ARM11 Kernel Configuration Memory

NAME	PROCESS VIRTUAL ADDRESS	WIDTH
KERNEL_?	0x1FF80000	1
KERNEL_VERSIONREVISION	0x1FF80001	1
KERNEL_VERSIONMINOR	0x1FF80002	1
KERNEL_VERSIONMAJOR	0x1FF80003	1
UPDATEFLAG	0x1FF80004	4
NSTID	0x1FF80008	8
SYSCOREVER	0x1FF80010	4
UNITINFO	0x1FF80014	1
?	0x1FF80015	1
?	0x1FF80016	1
KERNEL_CTRSDKVERSION	0x1FF80018	4
APPMEMTYPE	0x1FF80030	4
APPMEMALLOC	0x1FF80040	4
?	0x1FF80044	4
?	0x1FF80048	4
FIRM_?	0x1FF80060	1
FIRM_VERSIONREVISION	0x1FF80061	1
FIRM_VERSIONMINOR	0x1FF80062	1
FIRM_VERSIONMAJOR	0x1FF80063	1
FIRM_SYSCOREVER	0x1FF80064	4
FIRM_CTRSDKVERSION	0x1FF80068	4

This memory page is read-only for ARM11 processes.

Shared Memory Page For ARM11 Processes

NAME	PROCESS VIRTUAL ADDRESS	WIDTH
WIFI_MACADDR	0x1FF81060	6
3D_SLIDERSTATE	0x1FF81080	4
3D_LEDSTATE	0x1FF81084	1
MENUTID	0x1FF810A0	8
ACTIVEMENUTID	0x1FF810A8	8
signed ? HeadsetsConnected?	0x1FF810C0	1

This memory page is normally read-only for ARM11 processes, write-access is determined by the process exheader kernel "Shared page writing" flag.

ARM11 Kernel Config Fields

0x1FF80000 / 0x1FF80060

Unknown, this is normally value 0.

KERNEL_VERSIONREVISION / FIRM_VERSIONREVISION

This is the version-revision for the currently running FIRM.

KERNEL_VERSIONMINOR

This is the version-minor from ((title-version & 0x3FF) >> 4), for the currently running FIRM. The values from KERNEL_VERSIONMINOR and KERNEL_VERSIONMAJOR can be stored in applications' CXI exheader.

FIRM_VERSIONMINOR

This is the same as KERNEL_VERSIONMINOR. After AM:InstallNATIVEFIRM checks FIRM_SYSCOREVER, AM:InstallNATIVEFIRM then compares FIRM_VERSIONMINOR with the NATIVE_FIRM ((title-version & 0x3FF) >> 4), when the latter is larger than FIRM_VERSIONMINOR AM:InstallNATIVEFIRM will trigger a FIRM install.

KERNEL_VERSIONMAJOR / FIRM_VERSIONMAJOR

This is the version-major for the currently running FIRM.

UPDATEFLAG

Normally this flag is zero. When the ARM11 kernel is booting it will set this flag to 1, when bit0 from the data which field 0x1FF80016 is loaded from is clear, if the following PAD buttons are pressed: L, R, A, Up. When this flag is set, NS will launch the System Updater title instead of Home Menu.

NSTID

This field contains the titleID of the first title to launch from CTR-NAND after the FIRM system processes are loaded. The PM module launches this title. If this field titleID is all-zero, the system will not attempt to launch the title. The regular ARM11 kernel sets this to the regular NS titleID, while the SAFE_MODE ARM11 kernel sets this to the SAFE_MODE NS titleID.

SYSCOREVER

This field is initialized by the ARM11 kernel, this is the programID-low of the running FIRM. When launching CXIs, the value stored here must match the core version field stored in the CXI exheader. If they do not match, the PM module will refuse to launch the ARM11 process.

FIRM_SYSCOREVER

Normally this is the same as SYSCOREVER. This used by AM:InstallNATIVEFIRM for comparing with the NATIVE_FIRM titleID-low. When the low u8 from the NATIVE_FIRM titleID-low is larger than FIRMSYSCOREVER, AM:InstallNATIVEFIRM will trigger FIRM installing. When that u8 is not larger than FIRM_SYSCOREVER, and these two values don't match, AM:InstallNATIVEFIRM will return an error.

UNITINFO

Bit	Description
0	Clear for dev unit, set for retail.(See 0x1FF80015)
1	Set for debug units
2-7	?

Bit1 in this field is set by the ARM11 kernel when ARM debug CP14 DSCR bit14 is set. NS loads the menu TID from MENUTID when bits 1-7 of this register are clear. ErrDisp will display development error info when bit0 is clear.

0x1FF80015

When this field is zero, bit0 for UNITINFO is set for retail. When this field is non-zero, bit0 for UNITINFO is clear for dev/debug units, and an ARM11 kernel state flag which enables debugging is set.

0x1FF80016

This originates from the low 8-bits of register 0x10010000. When bit0 is set, the ARM11 kernel will not set the UPDATEFLAG to value 1.

KERNEL_CTRSDKVERSION / FIRM_CTRSDKVERSION

This is the CTR-SDK version which was used to build the currently running FIRM.

APPMEMTYPE

The value of this field determines the size for APPMEMALLOC. The retail type(value0) is used when the type is not values 2-5. See Memory_layout for the table of values for this and the mem-region sizes.

APPMEMALLOC

This contains the total size of the memory that can be allocated with the application memory-type. On retail this is 64MB for prod.

0x1FF80044

The size value for this field is: 0x08000000 - (APPMEMALLOC + *0x1FF80048).(Total FCRAM size - APPMEMALLOC - *0x1FF80048)

0x1FF80048

Normally this is value 0x1400000, for size 20MB.

Shared Memory Page Fields

WIFI_MACADDR

This is the wifi MAC address for this 3DS. This is initialized by the NWM module, it's unknown where the the MAC address written here was originally loaded from.

3D_SLIDERSTATE

This float contains the state of the 3D slider. The range of this float is value 0.0f for "off", and 1.0f for max.

3D_LEDSTATE

When non-zero, the 3D LED is disabled. See GSPGPU:SetLedForceOff.

MENUTID

Unknown, contains the menu TID(used by NS).

ACTIVEMENUTID

This contains the titleID of the currently running menu launched by NS.

NATIVE_FIRM Versions

System version	Title-version	Hex title contentID	Kernel/FIRM version
1.0.0-0	v432	00	2.27-0
1.1.0-1	v1472	02	2.28-0
2.0.0-2	v2516	09	2.29-7
2.1.0-3	v3553	0B	2.30-18
2.2.0-X	v4595	0F	2.31-40
3.0.0-5	v5647	18	2.32-15
4.0.0-7	v6677	1D	2.33-4
4.1.0-8	v7712	1F	2.34-0
5.0.0-11	v8758	25	2.35-6
5.1.0-11	v9792	26	2.36-0
6.0.0-11	v10833	29	2.37-0
6.1.0-11	v11872	2A	2.38-0
7.0.0-13	v12916	2E	2.39-4
7.2.0-17	v13956	30	2.40-0
8.0.0-18	v15047	37	2.44-6

The above kernel/FIRM versions are in the format: <KERNEL_VERSIONMAJOR>.<KERNEL_VERSIONMINOR>-<KERNEL_VERSIONREVISION>.