"real physical" rpi1-3, not sure what happens to ram shadowed by IO rpi4, with 4gig of ram, only 1gig is visible within "bus address space", 3gig cant be reached by VC4 (unknown how arm gets to it) https://www.raspberrypi.org/forums/viewtopic.php?p=1543934#p1543934 https://paulwratt.github.io/rpi-internal-registers-online/index.html 0 -> $RAMSIZE (0 to $RAMSIZE) RAM 0x1801_1000 VPU0_THREAD_CTRL_BASE_ADDRESS ?? 0x1A00_0000 -> 0x1A0F_FFFF vc_run APB Bridge? 0x6000_0000 mask rom 0x6000_8000 rpi1 sram and GP 0x6000_8047 rpi1 core0 stack in rom 0x6000_873b rpi1 core1 stack in rom 0x6001_0738 core0 stack pointer, at start of mask rom for rpi4 0x7d50_0000 -> 0x7d50_930f rpi4 PCI-E 0x7d50_8000 rpi4 PCI-E 0x7d58_0000 -> 0x7d58_ffff rpi4 GENET 0x7dc2_0000 rpi4 used by 2020-05-15 bootcode.bin in combination with 7e001 0x7dc3_4000 + 0x1000 2711 backing store for a BUFF 0x7dc3_8000 + 0x4000 2711 backing store for a BUFF 0x7e00_0000 -> 0x7fff_ffff (992mb to 1024mb, 32mb long) IO peripherals (only exists in the 4-alias) 0x7e00_0000 MS_BASE multicore_sync.h 0x7e00_1000 CCP2TX_BASE 0x7e00_2000 IC0_BASE irq control for vc4 core 0 0x7e00_2800 IC1_BASE irq control for vc4 core 1 0x7e00_3000 ST_BASE from timer.h 0x7e00_4000 TXP_BASE 0x7e00_5000 JP_BASE jpeg 0x7e00_6000 MPHI_BASE 0x7e00_7000 DMA0_BASE thru DMA14_BASE, 0x100 each 0x7e00_8000 NU_BASE from nexus_uba.h (debug control?) 0x7e00_9000 SYSAC_BASE from system_arbiter_ctrl.h (priority of every axi peer?) 0x7e00_9800 APERF0_BASE 0x7e00_a000 ASB_BASE from apb_async_bridge_ctrl.h 0x7e00_a000 + 0x24 2711 watchdog-2 0x7e00_b000 ARM_BASE controls the arm cpu core(s) 0x7e10_0000 vc4/2711 PM_BASE power gating control and watchdog 0x7e10_1000 CM_BASE cpr_clkman.h mapped to bcm2835-cprman in DT 0x7e10_2000 A2W_BASE allows enabling/disabling PLL blocks A/B/C/D/H 0x7e20_0000 -> 0x7E21_FFFF peri_audio APB Bridge? 0x7e20_0000 GP_BASE gpio 0x7e20_3000 " pcm" PCM_BASE 0x7e20_4000 "spim" 0x7e20_5000 i2c0 " i2c" I2C0_BASE 0x7e20_5200 i2c1 0x7e20_5400 i2c2 0x7e20_5600 i2c3 0x7e20_5800 i2c4 0x7e20_5a00 i2c5 0x7e20_5c00 i2c6 0x7e20_5e00 i2c7 0x7e20_6000 "pixv" 0x7e20_7000 "pixv" 0x7e20_8000 ".dpi" DPI_BASE configures the DPI video output 0x7e20_9000 ".dsi" DSI0_BASE 0x7e20_b600 FPGA_BASE 0x7e20_b700 FPGA_MB_BASE 0x7e20_c000 "pwm0" 0x7e20_d000 "perm" PRM_BASE perfmon.h 0x7e20_f000 "otp0" OTP_BASE 0x7e21_0000 "slim" 0x7e21_1000 " cpg" CPG_BASE 0x7e21_3000 "AVSP" 0x7e21_4000 I2C_SPI_SLV_BASE BSC/i2c slave/spi master 0x7e21_5040 mini uart/aux uart 0x7e21_5080 mini spi0 0x7e21_50c0 mini spi1 (aka spi2) 0x7e24_0000 "ave8" AVE_OUT_BASE ... "ave8" 0x7e27_f000 "ave8" 0x7e21_5000 AUX_IO_BASE 0x7e30_0000 EMMC_BASE the sdhci controller? 0x7e40_0000 SCALER_BASE hvs, 2d composition, sprites 0x7e60_0000 "smi_" ... "smi_" 0x7e6f_f000 "smi_" 0x7e70_0000 ".dsi" DSI1_BASE ... ".dsi" 0x7e7f_f000 ".dsi" 0x7ea0_0000 ISP_BASE 0x7ec0_0000 V3D_BASE from v3d.h 0x7ec1_1000 + 0x20 2711 watchdog-3 0x7ee0_0000 SD_BASE from sdc_ctrl.h (dram control) 0x7ee0_1000 L2_BASE l2_cache_ctrl.h, VPU L2 cache management 0x7ee0_2000 L1_BASE from vpu_l1_cache_ctrl.h 0x7ee0_2100 D0CACHE_BASE from hardware_vc4.h 0x7ee0_5000 DMA15_BASE 0x7ee0_8000 APERF1_BASE from axi_performance1.h 0x7e80_0000 -> 0x7E81_FFFF peri_image APB Bridge? 0x7e80_0000 "ucam" CAM0_BASE 0x7e80_1000 "ucam" CAM1_BASE / CCP_BASE 0x7e80_2000 ".cmi" CMI_BASE clock manager image, camera/usb clock controls 0x7e80_4000 " i2c" I2C1_BASE i2c1 on an rpi3 0x7e80_5000 " i2c" I2C2_BASE / HDMI EDID i2c (on rpi3) 0x7e80_6000 "veca" 0x7e80_7000 "pixv" 0x7e80_8000 "hdmi" HD_BASE hdmi.h 0x7e80_9000 "hdcp" 0x7e80_a000 "arbr" PIARBCTL_BASE peri_image_arb_ctrl.h 0x7e90_2000 HDMI_BASE 0x7e90_[0-7]000 "dbus" 0x7e91_[0-7]000 "ave0" AVE_IN_BASE 0x7e9c_0000 bcm XHCI 0x7f00_0000 H264_BASE bus address space: 4 aliases of the 1st 1gig of "real physical" 0 -> 0x3fff_ffff (0 to 1gig) 0-alias, L1 and L2 cached 0x4000_0000 -> 0x7fff_ffff (1gig to 2gig) 4-alias, L2 cached (L1 coherent) 0x8000_0000 -> 0xbfff_ffff (2gig to 3gig) 8-alias, L2 cached (ignores L1) 0xc000_0000 -> 0xffff_ffff (3gig to 4gig) C-alias, direct uncached while the open bootcode.bin is executing: 0 the entire bootcode.bin file 0x1b000 (108kb) the interrupt vector table, IC0_VADDR and IC1_VADDR say where it is, so .word could generate it? 0x1d000 (116kb) the irq stack pointer? 0x1c000 (112kb) the main stack pointer arm physical: mapped in 16mb chunks by mapBusToArm() in drivers/BCM2708ArmControl.cc current layout is: 0 -> 0x3dffffff (0 to 992mb, 62 chunks of 16mb) primary arm ram, mapped to the C alias in "bus address space" 0x3F000000 -> 0x3Fffffff (1008mb to 1024mb, 1 chunk 16mb long) IO peripherals, mapped to the IO peripherals in the 4 alias in "bus address space" official firmware puts io at 0x20000000 for rpi1/2, and 0x3F000000 for 3 official rpi4 firmware puts bcm2835 io at 0xFE000000 (32mb from 4g) bcm2836 io at 0xFF800000 (8mb from 4g) GICv2 at 0xFF841000 cpu interface window (each arm core sees diff?) at 0xFF842000