Applying custom software image updates to non-volatile storage in a failsafe manner

• US 20050132179A1
• Filed: 05/01/2004
• Published: 06/16/2005
• Est. Priority Date: 12/16/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Shell, Scott R., Rogers, Andrew M., Patel, Sachin C., Tonkelowitz, Mark Scott, Plagge, Mark, Markley, Michael E., Glaum, Jeffery D.
• Granted Patent: US 7,549,042 B2
• Time in Patent Office: Days
• US Class Current: 713/1
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 8/658 Incremental updates; Differential updates

Abstract

Described is a system and method in which software updates in the form of self-contained, secure entities are applied to an embedded device'"'"'s non-volatile storage in a failsafe manner. Various types of software updates may be applied, and updates may contain executable code and/or data. Following a reboot, an initial program loader determines an update mode, and if updating, boots to a special update loader. The update loader processes update packages to apply the updates. Kernel partition, system partition and reserve section updates may be updated with entire files or binary difference files, with failure handling mechanisms are provided for each type of update. Updates may be simulated before committing them. Updates may be relocated in memory as appropriate for a device.

Claims

1. In a computing device, a method comprising:

determining whether to boot the device into an operating system mode or into an update mode; and

when the device is booted to the update mode, performing at least one update to an image in device storage while logging a state of the update to enable recovery from any failure that may occur during each update.

2. The method of claim 1 wherein determining whether to boot the device into an operating system mode or into an update mode comprising checking a flag that is set prior to a reboot.

3. The method of claim 1 wherein the image is partitioned into at least two partitions, and wherein a selected partition is updated by building a replacement image for the partition and writing the replacement image over an existing image in the partition.

4. The method of claim 3 further comprising backing up the existing image in the partition to a backup image, determining if writing the replacement image successfully completed, and if not, restoring the existing image from the backup image.

5. The method of claim 4 wherein backing up the existing image includes storing the backup image in a compressed form.

6. The method of claim 1 wherein the image is partitioned into at least two partitions, and wherein a selected partition is updated by separately updating at least two components in the image.

7. The method of claim 6 wherein one of the partitions is a system partition, and wherein separately updating the at least two components in the image comprises writing operating system files into the partition.

8. The method of claim 1 wherein performing the at least one update comprises applying a binary difference file to an existing component.

9. The method of claim 8 wherein applying a binary difference file to an existing component comprises applying a subset of the binary difference file to a subset of the existing component.

10. The method of claim 9 wherein the subset comprises a block of data having a defined size.

11. The method of claim 9 wherein performing at least one update to an image comprises simulating an update process, and determining that the simulation succeeded before committing the update.

12. The method of claim 1 wherein the updates in a set of updates are performed individually on files in packages and files, and the individual package and file information logged such that following any failure, accessing the log file determines at which package and which file in the package the failure occurred.

13. One or more computer-readable media having computer-executable instructions which when executed perform the method of claim 1.

14. In a computing environment, a method comprising:

breaking an operating system image into separate updateable partitions; and

updating at least one partition in isolation with respect to another partition.

15. The method of claim 14 wherein updating at least one partition comprises booting a computing device into an update mode.

16. The method of claim 14 wherein updating at least one partition in isolation with respect to another partition comprises building a replacement image for a first partition and writing the replacement image over an existing image in the first partition, and updating a second partition by separately updating at least two components in an image in the second partition.

17. The method of claim 16 further comprising backing up the existing image in the first partition to a backup image, determining if writing the replacement image successfully completed, and if not, restoring the image from the backup image.

18. The method-of claim 17 wherein backing up the existing image includes storing the backup image in a compressed form.

19. The method of claim 16 wherein updating the second partition comprises logging the identity of each updated component to a log file, such that if a failure occurs, the log file may be accessed determines at which component update the failure occurred.

20. The method of claim 16 wherein updating the second partition comprises applying a binary difference file to an existing component.

21. The method of claim 20 wherein applying a binary difference file to an existing component comprises applying a subset of the binary difference file to a subset of the existing component.

22. The method of claim 21 wherein the subset comprises a block of data having a defined size.

23. The method of claim 16 wherein updating the second partition comprises simulating an update process, and determining that the simulation succeeded before committing updates to the second partition.

24. One or more computer-readable media having computer-executable instructions which when executed perform the method of claim 14.

25. In a computing device, a system comprising:

a boot mechanism; and

an update loader to which the boot mechanism boots upon detection of a pending update, the update loader comprising the only entity in the device code having write access to protected storage of the device, the protected storage containing at least two partitions and the update loader separately updating each partition.

26. The system of claim 25 further comprising a validation process, wherein prior to booting to the update loader, the validation process validates at least one update package, and if at least one update package is valid, the validation process queues each valid package for update and sets a mechanism for the boot mechanism to detect the pending update.

27. The system of claim 26 wherein the the validation process validates at least one update package by checking that each package is properly signed.

28. The system of claim 26 wherein the the validation process validates at least one update package by checking that each package is properly constructed.

29. The system of claim 25 wherein the boot mechanism boots the device into the update mode based on the value of a flag that was set prior to a reboot.

30. The system of claim 25 wherein the protected storage of the device is partitioned into a plurality of partitions, and wherein a selected partition is updated by the update component by building a replacement image for the partition and writing the replacement image over an existing image in the selected partition.

31. The system of claim 30 wherein the update component backs up the existing image in the selected partition to a backup image for restoring to the selected partition if the replacement image is not successfully written to the selected partition.

32. The system of claim 31 wherein the update component backs up the existing image in a compressed form.

33. The system of claim 30 wherein the protected storage of the device is partitioned into a plurality of partitions, and wherein a selected partition is updated by the update component by separately updating at least two components in the selected partition.

34. The system of claim 33 wherein the update loader updates at least one of the components in the selected partition by applying a binary difference file to an existing component.

35. The system of claim 34 wherein the update loader applies the binary difference file by applying a subset of the binary difference file to a subset of the existing component.

36. The system of claim 33 wherein the update loader simulates at least one update before committing the update.