First, AWESOME that the document QA7 is available to us!
Now, the arm control logic is right above the GPU peripheral address space (as set up by the 'default' GPU-boot)? The address 0x4000 0000 is the ARM physical address?
It's also not clear to me which lower memory regions might be used by GPU such that ARM-side should not mess with it. The VC SDRAM? What's the 'safe' address range for Arm programs when the default files - bootcode.bin and start.elf are used? I've gotten an impression that the very low addresses (0 - something) have some special (GPU-related) use.