ARM-software / CMSIS-Driver

There is a static variable n_prev in the ESP32 function ReceiveData which is assigned but not used for anything.

Line 574 in b2a6e81

static uint32_t n_prev;

Lines 588 to 591 in b2a6e81

    
           if (n == n_prev) { 
        
             /* No new bytes received */ 
        
             n = 0U; 
        
           }

Hi, thanks for pointing this out! Looks like some leftover code - we'll take a look at this.

I am closing in on the original problem I am investigating - there is a race condition in ESP32_Serial.c. This is on a STM32F777.

The SERIAL_COM struct has a buffer count and buffer index.

CMSIS-Driver/WiFi/ESP32/ESP32_Serial.c

Lines 59 to 60 in b2a6e81

    
           uint32_t rxc;           /* Rx buffer count   */ 
        
           uint32_t rxi;           /* Rx buffer index   */

The COM driver uses DMA to receive serial data into the RxBuf

CMSIS-Driver/WiFi/ESP32/ESP32_Serial.c

Line 269 in b2a6e81

status = Com.drv->Receive (&RxBuf[0], SERIAL_RXBUF_SZ);

Then the DMA fills the buffer, UART_Callback will start another DMA transfer. Com.rxc is incremented when this happens. In effect the rx buffer is circular.

CMSIS-Driver/WiFi/ESP32/ESP32_Serial.c

Line 407 in b2a6e81

Com.rxc += SERIAL_RXBUF_SZ;

In Serial_ReadBuf the calculation for available bytes is this:

CMSIS-Driver/WiFi/ESP32/ESP32_Serial.c

Lines 344 to 345 in b2a6e81

    
           n  = Com.rxc + Com.drv->GetRxCount(); 
        
           n -= Com.rxi;

What I am seeing is that Serial_ReadBuf gets called where the DMA transfer has just completed but the variables have not been reset. So rxc + Com.drv->GetRxCount() is less than rxi. The calculated available bytes value n overflows, and then is limited to the buffer size len. Thus the serial buffer can be read past the available bytes.

I've confirmed that if rxc + GetRxCount() is less than rxi, if you immediately re-read the values then rxc changes. Here's the quick fix, but there must be something better. Also I don't know what happens when the 32 bit values finally roll over.

n  = Com.rxc + Com.drv->GetRxCount();
if(n<Com.rxi)
  n += SERIAL_RXBUF_SZ;
n -= Com.rxi;

I'm not sure where this code repository is, but found another bug. MCI_STM32F7xx.c V1.10

/* Data buffer must be 32 Byte aligned and size is n *32 */
    if ((((uint32_t)data) != 0) || (((block_count * block_size) & 0x1FU) != 0)) {

Always will fail.

if ((((uint32_t)data & 0x1FU) != 0) || (((block_count * block_size) & 0x1FU) != 0)) {

Is probably the intention.

Many thanks again for the analysis and further investigation!
The serial interface code will apparently also need review.

Second one, MCI driver implementation: MCI_STM32F7xx.c and its code are not part of any public repository, so is also good that you reported it in this context. I checked the MCI driver code and the problem was already found but the STM32F7xx DFP was not yet released. We'll need to check the release schedule but till then you already have working solution.

	uint32_t rxc; /* Rx buffer count */
	uint32_t rxi; /* Rx buffer index */

Unused static variable in ReceiveData()