Overview

The MPU can be used to make an embedded system more robust and more secure by:

prohibiting the user applications from corrupting data used by critical tasks (such as the operating system kernel)
defining the SRAM memory region as a non-executable (execute never XN) to prevent code injection attacks
changing the memory access attributes

The MPU can be used to protect up to 16 memory regions. In Armv6 and Armv7 architecture (Cortex-M0+, M3, M4, and M7, these regions in turn can have eight subregions, if the region is at least 256 bytes. The exact amount of regions protected can vary between core and devices in the STM32, refer to Table 6 MPU register summary for more details. The subregions are always of equal size, and can be enabled or disabled by a subregion number. Because the minimum region size is driven by the cache line length (32 bytes), eight subregions of 32 bytes correspond to a 256-byte size.

The regions are numbered 0 to 15. In addition, there is a region called the default region with an id of -1. All the 0-15 memory regions take priority over the default region.

The regions can overlap, and can be nested. The region 15 has the highest priority and the region 0 has the lowest one and this governs how overlapping the regions behave. The priorities are fixed, and cannot be changed.

In Armv8 architecture (Cortex-M33 and M55) the regions are defined using a base and a limit address offering flexibility and simplicity to the developer on the way to organize them. Additionally, Cortex-M33 and M55 do not include subregions as the region size is now more flexible.

The figure below shows an example with six regions. This example shows the region 4 overlapping the regions 0 and 1. The region 5 is enclosed completely within the region 3. Since the priority is in an ascending order, the overlap regions (in orange) have the priority. So, if the region 0 is writeable and the region 4 is not, an address falling in the overlap between 0 and 4 is not writeable.

Figure 1. Example of overlapping regions

CAUTION:

In Armv8 architecture, regions are now not allowed to overlap. As the MPU region definition is much more flexible, overlapping MPU regions is not necessary.

The MPU is unified, meaning that there are not separate regions for the data and the instructions.

The MPU can be used also to define other memory attributes such as the cacheability, which can be exported to the system level cache unit, or to the memory controllers. The memory attribute settings in Arm® architecture can support two levels of cache: inner cache and outer cache. For the STM32F7 and STM32H7 series, only one level of cache (L1-cache) is supported.

The cache control is done globally by the cache control register, but the MPU can specify the cache policy and whether the region is cacheable or not.

Memory model

In STM32 products, the processor has a fixed default memory map that provides up to 4 Gbytes of addressable memory.

Figure 2. Cortex-M0+/M3/M4/M7 processor memory map

Figure 3. Cortex-M33 processor memory map

Table 2. Default memory map for the Cortex-M55 processor
Address range (inclusive)	Region	Interface
0x00000000-0x1FFFFFFF	Code	All accesses are performed on the instruction tightly coupled memory (ITCM) or manager-AXI (M-AXI) interface.
0x20000000-0x3FFFFFFF	SRAM	All accesses are performed on the data tightly coupled memory (DTCM) or M-AXI interface.
0x40000000-0x5FFFFFFF	Peripheral	Data accesses are performed on peripheral AHB (P-AHB) or M-AXI interface. Instruction accesses are performed on M-AXI.
0x60000000-0x9FFFFFFF	External RAM	All accesses are performed on the M-AXI interface
0xA0000000-0xDFFFFFFF	External device	All accesses are performed on the M-AXI interface.
0xE0000000-0xE00FFFFF	Private peripheral bus (PPB)	Instruction fetches are not supported. Reserved for system control and debug. Data accesses are either performed internally or on external private peripheral bus (EPPB).
0xE0100000-0xFFFFFFFF	Vendor_SYS	Instruction fetches are not supported. 0xE0100000-0xEFFFFFFF is reserved. Vendor resources start at 0xF0000000. Data accesses are performed on P-AHB interface.

Cortex-M0+/M3/M4/M7 memory types, registers and attributes

The memory map and the programming of the MPU split the memory map into regions. Each region has a defined memory type, and memory attributes. The memory type and attributes determine the behavior of accesses to the region.

Memory types

There are three common memory types:

Normal memory: allows the load and store of bytes, half-words, and words to be arranged by the CPU in an efficient manner (the compiler is not aware of memory region types). For the normal memory region, the load/store is not necessarily performed by the CPU in the order listed in the program.
Device memory: within the device region, the loads and stores are done strictly in order. This is to ensure that the registers are set in the proper order.
Strongly ordered memory: everything is always done in the programmatically listed order, where the CPU waits the end of load/store instruction execution (effective bus access) before executing the next instruction in the program stream. This can cause a performance hit.

MPU register description

The MPU registers are located at 0xE000 ED90. There are five basic MPU registers and a number of alias registers for region. The following are used to set up regions in the MPU:

MPU_TYPE: read-only register used to detect the MPU presence.
MPU_CTRL: control register.
MPU_RNR: region number, used to determine which region operations are applied to.
MPU_RBAR: region base address.
MPU_RASR: region attributes and size.
MPU_RBAR_An: alias n of MPU_RBAR, where n is 1 to 3.
MPU_RASR_An: alias n of MPU_RASR, where n is 1 to 3.

Note:

The Cortex-M0+ does not implement the MPU_RBAR_An and MPU_RASR_An registers.

For more details about the MPU registers, refer to the programming manuals listed in Introduction.

Memory attributes

The region attributes and size register (MPU_RASR) are where all the memory attributes are set. The table shows a brief description of the region attributes and size in the MPU_RASR register.

Table 3. Region attributes and size in MPU_RASR register
Bits	Name	Description
28	XN	Execute never
26:24	AP	Data access permission field (RO, RW, or No access)
21:19	TEX	Type extension field
18	S	Shareable
17	C	Cacheable
16	B	Bufferable
15:8	SRD	Subregion disabled. For each subregion 1 = disabled, 0 = enabled.
5:1	SIZE	Specifies the size of the MPU protection region.

Parameters of the previous table are detailed below:

The XN flag controls the code execution. In order to execute an instruction within the region, there must be read access for the privileged level, and XN must be 0. Otherwise, a MemManage fault is generated.

The data access permission (AP) field defines the AP of memory region. The table below illustrates the access permissions:

Table 4. Access permissions of regions
AP[2:0]	Privileged permissions	Unprivileged permissions	Description
000	No access	No access	All accesses generate a permission fault
001	RW	No access	Access from a privileged software only
010	RW	RO	Written by an unprivileged software generates a permission fault
011	RW	RW	Full access
100	Unpredictable	Unpredictable	Reserved
101	RO	No access	Read by a privileged software only
110	RO	RO	Read only, by privileged or unprivileged software
111	RO	RO	Read only, by privileged or unprivileged software

The S field is for a shareable memory region: the memory system provides data synchronization between bus masters in a system with multiple bus masters, for example, a processor with a DMA controller. A strongly-ordered memory is always shareable. If multiple bus masters can access a non-shareable memory region, the software must ensure the data coherency between the bus masters. The STM32F7 series and STM32H7 series do not support hardware coherency. The S field is equivalent to non-cacheable memory.

The TEX, C and B bits are used to define cache properties for the region, and to some extent, its shareability. They are encoded as per the following table.

Table 5. Cache properties and shareability
TEX	C	B	Memory type	Description	Shareable
000	0	0	Strongly ordered	Strongly ordered	Yes
000	0	1	Device	Shared device	Yes
000	1	0	Normal	Write through, no write allocate	S bit
000	1	1	Normal	Write-back, no write allocate	S bit
001	0	0	Normal	Non-cacheable	S bit
001	0	1	Reserved	Reserved	Reserved
001	1	0	Undefined	Undefined	Undefined
001	1	1	Normal	Write-back, write and read allocate	S bit
010	0	0	Device	Non-shareable device	No
010	0	1	Reserved	Reserved	Reserved

The subregion disable bits (SRD) flag whether a particular subregion is enabled or disabled. Disabling a subregion means that another region overlapping the disabled range matches instead. If no other enabled region overlaps the disabled subregion, the MPU issues a fault.

For the products that implement a cache (only for STM32F7 series and STM32H7 series that implement L1-cache) the additional memory attributes include:

Cacheable/non-cacheable: means that the dedicated region can be cached or not.
Write through with no write allocate: on hits, it writes to the cache and the main memory. On misses it updates the block in the main memory not bringing that block to the cache.
Write-back with no write allocate: on hits, it writes to the cache setting dirty bit for the block. The main memory is not updated. On misses, it updates the block in the main memory not bringing that block to the cache.
Write-back with write and read allocate: on hits it writes to the cache setting dirty bit for the block, the main memory is not updated. On misses it updates the block in the main memory and brings the block to the cache.

Note: For Cortex-M7, TCMs memories always behave as non-cacheable, non-shared normal memories, irrespective of the memory type attributes defined in the MPU for a memory region containing addresses held in the TCM.

Otherwise, the access permissions associated with an MPU region in the TCM address space are treated in the same way as addresses outside the TCM address space.