3.4. Memory model

The processor contains a bus matrix that arbitrates the processor core and optional DAP memory accesses to both the external memory system and to the internal NVIC and debug components.Priority is always given to the processor to ensure that any debug accesses are as non-intrusive as possible. For a zero wait-state system, all debug accesses to system memory, NVIC, and debug resources are non-intrusive for typical code execution.The system memory map is ARMv8-M baseline architecture compliant, and is common both to the debugger and processor accesses.

The processor supports only word size accesses in the range 0xE0000000-0xEFFFFFFF.

The default memory map provides user and privileged access to all regions except for the Private Peripheral Bus (PPB). The PPB space is privileged access only.

Table 3.2 shows the default memory map. This is the memory map that is used by implementations without the optional MPUs, or when the included MPUs are disabled. The attributes and permissions of all regions, except that targeting the Cortex-M23 processor NVIC and debug components, can be modified using an implemented MPU.

Table 3.2. Default memory map

Address regionRegion nameMemory typeInstruction accessesData accessesDescription
0x00000000 - 0x1FFFFFFFCodeNormalAMBA 5 AHB portAMBA 5 AHB port or I/O port[a]

Typically ROM or Flash.

Vector table that is required for boot-up resides here by default.

Supports code.

0x20000000 - 0x3FFFFFFFSRAMNormalAMBA 5 AHB portAMBA 5 AHB port or I/O port[a]

On chip RAM.

Supports code.

0x40000000 - 0x5FFFFFFFPeripheralDevice-AMBA 5 AHB port or I/O port[a]

On chip peripherals.


0x60000000 - 0x9FFFFFFFRAMNormalAMBA 5 AHB portAMBA 5 AHB port or I/O port[a]

Supports code.

0xA0000000 - 0xDFFFFFFFDeviceDevice-AMBA 5 AHB port or I/O port[a]XN.
0xE0000000 - 0xE003FFFFPPB--Internal PPB interfaceSCS, NVIC, MPU, and SAU registers.
0xE0040000 - 0xE004FFFFDeviceDeviceAMBA 5 AHB portAMBA 5 AHB port or I/O port[a]

MTB, ETM, CTI, TPIU configuration registers when implemented.


0xE0050000 - 0xE00EFFFFPPB--Internal PPB interface



0xE00F0000 - 0xE00FFFFFDeviceDeviceAMBA 5 AHB portAMBA 5 AHB port or I/O port[a]

Cortex-M23 MCU ROM when implemented.


0xE0100000 - 0xFFFFFFFF Vendor_SYSDevice-AMBA 5 AHB port or I/O port[a]

Suitable for CoreSight ROM tables and other CoreSight components.


[a] Only when the I/O port is included.


  • Regions that are marked as eXecute-Never (XN) generate a HardFault exception if code attempts to execute from such a location.

  • If an MPU is included, it can be used to control accesses to all regions other than the PPB. Attempted accesses that do not meet the required privilege level for the respective region are not performed on the bus and cause a HardFault exception.

  • The MPU can override all region attributes except the PPB space. See Chapter 6 Security Attribution and Memory Protection.

  • Some regions can be defined as secure by the SAU and/or the IDAU. In this case a Non-secure access triggers a secure Hardfault. Region 0xEXXXXXXX cannot be changed by the SAU and/or the IDAU. Region 0xFXXXXXXX is always Secure and not Non-secure callable for instructions. For more information, see Chapter 6 Security Attribution and Memory Protection.

See the ARM®v8-M Architecture Reference Manual for more information about the memory model.

Copyright © 2016 ARM. All rights reserved.ARM DDI 0550C