Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Memory Map

Physical and virtual address layout for Raspberry Pi 4 (BCM2711).

Virtual Memory

Status: MMU enabled with identity mapping (VA = PA)

After kernel initialization, the MMU is active with:

  • 39-bit virtual address space (512 GB)
  • 4 KB page granule, 2 MB block mappings
  • Identity mapping: virtual address equals physical address

See MMU & Paging for details.

Address Ranges

StartEndSizePurpose
0x000000000x3FFFFFFF1 GBDRAM (varies by Pi 4 model: 1/2/4/8 GB)
0x00080000--Kernel load address (firmware entry point)
0xC00000000xFFFFFFFF~1 GBReserved (future expansion)
0xFE0000000xFF800000~24 MBMMIO peripherals window

MMIO Base Address

CRITICAL: Pi 4 uses 0xFE000000 for ARM CPU peripheral access.

Why Multiple Addresses Exist

The BCM2711 chip supports different address mappings:

  • ARM physical access: 0xFE000000 ← Use this for bare-metal
  • Bus addressing: 0x7E000000 (appears in datasheets)
  • Pi 3 legacy: 0x3F000000 (BCM2837, not applicable to Pi 4)

When reading BCM2711 documentation showing bus addresses (0x7E00xxxx), translate to ARM physical by replacing 0x7E with 0xFE.

Key Peripheral Addresses

All MMIO regions are mapped as device memory (non-cacheable, strictly ordered).

PeripheralBase AddressDatasheet Reference
UART0 (PL011)0xFE201000BCM2711 §2.1
GPIO0xFE200000BCM2711 §5.2
System Timer0xFE003000BCM2711 §10.2
GIC-400 Distributor (GICD)0xFF841000BCM2711 §6.1
GIC-400 CPU Interface (GICC)0xFF842000BCM2711 §6.1
GENET v5 Ethernet0xFD580000Linux bcmgenet driver
Mailbox0xFE00B880BCM2711 §1.3

Kernel Memory Layout

Detailed layout defined in linker.ld:

SectionAddressSizeDescription
.text.boot0x00080000~256 BAssembly entry point
.text.exceptions0x000808002 KBException vector table (2KB aligned)
.text0x00081000+~50-100 KBRust kernel code
.rodataAfter .text~10-20 KBRead-only data, string literals
.dataAfter .rodata~1-5 KBInitialized global variables
.bssAfter .data~20-30 KBZero-initialized data + page tables
Heap__heap_start8 MBDynamic allocations (String, Vec, etc.)
Stack_stack_start2 MBCall stack (grows downward)

Kernel Image

  • Loaded at 0x00080000 by firmware
  • Total size: ~100 KB (debug), ~50 KB (release)
  • Entry point: _start in src/arch/aarch64/boot.s

Page Tables (in .bss)

  • L1_TABLE: 4 KB (512 entries, 1 GB per entry)
  • L2_TABLE_LOW: 4 KB (maps 0-1 GB normal memory)
  • L2_TABLE_MMIO: 4 KB (maps 3-4 GB device memory)
  • Total: 12 KB for translation tables

Heap

  • Defined by __heap_start and __heap_end symbols in linker script
  • Size: 8 MB reserved
  • Active: Bump allocator implemented (Phase 2 complete)
  • Location: After BSS section, aligned to 16 bytes
  • Used for: String, Vec, shell command history, dynamic allocations

Stack

  • Defined by _stack_start symbol in linker script
  • Size: 2 MB (currently only core 0 uses it)
  • Location: After heap, grows downward toward heap
  • Alignment: 16 bytes (ARM AAPCS requirement)
  • Future: Per-core stacks when multi-core support is added

Memory Attributes

After MMU initialization:

RegionTypeCacheableShareablePermissions
0x00000000-0x3FFFFFFFNormalYes (WB)InnerEL1 RW
0xFE000000-0xFF800000DeviceNoNoEL1 RW

Normal Memory (kernel code/data):

  • Write-Back, Read/Write-Allocate caching
  • Inner Shareable for multi-core coherency
  • ~100x faster than uncached access

Device Memory (MMIO):

  • Device-nGnRnE (non-Gathering, non-Reordering, no Early-ack)
  • Strictly ordered, every access reaches hardware
  • Required for correct peripheral operation

See MMU & Paging for MAIR_EL1 configuration details.

Future Memory Regions

Planned for future milestones:

Address RangePurposeMilestone
Higher-half kernelKernel at 0xFFFF_8000_0000_0000+Phase 5-6
Per-core stacks2 MB × 4 coresPhase 3 (Multi-core)
UserspaceLower 256 TB for user programsPhase 4 (EL0 Userspace)

Code References

  • Linker script: linker.ld
  • Page tables: src/arch/aarch64/mmu.rs (L1_TABLE, L2_TABLE_*)
  • UART base: src/drivers/uart.rs (UART_BASE)
  • GPIO base: src/drivers/gpio.rs (GPIO_BASE)
  • GIC base: src/drivers/gic.rs (GICD_BASE, GICC_BASE)
  • GENET base: src/drivers/genet.rs (GENET_BASE)

External References