A device upgrading method and apparatus, electronic device and vehicle

Abstract

The application provides a device upgrading method and device, an electronic device and a vehicle. The method is applied to the technical field of vehicle-mounted device control and includes the following steps: in the process of performing an upgrading operation on a vehicle-mounted remote communication terminal, if it is determined that a first processing unit receives a preset instruction for triggering the first processing unit to access a target storage area, it is detected whether a preset mark for representing that a second processing unit is currently accessing the target storage area exists in a global shared flag bit; and if it is detected that the preset mark exists in the global shared flag bit, the first processing unit is controlled to stop executing the preset instruction until the preset mark does not exist in the global shared flag bit. The method can effectively avoid the timing competition conflict caused by the first processing unit and the second processing unit simultaneously accessing the storage area in the upgrading process of the vehicle-mounted remote communication terminal, and improves the success rate and running stability of the upgrading of the vehicle-mounted remote communication terminal.

Description

Technical Field

[0001] This application relates to the field of vehicle-mounted equipment control technology, and more specifically, to a method, apparatus, electronic device, and vehicle for upgrading equipment in the field of vehicle-mounted equipment control technology. Background Technology

[0002] In the vehicle telematics box (TBOX) with a dual-core architecture of microcontroller unit (MCU) and navigation and driving domain (NAD), the existing conventional over-the-air (OTA) upgrade schemes typically employ a simple dual-core synchronization mechanism.

[0003] In scenarios involving continuous high-frequency upgrades (such as OTA stress testing and intensive version iterations), the MCU's "dynamic configuration execution" logic may encounter severe timing competition with the NAD's "partition switching" logic. This could lead to the MCU misjudging the partition status and issuing incorrect switching commands, resulting in upgrade rollback failures, software version inconsistencies, and upgrade process freezes. Summary of the Invention

[0004] This application provides a device upgrade method, apparatus, electronic device, and vehicle. The method can effectively avoid timing competition conflicts caused by the simultaneous access of the storage area by the first processing unit and the second processing unit during the upgrade of the vehicle-mounted remote communication terminal, thereby improving the success rate and operational stability of the vehicle-mounted remote communication terminal upgrade.

[0005] Firstly, a device upgrade method is provided, applied to an in-vehicle remote communication terminal. The in-vehicle remote communication terminal includes a first processing unit and a second processing unit. The method includes: during the upgrade operation of the in-vehicle remote communication terminal, upon determining that the first processing unit has received a preset instruction, detecting whether a preset flag exists in a globally shared flag bit; wherein the preset instruction is used to trigger the first processing unit to access a target storage area; the preset flag is used to indicate that the second processing unit is currently accessing the target storage area; the globally shared flag bit is used to share the operating status of the second processing unit with the first processing unit; upon detecting that a preset flag exists in the globally shared flag bit, controlling the first processing unit to stop executing the preset instruction until the preset flag does not exist in the globally shared flag bit.

[0006] The above technical solution first achieves state sharing between the first and second processing units by constructing a shared flag register inside the vehicle-mounted remote communication terminal. A preset flag identifies the status of the second processing unit's access to the target storage area. Before the first processing unit receives a preset instruction to trigger its access to the target storage area, it checks the global shared flag to quickly and accurately identify whether the second processing unit is currently accessing the target storage area, thus avoiding the risk of dual-core resource contention from the source. If the corresponding preset flag is detected in the global shared flag, the first processing unit is controlled to stop executing the preset instruction until the preset flag is no longer present in the global shared flag. This is equivalent to resuming the first processing unit's access operation only after the second processing unit stops accessing the target storage area. This effectively avoids timing conflicts caused by concurrent access to the storage area by the first and second processing units during the vehicle-mounted remote communication terminal upgrade process. It also avoids various abnormal faults caused by the simultaneous access operations of the first and second processing units to the target storage area, such as upgrade rollback mechanism failure, overall software version errors, and prolonged upgrade process freezes, thereby improving the success rate and operational stability of the vehicle-mounted remote communication terminal upgrade.

[0007] In conjunction with the first aspect, in some implementations of the first aspect, during the process of performing an upgrade operation on the vehicle-mounted remote communication terminal, the method further includes: when it is detected that the second processing unit is currently accessing the target storage area, writing a preset flag into a globally shared flag bit.

[0008] The above technical solution detects whether the second processing unit is currently accessing the target storage area. If the second processing unit is detected to be accessing the target storage area, a preset flag is written into the global shared flag. This allows the first processing unit to stop performing related operations on accessing the target storage area after detecting the flag, thereby avoiding the risk of timing competition caused by dual-core concurrent access to storage resources from the source and improving the success rate and operational stability of vehicle-mounted remote communication terminal upgrades.

[0009] In conjunction with the first aspect and the above implementation methods, in some implementation methods of the first aspect, during the upgrade operation of the vehicle-mounted remote communication terminal, the method further includes: obtaining the current interaction operation data between the first processing unit and the second processing unit; determining the current interaction state between the first processing unit and the second processing unit based on the current interaction operation data; and, if the current interaction state is a deadlock state, performing a corresponding fault reset operation according to the triggering cause of the deadlock state; wherein, the deadlock state refers to an abnormal stuck state in which the first processing unit and the second processing unit simultaneously access the target storage area, causing both to be unable to complete the access operation.

[0010] The above technical solution collects the interactive operation data between the first processing unit and the second processing unit in real time and determines their interaction status. Once a deadlock is detected due to both parties accessing the target storage area simultaneously, a targeted fault reset operation is performed based on the cause of the deadlock. This can promptly resolve the business blockage caused by resource contention between the first and second processing units, avoid long-term stagnation in the upgrade process of the vehicle-mounted remote communication terminal, and ensure the smooth data interaction process within the vehicle-mounted remote communication terminal.

[0011] In combination with the first aspect and the above implementation methods, in some implementation methods of the first aspect, the current interaction state between the first processing unit and the second processing unit is determined based on the current interactive operation data, including: obtaining the upgrade process stall duration when the vehicle-mounted remote communication terminal performs the upgrade operation; and determining the current interaction state between the first processing unit and the second processing unit based on the current interactive operation data when the upgrade process stall duration is greater than or equal to a first preset duration.

[0012] In conjunction with the first aspect and the above implementation methods, in some implementation methods of the first aspect, the current interactive operation data includes the heartbeat interaction state between the first processing unit and the second processing unit, the global shared flag, and the operation state of the first processing unit; based on the current interactive operation data, the current interaction state between the first processing unit and the second processing unit is determined, including: if there is no abnormality in the heartbeat interaction state, a preset flag exists in the global shared flag, and the operation state of the first processing unit is in the waiting interception state, the current interaction state is determined to be a waiting state; wherein, the waiting interception state refers to the state in which the first processing unit stops executing a preset instruction; the waiting state refers to the state in which either the first processing unit or the second processing unit detects that the other kernel is accessing the target storage area, suspends its own access instruction, and waits for the other kernel to complete the access operation; if any one of the following conditions is met, the current interaction state is determined to be a deadlock state: the heartbeat interaction state is abnormal, the duration of the preset flag in the global shared flag is greater than or equal to a second preset duration, and the duration of the first processing unit's operation state being in the waiting interception state is greater than or equal to a third preset duration.

[0013] The above technical solution can accurately identify waiting and deadlock states based on three parameters: the heartbeat interaction status between the first and second processing units, the global shared flag, and the running status of the first processing unit. This avoids misjudgments caused by a single parameter, and can quickly identify abnormal blocking scenarios where kernel resources are stuck and cannot be resolved on their own. This allows for timely reporting of deadlock faults, facilitating the subsequent startup of recovery and handling mechanisms, and improving the reliability of dual-core interaction process management.

[0014] In conjunction with the first aspect and the above implementation methods, in some implementation methods of the first aspect, a corresponding fault reset operation is performed according to the triggering cause of the deadlock state, including: if the triggering cause of the deadlock state is an abnormality occurring when the first processing unit accesses the target storage area, a corresponding first fault reset operation is performed on the first processing unit; if the triggering cause of the deadlock state is an abnormality occurring when the second processing unit accesses the target storage area, a corresponding second fault reset operation is performed on the second processing unit.

[0015] The above technical solution executes a first fault reset operation corresponding to the first processing unit when the first processing unit accesses the target storage area abnormally, and executes a second fault reset operation corresponding to the second processing unit when the second processing unit accesses the target storage area abnormally. The fault reset operation is only performed on the functional module corresponding to the faulty kernel, without the need to perform a whole machine restart. It can quickly release the mutex locks, shared partitions and other resources occupied by the abnormal kernel, realize rapid recovery of fault scenarios, significantly shorten the recovery time after the OTA upgrade process of the vehicle remote communication terminal is stuck and fails, reduce the service interruption caused by large-scale restarts, and effectively improve the operational stability of the vehicle remote communication terminal in the OTA upgrade scenario.

[0016] In conjunction with the first aspect and the above implementation methods, in some implementation methods of the first aspect, during the upgrade operation of the vehicle-mounted remote communication terminal, the method further includes: upon receiving an access instruction from the first processing unit or the second processing unit to a shared configuration file in the target storage area, obtaining the validity of the file pointer corresponding to the shared configuration file, and obtaining the current thread state of the upgrade thread currently performing the access operation; if the file pointer is valid and the current thread state is not abnormal, then access to the shared configuration file is allowed; if the file pointer is invalid or the current thread state is abnormal, then access to the shared configuration file is prohibited.

[0017] The above technical solution effectively avoids problems such as program crashes, configuration errors, and upgrade failures when accessing the configuration file is allowed by double-checking the validity of the file pointer corresponding to the shared configuration file and the thread state of the upgrade thread. This effectively ensures the data integrity and file operation security in a multi-threaded environment during the upgrade process of the vehicle-mounted remote communication terminal, and improves the stability of the vehicle-mounted remote communication terminal upgrade process.

[0018] Secondly, a device upgrade apparatus is provided, which is applied to an in-vehicle remote communication terminal. The in-vehicle remote communication terminal includes a first processing unit and a second processing unit. The apparatus includes: a detection module, used to detect whether a preset flag exists in a globally shared flag bit when the first processing unit receives a preset instruction during the upgrade operation of the in-vehicle remote communication terminal; wherein the preset instruction is used to trigger the first processing unit to access a target storage area; the preset flag is used to indicate that the second processing unit is currently accessing the target storage area; the globally shared flag bit is used to share the operating status of the second processing unit with the first processing unit; and a control module, used to control the first processing unit to stop executing the preset instruction when the preset flag bit is detected to exist in the globally shared flag bit, until the preset flag bit no longer exists in the globally shared flag bit.

[0019] In conjunction with the second aspect, in some implementations of the second aspect, during the upgrade operation of the vehicle-mounted remote communication terminal, the device further includes a writing module, which is specifically used to: write a preset flag into a globally shared flag bit when it is detected that the second processing unit is currently accessing the target storage area.

[0020] In conjunction with the second aspect and the above implementation methods, in some implementation methods of the second aspect, during the upgrade operation of the vehicle-mounted remote communication terminal, the device further includes an execution module, which is specifically used to: acquire the current interactive operation data between the first processing unit and the second processing unit; determine the current interactive state between the first processing unit and the second processing unit based on the current interactive operation data; and, if the current interactive state is a deadlock state, execute the corresponding fault reset operation according to the triggering cause of the deadlock state; wherein, the deadlock state refers to an abnormal stuck state in which the first processing unit and the second processing unit simultaneously access the target storage area, causing both to be unable to complete the access operation.

[0021] In conjunction with the second aspect and the above implementation methods, in some implementation methods of the second aspect, the execution module includes a determining unit, which is specifically used to: obtain the upgrade process stall duration when the vehicle-mounted remote communication terminal performs the upgrade operation; and, if the upgrade process stall duration is greater than or equal to a first preset duration, determine the current interaction state between the first processing unit and the second processing unit based on the current interactive operation data.

[0022] In conjunction with the second aspect and the above implementation methods, in some implementation methods of the second aspect, the current interactive operation data includes the heartbeat interaction state between the first processing unit and the second processing unit, the global shared flag, and the operating state of the first processing unit; the determining unit is further specifically used to: determine the current interaction state as a waiting state when there is no abnormality in the heartbeat interaction state, a preset flag exists in the global shared flag, and the operating state of the first processing unit is a waiting interception state; wherein, the waiting interception state refers to the state in which the first processing unit stops executing a preset instruction; the waiting state refers to the state in which either the first processing unit or the second processing unit detects that another kernel is accessing the target storage area, suspends its own access instruction, and waits for the other kernel to complete the access operation; and determine the current interaction state as a deadlock state when any one of the following conditions is met: there is an abnormality in the heartbeat interaction state, the duration of the preset flag in the global shared flag is greater than or equal to a second preset duration, and the duration of the first processing unit's operating state being in a waiting interception state is greater than or equal to a third preset duration.

[0023] In conjunction with the second aspect and the above implementation methods, in some implementation methods of the second aspect, the execution module includes an execution unit, which is specifically used to: perform a corresponding first fault reset operation on the first processing unit when the cause of the deadlock state is an abnormality occurring when the first processing unit accesses the target storage area; and perform a corresponding second fault reset operation on the second processing unit when the cause of the deadlock state is an abnormality occurring when the second processing unit accesses the target storage area.

[0024] In conjunction with the second aspect and the above implementation methods, in some implementation methods of the second aspect, the device further includes an access module, which is specifically used to: upon receiving an access instruction from the first processing unit or the second processing unit for a shared configuration file in the target storage area, obtain the validity of the file pointer corresponding to the shared configuration file and obtain the current thread state of the upgrade thread currently performing the access operation; if the file pointer is valid and the current thread state is not abnormal, then access to the shared configuration file is allowed; if the file pointer is invalid or the current thread state is abnormal, then access to the shared configuration file is prohibited.

[0025] Thirdly, an electronic device is provided, including a memory and a processor. The memory is used to store executable program code, and the processor is used to call and run the executable program code from the memory, causing the electronic device to perform the device upgrade method described in the first aspect and any possible implementation thereof.

[0026] Fourthly, a vehicle is provided, including an electronic device for performing the methods described in the first aspect and any possible implementation thereof.

[0027] Fifthly, a computer program product is provided, comprising: computer program code, which, when run on a computer, causes the computer to perform the device upgrade method described in the first aspect and any possible implementation thereof.

[0028] In a sixth aspect, a computer-readable storage medium is provided that stores computer program code, which, when executed on a computer, causes the computer to perform the device upgrade method of the first aspect and any possible implementation thereof. Attached Figure Description

[0029] Figure 1 This is a schematic flowchart illustrating a device upgrade method provided in an embodiment of this application; Figure 2 This is a schematic flowchart of a fault handling method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of a device upgrade apparatus provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0030] The technical solutions in this application will be clearly and thoroughly described below with reference to the accompanying drawings. In the description of the embodiments of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B. "And / or" in the text is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, in the description of the embodiments of this application, "multiple" refers to two or more than two.

[0031] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature.

[0032] In TBOX with a dual-core architecture of MCU and NAD, the existing OTA upgrade solution usually adopts a simple dual-core synchronization mechanism, that is, relying on one-way instruction interaction to achieve dual-core collaboration, with the MCU and NAD independently completing the reading and writing process of partition status identifiers.

[0033] However, in scenarios involving continuous high-frequency upgrades (such as OTA stress testing and intensive version iterations), the MCU's "dynamic configuration execution" logic may experience severe timing competition with the NAD's "partition switching" logic. Specifically, during the upgrade process, the MCU issues a partition switching instruction in advance. Executing this instruction requires reading and rewriting the partition status flag in the shared storage area. At this time, the NAD is still performing partition data synchronization operations and has not yet completed the refresh and writing of the partition synchronization flag. After reading the lagging and unupdated status information in the shared storage area, the MCU misjudges the partition's operating status, which may trigger an incorrect partition switching action. This causes both components to simultaneously compete for shared storage area resources, resulting in underlying storage anomalies such as data read / write overwriting, incomplete status flag writing, and incomplete partition image data. Consequently, this can lead to various abnormal failures such as upgrade rollback mechanism failure, system software version inconsistencies, and prolonged upgrade process freezes.

[0034] In response to the above situation, the current approach of relying solely on manually reserving a few minutes of operation interval to avoid the aforementioned conflicts lacks a systematic and automated anti-conflict management logic, making it difficult to meet the usage requirements in scenarios such as high-frequency continuous upgrades and stress testing.

[0035] To address the aforementioned technical issues, this application provides a device upgrade method. The execution subject of this method is an electronic device, specifically a TBOX. Typically, the TBOX is jointly executed by an MCU and a NAD within a dual-core architecture. This method effectively avoids timing competition conflicts caused by concurrent access to the storage area by the MCU and NAD during the TBOX upgrade process by adding dual-core status verification and timing mutual exclusion control logic to the TBOX upgrade process, thereby improving the success rate and operational stability of the TBOX upgrade.

[0036] Figure 1 This is a schematic flowchart of a device upgrade method provided in an embodiment of this application.

[0037] For example, the method is applied to a TBOX, which includes a first processing unit and a second processing unit.

[0038] For example, the first processing unit can be an MCU or a NAD, and the second processing unit can be a NAD or an MCU. When the first processing unit is an MCU, the second processing unit can be a NAD; when the first processing unit is a NAD, the second processing unit can be an MCU.

[0039] Among them, the MCU is the real-time control core of the whole vehicle side inside TBOX. It adopts a lightweight real-time chip architecture and has the characteristics of low latency, high reliability and low power consumption. It is mainly used to interface with the vehicle hardware and the whole vehicle bus, and undertakes the tasks of whole vehicle interaction, hardware management, safety monitoring and lightweight storage reading.

[0040] NAD is a high-performance application processor core that runs on TBOX. Its computing power is far superior to that of the MCU. It is mainly used to connect to external mobile networks and handle Internet services with high traffic, long duration, and high computational load. It shares the same firmware storage area with the MCU.

[0041] like Figure 1 As shown, the method 100 includes: Step 101: During the upgrade operation of the vehicle-mounted remote communication terminal, if it is determined that the first processing unit has received a preset instruction, check whether there is a preset flag in the global shared flag bit.

[0042] Among them, the preset instruction is used to trigger the first processing unit to access the target storage area; the preset flag is used to indicate that the second processing unit is currently accessing the target storage area; and the global shared flag is used to share the running status of the second processing unit with the first processing unit.

[0043] Step 102: If a preset flag is detected in the global shared flag, the first processing unit is controlled to stop executing the preset instruction until the preset flag is no longer present in the global shared flag.

[0044] In this embodiment, a shared flag register is first constructed within the vehicle-mounted remote communication terminal to achieve state sharing between the first processing unit and the second processing unit. A preset flag is used to identify the state of the second processing unit accessing the target storage area. Before the first processing unit receives a preset instruction to trigger its access to the target storage area, it first checks the global shared flag to quickly and accurately identify whether the second processing unit is currently accessing the target storage area, thus avoiding the risk of dual-core resource contention from the source. If the corresponding preset flag is detected in the global shared flag, the first processing unit is controlled to stop executing the preset instruction until the preset flag is no longer present in the global shared flag. This is equivalent to resuming the access operation of the first processing unit after the second processing unit stops accessing the target storage area. This can effectively avoid timing competition conflicts caused by the concurrent access of the first and second processing units to the storage area during the upgrade of the vehicle-mounted remote communication terminal. This avoids various abnormal faults caused by the failure of the upgrade rollback mechanism, the disorder of the whole machine software version, and the long-term deadlock of the upgrade process caused by the first and second processing units simultaneously performing access operations to the target storage area, thereby improving the success rate of the upgrade of the vehicle-mounted remote communication terminal and the operational stability of the vehicle terminal.

[0045] The following is about Figure 1 The implementation methods of each step in the illustrated embodiment are explained in detail below: In step 101, the TBOX mentioned above refers to the core in-vehicle communication processing terminal of intelligent connected vehicles, which adopts a dual-core collaborative architecture of MCU and NAD. The TBOX is the data interaction hub between the vehicle and the cloud server and various in-vehicle electronic control units, and can realize functions such as vehicle status reporting, remote control, fault diagnosis, emergency call, and remote firmware upgrade.

[0046] The aforementioned upgrade operation for TBOX refers to the OTA remote upgrade operation for TBOX. Specifically, TBOX downloads the firmware installation packages corresponding to MCU and NAD from the cloud server via a wireless network, and the dual cores work together to complete the complete business process of upgrade package verification, firmware partition erasure and writing, partition synchronization, version replacement, operation status monitoring, abnormal deadlock identification, and partial reset of faulty modules.

[0047] Furthermore, during the aforementioned OTA remote upgrade operation of TBOX, NAD will continuously perform "partition switching" logic operations such as firmware partition erasure and partition data synchronization; at the same time, MCU will continuously perform dynamic configuration file reading and writing, and rely on the partition status information in the configuration file to determine whether to perform partition switching control, that is, to run the "dynamic configuration execution" logic. The two sets of logics run in parallel during the upgrade process, which can easily lead to timing competition problems where both cores simultaneously occupy the shared storage area.

[0048] Among them, NAD is responsible for completing partition-related operations such as firmware partition erasure and writing, partition synchronization, and version replacement, which corresponds to the above-mentioned "partition switching" logic; MCU synchronously reads the partition status information in the shared storage area and executes operations such as issuing partition switching control commands and verifying the overall configuration parameters, which corresponds to the above-mentioned "dynamic configuration execution" logic.

[0049] To avoid timing conflicts between the MCU's "dynamic configuration execution" logic and the NAD's "partition switching" logic, this application embodiment can establish a globally shared flag register, i.e., a globally shared flag bit, in advance. The execution timing of dual-core services can be synchronously controlled through this globally shared flag bit. For example, the globally shared flag bit can be read before the MCU performs dynamic configuration file read / write operations. Then, if it is confirmed that the NAD has not triggered the "partition switching" logic, the "dynamic configuration execution" logic will be run. This isolates the execution time periods of the two types of services and effectively avoids timing conflicts caused by the MCU and NAD concurrently accessing the storage area during the TBOX upgrade process.

[0050] As mentioned above, when the first processing unit is an MCU, the second processing unit can be an NAD; when the first processing unit is an NAD, the second processing unit can be an MCU. The following embodiments illustrate this using an MCU as the first processing unit and an NAD as the second processing unit: In some embodiments, during the upgrade operation of TBOX, the method further includes: writing a preset flag into a global shared flag bit when it is detected that the second processing unit is currently accessing the target storage area.

[0051] The target storage area mentioned above refers to the storage space shared by the first processing unit and the second processing unit. For example, the target storage area may be a shared storage partition in the internal storage hardware of TBOX that is specifically allocated for use by the first processing unit and the second processing unit.

[0052] Specifically, if it is detected that the second processing unit is currently accessing the target storage area, it can be determined that the second processing unit is in a partition update state. In this partition update state, the second processing unit performs any access operation on the target storage area, including reading, writing, erasing, verification, firmware flashing, and partition update.

[0053] As mentioned above, the aforementioned preset flag is used to indicate that the second processing unit is currently accessing the target storage area, that is, to indicate that the second processing unit is currently in the partition update state (also known as the "partition synchronization" state). It is the basis for the first processing unit to identify whether there is a timing race conflict caused by the first processing unit and the second processing unit concurrently accessing the storage area.

[0054] The aforementioned global shared flag bit is a hardware-level status interaction carrier between the first processing unit and the second processing unit dual cores. It can be deployed in the shared flag bit register inside the TBOX, which can realize cross-core synchronous sharing of the real-time running status of the second processing unit, making it convenient for the first processing unit to quickly read and identify the current working status of the second processing unit.

[0055] Specifically, the second processing unit can monitor in real time whether it has received a partition switching command, whether it is performing any of the following processing tasks: partition erasure, firmware image writing, synchronization copying of new and old partition data, and partition firmware version integrity verification. If it detects that it has received a partition switching command or is performing any of the above processing tasks, it determines that the second processing unit is currently accessing the target storage area (i.e., it is in a partition update state).

[0056] Furthermore, when the second processing unit detects that it is currently accessing the target storage area, it can immediately set a preset flag in the global shared flag register. Relying on the shared flag register shared by both cores, it can synchronously inform the first processing unit of its own status. This allows the first processing unit to read the global shared flag first when it receives a preset instruction, thereby avoiding resource timing competition conflicts caused by the first processing unit's upgrade operation and the second processing unit's partition update operation accessing the target storage area at the same time.

[0057] As mentioned above, the aforementioned preset instruction is a control instruction that can trigger the first processing unit to access the target storage area between the first processing unit and the second processing unit.

[0058] For example, the aforementioned preset instructions may specifically include partition switching instructions or dynamic configuration execution instructions.

[0059] Among them, the aforementioned partition switching instruction refers to the control instruction issued to the second processing unit, which is used to trigger the second processing unit to complete operations such as firmware storage partition erasure and switching between old and new firmware partitions. It is the trigger instruction for the second processing unit to execute the complete partition update process. The aforementioned dynamic configuration execution instruction refers to the operation instruction issued to the first processing unit, which is used to read and write dynamic configuration files containing dual-core jump parameters, partition synchronization parameters, upgrade suspension duration, and other dual-core interaction status data. It is the instruction that triggers the first processing unit to complete the collection and update of dual-core interaction running status.

[0060] For example, if the TBOX's communication network is managed uniformly by the first processing unit, all OTA-related control commands and upgrade data packets from the cloud are first transmitted to the first processing unit via the communication module and the communication network. The second processing unit does not have independent network connectivity, cannot directly connect to the communication network, and does not have the ability to independently receive commands from the cloud. Based on this, the first processing unit can act as the central scheduling unit, uniformly receiving all control commands from the cloud and then distributing all control commands according to command type. Specifically, it forwards partition switching commands to the second processing unit, which executes the partition switching commands, while the first processing unit executes the dynamic configuration execution commands itself.

[0061] Furthermore, since the first processing unit will access the target storage area between the first processing unit and the second processing unit when executing the preset instruction, there may be a risk of timing competition caused by dual-core concurrent access to storage resources. Based on this, when it is determined that the first processing unit has received the preset instruction, it can first check whether there is a preset flag in the global shared flag bit, so as to determine whether to continue to execute or issue the preset instruction.

[0062] In step 102, the first processing unit directly reads the global shared flag bit and detects whether there is a preset flag indicating that the second processing unit is in the partition update state. Based on the read flag bit state, it can quickly determine whether the second processing unit is currently occupying the target storage area of ​​the first processing unit and the second processing unit.

[0063] For example, if no preset flag is detected in the global shared flag, it means that the second processing unit is not currently in the partition update state, and there is no risk of resource contention when dual cores concurrently access the shared firmware storage area. The first processing unit can directly execute or issue the currently received preset instruction. If a preset flag is detected in the global shared flag, it indicates that the second processing unit is currently in a partition update state and is occupying the shared firmware storage area to perform erase, write, image writing, data copying or version verification operations. There is a risk of resource contention due to dual-core concurrent access to the shared firmware storage area. The first processing unit can be controlled to stop executing the preset instruction and continuously read the global shared flag until no preset flag is detected in the global shared flag, and then resume execution or issue the preset instruction.

[0064] The above method detects whether the second processing unit is currently accessing the target storage area. If the second processing unit is detected to be accessing the target storage area, a preset flag is written into the global shared flag. This allows the first processing unit to stop performing related operations on accessing the target storage area after detecting the flag, thereby avoiding the risk of timing competition caused by dual-core concurrent access to storage resources from the source, improving the success rate of TBOX upgrades and the operational stability of the vehicle terminal.

[0065] To avoid timing contention and subsequent storage resource deadlock caused by concurrent access to shared storage resources by dual cores, and to prevent firmware partition synchronization interruption and upgrade process freezes, this application embodiment can be further configured with compatible... Figure 1 The implementation example includes a fallback fault handling mechanism.

[0066] The aforementioned storage resource deadlock refers to a state in which the first processing unit and the second processing unit are mutually blocked due to simultaneously preempting the target storage area, and neither can complete the access operation.

[0067] Figure 2 This is a schematic flowchart of a fault handling method provided in an embodiment of this application.

[0068] For example, this method is applied to TBOX, and the method is... Figure 1 The illustrated embodiment includes a fallback fault handling mechanism.

[0069] like Figure 2 As shown, the method 200 includes: Step 201: Obtain the current interaction data between the first processing unit and the second processing unit.

[0070] Understandably, during the OTA remote upgrade operation of TBOX, the interaction data between the first processing unit and the second processing unit can be obtained in real time, and the current interaction status of the dual-core architecture can be determined based on the obtained current interaction data, providing a reliable basis for subsequent deadlock identification.

[0071] The aforementioned current interactive operation data is used to characterize the real-time communication status between the first processing unit and the second processing unit, as well as the operation behavior of the target storage area.

[0072] For example, during the OTA remote upgrade operation of TBOX, the first processing unit, as the monitoring subject, obtains the interactive operation data between the first processing unit and the second processing unit in real time. Specifically, it receives the heartbeat messages periodically sent by the second processing unit, the reported partition erase and write and synchronization progress through the dual-core internal communication bus, reads the global shared flag to obtain the storage access status of the second processing unit, and records the partition switching instructions and dynamic configuration read and write records issued by itself.

[0073] The aforementioned current interactive operation data may specifically include the heartbeat interaction status between the first processing unit and the second processing unit, the global shared flag, the operation status of the first processing unit, and the dual-core resource usage data, among other operation data.

[0074] The heartbeat interaction status between the first processing unit and the second processing unit refers to the status of the interactive data formed by the periodic heartbeat messages sent between the first processing unit and the second processing unit. It is used to verify whether the communication link between the two ends is smooth and whether the main control on both sides is operating normally. It can identify communication failures such as heartbeat timeout, message loss, and verification error.

[0075] The global shared flag, also known as the "partition synchronization status flag," is a shared flag register set within the TBOX. It is updated in real time by the second processing unit and is used to characterize the synchronization stage of the A / B upgrade partition. This flag can characterize the status of the second processing unit, such as partition synchronization in progress, partition synchronization completed, or partition synchronization error, and can intuitively reflect the progress of the partition synchronization business process.

[0076] The running status of the first processing unit refers to the running status of the first processing unit itself, which is updated by the first processing unit itself. When the first processing unit reads the global shared flag and determines that the second processing unit is currently accessing the target storage area, it will set its own running status to wait for interception, stop advancing the upgrade process, and resume executing the preset instructions after the synchronization flag changes.

[0077] Dual-core resource usage data records the usage and release of file handles, mutexes, and partition read / write resources. This data is used to identify abnormal situations that cause process blockage, such as repeated closing of file pointers and conflicts caused by multi-core resource preemption.

[0078] Step 202: Based on the current interactive operation data, determine the current interaction state between the first processing unit and the second processing unit.

[0079] The aforementioned current interaction state is a dual-core collaborative operation state formed by the first processing unit and the second processing unit during the access to the target storage area.

[0080] For example, the current interaction state mentioned above may include, but is not limited to, a waiting state and a deadlock state; wherein, the waiting state refers to the state in which either the first processing unit or the second processing unit detects that the other end kernel is accessing the target storage area, and suspends its own access instruction and waits for the other end to complete the access operation; the deadlock state refers to the abnormal stuck state in which the first processing unit and the second processing unit access the target storage area at the same time, causing both to be unable to complete the access operation.

[0081] Since dual-core partition resource avoidance may cause short-term process stagnation, in order to avoid misjudgment of deadlock state, this application embodiment can first obtain the stagnation time of the upgrade process when TBOX performs the upgrade operation, and if the stagnation time of the upgrade process exceeds the first preset time, then determine the current interaction state between the first processing unit and the second processing unit based on the current interactive running data.

[0082] In some embodiments, determining the current interaction state between the first processing unit and the second processing unit based on the current interaction running data includes: obtaining the upgrade process stall duration when the TBOX performs the upgrade operation; and determining the current interaction state between the first processing unit and the second processing unit based on the current interaction running data when the upgrade process stall duration is greater than or equal to a first preset duration.

[0083] The aforementioned upgrade process stall duration refers to the cumulative time during which the TBOX cannot continue to advance during the upgrade operation. It is usually collected by the first processing unit. Specifically, the first processing unit records the completion time of the previous effective action in the upgrade process in real time and uses the difference between the completion time of the previous effective action and the current time as the upgrade process stall duration.

[0084] For example, the first preset duration can be set according to the waiting time required for normal resource avoidance of dual cores. For example, if the maximum waiting time required for normal resource avoidance of dual cores is 8 seconds, then the first preset duration can be set to 10 seconds.

[0085] Furthermore, if the upgrade process stalls for a duration greater than or equal to the first preset duration, it indicates that the upgrade process cannot proceed for an extended period. This is not a normal wait due to short-term resource avoidance by the dual cores, but may indicate an abnormal risk of storage resource deadlock. Therefore, the current interaction status between the first processing unit and the second processing unit can be determined based on the current interactive running data.

[0086] In some embodiments, the current interaction operation data includes the heartbeat interaction state between the first processing unit and the second processing unit, a global shared flag, and the operation state of the first processing unit. Based on the current interaction operation data, determining the current interaction state between the first processing unit and the second processing unit includes: determining the current interaction state as a waiting state when there is no abnormality in the heartbeat interaction state, a preset flag exists in the global shared flag, and the operation state of the first processing unit is a waiting interception state; wherein, the waiting interception state refers to the state in which the first processing unit stops executing a preset instruction; the waiting state refers to the state in which either the first processing unit or the second processing unit detects that another kernel is accessing the target storage area, suspends its own access instruction, and waits for the other kernel to complete the access operation; determining the current interaction state as a deadlock state when any one of the following conditions is met: there is an abnormality in the heartbeat interaction state, the duration of the preset flag in the global shared flag is greater than or equal to a second preset duration, and the duration of the first processing unit's operation state being in a waiting interception state is greater than or equal to a third preset duration.

[0087] As mentioned above, the heartbeat interaction state between the first processing unit and the second processing unit refers to the state of interactive data formed by the periodic exchange of heartbeat messages between the first processing unit and the second processing unit. The aforementioned abnormal heartbeat interaction state refers to any one of the following situations: packet loss, response timeout, or message verification error in the heartbeat messages sent between the first processing unit and the second processing unit. Conversely, the aforementioned non-abnormal heartbeat interaction state refers to the situation where no packet loss, response timeout, or message verification error occurs in the heartbeat messages sent between the first processing unit and the second processing unit.

[0088] The aforementioned global shared flags contain a preset flag to indicate that the second processing unit is currently accessing the target storage area, that is, the second processing unit is currently in the partition update state (also known as the "partition synchronization" state).

[0089] The aforementioned first processing unit's operating state is a waiting-to-intercept state, which indicates that the first processing unit is currently in a state of stopping the execution of preset instructions, that is, pausing the execution of preset instructions and waiting for the second processing unit to access the target storage area.

[0090] The duration of the preset flag in the aforementioned global shared flag is used to characterize the cumulative duration of the second processing unit's partition synchronization task that has not been completed. Typically, the start time when the global shared flag is set to the preset flag can be recorded, and the current system time can be read in real time. The difference between the current system time and the start time when the preset flag is set can be used as the duration of the preset flag.

[0091] The duration of the waiting interception state of the first processing unit is used to characterize the cumulative waiting time for the first processing unit to continuously suspend the execution of preset instructions. Typically, the start time of the first processing unit switching to the waiting interception state can be recorded, and the current system time can be read in real time. The difference between the current system time and the start time of the first processing unit switching to the waiting interception state can be used as the duration of the waiting interception state.

[0092] The aforementioned waiting state refers to the state in which either the first processing unit or the second processing unit detects that the other kernel is accessing the target storage area, and thus suspends its own access instruction and waits for the other kernel to complete the access operation. The aforementioned deadlock state refers to an abnormal stuck state in which the first processing unit and the second processing unit simultaneously access the target storage area, causing both to be unable to complete the access operation.

[0093] For example, the second preset duration can be set according to the normal existence duration of the preset flag in the global shared flag bit, such as the second preset duration can be set to 180 seconds; the third preset duration can also be set according to the normal duration of the first processing unit in the waiting interception state, such as the second preset duration can be set to 200 seconds.

[0094] Understandably, if there are no abnormalities in the heartbeat interaction state, the global shared flag is preset, and the first processing unit is in the waiting interception state, it indicates that the communication link between the first and second processing units is normal. At this time, the second processing unit is accessing the target storage area, and the first processing unit actively suspends the execution of preset instructions to avoid timing competition caused by dual-core concurrent access to storage resources. That is, the current process is a normal blocking process of dual-core collaborative work, so the current interaction state can be determined to be the waiting state.

[0095] If there is an abnormality in the heartbeat interaction state, it means that the communication link between the first processing unit and the second processing unit has failed, the cores at both ends cannot send and receive interaction messages normally, the dual-core interaction channel cannot maintain normal coordination, and the process cannot resume and advance autonomously. Therefore, the current interaction state can be determined to be a deadlock state. If there is no abnormality in the heartbeat interaction state, but the duration of the preset flag in the global shared flag bit is greater than or equal to the second preset duration, it indicates that the dual-core communication is normal, but the partition synchronization process of the second processing unit is stalled for a long time and the state cannot be automatically switched to the "synchronization completed" state. It is stuck in the "partition synchronization in progress" state, and the business process is stuck and cannot flow on its own. Therefore, the current interaction state can be determined to be a deadlock state. If there are no abnormalities in the heartbeat interaction state, but the duration of the first processing unit's running state in the waiting interception state is greater than or equal to the third preset duration, it indicates that the dual-core communication is normal. The first processing unit has been suspended from executing preset instructions for a long time, continuously waiting for the second processing unit to switch to the "synchronization completed" state, and this has exceeded the reasonable waiting time limit. The upgrade process is continuously blocked without any signs of progress, so it can be determined that the current interaction state is a deadlock state.

[0096] In summary, if any one of the following conditions is met: the heartbeat interaction state is abnormal, the duration of the preset flag in the global shared flag bit is greater than or equal to the second preset duration, or the duration of the first processing unit's running state being in the waiting interception state is greater than or equal to the third preset duration, the current interaction state is determined to be a deadlock state.

[0097] In some embodiments, the aforementioned current interactive running data may also include dual-core resource usage data. If the dual-core resource usage data indicates any of the abnormal situations such as repeated file closure, mutex lock preemption, and partition read / write resource conflict, and the upgrade process still cannot proceed normally after the automatic recovery mechanism is executed, the current interactive state is determined to be a deadlock state.

[0098] It is understandable that the above-mentioned repeated closing of files, mutex lock preemption, and partition read / write resource conflicts are all blocking anomalies caused by resource competition between dual cores. Such resource conflicts will cause a stalemate in which the two cores hold the resources needed by each other and wait for each other to release them. If the upgrade process still cannot proceed after the automatic recovery mechanism intervenes, it means that the resource stalemate cannot be resolved on its own. The two cores continue to block each other and cannot complete subsequent interaction and upgrade actions. Therefore, the current interaction state is determined to be a deadlock state.

[0099] The above method can accurately identify waiting and deadlock states based on three parameters: the heartbeat interaction status between the first and second processing units, the global shared flag, and the running status of the first processing unit. This avoids misjudgments caused by a single parameter, and can quickly identify abnormal blocking scenarios where kernel resources are stuck and cannot be resolved on their own. This allows for timely reporting of deadlock faults, facilitating the subsequent startup of recovery and handling mechanisms, and improving the reliability of dual-core interaction process management.

[0100] Step 203: If the current interaction state is deadlocked, execute the corresponding fault reset operation according to the cause of the deadlock.

[0101] The reasons for triggering the deadlock state mentioned above may include, but are not limited to: the first processing unit encountering an anomaly when accessing the target storage area (e.g., dynamic configuration execution error, failure to release occupied shared resources) and the second processing unit encountering an anomaly when accessing the target storage area (e.g., partition switching deadlock, long-term holding of partition read and write permissions), specifically manifested as resource contention failures such as mutex lock preemption, partition read and write resource conflict, repeated file closure, and dual-core loop waiting for the other to release shared storage resources.

[0102] The aforementioned fault reset operation refers to the fault recovery method of specifically calling the corresponding module reset interface or restarting the faulty side service process based on the triggering cause of the deadlock state.

[0103] In some embodiments, a corresponding fault reset operation is performed according to the cause of the deadlock state, including: performing a corresponding first fault reset operation on the first processing unit when the cause of the deadlock state is an abnormality occurring when the first processing unit accesses the target storage area; and performing a corresponding second fault reset operation on the second processing unit when the cause of the deadlock state is an abnormality occurring when the second processing unit accesses the target storage area.

[0104] Specifically, exceptions that occur when the first processing unit accesses the target storage area usually happen during the upgrade or dynamic configuration of business logic by the first processing unit. For example, the exception may be caused by an error in the dynamic configuration execution of the first processing unit, failure to properly release the mutex lock after preemption, repeated closing of the partition file handle, or long-term occupation of partition read and write permissions without release, which causes the kernel of the second processing unit to be continuously blocked and waiting.

[0105] The first fault reset operation corresponding to the first processing unit may be to call the reset interface built into the upgrade module of the first processing unit, restart the upgrade service process inside the first processing unit, automatically release the shared partition permissions, mutex locks and file resources held by the first processing unit, and reset the waiting interception state of the first processing unit.

[0106] The anomalies generated by the second processing unit accessing the target storage area usually occur during the partition management and partition switching business execution phase. For example, it may be that the partition switching is stuck, the mutex lock is not released, the partition read and write timing conflict occurs, or the shared partition resources are locked for a long time without being released, causing the first processing unit to continuously wait for resources and generate anomalies.

[0107] The second fault reset operation corresponding to the second processing unit can be to call the reset interface of the second processing unit partition management module or restart the partition-related service process of the second processing unit to release all shared storage and lock resources occupied by the second processing unit.

[0108] Furthermore, the first fault reset operation and the second fault reset operation described above can be soft reset operations.

[0109] The aforementioned soft reset operation refers to the operating system or underlying firmware only reinitializing the functional module corresponding to the fault, while the other normally operating services and business modules in the system continue to run, without affecting other running services or unrelated modules.

[0110] For example, if an anomaly occurs when the first processing unit accesses the target storage area, only the upgrade process of the first processing unit is reset and the shared partition and mutex lock held by the first processing unit are released. The partition management and other background services of the second processing unit are completely unaffected. Similarly, if an anomaly occurs when the second processing unit accesses the target storage area, only the partition management module of the second processing unit is soft-reset. All kinds of services of the first processing unit continue to run normally.

[0111] The above method executes a first fault reset operation corresponding to the first processing unit when the first processing unit accesses the target storage area abnormally, and executes a second fault reset operation corresponding to the second processing unit when the second processing unit accesses the target storage area abnormally. The fault reset operation is only performed on the functional module corresponding to the faulty kernel, without the need to perform a whole machine restart. It can quickly release the mutex locks, shared partitions and other resources occupied by the abnormal kernel, realize rapid recovery of fault scenarios, significantly shorten the recovery time after the TBOX OTA upgrade process is stuck and fails, reduce the business interruption caused by large-scale restarts, and effectively improve the operational stability of TBOX in OTA upgrade scenarios.

[0112] Furthermore, during the upgrade process of TBOX, frequent access to the dynamic configuration file may be required. However, accessing the dynamic configuration file typically carries two risks: firstly, the file pointer may become invalid, easily triggering memory overflow and program crashes; secondly, in multi-threaded concurrent upgrade scenarios, accessing the dynamic configuration file when the thread is in an abnormal state such as suspension, interruption, or resource preemption can easily lead to configuration errors, upgrade package parsing failures, or even failure of the entire machine OTA upgrade. Based on this, this embodiment of the application can set up a dual verification mechanism of "file pointer + thread running state," simultaneously checking the validity of the file pointer and the current thread state before accessing the dynamic configuration file.

[0113] In some embodiments, during the upgrade operation of TBOX, the method further includes: upon receiving an access instruction from the first processing unit or the second processing unit to a shared configuration file in the target storage area, obtaining the validity of the file pointer corresponding to the shared configuration file and obtaining the current thread state of the upgrade thread currently performing the access operation; if the file pointer is valid and the current thread state is not abnormal, then access to the shared configuration file is allowed; if the file pointer is invalid or the current thread state is abnormal, then access to the shared configuration file is prohibited.

[0114] For example, when the second processing unit completes the cloud OTA firmware download, synchronizes the upgrade version information, reports the upgrade progress, and updates the firmware verification parameters, or when the first processing unit collects the vehicle hardware status, synchronizes the underlying adaptation parameters, marks the upgrade as complete or failed, and triggers the upgrade reset flag, the two will respectively generate and send an access request for the shared configuration file in the target storage area. At this time, the TBOX can receive the shared configuration file access instruction sent by the first processing unit or the second processing unit.

[0115] The shared configuration file is stored in the target storage area of ​​TBOX and can be accessed by the first processing unit, the second processing unit, and each upgrade thread. The shared configuration file records dynamic configuration parameters such as OTA upgrade partition parameters, upgrade progress, and firmware verification information, and can also be called a "dynamic configuration file".

[0116] The file pointer corresponding to the aforementioned shared configuration file refers to the file operation pointer allocated by the TBOX operating system for accessing the shared configuration file after the upgrade thread currently performing the access operation opens the shared configuration file in the target storage area.

[0117] The validity of the file pointers mentioned above describes the legal and available status of file operation pointers bound to the shared configuration file, which can generally be divided into two states: valid and invalid.

[0118] For example, a file pointer is considered valid when it is not null, the file resource is not closed or released, the pointer is not tampered with, and the shared configuration file exists; a file pointer is considered invalid when any of the following conditions exist: the file pointer is null, the file resource has been released, the pointer has been illegally tampered with, or the shared configuration file is abnormal or missing.

[0119] Furthermore, the upgrade thread currently performing the access operation refers to the software scheduling task in TBOX that uniformly processes access instructions for the shared configuration file issued by the first and second processing units. Typically, the thread status query interface provided by TBOX can be called to obtain the thread scheduling running status, mutex lock occupancy, and interrupt reception flag corresponding to the upgrade thread, and the current thread state of the upgrade thread can be determined based on these parameters.

[0120] For example, if the thread scheduling running state is ready running state, the mutex lock occupancy status indicates that the relevant mutex lock of the target storage area is not occupied and there is no interruption receiving flag, then it is determined that the current thread state of the upgrade thread is normal (i.e. there is no abnormality); if the thread scheduling running state is suspended or blocked state, the mutex lock occupancy status indicates that any one of the following three situations exists: mutex lock resource preemption conflict and interruption receiving flag exists, then it is determined that the current thread state of the upgrade thread is abnormal.

[0121] Understandably, if it is confirmed that the file operation pointer bound to the shared configuration file is valid, and it is confirmed that there is no exception in the upgrade thread currently performing the access operation, it means that the file operation credentials are legitimate and usable, there is no risk of thread resource preemption or execution blocking, and the read and write operations will not cause program crashes or data corruption. Therefore, access to the shared configuration file is currently allowed. If it is determined that the file operation pointer bound to the shared configuration file is invalid, or that the upgrade thread currently performing the access operation is abnormal, it indicates that direct read and write operations are very likely to cause null pointer failures, read / write freezes, multi-threaded concurrent modification of configuration data, and other abnormal situations, which may lead to the failure of the entire machine OTA upgrade. Therefore, access to the shared configuration file is currently prohibited.

[0122] The above method effectively avoids problems such as program crashes, configuration errors, and upgrade failures when accessing the configuration file is allowed by double-checking the validity of the file pointer corresponding to the shared configuration file and the thread state of the upgrade thread. This is achieved by double-checking the validity of the file pointer corresponding to the shared configuration file and the thread state of the upgrade thread before determining whether access to the configuration file is allowed. As a result, it effectively ensures the data integrity during the TBOX upgrade process and the security of file operations in a multi-threaded environment, thereby improving the stability of the TBOX upgrade process.

[0123] Figure 3 This is a schematic diagram of the structure of an equipment upgrade device provided in an embodiment of this application.

[0124] For example, such as Figure 3 As shown, the device is applied to a vehicle-mounted remote communication terminal, which includes a first processing unit and a second processing unit. The device 300 includes: The detection module 301 is used to detect whether a preset flag exists in the global shared flag bit when the first processing unit has received a preset instruction during the upgrade operation of the vehicle-mounted remote communication terminal.

[0125] Among them, the preset instruction is used to trigger the first processing unit to access the target storage area; the preset flag is used to indicate that the second processing unit is currently accessing the target storage area; and the global shared flag is used to share the running status of the second processing unit with the first processing unit.

[0126] The control module 302 is used to control the first processing unit to stop executing the preset instruction when a preset flag is detected in the global shared flag bit, until the preset flag is no longer present in the global shared flag bit.

[0127] Optionally, during the upgrade operation of the vehicle-mounted remote communication terminal, the device also includes a writing module, which is specifically used to: write a preset flag into a globally shared flag bit when it is detected that the second processing unit is currently accessing the target storage area.

[0128] Optionally, during the upgrade operation of the vehicle-mounted remote communication terminal, the device further includes an execution module, which is specifically used to: acquire the current interactive operation data between the first processing unit and the second processing unit; determine the current interactive state between the first processing unit and the second processing unit based on the current interactive operation data; and, if the current interactive state is a deadlock state, execute the corresponding fault reset operation according to the triggering cause of the deadlock state; wherein, the deadlock state refers to an abnormal stuck state in which the first processing unit and the second processing unit simultaneously access the target storage area, causing both to be unable to complete the access operation.

[0129] In some embodiments, the execution module includes a determining unit, which is specifically configured to: obtain the duration of the upgrade process stall when the vehicle-mounted remote communication terminal performs an upgrade operation; and determine the current interaction state between the first processing unit and the second processing unit based on the current interaction operation data when the upgrade process stall duration is greater than or equal to a first preset duration.

[0130] In some embodiments, the current interactive operation data includes the heartbeat interaction state between the first processing unit and the second processing unit, a global shared flag, and the operating state of the first processing unit. The determining unit is further specifically configured to: determine the current interaction state as a waiting state when there is no abnormality in the heartbeat interaction state, a preset flag exists in the global shared flag, and the operating state of the first processing unit is a waiting interception state; wherein, the waiting interception state refers to the state in which the first processing unit stops executing a preset instruction; the waiting state refers to the state in which either the first processing unit or the second processing unit detects that another kernel is accessing the target storage area, suspends its own access instruction, and waits for the other kernel to complete the access operation; and determine the current interaction state as a deadlock state when any one of the following conditions is met: there is an abnormality in the heartbeat interaction state, the duration of the preset flag in the global shared flag is greater than or equal to a second preset duration, and the duration of the first processing unit's operating state being in a waiting interception state is greater than or equal to a third preset duration.

[0131] In some embodiments, the execution module includes an execution unit, which is specifically configured to: perform a corresponding first fault reset operation on the first processing unit when the cause of the deadlock is an abnormality occurring when the first processing unit accesses the target storage area; and perform a corresponding second fault reset operation on the second processing unit when the cause of the deadlock is an abnormality occurring when the second processing unit accesses the target storage area.

[0132] Optionally, the device further includes an access module, which is specifically used to: upon receiving an access instruction from the first processing unit or the second processing unit for a shared configuration file in the target storage area, obtain the validity of the file pointer corresponding to the shared configuration file and obtain the current thread state of the upgrade thread currently performing the access operation; if the file pointer is valid and the current thread state is not abnormal, then access to the shared configuration file is allowed; if the file pointer is invalid or the current thread state is abnormal, then access to the shared configuration file is prohibited.

[0133] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0134] For example, such as Figure 4 As shown, the electronic device 400 includes a memory 401 and a processor 402, wherein the memory 401 stores executable program code 4011, and the processor 402 is used to call and execute the executable program code 4011 to perform a device upgrade method.

[0135] Furthermore, embodiments of this application also protect an apparatus that may include a memory and a processor, wherein the memory stores executable program code, and the processor is used to call and execute the executable program code to perform a device upgrade method provided in embodiments of this application.

[0136] This embodiment can divide the device into functional modules based on the above method example. For example, each module can correspond to a separate function, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware. It should be noted that the module division in this embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0137] When each functional module is divided according to its corresponding function, the device may also include a detection module and a control module. It should be noted that all relevant content regarding the steps involved in the above method embodiments can be referenced from the functional descriptions of the corresponding functional modules, and will not be repeated here.

[0138] It should be understood that the apparatus provided in this embodiment is used to perform the above-described device upgrade method, and therefore can achieve the same effect as the above-described implementation method.

[0139] When using integrated units, the device may include a processing module and a storage module. When applied to an electronic device, the processing module can be used to control and manage the device's operations. The storage module can be used to support the electronic device in executing relevant program code and data.

[0140] The processing module may be a processor or a controller, which can implement or execute various exemplary logic blocks, modules, and circuits shown in conjunction with the disclosure of this application. The processor may also be a combination of functions that implement computing capabilities, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc., and the storage module may be a memory.

[0141] In addition, the device provided in the embodiments of this application may specifically be a chip, component or module. The chip may include a connected processor and a memory. The memory is used to store instructions. When the processor calls and executes the instructions, the chip can execute a device upgrade method provided in the above embodiments.

[0142] This embodiment also provides a vehicle that includes electronic equipment for performing a device upgrade method provided in the above embodiments.

[0143] This embodiment also provides a computer-readable storage medium storing computer program code. When the computer program code is run on a computer, the computer executes the aforementioned method steps to implement a device upgrade method provided in the above embodiment.

[0144] This embodiment also provides a computer program product that, when run on a computer, causes the computer to perform the aforementioned steps to implement a device upgrade method provided in the above embodiment.

[0145] In this embodiment, the device, computer-readable storage medium, computer program product, or chip are all used to execute the corresponding methods provided above. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0146] Through the above description of the embodiments, those skilled in the art will understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0147] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0148] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for upgrading equipment, characterized in that, The method is applied to an in-vehicle remote communication terminal, the in-vehicle remote communication terminal including a first processing unit and a second processing unit, the method including: During the upgrade operation of the vehicle-mounted remote communication terminal, if it is determined that the first processing unit has received a preset instruction, the presence of a preset flag in the global shared flag is checked; wherein, the preset instruction is used to trigger the first processing unit to access the target storage area; the preset flag is used to indicate that the second processing unit is currently accessing the target storage area; and the global shared flag is used to share the operating status of the second processing unit with the first processing unit. If the preset flag is detected in the global shared flag, the first processing unit is controlled to stop executing the preset instruction until the preset flag is no longer present in the global shared flag.

2. The method according to claim 1, characterized in that, During the upgrade process of the vehicle-mounted remote communication terminal, the method further includes: If the second processing unit is detected to be currently accessing the target storage area, the preset flag is written into the global shared flag.

3. The method according to claim 1, characterized in that, During the upgrade process of the vehicle-mounted remote communication terminal, the method further includes: Obtain the current interaction data between the first processing unit and the second processing unit; Based on the current interactive operation data, the current interaction state between the first processing unit and the second processing unit is determined; If the current interaction state is a deadlock state, a corresponding fault reset operation is performed according to the triggering cause of the deadlock state; wherein, the deadlock state refers to an abnormal stuck state in which the first processing unit and the second processing unit simultaneously access the target storage area, causing both to be unable to complete the access operation.

4. The method according to claim 3, characterized in that, Determining the current interaction state between the first processing unit and the second processing unit based on the current interaction operation data includes: The duration of the upgrade process pause when the vehicle-mounted remote communication terminal performs an upgrade operation is obtained. If the upgrade process stalls for a duration greater than or equal to a first preset duration, the current interaction state between the first processing unit and the second processing unit is determined based on the current interaction running data.

5. The method according to claim 3 or 4, characterized in that, The current interactive operation data includes the heartbeat interaction status between the first processing unit and the second processing unit, a globally shared flag, and the operating status of the first processing unit; determining the current interaction status between the first processing unit and the second processing unit based on the current interactive operation data includes: If there is no abnormality in the heartbeat interaction state, the preset flag is present in the global shared flag, and the running state of the first processing unit is in the waiting interception state, the current interaction state is determined to be a waiting state; wherein, the waiting interception state refers to the state in which the first processing unit stops executing the preset instruction; the waiting state refers to the state in which either the first processing unit or the second processing unit detects that another kernel is accessing the target storage area, and suspends its own access instruction and waits for the other kernel to complete the access operation; If any one of the following conditions is met: the heartbeat interaction state is abnormal, the duration of the preset flag in the global shared flag bit is greater than or equal to the second preset duration, and the duration of the first processing unit's running state being in the waiting interception state is greater than or equal to the third preset duration, the current interaction state is determined to be a deadlock state.

6. The method according to claim 3, characterized in that, The step of performing a corresponding fault reset operation based on the triggering cause of the deadlock state includes: If the deadlock state is triggered by an anomaly occurring when the first processing unit accesses the target storage area, a corresponding first fault reset operation is performed on the first processing unit. If the deadlock state is triggered by an anomaly occurring when the second processing unit accesses the target storage area, a corresponding second fault reset operation is performed on the second processing unit.

7. The method according to claim 1, characterized in that, During the upgrade process of the vehicle-mounted remote communication terminal, the method further includes: Upon receiving an access instruction from the first processing unit or the second processing unit for a shared configuration file in the target storage area, the validity of the file pointer corresponding to the shared configuration file is obtained, and the current thread state of the upgrade thread currently performing the access operation is obtained. If the file pointer is valid and the current thread state is not abnormal, then access to the shared configuration file is permitted; If the file pointer becomes invalid or the current thread state is abnormal, access to the shared configuration file is prohibited.

8. An equipment upgrade device, characterized in that, The device is applied to a vehicle-mounted remote communication terminal, the vehicle-mounted remote communication terminal including a first processing unit and a second processing unit, the device comprising: The detection module is used to detect whether a preset flag exists in the global shared flag bit when the first processing unit receives a preset instruction during the upgrade operation of the vehicle-mounted remote communication terminal. The preset instruction is used to trigger the first processing unit to access the target storage area. The preset flag is used to indicate that the second processing unit is currently accessing the target storage area. The global shared flag bit is used to share the running status of the second processing unit with the first processing unit. The control module is configured to control the first processing unit to stop executing the preset instruction when the preset flag is detected in the global shared flag bit, until the preset flag is no longer present in the global shared flag bit.

9. An electronic device, characterized in that, The electronic device includes: Memory, used to store executable program code; A processor for calling and running the executable program code from the memory, causing the electronic device to perform the method as described in any one of claims 1 to 7.

10. A vehicle, characterized in that, The vehicle includes electronic equipment for performing the method as described in any one of claims 1 to 7.

Images