2. Memory and bus architecture

2.1 System architecture

The device architecture relies on an Arm ^® Cortex ^® -M33 core optimized for execution, thanks to an instruction cache with a direct access to the embedded flash memory.

The architecture features a 32-bit multilayer AHB bus matrix interconnecting masters and slaves:

• • Masters:
  • – CPU core C-bus through 128-bit wide ICACHE connecting to flash memory
  • – CPU core C-bus through 32-bit wide ICACHE connecting to SRAM
  • – CPU core S-bus
  • – GPDMA1 port 0
  • – GPDMA1 port 1
  • – USB OTG_HS
• • Slaves:
  • – Internal flash memory on the CPU core C-bus
  • – Internal flash memory on the GPDMA1 bus
  • – Internal SRAM1
  • – Internal SRAM2
  • – AHB1 peripherals including AHB to APB bridges and APB peripherals (connected to APB1 and APB2)
  • – AHB2 peripherals
  • – AHB4 peripherals including AHB to APB bridges and APB peripherals (connected to APB7)
  • – AHB5 with the 2.4 GHz RADIO peripheral

The bus matrix provides access from a master to a slave, enabling concurrent access and efficient operation even when several high-speed peripherals work simultaneously. The architecture is shown in Figure 1 .

Figure 1. System architecture

2.1.1 CPU C-bus

This bus connects the C-bus of the CPU to the internal flash memory and to the bus matrix via the instruction cache. This bus is used for instruction fetch and data access to the internal memories mapped in code region. This bus targets the internal flash memory and the internal SRAM (SRAM1 and SRAM2) via the ICACHE address remap function.

2.1.2 CPU S-bus

This bus connects the system bus of the CPU to the bus matrix, and it is used by the core to access data located in a peripheral or SRAM area. This bus targets the internal SRAM (SRAM1 and SRAM2), the AHB1 peripherals including the APB1 and APB2 peripherals, AHB2, AHB4 peripherals including the APB7, and AHB5 peripherals.

2.1.3 GPDMA1-bus

The buses connect the two AHB master interfaces of the GPDMA1 to the bus matrix. This targets the internal flash memory, the internal SRAMs (SRAM1, SRAM2), the AHB1 peripherals including the APB1 and APB2 peripherals, the AHB2 peripherals, AHB4 peripherals including the APB7, and AHB5 peripherals.

2.1.4 USB OTG_HS-bus

The bus connects the AHB master interfaces of the USB OTG_HS to the bus matrix. This bus is used by the USB OTG_HS to load and store data in memory. This targets the internal flash memory and the internal SRAMs (SRAM1, SRAM2).

2.1.5 Bus matrix

The bus matrix manages the access arbitration (based on fixed priority) between masters, and features a bus multiplexer used to connect each master to a given slave without latency.

Table 1. Bus matrix access arbitration

2.1.6 AHB/APB bridges

The three bridges (AHB1 to APB1, AHB1 to APB2, and AHB4 to APB7) provide full synchronous connections between the AHB and the APB buses, resulting in flexible selection of the peripheral frequency.

Refer to Section 2.3.2: Memory map and register boundary addresses for the address mapping of the peripherals connected to these bridges.

After each device reset, the clock of peripherals having an xxEN bit in the RCC is disabled. Before using a peripheral, its clock must be enabled in the RCC_AHBxENR and RCC_APBxENR registers.

Note: When a 16- or 8-bit access is performed on an APB register, the access is transformed into a 32-bit access: the bridge duplicates the 16- or 8-bit data to feed the 32-bit vector.

AHB5 is a semisynchronous bus, connected through a bridge to the bus matrix.

2.2 TrustZone ^® security architecture

The security architecture is based on Arm ^® TrustZone with the Armv8-M mainline extension.

The TZEN option bit in the FLASH_OPTR register activates TrustZone security.

When the TrustZone is enabled, the SAU (security-attribution unit) and IDAU (implementation-defined-attribution unit) defines the access permissions based on secure and nonsecure states.

• • SAU: up to eight SAU configurable regions are available for security attribution.
• • IDAU: provides a first memory partition as nonsecure or nonsecure callable attributes. The IDAU memory map partition is not configurable and fixed by hardware

implementation (refer to Figure 2: Memory map ). It is then combined with the results from the SAU security attribution, and the higher security state is selected.

Based on IDAU security attribution, the flash memory, system SRAMs and peripherals memory space are aliased twice for secure and nonsecure states. However, the external memories space is not aliased.

Table 2 shows a typical example of eight SAU regions mapping, based on IDAU regions. The user can split and choose the secure, nonsecure or NSC regions for external memories according to application needs.

Table 2. Memory map security attribution example vs. SAU configuration regions ⁽¹⁾

1. NSC = nonsecure callable

2.2.1 Default TrustZone security state

When the TrustZone security is activated by the TZEN option bit in the FLASH_OPTR, the default system security state is detailed below:

• • CPU:
  • – CPU1 Cortex-M33 is in secure state after reset. The boot address must point to a secure area.
• • Memory map:
  • – SAU is fully secure after reset. Consequently, all memory map is fully secure. Up to height SAU configurable regions are available for security attribution.
• • Flash memory:
  • – The flash memory security area is defined by watermark user options.
  • – Flash block-based security attributions are nonsecure after reset.
• • SRAMs:
  • – All SRAMs are secure after reset. MPCBBx (block-based memory protection controller) are secure.
• • Peripherals (see Table 3 and Table 4 for a list of securable and TrustZone-aware peripherals)
  • – Securable peripherals are nonsecure after reset.
  • – TrustZone-aware peripherals are nonsecure after reset. Their secure configuration registers are secure.
• • All GPIOs are secure after reset.
• • Interrupts:
  • – NVIC: All interrupts are secure after reset. NVIC is banked for secure and nonsecure state.
  • – TZIC: All illegal access interrupts are disabled after reset (see Section 5.5: GTZC interrupts ).

2.2.2 TrustZone peripheral classification

When the TrustZone security is active, a peripheral can be either securable or TrustZone-aware type as follows:

• • Securable: peripheral protected by an AHB/APB firewall gate controlled from TZSC controller to define security properties
• • TrustZone-aware: peripheral connected directly to AHB or APB bus and implementing a specific TrustZone behavior such as a subset of registers being secure.

Refer to Section 5: Global TrustZone controller (GTZC) for more details.

Table 3 and Table 4 list the securable and TrustZone-aware peripherals within the system.

Table 3. Securables peripherals by TZSC

Table 3. Securable peripherals by TZSC (continued)

1. Available only on STM32WBA62/64/65xx devices

1. 2. Available only on STM32WBA62/65xx devices

1. 1. Available only on STM32WBA62/65xx devices.
   2. Available only on STM32WBA62/64/65xx devices.

2.3 Memory organization

2.3.1 Introduction

Program memory, data memory, registers and I/O ports are organized within the same linear address space.

The bytes are coded in memory in Little Endian format. The lowest numbered byte in a word is considered the word's least significant byte and the highest numbered byte the most significant.

2.3.2 Memory map and register boundary addresses

Figure 2. Memory map

STM32WBA6xxl devices contain a 2-Mbyte flash memory from address offset 0x00 0000 to 0x1F FFFF, and SRAM1 448-Kbyte from address offset 0x0 0000 to 0x6 FFFF, (continuous SRAM space with SRAM2).

STM32WBA6xxG devices contain a 1-Mbyte flash memory from address offset 0x00 0000 to 0x0F FFFF, and SRAM1 192-Kbyte from address offset 0x0 0000 to 0x2 FFFF, (noncontinuous SRAM space with SRAM2).

Any memory area not allocated to on-chip memories and peripherals is considered “Reserved”.

Table 5 gives the boundary addresses of the peripherals available in the device.

Table 5. Memory map and peripheral register boundary addresses

Table 5. Memory map and peripheral register boundary addresses (continued)

Table 5. Memory map and peripheral register boundary addresses (continued)

Table 5. Memory map and peripheral register boundary addresses (continued)

1. Gray shaded fields are reserved.

2. Available only on STM32WBA62/65xx devices.

3. Available only on STM32WBA62/64/65xx devices.

4. Device-dependent (STM32WBA6xxI 448-Kbyte SRAM1 offset 0x0 0000 - 0x6 FFFF, STM32WBA6xxG 192-Kbyte SRAM1 offset 0x0 0000 - 0x2 FFFF where 0x3 0000 - 0x6 FFFF is reserved).

5. Device-dependent (STM32WBA6xxI 2-Mbyte flash offset 0x00 0000 - 0x1F FFFF, STM32WBA6xxG 1-Mbyte flash offset 0x00 0000 - 0x0F FFFF where 0x10 0000 - 0x1F FFFF is reserved).

2.3.3 Embedded SRAM

The devices feature 512 Kbytes of SRAM:

• • SRAM1: up to 448 Kbytes (192 Kbytes on STM32WBA6xxG, 448 Kbytes on STM32WBA6xxI)
• • SRAM2: 64 Kbytes

These SRAMs can be accessed as bytes, half-words (16 bits) or full words (32 bits). These memories can be addressed both by CPU and DMA.

The CPU can access the SRAM1, and SRAM2 through the system bus or, when remapped in the I-CACHE, through the C-bus, depending on the selected address.

When TrustZone security is enabled, all SRAMs are secure after reset. The SRAM can be programmed as nonsecure with a block granularity. For more details, refer to Section 5: Global TrustZone controller (GTZC) .

SRAM features are detailed in Section 6.3.1: Internal SRAMs features .

2.3.4 Flash memory overview

The flash memory is composed of two distinct physical areas:

• • The main flash memory block contains the application program and user data.
• • The information block, composed of the following parts:
  • – option bytes for hardware and memory protection user configuration
  • – system memory, which contains ST proprietary code
  • – OTP (one-time programmable) area

The flash interface implements instruction access and data access based on the AHB protocol. It also implements the logic necessary to carry out the flash memory operations (program/erase) controlled through the flash registers plus security access control features. Refer to Section 7: Embedded flash memory (FLASH) for more details.