Xilinx远程更新之Multiboot

        Multiboot是Xilinx远程更新的重要组成部分，现已经初步开发完成从PCIe —> FPGA端的程序升级工作，现将Multiboot做一个总结记录。

        1、Multiboot组成

         包含Golden Image和Update Image两个基础组成部分;

        当Golden Image（初始地址0）中设置了WBSTAR跳转地址A1（Update Image的初始地址），FPGA上电从Golden Image开始运行，识别到WBSTAR非0，会产生一个IPPROG CMD，用于指示程序进行跳转，跳转到地址A1处，即Update Image开始运行；

        当Update Image开始运行，当出现CRC error或者IDCODE error时，会fallback到Golden Image去运行。这个机制，类似于单片机中的Boot程序+应用程序，两个程序分别位于Flash的不同地址空间。

        2、错误类型

        CRC error

        IDCODE error

        Watchdog timer time-out error

        由于前两种错误类型不常出现，倒是远程更新Update Image的过程中，出现烧写不成功时，例如烧写一半断电，这种是不会触发前两种错误去fallback的，远程更新就失去了意义。

        这里必须应用第三种错误Watchdog timer time-out error，让它超时自动跳转。

        3、Watchdog Timer

（1）Configuration logic starts executing commands in the golden bitstream stored at flash address location zero. The IPROG command embedded in the golden bitstream initiates the control to jump to the address location stored in the golden WBSTAR register. In this example WBSTAR points to the timer1 start address.

（2）The timer1 or the barrier image before the update image has a short timer enabled that helps sync the configuration logic to a known good SYNC word, reducing the chance a corrupted update image can cause a false sync.

（3）a. Known good update image present following timer1 – Update image loads as normal.

        b. Corrupted or sector of data erased i.e., no SYNC word (AA995566) in the beginning of the update image – Configuration logic starts observing the bitstream after it sees the SYNC (AA995566) word. In the case of a corrupted or erased SYNC word, data or commands are ignored and configuration logic keeps scanning through the flash for a valid SYNC word. In this scenario the timer value set in timer1 triggers Fallback by means of a watchdog timeout error and failsafe or golden image is loaded (proceed to Step5).

（4）a. timer2 is ignored if a known good update image is present following timer1.

        b. Update region corrupted or sector of data erased towards the end of update image – In this scenario configuration logic does not see the end of startup to complete configuration. timer2 comes into play and Fallback to address zero i.e., the golden image location is triggered by a watchdog timeout error.

（5）The golden failsafe image loads as a result of Fallback triggered by the timeout error.

        4、Multiboot测试

       根据Golden.bit和Update.bit的大小去评估Golden区域和Update区域的大小，在Tcl Shell中运行脚本生成Timer1.bin和Timer2.bin，将4个文件合并使用USB Blaster烧写至Flash中；

        在远程更新去烧写Update区域的过程中，首先要擦除Update区域，擦完后强行将板卡断电重启，程序能够正常运行Golden Image，说明看门狗功能正常运行。