Option bytes factory reset leads to segmentation fault

[se-nje]

Steps to reproduce:

• Connect NUCLEO-H563ZI to host with USB-C (STLINK)
• Open STM32CubeProgrammer GUI
• Select option bytes in side bar (OB icon)
• In the middle right, click on the drop-down on the "Read" button
• Select "Reset MCU to Factory Settings"
• Click "Start Factory Reset"

Expected behavior: All option bytes reset to factory settings

Actual behavior: Only "Performing system reset." action goes to "PASSED" status, a few seconds later a segmentation fault happens, likely during the "Setting TZEN=B4" phase, and the GUI disappears

Console log output:

The Analytics API is not enabled
The Analytics API is not enabled
Loading PRG Library: /opt/STMicroelectronics/STM32Cube/STM32CubeProgrammer/bin/../lib/libCubeProgrammer_API.so
99 external Loader list

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007f5ae492eb14, pid=69214, tid=0x00007f5aedbbd6c0
#
# JRE version: OpenJDK Runtime Environment (8.0_432-b07) (build 1.8.0_432-b07)
# Java VM: OpenJDK 64-Bit Server VM (25.432-b07 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# C  [libQt6Core.so.6+0x32eb14]  QRegularExpression::match(QString const&, long long, QRegularExpression::MatchType, QFlags<QRegularExpression::MatchOption>) const+0x74
#
# Core dump written. Default location: /opt/STMicroelectronics/STM32Cube/STM32CubeProgrammer/bin/core or core.69214
#
# An error report file with more information is saved as:
# /tmp/hs_err_pid69214.log
#
# If you would like to submit a bug report, please visit:
#   https://bell-sw.com/support
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#
bin/STM32CubeProgrammer: line 5: 69214 Aborted                 (core dumped) GDK_BACKEND=x11 "$DIR"/jre/bin/java -Djdk.gtk.version=2 -jar "$DIR/STM32CubeProgrammerLauncher" 2> /dev/null

System Information:

• Fedora Linux 41 (KDE Plasma, Wayland)
• STM32CubeProgrammer version 2.19.0 (installed with RPM package)

I'd have loved to attach the core dump and the exported option bytes, but sadly I'm unable to do so with Firefox (nothing happens when I drag-and-drop files). I can at least paste the option bytes and the stack trace from the core dump here:

{
  "deviceId" : 1156,
  "bitNameToValue" : {
    "PRODUCT_STATE" : 237,
    "BOR_LEV" : 0,
    "BORH_EN" : 0,
    "IO_VDD_HSLV" : 0,
    "IO_VDDIO2_HSLV" : 0,
    "IWDG_STOP" : 1,
    "IWDG_STDBY" : 1,
    "BOOT_UBE" : 180,
    "SWAP_BANK" : 0,
    "IWDG_SW" : 1,
    "NRST_STOP" : 1,
    "NRST_STDBY" : 1,
    "TZEN" : 180,
    "SRAM2_ECC" : 0,
    "SRAM3_ECC" : 1,
    "BKPRAM_ECC" : 1,
    "SRAM2_RST" : 0,
    "SRAM1_3_RST" : 1,
    "NSBOOTADD" : 524288,
    "NSBOOT_LOCK" : 195,
    "SECBOOT_LOCK" : 180,
    "SECBOOTADD" : 786432,
    "SECWM1_STRT" : 0,
    "SECWM1_END" : 15,
    "WRPSGn1" : -2,
    "SECWM2_STRT" : 0,
    "SECWM2_END" : 15,
    "WRPSGn2" : -2,
    "LOCKBL" : 0,
    "EDATA1_EN" : 0,
    "EDATA1_STRT" : 0,
    "EDATA2_EN" : 0,
    "EDATA2_STRT" : 0,
    "HDP1_STRT" : 0,
    "HDP1_END" : 3,
    "HDP2_STRT" : 0,
    "HDP2_END" : 3
  }
}

#0  0x00007f5b1e27fb54 __pthread_kill_implementation (libc.so.6 + 0x72b54)
#1  0x00007f5b1e226f9e raise (libc.so.6 + 0x19f9e)
#2  0x00007f5b1e20e942 abort (libc.so.6 + 0x1942)
#3  0x00007f5b1d96c689 _ZN2os5abortEb (libjvm.so + 0x96c689)
#4  0x00007f5b1db40b63 _ZN7VMError14report_and_dieEv (libjvm.so + 0xb40b63)
#5  0x00007f5b1d976b55 JVM_handle_linux_signal (libjvm.so + 0x976b55)
#6  0x00007f5b1d9696f8 _Z13signalHandleriP7siginfoPv (libjvm.so + 0x9696f8)
#7  0x00007f5b1e227050 __restore_rt (libc.so.6 + 0x1a050)
#8  0x00007f5ae492eb14 _ZNK18QRegularExpression5matchERK7QStringxNS_9MatchTypeE6QFlagsINS_11MatchOptionEE (libQt6Core.so.6 + 0x32eb14)
#9  0x00007f5ae492ebb7 _ZNK18QRegularExpression11globalMatchERK7QStringxNS_9MatchTypeE6QFlagsINS_11MatchOptionEE (libQt6Core.so.6 + 0x32ebb7)
#10 0x00007f5ae484fc43 _ZNK7QString5splitERK18QRegularExpression6QFlagsIN2Qt18SplitBehaviorFlagsEE (libQt6Core.so.6 + 0x24fc43)
#11 0x00007f5ae643b511 _ZN20OptionBytesInterface16ChecksBitsWRangeER7QStringRSt6vectorI5OBcmdSaIS3_EE (libCubeProgrammer_API.so + 0x23b511)
#12 0x00007f5ae643bc97 _ZN20OptionBytesInterface7GetBitsER7QString (libCubeProgrammer_API.so + 0x23bc97)
#13 0x00007f5ae6441f98 _ZN20OptionBytesInterface14ExecuteProgCmdE7QStringh (libCubeProgrammer_API.so + 0x241f98)
#14 0x00007f5ae637ba61 sendOptionBytesCmd (libCubeProgrammer_API.so + 0x17ba61)
#15 0x00007f5ae7c13574 n/a (/tmp/jna-1942060247/jna4079403761517829239.tmp (deleted) + 0x13574)
#16 0x00007f5aedbbae18 n/a (n/a + 0x0)

[Aziz BRIGUI]

Hello @se-nje,

Thanks for your detailed explanation,

Factory reset feature is not yet officially supported for STM32H5 (For now only STM32U5 is supported).

Our development team is working hard on extending the feature to other SoCs. However, you can imagine that for STM32H5 there are a lot of cases to handle (Especially for product lifecycle management and TrustZone).

I have internally reported the crash issue (Internal tracking number: Ticket 208112). I suspect it's coming from negative values in the option bytes JSON since it can be reproduced also by importing OB settings after changing a negative value and then clicking apply.

For now, I suggest resetting Option Bytes to default values manually.

Aziz

[mƎALLEm]

Hello @se-nje ,

As the factory reset feature is not yet officially supported by STM32H5, I propose to use export/import method described in this article:

Restoring the STM32 option bytes to their factory settings using STM32CubeProgrammer