Abbreviations and Concepts

  1. r: read-only

  2. ro: read-only

  3. rw: read-write

  4. wo: wrote-only

  5. rs: read / set-on-write-1 (write 1 sets the bit; write 0 does nothing)

  6. rc_w1: read / clear-on-write-1 (write 1 clears the bit; write 0 does nothing)

  7. rw1: read / write-1-toggle (write 1 toggles the bit; write 0 does nothing)

  8. rh: read / hardware-set (only hardware can set it; software can clear or read)

  9. rc: read / clear-on-read

  10. rs_w1: read / set-on-write-1 (alias of rs)



  11. byte: 8-bit

  12. half-word: 16-bit

  13. word: 32-bit


STM32 core peripheral register regions

Address Core Peripheral
0xE000E010 ~ 0xE000E01F System Timer
0xE000E100 ~ 0xE000E4Ef NVIC - Nested Vectored Interrupt Controller
0xE000Ed00 ~ 0xE000ED3F System Control Block
0xE000ED88 ~ 0xE000ED8B FPU Coprocessor Access Control
0xE000ED90 ~ 0xE000EDB8 MPU - Memory Protection Unit (rarely used in Cortex-M4 programming)
0xE000EF00 ~ 0xE000EF03 NVIC Again
0xE000EF30 ~ 0xE000EF44 FPU - Floating Point Unit

MPU - Memory Protection Unit

1. It is not commonly used in Cortex-M4 MCU. 2. Update it in free time.

NVIC - Nested Vectored Interrupt Controller

1. The NVIC Supports: 2. The processor automatically stacks its state on exception entry and unstacks this state on exception exit, with no instruction overhead.

3. NVIC Register Summary:
Address Name Type Required Privilege Value on Reset
0xE000E100 ~ 0xE000E11F NVIC_ISER0 ~ NVIC_ISER7     (goto) RW Privileged 0x00000000
0xE000E180 ~ 0xE000E19F NVIC_ICER0 ~ NVIC_ICER7     (goto) RW Privileged 0x00000000
0xE000E200 ~ 0xE000E21F NVIC_ISPR0 ~ NVIC_ISPR7     (goto) RW Privileged 0x00000000
0xE000E280 ~ 0xE000E29F NVIC_ICPR0 ~ NVIC_ICPR7     (goto) RW Privileged 0x00000000
0xE000E300 ~ 0xE000E31F NVIC_IABR0 ~ NVIC_IABR7     (goto) RO Privileged 0x00000000
0xE000E400 ~ 0xE000E4EF NVIC_IPR0 ~ NVIC_IPR59     (goto) RW Privileged 0x00000000
0xE000EF00 NVIC_STIR     (goto) WO Configurable 0x00000000

interrupt set-enable register x (NVIC_ISERx)

0. Base Address for NVIC_ Registers: 0xE000 E000

1. Address offset: 0x0100 + 0x04 * x (x = 0 ~ 7)

2. Each NVIC_ISER register is 32-bit.

3. Bit Mapping. NVIC_ISERx[y] = interrupt 32 * x + y

4. Write.

5. Read.

6. Bits 16 ~ 31 of the NVIC_ISER7 register are reserved.

7. If a pending interrupt is enabled, the NVIC activates the interrupt based on its priority. If an interrupt is not enabled, asserting its interrupt signal changes the interrupt state to pending, but the NVIC never activates the interrupt, regardless of its priority.

interrupt clear-enable register x (NVIC_ICERx)

1. Address offset: 0x0180 + 0x04 * x (x = 0 ~ 7)

2. Each NVIC_ICER register is 32-bit.

3. Bit Mapping. NVIC_ICERx[y] = interrupt 32 * x + y

4. Write.

5. Read.

6. Bits 16 ~ 31 of the NVIC_ICER7 register are reserved.

interrupt set-pending register x (NVIC_ISPRx)

1. Address offset: 0x0200 + 0x04 * x (x = 0 ~ 7)

2. Each NVIC_ISPR register is 32-bit.

3. Bit Mapping. NVIC_ISPRx[y] = interrupt 32 * x + y

4. Write.

5. Read.

6. Bits 16 ~ 31 of the NVIC_ISPR7 register are reserved.

interrupt clear-pending register x (NVIC_ICPRx)

1. Address offset: 0x0280 + 0x04 * x (x = 0 ~ 7)

2. Each NVIC_ICPR register is 32-bit.

3. Bit Mapping. NVIC_ICPRx[y] = interrupt 32 * x + y

4. Write.

5. Read.

6. Bits 16 ~ 31 of the NVIC_ICPR7 register are reserved.

interrupt active-bit register x (NVIC_IABRx)

1. Address offset: 0x0300 + 0x04 * x (x = 0 ~ 7)

2. Each NVIC_IABR register is 32-bit.

3. Bit Mapping. NVIC_IABRx[y] = interrupt 32 * x + y

4. Read.

interrupt priority register x (NVIC_IPRx)

1. Address offset: 0x0400 + 0x04 * x (x = 0 ~ 59)

2. Each NVIC_IPR register is 32-bit.

3. The NVIC_IPRx byte-accessible registers provide 8-bit priority fields IP[N] (N = 0 ~ 239) for in total 240 interrupts.
Each priority field holds a priority value. The lower the value, the greater the priority level.
However, the Cortex-M4 only cares about bits 7 ~ 4 of each IP[N], the lower bits 3 ~ 0 are ignored. So it actually just supports 16 different priority levels (0 ~ 15)

4. Mapping of IP[N] Fields in NVIC_IPRx Regs.

Reg Bits 31 ~ 24 Bits 23 ~ 16 Bits 15 ~ 8 Bits 7 ~ 0
NVIC_IPR59 IP[239] IP[238] IP[237] IP[236]
NVIC_IPRx IP[4x + 3] IP[4x + 2] IP[4x + 1] IP[4x]
NVIC_IPR0 IP[3] IP[2] IP[1] IP[0]


software trigger interrupt register x (NVIC_STIR)

1. Address offset: 0x0E00

2. The NVIC_STIR register is 32-bit. However, ony bits 8 ~ 0 are used.

3. Require Privilege:
When USERSETMPEND bit in the SCR is set to 1, unprivileged software can access NVIC_STIR.
Only privileged software can enable the unprivileged access to the NVIC_STIR.

4. Write to this reg to generate a Software Generated Interrupt (SGI).
The value to be written is the Interrupt ID of the required SGI, in the range 0 ~ 239.
For example, a value of 0x03 specifies interrupt IRQ3.

System Control Block (SCB)

1. Summary.

Address Name Type Required Privileged Reset Value
0xE000 E008 ACTLR RW Privileged 0x00000000
0xE000 ED00 CPUID RO Privileged 0x410FC241
0xE000 ED04 ICSR RW Privileged 0x00000000
0xE000 ED08 VTOR RW Privileged 0x00000000
0xE000 ED0C AIRCR RW Privileged 0xFA050000
0xE000 ED10 SCR RW Privileged 0x00000000
0xE000 ED14 CCR RW Privileged 0x00000200
0xE000 ED18 SHPR1 RW Privileged 0x00000000
0xE000 ED1C SHPR2 RW Privileged 0x00000000
0xE000 ED20 SHPR3 RW Privileged 0x00000000
0xE000 ED24 SHCSR RW Privileged 0x00000000
0xE000 ED28 CFSR RW Privileged 0x00000000
0xE000 ED28 MMSR RW Privileged 0x00
0xE000 ED29 BFSR RW Privileged 0x00
0xE000 ED2A UFSR RW Privileged 0x0000
0xE000 ED2C HFSR RW Privileged 0x00000000
0xE000 ED34 MMFAR RW Privileged Unknown
0xE000 ED38 BFAR RW Privileged Unknown
0xE000 ED3C AFSR RW Privileged 0x00000000


Auxiliary Control Register (ACTLR)

    1. Address offset: 0x00 (base adress = 0xE000 E008)

    2. About.
    By default this reg is set to provide optimum performance for the Cortex-M4. It does not normally need modification.
    It's mainly used by SoC designers or RTOS kernels, not typical application code.
    The ACTLR register is 32-bit and provides disable bits for the following processor functions:
    3. Only the bits 9, 8, and 2, 1, 0 are used. Other bits are reserved.

    4. Mapping.

    Bit 9 Bit 8 Bit 2 Bit 1 Bit 0
    DISOOFP DISFPCA DISFOLD DISDEFWBUF DISMCYCINT
    Reserved on Cortex-M4. Reserved on Cortex-M4. Disable instruction folding. Disable write buffer. Disable multi-cycle interrupt.


    5. Bit 0 - DISMCYCINT      Useful in some real-time or debug environments. Normally you leave it as default.

    6. Bit 1 - DISDEFWBUF      Setting this slows performance but can make debugging or tightly timed peripheral writes more predictable.

    7. Bit 2 - DISFOLD      Used when you want deterministic timing — for example, cycle-accurate benchmarking or safety-critical analysis.


CPUID base register (CPUID)

  1. Address offset: 0x00 (base adress = 0xE000 ED00)

  2. Value on reset: 0x410F C241

  3. The CPUID register is 32-bit and contains the processor part number, version and implemention information.

  4. Mapping.

  5. Bits 31 ~ 24 Bits 23 ~ 20 Bits 19 ~ 16 Bits 15 ~ 4 Bits 3 ~ 0
    Implementer Variant Constant PartNo Revision
    Implementer Code. (0x41 - Arm) Variant Number. The r value in the rnpn product revision identifier. (0x0 - revision 0) Constant Value. (reads as 0xF) Part Number of the Processor. (0x0C24 - Cortex-M4) Revision Number. The p value in the rnpn product revision identifier. (0x1 - patch 1)


Interrupt Control and State Register (ICSR)

  1. Address offset: 0x04 (base adress = 0xE000 ED00)

  2. It gives you status information about:

  3. Mapping:

  4. Bit 31 Bits 30, 29 Bit 28 Bit 27 Bit 26 Bit 25 Bits 24, 23 Bit 22 Bits 21, 20, 19 Bits 18 ~ 12 Bit 11 Bits 10, 9 Bits 8 ~ 0
    NMIPENDSET (rw) Reserved PENDSVSET (rw) PENDSVCLR (w) PENDSTSET (rw) PENDSTCLR (w) Reserved ISRPENDING (r) Reserved VECTPENDING[6:0] (r) RETOBASE (r) Reserved VECTACTIVE[8:0] (rw)
    NMI set-pending bit. ... PendSV set-pending bit. PendSV clear-pending bit. This bit is write-only. On a read, value is unknown. SysTick exception set-pending bit. SysTick exception clear-pending bit. Write-only. On a read, value is unknown. Bit-24 is reserved but must be kept zero; Bit-23 is read-as-zero when the processor is not in Debug. Interrupt Service Routine Pending flag, excluding NMI and Faults. Reserved but must be kept zero. Pending vector. Indicates an exception number of the highest priority level pending enabled exception. Return to base level. Indicates whethere there are preempted active exceptions. ... Active vector. Contains the active exception number.


  5. NMIPENDSET


  6. PENDSVSET


  7. PENDSVCLR


  8. PENDSTSET
  9. PENDSTCLR


  10. ISRPENDING


  11. VECTPENDING


  12. RETOBASE


  13. VECTACTIVE




Vector Table Offset Register (VTOR)

  1. Address offset: 0x08 (base adress = 0xE000 ED00)

  2. Mapping:

  3. Bits 31, 30 Bits 29 ~ 9 Bits 8 ~ 0
    Reserved. TBLOFF[29:9] (rw) Reserved.
    Must be kept cleared. Vector Table Base Offset.
    It contains bits [29:9] of the offset of the table base from memory address 0x00000000.
    Must be kept cleared.

  4. TBLOFF


Application Interrupt and Reset Control Register (AIRCR)

  1. Address offset: 0x0C (base adress = 0xE000 ED00)

  2. Value on reset: 0xFA05 0000

  3. Mapping:

  4. Bits 31 ~ 16 Bit 15 Bits 14 ~ 11 Bits 10, 9, 8 Bits 7 ~ 3 Bit 2 Bit 1 Bit 0
    VECTKEYSTAT[15:0] (read) / VECTKEY[15:0] (write) ENDIANESS (r) Reserved. PRIGROUP[2:0] (rw) Reserved. SYS
    RESET
    REQ
    (w)
    VECT
    CLR
    ACTIVE
    (w)
    VECT
    RESET
    (w)
    Register Key.
    Reads as 0xFA05
    On writes, write 0x05FA to it, otherwise the write is ignored.
    Data Endianess Bit.
    Reads as zero, indicating little-endian.
    Must be kept cleared. Interrupt Priority Grouping Field.
    This field determines how NVIC priority bits are split between group priority and subpriority..
    Must be kept cleared. System Reset Request.
    Writing 1 requests a system-level reset (it causes the entire device to be reset — just like a hardware reset).
    Reserved for debug use. This bit reads as zero.
    When writing to the register you must write 0 to this bit, otherwise behavior is unpredictable.
    Reserved for debug use. This bit reads as zero.
    When writing to the register you must write 0 to this bit, otherwise behavior is unpredictable.



System Control Register (SCR)

  1. Address offset: 0x10 (base adress = 0xE000 ED00)

  2. Mapping:

  3. Bits 31 ~ 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
    Reserved. SEVON
    PEDN
    (rw)
    Reserved. SLEEP
    DEEP
    (rw)
    SLEEP
    ON
    EXIT
    (rw)
    Reserved.
    Kept cleared. Send Event on Pending bit. Kept cleared. Controls whether the processor uses sleep (0) or deep sleep (1) as its low power mode. Configures sleep-on-exit when returning from Handler mode to Thread mode.
    0: Do not sleep when returning to Thread mode.
    1: Enter sleep, or deep sleep, on return from an interrupt service routine.
    Kept cleared.

  4. SEVEONPEND


Configuration and Control Register (CCR)

  1. Address offset: 0x14 (base adress = 0xE000 ED00)

  2. Mapping:

  3. Bits 31 ~ 10 Bit 9 Bit 8 Bits 7 ~ 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
    Reserved. STK
    ALIGN
    (rw)
    BFHF
    NMIGN
    (rw)
    Reserved. DIV_0_TRP (rw) UNALIGN_TRP (rw) Reserved. USER
    SET
    MPEND
    (rw)
    NON
    BASE
    THRD
    ENA
    (rw)
    Kept cleared. Configures stack alignment on exception entry. Enables (1) or disables (0) handlers with priority -1 or -2 to ignore data bus faults caused by load and store instructions. Kept cleared. 0 : Do not trap divide by zero.
    1: Trap divide by zero.
    When this bit is set to 0, a divide by zero returns a quotient of 0.
    0: Do not trap unaligned halfword and word accesses.
    1: Trap unaligned halfword and word accesses with a usage fault.

    NOTE:Unaligned LDM, STM, LDRD, and STRD instructions always fault irrespective of whether it is set to 1.
    Kept cleared. Enables (1) or disables (0) unprivileged software access to the NVIC_STIR. 0: Processor can enter Thread mode only when no exception is active.
    1: Processor can enter Thread mode from any level under the control of an EXC_RETURN value.



System Handler Priority Registers (SHPRx)

  1. The SHPR1 ~ SHPR3 registers set the priority value, 0 to 255 of the exception handlers that have configurable priority.

  2. The SHPR1 ~ SHPR3 are byte accessible.



System Handler Priority Register 1 (SHPR1)

  1. Address offset: 0x18 (base adress = 0xE000 ED00)

  2. Mapping:

  3. Bits 31 ~ 24 Bits 23 ~ 16 Bits 15 ~ 8 Bits 7 ~ 0
    Reserved. PRI_6[7:0] PRI_5[7:0] PRI_4[7:0]
    Kept cleared. Priority of system handler 6, usage fault. Priority of system handler 5, bus fault. Priority of system handler 4, memory management fault.



System Handler Priority Register 2 (SHPR2)

  1. Address offset: 0x1C (base adress = 0xE000 ED00)

  2. Mapping:

  3. Bits 31 ~ 24 Bits 23 ~ 0
    Reserved. PRI_11[7:0]
    Kept cleared. Priority of system handler 11, SVCall.



System Handler Priority Register 3 (SHPR3)

  1. Address offset: 0x20 (base adress = 0xE000 ED00)

  2. Mapping:

  3. Bits 31 ~ 24 Bits 23 ~ 16 Bits 15 ~ 0
    PRI_15[7:0] PRI_14[7:0] Reserved.
    Priority of system handler 15, SysTick exception. Priority of system handler 14, PendSV. Kept cleared.



System Handler Control and State Register (SHCSR)

  1. Address offset: 0x24 (base adress = 0xE000 ED00)

  2. The SHCSR enables the system handlers, if you disable a system handler and the corresponding fault occurs, the processor treats the fault as a hard fault.

  3. Enable bits, set to 1 to enable the exception, or set to 0 to disable the exception.

  4. Pending bits, read as 1 if the exception is pending, or as 0 if it is not pending.
    You can write to these bits to change the pending status of the exceptions.

  5. Active bits, read as 1 if the exception is active, or as 0 if it is not active.
    You can write to these bits to change the active status of the exceptions.

  6. Mapping:

  7. Bits 31 ~ 19 Bit 18 Bit 17 Bit 16 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 7 Bits 6 ~ 4 Bit 3 Bit 2 Bit 1 Bit 0
    Reserved. USG
    FAULT
    ENA
    (rw)
    BUS
    FAULT
    ENA
    (rw)
    MEM
    FAULT
    ENA
    (rw)
    SV
    CALL
    PEND
    ED
    (rw)
    BUS
    FAULT
    PEND
    ED
    (rw)
    MEM
    FAULT
    PEND
    ED
    (rw)
    USG
    FAULT
    PEND
    ED
    (rw)
    SYS
    TICK
    ACT
    (rw)
    PEND
    SV
    ACT
    (rw)
    Reserved. MONIT
    OR
    ACT
    (rw)
    SV
    CALL
    ACT
    (rw)
    Reserved. USG
    FAULT
    ACT
    (rw)
    Reserved. BUS
    FAULT
    ACT
    (rw)
    MEM
    FAULT
    ACT
    (rw)
    Kept cleared. Usage fault enable bit. Bus fault enable bit. Memory management fault enable bit. SVC call pending bit. Bus fault exception pending bit. Memory management fault exception pending bit. Usage fault exception pending bit. SysTick exception active bit. PendSV exception active bit. Kept cleared. Debug monitor active bit. SVC call active bit. Kept cleared. Usage fault exception active bit. Kept cleared. Bus fault exception active bit. Memory management fault exception active bit.



Configurable Fault Status Register (CFSR)

  1. Address offset: 0x28 (base adress = 0xE000 ED00)

  2. It is made from UFSR + BFSR + MMFSR.

  3. The CFSR is byte accessible. You can access the CFSR or its subregisters as follows:

  4. Mapping:
  5. CFSR Subregisters
    Bits 31 ~ 16 Bits 15 ~ 8 Bits 7 ~ 0
    UFSR BFSR MMFSR

    CFSR Details
    Bits 31 ~ 26 Bit 25 Bit 24 Bits 23 ~ 20 Bit 19 Bit 18 Bit 17 Bit 16 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
    Reserved. DIVBY
    ZERO
    (rc_w1)
    UNALIGNED
    (rc_w1)
    Reserved. NOCP
    (rc_w1)
    INVPC
    (rc_w1)
    INV
    STATE
    (rc_w1)
    UNDEF
    INSTR
    (rc_w1)
    BFAR
    VALID
    (rw)
    Reserved. LSP
    ERR
    (rw)
    STK
    ERR
    (rw)
    UNSTK
    ERR
    (rw)
    IMPRECIS
    ERR
    (rw)
    PRECIS
    ERR
    (rw)
    IBUS
    ERR
    (rw)
    MMAR
    VALID
    (rw)
    Reserved. MLSP
    ERR
    (rw)
    MSTK
    ERR
    (rw)
    MUNSTK
    ERR
    (rw)
    Reserved. DACC
    VIOL
    (rw)
    IACC
    VIOL
    (rw)
    Kept cleared. Divide by zero usage fault.
    0: No divide by zero fault, or divide by zero trapping not enabled.
    1: The processor has executed an SDIV or UDIV instruction with a divisor of 0.
    Unaligned access usage fault.
    (Unaligned LDM, STM, LDRD, and STRD instructions always fault irrespective of the setting of UNALIGN_TRP.)
    0: No unaligned access fault, or unaligned access trapping not enabled.
    1: the processor has made an unaligned memory access.
    Kept cleared. No coprocessor usage fault.
    0: No usage fault caused by attempting to access a coprocessor.
    1: the processor has attempted to access a coprocessor.
    Invalid PC load usage fault, caused by an invalid PC load by EXC_RETURN.
    0: No invalid PC load usage fault.
    1: The processor has attempted an illegal load of EXC_RETURN to the PC, as a result of an invalid context, or an invalid EXC_RETURN value.
    Invalid state usage fault.
    0: No invalid state usage fault.
    1: The processor has attempted to execute an instruction that makes illegal use of the EPSR.
    Undefined instruction usage fault.
    0: No undefined instruction usage fault.
    1: The processor has attempted to execute an undefined instruction.
    Bus Fault Address Register (BFAR) valid flag. Kept cleared. Bus fault on floating-point lazy state preservation.
    0: No bus fault occurred during floating-point lazy state preservation.
    1: A bus fault occurred during floating-point lazy state preservation.
    Bus fault on stacking for exception entry.
    0: No stacking fault.
    1: Stacking for an exception entry has caused one or more bus faults.
    Bus fault on unstacking for a return from exception.
    0: No unstacking fault.
    1: Unstack for an exception return has caused one or more bus faults.
    Imprecise data bus error.
    0: No imprecise data bus error.
    1: A data bus error has occurred, but the return address in the stack frame is not related to the instruction that caused the error.
    Precise data bus error.
    0: No precise data bus error.
    1: A data bus error has occurred, and the PC value stacked for the exception return points to the instruction that caused the fault.
    Instruction bus error.
    0: No instruction bus error.
    1: Instruction bus error.
    Memory Management Fault Address Register (MMAR) valid flag.
    0: Value in MMAR is not a valid fault address.
    1: MMAR holds a valid fault address.
    Kept cleared. 0: No MemManage fault occurred during floating-point lazy state preservation.
    1: A MemManage fault occurred during floating-point lazy state preservation.
    Memory manager fault on stacking for exception entry.
    0: No stacking fault.
    1: Stacking for an exception entry has caused one or more access violations.
    Memory manager fault on unstacking for a return from exception.
    0: No unstacking fault.
    1: Unstack for an exception return has caused one or more access violations.
    Kept cleared. Data access violation flag.
    0: No data access violation fault.
    1: The processor attempted a load or store at a location that does not permit the operation.
    Instruction access violation flag.
    0: No instruction access violation fault.
    1: The processor attempted an instruction fetch from a location that does not permit execution.


Usage Fault Status Register (UFSR)

  1. This register is 16-bit.

  2. INVPC

  3. INVSTATE

  4. UNDEFINSTR



Bus Fault Status Register (BFSR)

  1. This register is 8-bit.

  2. BFARVALID

  3. STKERR


  4. UNSTKERR

  5. IBUSERR



Memory Management Fault Address Register (MMFSR)

  1. This register is 8-bit.

  2. MMARVALID

  3. MSTKERR

  4. MUNSTKERR

  5. DACCVIOL

  6. IACCVIOL



Hard Fault Status Register (HFSR)

  1. Address offset: 0x2C (base adress = 0xE000 ED00)

  2. This register gives information about events that activate the hard fault handler.

  3. This register is read, write to clear.
    This means that bits in the register read normally, but writing 1 to any bit clears that bit to 0.

  4. Mapping:

  5. Bit 31 Bit 30 Bits 29 ~ 2 Bit 1 Bit 0
    DEBUG_VT
    (rc_w1)
    FORCED
    (rc_w1)
    Reserved. VECTTBL
    (rc_w1)
    Reserved.
    Reserved for Debug use.
    When writing to the register you must write 0 to this bit, otherwise behavior is unpredictable.
    Forced hard fault.
    0: No forced hard fault.
    1: Forced hard fault.
    Kept cleared. Vector table hard fault.
    0: No bus fault on vector table read.
    1: Bus fault on vector table read.
    Kept cleared.


  6. FORCED


  7. VECTTBL


Memory Management Fault Address Register (MMFAR)

  1. Address offset: 0x34 (base adress = 0xE000 ED00)

  2. This register is 32-bit

  3. When the MMARVALID bit of the MMFSR is set to 1, this field holds the address of the location that generated the memory management fault.


Bus Fault Address Register (BFAR)

  1. Address offset: 0x38 (base adress = 0xE000 ED00)

  2. This register is 32-bit

  3. When the BFARVALID bit of the BFSR is set to 1, this field holds the address of the location that generated the bus fault.


Auxiliary Fault Status Register (AFSR)

  1. Address offset: 0x3C (base adress = 0xE000 ED00)

  2. This register is 32-bit

  3. It is not often used in simple projects, but it plays an important role for debugging, external fault sources, and vendor-specific extensions.

  4. Each bit can be set by implementation-specific logic to indicate auxiliary fault sources.

  5. The meaning of these bits is vendor-specific. Some MCUs never set them at all (always 0).


SysTick timer (STK)

1. Summary:

Address Name Type Required Privilege Value on Reset
0xE000 E010 STK_CTRL       (goto) RW Privileged 0x00000000
0xE000 E014 STK_LOAD      (goto) RW Privileged Unknown
0xE000 E018 STK_VAL         (goto) RW Privileged Unknown
0xE000 E01C STK_CALIB     (goto) RO Privileged 0xC0000000


2. The processor has a 24-bit system timer, SysTick, that counts down from the reload value to zero, reloads (wraps to) the value in the STK_LOAD register on the next clock edge, then counts down on subsequent clocks.

SysTick Control and Status Register (STK_CTRL)

  1. Address offset: 0x00 (base adress = 0xE000 ED10)

  2. This register is 32-bit

  3. Mapping

  4. Bits 31 ~ 17 Bit 16 Bits 15 ~ 3 Bit 2 Bit 1 Bit 0
    Reserved. COUNTFLAG
    (rw)
    Reserved. CLKSOURCE
    (rw)
    TICKINT
    (rw)
    ENABLE
    (rw)
    Kept cleared. Returns 1 if timer counted to 0 since last time this was read. Kept cleared. Selects the clock source.
    0: AHB/8
    1: Processor clock (AHB)
    SysTick exception request enable.
    0: Counting down to zero does not assert the SysTick exception request.
    1: Counting down to zero to asserts the SysTick exception request.
    Counter enable (1) or disable (1)


  5. ENABLE


SysTick Reload Value Register (STK_LOAD)

  1. Address offset: 0x04 (base adress = 0xE000 ED10)

  2. This register is 32-bit

  3. Mapping

  4. Bits 31 ~ 24 Bits 23 ~ 0
    Reserved. RELOAD[23:0]
    (rw)
    Kept cleared. RELOAD value.


  5. RELOAD



SysTick Current Value Register (STK_VAL)

  1. Address offset: 0x08 (base adress = 0xE000 ED10)

  2. This register is 32-bit

  3. Mapping

  4. Bits 31 ~ 24 Bits 23 ~ 0
    Reserved. CURRENT[23:0]
    (rw)
    Kept cleared. Current Counter Value.
    A write of any value clears the field to 0, and also clears the COUNTFLAG bit in the STK_CTRL register to 0.



SysTick Calibration Value Register (STK_CALIB)

  1. Address offset: 0x0C (base adress = 0xE000 ED10)

  2. This register is 32-bit

  3. This register indicates the SysTick calibration properties.

  4. Mapping

  5. Bit 31 Bit 30 Bits 29 ~ 24 Bits 23 ~ 0
    NOREF
    (r)
    SKEW
    (r)
    Reserved. TENMS[23:0]
    (r)
    NOREF flag. Indicates whether a reference clock (external to the processor) is provided.
    0: A reference clock (external or internal) is available — TENMS field is valid.
    1: No reference clock is provided; TENMS is not valid.
    SKEW flag. Indicates whether the 10 ms reference value in TENMS is exact (0) or only approximate (1). Kept cleared. Calibration value.
    Contains the number of SysTick clock cycles required to generate exactly 10 ms of time at the reference clock frequency.


  6. TENMS


FPU

Will be covered in the future...

Processor Modes

  1. Thread mode.


  2. Handler mode.



Privilege Levels

  1. Unprivileged.


  2. Privileged.



Core Registers

  1. Low general-purpose registers:


  2. High general-purpose registers:


  3. SP (R13)

  4. LR (R14)

  5. PC (R15)

  6. PSR

  7. PRIMASK

  8. FAULTMASK

  9. BASEPRI

  10. CONTROL



Stack Pointer (SP)

  1. The Stack Pointer (SP) is register R13.

  2. In Thread mode, 1st-bit of the CONTROL register indicates the stack pointer to use either MSP (0) or PSP (1)

  3. In Handler mode, the stack pointer is always MSP.

  4. On reset, the processor loads the MSP with the value from address 0x0000 0000.

  5. In Cortex-M4, the stack grows downward in memory (from higher address to lower address).

  6. Each push operation decrements the SP before storing data.
  7. Each pop operation loads the data and then incements the SP afterward.

  8. Therefore, the SP always points to the last valid word.


Link Register (LR)

  1. The Link Register (LR) is register R14.

  2. It stores the return information for subroutines, function calls, and exceptions.

  3. On reset, the processor loads the LR value 0xFFFF FFFF.



Program Counter (PC)

  1. The Program Counter (PC) is register R15.

  2. It holds the address of the next instruction to execute..

  3. On reset, the processor loads the PC with the value of the reset vector, which is at address 0x0000 0004.

  4. 0th-bit of the value is loaded into the EPSR T-bit at reset and must be 1.



Program Status Register (PSR)

  1. Mapping:

  2. Bit 31 Bit 30 Bit 29 Bit 28 Bit 27 Bits 26, 25 Bit 24 Bits 23 ~ 20 Bits 19 ~ 16 Bits 15 ~ 10 Bit 9 Bits 8 ~ 0
    N Z C V Q ICI/IT T Reserved. GE[3:0] ICI/IT Reserved. ISR_NUMBER
    0: Operation result was positive, zero, greater than, or equal.
    1: Operation result was negative or less than.
    0: Operation result was not zero.
    1: Operation result was zero.
    0: Add operation did not result in a carry bit or subtract operation resulted in a borrow bit.
    1: Add operation resulted in a carry bit or subtract operation did not result in a borrow bit.
    0: Operation did not result in an overflow.
    1: Operation resulted in an overflow.
    Saturation or Sticky Overflow flag.
    Could be cleared to zero by software using an MSR instruction.
    ICI: Interruptible-continuable instruction bits.
    IT: Indicates the execution state bits of the If-Then instruction.
    Thumb State Bit. ... Greater than or Equal flags See before ... This is the number of the current exception.


  3. The Q flag is set by certain DSP (Digital Signal Processing) or saturating arithmetic instructions when the result overflows its allowed range and gets saturated (clamped to the min/max value).
    Once it becomes 1, it stays 1 until software explicitly clears it.


  4. Mapping of APSR:

  5. Bit 31 Bit 30 Bit 29 Bit 28 Bit 27 Bits 26 ~ 20 Bits 19 ~ 16 Bits 15 ~ 0
    N Z C V Q Reserved. GE[3:0] Reserved.


  6. Mapping of IPSR:

  7. Bits 31 ~ 9 Bits 8 ~ 0
    Reserved. ISR_NUMBER


  8. Mapping of EPSR:

  9. Bits 31 ~ 27 Bits 26, 25 Bit 24 Bits 23 ~ 16 Bits 15 ~ 10 Bits 9 ~ 0
    Reserved. ICI/IT T Reserved. ICI/IT Reserved.


  10. Read all of the three registers with MRS instruction.
    MRS <R0 ~ R12>, PSR

  11. Write to the APSR N, Z, C, V, and Q bits using APSR_nzcvq with the MSR instruction.
    MSR APSR_nzcvq, <R0 ~ R12>

  12. When an interrupt occurs during the execution of an LDM STM, PUSH, POP, VLDM, VSTM, VPUSH, or VPOP instruction, the processor:
  13. After servicing the interrupt, the processor:

  14. When the EPSR holds ICI execution state, bits[26:25, 11:10] are zero


ISR_NUMBER



Priority Mask Register (PRIMASK)

  1. The PRIMASK register enables / disables the activation of all exceptions with configurable priority.

  2. Exceptions except NMI and HardFault all have configurable priority.

  3. Bit Assignment:
  4. Bits 31 ~ 1 Bit 0
    Reserved. PRIMASK
    ... 0: No effect.
    1: Prevents the activation of all exceptions with configurable priority.



Fault Mask Register (FAULTMASK)

  1. The FAULTMASK register prevents activation of all exceptions except for Non-Maskable Interrupt (NMI).

  2. Bit Assignment:

  3. Bits 31 ~ 1 Bit 0
    Reserved. FAULTMASK
    ... 0: No effect.
    1: Prevents the activation of all exceptions except for NMI.

  4. The processor clears the FAULTMASK bit to 0 on exit from any exception handler except the NMI handler.


Base Priority Mask Register (BASEPRI)

  1. This register defines the minimum priority for exception processing.

  2. Bit Assignment:

  3. Bits 31 ~ 8 Bits 7 ~ 4 Bits 3 ~ 0
    Reserved. BASEPRI[7:4] Reserved.
    ... 0x00: No effect.
    Non-Zero: The processor does not process any exception with a priority value greater than or equal to BASEPRI.
    ...


  4. bits[3:0] of BASEPRI are reserved (always read as 0), and are NEVER used.

  5. If you wrote 0x0000 0010 to BASEPRI, it will mask priority greater than or equal to 1.



CONTROL Register (CONTROL)

  1. This register controls the stack used and the privilege level for software execution when the processor is in Thread mode and indicates whether the FPU state is active.

  2. Bit Assignment:

  3. Bits 31 ~ 3 Bit 2 Bit 1 Bit 0
    Reserved. FPCA SPSEL nPRIV
    ... 0: No floating-point context active.
    1: Floating-point context active.
    The Cortex-M4 uses this bit to determine whether to preserve floating-point state when processing an exception.
    0: MSP is the current stack pointer.
    1: PSP is the current stack pointer.
    In Handler mode this bit reads as zero and ignores writes. The Cortex-M4 updates this bit automatically on exception return.
    Thread mode privilege level.
    0: Privileged.
    1: Unprivileged.




The Cortex microcontroller software interface standard (CMSIS)


Memory Map of Cortex-M4


  1. 0x00000000 ~ 0x1FFFFFFF 0x20000000 ~ 0x3FFFFFFF 0x40000000 ~ 0x5FFFFFFF 0x60000000 ~ 0x9FFFFFFF 0xA0000000 ~ 0xDFFFFFFF 0xE0000000 ~ 0xE00FFFFF 0xE0100000 ~ 0xFFFFFFFF
    Code
    (0.5 GB)
    SRAM
    (0.5 GB)
    Peripheral
    (0.5 GB)
    (XN)
    External RAM
    (1.0 GB)
    External Device
    (1.0 GB)
    (XN)
    Private Peripheral Bus
    (1.0 MB)
    (XN)
    Vendor-Specific Memory
    (511 MB)
    (XN)


  2. SRAM Bit Band:

  3. 0x20000000 ~ 0x200FFFFF 0x22000000 ~ 0x23FFFFFF
    Bit Band Region
    (1MB)
    Bit Band Alias
    (32MB)


  4. Peripheral Bit Band:

  5. 0x40000000 ~ 0x400FFFFF 0x42000000 ~ 0x43FFFFFF
    Bit Band Region
    (1MB)
    Bit Band Alias
    (32MB)


  6. Bit Band Region:


  7. Bit Band Alias:


  8. bit_word_offset = (byte_offset x 32) + (bit_number x 4)
    bit_word_addr   = bit_band_base + bit_word_offset
  9. The alias word at 0x23FFFFED maps to bit[0] of the bit-band byte at 0x200FFFFF:
    0x23FFFFED = 0x22000000 + (0xFFFFF x 32) + (0 x 4).


  10. Cortex-M4 is little-endian.



Exception States

  1. Inactive

  2. Pending

  3. Active

  4. Active and pending



Reset Exception Type

  1. Execution restarts as privileged execution in Thread mode.



NMI

  1. It is permanently enabled and has a fixed priority of -2.



Hard Fault

  1. A hard fault is an exception that occurs because of an error during exception processing, or because an exception cannot be managed by any other exception mechanism.

  2. Hard faults have a fixed priority of -1.



Memory Management Fault

  1. It occurs because of a memory protection related fault.

  2. The MPU or the fixed memory protection constraints determines this fault, for both instruction and data memory transactions.

  3. This fault is used to abort instruction accesses to Execute Never (XN) memory regions.



Bus Fault

  1. It occurs because of a memory related fault for an instruction or data memory transaction.



Usage Fault

  1. It occurs in case of an instruction execution fault.
    This includes:


  2. The following can cause a usage fault when the core is configured to report it:



SVCall

  1. A supervisor call (SVC) is an exception that is triggered by the SVC instruction.



PendSV

  1. PendSV is an interrupt-driven request for system-level service.

  2. In an OS environment, use PendSV for context switching when no other exception is active.



SysTick

  1. A SysTick exception is an exception the system timer generates when it reaches zero.



Interrupt (IRQ)

  1. An interrupt, or IRQ, is an exception signalled by a peripheral, or generated by a software request.

  2. All interrupts are asynchronous to instruction execution.

  3. In the system, peripherals use interrupts to communicate with the processor.


  4. Exception number IRQ number Exception type Priority Vector address or offset Activation
    1 - Reset -3, the highest 0x0000 0004 Asynchronous
    2 -14 NMI -2 0x0000 0008 Asynchronous
    3 -13 Hard fault -1 0x0000 000C -
    4 -12 Memory management fault Configurable 0x0000 0010 Synchronous
    5 -11 Bus fault Configurable 0x0000 0014 Synchronous when precise.
    Asynchronous when imprecise.
    6 -10 Usage fault Configurable 0x0000 0018 Synchronous
    7 ~ 10 - - - Reserved -
    11 -5 SVCall Configurable 0x0000 002C Synchronous
    12, 13 - - - Reserved -
    14 -2 PendSV Configurable 0x0000 0038 Asynchronous
    15 -1 SysTick Configurable 0x0000 003C Asynchronous
    16 and above 0 and above Interrupt (IRQ) Configurable 0x0000 0040 and above Asynchronous


Exception Handlers

  1. Interrupt Servie Routines (ISRs)


  2. Fault Handlers


  3. System Handlers




Vector Table

  1. It contains the reset value of the stack pointer, and the start addresses for all exception handlers.

  2. The least-significant bit of each vector must be 1.


  3. Exception number IRQ number Offset Vector
    - - 0x0000 Initial SP value
    1 - 0x0004 Reset
    2 - 0x0008 NMI
    3 - 0x000C Hard fault
    4 - 0x0010 Memory management fault
    5 - 0x0014 Bus fault
    6 - 0x0018 Usage fault
    7 ~ 10 - - Reserved.
    11 - 0x002C SVCall
    12 - - Reserved for Debug
    13 - - Reserved.
    14 - 0x0038 PendSV
    15 - 0x003C Systick
    16 0 0x0040 IRQ0
    17 1 0x0044 IRQ1
    18 2 0x0048 IRQ2
    . . . .
    n n - 16 0x0040 + 4 x (n - 16) IRQn
    . . . .
    255 239 0x03FC IRQ239


  4. On system reset, the vector table is fixed at address 0x0000 0000.

  5. Privileged software can write to the VTOR to relocate the vector table start address to a different memory location,
    in the range 0x00000080 to 0x3FFFFF80.



Exception Priorities

  1. A lower priority value indicating a higher priority.

  2. Configurable priorities for all exceptions except Reset, Hard fault, and NMI.

  3. If software does not configure any priorities, then all exceptions with a configurable priority have a priority of 0.

  4. Configurable priority values are in the range 0 ~ 15.

  5. When the processor is executing an exception handler, the exception handler is preempted if a higher priority exception occurs.
    If an exception occurs with the same priority as the exception being handled, the handler is not preempted, irrespective of the exception number.



Interrupt Priority Grouping

  1. This divides each interrupt priority register entry into two fields:


  2. Only the group priority determines preemption of interrupt exceptions.
    When the processor is executing an interrupt exception handler, another interrupt with the same group priority as the interrupt being handled does not preempt the handler..

  3. If multiple pending interrupts have the same group priority, the subpriority field determines the order in which they are processed.

  4. If multiple pending interrupts have the same group priority and subpriority, the interrupt with the lowest IRQ number is processed first.



Exception Entry

  1. Preemption

  2. Return

  3. Tail-chaining

  4. Late-arriving



Exception Return

  1. Exception entry occurs when there is a pending exception with sufficient priority and either:

  2. When the processor takes an exception, unless the exception is a tail-chained or a late-arriving exception, the processor pushes information onto the current stack.
    This operation is referred as stacking and the structure of eight data words is referred as stack frame.


  3. When using floating-point routines, the Cortex-M4 processor automatically stacks the architected floating-point state on exception entry.
  4. Where stack space for floating-point state is not allocated, the stack frame is the same as that of Armv7-M implementations without an FPU.


  5. Exception frame with floating-point storage.

  6. Stack Order (from SP) Register
    SP + 0x20 {Aligner}
    SP + 0x1C xPSR
    SP + 0x18 PC (R15)
    SP + 0x14 LR (R14)
    SP + 0x10 R12
    SP + 0x0C R3
    SP + 0x08 R2
    SP + 0x04 R1
    SP + 0x00 R0


  7. Exception frame without floating-point storage.

  8. Stack Order (from SP) Register
    {Aligner}
    FPSCR
    S15
    S14
    S13
    S12
    S11
    S10
    S9
    S8
    S7
    S6
    S5
    S4
    S3
    S2
    S1
    S0
    SP + 0x1C xPSR
    SP + 0x18 PC (R15)
    SP + 0x14 LR (R14)
    SP + 0x10 R12
    SP + 0x0C R3
    SP + 0x08 R2
    SP + 0x04 R1
    SP + 0x00 R0


  9. The alignment of the stack frame is controlled via the STKALIGN-bit of the Configuration Control Register (CCR).

  10. In parallel to the stacking operation, the processor performs a vector fetch that reads the exception handler start address from the vector table.
    When stacking is complete, the processor starts executing the exception handler.
    At the same time, the processor writes an EXC_RETURN value to the LR. This indicates which stack pointer corresponds to the stack frame and what operation mode the was processor was in before the entry occurred.

  11. If another higher priority exception occurs during exception entry, the processor starts executing the exception handler for this exception and does not change the pending status of the earlier exception.
    This is the late arrival case.

  12. Exception return occurs when the processor is in Handler mode and executes one of the following instructions to load the EXC_RETURN value into the PC:

  13. The lowest five bits of this value provide information on the return stack and processor mode.
    And all EXC_RETURN values have bits[31:5] set to one.


  14. EXC_RETURN[31:0] Description
    0xFFFF FFF1 Return to Handler mode.
    Exception return uses non-floating-point state from the MSP and execution uses MSP after return.
    0xFFFF FFF9 Return to Thread mode.
    Exception return uses non-floating-point state from MSP and execution uses MSP after return.
    0xFFFF FFFD Return to Thread mode.
    Exception return uses non-floating-point state from the PSP and execution uses PSP after return.
    0xFFFF FFE1 Return to Handler mode.
    Exception return uses floating-point-state from MSP and execution uses MSP after return.
    0xFFFF FFE9 Return to Thread mode.
    Exception return uses floating-point state from MSP and execution uses MSP after return.
    0xFFFF FFED Return to Thread mode.
    Exception return uses floating-point state from PSP and execution uses PSP after return.



Fault Types

Fault Handler Bit Name Fault Status Register
Bus error on a vector read. Hard fault VECTTBL HFSR
Fault escalated to a hard fault. Hard fault FORCED HFSR
MPU or default memory map mismatch on instructions access MemManage IACCVIOL MMFAR
MPU or default memory map mismatch on data access MemManage DACCVIOL MMFAR
MPU or default memory map mismatch during exception stacking MemManage MSTKERR MMFAR
MPU or default memory map mismatch during exception unstacking MemManage MUNSTKERR MMFAR
MPU or default memory map mismatch during lazy FP state preservation MemManage MLSPERR MMFAR
Bus error during exception stacking Bus fault STKERR BFAR
Bus error during exception unstacking Bus fault UNSTKERR BFAR
Bus error during instruction prefetch Bus fault IBUSERR BFAR
Bus error during lazy FU state preservation Bus fault LSPERR BFAR
Precise data bus error Bus fault PRECISERR BFAR
Imprecise data bus error Bus fault IMPRECISERR BFAR
Attempt to access a coprocessor Usage fault NOCP CFSR
Undefined instruction Usage fault UNDEFINSTR CFSR
Attempt to enter an invalid instruction set state Usage fault INVSTATE CFSR
Invalid EXC_RETURN value Usage fault INVPC CFSR
Illegal unaligned load or store Usage fault UNALIGNED CFSR
Divide by 0 Usage fault DIVBYZERO CFSR


Fault Escalation and Hard Faults

  1. In some situations, a fault with configurable priority is treated as a hard fault.
    This is called priority escalation, and the fault is described as escalated to hard fault.



  2. if a corrupted stack causes a fault, the fault handler executes even though the stack push for the handler failed.
    The fault handler operates but the stack contents are corrupted.

  3. Only Reset and NMI can preempt the fixed priority hard fault.
    A hard fault can preempt any exception other than Reset, NMI, or another hard fault.



Lockup

  1. The processor enters a lockup state if a hard fault occurs when executing the NMI or hard fault handlers.

  2. The processor remains in lockup state until either:

  3. If lockup state occurs from the NMI handler a subsequent NMI does not cause the processor to leave lockup state.



Power Management

  1. The STM32 and Cortex-M4 processor sleep modes reduce power consumption.

  2. The SLEEPDEEP-bit of the SCR selects which sleep mode is used.



Entering Sleep Mode

  1. Wait for interrupt.



  2. Wait for event.



  3. If the SLEEPONEXIT-bit of the SCR is set to 1, when the processor completes the execution of an exception handler, it returns to Thread mode and immediately enters sleep mode.



Wakeup from Sleep Mode




Instruction Set

  1. Op2 is a flexible operand that can be either a register or a constant.

  2. S is optional, if specified, the condition code flags (N, Z, C, V) are updated on the result of the operation.

  3. cond is an optional suffix.

  4. Shift is an optional shift to be applied to Rm.
    It can be one of the following:

  5. Summary:

  6. Mnemonic Description Flags
    ADD{S}{cond} Rd, Rn, Op2 N, Z, C, V
    ADC{S}{cond} Rd, Rn, Op2 N, Z, C, V
    ADR Rd, label --
    AND{S}{cond} Rd, Rn, Op2 N, Z, C
    ASR{S}{cond} Rd, Rm, <Rs|#n> N, Z, C



Restrictions when using PC or SP

  1. 0th-bit of any address written to the PC with a BX , BLX , LDM , LDR , or POP instruction must be 1 for correct execution.
    Because this bit indicates the required instruction set, and the Cortex-M4 processor only supports thumb instructions.



Conditional Code Suffixes

  1. Summary:

  2. Suffix Flags Description
    EQ Z = 1 EQual
    NE Z = 0 Not Equal
    CS or HS C = 1 Higher or Same. Unsigned ≥
    CC or LO C = 0 LOwer. Unsigned <
    MI N = 1 MInus (negative)
    PL N = 0 PLus (positive or zero)
    VS V = 1 OVerflow Set
    VC V = 0 OVerflow Cleared
    HI C = 1 and Z = 0 HIgher. Unsigned >
    LS C = 0 or Z = 1 Lower or Same. Unsigned ≤
    GE N = V Greater or Equal. Signed ≥
    LT N != V Less Than. Signed <
    GT Z = 0 and N = V Greater Than. Signed >
    LE Z = 1 or N != V Less or Equal. Signed ≤
    AL - ALways. This is the default when no suffix is sepcified.


  3. Example Usage:
  4. CMP   R0, #10      ; Compare R0 with 10, sets flags
    BGE   greater_eq   ; Branch if R0 >= 10  (N == V)
    ADDNE R1, R1, #1   ; Increment R1 if R0 != 10  (Z == 0)



ADD, ADC, SUB, SBC, and RSB

  1. Syntax:
  2. op{S}{cond} {Rd, } Rn, Op2
    op{cond} {Rd, } Rn, #imm12  ; ADD and SUB only

  3. 'op'


  4. 'S'


  5. 'cond'


  6. 'Rd'


  7. 'Rn'


  8. 'imm12'