STM32: align MPU regions to actual size - #15441

Do you want to test this code? You can flash it directly from the Betaflight App:

• Simply put #15441 (this pull request number) in the Select commit field in the Firmware Flasher tab (you need to Enable expert mode, Show release candidates and Development).

WARNING: It may be unstable. Use only for testing!

Walkthrough

The STM32 memory-protection configuration now uses power-of-two region bytes and iterative base realignment to ensure the MPU region covers the configured endpoint. PMSAv7 behavior and cache-maintenance considerations are documented in the updated comments.

Changes

STM32 MPU alignment

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• betaflight/betaflight#15421: Adds an STM32H5 non-cacheable MPU region, related to MPU region setup and cache behavior.

Suggested labels: RN: IMPROVEMENT

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Should fix Matek f743 as well as Geprc taker h743 (tested on the taker h743).

@coderabbitai please review

@blckmn I’ll review the MPU alignment changes in #15441, with particular attention to PMSAv7 sizing, range coverage, overflow/edge cases, and the STM32H7/F7 call sites.

@coderabbitai

clamping a malformed MPU request to a gigantic region? You sure?

Analyze the actual execution path in Betaflight, the possible values of length, msbpos, and regionBytes, and determine whether msbpos + 1 can realistically reach an undefined shift or overflow on supported hardware. If not, explain why. If so, propose the best fix.

#!/bin/bash
set -euo pipefail

printf '%s\n' '== candidate files =='
fd -t f 'memprot_hal\.c|memprot.*\.h|.*mpu.*\.(c|h)$' src 2>/dev/null || true

printf '%s\n' '== outline =='
ast-grep outline src/platform/STM32/memprot_hal.c --items all 2>/dev/null || true

printf '%s\n' '== definitions and call sites =='
rg -n -C 5 --glob '*.{c,h}' \
  '\bmemProtConfigure\s*\(|\bmsbpos\s*\(|\bregionBytes\b|\bMPU_REGION_SIZE\b|\bMPU_RASR_SIZE\b' \
  src 2>/dev/null || true

printf '%s\n' '== relevant target configuration references =='
rg -n -C 3 --glob '*.{c,h}' \
  '\bMEMPROT\b|\bMPU\b|DMA_RAM|dmaRam|blackbox' \
  src/main/target src/platform 2>/dev/null || true

#!/bin/bash
set -euo pipefail

printf '%s\n' '== generic implementation and region type =='
nl -ba src/platform/STM32/memprot_hal.c | sed -n '27,108p'
nl -ba src/main/drivers/memprot.h | sed -n '1,80p'

printf '%s\n' '== ARMv7 generic-path descriptor definitions =='
for f in src/platform/STM32/memprot_stm32g4xx.c src/platform/STM32/memprot_stm32h7xx.c; do
  printf '\n-- %s --\n' "$f"
  nl -ba "$f" | sed -n '1,160p'
done

printf '%s\n' '== linker-script candidates and DMA symbol definitions =='
fd -t f -e ld -e ld.in -e lds -e S . | while IFS= read -r f; do
  if rg -n -C 4 '_dmaram_(start|end)__|dma_ram_(r|w|rw)_(start|end)|DMA_RAM' "$f" >/dev/null; then
    printf '\n-- %s --\n' "$f"
    rg -n -C 4 '_dmaram_(start|end)__|dma_ram_(r|w|rw)_(start|end)|DMA_RAM' "$f"
  fi
done

printf '%s\n' '== MPU size encoding limits from vendored headers =='
rg -n -C 3 'MPU_REGION_SIZE_(32B|4GB)|MPU_RASR_SIZE_Msk|MPU_REGION_SIZE_Msk' \
  lib src --glob '*.{h,c}' 2>/dev/null || true

#!/bin/bash
set -euo pipefail

show_range() {
  file="$1"
  start="$2"
  end="$3"
  printf '\n== %s (lines %s-%s) ==\n' "$file" "$start" "$end"
  sed -n "${start},${end}{=;p;}" "$file"
}

show_range src/platform/STM32/memprot_hal.c 27 108
show_range src/main/drivers/memprot.h 1 80
show_range src/platform/STM32/memprot_stm32g4xx.c 1 160
show_range src/platform/STM32/memprot_stm32h7xx.c 1 160

printf '%s\n' '== linker-script DMA symbol definitions =='
fd -t f -e ld -e ld.in -e lds -e S . -x sh -c '
  if rg -n -C 4 "_dmaram_(start|end)__|dma_ram_(r|w|rw)_(start|end)|DMA_RAM" "$1" >/dev/null; then
    printf "\n-- %s --\n" "$1"
    rg -n -C 4 "_dmaram_(start|end)__|dma_ram_(r|w|rw)_(start|end)|DMA_RAM" "$1"
  fi
' sh {}

printf '%s\n' '== MPU encoding constants =='
rg -n -C 3 'MPU_REGION_SIZE_(32B|4GB)|MPU_RASR_SIZE_Msk|MPU_REGION_SIZE_Msk' \
  lib src --glob '*.{h,c}' 2>/dev/null || true

#!/bin/bash
set -euo pipefail

printf '%s\n' '== all MPU-region array definitions and generic implementation selection =='
rg -n -C 5 --glob '*.{c,h,mk,cmake,txt}' \
  '\bmpuRegions\s*\[\s*\]|memprot_hal\.c|memprot_stm32(f7|h7|g4)' \
  src make CMakeLists.txt 2>/dev/null || true

printf '%s\n' '== H743/G4 relevant linker memory declarations and DMA_RW_AXI placement =='
for f in src/platform/STM32/link/stm32_ram_h743.ld src/platform/STM32/link/stm32_flash_g4_split.ld; do
  printf '\n-- %s --\n' "$f"
  rg -n -C 8 '^(MEMORY|[[:space:]]*[A-Za-z0-9_]+[[:space:]]*\([^)]*\)[[:space:]]*:)|DMA_RW_AXI|DMA_RW_D2|\.DMA_RAM' "$f"
done

printf '%s\n' '== F7 system MPU setup and generic HAL references =='
rg -n -C 6 --glob '*.{c,h}' \
  '\bHAL_MPU_ConfigRegion\s*\(|\bMPU_ConfigRegion\s*\(|\bmemProtConfigure\s*\(' \
  src/platform/STM32 src/main 2>/dev/null || true

printf '%s\n' '== flsl implementation/contract =='
rg -n -C 5 --glob '*.{c,h}' '\bflsl\s*\(' src 2>/dev/null || true

@morrob955 You’re right to challenge the “clamp” idea. I traced the actual path, and a malformed request must not be converted into a giant permissive MPU region. I withdraw that suggestion.

For this PR, the undefined-shift/overflow case is not reachable on supported Betaflight builds:

• memProtConfigure() in src/platform/STM32/memprot_hal.c is compiled only for STM32H7 and STM32G4 (STM32H7.mk / STM32G4.mk), not STM32F7. The F7 HAL headers exist in-tree, but F7 does not build or call this implementation.
• It runs once during startup and receives only the static mpuRegions[] descriptors. There is no CLI, configuration, or other runtime-controlled MPU request path.
• Those descriptors use linker symbols for DMA sections:
  • H7: dmaram_* and dmarwaxi_*, both placed in the 512 KiB AXI RAM bank in the H743 linker script.
  • G4: DMA sections are likewise linker-bounded SRAM sections, far below the problematic range.

The sizing values are:

msbpos is ceil(log2(length)); regionBytes is deliberately 2^(msbpos + 1) because the PMSAv7 RASR.SIZE encoding represents 2^(SIZE + 1) bytes. The one-size-larger value is correct and necessary for alignment/coverage.

The first undefined shift would require msbpos + 1 >= 32, which requires a derived length >= 2 GiB (or a malformed wrapped subtraction from end < start). Neither can arise from these linker-defined SRAM ranges. The growth loop also cannot reach that size: at most it selects a 1 MiB enclosing region for the H743’s 512 KiB AXI RAM.

So: no clamp and no fix needed for the real supported path in this PR.

If we ever choose to harden this internal helper against a future broken linker descriptor, the right policy is to call memProtConfigError() on an invalid/reversed range or an unrepresentable size—not silently widen the MPU mapping. A fully general implementation would also perform the temporary coverage arithmetic in uint64_t, since PMSAv7 can encode a 4 GiB region while uint32_t regionBytes cannot represent it.

🐇🔍