AMBA AXI · Module 7

The 4KB Boundary Rule

AXI's hard rule that no burst may cross a 4 KB address boundary — why it exists (minimum page size and address decode), how to check whether a burst crosses, and how masters split transfers at the boundary.

There is one placement rule in AXI that is absolute and that every master must respect: a burst must not cross a 4 KB address boundary. The entire address range a burst touches has to fall within a single 4 KB-aligned region. This isn't a performance guideline — it's a correctness requirement rooted in how memory is paged and decoded, and violating it produces some of the nastiest, hardest-to-trace bugs in a system. This chapter explains the rule, why 4 KB specifically, how to test whether a burst crosses, and how masters (and interconnects) split a transfer at the boundary to obey it.

1. The Rule

A single AXI burst's address range — from its first byte to its last — must lie entirely within one 4 KB (4096-byte) region aligned to a 4 KB boundary. 4 KB boundaries sit at every multiple of 0x1000. Formally, for a burst starting at Start_Address and covering Total_Bytes:

The burst is legal only if INT(Start_Address / 0x1000) == INT((Start_Address + Total_Bytes − 1) / 0x1000) — i.e., the first and last bytes are in the same 4 KB region.

If the first and last byte fall in different 4 KB regions, the burst crosses a boundary and is illegal. This applies to the burst's full byte span ((AxLEN+1) × 2^AxSIZE for INCR), so it's really a joint constraint on the start address and the length.

Figure 1 — the 4 KB boundary rule. A burst must fit entirely inside one 4 KB-aligned region (boundaries at every 0x1000). A burst whose byte range stays below the next 0x1000 boundary is legal; one whose range would extend past it is illegal and must be split. The rule binds start address and length together.

2. Why 4 KB — Pages and Address Decode

The rule exists because 4 KB is the minimum page size in essentially all memory-management units, and therefore the smallest granularity at which the address map can change. Two consequences:

A burst could otherwise span two slaves. Address decode (which subordinate an address routes to) can differ on either side of any 4 KB boundary, because two adjacent 4 KB pages may map to entirely different physical destinations. A single AXI transaction has one AxADDR and routes to one subordinate with one response path — it cannot be half at slave A and half at slave B. Confining a burst to one 4 KB region guarantees the whole burst decodes to a single slave.
It bounds the work an interconnect must do. Because no burst crosses a 4 KB boundary, an interconnect's decode/routing logic only ever has to send a burst to one place — it never has to split or fork a transaction mid-flight to two destinations. The rule pushes that responsibility to the side that shapes the burst.

So 4 KB is not arbitrary: it's the architectural unit at which mapping changes, and the rule keeps every burst inside one mappable unit.

Figure 2 — why 4 KB. Adjacent 4 KB pages can map to different slaves (the decode changes at the boundary). A burst confined to one 4 KB region always decodes to a single slave with a single response path; a crossing burst would need to split across two slaves — impossible for one transaction with one AxADDR. The rule guarantees single-slave routing.

3. Checking and Splitting at the Boundary

To check a burst: compute its last byte Start_Address + Total_Bytes − 1 and see if it lands in the same 4 KB region as the start. If it doesn't, the transfer must be split at the 4 KB boundary into two (or more) bursts, each within one region.

Worked example. Suppose a master wants to transfer 16 bytes starting at 0xFF8, 4 bytes/beat. The range is 0xFF8 … 0x1007 — it crosses 0x1000. Split at the boundary:

Burst 1: start 0xFF8, covering 0xFF8 … 0xFFF = 8 bytes (2 beats) — fills up to the boundary.
Burst 2: start 0x1000, covering 0x1000 … 0x1007 = 8 bytes (2 beats) — the remainder, in the next region.

Each sub-burst is legal (within one region), and together they cover the same 16 bytes. The split point is always the 4 KB boundary; the bytes before it go in one burst, the bytes from it onward in the next.

4kb-split — one crossing transfer issued as two boundary-aligned bursts

6 cycles

Figure 3 — 4kb-split: a 16-byte transfer at 0xFF8 that would cross 0x1000 is issued as two bursts. Burst 1 (AWADDR=0xFF8, 8 bytes) fills to the boundary; burst 2 (AWADDR=0x1000, 8 bytes) carries the remainder. Two address handshakes, each burst confined to one 4 KB region — the data is identical to the would-be single crossing burst.

4. Who Enforces It

The rule is the issuing side's responsibility — a manager must not drive a burst that crosses a 4 KB boundary; doing so is a protocol violation. In practice the split happens in one of these places:

The manager / DMA shapes its bursts to respect the boundary (the common case — burst-generation logic checks the boundary and splits).
An interconnect / bridge may split a crossing burst it receives (some do, as a safety/convenience feature), but relying on this is risky — not all do, and the spec puts the obligation on the master.
A protocol checker / VIP flags any burst whose range crosses a 4 KB boundary as an error.

The safe design stance: shape bursts at the source so they never cross, and verify it. Never assume something downstream will fix a crossing burst.

Figure 4 — enforcement flow. The burst-generating master computes whether the intended transfer crosses a 4 KB boundary; if so it splits at the boundary into legal bursts, otherwise it issues one. The obligation is on the issuer — a crossing burst is a protocol violation, and downstream splitting (by some interconnects) must not be assumed.

5. Common Misconceptions

Myths to unlearn

"The limit is about burst length (256 beats)." No — those are separate rules. A burst can be well within 256 beats and still illegally cross a 4 KB boundary; conversely it can be short and legal. The 4 KB rule constrains the address range, not the beat count.
"Only very long bursts can cross." A short burst near a boundary crosses too — e.g., a 16-byte burst at 0xFF8 crosses 0x1000. It's about position + size, not size alone.
"The interconnect will split crossing bursts for me." Don't rely on it — the obligation is on the master. Some interconnects split, many don't; a crossing burst is a protocol violation at the source.
"FIXED and WRAP need 4 KB splitting too." In practice no — FIXED never advances its address, and WRAP stays within its own (much smaller, aligned) block, so neither crosses a 4 KB boundary. Only INCR's forward march makes it an active concern.
"4 KB is just a convention you can configure." It's fixed by the architecture (minimum page size); it is not tunable.

6. Debugging Insight

🔍 Debugging insight — boundary crossings corrupt the tail and confuse routing

A 4 KB crossing produces a very specific signature — the tail of a transfer goes wrong while the head is fine:

A transfer's later beats are corrupted, lost, or get DECERR? Compute Start_Address + Total_Bytes − 1 and check the 4 KB region. If the range crosses 0x1000, the beats past the boundary spilled into the next region — which decodes to a different slave (corruption) or is unmapped (DECERR). The early beats (before the boundary) are correct, which is the tell.
Intermittent corruption depending on buffer placement? Classic crossing bug — it only manifests when a buffer happens to be positioned so a burst straddles a 4 KB boundary. Page-align or boundary-shape the bursts.
A protocol checker fires "burst crosses 4 KB boundary"? The master's burst-shaping is wrong — it isn't splitting at the boundary. Fix the burst-generation logic (compute bytes-to-boundary and split).
Works on one platform, fails on another? The address map differs — a region that was contiguous-to-one-slave on platform A spans a slave change at a 4 KB boundary on platform B, exposing a latent crossing.

The diagnostic is always the same arithmetic: does [Start, Start+Total−1] stay within one 0x1000 region? A "tail-only" failure is the fingerprint, and the fix is splitting at the boundary in the issuing master.

7. Verification Insight

✅ Verification insight — assert no crossing, and test the split right at the boundary

The core assertion is simple and mandatory: no burst's address range may cross a 4 KB boundary — check INT(Start/0x1000) == INT((Start+Total_Bytes−1)/0x1000) on every burst and flag violations. This is a standard protocol-checker rule; make sure it's enabled and that your own stimulus generator never produces a crossing burst (unless you're deliberately testing rejection). For a DUT that splits (a DMA or splitting interconnect), the high-value tests place a transfer so it just crosses a 4 KB boundary and verify the split is correct: the two sub-bursts together cover exactly the original byte range, the split is at the 0x1000 boundary, each sub-burst is independently legal, and the data/ordering is preserved (anchored by the golden address model of Chapter 7.5).

Coverage should hit the boundary cases precisely: a burst ending exactly at 0x...FFF (legal, touches but doesn't cross), one starting exactly at 0x...000 (legal), and one straddling by a single byte (illegal / must-split). Sweep different start offsets and lengths so the crossing lands at various points. Negative testing — deliberately injecting a crossing burst to confirm the checker catches it — is essential, because this is precisely the violation that causes silent tail corruption in real systems. Combine with the address-progression and strobe checks so the split sub-bursts are validated byte-accurately.

8. Interview Questions

9. Summary

The 4 KB boundary rule is AXI's one absolute placement constraint: no burst may cross a 4 KB boundary — its full byte range (Start … Start + Total_Bytes − 1) must lie within a single 0x1000-aligned region. The reason is architectural: 4 KB is the minimum page size, so the address map — and which slave an address decodes to — can change at any 4 KB boundary. Keeping each burst inside one region guarantees it routes to a single slave with one response path, which a single-AxADDR transaction requires. The check is INT(Start/0x1000) == INT((Start+Total−1)/0x1000); a transfer that would cross is split at the boundary into legal sub-bursts (e.g., 16 bytes at 0xFF8 → 0xFF8..0xFFF + 0x1000..0x1007).

Enforcement is the master's job — a crossing burst is a protocol violation, and downstream splitting must not be assumed. Only INCR can actually cross (FIXED can't move; WRAP stays in its block). Its bug signature is unmistakable: tail-of-transfer corruption or DECERR, often intermittent with buffer placement — diagnosed by the same region arithmetic and fixed by boundary-aware burst shaping. Verify with the always-on "no crossing" assertion plus directed split tests right at the boundary. Next: narrow and unaligned transfers — the partial-beat behavior that the unaligned cases from Chapter 7.5 set up.

10. What Comes Next

You've got the placement rule; next, the partial-beat mechanics:

7.7 — Narrow & Unaligned Transfers (coming next) — narrow transfers (AxSIZE below bus width) and unaligned start addresses, and the partial beats they produce.
7.8 — Strobe Behavior in Bursts (coming soon) — how WSTRB evolves across narrow and unaligned burst beats.

Previous: 7.5 — Burst Address Calculation. Related: 7.3 — INCR Bursts, the only type that can cross a boundary. For the broader protocol catalog, see the AMBA family overview doc.