Introduction

The chip incorporates several distinct address regions. Program memory, data memory, registers, and I/O ports are organized within the same linear 4G bytes address space. The bytes are coded in Little-Endian format.

The addressable space is divided into multiple main blocks, as shown in the following table and figure. All the areas that are not allocated to on-chip memories and peripherals are considered as RSVD (reserved).

Base address	End address	Size (bytes)	Function		TrustZone
0x0000_0000	0x000F_FFFF	1M	KM4TZ internal ROM or TCM	ROM Flash	-
0x0010_0000	0x001F_FFFF	1M	Common ROM
0x0020_0000	0x0FFF_FFFF	254M	SPI NOR Flash
0x1000_0000	0x101F_FFFF	2M	ROM	ROM Flash	Secure
0x1020_0000	0x1FFF_FFFF	254M	SPI NOR Flash
0x2000_0000	0x200F_FFFF	1M	SRAM	SRAM	-
0x2010_0000	0x2FFF_FFFF	255M	RSVD
0x3000_0000	0x300F_FFFF	1M	SRAM	SRAM	Secure
0x3010_0000	0x3FFF_FFFF	255M	RSVD
0x4000_0000	0x407F_FFFF	8M	High-Speed peripherals group	Peripherals	-
0x4080_0000	0x417F_FFFF	16M	Low-Speed peripherals group
0x4180_0000	0x4FFF_FFFF	232M	RSVD
0x5000_0000	0x507F_FFFF	8M	High-Speed peripherals group	Peripherals	Secure
0x5080_0000	0x517F_FFFF	16M	Low-Speed peripherals group
0x5180_0000	0x5FFF_FFFF	232M	RSVD
0x6000_0000	0x6FFF_FFFF	256M	External PSRAM	DRAM	-
0x7000_0000	0x7FFF_FFFF	256M	External PSRAM	DRAM	Secure

Note

• The function of TrustZone is only applicable to KM4TZ, so the secure address spaces can only be accessed from the secure world of KM4TZ and other security-capable masters.

• The security attribution of address space is determined by the bit[28] of this address.

• The memory space in the table represents logical address mapping, but not the actual physical memory size. For example:

  • The system SRAM is logically mapped as 1MB in the memory map, but the actual physical size is only 512KB.

  • When the BT function is disabled, the physical memory inside the BT module can be mapped to the address space above 512KB and shared with the system for general use.

Memory map

The following sections describe the detailed mapping of available memory and register areas.

Memory Map and Register Boundary Address

The following table lists the memory map and boundary addresses of registers available in the chip.

Port ID	Port name	Security	Base address	End address	Size (bytes)
S0	SPIC_AUTO_MODE	Non-secure	0x0800_0000	0x0FFF_FFFF	128M
S1	SRAM	MPC	0x2000_0000	0x2008_FFFF	576K
S2	SHARE_SRAM	MPC	0x2009_0000	0x200F_FFFF	488K
S3	WIFI_REG	PPC	0x4000_0000	0x4000_2BFF
	WIFI_RF_REG	PPC	0x4000_3C00	0x400F_FFFF
	BT_REG	PPC	0x4008_0000	0x400F_FFFF	512K
	AES_REG	PPC	0x4010_0000	0x4010_FFFF	64K
	GDMA0_REG	PPC	0x4011_0000	0x4011_7FFF	32K
	SHA_REG	PPC	0x4011_8000	0x4011_FFFF	32K
	SDIO_REG	PPC	0x4012_0000	0x4012_3FFF	16K
	SPI0_REG	PPC	0x4012_4000	0x4012_4FFF	4K
	SPI1_REG	PPC	0x4012_5000	0x4012_5FFF	4K
	PSRAM_PHY_REG	PPC	0x4012_6000	0x4012_6FFF	4K
	PSRAM_REG	PPC	0x4012_7000	0x4012_7FFF	4K
	SPI_FLASH_CTRL	PPC	0x4012_8000	0x4012_8FFF	4K
	AES_KEY_REG	PPC	0x4012_9000	0x4012_9FFF	4K
	SPORT0_REG	PPC	0x4012_A000	0x4012_AFFF	4K
	SHA_KEY_REG	PPC	0x4012_B000	0x4012_BFFF	4K
	USB_REG	PPC	0x4014_0000	0x4017_FFFF	256K
	AES_SHA_DMA_REG	PPC	0x4018_0000	0x4018_0FFF	4K
S4	OTPC_REG	PPC	0x4100_0000	0x4100_7FFF	32K
	SYSTEM_CTRL	PPC	0x4100_8000	0x4100_BFFF	16K
	UART0_REG	PPC	0x4100_C000	0x4100_CFFF	4K
	UART1_REG	PPC	0x4100_D000	0x4100_DFFF	4K
	UART2_REG	PPC	0x4100_E000	0x4100_EFFF	4K
	LOGUART_REG	PPC	0x4100_F000	0x4100_FFFF	4K
	GPIO_REG	PPC	0x4101_0000	0x4101_0FFF	4K
	ADC_REG	PPC	0x4101_1000	0x4101_17FF	2K
	CMP_REG	PPC	0x4101_1800	0x4101_1FFF	2K
	CTC_REG	PPC	0x4101_2000	0x4101_2FFF	4K
	IPC0_REG	PPC	0x4101_4000	0x4101_47FF	2K
	IPC1_REG	PPC	0x4101_4800	0x4101_4FFF	2K
	DEBUGTIMER_REG	PPC	0x4101_5000	0x4101_5FFF	4K
	PMC_TIMER_REG	PPC	0x4101_6000	0x4101_6FFF	4K
	TIMER0_REG	PPC	0x4101_7000	0x4101_71FF	512
	TIMER1_REG	PPC	0x4101_7200	0x4101_73FF	512
	TIMER2_REG	PPC	0x4101_7400	0x4101_75FF	512
	TIMER3_REG	PPC	0x4101_7600	0x4101_77FF	512
	TIMER4_REG	PPC	0x4101_7800	0x4101_79FF	512
	TIMER5_REG	PPC	0x4101_7A00	0x4101_7BFF	512
	TIMER6_REG	PPC	0x4101_7C00	0x4101_7DFF	512
	TIMER7_REG	PPC	0x4101_7E00	0x4101_7FFF	512
S5	TIMER8_REG	PPC	0x4110_0000	0x4110_01FF	512
	TIMER9_REG	PPC	0x4110_0200	0x4110_03FF	512
	TIMER10_REG	PPC	0x4110_0400	0x4110_05FF	512
	TIMER11_REG	PPC	0x4110_0600	0x4110_07FF	512
	TRNG_REG	PPC	0x4110_1000	0x4110_1FFF	4K
	RXI300_REG	PPC	0x4110_2000	0x4110_3FFF	8K
	RSIP_REG	PPC	0x4110_4000	0x4110_4FFF	4K
	IR_REG	PPC	0x4110_7000	0x4110_7FFF	4K
	I2C0_REG	PPC	0x4110_8000	0x4110_9FFF	8K
	I2C1_REG	PPC	0x4110_A000	0x4110_BFFF	8K
S6	PSRAM	MPC	0x6000_0000	0x6FFF_FFFF	256M
S7	KR4_PLIC	Non-secure	0x8000_0000	0x8000_0FFF	4K

ROM

The ROM address space is mapped from 0x0000_0000 to 0x000E_FFFF. It consists of two main components: the KM4TZ ROM and the Common ROM.

• KM4TZ ROM: contains the core boot code responsible for initializing the system during power-on or reset.

• Common ROM: provides shared firmware functions and system-level utilities accessible by both processors.

TCM

The KM4 core is equipped with 16KB of instruction cache (I-Cache) and 16KB of data cache (D-Cache). When the caches are disabled, the underlying memory can be used as Tightly Coupled Memory (TCM), providing deterministic access for time-critical applications. The TCM address space is mapped from 0x000F_0000 to 0x000F_FFFF.

On-chip SRAM

The on-chip SRAM starts from 0x2000_0000 and consists of two blocks:

• A general purposed 512KB of contiguous SRAM for system heap and application, is connected to S1.

• A dedicated 152KB of connectivity SRAM shared with Bluetooth (lower protocol stack), is connected to S2. If Bluetooth function is disabled in user’s application, the corresponding SRAM would be used as general SRAM.

All the SRAM can be accessed as bytes (8 bits), half-words (16 bits) or full words (32 bits) by processors, DMA engine and other AXI masters.

The entire SRAM can be disabled or enabled in the Power Management Unit (PMU) to save power, and can also enter retention mode for quickly resuming from sleep mode when the system enters sleep mode.

Flash

The Flash memory consists of a SPI Flash controller and a Flash memory array module. The SPI Flash controller acts as an interface between the system bus and the Flash memory device. It implements the erase and program Flash memory operations, and the read/write protection mechanisms, and accelerates code execution with a system of instruction prefetch and cache lines.

The SPI Flash controller of the chip supports SPI NOR/NAND Flash with Single/Dual/Quad I/O pins. It can run up to 104MHz Single Data Rate (SDR) speed.

PSRAM

The PSRAM controller of the chip supports high-speed hyperbus PSRAM with Double Data Rate (DDR).

• Clock rate: up to 200MHz

• 8-/16-bit I/O

• Supports half-sleep mode and deep power-down mode