1. What is a Memory Map?

A microprocessor’s memory map is a blueprint that assigns every byte of its addressable space to a purpose. When the processor puts an address on its address bus, the hardware determines which device responds — flash memory, SRAM, a peripheral register, or the system control space.

The mapping is fixed by the processor architecture and the chip vendor. ARM defines the top-level regions (code, SRAM, peripheral, system) and each chip vendor (ST, NXP, TI) then places their specific flash, SRAM, and peripherals within those regions.

2. The 32-bit Address Bus — 4 GB Space

The Cortex-M processor has a 32-bit address bus. A 32-bit address can represent 2³² = 4,294,967,296 unique byte addresses, which equals exactly 4 GB of addressable space.

/* The full 32-bit address space in one equation:
   2^32 = 4,294,967,296 bytes = 4 GB

   Addresses range from:
   0x00000000 (lowest)  to  0xFFFFFFFF (highest)
   ┌───────────────────────────────────────────┐
   │  0x00000000          →          0xFFFFFFFF │
   │       Code   SRAM   Peripheral  System ... │
   └───────────────────────────────────────────┘   */

/* Example: accessing a register at a known address */
#define GPIOA_MODER  (*(volatile uint32_t *)0x40020000U)

void set_pa5_output(void) {
    GPIOA_MODER &= ~(3U << 10);   /* clear bits 11:10 */
    GPIOA_MODER |=  (1U << 10);   /* set mode = output */
}

Even though the processor can address 4 GB, no real STM32 chip has 4 GB of actual memory. Most of the 4 GB space is simply not populated — reading from an unpopulated address causes a HardFault (bus fault). The memory map defines exactly which addresses are populated.

3. The AHB System Bus Diagram

The Cortex-M CPU core connects to all memories and peripherals through a bus called the AHB (Advanced High-performance Bus). AHB is part of ARM’s AMBA (Advanced Microcontroller Bus Architecture) specification.

For slower peripherals (UART, I2C, SPI, basic timers), the AHB connects through an APB (Advanced Peripheral Bus) bridge that runs at a lower clock frequency (50 MHz for APB1, 100 MHz for APB2 on STM32F411). The bridge handles clock domain crossing so the fast CPU does not have to wait for slow peripherals.

4. Complete ARM Cortex-M Memory Map

The ARM architecture defines the following fixed regions within the 4 GB space. Every Cortex-M chip in the world — STM32, LPC, Kinetis, SAM — uses these exact boundaries.

5. Code Region (0x00000000 – 0x1FFFFFFF)

The Code region is where the processor fetches instructions from. ARM architecture designates this 512 MB region for program memory and mandates that the vector table must be accessible here at reset.

STM32F411 Code region layout

/* Verify: the vector table at 0x08000000 mirrors to 0x00000000 */
volatile uint32_t *flash_vt  = (uint32_t *)0x08000000U;
volatile uint32_t *alias_vt  = (uint32_t *)0x00000000U;

/* These should print the same value (initial MSP) */
printf("Flash[0]: 0x%08X\n", (unsigned)flash_vt[0]);
printf("Alias[0]: 0x%08X\n", (unsigned)alias_vt[0]);

6. SRAM Region (0x20000000 – 0x3FFFFFFF)

SRAM (Static Random Access Memory) is the processor’s working memory — fast, volatile storage that loses content when power is removed. This is where the stack, heap, and all runtime data live.

7. Peripheral Region (0x40000000 – 0x5FFFFFFF)

This 512 MB region is where chip vendors place the memory-mapped registers of all on-chip peripherals. Writing to an address in this region does not write to memory — it writes to a hardware register that controls physical hardware.

On STM32F411, the peripheral region is subdivided into APB1 bus, APB2 bus, AHB1 bus, and AHB2 bus sub-regions:

/* Peripheral register access via C macros — STM32F411 */

/* RCC (Reset and Clock Control) — enables peripheral clocks */
#define RCC_BASE         0x40023800U
#define RCC_AHB1ENR     (*(volatile uint32_t *)(RCC_BASE + 0x30U))

/* GPIOA base address */
#define GPIOA_BASE      0x40020000U
#define GPIOA_MODER     (*(volatile uint32_t *)(GPIOA_BASE + 0x00U))
#define GPIOA_ODR       (*(volatile uint32_t *)(GPIOA_BASE + 0x14U))

/* Example: toggle LED on PA5 */
void init_led(void)
{
    RCC_AHB1ENR |= (1U << 0);          /* enable GPIOA clock */
    GPIOA_MODER &= ~(3U << 10);        /* PA5: clear mode bits */
    GPIOA_MODER |=  (1U << 10);        /* PA5: output mode    */
}

void toggle_led(void)
{
    GPIOA_ODR ^= (1U << 5);            /* toggle bit 5        */
}

8. External RAM and Device Regions

The 2 GB region from 0x60000000 to 0xDFFFFFFF is reserved for external memory connected through the FMC (Flexible Memory Controller) or its older variant FSMC. Not all STM32 chips have FMC — the STM32F411 does not include FMC.

9. Private Peripheral Bus (0xE0000000 – 0xE00FFFFF)

The Private Peripheral Bus (PPB) is a special 1 MB region that is the same on every single Cortex-M processor ever made. It gives access to the ARM-defined system control and debug registers. These addresses are hard-coded in the ARM architecture — they are not configurable by chip vendors.

/* PPB registers are always at these addresses on any Cortex-M */

/* NVIC Interrupt Set Enable Register 0 (enables IRQs 0–31) */
#define NVIC_ISER0   (*(volatile uint32_t *)0xE000E100U)

/* SysTick Control and Status Register */
#define SYST_CSR     (*(volatile uint32_t *)0xE000E010U)

/* SCB Application Interrupt and Reset Control Register */
#define SCB_AIRCR    (*(volatile uint32_t *)0xE000ED0CU)

/* DWT Cycle Counter */
#define DWT_CYCCNT   (*(volatile uint32_t *)0xE0001004U)
#define DWT_CTRL     (*(volatile uint32_t *)0xE0001000U)

/* Enable DWT cycle counter for timing measurements */
void dwt_enable(void)
{
    /* CoreDebug DEMCR: enable DWT */
    *(volatile uint32_t *)0xE000EDFC |= (1U << 24);
    DWT_CYCCNT = 0;
    DWT_CTRL  |= 1U;   /* CYCCNTENA */
}

uint32_t get_cycles(void) { return DWT_CYCCNT; }

10. STM32F411 Specific Memory Layout

The STM32F411xC/xE datasheet (DocID026289) defines exactly how the ARM memory regions are populated for this specific chip. Key facts:

11. Accessing Memory Regions in C Code

Now that you know what lives where, here are practical patterns for accessing each region from C.

#include <stdint.h>

/* ---- 1. Reading from Code region (flash constants) ---- */
/* The linker places const data in flash automatically */
const uint32_t lookup_table[4] = {0, 1, 4, 9};  /* lives in flash */

/* ---- 2. Writing/reading SRAM ---- */
static uint8_t dma_buffer[256];   /* in SRAM (.bss) */

/* ---- 3. Peripheral access — always volatile ---- */
#define RCC_BASE     0x40023800UL
#define GPIOA_BASE   0x40020000UL

/* Enable GPIOA clock and configure PA5 output */
void gpio_init(void)
{
    volatile uint32_t *rcc_ahb1enr = (uint32_t *)(RCC_BASE  + 0x30);
    volatile uint32_t *gpioa_moder = (uint32_t *)(GPIOA_BASE + 0x00);
    volatile uint32_t *gpioa_odr   = (uint32_t *)(GPIOA_BASE + 0x14);

    *rcc_ahb1enr |= (1U << 0);          /* GPIOAEN */
    *gpioa_moder &= ~(3U << 10);
    *gpioa_moder |=  (1U << 10);        /* PA5 output */
    *gpioa_odr   |=  (1U << 5);         /* PA5 high   */
}

/* ---- 4. PPB access — NVIC and SysTick ---- */
#define NVIC_ISER0   (*(volatile uint32_t *)0xE000E100U)
#define SYST_CSR     (*(volatile uint32_t *)0xE000E010U)
#define SYST_RVR     (*(volatile uint32_t *)0xE000E014U)

/* Configure SysTick to fire every 1 ms at 100 MHz */
void systick_init(void)
{
    SYST_RVR  = 100000U - 1U;  /* reload value: 100 MHz / 1 kHz - 1 */
    SYST_CSR  = 0x7U;           /* CLKSOURCE=1, TICKINT=1, ENABLE=1  */
}

/* ---- 5. Reading chip unique device ID (in Code region OTP area) ---- */
#define UID_BASE  0x1FFF7A10U  /* STM32F411 unique ID base */

void read_uid(uint32_t uid[3])
{
    volatile uint32_t *p = (volatile uint32_t *)UID_BASE;
    uid[0] = p[0];
    uid[1] = p[1];
    uid[2] = p[2];
}

12. FAQ