Memory layout

Physical memory regions

Address	Size	Description
0x0	0x10000	Bootrom (super secret code/data @ 0x8000)
0x10000	0x10000	Bootrom mirror
0x10000000	?	IO memory
0x1FF00000	0x80000	DSP memory
0x1FF80000	0x80000	AXI WRAM
0x20000000	0x8000000	FCRAM

ARM11 User-land memory regions

Virtual Address	Region Max Size	Description
0x00100000 / 0x14000000	0x03F00000	The ExeFS:/.code is loaded here, executables must be loaded to the 0x00100000 region when the exheader "special memory" flag is clear. The 0x03F00000-byte size restriction only applies when this flag is clear. Executables are usually loaded to 0x14000000 when the exheader "special memory" flag is set, however this address can be arbitrary.
0x08000000	0x08000000	Heap mapped by ControlMemory
0x10000000-StackSize	StackSize from process exheader	Stack for the main-thread, initialized by the ARM11 kernel. The StackSize from the exheader is usually 0x4000, therefore the stack-bottom is usually 0x0FFFC000.
0x10000000	0x04000000	Applications usually map this region for HID
0x14000000	0x08000000	Can be mapped by ControlMemory
0x1EC00000		IO registers, the mapped IO pages which each process can access is specified in the CXI exheader.(Applications normally don't have access to registers in this range)

All executable pages are read-only, and data pages have the execute-never permission set. Normally .text from the loaded ExeFS:/.code is the only mapped executable memory. Executable CROs can be loaded into memory, once loaded the CRO .text section memory page permissions are changed via ControlProcessMemory from RW- to R-X. The address and size of each ExeFS:/.code section is stored in the exheader, the permissions for each section is: .text R-X, .rodata R--, .data RW-, and .bss RW-. The loaded .code is mapped to the addresses specified in the exheader by the ARM11 kernel. The stack permissions is initialized by the ARM11 kernel: RW-. The heap permissions is normally RW-.