# System and memory
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
**Parent Topic:** [Framework and programming model](https://docs.qualcomm.com/doc/80-58740-1/topic/framework_and_programming_model.html)
## System architecture
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
The chip adopts 32-bit RISC-V CPU, equipped with 32KB I-Cache and16 KB D-Cache, CPU
frequency up to 325 MHz, suitable for high-performance applications such as Internet of
Things, embedded and artificial intelligence.
The main system consists of the following parts:
- Bus interface
- CPU accesses memory through the AXI bus
- CPU accesses peripherals through the AHB bus
- With low power consumption, high performance and other characteristics
- Memory
- 484KB SRAM for data storage
- 128KB ROM
- Support embedded high-speed pSRAM, expandable RAM capacity
- Peripherals
- A total of 30 peripheral modules, including advanced peripherals such as
SDH/SDU/EMAC/CAM/Display
The Wi-Fi 6 + BT/BLE + 802.15.4 wireless subsystem is integrated on-chip, which can
support a variety of wireless connections and data transmission, and provide various
connection and transmission experiences.
The system architectures of the chip is shown in the following figure.
Figure : QCC74x system architecture
## CPU
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
### Features
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
The chip has a built-in 32‑bit RISC-V CPU, uses a 5-stage pipeline: fetch, decode,
execute, memory access, and write back. This high-performance embedded microprocessor has the
following features:
- 32‑bit RISC-V processor
- Supports RISC-V RV32IMAFCP instruction set
- Supports RISC-V 32‑bit/16‑bit mixed instruction set
- Supports RISC-V machine mode and user mode
- Thirty-two 32‑bit integer general-purpose registers (GPR) and thirty-two
32‑bit/64‑bit floating-point GPRs
- Integer (5-stage)/floating-point (7-stage), single-issue, sequentially executed
pipeline
- Supports AXI 4.0 main device interface and AHB 5.0 peripheral
interface
- 32KB instruction cache, two-way set associative structure
- 16KB data cache, two-way set associative structure
- Unaligned memory access
- Double-cycle hardware multiplier and Radix-4 hardware divider
- Supports BHT (8K) and BTB
- Supports extended enhanced instruction set
- Supports MCU feature extension technique, including interrupt
processing acceleration technique and MCU extension feature
- Compatible with RISC-V CLIC interrupt standard and interrupt nesting; 96 external
interrupt sources, 4 bits for configuring interrupt priority
- Compatible with RISC-V PMP, 8 configurable areas
- Supports hardware performance monitor (HPM) units
- Supports RISC-V Debug Specification
### Extended functions
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
- Bit operation instruction, arithmetic operation instruction,
and enhanced memory access instruction
- Cache operation instruction and synchronization instruction, making programming
easy for software programmers
- Interrupt speculative push technique and vector interrupt tail-biting technique,
accelerated interrupt response, with interrupt response delay of 20 processor clock
cycles
- Common application requirements in MCU fields like NMI, low-power mode for
deep/light sleep, low-power wake-up events, and locking
- Supports unaligned memory access, which can be enabled/disabled
by software, making programming and debugging easy for software
programmers
### Implemented standards
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
The processor is compatible with the RISC-V standard and the specific versions
are:
- The RISC-V Instruction Set Manual, Volume I: RISC-V User Level ISA, Version
2.2
- The RISC-V Instruction Set Manual, Volume II: RISC-V Privileged
Architecture, Version1.10
- RISC-V Core-Local Interrupt Controller (CLIC) Version 0.8
- RISC-V External Debug Support Version 0.13.2
- RISC-V "P" Extension Proposal Version 0.9
## Boot process
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
This section introduces the steps involved in the start-up process of the chip, from
power-on to the execution of the main function.
Figure : Start-up flow diagram
The chip boot process falls into two categories:
- Boot from flash
- Boot from UART/SDIO
Taking booting from flash as an example, the following describes the complete boot
process of the chip in detail, which is divided into three steps:
1. The primary bootloader is embedded in the internal ROM of the chip. It reads the
firmware header from the flash 0x0 offset address, completes chip-related configuration and
checks based on the header parameters. After configuration, starts the secondary bootloader
from the 0x2000 address.
2. The secondary bootloader reads the partition table from the flash and boots the
latest main program firmware according to the partition table.
3. The application starts running, sets chip-related clocks, pins, and other
configurations as needed by the user, and finally starts the RTOS scheduler.
### Primary bootloader
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
After the chip is reset or repowered, the CPU immediately starts running, performing
a series of initialization operations to restore the chip to an initial state. The
initialization reset code is fixed in the mask ROM of the chip and cannot be changed.
During the boot process, the primary bootloader determines the boot mode of the chip
based on the level state of the HBN\_RSV0 register and GPIO2, where the HBN\_RSV0 register holds
the flag for chip wake-up, with the specific execution process as follows:
1. Reset from deep sleep mode: Check the HBN\_RSV0 register to determine if a wake-up
from deep sleep mode is requested. If so, wake up from deep sleep mode and enter the fast
boot process. After verifying the flag in the HBN\_RSV0 register, the program uses the boot
parameters stored at the OCRAM starting address, and immediately jump to that address to
run. If the flag in the verified HBN\_RSV0 register is not valid, or if there is a boot
anomaly, then it continues to boot as in a normal power-on reset process.
2. Power-on reset, software PWRON reset: Check the GPIO2 pin level to determine if
boot from a flash image. If the GPIO2 pin level is 1 (High), it enters the UART/SDIO boot
mode, which is mainly for flash writing or downloading images to RAM for execution (wireless
pass-through scenario). If the GPIO2 pin level is 0 (Low), it enters the flash boot mode.
After entering this mode, the secondary bootloader is generally run.
3. Secure boot: According to the configuration in eFuse, start the secure boot
process, which checks the integrity and legality of the secondary bootloader's signature,
and decides whether to enable flash decryption.
### Secondary bootloader
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
The image stored from the flash's 0x0 offset address (including firmware header) is
the secondary bootloader. The source code of the secondary bootloader can be found in the
boot2\_isp directory of the released SDK. The secondary bootloader can
easily plan flash partition information through the partition table, and it supports secure
boot, encrypted boot, signature verification, and Over-The-Air (OTA) update functions for user
applications.
After the primary bootloader starts, it reads the firmware header from the beginning
of the image, completes the related chip configuration and checks according to the firmware
header, such as checking for encrypted boot, and so on. After configuration, it jumps to run
the secondary bootloader.
After the secondary bootloader starts, it reads the partition table from the flash's
0xE000 offset address by default (configurable). The default design uses A/B dual partition
tables. The application firmware entity location will also be in two separate A/B partitions,
which facilitate OTA. The secondary bootloader determines which partition to boot based on the
active\_index and age information in the partition table. See the partition table instructions
for specific reference.
For the partition that will be booted, the secondary bootloader reads the firmware
header from the flash, checks the integrity and legality of the application's signature, and
decides whether to enable flash decryption. Finally, it jumps to execute the application.
### Application boot stage
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
The application boot includes all processes from the start of the application's
execution to before the user's APP `main` function. Divided into two
stages:
- Power, clock, and basic C language run-time environment initialization
- Run the `main` function and call `main`
#### Hardware and system run-time environment initialization
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
The application entry starts executing from the `_start` within the
`start.S` file. This initialization function establishes a basic C Runtime
(CRT) and configures the internal hardware of the chip.
- Reconfigures the CPU exception vector for the application
- Initializes the Floating Point Unit (FPU)
- Sets the stack pointer
- Initializes internal memory (data and bss sections)
- Restores the CPU interrupt status register to its default state and enables
interrupts
- Enables the cache
- If memory protection is configured, memory protection is
initialized.
After these operations are completed, the user's `main` function is
called.
#### Running the main task
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
Once the necessary run-time environment is initialized, it transitions to the user
program. Typically, the first segment of the user program calls the
`board_init` function from `board.c`, completing the
initialization of project-specific ports, potentially including UART, GPIO, and other
peripheral ports.
After the basic hardware port initialization is complete, users can choose to run a
bare-metal system or the FreeRTOS operating system, depending on their needs. If wireless
functionality is used, FreeRTOS must be enabled, and the user must create tasks to run the
different features. If running bare-metal, typically the user's functionality runs within a
while loop.
### Boot from UART/SDIO
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
Boot from UART/SDIO, commonly referred to as booting from interface mode (or
programming mode), is a branch scenario after the primary bootloader starts. This mode is used
for flash programming or downloading images to RAM for execution (in wireless pass-through
scenarios).
The system supports boot from flash/UART/SDIO, as described below:
| Boot Pin | Level | Description |
| --- | --- | --- |
| GPIO2 | 1 | Boot from UART(GPIO21/22)/SDIO. This mode is used for flash programming or downloading images to RAM for execution (wireless transparent transmission scenario) |
| GPIO2 | 0 | Boot the application image from flash |
| | | |
## Address mapping
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
Table : Memory address map
| Module | Size | Base address cache | Base address noncache |
| --- | --- | --- | --- |
| OCRAM | 320KB | 0x62FC0000 | 0x22FC0000 |
| WRAM | 160KB | 0x63010000 | 0x23010000 |
OCRAM and WRAM can be accessed either through the AHB bus or through AXI bus. When the
CPU uses the 0x62FC0000 address to access the OCRAM, it goes through the internal cache and
access the OCRAM through AXI to AHB. When the CPU uses the 0x22FC0000 address to access the
OCRAM, it directly accesses the OCRAM through the AHB bus.
## Interrupt source
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
A total of 64 interrupt sources are included, and the interrupt
sources and corresponding interrupt numbers are shown in the
following table:
| Interrupt source | Interrupt source | Interrupt number | Description |
| --- | --- | --- | --- |
| BMX | Bus error | IRQ\_NUM\_BASE+0 | Bus error response interrupt |
| BMX | Bus timeout | IRQ\_NUM\_BASE+1 | Bus response timeout interrupt |
| Display | Display | IRQ\_NUM\_BASE+2 | Display all interrupt |
| SDU | SDU software reset | IRQ\_NUM\_BASE+3 | SDU reset triggered by host |
| Audio ADC | Audio ADC | IRQ\_NUM\_BASE+4 | Audio ADC interrupt |
| RF | RF interrupt 0 | IRQ\_NUM\_BASE+5 | RF interrupt 0 |
| RF | RF interrupt 1 | IRQ\_NUM\_BASE+6 | RF interrupt 1 |
| SDU | SDU side interrupt | IRQ\_NUM\_BASE+7 | SDU side all interrupt |
| Wi-Fi | TBTT SLEEP | IRQ\_NUM\_BASE+8 | Wi-Fi TBTT SLEEP interrupt |
| SecEng | Group0 | IRQ\_NUM\_BASE+9 | Group0 SHA/AES/TRNG/PKA/GMAC interrupt |
| SecEng | Group1 | IRQ\_NUM\_BASE+10 | Group1 SHA/AES/TRNG/PKA/GMAC interrupt |
| SecEng | Group0 CDET | IRQ\_NUM\_BASE+11 | Group0 CDET interrupt |
| SecEng | Group1 CDET | IRQ\_NUM\_BASE+12 | Group1 CDET interrupt |
| SF\_Ctrl | Group0 | IRQ\_NUM\_BASE+13 | SF\_Ctrl Group0 interrupt |
| SF\_Ctrl | Group1 | IRQ\_NUM\_BASE+14 | SF\_Ctrl Group1 interrupt |
| DMA | DMA0\_ALL | IRQ\_NUM\_BASE+15 | DMA0 all interrupt |
| CAM\_OUT0 | CAM\_OUT0 | IRQ\_NUM\_BASE+16 | CAM\_OUT0 interrupt |
| SDH | SDH all interrupt | IRQ\_NUM\_BASE+17 | SDH all interrupt |
| CAM\_OUT1 | CAM\_OUT1 | IRQ\_NUM\_BASE+18 | CAM\_OUT1 interrupt |
| Wi-Fi | TBTT WAKEUP | IRQ\_NUM\_BASE+19 | Wi-Fi TBTT WAKEUP interrupt |
| IR | IRRX | IRQ\_NUM\_BASE+20 | IR Rx interrupt |
| Audio DAC | Audio DAC | IRQ\_NUM\_BASE+22 | Audio DAC interrupt |
| MJPEG | Encoder | IRQ\_NUM\_BASE+23 | MJPEG encoder all interrupt |
| EMAC | EMAC | IRQ\_NUM\_BASE+24 | EMAC interrupt |
| GPADC | GPADC\_DMA | IRQ\_NUM\_BASE+25 | GPADC\_DMA interrupt |
| eFuse | eFuse | IRQ\_NUM\_BASE+26 | eFuse interrupt |
| SPI | SPI | IRQ\_NUM\_BASE+27 | SPI interrupt |
| UART | UART0 | IRQ\_NUM\_BASE+28 | UART0 interrupt |
| UART | UART1 | IRQ\_NUM\_BASE+29 | UART1 interrupt |
| ISO 11898 | ISO 11898 | IRQ\_NUM\_BASE+30 | ISO 11898 interrupt |
| GPIO | GPIO\_DMA | IRQ\_NUM\_BASE+31 | GPIO DMA interrupt |
| I2C0 | I2C0 | IRQ\_NUM\_BASE+32 | I2C0 interrupt |
| PWM | PWM | IRQ\_NUM\_BASE+33 | PWM interrupt |
| TIMER0 | TIMER0\_CH0 | IRQ\_NUM\_BASE+36 | Timer 0 Channel 0 interrupt |
| TIMER0 | TIMER0\_CH1 | IRQ\_NUM\_BASE+37 | Timer 0 Channel 1 interrupt |
| TIMER0 | TIMER0\_WDT | IRQ\_NUM\_BASE+38 | Timer 0 watchdog interrupt |
| I2C1 | I2C1 | IRQ\_NUM\_BASE+39 | I2C1 interrupt |
| I2S | I2S | IRQ\_NUM\_BASE+40 | I2S interrupt |
| | Reserved | IRQ\_NUM\_BASE+41 | Reserved |
| | Reserved | IRQ\_NUM\_BASE+42 | Reserved |
| XTAL | Xtal Ready | IRQ\_NUM\_BASE+43 | Xtal ready interrupt |
| GPIO | GPIO\_INT0 | IRQ\_NUM\_BASE+44 | GPIO interrupt |
| DM | DM | IRQ\_NUM\_BASE+45 | DM interrupt |
| BT | BT | IRQ\_NUM\_BASE+46 | Bluetooth interrupt |
| MAC154 | ENH ACK | IRQ\_NUM\_BASE+47 | MAC154 ENH ACK interrupt |
| MAC154 | Others | IRQ\_NUM\_BASE+48 | MAC154 other interrupt |
| MAC154 | AES | IRQ\_NUM\_BASE+49 | MAC154 AES interrupt |
| PDS | PDS | IRQ\_NUM\_BASE+50 | PDS interrupt |
| HBN | HBN OUT0 | IRQ\_NUM\_BASE+51 | HBN out 0 interrupt |
| HBN | HBN OUT1 | IRQ\_NUM\_BASE+52 | HBN out 1 interrupt |
| BOR | BOR | IRQ\_NUM\_BASE+53 | Brown out reset interrupt |
| Wi-Fi | Wi-Fi | IRQ\_NUM\_BASE+54 | Wi-Fi interrupt |
| BZ PHY | BZ PHY | IRQ\_NUM\_BASE+55 | BZ PHY interrupt |
| BLE | BLE | IRQ\_NUM\_BASE+56 | BLE interrupt |
| Wi-Fi | MAC TR timer | IRQ\_NUM\_BASE+57 | MAC Tx and Rx timer interrupt |
| Wi-Fi | MAC TR MISC | IRQ\_NUM\_BASE+58 | MAC Tx and Rx misc interrupt |
| Wi-Fi | MAC Rx trigger | IRQ\_NUM\_BASE+59 | MAC Rx trigger interrupt |
| Wi-Fi | MAC Tx trigger | IRQ\_NUM\_BASE+60 | MAC Tx trigger interrupt |
| Wi-Fi | MAC General | IRQ\_NUM\_BASE+61 | MAC general interrupt |
| Wi-Fi | MAC prot | IRQ\_NUM\_BASE+62 | MAC prot interrupt |
| Wi-Fi | IPC | IRQ\_NUM\_BASE+63 | MAC IPC interrupt |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
Note: IRQ\_NUM\_BASE is 16 and the interrupt number 015 is a RISC-V reserved
interrupt.
## Peripheral overview
Source: [https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html](https://docs.qualcomm.com/doc/80-58740-1/topic/system_and_memory.html)
Table : Peripheral list
| Peripheral | Number | Note |
| --- | --- | --- |
| GPIO | 19/35 | QFN40 corresponds to 19 GPIOs. QFN56 corresponds to 35 GPIOs |
| ISO11898 | 1 | AHB bus |
| I2S | 1 | Supports Left-Justified/Right-Justified/Normal I2S/DSP and other data formats |
| Timer | 2 | Supports FreeRun mode and PreLoad mode |
| DMA | 4 | Supports LLI linked list function |
| IR | 1 | Supports receiving. The protocol includes NEC and RC-5. Also supports receiving data by pulse width counting |
| Audio PWM | 1 | Supports audio playback |
| Audio ADC | 1 | Supports recording |
| EMAC | 1 | Supports 10 Mbps and 100 Mbps |
| CAM | 1 | Supports image rectangle crop |
| MJPEG | 1 | Supports arbitrary quantization tables |
| DBI | 1 | Supports Type B/Type C 3-wire/Type C 4-wire, and also integrates QSPI mode |
| SDH | 1 | Supports high-speed SD card |
| SDU | 1 | Supports CCCR (function0) and function1. Support SDU soft reset. Function1 has 16 port receive buffers |
| SEC ENG | 1 | Supports AES/SHA/GMAC/TRNG |
Last Published: Feb 11, 2026