Device system upgrade method and apparatus, electronic device, and storage medium

Abstract

The present application provides a device system upgrade method and apparatus, an electronic device, and a storage medium. The device system upgrade method comprises: determining a first partition on the basis of first firmware currently running in a device system, wherein the first firmware is stored in the first partition; storing second firmware in a second partition; upgrading the device system on the basis of the second firmware; determining whether the upgrade of the device system is successful; and if the upgrade of the device system fails, controlling the device system to enter the first partition, and running the first firmware. In the present application, upgrade firmware is stored in the second partition where the device system currently does not run, and then the device system is controlled to switch to the second partition for running, thereby implementing upgrade of the device system. Additionally, when the upgrade of the device system fails, the device system is controlled to switch to the first partition again to run the original first firmware, thereby solving the problem in the related art that self-recovery cannot be performed once the upgrade of the device system fails.

Description

Method and device for upgrading device system, electronic device and storage medium

[0001] The present application claims priority from the Chinese patent application No. 202410897513.0, filed on July 5, 2024, and entitled "Method and device for upgrading device system, electronic device and storage medium", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present application relates to the technical field of household appliances, in particular to a method and device for upgrading a device system, an electronic device and a storage medium. BACKGROUND

[0003] With the rapid development of Internet of Things technology, the market demand for Internet of Things devices is also changing rapidly. In order to meet the changing needs of users, it is particularly important to upgrade and iterate the software of the existing Internet of Things devices (OTA (Over The Air) upgrade). However, the traditional upgrade iteration method has the problem of being unable to recover after upgrade failure.

[0004] SUMMARY

[0005] The present application aims to at least solve one of the problems in the prior art or related art.

[0006] To this end, a first aspect of the present application provides a method for upgrading a device system.

[0007] A second aspect of the present application provides a device system upgrading device.

[0008] A third aspect of the present application provides an electronic device.

[0009] A fourth aspect of the present application provides a storage medium.

[0010] Therefore, according to a first aspect of the present application, a method for upgrading a device system is provided, comprising: determining a first partition according to a first firmware currently running by the device system, wherein the first firmware is stored in the first partition; storing a second firmware to a second partition; upgrading the device system according to the second firmware; determining whether the upgrade of the device system is successful; and based on the upgrade of the device system failing, controlling the device system to enter the first partition and run the first firmware.

[0011] The device system upgrading method provided in the application is mainly used for upgrading the device through OTA (Over The Air) technology. The device has multiple partitions, including a boot partition, a first partition, a second partition, a firmware information partition, and a user data partition. The boot partition is the first code loaded after the device system is powered on. In the code, the device system determines whether to run in the first partition or the second partition according to the data in the firmware information partition and the user data partition. The first partition and the second partition are partitions for storing firmware. The running logic of the device system is realized by the code in the partition, and the object of OTA upgrading is the firmware in the partition. The firmware information partition stores basic data required when the boot partition selects a running partition, such as the length information of the firmware and the CRC (Cyclic Redundancy Checksum) checksum of the firmware. The user data partition mainly stores data that needs to be saved after power failure during user use, such as device running parameters, device unique codes, and rollback flag bits. The device system upgrading method mainly includes the following steps. First, the first partition is determined according to the first firmware currently running in the device system. The first firmware is stored in the first partition, that is, it is determined that the device system runs in which partition before upgrading, and then the partition is taken as the first partition. Then, the second firmware is stored in the second partition. The second partition can store other firmware or no firmware. The second firmware is the firmware after upgrading, that is, the firmware after upgrading is stored in the non-current running partition of the device system. Then, the device system is upgraded according to the second firmware, that is, the running partition of the device system is switched, from the first partition before upgrading to the second partition, so that the device system runs in the second partition with the second firmware, thereby completing the upgrading of the device system. Next, it is determined whether the upgrading of the device system is successful, that is, it is determined whether the device system runs the second firmware smoothly. If the device system runs the second firmware smoothly, that is, it can run normally, it means that the upgrading is successful, and the device system can continue to run the second firmware in the second partition. If the device system cannot run normally when running the second firmware, it means that the upgrading fails, and the device system needs to be controlled to return to the first partition and run the first firmware before upgrading, thereby realizing the self-recovery of the device system. The application stores the upgrading firmware in the second partition that is not currently running in the device system, and then controls the device system to switch from the first partition to the second partition for running, thereby realizing the upgrading of the device system. Meanwhile, when the device system fails to upgrade, the device system is controlled to switch to the first partition again to run the original first firmware, thereby solving the problem that the device system cannot self-recover after failing to upgrade in the related art.

[0012] According to the device system upgrading method provided in the application, the following technical features can be further included.

[0013] In some embodiments, the step of determining whether the device system is successfully upgraded comprises: controlling the device system to enter a boot partition, and adding one to the running number of the boot partition to obtain a first running number, wherein the boot partition is used to determine whether the device system enters the first partition or the second partition; obtaining a second running number of the second partition; determining a first difference between the first running number and the second running number; and determining that the device system is unsuccessfully upgraded based on the first difference being greater than a first preset threshold.

[0014] In the embodiments, the step of determining whether the device system is successfully upgraded comprises: when the device system enters the boot partition each time, the number of times that the device system enters the boot partition is recorded. Similarly, when the device system enters the first partition and the second partition, the number of times that the device system enters the partition is recorded after the device system normally runs the firmware. Therefore, when the device system is successfully upgraded, the device system is restarted, and the device system is first controlled to enter the boot partition, and the running number of the boot partition, i.e., the number of times that the device system enters the boot partition, is added by one to obtain a first running number. The boot partition is the first code loaded after the device system is powered on, and in the code, the device system determines whether to run in the first partition or the second partition according to the data in the firmware information area and the user data area. Then, a second running number of the second partition, i.e., the number of times that the device system enters the second partition, is obtained. Since the second firmware in the second partition is the upgraded firmware at this time, the device system needs to enter the second partition to run the second firmware, and thus the second running number of the second partition is obtained. Then, the first running number and the second running number are compared to determine a first difference between the first running number and the second running number. When the first difference is greater than a first preset threshold, it is determined that the device system cannot normally run the second firmware in the second partition, and thus the device system is not controlled to enter the second partition, and it is directly determined that the device system is unsuccessfully upgraded. When the first difference is less than the first preset threshold, the device system is controlled to normally enter the second partition. If the device system can normally run the second firmware in the second partition, the second running number of the second partition is added by one, and then the system is controlled to normally run. If the device system cannot normally run the second firmware in the second partition, the device system is restarted and the above steps are repeated until the first difference is greater than the first preset threshold or the device system can normally run the second firmware in the second partition. The difference between the number of times that the device system enters the boot partition and the number of times that the device system enters the second partition is calculated, so that whether the device system is successfully upgraded is determined.

[0015] In some embodiments, based on the device system upgrade failure, the step of controlling the device system to enter the first partition and run the first firmware includes: determining the legality of the first firmware in the first partition; based on the first firmware being legal, controlling the device system to enter the first partition and run the first firmware, clearing the rollback flag, and marking the second partition; based on the first firmware being illegal, sending a prompt message to the user.

[0016] In this embodiment, based on the device system upgrade failure, the step of controlling the device system to enter the first partition and run the first firmware includes: since the device system upgrade fails, i.e., the device system cannot normally run the second firmware in the second partition, in order to enable the device system to also normally run, the device system needs to be controlled to re-enter the first partition and run the first firmware before the upgrade, i.e., the device system needs to perform a rollback operation. When the device system performs the rollback operation, it is necessary to first determine the legality of the first firmware in the first partition, i.e., to determine whether the first firmware in the first partition is complete and can be normally used. When the first firmware is legal, the device system is controlled to enter the first partition and run the original first firmware, and the rollback flag is cleared. The rollback flag is stored in the user data partition, and when it is detected that the device system needs to perform a rollback operation, the rollback flag is automatically set. Therefore, when the control system enters the first partition and re-runs the original first firmware, i.e., the device system rollback operation is completed, the rollback flag needs to be cleared. At the same time, the second partition also needs to be marked. Since the device system cannot run the second firmware in the second partition, it indicates that the second firmware in the second partition is illegal, and therefore the second partition needs to be marked as illegal. When the first firmware is illegal, it indicates that the device system also cannot enter the first partition to run the first firmware, and therefore a prompt message needs to be sent to the user, prompting the user that the device system has been damaged and please contact the after-sales service. The present application determines the legality of the first firmware in the first partition when the device system performs the rollback operation, thereby determining that the rollback operation can be normally run.

[0017] In some embodiments, the step of determining whether the device system upgrade is successful includes: controlling the device system to enter a boot partition and record a current time, wherein the boot partition is used to determine whether the device system enters the first partition or the second partition; obtaining a first time when the device system last entered the boot partition; determining a second difference between the current time and the first time; based on the second difference being within a preset range, determining that the device system upgrade fails.

[0018] In the technical solution, the step of judging whether the upgrade of the device system is successful includes: when the firmware fails to run after the device system enters the running partition, the device system is periodically restarted due to the action of the watchdog (embedded system monitoring device). Therefore, when the device system enters the boot partition each time, the current time is recorded. After the device system is upgraded and restarted, the device system is first controlled to enter the boot partition, and the time when the device system enters the boot partition is recorded. The boot partition is the first code loaded after the device system is powered on, and in the code, the device system determines whether to run in the first partition or the second partition according to the data in the firmware information area and the user data area. Then the first time when the device system enters the boot partition last time is obtained. Then the first time and the current time are compared to determine a second difference between the current time and the first time. When the second difference is in a preset range, which is determined by the watchdog (embedded system monitoring device), it means that the device system cannot normally run the second firmware in the second partition, so the device system does not need to be controlled to enter the second partition, and the device system upgrade is directly judged to fail. When the second difference is not in the preset range, the device system is controlled to normally enter the second partition. If the device system can normally run the second firmware in the second partition, the system is controlled to normally run. If the device system cannot normally run the second firmware in the second partition, the device system is restarted by controlling the watchdog (embedded system monitoring device) to reset and repeating the above steps until the second difference is in the preset range or the device system can normally run the second firmware in the second partition. The present application calculates the difference between the current time when the device system enters the boot partition and the first time when the device system enters the boot partition last time, thereby realizing the judgment of the success or failure of the device system upgrade.

[0019] In some technical solutions, optionally, based on the device system upgrade failure, the step of controlling the device system to enter the first partition and running the first firmware includes: when the number of times of device system upgrade failure is greater than a second preset threshold, the legality of the first firmware in the first partition is determined; based on the first firmware being legal, the device system is controlled to enter the first partition and run the first firmware, and the rollback flag is cleared, and the second partition is marked; based on the first firmware being illegal, the device system sends a prompt information to the user.

[0020] In the technical solution, based on the device system upgrade failure, the step of controlling the device system to enter the first partition and running the first firmware includes: since the device system upgrade fails, i.e. the device system cannot normally run the second firmware in the second partition, in order to enable the device system to also normally run, it is necessary to control the device system to re-enter the first partition and run the first firmware before the upgrade, i.e. the device system needs to perform a rollback operation. When the device system performs the rollback operation, first, the number of times of device system upgrade failure is recorded, when the number of times is less than a second preset threshold, the device system is controlled to enter the second partition and run the second firmware, i.e. the device system is controlled to try again. If the number of times is greater than the second preset threshold, it is necessary to determine the legality of the first firmware in the first partition, i.e. to judge whether the first firmware in the first partition is complete and can be normally used. When the first firmware is legal, the device system is controlled to enter the first partition and run the original first firmware, and the rollback flag bit is cleared, wherein the rollback flag bit is stored in the user data partition, when it is detected that the device system needs to perform a rollback operation, the rollback flag bit is automatically set, therefore, when the control system enters the first partition and re-runs the original first firmware, i.e. the device system rollback operation is completed, it is necessary to clear the rollback flag bit. It is also necessary to mark the second partition, since the device system cannot run the second firmware in the second partition, it is indicated that the second firmware in the second partition is illegal, therefore, it is necessary to mark the second partition as illegal. When the first firmware is not legal, it is indicated that the device system also cannot enter the first partition to run the first firmware, therefore, it is necessary to send a prompt information to the user, prompting the user that the device system is damaged, please contact the after-sales. The present application determines the legality of the first firmware in the first partition when the device system performs a rollback operation, thereby determining that the rollback operation can be normally run.

[0021] In some technical solutions, optionally, the device system upgrade method further includes: based on the device system upgrade success, receiving a first operation of a user, wherein the first operation is an operation of enabling the device system to perform a version rollback; setting a rollback flag bit and controlling the device system to restart; determining the legality of the first firmware in the first partition; based on the first firmware being legal, controlling the restarted device system to enter the first partition and run the first firmware, and clearing the rollback flag bit.

[0022] In the technical solution, the upgrading method of the device system further comprises: when the user performs the firmware OTA upgrading, it is found that the OTA upgraded firmware does not conform to the user's own usage habits, and the device system continues to use the old firmware. The version rollback operation can be performed on the device system, that is, when the device system is upgraded successfully, the first operation of the user can be received, wherein the first operation is an operation of making the device system perform the version rollback, for example, the user can make the device perform the version rollback operation through a remote controller, an APP (Application), voice, a device entity key, etc. After receiving the first operation, the rollback flag bit of the user data partition is set, and then the device system is controlled to restart. Then the legality of the first firmware in the first partition is determined, that is, whether the first firmware in the first partition is complete and can be normally used is judged. When the first firmware is legal, the device system is controlled to enter the first partition and run the original first firmware, and the rollback flag bit is cleared. When the first firmware is not legal, it means that the device system cannot enter the first partition to run the first firmware, so a prompt information needs to be sent to the user to remind the user of the rollback failure. The present application solves the problem that the user cannot rollback in the related art by receiving the first operation of the user, then controlling the device system to rollback to the first partition and running the first firmware before upgrading, thereby solving the problem that the user cannot rollback in the related art.

[0023] In some technical solutions, the step of setting the rollback flag bit and controlling the device system to restart comprises: determining whether the second firmware in the second partition allows rollback; based on the second firmware allowing rollback, setting the rollback flag bit and controlling the device system to restart.

[0024] In the technical solution, the step of setting the rollback flag bit and controlling the device system to restart comprises: when the user performs the rollback operation, it is necessary to first judge whether the currently running firmware, that is, the second firmware in the second partition, allows rollback, and if not, a sound and light prompt is sent to remind the user. Generally, when the currently running firmware, that is, the second firmware, repairs some fatal problems, for example, repairs the vulnerabilities that seriously affect the device running performance, the user's life and property safety, and increases the anti-attack mode and the like, the device system rollback is prohibited. If the second firmware allows rollback, the rollback flag bit is set and the device system is controlled to restart. By judging whether the currently running firmware allows rollback when performing the rollback operation, the normal operation of the device system is ensured.

[0025] In some technical solutions, the step of determining the legality of the first firmware in the first partition comprises: controlling the restarted device system to enter a boot partition, wherein the boot partition is used to determine whether the device system enters the first partition or the second partition; detecting the state of the rollback flag bit in the boot partition; based on the rollback flag bit being in the set state, the legality of the first firmware in the first partition is determined.

[0026] In the technical solution, the step of determining the legality of the first firmware in the first partition comprises: firstly controlling the device system after reboot to enter a boot partition, wherein the boot partition is the first segment of code loaded after the device system is powered on, and in the code, the device system determines whether to run in the first partition or the second partition according to the data in the firmware information area and the user data area through a series of judgments. Then, the state of the rollback flag bit is detected in the boot partition. If the rollback flag bit is in zero state, it means that the device system does not need to perform rollback operation, and the device system is directly controlled to enter the second partition to run the second firmware. If the rollback flag bit is in set state, it means that the device system needs to perform rollback operation, and therefore the legality of the first firmware in the first partition needs to be determined.

[0027] In some technical solutions, the step of determining the legality of the first firmware in the first partition further comprises: calculating first verification information of the first firmware in the first partition; obtaining second verification information of the stored first firmware; and determining the legality of the first firmware according to the first verification information and the second verification information.

[0028] In the technical solution, the step of determining the legality of the first firmware in the first partition further comprises: firstly calculating first verification information of the first firmware in the first partition, wherein the first verification information comprises length information of the first firmware and a CRC (Cyclic Redundancy Checksum) check code of the first firmware. Then, second verification information of the first firmware previously stored in the firmware information partition is obtained, wherein the second verification information comprises length information previously stored of the first firmware and a CRC check code previously stored of the first firmware. Then, the first verification information and the second verification information are compared. If they are consistent, it means that the first firmware is legal, i.e. the device system can run the first firmware. If they are inconsistent, it means that the first firmware is illegal, i.e. the device system cannot run the first firmware.

[0029] In some technical solutions, the step of upgrading the device system according to the second firmware comprises: writing third verification information of the second firmware into the firmware information partition, and setting the upgrade flag bit, wherein the firmware information partition comprises basic data required when the boot partition is selected; controlling the device system to enter the boot partition and detecting the upgrade flag bit; based on the upgrade flag bit being in set state, calculating fourth verification information of the second firmware in the second partition; based on the fourth verification information being the same as the third verification information, controlling the device system to enter the second partition and run the second firmware, and clearing the upgrade flag bit.

[0030] In the technical solution, the step of upgrading the device system according to the second firmware includes: when the second firmware is stored in the second partition, the third verification information of the second firmware is written into the firmware information partition, and the upgrade flag bit in the firmware information partition is set, wherein the firmware information partition stores basic data required when the boot partition selects the running partition, for example: boot partition startup times, startup time, firmware length in the first or second partition, firmware CRC check code, startup times, software version number, whether to allow rollback, current running partition, upgrade flag bit, startup failure times, and upgrade result data. The third verification information includes length information and CRC check code of the second firmware. Then the device system is controlled to restart and enter the boot partition. When the upgrade flag bit is detected to be in the set state in the boot partition, the fourth verification information of the second firmware in the second partition is calculated, that is, the length information and CRC check code of the second firmware are calculated. Then verification is performed, if the fourth verification information calculated is the same as the third verification information stored before, the verification is passed, that is, the device system is controlled to enter the second partition and run the second firmware, and the upgrade flag bit is cleared. The length information and CRC check code of the second firmware are verified in the application, so that it is ensured that the device system can normally run the second firmware.

[0031] According to a second aspect of the application, an upgrading device of a device system is provided, including: a first determination module, the first determination module is used for determining the first partition according to the first firmware currently running in the device system, wherein the first firmware is stored in the first partition; a first storage module, the first storage module is used for storing the second firmware to the second partition; a first control module, the first control module is used for upgrading the device system according to the second firmware; a judgment module, the judgment module is used for judging whether the upgrading of the device system is successful; a second control module, the second control module is used for controlling the device system to enter the first partition and run the first firmware based on the failure of the upgrading of the device system.

[0032] The device system upgrading apparatus provided by the application mainly comprises a first determining module, a first storage module, a first control module, a judging module and a second control module. The first determining module determines a first partition according to a first firmware currently running in the device system, wherein the first firmware is stored in the first partition, that is, the first partition in which the device system runs before upgrading is determined, and then the second firmware is stored in a second partition by the first storage module, wherein the second partition can store other firmware or no firmware, and the second firmware is the firmware after upgrading, that is, the firmware after upgrading is stored in the non-current running partition of the device system. Then the first control module upgrades the device system according to the second firmware, that is, controls the device system to switch the running partition from the first partition before upgrading to the second partition, so that the device system runs the second firmware in the second partition, thereby completing the upgrading of the device system. Next, the judging module judges whether the upgrading of the device system is successful, that is, determines whether the device system runs the second firmware smoothly, if the device system runs the second firmware smoothly, that is, can run normally, it means that the upgrading is successful, and the device system can continue to run the second firmware in the second partition. If the device system cannot run normally when running the second firmware, it means that the upgrading fails, and then the second control module needs to control the device system to return to the first partition and run the first firmware before upgrading, thereby realizing the self-recovery of the device system. The application stores the upgrading firmware in the second partition which is not currently running in the device system, and then controls the device system to switch from the first partition to the second partition to run, thereby realizing the upgrading of the device system. Meanwhile, when the device system fails to upgrade, the device system is controlled to switch to the first partition again to run the original first firmware, thereby solving the problem that the device system cannot self-recover after failing to upgrade in the related art.

[0033] According to a third aspect of the application, an electronic device is provided, comprising a memory, a processor and a computer program stored in the memory and executable in the processor, and the processor implements the steps of the device system upgrading method according to any one of the above aspects when executing the computer program.

[0034] The electronic device provided by the application implements the steps of the device system upgrading method, and can achieve the technical effects of any one of the above technical solutions, which will not be described here.

[0035] According to a fourth aspect of the application, a storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the steps of the device system upgrading method according to any one of the above aspects.

[0036] The storage medium provided by the application implements the steps of the device system upgrading method, and can achieve the technical effects of any one of the above technical solutions, which will not be described here.

[0037] Additional aspects and advantages of the present application will become apparent from the following description, which is by way of illustration. BRIEF DESCRIPTION OF DRAWINGS

[0038] The above and / or additional aspects and advantages of the present application will become apparent and be readily appreciated from the following description, taken in conjunction with the accompanying drawings, in which:

[0039] FIG. 1 shows one of flow diagrams of a method for upgrading a device system according to an embodiment of the present application;

[0040] FIG. 2 shows one of flow diagrams of a step of determining whether the upgrade of the device system is successful according to an embodiment of the present application;

[0041] FIG. 3 shows one of flow diagrams of a step of controlling the device system to enter a first partition and run a first firmware based on the upgrade of the device system failing according to an embodiment of the present application;

[0042] FIG. 4 shows another of flow diagrams of a step of determining whether the upgrade of the device system is successful according to an embodiment of the present application;

[0043] FIG. 5 shows another of flow diagrams of a step of controlling the device system to enter a first partition and run a first firmware based on the upgrade of the device system failing according to an embodiment of the present application;

[0044] FIG. 6 shows another of flow diagrams of a method for upgrading a device system according to an embodiment of the present application;

[0045] FIG. 7 shows one of flow diagrams of a step of setting a rollback flag and controlling the device system to restart according to an embodiment of the present application;

[0046] FIG. 8 shows one of flow diagrams of a step of determining the legality of the first firmware in the first partition according to an embodiment of the present application;

[0047] FIG. 9 shows another of flow diagrams of a step of determining the legality of the first firmware in the first partition according to an embodiment of the present application;

[0048] FIG. 10 shows one of flow diagrams of a step of upgrading the device system according to the second firmware according to an embodiment of the present application;

[0049] FIG. 11 shows a schematic block diagram of a device according to an embodiment of the present application;

[0050] FIG. 12 shows a schematic diagram of a user rollback system method according to an embodiment of the present application;

[0051] FIG. 13 shows a schematic diagram of a device system self-recovery method according to an embodiment of the present application;

[0052] FIG. 14 shows a schematic diagram of a device system self-recovery method according to an embodiment of the present application;

[0053] FIG. 15 shows a schematic block diagram of an upgrading apparatus of a device system according to an embodiment of the present application;

[0054] FIG. 16 shows a schematic block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to enable a more complete understanding of the above-mentioned objects, features and advantages of the present application, the present application will be described in further detail below with reference to the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0056] In the following description, a large number of specific details are set forth in order to facilitate a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and therefore the scope of protection of the present application is not limited to the specific embodiments disclosed below.

[0057] FIG. 1 shows a schematic flow diagram of an upgrading method of a device system according to an embodiment of the present application. The method comprises:

[0058] Step 102: determining a first partition according to a first firmware currently running by the device system, wherein the first firmware is stored in the first partition;

[0059] Step 104: storing a second firmware into a second partition;

[0060] Step 106: upgrading the device system according to the second firmware;

[0061] Step 108: determining whether the upgrading of the device system is successful;

[0062] Step 110: based on the upgrading of the device system failing, controlling the device system to enter the first partition and run the first firmware.

[0063] The device system upgrading method provided in the application is mainly used for upgrading the device through OTA (Over The Air, over the air) technology. The device system upgrading method mainly comprises the following steps. First, a first partition is determined according to a first firmware currently running in the device system, wherein the first firmware is stored in the first partition, that is, it is determined that the device system runs in which partition before upgrading, and then the partition is taken as the first partition. Then, a second firmware is stored in a second partition, wherein the second partition can store other firmware or can have no firmware, and the second firmware is the firmware after upgrading, that is, the firmware after upgrading is stored in the non-current running partition of the device system. Then, the device system is upgraded according to the second firmware, that is, the running partition of the device system is switched, from the first partition before upgrading to the second partition, so that the device system runs the second firmware in the second partition, thereby completing the upgrading of the device system. Next, it is judged whether the upgrading of the device system is successful, that is, it is determined whether the device system runs the second firmware smoothly. If the device system runs the second firmware smoothly, that is, it can run normally, it is indicated that the upgrading is successful, and the device system can continue to run the second firmware in the second partition. If the device system cannot run normally when running the second firmware, it is indicated that the upgrading fails, and then the device system is controlled to return to the first partition to run the first firmware before upgrading, thereby realizing the self-recovery of the device system. In the application, the firmware after upgrading is stored in the second partition which is not currently running in the device system, and then the device system is controlled to switch from the first partition to the second partition to run, thereby realizing the upgrading of the device system. Meanwhile, when the device system upgrading fails, the device system is controlled to switch to the first partition again to run the original first firmware, thereby solving the problem that the device system cannot be self-recovered after the upgrading fails in the related art.

[0064] FIG. 2 shows one of the flow diagrams of the step of judging whether the upgrading of the device system is successful in the device system upgrading method of one embodiment of the application. The step of judging whether the upgrading of the device system is successful comprises the following steps.

[0065] Step 202: The device system is controlled to enter a boot partition, and the running number of the boot partition is increased by one to obtain a first running number, wherein the boot partition is used to determine whether the device system enters the first partition or the second partition.

[0066] Step 204: A second running number of the second partition is obtained.

[0067] Step 206: A first difference between the first running number and the second running number is determined.

[0068] Step 208: If the first difference is greater than a first preset threshold, it is judged that the upgrading of the device system fails.

[0069] In the embodiment, the step of judging whether the upgrade of the device system is successful comprises: recording the number of times that the device system enters the boot partition each time the device system enters the boot partition. Similarly, the number of times that the device system enters the first partition and the second partition is also recorded after the device system normally runs the firmware. Therefore, when the device system completes the upgrade, the device system is restarted, and the device system first enters the boot partition, and the number of times that the device system enters the boot partition is incremented by one, thereby obtaining the first running number. The boot partition is the first code loaded after the device system is powered on, and in the code, the device system determines whether to run in the first partition or the second partition according to the data in the firmware information area and the user data area. Then the second running number of the second partition, i.e., the number of times that the device system enters the second partition, is obtained. Since the second firmware in the second partition is the upgraded firmware at this time, the device system needs to enter the second partition to run the second firmware, so the second running number of the second partition needs to be obtained. Then the first running number and the second running number are compared to determine the first difference between the first running number and the second running number. When the first difference is greater than a first preset threshold, it means that the device system cannot normally run the second firmware in the second partition, so the device system does not need to be controlled to enter the second partition, and the device system upgrade is directly judged to fail. When the first difference is less than the first preset threshold, the device system is normally controlled to enter the second partition. If the device system can normally run the second firmware in the second partition, the second running number of the second partition is incremented by one, and then the system is normally controlled to run. If the device system cannot normally run the second firmware in the second partition, the device system is restarted and the above steps are repeated until the first difference is greater than the first preset threshold or the device system can normally run the second firmware in the second partition. The present application determines the difference between the number of times that the device system enters the boot partition and the number of times that the device system enters the second partition, thereby realizing the judgment of the success or failure of the device system upgrade.

[0070] FIG. 3 shows one of the flow diagrams of the step of controlling the device system to enter the first partition and run the first firmware based on the failure of the device system upgrade in the upgrade method of the device system of an embodiment of the present application; wherein the step of controlling the device system to enter the first partition and run the first firmware based on the failure of the device system upgrade comprises:

[0071] Step 302: determining the legality of the first firmware in the first partition;

[0072] Step 304: based on the legality of the first firmware, controlling the device system to enter the first partition and run the first firmware, clearing the rollback flag, and marking the second partition;

[0073] Step 306: based on the first firmware being illegal, the control device system sends a prompt information to the user.

[0074] In this embodiment, based on the device system upgrade failure, the step of controlling the device system to enter the first partition and running the first firmware includes: since the device system upgrade failure, i.e. the device system cannot normally run the second firmware in the second partition, in order to enable the device system to also be able to normally run, it is necessary to control the device system to re-enter the first partition and run the first firmware before the upgrade, i.e. the device system needs to perform a rollback operation. When the device system performs the rollback operation, it is necessary to first determine the legality of the first firmware in the first partition, i.e. to judge whether the first firmware in the first partition is complete and can be normally used. When the first firmware is legal, the control device system enters the first partition and runs the original first firmware, and the rollback flag bit is cleared, wherein the rollback flag bit is stored in the user data partition, and when it is detected that the device system needs to perform a rollback operation, the rollback flag bit is automatically set. Therefore, when the control system enters the first partition and re-runs the original first firmware, i.e. the device system rollback operation is completed, it is necessary to clear the rollback flag bit. It is also necessary to mark the second partition. Since the device system cannot run the second firmware in the second partition, it means that the second firmware in the second partition is illegal, so it is necessary to mark the second partition as illegal. When the first firmware is illegal, it means that the device system cannot enter the first partition to run the first firmware, so it is necessary to send a prompt information to the user, reminding the user that the device system has been damaged, please contact the after-sales. The present application determines the legality of the first firmware in the first partition when the device system performs the rollback operation, thereby determining that the rollback operation can be normally run.

[0075] FIG. 4 shows a flowchart of the step of judging whether the device system upgrade is successful in the device system upgrade method of one embodiment of the present application; wherein the step of judging whether the device system upgrade is successful includes:

[0076] Step 402: controlling the device system to enter the boot partition and recording the current time, wherein the boot partition is used to determine whether the device system enters the first partition or the second partition;

[0077] Step 404: obtaining the first time when the device system enters the boot partition last time;

[0078] Step 406: determining the second difference between the current time and the first time;

[0079] Step 408: based on the second difference being in the preset range, it is judged that the device system upgrade failure.

[0080] In the embodiment, the step of judging whether the upgrade of the device system is successful comprises: when the firmware fails to run, the device system is periodically restarted due to the watchdog (embedded system monitoring device). Therefore, when the device system enters the boot partition each time, the current time is recorded. After the device system is upgraded and restarted, the device system is first controlled to enter the boot partition, and the time when the device system enters the boot partition is recorded. The boot partition is the first code loaded after the device system is powered on, and in the code, the device system determines whether to run in the first partition or the second partition according to the data in the firmware information area and the user data area. Then, the first time when the device system enters the boot partition last time is obtained. Then, the first time and the current time are compared to determine a second difference between the current time and the first time. When the second difference is in a preset range, which is determined by the watchdog (embedded system monitoring device), it is indicated that the device system cannot normally run the second firmware in the second partition, so the device system does not need to enter the second partition, and the device system is directly judged to fail to upgrade. When the second difference is not in the preset range, the device system is controlled to normally enter the second partition. If the device system can normally run the second firmware in the second partition, the system is controlled to normally run. If the device system cannot normally run the second firmware in the second partition, the device system is restarted by controlling the watchdog (embedded system monitoring device) to reset, and the above steps are repeated until the second difference is in the preset range or the device system can normally run the second firmware in the second partition. The present application determines the success or failure of the device system upgrade by calculating the difference between the current time when the device system enters the boot partition and the first time when the device system enters the boot partition last time.

[0081] FIG. 5 shows a flowchart of the step of controlling the device system to enter the first partition and run the first firmware based on the failure of the device system upgrade in the device system upgrade method of the embodiment of the present application; wherein the step of controlling the device system to enter the first partition and run the first firmware based on the failure of the device system upgrade comprises:

[0082] Step 502: based on the number of times of the failure of the device system upgrade being greater than a second preset threshold, the legality of the first firmware in the first partition is determined;

[0083] Step 504: based on the first firmware being legal, the device system is controlled to enter the first partition and run the first firmware, the rollback flag is cleared, and the second partition is marked;

[0084] Step 506: based on the first firmware being illegal, the device system sends a prompt information to the user.

[0085] In the embodiment, based on the device system upgrade failure, the step of controlling the device system to enter the first partition and running the first firmware includes: since the device system upgrade failure, i.e. the device system cannot normally run the second firmware in the second partition, in order to enable the device system to also normally run, it is necessary to control the device system to re-enter the first partition and run the first firmware before the upgrade, i.e. the device system needs to perform a rollback operation. When the device system performs the rollback operation, first, the number of times of device system upgrade failure is recorded, when the number of times is less than a second preset threshold, the device system is controlled to enter the second partition and run the second firmware, i.e. the device system is controlled to try again. If the number of times is greater than the second preset threshold, it is necessary to determine the legality of the first firmware in the first partition, i.e. to determine whether the first firmware in the first partition is complete and can be normally used. When the first firmware is legal, the device system is controlled to enter the first partition and run the original first firmware, and the rollback flag bit is cleared, wherein the rollback flag bit is stored in the user data partition, when it is detected that the device system needs to perform a rollback operation, the rollback flag bit is automatically set, thus when the control system enters the first partition and runs the original first firmware, i.e. the device system rollback operation is completed, the rollback flag bit needs to be cleared. At the same time, the second partition also needs to be marked, since the device system cannot run the second firmware in the second partition, it means that the second firmware in the second partition is illegal, thus the second partition needs to be marked as illegal. When the first firmware is not legal, it means that the device system also cannot enter the first partition to run the first firmware, thus a prompt information needs to be sent to the user, prompting the user that the device system is damaged, please contact the after-sales. The present application determines the legality of the first firmware in the first partition when the device system performs a rollback operation, thus determining that the rollback operation can be normally run.

[0086] Fig. 6 shows a flowchart of the device system upgrade method of the embodiment of the present application, wherein the device system upgrade method further includes:

[0087] Step 602: based on the device system upgrade success, receiving a first operation of the user, wherein the first operation is an operation of making the device system perform a version rollback;

[0088] Step 604: setting the rollback flag bit and controlling the device system to restart;

[0089] Step 606: determining the legality of the first firmware in the first partition;

[0090] Step 608: based on the first firmware being legal, controlling the restarted device system to enter the first partition and run the first firmware, and clearing the rollback flag bit.

[0091] In this embodiment, the upgrading method of the device system further comprises: when the user performs the firmware OTA upgrading, it is found that the OTA upgraded firmware does not conform to the user's own usage habits, and the device system continues to use the old firmware. The device system can be subjected to a version rollback operation, that is, when the device system is upgraded successfully, a first operation of the user can be received, wherein the first operation is an operation of making the device system perform a version rollback, for example, the user can make the device perform a version rollback operation through a remote controller, an APP (Application), voice, a device entity key, etc. After receiving the first operation, a rollback flag bit of the user data partition is set, and then the device system is controlled to restart. Then, the legality of the first firmware in the first partition is determined, that is, whether the first firmware in the first partition is complete and can be normally used is judged. When the first firmware is legal, the device system is controlled to enter the first partition and run the original first firmware, and the rollback flag bit is cleared. When the first firmware is not legal, it is indicated that the device system also cannot enter the first partition to run the first firmware, and therefore a prompt information needs to be sent to the user to remind the user of the rollback failure. The present application solves the problem that the user cannot rollback in the related art by receiving the first operation of the user, then controlling the device system to rollback to the first partition and run the first firmware before upgrading, thereby solving the problem that the user cannot rollback after upgrading in the related art.

[0092] FIG. 7 shows a flowchart of the step of setting the rollback flag bit and controlling the device system to restart in the upgrading method of the device system of one embodiment of the present application; wherein the step of setting the rollback flag bit and controlling the device system to restart comprises:

[0093] Step 702: determining whether the second firmware in the second partition allows rollback;

[0094] Step 704: based on the second firmware allowing rollback, the rollback flag bit is set, and the device system is controlled to restart.

[0095] In this embodiment, the step of setting the rollback flag bit and controlling the device system to restart comprises: when the user performs a rollback operation, it is necessary to first determine whether the currently running firmware, that is, the second firmware in the second partition, allows rollback, and if not, a sound and light prompt is sent to remind the user. Generally, when the currently running firmware, that is, the second firmware, repairs some fatal problems, for example, repairs vulnerabilities that seriously affect the performance of the device, the safety of the user's life and property, and increases the attack prevention mode and the like, the device system is prohibited from rollback. If the second firmware allows rollback, the rollback flag bit is set, and the device system is controlled to restart. By judging whether the currently running firmware allows rollback when performing a rollback operation, the normal operation of the device system is ensured.

[0096] Figure 8 shows one of the flow diagrams of the step of determining the legality of the first firmware in the first partition in the upgrading method of the device system of one embodiment of the present application; wherein the step of determining the legality of the first firmware in the first partition comprises:

[0097] Step 802: controlling the restarted device system to enter the booting partition, wherein the booting partition is used to decide whether the device system enters the first partition or the second partition;

[0098] Step 804: detecting the state of the rollback flag in the booting partition;

[0099] Step 806: based on the rollback flag being in the set state, determining the legality of the first firmware in the first partition.

[0100] In this embodiment, the step of determining the legality of the first firmware in the first partition comprises: firstly, controlling the restarted device system to enter the booting partition, wherein the booting partition is the first piece of code loaded after the device system is powered on, and in this code, the device system decides whether to run in the first partition or the second partition according to the data in the firmware information area and the user data area through a series of judgments. Then, detecting the state of the rollback flag in the booting partition, if the rollback flag is in the zero state, it means that the device system does not need to perform rollback operation, and then directly controlling the device system to enter the second partition to run the second firmware. If the rollback flag is in the set state, it means that the device system needs to perform rollback operation, and thus the legality of the first firmware in the first partition needs to be determined.

[0101] Figure 9 shows another of the flow diagrams of the step of determining the legality of the first firmware in the first partition in the upgrading method of the device system of one embodiment of the present application; wherein the step of determining the legality of the first firmware in the first partition further comprises:

[0102] Step 902: calculating the first verification information of the first firmware in the first partition;

[0103] Step 904: obtaining the second verification information of the stored first firmware;

[0104] Step 906: determining the legality of the first firmware according to the first verification information and the second verification information.

[0105] In the embodiment, the step of determining the legality of the first firmware in the first partition further comprises: firstly calculating first verification information of the first firmware in the first partition, wherein the first verification information comprises length information of the first firmware and a CRC check code of the first firmware. Then, second verification information of the first firmware previously stored in the firmware information partition is acquired, wherein the second verification information comprises length information of the first firmware previously stored and a CRC check code of the first firmware previously stored. Then, the first verification information and the second verification information are compared. If the two are consistent, it indicates that the first firmware is legal, i.e. the device system can run the first firmware. If the two are inconsistent, it indicates that the first firmware is illegal, i.e. the device system cannot run the first firmware.

[0106] FIG. 10 shows a flowchart of the step of upgrading the device system according to the second firmware in the upgrading method of the device system of an embodiment of the present application. The step of upgrading the device system according to the second firmware comprises:

[0107] Step 1002: writing third verification information of the second firmware into the firmware information partition, and setting the upgrade flag bit, wherein the firmware information partition comprises basic data required when the boot partition selects the partition;

[0108] Step 1004: controlling the device system to enter the boot partition, and detecting the upgrade flag bit;

[0109] Step 1006: based on the upgrade flag bit being in the set state, calculating fourth verification information of the second firmware in the second partition;

[0110] Step 1008: based on the fourth verification information being the same as the third verification information, controlling the device system to enter the second partition, running the second firmware, and clearing the upgrade flag bit.

[0111] In this embodiment, the step of upgrading the device system according to the second firmware includes: when the second firmware is stored in the second partition, writing third verification information of the second firmware into the firmware information partition, and setting the upgrade flag bit in the firmware information partition, wherein the firmware information partition stores basic data required when the boot partition selects the running partition, such as boot partition startup times, startup time, firmware length in the first or second partition, firmware CRC checksum, startup times, software version number, whether to allow rollback, current running partition, upgrade flag bit, startup failure times, and upgrade result data. The third verification information includes length information and CRC checksum of the second firmware. Then the device system is controlled to restart and enter the boot partition. When the upgrade flag bit is detected to be in the set state in the boot partition, the fourth verification information of the second firmware in the second partition is calculated, i.e., the length information and CRC checksum of the second firmware are calculated. Then verification is performed, and if the fourth verification information calculated is the same as the third verification information stored before, the verification passes, i.e., the device system is controlled to enter the second partition and run the second firmware, and the upgrade flag bit is cleared. The length information and CRC checksum of the second firmware are verified in the application, so that it is ensured that the device system can normally run the second firmware.

[0112] Fig. 11 shows a schematic block diagram of a device according to an embodiment of the application; wherein the device 1100 has multiple partitions, including: a boot partition 1102, a first partition 1104, a second partition 1106, a firmware information partition 1108, and a user data partition 1110. The boot partition 1102 is the first segment of code loaded after the device system is powered on, and in the code, the device system determines whether to run in the first partition 1104 or the second partition 1106 according to data in the firmware information partition 1108 and the user data partition 1110 through a series of judgments; the first partition 1104 and the second partition 1106 are partitions storing firmware, and the running logic of the device system is implemented by the code of the partition, and the object of OTA upgrade is the firmware of the partition. The firmware information partition 1108 stores basic data required when the boot partition 1102 selects the running partition, such as length information of the firmware and CRC (Cyclic Redundancy Checksum, cyclic redundancy checksum) checksum of the firmware. The user data partition 1110 mainly stores data that needs to be powered off and saved during user use, such as device running parameters, device unique code, rollback flag bit, and the like.

[0113] Fig. 12 shows a schematic diagram of a user rollback system method according to an embodiment of the application; wherein the user rollback system method includes:

[0114] Step 1202: the user performs a feature operation to make the device system rollback;

[0115] Step 1204: judging whether to allow rollback; if the result is no, executing step 1206; if the result is yes, executing step 1208;

[0116] Step 1206: prompting user that rollback is not allowed;

[0117] Step 1208: setting system rollback flag bit and soft resetting the device;

[0118] Step 1210: entering boot partition;

[0119] Step 1212: judging whether system rollback flag bit is set; if the result is no, executing step 1220; if the result is yes, executing step 1214;

[0120] Step 1214: judging whether the firmware of non-current running partition is legal; if the result is yes, executing step 1216; if the result is no, executing step 1218;

[0121] Step 1216: switching running partition and clearing relevant flag bit;

[0122] Step 1218: prompting user that rollback fails;

[0123] Step 1220: jumping to corresponding running partition;

[0124] Step 1222: ending.

[0125] As shown in FIG. 12, when the user performs firmware OTA upgrade, it is found that the OTA upgraded firmware does not conform to the user's own habits, and the system continues to use the old firmware. The device system can be subjected to version rollback operation, and the user can let the device system perform version rollback operation through a remote controller, an APP, voice, a device entity key, etc. After receiving the corresponding command, the device system first judges whether the current running firmware, i.e., the second firmware, allows rollback. If the current firmware does not allow rollback, the user is reminded through sound and light prompts, APP push, etc. If the current firmware allows rollback, the rollback flag bit is set and the device is automatically restarted. After the device is restarted, it enters the boot partition. After detecting that the rollback flag bit is in the set state, the legality of the firmware of the non-current running partition, i.e., the first firmware of the first partition, is checked. If the firmware of the non-current running partition is legal, the running partition is switched, i.e., the device system is controlled to switch from running the second firmware in the second partition to running the first firmware in the first partition. If the firmware of the non-current running partition is not legal, the running partition is not changed and the user is prompted that the rollback fails. Finally, the flag bit is cleared and the device system is controlled to jump to the corresponding partition, i.e., enter the first partition or the second partition. The method for judging the legality of the firmware is to first judge whether the firmware length meets the requirements; secondly, the CRC check code of the firmware is calculated and compared with the CRC check code of the corresponding firmware stored in the firmware information partition. The calculated CRC check code is required to be consistent with the CRC check code in the firmware information partition. Then it is indicated that the firmware is legal.

[0126] FIG. 13 shows one of the schematic diagrams of the device system self-recovery method of one embodiment of the present application; wherein the device system self-recovery method comprises:

[0127] Step 1302: the device is started;

[0128] Step 1304: enter the boot partition, and the number of times of entering the boot partition is +1;

[0129] Step 1306: obtain the running number of the running partition;

[0130] Step 1308: calculate the difference N between the running number of the boot partition and the running number of the running partition;

[0131] Step 1310: judge whether N> a certain threshold value; if the result is yes, execute step 1312; if the result is no, execute step 1318;

[0132] Step 1312: judge whether the firmware of the non-current running partition is legal; if the result is no, execute step 1314; if the result is yes, execute step 1316;

[0133] Step 1314: remind the user that the device is damaged, please contact the after-sales service;

[0134] Step 1316: switch the running partition, and clear the related flag bit, indicating that the current running partition is illegal;

[0135] Step 1318: jump to the corresponding running partition;

[0136] Step 1320: determine whether the running partition is entered normally; if the result is no, execute step 1302; if the result is yes, execute step 1322;

[0137] Step 1322: the number of times of entering the running partition + 1;

[0138] Step 1324: the system runs normally.

[0139] As shown in FIG. 13, when the device is powered on or restarted, the device system will first enter the boot partition. After entering the boot partition, the device system will enter the boot partition count value + 1. Then get the running times of the running partition, and calculate the difference N between the boot partition running times and the running partition running times. If the difference N is greater than a certain threshold, it is determined that the device system startup / upgrade fails. Then the device system will perform a rollback operation, that is, mark the current running partition as faulty, and detect the legality of the non-current running partition firmware by calculating the check code, judging the firmware length, etc. If the non-current running partition firmware is legal, switch the non-current running partition to the target running partition and clear the related flag bit, and mark the current running partition as illegal partition; otherwise, remind the user that the device is damaged, please contact the after-sales as soon as possible. If the difference N is less than or equal to a certain threshold, the running partition is not changed, and the device system jumps to the original partition to continue running. When the system normally enters the running partition, the system will enter the running partition count value + 1; when the system cannot normally enter the running partition, it will be reset and restarted, and the process will be repeated.

[0140] FIG. 14 shows a schematic diagram of a device system self-recovery method according to an embodiment of the present application; wherein the device system self-recovery method further comprises:

[0141] Step 1402: the device starts;

[0142] Step 1404: enter the boot partition and record the current time;

[0143] Step 1406: get the time of the last time entering the boot partition;

[0144] Step 1408: calculate the time difference X of entering the boot partition twice;

[0145] Step 1410: determine whether X≈watchdog reset time; if the result is yes, execute step 1412; if the result is no, execute step 1422;

[0146] Step 1412: running failure times (Y) + 1;

[0147] Step 1414: judging whether the number of failures Y is greater than a certain threshold value; if the result is yes, executing step 1416; if the result is no, executing step 1422;

[0148] Step 1416: judging whether the non-current running partition firmware is legal; if the result is yes, executing step 1420; if the result is no, executing step 1418;

[0149] Step 1418: reminding the user that the device is damaged and contacting the after-sales service;

[0150] Step 1420: switching the running partition and clearing the related flag, marking the current running partition illegal;

[0151] Step 1422: jumping to the corresponding running partition;

[0152] Step 1424: judging whether the running partition is entered normally; if the result is yes, executing step 1426; if the result is no, executing step 1428;

[0153] Step 1426: the system is running normally;

[0154] Step 1428: the watchdog is reset.

[0155] As shown in FIG. 14, when the device is powered on or restarted, the system will first enter the boot partition. After entering the boot partition, the system will record the time of entering the boot partition currently. Then the time of entering the boot partition last time is obtained, and the time difference X of entering the boot partition twice is calculated. If the time difference X is equal to the watchdog reset time, it is judged that the startup / upgrade fails, and the number of startup / upgrade failures is recorded, that is, the number of device startup failures (Y) is +1, and whether the number of device startup failures Y is greater than a certain threshold value is judged. If the number of device startup failures Y is greater than a certain threshold value, the device system will perform a rollback operation, that is, marking the current running partition as faulty, and detecting the legality of the non-current running partition firmware by calculating the check code, judging the firmware length, etc. If the non-current running partition firmware is legal, the non-current running partition is switched to the target running partition and the related flag bit is cleared, and the current running partition is marked as an illegal partition; otherwise, the user is reminded that the device is damaged and the after-sales service should be contacted as soon as possible. If the number of device startup failures Y is less than or equal to a certain threshold value, the running partition is not changed, and the system jumps to the original partition to continue running. When the system cannot normally enter the running partition, the watchdog is reset and restarted, and the process is repeated.

[0156] Meanwhile, if the device system still cannot run normally after the self-recovery method of FIG. 13 or FIG. 14 is performed, for example, the current running partition is the first partition, the device system determines that the starting / upgrade fails, and switches the running partition to the second partition, and after switching to the second partition, it is still determined that the starting / upgrade fails, then a sound and light prompt is sent to remind the user that the device is damaged and should contact the after-sales service as soon as possible.

[0157] FIG. 15 shows a schematic block diagram of an upgrade device of a device system according to an embodiment of the present application, wherein the upgrade device 150 of the device system comprises:

[0158] a first determination module 1502, configured to determine the first partition according to a first firmware currently running in the device system, wherein the first firmware is stored in the first partition;

[0159] a first storage module 1504, configured to store a second firmware to the second partition;

[0160] a first control module 1506, configured to upgrade the device system according to the second firmware;

[0161] a judgment module 1508, configured to judge whether the upgrade of the device system is successful;

[0162] a second control module 1510, configured to control the device system to enter the first partition and run the first firmware based on the failure of the upgrade of the device system.

[0163] The upgrading device 150 of the device system provided in the application mainly comprises a first determining module 1502, a first storage module 1504, a first control module 1506, a judging module 1508 and a second control module 1510. First, the first determining module 1502 determines a first partition according to a first firmware currently running in the device system, wherein the first firmware is stored in the first partition, that is, it is determined that the device system runs in which partition before upgrading, and then the partition is taken as the first partition. Then, the first storage module 1504 stores a second firmware in a second partition, wherein the second partition can store other firmwares or no firmware, and the second firmware is the firmware after upgrading, that is, the firmware after upgrading is stored in the non-current running partition of the device system. Then, the first control module 1506 upgrades the device system according to the second firmware, that is, controls the device system to switch the running partition from the first partition before upgrading to the second partition, so that the device system runs the second firmware in the second partition, thereby completing the upgrading of the device system. Next, the judging module 1508 judges whether the upgrading of the device system is successful, that is, it is determined whether the device system runs the second firmware smoothly. If the device system runs the second firmware smoothly, that is, it can run normally, it means that the upgrading is successful, and the device system can continue to run the second firmware in the second partition. If the device system cannot run normally when running the second firmware, it means that the upgrading fails, and then the second control module 1510 needs to control the device system to return to the first partition and run the first firmware before upgrading, thereby realizing the self-recovery of the device system. The application stores the upgrading firmware in the second partition which is not currently running in the device system, and then controls the device system to switch from the first partition to the second partition to run, thereby realizing the upgrading of the device system. At the same time, when the device system fails to upgrade, the device system is controlled to switch to the first partition again to run the original first firmware, thereby solving the problem that the device system cannot self-recover after the upgrading fails in the related art.

[0164] In some embodiments, optionally, the judging module 1508 is configured to control the device system to enter a booting partition, and add one to the running times of the booting partition to obtain a first running time, wherein the booting partition is used to determine whether the device system enters the first partition or the second partition; obtain a second running time of the second partition; determine a first difference between the first running time and the second running time; and based on the first difference being greater than a first preset threshold, judge that the device system fails to upgrade.

[0165] In this embodiment, the number of times the device system enters the booting partition is recorded each time the device system enters the booting partition. Similarly, the number of times the device system enters the first partition and the second partition is recorded after the device system normally runs the firmware. Therefore, when the device system completes the upgrade, the device system is restarted, and the judging module 1508 controls the device system to enter the booting partition, and the number of times the device system enters the booting partition is increased by one, thereby obtaining the first running number. The booting partition is the first code loaded after the device system is powered on, and in the code, the device system determines whether to run in the first partition or the second partition according to the data in the firmware information area and the user data area through a series of judgments. Then the second running number of the second partition, i.e., the number of times the device system enters the second partition, is obtained. Since the second firmware in the second partition is the upgraded firmware at this time, the device system needs to enter the second partition to run the second firmware, so the second running number of the second partition needs to be obtained. Then the first running number and the second running number are compared to determine the first difference between the first running number and the second running number. When the first difference is greater than the first preset threshold, it indicates that the device system cannot normally run the second firmware in the second partition, so the device system does not need to be controlled to enter the second partition, and the device system upgrade is directly determined to fail. When the first difference is less than the first preset threshold, the device system is normally controlled to enter the second partition. If the device system can normally run the second firmware in the second partition, the second running number of the second partition is increased by one, and then the system is normally controlled to run. If the device system cannot normally run the second firmware in the second partition, the device system is restarted and the above steps are repeated until the first difference is greater than the first preset threshold or the device system can normally run the second firmware in the second partition. The present application determines the difference between the number of times the device system enters the booting partition and the number of times the device system enters the second partition, thereby determining whether the device system upgrade succeeds or fails.

[0166] In some embodiments, optionally, the second control module 1510 is configured to determine the legality of the first firmware in the first partition; based on the legality of the first firmware, the device system is controlled to enter the first partition and run the first firmware, the rollback flag is cleared, and the second partition is marked; based on the illegality of the first firmware, the device system is controlled to send a prompt information to the user.

[0167] In the embodiment, since the device system fails in the system upgrade, i.e. the device system cannot normally run the second firmware in the second partition, in order to enable the device system to also normally run, it is required to control the device system to re-enter the first partition and run the first firmware before the upgrade, i.e. the device system needs to perform a rollback operation. When the device system performs the rollback operation, the second control module 1510 needs to first determine the legality of the first firmware in the first partition, i.e. to judge whether the first firmware in the first partition is complete and can be normally used. When the first firmware is legal, the device system is controlled to enter the first partition and run the original first firmware, and the rollback flag bit is cleared, wherein the rollback flag bit is stored in the user data partition, and when it is detected that the device system needs to perform the rollback operation, the rollback flag bit is automatically set. Therefore, when the control system enters the first partition and re-runs the original first firmware, i.e. the device system rollback operation is completed, the rollback flag bit needs to be cleared. At the same time, the second partition also needs to be marked. Since the device system cannot run the second firmware in the second partition, it is indicated that the second firmware in the second partition is illegal, and therefore the second partition needs to be marked as illegal. When the first firmware is not legal, it is indicated that the device system also cannot enter the first partition to run the first firmware, and therefore a prompt information is required to be sent to the user, prompting the user that the device system is damaged, please contact the after-sales. The present application determines the legality of the first firmware in the first partition when the device system performs the rollback operation, thereby determining that the rollback operation can be normally run.

[0168] In some embodiments, optionally, the judging module 1508 is further configured to control the device system to enter a booting partition and record a current time, wherein the booting partition is used to determine whether the device system enters the first partition or the second partition; acquire a first time when the device system last enters the booting partition; determine a second difference between the current time and the first time; and when the second difference is in a preset range, judge that the device system fails in the system upgrade.

[0169] In this embodiment, when the firmware fails to run after the device system enters the running partition, the device system is periodically restarted due to the watchdog (embedded system monitoring device). Therefore, the current time is recorded each time the device system enters the boot partition. After the device system is upgraded and restarted, the judgment module 1508 first controls the device system to enter the boot partition and records the time when the device system enters the boot partition. The boot partition is the first code loaded after the device system is powered on, and in this code, the device system determines whether to run in the first partition or the second partition according to the data in the firmware information area and the user data area. Then the first time when the device system enters the boot partition last time is obtained. Then the first time and the current time are compared to determine the second difference between the current time and the first time. When the second difference is in the preset range, which is determined by the watchdog (embedded system monitoring device) time, it means that the device system cannot normally run the second firmware in the second partition, so the device system does not need to enter the second partition, and the device system upgrade failure is directly determined. When the second difference is not in the preset range, the device system is controlled to normally enter the second partition. If the device system can normally run the second firmware in the second partition, the system is controlled to run normally. If the device system cannot normally run the second firmware in the second partition, the device system is restarted by controlling the watchdog (embedded system monitoring device) to reset and repeating the above steps until the second difference is in the preset range or the device system can normally run the second firmware in the second partition. The present application calculates the difference between the current time when the device system enters the boot partition and the first time when the device system enters the boot partition last time, thereby determining the success or failure of the device system upgrade.

[0170] In some embodiments, optionally, the second control module 1510 is further configured to determine the legality of the first firmware in the first partition based on the number of device system upgrade failures being greater than a second preset threshold; based on the first firmware being legal, control the device system to enter the first partition and run the first firmware, clear the rollback flag, and mark the second partition; based on the first firmware being illegal, control the device system to send a prompt information to the user.

[0171] In the embodiment, when the device system performs the rollback operation, the second control module 1510 first records the number of times of device system upgrade failures, when the number of times is less than a second preset threshold, the device system is controlled to enter the second partition to run the second firmware, that is, the device system is controlled to try again. When the number of times is greater than the second preset threshold, the legality of the first firmware in the first partition needs to be determined, that is, whether the first firmware in the first partition is complete and can be normally used is determined. When the first firmware is legal, the device system is controlled to enter the first partition and run the original first firmware, and the rollback flag bit is cleared, wherein the rollback flag bit is stored in the user data partition, when it is detected that the device system needs to perform the rollback operation, the rollback flag bit is automatically set, therefore, when the control system enters the first partition and the original first firmware is run again, that is, the device system rollback operation is completed, the rollback flag bit needs to be cleared. The second partition also needs to be marked, because the device system cannot run the second firmware in the second partition, it is indicated that the second firmware in the second partition is illegal, therefore, the second partition needs to be marked as illegal. When the first firmware is not legal, it is indicated that the device system also cannot enter the first partition to run the first firmware, therefore, a prompt information is sent to the user, prompting the user that the device system is damaged, please contact the after-sales. The legality of the first firmware in the first partition is determined when the device system performs the rollback operation, therefore, it is determined that the rollback operation can be normally run.

[0172] In some embodiments, the upgrade device 150 of the device system further includes: a receiving module, configured to receive a first operation of a user based on that the device system is successfully upgraded, wherein the first operation is an operation of making the device system perform version rollback; a third control module, configured to set a rollback flag bit and control the device system to restart; a second determination module, configured to determine the legality of the first firmware in the first partition; and a fourth control module, configured to, based on that the first firmware is legal, control the restarted device system to enter the first partition and run the first firmware, and clear the rollback flag bit.

[0173] In this embodiment, the upgrading apparatus 150 of the device system further comprises a receiving module, a third control module, a second determination module and a fourth control module. When the user performs the firmware OTA upgrading, and finds that the OTA-upgraded firmware does not conform to the user's own usage habits, and the device system continues to use the old firmware, the device system can be subjected to a version rollback operation, that is, after the device system is upgraded successfully, the receiving module can receive a first operation of the user, wherein the first operation is an operation of causing the device system to perform a version rollback, for example, the user can cause the device to perform a version rollback operation through a remote controller, an APP (Application), voice, a device entity key and the like. After receiving the first operation, the third control module sets a rollback flag bit of a user data partition, and then controls the device system to restart. Then the second determination module determines the legality of the first firmware in the first partition, that is, judges whether the first firmware in the first partition is complete and can be normally used. When the first firmware is legal, the fourth control module controls the device system to enter the first partition, and runs the original first firmware, and clears the rollback flag bit. When the first firmware is not legal, it means that the device system also cannot enter the first partition to run the first firmware, and therefore a prompt information needs to be sent to the user to remind the user of the rollback failure. The present application solves the problem of user rollback failure in the related art by receiving the first operation of the user, and then controlling the device system to rollback to the first partition and run the first firmware before upgrading.

[0174] In some embodiments, optionally, the third control module is specifically configured to determine whether the second firmware in the second partition allows rollback; based on the second firmware allowing rollback, the rollback flag bit is set, and the device system is controlled to restart.

[0175] In this embodiment, when the user performs the rollback operation, the third control module needs to first determine whether the currently running firmware, that is, the second firmware in the second partition, allows rollback. If not, an audible and visual prompt is sent to remind the user. Generally, when the currently running firmware, that is, the second firmware, repairs some fatal problems, for example, repairs vulnerabilities that seriously affect the running performance of the device, the safety of the user's life and property, and increases the attack prevention mode and the like, the device system is prohibited from rollback. If the second firmware allows rollback, the rollback flag bit is set, and the device system is controlled to restart. By determining whether the currently running firmware allows rollback when the rollback operation is performed, the normal running of the device system is ensured.

[0176] In some embodiments, optionally, the second determination module is configured to control the restarted device system to enter a boot partition, wherein the boot partition is configured to determine whether the device system enters the first partition or the second partition; detect the state of the rollback flag bit in the boot partition; and based on the rollback flag bit being in a set state, determine the legality of the first firmware in the first partition.

[0177] In this embodiment, the second determining module is configured to first control the device system after the restart to enter a boot partition, wherein the boot partition is the first code loaded after the device system is powered on, and in the code, the device system determines whether to run in the first partition or the second partition according to the data in the firmware information area and the user data area through a series of judgments. Then, the state of the rollback flag is detected in the boot partition. If the rollback flag is in the zero state, it indicates that the device system does not need to perform a rollback operation, and the device system is directly controlled to enter the second partition to run the second firmware. If the rollback flag is in the set state, it indicates that the device system needs to perform a rollback operation, and therefore the legality of the first firmware in the first partition needs to be determined.

[0178] In some embodiments, the second determining module is further configured to calculate first verification information of the first firmware in the first partition; acquire second verification information of the stored first firmware; and determine the legality of the first firmware according to the first verification information and the second verification information.

[0179] In this embodiment, the second determining module is further configured to first calculate first verification information of the first firmware in the first partition, wherein the first verification information includes length information of the first firmware and a CRC check code of the first firmware. Then, second verification information of the first firmware previously stored in the firmware information partition is acquired, wherein the second verification information includes length information previously stored of the first firmware and a CRC check code previously stored of the first firmware. Then, the first verification information and the second verification information are compared. If they are consistent, it indicates that the first firmware is legal, i.e., the device system can run the first firmware. If they are inconsistent, it indicates that the first firmware is illegal, i.e., the device system cannot run the first firmware.

[0180] In some embodiments, optionally, the first control module 1506 is specifically configured to write third verification information of the second firmware into the firmware information partition, and set the upgrade flag, wherein the firmware information partition includes basic data required when the boot partition is selected; control the device system to enter the boot partition and detect the upgrade flag; based on the upgrade flag being in the set state, calculate fourth verification information of the second firmware in the second partition; based on the fourth verification information being the same as the third verification information, control the device system to enter the second partition and run the second firmware, and clear the upgrade flag.

[0181] In this embodiment, the first control module 1506 is specifically configured to write third verification information of the second firmware into the firmware information partition when the second firmware is stored in the second partition, and set the upgrade flag bit in the firmware information partition, wherein the firmware information partition stores basic data required when the boot partition selects the running partition, for example: boot partition startup times, startup time, firmware length in the first or second partition, firmware CRC check code, startup times, software version number, whether to allow rollback, current running partition, upgrade flag bit, startup failure times, and upgrade result data. The third verification information includes length information and CRC check code of the second firmware. Then the control device system is restarted and enters the boot partition. When the upgrade flag bit is detected to be in the set state in the boot partition, the fourth verification information of the second firmware in the second partition is calculated, that is, the length information and CRC check code of the second firmware of the second firmware are calculated. Then verification is performed, if the fourth verification information calculated is the same as the third verification information stored before, the verification is passed, that is, the control device system enters the second partition and runs the second firmware, and the upgrade flag bit is cleared. The length information and CRC check code of the second firmware are verified in the application, so as to ensure that the device system can normally run the second firmware.

[0182] Figure 16 shows a schematic block diagram of an electronic device according to an embodiment of the application; wherein the electronic device 160 comprises a memory 1602, a processor 1604, and a computer program stored in the memory 1602 and executable on the processor 1604, and the processor 1604 implements the steps of the device system upgrade method according to any one of the above embodiments when executing the computer program.

[0183] The electronic device 160 provided by the application, the processor 1604 implements the steps of the device system upgrade method when executing the computer program, and the technical effects of any one of the above embodiments can be achieved, which will not be repeated.

[0184] An embodiment of the application provides a storage medium having a computer program stored thereon, and the computer program is executable by a processor to implement the steps of the device system upgrade method according to any one of the above embodiments.

[0185] The storage medium provided by the application, the computer program is executable by the processor to implement the steps of the device system upgrade method, and the technical effects of any one of the above embodiments can be achieved, which will not be repeated.

[0186] In the description of the present specification, the terms "first", "second", etc. are only used for the purpose of description, and cannot be understood as indicating or implying relative importance, unless otherwise explicitly specified and limited; the terms "connection", "installation", "fixation" and the like should be understood in a broad sense, for example, "connection" can be fixed connection, can also be detachable connection, or integrally connected; can be directly connected, or indirectly connected through an intermediate medium. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0187] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "a specific embodiment" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0188] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. Those skilled in the art can make various modifications and changes to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. An upgrading method of a device system, wherein, The method comprises the following steps: determining a first partition according to a first firmware currently running by the device system, wherein the first firmware is stored in the first partition; storing a second firmware to a second partition; upgrading the device system according to the second firmware; judging whether the upgrading of the device system is successful; based on the upgrading of the device system being unsuccessful, controlling the device system to enter the first partition and run the first firmware.

2. The upgrading method of the device system according to claim 1, wherein, The step of judging whether the upgrading of the device system is successful comprises: controlling the device system to enter a boot partition and increasing a first running number of the boot partition by one, wherein the boot partition is used to determine whether the device system enters the first partition or the second partition; obtaining a second running number of the second partition; determining a first difference between the first running number and the second running number; based on the first difference being greater than a first preset threshold, judging that the upgrading of the device system is unsuccessful.

3. The upgrading method of the device system according to claim 2, wherein, The step of, based on the upgrading of the device system being unsuccessful, controlling the device system to enter the first partition and run the first firmware comprises: determining the legality of the first firmware in the first partition; based on the first firmware being legal, controlling the device system to enter the first partition and run the first firmware, clearing a rollback flag and marking the second partition; based on the first firmware being illegal, controlling the device system to send a prompt information to a user.

4. The upgrading method of the device system according to claim 1, wherein, The step of judging whether the upgrading of the device system is successful comprises: controlling the device system to enter a boot partition and recording a current time, wherein the boot partition is used to determine whether the device system enters the first partition or the second partition; obtaining a first time when the device system enters the boot partition last time; determining a second difference between the current time and the first time; based on the second difference being in a preset range, judging that the upgrading of the device system is unsuccessful.

5. The upgrading method of the device system according to claim 4, wherein, The step of, based on the upgrading of the device system being unsuccessful, controlling the device system to enter the first partition and run the first firmware comprises: based on the number of times of the unsuccessful upgrading of the device system being greater than a second preset threshold, determining the legality of the first firmware in the first partition; based on the first firmware being legal, controlling the device system to enter the first partition and run the first firmware, clearing a rollback flag and marking the second partition; based on the first firmware being illegal, controlling the device system to send a prompt information to a user.

6. The upgrading method of the device system according to any one of claims 1 to 5, wherein, The method further comprises: based on the successful upgrading of the device system, receiving a first operation of a user, wherein the first operation is an operation of making the device system perform version rollback; setting a rollback flag and controlling the device system to restart; determining the legality of the first firmware in the first partition; based on the first firmware being legal, controlling the restarted device system to enter the first partition and run the first firmware, and clearing the rollback flag.

7. The upgrading method of the device system according to claim 6, wherein, The step of setting the rollback flag and controlling the device system to restart comprises: determining whether the second firmware in the second partition allows rollback; based on the second firmware allowing rollback, setting the rollback flag and controlling the device system to restart.

8. The upgrading method of the device system according to claim 6, wherein, The step of determining the legality of the first firmware in the first partition comprises: controlling the restarted device system to enter a boot partition, wherein the boot partition is used to determine whether the device system enters the first partition or the second partition; and detecting the state of the rollback flag in the boot partition; based on the rollback flag being in the set state, determining the legality of the first firmware in the first partition.

9. The upgrading method of the device system according to claim 8, wherein, The step of determining the legality of the first firmware in the first partition further comprises: calculating first verification information of the first firmware in the first partition; obtaining second verification information of the stored first firmware; determining the legality of the first firmware according to the first verification information and the second verification information.

10. The upgrading method of the device system according to claim 1, wherein, The step of upgrading the device system according to the second firmware comprises: writing third verification information of the second firmware into a firmware information partition, and setting an upgrade flag, wherein the firmware information partition comprises basic data required when selecting a boot partition; controlling the device system to enter the boot partition and detecting the upgrade flag; based on the upgrade flag being in the set state, calculating fourth verification information of the second firmware in the second partition; based on the fourth verification information being the same as the third verification information, controlling the device system to enter the second partition and run the second firmware, and clearing the upgrade flag.

11. An upgrading apparatus of a device system, wherein, comprises: a first determination module configured to determine a first partition according to a first firmware currently running on the device system, wherein the first firmware is stored in the first partition; a first storage module configured to store a second firmware into a second partition; a first control module configured to upgrade the device system according to the second firmware; a judgment module configured to judge whether the upgrade of the device system is successful; a second control module configured to, based on the upgrade of the device system failing, control the device system to enter the first partition and run the first firmware.

12. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein, The processor executes the computer program to implement the steps of the upgrade method of the device system according to any one of claims 1 to 10.

13. A storage medium having stored thereon a computer program, wherein, The computer program is executed by the processor to implement the steps of the upgrade method of the device system according to any one of claims 1 to 10.

Images