Fault-Tolerant Variable Region Repaving for FOTA Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current firmware update processes lack fault-tolerant mechanisms for repaving non-volatile UEFI variables during Over-The-Air (OTA) updates, which can lead to instability and failure in maintaining a known good boot state, especially in devices deployed in the field.
Innovation Solution
Implementing a transaction-based fault-tolerant write process that uses a spare region in secure non-volatile memory to backup primary region data, allowing for fault-tolerant repaving of UEFI variables during firmware updates, ensuring that either the primary or spare region remains valid, thus enabling successful boot and restart of the variable region repaving process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If firmware variables are repaved during FOTA update, then firmware can be updated over the air, but system stability may be compromised due to potential failures in variable region repaving
Solution Approach 1:
The patent applies preliminary action by creating a backup of the primary variable region in a spare region before performing the repave operation. This backup is prepared in advance so that if the repave fails, the system can restore from the backup and maintain boot stability.
Solution Approach 2:
The patent implements beforehand cushioning by allocating a spare region as a safety buffer before the repave operation. This spare region acts as a cushion against potential failures, allowing the system to recover without compromising boot stability if the primary region repave fails.
2Reliability
If a spare region is allocated for backup, then fault tolerance is improved, but memory space is consumed
Solution Approach 1:
The patent applies segmentation by dividing the secure store into distinct functional regions: a primary variable region for active firmware variables and a spare region for backup purposes. This segmentation allows the backup functionality to be isolated in a dedicated area, making efficient use of memory space while ensuring fault tolerance.
3Reliability
If fault-tolerant repave process is implemented, then boot state reliability is maintained, but update process complexity increases
Solution Approach 1:
The patent applies the taking out principle by extracting the backup and restore functionality into a separate, dedicated spare region. This isolation simplifies the fault-tolerant mechanism by separating the backup management logic from the primary variable region operations, reducing overall process complexity while maintaining reliability.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Variables utilized in device firmware that provides various boot and runtime services are repaved in a fault-tolerant manner within a secure store in a durable, non-volatile device memory during an FOTA update process. A spare region in the secure store is utilized to temporarily hold a back-up of a primary region in which the firmware variables are written. Using a transaction-based fault- tolerant write (FTW) process, the variables in the primary region can be repaved with variables contained in a firmware update payload that is delivered from a remote service. In the event of a fault in the variable region repaving process, either the primary or spare region will remain valid so that firmware in a known good state can be utilized to enable the device to boot successfully and the variable region repaving in the FOTA update process may be restarted.