Updating firmware of an electronic device by storing a version identifier in a separate header

Electronic devices are ubiquitous in society, including business devices such as desktops, laptops, portables, servers, etc., as well as consumer devices such as music players, cell phones, cameras, digital video recorders, televisions, set-top boxes, game players, etc., as well as system components such as disk drives, solid state drives, printers, monitors, etc. An electronic device typically comprises a microprocessor executing code segments of a control program for controlling various operations of the electronic device. The control program is typically stored in a non-volatile memory, such as in a non-volatile semiconductor memory (e.g., a flash memory), or on a non-volatile disk (e.g., an optical or magnetic disk drive).

From time to time it may be desirable to update an electronic device with a new version of the control program. The control program may be updated by downloading a new version from a network (e.g., Internet, cellular network, cable network, etc.), or by the electronic device reading the new version from a removable storage medium (e.g., optical disk, flash card, USB drive, etc.). Typically it is desirable to update the control program in a fail safe manner to avoid rendering the electronic device inoperable if the program update is interrupted (e.g., due to a power failure).

FIG. 1A shows an electronic device according to an embodiment of the present invention comprising a non-volatile memory storing first and second version identifiers (VIDs) corresponding to first and second versions of a control program (CP).

FIG. 1B is a flow diagram according to an embodiment of the present invention wherein when both VIDs are valid, the electronic device selects between first and second versions of the CP based on the VIDs.

FIG. 2 is a flow diagram according to an embodiment of the present invention wherein when the second VID is invalid, the first version of the CP is selected.

FIG. 3 shows an embodiment of the present invention wherein the VIDs are protected by respective check codes, and the CPs are protected by respective check codes.

FIG. 4 is a flow diagram according to an embodiment of the present invention wherein the first version of the CP is selected for execution when the second version of the CP fails verification using the check code.

FIG. 5A is a flow diagram according to an embodiment of the present invention wherein when the CP is updated to a third version, the third version of the CP is first stored in the non-volatile memory, and then a corresponding header with VID and check code is stored in the non-volatile memory.

FIG. 5B shows an embodiment of the present invention wherein the third version of the CP and corresponding header overwrite the first version in the non-volatile memory.

FIGS. 6A and 6B illustrate an embodiment of the present invention wherein the first version of the CP is erased and the header invalidated after storing the second version of the CP in the non-volatile memory.

FIGS. 7A-7C illustrate an embodiment of the present invention wherein at least two copies of the CP are stored in the non-volatile memory and the oldest version of the CP is erased.

FIG. 1A shows an electronic device 2 according to an embodiment of the present invention comprising a non-volatile memory 4 storing a first version of a control program (CP) 6 A, a first header 8 A comprising a first version identifier (VID) 10 A identifying the first version of the CP 6 A and a first VID check code 12 A generated in response to at least the first VID 10 A. The non-volatile memory 4 further stores a second version of the CP 6 B, and a second header 8 B comprising a second VID 10 B identifying the second version of the CP 6 B and a second VID check code 12 B generated in response to at least the second VID 10 B. The electronic device 2 further comprises control circuitry 14 operable to execute the flow diagram of FIG. 1B , wherein the first VID is read from the first header (step 16 ), and the first VID check code is read from the first header to verify the validity of the first VID (step 18 ). The second VID is read from the second header (step 20 ), and the second VID check code is read from the second header to verify the validity of the second VID (step 22 ). When the first and second VIDs are valid (step 24 ), the control circuitry 14 selects between the first version and the second version of the CP in response to the first and second VIDs (step 26 ), and executes the selected version of the CP (step 28 ).

Any suitable non-volatile memory 4 may be employed in the embodiments of the present invention, such as a disk of a disk drive or any suitable electrically erasable and programmable semiconductor memory (e.g., a flash). When the CP is updated with a new version, the non-volatile memory 4 may store multiple versions of the CP (the new version and one or more older versions). When the electronic device is re-booted, the control circuitry 14 evaluates the VIDs in the headers to determine which version of the CP is the newest version. Any suitable VID may be employed in the embodiments of the present invention, such as a sequential number where the VID having the highest number represents the newest version of the CP. In an alternative embodiment, the VID may comprise a date where the most recent VID represents the newest version of the CP.

In the embodiments of the present invention, each VID is stored in a header that corresponds to a respective CP as illustrated in FIG. 1A . In this manner, when the electronic device is booted it can quickly evaluate the headers to find the VID corresponding to the newest version of the CP. The headers may be implemented in any suitable manner, and in one embodiment, the headers may be stored in a circular buffer having a predetermined number of records. A record with a non-zero VID may be considered as a potentially valid record corresponding to a potentially valid CP.

The VID check code in each header (e.g., VID check code 12 A of FIG. 1A ) is used to verify the validity of the VID, and in one embodiment, the validity of the corresponding CP. The VID check code protects against a communication error or interruption in the CP update (e.g., due to a reset or power failure) by verifying the integrity of the download. Any suitable check code may be employed to generate the VID check code, such as with a suitable cyclical redundancy check (CRC) code.

In one embodiment, the VID check code is generated over the VID as well as over the CP. For example, as the CP is downloaded into the electronic device the VID check code may be generated over the CP data. Once the CP data has been downloaded, the new VID may be generated and the VID check code updated in response to the new VID. A header comprising the VID and VID check code may then be stored in the non-volatile memory. In an alternative embodiment, the VID check code may be pre-generated and included with the CP when downloaded into the electronic device. The VID check code may then be updated by the control circuitry 14 after the control circuitry 14 generates the corresponding VID. In yet another embodiment, the VID may be included with the CP when downloaded, and the VID check code may be pre-generated over both the CP and the VID.

In one embodiment, when the electronic device is booted (e.g., powered on), it finds the header record storing the VID corresponding to the newest version of the CP. The control circuitry then reads the CP and generates a validation check code over the CP and the VID. If the validation check code matches the VID check code, the CP and VID are validated so that the CP may be executed. If the validation check code does not match the VID check code, it means the corresponding CP is invalid. When this happens, the control circuitry selects an older version of the CP to execute so that the update to the new version of the CP can be restarted. This embodiment is understood generally from the flow diagram of FIG. 2 which expands on the flow diagram of FIG. 1B , wherein when the second VID is invalid (step 30 ), the control circuitry executes the first version of the CP (step 32 ).

In the embodiment where the VID check code is generated over both the VID and the CP, it requires the control circuitry to read both the VID and the CP from the non-volatile memory in order to generate the validation check code. In an alternative embodiment shown in FIG. 3 , the VID check code may be generated over the VID and a separate CP check code may be generated over the CP. In this embodiment, the control circuitry can validate the VID without reading the CP from the non-volatile memory. If the VID is invalid, the control circuitry may select an older version of the CP to execute (after validating the older version using its CP check code). This embodiment is understood with reference to the flow diagram of FIG. 4 which expands on the flow diagram of FIG. 1B , wherein when both first and second VIDs are valid (step 24 ), the control circuitry selects the second CP since its VID identifies the newest version (step 34 ). The control circuitry then reads the second CP and generates a validation check code to be compared with its CP check code (step 36 ). If the validation check code matches the CP check code (step 38 ), the second CP is executed (step 40 ). If the validation check code does not match the CP check code (step 38 ), then the control circuitry reads the first CP and generates a validation check code to be compared with its CP check code (step 42 ). If the validation check code matches the CP check code (step 44 ), the first CP is executed (step 46 ). If the validation check code does not match the CP check code (step 44 ), then the control circuitry signals an error condition (step 48 ).

In one embodiment, the VID and VID check code are not stored in the non-volatile memory until after the new version of the CP has been received and stored in the non-volatile memory (and optionally validated). In this manner, if an error occurs (e.g., a power failure) while downloading the new version of the CP, the corresponding header will not have been updated and will therefore be ignored by the control circuitry during the next boot. This embodiment is understood with reference to the flow diagram of FIG. 5A , wherein when updating the CP the new version of the CP (e.g., third version) is first received (step 50 ) and stored in the non-volatile memory (step 52 ). A corresponding VID is either received during the download or generated by the control circuitry (step 54 ), and a VID check code is either received during the download or generated by the control circuitry (step 56 ). The VID and VID check code are then stored as a header record in the non-volatile memory (step 58 ) which essentially enables use of the third version of the CP stored in the non-volatile memory.

FIG. 5B illustrates an embodiment of the present invention wherein when a new version of the CP is received during a download, it overwrites the oldest version of the CP stored in the non-volatile memory. In the example shown in FIG. 5B , a third version of the CP (and corresponding header) overwrite the first version such that the non-volatile memory stores the two most recent versions of the CP. If an error occurs while downloading the third version of the CP, the VID in the corresponding header will not be valid (as detected from the VID check code) and therefore the control circuitry will execute the second version of the CP.

In one embodiment, the control circuitry maintains only one copy of the CP in the non-volatile memory wherein the older version of the CP is erased. This embodiment is understood with reference to the flow diagram of FIG. 6A and example of FIG. 6B wherein during an update of the CP a second version of the CP is received (step 60 ) and stored in the non-volatile memory (step 62 ). The corresponding VID is either received or generated (step 64 ) and the VID check code either received or generated (step 66 ). The VID and VID check code are stored as a header record in the non-volatile memory (step 68 ). If the header record for the second version is successfully stored in the non-volatile memory, then the first version of the CP can be safely erased (step 70 ) and the first header invalidated (step 72 ) such as by clearing the header. This embodiment may help expedite the next update operation by freeing space in the non-volatile memory for the next download, particularly in an embodiment where the non-volatile memory cannot be overwritten (e.g., flash memory that must first be erased and then re-programmed). In one embodiment, erasing an older version of the CP is deferred until the electronic device enters an idle mode rather than immediately erasing the older version after receiving a new version. This embodiment avoids impacting the perceived performance of the electronic device since erasing an older CP version may take some time.

In one embodiment, the header of an older CP version may be invalidated (e.g., cleared) with or without erasing the corresponding CP. In either case, invalidating the header of an older CP version may improve performance during the next boot cycle of the electronic device by reducing the number of headers the control circuitry needs to evaluate. For example, if there is only one valid header, the control circuitry can immediately begin to read and execute the corresponding CP without needing to check the VID of other headers.

In one embodiment, the control circuitry maintains at least two versions of the CP in the non-volatile memory so there is redundancy in the event that one version becomes corrupted. An example of this embodiment is illustrated in FIGS. 7A-7C where the control circuitry reserves space in the non-volatile memory to store three versions of the CP. In FIG. 7A , the non-volatile memory stores a second and third version of the CP, wherein the first version of the CP has been erased. When a fourth version of the CP is received, it is stored in the free space as illustrated in FIG. 7B . The oldest version of the CP (version 2) is then erased as illustrated in FIG. 7C .

The control circuitry for implementing the embodiments of the present invention within an electronic device may comprise any suitable circuitry, such as any suitable integrated circuit or circuits. In one embodiment, the control circuitry comprises a microprocessor executing instructions, the instructions being operable to cause the microprocessor to implement the embodiments described herein. The instructions may be stored in any suitable computer-readable medium. In one embodiment, the instructions may be stored in a non-volatile semiconductor memory external to the microprocessor, or integrated with the microprocessor in a system on a chip (SOC).