US9772856B2 - System-level dual-boot capability in systems having one or more devices without native dual-boot capability - Google Patents

System-level dual-boot capability in systems having one or more devices without native dual-boot capability Download PDF

Info

Publication number
US9772856B2
US9772856B2 US14/327,811 US201414327811A US9772856B2 US 9772856 B2 US9772856 B2 US 9772856B2 US 201414327811 A US201414327811 A US 201414327811A US 9772856 B2 US9772856 B2 US 9772856B2
Authority
US
United States
Prior art keywords
master
slave
volatile
memory
image
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US14/327,811
Other versions
US20160011878A1 (en
Inventor
Srirama Chandra
Cleo Mui
Cheng Jen Gwo
Saurabh Chheda
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Lattice Semiconductor Corp
Original Assignee
Lattice Semiconductor Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Lattice Semiconductor Corp filed Critical Lattice Semiconductor Corp
Priority to US14/327,811 priority Critical patent/US9772856B2/en
Assigned to LATTICE SEMICONDUCTOR CORPORATION reassignment LATTICE SEMICONDUCTOR CORPORATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: CHANDRA, SRIRAMA, GWO, CHENG JEN, MUI, CLEO
Assigned to LATTICE SEMICONDUCTOR CORPORATION reassignment LATTICE SEMICONDUCTOR CORPORATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: CHHEDA, SAURABH
Assigned to JEFFERIES FINANCE LLC reassignment JEFFERIES FINANCE LLC SECURITY INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: DVDO, INC., LATTICE SEMICONDUCTOR CORPORATION, SIBEAM, INC., SILICON IMAGE, INC.
Publication of US20160011878A1 publication Critical patent/US20160011878A1/en
Application granted granted Critical
Publication of US9772856B2 publication Critical patent/US9772856B2/en
Assigned to LATTICE SEMICONDUCTOR CORPORATION, SILICON IMAGE, INC., DVDO, INC., SIBEAM, INC. reassignment LATTICE SEMICONDUCTOR CORPORATION RELEASE BY SECURED PARTY (SEE DOCUMENT FOR DETAILS). Assignors: JEFFERIES FINANCE LLC
Assigned to WELLS FARGO BANK, NATIONAL ASSOCIATION, AS ADMINISTRATIVE AGENT reassignment WELLS FARGO BANK, NATIONAL ASSOCIATION, AS ADMINISTRATIVE AGENT SECURITY INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: LATTICE SEMICONDUCTOR CORPORATION
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/4401—Bootstrapping
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1402—Saving, restoring, recovering or retrying
    • G06F11/1415—Saving, restoring, recovering or retrying at system level
    • G06F11/1417—Boot up procedures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/0223—User address space allocation, e.g. contiguous or non contiguous base addressing
    • G06F12/023—Free address space management
    • G06F12/0238—Memory management in non-volatile memory, e.g. resistive RAM or ferroelectric memory
    • G06F12/0246—Memory management in non-volatile memory, e.g. resistive RAM or ferroelectric memory in block erasable memory, e.g. flash memory
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/06—Addressing a physical block of locations, e.g. base addressing, module addressing, memory dedication
    • G06F12/0638—Combination of memories, e.g. ROM and RAM such as to permit replacement or supplementing of words in one module by words in another module
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/10—Providing a specific technical effect
    • G06F2212/1016—Performance improvement
    • G06F2212/1024—Latency reduction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/20—Employing a main memory using a specific memory technology
    • G06F2212/205—Hybrid memory, e.g. using both volatile and non-volatile memory
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/72—Details relating to flash memory management
    • G06F2212/7208—Multiple device management, e.g. distributing data over multiple flash devices

Definitions

  • the present invention relates to electronics and, more specifically but not exclusively, to dual-boot capability for systems having multiple programmable devices, such as programmable logic devices and/or programmable mixed-signal devices.
  • programmable devices such as programmable logic devices (PLDs) and programmable mixed-signal devices (PMDs) have both on-chip volatile configuration memory and on-chip non-volatile configuration memory, where a primary image is programmed into the non-volatile memory and then, upon device power-up, copied from the non-volatile memory into the volatile memory for use in operating the PD.
  • PLDs programmable logic devices
  • PMDs programmable mixed-signal devices
  • FPGA field-programmable gate array
  • the PD wakes up with a faulty primary image stored in the non-volatile memory. At that time, the PD might not be able to boot up properly, resulting in a system failure.
  • programming and its variants refer to the storage of images into non-volatile memory
  • configuration and its variants refer to the copying of images from non-volatile memory into volatile memory, e.g., upon power-up.
  • Some PDs have native dual-boot capability that enables the PD to boot up even when the primary image is invalid.
  • the PD copies a fail-safe (“golden”) image, e.g., from an off-chip non-volatile memory device, into its volatile memory for use in booting up the PD.
  • a fail-safe (“golden”) image e.g., from an off-chip non-volatile memory device, into its volatile memory for use in booting up the PD.
  • the functionality of the golden image may be the same as or different from that of the primary image.
  • FIG. 1 shows a block diagram of a multi-device system according to one embodiment of the disclosure.
  • FIG. 2 shows the formatting of an example combined golden image for storage in the external non-volatile memory device of FIG. 1 .
  • Certain embodiments of the disclosure enable multi-PD systems to be implemented with as few as a single PD having native dual-boot capability and the rest of the PDs having no native dual-boot capability and still extend the dual-boot capability to the entire system.
  • the disclosure can extend some of the advantages of system-level dual-boot capability (e.g., system reliability, robustness) without having to provide each PD in the system with native dual-boot capability.
  • FIG. 1 shows a block diagram of a multi-device system 100 according to one embodiment of the disclosure.
  • System 100 comprises a master programmable device (PD) 110 , N slave PDs 120 , and an external non-volatile memory device 130 , where N is a positive integer.
  • Master PD 110 has both master volatile configuration memory 112 (e.g., SRAM) and master non-volatile configuration memory 114 (e.g., flash, EEPROM).
  • each slave PD 120 has slave volatile configuration memory 122 and slave non-volatile configuration memory 124 .
  • the non-volatile memory can be programmed with a primary image, such that, upon power-up, the PD copies the primary image from its non-volatile memory into its volatile memory for use in operating the PD.
  • Each programming and configuration interface 108 e.g., I2C bus
  • External non-volatile memory device 130 stores a combined golden image that includes a master golden image for master PD 110 as well as N slave golden images, one for each different slave PD 120 .
  • the master golden image e.g., 202 ( 0 ) of FIG. 2
  • the master golden image includes a special dual-boot function in addition to one or more other functions designed for maintaining the system functionality.
  • Master PD 110 has conventional, native dual-boot capability that enables the master PD to detect invalidity of the master primary image before the master primary image is copied from master non-volatile memory 114 into master volatile memory 112 upon power-up of the master PD.
  • Each slave PD 120 in system 100 has no native dual-boot capability. As such, each slave PD 120 has no way of to recover when its non-volatile image ( 124 ) is invalid.
  • System 100 is programmed using the following three-step system-programming procedure to ensure that slave PDs are programmed with valid images before programming the master PD, since only the master PD has the native dual-boot capability.
  • master PD 110 and all N slave PDs 120 in system 100 will be configured to operate under the control of their respective golden images.
  • any occurrence of system-level power cycling or even power cycling of just master PD 110 could result in storing incomplete images in master non-volatile memory 114 and/or one or more slave non-volatile memories 124 .
  • the master PD upon power up, the master PD will boot using the golden image stored in external non-volatile memory device 130 instead of primary non-volatile image 114 .
  • This triggering of the booting from external memory 130 is just a manifestation of the native dual-boot capability of master PD 110 .
  • the master device 110 will load its volatile memory 112 from golden image 202 ( 0 ) stored in the external non-volatile memory device 130 .
  • the dual-boot program begins to execute and loads the slave golden images 202 ( 1 ) to 202 (N) stored in memory device 130 into the slave PDs' volatile memories 122 ( 1 ) to 122 (N).
  • the slave PD-specific image downloaded from the golden boot memory 130 will overwrite the contents stored in the corresponding PD 120 ( 1 ) to 120 (N) volatile memory 122 .
  • the master device 110 will load its volatile memory 112 from golden image 202 ( 0 ) stored in the external non-volatile memory device 130 .
  • the dual-boot program begins to execute and loads the image stored in golden images 202 ( 1 ) to 202 (N) into the slave PDs' volatile memories 122 ( 1 ) to 122 (N).
  • the power-up phase of the power cycling might occur during the programming portion of the third step or during the verifying portion of the third step. If the power-up phase occurs during the programming portion, then the master device 110 will load its volatile memory 112 from golden image 202 ( 0 ) stored in the external non-volatile memory device 130 . After the master PD's volatile memory 112 is configured, the dual-boot program begins to execute and loads the images stored in golden images 202 ( 1 ) to 202 (N) into slave PDs' volatile memory 122 ( 1 ) to 122 (N).
  • Certain embodiments of the disclosure might not be able to recover from every instance of corruption of a master or slave primary image, but these embodiments can still provide significant system-level reliability and robustness without having to provision every PD in the system with native dual-boot capability.
  • the present disclosure also includes computer-implemented software-development tools that can be used to generate the master and slave golden images for those multi-PD systems.
  • a software designer can use such a software-development tool to generate a new master golden image and/or one or more new slave golden images for system 100 of FIG. 1 .
  • This embodiment of the software-development tool has (at least) two features, the details of which the design engineer may be unaware.
  • the software-development tool can be configured to embed the new master golden image with the dual-boot function along with the one or more master-PD functions that the software designer is actively designing. As such, the software designer does not need to know any details about the dual-boot function, yet is able to use the software-development tool to generate master golden images with appropriate, embedded dual-boot functions.
  • the software-development tool can be configured to combine the resulting golden images into a single, combined golden image for storage in a single external non-volatile memory device, such as device 130 of FIG. 1 , such that the dual-boot function of the master golden image is enabled to extract and separately copy the master golden image and each slave golden image from the external non-volatile memory device into the appropriate PD volatile memory.
  • FIG. 2 shows the formatting of an exemplary combined golden image 200 for storage in external non-volatile memory device 130 of FIG. 1 .
  • the master golden image for master PD 110 (with an embedded dual-boot function) is stored in a zeroth field 202 ( 0 ) of memory device 130
  • the slave golden image for a first slave PD 120 ( 1 ) is stored in a first field 202 ( 1 )
  • the slave golden image for a second slave PD 120 ( 2 ) is stored in a second field 202 ( 2 )
  • so on until the slave golden image for the Nth slave PD 120 (N) is stored in an Nth field 202 (N).
  • the (possibly different) lengths of the (N+1) different fields 202 are known to both the software-development tool and the dual-boot function that gets embedded into the master golden image by the software-development tool.
  • FIG. 1 shows an embodiment in which (i) each primary image is stored on its corresponding PD and (ii) all of the golden images are stored on an external memory device as a single, combined golden image
  • the disclosure is not so limited.
  • one or more or even all of the golden images may be stored separately rather than combined, and individual primary images may be stored on-chip or off-chip.
  • each PD in system 100 can be any suitable programmable device, such as, without limitation, a field-programmable gate array (FPGA), a programmable logic device, or a programmable mixed-signal device.
  • FPGA field-programmable gate array
  • each PD may be a single, integrated device or a multi-component subsystem.
  • External non-volatile memory device 130 of FIG. 1 can be any suitable memory device, such as, without limitation, a (SPI) flash drive, or an EEPROM (electronically erasable programmable read-only memory).
  • a (SPI) flash drive or an EEPROM (electronically erasable programmable read-only memory).
  • EEPROM electrostatic erasable programmable read-only memory
  • Each different interface in system 100 can be any suitable interface, such as, without limitation, a serial peripheral interface (SPI), a joint test action group (JTAG) interface, or an inter-integrated circuit (I2C) interface.
  • SPI serial peripheral interface
  • JTAG joint test action group
  • I2C inter-integrated circuit
  • Couple refers to any manner known in the art or later developed in which energy is allowed to be transferred between two or more elements, and the interposition of one or more additional elements is contemplated, although not required. Conversely, the terms “directly coupled,” “directly connected,” etc., imply the absence of such additional elements.
  • Signals and corresponding nodes, ports, or paths may be referred to by the same name and are interchangeable for purposes here.
  • any block diagrams herein represent conceptual views of illustrative circuitry embodying the principles of the disclosure.
  • any flow charts, flow diagrams, state transition diagrams, pseudo code, and the like represent various processes which may be substantially represented in computer readable medium and so executed by a computer or processor, whether or not such computer or processor is explicitly shown.
  • figure numbers and/or figure reference labels in the claims is intended to identify one or more possible embodiments of the claimed subject matter in order to facilitate the interpretation of the claims. Such use is not to be construed as necessarily limiting the scope of those claims to the embodiments shown in the corresponding figures.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Quality & Reliability (AREA)
  • Computer Security & Cryptography (AREA)
  • Stored Programmes (AREA)

Abstract

In one embodiment, a system has a master programmable device (PD) with native dual-boot capability and one or more slave PDs with no native dual-boot capability. A master golden image includes an embedded dual-boot function. During power-up, each PD copies its primary image into its volatile configuration memory and determines whether the primary image is valid. When the master's configuration engine detects an invalid master primary image, then the master's native dual-boot capability enables the master to implement a system-reboot procedure, which includes copying the master golden image from an external memory device into the master's volatile configuration memory and launching the embedded dual-boot function, which in turn copies the slave golden images from the external memory device into the slaves' volatile configuration memories before enabling other master-golden-image functions. Significant system reliability and robustness are achieved without provisioning every PD with native dual-boot capability.

Description

BACKGROUND
Field of the Invention
The present invention relates to electronics and, more specifically but not exclusively, to dual-boot capability for systems having multiple programmable devices, such as programmable logic devices and/or programmable mixed-signal devices.
Description of the Related Art
This section introduces aspects that may help facilitate a better understanding of the disclosure. Accordingly, the statements of this section are to be read in this light and are not to be understood as admissions about what is prior art or what is not prior art.
Some programmable devices (PDs), such as programmable logic devices (PLDs) and programmable mixed-signal devices (PMDs) have both on-chip volatile configuration memory and on-chip non-volatile configuration memory, where a primary image is programmed into the non-volatile memory and then, upon device power-up, copied from the non-volatile memory into the volatile memory for use in operating the PD. As the terms are used here, a field-programmable gate array (FPGA) is assumed to be a type of PLD. While the devices operate using the image stored in the volatile configuration memory, it is possible to reprogram the on-chip non-volatile configuration memory through a process called background programming. If the background programming process is interrupted (e.g., power cycling the board), then the PD wakes up with a faulty primary image stored in the non-volatile memory. At that time, the PD might not be able to boot up properly, resulting in a system failure. As used in this specification, the term “programming” and its variants refer to the storage of images into non-volatile memory, while the term “configuration” and its variants refer to the copying of images from non-volatile memory into volatile memory, e.g., upon power-up.
Some PDs have native dual-boot capability that enables the PD to boot up even when the primary image is invalid. In particular, when the PD fails to boot up properly due to an invalid primary image, the PD copies a fail-safe (“golden”) image, e.g., from an off-chip non-volatile memory device, into its volatile memory for use in booting up the PD. Depending on the particular implementation, the functionality of the golden image may be the same as or different from that of the primary image.
In the absence of dual-boot capability, a PD having an invalid primary image cannot recover from a boot-up failure, and external intervention is required to detect and correct the situation.
BRIEF DESCRIPTION OF THE DRAWINGS
Other embodiments of the disclosure will become more fully apparent from the following detailed description, the appended claims, and the accompanying drawings in which like reference numerals identify similar or identical elements.
FIG. 1 shows a block diagram of a multi-device system according to one embodiment of the disclosure; and
FIG. 2 shows the formatting of an example combined golden image for storage in the external non-volatile memory device of FIG. 1.
 DETAILED DESCRIPTION
Certain embodiments of the disclosure enable multi-PD systems to be implemented with as few as a single PD having native dual-boot capability and the rest of the PDs having no native dual-boot capability and still extend the dual-boot capability to the entire system. In this way, the disclosure can extend some of the advantages of system-level dual-boot capability (e.g., system reliability, robustness) without having to provide each PD in the system with native dual-boot capability.
FIG. 1 shows a block diagram of a multi-device system 100 according to one embodiment of the disclosure. System 100 comprises a master programmable device (PD) 110, N slave PDs 120, and an external non-volatile memory device 130, where N is a positive integer. Master PD 110 has both master volatile configuration memory 112 (e.g., SRAM) and master non-volatile configuration memory 114 (e.g., flash, EEPROM). In addition, each slave PD 120 has slave volatile configuration memory 122 and slave non-volatile configuration memory 124. In each PD, the non-volatile memory can be programmed with a primary image, such that, upon power-up, the PD copies the primary image from its non-volatile memory into its volatile memory for use in operating the PD. Each programming and configuration interface 108 (e.g., I2C bus) enables master PD 110 to program and configure the corresponding slave PD 120.
External non-volatile memory device 130 stores a combined golden image that includes a master golden image for master PD 110 as well as N slave golden images, one for each different slave PD 120. The master golden image (e.g., 202(0) of FIG. 2) includes a special dual-boot function in addition to one or more other functions designed for maintaining the system functionality.
Master PD 110 has conventional, native dual-boot capability that enables the master PD to detect invalidity of the master primary image before the master primary image is copied from master non-volatile memory 114 into master volatile memory 112 upon power-up of the master PD. Each slave PD 120 in system 100 has no native dual-boot capability. As such, each slave PD 120 has no way of to recover when its non-volatile image (124) is invalid.
System 100 is programmed using the following three-step system-programming procedure to ensure that slave PDs are programmed with valid images before programming the master PD, since only the master PD has the native dual-boot capability.
    • 1) Master PD 110 is erased, where the master volatile memory 112 is erased first;
    • 2) After step (1) is successfully completed, the slave non-volatile memory 124 of each slave PD 120 is erased and then programmed with its respective slave primary image, e.g., via interface 108. The slave primary image may be provided by an external device such as device 130 via interface 104 or a microprocessor via JTAG interface 108. The programming of the slave non-volatile memory is then verified (e.g., by performing an appropriate checksum analysis); and
    • 3) After step (2) is successfully completed, master non-volatile memory 114 of master PD 110 is programmed with its master primary image via interface 102, and the programming of the master non-volatile memory is then verified.
When, upon system power-up or even just device power-up, the configuration engine (not shown) of master PD 110 determines that the master primary image is corrupted or otherwise invalid, the following five-step system-reboot procedure is implemented:
    • 1) The native dual-boot capability of master PD 110 causes the master PD to configure the master volatile memory 114 with the master golden image 202(0) from external non-volatile memory device 130 via interface 104;
    • 2) Master PD 110 then executes (i.e., initiates) the dual-boot function loaded from the master golden image 202(0);
    • 3) The dual-boot function is executed first. When the dual-boot function is in operation, all other functionalities in master PD 110 are in an idle state;
    • 4) The dual-boot function then configures the slave volatile memory 124 of the each slave PD 120 using the corresponding slave golden image (e.g., 202(1) to 202(N) of FIG. 2) from memory device 130.
    • 5) After all the slave devices are configured, the dual-boot function flags completion to the rest of functions in master PD 110. After that, the rest of the functions in the master PLD/PMD can start to operate.
After this system-reboot procedure is successfully completed, master PD 110 and all N slave PDs 120 in system 100 will be configured to operate under the control of their respective golden images.
During the system-programming or background-programming procedure, any occurrence of system-level power cycling or even power cycling of just master PD 110 could result in storing incomplete images in master non-volatile memory 114 and/or one or more slave non-volatile memories 124. Under this condition, upon power up, the master PD will boot using the golden image stored in external non-volatile memory device 130 instead of primary non-volatile image 114. This triggering of the booting from external memory 130 is just a manifestation of the native dual-boot capability of master PD 110.
With respect to the three different steps of the system-programming procedure, if power cycling occurs during the first step of erasing the master non-volatile memory, then, upon the power-up phase of the power cycling, the master device 110 will load its volatile memory 112 from golden image 202(0) stored in the external non-volatile memory device 130. After the master PD's volatile memory 112 is configured, the dual-boot program begins to execute and loads the slave golden images 202(1) to 202(N) stored in memory device 130 into the slave PDs' volatile memories 122(1) to 122(N). The slave PD-specific image downloaded from the golden boot memory 130 will overwrite the contents stored in the corresponding PD 120(1) to 120(N) volatile memory 122.
If power cycling occurs during the second step of erasing, programming, and verifying the slave non-volatile memories of the N different slave PDs, then, upon the power-up phase of the power cycling, the master device 110 will load its volatile memory 112 from golden image 202(0) stored in the external non-volatile memory device 130. After the master PD's volatile memory 112 is configured, the dual-boot program begins to execute and loads the image stored in golden images 202(1) to 202(N) into the slave PDs' volatile memories 122(1) to 122(N).
If power cycling occurs during the third step of programming and verifying the master non-volatile memory of the master PD, then the power-up phase of the power cycling might occur during the programming portion of the third step or during the verifying portion of the third step. If the power-up phase occurs during the programming portion, then the master device 110 will load its volatile memory 112 from golden image 202(0) stored in the external non-volatile memory device 130. After the master PD's volatile memory 112 is configured, the dual-boot program begins to execute and loads the images stored in golden images 202(1) to 202(N) into slave PDs' volatile memory 122(1) to 122(N).
Certain embodiments of the disclosure might not be able to recover from every instance of corruption of a master or slave primary image, but these embodiments can still provide significant system-level reliability and robustness without having to provision every PD in the system with native dual-boot capability.
In addition to multi-PD systems, such as system 100 of FIG. 1, the present disclosure also includes computer-implemented software-development tools that can be used to generate the master and slave golden images for those multi-PD systems. In one embodiment, a software designer can use such a software-development tool to generate a new master golden image and/or one or more new slave golden images for system 100 of FIG. 1.
This embodiment of the software-development tool has (at least) two features, the details of which the design engineer may be unaware. First of all, when a software designer is generating a new master golden image for system 100, the software-development tool can be configured to embed the new master golden image with the dual-boot function along with the one or more master-PD functions that the software designer is actively designing. As such, the software designer does not need to know any details about the dual-boot function, yet is able to use the software-development tool to generate master golden images with appropriate, embedded dual-boot functions.
Second, when a software designer is generating a new master golden image and/or one or more new slave golden images for system 100, the software-development tool can be configured to combine the resulting golden images into a single, combined golden image for storage in a single external non-volatile memory device, such as device 130 of FIG. 1, such that the dual-boot function of the master golden image is enabled to extract and separately copy the master golden image and each slave golden image from the external non-volatile memory device into the appropriate PD volatile memory. This involves the software-development tool and the dual-boot function having a priori knowledge of the formatting of the various golden images into the combined golden image that a programming tool can understand.
FIG. 2 shows the formatting of an exemplary combined golden image 200 for storage in external non-volatile memory device 130 of FIG. 1. According to this particular implementation, the master golden image for master PD 110 (with an embedded dual-boot function) is stored in a zeroth field 202(0) of memory device 130, the slave golden image for a first slave PD 120(1) is stored in a first field 202(1), the slave golden image for a second slave PD 120(2) is stored in a second field 202(2), and so on until the slave golden image for the Nth slave PD 120(N) is stored in an Nth field 202(N). The (possibly different) lengths of the (N+1) different fields 202 are known to both the software-development tool and the dual-boot function that gets embedded into the master golden image by the software-development tool.
Although FIG. 1 shows an embodiment in which (i) each primary image is stored on its corresponding PD and (ii) all of the golden images are stored on an external memory device as a single, combined golden image, the disclosure is not so limited. In general, one or more or even all of the golden images may be stored separately rather than combined, and individual primary images may be stored on-chip or off-chip.
Depending on the particular implementation, each PD in system 100 can be any suitable programmable device, such as, without limitation, a field-programmable gate array (FPGA), a programmable logic device, or a programmable mixed-signal device. Moreover, each PD may be a single, integrated device or a multi-component subsystem.
External non-volatile memory device 130 of FIG. 1 can be any suitable memory device, such as, without limitation, a (SPI) flash drive, or an EEPROM (electronically erasable programmable read-only memory).
Each different interface in system 100 can be any suitable interface, such as, without limitation, a serial peripheral interface (SPI), a joint test action group (JTAG) interface, or an inter-integrated circuit (I2C) interface.
Also for purposes of this description, the terms “couple,” “coupling,” “coupled,” “connect,” “connecting,” or “connected” refer to any manner known in the art or later developed in which energy is allowed to be transferred between two or more elements, and the interposition of one or more additional elements is contemplated, although not required. Conversely, the terms “directly coupled,” “directly connected,” etc., imply the absence of such additional elements.
Signals and corresponding nodes, ports, or paths may be referred to by the same name and are interchangeable for purposes here.
It should be appreciated by those of ordinary skill in the art that any block diagrams herein represent conceptual views of illustrative circuitry embodying the principles of the disclosure. Similarly, it will be appreciated that any flow charts, flow diagrams, state transition diagrams, pseudo code, and the like represent various processes which may be substantially represented in computer readable medium and so executed by a computer or processor, whether or not such computer or processor is explicitly shown.
It will be further understood that various changes in the details, materials, and arrangements of the parts which have been described and illustrated in order to explain embodiments of this disclosure may be made by those skilled in the art without departing from embodiments of the disclosure encompassed by the following claims.
The use of figure numbers and/or figure reference labels in the claims is intended to identify one or more possible embodiments of the claimed subject matter in order to facilitate the interpretation of the claims. Such use is not to be construed as necessarily limiting the scope of those claims to the embodiments shown in the corresponding figures.
Reference herein to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the disclosure. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments necessarily mutually exclusive of other embodiments. The same applies to the term “implementation.”
The embodiments covered by the claims in this application are limited to embodiments that (1) are enabled by this specification and (2) correspond to statutory subject matter. Non-enabled embodiments and embodiments that correspond to non-statutory subject matter are explicitly disclaimed even if they fall within the scope of the claims.

Claims (17)

What is claimed is:
1. A system comprising:
a master programmable device (PD) having native dual-boot capability; and
a slave PD without native dual-boot capability and connected to the master PD, wherein:
the master PD has master volatile configuration memory;
the slave PD has slave volatile configuration memory;
a first non-volatile configuration memory in the system stores a master primary image for the master PD;
a second non-volatile configuration memory in the system stores a slave primary image for the slave PD; and
a third non-volatile memory in the system stores a master golden image for the master PD and a slave golden image for the slave PD, wherein the master golden image comprises a dual-boot function and one or more other master-PD functions and the system is designed such that:
during system power-up, (i) the master PD copies the master primary image from the first non-volatile memory into the master volatile memory and (ii) the slave PD copies the slave primary image from the second non-volatile memory into the slave volatile memory; and
in response to the master PD detecting that the master primary non-volatile image is invalid:
(1) the master PD copies the master golden image from the third non-volatile memory, instead of the master primary image from the first non-volatile configuration memory, into the master volatile memory of the master PD;
(2) then the master PD launches the dual-boot function of the master golden image;
(3) then the dual-boot function inhibits the one or more other master-PD functions of the master golden image;
(4) then the dual-boot function copies the slave golden image from the third non-volatile memory into the slave volatile memory of the slave PD; and
(5) then the dual-boot function enables the one or more other master-PD functions of the master golden image.
2. The system of claim 1, wherein:
the master primary image is stored in master non-volatile memory within the master PD such that the first non-volatile memory is part of the master non-volatile memory within the master PD; and
the slave primary image is stored in slave non-volatile memory within the slave PD such that the second non-volatile memory is part of the slave non-volatile memory within the slave PD.
3. The system of claim 1, wherein the first non-volatile memory is external to the master PD.
4. The system of claim 1, wherein the second non-volatile memory is external to the slave PD.
5. The system of claim 1, further comprising an external memory device, wherein the master golden image and the slave golden image are stored in the external memory device such that the third non-volatile memory is part of the external memory device.
6. The system of claim 5, wherein the external memory device is directly connected to the master PD, but not directly connected to the slave PD.
7. The system of claim 5, wherein:
the master and slave golden images are stored as a single, combined golden image in the external memory device; and
the dual-boot function of the master golden image is configured to extract and separately copy the master golden image and the slave golden image from the external memory device into the corresponding volatile memories of the master and slave PDs.
8. The system of claim 1, wherein the system is programmed by:
(a) erasing memory for the master PD;
(b) then erasing, programming, and verifying memory for the slave PD; and
(c) then programming and verifying the memory for the master PD.
9. The system of claim 8, wherein the system is designed such that, when power cycling occurs during any of steps (a), (b), and (c) of claim 8, then steps (1)-(5) of claim 1 are implemented.
10. The system of claim 8, further comprising one or more other slave PDs, wherein:
step (4) of claim 1 further comprises, for each other slave PD, the dual-boot function copying a corresponding slave golden image from the third non-volatile memory into corresponding slave volatile memory within the other slave PD; and
step (b) of claim 8 further comprises, for each other slave PD, erasing, programming, and verifying corresponding slave primary memory within the other slave PD.
11. A method comprising:
providing a master programmable device (PD) having volatile configuration memory and non-volatile configuration memory for storing a master primary image for the master PD, at least one slave PD without native dual-boot capability having volatile configuration memory and non-volatile configuration memory for storing a slave primary image for the slave PD, and a non-volatile memory device storing a master golden image for the master PD and a slave golden image for the slave PD; and
upon detecting that the master primary image for the master PD is invalid:
causing the master PD to copy the master golden image from the non-volatile memory device, instead of the master primary image from the non-volatile configuration memory, into the volatile configuration memory of the master PD; and
causing the master PD to copy the slave golden image from the non-volatile memory device into the volatile configuration memory of the slave PD.
12. The method of claim 11, wherein the method further includes:
providing at least a second slave PD having volatile configuration memory and non-volatile configuration memory for storing a slave primary image for the second slave PD, and the memory device for storing a slave golden image for the second slave PD; and
upon detecting that the master primary image for the master PD is invalid:
causing the master PD to copy the slave golden image for the second slave PD from the memory device into the volatile configuration memory of the second slave PD.
13. A system comprising:
a master programmable device (PD) having volatile configuration memory and non-volatile configuration memory for storing a master primary image for the master PD,
at least one slave PD without native dual-boot capability having volatile configuration memory and non-volatile configuration memory for storing a slave primary image for the slave PD; and
a non-volatile memory device storing a master golden image for the master PD and a slave golden image for the slave PD;
wherein the master PD is configured, upon detecting that the master primary image for the master PD is invalid, to copy the master golden image from the non-volatile memory device, instead of the master primary image from the non-volatile configuration memory, into the volatile configuration memory of the master PD and to copy the slave golden image from the non-volatile memory device into the volatile configuration memory of the slave PD.
14. The system of claim 13, wherein the memory device is external to the master PD and the slave PD.
15. The system of claim 14, wherein the memory device is directly connected to the master PD, but not directly connected to the slave PD.
16. The system of claim 13, wherein the master and slave golden images are stored as a combined golden image in the memory device.
17. The system of claim 13 including:
at least a second slave PD having volatile configuration memory and non-volatile configuration memory for storing a slave primary image for the second slave PD; and
the memory device storing a slave golden image for the second slave PD;
wherein the master PD is configured, upon detecting that the master primary image for the master PD is invalid to copy the slave golden image for the second slave PD from the memory device into the volatile configuration memory of the second slave PD.
US14/327,811 2014-07-10 2014-07-10 System-level dual-boot capability in systems having one or more devices without native dual-boot capability Active 2035-07-04 US9772856B2 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US14/327,811 US9772856B2 (en) 2014-07-10 2014-07-10 System-level dual-boot capability in systems having one or more devices without native dual-boot capability

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US14/327,811 US9772856B2 (en) 2014-07-10 2014-07-10 System-level dual-boot capability in systems having one or more devices without native dual-boot capability

Publications (2)

Publication Number Publication Date
US20160011878A1 US20160011878A1 (en) 2016-01-14
US9772856B2 true US9772856B2 (en) 2017-09-26

Family

ID=55067633

Family Applications (1)

Application Number Title Priority Date Filing Date
US14/327,811 Active 2035-07-04 US9772856B2 (en) 2014-07-10 2014-07-10 System-level dual-boot capability in systems having one or more devices without native dual-boot capability

Country Status (1)

Country Link
US (1) US9772856B2 (en)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6723863B2 (en) * 2016-08-01 2020-07-15 オリンパス株式会社 Embedded system, photography equipment and refresh method
JP7398438B2 (en) 2018-05-11 2023-12-14 ラティス セミコンダクタ コーポレーション Key provisioning system and method for programmable logic devices
EP3871079A4 (en) * 2019-04-15 2022-06-22 Hewlett-Packard Development Company, L.P. Image transfer

Citations (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6357021B1 (en) * 1999-04-14 2002-03-12 Mitsumi Electric Co., Ltd. Method and apparatus for updating firmware
US6421792B1 (en) * 1998-12-03 2002-07-16 International Business Machines Corporation Data processing system and method for automatic recovery from an unsuccessful boot
US6442067B1 (en) * 2000-05-23 2002-08-27 Compaq Information Technologies Group, L.P. Recovery ROM for array controllers
US20030005277A1 (en) * 2001-06-29 2003-01-02 Harding Matthew C. Automatic replacement of corrupted BIOS image
US6532551B1 (en) * 1999-05-14 2003-03-11 Sharp Kabushiki Kaisha Data management method for backup memory
US20030084337A1 (en) * 2001-10-03 2003-05-01 Simionescu Dan C. Remotely controlled failsafe boot mechanism and manager for a network device
US20040030883A1 (en) * 2002-08-09 2004-02-12 Munguia Peter R. Method and apparatus for booting from a selection of multiple boot images
US20050132351A1 (en) * 2003-12-12 2005-06-16 Randall Roderick K. Updating electronic device software employing rollback
US20050251673A1 (en) * 2004-05-05 2005-11-10 International Business Machines Corporation Updatable firmware having boot and/or communication redundancy
US20060059327A1 (en) * 2004-09-13 2006-03-16 Brown Norman P Method to reset an image to a known state
US7043664B1 (en) * 2002-10-31 2006-05-09 Microsoft Corporation Firmware recovery
US7301822B1 (en) 2005-05-18 2007-11-27 Xilinx, Inc. Multi-boot configuration of programmable devices
US7425843B1 (en) 2007-08-07 2008-09-16 Xilinx, Inc. Programmable logic device multi-boot state machine for serial peripheral interface (SPI) programmable read only memory (PROM)
US7576561B1 (en) 2007-11-13 2009-08-18 Xilinx, Inc. Device and method of configuring a device having programmable logic
US7908470B1 (en) * 2006-10-31 2011-03-15 Hewlett-Packard Development Company, L.P. Multi-processor computer with plural boot memories
US7962777B2 (en) * 2003-12-31 2011-06-14 Sandisk Corporation Flash memory system startup operation
US8060784B1 (en) 2006-06-06 2011-11-15 Lattice Semiconductor Corporation Programmable logic device and methods for providing multi-boot configuration data support
US8122234B1 (en) * 2006-08-22 2012-02-21 Marvell International Ltd. Flash memory backup system for network devices
US20130111457A1 (en) * 2011-10-28 2013-05-02 Bradley Culter Systems and methods for composing or decomposing a composite image for firmware update images
US20130232328A1 (en) * 2010-11-18 2013-09-05 Thomson Licensing Method to safely reprogram an fpga
US20140173328A1 (en) * 2012-12-19 2014-06-19 International Business Machines Corporation Correcting a failure associated with a current firmware image
US9230112B1 (en) * 2013-02-23 2016-01-05 Xilinx, Inc. Secured booting of a field programmable system-on-chip including authentication of a first stage boot loader to mitigate against differential power analysis

Patent Citations (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6421792B1 (en) * 1998-12-03 2002-07-16 International Business Machines Corporation Data processing system and method for automatic recovery from an unsuccessful boot
US6357021B1 (en) * 1999-04-14 2002-03-12 Mitsumi Electric Co., Ltd. Method and apparatus for updating firmware
US6532551B1 (en) * 1999-05-14 2003-03-11 Sharp Kabushiki Kaisha Data management method for backup memory
US6442067B1 (en) * 2000-05-23 2002-08-27 Compaq Information Technologies Group, L.P. Recovery ROM for array controllers
US20030005277A1 (en) * 2001-06-29 2003-01-02 Harding Matthew C. Automatic replacement of corrupted BIOS image
US20030084337A1 (en) * 2001-10-03 2003-05-01 Simionescu Dan C. Remotely controlled failsafe boot mechanism and manager for a network device
US20040030883A1 (en) * 2002-08-09 2004-02-12 Munguia Peter R. Method and apparatus for booting from a selection of multiple boot images
US7043664B1 (en) * 2002-10-31 2006-05-09 Microsoft Corporation Firmware recovery
US20050132351A1 (en) * 2003-12-12 2005-06-16 Randall Roderick K. Updating electronic device software employing rollback
US7962777B2 (en) * 2003-12-31 2011-06-14 Sandisk Corporation Flash memory system startup operation
US20050251673A1 (en) * 2004-05-05 2005-11-10 International Business Machines Corporation Updatable firmware having boot and/or communication redundancy
US20060059327A1 (en) * 2004-09-13 2006-03-16 Brown Norman P Method to reset an image to a known state
US7301822B1 (en) 2005-05-18 2007-11-27 Xilinx, Inc. Multi-boot configuration of programmable devices
US8060784B1 (en) 2006-06-06 2011-11-15 Lattice Semiconductor Corporation Programmable logic device and methods for providing multi-boot configuration data support
US8122234B1 (en) * 2006-08-22 2012-02-21 Marvell International Ltd. Flash memory backup system for network devices
US7908470B1 (en) * 2006-10-31 2011-03-15 Hewlett-Packard Development Company, L.P. Multi-processor computer with plural boot memories
US7425843B1 (en) 2007-08-07 2008-09-16 Xilinx, Inc. Programmable logic device multi-boot state machine for serial peripheral interface (SPI) programmable read only memory (PROM)
US7576561B1 (en) 2007-11-13 2009-08-18 Xilinx, Inc. Device and method of configuring a device having programmable logic
US20130232328A1 (en) * 2010-11-18 2013-09-05 Thomson Licensing Method to safely reprogram an fpga
US20130111457A1 (en) * 2011-10-28 2013-05-02 Bradley Culter Systems and methods for composing or decomposing a composite image for firmware update images
US20140173328A1 (en) * 2012-12-19 2014-06-19 International Business Machines Corporation Correcting a failure associated with a current firmware image
US9230112B1 (en) * 2013-02-23 2016-01-05 Xilinx, Inc. Secured booting of a field programmable system-on-chip including authentication of a first stage boot loader to mitigate against differential power analysis

Also Published As

Publication number Publication date
US20160011878A1 (en) 2016-01-14

Similar Documents

Publication Publication Date Title
JP6790325B2 (en) Target devices, methods, programs, and non-temporary computer-readable storage media
US10701084B2 (en) Reliable and secure firmware update with a dynamic validation for internet of things (IoT) devices
US9027014B2 (en) Updating firmware compatibility data
CN100582799C (en) Electronic device diagnostic methods and systems
US8621298B2 (en) Apparatus for protecting against external attack for processor based on arm core and method using the same
JP2003058385A (en) Method for updating eeprom-resident fpga code through system management processor and jtag bus
JP2003058386A (en) System and method for jtag bridge connection of programmable logic device on multiple circuit boards
CN107690630B (en) Calculate the bridge configuration in equipment
WO2012067710A1 (en) Method to safely reprogram an fpga
US9772856B2 (en) System-level dual-boot capability in systems having one or more devices without native dual-boot capability
WO2022237551A1 (en) Secure boot device and method
US8108754B1 (en) Programmable logic device programming verification systems and methods
US7340595B2 (en) Multiplex execution-path system
JP6175788B2 (en) Electronic devices that can update microprograms
WO2010097514A1 (en) A method for secure remote reconfiguration of the programmable low-cost fpga hardware
JP2009116642A (en) Method and program for recovering from pci bus fault
US9367488B1 (en) System on a chip (SoC) RHBD structured ASIC
JP2003132010A (en) Method and apparatus for bridge connection between jtag bus and serial bus
US20150309803A1 (en) Method and apparatus for booting processor
US11048521B2 (en) Resilient upgradable boot loader with power reset
Straka et al. Fault tolerant structure for sram-based fpga via partial dynamic reconfiguration
Hanafi et al. Dual-lockstep microblaze-based embedded system for error detection and recovery with reconfiguration technique
US20230385500A1 (en) Method for Checking the Integrity of Reloadable Functional Units
US8347022B2 (en) Flash ROM programming
KR100624723B1 (en) Mobile communication terminal with hardware version control function and its operation method

Legal Events

Date Code Title Description
AS Assignment

Owner name: LATTICE SEMICONDUCTOR CORPORATION, OREGON

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:CHANDRA, SRIRAMA;MUI, CLEO;GWO, CHENG JEN;REEL/FRAME:033286/0061

Effective date: 20140630

AS Assignment

Owner name: LATTICE SEMICONDUCTOR CORPORATION, OREGON

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:CHHEDA, SAURABH;REEL/FRAME:033308/0367

Effective date: 20140714

AS Assignment

Owner name: JEFFERIES FINANCE LLC, NEW YORK

Free format text: SECURITY INTEREST;ASSIGNORS:LATTICE SEMICONDUCTOR CORPORATION;SIBEAM, INC.;SILICON IMAGE, INC.;AND OTHERS;REEL/FRAME:035309/0142

Effective date: 20150310

STCF Information on status: patent grant

Free format text: PATENTED CASE

AS Assignment

Owner name: SIBEAM, INC., OREGON

Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:JEFFERIES FINANCE LLC;REEL/FRAME:049827/0326

Effective date: 20190517

Owner name: SILICON IMAGE, INC., OREGON

Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:JEFFERIES FINANCE LLC;REEL/FRAME:049827/0326

Effective date: 20190517

Owner name: LATTICE SEMICONDUCTOR CORPORATION, OREGON

Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:JEFFERIES FINANCE LLC;REEL/FRAME:049827/0326

Effective date: 20190517

Owner name: DVDO, INC., OREGON

Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:JEFFERIES FINANCE LLC;REEL/FRAME:049827/0326

Effective date: 20190517

Owner name: WELLS FARGO BANK, NATIONAL ASSOCIATION, AS ADMINIS

Free format text: SECURITY INTEREST;ASSIGNOR:LATTICE SEMICONDUCTOR CORPORATION;REEL/FRAME:049980/0786

Effective date: 20190517

Owner name: WELLS FARGO BANK, NATIONAL ASSOCIATION, AS ADMINISTRATIVE AGENT, COLORADO

Free format text: SECURITY INTEREST;ASSIGNOR:LATTICE SEMICONDUCTOR CORPORATION;REEL/FRAME:049980/0786

Effective date: 20190517

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 4

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 8

OSZAR »