2. Memory and bus architecture

The device architecture relies on an Arm ^® Cortex ^® -M33 core, optimized for execution through an instruction cache that accesses the embedded flash memory.

2.1 System architecture

The architecture features a 32-bit multilayer AHB bus matrix that interconnects:

• • Masters:
  • – CPU core C-bus through ICACHE fast port, connecting to flash and SRAM memory
  • – CPU core C-bus through ICACHE slow port remapping, connecting to external memory
  • – CPU core S-bus
  • – LPDMA1
• • Slaves:
  • – Internal flash memory
  • – Internal SRAM1
  • – Internal SRAM2
  • – AHB1 peripherals including AHB to APB bridges and APB peripherals (connected to APB1 and APB2)
  • – AHB2 peripherals
  • – AHB4 peripherals including AHB to APB bridges and APB peripherals (connected to APB7)
  • – AHB5 with the 2.4 GHz RADIO peripheral
  • – AHB5 with PTACONV peripheral

The bus matrix provides access from a master to a slave, enabling concurrent access and efficient operation even when several high-speed peripherals work simultaneously. The architecture is shown in Figure 1 .

Figure 1. System architecture

2.1.1 CPU C-bus

This bus connects the C-bus of the CPU to the internal flash memory and to the bus matrix. This bus is used for instruction fetching and data access to the internal memories mapped in the code region. This bus targets the internal flash memory, internal SRAM (SRAM1 and SRAM2), and XSPI1 bank through the ICACHE address remap function.

2.1.2 CPU S-bus

This bus connects the system bus of the CPU to the bus matrix, and it is used by the core to access data located in a peripheral or SRAM area. This bus targets the internal SRAM (SRAM1 and SRAM2), XSPI1 bank, AHB1 peripherals including the APB1 and APB2 peripherals, AHB2, AHB4 peripherals including the APB7, and AHB5 peripherals.

2.1.3 LPDMA1-bus

The bus connects the AHB master interface of the LPDMA1 to the bus matrix. This targets the internal flash memory, the internal SRAM (SRAM1 and SRAM2), XSPI1 bank, AHB1 peripherals including the APB1 and APB2 peripherals, AHB2 peripherals, AHB4 peripherals including the APB7, and AHB5 peripherals.

2.1.4 Bus matrix

The bus matrix manages the access arbitration (based on fixed priority) between masters, and features a bus multiplexer used to connect each master to a given slave with no latency.

Table 1. Bus matrix access arbitration

2.1.5 AHB/APB bridges

The three bridges, AHB1 to APB1, AHB1 to APB2, and AHB4 to APB7, provide full synchronous connections between the AHB and the APB buses, resulting in the flexible selection of the peripheral frequency.

Refer to Section 2.3.2: Memory map and register boundary addresses for the address mapping of the peripherals connected to these bridges.

After each device reset, the clock of peripherals having a xxEN bit in the RCC is disabled. Before using a peripheral, its clock must be enabled in the RCC_AHBxENR and RCC_APBxENR registers.

Note: When a 16- or 8-bit access operation is performed on an APB register, it is transformed into a 32-bit access operation: the bridge duplicates the 16- or 8-bit data to feed the 32-bit vector.

The 2.4 GHz RADIO peripheral AHB5 is a semisynchronous bus, connected through a bridge to the bus matrix.

2.2 TrustZone ^® security architecture

The security architecture is based on Arm ^® TrustZone ^® with the Armv8_M mainline extension.

The TZEN option bit in the FLASH_OPTR register activates TrustZone ^® security.

When TrustZone ^® is enabled, the SAU (security attribution unit) and IDAU (implementation-defined attribution unit) define the access permissions based on secure and nonsecure states.

• • SAU: up to eight SAU configurable regions are available for security attribution.
• • IDAU: provides a first memory partition as nonsecure or nonsecure callable attributes. The IDAU memory map partition is not configurable and fixed by hardware implementation (refer to Figure 2: Memory map ). It is then combined with the results from the SAU security attribution, and the highest security state is selected.

Based on IDAU security attribution, the flash memory, system SRAMs, and peripheral memory space are aliased twice for secure and nonsecure states. However, the external memory space is not aliased.

Table 2 shows a typical example of eight SAU regions mapping, based on IDAU regions. The user can split and choose the secure, nonsecure, or NSC regions for external memories according to application requirements.

Table 2. Memory map security attribution example vs. SAU configuration regions ⁽¹⁾

1. NSC = nonsecure callable

2.2.1 Default TrustZone ^® security state

When the TrustZone ^® security is activated by the TZEN option bit in the FLASH_OPTR register, the default system security state is as detailed below:

• • CPU:
  • – Core is in a secure state after reset. The boot address must point to a secure area.
• • Memory map:
  • – SAU is fully secure after reset. Consequently, the entire memory map is fully secure. Up to eight SAU configurable regions are available for security attribution.
• • Flash memory:
  • – The flash memory security area is defined by watermark user options.
  • – Flash memory block-based security attributions are nonsecure after reset.
• • SRAMs:
  • – SRAM1 and SRAM2 are secure after reset. MPCBBx (block-based memory protection controller) is secure.
• • External memories:
  • – The XSPI bank is secure after reset. MPCWM (watermark-based memory protection controller) is secure.
• • Peripherals (see Table 3 and Table 4 for a list of securable and TrustZone ^® -aware peripherals):
  • – Securable peripherals are nonsecure after reset.
  • – TrustZone ^® -aware peripherals are nonsecure after reset. Their secure configuration registers are secure.
• • All GPIOs are secure after reset.
• • Interrupts:
  • – NVIC: all interrupts are secure after reset. NVIC is banked for secure and nonsecure states.
  • – TZIC: all illegal access interrupts are disabled after reset (see Section 5.5: GTZC interrupts ).

2.2.2 TrustZone ^® peripheral classification

When the TrustZone ^® security is active, a peripheral can be either the securable or TrustZone ^® -aware type as follows:

• • Securable: peripheral protected by an AHB/APB firewall gate controlled by the TZSC controller to define security properties
• • TrustZone ^® -aware: peripheral connected directly to the AHB or APB bus and implementing specific TrustZone ^® behavior, such as a subset of registers being secure.

Refer to Section 5: Global TrustZone ^® controller (GTZC) for more details.

Table 3 and Table 4 list the securable and TrustZone ^® -aware peripherals within the system.

Table 3. Securable peripherals by TZSC

1. Only available on STM32WBA25xx devices.

1. Only available on STM32WBA25xx devices.

2.3 Memory organization

2.3.1 Introduction

Program memory, data memory, registers and I/O ports are organized within the same linear address space.

The bytes are coded in memory in Little Endian format. The lowest numbered byte in a word is considered the word's least significant byte and the highest numbered byte the most significant.

The addressable memory space is divided into eight main blocks, of 512 Mbytes each.

2.3.2 Memory map and register boundary addresses

Figure 2. Memory map

Table 5 gives the boundary addresses of the peripherals available in the device.

!!! LINKS TO BE UPDATED !!!

Table 5. Memory map and peripheral register boundary addresses

Table 5. Memory map and peripheral register boundary addresses (continued)

Table 5. Memory map and peripheral register boundary addresses (continued)

Table 5. Memory map and peripheral register boundary addresses (continued)

Table 5. Memory map and peripheral register boundary addresses (continued)

1. Gray shaded fields are reserved.

2. Only available on STM32WBA25xx devices.

2.3.3 Embedded SRAM

The devices feature 96-Kbyte SRAMs:

• • SRAM1: 64 Kbytes
• • SRAM2: 32 Kbytes in two pages (8 Kbytes and 24 Kbytes)

The SRAMs can be accessed as bytes, half-words (16 bits), or full words (32 bits). These memories can be addressed by both the CPU and DMA.

The CPU can access the SRAMs through the system bus or using the ICACHE through the C-bus, depending on the access address.

When TrustZone ^® security is enabled, all SRAMs are secure after reset. The SRAM can be programmed as nonsecure with a block granularity. For more details, refer to Section 5: Global TrustZone ^® controller (GTZC) .

SRAM features are detailed in Section 6.3.1: Internal SRAM features .

2.3.4 Flash memory overview

The flash memory is composed of two distinct physical areas:

• • The main flash memory block, containing the application program and user data.
• • The information block, which is composed of the following parts:
  • – Option bytes for hardware and memory protection user configuration
  • – System memory containing STMicroelectronics proprietary code
  • – OTP (one-time programmable) area

The FLASH interface implements instruction access and data access based on the AHB protocol. It also implements the necessary logic to carry out the flash memory operations (program/erase) that are controlled through the FLASH registers, as well as security access control features. Refer to Section 7: Embedded flash memory (FLASH) for more details.

3 Boot modes

At startup, a BOOT0 pin, and the NBOOT0, NSWBOOT0, NSBOOTADDx/SECBOOTADD0, and TZEN option bytes are used to select the boot memory address, which includes:

• • Boot from any address in the user flash memory
• • Boot from system memory (bootloader)
• • Boot from any address in the embedded SRAM
• • Boot from root security service (RSS)

The BOOT0 value may come from the PH3-BOOT0 pin or from the option bit NBOOT0, depending on the value of a user option bit to free the GPIO pad, if needed.

The bootloader, located in the system memory, is used to program the flash memory by using USART, I2C, or SPI in device mode.

Table 6 details the boot modes when TrustZone® is disabled, and Table 7 when enabled.

Table 6. Boot modes when TrustZone® is disabled (TZEN = 0)

1. BOOT0 is either not NBOOT0 when NSWBOOT0 = 0 or pin PH3-BOOT0 when NSWBOOT0 = 1

When TrustZone® is enabled by setting the TZEN option bit, the boot space must be in the secure area. The SECBOOTADD0 option bytes are used to select the boot secure memory address.

A unique boot entry option can be selected by setting the BOOT_LOCK option bit. In this case, all other boot options are ignored.

Table 7. Boot modes when TrustZone® is enabled (TZEN = 1)

1. BOOT0 is either not NBOOT0 when NSWBOOT0 = 0 or pin PH3-BOOT0 when NSWBOOT0 = 1

2. The default NSBOOTADD0 points to a secure flash memory area, at boot privileged software must write Cortex®-M33 VTOR_NS to point to a nonsecure area.

1. 3. The default NSBOOTADD1 points to the bootloader, at boot privileged software must write Cortex®-M33 VTOR_NS to point to a nonsecure user area.

The boot address option bytes are used to program any boot memory address. However, the allowed address space depends on the flash memory read protection (RDP) level.

If the programmed boot memory address is outside of the allowed memory-mapped area when TZEN = 0 and the RDP level is 2, or when TZEN = 1 and the RDP level is 0.5 or more, the default boot fetch address is forced either in the secure flash memory or the nonsecure flash memory, depending on the TrustZone® security option, as described in Table 8 .

Table 8. Boot space versus RDP protection

1. 1. The initial NSBOOTADDx can point to a secure area. At boot, privileged software must write Cortex®-M33 VTOR_NS to point to a nonsecure user area.

The BOOT0 value (either coming from the pin or the user option) is latched upon reset release. It is up to the user to set the BOOT0 or NBOOT0 values to select the required boot mode.

The BOOT0 pin or NBOOT0 user option (depending on NSWBOOT0 in FLASH_OPTR) is also resampled when exiting standby modes. Consequently, the BOOT0 pin or user option must be kept in the required boot mode configuration in standby modes. After the startup delay, the selection of the boot area is done before releasing the processor reset.

PH3-BOOT0 GPIO is configured as follows:

• • Input mode during the complete reset phase if the NSWBOOT0 option bit is set in FLASH_OPTR, automatically switching to analog mode after reset is released (BOOT0 pin).
• • Input mode from the reset phase to the completion of the option byte loading if the NSWBOOT0 bit is cleared in FLASH_OPTR (BOOT0 value coming from the user option), automatically switches to analog mode even if the reset phase is not complete.

Embedded bootloader

The embedded bootloader is located in the system memory and is programmed by STMicroelectronics during production. Refer to AN2606: STM32 microcontroller system memory boot mode .

Embedded root security services (RSS)

The embedded RSS are located in the secure information block, programmed by STMicroelectronics during production.