Processor power-down recovery method, system, electronic device, and readable storage medium

Abstract

The present disclosure relates to the technical field of processors, in particular to a processor power-off recovery method and system, an electronic device and a readable storage medium. The method comprises: latching a write transaction shadow copy of a write request on a passageway between a processor core and an external non-volatile memory when the write request is accepted and is directed to a co-hosted data area; in response to a power-off warning signal, freezing the current latched write transaction shadow copy at a pipeline retirement boundary of a processor in-transit instruction, and writing the write transaction shadow copy into a target slot of a recovery area of the external non-volatile memory; after power-on reset, default setting a data area write blocking signal to block writing to the co-hosted data area; scanning and verifying snapshot slots of the recovery area to determine whether there is a valid snapshot; and if there is a valid snapshot, performing data recovery based on data in the snapshot. The technical solution can reliably deal with sudden power-off events of a processor system, and ensure data consistency and system reliability.

Description

Technical Field

[0001] This disclosure relates to the field of processor technology, specifically to a processor power-down recovery method, system, electronic device, and readable storage medium. Background Technology

[0002] With the rapid development of embedded systems and IoT devices, an increasing number of processor systems are adopting an architecture design that uses a serial interface to connect to external non-volatile memory as shared main memory (or unified main memory). In this architecture, program code and runtime data are stored together in the same external non-volatile memory, and the processor core accesses this memory through a serial interface (such as SPI, xSPI, etc.). This design has significant advantages such as fewer pins, simpler circuit board layout, and lower system cost, and is therefore widely used in cost- and size-sensitive applications such as automotive electronics, industrial control, smart homes, and wearable devices.

[0003] In the process of making this disclosure, the inventors discovered that the processor system using a serial interface to connect to external non-volatile memory as common main memory has serious reliability problems when facing sudden power outages. Specifically, write operations to external non-volatile memory have significant latency. Taking Serial Peripheral Interface Magnetoresistive Random Access Memory (SPI MRAM) as an example, its page write cycle can reach tens of microseconds or even longer. While Extended Serial Peripheral Interface Magnetoresistive Random Access Memory (xSPIMRAM) supports higher clock frequencies, its write completion time is still much higher than the write speed of the processor core's internal registers. When the system encounters a sudden power outage, there may be write requests that have not yet been physically committed to the external non-volatile memory. Because the write latency of external non-volatile memory is much higher than that of volatile memory (such as SRAM and DRAM), write requests in transit may not have been physically written to the non-volatile medium when the power outage occurs, resulting in data loss or data corruption.

[0004] More seriously, traditional solutions typically only attempt to save the processor's internal state (such as register files and program counters) to non-volatile memory during a power outage, neglecting any write transactions that may be in transit within the processor pipeline. The data corresponding to these in-transit write transactions may have already updated the processor's architectural state (e.g., write instructions have been retired), but the corresponding data has not yet been written to the common main memory data area. In this situation, if only the processor's architectural state is saved while write transaction information is lost, a discrepancy will occur between the architectural state and the actual memory state after power-on recovery—a phenomenon known as "state splitting." Summary of the Invention

[0005] To address the problems in the related technologies, this disclosure provides a processor power-down recovery method, system, electronic device, and readable storage medium.

[0006] In a first aspect, this disclosure provides a processor power-down recovery method, applied to a processor system connected via a serial interface to an external non-volatile memory as a shared main memory, wherein the shared main memory stores both program code and runtime data. The method includes:

[0007] On the path between the processor core and external non-volatile memory, when a write request is received pointing to the common main memory data area, a copy of the write transaction is latched; the copy of the write transaction is cleared after the physical commit is confirmed on the external non-volatile memory. In response to a power failure warning signal, at the pipeline retirement boundary of the processor's in-transit instructions, the currently latched copy of the write transaction is frozen and written to the target slot of the recovery area of ​​the external non-volatile memory; the recovery area includes at least two snapshot slots. After power-on reset, the data area write blocking signal is set by default to prevent writing to the common main memory data area; Scan and verify the snapshot slots in the recovery area to determine whether a valid snapshot exists; If a valid snapshot exists, perform data recovery based on the data in the snapshot; If no valid snapshot exists, release the write blocking signal for the data area and perform a cold start.

[0008] In one embodiment of this disclosure, the write transaction copy includes the address of the write request, byte enable, value to be written, and data integrity identifier; when latching the write transaction copy of the write request, the copy validity flag is set simultaneously; when clearing the write transaction copy, the copy validity flag is cleared simultaneously.

[0009] In one embodiment of this disclosure, when the copy validity flag is valid, back pressure is used to prevent subsequent write requests to the common main memory data area from entering the path until the copy validity flag is cleared.

[0010] In one embodiment of this disclosure, freezing the currently latched write transaction copy at the pipeline retirement boundary of a processor instruction in transit includes: First-level convergence: Pause new instruction fetching and wait for all instructions in the processor pipeline to retire in order to solidify the processor architecture state; Second-level convergence: After the first-level convergence is completed, read the currently latched copy of the write transaction at the pipeline retirement boundary and freeze it; The second-level convergence does not require that the write request corresponding to the write transaction copy has been physically committed on the external non-volatile memory as a necessary condition for convergence completion.

[0011] In one embodiment of this disclosure, each snapshot slot in the recovery area includes a serial number field and a commit flag field; the target slot of the recovery area written to external non-volatile memory includes: Select the target slot based on the sequence number and commit flag of each snapshot slot: The slot with an invalid submission flag is preferentially selected as the target slot; If all slots have valid commit flags, the slot with the older sequence number is selected as the target slot, and the slot with the newer sequence number and a valid commit flag is retained as a rollback candidate slot.

[0012] In one embodiment of this disclosure, the writing to the target slot of the recovery area of ​​the external non-volatile memory further includes a two-stage commit: In the first stage, before writing the snapshot content, if the commit flag of the target slot is a valid value, then the commit flag is written to an invalid value. In the second stage, after all the head area and payload area of ​​the target slot have been written, a new valid value is written to the submission flag at the last atom.

[0013] In one embodiment of this disclosure, the snapshot slot includes an identifier field, a header checksum field, a payload checksum field, and a commit flag field; Whether the judgment has a valid snapshot includes: A valid snapshot is determined to exist in the snapshot slot only when the identifier field in the same snapshot slot matches the agreed constant, the header check value field passes the check, the load check value field passes the check, and the commit flag field is consistent with the agreed commit constant.

[0014] In one embodiment of this disclosure, performing data recovery based on data in a snapshot includes: Write the program counter, general-purpose register set, and control status register from the snapshot back to the processor core; An idempotent write request is initiated to the shared main memory data area based on the write transaction copy in the snapshot; Release the write blocking signal for the data area after the write is completed.

[0015] In one embodiment of this disclosure, it further includes: Identify non-replay access requests pointing to memory-mapped input / output addresses, peripheral command addresses, or atomic operation addresses; The step of latching the write transaction copy is not performed for the non-replay access request; If the non-replay access request is within a consistency window where the processor has retired but external side effects have not yet taken effect, and the power failure warning signal is received, then the current snapshot saving is abandoned and the cold start is performed.

[0016] In one embodiment of this disclosure, the power failure warning signal includes a first-level warning signal, a second-level evaluation signal, and a third-level critical signal generated sequentially; the method further includes: In response to the first-level warning signal, a power-holding window is provided, and a snapshot write is performed within the power-holding window; If the snapshot has not been written completely when the second-level evaluation signal is triggered, the current snapshot saving will be abandoned. If the snapshot has not been written when the third-level critical signal is triggered, the incomplete content of the target slot will be discarded in the valid snapshot determination after power-on.

[0017] In one embodiment of this disclosure, the data area write blocking signal is active from the time of power-on reset until the snapshot decision is completed; When a valid snapshot exists, the data area write blocking signal remains in effect until the data recovery is complete; When a valid snapshot is not found, the data area write blocking signal is released immediately after the decision is made.

[0018] In one embodiment of this disclosure, the data area write blocking signal only intercepts write requests to the common main memory data area address; instruction fetch requests, read requests to the common main memory data area, and access requests to control class addresses are not intercepted by the data area write blocking signal.

[0019] In one embodiment of this disclosure, it further includes: A custom safe recovery point capture instruction is provided. When the instruction retires at a program semantic safe point, it atomically captures the current processor architecture state to the on-chip shadow register set and maintains the on-chip valid flag. The preconditions for setting the on-chip valid flag include that there are currently no pending data area write requests. After the valid flag within the chip is set, multi-source failure events are continuously monitored, and the valid flag within the chip is automatically cleared when any failure event occurs. When the power failure warning signal is triggered, if the on-chip valid flag is valid, the step of waiting for pipeline retirement is skipped, and the contents of the on-chip shadow register group are directly written into the recovery area.

[0020] In one embodiment of this disclosure, the multi-source failure event includes at least one of the following: Write requests to the common main memory data area, memory-mapped input / output read / write, control status register write, atomic operations, exception return instructions, control flow changes caused by interrupts or exceptions, and shadow register aging timeout.

[0021] Secondly, this disclosure provides a processor power-down recovery system, applied to a processor system connected via a serial interface to an external non-volatile memory as a shared main memory, wherein the shared main memory stores both program code and runtime data, including: The main memory access arbitration unit is located on the path between the processor core and the serial non-volatile memory control unit. It is used to latch the write transaction copy of the write request when a write request to the common main memory data area is received; and to clear the write transaction copy after receiving confirmation of the physical commit of the write request on the external non-volatile memory. A recovery control unit, coupled to the main memory access arbitration unit, is used to freeze the copy of the write transaction currently latched by the main memory access arbitration unit in an internal cache at the pipeline retirement boundary of the processor's in-transit instructions in response to a power failure warning signal. A status snapshot management unit, coupled to the recovery control unit and the main memory access arbitration unit, is used to write the write transaction copies frozen by the recovery control unit into the target slot of the recovery area of ​​the external non-volatile memory; the recovery area includes at least two snapshot slots; The recovery control unit is further configured to, upon power-on reset, default to setting a data area write blocking signal and apply it to the main memory access arbitration unit to prevent writing to the common main memory data area; drive the status snapshot management unit to scan and verify the snapshot slots in the recovery area to determine whether a valid snapshot exists; if a valid snapshot exists, perform data recovery based on the data in the snapshot; if no valid snapshot exists, release the data area write blocking signal and perform a cold start.

[0022] Thirdly, embodiments of this disclosure provide an electronic device including a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method as described in any of the first aspects.

[0023] Fourthly, this disclosure provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the method as described in any of the first aspects.

[0024] The technical effects provided by the embodiments of this disclosure may include the following beneficial effects: The processor power-down recovery method provided in this disclosure establishes a write transaction copy latching mechanism on the path between the processor core and external non-volatile memory. When a write request to a shared main memory data area is received, the write transaction copy of the write request is latched, and the copy is cleared after the write request is physically committed on the external non-volatile memory. This allows for precise tracking of every data area write transaction that has not yet been physically committed during normal operation. This mechanism ensures that, in the event of a power failure, the system can obtain complete information on all pending write requests (including address, byte enable, value to be written, and data integrity flag), avoiding inconsistencies between the architecture state and the storage state caused by lost write transactions. Simultaneously, backpressure prevents subsequent write requests from entering the path when the copy validity flag is valid, ensuring that at any given time, at most one incomplete write transaction copy needs to be processed. This simplifies the logical complexity of power-down saving and avoids the state explosion problem caused by multiple incomplete write transactions.

[0025] The technical solution provided in this disclosure, in response to a power failure warning signal, freezes the currently latched write transaction copy at the pipeline retirement boundary of the processor's in-transit instructions and writes it into the target slot of the recovery area, achieving atomic capture of the write transaction copy and the processor architecture state. The first-level convergence freezes the processor architecture state by pausing new instruction fetching and waiting for all in-transit instructions to retire, ensuring the consistency and predictability of the processor state during recovery. The second-level convergence reads and freezes the write transaction copy at the pipeline retirement boundary, without requiring that the write request corresponding to the write transaction copy has been physically committed on external non-volatile memory as a necessary condition for convergence completion. It fully considers the slow write characteristics of non-volatile memory, capturing and saving uncommitted write transaction copies, and re-executing them through idempotent writes upon power-on recovery. This significantly shortens the power failure response time and improves the success rate of power failure saving while ensuring data consistency.

[0026] The technical solution provided in this disclosure effectively manages limited recovery area resources by setting up a recovery area containing at least two snapshot slots and intelligently selecting slots based on the commit flag and serial number—prioritizing slots with invalid commit flags, and selecting the slot with the older serial number as the target slot when all slots are valid, while retaining the valid slot with the newest serial number as a rollback candidate slot. This avoids the problem of having no recoverable data source due to overwriting valid snapshots. Even if a power outage occurs during the writing of a new snapshot, the system can still roll back to the latest valid snapshot in the candidate slots after power-on, ensuring that at least one complete valid snapshot can be used for recovery, significantly improving the system's fault tolerance.

[0027] The technical solution provided in this disclosure employs a two-stage commit method for writing snapshots—first, the commit flag is written to an invalid value before writing the snapshot content; then, after all the header and payload areas have been written, a new valid value is written to the commit flag at the last atom—ensuring that the integrity of the snapshot can be reliably identified by the power-on recovery logic. If a power failure occurs during the snapshot writing process, the commit flag will remain invalid, and the slot will not be mistakenly identified as a valid snapshot after power-on, avoiding the risk of erroneous recovery based on incomplete data.

[0028] The technical solution provided in this disclosure prevents writes to the common main memory data area by setting a data area write blocking signal by default after power-on reset. This blocking signal remains valid until the snapshot slot in the recovery area is scanned and verified to determine the existence of a valid snapshot. This prevents the write operation in the boot code from corrupting the valid snapshot data in the recovery area before the snapshot determination is completed. The data area write blocking signal only blocks write requests to the common main memory data area address; instruction fetch requests, read requests, and control-type accesses are not blocked. This allows the boot execution unit to still read the boot code from the common main memory after power-on, achieving a balance between security and availability.

[0029] The technical solution provided in this disclosure, by performing four-fold condition verification on the snapshot slot in the recovery area (identifier word matches the agreed constant, header check value passes verification, load check value passes verification, and commit flag matches the agreed commit constant), can accurately identify and reject three types of invalid snapshots: snapshots that have not been written (identifier word mismatch), snapshots that are damaged due to power failure during the writing process (check value mismatch), and snapshots that have not completed two-stage commit (commit flag inconsistency). This ensures that only complete and valid snapshots are used for recovery, avoiding system anomalies caused by recovery based on outdated, damaged, or incomplete data, and significantly improving the reliability and security of power-on recovery.

[0030] In summary, the technical solution provided by the embodiments of this disclosure can reliably cope with sudden power failure events of the processor system. Through the synergistic effect of various technical means such as write transaction copy latching, pipeline convergence, multi-snapshot slot management, two-phase commit, power-on verification, and data area write blocking, the complete preservation of the processor state during power failure and accurate recovery after power-on are achieved. This significantly improves the reliability and data security of processor systems that use serial interface to connect external non-volatile memory as co-main memory, and has important engineering application value.

[0031] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0032] Other features, objects, and advantages of this disclosure will become more apparent from the following detailed description of non-limiting embodiments, taken in conjunction with the accompanying drawings. The following is a description of the accompanying drawings.

[0033] Figure 1 A block diagram of a processor system according to an embodiment of the present disclosure is shown.

[0034] Figure 2 A flowchart illustrating a processor power-down recovery method according to an embodiment of the present disclosure is shown.

[0035] Figure 3 A schematic diagram illustrating the field format of a snapshot slot according to an embodiment of the present disclosure is shown.

[0036] Figure 4a A flowchart illustrating the power-down save path according to an embodiment of the present disclosure is shown.

[0037] Figure 4b A flowchart illustrating a power-on recovery path according to an embodiment of this disclosure is provided.

[0038] Figure 5 A timing diagram is shown for a processor power-down recovery method according to an embodiment of the present disclosure.

[0039] Figure 6 A structural block diagram of a main memory access arbitration unit according to an embodiment of the present disclosure is shown.

[0040] Figure 7 A structural block diagram of a power failure warning unit according to an embodiment of the present disclosure is shown.

[0041] Figure 8 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0042] Figure 9 A schematic diagram of the structure of a computer system suitable for implementing the method according to embodiments of the present disclosure is shown. Detailed Implementation

[0043] In the following, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings to enable those skilled in the art to readily implement them. Furthermore, for clarity, portions unrelated to the description of exemplary embodiments have been omitted from the drawings.

[0044] In this disclosure, it should be understood that terms such as “comprising” or “having” are intended to indicate the presence of features, figures, steps, behaviors, components, parts or combinations thereof disclosed in this specification, and are not intended to exclude the possibility of the presence or addition of one or more other features, figures, steps, behaviors, components, parts or combinations thereof.

[0045] It should also be noted that, unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other. This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0046] Figure 1 A block diagram of a processor system according to an embodiment of the present disclosure is shown.

[0047] like Figure 1 As shown, the processor system includes a processor core 101, a main memory access arbitration unit 102, a serial non-volatile memory control unit 103, an external non-volatile memory 104, a recovery control unit 105, a status snapshot management unit 106, a boot execution unit 107, and a power failure warning unit 108.

[0048] The processor core 101 is coupled to the serial non-volatile memory control unit 103 via the main memory access arbitration unit 102. The serial non-volatile memory control unit 103 is connected to the external non-volatile memory 104 via a serial interface (e.g., Serial Peripheral Interface (SPI), eXtended SPI (xSPI), etc.). The external non-volatile memory 104 stores both program code and runtime data, thus serving as shared main memory. The recovery control unit 105 is coupled to the main memory access arbitration unit 102, the status snapshot management unit 106, and the power failure warning unit 108. The status snapshot management unit 106 is coupled to the main memory access arbitration unit 102 and accesses the recovery area of ​​the external non-volatile memory 104 via the main memory access arbitration unit 102 and the serial non-volatile memory control unit 103. The external non-volatile memory 104 includes a recovery area and a data area. The recovery area includes at least two snapshot slots for storing system status snapshots during power failure. After power-on, the boot execution unit 107 accesses the external non-volatile memory 104 via the main memory access arbitration unit 102. Its writes to the data area are constrained by the data area write blocking signal. The on-chip shadow register set is triggered by the processor core's custom safe recovery point capture instruction, and its validity allows the recovery control unit 105 to select the fast / slow path during power failure.

[0049] In this embodiment, the processor core 101 can be a 5-stage pipelined processor core based on the RISC-V architecture, or it can be a processor core based on other instruction set architectures with a defined retirement boundary. The external non-volatile memory 104 can be a Serial Peripheral Interface Magnetoresistive Random Access Memory (SPI MRAM), an Extended Serial Peripheral Interface Magnetoresistive Random Access Memory (xSPI MRAM), or a Serial Ferroelectric Random Access Memory (FRAM). The clock frequency of the serial peripheral interface is lower than the clock frequency of the processor core 101. In one embodiment, the clock frequency of the processor core 101 is approximately 100MHz, and the clock frequency of the serial interface is approximately 10MHz.

[0050] Figure 2 A flowchart illustrating a processor power-down recovery method according to an embodiment of the present disclosure is shown.

[0051] like Figure 2 As shown, the processor power-down recovery method includes: Step S201: On the path between the processor core and the external non-volatile memory, when a write request is received pointing to the common main memory data area, a copy of the write transaction is latched; the copy of the write transaction is cleared after the physical commit is confirmed on the external non-volatile memory.

[0052] During normal operation, when a data area write request issued by the processor core 101 is accepted by the main memory access arbitration unit 102, the main memory access arbitration unit 102 latches the address, byte enable, and value to be written of the write request into an internal register set as a write transaction copy, and simultaneously sets the copy validity flag. When the serial non-volatile memory control unit 103 reports confirmation that the physical submission of the write request on the external non-volatile memory 104 has been completed, the main memory access arbitration unit 102 clears the copy validity flag and releases the write transaction copy. In one embodiment, the write transaction copy also includes a data integrity identification field (e.g., a parity bit or CRC check value) for verifying data integrity during recovery and rewriting.

[0053] In step S202, in response to a power failure warning signal, at the pipeline retirement boundary of the processor's in-transit instructions, the currently latched copy of the write transaction is frozen and written to the target slot of the recovery area of ​​the external non-volatile memory; the recovery area includes at least two snapshot slots.

[0054] Specifically, when the power failure warning unit 108 detects that the input power has dropped to a threshold, it sends a power failure warning signal to the recovery control unit 105. In response to this signal, the recovery control unit 105 controls the processor core 101 to suspend new instruction fetching and wait for all instructions in transit in the pipeline to retire. At the pipeline retirement boundary, the recovery control unit 105 reads the currently latched copy of the write transaction from the main memory access arbitration unit 102 and freezes it in the internal cache. Subsequently, the driving state snapshot management unit 106 writes the frozen copy of the write transaction as the snapshot payload into the target slot of the recovery area of ​​the external non-volatile memory 104.

[0055] Step S203: After power-on reset, the data area write blocking signal is set by default to prevent writing to the common main memory data area.

[0056] When the system is powered on and reset, the recovery control unit 105 sets the default data area write blocking signal and applies it to the main memory access arbitration unit 102. This signal takes effect in the first clock cycle after the reset is released, earlier than the instruction fetch operation of the boot execution unit 107, thereby preventing the boot execution unit 107 from writing to the common main memory data area before the snapshot decision is completed, and avoiding the data to be restored from being overwritten by the startup initialization code.

[0057] Step S204: Scan and verify the snapshot slots in the recovery area to determine whether there are valid snapshots.

[0058] The recovery control unit 105 drives the state snapshot management unit 106 to scan each snapshot slot in the recovery area of ​​the external non-volatile memory 104, reads the identifier, header check value, load check value and commit flag field of each slot, and determines whether there is a valid snapshot in each slot according to the preset check rules.

[0059] Step S205: If a valid snapshot exists, perform data recovery based on the data in the snapshot.

[0060] The recovery control unit 105 writes the program counter, general-purpose register set and control status register in the snapshot back to the processor core 101, and initiates an idempotent write request to the common main memory data area according to the write transaction boundary descriptor in the snapshot (i.e. the write transaction copy written to the snapshot), and resubmits the address and data recorded in the copy to the external non-volatile memory 104, thereby finally completing the write transaction that was located in the serial gray window before the power failure.

[0061] Step S206: If no valid snapshot exists, release the data area write blocking signal and perform a cold start.

[0062] When all snapshot slots fail to be verified, the recovery control unit 105 releases the data area write blocking signal, enabling the boot execution unit 107 to execute the normal startup initialization process to cover the common main memory data area, and the system runs in cold start mode.

[0063] The above solution achieves processor volatility and write transaction consistency recovery in a co-main memory serial storage architecture by routinely maintaining write transaction copies, freezing snapshots during power failures, and implementing hardware write blocking and snapshot determination after power-on. Compared to existing technologies, this solution converges snapshot storage objects to processor architecture state and write transaction copies, avoiding duplicate saving of data areas; the hardware write blocking mechanism makes isolation strength orthogonal to firmware correctness, improving system reliability and security.

[0064] According to embodiments of this disclosure, the write transaction copy latching mechanism in step S201 will be described in detail.

[0065] The main memory access arbitration unit 102 is located on the path between the processor core 101 and the serial non-volatile memory control unit 103. This path can be a bus or a point-to-point connection. The main memory access arbitration unit 102 includes address decoding logic to decode the address of an access request from the processor core 101 to determine the target address type of the access request. Target address types include: common main memory data area address, common main memory program code area address (usually sharing the same physical address space as the data area, but distinguished by address range), memory-mapped input / output (MMIO) address, peripheral command address, control class address, and atomic operation address, etc.

[0066] When the access request received by the main memory access arbitration unit 102 is a write request pointing to the address of the common main memory data area, the main memory access arbitration unit 102 performs the following operations: First, check the status of the copy validity flag. If the copy validity flag is valid, it means that there is currently a write transaction copy waiting to be committed. The arbitration logic then uses a backpressure signal to prevent the write request from entering the path until the copy validity flag is cleared. The backpressure can be implemented by invalidating the write request handshake signal (e.g., AWREADY or WREADY) of the processor core 101, preventing the processor core 101 from completing the write request handshake and thus suspending the issuance of subsequent write requests. It should be noted that using a backpressure signal to prevent write requests from entering the path is optional. In another implementation, the serial interface occupancy can inherently guarantee that at any given time, at most one in-transit write request occupies the serial non-volatile memory control unit until it completes and returns confirmation.

[0067] If the copy validity flag is invalid (i.e., there are currently no incomplete write transaction copies), the main memory access arbitration unit 102 accepts the write request and latches the write request information into the write transaction copy latch group. The latched information includes, but is not limited to: the address of the write request (e.g., a 32-bit or 64-bit address), byte enable (indicating which bytes are valid), write data, and data integrity identifiers (e.g., ECC checksum or CRC checksum). Simultaneously with latching, the main memory access arbitration unit 102 sets the copy validity flag to valid.

[0068] Subsequently, the main memory access arbitration unit 102 forwards the write request to the serial non-volatile memory control unit 103. The serial non-volatile memory control unit 103, based on the type of the connected external non-volatile memory 104 (e.g., SPI MRAM, xSPI MRAM, or SPI FRAM), converts the write request into a corresponding serial protocol command sequence and sends it to the external non-volatile memory 104 via the serial interface. Upon receiving the complete write command and data, the external non-volatile memory 104 executes the write operation, completes the data writing on the physical medium, and then returns a write completion acknowledgment to the serial non-volatile memory control unit 103.

[0069] After receiving a write completion acknowledgment, the serial non-volatile memory control unit 103 sends a physical commit completion confirmation signal to the main memory access arbitration unit 102. In response to this confirmation signal, the main memory access arbitration unit 102 clears the contents of the write transaction copy latch group and invalidates the copy validity flag. At this point, the main memory access arbitration unit 102 can accept subsequent write requests.

[0070] Through the above mechanism, the latching and clearing of the write transaction copy are synchronized with the physical commit process of the external non-volatile memory, ensuring that the write transaction copy is only cleared after the write request has been physically committed. If a power failure occurs before the physical commit of the write request is completed, the write transaction copy is retained in the main memory access arbitration unit and can be captured to the recovery area during the power failure response.

[0071] The above technical solution ensures that there is at most one incomplete data area write transaction at any given time through the back pressure mechanism, simplifying the state space saved after power failure; by synchronizing the latching and clearing of the write transaction copy with the physical commit completion confirmation, the consistency between the write transaction copy and the actual storage state is guaranteed; the latched data integrity identifier enables the data integrity of the write transaction copy to be verified after power-on, avoiding recovery based on damaged data.

[0072] According to embodiments of this disclosure, the pipeline convergence and freezing mechanism in step S202 will be described in detail.

[0073] When the recovery control unit 105 receives a power failure warning signal (e.g., a first-level warning signal pf_warn) from the power failure warning unit 108, the recovery control unit 105 initiates the power failure saving process for writing transaction copies.

[0074] First, the recovery control unit 105 performs the first level of convergence. Specifically, the recovery control unit 105 sends a pause instruction fetch signal to the instruction fetch unit (IFU) of the processor core 101 (e.g., disables the IFU's enable signal), stopping the fetching of new instructions from the external non-volatile memory 104. Simultaneously, the recovery control unit 105 continuously monitors the pipeline state of the processor core 101, determining whether all instructions in transit have been retired. Instructions in transit refer to instructions that have entered the pipeline but have not yet been retired. Once all instructions in transit have been retired, the first level of convergence is complete. At this point, the architectural state of the processor core 101 (including the program counter, general-purpose registers, control status registers, etc.) is in a consistent state—the architectural state updates for all retired instructions have been committed, and the temporary states of all non-retired instructions do not affect the architectural state.

[0075] After the first level of convergence is completed, the recovery control unit 105 performs the second level of convergence. During the second level of convergence, the recovery control unit 105 reads the currently latched write transaction copy from the write transaction copy latch group of the main memory access arbitration unit 102 at the pipeline retirement boundary (i.e., the boundary of instruction retirement) and freezes it in the internal cache of the recovery control unit 105. It is important to note that the completion of the second level of convergence does not require that the write request corresponding to the write transaction copy has been physically committed on the external non-volatile memory 104. In other words, even if the external non-volatile memory 104 is still performing write operations during the second level of convergence, the recovery control unit 105 can still read the write transaction copy and freeze it. This is because the write transaction copy is latched before the write request enters the serial non-volatile memory control unit 103, and its content does not change after latching.

[0076] After the second-level convergence is completed, the recovery control unit 105 transmits the frozen write transaction copies in the internal cache and the architectural state of the processor core 101 (including the program counter, general-purpose register set, control status register, etc.) to the state snapshot management unit 106. The state snapshot management unit 106 selects the target slot according to the slot selection logic, and then writes the snapshot data into the recovery area of ​​the external non-volatile memory 104 through a two-phase commit method.

[0077] The above technical solution, through the first-level convergence, freezes the processor architecture state by waiting for all instructions in transit to retire, avoiding the problem of inconsistent architecture state caused by partial instruction execution during recovery; the second-level convergence does not require waiting for the slow physical write of non-volatile memory to complete, which significantly shortens the power-down response time and improves the success rate of power-down preservation; by saving the write transaction copy together with the processor architecture state, it is ensured that the execution state before the power-down can be completely restored after power-on.

[0078] It is understandable that a power-keeping window is provided in response to the power failure warning signal. If the write request corresponding to the write transaction copy can be physically committed on the external non-volatile memory within the power-keeping window, then the second-level convergence waits for the write request corresponding to the write transaction copy to be physically committed on the external non-volatile memory before freezing the write transaction copy. Furthermore, the write transaction copy is not included in the snapshot, and idempotent write is not performed when power is restored.

[0079] According to embodiments of this disclosure, the selection of the recovery area snapshot slot and the two-stage submission mechanism in step S202 will be described in detail.

[0080] The recovery area of ​​the external non-volatile memory 104 includes at least two snapshot slots. The number of snapshot slots can be 2 or N (N>2), and each snapshot slot is of the same size. As the number of snapshot slots increases, the system can retain more historical versions as rollback candidates, improving recovery reliability. Each snapshot slot includes a sequence number field, an identifier field, a header checksum field, a payload area, a payload checksum field, and a commit flag field. The sequence number field uniquely identifies the write order of the snapshot; it is incremented (e.g., by 1) each time a snapshot is successfully written. The sequence number can be a global counter or a timestamp.

[0081] The slot selection logic of the status snapshot management unit 106 selects the target slot according to the following rules: Rule 1: Prioritize slots with invalid commit flags as target slots. An invalid commit flag (e.g., 0x0000) indicates that the slot currently does not contain a valid snapshot—it may have never been written to, or the last write operation was interrupted due to a power outage (the first phase of a two-phase commit was completed but the second phase was not), or the slot has been explicitly abandoned. Choosing slots with invalid commit flags as target slots avoids overwriting valid snapshots and allows reuse of abandoned slots.

[0082] Rule 2: If all slots have valid commit flags, the slot with the older sequence number is selected as the target slot, and the slot with the newest sequence number and a valid commit flag is retained as a rollback candidate slot. Specifically, the slot selection logic compares the sequence numbers of all snapshot slots and selects the slot with the smallest sequence number (i.e., the oldest snapshot) as the target slot for overwriting. Simultaneously, the slot with the largest sequence number (i.e., the latest valid snapshot) is retained as a rollback candidate slot—if a power outage occurs during the writing of a new snapshot, the system can roll back to the latest valid snapshot saved in that candidate slot after power is restored. This design ensures that at least one complete valid snapshot can be used for recovery, improving the system's fault tolerance.

[0083] After selecting the target slot, the state snapshot management unit 106 performs a two-phase commit: Phase 1: Before writing snapshot content, the status snapshot management unit 106 checks the commit flag of the target slot. If the commit flag of the target slot is currently a valid value, the status snapshot management unit 106 first writes the commit flag to an invalid value (e.g., 0x0000), and then physically commits the write operation on the external non-volatile memory 104 via the serial non-volatile memory control unit 103. This operation ensures that the target slot is marked as invalid before writing new snapshot content, and even if a power failure occurs during the writing process, the target slot will not be mistakenly identified as a valid snapshot after power is restored.

[0084] The second stage: After the commit flag is written to an invalid value, the state snapshot management unit 106 writes the snapshot content to the target slot. The writing order is as follows: first, write the header information (including sequence number, identifier, etc.), then write the payload (including processor architecture status and write transaction copy), and finally write the header checksum and payload checksum. After the two levels of checksums are written, a new valid value (e.g., the commit constant 0xA5A5) is atomically written to the commit flag field at the end. Here, "atomic write at the end" means that the write operation of the commit flag is the last step in the entire snapshot write process, and this write operation is atomic (i.e., either all writes are successful, or none are written). Once the commit flag is successfully written to a valid value, the snapshot slot is marked as valid.

[0085] The above technical solution prioritizes slots with invalid commit flags through slot selection logic to avoid destroying valid snapshots; when all slots are valid, a ring overwrite strategy is adopted and rollback candidate slots are reserved to ensure that at least one valid snapshot is always available; the two-phase commit mechanism ensures that the integrity of the snapshot can be reliably detected by setting the commit flag to invalid before writing and atomically setting it to valid after writing, avoiding erroneous recovery caused by some snapshots being misjudged as valid due to write interruption.

[0086] According to embodiments of this disclosure, the effective snapshot verification and data recovery mechanism in steps S204 and S205 will be described in detail.

[0087] After power-on reset, the recovery control unit 105 defaults to setting the data area write blocking signal. Then, the recovery control unit 105 drives the state snapshot management unit 106 to scan and verify all snapshot slots in the recovery area.

[0088] For each snapshot slot, the status snapshot management unit 106 performs the following verification steps: First, read the identifier field of the snapshot slot and determine if it matches a conventional constant. The conventional constant can be a predefined fixed value (e.g., 0x5A5A5A5A) used to indicate that the snapshot slot has been used. If the identifier does not match, it means that the slot has never been written to a valid snapshot, and the slot is invalid.

[0089] Second, if the identifier matches, the header checksum field of the snapshot slot is read to verify the header information (including serial number, header length, version information, etc.). The verification algorithm can use Cyclic Redundancy Check (CRC) or checksum. If the header verification fails, it means that the header information was corrupted during the writing process due to power failure or other reasons, and the slot is invalid.

[0090] Third, if the header verification passes, the load checksum field of the snapshot slot is read to verify the payload (including processor architecture status and write transaction copy). The verification algorithm can also use CRC or checksum. If the load verification fails, it indicates that the payload was corrupted during the write process, and the slot is invalid.

[0091] Fourth, if the load check passes, the commit flag field of the snapshot slot is read to determine if it matches the agreed commit constant (e.g., 0xA5A5). If the commit flag is not equal to the agreed commit constant, it means that the two-phase commit of the snapshot has not been completed (the power outage may have occurred before or during the second phase), and the slot is invalid.

[0092] A snapshot slot is considered valid only if all four conditions are met. If multiple snapshot slots are valid, the snapshot slot with the newest serial number is selected as the recovery source (because a newer serial number indicates that the snapshot was the most recently successfully saved).

[0093] After determining that a valid snapshot exists, the recovery control unit 105 performs data recovery based on the valid snapshot: The recovery control unit 105 reads processor architecture status information, including the program counter (PC), general purpose register set (GPR), and control status register (CSR), from the payload area of ​​the valid snapshot. The recovery control unit 105 writes this information back to the processor core 101 via the debug interface of the processor core 101 or a dedicated status recovery interface.

[0094] Then, the recovery control unit 105 reads the frozen write transaction copy from the payload area of ​​the valid snapshot. The write transaction copy contains the address, byte enable, pending value, and data integrity flag of the uncommitted write request. The recovery control unit 105 initiates an idempotent write request to the data area of ​​the external non-volatile memory 104 through the main memory access arbitration unit 102 and the serial non-volatile memory control unit 103. The execution of this write request is idempotent—if the effect of performing the write operation once is exactly the same as performing it multiple times, then if a second power failure occurs during the recovery process, performing the same write operation again after power is restored will not cause data errors.

[0095] After the write operation is completed, the recovery control unit 105 releases the data area write blocking signal, allowing subsequent normal writing to the data area. At this time, the processor core 101 continues execution from the recovered program counter address.

[0096] If no valid snapshot is found in any of the snapshot slots, the recovery control unit 105 releases the data area write blocking signal and triggers the processor core 101 to perform a cold boot. During a cold boot, the processor core 101 starts execution from the reset vector address and runs the boot program stored in the common main memory.

[0097] The above technical solution ensures that only complete and valid snapshots can be used for recovery through four-fold condition verification (identifier matching, header verification, load verification, and commit flag matching), avoiding erroneous recovery based on damaged or incomplete snapshots; it selects a valid snapshot with a newer serial number as the recovery source to ensure recovery to the most recent normal state; the idempotent write mechanism ensures that if a second power failure occurs during the recovery process, the write can be safely performed again after power is restored, without causing data duplication or errors; the data area write blocking signal prevents all writes to the data area before recovery is complete, protecting the atomicity of the recovery process.

[0098] According to embodiments of this disclosure, not all write requests to the external non-volatile memory 104 are replayable. Some write requests are non-replayable—that is, performing the same operation multiple times may produce different results or side effects. For example, a write request to a memory-mapped input / output (MMIO) address may trigger a peripheral state change; a write request to a peripheral command address may initiate a peripheral operation; atomic operations (such as test-and-set, read-modify-write, etc.) involve compound read-modify-write operations, are not simple write operations, and are therefore also non-replayable.

[0099] The address decoding logic of the main memory access arbitration unit 102 is used to identify these non-replayable access requests. When the address decoding logic identifies that the current access request points to an MMIO address, a peripheral command address, or an atomic operation address, the main memory access arbitration unit 102 prohibits latching a write transaction copy for that request. Specifically, for non-replayable access requests, the main memory access arbitration unit 102 does not perform the latching write transaction copy operation, nor does it set the copy validity flag, but instead directly forwards the request to the serial non-volatile memory control unit 103 or the corresponding peripheral interface.

[0100] However, non-replay access requests have a consistency window—the period between the retirement of the instruction corresponding to the access request in processor core 101 (i.e., the instruction execution is complete and the architecture state is updated) and the actual effect of external side effects (e.g., peripheral state changes). Within this consistency window, if a power failure occurs, the processor architecture state already reflects that the access request has been completed (the instruction has retired), but the external side effects may not have taken effect yet, resulting in inconsistency between the architecture state and the external state.

[0101] To address this situation, this disclosure provides the following processing mechanism: When a non-replay access request is within a consistency window where the processor has retired but external side effects have not yet taken effect, if the recovery control unit 105 receives a power-down warning signal, the recovery control unit 105 abandons the current snapshot saving and performs a cold start. Specifically, when the recovery control unit 105 detects a non-replay access request with incomplete external side effects, it does not perform a snapshot saving operation, but directly releases the data area write blocking signal and triggers a cold start. This is because, in this situation, even if a snapshot is saved, consistency cannot be restored after power-on through simple idempotent writes; a cold start is the only safe processing method.

[0102] The above technical solution avoids the side effect inconsistency problem caused by attempting to replay non-replay operations during recovery by identifying non-replay access requests and prohibiting them from being latched and written to transaction copies. By abandoning snapshot saving and performing a cold start when a power failure is detected within the consistency window, the system ensures that it adopts the safest recovery strategy when encountering an unrecoverable inconsistent state, thus avoiding the spread of state errors caused by attempts to recover.

[0103] According to embodiments of this disclosure, a data area write blocking signal is generated by the recovery control unit 105 and acts on the main memory access arbitration unit 102. The data area write blocking signal is in an active state by default (e.g., active high) after power-on reset until the recovery control unit 105 completes the snapshot decision and determines subsequent operations.

[0104] The recovery period masking logic of the main memory access arbitration unit 102 receives the data area write blocking signal. When the data area write blocking signal is active, the recovery period masking logic intercepts all write requests pointing to the common main memory data area address. Specifically, the recovery period masking logic judges the address of the write request from the processor core 101: if the address falls within the address range of the common main memory data area, the recovery period masking logic does not allow the write request to be passed to the serial non-volatile memory control unit 103, but instead returns a write error response to the processor core 101 (e.g., the write acknowledge signal is set to an error state) or maintains the handshake signal of the write request, preventing the completion of the write request. In this way, during the period when the data area write blocking signal is active, the processor core 101 cannot write any data to the common main memory data area.

[0105] However, the data area write blocking signal does not intercept the following types of access: instruction fetch requests (i.e., instruction read requests), read requests to the common main memory data area, and access requests to control class addresses. Instruction fetch requests aim to read program code; these requests do not modify the data area, so it is safe to allow instruction fetching during recovery, while also enabling processor core 101 to begin reading instructions from common main memory immediately after recovery. Read requests to the common main memory data area also do not modify the data, so they are allowed. Access requests to control class addresses (e.g., configuring the control registers of the serial non-volatile memory control unit 103) do not affect the data area, so they are allowed during recovery.

[0106] According to embodiments of this disclosure, the data area write blocking signal remains active after power-on reset until the snapshot decision is completed. When the recovery control unit 105 determines that a valid snapshot exists, the data area write blocking signal remains active until data recovery is complete (including processor architecture state recovery and idempotent write completion). When the recovery control unit 105 determines that no valid snapshot exists, the data area write blocking signal is released immediately after the decision is completed.

[0107] Furthermore, during power-down saving or power-on recovery performed by the recovery control unit 105, in response to the multi-source access masking signal from the recovery control unit 105, the recovery period masking logic suppresses the arbitration qualification of instruction-side requests and data-side requests, allowing only recovery-side requests from the status snapshot management unit 106. Specifically, during power-down saving, to avoid interference with snapshot writing, the recovery period masking logic suppresses the arbitration qualification of instruction-side requests (fetch requests) and data-side requests (read / write requests) from the processor core 101, so that the serial non-volatile memory control unit 103 only serves the recovery-side requests (i.e., snapshot write requests) from the status snapshot management unit 106. Similarly, during power-on recovery, the recovery period masking logic also suppresses the arbitration qualification of instruction-side requests and data-side requests, ensuring that snapshot read and write operations are not interfered with.

[0108] The above technical solution prevents writing to the data area during recovery by using a write blocking signal, thus protecting the integrity of the data area and the atomicity of the recovery process. Fetch requests, read requests, and control accesses are not blocked, allowing necessary read operations to still be performed during recovery, thereby improving recovery efficiency. The recovery period shielding logic suppresses non-recovery side requests during power-down saving and power-on recovery, ensuring that snapshot operations are not interfered with.

[0109] According to embodiments of this disclosure, the processor system supports custom safe recovery point capture instructions (e.g., SafeRecovery Point Capture, SRP.CAP instructions). These instructions are inserted by software (e.g., the operating system kernel) at program semantic safe points. Program semantic safe points refer to specific locations during program execution where the program's architectural state is consistent and recoverable, such as system call entry / exit points, context switch points, and locations outside critical sections.

[0110] When processor core 101 executes a custom safe recovery point capture instruction, this instruction triggers the following operation after pipeline retirement: atomically capturing the current processor architecture state (including the program counter, general-purpose register set, control status register, etc.) to... Figure 1 The on-chip shadow register set is shown, and it maintains an on-chip validity flag. The on-chip shadow register set is a set of dedicated registers coupled to processor core 101, used to temporarily store captured processor architecture states. The on-chip validity flag is used to indicate whether the contents of the on-chip shadow register set are valid.

[0111] The precondition for setting the on-chip valid flag includes the absence of any pending data area write requests. Specifically, before executing the capture operation, processor core 101 checks whether the copy valid flag of the main memory access arbitration unit 102 is invalid. If the copy valid flag is valid (indicating the presence of pending data area write transactions), the capture operation is not executed, or it waits for the copy valid flag to become invalid before execution. This precondition ensures consistency between the captured architectural state and the data area state—if pending data area write transactions exist at the time of capture, the data area may be in an inconsistent state during recovery, making the recovery point unreliable.

[0112] After the on-chip valid flag is set, the on-chip shadow register set continuously monitors for multi-source failure events. Multi-source failure events include at least one of the following: write requests to the common main memory data area, memory-mapped I / O read / write, control status register writes, atomic operations, exception return instructions, control flow changes caused by interrupts or exceptions, and shadow register aging timeout. When any failure event occurs, the on-chip shadow register set's multi-source failure monitoring logic automatically clears the on-chip valid flag, rendering the recovery point invalid. For example, if processor core 101 performs a write operation to the common main memory data area after a recovery point is captured, this write operation will change the state of the data area, causing the previously captured architecture state to no longer match the data area state, thus invalidating the recovery point. Similarly, if an MMIO read / write or atomic operation is performed, the external state may change, also invalidating the recovery point. Control flow changes caused by interrupts or exceptions will also cause the architecture state to deviate from the captured state, thus invalidating the recovery point. Shadow register aging timeout means that if a recovery point has not been updated for a long time, the on-chip valid flag is automatically cleared to avoid using outdated recovery points.

[0113] When a power failure warning signal is triggered, the recovery control unit 105 checks the on-chip validity flag. If the on-chip validity flag is valid, the recovery control unit 105 skips the step of waiting for pipeline retirement (i.e., skips the first and second levels of convergence mentioned above) and directly writes the contents of the on-chip shadow register set into the target snapshot slot of the recovery area. This is because the on-chip shadow register set already stores a consistent and valid processor architecture state, and this state was captured at a program semantic safe point, so there is no need to wait for pipeline retirement again. This greatly shortens the power failure save time and improves the success rate of power failure save. At the same time, since there are no pending data area write requests, there is no need to read the current write transaction shadow from the main memory access arbitration unit 102.

[0114] The above technical solution allows software to actively set recovery points at program semantic safety points using custom safety point capture instructions. The architecture state of these recovery points is consistent with the data area state, and execution can be directly restored to the safety point after power-on. The on-chip shadow register group saves the captured architecture state on-chip, avoiding writing to slow non-volatile memory during each capture and improving capture efficiency. Multi-source failure monitoring automatically clears failed recovery points, ensuring that recovery points are always valid. If a valid on-chip recovery point exists during power failure, pipeline convergence is skipped, and the contents of the on-chip shadow register group are directly saved, significantly shortening the power failure saving time and improving the saving success rate in scenarios with rapid power drops.

[0115] The following provides a further explanation of the complete fields of the snapshot slot in the recovery area.

[0116] Figure 3 A schematic diagram showing the complete fields of a snapshot slot according to an embodiment of this disclosure is provided.

[0117] like Figure 3 As shown, the snapshot slot includes a header area, a payload area, and a commit flag field.

[0118] The header area sequentially includes an identifier (magic) field, a version field, a sequence number field, a source flag (from_srp) field, a payload length field, a header checksum field (header CRC), and a payload checksum field (payload CRC). The identifier field stores a predefined constant value used to identify whether the address area belongs to a snapshot slot of this system. The version field stores a predefined format version constant used to identify the field layout and checksum version used by the snapshot header and payload. During power-on recovery, this value is used to determine whether the snapshot format is compatible with the current recovery logic, rejecting incompatible versions to avoid parsing snapshots with incorrect field layouts. The version field is updated only when the snapshot format changes, unlike the sequence number field which increments with each save. The sequence number field stores the sequence number, which is incremented and written each time a snapshot is written, used to identify the order of snapshot slots during power-on recovery. The source flag field stores whether this snapshot was generated by the fast path (set to "1") determined by the SRP.CAP instruction or by the slow path (set to "0") that performs two layers of convergence. The payload length field stores the length of the payload. The identifier field, version field, sequence number field, source flag field, and payload length field constitute the coverage area of ​​the header CRC.

[0119] The payload area sequentially includes a program counter (PC) field, a general-purpose register set field, a control status register (CSR) field, and a write transaction boundary descriptor field. The control status register field contains the necessary CSR and a reserved CSR area; the write transaction boundary descriptor field stores the address, byte enable, pending write value, and data integrity flag of the write transaction copy frozen during power-down saving. All fields of the payload area constitute the coverage of the payload CRC.

[0120] The commit flag field is located at the end of the snapshot slot and exists independently of the header checksum and the payload checksum. It is used to prove that the snapshot write process has been completed to the last position. Specifically, the commit flag field stores a conventional commit constant (e.g., "0xA5A5"), and the last atomic write is only completed in the second phase of the two-phase commit. This commit flag is used in conjunction with two levels of CRC: the CRC verifies the integrity of the content, and the commit flag verifies the integrity of the process (whether the last snapshot has been written). Both are indispensable.

[0121] According to an embodiment of this disclosure, the recovery control unit 105 includes a hardware finite state machine that cannot be rewritten by software. This hardware finite state machine retains the path (e.g., ...) even after power failure. Figure 4a (as shown) and power-on recovery path (as shown) Figure 4b As shown, all are implemented in a single state machine.

[0122] In this embodiment, the state register of the hardware finite state machine is not mapped to any software-writable address. Specifically, the state register is an internal chip register, and its address is not included in the processor's CSR address space or memory address space, so software cannot read or write to it via CSR instructions or memory access instructions. The release of the data area write blocking signal is triggered only by the snapshot decision result of the hardware finite state machine and is not subject to write control by the software configuration register. This design ensures that the strength of the decision and write isolation release is orthogonal to the firmware, so even if the boot firmware is incorrectly burned or tampered with, the protection of the data area cannot be prematurely removed.

[0123] Figure 4a As shown, during normal operation, if a power failure warning signal is triggered, the hardware finite state machine selects a path based on the on-chip valid flag in the on-chip shadow register group: if the on-chip valid flag is true, it directly enters the invalidation old commit flag state via the fast path, skipping the first and second convergence states; if the on-chip valid flag is false, it sequentially enters the first and second convergence states, and then the invalidation old commit flag state. Afterwards, it sequentially enters the write slot and load state, the write CRC state, and the write new commit flag state. Upon completion, it enters the completion state and waits for power failure.

[0124] In the first convergence state, the control unit 105 controls the processor core 101 to pause new instruction fetching and wait for all instructions in the pipeline to retire.

[0125] In the second convergence state, at the pipeline retirement boundary, the recovery control unit 105 reads the currently latched copy of the write transaction from the main memory access arbitration unit 102 and freezes it in the internal cache.

[0126] Before writing the snapshot content, the status snapshot management unit 106 checks the commit flag field of the target snapshot slot to invalidate the old commit flag status. If the commit flag field is currently a valid value, it is written as an invalid value; otherwise, the step is skipped. This step constitutes the first stage of a two-phase commit, ensuring that the old content of the target snapshot slot is not mistakenly judged as valid after power-on.

[0127] The status snapshot management unit 106 writes the snapshot content to the target snapshot slot, including the slot header and payload status. Specifically, the status snapshot management unit 106 first writes the header fields (identifier, version, serial number, source flag, payload length) to the header area of ​​the target snapshot slot; then, it writes the payload fields (program counter, general purpose register group, control status register, write transaction boundary descriptor) to the payload area of ​​the target snapshot slot.

[0128] The CRC status is written, and the status snapshot management unit 106 calculates and writes two levels of cyclic redundancy check values. Specifically, the status snapshot management unit 106 performs cyclic redundancy check calculations on the header fields (from the identifier to the length field), obtains the header check value, and writes it into the corresponding fields of the header area; it also performs cyclic redundancy check calculations on all fields of the payload area (from the program counter to the write transaction boundary descriptor), obtains the payload check value, and writes it into the corresponding fields of the header area.

[0129] After writing the new commit flag status, once the header area, payload area, header check value, and payload check value of the target snapshot slot are all written, the status snapshot management unit 106 writes the new valid value to the commit flag field at the last atomic position.

[0130] like Figure 4bAs shown, after power-on reset, the hardware finite state machine is forced into a reset isolation state. In the reset isolation state, the recovery control unit 105 defaults to setting the data area write blocking signal and acts on the main memory access arbitration unit 102 to prevent the boot execution unit 107 from writing to the common main memory data area. Subsequently, the hardware finite state machine enters the slot scanning state, driving the state snapshot management unit 106 to scan each snapshot slot in the recovery area. After the scan is completed, it enters the slot verification state to verify each scanned snapshot slot to determine whether there is a valid snapshot. If there is a valid snapshot, it sequentially enters the state write-back state and the write transaction completion state, and after completion, it enters the release recovery running state. After that, the system runs normally. In the normal running state, if the power failure warning signal is triggered, it enters the state write-back state and the write transaction completion state. Figure 4a The power-down save path is shown. If the slot verification fails, and verification still fails after eliminating bad slots and switching back to candidate slots, it indicates that all snapshot slot verifications have failed, and the system enters a cold start state.

[0131] Upon system power-on reset, the isolation state is restored, and the default data area write blocking signal is set in control unit 105 and applied to main memory access arbitration unit 102. This signal takes effect in the first clock cycle after reset release, earlier than the instruction fetch operation of boot execution unit 107. During the period when the data area write blocking signal is active, write requests from boot execution unit 107 to the common main memory data area are intercepted by main memory access arbitration unit 102, but instruction fetch requests, read requests to the data area, and access requests to control class addresses are not affected by this signal.

[0132] During slot scanning, the recovery control unit 105 drives the state snapshot management unit 106 to scan each snapshot slot in the recovery area. Specifically, the state snapshot management unit 106 reads the identifier field and commit flag field of each snapshot slot from the recovery area of ​​the external non-volatile memory 104 through the main memory access arbitration unit 102 and the serial non-volatile memory control unit 103. For snapshot slots whose identifier does not match the agreed constant (e.g., "0x5A5A5A5A"), they are directly marked as invalid and subsequent verification is skipped.

[0133] The recovery control unit 105 drives the state snapshot management unit 106 to perform a complete verification of each snapshot slot filtered by the identifier. Specifically, the state snapshot management unit 106 reads all fields of the header area, all fields of the payload area, the header check value field, the load check value field, and the commit flag field of the snapshot slot; it recalculates the cyclic redundancy check value for the read header area and compares it with the header check value field; it recalculates the cyclic redundancy check value for the read payload area and compares it with the load check value field; and it checks whether the commit flag field is equal to the agreed commit constant. Only when the identifier field in the same snapshot slot matches the agreed constant, the header check value field passes verification, the load check value field passes verification, and the commit flag field is consistent with the agreed commit constant, does the recovery control unit 105 determine that there is a valid snapshot in that snapshot slot.

[0134] In the state write-back process, when a valid snapshot is determined to exist, the recovery control unit 105 writes the program counter, general-purpose register set, and control status register from the snapshot payload area back to the processor core 101. Specifically, the recovery control unit 105 writes the architectural state values ​​from the snapshot to the program counter register, general-purpose register set, and control status register set of the processor core 101, respectively, via the debug interface or dedicated state write-back bus of the processor core 101. This write-back operation is performed when the processor core 101 is in a paused state, ensuring the atomicity and consistency of the write-back process.

[0135] In the write transaction completion state, the recovery control unit 105 drives the main memory access arbitration unit 102 to initiate an idempotent completion request to the common main memory data area based on the write transaction boundary descriptor (i.e., write transaction copy) in the snapshot payload area. This completion request resubmits the address, byte enable, and write value recorded in the write transaction copy to the corresponding address in the external non-volatile memory 104.

[0136] After the write request is completed, the recovery control unit 105 releases the data area write blocking signal and notifies the processor core 101 to continue execution from the written-back program counter address. Specifically, the recovery control unit 105 invalidates the data area write blocking signal, allowing the boot execution unit 107 and subsequent normal program execution to write to the data area; at the same time, it sends a recovery signal to the processor core 101, and the processor core 101 resumes instruction fetching and execution from the address in the program counter register.

[0137] In cold start mode, when all snapshot slot verifications fail (i.e., no valid snapshot exists), the recovery control unit 105 releases the data area write blocking signal, allowing the boot execution unit 107 to execute the normal boot initialization process to overwrite the common main memory data area. Specifically, the recovery control unit 105 invalidates the data area write blocking signal and jumps to the reset vector address of the boot execution unit 107. The boot execution unit 107 then begins executing the boot initialization code in the on-chip boot area, including operations such as clearing the data area and initializing the BSS segment. These operations will overwrite the old data in the common main memory data area, and the system runs in cold start mode.

[0138] Figure 5 A timing diagram is shown for a processor power-down recovery method according to an embodiment of the present disclosure.

[0139] like Figure 5 As shown, from time T0, the copy latch signal remains high, indicating that the copy of the current write transaction has been established (this state is not causally related to the power failure warning signal pf_warn, and may have been high before pf_warn). During the T0→T1 interval, the pipeline retirement signal takes effect, completing the first level of convergence; at the retirement boundary T2, the second level of convergence is completed by adding the read-only frozen copy to the snapshot. After both levels of convergence are completed, during the subsequent T2→T3 interval, the snapshot write signal is valid, and the system enters the subsequent dual-slot write process. At time T3, the two-stage commit of the snapshot is completed, with the last atomic bit being written to the commit flag, and the snapshot write signal changing from high to low. However, the physical commit of this write operation was not completed before the power failure, so the copy latch signal was not cleared in advance, but instead changed from high to low along with the system power supply signal at time T4, after which the system powered down, and thereafter relied solely on the committed snapshots in external storage for protection. At time T5, the system is powered on again. After power is restored, the data area write blocking signal immediately goes high and takes effect by default. The system then enters the slot scan, slot verification, snapshot decision, and recovery path status write-back and write transaction copy rewriting process. By time T7, the power-on recovery path process is complete, the data area write blocking signal returns to low, and the system officially releases the write block and resumes normal operation.

[0140] This disclosure also provides a processor power-down recovery system, applied to a processor system that connects to an external non-volatile memory via a serial interface as a common main memory, wherein the common main memory stores both program code and runtime data.

[0141] refer to Figure 1 As shown, the processor power-down recovery system includes: The main memory access arbitration unit 102 is located on the path between the processor core 101 and the serial non-volatile memory control unit 103. It is used to latch the write transaction copy of the write request when a write request to the common main memory data area is received; and to clear the write transaction copy after receiving confirmation of the physical submission of the write request on the external non-volatile memory 104. The recovery control unit 105, coupled to the main memory access arbitration unit 102, is used to freeze the copy of the write transaction currently latched by the main memory access arbitration unit 102 in the internal cache at the pipeline retirement boundary of the processor's in-transit instructions in response to a power failure warning signal. The status snapshot management unit 106 is coupled to the recovery control unit 105 and the main memory access arbitration unit 102, and is used to write the write transaction copies frozen by the recovery control unit 105 into the target slot of the recovery area of ​​the external non-volatile memory 104; the recovery area includes at least two snapshot slots; The recovery control unit 105 is further configured to, upon power-on reset, default to setting a data area write blocking signal and apply it to the main memory access arbitration unit 102 to prevent writing to the common main memory data area; drive the status snapshot management unit 106 to scan and verify the snapshot slots in the recovery area to determine whether a valid snapshot exists; if a valid snapshot exists, perform data recovery based on the data in the snapshot; if no valid snapshot exists, release the data area write blocking signal and perform a cold start.

[0142] Figure 6 A structural block diagram of a main memory access arbitration unit according to an embodiment of the present disclosure is shown.

[0143] like Figure 6 As shown, the main memory access arbitration unit includes a write transaction copy latch group 601, a copy validity flag 602, an arbitration request logic 603, an address decoding logic (not shown in the figure), and a recovery period masking logic 604.

[0144] The arbitration logic 603 receives instruction-side requests from the instruction prefetch buffer unit, data-side requests from the data buffer unit, and recovery-side requests from the status snapshot management unit 106. During normal operation, the arbitration logic arbitrates the three types of access requests, converting the authorized access transactions into an internal transaction format and sending them to the serial non-volatile memory control unit 103.

[0145] The write transaction copy latch group 601 is used to latch, upon receiving a write request directed to a common main memory data area, information including at least the address, byte enable, and value to be written, as a write transaction copy. In one embodiment, the write transaction copy further includes a data integrity identification field (e.g., a parity bit or a CRC check value) for verifying data integrity during recovery write operations.

[0146] The copy validity flag 602 is used to identify whether there are any uncommitted data area write transactions: when the write transaction copy latch group 601 latches the copy of the write request, the copy validity flag 602 is set simultaneously, for example, to logic "1", indicating that there are currently any uncommitted data area write transactions. When the write transaction copy is cleared, the copy validity flag is also cleared.

[0147] In this embodiment, when the copy validity flag 602 is valid, the request arbitration logic 603 uses backpressure to prevent subsequent write requests to the shared main memory data area from entering the main memory access arbitration unit 102 until the copy validity flag 602 is cleared. The backpressure mechanism ensures that at any given time, only one incomplete write transaction copy needs to be processed, simplifying the state preservation logic during power failure and avoiding the state explosion problem caused by multiple incomplete write transactions. Simultaneously, since the write speed of external non-volatile memory is relatively slow, the backpressure mechanism can prevent write request queue overflow, ensuring data consistency.

[0148] Address decoding logic is used to identify non-replayable access requests pointing to memory-mapped input / output addresses, peripheral command addresses, or atomic operation addresses. For such non-replayable access requests, the request arbitration logic 603 does not latch their information to the write transaction copy latch group 601, thereby avoiding unexpected external side effects when replaying such accesses during the recovery phase.

[0149] In this embodiment of the disclosure, when the non-replay access request is within the consistency window period where the processor core 101 has been retired but the external side effects have not yet taken effect, if a power failure warning signal is received, the recovery control unit 105 abandons the current snapshot saving and enters the cold start path.

[0150] The recovery period shielding logic 604 is used to suppress the arbitration qualification of command-side requests and data-side requests in response to the multi-source access shielding signal from the recovery control unit 105 during the power-down save procedure or power-on recovery procedure, allowing only recovery-side requests from the status snapshot management unit 106. This mechanism ensures the exclusivity and security of the recovery-side path during save / recovery.

[0151] Figure 7 A structural block diagram of a power failure warning unit according to an embodiment of the present disclosure is shown.

[0152] like Figure 7As shown, the power failure warning unit includes a holding capacitor 701, a reverse current blocking device 702, a fuse 703, a critical domain voltage regulator 704, a non-critical load switch (not shown), resistors R1-R6, and multiple voltage comparators (e.g., a first comparator U1, a second comparator U2, and a third comparator U3). The capacitance value of the holding capacitor 701 is selected according to the energy required for system power failure preservation, ensuring that within the power supply window after an input power failure, the recovery control unit 105, the main memory access arbitration unit 102, and the status snapshot management unit 106 can complete the snapshot write operation. The reverse current blocking device 702 (e.g., a diode or an ideal diode controller) is located between the input power supply VIN and the holding capacitor 701 to prevent the energy of the holding capacitor 701 from flowing back into the input power supply, ensuring that the energy of the holding capacitor 701 is only used to power the critical domain circuit. The fuse 703 is located in the positive path of the input power supply and is used to cut off the power supply and protect the circuit when an overcurrent or short circuit occurs in the input power supply. A critical domain regulator 704 (e.g., a low-dropout linear regulator, LDO) provides a stable operating voltage for the recovery control unit 105, the main memory access arbitration unit 102, and the status snapshot management unit 106. Even when the input power supply voltage drops, the critical domain regulator 704 maintains a stable output voltage. The control terminal of a non-critical load switch is connected to the recovery control unit 105 to disconnect non-critical loads (e.g., LED indicators, communication interfaces, etc.) after a power failure warning signal is triggered, thereby extending the power supply time of the critical domain.

[0153] The input power supply VIN reaches the holding node via fuse 703 and reverse-current blocking device 702 (the holding node is connected in parallel with holding capacitor 701 to ground GND), and then supplies power to the critical holding domain 705 via critical domain regulator 704; the holding node is also connected to a non-critical load via a load switch. The holding node voltage is connected to the non-inverting input of three comparators via three sets of voltage-combining resistors (R1 / R2, R3 / R4, R5 / R6), and the reference voltage is connected to the inverting input. Multiple voltage comparators correspond to different threshold voltages. The first comparator U1 corresponds to the first threshold Vth1 (e.g., 90% of the nominal voltage). When the input power supply voltage is lower than Vth1, the first comparator U1 outputs a first-level warning signal (pf_warn). The second comparator U2 corresponds to the second threshold Vth2 (e.g., 80% of the nominal voltage). When the input power supply voltage is lower than Vth2, the second comparator U2 outputs a second-level evaluation signal (pf_eval). The third comparator U3 corresponds to the third threshold Vth3 (e.g., 70% of the nominal voltage). When the input power supply voltage is lower than Vth3, the third comparator U3 outputs the third-level critical signal (pf_crit). Each threshold satisfies Vth1>Vth2>Vth3, causing the warning signals to be generated sequentially.

[0154] According to embodiments of this disclosure, the recovery control unit 105 initiates a snapshot write operation in response to a first-level warning signal (i.e., steps S201 to S202 described above). During the snapshot write operation, the holding capacitor 701 provides a power supply window for the critical domain. If the snapshot has not been completed when the second-level evaluation signal is triggered, the recovery control unit 105 abandons the current snapshot saving. This means that if the power drop is too rapid and the snapshot write cannot be completed before the second-level evaluation signal is triggered, the recovery control unit 105 will not continue to attempt to write, but will directly abandon the attempt and enter a cold start preparation state. If the snapshot has not been completed when the third-level critical signal is triggered, the incomplete content of the target slot is discarded in the valid snapshot determination after power-on—since the power supply voltage is already very low at this time, continuing to write may lead to data corruption, so it is better to wait for power-on and start again.

[0155] The above technical solution provides a tiered power failure response strategy through a multi-level early warning mechanism. When the power supply voltage drops slightly (first-level early warning), snapshot saving is initiated. When the voltage continues to drop (second-level evaluation), it is determined whether the saving can be completed in time. When the voltage is close to being unsustainable (third-level critical), saving is abandoned and existing data is protected. The holding capacitor and critical domain voltage regulator provide the necessary energy and time margin for snapshot saving. Non-critical load switches disconnect non-critical loads during power failure, extending the power supply time of critical domains and improving the success rate of power failure saving.

[0156] In one embodiment of this disclosure, the recovery control unit includes a hardware finite state machine that cannot be rewritten by software; The state registers of the hardware finite state machine are not mapped to any software-writable address; The release of the data area write blocking signal is triggered only by the snapshot decision result of the hardware finite state machine and is not subject to write control by the software configuration register.

[0157] In one embodiment of this disclosure, the status snapshot management unit includes slot selection logic for selecting a target slot based on the sequence number and submission flag of each snapshot slot: The slot with an invalid submission flag is preferentially selected as the target slot; If all slots have valid commit flags, the slot with the older sequence number is selected as the target slot, and the slot with the newer sequence number and a valid commit flag is retained as a rollback candidate slot.

[0158] In one embodiment of this disclosure, the state snapshot management unit includes two-phase commit logic for performing a first phase and a second phase of writing to the target snapshot slot: In the first stage, before writing the snapshot content, if the commit flag of the target slot is a valid value, then the commit flag is written to an invalid value. In the second stage, after all the head area and payload area of ​​the target slot have been written, a new valid value is written to the submission flag at the last atom.

[0159] In one embodiment of this disclosure, the snapshot slot includes an identifier field, a header checksum field, a payload checksum field, and a commit flag field; A valid snapshot is determined to exist in the snapshot slot only when the identifier field in the same snapshot slot matches the agreed constant, the header check value field passes the check, the load check value field passes the check, and the commit flag field is consistent with the agreed commit constant.

[0160] In one embodiment of this disclosure, it further includes: The on-chip shadow register group, connected to the processor core and the recovery control unit, is used to atomically capture the current processor architecture state to the on-chip shadow register group and maintain the on-chip valid flag when a custom safe recovery point capture instruction retires at a program semantic safe point; the precondition for setting the on-chip valid flag includes that there are currently no uncommitted data area write requests. The on-chip shadow register group also includes multi-source failure monitoring logic, which is used to continuously monitor multi-source failure events of the processor core after the on-chip valid flag is set, and automatically clear the valid flag when any failure event occurs; when the power failure warning signal is triggered, if the on-chip valid flag is valid, the recovery control unit skips the operation of waiting for pipeline retirement and directly writes the contents of the on-chip shadow register group into the recovery area.

[0161] In one embodiment of this disclosure, the multi-source failure event includes at least one of the following: Write requests to the common main memory data area, memory-mapped input / output read / write, control status register write, atomic operations, exception return instructions, control flow changes caused by interrupts or exceptions, and shadow register aging timeout.

[0162] In one embodiment of this disclosure, the external non-volatile memory is a serial peripheral interface magnetoresistive random access memory, an extended serial peripheral interface magnetoresistive random access memory, or a serial ferroelectric random access memory.

[0163] The specific technical details of the embodiments disclosed herein can be found in the above method embodiments, and will not be repeated here.

[0164] This disclosure also discloses an electronic device. Figure 8 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0165] like Figure 8As shown, the electronic device includes a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to embodiments of the present disclosure.

[0166] The processor power-down recovery method is applied to a processor system that uses an external non-volatile memory connected via a serial interface as shared main memory, where the shared main memory stores both program code and runtime data. The method includes: On the path between the processor core and external non-volatile memory, when a write request is received pointing to the common main memory data area, a copy of the write transaction is latched; the copy of the write transaction is cleared after the physical commit is confirmed on the external non-volatile memory. In response to a power failure warning signal, at the pipeline retirement boundary of the processor's in-transit instructions, the currently latched copy of the write transaction is frozen and written to the target slot of the recovery area of ​​the external non-volatile memory; the recovery area includes at least two snapshot slots. After power-on reset, the data area write blocking signal is set by default to prevent writing to the common main memory data area; Scan and verify the snapshot slots in the recovery area to determine whether a valid snapshot exists; If a valid snapshot exists, perform data recovery based on the data in the snapshot; If no valid snapshot exists, release the write blocking signal for the data area and perform a cold start.

[0167] In one embodiment of this disclosure, the write transaction copy includes the address of the write request, byte enable, value to be written, and data integrity identifier; when latching the write transaction copy of the write request, the copy validity flag is set simultaneously; when clearing the write transaction copy, the copy validity flag is cleared simultaneously.

[0168] In one embodiment of this disclosure, when the copy validity flag is valid, back pressure is used to prevent subsequent write requests to the common main memory data area from entering the path until the copy validity flag is cleared.

[0169] In one embodiment of this disclosure, freezing the currently latched write transaction copy at the pipeline retirement boundary of a processor instruction in transit includes: First-level convergence: Pause new instruction fetching and wait for all instructions in the processor pipeline to retire in order to solidify the processor architecture state; Second-level convergence: After the first-level convergence is completed, read the currently latched copy of the write transaction at the pipeline retirement boundary and freeze it; The second-level convergence does not require that the write request corresponding to the write transaction copy has been physically committed on the external non-volatile memory as a necessary condition for convergence completion.

[0170] In one embodiment of this disclosure, each snapshot slot in the recovery area includes a serial number field and a commit flag field; the target slot of the recovery area written to external non-volatile memory includes: Select the target slot based on the sequence number and commit flag of each snapshot slot: The slot with an invalid submission flag is preferentially selected as the target slot; If all slots have valid commit flags, the slot with the older sequence number is selected as the target slot, and the slot with the newer sequence number and a valid commit flag is retained as a rollback candidate slot.

[0171] In one embodiment of this disclosure, the writing to the target slot of the recovery area of ​​the external non-volatile memory further includes a two-stage commit: In the first stage, before writing the snapshot content, if the commit flag of the target slot is a valid value, then the commit flag is written to an invalid value. In the second stage, after all the head area and payload area of ​​the target slot have been written, a new valid value is written to the submission flag at the last atom.

[0172] In one embodiment of this disclosure, the snapshot slot includes an identifier field, a header checksum field, a payload checksum field, and a commit flag field; Whether the judgment has a valid snapshot includes: A valid snapshot is determined to exist in the snapshot slot only when the identifier field in the same snapshot slot matches the agreed constant, the header check value field passes the check, the load check value field passes the check, and the commit flag field is consistent with the agreed commit constant.

[0173] In one embodiment of this disclosure, performing data recovery based on data in a snapshot includes: Write the program counter, general-purpose register set, and control status register from the snapshot back to the processor core; An idempotent write request is initiated to the shared main memory data area based on the write transaction copy in the snapshot; Release the write blocking signal for the data area after the write is completed.

[0174] In one embodiment of this disclosure, it further includes: Identify non-replay access requests pointing to memory-mapped input / output addresses, peripheral command addresses, or atomic operation addresses; The step of latching the write transaction copy is not performed for the non-replay access request; If the non-replay access request is within a consistency window where the processor has retired but external side effects have not yet taken effect, and the power failure warning signal is received, then the current snapshot saving is abandoned and the cold start is performed.

[0175] In one embodiment of this disclosure, the power failure warning signal includes a first-level warning signal, a second-level evaluation signal, and a third-level critical signal generated sequentially; the method further includes: In response to the first-level warning signal, a power-holding window is provided, and a snapshot write is performed within the power-holding window; If the snapshot has not been written completely when the second-level evaluation signal is triggered, the current snapshot saving will be abandoned. If the snapshot has not been written when the third-level critical signal is triggered, the incomplete content of the target slot will be discarded in the valid snapshot determination after power-on.

[0176] In one embodiment of this disclosure, the data area write blocking signal is active from the time of power-on reset until the snapshot decision is completed; When a valid snapshot exists, the data area write blocking signal remains in effect until the data recovery is complete; When a valid snapshot is not found, the data area write blocking signal is released immediately after the decision is made.

[0177] In one embodiment of this disclosure, the data area write blocking signal only intercepts write requests to the common main memory data area address; instruction fetch requests, read requests to the common main memory data area, and access requests to control class addresses are not intercepted by the data area write blocking signal.

[0178] In one embodiment of this disclosure, it further includes: A custom safe recovery point capture instruction is provided. When the instruction retires at a program semantic safe point, it atomically captures the current processor architecture state to the on-chip shadow register set and maintains the on-chip valid flag. The preconditions for setting the on-chip valid flag include that there are currently no pending data area write requests. After the valid flag within the chip is set, multi-source failure events are continuously monitored, and the valid flag within the chip is automatically cleared when any failure event occurs. When the power failure warning signal is triggered, if the on-chip valid flag is valid, the step of waiting for pipeline retirement is skipped, and the contents of the on-chip shadow register group are directly written into the recovery area.

[0179] In one embodiment of this disclosure, the multi-source failure event includes at least one of the following: Write requests to the common main memory data area, memory-mapped input / output read / write, control status register write, atomic operations, exception return instructions, control flow changes caused by interrupts or exceptions, and shadow register aging timeout.

[0180] Figure 9 A schematic diagram of the structure of a computer system suitable for implementing the method according to embodiments of the present disclosure is shown.

[0181] like Figure 9 As shown, the computer system includes a processing unit that can execute various methods described above based on a program stored in a read-only memory (ROM) or a program loaded from a storage portion into a random access memory (RAM). The RAM also stores various programs and data required for the operation of the computer system. The processing unit, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0182] The following components are connected to the I / O interface: input sections including keyboards, mice, etc.; output sections including cathode ray tubes (CRTs), liquid crystal displays (LCDs), and speakers; storage sections including hard disks; and communication sections including network interface cards such as LAN cards and modems. The communication section performs communication processes via a network such as the Internet. Drives are also connected to the I / O interface as needed. Removable media, such as disks, optical disks, magneto-optical disks, semiconductor memories, etc., are installed on the drive as needed so that computer programs read from them can be installed into the storage section as required. The processing unit can be implemented as a CPU, GPU, TPU, FPGA, NPU, etc.

[0183] In particular, according to embodiments of this disclosure, the methods described above can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program containing program code for performing the methods described above. In such embodiments, the computer program can be downloaded and installed from a network via a communication component, and / or installed from a removable medium.

[0184] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0185] The units or modules described in the embodiments of this disclosure can be implemented in software or programmable hardware. The described units or modules can also be located in a processor, and the names of these units or modules do not necessarily constitute a limitation on the unit or module itself.

[0186] In another aspect, this disclosure also provides a chip including at least one processor that can be used to implement the methods involved in the above system embodiments.

[0187] In one possible design, the chip also includes a memory for storing program instructions and data, which may be located inside or outside the processor.

[0188] In another aspect, this disclosure also provides a computer-readable storage medium, which may be a computer-readable storage medium included in the electronic device or computer system described above; or it may be a standalone computer-readable storage medium not assembled into a device. The computer-readable storage medium stores one or more programs, which are used by one or more processors to perform the methods described in this disclosure.

[0189] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

Claims

1. A processor power-down recovery method, applied to a processor system connected to an external non-volatile memory via a serial interface as shared main memory, wherein the shared main memory stores both program code and runtime data, characterized in that, include: On the path between the processor core and external non-volatile memory, when a write request is received that points to a common main memory data area, a copy of the write transaction is latched. The write transaction copy is cleared after physical commit confirmation on external non-volatile memory; In response to a power failure warning signal, at the pipeline retirement boundary of the processor's in-transit instructions, the currently latched copy of the write transaction is frozen and written to the target slot of the recovery area of ​​the external non-volatile memory; the recovery area includes at least two snapshot slots. After power-on reset, the data area write blocking signal is set by default to prevent writing to the common main memory data area; Scan and verify the snapshot slots in the recovery area to determine whether a valid snapshot exists; If a valid snapshot exists, perform data recovery based on the data in the snapshot; If no valid snapshot exists, release the write blocking signal for the data area and perform a cold start.

2. The method according to claim 1, characterized in that, The process of freezing the currently latched write transaction copy at the pipeline retirement boundary of the processor's in-transit instructions includes: First-level convergence: Pause new instruction fetching and wait for all instructions in the processor pipeline to retire in order to solidify the processor architecture state; Second-level convergence: After the first-level convergence is completed, read the currently latched copy of the write transaction at the pipeline retirement boundary and freeze it; The second-level convergence does not require that the write request corresponding to the write transaction copy has been physically committed on the external non-volatile memory as a necessary condition for convergence completion.

3. The method according to claim 1, characterized in that, Each snapshot slot in the recovery area includes a serial number field and a commit flag field; the target slot in the recovery area written to external non-volatile memory includes: Select the target slot based on the sequence number and commit flag of each snapshot slot: The slot with an invalid submission flag is preferentially selected as the target slot; If all slots have valid commit flags, the slot with the older sequence number is selected as the target slot, and the slot with the newer sequence number and a valid commit flag is retained as a rollback candidate slot.

4. The method according to claim 3, characterized in that, The target slot in the recovery area of ​​the external non-volatile memory also includes a two-stage commit process: In the first stage, before writing the snapshot content, if the commit flag of the target slot is a valid value, then the commit flag is written to an invalid value. In the second stage, after all the head area and payload area of ​​the target slot have been written, a new valid value is written to the submission flag at the last atom.

5. The method according to claim 1, characterized in that, The snapshot slot includes an identifier field, a header checksum field, a load checksum field, and a commit flag field; Whether the judgment has a valid snapshot includes: A valid snapshot is determined to exist in the snapshot slot only when the identifier field in the same snapshot slot matches the agreed constant, the header check value field passes the check, the load check value field passes the check, and the commit flag field is consistent with the agreed commit constant.

6. The method according to claim 1, characterized in that, The data recovery based on the data in the snapshot includes: Write the program counter, general-purpose register set, and control status register from the snapshot back to the processor core; An idempotent write request is initiated to the shared main memory data area based on the write transaction copy in the snapshot; Release the write blocking signal for the data area after the write is completed.

7. The method according to claim 1, characterized in that, Also includes: A custom safe recovery point capture instruction is provided. When the instruction retires at a program semantic safe point, it atomically captures the current processor architecture state to the on-chip shadow register set and maintains the on-chip valid flag. The preconditions for setting the on-chip valid flag include that there are currently no pending data area write requests. After the valid flag within the chip is set, multi-source failure events are continuously monitored, and the valid flag within the chip is automatically cleared when any failure event occurs. When the power failure warning signal is triggered, if the on-chip valid flag is valid, the step of waiting for pipeline retirement is skipped, and the contents of the on-chip shadow register group are directly written into the recovery area.

8. A processor power-down recovery system, applied to a processor system that connects to an external non-volatile memory via a serial interface as a common main memory, wherein the common main memory stores both program code and runtime data, characterized in that, include: The main memory access arbitration unit is located on the path between the processor core and the serial non-volatile memory control unit. It is used to latch the write transaction copy of the write request when a write request to the common main memory data area is received; and to clear the write transaction copy after receiving confirmation of the physical commit of the write request on the external non-volatile memory. A recovery control unit, coupled to the main memory access arbitration unit, is used to freeze the copy of the write transaction currently latched by the main memory access arbitration unit in an internal cache at the pipeline retirement boundary of the processor's in-transit instructions in response to a power failure warning signal. A status snapshot management unit, coupled to the recovery control unit and the main memory access arbitration unit, is used to write the write transaction copies frozen by the recovery control unit into the target slot of the recovery area of ​​the external non-volatile memory; the recovery area includes at least two snapshot slots; The recovery control unit is further configured to, upon power-on reset, default to setting a data area write blocking signal and apply it to the main memory access arbitration unit to prevent writing to the common main memory data area; drive the status snapshot management unit to scan and verify the snapshot slots in the recovery area to determine whether a valid snapshot exists; if a valid snapshot exists, perform data recovery based on the data in the snapshot; if no valid snapshot exists, release the data area write blocking signal and perform a cold start.

9. An electronic device, characterized in that, It includes a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method of any one of claims 1-7.

10. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by a processor, the computer instructions implement the method of any one of claims 1-7.

Images