1. Execute Never (XN) — Region Memory Attributes

Not all memory regions are equal. The ARM architecture tags certain regions with an XN (eXecute Never) attribute, which tells the processor’s Memory Protection Unit (MPU) and architecture rules that code must never be fetched for execution from those addresses.

If the processor’s program counter ever points into an XN region — either because a bug overwrote the PC or because an attacker tried to execute data as code — the hardware raises a MemManage fault (or HardFault if MemManage is not enabled) before a single instruction from that region executes.

2. External RAM Region (0x60000000 – 0x9FFFFFFF)

This 1 GB region is reserved for external memory chips connected to the processor through a memory controller. Unlike the peripheral region, code can be executed from here — making it suitable for Execute-in-Place (XIP) applications where the program is too large to fit in on-chip flash.

Configuring external SDRAM on STM32F4 with FMC

/* Conceptual: FMC initialisation for IS42S16400J SDRAM (STM32F4 with FMC) */
/* NOT available on STM32F411 — shown for reference on larger STM32F4 devices */

#define FMC_BASE     0xA0000000UL   /* FMC register base */
#define SDRAM_BANK1  0xC0000000UL   /* External RAM bank 1 mapped here */

/* After FMC SDRAM init, use external memory like normal SRAM: */
uint32_t *ext_ram = (uint32_t *)SDRAM_BANK1;
ext_ram[0] = 0xDEADBEEF;   /* write to external SDRAM */
uint32_t val = ext_ram[0]; /* read back */

/* Place large arrays in external RAM with linker section attribute: */
__attribute__((section(".sdram")))
uint8_t video_frame_buffer[480 * 272 * 2];  /* 261 KB — too big for on-chip SRAM */

3. External Device Region (0xA0000000 – 0xDFFFFFFF)

This 1 GB region is designated for external devices and shared memory — equipment that behaves like a peripheral rather than addressable memory. It is permanently marked XN (eXecute Never) and is also non-cacheable and non-bufferable by default, meaning every access goes directly to the external device with no memory-system optimisation.

/* Parallel LCD using FMC in 8080 mode — External Device region */
/* Command register at bank 1, A16=0 (RS line tied to FMC address bit 16) */
#define LCD_CMD_ADDR   0x60000000UL   /* External Device region, bank 1 */
#define LCD_DATA_ADDR  0x60020000UL   /* A16=1 → data register           */

#define LCD_CMD    (*(volatile uint16_t *)LCD_CMD_ADDR)
#define LCD_DATA   (*(volatile uint16_t *)LCD_DATA_ADDR)

void lcd_write_reg(uint16_t reg, uint16_t value)
{
    LCD_CMD  = reg;     /* select register */
    LCD_DATA = value;   /* write value     */
}

void lcd_set_pixel(uint16_t color)
{
    LCD_DATA = color;   /* stream pixel data to GRAM */
}

4. Private Peripheral Bus Region (0xE0000000 – 0xE00FFFFF)

The Private Peripheral Bus (PPB) region is 1 MB and contains the ARM-defined system control registers that are identical on every Cortex-M chip. It is XN and always requires privileged access.

/* Key PPB registers — same addresses on ALL Cortex-M devices */

/* SysTick (at 0xE000E010) */
#define SYST_CSR    (*(volatile uint32_t *)0xE000E010U)  /* Control & Status */
#define SYST_RVR    (*(volatile uint32_t *)0xE000E014U)  /* Reload Value     */
#define SYST_CVR    (*(volatile uint32_t *)0xE000E018U)  /* Current Value    */

/* NVIC (at 0xE000E100) */
#define NVIC_ISER0  (*(volatile uint32_t *)0xE000E100U)  /* Interrupt Set Enable   */
#define NVIC_ICER0  (*(volatile uint32_t *)0xE000E180U)  /* Interrupt Clear Enable */
#define NVIC_ISPR0  (*(volatile uint32_t *)0xE000E200U)  /* Interrupt Set Pending  */
#define NVIC_IPR0   (*(volatile uint32_t *)0xE000E400U)  /* Interrupt Priority     */

/* SCB (at 0xE000ED00) */
#define SCB_CPUID   (*(volatile uint32_t *)0xE000ED00U)  /* CPU ID register        */
#define SCB_AIRCR   (*(volatile uint32_t *)0xE000ED0CU)  /* App Int & Reset Control*/
#define SCB_SHCSR   (*(volatile uint32_t *)0xE000ED24U)  /* System Handler Control */

/* DWT Cycle Counter (at 0xE0001000) */
#define DWT_CTRL    (*(volatile uint32_t *)0xE0001000U)
#define DWT_CYCCNT  (*(volatile uint32_t *)0xE0001004U)

/* Read CPU ID: e.g. 0x410FC241 for Cortex-M4 r0p1 */
void print_cpu_id(void)
{
    uint32_t id = SCB_CPUID;
    /* bits [19:16] = Constant = 0xF
       bits [15:4]  = Part number = 0xC24 (M4) or 0xC23 (M3)
       bits [3:0]   = Revision                                */
}

5. What is AMBA?

AMBA stands for Advanced Microcontroller Bus Architecture. It is an open specification developed by ARM that defines standard on-chip bus protocols for connecting processor cores, memory, and peripherals inside a System-on-Chip (SoC).

Because AMBA is a published open standard, any chip designer (ST, NXP, Broadcom, Qualcomm, Apple) can use it to interconnect ARM IP blocks — the CPU, DMA controller, memory controller, and peripherals — without needing custom bus logic. This is a major reason why ARM-based chips dominate the embedded and mobile markets: the ecosystem of compatible IP is enormous.

6. AHB Lite — High-performance Bus

AHB Lite (AMBA High-performance Bus — Lite) is the primary bus used for the Cortex-M core’s main interfaces. It carries instruction fetches, data reads/writes to SRAM, and accesses to high-speed peripherals like GPIO, DMA, and RCC.

AHB Lite pipelined transfer timing

On STM32F411, the AHB1 bus runs at the full system clock (100 MHz), giving a peak throughput of 400 MB/s for 32-bit transfers (100 MHz × 4 bytes). This is why GPIO toggling can be very fast on Cortex-M — a single 32-bit write to the GPIOA_BSRR register over AHB1 completes in one clock cycle.

/* GPIO BSRR: fastest way to set/clear GPIO bits — single AHB write */
#define GPIOA_BSRR  (*(volatile uint32_t *)0x40020018U)

/* Set PA5 HIGH  — one 32-bit AHB write, one clock cycle */
GPIOA_BSRR = (1U << 5);

/* Set PA5 LOW   — write to upper 16 bits (reset bits) */
GPIOA_BSRR = (1U << (5 + 16));

/* Toggle PA5 at maximum speed using ODR XOR */
#define GPIOA_ODR   (*(volatile uint32_t *)0x40020014U)
while (1) {
    GPIOA_ODR ^= (1U << 5);   /* Each iteration = 1 AHB write + loop overhead */
}

7. APB — Advanced Peripheral Bus

APB (Advanced Peripheral Bus) is a simpler, lower-speed bus designed for peripherals that do not need the full bandwidth of AHB. It has a smaller signal count, lower gate count, and lower power consumption — ideal for UART, I2C, basic timers, and watchdogs.

8. The AHB-to-APB Bridge

Slow APB peripherals cannot connect directly to the fast AHB bus — their timing requirements are incompatible. The AHB-to-APB bridge is a hardware module that translates between the two bus protocols, handling the clock domain crossing and protocol conversion transparently.

From the programmer’s perspective, the bridge is completely invisible. You write to a UART register address and the hardware handles the protocol conversion. The only observable effect is that APB peripheral accesses take more clock cycles than AHB peripheral accesses.

/* USART2 is on APB1 at 0x40004400 — access goes through AHB-APB bridge */
#define USART2_SR   (*(volatile uint32_t *)0x40004400U)
#define USART2_DR   (*(volatile uint32_t *)0x40004404U)
#define USART2_BRR  (*(volatile uint32_t *)0x40004408U)
#define USART2_CR1  (*(volatile uint32_t *)0x4000440CU)

/* Writing to USART2_DR is an AHB transaction that the bridge translates
   to an APB write at 50 MHz. The CPU may insert 1 wait state.         */
void uart_send_byte(uint8_t byte)
{
    while (!(USART2_SR & (1U << 7)));  /* wait TXE (TX Empty) */
    USART2_DR = byte;
}

/* Compare: GPIOA on AHB1 — no bridge, no wait states */
#define GPIOA_ODR  (*(volatile uint32_t *)0x40020014U)
void gpio_toggle(void) { GPIOA_ODR ^= (1U << 5); }  /* 1 cycle */

9. Four Cortex-M Bus Interfaces

The Cortex-M processor core exposes four distinct AHB Lite bus interfaces to the outside world. Each has a specific purpose. This is why the core can do more than one thing at a time — instruction fetch and data access can happen simultaneously because they use different buses.

10. Bus Matrix on STM32F411

On the STM32F411, a multi-layer AHB bus matrix connects multiple bus masters (CPU, DMA1, DMA2) to multiple slaves (flash, SRAM, peripheral buses). The matrix allows simultaneous accesses as long as two masters target different slaves.

Practical example — DMA + CPU simultaneous access

/* DMA2 transfers data from SRAM to SPI1 (on APB2)
   while CPU continues executing from flash.
   No conflict: CPU uses I-CODE (flash), DMA2 uses System bus (SRAM→APB2). */

#define DMA2_S3CR    (*(volatile uint32_t *)0x40026458U)  /* DMA2 stream3 CR */
#define DMA2_S3NDTR  (*(volatile uint32_t *)0x4002645CU)  /* transfer count  */
#define DMA2_S3PAR   (*(volatile uint32_t *)0x40026460U)  /* peripheral addr */
#define DMA2_S3M0AR  (*(volatile uint32_t *)0x40026464U)  /* memory addr     */

static uint8_t spi_tx_buf[64];   /* in SRAM — filled by CPU */

void start_spi_dma(void)
{
    DMA2_S3PAR   = 0x4001300CU;           /* SPI1->DR address (APB2) */
    DMA2_S3M0AR  = (uint32_t)spi_tx_buf; /* source in SRAM           */
    DMA2_S3NDTR  = 64;
    DMA2_S3CR    = (3U << 25)            /* channel 3                */
                 | (1U << 6)             /* memory-to-peripheral     */
                 | (1U << 10)            /* memory increment         */
                 | (1U << 0);            /* enable stream            */

    /* CPU is now free — DMA handles the transfer via the bus matrix */
}

11. Performance Implications for Embedded Code

Understanding the bus architecture helps you write faster code and avoid hidden bottlenecks.

Clock enable: gating matters for APB peripherals

/* Peripheral clocks are DISABLED by default to save power.
   You must enable the clock before the first register access.
   Accessing a peripheral with its clock off returns 0x00000000 on reads
   and the write is silently ignored — a common beginner bug.            */

#define RCC_BASE      0x40023800UL
#define RCC_AHB1ENR  (*(volatile uint32_t *)(RCC_BASE + 0x30U))
#define RCC_APB1ENR  (*(volatile uint32_t *)(RCC_BASE + 0x40U))
#define RCC_APB2ENR  (*(volatile uint32_t *)(RCC_BASE + 0x44U))

void enable_clocks(void)
{
    /* AHB1: enable GPIOA (bit 0) and DMA2 (bit 22) */
    RCC_AHB1ENR |= (1U << 0) | (1U << 22);

    /* APB1: enable USART2 (bit 17) and I2C1 (bit 21) */
    RCC_APB1ENR |= (1U << 17) | (1U << 21);

    /* APB2: enable SPI1 (bit 12) and TIM1 (bit 0) */
    RCC_APB2ENR |= (1U << 12) | (1U << 0);

    /* After enabling, a small delay is required for clock propagation.
       Reading the ENR register once is sufficient on STM32F4:          */
    (void)RCC_AHB1ENR;
}

12. FAQ