Method for solving failure of online upgrade of FPGA (Field Programmable Gate Array)

Abstract

The invention discloses an FPGA (Field Programmable Gate Array) online upgrade failure solving method, which comprises the following steps of: starting to read configuration data byte by byte from an initial position, jumping to a target address after a preset synchronization word is read, starting to load mirror image data of a first timer, and configuring the first timer; after the mirror image data of the first timer is loaded, successfully starting the first timer to start timing, reading the mirror image of the to-be-updated program, performing integrity verification on the mirror image of the to-be-updated program, starting to load the mirror image of the to-be-updated program if the verification is successful in the first preset time, and otherwise, reading mirror image data of the second timer, and starting a second timer to start timing, and if the complete to-be-updated program mirror image is not read within a second preset time, triggering a rollback event. Therefore, by introducing the two timers, overtime detection and program integrity verification are carried out in the upgrading process, so that the system can rapidly return to a stable state when upgrading fails, and the upgrading success rate and the system reliability are improved.

Description

Technical Field

[0001] The present invention relates to the field of FPGA upgrade technology, and in particular to a solution to FPGA online upgrade failure. Background Art

[0002] In military applications, with the large-scale application of FPGAs, the integration of weapons and equipment is becoming increasingly higher, and the integration requirements for components equipped with FPGA products are also becoming higher and higher. Therefore, in the application of weapons and equipment, the upgrade method of FPGA-mounted simulators is increasingly unable to meet the current high-integration needs.

[0003] The traditional FPGA (field programmable gate array) online or serial port upgrade method can solve the upgrade problem of mounting the emulator. However, if the traditional method fails to upgrade, the relevant program will no longer exist in the product and cannot be run again. At this time, the system will be stuck and cannot be used again or any upgrade processing will be performed. Once the upgrade fails, there is a pain point that the emulator must be remounted to continue the upgrade.

[0004] During an FPGA system upgrade, ensuring the reliability and security of the upgrade process is crucial. The system reads data starting at address 0, searching for a synchronization word, such as (0xaa995566). After finding the synchronization word, the configuration logic begins loading the FPGA with commands embedded in the configuration stream. However, in some special scenarios, the synchronization word stored in the configuration stream may be lost, resulting in an inability to roll back and system malfunction. Summary of the Invention

[0005] This application provides a solution to FPGA online upgrade failure by introducing two timers to perform timeout detection and program integrity verification during the upgrade process to ensure that the system can quickly fall back to a stable state when the upgrade fails, thereby improving the upgrade success rate and system reliability.

[0006] This application provides a solution to FPGA online upgrade failure, including: S101, when the FPGA is performing a system upgrade, the configuration data is read byte by byte starting from the initial position and a preset synchronization word is detected; S102, after reading the preset synchronization word, parsing the instruction pre-embedded in the synchronization word, jumping to the target address to start loading the first timer mirror data, and configuring the watchdog counter of the first timer; S103, after the first timer image data is loaded, the first timer is successfully started to start timing, the program image to be updated is read, and the integrity of the program image to be updated is verified. If the verification is successful within the first preset time, the program image to be updated is loaded; otherwise, step S104 is executed; S104 , reading the second timer image data, starting the second timer to start timing, and triggering a rollback event if the complete image of the program to be updated cannot be read within the second preset time.

[0007] Preferably, the configuration storage area of ​​the FPGA is provided with configuration data of the first timer and the second timer, which are respectively located before the start address and after the end address of the storage area where the program to be updated is located, forming a storage barrier.

[0008] Preferably, the first timer is located before the starting address of the storage area where the program to be updated is located, serving as a front barrier for verifying and timing the synchronization word before loading the program; the second timer is located after the end address of the storage area where the program to be updated is located, serving as a rear barrier for performing integrity verification and timing after the program loading is completed.

[0009] Preferably, the target address is set as the upgrade program storage address, and the upgrade program storage address is set as the storage address of the program to be updated.

[0010] Preferably, the integrity verification of the program image to be updated includes: Perform matching verification on the synchronization word; The subsequent read data is verified using the preset verification mechanism.

[0011] Preferably, the triggering rollback event specifically includes: Start from the pre-stored stable working program image and restore to the stable working state before the FPGA upgrade.

[0012] Preferably, the method further comprises: If the synchronization word is lost or a block of image is erased, the configuration data is read from the configuration storage area in a predetermined order to find the synchronization word, and the timing function of the first timer is used as a timeout detection means. If a timeout is detected, a rollback event is triggered.

[0013] One or more technical solutions provided in this application have at least the following technical effects or advantages: By setting the first timer (timer1) and the second timer (timer2), the integrity of the program can be periodically checked during the loading process to prevent timeouts during the synchronization word search or program loading process. If the integrity of the program image to be updated cannot be successfully verified within the first preset time, or if the complete program image to be updated cannot be read within the second preset time, a fallback event will be triggered, and the program will be started from the pre-stored stable working program image (Golden image) to restore to the stable working state before the upgrade; The integrity of the program image to be updated is verified using a pre-set synchronization word and a checksum mechanism, ensuring that the loaded program is correct and complete. If the synchronization word is lost or the image is erased, the configuration logic continues to read configuration data from the configuration storage area in a predetermined order to search for the synchronization word. The first timer's timing function is used as a timeout detection method, further enhancing system security. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 The figure is a flowchart of a method for resolving an FPGA online upgrade failure according to an embodiment of the present invention. DETAILED DESCRIPTION

[0015] To facilitate understanding of the present invention, the present application will be described more comprehensively below with reference to the relevant drawings; the drawings show preferred embodiments of the present invention, but the present invention can be implemented in many different forms and is not limited to the embodiments described herein; on the contrary, the purpose of providing these embodiments is to enable a more thorough and comprehensive understanding of the disclosed content of the present invention.

[0016] It should be noted that the terms “vertical”, “horizontal”, “up”, “down”, “left”, “right” and similar expressions used in this document are for illustrative purposes only and do not represent the only implementation method.

[0017] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this invention pertains; the terms used herein in the specification of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention; the term "and / or" used herein includes any and all combinations of one or more of the associated listed items.

[0018] During FPGA system upgrades, ensuring the reliability and security of the upgrade process is crucial. In particular, in certain scenarios, the synchronization word stored in the configuration memory area may be lost or corrupted, preventing the system from properly rolling back, which in turn affects normal operation. To address this issue, this paper, based on the domestically produced Fudan Micro FPGA platform and combined with the MicroBlaze soft-core golden image, proposes a method using dual timers (timer1 and timer2). This method creates a storage barrier for the program memory area to be upgraded, achieving physical isolation. This ensures that if an anomaly is detected during the update process, the dual timers can promptly detect it and trigger a fallback mechanism.

[0019] The embodiments of this invention are primarily used in system upgrade scenarios based on the domestically produced Fudan Micro FPGA platform. As a leading domestic FPGA solution provider, Fudan Micro FPGA's products are widely used in numerous fields. The MicroBlaze soft core is a configurable 32-bit RISC processor core that can be implemented within an FPGA as the system's control core. In this embodiment, the MicroBlaze soft core is used as part of the golden image to provide a stable and reliable system fallback mechanism.

[0020] like Figure 1 As shown in the figure, a solution to the FPGA online upgrade failure includes the following steps: S101, when the FPGA is performing a system upgrade, the FPGA configuration logic reads the configuration data byte by byte starting from the initial position and detects a preset synchronization word in the data stream to indicate the start of the configuration data.

[0021] The selection of the synchronization word is crucial during FPGA configuration. It must be unique and not occur naturally in normal configuration data to avoid misidentification. Furthermore, the synchronization word design should also consider noise and bit error rates during data transmission to ensure high robustness.

[0022] The preset sync word is a unique, pre-defined data pattern, such as 0xaa995566, that identifies the start and integrity of the configuration data. The configuration logic detects the sync word using a pattern matching algorithm. By reading the sync word, the FPGA can confirm the correctness of the configuration data and provide an accurate starting point for the subsequent loading process.

[0023] In some embodiments, the FPGA configuration memory area is used to store FPGA configuration data, including synchronization words, program data, checksums, etc. A first timer (timer1) and a second timer (timer2) are set in the FPGA configuration memory area, located before the start address and after the end address of the memory area containing the program to be updated (the upgrade program memory area), respectively, to form a memory barrier.

[0024] Specifically, the first timer (timer1) is located before the starting address of the storage area containing the program to be updated. It serves as a pre-barrier, verifying the synchronization word and timing before loading the program. Before loading the program to be updated, the configuration logic first reads and verifies the synchronization word in the first timer image. This synchronization word is used to initialize the first timer and ensure that the configuration data of the first timer is correct and complete. The program to be updated is then loaded. After jumping to the target address, the first timer acts as a loading condition. The second timer (timer2) is located after the ending address of the storage area containing the program to be updated. It serves as a post-barrier, performing integrity verification and timing after the program is loaded. The positions of the two timers in the storage area are fixed and do not change depending on the program.

[0025] The first timer (timer1) and the second timer (timer2) are both programmable timers, with their timing lengths and count thresholds adjustable based on actual needs. Specifically, the timing length of timer1 is set to a first preset time, greater than the maximum expected time required for system program loading, to ensure that timeouts do not occur during the synchronization word search or program loading process. The count threshold of timer2 is set to a second preset time, less than the timing length of timer1, to allow for shorter detection of program incompleteness.

[0026] S102, after reading the preset synchronization word, parse the instructions pre-embedded in the synchronization word, jump to the target address and start loading the first timer mirror data (configuration information of the first timer, such as timing length, technical threshold, etc.), so that the configuration logic can correctly initialize and start the first timer, and configure the watchdog counter of the first timer.

[0027] Specifically, the pre-embedded instruction is set as an IPROG command, which instructs the FPGA configuration logic to jump to the target address and begin reading the first timer mirror data to search for the preset synchronization word. Once the synchronization word is found, the first timer is configured. Before loading the program to be updated, the configuration logic first reads and verifies the synchronization word in the first timer mirror. This synchronization word is used to initialize the first timer and ensure that the configuration data of the first timer is correct and complete.

[0028] The watchdog counter is used to periodically check the integrity of the program during the loading process to prevent timeouts from occurring during the process of searching for synchronization words or loading the program.

[0029] S103: After loading the first timer image data, the first timer is successfully started to start timing, the program image to be updated is read from the configuration storage area (the image contains the program data that needs to be updated in the FPGA and is used to replace or update the existing FPGA configuration), and the corresponding preset synchronization word is retrieved to perform integrity verification of the program image to be updated. If the verification is successful within the first preset time, the program image to be updated is loaded; otherwise, step S104 is executed.

[0030] Among them, the program image to be updated refers to the program data used to update or replace the current configuration of the FPGA. This data usually exists in the form of a binary file and contains the new logic or functions that the FPGA needs to execute. During the system upgrade process of the FPGA, the program image to be updated is loaded into the internal configuration memory of the FPGA to replace the old configuration data, thereby achieving functional updates or expansions. The program image to be updated is usually stored in an external memory, such as Flash memory, EEPROM or other non-volatile storage devices. These memories are connected to the FPGA and are used to provide updated program images when needed. When the FPGA is started or the system is upgraded, the configuration logic will read the program image to be updated from the external memory and load it into the internal configuration memory of the FPGA.

[0031] Specifically, the integrity verification of the program image to be updated includes: The synchronization word is matched and verified. After the preset synchronization word in the program image data to be updated is retrieved, the subsequent read data is verified using a preset verification mechanism. The verification mechanism can use a checksum or a cyclic redundancy check (CRC), which is not limited or elaborated in the present invention.

[0032] S104, read the second timer image data, start the second timer to start timing, if the complete program image to be updated cannot be read within the second preset time, trigger the fallback event, start from the pre-stored stable working program image (Golden image), and restore to the stable working state before the upgrade.

[0033] Among them, the first preset time and the second preset time are set according to actual conditions and expert experience. For example, the first preset time is set to be greater than the maximum time required for the system to load the program, and takes into account the real-time requirements of the system; the second preset time is set to be small enough to detect incomplete programs in a shorter time.

[0034] Specifically, the Golden image is a stable and known working program that has been rigorously tested and verified, and is backed up before updating the Golden image to prevent damage or loss; the stable working program image is stored in non-volatile memory to ensure that it remains available after the system is powered off or inflated.

[0035] In some embodiments, the method further comprises: If the synchronization word is lost or a block of the image is erased, the configuration logic continues to read the configuration data from the configuration storage area in a predetermined order to search for the synchronization word, and uses the timing function of the first timer as a timeout detection means, where the timeout period is set to be greater than the preset maximum expected time required to find the synchronization word; if a timeout is detected, a fallback event is triggered.

[0036] For example, consider an FPGA system with an initial memory address of ADDR 0 and an upgrade program stored at ADDR 1. The timer 1 image is already placed before ADDR 1, and the timer 2 image is placed after the upgrade program completes. The solutions to the FPGA online upgrade failure include: A1. Initial read: The FPGA configuration logic reads the configuration data starting from ADDR 0, finds the IPROG command, and jumps to ADDR 1.

[0037] A2. Find the timer1 synchronization word: Start searching for the synchronization word (such as 0xaa995566) in the timer1 image at ADDR 1. After finding the synchronization word, start configuring the timer1 watchdog counter and set the timing time (the first preset time) to T1 (which is longer than the time required for the system to load the program).

[0038] A3. Read the update program: After reading the timer1 image data, timer1 starts timing and then reads the program image to be updated (updata) from the storage, first looking for the synchronization word.

[0039] A4. Determine the integrity of the update: If the update image is complete, run the program to be updated directly without reading the timer2 image. If the update image is incomplete (for example, the middle or tail is missing), read the timer2 image and configure a very small counter value (the second preset time) for timer2, T2. When timer2 counts up, a fallback event is triggered, and the FPGA starts from the Golden image.

[0040] A5. Handling synchronization header loss or image erasure: If the synchronization word of the updata image is not found before timer1 expires, or the image is erased: After timer1 expires, the fallback event is triggered, and the FPGA starts from the Golden image, restoring the normal operation of the system.

[0041] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages: Using two timers (timer1 and timer2), a memory barrier is formed around the program storage area to be updated, achieving physical isolation. Timer1, located before the start address of the program storage area to be updated, is used for synchronization word verification and timing before program loading. Timer2, located after the end address, is used for integrity verification and timing after program loading is complete.

[0042] By setting the first timer (timer1) and the second timer (timer2), the integrity of the program can be periodically checked during the loading process to prevent timeouts during the synchronization word search or program loading process. If the integrity of the program image to be updated cannot be successfully verified within the first preset time, or if the complete program image to be updated cannot be read within the second preset time, a fallback event will be triggered, and the program will be started from the pre-stored stable working program image (Golden image) to restore to the stable working state before the upgrade; The integrity of the program image to be updated is verified using a pre-set synchronization word and a checksum mechanism, ensuring that the loaded program is correct and complete. If the synchronization word is lost or the image is erased, the configuration logic continues to read configuration data from the configuration storage area in a predetermined order to search for the synchronization word. The first timer's timing function is used as a timeout detection method, further enhancing system security.

[0043] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Various modifications and variations are readily apparent to those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A solution to FPGA online upgrade failure, characterized in that: include: S101, when the FPGA is performing a system upgrade, the configuration data is read byte by byte starting from the initial position and a preset synchronization word is detected; S102, after reading the preset synchronization word, parsing the instruction pre-embedded in the synchronization word, jumping to the target address to start loading the first timer mirror data, and configuring the watchdog counter of the first timer; S103, after the first timer image data is loaded, the first timer is successfully started to start timing, the program image to be updated is read, and the integrity of the program image to be updated is verified. If the verification is successful within the first preset time, the program image to be updated is loaded; otherwise, step S104 is executed; S104 , reading the second timer image data, starting the second timer to start timing, and triggering a rollback event if the complete image of the program to be updated cannot be read within the second preset time.

2. The FPGA online upgrade failure solution according to claim 1, wherein: The configuration storage area of ​​the FPGA is provided with configuration data of the first timer and the second timer, which are respectively located before the start address and after the end address of the storage area where the program to be updated is located, forming a storage barrier.

3. The FPGA online upgrade failure solution according to claim 2, wherein: The first timer is located before the starting address of the storage area where the program to be updated is located, and serves as a front barrier for verifying and timing the synchronization word before loading the program; the second timer is located after the end address of the storage area where the program to be updated is located, and serves as a rear barrier for performing integrity verification and timing after the program loading is completed.

4. The FPGA online upgrade failure solution according to claim 1, wherein: The target address is set as the upgrade program storage address, and the upgrade program storage address is set as the storage address of the program to be updated.

5. The FPGA online upgrade failure solution according to claim 1, wherein: The integrity verification of the program image to be updated includes: Perform matching verification on the synchronization word; The subsequent read data is verified using the preset verification mechanism.

6. The FPGA online upgrade failure solution according to claim 1, wherein: The triggering fallback event specifically includes: Start from the pre-stored stable working program image and restore to the stable working state before the FPGA upgrade.

7. The FPGA online upgrade failure solution according to claim 1, wherein: The method further comprises: If the synchronization word is lost or a block of image is erased, the configuration data is read from the configuration storage area in a predetermined order to find the synchronization word, and the timing function of the first timer is used as a timeout detection means. If a timeout is detected, a rollback event is triggered.

Images