Memory System & MPU

• Every Cortex-M sees the same 4 GiB map. The architecture fixes eight regions, each with default attributes and semantics.
• A vendor SoC maps its flash, SRAM, peripherals and external memories inside these regions — but the region boundaries and defaults are architectural.
• The compiler / linker can therefore assume memory semantics (e.g. that 0x4000_0000 is Device memory) without device-specific macros.
• The NVIC, SCB, MPU, FPU, SysTick, and CoreSight components live at fixed addresses inside the Private Peripheral Bus (PPB).

• Vector table must be reachable at address 0 after reset.
• Most SoCs "alias" flash to 0x0000_0000 (e.g. STM32 BOOT0 pin selects flash vs system-memory vs SRAM).
• Normal memory semantics — cacheable, bufferable, executable.
• Instructions can also be fetched from the SRAM region, but performance on M3/M4 is lower because of the bus matrix design — M7 mitigates this via I-cache + AXI.

Layout inside Code region (vendor pattern)

0x0000_0000   (boot alias — remapped by OPTR)
0x0800_0000   main flash — STM32
0x1FFF_0000   system memory (DfU bootloader)
0x1FFF_7800   OTP / option bytes
0x1FFF_F800   engineering bytes

Exact map depends entirely on the vendor. The architecture only guarantees reset reads from 0x0000_0000/4.

• Canonical home for stack, heap, .data, .bss.
• Normal memory — cacheable (on cored MCUs), bufferable, non-executable unless XN disabled (rarely).
• First 1 MiB (0x2000_0000 – 0x200F_FFFF) is the bit-band region on M3/M4 — single-bit atomic access via the alias.
• Parity / ECC on many SoCs — a soft error on a word you never touched can still faultingly propagate via speculative load on M7.

• Default attributes: Device memory — no speculation, no merging, ordering preserved between accesses to the same peripheral.
• Execute-never by default (XN): even if MPU is off, CPU refuses to fetch instructions from this region.
• First 1 MiB has a bit-band alias at 0x4200_0000 (M3/M4 only).
• All the GPIO, timers, UART, SPI, I²C, DMA etc. on the chip live here — so does the on-chip ADC / USB / Ethernet MAC.

On Cortex-M3 / M4, a bit-band alias region lets each bit of a 32-bit word in bit-band memory be addressed as its own 32-bit word in the alias.

• Read from alias → returns 0 or 1 (padded to 32 bits).
• Write to alias → atomically sets or clears the corresponding bit.
• The bus translates the access — no RMW cycle in CPU, no IRQ masking needed.
• Dropped from Cortex-M7 and all Armv8-M cores — use exclusive load/store or atomic bit-set/clear peripherals instead.

Addressing math

alias = band_base + (word_offset << 5)
                  + (bit_offset  << 2)

/* SRAM band:   0x2000_0000 … 0x200F_FFFF (1 MiB)
   SRAM alias:  0x2200_0000 … 0x23FF_FFFF (32 MiB) */

#define BIT_BAND_SRAM(byte, bit)   \
    (*(volatile uint32_t *)        \
       (0x22000000u +               \
        ((uint32_t)(byte) - 0x20000000u) * 32 + \
        (bit) * 4))

Every bit in the 1 MiB band has exactly one 4-byte alias — so 8 MiB of bit × 4 bytes = 32 MiB alias.

• Memory Protection Unit — a region-based permission checker (no translation, no virtualisation).
• 8 regions (optionally 16 on some M3/M4) plus one "background" region for privileged fall-through.
• Each region must be power-of-two size, between 32 B and 4 GiB.
• Must be naturally aligned (base address must be a multiple of size).
• Higher-numbered region wins when they overlap.

Per-region attributes

• Base address (RBAR).
• Size (RASR.SIZE = log₂(size) − 1).
• Access permission: no / RW-privileged / RW-unpriv / RO.
• Type attrs: cacheable, bufferable, shareable, TEX encoding.
• Execute-never bit.
• Sub-region disable (SRD) — an 8-bit field that carves the region into 8 equal slices; set bit → that slice is disabled.

What's different

• Base + Limit addressing (not base + power-of-two size). Any 32-byte granularity.
• Attribute-indirect: region carries a 3-bit AttrIdx pointing into a shared MPU_MAIR pair of 32-bit registers (à la A-profile MAIR).
• No sub-region disable — arbitrary limits make it unnecessary.
• Separate banks in TrustZone: MPU_S for Secure, MPU_NS for Non-Secure.
• 8 or 16 regions configurable at implementation.

/* Set attr 0 = Normal WB inner+outer cacheable */
MPU->MAIR0 = (0xFFu << 0);

/* Region 0: flash 0x0800_0000 .. 0x082F_FFFF */
MPU->RNR   = 0;
MPU->RBAR  = 0x08000000 | (0u<<3) /* AttrIdx */
                         | (5u<<1) /* AP = priv RO, unpriv RO */
                         | 0;       /* XN=0, executable */
MPU->RLAR  = 0x082FFFE0 | 1;       /* limit, ENABLE=1 */

MPU->CTRL = 1 | (1<<2);            /* ENABLE + PRIVDEFENA */

Cleaner & more orthogonal than v7-M MPU. RTOSes target both via a single abstraction (e.g. FreeRTOS MPU port).

Cortex-M7

• Optional L1 I-cache + D-cache, configurable 4–64 KiB each, 2-way or 4-way set-assoc.
• Write-back or write-through per region (via MPU attrs).
• Caches are not coherent with DMA — software managed.
• Separate SCB_InvalidateICache, SCB_CleanDCache, SCB_InvalidateDCache operations in CMSIS.

M55 / M85

• Optional, up to 16 / 32 KiB I+D cache (impl-defined upper bound on M85).
• Added MSCR bits for easier cache maintenance from C.

CPU → peripheral (TX)

memcpy(tx_buf, src, n);

/* push dirty lines out before DMA reads */
SCB_CleanDCache_by_Addr((uint32_t*)tx_buf, n);

dma_start(tx_buf, n);

Peripheral → CPU (RX)

/* make sure we don't have stale lines */
SCB_InvalidateDCache_by_Addr((uint32_t*)rx_buf, n);

dma_start(rx_buf, n);
wait_for_dma_done();

/* after DMA writes, invalidate again so CPU reads from RAM */
SCB_InvalidateDCache_by_Addr((uint32_t*)rx_buf, n);
/* buffer now safe to use from CPU */

What it is

• SRAM physically attached to the CPU's instruction and data buses, outside the main bus matrix.
• ITCM at low address in Code region (e.g. 0x0000_0000 on STM32H7 when BOOT_ADD0 selects it).
• DTCM at low address in SRAM region (0x2000_0000 on STM32H7, 128 KiB).
• Single-cycle access, no wait-states, no cache involvement.
• Typical size: 16–128 KiB per TCM. Visible only to one master (the core).

What to put there

• ISRs that must start in < 20 ns regardless of cache state (audio DSP, motor control PWM update).
• Tightest FIR/IIR kernel data.
• The exception stack — bounded, predictable.

• Data loads/stores obey the CPU's configured endianness.
• Instruction fetches are always little-endian regardless (instructions are bytes in ROM written out by the linker).
• Byte-swap intrinsics map to single-cycle instructions: __REV, __REV16, __REVSH, __RBIT.
• Network-byte-order conversion is therefore free compared to 8051-era MCUs where bswap takes 4 instructions.

/* 'be32toh' on little-endian Cortex-M */
static inline uint32_t be32toh(uint32_t v)
{
    uint32_t out;
    __asm volatile ("rev %0, %1" : "=r"(out) : "r"(v));
    return out;
}

/* Compiler already emits REV for __builtin_bswap32 */
uint32_t net = __builtin_bswap32(host);

• MSPLIM, PSPLIM — 32-bit, 8-byte aligned lower-bound for each stack.
• Hardware checks on every push / stack-frame write: if SP < SPLIM → UsageFault with UFSR.STKOF.
• Completely replaces the old guard-page hack (unmapped region at the bottom of the stack enforced by MPU).
• Banked per security state on TrustZone cores: MSPLIM_S, PSPLIM_S, MSPLIM_NS, PSPLIM_NS.

/* FreeRTOS v8-M port snippet */
void vPortSetupTaskStack(StackType_t *top, StackType_t *bottom)
{
    __set_PSPLIM((uint32_t)bottom);
}

/* Stack overflow → UsageFault at first push past limit */
void UsageFault_Handler(void)
{
    if (SCB->CFSR & SCB_CFSR_STKOF_Msk) {
        /* current task smashed its stack — reschedule */
        configASSERT(!"stack overflow");
    }
    for (;;);
}