Camera initialization bug: use uninitialized field DMA_Handle of hDcmiEval in application Camera_To_USBDisk

[Spencer_0]

The field DMA_Handle of the local data pointer phdcmi, which points to a global struct variable hDcmiEval, is not initialized in the function BSP_CAMERA_Init (from the file STM32Cube_FW_F4_V1.25.0/Drivers/BSP/STM32469I_EVAL/stm32469i_eval_camera.c).

uint8_t BSP_CAMERA_Init(uint32_t Resolution)
{
  DCMI_HandleTypeDef *phdcmi;
  uint8_t status = CAMERA_ERROR;
 
  /* Get the DCMI handle structure */
  phdcmi = &hDcmiEval;
 
  /*** Configures the DCMI to interface with the camera module ***/
  /* DCMI configuration */
  phdcmi->Init.CaptureRate      = DCMI_CR_ALL_FRAME;
  phdcmi->Init.HSPolarity       = DCMI_HSPOLARITY_HIGH;
  phdcmi->Init.SynchroMode      = DCMI_SYNCHRO_HARDWARE;
  phdcmi->Init.VSPolarity       = DCMI_VSPOLARITY_HIGH;
  phdcmi->Init.ExtendedDataMode = DCMI_EXTEND_DATA_8B;
  phdcmi->Init.PCKPolarity      = DCMI_PCKPOLARITY_RISING;
 
  phdcmi->Instance              = DCMI;
 
  /* Configure IO functionalities for CAMERA detect pin */
  BSP_IO_Init();
  /* Apply Camera Module hardware reset */
  BSP_CAMERA_HwReset();
...
}

In the function HAL_DCMI_Start_DMA (from the file STM32Cube_FW_F4_V1.25.0/Drivers/STM32F4xx_HAL_Driver/Src/stm32f4xx_hal_dcmi.c), the DMA_Handle field is used to store function pointers.

HAL_StatusTypeDef HAL_DCMI_Start_DMA(DCMI_HandleTypeDef* hdcmi, uint32_t DCMI_Mode, uint32_t pData, uint32_t Length)
{
  /* Initialize the second memory address */
  uint32_t SecondMemAddress = 0U;
 
  /* Check function parameters */
  assert_param(IS_DCMI_CAPTURE_MODE(DCMI_Mode));
 
  /* Process Locked */
  __HAL_LOCK(hdcmi);
 
  /* Lock the DCMI peripheral state */
  hdcmi->State = HAL_DCMI_STATE_BUSY;
  
  /* Enable DCMI by setting DCMIEN bit */
  __HAL_DCMI_ENABLE(hdcmi);
 
  /* Configure the DCMI Mode */
  hdcmi->Instance->CR &= ~(DCMI_CR_CM);
  hdcmi->Instance->CR |=  (uint32_t)(DCMI_Mode);
 
  /* Set the DMA memory0 conversion complete callback */
  hdcmi->DMA_Handle->XferCpltCallback = DCMI_DMAXferCplt;
 
  /* Set the DMA error callback */
  hdcmi->DMA_Handle->XferErrorCallback = DCMI_DMAError;
 
  /* Set the dma abort callback */
  hdcmi->DMA_Handle->XferAbortCallback = NULL;
...
}

However, DMA_Handle points to the memory address 0x0000_0000, which is a invalid memory address.

In ARM Cortex-M4 MCUs, the code starts 0x800_0000. 

I am confused why this application runs well and does not crash. Is address 0x0000_0000 a valid memory address?

[Spencer_0]

The Camera_to_USBDisk application I use is in STM32F469I-EVAL, which belongs to STM32Cube_FW_F4_V1.25.0.

Does anybody can fix this bug?

[Imen.D]

Hello @Spencer_0​ ,

Let me first welcome you to the STM32 Community :)

I added the adequate topics to your question in order to increase its chance to be reviewed by our experts.

Hello @Walid ZRELLI​ ,

Can you please have a look at this post and confirm this issue ?

Thanks

Imen

[Walid ZRELLI]

Hello @Spencer_0​ ,

In case of using DCMI_DOUBLE_BUFFER mode, the second memory address will be updated as follows:

SecondMemAddress = (uint32_t)(pData + (4U*hdcmi->XferSize)) ;

You could check the HAL_DCMI_Start_DMA() funtion.

So, there is no bug to fix.

With Regards,

Walid.

[Spencer_0]

Hello @Walid ZRELLI​ , thanks for your reply.

I use the gdb to debug the application, and I find that the application doesn't use the DCMI_DOUBLE_BUFFER mode in my case.

The execution trace is here:

#0  HAL_DCMI_Start_DMA (hdcmi=0x200020e4 <hDcmiEval>, DCMI_Mode=0x0, pData=0xc0177000, Length=0x2580) at ../../../Drivers/STM32F4xx_HAL_Driver/Src/stm32f4xx_hal_dcmi.c:385
/* The program does not take the branch that uses the DCMI_DOUBLE_BUFFER mode here */
#1  0x0801012a in BSP_CAMERA_ContinuousStart (buff=0xc0177000 "\265\372\200") at ../../../Drivers/BSP/STM32469I_EVAL/stm32469i_eval_camera.c:276
#2  0x0802f15a in Camera_Init () at ../../Src/main.c:288
#3  0x0802f762 in main () at ../../Src/main.c:354

Apparently, if the application doesn't use the DCMI_DOUBLE_BUFFER mode, the address is still not transformed, and the pointer`hdcmi->DMA_Handle` points to the address 0x0000_0000.

So I believe that it is still an uninitialized field bug.

However, the picture captured by the Camera is always blank in my case. I wonder that if the proper execution flow should take the DCMI_DOUBLE_BUFFER mode branch. Otherwise the image captured by the camera is blank.

With kind regards,

Spencer Zhou

[Spencer_0]

Thanks for your help @Imen DAHMEN​ ��