to receive or send data via a network. Specific examples of the above-mentioned network may include a wired network and a wireless network. In one example, the transmission device 906 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 906 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0129] In addition, the electronic device further comprises: a display 908 for displaying whether the upgrade is successful; and a connection bus 910 for connecting various module components in the electronic device.

[0130] In other embodiments, the terminal device or server may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes through network communication. Among them, the nodes may form a peer-to-peer (P2P, Peer To Peer) network, and any form of computing device, such as a server, terminal or other electronic device, may become a node in the blockchain system by joining the peer-to-peer network.

[0131] According to one aspect of the present application, a computer program product is provided, the computer program product comprising a computer program / instruction, the computer program / instruction comprising a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part, and / or installed from a removable medium. When the computer program is executed by a central processing unit, various functions provided by the embodiments of the present application are executed.

[0132] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0133] According to one aspect of the present application, a computer-readable storage medium is provided, and a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the upgrade method of the above-mentioned controller.

[0134] Optionally, in this embodiment, the computer-readable storage medium may be configured to store a computer program for performing the following steps:

[0135] S1, when an upgrade data packet is received and the boot program indication bit indicates the first boot partition, the target boot program file in the upgrade data packet is flashed to the second boot partition, wherein the upgrade data packet includes the target boot program file and the target application file, and the first boot partition is a storage partition with a first read timing after the controller is started;

[0136] S2, when the target boot program file in the second boot partition passes the integrity check, after backing up the reference boot program file in the first boot partition to the file backup partition, processing the reference boot program file in the first boot partition to obtain a candidate boot program file, and adjusting the boot program indication bit to indicate the second boot partition, wherein the candidate boot program file is a file that fails to pass the integrity check;

[0137] S3, starting the controller, and loading the target boot program file in the second boot partition if the program file in the first boot partition fails the integrity check;

[0138] S4, jumps to the application partition, and confirms that the controller upgrade is completed when the target application file is loaded.

[0139] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0140] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling one or more computer devices (which can be personal computers, servers or network devices, etc.) to execute all or part of the steps of the above methods in each embodiment of the present application.

[0141] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0142] In the several embodiments provided in the present application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0143] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0144] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0145] The above are only preferred implementations of the present application. It should be pointed out that ordinary technicians in this technical field can make several improvements and modifications without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A controller upgrade method, characterized in that: include: When an upgrade data packet is received and the boot program indication bit indicates a first boot partition, a target boot program file in the upgrade data packet is flashed to a second boot partition, wherein the upgrade data packet includes the target boot program file and a target application file, and the first boot partition is a storage partition with a first read timing after the controller is started; In the case where the target boot program file in the second boot partition passes the integrity check, after backing up the reference boot program file in the first boot partition to the file backup partition, processing the reference boot program file in the first boot partition to obtain a candidate boot program file, and adjusting the boot program indication bit to indicate the second boot partition, wherein the candidate boot program file is a file that fails to pass the integrity check; Starting the controller, and loading the target boot program file in the second boot partition if the program file in the first boot partition fails the integrity check; Jump to the application partition, and confirm that the upgrade of the controller is completed when the target application file is loaded.

2. The method according to claim 1, characterized in that The method further comprises: When the upgrade data packet is received and the boot program indicator bit indicates the second boot partition, the target boot program file in the upgrade data packet is flashed to the first boot partition; When the target boot program file in the first boot partition passes the integrity check, adjusting the boot program indication bit to indicate the first boot partition; Starting the controller, and loading the target boot program file in the first boot partition when the program file in the first boot partition passes the integrity check; Jump to the application partition, and confirm that the upgrade of the controller is completed when the target application file is loaded.

3. The method according to claim 2, characterized in that After loading the target boot program file, it also includes: When initialization of the controller according to the target boot program file fails and the boot program indication bit indicates the first boot partition, processing the target boot program file in the first boot partition to obtain the candidate boot program file, and adjusting the boot program indication bit to indicate the second boot partition; If initialization of the controller according to the target boot program file fails and the boot program indication bit indicates the second boot partition, flashing the reference boot program file in the file backup partition to the first boot partition, and adjusting the boot program indication bit to indicate the first boot partition; After adjusting the boot program indicator bit, the controller is started.

4. The method according to claim 2, characterized in that: Before starting the controller, the method further includes: Upon receiving the upgrade data packet and in the case where the application indication bit indicates the first application partition, the target application file is flashed to the second application partition, and in the case where the target application file in the second application partition passes the integrity check, the application indication bit is adjusted to indicate the second application partition, wherein the first application partition and the second application partition are used to store application files; When the upgrade data packet is received and the application indicator bit indicates the second application partition, the target application file is flashed to the first application partition, and when the target application file in the first application partition passes the integrity check, the application indicator bit is adjusted to indicate the first application partition.

5. The method according to claim 4, characterized in that The jumping to the application partition includes: Loading the target application file in the application partition indicated by the application indication bit; If the loaded target application file fails the integrity check and the application indication bit indicates the first application partition, adjusting the application indication bit to indicate the second application partition; If the loaded target application file fails the integrity check and the application indication bit indicates the second application partition, the application indication bit is adjusted to indicate the first application partition.

6. The method according to any one of claims 1 to 5, characterized in that Before receiving the upgrade data packet, the method further comprises: When the controller receives the upgrade data packet, the controller stores the upgrade data packet in an external memory and notifies the processor to be upgraded; The processor to be upgraded stores the upgrade data packet in a file storage area, wherein the file storage area includes the first boot partition, the second boot partition, the file backup partition and a boot program indication bit storage area, and the boot program indication bit storage area is used to store the boot program indication bit.

7. A controller upgrade device, characterized in that: include: a flashing indication unit, configured to flash a target boot program file in the upgrade data packet to a second boot partition when an upgrade data packet is received and the boot program indication bit indicates the first boot partition, wherein the upgrade data packet includes the target boot program file and the target application file, and the first boot partition is a storage partition with a first read timing after the controller is started; an indication bit adjustment unit, configured to, when the target boot program file in the second boot partition passes the integrity check, back up the reference boot program file in the first boot partition to a file backup partition, process the reference boot program file in the first boot partition to obtain a candidate boot program file, and adjust the boot program indication bit to indicate the second boot partition, wherein the candidate boot program file is a file that fails to pass the integrity check; a program loading unit, configured to start the controller and, if the program file of the first boot partition fails the integrity check, load the target boot program file in the second boot partition; The application upgrade unit is used to jump to the application partition and confirm the completion of the upgrade of the controller when the target application file is loaded.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program executes the method described in any one of claims 1 to 6 when executed.

9. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 6 through the computer program.

Images