Buses and Address Spaces

A bus is a set of shared wires plus a protocol for using them. In one transfer a master drives three groups of signals:

• Address: which location, 32 bits wide on a 32-bit microcontroller.
• Control: read or write, the size of the access (byte, halfword, word), and sometimes whether it is an instruction fetch or data, privileged or not.
• Data: from master to slave for a write, from slave to master for a read.

The slave has two more things to say. It can hold the transfer with a wait signal until it is ready, which is how a slow memory stretches an access over several clock cycles (lesson 6). And it can answer with an error, which the core turns into a fault. On Arm microcontrollers the on-chip buses follow Arm’s AMBA protocols, usually a fast AHB for the core, memories and DMA, and a simpler, slower APB for most peripherals, joined by a bridge. The RP2040’s SDK register headers label each block with its bus: UART, DMA configuration and IO_BANK0 registers are on APB; PIO is on the faster AHB-lite.

Every slave owns a range of addresses. The interconnect compares the upper address bits with those ranges and selects exactly one slave; the lower bits, the offset, select a location inside it. On every Cortex-M processor the architecture divides the 4 GiB space into eight 512 MiB slices and gives each a default meaning, which tells you what kind of memory to expect and which default memory attributes (executable or not, device or normal memory) the core applies. The slice is simply

that is, the top three bits of the address. Code lives in region 0, SRAM in region 1, peripherals in region 2, external RAM and devices in regions 3 to 6, and the core’s own private peripherals and vendor system space in region 7 (the Cortex-M0+ Devices Generic User Guide, §2.2). The architecture fixes these defaults and the location of the private peripheral bus; what the vendor actually places in each region, and how it is decoded, is the chip’s own address map. Vendors do bend the defaults: the RP2040’s SIO block is on-chip, yet sits at 0xD000_0000, in a slice labelled External device.

↑ This step uses the figure at the top of the page.

Choose 0x4001_E004 in the figure. The top bits 010 say Peripheral. The RP2040 map puts the pad-control block PADS_BANK0 at 0x4001_C000, so the offset is 0x2004. Bits 13:12 of the offset are 10, which on the RP2040 selects the atomic SET alias, and the remaining offset 0x004 is GPIO0’s pad-control register. Writing 0x08 there sets only bit 3, the pull-up enable (PADS_BANK0_GPIO0_PUE_BITS in the SDK header), without a read-modify-write (unit 2 lesson 6). One number, three levels of meaning, all decided by fixed wiring.

The same header is also a warning about reset states. The pad register resets to 0x56, which has bit 2, the pull-down enable, already set; with both bits set the RP2040 enables a weak “bus keeper” rather than a pull-up (the SDK’s gpio.h documents this). A real pull-up needs a second atomic write, 0x04 to the CLEAR alias at 0x4001_F004, or the SDK’s gpio_pull_up(), which sets one bit and clears the other.

Cortex-M and RISC-V microcontrollers use a single address space for instructions and data: a pointer can point at flash, SRAM or a register, and const data in flash is read with an ordinary load. This is the von Neumann arrangement. Many cores still fetch instructions and data over separate bus interfaces for speed, but software sees one map.

The classic 8-bit AVR is Harvard: program memory and data memory are separate spaces, each starting at address 0, reached by different instructions. A const table on an AVR is copied into scarce SRAM at startup unless it is marked PROGMEM, and then it must be read with pgm_read_byte(), because an ordinary pointer dereference would read data address 0x0100, not program address 0x0100 (avr-libc pgmspace.h). The C language hides the difference until a pointer crosses it.

A slave, or the interconnect itself, can reject an access: an address with nothing behind it, a write to a read-only region, an access size the slave does not support, a peripheral whose clock is off. Which of these actually produce an error is chip-specific: the RP2040’s peripheral bridge, for example, does not fault a narrow write but replicates it across the whole 32-bit word, which is its own surprise. The rejection comes back as a bus error, and the core raises a fault exception: HardFault on Armv6-M cores such as the Cortex-M0+, or the more specific BusFault on Armv7-M cores when it is enabled. Unit 6 lesson 4 reads those faults. The practical rule: the address map is a contract, and only the ranges it lists are safe to touch.

0x4003_4018. Region $\lfloor \text{0x4003\_4018} / \text{0x2000\_0000} \rfloor = 2$: Peripheral. RP2040 UART0 is at 0x4003_4000, so the offset is 0x18; bits 13:12 are 00, a normal access. The SDK header uart.h names offset 0x18 UARTFR, the flag register that says whether the transmit FIFO has room.

0xE000_ED0C. Region 7: the system region. The Cortex-M private peripheral bus starts at 0xE000_0000, the System Control Space at 0xE000_E000, and the System Control Block at SCS + 0xD00 = 0xE000_ED00 (CMSIS core_cm0plus.h). Offset 0x00C in the SCB is AIRCR, the register firmware writes to request a system reset (lesson 6). This part of the map is the same on every Cortex-M0+, whoever made the chip.

0x2100_0000. Region 1: SRAM. On the RP2040 this is SRAM0_BASE, the first byte of bank 0 seen without striping. The same physical cell also appears somewhere in the striped window at 0x2000_0000; which address you use decides how your data is spread across banks, not what the bytes are.