Intelligent breakpoint resuming method based on multi-level check state context in boot loader

Abstract

The application discloses a multi-level check state context-based intelligent breakpoint resume method in a BootLoader, and belongs to the technical field of embedded firmware upgrading. In view of the problems of state atomicity loss and CRC check deadlock in the existing single progress pointer scheme, the application divides a pre-write snapshot storage area and a post-write snapshot storage area in a non-volatile memory, and defines a unified snapshot structure body; a pre-write snapshot is saved before performing a Flash write operation, a post-write snapshot is saved after the write operation is successful, and then metadata is persisted; after system abnormal reset, the two snapshots are read and integrity check is performed, five types of interruption scenes are determined based on validity combination, and corresponding recovery logic is matched. The application ensures the consistency of physical data and logical state and the accurate reconstruction of a CRC reference value through a double snapshot mechanism, realizes intelligent breakpoint resume, significantly improves firmware upgrading reliability, and is not dependent on additional hardware and has strong universality.

Description

Technical Field

[0001] This invention relates to the field of embedded firmware upgrade technology, specifically to an intelligent breakpoint resume method in BootLoader based on multi-level verification state context. Background Technology

[0002] During online firmware upgrades of embedded devices, the upgrade process may be unexpectedly interrupted at any time due to abnormal situations such as vehicle power fluctuations, communication interruptions, and system resets. Power-off resume technology, as a key technology to improve the reliability of firmware upgrades, widely adopts an incremental recovery strategy. That is, during the upgrade process, the progress status of "successfully received and correctly written to Flash" is reliably recorded so as to resume from the interruption point, avoiding the retransmission of completed data from the beginning, thereby saving communication bandwidth and time and improving the success rate of the upgrade.

[0003] Currently, the mainstream power-off resume download solution in the industry adopts a single progress pointer status marking method. During firmware upgrades, this solution persistently saves the latest progress pointer to non-volatile memory after each successfully received data block and completed Flash writing. If the upgrade is interrupted for any reason, and the system resets and re-enters BootLoader mode, the system reads this pointer and resumes downloading from the point of interruption, thus achieving the basic function of power-off resume download.

[0004] However, this single-progress pointer scheme has significant technical drawbacks: Flash data writing and status flag persistence are two independent physical operations that cannot guarantee atomicity. If the device loses power within the time window when "data blocks have been written to Flash" but "the progress pointer has not been updated", the system will fall into a state contradiction after recovery: physically the data exists, but logically the system believes that the data has not been written. Since the full CRC checksum is calculated based on the sequential accumulation of the data stream, if the system resumes and retransmits the data block from the time of the power outage, the system will recalculate the CRC value of that data block. If the data block is not retransmitted, the data block will be skipped, resulting in an incorrect CRC base value. Ultimately, this will inevitably lead to firmware integrity verification failure and cause an upgrade deadlock.

[0005] To address the aforementioned issues, while existing solutions include adding energy storage capacitors or employing dual-bank Flash hardware redundancy, these significantly increase hardware costs and circuit complexity. Therefore, this application proposes a method that addresses the aforementioned state inconsistency problem at a low cost and with high robustness at the software algorithm logic level. Summary of the Invention

[0006] The purpose of this invention is to provide an intelligent breakpoint resume method in BootLoader based on multi-level verification state context.

[0007] The technical problem solved by this invention is as follows: In the existing BootLoader firmware upgrade interruption point resumption scheme, the single progress pointer status marking method cannot guarantee atomicity between Flash data writing and status mark persistence, which leads to the system falling into the contradiction of inconsistent physical data and logical state after abnormal power failure recovery; at the same time, because the full CRC check value is calculated based on the sequential accumulation of data stream, the CRC recalculation problem of the written data block cannot be accurately handled when the interruption point is resumed, which ultimately leads to firmware integrity verification failure and upgrade deadlock.

[0008] This invention can be achieved through the following technical solution: an intelligent breakpoint resumption method based on multi-level verification state context in BootLoader, comprising the following steps: Step 1: Divide the non-volatile memory into a pre-write snapshot storage area and a post-write snapshot storage area, and define a unified snapshot storage structure; Step 2: For any data block to be written, save the corresponding pre-write snapshot and post-write snapshot before performing the Flash write operation and after the Flash write is successful, respectively, and then persist the metadata to the non-volatile storage area. Step 3: When the system is restarted after an abnormal reset and enters the BootLoader, the first step is to perform a context integrity check. If the check is successful, the validity of the snapshot information is checked. Based on the combination of the validity of the two snapshot information scenarios, the corresponding recovery logic is matched to resume the interrupted download.

[0009] A further improvement of the present invention is that the snapshot unified storage structure includes at least a magic number identifier, the current data block number, the number of bytes received, and the total CRC cumulative value, and calculates the CRC-16 check value of the snapshot itself and adds it to the end of the structure.

[0010] A further improvement of the present invention is that when the pre-write snapshot and the post-write snapshot are saved to the corresponding snapshot storage area, the previously saved snapshot information in the same storage area is overwritten each time new snapshot information is written.

[0011] A further improvement of the present invention is that the context integrity verification process in step three is as follows: read the context data stored in Flash, recalculate the full CRC cumulative value of the global data, and compare it with the full CRC cumulative value recorded in the two snapshot information. If the full CRC cumulative value in at least one snapshot information is consistent, the context integrity verification is determined to be successful; otherwise, the verification is determined to be unsuccessful.

[0012] A further improvement of the present invention is that the snapshot information validity verification process in step three is as follows: Recalculate the CRC-16 of the snapshot information structure itself. If the calculated value is not consistent with the CRC-16 checksum of the snapshot itself stored in the structure, the corresponding snapshot information is deemed to be corrupted and invalid; otherwise, it is valid. The magic number identifier in the snapshot information is checked for consistency with the custom magic number identifier stored in the host computer. If the magic numbers do not match, the corresponding snapshot information is determined to be invalid; otherwise, it is valid.

[0013] A further improvement of this invention is that it executes corresponding recovery logic based on the combination of validity scenarios of the two snapshots: If both the pre-write snapshot and the post-write snapshot are valid and the number of bytes received in both are equal, then it is determined that the transmission was interrupted before the Nth data block was written, and the request to resume transmission will start again from the data block number N. If both the pre-write snapshot and the post-write snapshot are valid, and the number of bytes received by the two snapshots are not equal, it is determined that the Nth data block has been written but the metadata has not been updated. The status information of the pre-write snapshot is used to start requesting a resume transmission from the data block number N. If only the pre-write snapshot is valid, it is determined that the writing of the Nth data block was interrupted. The status information of the pre-write snapshot is used to restart the request for resuming the transmission from the data block number N. If only the post-write snapshot is valid, it is determined that the writing of the Nth data block and the metadata update are completed, but the context saving is interrupted. The status information of the post-write snapshot is used to request the resumption of transmission starting from the data block number N+1. If both snapshots are invalid, a security degradation strategy is implemented, and the entire data is transferred from the beginning.

[0014] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention introduces a dual snapshot mechanism—pre-write snapshot and post-write snapshot—to save system state snapshots before and after data is written to Flash, forming a complete state context. Even if a power outage occurs in a critical state where data writing is complete but metadata has not been updated, the system can accurately determine the actual state through snapshot comparison, fundamentally solving the atomicity problem and ensuring the consistency between physical data and logical state.

[0015] 2. This invention, by using the full CRC cumulative value saved in the snapshot, can accurately reconstruct the initial state of the CRC accumulator during system recovery. Regardless of whether the interruption occurs before, during, or after data writing, the system can determine the correct CRC baseline value based on the snapshot information, avoiding verification errors caused by duplicate or missed calculations, and fundamentally eliminating the possibility of escalation deadlock.

[0016] 3. Based on the effective combination of pre-write and post-write snapshots, this invention can accurately identify five different interruption scenarios: both snapshots are valid and have the same number of bytes; both snapshots are valid but have different number of bytes; only the pre-write snapshot is valid; only the post-write snapshot is valid; and both snapshots are invalid. For each scenario, the system executes the corresponding optimal recovery logic, significantly improving the accuracy and efficiency of breakpoint resume transmission. Through the intelligent breakpoint resume transmission mechanism, even in harsh environments with frequent power outages, the system can ensure the continuity and integrity of the upgrade process, greatly improving the success rate of firmware upgrades. At the same time, it avoids unnecessary duplicate transmissions, saves communication bandwidth and upgrade time, and improves the user experience.

[0017] 4. The method of this invention does not depend on a specific hardware platform or communication protocol and can be widely applied to firmware upgrade scenarios for various embedded devices. The snapshot structure design has good scalability, and other status fields can be added according to actual needs to adapt to different application scenarios. Attached Figure Description

[0018] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0019] Figure 1 This is a flowchart illustrating the method execution of the present invention. Detailed Implementation

[0020] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided.

[0021] Please see Figure 1 As shown, the intelligent breakpoint resumption method in BootLoader based on multi-level verification state context includes the following steps: Step 1: Storage Configuration and Data Definition The non-volatile memory will be independently divided into two sectors of equal size, which will be used as the pre-write snapshot storage area and the post-write snapshot storage area, respectively. Define a snapshot unified storage structure, which should include at least the following fields: Custom magic number identifier; Current data block number; Number of bytes received; Total CRC cumulative value.

[0022] Calculate the CRC-16 checksum of the snapshot itself and append it to the end of the snapshot data.

[0023] Step 2: Single Data Block Timing Processing Stage For any numbered data block, assuming the number is N: S21. Save snapshot before writing Before writing the Nth data block to Flash, the snapshot information at the current moment is completely saved to the pre-write snapshot storage area.

[0024] The snapshot records: the magic number identifier, the current data block number N, the number of bytes received up to now (i.e., the cumulative value of the first N-1 blocks), the cumulative CRC value of the full data up to now (i.e., the cumulative CRC value of the first N-1 blocks), and the snapshot's own CRC-16 checksum. S22, Data block write operation Write the Nth data block to Flash. After writing is complete, check the Flash operation status flag to confirm that the writing was successful. S23. Save snapshot after writing After the Nth data block is successfully written to Flash, and before metadata such as the global CRC cumulative value and progress pointer are persisted, the snapshot information at the current moment is saved to the post-write snapshot storage area.

[0025] The snapshot records: the magic number identifier, the current data block number N, the updated number of bytes received (including the Nth block), the updated total CRC cumulative value (including the contribution value of the Nth block), and the snapshot's own CRC-16 checksum.

[0026] It should be noted that after the latest snapshot information is written, the previous snapshot information will be overwritten to save storage space.

[0027] S24. Metadata Persistence Persist metadata such as progress pointers and full CRC cumulative values ​​to non-volatile storage.

[0028] Step 3: Recovery Decision-Making Phase After System Abnormal Reset Upon power-up, the device automatically enters the BootLoader and executes the breakpoint recovery process, including: S31. Read context data and perform integrity verification. Perform CRC check on the entire data block stored in Flash and recalculate the total CRC cumulative value. Read the pre-write snapshot information and post-write snapshot information from the current non-volatile memory respectively, and compare the calculated value with the full CRC cumulative value recorded in the two snapshot information. If the calculated value matches the full CRC cumulative value of at least one of the two snapshot information, the verification is considered successful, and the subsequent snapshot information validity judgment operation is performed; otherwise, the verification is considered to have failed, the context data is considered to be corrupted, and a safe rollback strategy is executed, that is, the context data is cleared and the upgrade starts from scratch.

[0029] S32. Validity determination of snapshot information Recalculate the CRC-16 of the snapshot information structure itself. If the calculated value is not consistent with the CRC-16 checksum of the snapshot itself stored in the structure, the corresponding snapshot information is deemed to be corrupted and invalid; otherwise, it is valid.

[0030] At the same time, the magic number identifier in the snapshot information is checked for consistency with the custom magic number identifier stored in the host computer. If the magic number does not match, the corresponding snapshot information is directly determined to be invalid; otherwise, it is valid. S33. Recovery strategy based on snapshot information validity combination matching Based on the verification results of the two snapshots, five specific interruption scenarios are identified, each with its own independent recovery logic: If both pre-write and post-write snapshots are valid Compare whether the "Number of bytes received" field in the two snapshot messages is equal: If they are equal, it is determined that the last upgrade was interrupted before the Nth data block was written to Flash. The system uses the number of bytes in the pre-write snapshot and the cumulative CRC value as the base to restore the CRC accumulator, and re-requests and writes the Nth data block from the data block number N. If they are not equal, it is determined that the Nth data block has been successfully written to Flash, but the metadata in the post-write snapshot has not been updated. The system uses the pre-write snapshot to restore the state and re-requests the transmission from the data block number N.

[0031] If only the write-before snapshot is valid At this point, it is determined that the system was interrupted during the last write of the Nth data block. The system restores the state using a pre-write snapshot and re-requests the continuation of the transmission from the data block number N.

[0032] If only post-write snapshots are valid At this point, it is determined that the writing of the Nth data block and the update of metadata were completed before the power outage, but the process was interrupted when saving the overall context data. In this case, a post-write snapshot is used to restore the state, and the transmission is resumed from the N+1th data block.

[0033] If both snapshots are invalid At this point, there is no valid recovery status information. It may be due to the initial drive or the data in the non-volatile memory being corrupted. The security degradation strategy is executed directly, and the full data transfer is started from the beginning.

[0034] Explanation of relevant technical terms: 1. Atomicity operation: An indivisible operation that either completes entirely or does not complete entirely, with no intermediate state.

[0035] 2. Non-volatile RAM (NVRAM): Memory that does not lose data after power failure, such as Flash and EEPROM.

[0036] 3. CRC (Cyclic Redundancy Check): An algorithm that generates a short checksum based on the data content, used to detect whether errors have occurred in the data during storage or transmission.

[0037] 4. Bootloader: The first program executed when the system starts up. It is responsible for initializing the hardware and guiding the main program. It is also often responsible for firmware upgrades.

[0038] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A smart breakpoint resumption method based on multi-level verification state context in BootLoader, characterized by: Includes the following steps: Step 1: Divide the non-volatile memory into a pre-write snapshot storage area and a post-write snapshot storage area, and define a unified snapshot storage structure; Step 2: For any data block to be written, save the corresponding pre-write snapshot and post-write snapshot before performing the Flash write operation and after the Flash write is successful, respectively, and then persist the metadata to the non-volatile storage area. Step 3: When the system is restarted after an abnormal reset and enters the BootLoader, the first step is to perform a context integrity check. If the check is successful, the validity of the snapshot information is checked. Based on the combination of the validity of the two snapshot information scenarios, the corresponding recovery logic is matched to resume the interrupted download.

2. The intelligent breakpoint resumption method based on multi-level verification state context in the BootLoader according to claim 1, characterized in that, The snapshot unified storage structure includes at least a magic number identifier, the current data block number, the number of bytes received, and the total CRC cumulative value. The snapshot's own CRC-16 check value is calculated and added to the end of the structure.

3. The intelligent breakpoint resumption method based on multi-level verification state context in the BootLoader according to claim 1, characterized in that, When the pre-write snapshot and the post-write snapshot are saved to the corresponding snapshot storage area, the previously saved snapshot information in the same storage area is overwritten each time new snapshot information is written.

4. The intelligent breakpoint resumption method based on multi-level verification state context in the BootLoader according to claim 2, characterized in that, The context integrity verification process in step three is as follows: read the context data stored in Flash, recalculate the total CRC cumulative value of the global data, and compare it with the total CRC cumulative value recorded in the two snapshot information. If the total CRC cumulative value in at least one snapshot information is consistent, the context integrity verification is considered successful; otherwise, the verification is considered to have failed.

5. The intelligent breakpoint resumption method based on multi-level verification state context in the BootLoader according to claim 2, characterized in that, The snapshot information validity verification process in step three is as follows: Recalculate the CRC-16 of the snapshot information structure itself. If the calculated value is not consistent with the CRC-16 checksum of the snapshot itself stored in the structure, the corresponding snapshot information is deemed to be corrupted and invalid; otherwise, it is valid. The magic number identifier in the snapshot information is checked for consistency with the custom magic number identifier stored in the host computer. If the magic numbers do not match, the corresponding snapshot information is determined to be invalid; otherwise, it is valid.

6. The intelligent breakpoint resumption method based on multi-level verification state context in the BootLoader according to claim 2, characterized in that, Based on the combination of validity scenarios of the two snapshots, execute the corresponding recovery logic: If both the pre-write snapshot and the post-write snapshot are valid and the number of bytes received in both are equal, then it is determined that the transmission was interrupted before the Nth data block was written, and the request to resume transmission will start again from the data block number N. If both the pre-write snapshot and the post-write snapshot are valid, and the number of bytes received by the two snapshots are not equal, it is determined that the Nth data block has been written but the metadata has not been updated. The status information of the pre-write snapshot is used to start requesting a resume transmission from the data block number N. If only the pre-write snapshot is valid, it is determined that the writing of the Nth data block was interrupted. The status information of the pre-write snapshot is used to restart the request for resuming the transmission from the data block number N. If only the post-write snapshot is valid, it is determined that the writing of the Nth data block and the metadata update are completed, but the context saving is interrupted. The status information of the post-write snapshot is used to request the resumption of transmission starting from the data block number N+1. If both snapshots are invalid, a security degradation strategy is implemented, and the entire data is transferred from the beginning.

Images