All from the kernel sources, cat /proc/iomem, devmem and looking in the AMSS.
The wierd thing is that on other MSM implementations the AMSS is EITHER loaded into low 31Mb SMI64 _OR_ upper EBI. Samsung seem to have done both. I have no idea why!
We should really be able to use all of the 128Mb, and use the lower 31Mb of SMI64 for the baseband. We should also be able to use 2Mb of that 31Mb that is empty because the baseband size is only 19mb + 10mb for bootloaders.
Unfortunatly the kernel can't seem to read the EBI above the 109Mb boundry or the Lower 31Mb of SMI. This might take some findling with the MPU/MMU