« AnteriorContinuar »
METHOD AND APPARATUS FOR BOOTING
AND UPGRADING FIRMWARE
BACKGROUND OF THE INVENTION 5
1. Field of Invention
This invention relates to methods for storing computer programs and methods for initiating program control.
2. Description of Related Art
The majority of computer peripherals, such as image scanners, modems, and printers, typically employ an on-board controlling system including alterable memory, such as random access memory (RAM), which may be volatile and/or non-volatile, and nonalterable memory, such as read only memory (ROM), and various hardware circuits that facilitate firmware transfer. One drawback to early peripheral devices was the inability to upgrade and improve the software within the devices without requiring a service technician to physically remove the old programs contained on the non-alterable memory and install a new non-alterable memory containing the upgraded software.
As non-volatile memories improved, especially flash electrically erasable programmable read only memory (EEPROM), hardware vendors developed techniques to 2J remotely download and store upgraded software onto the peripherals. The methods typically involved providing the peripheral device with the new software, and then directing the on-board controller in the peripheral device to store the new program within the non-volatile alterable memory. The 3Q software and the storing of such software in non-alterable memory are commonly referred to in combination as firmware.
However, one drawback to this method for downloading and storing the new firmware is that data and programs could 35 be corrupted, thus rendering the system useless, if, during this firmware upgrade routine, the process is interrupted by, for example, an unexpected loss of power. Often, when this occurs, the only remedy to fix the peripheral is to deploy a service technician to physically replace the non-volatile 40 alterable memory or even to replace an entire circuit board.
SUMMARY OF THE INVENTION
This invention provides systems, methods and architectures that enable recoverable software upgrading of software 4J contained in a non-volatile alterable memory.
This invention separately provides a firmware architecture that allows recovery from failed firmware upgrading procedures.
This invention separately provides a firmware architec- 50 ture that allows a firmware upgrade without removing the upgraded firmware.
In various exemplary embodiments of this invention, a system containing firmware includes memory storing a bootstrap program. The system further includes a non- 55 volatile alterable memory having at least two firmware memory spaces. The first one of the firmware memory spaces stores a current firmware program.
When that firmware program is to be upgraded, the upgrade firmware is received and stored in a second one of 60 the at least two memory spaces. After the upgrade firmware is completely received and stored in that second memory space, the original firmware in the first memory space is erased or otherwise marked as no longer being valid. Thus, the only valid firmware is then the upgrade firmware in the 65 second memory space. The bootstrap program accesses which ever memory space contains valid firmware.
Other features and advantages of various exemplary embodiments of the methods and systems of this invention will be described below or will become apparent from the accompanying drawings and from the detailed description which follows.
BRIEF DESCRIPTION OF THE DRAWINGS
The invention is described in detail with regard to the following figures, wherein like numerals reference like elements, and wherein:
FIG. 1 is a block diagram of a firmware data source and various firmware-containing devices.
FIG. 2 is a block diagram of one exemplary embodiment of a firmware containing device according to this invention;
FIG. 3 is a block diagram of one exemplary embodiment of the non-volatile alterable memory of FIG. 2;
FIG. 4 is a flowchart outlining a first exemplary embodiment of a method for initiating program control according to this invention;
FIG. 5 is a flowchart outlining a second exemplary embodiment of a method for initiating program control according to this invention; and
FIGS. 6A and 6B are a flowchart outlining an exemplary embodiment of a method for upgrading firmware according to this invention.
DETAILED DESCRIPTION OF PREFERRED
FIG. 1 is a block diagram of a system for upgrading firmware using a firmware data source 100 that can be connected to one or more of a modem 200 through a first link 120, a printer 300 through a second link 130, an image scanner 400 through a third link 140, or any other known or later developed firmware containing device, such as the general firmware containing device 500, which is connected to the firmware data source 100 via a fourth data link 150. New, upgrade or replacement firmware can be transferred from the firmware data source 100 to the various firmware containing devices 200-500 through the links 110-150.
The firmware data source 100 can be any known or later developed data source that is capable of providing new programs firmware to the firmware containing devices 200-500. Similarly, the links 120-150 can each be any known or later developed devices, software utilities or systems for connecting the firmware containing device 200-500 to the firmware data source 100, including a direct cable connections such as a serial bus or a SCSI port, connections over a wide area network or a local area network, connections over an intranet or extranet, connections over the Internet, or connections over any other distributed processing network or system.
Furthermore, the firmware data source 100 and the respective link may both be inserted, in whole or in part, within the firmware containing device 500. For example, the firmware data source 100 can be a floppy disk drive inserted into the firmware containing device and the respective link 150 can be a disk drive controller and connecting cable hardware.
FIG. 2 is one exemplary embodiment of the firmware containing device 500. The firmware containing device 500 contains a controller 510, an optional alterable memory 520, an optional non-alterable memory 530, a non-volatile alterable memory 540, and peripheral hardware 550. Communication between the controller 510 and the various memories 520-540 and the peripheral hardware 550 is accommodated using a bus 512.
The controller 510 carries out the various functions provided by the particular firmware containing device 500, including downloading new or replacement firmware based upon firmware stored in any one of the memories 520-550. The optional alterable memory 520 is a volatile, high-speed memory generally used to store programs and temporary data. The optional non-alterable memory 530 is a nonvolatile memory that is used to store data and programs such as default system settings and basic input/output routines that will not need updating over time and that does not require power to be continuously provided.
The non-volatile alterable memory 540 is also capable of storing data and programs, but has the advantage of being both alterable and non-volatile, i.e. information is not lost when power is removed.
The firmware containing device 500 is connected to the outside world via the peripheral hardware 550 and the data link 150.
During power up, the controller 510 will transition from a reset state to a known operating state using preprogrammed instructions stored either in the non-alterable memory 530 or the non-volatile alterable memory 540. The controller 510 may continue to execute programs from the non-alterable memory 530 or the non-volatile alterable memory 540, or it may transfer various programs to the alterable memory 520, then execute the programs stored in the alterable memory 520.
During a program upgrade operation of the general firmware containing device 500, the firmware data source 100, using the link 150, will download new programs and data. As new programs are received by the controller 510, they are directed to the alterable memory 520 for temporary storage. The controller 510 will optionally perform a verification check on the new data and programs using a verification technique, such as a cyclic redundancy check or a checksum routine. Once the new data and programs are verified, the controller 510 then checks the non-volatile alterable memory 540 for the appropriate location to store the new information.
FIG. 3 shows in greater detail one exemplary embodiment of the architecture of the non-volatile alterable memory 540 of FIG. 2 according to this invention.
The boot code space 542 is provided as the default location from which the controller 510 will start operation after power-up. However, it should be appreciated that the boot space portion may instead be a portion of the nonalterable memory 530. The two firmware code spaces 544 and 546 are reserved to store the firmware used by the firmware containing device 500. Each firmware code space 544 and 546 is large enough to accommodate the complete firmware of the firmware containing device 500. While the boot code space 546 is depicted being smaller than the first or second firmware spaces 544 and 546 and the first and second firmware spaces 544 and 546 are depicted as equal in size, these spaces 542, 544 and 546 can be of any relative and absolute size.
The checksum memory portions 545 and 547 provide a measure of confidence of the validity of the data of their respective firmware spaces. While the first and second checksum memory portions 545 and 547 can be any size, in various exemplary embodiments of the non-volatile alterable memory according to this invention, the first and second checksum memory portions 545 and 547 are large enough to store at least 32 bits of data.
While various exemplary embodiments of the systems and methods according to this invention use a checksum to
check the integrity of the respective firmware spaces 544 and 546, any known or later developed technique may be used to validate the data in the first and/or second checksum memory portions 545 and/or 542. For example, cyclic
5 redundancy checks, multiple checksums, and techniques involving Markov models may be used.
During power-up, the controller 510 starts operation using instructions in the boot code space 542. During this time, the controller 510 will initialize various hardware, then deter
1° mine which of the two firmware spaces 544 or 546 contains valid firmware. Upon identifying the proper firmware space 544 or 546, the controller 510, upon direction from instructions stored in the boot code space 542, will execute instructions stored in the identified firmware space 544 or
Before storing the new firmware, the controller 510 must determine which of the two firmware spaces 545 or 546 contains valid firmware. When the firmware spaces 544 or 546 no longer store valid or current firmware, that firmware
20 will typically be erased, marked as invalid or the firmware will not comply with the checksum. Alternatively, the controller 510 may define the current firmware space used by the controller 510 as the valid firmware space or may determine validity based on a record keeping scheme. It
25 should be appreciated that any known or later developed technique that identifies which of the first and second firmware spaces 544 or 546 contains valid data can be used. Upon determining which of the first and second firmware spaces 544 or 546 contains valid and invalid firmware, the
30 controller 510 will load the new data and programs into the firmware space 544 or 546 that does not contain valid firmware.
FIG. 4 is a flowchart outlining a first exemplary embodiment of a method for initiating program control according to the invention. Beginning in step S100, control continues to step S110, where the code in the boot code space is executed. Next, in step S120, various hardware elements of the firmware containing device are initialized, as required. For example, interrupt controllers, dynamic RAM controllers, various peripherals and various microprocessor registers may need be manipulated. Then, in step S130, a determination is made whether the first firmware space is erased. If the first firmware space is erased, control jumps to step S150, otherwise control continues to step S140.
In step S140, if the first firmware space is not erased, a determination is made whether the data in the first firmware space is valid. If the data in the first firmware space is not valid, control continues to step S150. Otherwise control
5Q jumps to step S160.
In step S150, the firmware in the first firmware space is executed. In contrast, in step S160, the firmware stored in the second firmware space is executed.
FIG. 5 is a flowchart outlining a second exemplary
55 embodiment of a method for initiating program control according to the invention. Beginning with step S200, control continues to step S210, where code in the boot space is executed. Next, in step S220, various hardware elements are initialized as required. Control then continues to step
In step S230, a determination is made whether the first firmware space 544 is erased. If the first firmware space is erased, control jumps to step S260. Otherwise, control continues to step S240. In step S240, if the first firmware 65 space 544 is not erased, the validity of the data of the first firmware space 544 is checked. If the data of the first firmware space 544 is valid, control continues to step S250.