__nocache section conflicts with __ramfunc on stm32h750

[xhpohanka]

Describe the bug

While playing with uart dma on my custom stm32h750 board (#87795) I have found a strange issue.
When I have both __ramfunc and __nocache then any call to function in ram ends with MPU FAULT.
If no __nocache memory is used functions in ram can be called normally, and vice versa.

There is probably some MPU misconfiguration, but I cannot find the exact issue, sections seem to be correctly placed and sized.

nocache         0x0000000024000000       0x20
                0x0000000024000000                . = ALIGN (_region_min_align)
                0x0000000024000000                . = ALIGN ((0x1 << LOG2CEIL (_nocache_ram_size)))
                0x0000000024000000                _nocache_ram_start = .
 *(SORT_BY_ALIGNMENT(.nocache))
 *(SORT_BY_ALIGNMENT(.nocache.*))
 .nocache."WEST_TOPDIR/test_mpu/src/main.c".0
                0x0000000024000000       0x20 app/libapp.a(main.c.obj)
                0x0000000024000020                . = ALIGN (_region_min_align)
                0x0000000024000020                . = ALIGN ((0x1 << LOG2CEIL (_nocache_ram_size)))
                0x0000000024000020                _nocache_ram_end = .
                0x0000000000000020                _nocache_ram_size = (_nocache_ram_end - _nocache_ram_start)

.ramfunc        0x0000000024000020       0xe0 load address 0x000000009003ce0c
                0x0000000024000020                . = ALIGN (_region_min_align)
                0x0000000024000080                . = ALIGN ((0x1 << LOG2CEIL (__ramfunc_size)))
 *fill*         0x0000000024000020       0x60 
                0x0000000024000080                __ramfunc_start = .
 *(SORT_BY_ALIGNMENT(.ramfunc))
 .ramfunc       0x0000000024000080       0x30 app/libapp.a(main.c.obj)
 .ramfunc.__stub
                0x00000000240000b0        0x8 linker stubs
 *(SORT_BY_ALIGNMENT(.ramfunc.*))
                0x00000000240000c0                . = ALIGN (_region_min_align)
 *fill*         0x00000000240000b8        0x8 
                0x0000000024000100                . = ALIGN ((0x1 << LOG2CEIL (__ramfunc_size)))
 *fill*         0x00000000240000c0       0x40 
                0x0000000024000100                __ramfunc_end = .
                0x0000000000000080                __ramfunc_size = (__ramfunc_end - __ramfunc_start)
                0x000000009003ce0c                __ramfunc_load_start = LOADADDR (.ramfunc)

I have prepared minimal example where the issue can be easily seen
test_mpu.zip

Note: I run my code from external qspi flash

To Reproduce
Steps to reproduce the behavior:

1. use my minimal example on similar hw
2. see the error

Logs and console output

*** Booting Zephyr OS build v3.7.1-78-gf000b8a131f3 ***
[00:00:00.074,000] <inf> net_config: Initializing network
[00:00:00.082,000] <inf> net_config: Waiting interface 1 (0x24001418) to be up...
[00:00:04.259,000] <inf> net_config: Interface 1 (0x24001418) coming up
[00:00:04.270,000] <inf> net_config: Running dhcpv4 client...
[00:00:04.281,000] <inf> test_mpu: main loop
[00:00:05.288,000] <inf> test_mpu: main loop
[00:00:06.296,000] <inf> test_mpu: main loop
[00:00:07.274,000] <inf> net_dhcpv4: Received: 10.42.0.175
[00:00:07.284,000] <inf> net_config: IPv4 address: 10.42.0.175
[00:00:07.293,000] <inf> net_config: Lease time: 3600 seconds
[00:00:07.301,000] <inf> net_config: Subnet: 255.255.255.0
[00:00:07.309,000] <inf> net_config: Router: 10.42.0.1
[00:00:07.319,000] <inf> test_mpu: main loop
[00:00:08.326,000] <inf> test_mpu: main loop
[00:00:09.333,000] <inf> test_mpu: main loop
[00:00:10.341,000] <inf> test_mpu: main loop
[00:00:10.474,000] <inf> phy_mii: PHY (0) Link speed 100 Mb, full duplex
[00:00:11.348,000] <inf> test_mpu: main loop
[00:00:12.356,000] <inf> test_mpu: main loop
[00:00:13.364,000] <inf> test_mpu: main loop
[00:00:14.281,000] <inf> test_mpu: work timeout
[00:00:14.289,000] <err> os: ***** MPU FAULT *****
[00:00:14.297,000] <err> os:   Instruction Access Violation
[00:00:14.305,000] <err> os: r0/a1:  0x00000000  r1/a2:  0x000024d0  r2/a3:  0x24002ec0
[00:00:14.316,000] <err> os: r3/a4:  0x00000002 r12/ip:  0x00000000 r14/lr:  0x90024191
[00:00:14.327,000] <err> os:  xpsr:  0x61000000
[00:00:14.334,000] <err> os: s[ 0]:  0x00000000  s[ 1]:  0x00000000  s[ 2]:  0x24002ec0  s[ 3]:  0x24000081
[00:00:14.347,000] <err> os: s[ 4]:  0x240014d8  s[ 5]:  0x90024191  s[ 6]:  0xffffffff  s[ 7]:  0xffffffff
[00:00:14.359,000] <err> os: s[ 8]:  0x00000000  s[ 9]:  0xaaaaaaaa  s[10]:  0xaaaaaaaa  s[11]:  0x2400a7f0
[00:00:14.372,000] <err> os: s[12]:  0x9002408d  s[13]:  0x24002ec0  s[14]:  0x00000000  s[15]:  0x00000000
[00:00:14.384,000] <err> os: fpscr:  0x00000008
[00:00:14.392,000] <err> os: Faulting instruction address (r15/pc): 0x24000100
[00:00:14.402,000] <err> os: >>> ZEPHYR FATAL ERROR 20: Unknown error on CPU 0
[00:00:14.412,000] <err> os: Current thread: 0x24002ec0 (sysworkq)
[00:00:14.421,000] <err> os: Halting system

Environment (please complete the following information):

• OS: Linux
• Toolchain: Zephyr SDK
• v3.7.1

[etienne-lms]

For info, I've tried to reproduce your issue with an H741 board I have here: stm32h741i_disco.
I build tests/arch/common/ramfunc with a hack to add a __nocache buffer in the test source file.
However, it seems to work fine with both a nocache section and a ramfunc section.

The patch:

--- a/tests/arch/common/ramfunc/src/ramfunc.c
+++ b/tests/arch/common/ramfunc/src/ramfunc.c
@@ -8,10 +8,13 @@
 #include <zephyr/linker/linker-defs.h>
 #include <zephyr/internal/syscall_handler.h>
 
+static __nocache char buffer[32];
+
 static volatile int test_flag;
 
 __ramfunc static void ram_function(void)
 {
+	printk("nocache buffer: \"%s\"\n", buffer);
 	test_flag = 1;
 }
 
@@ -22,6 +25,8 @@ ZTEST(ramfunc, test_ramfunc)
 	init_flag = test_flag;
 	zassert_true(init_flag == 0, "Test flag not initialized to zero");
 
+	sprintf(buffer, "ho ho ho ho ho");
+
 	/* Verify that the .ramfunc section is not empty, it is located
 	 * inside SRAM, and that ram_function(.) is located inside
 	 * the .ramfunc section.

My build command:

west build -b stm32h747i_disco/stm32h747xx/m7 tests/arch/common/ramfunc -- -DCONFIG_NOCACHE_MEMORY=y

The generated logs:

*** Booting Zephyr OS build v4.2.0-rc1-30-gfeac117db2f1 ***
Running TESTSUITE ramfunc
===================================================================
START - test_ramfunc
nocache buffer: "ho ho ho ho ho"
 PASS - test_ramfunc in 0.023 seconds
===================================================================
TESTSUITE ramfunc succeeded

------ TESTSUITE SUMMARY START ------

SUITE PASS - 100.00% [ramfunc]: pass = 1, fail = 0, skip = 0, total = 1 duration = 0.023 seconds
 - PASS - [ramfunc.test_ramfunc] duration = 0.023 seconds

------ TESTSUITE SUMMARY END ------

===================================================================
PROJECT EXECUTION SUCCESSFUL

Extract from the zephyr_final.map file:

(...)
                0x0000000024000000                _image_ram_start = .

nocache         0x0000000024000000       0x20 load address 0x0000000008010f3c
                0x0000000024000000                . = ALIGN (_region_min_align)
                0x0000000024000000                . = ALIGN ((0x1 << LOG2CEIL (_nocache_ram_size)))
                0x0000000024000000                _nocache_ram_start = .
 *(SORT_BY_ALIGNMENT(.nocache))
 *(SORT_BY_ALIGNMENT(.nocache.*))
 .nocache."WEST_TOPDIR/zephyr/tests/arch/common/ramfunc/src/ramfunc.c".0
                0x0000000024000000       0x20 app/libapp.a(ramfunc.c.obj)
                0x0000000024000020                . = ALIGN (_region_min_align)
                0x0000000024000020                . = ALIGN ((0x1 << LOG2CEIL (_nocache_ram_size)))
                0x0000000024000020                _nocache_ram_end = .
                0x0000000000000020                _nocache_ram_size = (_nocache_ram_end - _nocache_ram_start)
                0x0000000008010f3c                _nocache_load_start = LOADADDR (nocache)

.ramfunc        0x0000000024000020       0x60 load address 0x0000000008010f5c
                0x0000000024000020                __ramfunc_region_start = .
                0x0000000024000020                . = ALIGN (_region_min_align)
                0x0000000024000040                . = ALIGN ((0x1 << LOG2CEIL (__ramfunc_size)))
 *fill*         0x0000000024000020       0x20 
                0x0000000024000040                __ramfunc_start = .
 *(SORT_BY_ALIGNMENT(.ramfunc))
 .ramfunc       0x0000000024000040       0x20 app/libapp.a(ramfunc.c.obj)
 .ramfunc.__stub
                0x0000000024000060        0x8 linker stubs
 *(SORT_BY_ALIGNMENT(.ramfunc.*))
                0x0000000024000080                . = ALIGN (_region_min_align)
 *fill*         0x0000000024000068       0x18 
                0x0000000024000080                . = ALIGN ((0x1 << LOG2CEIL (__ramfunc_size)))
                0x0000000024000080                __ramfunc_end = .
                0x0000000000000040                __ramfunc_size = (__ramfunc_end - __ramfunc_start)
                0x0000000008010f5c                __ramfunc_load_start = LOADADDR (.ramfunc)

app_smem        0x0000000024000800      0x860 load address 0x0000000008010fbc
(...)

My conclusion is just that MPU mapping seems to correctly handle these sections.
I'd need to dump the MPU config to check how these sections are mapped.

Could your issue be related to the fact you're executing from an external QSPI flash memory?
I'll try to reproduce setup...

[etienne-lms]

I dumped the MPU config for the sample I described above (many thanks to @mathieuchopstm for the GDB script).
I can see the 2 areas:

 Region 07: ENABLED (0x24000000~0x2400001F | 32 bytes = 0x20 bytes)
  Attr: teX cb S AP=0b001 NX | SRD: 0x00 (0b0)
 Region 08: ENABLED (0x24000040~0x2400007F | 64 bytes = 0x40 bytes)
  Attr: teX CB s AP=0b110 | SRD: 0x00 (0b0)

nocache section is "Outer and inner Non-cacheable Normal" memory without execution rights.
ramfunc section is "Outer and inner Cacheable (write back; write and read allocate) Normal" with execution rights.

[xhpohanka]

Hi @etienne-lms
can you share the script for dumping MPU areas, please? Maybe it can show us something useful.
I will also try to run the test code from internal memory, I had no time to work on that more, yet :(

[etienne-lms]

Hi @xhpohanka, here is the script: dump-mpu.gdb-script.txt

[xhpohanka]

I was able to reproduce the issue on the nucleo-h743zi running from internal flash.
test_mpu_nucleo.zip

It is clearly connected with CONFIG_NETWORKING=y, if it is enabled then I get the failure.

MPU dump without networking

MPU is ENABLED and supports 16 regions.
System address map background region is ENABLED for privileged accesses.
 Region 00: ENABLED (0x08000000~0x081FFFFF | 2 MiB = 0x200000 bytes)
  Attr: tex Cb s AP=0b111 | SRD: 0x00 (0b0)
 Region 01: ENABLED (0x24000000~0x2407FFFF | 512 KiB = 0x80000 bytes)
  Attr: teX CB s AP=0b001 NX | SRD: 0x00 (0b0)
 Region 02: ENABLED (0x1FF00000~0x1FF7FFFF | 512 KiB = 0x80000 bytes)
  Attr: tex cb S AP=0b001 NX | SRD: 0x00 (0b0)
 Region 03: ENABLED (0x30040000~0x30043FFF | 16 KiB = 0x4000 bytes)
  Attr: teX cb s AP=0b001 NX | SRD: 0x00 (0b0)
 Region 04: ENABLED (0x30040000~0x300400FF | 256 bytes = 0x100 bytes)
  Attr: tex cb S AP=0b001 | SRD: 0x00 (0b0)
 Region 05: ENABLED (0x90000000~0x9FFFFFFF | 256 MiB = 0x10000000 bytes)
  Attr: tex cb S AP=0b000 | SRD: 0x00 (0b0)
 Region 06: ENABLED (0x24000000~0x2400007F | 128 bytes = 0x80 bytes)
  Attr: teX CB s AP=0b110 | SRD: 0x00 (0b0)
 Region 07: ENABLED (0x24001EC0~0x24001EFF | 64 bytes = 0x40 bytes)
  Attr: teX CB s AP=0b101 NX | SRD: 0x00 (0b0)
 Region 08: DISABLED
 Region 09: DISABLED
 Region 10: DISABLED
 Region 11: DISABLED
 Region 12: DISABLED
 Region 13: DISABLED
 Region 14: DISABLED
 Region 15: DISABLED

MPU dump with networking

MPU is ENABLED and supports 16 regions.
System address map background region is ENABLED for privileged accesses.
 Region 00: ENABLED (0x08000000~0x081FFFFF | 2 MiB = 0x200000 bytes)
  Attr: tex Cb s AP=0b111 | SRD: 0x00 (0b0)
 Region 01: ENABLED (0x24000000~0x2407FFFF | 512 KiB = 0x80000 bytes)
  Attr: teX CB s AP=0b001 NX | SRD: 0x00 (0b0)
 Region 02: ENABLED (0x1FF00000~0x1FF7FFFF | 512 KiB = 0x80000 bytes)
  Attr: tex cb S AP=0b001 NX | SRD: 0x00 (0b0)
 Region 03: ENABLED (0x30040000~0x30043FFF | 16 KiB = 0x4000 bytes)
  Attr: teX cb s AP=0b001 NX | SRD: 0x00 (0b0)
 Region 04: ENABLED (0x30040000~0x300400FF | 256 bytes = 0x100 bytes)
  Attr: tex cb S AP=0b001 | SRD: 0x00 (0b0)
 Region 05: ENABLED (0x90000000~0x9FFFFFFF | 256 MiB = 0x10000000 bytes)
  Attr: tex cb S AP=0b000 | SRD: 0x00 (0b0)
 Region 06: ENABLED (0x24000000~0x2400001F | 32 bytes = 0x20 bytes)
  Attr: teX cb S AP=0b001 NX | SRD: 0x00 (0b0)
 Region 07: ENABLED (0x24000080~0x240000FF | 128 bytes = 0x80 bytes)
  Attr: teX CB s AP=0b110 | SRD: 0x00 (0b0)
 Region 08: ENABLED (0x24003D00~0x24003D3F | 64 bytes = 0x40 bytes)
  Attr: teX CB s AP=0b101 NX | SRD: 0x00 (0b0)
 Region 09: DISABLED
 Region 10: DISABLED
 Region 11: DISABLED
 Region 12: DISABLED
 Region 13: DISABLED
 Region 14: DISABLED
 Region 15: DISABLED

[etienne-lms]

I don't see the nocache section in the 1st dump (region expected at 0x24000000~0x2400001F).
Maybe you swapped the 2 cases?
Could you provide the MPU FAULT error logs in the config where is fails?

FYI, the setup I used (comment #88047 (comment)) already enables CONFIG_NETWORKING=y. I'm not sure this information helps :-)
FWIW, I tried with the config option disabled, still functional.

By the way, looking back at your logs in the Issue description, the faulty address is 0x24000100 that is the end of your ramfunc section, hence the start of some area that is not mapped. Could it be that this section was not properly loaded and the call to test() ended in execution of NOP instructions until the end of the ramfunc section mapping is reached?

[xhpohanka]

Hmm, I'm really lost :D
btw I'm on v3.7-branch, exactly here 7dcd584

Please check following, CONFIG_NETWORKING enabled, __nocache buffer used

[00:00:09.106,000] <inf> test_mpu: main loop
[00:00:10.051,000] <inf> test_mpu: work timeout
[00:00:10.058,000] <err> os: ***** MPU FAULT *****
[00:00:10.066,000] <err> os:   Instruction Access Violation
[00:00:10.074,000] <err> os: r0/a1:  0x00000000  r1/a2:  0x40028000  r2/a3:  0x00000003
[00:00:10.085,000] <err> os: r3/a4:  0x00000000 r12/ip:  0x08004df9 r14/lr:  0x0800ae51
[00:00:10.096,000] <err> os:  xpsr:  0x61000000
[00:00:10.103,000] <err> os: Faulting instruction address (r15/pc): 0x24000100
[00:00:10.114,000] <err> os: >>> ZEPHYR FATAL ERROR 20: Unknown error on CPU 0
[00:00:10.124,000] <err> os: Current thread: 0x24001a78 (sysworkq)
[00:00:10.133,000] <err> os: Halting system

gdb log

(gdb) load
`/home/honza/dev/zephyrproject/test_mpu/nucleo/zephyr/zephyr.elf' has changed; re-reading symbols.
Loading section rom_start, size 0x298 lma 0x8000000
Loading section text, size 0x13178 lma 0x8000298
Loading section .ARM.exidx, size 0x8 lma 0x8013410
Loading section initlevel, size 0xf0 lma 0x8013418
Loading section device_area, size 0x17c lma 0x8013508
Loading section sw_isr_table, size 0x4b0 lma 0x8013684
Loading section log_const_area, size 0x80 lma 0x8013b34
Loading section log_backend_area, size 0x10 lma 0x8013bb4
Loading section shell_area, size 0x30 lma 0x8013bc4
Loading section shell_root_cmds_area, size 0x28 lma 0x8013bf4
Loading section shell_subcmds_area, size 0x14 lma 0x8013c1c
Loading section rodata, size 0x26d8 lma 0x8013c30
Loading section .ramfunc, size 0xe0 lma 0x8016308
Loading section datas, size 0xfc8 lma 0x80163e8
Loading section device_states, size 0x26 lma 0x80173b0
Loading section log_msg_ptr_area, size 0x4 lma 0x80173d8
Loading section log_dynamic_area, size 0x40 lma 0x80173dc
Loading section k_mem_slab_area, size 0x38 lma 0x801741c
Loading section k_mutex_area, size 0x50 lma 0x8017454
Loading section net_buf_pool_area, size 0x58 lma 0x80174a4
Loading section net_if_area, size 0x40 lma 0x80174fc
Loading section net_if_dev_area, size 0x1c lma 0x801753c
Loading section net_l2_area, size 0x10 lma 0x8017558
Loading section .last_section, size 0x4 lma 0x8017568
Start address 0x08004774, load size 95594
Transfer rate: 48 KB/sec, 3414 bytes/write.
(gdb) c
Continuing.

Breakpoint 7, main () at /home/honza/dev/zephyrproject/test_mpu/src/main.c:33
33		LOG_INF("main fn");
(gdb) c
Continuing.
halted: PC: 0x08000c62
^C
Program received signal SIGINT, Interrupt.
arch_system_halt (reason=reason@entry=20) at /home/honza/dev/zephyrproject/zephyr/kernel/fatal.c:30
30		for (;;) {
(gdb) dump_mpu_info 
MPU is ENABLED and supports 16 regions.
System address map background region is ENABLED for privileged accesses.
 Region 00: ENABLED (0x08000000~0x081FFFFF | 2 MiB = 0x200000 bytes)
  Attr: tex Cb s AP=0b111 | SRD: 0x00 (0b0)
 Region 01: ENABLED (0x24000000~0x2407FFFF | 512 KiB = 0x80000 bytes)
  Attr: teX CB s AP=0b001 NX | SRD: 0x00 (0b0)
 Region 02: ENABLED (0x1FF00000~0x1FF7FFFF | 512 KiB = 0x80000 bytes)
  Attr: tex cb S AP=0b001 NX | SRD: 0x00 (0b0)
 Region 03: ENABLED (0x30040000~0x30043FFF | 16 KiB = 0x4000 bytes)
  Attr: teX cb s AP=0b001 NX | SRD: 0x00 (0b0)
 Region 04: ENABLED (0x30040000~0x300400FF | 256 bytes = 0x100 bytes)
  Attr: tex cb S AP=0b001 | SRD: 0x00 (0b0)
 Region 05: ENABLED (0x90000000~0x9FFFFFFF | 256 MiB = 0x10000000 bytes)
  Attr: tex cb S AP=0b000 | SRD: 0x00 (0b0)
 Region 06: ENABLED (0x24000000~0x2400001F | 32 bytes = 0x20 bytes)
  Attr: teX cb S AP=0b001 NX | SRD: 0x00 (0b0)
 Region 07: ENABLED (0x24000080~0x240000FF | 128 bytes = 0x80 bytes)
  Attr: teX CB s AP=0b110 | SRD: 0x00 (0b0)
 Region 08: ENABLED (0x240042C0~0x240042FF | 64 bytes = 0x40 bytes)
  Attr: teX CB s AP=0b101 NX | SRD: 0x00 (0b0)
 Region 09: DISABLED
 Region 10: DISABLED
 Region 11: DISABLED
 Region 12: DISABLED
 Region 13: DISABLED
 Region 14: DISABLED
 Region 15: DISABLED
(gdb) bt
#0  arch_system_halt (reason=reason@entry=20) at /home/honza/dev/zephyrproject/zephyr/kernel/fatal.c:30
#1  0x0800a6f4 in k_sys_fatal_error_handler (reason=reason@entry=20, esf=esf@entry=0x24003cc0 <z_interrupt_stacks+2048>) at /home/honza/dev/zephyrproject/zephyr/kernel/fatal.c:44
#2  0x0800a796 in z_fatal_error (reason=20, esf=esf@entry=0x24003cc0 <z_interrupt_stacks+2048>) at /home/honza/dev/zephyrproject/zephyr/kernel/fatal.c:119
#3  0x08004034 in z_arm_fatal_error (reason=<optimized out>, esf=esf@entry=0x24003cc0 <z_interrupt_stacks+2048>) at /home/honza/dev/zephyrproject/zephyr/arch/arm/core/fatal.c:86
#4  0x08004694 in z_arm_fault (msp=<optimized out>, psp=<optimized out>, exc_return=<optimized out>, callee_regs=<optimized out>) at /home/honza/dev/zephyrproject/zephyr/arch/arm/core/cortex_m/fault.c:1157
#5  0x08004770 in z_arm_usage_fault () at /home/honza/dev/zephyrproject/zephyr/arch/arm/core/cortex_m/fault_s.S:102
#6  <signal handler called>
#7  0x24000100 in eth0_data ()
#8  0x0800ae50 in work_queue_main (workq_ptr=0x24001a78 <k_sys_work_q>, p2=<optimized out>, p3=<optimized out>) at /home/honza/dev/zephyrproject/zephyr/kernel/work.c:688
#9  0x240046f0 in sys_work_q_stack ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) p buffer
$9 = "ho ho ho ho ho\000K\003\"\003\223\aK\002\223\000#\030F\315\351\0003"
(gdb) p &buffer
$10 = (uint8_t (*)[32]) 0x24000000 <buffer>

now with CONFIG_NETWORKING disabled (just commented out in prj.conf), __nocache buffer still used

(gdb) !ninja -C nucleo 
ninja: Entering directory `nucleo'
[0/1] Re-running CMake...
Loading Zephyr default modules (Zephyr base (cached)).
-- Application: /home/honza/dev/zephyrproject/test_mpu
-- CMake version: 4.0.2-dirty
-- Cache files will be written to: /home/honza/.cache/zephyr
-- Zephyr version: 3.7.1 (/home/honza/dev/zephyrproject/zephyr)
-- Found west (found suitable version "1.4.0", minimum required is "0.14.0")
-- Board: nucleo_h753zi, qualifiers: stm32h753xx
-- Found host-tools: zephyr 0.16.4 (/home/honza/zephyr-sdk-0.16.4)
-- Found toolchain: zephyr 0.16.4 (/home/honza/zephyr-sdk-0.16.4)
-- Found BOARD.dts: /home/honza/dev/zephyrproject/zephyr/boards/st/nucleo_h753zi/nucleo_h753zi.dts
-- Generated zephyr.dts: /home/honza/dev/zephyrproject/test_mpu/nucleo/zephyr/zephyr.dts
-- Generated devicetree_generated.h: /home/honza/dev/zephyrproject/test_mpu/nucleo/zephyr/include/generated/zephyr/devicetree_generated.h
-- Including generated dts.cmake file: /home/honza/dev/zephyrproject/test_mpu/nucleo/zephyr/dts.cmake
Parsing /home/honza/dev/zephyrproject/zephyr/Kconfig
Loaded configuration '/home/honza/dev/zephyrproject/zephyr/boards/st/nucleo_h753zi/nucleo_h753zi_defconfig'
Merged configuration '/home/honza/dev/zephyrproject/test_mpu/prj.conf'
Configuration saved to '/home/honza/dev/zephyrproject/test_mpu/nucleo/zephyr/.config'
Kconfig header saved to '/home/honza/dev/zephyrproject/test_mpu/nucleo/zephyr/include/generated/zephyr/autoconf.h'
CMake Deprecation Warning at /home/honza/dev/zephyrproject/modules/lib/civetweb/CMakeLists.txt:2 (cmake_minimum_required):
  Compatibility with CMake < 3.10 will be removed from a future version of
  CMake.

  Update the VERSION argument <min> value.  Or, use the <min>...<max> syntax
  to tell CMake that the project requires at least <min> but has been updated
  to work with policies introduced by <max> or earlier.


-- Configuring done (2.3s)
-- Generating done (0.1s)
-- Build files have been written to: /home/honza/dev/zephyrproject/test_mpu/nucleo
[156/157] Linking C executable zephyr/zephyr.elf
Memory region         Used Size  Region Size  %age Used
           FLASH:       50900 B         2 MB      2.43%
             RAM:       10944 B       512 KB      2.09%
          EXTMEM:          0 GB       256 MB      0.00%
           SRAM1:          0 GB       128 KB      0.00%
           SRAM2:          0 GB       128 KB      0.00%
           SRAM3:         16 KB        32 KB     50.00%
           SRAM4:          0 GB        64 KB      0.00%
            DTCM:          0 GB       128 KB      0.00%
        IDT_LIST:          0 GB        32 KB      0.00%
Generating files from /home/honza/dev/zephyrproject/test_mpu/nucleo/zephyr/zephyr.elf for board: nucleo_h753zi
(gdb) load
`/home/honza/dev/zephyrproject/test_mpu/nucleo/zephyr/zephyr.elf' has changed; re-reading symbols.
Loading section rom_start, size 0x298 lma 0x8000000
Loading section text, size 0x9920 lma 0x8000298
Loading section .ARM.exidx, size 0x8 lma 0x8009bb8
Loading section initlevel, size 0xb8 lma 0x8009bc0
Loading section device_area, size 0x12c lma 0x8009c78
Loading section sw_isr_table, size 0x4b0 lma 0x8009da4
Loading section log_const_area, size 0x58 lma 0x800a254
Loading section log_backend_area, size 0x10 lma 0x800a2ac
Loading section shell_area, size 0x30 lma 0x800a2bc
Loading section shell_root_cmds_area, size 0x28 lma 0x800a2ec
Loading section shell_subcmds_area, size 0x14 lma 0x800a314
Loading section rodata, size 0x2210 lma 0x800a328
Loading section .ramfunc, size 0x80 lma 0x800c538
Loading section datas, size 0xc8 lma 0x800c5b8
Loading section device_states, size 0x1e lma 0x800c680
Loading section log_msg_ptr_area, size 0x4 lma 0x800c6a0
Loading section log_dynamic_area, size 0x2c lma 0x800c6a4
Loading section .last_section, size 0x4 lma 0x800c6d0
Start address 0x08004238, load size 50898
Transfer rate: 31 KB/sec, 2544 bytes/write.
(gdb) c
Continuing.

Breakpoint 7, main () at /home/honza/dev/zephyrproject/test_mpu/src/main.c:33
33		LOG_INF("main fn");
(gdb) c
Continuing.
halted: PC: 0x08000762
^C
Program received signal SIGINT, Interrupt.
arch_cpu_idle () at /home/honza/dev/zephyrproject/zephyr/arch/arm/core/cortex_m/cpu_idle.c:96
96		__enable_irq();
(gdb) dump_mpu_info 
MPU is ENABLED and supports 16 regions.
System address map background region is ENABLED for privileged accesses.
 Region 00: ENABLED (0x08000000~0x081FFFFF | 2 MiB = 0x200000 bytes)
  Attr: tex Cb s AP=0b111 | SRD: 0x00 (0b0)
 Region 01: ENABLED (0x24000000~0x2407FFFF | 512 KiB = 0x80000 bytes)
  Attr: teX CB s AP=0b001 NX | SRD: 0x00 (0b0)
 Region 02: ENABLED (0x1FF00000~0x1FF7FFFF | 512 KiB = 0x80000 bytes)
  Attr: tex cb S AP=0b001 NX | SRD: 0x00 (0b0)
 Region 03: ENABLED (0x30040000~0x30043FFF | 16 KiB = 0x4000 bytes)
  Attr: teX cb s AP=0b001 NX | SRD: 0x00 (0b0)
 Region 04: ENABLED (0x30040000~0x300400FF | 256 bytes = 0x100 bytes)
  Attr: tex cb S AP=0b001 | SRD: 0x00 (0b0)
 Region 05: ENABLED (0x90000000~0x9FFFFFFF | 256 MiB = 0x10000000 bytes)
  Attr: tex cb S AP=0b000 | SRD: 0x00 (0b0)
 Region 06: ENABLED (0x24000000~0x2400007F | 128 bytes = 0x80 bytes)
  Attr: teX CB s AP=0b110 | SRD: 0x00 (0b0)
 Region 07: ENABLED (0x24001EC0~0x24001EFF | 64 bytes = 0x40 bytes)
  Attr: teX CB s AP=0b101 NX | SRD: 0x00 (0b0)
 Region 08: DISABLED
 Region 09: DISABLED
 Region 10: DISABLED
 Region 11: DISABLED
 Region 12: DISABLED
 Region 13: DISABLED
 Region 14: DISABLED
 Region 15: DISABLED
(gdb) p buffer
$7 = "ho ho ho ho ho", '\000' <repeats 17 times>
(gdb) p &buffer
$8 = (uint8_t (*)[32]) 0x24000dd4 <buffer>

and voila

[00:00:08.047,000] <inf> test_mpu: main loop
[00:00:09.054,000] <inf> test_mpu: main loop
[00:00:10.000,000] <inf> test_mpu: work timeout
[00:00:10.007,000] <inf> test_mpu: test_fn in ram, ho ho ho ho ho
[00:00:10.061,000] <inf> test_mpu: main loop
[00:00:11.068,000] <inf> test_mpu: main loop

UPDATE:
Now I understand I did not have CONFIG_NOCACHE_MEMORY explicitely enabled, thus it is not used without CONFIG_NETWORKING :)

[xhpohanka]

Actually I dont understand it at all

...
<err> os: Faulting instruction address (r15/pc): 0x24000100
...

...
#5  0x08004770 in z_arm_usage_fault () at /home/honza/dev/zephyrproject/zephyr/arch/arm/core/cortex_m/fault_s.S:102
#6  <signal handler called>
#7  0x24000100 in eth0_data ()
#8  0x0800ae50 in work_queue_main (workq_ptr=0x24001a78 <k_sys_work_q>, p2=<optimized out>, p3=<optimized out>) at /home/honza/dev/zephyrproject/zephyr/kernel/work.c:688
#9  0x240046f0 in sys_work_q_stack ()


(gdb) info symbol 0x24000100
eth0_data in section datas

(gdb) p test_fn 
$15 = {int (void)} 0x24000080 <test_fn>