Another STM32F103 clone?

?

I normally do not use CAN, but when I enabled clock to CAN I was able to write to CAN memory on my chip. So CAN seem to be there. In fact, usual F103C8 devices (SPI-s, I2C-s, UART-s, timers, DMA) do at least something resonable, while other devices present in bigger STM models and some clone chips seem to be not present (using debugger to read registers give 0, attempt to write are ignored).

There is resonably strong hint that this is not a GD device, namely JEDEC id is like in STM chips:

(gdb) x/8xw 0xE00FFFE0

0xe00fffe0: 0x00000010 0x00000004 0x0000000a 0x00000000 0xe00ffff0: 0x0000000d 0x00000010 0x00000005 0x000000b1

ROM table is:

(gdb) x/8xw 0xe00ff000

0xe00ff000: 0xfff0f003 0xfff02003 0xfff03003 0xfff01003 0xe00ff010: 0xfff41003 0xfff42003 0x00000000 0x00000000

Report in the net say that GD chips have GD id. HK also is reported to have its id. Another clone has 0.

ATM I only found report about CS/CKS chips to present STM id. However, there is claim that CS and CKS are the same chip and my CKS shows non-STM id (59, I do not have id table to say what it means). OTOH id may be in flash, in such case different chip batches may have different id-s...

Info on internet mentions about 15 diffrenet Chinese manufacturers cloning STM chips. One of them is Flashchip. My chip seem to match id of FCM32F103C:

(gdb) x/2xw 0x1FFFF7C0

0x1ffff7c0: 0x46433332 0x0046103c

which appears in FSM32F103C migration note. This is one of few F103 compatible processors with M4 core, has 128kB flash. The migration note claims 20 kB RAM, my test indicate 32kB. More precisely, my test routine wrote to words from 0x20000400 to

0x20008000 and checked that written value is there. This was repeated for two different values. So I have rather strong indication that chip really have 32kB RAM (ok, test only covered 31kB, but first 1kB contained test program which apparently run correctly). Maybe manufactures claim 20kB because this is all what STM32F103CB has.

Long period is easy: I used a counter, actually 3 versions of counter. One version of counter used large increment which ensured that all bytes were changing quickly (with low increments there were long streches were high bytes were the same).

I also tried 3 lousy random number generators, but in this problem I do not think that much more testing is needed: AFAICS to pass my test with less memory chip would need quite complicated address remapping working at bit level. It does not make sense to put such circuit on the chip and probably it is infeasible with chip technology.

I double that lousy random number generators will be of much use in future. But writing a good one is more work, and even linking to some has disadvantage of size: memory taken by test program was excluded from modification so I wanted test program to be as small as possible. My program was 680 bytes which together with varibles and stack comfortably fit in 1kB of RAM...

What's wrong with an LFSR? They are very simple and have relatively good pseudo-random properties. What, by your definition, is a "good" or a "lousy" RNG?

"lousy" RNG fails relatively simple statistic tests. That includes LFSR in its usual incarnations. By chance, I have found paper about random number generators which presents results of some tests and proposes a different generator. There is related site:

I am not sure if this one is really good, but the material they present shows weaknesses of many others.

Maybe I didn't read the thread well enough, but I thought this was just a way to generate addresses to test RAM, no? The only specific property I've seen is that it be "relatively prime" to the memory address space. LFSR certainly can manage that. Heck, a Grey code can probably manage that.

With 17 bits, I can generate a PR sequence that is relatively prime to powers of 2 and of length 82,677.

Am I missing something important?

I do not see "relatively prime" as really helpful. I mean: I would use only tiny part of period, so for purpose of memory testing it does not matter too much.

Do you realize that popular PRNG-s are perfectly regular using relatively simple rules? Better play tricks so that is hard to detect this regularity. My first two counters had problem that low order bits were changing with small periods, third one counted modulo a prime. When viewed as numbers, once you knew the rule it was perfectly regular (and probably guessing the rule would be not that hard). At bit level carries and modulo meant that logic working on separate bits or small groups of bits would have trouble following/predicting the sequence.

If I what I wrote sounded negative, let me say that I in general have doubts about efficiency of many tests. For example, I waited on PC-s doing POST. Yet, I saw failing POST maybe one or two times and IIRC errors were so gross that very simple and much faster test should catch them. OTOH I have seem machines which passed POST but failed more comprehensive memory test. And machines that in use exhibited what looked like memory errors but passed available tests (I "cured" few by underclocking them).

In software context I saw projects that religiously added tests to have "100% test coverage", yet those tests were too weak to catch major breakage. OTOH I also had situations were _new_ approach to testing allowed to identify and consequently fix several bugs.

One approach to testing which is reasonably effective is to first identify likely "failure modes" and invent tests that detects specific failure mode. In this case possible "failure mode" was some address scrambling scheme. In fact there is some kind of "scrambling", namely chip seem to use incomplete address decoding. Now, for scrambling at word level already simplest counter would detect it. That still leaves possiblity of scrambling at byte or bit level. In particular, only carries prevent periodicity with period 256 and limited number of un-aliased extra cells possibly could handle places where carries occur. Second test had much more carries, making this highly unlikely. In third counter no bit position was periodic and carries were in different places than second test. So scrambling scheme that passes all 3 counter test is getting more weird. Now, address decoding lies on performence critical path. MCU manufactur needs good reason to put extra logic there. Skipping gates and using incomplete decoding is cheap. I am not sure if there is good reason to add any scrambling beyond incomplete decoding. But certainly there is no reason to add several complicated scrambling circuits working differently on different byte (or bit) planes.

Also, goal of my testing was to find out if extra memory is there. Once you accept that there is 32kB of memory natural question is why manufactures says that there is

20KB. One possible answer is that manufactures does not test extra memory. So one may further ask if extra memory works reliably. Answering this last question goes well beyond goal of my testing, it is much bigger project and to that matter even if it works reliably for me it does not prove that it will work reliably for other people.

Mersenne twister which is present in several libraries has rather large state and long code. I am not sure how large exactly it is but my impression was that its state consists of hundreds of 64-bit integers...

And concerning needs, FCM32 can efficiently do 64-bit arithmetic. Already Cortex-M0 will have suboptimal performance with 64-bit numbers. And on 8-bitters or processors like smallest MSP430 which lack hardware multiplication arithmetic on bigger numbers can be quite expensive. Hence, PRNG which works fast on big machines could be quite slow on small machines. Up to now I did not reall need PRNG on small machines, so I postponed implementing one. If/when I have need I will know which compromises/tradeoffs are appropriate for given application.

^^^^^^^^^ Rather values to store. Addresses are incremented in sequential way.

Don Y wrote that PRNG is generally usable for other problems. But for simulations and Monte Carlo computations statistical properties are important. Lousy PRNG-s are major source of erros in such computations.

And yes, for memory testing good randomness is not needed. As I explained in other posts for testing _presence_ of memory I think that already relatively simple counter is good enough.

Not really, no. Well, there's the detail that the sequence must be wide enough so that it does not repeat during the testing. A sequence with length 82,677 will be fine for 128 kB flash (two bytes per element), but is not scalable to a 256 kB flash test.

But while LFSR's are nice in some use-cases, they are not the simplest sequence generator for software for this sort of thing.

One of the best is:

const uint32_t a = 984830993; const uint32_t b = 1267261529;

uint32_t pseudo(uint32_t i) { return (a * i) + b; }

"a" and "b" are just big prime numbers, as found from this link or by googling around a bit:

This gives you a sequence that is deterministic, you can jump into it at any point, it has no correlation with bit numbers, addresses, etc., and is extremely simple to calculate.

That is more or less one of lousy generators that I used (I had different constants). For memory testing it shares the same problems that counters have: low order bits have short period that is power of 2. When you want good randomness, they fail relatively simple statistical tests. One can improve them or they may be good enough for some applications, but one should be aware of their limitations.

It is not supposed to pass any statistical tests for randomness - all you need here is no simple correlation between the values you write and the address. It is not a serious pseudo random generator, just a simple deterministic sequence that jumps around enough for the job, with insignificant costs in terms of source code and run time.

If you want to remove the power-of-two cycles of the bits (for example, if you want to do memory testing and check there is no short-circuit between address lines and data lines), include a modulo operation by another large prime number.

For a memory tester, the RNG only has to scatter the address sequence enough to decorrelate it from whatever address interactions might lurk within the hardware.

Of course, for some kinds of issues like Rowhammer, finding the interactions is also important.