#181 Fix invalid device ID check

[Ronald Monthero]

I am using stm32flash version 0.7
Environment:
linux kernel - 6.6.x
NXP imx93 -
stm32flash fetched as recipe from Yocto 5.0 Scarthgap for my setup

Issue: stm32flash fails with below error

[Ronald Monthero]

Details of issue:

Error: Unknown/unsupported device (Device ID: 0x483)
MCU - stm32h735
stm32flash - v 0.7

== Issue encountered when flashing firmware from linux som => stm32h735x mcu
Proposed solution below with patch attached and tested for my stm32H735 MCU with stm32flash v 0.7

root@ucm-imx93:~# stm32flash -w zephyr.bin -v  /dev/ttyLP6 -b 115200
stm32flash 0.7
http://stm32flash.sourceforge.net/
Using Parser : Raw BINARY
Size         : 498708
Interface serial_posix: 115200 8E1
Unknown/unsupported device (Device ID: 0x483)

== Analysis:

• On checking the source code in dev_table.c indeed MCU stm3273X is part of the array list stm32_dev_t devices[] but an invalid check in stm32_init( ) causes it to fail

const stm32_dev_t devices[] = {
        /* ID   "name"                              SRAM-address-range      FLASH-address-range    PPS  PSize   Option-byte-addr-range  System-mem-addr-range   Flags */

        /* H7 */
        {0x483, "STM32H72xxx/73xxx"               , 0x20004100, 0x20020000, 0x08000000, 0x08100000,  1, p_128k, 0         , 0         , 0x1FF00000, 0x1FF1E800, 0},    <<<< 

== Proposed solution:
I have fixed the issue with a simple patch to fix this invalid device id check.

Tested firmware flashing after applying my patch: (ignore debug prints of dev list)

root@ucm-imx93:~# /bin/stm32flash -w zephyr.bin /dev/ttyLP6 -b 460800
stm32flash 0.7

http://stm32flash.sourceforge.net/

Using Parser : Raw BINARY
Size         : 498708
Interface serial_posix: 460800 8E1
Checking device id: 0x443

Checking device id: 0x440

Checking device id: 0x444

Checking device id: 0x442

Checking device id: 0x445

Checking device id: 0x448

Checking device id: 0x412

Checking device id: 0x410

Checking device id: 0x414

Checking device id: 0x420

Checking device id: 0x428

Checking device id: 0x418

Checking device id: 0x430

Checking device id: 0x411

Checking device id: 0x432

Checking device id: 0x422

Checking device id: 0x439

Checking device id: 0x438

Checking device id: 0x446

Checking device id: 0x413

Checking device id: 0x419

Checking device id: 0x423

Checking device id: 0x433

Checking device id: 0x458

Checking device id: 0x431

Checking device id: 0x441

Checking device id: 0x421

Checking device id: 0x434

Checking device id: 0x463

Checking device id: 0x452

Checking device id: 0x449

Checking device id: 0x451

Checking device id: 0x466

Checking device id: 0x456

Checking device id: 0x460

Checking device id: 0x467

Checking device id: 0x468

Checking device id: 0x469

Checking device id: 0x479

Found Device ID: 0x0483 name: STM32H72xxx/73xxx       <<<<<< 

Version      : 0x31
Option 1     : 0x00
Option 2     : 0x00
Device ID    : 0x0483 (STM32H72xxx/73xxx)

- RAM        : Up to 128KiB  (16640b reserved by bootloader)
- Flash      : Up to 1024KiB (size first sector: 1x131072)
- Option bytes  : 1b
- System memory : 122KiB
Write to memory
Erasing memory
Wrote address 0x08079c14 (100.00%) Done.              <<<<<<

root@ucm-imx93:~#

Enclosed pls find patch attached

[Tormod Volden]

Hi, thanks for the bug report and the suggested patch. However I don't understand the attached patch. Apparently it is not the same patch as was used in your testing. What is wrong in the original code that makes it an "invalid check"?

[Ronald Monthero]

Hi Tormod,
It turns out that there is a possible race condition or corruption which is overwriting one of the dev structures while traversing the device list. This causes the search loop of device ID list, to terminate early when checking the value of stm->dev->id, making the code think the MCU device ID is not found.
It's a bit tricky to track this down, as issue occurs randomly. I narrowed it down after several attempts to capture debug details - with a watchpoint enabled for it. as shown below, it shows the point of device list traversed and at device index list 9 turns out 0x0.

`
.....
< .. downsized device list iterations.. >

(gdb) watch stm->dev->id
Hardware watchpoint 5: stm->dev->id
(gdb) n
563 fprintf(stdout,">>>> Checking device id: 0x%03x\n", stm->dev->id);
(gdb) n

Checking device id: 0x414
564 if (stm->dev->id == 0x00)
(gdb) n
566 ++stm->dev;
(gdb) n

Hardware watchpoint 5: stm->dev->id <<<<<<
Old value = <unreadable> <<<<<<
New value = 0 <<<<<< Corrupted </unreadable>

stm32_init (port=0xaaaaaaac0300 <port_serial>, init=1 '\001') at stm32.c:562
562 while (stm->dev->id != 0x00 && stm->dev->id != stm->pid) {
(gdb) n
569 fprintf(stdout,">>>> stm->dev->id = %d", stm->dev->id);</port_serial>

(gdb) p/x stm->dev->id
$5 = 0x0 <<<<<
(gdb) p/x stm->pid
$6 = 0x483

(gdb) n
571 if (!stm->dev->id) {
(gdb) n
572 fprintf(stderr, "Unknown/unsupported device (Device ID: 0x%03x)\n", s
(gdb) n
Unknown/unsupported device (Device ID: 0x483)
573 fprintf(stdout,"error case: stm->dev->id = %d", stm->dev->id);
(gdb) n
574 stm32_close(stm);
(gdb) info locals
len = 2 '\002'
val = 146 '\222'
buf = "\001\004\203\001\002\021!1Dcs\202\222\252\000\000\n\000\000\000\000\000\000\000\003\00\000\000\000P\367\377\377\377\377\000\000XB\252\252\252\252\000\000P\367\377\377\377\377\000\377\377\377\000\000 \367\377\377\377\377\000\000\320\377\377\377\200\377\377\377P\367\377\377000P\367\377\377\377\377\000\000 \367\377\377\377\377\000\000\320\377\377\377\200\377\377\377ts 16 times>, "d\000\000\000\000\000\000\000\003\000\000\000\006\000\000\000\000\000\000\000\77\000\000\000\000\000\000\000\000\000\377\377\377\377\377\377\377\000\377\377\377\000\377\37\377\377\360\377\360\377\000\000\000\000\000\000\000\000(\000\254\252\252\252\000\000"...
stm = 0xaaaaaaac2400
i = 12
new_cmds = 0
version = 49 '1'

(gdb) p/x stm->pid
$7 = 0x483
(gdb) p/x stm->dev->id
$8 = 0x0 <<<<< dev->id = 0x0
(gdb) p/x stm->dev
$9 = 0xaaaaaaabecb8
(gdb) p/x stm->dev->id
$10 = 0x0
(gdb) p/x stm->option1
$11 = 0x0
(gdb) p/x stm->option2
$12 = 0x0
(gdb) p/x stm->port
$13 = 0xaaaaaaac0300
(gdb) p/s stm->port
$14 = (struct port_interface *) 0xaaaaaaac0300 <port_serial>`</port_serial>

It's possible some code is writing past the end of a buffer, memory corruption.
I am also running with valgrind for memory analysis, if anything I'll let you know .

( fyi - stm32flash run in arm64 bit environment, hardware platform - imx93 som )