From a186e9adebc56a4ef97b7f639920baeda6cb3a3e Mon Sep 17 00:00:00 2001 From: DuoYuWang Date: Wed, 26 Aug 2026 22:04:54 +0800 Subject: [PATCH 1/2] stm32h7: Use the selected SRAM end for the protected user heap. up_allocate_heap() calculates the available user heap from SRAM_END but previously placed the aligned region relative to SRAM123_END. That mixes the selected primary SRAM with a fixed D2 SRAM boundary and leaves SRAM123_END undefined for dual-core M7 and M4 configurations. Place the user heap relative to SRAM_END so its size, MPU alignment, and location all refer to the SRAM region selected by the chip configuration. Tested by building and booting a Protected image on an STM32H7 PX4 FMUv6C. Assisted-by: Codex:GPT-5 Signed-off-by: DuoYuWang --- arch/arm/src/stm32h7/stm32_allocateheap.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/arch/arm/src/stm32h7/stm32_allocateheap.c b/arch/arm/src/stm32h7/stm32_allocateheap.c index ab77f78604da4..30ae0130057d5 100644 --- a/arch/arm/src/stm32h7/stm32_allocateheap.c +++ b/arch/arm/src/stm32h7/stm32_allocateheap.c @@ -253,15 +253,15 @@ void up_allocate_heap(void **heap_start, size_t *heap_size) DEBUGASSERT(ubase < (uintptr_t)SRAM_END); /* Adjust that size to account for MPU alignment requirements. - * NOTE that there is an implicit assumption that the SRAM123_END - * is aligned to the MPU requirement. + * NOTE that there is an implicit assumption that SRAM_END is aligned + * to the MPU requirement. */ log2 = (int)mpu_log2regionfloor(usize); DEBUGASSERT((SRAM_END & ((1 << log2) - 1)) == 0); usize = (1 << log2); - ubase = SRAM123_END - usize; + ubase = SRAM_END - usize; /* Return the user-space heap settings */ @@ -320,8 +320,8 @@ void up_allocate_kheap(void **heap_start, size_t *heap_size) DEBUGASSERT(ubase < (uintptr_t)SRAM_END); /* Adjust that size to account for MPU alignment requirements. - * NOTE that there is an implicit assumption that the SRAM123_END - * is aligned to the MPU requirement. + * NOTE that there is an implicit assumption that SRAM_END is aligned + * to the MPU requirement. */ log2 = (int)mpu_log2regionfloor(usize); From a4754782d60d916ca77e22d4e0388c0049c3c482 Mon Sep 17 00:00:00 2001 From: DuoYuWang Date: Wed, 26 Aug 2026 22:05:04 +0800 Subject: [PATCH 2/2] stm32h7: Keep protected user SRAM non-shareable. The generic ARMv7-M user SRAM helper marks memory shareable. STM32H7 Protected user data and heaps can reside in cacheable AXI or D2 SRAM, where userspace synchronization needs LDREX/STREX to use the CPU-local exclusive monitor. Map protected user SRAM as Normal, cacheable, and non-shareable. Dual-core RPTUN SRAM remains unaffected because it is mapped separately with explicit shareable attributes. Tested by booting a Protected image and running user and kernel work-queue stress tests on an STM32H7 PX4 FMUv6C. Assisted-by: Codex:GPT-5 Signed-off-by: DuoYuWang --- arch/arm/src/stm32h7/stm32_mpuinit.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/arch/arm/src/stm32h7/stm32_mpuinit.c b/arch/arm/src/stm32h7/stm32_mpuinit.c index a141895b21020..f6912bb5d1d88 100644 --- a/arch/arm/src/stm32h7/stm32_mpuinit.c +++ b/arch/arm/src/stm32h7/stm32_mpuinit.c @@ -52,6 +52,26 @@ # endif #endif +/**************************************************************************** + * Private Functions + ****************************************************************************/ + +#ifdef CONFIG_BUILD_PROTECTED +static void stm32_mpu_user_intsram(uintptr_t start, size_t size) +{ + /* STM32H7 protected user memory can span AXI and D2 SRAM. Keep it + * Normal and non-shareable so that LDREX/STREX use the CPU-local + * exclusive monitor. Dual-core RPTUN shared memory is mapped separately + * below with shareable attributes. + */ + + mpu_configure_region(start, size, + MPU_RASR_TEX_SO | + MPU_RASR_C | + MPU_RASR_AP_RWRW); +} +#endif + /**************************************************************************** * Public Functions ****************************************************************************/ @@ -94,7 +114,7 @@ void stm32_mpuinitialize(void) mpu_user_flash(USERSPACE->us_textstart, USERSPACE->us_textend - USERSPACE->us_textstart); - mpu_user_intsram(datastart, dataend - datastart); + stm32_mpu_user_intsram(datastart, dataend - datastart); #endif #ifdef CONFIG_RPTUN @@ -121,7 +141,7 @@ void stm32_mpuinitialize(void) void stm32_mpu_uheap(uintptr_t start, size_t size) { - mpu_user_intsram(start, size); + stm32_mpu_user_intsram(start, size); } #endif