CN111796839A - Controller program management method and device - Google Patents
Controller program management method and device Download PDFInfo
- Publication number
- CN111796839A CN111796839A CN202010645813.1A CN202010645813A CN111796839A CN 111796839 A CN111796839 A CN 111796839A CN 202010645813 A CN202010645813 A CN 202010645813A CN 111796839 A CN111796839 A CN 111796839A
- Authority
- CN
- China
- Prior art keywords
- program
- bootloader
- erasing
- eol
- bootloader program
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 230000015654 memory Effects 0.000 claims abstract description 74
- 238000001514 detection method Methods 0.000 claims abstract description 28
- 238000000034 method Methods 0.000 claims abstract description 21
- 238000004891 communication Methods 0.000 claims description 5
- 238000011010 flushing procedure Methods 0.000 claims description 3
- 238000005192 partition Methods 0.000 description 11
- 238000010586 diagram Methods 0.000 description 6
- 238000012360 testing method Methods 0.000 description 6
- 230000006870 function Effects 0.000 description 3
- 239000003292 glue Substances 0.000 description 3
- RVCKCEDKBVEEHL-UHFFFAOYSA-N 2,3,4,5,6-pentachlorobenzyl alcohol Chemical compound OCC1=C(Cl)C(Cl)=C(Cl)C(Cl)=C1Cl RVCKCEDKBVEEHL-UHFFFAOYSA-N 0.000 description 1
- 230000002159 abnormal effect Effects 0.000 description 1
- 230000008094 contradictory effect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000009434 installation Methods 0.000 description 1
- 230000009191 jumping Effects 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002085 persistent effect Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 238000003672 processing method Methods 0.000 description 1
- 238000005476 soldering Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F8/00—Arrangements for software engineering
- G06F8/60—Software deployment
- G06F8/61—Installation
- G06F8/63—Image based installation; Cloning; Build to order
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
- G06F21/563—Static detection by source code analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/572—Secure firmware programming, e.g. of basic input output system [BIOS]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2143—Clearing memory, e.g. to prevent the data from being stolen
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Health & Medical Sciences (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- Databases & Information Systems (AREA)
- Virology (AREA)
- Stored Programmes (AREA)
Abstract
The embodiment of the invention provides a method and a device for managing a controller program. The method comprises the following steps: after offline detection is performed on the basis of an offline detection EOL program provided by a hardware provider, erasing the EOL program through a first BootLoader program provided by the hardware provider, wherein the first BootLoader program and the EOL program are programmed into a controller nonvolatile memory at a bare board stage; the method comprises the steps that a second BootLoader program and an application file provided by a product supplier are written into a nonvolatile memory through a first BootLoader program; and storing a preset erasing code into a preset memory through the first BootLoader program, and executing an erasing operation on the first BootLoader program through the erasing code so as to ensure that no hardware provider program residue exists in the controller.
Description
Technical Field
The invention relates to the technical field of automobile electronics, in particular to a method and a device for managing a controller program.
Background
In the production process of the existing automobile controller, generally, in the PCBA stage of the controller (which refers to a state when the mounting and soldering of components on a circuit board of the controller are completed but the mounting and glue filling of a housing are not completed), software of an EOL program, a BootLoader program and a product application program (application, which is a program that is finally required to be operated when a sample leaves a factory and realizes specific functions of a controller product) is injected (programmed) into a main control single chip Microcomputer (MCU) of the controller together, and then the mounting and glue filling of the housing are completed.
Software and Hardware development of some controllers in the current industry is completed by cooperation of more than one manufacturer, and generally, an EOL program is developed by a Hardware supplier (Hardware supplier) of the controller, while a BootLoader and a Product application program of the controller are developed by a Product supplier (Product supplier).
The EOL program is used for performing offline detection when the controller completes offline assembly, so that the hardware function of the controller is ensured to be abnormal; the main function of BootLoader is to support updating of product applications (i.e. the flash).
It should be noted that after the casing installation and glue filling are completed, the program cannot be written into the MCU any more, but the program can be refreshed by BootLoader provided by a Hardware supplier (Hardware supplier).
For the processing of an EOL program and a BootLoader program, there are generally two schemes for implementation.
In the first scheme, as shown in fig. 1, an EOL program provided by a hardware provider and a BootLoader program developed by a product provider are burnt into a flash of a controller at a bare board stage of the controller, after an EOL test is performed, communication is established between an upper computer and the EOL program provided by the hardware provider, the EOL program of the hardware provider is firstly erased, and then a product application program is flushed into the flash.
The advantages of this solution are: after leaving the factory, the EOL program cannot remain in the controller, so that the risk of leaving a back door cannot exist.
However, before the EOL program erasing and the product application program is executed, the BootLoader needs to be called through secure access authentication of BootLoader, which requires the product supplier to provide an algorithm for unlocking secure access to the hardware supplier, which is generally difficult for the product supplier to release.
The second scheme is as follows:
referring to fig. 2, a hardware supplier provides an EOL program, a product supplier develops a BootLoader program and an application, the three programs are synthesized into a binary file, the binary file is together written into a flash of a controller, and the EOL program is directly called to perform offline detection after the controller is produced.
The advantages of this solution are:
all programs are directly burnt into the controller in the bare board stage of the controller, and the BootLoader developed by a product supplier is not required to be used for later writing the programs in a flash mode, so that the product supplier does not need to provide an algorithm for unlocking the secure access to a hardware supplier.
However, with the above scheme, after the controller is offline, EOL program code of the hardware provider still remains, and the risk of leaving a program backdoor in the code cannot be avoided.
In summary, the two schemes have two contradictory problems that the controller leaves the EOL code or the security access algorithm needs to be released, and it is difficult to achieve both of them in the current scheme.
Disclosure of Invention
Embodiments of the present invention provide a method and apparatus for managing a controller program to implement that the EOL code remains in the cleanup process without requiring the product vendor to release the security access algorithm.
In order to achieve the above purpose, the embodiments of the present invention provide the following technical solutions:
a controller program management method, comprising:
after offline detection is performed on the basis of an offline detection EOL program provided by a hardware supplier, erasing the EOL program through a first BootLoader program provided by the hardware supplier; the first BootLoader program and the EOL program are programmed into a controller nonvolatile memory at a bare board stage;
the method comprises the steps that a second BootLoader program and an application file provided by a product supplier are written into the nonvolatile memory through the first BootLoader program;
storing a preset erasing code into a preset memory through the first BootLoader program;
executing an erasing operation on the first BootLoader program through the erasing code; the predetermined memory and the nonvolatile memory are different memories.
Optionally, the preset memory is specifically a volatile memory; after the first BootLoader program is erased, the method further comprises: and powering on and powering off the controller again to enable the erasing codes in the volatile memory to disappear after power failure.
Optionally, after performing offline detection based on an offline detection EOL program provided by a hardware provider, erasing the EOL program by using a first BootLoader program provided by the hardware provider, where the erasing includes: after offline detection is executed based on the EOL program, an upper computer matched with the first BootLoader program sends a program flashing command; the program flashing command is used for indicating a program pointer to jump into the first BootLoader program; the upper computer sends a flash erasing command to the first BootLoader program; the flash erasing command comprises a starting address and a length to be erased; the EOL program is stored in a storage space determined by the starting address and the length of the to-be-erased program; and the first BootLoader program carries out erasing operation according to the flash erasing command.
Optionally, the writing a second BootLoader program and an application file provided by a product vendor into the non-volatile memory by the first BootLoader program includes: and the upper computer writes the second BootLoader program and the application file into the nonvolatile memory through communication with the first BootLoader program.
Optionally, the erasure code is pre-stored in the first BootLoader program in a code segment manner.
Optionally, the erasing code is an independent file, and the erasing code is pre-loaded into the upper computer; the step of storing a preset erasing code into a preset memory through the first BootLoader program comprises the following steps: and the upper computer is communicated with the first BootLoader program, and downloads the erasing code into the nonvolatile memory.
A controller program management apparatus comprising:
a programming unit to:
in a bare board stage, programming an offline detection EOL program developed by a hardware provider and a first BootLoader program developed by the hardware provider into a nonvolatile memory of a controller;
a first erase unit to:
after offline detection is executed based on the EOL program, erasing the EOL program through a first BootLoader program provided by a hardware supplier;
the first BootLoader program is configured to: erasing the EOL program after performing offline detection based on the EOL program;
a flash unit to:
the method comprises the steps that a second BootLoader program and an application file provided by a product supplier are written into the nonvolatile memory through the first BootLoader program;
storing a preset erasing code into a preset memory through the first BootLoader program;
a second erase unit to:
executing an erasing operation on the first BootLoader program through the erasing code; the predetermined memory and the nonvolatile memory are different memories.
Optionally, the preset memory is specifically a volatile memory; the device further comprises: a power-on and power-off control unit for: and after the first BootLoader program is erased, powering on and powering off the controller again so as to enable the erasing codes in the volatile memory to be lost.
It can be seen that, in the embodiment of the present invention, in the bare board stage, the EOL program and the first BootLoader program developed by the hardware provider are programmed into the flash of the controller, after the EOL detection is completed, the EOL is erased by the first BootLoader program, and the second BootLoader program and the application file provided by the product provider are flash-written into the flash.
The first BootLoader program is developed by a hardware supplier, but not a product supplier, so that the first BootLoader program does not need the product supplier to provide an algorithm for unlocking the secure access to the hardware supplier when erasing and writing are performed, and the independence of work between two manufacturers is ensured.
After the flash is finished, the first BootLoader developed by the hardware supplier is erased by the erasing code stored in the preset memory. In this way, the second BootLoader program and the application file provided by the product supplier exist in the controller, so that the controller can be ensured to only reserve the program developed by the product supplier, no EOL residue or other hardware supplier program residues exist, the risk of the hardware supplier leaving a program backdoor is avoided, and the safety is ensured.
According to the technical scheme provided by the embodiment of the invention, the EOL code is cleared, and the product supplier is not required to release the security access algorithm, so that the problem that the EOL code and the security access algorithm cannot be considered in the prior art is solved.
Drawings
Fig. 1 is a schematic diagram of a conventional processing method for an EOL program and a BootLoader program;
FIG. 2 is a schematic diagram of an EOL program, a BootLoader program, and an application being simultaneously programmed into a flash;
FIG. 3 is an exemplary flowchart of a method for managing a controller program according to an embodiment of the present invention;
FIG. 4 is a schematic diagram illustrating a situation that a program in a controller occupies a partition after programming according to an embodiment of the present invention;
fig. 5 is a schematic diagram illustrating that a program pointer jumps into a first BootLoader program according to an embodiment of the present invention;
fig. 6 is a schematic diagram illustrating a situation that a program in a controller occupies a partition after an EOL program provided in an embodiment of the present invention is erased;
fig. 7 is a situation that a program in a controller occupies a partition after a second BootLoader program and an application file are written into a nonvolatile memory in a flash memory according to an embodiment of the present invention;
fig. 8 shows a situation that a program in a controller occupies a partition after an erasure code provided in an embodiment of the present invention is stored in a preset memory;
fig. 9 is a situation that a program in a controller occupies a partition after an erase operation is performed on a first BootLoader program according to an embodiment of the present invention;
FIG. 10 is a block diagram illustrating a final program occupancy state in a controller according to an embodiment of the present invention;
fig. 11 is an exemplary structure of a controller program management apparatus according to an embodiment of the present invention.
Detailed Description
The present invention provides a controller program management method and apparatus to implement the functionality of persisting EOL code in a cleanup process without requiring the product vendor to release the secure access algorithm.
The controller program management device can comprise programming equipment, an upper computer and the like.
Fig. 3 shows an exemplary flow of a controller program management method executed by the controller program management apparatus described above, including:
s0: in a bare board stage, an offline detection EOL program developed by a hardware provider and a first BootLoader program developed by the hardware provider are programmed to a nonvolatile memory (e.g., flash) of a controller.
Step S0 may be accomplished by a separate programming device.
It should be noted that the first BootLoader program is developed by a hardware vendor, not a product vendor.
In one example, an EOL program may occupy the start space (header) of a flash, while a first BootLoader program may occupy the end space or other space of the flash. After step S0 is completed, the program in the controller occupies the partition as shown in fig. 4.
It should be noted that, in terms of program address allocation, the first BootLoader program needs to be separated from addresses of the second BootLoader program and the application program mentioned later, and there cannot be a conflict, and because the second BootLoader program and the application address occupy a start space (a header) of a flash and addresses behind the start space, the first BootLoader program is usually placed in an end space of the flash or other positions that do not conflict with the second BootLoader program and the application; the placement principle of the EOL program is that the EOL program cannot conflict with the first BootLoader, and the EOL program needs to be allocated to a place included by the second BootLoader program and the application address in consideration of subsequent erasing of the EOL program. The product can therefore place the EOL program in the start space (header) of the flash.
The starting address and length occupied by the EOL program are known at the hardware vendor factory side.
S1: and after offline detection is executed based on the EOL program, jumping to the first BootLoader program by the EOL program.
Specifically, after the controller sample piece is assembled, the controller is powered on to execute the EOL test.
The EOL test requires the participation of an upper computer (the lower computer is the controller) which communicates with the EOL program in the controller to complete a series of tests.
After the test is passed, the program is updated, and the upper level sends a program flush command, where the program flush command is used to instruct a program pointer to jump into the first BootLoader program (see the schematic in fig. 5).
Please note that, the upper computer cooperating with the EOL program in the EOL testing stage and the upper computer cooperating with the first BootLoader program in the flushing stage may be different or the same upper computer.
More specifically, there is associated logic in the EOL program that causes the pointer to jump into the first BootLoader of the hardware vendor upon receipt of a program flush command.
It should be noted that the program flash command is a flow formed by a series of commands, a universal UDS protocol in the automotive industry is used, after the upper computer sends a first request in the flash command, a program pointer jumps to a BootLoader program, a series of commands follow, and actually, a subsequent flash erase command is also a step of the flash command.
S2: the EOL program is erased by the first BootLoader program.
EOL program erasing also requires the participation of the upper computer.
In one example, the host computer may send a flash erase command to the first BootLoader.
The flash erase command includes a start address and a length to be erased. Since this erasure is prepared for subsequent flashing of the second BootLoader and application, the start address and length are determined by the address conditions of the second BootLoader and application.
After receiving the flash erasing command, the first BootLoader program can perform erasing operation according to the flash erasing command.
Since the memory space determined by the start address and the length of the erase command includes the EOL program, the erase EOL program can be implemented.
After step S2 is completed, the program in the controller occupies the partition as shown in fig. 6.
S3: and flushing a second BootLoader program and an application file provided by a product supplier into the nonvolatile memory through the first BootLoader program.
Specifically, the upper computer may write the second BootLoader program and the application file into the nonvolatile memory through communication with the first BootLoader program.
After step S3 is completed, the program in the controller occupies the partition as shown in fig. 7.
S4: and storing the preset erasing code into a preset memory through a first BootLoader program.
The default memory is a different memory from the non-volatile memory. This is because the erasure code also belongs to the hardware provider program, and is stored in a preset memory other than the non-volatile memory in order to avoid the risk of the hardware provider leaving a program backdoor.
In one example, the predetermined memory may be a volatile memory (RAM). The steps S1-S4 are applied to the upper computer.
Specifically, the erasure code may be stored in the first BootLoader program in advance in a code segment manner. And copying the data to a RAM from the first BootLoader when the data needs to be used.
Or the erasing code can be made into an independent file, the file is loaded on the upper computer, and then the erasing code is downloaded into the RAM through communication with the first BootLoader program.
The erasure code may take the form of an existing code.
After step S4 is completed, the program in the controller occupies the partition as shown in fig. 8.
S5: and executing an erasing operation on the first BootLoader program through the erasing code.
Taking the RAM as an example, the program pointer jumps to the erasing code in the RAM, and executes the erasing operation to erase the first BootLoader.
It should be noted that the condition of program pointer jump does not need to be triggered by an external upper computer, but the jump is automatically performed after the first BootLoader inside the controller executes the operation of copying the erasure code into the RAM.
That is, after the logic in the first BootLoader is designed to execute downloading, the logic jumps to the RAM.
After step S5 is completed, the program in the controller occupies the partition as shown in fig. 9.
For a scenario where the erasure code is downloaded to the RAM of the controller, the following steps may also be included:
s6: and powering up and down the controller again to enable the erasing codes in the volatile memory to disappear after power failure.
After step S5 is completed, the program in the controller occupies the partition as shown in fig. 10. Only the second BootLoader and application program of the product supplier are reserved in the controller, and no code of the hardware supplier is left.
It can be seen that, in the embodiment of the present invention, in the bare board stage, the EOL program and the first BootLoader program developed by the hardware provider are programmed into the flash of the controller, after the EOL detection is completed, the EOL is erased by the first BootLoader program, and the second BootLoader program and the application file provided by the product provider are flash-written into the flash.
The first BootLoader program is developed by a hardware supplier, but not a product supplier, so that the first BootLoader program does not need the product supplier to provide an algorithm for unlocking the secure access to the hardware supplier when erasing and writing are performed, and the independence of work between two manufacturers is ensured.
After the flash is finished, the first BootLoader developed by the hardware supplier is erased by the erasing code stored in the preset memory, and after the erasing is finished, the second BootLoader program and the application file provided by the product supplier exist in the controller, so that the controller can be ensured to only reserve the program developed by the product supplier, EOL residue or other hardware supplier program residue is avoided, the risk of the hardware supplier leaving a program backdoor is avoided, and the safety is ensured.
According to the technical scheme provided by the embodiment of the invention, the EOL code is cleared, and the product supplier is not required to release the security access algorithm, so that the problem that the EOL code and the security access algorithm cannot be considered in the prior art is solved.
The invention also claims a controller program management device. Referring to fig. 11, examples thereof include:
a programming unit 1 for:
in a bare board stage, an offline detection EOL program developed by a hardware provider and a first BootLoader program developed by the hardware provider are programmed into a nonvolatile memory of a controller.
The programming unit 1 may specifically be a separate programming device.
An EOL unit 2 to: performing offline detection based on the EOL;
a first erasing unit 3 for: after offline detection is executed based on the EOL program, the EOL program is erased through a first BootLoader program;
a flash unit 4 for:
the method comprises the steps that a second BootLoader program and an application file provided by a product supplier are written into a nonvolatile memory through a first BootLoader program;
storing a preset erasing code into a preset memory through a first BootLoader program;
a second erasing unit 5 for:
executing an erasing operation on the first BootLoader program through an erasing code; the default memory and the non-volatile memory are different memories.
Of course, the second erasing unit 5 may not be included in the case where the jump to the erasing code is possible without using the upper computer.
For details, please refer to the above description, which is not repeated herein.
In other embodiments of the present invention, the predetermined memory may be a volatile memory. Still referring to fig. 11, the controller program management apparatus may further include:
a power-on and power-off control unit 6 for:
and after the first BootLoader program is erased, powering on and powering off the controller again so as to enable the erasing codes in the volatile memory to be powered off and disappear.
For details, please refer to the above description, which is not repeated herein.
In other embodiments of the present invention, after performing offline detection based on the EOL program, "erasing the EOL program by the first BootLoader program" may be specifically implemented in the following manner:
after offline detection is executed based on an EOL program, a BootLoader upper computer (a flash unit 4) sends a program flash command; the program flashing command is used for indicating a program pointer to jump into a first BootLoader program;
the BootLoader upper computer sends a flash erasing command to a first BootLoader program; the flash erasing command comprises a starting address and a length to be erased; the starting address is the starting address of the second BootLoader program and the application, and the length is the length of the second BootLoader program and the application;
and after receiving the flash erasing command, the first BootLoader program performs erasing operation according to the flash erasing command.
In other embodiments of the present invention, the second BootLoader program and the application file are written into the flash by communicating with the first BootLoader program through the upper computer.
For details, please refer to the above description, which is not repeated herein.
In one example, the erasure code may be pre-stored in the first BootLoader program in a code segment manner.
For details, please refer to the above description, which is not repeated herein.
In another example, the erasure code may be a separate file; the erasing code can be pre-loaded to an upper computer, and then the upper computer is communicated with a first BootLoader program, and the erasing code is downloaded to the nonvolatile memory.
For details, please refer to the above description, which is not repeated herein.
Those of skill would further appreciate that the various illustrative components and model steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the various illustrative components and steps have been described above generally in terms of their functionality in order to clearly illustrate this interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
The steps of a method or model described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in Random Access Memory (RAM), memory, Read Only Memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, a removable disk, WD-ROM, or any other form of storage medium known in the art.
The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims (8)
1. A controller program management method, comprising:
after offline detection is performed on the basis of an offline detection EOL program provided by a hardware supplier, erasing the EOL program through a first BootLoader program provided by the hardware supplier; the first BootLoader program and the EOL program are programmed into a controller nonvolatile memory at a bare board stage;
the method comprises the steps that a second BootLoader program and an application file provided by a product supplier are written into the nonvolatile memory through the first BootLoader program;
storing a preset erasing code into a preset memory through the first BootLoader program;
executing an erasing operation on the first BootLoader program through the erasing code; the predetermined memory and the nonvolatile memory are different memories.
2. The method of claim 1,
the preset memory is a volatile memory;
after the first BootLoader program is erased, the method further comprises: and powering on and powering off the controller again to enable the erasing codes in the volatile memory to disappear after power failure.
3. The method of claim 1 or 2,
after the offline detection is performed based on the offline detection EOL program provided by the hardware provider, erasing the EOL program by a first BootLoader program provided by the hardware provider includes:
after offline detection is executed based on the EOL program, an upper computer matched with the first BootLoader program sends a program flashing command; the program flashing command is used for indicating a program pointer to jump into the first BootLoader program;
the upper computer sends a flash erasing command to the first BootLoader program; the flash erasing command comprises a starting address and a length to be erased; the EOL program is stored in a storage space determined by the starting address and the length;
and the first BootLoader program carries out erasing operation according to the flash erasing command.
4. The method of claim 3, wherein the flushing, by the first BootLoader program, a second BootLoader program and an application file provided by a product vendor into the non-volatile memory comprises:
and the upper computer writes the second BootLoader program and the application file into the nonvolatile memory through communication with the first BootLoader program.
5. The method according to claim 1 or 2, wherein the erasure code is pre-stored in the first BootLoader program in a code segment manner.
6. The method of claim 3,
the erasing code is an independent file and is pre-loaded into the upper computer;
the storing of the preset erasing code to the preset memory through the first BootLoader program includes:
and the upper computer is communicated with the first BootLoader program, and downloads the erasing code into the nonvolatile memory.
7. A controller program management apparatus, comprising:
a programming unit to:
in a bare board stage, programming an offline detection EOL program developed by a hardware provider and a first BootLoader program developed by the hardware provider into a nonvolatile memory of a controller;
a first erase unit to:
after offline detection is executed based on the EOL program, erasing the EOL program through the first BootLoader program;
a flash unit to:
the method comprises the steps that a second BootLoader program and an application file provided by a product supplier are written into the nonvolatile memory through the first BootLoader program;
storing a preset erasing code into a preset memory through the first BootLoader program;
a second erase unit to:
executing an erasing operation on the first BootLoader program through the erasing code; the predetermined memory and the nonvolatile memory are different memories.
8. The apparatus of claim 7,
the preset memory is specifically a volatile memory;
the device further comprises:
a power-on and power-off control unit for:
and after the first BootLoader program is erased, powering on and powering off the controller again so as to enable the erasing codes in the volatile memory to be lost.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010645813.1A CN111796839B (en) | 2020-07-07 | 2020-07-07 | Controller program management method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010645813.1A CN111796839B (en) | 2020-07-07 | 2020-07-07 | Controller program management method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111796839A true CN111796839A (en) | 2020-10-20 |
| CN111796839B CN111796839B (en) | 2024-04-09 |
Family
ID=72810382
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010645813.1A Active CN111796839B (en) | 2020-07-07 | 2020-07-07 | Controller program management method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111796839B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP4075313A1 (en) * | 2021-04-15 | 2022-10-19 | Rockwell Automation Technologies, Inc. | Systems and methods for purging data from memory |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5291479A (en) * | 1991-07-16 | 1994-03-01 | Digital Technics, Inc. | Modular user programmable telecommunications system with distributed processing |
| US20050015582A1 (en) * | 2003-05-26 | 2005-01-20 | Sony Corporation | Program and information processing method |
| US20050138645A1 (en) * | 2003-12-18 | 2005-06-23 | Karl Lu | Safe method for upgrading firmware of optical disk product |
| US20080082726A1 (en) * | 2006-09-28 | 2008-04-03 | Reuven Elhamias | Memory Cards with End of Life Recovery and Resizing |
| CN105608370A (en) * | 2015-12-30 | 2016-05-25 | 科力远混合动力技术有限公司 | ECU program flashing and detection method |
| CN107870775A (en) * | 2016-09-26 | 2018-04-03 | 深圳市中兴微电子技术有限公司 | A kind of update method of processor and BootLoader program |
| CN108388435A (en) * | 2018-02-10 | 2018-08-10 | 山东国金汽车制造有限公司 | A method of by BootLoader and the disposable programming of application program |
| CN109189405A (en) * | 2018-07-19 | 2019-01-11 | 山东省科学院自动化研究所 | A kind of method and system of proving program Flash data consistency |
| CN111198705A (en) * | 2019-12-19 | 2020-05-26 | 潍柴动力股份有限公司 | Memory backup method and device for preventing ECU from being swiped up, storage medium and electronic equipment |
-
2020
- 2020-07-07 CN CN202010645813.1A patent/CN111796839B/en active Active
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5291479A (en) * | 1991-07-16 | 1994-03-01 | Digital Technics, Inc. | Modular user programmable telecommunications system with distributed processing |
| US20050015582A1 (en) * | 2003-05-26 | 2005-01-20 | Sony Corporation | Program and information processing method |
| US20050138645A1 (en) * | 2003-12-18 | 2005-06-23 | Karl Lu | Safe method for upgrading firmware of optical disk product |
| US20080082726A1 (en) * | 2006-09-28 | 2008-04-03 | Reuven Elhamias | Memory Cards with End of Life Recovery and Resizing |
| CN105608370A (en) * | 2015-12-30 | 2016-05-25 | 科力远混合动力技术有限公司 | ECU program flashing and detection method |
| CN107870775A (en) * | 2016-09-26 | 2018-04-03 | 深圳市中兴微电子技术有限公司 | A kind of update method of processor and BootLoader program |
| CN108388435A (en) * | 2018-02-10 | 2018-08-10 | 山东国金汽车制造有限公司 | A method of by BootLoader and the disposable programming of application program |
| CN109189405A (en) * | 2018-07-19 | 2019-01-11 | 山东省科学院自动化研究所 | A kind of method and system of proving program Flash data consistency |
| CN111198705A (en) * | 2019-12-19 | 2020-05-26 | 潍柴动力股份有限公司 | Memory backup method and device for preventing ECU from being swiped up, storage medium and electronic equipment |
Non-Patent Citations (2)
| Title |
|---|
| 冯轶;卫育新;: "基于TMS320C6713及AM29LV800B的上电自举设计", 电子设计工程, no. 02 * |
| 李光学;郭燕红;李超;岳宗帅;宋茜;: "基于STM32的高可靠IAP在线烧写设计", 电子测量技术, no. 17 * |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP4075313A1 (en) * | 2021-04-15 | 2022-10-19 | Rockwell Automation Technologies, Inc. | Systems and methods for purging data from memory |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111796839B (en) | 2024-04-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110231952B (en) | ECU program backup and cyclic upgrade control method and device | |
| RU2142168C1 (en) | Method for complete rewriting of cleared non- volatile memory | |
| US7774382B2 (en) | Method and apparatus for configuring a control device, and corresponding control device | |
| CN110825403A (en) | Method and system for flashing ECU (electronic control Unit) of automobile | |
| US6842858B2 (en) | Mechanism for updating firmware of an electronic device | |
| JP2009505304A (en) | Embedded memory access control | |
| CN111026427B (en) | Remote online upgrading method for embedded system containing CPU and FPGA | |
| JP2007257473A (en) | Onboard control unit | |
| CN112925569A (en) | Firmware data processing method, device, equipment and storage medium | |
| CN103744712A (en) | Method and device for updating application program | |
| CN111796839A (en) | Controller program management method and device | |
| JP4492025B2 (en) | Data storage method for electronic control unit | |
| CN111459508B (en) | BootLoader self-upgrading method and system | |
| CN108334362B (en) | FPGA chip upgrading method and device and storage equipment | |
| JP6001962B2 (en) | Inverter device | |
| CN116755737A (en) | OTA (over the air) upgrading method, device, equipment, storage medium and program for automobile software | |
| JP6935694B2 (en) | Electronic control device | |
| CN114895950A (en) | Self-updating method and system for program and guide layer | |
| JP2019008693A (en) | Vehicle-purpose electronic control unit | |
| JP2001117780A (en) | Information storage device and its downloading method | |
| CN113050969A (en) | Display parameter updating method, driving chip and display device | |
| JP2000003599A (en) | Controller for automobile | |
| CN117215619B (en) | Online upgrading method of application program, chip and intelligent device | |
| JP2006252278A (en) | Microcomputer | |
| CN111831310B (en) | Software updating method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB02 | Change of applicant information |
Address after: 4 / F, building 1, No.14 Jiuxianqiao Road, Chaoyang District, Beijing 100020 Applicant after: Beijing Jingwei Hirain Technologies Co.,Inc. Address before: 8 / F, block B, No. 11, Anxiang Beili, Chaoyang District, Beijing 100101 Applicant before: Beijing Jingwei HiRain Technologies Co.,Ltd. |
|
| CB02 | Change of applicant information | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |