--- /sys/src/9/bcm64/MEMORYMAP	Tue Aug 11 19:09:54 2026
+++ /sys/src/9/bcm64/MEMORYMAP	Tue Jun  2 11:48:47 2026
@@ -14,3 +14,30 @@
 
 10 0000 0000	10 0000 0000	identity mapping for local bus
 10 8000 0000					top of virtual space
+
+VIRTIO map
+
+local bus
+0x00fff000	emmc1
+0x01100000	emmc2
+0x7c013880	vcore mailbox
+0x7d001000	debug uart
+0x7d200000	power regs
+0x7d508500	gpio
+0x7d504100	pin mux
+0x7c003000	timers
+
+RP1 pcie space		1c 0000 0000
+0x80030000	uart1
+0x80034000	uart2
+0x80038000	uart3
+0x8003c000	uart4
+0x80040000	uart5
+0x800d0000	RP1 gpio
+0x80100000	gem ethernet
+0x80108000	intc
+0x80200000	xhci0
+0x80300000	xhci1
+
+other pcie space	1B 8000 0000
+0xc0000000	nvme
--- /sys/src/9/bcm64/dat.h	Tue Aug 11 19:09:54 2026
+++ /sys/src/9/bcm64/dat.h	Tue Jul 21 11:47:21 2026
@@ -73,10 +73,10 @@
 	ulong	status;
 	ulong	control;
 	/*
-	 * vfp3 with ieee fp regs; uvlong is sufficient for hardware but
+	 * floating point & advanced simd (neon) registers: 128-bit
 	 * each must be able to hold an Internal from fpi.h for sw emulation.
 	 */
-	ulong	regs[Maxfpregs][3];
+	ulong	regs[Maxfpregs][4];
 
 	int	fpstate;
 	uintptr	pc;		/* of failed fp instr. */
@@ -337,6 +337,7 @@
 	uintptr	busio;
 	uintptr	armlocal;
 	uintptr	pcispace;
+	uintptr pcispace1;
 	uint	oscfreq;
 	uint	emmc2freq;
 	uint	dstepping;
--- /sys/src/9/bcm64/ethergem.c	Tue Aug 11 19:09:54 2026
+++ /sys/src/9/bcm64/ethergem.c	Sat Jun 13 13:44:05 2026
@@ -424,7 +424,7 @@
 	}
 	//if(td == nil && qcanread(edev->oq))
 	//	iprint("gemtransmit(after %d): queue full\n", n);
-	if(n)
+	if(ringtail(r) != nil)
 		regs[Ctl] |= Txstart;
 	iunlock(&ctlr->txlock);
 }
--- /sys/src/9/bcm64/l.s	Tue Aug 11 19:09:54 2026
+++ /sys/src/9/bcm64/l.s	Tue Jul 21 10:01:52 2026
@@ -575,6 +575,22 @@
 	FSTQ	(13,0,208)
 	FSTQ	(14,0,224)
 	FSTQ	(15,0,240)
+	FSTQ	(16,0,256)
+	FSTQ	(17,0,272)
+	FSTQ	(18,0,288)
+	FSTQ	(19,0,304)
+	FSTQ	(20,0,320)
+	FSTQ	(21,0,336)
+	FSTQ	(22,0,352)
+	FSTQ	(23,0,368)
+	FSTQ	(24,0,384)
+	FSTQ	(25,0,400)
+	FSTQ	(26,0,416)
+	FSTQ	(27,0,432)
+	FSTQ	(28,0,448)
+	FSTQ	(29,0,464)
+	FSTQ	(30,0,480)
+	FSTQ	(31,0,496)
 	RETURN
 
 #define FLDQ(src,off,dst)	WORD	$(0x3DC00000 | dst<<0 | src<<5 | (off/16)<<10)
@@ -595,6 +611,22 @@
 	FLDQ	(0,208,13)
 	FLDQ	(0,224,14)
 	FLDQ	(0,240,15)
+	FLDQ	(0,256,16)
+	FLDQ	(0,272,17)
+	FLDQ	(0,288,18)
+	FLDQ	(0,304,19)
+	FLDQ	(0,320,20)
+	FLDQ	(0,336,21)
+	FLDQ	(0,352,22)
+	FLDQ	(0,368,23)
+	FLDQ	(0,384,24)
+	FLDQ	(0,400,25)
+	FLDQ	(0,416,26)
+	FLDQ	(0,432,27)
+	FLDQ	(0,448,28)
+	FLDQ	(0,464,29)
+	FLDQ	(0,480,30)
+	FLDQ	(0,496,31)
 	RETURN
 
 TEXT cas(SB), 1, $-4
--- /sys/src/9/bcm64/main.c	Tue Aug 11 19:09:54 2026
+++ /sys/src/9/bcm64/main.c	Wed Jun  3 14:02:49 2026
@@ -183,6 +183,7 @@
 dtproperty(Dtnode n, char *prop, uchar *value, int len)
 {
 	extern uchar ether0mac[];
+	int i;
 
 	if(!strcmp(n.name, "chosen") && !strcmp(prop, "bootargs"))
 		plan9iniinit((char*)value, 1);
@@ -190,13 +191,30 @@
 	  !strcmp(n.parent->name, "rp1") &&
 	  strstr(prop, "local-mac-address") && len == 6)
 		memmove(ether0mac, value, 6);
-	else if(!strncmp(n.name, "pcie@12", 7) &&
+	else if(!strncmp(n.name, "pcie@100011", 11) &&
 	  !strcmp(prop, "ranges") &&
 	  len >= 48)
-		soc.pcispace = (uvlong)nhgetl(value+40) << 32;
-	else if(!strcmp(n.name, "memory@0") && !strcmp(prop, "reg"))
-		conf.mem[0].limit = nhgetl(value + 8);
-	else if(!strcmp(n.name, "clk_emmc2") && !strcmp(prop, "clock-frequency"))
+		soc.pcispace1 = nhgetv(value+40);
+	else if(!strncmp(n.name, "pcie@", 5) &&
+	  !strcmp(prop, "ranges") &&
+	  len >= 48)
+		soc.pcispace = nhgetv(value+40);
+	else if(!strcmp(n.name, "memory@0") && !strcmp(prop, "reg")){
+		conf.mem[0].base = nhgetv(value);
+		conf.mem[0].limit = conf.mem[0].base + nhgetl(value + 8);
+		conf.mem[1].base = nhgetv(value + 12);
+		conf.mem[1].limit = conf.mem[1].base + nhgetl(value + 20);
+		for(i = 24; i < len; i += 12){
+			if(i == 24){
+				conf.himem.base = nhgetv(value + i);
+				conf.himem.limit = conf.himem.base + nhgetl(value + i + 8);
+			}else{
+				if(nhgetv(value + i) != conf.himem.limit)
+					break;
+				conf.himem.limit += nhgetl(value + i + 8);
+			}
+		}
+	}else if(!strcmp(n.name, "clk-emmc2") && !strcmp(prop, "clock-frequency"))
 		soc.emmc2freq = nhgetl(value);
 	else if(!strncmp(n.name, "framebuffer@", 12) &&
 	  !strcmp(n.parent->name, "chosen"))
@@ -229,39 +247,10 @@
 			memsize = 16*MB;
 	}
 
-	getramsize(&conf.mem[0]);
 	if(conf.mem[0].limit == 0){
 		conf.mem[0].base = PHYSDRAM;
 		conf.mem[0].limit = PHYSDRAM + memsize;
 	}
-	/*
-	 * pi4 extra memory (beyond video ram) indicated by board id
-	 */
-	switch(getboardrev()&0xF00000){
-	case 0xA00000:
-		break;
-	case 0xB00000:
-		conf.mem[1].base = 1*GiB;
-		conf.mem[1].limit = 2*GiB;
-		break;
-	case 0xC00000:
-		conf.mem[1].base = 1*GiB;
-		conf.mem[1].limit = 0xFF000000;
-		break;
-	default:
-	case 0xD00000:
-		conf.mem[1].base = 1*GiB;
-		conf.mem[1].limit =  0xFF000000;
-		conf.himem.base = 4LL*GiB;
-		conf.himem.limit = 8LL*GiB;
-		break;
-	case 0xE00000:
-		conf.mem[1].base = 1*GiB;
-		conf.mem[1].limit = 0xFF000000;
-		conf.himem.base = 4LL*GiB;
-		conf.himem.limit = 16LL*GiB;
-		break;
-	}
 	if(p != nil){
 		for(i = 0; i < nelem(conf.mem); i++){
 			if(memsize < conf.mem[i].base)
@@ -459,7 +448,7 @@
 	if(pl011init != nil)
 		(*pl011init)();
 	print("\nPlan 9 from Bell Labs\n");
-	print("vcore reports memory = 0x%llux\n", conf.mem[0].limit);
+	print("pcispace %#p %#p\n", soc.pcispace, soc.pcispace1);
 	trapinit();
 	clockinit();
 	printinit();
--- /sys/src/9/bcm64/mkfile	Tue Aug 11 19:09:54 2026
+++ /sys/src/9/bcm64/mkfile	Wed Sep  2 09:45:40 2026
@@ -72,7 +72,6 @@
 	$CC $CFLAGS '-DKERNDATE='`{date -n} $CONF.c
 	echo '# linking raw kernel'	# H6: no headers, data segment aligned
 	$LD -s -l -o $target -H6 -R4096 -T$loadaddr $OBJ $CONF.$O $LIB
-	cp $target /lib/tftpd/faa1159e
 
 s$p$CONF:DQ:	$CONF.$O $OBJ $LIB
 	echo '# linking kernel with symbols'
--- /sys/src/9/bcm64/mmu64.c	Tue Aug 11 19:09:54 2026
+++ /sys/src/9/bcm64/mmu64.c	Tue Jun  2 13:36:51 2026
@@ -134,7 +134,8 @@
 	/*
 	 * map 4G for I/O registers at VIRTIO = 06 0000 0000
 	 * first half maps to local bus at 10 0000 0000 - 10 7FFF FFFF
-	 * second half maps to RP1 in PCI window at 1C 0000 0000 - 1C 7FFF FFFF
+	 * third quarter maps to RP1 in PCI window at 1C 0000 0000 - 1C 3FFF FFFF
+	 * fourth quarter maps to other PCI window at 18 0000 0000 - 18 3FFF FFFF
 	 */
 	pa = 0x1000000000ull;
 	va = VIRTIO;
@@ -145,6 +146,12 @@
 		pa += GiB;
 	}
 	pa = soc.pcispace;
+	for(; i < 3; i++){
+		l0[L0X(va)] = pa|LAttrIO|LBlock;
+		va += GiB;
+		pa += GiB;
+	}
+	pa = soc.pcispace1;
 	for(; i < 4; i++){
 		l0[L0X(va)] = pa|LAttrIO|LBlock;
 		va += GiB;
--- /sys/src/9/bcm64/syscall.c	Tue Aug 11 19:09:54 2026
+++ /sys/src/9/bcm64/syscall.c	Mon Jul 13 09:58:14 2026
@@ -364,7 +364,7 @@
 	up->psstate = 0;
 
 	if(scallnr == NOTED)
-		noted(ureg, *(ulong*)(sp+BY2WD));
+		noted(ureg, up->s.args[0]);
 
 	splhi();
 	if(scallnr != RFORK && (up->procctl || up->nnote))
--- /sys/src/9/bcm64/trap.c	Tue Aug 11 19:09:54 2026
+++ /sys/src/9/bcm64/trap.c	Tue Jul 14 12:47:31 2026
@@ -592,7 +592,10 @@
 	insyscall = up->insyscall;
 	up->insyscall = 1;
 
-	n = fault(va, read);		/* goes spllo */
+	if(va>>32)
+		n = -1;
+	else
+		n = fault(va, read);		/* goes spllo */
 	splhi();
 	if(n < 0){
 		char buf[ERRMAX];