An intelligent toy OTA upgrading method and system based on an SDNAND chip

Abstract

The application relates to the technical field of firmware updating, and discloses an intelligent toy OTA (Over-the-Air) upgrading method and system based on an SDNAND chip, which comprises the following steps: storing initial updating data in a physical isolation buffer area in blocks to obtain to-be-verified updating data; extracting an authorized signature feature and a self-digestion feature to perform consistency authentication; when the authentication fails, generating a credential interception signal; according to the credential interception signal, extracting a target physical address and a data span parameter, resetting memory area access permission, and forming a hardware channel blocking state; according to the hardware channel blocking state, generating a bottom block erasing instruction, and performing forced erasing on the physical isolation buffer area to obtain an emptied safe area; and according to system boot configuration parameters and a memory mapping table, resetting a register environment of a bottom hardware device to obtain a safe running state of the toy device. The method can reduce the risk of illegal updating data polluting a core running area.

Description

Technical Field

[0001] This invention relates to the field of firmware update technology, and in particular to an OTA upgrade method and system for smart toys based on SDNAND chips. Background Technology

[0002] Currently, with the increasing complexity of interactive functions, remote online upgrades (OTA) for smart toys have become a crucial link in maintaining device firmware iteration and patching underlying security vulnerabilities. At the hardware architecture level, such devices typically use a highly integrated SOC chip as the main processing unit, coupled with SDNAND storage media with standard digital security features to store system images and business data.

[0003] In a current technology, some basic single-partition storage architectures, when performing OTA upgrades, typically receive firmware update packages from external sources through the main processing unit. After performing routine software application-level signature verification in the shared processing area of ​​memory, they directly control the data bus to burn the instruction data of the update package into the runtime storage area of ​​the main program, thereby completing the overwriting and replacement of the old version data. However, this traditional update mechanism relies excessively on the verification logic at the software code level, neglecting the management of the resident state of the update data flow to the underlying hardware. During the entire physical process from receiving data to writing to the storage area, if hardware access permissions for the buffer address were locked by the memory protection unit before DMA writing, harmful data could be intercepted at the physical layer. However, current technology only relies on software signature verification to determine this after writing, forming a protection window. Once the update package is tampered with or carries illegal instructions, due to the time lag in software-level verification, harmful data will be directly written to the storage medium via the data bus. At this time, the underlying hardware fails to trigger the bus reset and access permission reset mechanism in real time to physically block the data in the event of a hardware error interrupt. It also lacks a mechanism to force erase the underlying standard block for residual hidden data, which can easily lead to the contamination of the bad block management table of the SDNAND chip or the degradation of the available storage space.

[0004] Therefore, existing technologies have the problem that unauthorized data updates can directly contaminate the core operating area, and it is difficult to implement timely low-level access blocking and forced cache erasure. Summary of the Invention

[0005] This invention provides an OTA upgrade method and system for smart toys based on SDNAND chips, which solves the problems in the prior art where illegal update data can easily pollute the core operating area and it is difficult to implement low-level access blocking and forced cache erasure in a timely manner.

[0006] Firstly, in order to solve the above-mentioned technical problems, the present invention provides an OTA upgrade method for smart toys based on an SDNAND chip, comprising: Obtain the initial update data of the smart toy, and store the initial update data in blocks in a preset physical isolation buffer area to obtain the update data to be verified; Extract the authorization signature feature and self-digest feature of the data to be verified and updated, perform consistency authentication based on the authorization signature feature and self-digest feature, and generate a credential interception signal for the data to be verified and updated if the authentication fails. Based on the credential interception signal, the target physical address and data span parameters of the data to be verified and updated are extracted, a hardware interrupt is triggered to reset the memory region access permissions, and the data transmission link is cut off and state encapsulation is performed according to the reset access permissions to obtain the hardware channel blocking state. Based on the hardware channel blocking status, the target physical address, and the data span parameter, a low-level block erase instruction is generated. The low-level block erase instruction is used to perform forced erasure of the physical isolation buffer area to obtain an empty security area. Extract system boot configuration parameters and memory mapping table from the preset backup system image, and reset the register environment of the underlying hardware device according to the system boot configuration parameters and memory mapping table to obtain the safe operating state of the toy device.

[0007] Secondly, the present invention provides an OTA upgrade system for smart toys based on an SDNAND chip, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described above.

[0008] Compared with the prior art, the present invention has the following beneficial effects: (1) This invention acquires initial update data and stores it in blocks in a preset physical isolation buffer area. At the same time, it extracts the authorized signature feature and its own digest feature to perform consistency authentication, so that unverified update data enters the restricted buffer area before being written to the core operating area. Through signature verification based on the authorized signature feature and its own digest feature, the risk of tampering with update data during transmission or storage can be identified, reducing the possibility of illegal update data polluting the core operating area before verification is completed, and improving the security of the OTA upgrade entry stage.

[0009] (2) This invention triggers a hardware interrupt based on the target physical address and data span parameters when authentication fails, and resets the access permissions of the physical isolation buffer area in privileged mode. Simultaneously, it disables the data transport channels associated with that area, preventing the transmission of failed authentication update data to the core operating area. Compared to simple software application layer interception, this approach creates coordinated restrictions at the underlying access control and data transport links, thereby reducing the risk of unauthorized update data bypassing the verification process and contaminating the core operating area.

[0010] (3) This invention generates a low-level block erase instruction based on the hardware channel blocking status, target physical address, and data span parameters, and uses the flash memory controller to perform a block erase operation on the target physical block corresponding to the physical isolation buffer area. After the erase is completed, the status register is read to determine whether there is an erase failure error code. This process can promptly clean up illegal update data in the buffer area after authentication failure, and trigger backup system image rollback and register environment reset when necessary, thereby improving the recovery capability and operational reliability of smart toys in abnormal OTA upgrade scenarios. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of the OTA upgrade method for smart toys based on SDNAND chips provided in the first embodiment of the present invention; Figure 2 This is a distribution map of access popularity of each data block within the physical isolation buffer area during the OTA upgrade process provided in the first embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] Reference Figure 1 The first embodiment of the present invention provides an OTA upgrade method for smart toys based on SDNAND chips, including the following steps: S1, Obtain the initial update data of the smart toy, and store the initial update data in blocks into a preset physical isolation buffer area to obtain the update data to be verified; S2, extract the authorization signature feature and self-digest feature of the data to be verified and updated, perform consistency authentication based on the authorization signature feature and self-digest feature, and if the authentication fails, generate a credential interception signal for the data to be verified and updated. S3, extract the target physical address and data span parameters of the data to be verified and updated based on the credential interception signal, trigger a hardware interrupt to reset the memory region access permissions, cut off the data transmission link and perform state encapsulation based on the reset access permissions, and obtain the hardware channel blocking state. S4, Generate a low-level block erase instruction based on the hardware channel blocking status, the target physical address and the data span parameter, and use the low-level block erase instruction to perform forced erasure of the physical isolation buffer area to obtain an empty security area; S5. Extract system boot configuration parameters and memory mapping table from the preset backup system image, and reset the register environment of the underlying hardware device according to the system boot configuration parameters and memory mapping table to obtain the safe operating state of the toy device.

[0014] In step S1, the initial update data of the smart toy is obtained, and the initial update data is divided into blocks and stored in a preset physical isolation buffer area to obtain the update data to be verified, including: The initial update data is cut into fixed-length blocks to obtain multiple update data blocks; Extract the verification identifiers of the multiple updated data blocks and allocate buffer physical addresses to each of the multiple updated data blocks; Establish a buffer index relationship between the verification identifier, the buffer physical address, and the corresponding updated data block; The multiple update data blocks are written into a preset physical isolation buffer area according to the buffer physical address, and the storage location of the multiple update data blocks in the physical isolation buffer area is recorded according to the buffer index relationship to obtain the update data to be verified.

[0015] In one implementation, the initial update data is cut into multiple update data blocks by a fixed length. In this embodiment, the binary firmware file stream sequence received by the smart toy communication interface is obtained and identified as the initial update data. This embodiment uses a preset cutting length parameter to perform a data stream truncation operation on the initial update data, generating multiple sub-data packets of uniform size, which are then identified as the multiple update data blocks. The preset cutting length parameter is set to 512 bytes. This value is selected because the SMAND chip used in this embodiment provides a 512-byte logical sector as the basic read / write addressing unit to the main control side; cutting the initial update data into 512-byte blocks aligns each update data block with the logical sector boundary exposed by the SMAND chip, facilitating the recording of the storage location of each update data block through a buffer index relationship. If the actual SMAND chip uses other logical sector lengths or page programming lengths as the minimum write unit, then the cutting length parameter is set to an integer multiple of that minimum write unit.

[0016] It is worth noting that the verification identifiers of the multiple updated data blocks are extracted, and buffer physical addresses are allocated to each of the multiple updated data blocks. In this embodiment, a secure hash algorithm is performed on each of the multiple updated data blocks to generate a hash digest value of 256 bits, which is then used as the verification identifier. In this embodiment, a reserved upgrade cache area is designated in the SDNAND chip as the preset physical isolation buffer area. The reserved upgrade cache area is established during the device factory initialization or storage formatting stage. The main control chip reads the capacity information and bad block marking information of the SDNAND chip, avoids blocks marked as unusable, and selects several consecutive or discrete available blocks from the set of free blocks as upgrade cache blocks. The capacity of the reserved upgrade cache area is not less than the sum of the maximum length of a single OTA update package and the length of the verification metadata; when the capacity of a single OTA update package is greater than that of a single cache block, it is stored in blocks according to the increasing block number order or the order recorded in the buffer index table. After establishment, the main control chip writes the starting logical address, number of blocks, block size, and availability status of the region into the buffer index table. Through the access control configuration of the flash memory controller and the storage mapping permission configuration of the main control chip, the region is restricted to be accessible only to the upgrade management program. This embodiment employs a circular buffer queue algorithm. Using the starting physical address of the physical isolation buffer region as the base address, and following a fixed address increment step corresponding to the cut length parameter, absolute physical addresses are sequentially assigned to each updated data block to obtain the buffer physical address. Simultaneously, the verification identifier of each updated data block and its corresponding buffer physical address are written into the buffer index table, enabling subsequent authentication, blocking, and erasure steps to locate the range of data blocks to be processed based on the buffer index table.

[0017] For example, a buffer index relationship is established between the verification identifier, the buffer physical address, and the corresponding updated data block; The multiple updated data blocks are written to a preset physical isolation buffer area according to the buffer physical address, and the storage location of the multiple updated data blocks in the physical isolation buffer area is recorded according to the buffer index relationship to obtain the updated data to be verified. In this embodiment, according to the buffer physical address, the corresponding control parameters are written to the source address register, destination address register, and transfer length register of the direct memory access controller, and a write operation is initiated to the physical isolation buffer area through the SDNAND storage controller or SDIO controller. The direct memory access controller is used to move each updated data block from the receive buffer to the data buffer register of the storage controller, and the storage controller writes each updated data block to the physical isolation buffer area according to the buffer physical address or the corresponding logical sector address. After the physical bus transmission is completed, the initial updated data is in a restricted physical space without system read / write and code execution permissions. In this embodiment, the data set in this state is determined as the updated data to be verified.

[0018] In step S2, the authorized signature feature and self-digest feature of the data to be verified and updated are extracted. Consistency authentication is performed based on the authorized signature feature and the self-digest feature. If authentication fails, a credential interception signal is generated for the data to be verified and updated, including: Perform hash calculation on the main payload in the data to be verified to obtain the digest value to be verified; Signature verification is performed using the preset public key, the authorized signature feature, and the digest value to be verified to obtain the signature verification result; If the signature verification result fails, it is determined that the authorized signature feature does not match the data to be verified and updated, and a credential interception signal is generated for the data to be verified and updated.

[0019] In one implementation, this embodiment reads the signature length field from the end-of-packet region of the update data to be verified, which is located within a physically isolated buffer area, and determines the start and end positions of the end signature field based on the signature length field. Subsequently, a cryptographic signature data segment is extracted from the end signature field, and this cryptographic signature data segment is used as the authorized signature feature. The main payload data segment preceding the end signature field is used as the self-digest feature. SHA-256 or SM3 hash calculation is performed on the self-digest feature to obtain a 256-bit digest value to be verified. This embodiment reads the public key embedded in the one-time programmable electronic fuse array inside the main control chip of the smart toy. During the smart toy production stage, the public key is written into the one-time programmable electronic fuse array of the main control chip by a factory secure programming device. Before programming, an asymmetric key pair is generated by a key generation device in a secure environment. The private key is used to sign the update package. The public key is transmitted to the programming device after being digitally digested and hardware encrypted. After verifying the integrity of the public key, the programming device writes it into the electronic fuse array. After writing, the physical fuses of the electronic fuse array are permanently blown, making the public key content unchangeable and unreadable. It is only allowed to be called by the chip's internal security engine during signature verification operations, ensuring the immutability and trustworthiness of the public key at the physical level.

[0020] Subsequently, the authorized signature feature, the digest value to be verified, and the public key are used as verification inputs to perform a public key verification operation corresponding to the public key type. If the verification operation returns an invalid signature or an inconsistent digest matching result, a failed verification result is obtained. If the verification operation returns a valid signature and an consistent digest matching result, a successful verification result is obtained. If the verification result fails, it is determined that the authorized signature feature does not match the data to be verified and an interception signal for the data to be verified is generated. If the verification result passes, the data to be verified and updated is identified as legitimate update data, and the restricted transport status of the corresponding data block in the physical isolation buffer area is released. Subsequently, the legitimate update data is written to the upgrade storage area of ​​the SDNAND chip according to the buffer index relationship, and a startup verification is performed after the writing is completed. If the startup verification passes, the system startup identifier is updated, so that the smart toy loads the system image corresponding to the legitimate update data during the next startup.

[0021] In step S3, the target physical address and data span parameters of the data to be verified and updated are extracted according to the credential interception signal, a hardware interrupt is triggered to reset the memory region access permissions, the data transmission link is cut off according to the reset access permissions and state encapsulation is performed to obtain the hardware channel blocking state.

[0022] The process of extracting the target physical address and data span parameters of the data to be verified and updated based on the credential interception signal, and triggering a hardware interrupt to reset memory region access permissions, includes: Read the storage mapping relationship corresponding to the physical isolation buffer area based on the credential interception signal; Obtain the starting buffer address of the data to be verified and updated in the buffer index table, and extract the corresponding starting storage address and occupied length from the storage mapping relationship based on the starting buffer address, which are respectively used as the target physical address and data span parameter; A forced takeover control word is generated based on the target physical address, and a communication interception command is issued based on the forced takeover control word; The system hardware interrupt is triggered by the communication interception instruction, and the region access permission configuration of the underlying memory protection unit is modified in hardware privilege mode to obtain the reset access permission.

[0023] In one implementation, the storage mapping relationship corresponding to the physical isolation buffer area is read according to the credential interception signal; the starting buffer address of the data to be verified and updated in the buffer index table is obtained; and the corresponding starting storage address and occupied length are extracted from the storage mapping relationship based on the starting buffer address, respectively serving as the target physical address and data span parameter. When the high-level credential interception signal is received, the central processing unit initiates a page table lookup request to the translation backup buffer of the memory management unit. In this embodiment, the starting address of the virtual memory allocated to the physical isolation buffer area by the system is extracted and determined as the virtual buffer address. Based on the virtual buffer address, index matching is performed in the page table mapping relationship or storage mapping relationship to extract the actual physical starting address and the allocated total byte offset length corresponding to this area in the SDNAND chip reserved upgrade cache area. For example, the extracted absolute physical starting address is determined as the target physical address, and the total byte offset length is determined as the data span parameter.

[0024] It should be noted that the physical isolation buffer area is mapped to the physical address space of the main control chip via QSPI or SDIO bus. The access permissions managed by the memory protection unit are this mapped address range. Therefore, modifying its access permissions can block any subsequent data write operations initiated to this buffer area via the bus. A forced takeover control word is generated based on the target physical address. The forced takeover control word includes an operation type field, a target channel number field, a target physical address field, and a data span field. Among them, the operation type field is used to indicate the termination of update data transfer, the target channel number field is used to identify the direct memory access channel performing OTA data transfer, and the target physical address field and data span field are used to limit the range of data that is prohibited from being transferred this time. A communication interception instruction containing the forced takeover control word is sent to the channel control register of the direct memory access controller responsible for managing update data transfer, forcibly terminating the data write and data transfer tasks related to the update data to be verified and the physical isolation buffer area. After receiving the communication interception instruction, the direct memory access controller triggers the corresponding hardware interrupt to the main processor. After responding to the interrupt, the main processor enters the corresponding interrupt service routine and performs the access permission modification operation in privileged mode in the interrupt service routine. In this mode, the main processor rewrites the region access permission register of the underlying memory protection unit, forcibly changing the access attribute of the corresponding physical isolation buffer region from a normal writable state to an absolutely writable state. The modified register configuration is the reset access permission.

[0025] It is worth noting that in the specific implementation based on the ARM Cortex-M series processor, the region access permission register of the underlying memory protection unit includes MPU_RBAR (base address register) and MPU_RASR (attribute and size register). The absolute write-prohibited state can be achieved by configuring the AP field in MPU_RASR to No Access. If it is RISC-V, MPU_RBAR / MPU_RASR can be replaced with PMP address register and PMP configuration register.

[0026] Specifically, the process of cutting off the data transmission link and performing state encapsulation based on the reset access permissions to obtain the hardware channel blocking state includes: Based on the reset access permissions, disable the data transport channels associated with the physical isolation buffer area to obtain the link disconnection status parameters; The hardware channel blocking status is obtained by performing state encapsulation on the link disconnection status parameter, the target physical address, and the data span parameter.

[0027] It is worth noting that, based on the reset access permissions, the data transfer channels associated with the physical isolation buffer area are disabled, resulting in a link disconnect status parameter. The system's underlying access control logic monitors the permission configuration status of the physical isolation buffer area in real time. When the reset access permissions indicate a write-prohibited or transfer-prohibited state, the main processor modifies the channel enable configuration of the direct memory access controller and flash memory controller in privileged mode, prohibiting data write, read, and transfer operations to the core runtime area associated with the physical isolation buffer area, thereby generating the link disconnect status parameter.

[0028] For example, the hardware channel blocking state is obtained by encapsulating the link disconnection state parameter, the target physical address, and the data span parameter. In this embodiment, a system security log structure is generated according to a fixed field order. The system security log structure sequentially includes an event type field, a link disconnection state parameter field, a target physical address field, a data span parameter field, a timestamp field, and a verification field. The main processor writes the above fields into a contiguous buffer in byte alignment and performs cyclic redundancy check on the event type field to the timestamp field to obtain the verification field, thereby generating a structured feedback message. In this embodiment, this structured feedback message is identified as the hardware channel blocking state and is unidirectionally written into a security audit log sector with write-only attributes, forming a closed-loop interception event tracing record, which is also directly called and parsed by the subsequent physical erasure mechanism.

[0029] In step S4, a low-level block erase instruction is generated based on the hardware channel blocking status, the target physical address, and the data span parameter. The low-level block erase instruction is then used to perform a forced erase on the physical isolation buffer area to clear the secure area.

[0030] The process of generating a low-level block erase instruction based on the hardware channel blocking status, the target physical address, and the data span parameter includes: Analyze the hardware channel blocking status and extract the target physical address and the data span parameter; The target block address set to be erased in the physical isolation buffer area is determined based on the target physical address and the data span parameter. The target block address set is either the set of logical block addresses that the SDNAND chip opens to the main control side, or the set of erase block addresses that the flash memory controller can recognize. According to the block erase command format supported by the flash controller, the preset block erase opcode, the target block address set, and the command verification field are written into the command register or command queue of the flash controller to generate a low-level block erase instruction that can be executed by the flash controller; wherein, the command verification field is obtained by the main processor performing a verification operation based on the preset block erase opcode and the target block address set.

[0031] In one implementation, this embodiment performs a bitmask parsing operation on the data frame corresponding to the hardware channel blocking state. The absolute physical start address and span byte count of the locked isolation buffer region are extracted through a bitwise shift operation and determined as the target physical address and the data span parameter, respectively. Combining the page, block, and spare area organization parameters of the sDNAND chip, one or more target physical blocks occupied in the physical isolation buffer region are determined based on the target physical address and the data span parameter, and a corresponding target block address set is generated. Subsequently, this embodiment, according to the block erase command format supported by the flash controller, writes the pre-configured block erase opcode based on the selected sDNAND chip model, the target block address set, and the command verification field into the flash controller's command register or command queue, generating the underlying block erase instruction that can be recognized and executed by the flash controller. The command verification field is obtained by the main processor performing cyclic redundancy check on the block erase opcode and the target block address set, and is used by the flash controller to determine whether an error occurred in the command content during transmission.

[0032] Specifically, the physical isolation buffer area is forcibly erased using the underlying block erase command to clear the safe area, including: The underlying block erase instruction drives the flash memory controller to perform a block erase operation on the target physical block corresponding to the physical isolation buffer region. Read the status register output by the flash controller after the erase operation is completed. If there is no erase failure error code in the status register, reset the access control permissions of the physical isolation buffer area to clear the security area.

[0033] It is worth noting that in this embodiment, the generated underlying block erase command is sent to the flash memory controller on the smart toy's motherboard via the internal control bus. The flash memory controller responds to the underlying block erase command and performs a block erase operation on the target physical block, restoring it to an erased state. Through this block erase operation, the previously stored illegal update data in the target physical block is cleared from the normal read / write path, thereby reducing the risk of illegal update data continuing to occupy the buffer area or being misread by subsequent processes. After the erase operation is completed, this embodiment reads the hardware status register inside the flash memory controller and checks a specific diagnostic flag bit in the register using a logical AND operation. If the result is that the flag bit is not set, it indicates that there is no erase failure error code, meaning the underlying block erase has been successfully completed. At this time, this embodiment sends control commands to the storage access control module of the flash memory controller and the main control chip to release the previously set write-prohibited or transport-prohibited state for the physical isolation buffer area, reset the access control permissions of the physical isolation buffer area, and obtain an empty secure area.

[0034] It should be noted that if the measured status register contains an erase failure error code, it is determined that the target physical block has suffered hardware damage or wear exceeded the limit. In this embodiment, the hardware watchdog of the smart toy's main control chip is directly triggered to reset, forcing the device to restart and triggering the boot program to roll back to the backup system image.

[0035] like Figure 2 As shown, this graph illustrates the access frequency distribution of each data block within the physical isolation buffer area during an OTA upgrade. The graph visually presents an 8-row (intra-block) by 8-column (byte offset) two-dimensional data matrix using color depth, with the color levels on the right representing the corresponding data values ​​(0-250). This heatmap can quickly identify high-frequency access hotspots, such as the bright yellow block near row 4, and low-frequency or idle cold data areas, such as the dark block in the lower right corner, through color clustering features. This provides intuitive data support for dynamically optimizing buffer slicing strategies and accurately locating the underlying physical blocks to be erased.

[0036] In step S5, system boot configuration parameters and memory mapping table are extracted from the preset backup system image. The register environment of the underlying hardware device is reset according to the system boot configuration parameters and memory mapping table to obtain the safe operating state of the toy device.

[0037] This includes extracting system boot configuration parameters and memory mapping tables from a preset backup system image, including: A read command is sent to the preset backup storage area to load the backup system image; Extract the header data of the backup system image, and perform structure parsing on the header data to obtain parsed header data; Hardware initialization parameters are extracted from the parsed header data as system boot configuration parameters, and physical address allocation ranges are extracted as memory mapping tables.

[0038] In one implementation, a read command is issued to a preset backup storage area to load the backup system image. It should be noted that in this embodiment, a hidden backup partition is designated as the preset backup storage area within the SDNAND chip. This hidden backup partition is set to read-only mode under normal operating conditions through the write protection configuration of the flash memory controller and the storage access permission configuration of the main control chip to prevent accidental or malicious tampering. When updating the backup system image, the system temporarily removes the write protection of the hidden backup partition through privileged mode and re-enables write protection after the update is completed. The hidden backup partition has been programmed with complete system firmware via low-level burning instructions during the device's factory manufacturing stage or during the last successful power-on self-test, and a cyclic redundancy check (CRC) code has been calculated and added. In this embodiment, a read command is issued to the preset backup storage area through an internal serial peripheral interface. This read command carries a fixed physical starting address and read length parameters, loading the complete system firmware within the physical address range into the temporary cache area of ​​main memory, thus obtaining the backup system image.

[0039] It is worth noting that the header data of the backup system image is extracted, and structural parsing is performed on the header data to obtain parsed header data. Hardware initialization parameters are extracted from the parsed header data as system boot configuration parameters, and physical address allocation ranges are extracted as memory mapping tables. In this embodiment, the first 512 bytes of the backup system image are extracted as the header data. A preset data structure template is used to perform structural parsing on the header data. The preset data structure template predefines the magic number at offset 0 bytes, the clock configuration word at offset 64 bytes, the interrupt vector base address at offset 128 bytes, and the task memory start and end range at offset 256 bytes. The above fixed offset parameters are set based on the fact that during the compilation and construction phase of the smart toy firmware, the compiler's linker script pre-divides a fixed-length boot configuration block. For example, 64 bytes of storage space are hard-allocated for header authentication and the magic number, so that the clock configuration word must immediately follow at offset 64 bytes, and so on. This hard-coded data structure template ensures that, in the simplified boot mode during the initial recovery phase, the device can directly and quickly read low-level initialization parameters using absolute physical addressing with a fixed offset, without relying on complex file system parsing libraries. Independent fields are defined according to this template to obtain the structured parsing header data. The clock configuration word and interrupt vector base address combination are extracted from the parsing header data to determine the hardware initialization parameters, which are then used as the system boot configuration parameters. Simultaneously, the start and end values ​​of the absolute physical addresses allocated to each system task are extracted, and the data table recording these physical address allocation intervals is defined as the memory mapping table.

[0040] The safe operating state of the toy device is obtained by resetting the register environment of the underlying hardware device according to the system boot configuration parameters and the memory mapping table, including: The system boot configuration parameters are used to generate hardware configuration instructions, and the hardware clock frequency is restored according to the hardware configuration instructions. The base address is relocated according to the memory mapping table, and the register pointer of the hardware task module is reconfigured to obtain the target register pointer; The safe operating state of the toy device is obtained by restoring the register context environment based on the target register pointer.

[0041] In one implementation, hardware configuration instructions are generated based on the system boot configuration parameters, and the hardware clock frequency is restored based on the hardware configuration instructions. This embodiment extracts the clock configuration word from the system boot configuration parameters, for example, a clock multiplier of 120. A phase-locked loop (PLL) configuration control word for the system reset and clock control registers is constructed based on this clock multiplier, and this word is determined as the hardware configuration instruction. In this embodiment, the hardware configuration instruction is written to the corresponding system reset and clock control registers via the internal bus, forcibly setting the main processor's clock frequency to 120MHz.

[0042] It should be noted that, based on the memory mapping table, base address relocation is performed, and the register pointers of the hardware task modules are reconfigured to obtain the target register pointer. This embodiment extracts the physical address allocation ranges corresponding to each hardware task module recorded in the memory mapping table. A base address relocation algorithm is used for address translation, extracting the absolute starting physical address of the backup system image in the main memory temporary processing area. This absolute starting physical address is then calculated by subtracting it from the logical starting address set during the compiler linking stage to obtain the relocation offset. Subsequently, this relocation offset is directly written into the vector table offset register VTOR inside the microcontroller system control block, thereby forcibly redirecting the addressing of all interrupt vectors to the new absolute physical address of the interrupt vector base address corresponding to the backup system image at the hardware level. Based on the updated absolute physical address, the main stack pointer register and program counter values ​​of the corresponding hardware task module are updated to the entry physical address of the backup system's normal startup, thus obtaining the target register pointer.

[0043] For example, the safe operating state of the toy device is obtained by restoring the register context environment based on the target register pointer. In this embodiment, before jumping to the backup system image, normal interrupts are disabled, and incomplete channel states related to this OTA upgrade are cleared from the direct memory access controller and flash memory controller. Then, the base address of the interrupt vector table of the backup system image is written to the vector table offset register. The initial value of the main stack pointer is read from the first address of the interrupt vector table, and the reset entry address is read from the next address of the interrupt vector table. Finally, the main stack pointer register is updated to the initial value of the main stack pointer, and the process jumps to the reset entry address to execute the backup system startup procedure. After the backup system completes startup, the safe operating state of the toy device is generated.

[0044] Further, in an optional implementation, after entering the safe operating state of the toy device, this embodiment reads the cumulative number of OTA upgrade failures recorded in the system's non-volatile memory. This embodiment determines whether the cumulative number is less than a preset retry upper limit threshold, which is set to three. This value is selected because a single or two upgrade failures may be caused by transient anomalies such as network transmission interruptions, power fluctuations, or bus busyness; three consecutive failures indicate a low probability of success with immediate retrying and may increase power consumption and memory write / erase cycles. Therefore, this embodiment uses three as the retry upper limit, allowing the device limited self-recovery while avoiding the device being in a state of repeated upgrade failures for an extended period. Using this constant three as the circuit breaker threshold provides the system with reasonable self-repair tolerance while effectively preventing the system from falling into an infinite number of invalid retries, leading to power exhaustion and computing deadlock. If the cumulative number is less than the constant three, this embodiment starts an internal hardware timer, enters a suspended waiting state, and waits for the next OTA trigger cycle to arrive before reconnecting to the server to obtain updated data.

[0045] It should be noted that if the cumulative number of attempts reaches a constant three, this embodiment reports a hexadecimal status code indicating a permanent upgrade failure to the cloud management server via the internal wireless network communication module. It also controls the device's local general-purpose input / output pins to drive the LED indicator to flash at a frequency of 1Hz for an audio-visual alert, requesting manual intervention. The 1Hz frequency corresponds to one on / off cycle per second, facilitating visual identification by the user without significantly increasing the smart toy's standby power consumption.

[0046] It is worth noting that this embodiment establishes a parallel firmware copy synchronization update mechanism. After each normal OTA upgrade process is successfully completed and the new firmware boots into the core runtime area and completes the first power-on self-test, this embodiment extracts the upgraded firmware copy. This embodiment performs the aforementioned consistency authentication verification on the firmware copy; after verification, the system temporarily removes write protection on the flash memory controller side and the main control chip storage access permission side in privileged mode, and re-enables write protection on both sides after the update is completed. The bus controller is then used to completely write the firmware copy into the hidden backup partition corresponding to the preset backup storage area, overwriting the old data and updating the backup system image, and then re-enables write protection.

[0047] In summary, this invention discloses an OTA upgrade method for smart toys based on a sDNAND chip. This invention divides the initial update data into blocks and stores them in independent physically isolated buffer areas, performing consistency authentication through authorized signature features and its own digest features. If authentication fails, a hardware interrupt is triggered based on the target physical address and data span parameters, resetting the access permissions of the physically isolated buffer area to restrict the continued transmission of illegal update data to the core operating area. Subsequently, a low-level block erase instruction is generated based on the hardware channel blocking status, and the target physical block is erased through the flash memory controller, with the status register being read to confirm the erase result. Finally, combined with the base address relocation of the backup system image, register environment recovery, retry reporting, and image synchronous write protection mechanisms, the device can revert to a runnable state in abnormal OTA upgrade scenarios. This invention reduces the risk of illegal update data contaminating the core operating area and improves the anomaly handling capability and system recovery reliability of smart toys during OTA upgrades.

[0048] The second embodiment of the present invention provides an OTA upgrade system for smart toys based on an SDNAND chip, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method described above.

[0049] It should be noted that the OTA upgrade system for smart toys based on SDNAND chips provided in this embodiment of the invention is used to execute all the process steps of the OTA upgrade method for smart toys based on SDNAND chips in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0050] It should be noted that the system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0051] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A method for OTA upgrade of smart toys based on SDNAND chips, characterized in that, include: Obtain the initial update data of the smart toy, and store the initial update data in blocks in a preset physical isolation buffer area to obtain the update data to be verified; Extract the authorization signature feature and self-digest feature of the data to be verified and updated, perform consistency authentication based on the authorization signature feature and self-digest feature, and generate a credential interception signal for the data to be verified and updated if the authentication fails. Based on the credential interception signal, the target physical address and data span parameters of the data to be verified and updated are extracted, a hardware interrupt is triggered to reset the memory region access permissions, and the data transmission link is cut off and state encapsulation is performed according to the reset access permissions to obtain the hardware channel blocking state. Based on the hardware channel blocking status, the target physical address, and the data span parameter, a low-level block erase instruction is generated. The low-level block erase instruction is used to perform forced erasure of the physical isolation buffer area to obtain an empty security area. Extract system boot configuration parameters and memory mapping table from the preset backup system image, and reset the register environment of the underlying hardware device according to the system boot configuration parameters and memory mapping table to obtain the safe operating state of the toy device.

2. The OTA upgrade method for smart toys based on sDNAND chips according to claim 1, characterized in that, The process of acquiring initial update data from the smart toy and storing the initial update data in blocks within a preset physical isolation buffer area to obtain update data to be verified includes: The initial update data is cut into fixed-length blocks to obtain multiple update data blocks; Extract the verification identifiers of the multiple updated data blocks and allocate buffer physical addresses to each of the multiple updated data blocks; Establish a buffer index relationship between the verification identifier, the buffer physical address, and the corresponding updated data block; The multiple update data blocks are written into a preset physical isolation buffer area according to the buffer physical address, and the storage location of the multiple update data blocks in the physical isolation buffer area is recorded according to the buffer index relationship to obtain the update data to be verified.

3. The OTA upgrade method for smart toys based on sDNAND chips according to claim 1, characterized in that, The process involves extracting the authorization signature feature and its own digest feature of the data to be verified and updated, performing consistency authentication based on the authorization signature feature and its own digest feature, and generating a credential interception signal for the data to be verified and updated if the authentication fails. Perform hash calculation on the main payload in the data to be verified to obtain the digest value to be verified; Signature verification is performed using the preset public key, the authorized signature feature, and the digest value to be verified to obtain the signature verification result; If the signature verification result fails, it is determined that the authorized signature feature does not match the data to be verified and updated, and a credential interception signal is generated for the data to be verified and updated.

4. The OTA upgrade method for smart toys based on SDNAND chips according to claim 1, characterized in that, The step of extracting the target physical address and data span parameters of the data to be verified and updated based on the credential interception signal, and triggering a hardware interrupt to reset memory region access permissions, includes: Read the storage mapping relationship corresponding to the physical isolation buffer area based on the credential interception signal; Obtain the starting buffer address of the data to be verified and updated in the buffer index table, and extract the corresponding starting storage address and occupied length from the storage mapping relationship based on the starting buffer address, which are respectively used as the target physical address and data span parameter; A forced takeover control word is generated based on the target physical address, and a communication interception command is issued based on the forced takeover control word; The system hardware interrupt is triggered by the communication interception instruction, and the region access permission configuration of the underlying memory protection unit is modified in hardware privilege mode to obtain the reset access permission.

5. The OTA upgrade method for smart toys based on SDNAND chips according to claim 1, characterized in that, The step of cutting off the data transmission link and performing state encapsulation according to the reset access permissions to obtain the hardware channel blocking state includes: Based on the reset access permissions, disable the data transport channels associated with the physical isolation buffer area to obtain the link disconnection status parameters; The hardware channel blocking status is obtained by performing state encapsulation on the link disconnection status parameter, the target physical address, and the data span parameter.

6. The OTA upgrade method for smart toys based on SDNAND chips according to claim 1, characterized in that, The step of generating the underlying block erase instruction based on the hardware channel blocking status, the target physical address, and the data span parameter includes: Analyze the hardware channel blocking status and extract the target physical address and the data span parameter; The target block address set to be erased in the physical isolation buffer area is determined based on the target physical address and the data span parameter. The target block address set is either the set of logical block addresses that the SDNAND chip opens to the main control side, or the set of erase block addresses that the flash memory controller can recognize. According to the block erase command format supported by the flash controller, the preset block erase opcode, the target block address set, and the command verification field are written into the command register or command queue of the flash controller to generate a low-level block erase instruction that can be executed by the flash controller; wherein, the command verification field is obtained by the main processor performing a verification operation based on the preset block erase opcode and the target block address set.

7. The OTA upgrade method for smart toys based on SDNAND chips according to claim 1, characterized in that, The step of using the underlying block erase command to force-erase the physical isolation buffer area to clear the safe area includes: The underlying block erase instruction drives the flash memory controller to perform a block erase operation on the target physical block corresponding to the physical isolation buffer region. Read the status register output by the flash controller after the erase operation is completed. If there is no erase failure error code in the status register, reset the access control permissions of the physical isolation buffer area to clear the security area.

8. The OTA upgrade method for smart toys based on SDNAND chips according to claim 1, characterized in that, The step of extracting system boot configuration parameters and memory mapping table from a preset backup system image includes: A read command is sent to the preset backup storage area to load the backup system image; Extract the header data of the backup system image, and perform structure parsing on the header data to obtain parsed header data; Hardware initialization parameters are extracted from the parsed header data as system boot configuration parameters, and physical address allocation ranges are extracted as memory mapping tables.

9. The OTA upgrade method for smart toys based on SDNAND chips according to claim 1, characterized in that, The step of resetting the register environment of the underlying hardware device according to the system boot configuration parameters and the memory mapping table to obtain the safe operating state of the toy device includes: The system boot configuration parameters are used to generate hardware configuration instructions, and the hardware clock frequency is restored according to the hardware configuration instructions. The base address is relocated according to the memory mapping table, and the register pointer of the hardware task module is reconfigured to obtain the target register pointer; The safe operating state of the toy device is obtained by restoring the register context environment based on the target register pointer.

10. An OTA upgrade system for smart toys based on a sDNAND chip, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method according to any one of claims 1 to 9.

Images