Forum Discussion

FabianL's avatar
FabianL
Icon for Occasional Contributor rankOccasional Contributor
10 months ago

Arria 10: Remote Update may brick FPGA and Factory Fallback won't work

Hello, we have observed some critical failures when doing tests with various potential error scenarios concerning a remote Update of the FPGA bitstream in the attached SPI Flash device. We could re...
Configuration
Farabi's avatar
Farabi
Icon for Regular Contributor rankRegular Contributor
5 months ago

Hello Fabian,


Sorry to take sometime to answer your question. I just transfer this case to myself so I can monitor this case individually.


1-Why factory fallback doesn't occur when application image is misaligned and watchdog disabled

<ANS> Misaligned image might not trigger CRC error, because FPGA may not recognize the bitstream header correctly. If the image is corrupted in such a way that will prevent configuration from starting, the CRC logic never got invoked, resulting the fallback mechanism does not activated. Please check your bitstream if the last 576 bytes are corrupted or not. If corrupted, this will prevent fallback to factory image as well. During this failure, can you check the nSTATUS signal?


2- Why doesn't the watchdog trigger fallback when not served in the application image?

<ANS> From Remote Update IP document: watchdog timer only starts counting after FPGA enters usermode. If the application image is invalid- FPGA never reach usermode, watchdog is never activated. Watchdog must be explicitly enabled via RU_WATCHDOG_ENABLE in the factory image. If this is not done, the watchdog is by default- disabled.


In your setup:

1- You correctly enabled the watchdog in the factory image.

2- The application image does not serve the watchdog (no writes to RU_RESET_TIMER) which should trigger fallback only if the image enters user mode.

3- If the image is misaligned and fails to enter user mode, watchdog never starts-> fallback will never occurs.


regards,

Farabi



FabianL's avatar
FabianL
Icon for Occasional Contributor rankOccasional Contributor
5 months ago

Hello Farabi,

Thanks very much for the reply.

  1. Thanks for the explanation about the missing CRC error. So I guess the only way to safely deal with this is to enable the watchdog. That is fine for us.
  2. I'm sorry, but I don't fully under stand your answer. We have to scenarios (see also here
    1. Misaligned Image:
      1. Enable Watchdog in Factory Image
      2. trigger reconfiguration (write 1 to RU_RECONFIGURATION_MODE & RU_RECONFIG)
      3. Reconfiguration fails due to misaligned image --> Watchdog triggers
      4. Fallback to factory mode
      5. ==> This case is working as expected. Good Case!
    2. Aligned valid Image
      1. Enable Watchdog in Factory Image
      2. trigger reconfiguration (write 1 to RU_RECONFIGURATION_MODE & RU_RECONFIG)
      3. Application Image starts. Application Image does not serve or actively disable the watchdog!
      4. Since the application image does not serve the watchdog, I would expect a factory fallback due to watchdog triggering. NOTE: We do not talk about further reconfiguration triggered from within application image. We only do reconfiguration from within the factory load.
      5. ==> This is not happening. And I don't understand why. Or is the watchdog automatically disabled once a valid application image is loaded?

best regards

Fabian