Bootloader updating

1. A microcontroller comprising a processor and a memory, wherein:

the memory comprises a first-stage bootloader region, a first second-stage bootloader region, a second second-stage bootloader region, and an application region for storing an application;

a first-stage bootloader is stored in the first-stage bootloader region;

an active second-stage bootloader is stored in an active one of the first and second second-stage bootloader regions;

the processor is configured to execute instructions from the first-stage bootloader when the microcontroller is reset;

the first-stage bootloader comprises instructions for transferring execution from the first-stage bootloader to the active second-stage bootloader;

the active second-stage bootloader comprises instructions for transferring execution from the active second-stage bootloader to an address in the application region;

the active second-stage bootloader comprises instructions for causing the processor to write a replacement second-stage bootloader to whichever of the first and second second-stage bootloader regions is not the active region; and

the first-stage bootloader comprises instructions for detecting the replacement second-stage bootloader in whichever of the first and second second-stage bootloader regions is not the active region and for transferring execution to the replacement second-stage bootloader in whichever of the first and second second-stage bootloader regions is not the active region when the microcontroller is next reset, such that whichever of the first and second second-stage bootloader regions is not the active region becomes the active second-stage bootloader region when the microcontroller is next reset.

2. The microcontroller of claim 1 , comprising hardware protection circuitry configured to prevent the first-stage bootloader from being overwritten by software stored in the memory.

3. The microcontroller of claim 1 , wherein the memory stores no software instructions for updating the first-stage bootloader.

4. The microcontroller of claim 1 , wherein the first-stage bootloader comprises instructions for authenticating the second-stage bootloader.

5. The microcontroller of claim 1 , wherein the first-stage bootloader does not contain any instructions for causing the processor to write to any of the first second-stage bootloader region, the second second-stage bootloader region, and the application region.

6. The microcontroller of claim 1 , wherein the active second-stage bootloader comprises instructions for authenticating an application stored in the application region.

7. The microcontroller of claim 6 , wherein the active second-stage bootloader comprises instructions for using a cryptographic or hash routine contained in the first-stage bootloader to authenticating an application stored in the application region.

8. The microcontroller of claim 1 , comprising a radio modem, wherein the microcontroller is configured to receive the replacement second-stage bootloader by radio.

9. The microcontroller of claim 1 , wherein an application stored in the application region comprises instructions for controlling a communications interface of the microcontroller to receive the replacement second-stage bootloader.

10. The microcontroller of claim 9 , wherein the memory is non-volatile memory and wherein the application comprises instructions for storing the replacement second-stage bootloader in an update working region of the memory; and

wherein the second-stage bootloader comprises instructions for copying the replacement second-stage bootloader from the update working region to whichever of the first and second second-stage bootloader regions is not the active region.

11. The microcontroller of claim 9 , wherein the application comprises instructions for writing the replacement second-stage bootloader directly to whichever of the first and second-stage bootloader regions is not the active region.

12. The microcontroller of claim 1 , wherein an application is stored in the application region, and wherein the application comprises a first and a second portion, the first portion being configured as secure and the second portion being configured as non-secure.

13. The microcontroller of claim 1 , wherein the memory is a non-volatile memory, and wherein the first-stage bootloader region, the first second-stage bootloader region, the second second-stage bootloader region and the application region are distinct, non-overlapping regions of the memory.

14. The microcontroller of claim 1 , wherein the first and second second-stage bootloader regions are of a common size, and wherein the microcontroller has an amount of random-access memory (RAM) that is less than said common size.

15. The microcontroller of claim 1 , wherein the active second-stage bootloader or an application in the application region comprises instructions for signalling to the first-stage bootloader when the replacement second-stage bootloader has been written.

16. The microcontroller of claim 1 , wherein the active second-stage bootloader comprises metadata representative of an age of the active second-stage bootloader, and wherein the first-stage bootloader comprises a comparison algorithm for determining which of the first and second second-stage bootloader regions contains a newer second-stage bootloader and for transferring executing the newer second-stage bootloader.

17. The microcontroller of claim 1 , wherein the replacement second-stage bootloader comprises position-dependent code.

18. The microcontroller of claim 1 , wherein the second-stage bootloader or an active application stored in the application region comprises instructions for receiving a replacement application image.

19. The microcontroller of claim 1 , comprising hardware protection circuitry configured to prevent writing to the first and second second-stage bootloader regions by software executed from the application region.

20. A method of updating a bootloader on a microcontroller, wherein:

the microcontroller comprises a processor and a memory;

the memory comprises a first-stage bootloader region, a first second-stage bootloader region, a second second-stage bootloader region, and an application region;

a first-stage bootloader is stored in the first-stage bootloader region;

an active second-stage bootloader is stored in an active one of the first and second second-stage bootloader regions;

an application is stored in the application region; and

the processor is configured to execute instructions from the first-stage bootloader when the microcontroller is reset,

the first-stage bootloader comprises instructions for transferring execution from the first-stage bootloader to the active second-stage bootloader;

the active second-stage bootloader comprises instructions for transferring execution from the active second-stage bootloader to the application;

the method comprising:

the active second-stage bootloader causing the processor to write a replacement second-stage bootloader to whichever of the first and second second-stage bootloader regions is not the active region, wherein the first-stage bootloader comprises instructions for detecting the replacement second-stage bootloader in whichever of the first and second second-stage bootloader regions is not the active region and for transferring execution to the replacement second-stage bootloader in whichever of the first and second second-stage bootloader regions is not the active region when the microcontroller is next reset, such that whichever of the first and second second-stage bootloader regions is not the active region becomes the active second-stage bootloader region when the microcontroller is next reset.

21. The method of claim 20 , wherein the first second-stage bootloader region is rewriteable, and wherein the second rewriteable second-stage bootloader region is rewriteable.

22. The microcontroller of claim 1 , wherein the first second-stage bootloader region is rewriteable, and wherein the second rewriteable second-stage bootloader region is rewriteable.