3dbrew - User contributions [en]

KDebug

2016-12-13T01:24:53Z

Bond697:

[[Category:Kernel synchronization objects]]
[[Category:Kernel interrupt events]]
class [[KDebug]] extends [[KSynchronizationObject]] and [[KSendableInterruptEvent]];

Size : 0xA0 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Count of KThreads that sync with this object - number of nodes in the linked list below
|-
| 0xC
| KLinkedListNode*
| Pointer to first KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x10
| KLinkedListNode*
| Pointer to last KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x14
| [[KSendableInterruptEvent]]
| Process termination event
|-
| 0x2C
| u32
| Debug event flags.
Bit0: debugger is attached, bit1: report CPU exceptions, bit2 : ?, bit3: ?, bit4: ?
|-
| 0x30
| u32
| Stop point type that caused the event: 0 = svc 0xFF, 1 = breakpoint, 2 = watchpoint (otherwise it's not updated).
|-
| 0x34
| u32
| Count of KEventInfo object nodes associated with this KDebug object
|-
| 0x38
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in linked list of KEventInfo objects
|-
| 0x3C
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in linked list of KEventInfo objects
|-
| 0x4C
| [[KProcess]]*
| Process the thread belongs to (virtual address)
|-
| 0x50
| [[KThread]]*
| Current KThread- thread being debugged
|-
| 0x54
| [[KThread]]*
| Thread using ContinueDebugEvent
|-
| 0x58
| s32
| Cpu core of thread using ContinueDebugEvent
|-
| 0x5C
| u32
| Count of KDebugThread object nodes associated with this KDebug object
|-
| 0x60
| KLinkedListNode*
| Pointer to first KLinkedListNode in linked list of KDebugThread objects
|-
| 0x64
| KLinkedListNode*
| Pointer to last KLinkedListNode in linked list of KDebugThread objects
|-
| 0x68
| u32
| Count of KDebug object nodes
|-
| 0x6C
| KLinkedListNode*
| Pointer to first KLinkedListNode in linked list of KDebug objects
|-
| 0x70
| KLinkedListNode*
| Pointer to last KLinkedListNode in linked list of KDebug objects
|-
| 0x74
| [[KRecursiveLock]] *
| Recursive lock
|-
| 0x7C
| [[KThread]]*
| Current KThread- used in svcBreak
|-
| 0x84
| u8
| Set to 1 to indicate the KProcess it belongs to exited
|-
| 0x85
| u8
| Set to 1 to indicate the KProcess it belongs to has been terminated
|-
| 0x88
| u32 *
| Register dump
|-
| 0x8C
| u32
| [[SVC#EXCEPTION_event|Exception type]]
|-
| 0x92
| u16
| ID of the invalid SVC that was attempted
|-
| 0x98
| const char *
| Debug string
|-
| 0x9C
| u32
| Debug string length
|}

Exception fields are set for the latest notified exception that occured in userland.

KDebug

2016-12-13T01:24:16Z

Bond697:

[[Category:Kernel synchronization objects]]
[[Category:Kernel interrupt events]]
class [[KDebug]] extends [[KSynchronizationObject]] and [[KSendableInterruptEvent]];

Size : 0xA0 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Count of KThreads that sync with this object - number of nodes in the linked list below
|-
| 0xC
| KLinkedListNode*
| Pointer to first KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x10
| KLinkedListNode*
| Pointer to last KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x14
| [[KSendableInterruptEvent]]
| Process termination event
|-
| 0x2C
| u32
| Debug event flags.
Bit0: debugger is attached, bit1: report CPU exceptions, bit2 : ?, bit3: ?, bit4: ?
|-
| 0x30
| u32
| Stop point type that caused the event: 0 = svc 0xFF, 1 = breakpoint, 2 = watchpoint (otherwise it's not updated).
|-
| 0x34
| u32
| Count of KEventInfo object nodes associated with this KDebug object
|-
| 0x38
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in linked list of KEventInfo objects
|-
| 0x3C
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in linked list of KEventInfo objects
|-
| 0x4C
| [[KProcess]]*
| Process the thread belongs to (virtual address)
|-
| 0x50
| [[KThread*]]
| Current KThread- thread being debugged
|-
| 0x54
| [[KThread*]]
| Thread using ContinueDebugEvent
|-
| 0x58
| s32
| Cpu core of thread using ContinueDebugEvent
|-
| 0x5C
| u32
| Count of KDebugThread object nodes associated with this KDebug object
|-
| 0x60
| KLinkedListNode*
| Pointer to first KLinkedListNode in linked list of KDebugThread objects
|-
| 0x64
| KLinkedListNode*
| Pointer to last KLinkedListNode in linked list of KDebugThread objects
|-
| 0x68
| u32
| Count of KDebug object nodes
|-
| 0x6C
| KLinkedListNode*
| Pointer to first KLinkedListNode in linked list of KDebug objects
|-
| 0x70
| KLinkedListNode*
| Pointer to last KLinkedListNode in linked list of KDebug objects
|-
| 0x74
| [[KRecursiveLock]] *
| Recursive lock
|-
| 0x7C
| [[KThread*]]
| Current KThread- used in svcBreak
|-
| 0x84
| u8
| Set to 1 to indicate the KProcess it belongs to exited
|-
| 0x85
| u8
| Set to 1 to indicate the KProcess it belongs to has been terminated
|-
| 0x88
| u32 *
| Register dump
|-
| 0x8C
| u32
| [[SVC#EXCEPTION_event|Exception type]]
|-
| 0x92
| u16
| ID of the invalid SVC that was attempted
|-
| 0x98
| const char *
| Debug string
|-
| 0x9C
| u32
| Debug string length
|}

Exception fields are set for the latest notified exception that occured in userland.

KThread

2016-12-11T21:19:36Z

Bond697:

[[Category:Kernel synchronization objects]]
[[Category:Kernel interrupt events]]
class [[KThread]] extends [[KSynchronizationObject]], [[KTimeableInterruptEvent]], [[KSendableInterruptEvent]] and [[KSchedulableInterruptEvent]];

Size : 0xB0 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Count of KThreads that sync with this object - number of nodes in the linked list below
|-
| 0xC
| KLinkedListNode*
| Pointer to first KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x10
| KLinkedListNode*
| Pointer to last KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x14
| [[KTimeableInterruptEvent]]
| Used to suspend threads (*this)
|-
| 0x24
| [[KSendableInterruptEvent]]
| Interrupt event (*this) sent to terminate a thread, except in the case just below
|-
| 0x2C
| [[KSchedulableInterruptEvent]]
| Interrupt event (*this) scheduled by the IRQ handler when the thread should terminate (*this)
|-
| 0x34
| u8
| Whether the thread is in the scheduler's queue and is ready to run
|-
| 0x35
| u8
| Used in syncing
|-
| 0x36
| s8
| Indicates that the thread shall terminate
|-
| 0x37
| u8
| Used in syncing
|-
| 0x38
| KDebugThread*
| Pointer to KDebugThread object used with the current KThread
|-
| 0x3C
| u32
| Base thread priority
|-
| 0x40
| u32
| Pointer to object the KThread is waiting on- can be a timer, event, session, etc.
|-
| 0x44
| Result
| Status for object above
|-
| 0x48
| KObjectMutex*
| Locking kernel mutex
|-
| 0x4C
| u32
| Arbitration address
|-
| 0x50
| KLinkedListNode*
| Pointer to first KLinkedListNode in node list of objects this thread is waiting on
|-
| 0x54
| KLinkedListNode*
| Pointer to last KLinkedListNode in node list of objects this thread is
|-
| 0x5C
| [[KMutex|KMutexLinkedList]] *
| Set in some very specific circumstances
|-
| 0x60
| u32
| Count of KMutex objects this thread is using
|-
| 0x64
| KLinkedListNode*
| Pointer to first KLinkedListNode in node list of KMutex objects this thread is using
|-
| 0x68
| KLinkedListNode*
| Pointer to last KLinkedListNode in node list of KMutex objects this thread is using
|-
| 0x6C
| s32
| Dynamic thread priority
|-
| 0x70
| s32
| Processor that created the thread
|-
| 0x74
| u32
| Pointer to [[KResourceLimit]]+0x60, which holds the amount of CPU time available in ticks
|-
| 0x7C
| u8
| ?
|-
| 0x7D
| u8
| ?
|-
| 0x7E
| u8
| Thread affinity mask - set differently depending on whether the thread is created via svc call or from inside the kernel
|-
| 0x80
| KProcess*
| Process the thread belongs to (virtual address)
|-
| 0x84
| u32
| Thread id
|-
| 0x88
| u32*
| Ptr to svc mode register storage for KThread inside the thread context.
|-
| 0x8C
| u32*
| End-address of the page for this thread context allocated in the [[Memory_layout|0xFF4XX000]] region. Thus, if the beginning of this mapped page is 0xFF401000, this ptr would be 0xFF402000. Thread context page - used for thread svc stack, preserving svc mode registers and VFP exception register for thread.
|-
| 0x90
| s32
| Ideal processor (processorid value from [[SVC|svcCreateThread]])
|-
| 0x94
| void*
| Ptr to [[Thread Local Storage]]
|-
| 0x98
| void*
| Ptr to [[Thread Local Storage]] in FCRAM via kernel vmem
|-
| 0xA0
| KThreadLinkedListNode
| Previous and next scheduled threads
|-
| 0xA8
| KThreadLinkedList *
| Pointer to linked list of scheduled threads that has stolen it, or 0 if in normal list
|-
| 0xAC
| s32
| Priority field used for priority inheritance when needed
|}

With the following declarations: <code>struct KThreadLinkedList { KThread *first, *last; };</code> and <code>struct KThreadLinkedListNode { KThread *prev, *next; };</code>.

=Thread Affinity Mask=

If the thread is created via a call to SVC 8(CreateThread), which uses thread creation type 3, and the CPU ID is -2(meaning use the core specified in the exheader), the mask is just the affinity mask from the thread's owner KProcess. If the CPU ID is -1(meaning any core), the affinity mask is set to 0xF on the New3DS and 0x3 on the Old3DS. Otherwise, the affinity mask is (1 << cpu_id) | 1.

If the thread is created via a call by the kernel, which uses thread creation types 0-2, the checks for -1 and -2 are skipped and the mask is always (1 << cpu_id) | 1.

KResourceLimit

2016-12-11T21:18:39Z

Bond697:

[[Category:Kernel auto objects]]
class [[KResourceLimit]] extends [[KAutoObject]];

Size : 0x74 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| s32
| Max Priority
|-
| 0xC
| s32
| Max commit
|-
| 0x10
| s32
| Max thread
|-
| 0x14
| s32
| Max event
|-
| 0x18
| s32
| Max mutex
|-
| 0x1C
| s32
| Max semaphore
|-
| 0x20
| s32
| Max timer
|-
| 0x24
| s32
| Max shared memory
|-
| 0x28
| s32
| Max address arbiter
|-
| 0x2C
| s32
| Max CPU time
|-
| 0x30
| s32
| Current Priority
|-
| 0x34
| s32
| Current commit
|-
| 0x38
| s32
| Current thread
|-
| 0x3C
| s32
| Current event
|-
| 0x40
| s32
| Current mutex
|-
| 0x44
| s32
| Current semaphore
|-
| 0x48
| s32
| Current timer
|-
| 0x4C
| s32
| Current shared memory
|-
| 0x50
| s32
| Current address arbiter
|-
| 0x54
| s32
| Current CPU time
|-
| 0x58
| KObjectMutex
| Mutex
|-
| 0x60
| u32
| CPU time available in ticks
|-
| 0x64
| u32
| Unknown
|-
| 0x68
| u32
| Unknown
|-
| 0x6C
| u32
| Unknown
|}

There are 4 KResourceLimit objects created on the kernel heap. Each is used for a different category specified by the exheader's resource limit category specifier in the exheader [[NCCH/Extended_Header#ARM11_Local_System_Capabilities|ARM11 Local System Capabilities]].

KClassToken

2016-12-10T19:18:30Z

Bond697:

[[Category:Kernel objects]]

Size : 0x5 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| char*
| Pointer to kernel type string
|-
| 0x4
| u8
| Kernel object descriptive bitflags
|}

Each type of kernel object has a token that describes it. The token is used to make sure that a kernel object of a certain type is able to perform a function requested by the kernel.

= Bitflags =
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| Can synchronize
|-
| 1
| Is interruptible
|-
| 2
|
|-
| 3
|
|-
| 4
|
|-
| 5
|
|-
| 6
|
|-
| 7
|
|}

== Bitflags and their corresponding objects ==
{| class="wikitable" border="1"
|-
! colspan="8"|Bits
! Value
! Associated class
|-
| 1
| 0
| 0
| 1
| 1
| 0
| 1
| 0
| 0x59
| [[KDmaObject]]
|-
| 1
| 0
| 1
| 0
| 1
| 0
| 1
| 0
| 0x55
| [[KServerPort]]
|-
| 1
| 0
| 1
| 0
| 0
| 0
| 1
| 1
| 0xC5
| [[KProcess]]
|-
| 1
| 0
| 1
| 0
| 1
| 1
| 0
| 0
| 0x35
| [[KTimer]]
|-
| 0
| 0
| 0
| 0
| 1
| 1
| 0
| 1
| 0xB0
| [[KSharedMemory]]
|-
| 0
| 0
| 0
| 1
| 0
| 0
| 1
| 1
| 0xC8
| [[KResourceLimit]]
|-
| 1
| 0
| 0
| 0
| 0
| 0
| 0
| 0
| 0x01
| [[KSynchronizationObject]]
|-
| 0
| 0
| 0
| 0
| 1
| 1
| 1
| 0
| 0x70
| [[KSession]]
|-
| 0
| 0
| 0
| 1
| 0
| 1
| 0
| 1
| 0xA8
| [[KPort]]
|-
| 1
| 1
| 1
| 1
| 0
| 1
| 0
| 0
| 0x2F
| [[KSemaphore]]
|-
| 1
| 0
| 1
| 1
| 0
| 0
| 1
| 0
| 0x4D
| [[KDebug]]
|-
| 1
| 0
| 1
| 1
| 0
| 0
| 0
| 1
| 0x8D
| [[KThread]]
|-
| 1
| 0
| 1
| 0
| 1
| 0
| 0
| 1
| 0x95
| [[KServerSession]]
|-
| 0
| 0
| 0
| 1
| 1
| 0
| 0
| 1
| 0x98
| [[KAddressArbiter]]
|-
| 0
| 0
| 0
| 1
| 0
| 1
| 1
| 0
| 0x68
| [[KCodeSet]]
|-
| 1
| 1
| 1
| 1
| 1
| 0
| 0
| 0
| 0x1F
| [[KEvent]]
|-
| 1
| 0
| 1
| 0
| 0
| 1
| 1
| 0
| 0x65
| [[KClientPort]]
|-
| 0
| 0
| 0
| 0
| 0
| 0
| 0
| 0
| 0x00
| [[KAutoObject]]
|-
| 1
| 0
| 1
| 0
| 0
| 1
| 0
| 1
| 0xA5
| [[KClientSession]]
|-
| 1
| 0
| 0
| 1
| 1
| 1
| 0
| 0
| 0x39
| [[KMutex]]
|}

KClassToken

2016-12-10T18:57:44Z

Bond697:

[[Category:Kernel objects]]

Size : 0x5 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| char*
| Pointer to kernel type string
|-
| 0x4
| u8
| Kernel object descriptive bitflags
|}

Each type of kernel object has a token that describes it. The token is used to make sure that a kernel object of a certain type is able to perform a function requested by the kernel.

= Bitflags =
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| Can synchronize
|-
| 1
| Is interruptible
|-
| 2
|
|-
| 3
|
|-
| 4
|
|-
| 5
|
|-
| 6
|
|-
| 7
|
|}

== Bitflags and their corresponding objects ==
0 1 0 1 1 0 0 1 | 0x59 - KDmaObject 
0 0 1 0 1 1 1 1 | 0x2F - KSemaphore 
0 0 0 0 0 0 0 0 | 0x00 - KAutoObject 
0 1 1 0 0 1 0 1 | 0x65 - KClientPort 
0 1 0 1 0 1 0 1 | 0x55 - KServerPort 
1 0 1 1 0 0 0 0 | 0xB0 - KSharedMemory 
1 0 1 0 0 1 0 1 | 0xA5 - KClientSession 
1 1 0 0 1 0 0 0 | 0xC8 - KResourceLimit 
1 0 0 1 0 1 0 1 | 0x95 - KServerSession 
1 0 0 1 1 0 0 0 | 0x98 - KAddressArbiter 
0 0 0 0 0 0 0 1 | 0x01 - KSynchronizationObject 
1 0 1 0 1 0 0 0 | 0xA8 - KPort 
0 0 0 1 1 1 1 1 | 0x1F - KEvent 
0 0 1 1 1 0 0 1 | 0x39 - KMutex 
0 0 1 1 0 1 0 1 | 0x35 - KTimer 
0 1 0 0 1 1 0 1 | 0x4D - KDebug 
1 0 0 0 1 1 0 1 | 0x8D - KThread 
0 1 1 0 1 0 0 0 | 0x68 - KCodeSet 
1 1 0 0 0 1 0 1 | 0xC5 - KProcess 
0 1 1 1 0 0 0 0 | 0x70 - KSession

KClassToken

2016-12-10T18:06:19Z

Bond697:

KClassToken

2016-12-10T18:04:45Z

Bond697: Created page with "Category:Kernel objects Size : 0x5 bytes {| class="wikitable" border="1" |- ! Offset ! Type ! Description |- | 0x0 | char* | Pointer to kernel type string |- | 0x4 | u8..."

KResourceLimit

2016-12-05T18:40:00Z

Bond697:

[[Category:Kernel auto objects]]
class [[KResourceLimit]] extends [[KAutoObject]];

Size : 0x74 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| s32
| Max Priority
|-
| 0xC
| s32
| Max commit
|-
| 0x10
| s32
| Max thread
|-
| 0x14
| s32
| Max event
|-
| 0x18
| s32
| Max mutex
|-
| 0x1C
| s32
| Max semaphore
|-
| 0x20
| s32
| Max timer
|-
| 0x24
| s32
| Max shared memory
|-
| 0x28
| s32
| Max address arbiter
|-
| 0x2C
| s32
| Max CPU time
|-
| 0x30
| s32
| Current Priority
|-
| 0x34
| s32
| Current commit
|-
| 0x38
| s32
| Current thread
|-
| 0x3C
| s32
| Current event
|-
| 0x40
| s32
| Current mutex
|-
| 0x44
| s32
| Current semaphore
|-
| 0x48
| s32
| Current timer
|-
| 0x4C
| s32
| Current shared memory
|-
| 0x50
| s32
| Current address arbiter
|-
| 0x54
| s32
| Current CPU time
|-
| 0x58
| KObjectMutex
| Mutex
|-
| 0x60
| u32
| Unknown
|-
| 0x64
| u32
| Unknown
|-
| 0x68
| u32
| Unknown
|-
| 0x6C
| u32
| Unknown
|}

There are 4 KResourceLimit objects created on the kernel heap. Each is used for a different category specified by the exheader's resource limit category specifier in the exheader [[NCCH/Extended_Header#ARM11_Local_System_Capabilities|ARM11 Local System Capabilities]].

KThread

2016-12-04T22:35:05Z

Bond697:

[[Category:Kernel objects]]
class [[KThread]] extends [[KSynchronizationObject]];

Size : 0xB0 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Count of KThreads that sync with this object - number of nodes in the linked list below
|-
| 0xC
| KLinkedListNode*
| Pointer to first KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x10
| KLinkedListNode*
| Pointer to last KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x14
| [[KTimeableInterruptEvent|KThreadInterruptEvent]]
| Used to suspend threads
|-
| 0x24
| u32
| Start of 0x8 byte unnamed kernel object in KThread
|-
| 0x2C
| u32
| Start of unnamed kernel object of undetermined size in KThread
|-
| 0x34
| u8
| Whether the thread is in the scheduler's queue and is ready to run
|-
| 0x35
| u8
| Used in syncing
|-
| 0x36
| s8
| Indicates that the thread shall terminate
|-
| 0x37
| u8
| Used in syncing
|-
| 0x38
| KDebugThread*
| Pointer to KDebugThread object used with the current KThread
|-
| 0x3C
| u32
| Base thread priority
|-
| 0x40
| u32
| Pointer to object the KThread is waiting on- can be a timer, event, session, etc.
|-
| 0x44
| Result
| Status for object above
|-
| 0x48
| KObjectMutex*
| Locking kernel mutex
|-
| 0x4C
| u32
| Arbitration address
|-
| 0x50
| KLinkedListNode*
| Pointer to first KLinkedListNode in node list of objects this thread is waiting on
|-
| 0x54
| KLinkedListNode*
| Pointer to last KLinkedListNode in node list of objects this thread is
|-
| 0x5C
| [[KSchedulableInterruptEvent|KMutexInterruptEvent]] *
| Set in some very specific circumstances
|-
| 0x60
| u32
| Count of KMutex objects this thread is using
|-
| 0x64
| KLinkedListNode*
| Pointer to first KLinkedListNode in node list of KMutex objects this thread is using
|-
| 0x68
| KLinkedListNode*
| Pointer to last KLinkedListNode in node list of KMutex objects this thread is using
|-
| 0x6C
| s32
| Dynamic thread priority
|-
| 0x70
| s32
| Processor that created the thread
|-
| 0x74
| u32
| ?
|-
| 0x7C
| u8
| ?
|-
| 0x7D
| u8
| ?
|-
| 0x7E
| u8
| Thread affinity mask - set differently depending on whether the thread is created via svc call or from inside the kernel
|-
| 0x80
| KProcess*
| Process the thread belongs to (virtual address)
|-
| 0x84
| u32
| Thread id
|-
| 0x88
| u32*
| Ptr to svc mode register storage for KThread inside the thread context.
|-
| 0x8C
| u32*
| End-address of the page for this thread context allocated in the [[Memory_layout|0xFF4XX000]] region. Thus, if the beginning of this mapped page is 0xFF401000, this ptr would be 0xFF402000. Thread context page - used for thread svc stack, preserving svc mode registers and VFP exception register for thread.
|-
| 0x90
| s32
| Ideal processor (processorid value from [[SVC|svcCreateThread]])
|-
| 0x94
| void*
| Ptr to [[Thread Local Storage]]
|-
| 0x98
| void*
| Ptr to [[Thread Local Storage]] in FCRAM via kernel vmem
|-
| 0xA0
| KThread*
| Previous (virtual address)
|-
| 0xA4
| KThread*
| Next (virtual address)
|-
| 0xA8
| struct { KThread* first; KThread* last; } * ptr
| Pointer to linked list that has stolen it, or 0 if in normal list
|-
| 0xAC
| s32
| Priority field used for priority inheritance when needed
|}

=Thread Affinity Mask=

If the thread is created via a call to SVC 8(CreateThread), which uses thread creation type 3, and the CPU ID is -2(meaning use the core specified in the exheader), the mask is just the affinity mask from the thread's owner KProcess. If the CPU ID is -1(meaning any core), the affinity mask is set to 0xF on the New3DS and 0x3 on the Old3DS. Otherwise, the affinity mask is (1 << cpu_id) | 1.

If the thread is created via a call by the kernel, which uses thread creation types 0-2, the checks for -1 and -2 are skipped and the mask is always (1 << cpu_id) | 1.

KBaseInterruptEvent

2016-12-04T21:24:54Z

Bond697:

[[Category:Kernel objects]]
Abstract base class for all interrupt events.

Size: 0x4 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| void **
| Pointer to vtable
|}

This abstract base class defines <code>virtual KSchedulableInterruptEvent* handleInterruptAndGetKSchedulableInterruptEvent(u32 interruptID) = 0</code>. It's actually the function called by the IRQ handler, which returns a [[KSchedulableInterruptEvent|KSchedulableInterruptEvent]] to call the second virtual method of (which signals the object) after a reschedule.

If either NULL or 1 is returned, nothing will be signaled. If NULL is returned, no post-interrupt rescheduling will be done.

The kernel uses the [[KSchedulableInterruptEvent|KEventInterruptEvent]] field of a [[KEvent|KEvent]] when binding public interrupts per svcBindInterrupt request.

KSession

2016-10-27T18:03:58Z

Bond697:

[[Category:Kernel objects]]
class [[KSession]] extends [[KAutoObject]];

Size : 0x4C bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x20
| [[KThread]]*
| X ?
|-
| 0x24
| [[KThread]]*
| Y ?
|-
| 0x2C
| [[KThread]]*
| Z ?
|}
It seems X=Y=Z. X, Y and Z can be NULL.

Structure for [[7.0.0-13]] NATIVE_FIRM upward:

Size : 0x4C bytes ([[KAutoObject]], [[KServerSession]], [[KClientSession]], sequentially):

{| class="wikitable" border="1"
|-
! Offset
!colspan="2"|Type
! Description
|-
| 0x0
|rowspan="2"|[[KAutoObject]]
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
|rowspan="9"|[[KServerSession]]
| u32
| Pointer to vtable
|-
| 0xC
| u32
| Reference count
|-
| 0x10
| u32
| KLinkedListNode count for sync threads
|-
| 0x14
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x18
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x1C
| KSession*
| Pointer to parent session
|-
| 0x20
| [[KThread]]*
| Last stolen KThread during sync request- current thread when KServerSession code is running during svc - noted in KThread+0xA8 as well
|-
| 0x24
| [[KThread]]*
| First stolen KThread during sync request
|-
| 0x28
| [[KThread]]*
| KThread that originated the session
|-
| 0x2C
|rowspan="8"|[[KClientSession]]
| u32
| Pointer to vtable
|-
| 0x30
| u32
| Reference count
|-
| 0x34
| u32
| KLinkedListNode count for sync threads
|-
| 0x38
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x3C
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x40
| KSession*
| Pointer to parent session
|-
| 0x44
| u32
| Session status
|-
| 0x48
| [[KClientPort]]*
| Pointer to associated client port inside parent KPort
|-
|}

Session status:

1: open 
2: closed by client 
3: closed by server?

KSession

2016-10-27T17:29:52Z

Bond697:

[[Category:Kernel objects]]
class [[KSession]] extends [[KAutoObject]];

Size : 0x4C bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x20
| [[KThread]]*
| X ?
|-
| 0x24
| [[KThread]]*
| Y ?
|-
| 0x2C
| [[KThread]]*
| Z ?
|}
It seems X=Y=Z. X, Y and Z can be NULL.

Structure for [[7.0.0-13]] NATIVE_FIRM upward:

Size : 0x4C bytes ([[KAutoObject]], [[KServerSession]], [[KClientSession]], sequentially):

{| class="wikitable" border="1"
|-
! Offset
!colspan="2"|Type
! Description
|-
| 0x0
|rowspan="2"|[[KAutoObject]]
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
|rowspan="9"|[[KServerSession]]
| u32
| Pointer to vtable
|-
| 0xC
| u32
| Reference count
|-
| 0x10
| u32
| Node count for threads
|-
| 0x14
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x18
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x1C
| KSession*
| Pointer to parent session
|-
| 0x20
| [[KThread]]*
| Last stolen KThread during sync request- current thread when KServerSession code is running during svc - noted in KThread+0xA8 as well
|-
| 0x24
| [[KThread]]*
| First stolen KThread during sync request
|-
| 0x28
| [[KThread]]*
| KThread that originated the session
|-
| 0x2C
|rowspan="8"|[[KClientSession]]
| u32
| Pointer to vtable
|-
| 0x30
| u32
| Reference count
|-
| 0x34
| u32
| KLinkedListNode count for object
|-
| 0x38
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in list of KThreads using this client session
|-
| 0x3C
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in list of KThreads using this client session
|-
| 0x40
| KSession*
| Pointer to parent session
|-
| 0x44
| u32
| Session status
|-
| 0x48
| [[KClientPort]]*
| Pointer to associated client port inside parent KPort
|-
|}

Session status:

1: open 
2: closed by client 
3: closed by server?

KSession

2016-10-25T16:39:11Z

Bond697:

[[Category:Kernel objects]]
class [[KSession]] extends [[KAutoObject]];

Size : 0x4C bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x20
| [[KThread]]*
| X ?
|-
| 0x24
| [[KThread]]*
| Y ?
|-
| 0x2C
| [[KThread]]*
| Z ?
|}
It seems X=Y=Z. X, Y and Z can be NULL.

Structure for [[7.0.0-13]] NATIVE_FIRM upward:

Size : 0x4C bytes ([[KAutoObject]], [[KServerSession]], [[KClientSession]], sequentially):

{| class="wikitable" border="1"
|-
! Offset
!colspan="2"|Type
! Description
|-
| 0x0
|rowspan="2"|[[KAutoObject]]
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
|rowspan="9"|[[KServerSession]]
| u32
| Pointer to vtable
|-
| 0xC
| u32
| Reference count
|-
| 0x10
| u32
| Node count for threads
|-
| 0x14
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x18
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x1C
| KSession*
| Pointer to parent session
|-
| 0x20
| [[KThread]]*
| Last stolen KThread during sync request- current thread when KServerSession code is running during svc - noted in KThread+0xA8 as well
|-
| 0x24
| [[KThread]]*
| First stolen KThread during sync request
|-
| 0x28
| [[KThread]]*
| KThread that originated the session
|-
| 0x2C
|rowspan="8"|[[KClientSession]]
| u32
| Pointer to vtable
|-
| 0x30
| u32
| Reference count
|-
| 0x34
| u32
| KLinkedListNode count for object
|-
| 0x38
| KLinkedListNode*
| Pointer to first KLinkedListNode in list of KThreads using this client session
|-
| 0x3C
| KLinkedListNode*
| Pointer to last KLinkedListNode in list of KThreads using this client session
|-
| 0x40
| KSession*
| Pointer to parent session
|-
| 0x44
| u32
| Session status
|-
| 0x48
| KClientPort*
| Pointer to associated client port inside parent KPort
|-
|}

Session status:

1: open 
2: closed by client 
3: closed by server?

ARM11 Interrupts

2016-10-25T16:01:41Z

Bond697:

== Interrupts ==

Interrupt priority is 0-0xF

= Private Interrupts =

Each CPU core has 32 software interrupts that are private and belong to that core. These interrupts are numbers 0-0x1F for each core. The hardware interrupts are not core-specific and start at interrupt ID 0x20.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0-0x5
|
| MPCore software-interrupt.
|-
| 0x6
| Kernel
| MPCore software-interrupt.
|-
| 0x7
|
| MPCore software-interrupt.
|-
| 0x8
| Kernel
| MPCore software-interrupt. Used for scheduling.
|-
| 0x9-0xE
|
| MPCore software-interrupt.
|-
| 0xF
| dmnt/debugger
| MPCore software-interrupt. Used to abstract FIQ (debug).
|-
| 0x1D
| Kernel
| MPCore timer.
|-
| 0x1E
| Kernel
| MPCore watchdog - set when the watchdog counter reaches 0 in timer mode, causes interrupt 30 to set as pending. Only set on core 1 as core 1's timer is used for everything.
|}

= Hardware Interrupts =

There are 0x60 hardware interrupts starting at 0x20 and continuing up to 0x7F. These are not private and are accessible from any core.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0x28
| gsp, TwlBg
| PSC0?
|-
| 0x29
| gsp, TwlBg
| PSC1?
|-
| 0x2A
| gsp, TwlBg
| PDC0?
|-
| 0x2B
| gsp, TwlBg
| PDC1?
|-
| 0x2C
| gsp, TwlBg
| PPF?
|-
| 0x2D
| gsp, TwlBg
| ?
|-
| 0x30
| Kernel
| ?
|-
| 0x39
| Kernel
| DMA
|-
| 0x3A
| Kernel
| DMA
|-
| 0x3B
| Kernel
| DMA
|-
| 0x40
| nwm
| WIFI SDIO Controller @ 0x10122000
|-
| 0x41
| nwm
| ?
|-
| 0x42
| nwm_dev?
| WIFI SDIO Controller @ 0x10100000
|-
| 0x45
| mvd (New3DS)
| ?
|-
| 0x46
| mvd (New3DS)
| ?
|-
| 0x48
| camera
| ?
|-
| 0x49
| camera
| ?
|-
| 0x4A
| dsp
| ?
|-
| 0x4B
| camera
| Y2R Conversion Finished
|-
| 0x4C
| TwlBg
| ?
|-
| 0x4D
| TwlBg
| ?
|-
| 0x4E
| mvd (New3DS)
| ?
|-
| 0x4F
| mvd (New3DS)
| ?
|-
| 0x50
| pxi, TwlBg
| Sync
|-
| 0x51
| pxi, TwlBg
| ?
|-
| 0x52
| pxi, TwlBg
| Send Fifo Empty
|-
| 0x53
| pxi, TwlBg
| Receive Fifo Not Empty
|-
| 0x54
| i2c, TwlBg
| ?
|-
| 0x55
| i2c, TwlBg
| ?
|-
| 0x56
| spi, TwlBg
| ?
|-
| 0x57
| spi, TwlBg
| ?
|-
| 0x58
| Kernel
| PDN
|-
| 0x59
| TwlBg
| ?
|-
| 0x5A
| mic
| ?
|-
| 0x5C
| i2c, TwlBg
| ?
|-
| 0x60
| gpio, TwlBg
| Asserted when shell is opened?
|-
| 0x62
| gpio, TwlBg
| Asserted when shell is closed?
|-
| 0x63
| gpio, TwlBg
| Touchscreen
|-
| 0x64
| gpio, TwlBg
| Headphone jack plugged in
|-
| 0x66
| gpio, TwlBg
| ?
|-
| 0x68
| gpio, TwlBg
| IR?
|-
| 0x69
| gpio, TwlBg
| ?
|-
| 0x6A
| gpio, TwlBg
| ?
|-
| 0x6B
| gpio, TwlBg
| ?
|-
| 0x6C
| gpio, TwlBg
| ?
|-
| 0x6D
| gpio, TwlBg
| ?
|-
| 0x6E
| gpio, TwlBg
| ?
|-
| 0x6F
| gpio, TwlBg
| ?
|-
| 0x70
| gpio, TwlBg
| Headphone jack plugged out
|-
| 0x71
| gpio, TwlBg
| MCU (HOME/POWER pressed)
|-
| 0x72
| gpio, TwlBg
| ?
|-
| 0x73
| TwlBg
| ?
|-
| 0x74
| ?
| Gamecard related
|-
| 0x75
| ?
| Gamecard inserted
|}

There are 2 tables in the ARM11 kernel: the first has 32 * 2(or 32 * 4) 8-byte entries. This table is for the private interrupts that belong to each core. The data for each interrupt can be found by doing table_base + (core_num * 0x100) + (intr_num * 8). The second table is for public hardware interrupts and the data for each interrupt can be retrieved by doing table_base + (intr_num * 8).

= InterruptData =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to interrupt data object for interrupt number
|-
| 0x4
| u8
| Interrupt is pending
|-
| 0x5
| u8
| Interrupt is enabled, about to execute
|-
| 0x6
| u8
| Interrupt priority
|-
| 0x7
| u8
| Unused, alignment
|}

The interrupt data pointer is a pointer to the object that handles that interrupt. The first first word in the object is a pointer to the object's vtable and the first function in the vtable is the interrupt handler for that interrupt number. When an interrupt runs, the function is passed its object in r0 and the interrupt number in r1.

= Interrupt Table (New3DS) =
(0xFFF318F4 in 10.3)

{| class="wikitable" border="1"
! Offset
! Type
! Description
|-
| 0x0
| InterruptEvent[224]
| Table of interrupt event objects for all hardware and software interrupts
|-
| 0x700
| KThread*
| Thread currently acting on the interrupt table
|-
| 0x704
| s16
| Error tracker for thread above
|-
| 0x706
| u16
| Alignment
|}

= InterruptEvent =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to interrupt event object
|-
| 0x4
| u32
| Interrupt flags
|}

ARM11 Interrupts

2016-10-25T15:57:56Z

Bond697: /* Private Interrupts */

== Interrupts ==

Interrupt priority is 0-0xF

= Private Interrupts =

Each CPU core has 32 software interrupts that are private and belong to that core. These interrupts are numbers 0-0x1F for each core. The hardware interrupts are not core-specific and start at interrupt ID 0x20.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0-0x5
|
| MPCore software-interrupt.
|-
| 0x6
| Kernel
| MPCore software-interrupt.
|-
| 0x7
|
| MPCore software-interrupt.
|-
| 0x8
| Kernel
| MPCore software-interrupt. Used for scheduling.
|-
| 0x9-0xE
|
| MPCore software-interrupt.
|-
| 0xF
| dmnt/debugger
| MPCore software-interrupt. Used to abstract FIQ (debug).
|-
| 0x1D
| Kernel
| MPCore timer.
|-
| 0x1E
| Kernel
| MPCore watchdog - set when the watchdog counter reaches 0 in timer mode, causes interrupt 30 to set as pending
|}

= Hardware Interrupts =

There are 0x60 hardware interrupts starting at 0x20 and continuing up to 0x7F. These are not private and are accessible from any core.

{| class="wikitable" border="1"
! IRQ
! Listener
! Description
|-
| 0x28
| gsp, TwlBg
| PSC0?
|-
| 0x29
| gsp, TwlBg
| PSC1?
|-
| 0x2A
| gsp, TwlBg
| PDC0?
|-
| 0x2B
| gsp, TwlBg
| PDC1?
|-
| 0x2C
| gsp, TwlBg
| PPF?
|-
| 0x2D
| gsp, TwlBg
| ?
|-
| 0x30
| Kernel
| ?
|-
| 0x39
| Kernel
| DMA
|-
| 0x3A
| Kernel
| DMA
|-
| 0x3B
| Kernel
| DMA
|-
| 0x40
| nwm
| WIFI SDIO Controller @ 0x10122000
|-
| 0x41
| nwm
| ?
|-
| 0x42
| nwm_dev?
| WIFI SDIO Controller @ 0x10100000
|-
| 0x45
| mvd (New3DS)
| ?
|-
| 0x46
| mvd (New3DS)
| ?
|-
| 0x48
| camera
| ?
|-
| 0x49
| camera
| ?
|-
| 0x4A
| dsp
| ?
|-
| 0x4B
| camera
| Y2R Conversion Finished
|-
| 0x4C
| TwlBg
| ?
|-
| 0x4D
| TwlBg
| ?
|-
| 0x4E
| mvd (New3DS)
| ?
|-
| 0x4F
| mvd (New3DS)
| ?
|-
| 0x50
| pxi, TwlBg
| Sync
|-
| 0x51
| pxi, TwlBg
| ?
|-
| 0x52
| pxi, TwlBg
| Send Fifo Empty
|-
| 0x53
| pxi, TwlBg
| Receive Fifo Not Empty
|-
| 0x54
| i2c, TwlBg
| ?
|-
| 0x55
| i2c, TwlBg
| ?
|-
| 0x56
| spi, TwlBg
| ?
|-
| 0x57
| spi, TwlBg
| ?
|-
| 0x58
| Kernel
| PDN
|-
| 0x59
| TwlBg
| ?
|-
| 0x5A
| mic
| ?
|-
| 0x5C
| i2c, TwlBg
| ?
|-
| 0x60
| gpio, TwlBg
| Asserted when shell is opened?
|-
| 0x62
| gpio, TwlBg
| Asserted when shell is closed?
|-
| 0x63
| gpio, TwlBg
| Touchscreen
|-
| 0x64
| gpio, TwlBg
| Headphone jack plugged in
|-
| 0x66
| gpio, TwlBg
| ?
|-
| 0x68
| gpio, TwlBg
| IR?
|-
| 0x69
| gpio, TwlBg
| ?
|-
| 0x6A
| gpio, TwlBg
| ?
|-
| 0x6B
| gpio, TwlBg
| ?
|-
| 0x6C
| gpio, TwlBg
| ?
|-
| 0x6D
| gpio, TwlBg
| ?
|-
| 0x6E
| gpio, TwlBg
| ?
|-
| 0x6F
| gpio, TwlBg
| ?
|-
| 0x70
| gpio, TwlBg
| Headphone jack plugged out
|-
| 0x71
| gpio, TwlBg
| MCU (HOME/POWER pressed)
|-
| 0x72
| gpio, TwlBg
| ?
|-
| 0x73
| TwlBg
| ?
|-
| 0x74
| ?
| Gamecard related
|-
| 0x75
| ?
| Gamecard inserted
|}

There are 2 tables in the ARM11 kernel: the first has 32 * 2(or 32 * 4) 8-byte entries. This table is for the private interrupts that belong to each core. The data for each interrupt can be found by doing table_base + (core_num * 0x100) + (intr_num * 8). The second table is for public hardware interrupts and the data for each interrupt can be retrieved by doing table_base + (intr_num * 8).

= InterruptData =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to interrupt data object for interrupt number
|-
| 0x4
| u8
| Interrupt is pending
|-
| 0x5
| u8
| Interrupt is enabled, about to execute
|-
| 0x6
| u8
| Interrupt priority
|-
| 0x7
| u8
| Unused, alignment
|}

The interrupt data pointer is a pointer to the object that handles that interrupt. The first first word in the object is a pointer to the object's vtable and the first function in the vtable is the interrupt handler for that interrupt number. When an interrupt runs, the function is passed its object in r0 and the interrupt number in r1.

= Interrupt Table (New3DS) =
(0xFFF318F4 in 10.3)

{| class="wikitable" border="1"
! Offset
! Type
! Description
|-
| 0x0
| InterruptEvent[224]
| Table of interrupt event objects for all hardware and software interrupts
|-
| 0x700
| KThread*
| Thread currently acting on the interrupt table
|-
| 0x704
| s16
| Error tracker for thread above
|-
| 0x706
| u16
| Alignment
|}

= InterruptEvent =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to interrupt event object
|-
| 0x4
| u32
| Interrupt flags
|}

KSession

2016-10-20T19:32:17Z

Bond697: Undo revision 18440 by Neobrain (talk)

[[Category:Kernel objects]]
class [[KSession]] extends [[KAutoObject]];

Size : 0x4C bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x20
| [[KThread]]*
| X ?
|-
| 0x24
| [[KThread]]*
| Y ?
|-
| 0x2C
| [[KThread]]*
| Z ?
|}
It seems X=Y=Z. X, Y and Z can be NULL.

Structure for [[7.0.0-13]] NATIVE_FIRM upward:

Size : 0x4C bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Pointer to vtable
|-
| 0xC
| u32
| Reference count
|-
| 0x10
| u32
| Node count for threads
|-
| 0x14
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x18
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x1C
| KSession*
| Pointer to parent session
|-
| 0x20
| [[KThread]]*
| Last stolen KThread during sync request- current thread when KServerSession code is running during svc - noted in KThread+0xA8 as well
|-
| 0x24
| [[KThread]]*
| First stolen KThread during sync request
|-
| 0x28
| [[KThread]]*
| KThread that originated the session
|-
| 0x2C
| u32
| Pointer to vtable
|-
| 0x30
| u32
| Reference count
|-
| 0x34
| u32
| KLinkedListNode count for object
|-
| 0x38
| KLinkedListNode*
| Pointer to first KLinkedListNode in list of KThreads using this client session
|-
| 0x3C
| KLinkedListNode*
| Pointer to last KLinkedListNode in list of KThreads using this client session
|-
| 0x40
| KSession*
| Pointer to parent session
|-
| 0x44
| u32
| Session status
|-
| 0x48
| KClientPort*
| Pointer to associated client port inside parent KPort
|-

Memory Management

2016-10-12T17:19:19Z

Bond697:

= Types and structures =

== enum MemoryOperation ==

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x10000
|}

The LINEAR memory-operation indicates that the mapped physical address is always MappedVAddr+0x0C000000, thus this memory can be used for hardware devices' DMA(such as the [[GPU]]). Addr0+size for this must be within the 0x14000000-0x1C000000 range when Addr0 is non-zero(Addr1 must be zero), Addr0 isn't actually used by svcControlMemory for mapping memory: Addr0 is not used by the kernel after doing address-range checks. The kernel determines what physical-address to use by allocating memory from FCRAM(about the same way as other memory), which is then used to determine the virtual-address.

[[8.0.0-18]] added a new memory mapping(0x30000000-0x38000000) for LINEAR memory, this replaces the original mapping for newer titles. The kernel uses the new mapping when the process memory-region is BASE, or when the process kernel-release-version field is >=0x022c(2.44 / system-version [[8.0.0-18]]).

The input mem-region value for svcControlMemory is only used(when non-zero) when the PID is value 1, for the [[FIRM]] ARM11 "loader" module.

== enum MemoryPermission ==

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| R
| 1
|-
| W
| 2
|-
| RW
| 3
|-
| X
| 4
|-
| RX
| 5
|-
| WX
| 6
|-
| RWX
| 7
|-
| DONTCARE
| 0x10000000
|}

== enum MemoryState ==
{| class="wikitable" border="1"
! Memory state flags
! Value
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

== struct MemoryInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Base process virtual address
|-
| u32
| Size
|-
| u32
| Permission
|-
| enum MemoryState
| State
|}

== enum PageFlags ==
{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

== struct PageInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| PageFlags (u32)
| Flags
|}

= Memory Mapping =
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must therefore be <=3, where value zero is used when un-mapping memory. Furthermore it appears that only regular heap pages can be mirrored (it won't work for TLS, stack, .data, .text, for example).

Bitmask 0xF00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC.

ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

The ARM11 kernel does not allow processes to create shared memory blocks via svcCreateMemoryBlock, when the process memorytype (from the kernel flags stored in the exheader kernel descriptor) is the application memorytype, and when addr=0. When the memorytype is not the application memorytype and addr=0, the kernel allocates new memory for the calling process and turns it into a shared memory block. When addr is non-zero, it must be located in memory which is already mapped. Furthermore, it appears that only regular heap pages (allocated using svcControlMemory op=COMMIT) are accepted as valid addrs.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory. Type is the MemoryOperation enum, without the memory-type/memory-region. ControlProcessMemory only supports type4, type5, and type6. ControlProcessMemory does not support using the current KProcess handle alias.

Note that with the MAP MemoryOperation, the kernel will refuse to MAP memory for the specified addr1, when addr1 was already used with another MAP operation as addr1. The kernel also doesn't allow memory to be freed via the FREE MemoryOperation, when other virtual-memory is mapped to this same memory(when the MAP MemoryOperation was used with this memory with addr1).

<code>'''MapProcessMemory'''(Handle process, u32 destAddr, u32 limit)</code> maps memory from the given process into the current process. First <code>min(limit, 0x3F00000)</code> bytes are mapped starting from <code>0x00100000</code> in the source process to <code>destAddr</code> in the current process. Then <code>min(limit - 0x7F00000, 0x6000000)</code> bytes (if more than 0) are mapped from <code>0x08000000</code> in the source process to <code>destAddr + 0x7F00000</code> in the current process. Another way to view this is that it is overlaying the two ranges <code>[0x0010_0000; 0x0400_0000]</code> and <code>[0x0800_0000; 0x0E00_0000]</code> from the source process onto <code>[destAddr - 0x100000; destAddr + limit]</code> in the current process, truncating whatever part of the mapping that doesn't fit. This system call is used by [[RO Services]] to map the program's code and heap into ro. Memory mapped by MapProcessMemory is unmapped by UnmapProcessMemory.

= How The Kernel Allocates And Tracks Memory =

== MemoryBlockHeader ==

Size: 0xC-bytes(?) pre-v11.0, 0x18-bytes starting with v11.0.

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Size in pages
|-
| 0x4
| MemoryBlockHeader*
| Next
|-
| 0x8
| MemoryBlockHeader*
| Prev
|-
| 0xC
| MemoryBlockHeader*
| Pointer to the current memchunk. Added with v11.0?
|-
| 0x10
| u32
| Nonce, doesn't seem to be read at all except during MAC calculation. Added with v11.0. Used with the new heap [[11.0.0-33|security]] feature. A kernel state field is copied to this field before calculating the MAC. Once done, that kernel state field is subtracted by the value of the calculated MAC stored below. Since this kernel state field is initially 0x0, this field for the FCRAM APPLICATION+0 MemoryBlockHeader during kernel boot is set to 0x0.
|-
| 0x14
| u32
| MAC calculated over rest of struct. Added with v11.0. Used with the new heap [[11.0.0-33|security]] feature.
|}

== RegionDescriptor ==

Size: 0x10-bytes pre-[[11.0.0-33|11.0.0-X]], 0x20-bytes starting with [[11.0.0-33|11.0.0-X]].

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| MemoryBlockHeader*
| First
|-
| 0x4
| MemoryBlockHeader*
| Last
|-
| 0x8
| u32
| Region start
|-
| 0xC
| u32
| Region size
|-
| 0x10
| 0x10-byte block.
| This is the "key" used with the kernel heap MAC implemented with [[11.0.0-33|11.0.0-X]].
|}

== FCRAM Region Descriptor ==

Size: 0x50-bytes pre-[[11.0.0-33|11.0.0-X]], 0x80-bytes starting with [[11.0.0-33|11.0.0-X]].

X = RegionDescriptor_size*3.

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| RegionDescriptor
| RegionDescriptor for app memory
|-
| RegionDescriptor_size*1
| RegionDescriptor
| RegionDescriptor for sys memory
|-
| RegionDescriptor_size*2
| RegionDescriptor
| RegionDescriptor for base memory
|-
| X + 0x0
| u32
| Ptr to start of FCRAM region descriptor
|-
| X + 0x4
| u32
| FCRAM start
|-
| X + 0x8
| u32
| FCRAM size in pages
|-
| X + 0xC
| u32
| Base memory start in FCRAM
|-
| X + 0x10
| u32
| Count of physical FCRAM used by the kernel, in bytes. (used by [[SVC|svcGetSystemInfo]])
|-
| X + 0x14
| u32
| ?
|-
| X + 0x18
| KThread*
| Thread operating on region data
|-
| X + 0x1C
| s16
| Error info for thread listed above
|-
| X + 0x1E
| u16
| Alignment
|}

== Kernel Region Descriptor ==

KServerPort

2016-09-29T02:05:08Z

Bond697:

[[Category:Kernel objects]]
class [[KServerPort]] extends [[KSynchronizationObject]];

Size : 0x24 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Node count for threads
|-
| 0xC
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x10
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x14
| u32
| Node count for threads
|-
| 0x18
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of KServerSessions associated with this object
|-
| 0x1C
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of KServerSessions associated with this object
|-
| 0x20
| [[KPort]]*
| Pointer to parent KPort
|-

Memory layout

2016-09-25T23:34:19Z

Bond697: /* Memory map by firmware */

= Physical Memory =

== ARM11 ==
{| class="wikitable" border="1"
|-
! Old 3DS
! Address
! Size
! Description
|-
| style="background: green" | Yes
| 0x00000000
| 0x00010000
| Bootrom (super secret code/data @ 0x8000)
|-
| style="background: green" | Yes
| 0x00010000
| 0x00010000
| Bootrom mirror
|-
| style="background: green" | Yes
| 0x10000000
|?
| [[IO]] memory
|-
| style="background: green" | Yes
| 0x17E00000
| 0x00002000
| MPCore private memory region

|-
| style="background: red" | No
| 0x17E10000
| 0x00001000
| L2C-310 Level 2 Cache Controller (2MB)
|-
| style="background: green" | Yes
| 0x18000000
| 0x00600000
| VRAM (divided in two banks, VRAM and VRAMB)
|-
| style="background: red" | No
| 0x1F000000
| 0x00400000
| [[New_3DS]] additional memory
|-
| style="background: green" | Yes
| 0x1FF00000
| 0x00080000
| DSP memory
|-
| style="background: green" | Yes
| 0x1FF80000
| 0x00080000
| AXI WRAM
|-
| style="background: green" | Yes
| 0x20000000
| 0x08000000
| FCRAM
|-
| style="background: red" | No
| 0x28000000
| 0x08000000
| [[New_3DS]] FCRAM extension
|-
| style="background: green" | Yes
| 0xFFFF0000
| 0x00010000
| Bootrom mirror
|}

===0x17E10000===
The 32-bit register at <code>0x17E10000</code>+<code>0x100</code> only has bit 0 set when, on New 3DS, [[PTMSYSM:ConfigureNew3DSCPU]] was used with bit 1 set for the input value (the L2 cache flag). All other bits in this register are normally all-zero. Therefore, bit 0 set = new cache hardware enabled, bit 0 clear = new cache hardware disabled. This bit is how the ARM11 kernel checks whether the additional cache hardware is enabled).

To enable the additional cache hardware, the following is used by the ARM11 kernel:
* Sets bit 0 in 32-bit register <code>0x17E10000</code>+<code>0x100</code>.

To disable the additional cache hardware, the following is used by the ARM11 kernel:
* Writes value <code>0xFFFF</code> to 32-bit register <code>0x17E10000</code>+<code>0x77C</code>.
* Waits for bit 0 in 32-bit register <code>0x17E10000</code>+<code>0x730</code> to become clear.
* Writes value <code>0x0<code> to 32-bit register <code>0x17E10000</code>+<code>0x0</code>.
* Clears bit 0 in 32-bit register <code>0x17E10000</code>+<code>0x100</code>.

=== <code>0x1F000000</code> ([[New 3DS]] only) ===
This area is used by [[QTM Services]],starting at offset <code>0x200000</code>, size <code>0x180000</code>. This area is not accessible to the GPU on the old 3DS. The old 3DS and New 3DS GSP module has <code>vaddr->physaddr</code> conversion code for this entire region. On the New 3DS, only the first <code>0x200000</code> bytes (half of this memory) are accessible to the GPU.

== ARM9 ==
{| class="wikitable" border="1"
|-
! Old 3DS
! Address
! Size
! Description
|-
| style="background: green" | Yes
| 0x00000000
| 0x08000000
| Instruction TCM, repeating each 0x8000 bytes.
|-
| style="background: green" | Yes
| 0x01FF8000
| 0x00008000
| Instruction TCM (Accessed by the kernel and process by this address)
|-
| style="background: green" | Yes
| 0x07FF8000
| 0x00008000
| Instruction TCM (Accessed by bootrom by this address)
|-
| style="background: green" | Yes
| 0x08000000
| 0x00100000
| ARM9-only internal memory (ARM7's internal regions are mapped here as well)
|-
| style="background: red" | No
| 0x08100000
| 0x00080000
| [[New_3DS]] ARM9-only extension, only enabled when a certain [[CONFIG_Registers|CONFIG]] register is set.
|-
| style="background: green" | Yes
| 0x10000000
| 0x08000000
| [[IO]] memory
|-
| style="background: green" | Yes
| 0x18000000
| 0x00600000
| VRAM (divided in two banks, VRAM and VRAMB)
|-
| style="background: green" | Yes
| 0x1FF00000
| 0x00080000
| DSP memory
|-
| style="background: green" | Yes
| 0x1FF80000
| 0x00080000
| AXI WRAM
|-
| style="background: green" | Yes
| 0x20000000
| 0x08000000
| FCRAM
|-
| style="background: red" | No
| 0x28000000
| 0x08000000
| [[New_3DS]] FCRAM extension
|-
| style="background: green" | Yes
| 0xFFF00000
| 0x00004000
| Data TCM (Mapped during bootrom)
|-
| style="background: green" | Yes
| 0xFFFF0000
| 0x00010000
| Bootrom, the main region is at +0x8000, which is disabled during system boot.
|}

==ARM9 MPU Regions==
For the below instruction permissions: RO = memory is executable, while None = not-executable.

===NATIVE_FIRM/SAFE_MODE_FIRM ARM9 kernel===
{| class="wikitable" border="1"
|-
! Region
! Address
! Size
! Privileged-mode data permissions
! User-mode data permissions
! Privileged-mode instruction permissions
! User-mode instruction permissions
|-
| 0
| 0xFFFF0000
| 32KB/0x8000
| RO
| None
| RO
| None
|-
| 1
| 0x01FF8000
| 32KB/0x8000
| RW
| RW
| RO
| RO
|-
| 2
| 0x08000000
| 1MB/0x100000. >=[[8.0.0-18|8.0.0-X]]: 2MB/0x200000.
| RW
| RW
| RO
| RO
|-
| 3
| 0x10000000
| 128KB/0x20000
| RW
| RW
| None
| None
|-
| 4
| 0x10100000
| 512KB/0x80000
| RW
| RW
| None
| None
|-
| 5
| 0x20000000
| 128MB/0x8000000. >=[[8.0.0-18|8.0.0-X]]: 256MB/0x10000000.
| RW
| RW
| None
| None
|-
| 6
| 0x08000000
| 128KB/0x20000
| RW
| None
| RO
| None
|-
| 7
| 0x08020000
| <[[3.0.0-5]]: 64KB/0x10000. >=[[3.0.0-5]]: 32KB/0x8000.
| RW
| None
| RO
| None
|}

The above is the MPU region settings setup by the ARM9-kernel in the crt0.

The New3DS ARM9-kernel MPU region settings are the same as the Old3DS MPU region settings for >=[[8.0.0-18|8.0.0-X]].

At the start of the Process9 function executed in kernel-mode via svc7b during firm-launching, it changes some MPU region settings. At the end of that function, before it uses the ARM9/ARM11 entrypoint fields, it disables MPU.

===New3DS [[FIRM|ARM9-loader]]===
{| class="wikitable" border="1"
|-
! Region
! Address
! Size
! Privileged-mode data permissions
! User-mode data permissions
! Privileged-mode instruction permissions
! User-mode instruction permissions
|-
| 0
| 0xFFFF0000
| 32KB/0x8000
| RO
| None
| RO
| None
|-
| 1
| 0x01FF8000
| 32KB/0x8000
| RW
| None
| RO
| None
|-
| 2
| 0x08000000
| 2MB/0x200000
| RW
| None
| RO
| None
|-
| 3
| 0x10000000
| 128KB/0x20000
| RW
| None
| None
| None
|}

MPU regions 4-7 are disabled. Note that the entire ARM9-loader runs in SVC-mode.

===TWL_FIRM/AGB_FIRM ARM9 kernel===
{| class="wikitable" border="1"
|-
! Region
! Address
! Size
! Privileged-mode data permissions
! User-mode data permissions
! Privileged-mode instruction permissions
! User-mode instruction permissions
|-
| 0
| 0xFFFF0000
| 32KB/0x8000
| RO
| None
| RO
| None
|-
| 1
| 0x01FF8000
| 32KB/0x8000
| RW
| RW
| RO
| RO
|-
| 2
| 0x08000000
| 1MB/0x100000. New3DS: 2MB/0x200000.
| RW
| RW
| RO
| RO
|-
| 3
| 0x10000000
| 2MB/0x200000.
| RW
| RW
| None
| None
|-
| 4
| 0x1FF00000
| 512KB/0x80000
| RW
| RW
| None
| None
|-
| 5
| 0x20000000
| 128MB/0x8000000. New3DS: 256MB/0x10000000.
| RW
| RW
| None
| None
|-
| 6
| 0x08000000
| <[[3.0.0-5|3.0.0-X]]: 256KB/0x40000. >=[[3.0.0-5|3.0.0-X]]: 128KB/0x20000
| RW
| None
| RO
| None
|-
| 7
| 0x08080000
| 128KB/0x20000
| RW
| RW
| RO
| RO
|}

==ARM9 ITCM==
{| class="wikitable" border="1"
|-
! ITCM mirror address
! ITCM bootrom mirror address
! Offset
! Size
! Description
|-
| 0x01FF8000
|
| 0x0
| 0x3700
| Uninitialized memory.
|-
| 0x01FFB700
| 0x07FFB700
| 0x3700
| 0x100
| The unprotected ARM9-bootrom code copies code from unprotected bootrom to 0x07FFB700(ITCM mirror) size 0x100, then calls the code at 0x07FFB700. The code located here is the code used for disabling access to the bootroms.
|-
| 0x01FFB800
|
| 0x3800
| 0x4
| This is always 0xDEADB00F.
|-
| 0x01FFB804
|
| 0x3804
| 0x4
| This is the u32 DeviceId.
|-
| 0x01FFB808
|
| 0x3808
| 0x10
| This is the fall-back keyY used for movable.sed keyY when movable.sed doesn't exist in NAND(the last two words here are used on retail for generating console-unique TWL keydata/etc). This is also used for "LocalFriendCodeSeed", etc.
|-
| 0x01FFB818
|
| 0x3818
| 0x1
| ?
|-
| 0x01FFB819
|
| 0x3819
| 0x1
| This is the [[CTCert]] issuer type: 0 = retail "Nintendo CA - G3_NintendoCTR2prod", non-zero = dev "Nintendo CA - G3_NintendoCTR2dev".
|-
| 0x01FFB81A
|
| 0x381A
| 0x6
| ?
|-
| 0x01FFB820
|
| 0x3820
| 0x4
| This is the CTCert ECDSA exponent, this is byte-swapped when *((u8*)(0x01FFB800+0x18)) is >=5.
|-
| 0x01FFB824
|
| 0x3824
| 0x2
| ?
|-
| 0x01FFB826
|
| 0x3826
| 0x1E
| This is the CTCert ECDSA privk.
|-
| 0x01FFB844
|
| 0x3844
| 0x3C
| This is the CTCert ECDSA signature.
|-
| 0x01FFB880
|
| 0x3880
| 0x80
| This is all-zero.
|-
| 0x01FFB900
|
| 0x3900
| 0x200
| This is the 0x200-bytes from NAND sector0.
|-
| 0x01FFBB00
|
| 0x3B00
| 0x200
| This is the 0x200-bytes from the plaintext NAND firm partition FIRM header, read by bootrom.
|-
| 0x01FFBD00
|
| 0x3D00
| 0x100
| This is the RSA-2048 modulus for [[RSA_Registers|RSA]]-engine slot0 set by bootrom.
|-
| 0x01FFBE00
|
| 0x3E00
| 0x100
| This is the RSA-2048 modulus for RSA-engine slot1 set by bootrom.
|-
| 0x01FFBF00
|
| 0x3F00
| 0x100
| This is the RSA-2048 modulus for RSA-engine slot2.
|-
| 0x01FFC000
|
| 0x4000
| 0x100
| This is the RSA-2048 modulus for RSA-engine slot3.
|-
| 0x01FFC100
|
| 0x4100
| 0x800
| These are RSA-2048 keys: 4 slots, each slot is 0x200-bytes. Slot+0 is the modulus, slot+0x100 is the private exponent. This can be confirmed by RSA-decrypting a message into a signature, then RSA-encrypting the signature back into a message, and comparing the original message with the output from the last operation.

[[FIRM]] doesn't seem to ever use these. None of these are related to RSA-keyslot0 used for v6.0/v7.0 key generation. These moduli are separate from all other moduli used elsewhere.
|-
| 0x01FFC900
| 0x07FFC900
| 0x4900
| 0x400
| The unprotected ARM9-bootrom copies data to 0x07FFC900(mirror of 0x01FFC900) size 0x400. This data is copied from AXI WRAM, initialized by ARM11-bootrom(the addr used for the src is determined by [[CONFIG_Registers|REG_UNITINFO]]). These are RSA moduli: retailsrcptr = 0x1FFFD000, devsrvptr = 0x1FFFD400.
* The first 0x100-bytes here is the RSA-2048 modulus for the CFA NCCH header, and for the gamecard NCSD header.
* 0x01FFCA00 is the RSA-2048 modulus for the CXI accessdesc signature, written to rsaengine keyslot1 by NATIVE_FIRM.
* 0x01FFCB00 size 0x200 is unknown, probably RSA related, these aren't used by [[FIRM]](these are not console-unique).
|-
| 0x01FFCD00
|
| 0x4D00
| 0x80
| Unknown, not used by [[FIRM]]. This isn't console-unique.
The first 0x10-bytes are checked by the v6.0/v7.0 NATIVE_FIRM keyinit function, when non-zero it clears this block and continues to do the key generation. Otherwise when this block was already all-zero, it immediately returns. This memclear was probably an attempt at destroying the RSA slot0 modulus, that missed (exactly 0x1000-bytes away). Even though they "failed" here, one would still need to derive the private exponent, which would require obtaining a ciphertext and plaintext.
|-
| 0x01FFCD80
|
| 0x4D80
| 0x64
| 0x01FFCD84 size 0x10-bytes is the NAND CID(the 0x64-byte region at 0x01FFCD80 is initialized by Process9 + ARM9-bootrom). The u32 at 0x01FFCDC4 is the total number of NAND sectors, read from a MMC command.
|-
| 0x01FFCDE4
|
| 0x4DE4
| 0x21C
| Uninitialized memory.
|-
| 0x01FFD000
| 0x07FFD000
| 0x5000
| 0x2470
| The unprotected ARM9-bootrom copies 0x1FFFA000(AXIWRAM mem initialized by ARM11-bootrom) size 0x2470 to 0x07FFD000(mirror of 0x01FFD000). This block contains DSi keys.
* 0x01FFD000 is the RSA-1024 modulus for the retail System Menu
* 0x01FFD080 is the RSA-1024 modulus for DSi Wifi firmware and DSi Sound
* 0x01FFD100 is the RSA-1024 modulus for base DSi apps (Settings, Shop, etc.)
* 0x01FFD180 is the RSA-1024 modulus for DSiWare and RSA-signed cartridge headers
* 0x01FFD210 is the keyY for per-console-encrypted ES blocks
* 0x01FFD220 is the keyY for fixed-keyX ES blocks
* 0x01FFD300 is the DSi common (normal)key
* 0x01FFD350 is a normalkey set on keyslot 0x02, and is likely only used during boot
* 0x01FFD380 is the keyslot 0x00 keyX and the first half of the retail keyX for modcrypt crypto "Nintendo"
* 0x01FFD398 is the keyX used for 'Tad' crypto, usually in keyslot 0x02 "Nintendo DS", ..
* 0x01FFD3A8 is set as the middle two words of keyslot 0x03's keyX, before being overwritten "NINTENDO"
* 0x01FFD3BC is the keyY for keyslot 0x01, see below
* 0x01FFD3C8 is the fixed keyY used for eMMC partition crypto on retail DSi, see below (keyslot 0x03)
* 0x01FFD3E0 is the 0x1048-byte Blowfish data for DSi cart crypto
* 0x01FFE428 is the 0x1048-byte Blowfish data for DS cart crypto
On the 3DS, keyslots 0x01 and 0x03 have the last word set as 0xE1A00005 instead of the next word in ITCM. This is consistent with retail DSis.
|-
| 0x01FFF470
|
| 0x7470
| 0xB90
| Uninitialized memory.
0x01FFFC00 size 0x100-bytes starting with [[9.5.0-22|9.5.0-X]] is the FIRM header used during FIRM-launching.
|}

=Memory map by firmware=
* [[Virtual address mapping FW0B]]
* [[Virtual address mapping FW1F]]
* [[Virtual address mapping FW25]]
* [[Virtual address mapping FW2E]]
* [[Virtual address mapping FW37]]
* [[Virtual address mapping FW38‎]]
* [[Virtual address mapping FW3F]]
* FW49([[9.6.0-24|9.6.0-X]]) and [[10.0.0-27|10.0.0-X]] ARM11-kernel vmem mapping is identical to FW40([[9.5.0-22|9.5.0-X]]).

* [[Virtual address mapping TWLFIRM04]]

* [[Virtual address mapping New3DS v8.1]]
* [[Virtual address mapping New3DS v9.0]]
* [[Virtual address mapping New3DS v9.2]]
* [[Virtual address mapping New3DS v11.1]]

=ARM11 Detailed physical memory map=
18000000 - 18600000: VRAM

1FF80000 - 1FFAB000: Kernel code
1FFAB000 - 1FFF0000: SlabHeap [temporarily contains boot processes]
1FFF0000 - 1FFF1000: ?
1FFF1000 - 1FFF2000: ?
1FFF2000 - 1FFF3000: ?
1FFF3000 - 1FFF4000: ?
1FFF4000 - 1FFF5000: Exception vectors
1FFF5000 - 1FFF5800: Unused?
1FFF5800 - 1FFF5C00: 256-entry L2 MMU table for VA FF4xx000
1FFF5C00 - 1FFF6000: 256-entry L2 MMU table for VA FF5xx000
1FFF6000 - 1FFF6400: 256-entry L2 MMU table for VA FF6xx000
1FFF6400 - 1FFF6800: 256-entry L2 MMU table for VA FF7xx000
1FFF6800 - 1FFF6C00: 256-entry L2 MMU table for VA FF8xx000
1FFF6C00 - 1FFF7000: 256-entry L2 MMU table for VA FF9xx000
1FFF7000 - 1FFF7400: 256-entry L2 MMU table for VA FFAxx000
1FFF7400 - 1FFF7800: 256-entry L2 MMU table for VA FFBxx000
1FFF7800 - 1FFF7C00: MMU table but unused?
1FFF7C00 - 1FFF8000: 256-entry L2 MMU table for VA FFFxx000
1FFF8000 - 1FFFC000: 4096-entry L1 MMU table for VA xxx00000 (CPU 0)
1FFFC000 - 20000000: 4096-entry L1 MMU table for VA xxx00000 (CPU 1)
20000000 - 28000000: Main memory

The entire FCRAM is cleared during NATIVE_FIRM boot. This is done by the ARM11 kernel in order by region as it initializes after loading [[FIRM]] launch parameters from FCRAM.

== FCRAM memory-regions layout ==
FCRAM is partitioned into three regions of memory (APPLICATION, SYSTEM, and BASE). Most applications can only allocate memory from one of these regions (which is encoded in the [[NCCH/Extended_Header#ARM11_Kernel_Flags|process kernel flags]]). There is a fixed set of possible size of each memory region, determined by the APPMEMTYPE value in [[Configuration_Memory#APPMEMTYPE|configuration memory]] (which in turn is set up according to the [[FIRM#FIRM_Launch_Parameters|firmware launch parameters]]).

Support for APPMEMTYPEs 6 and 7 was implemented in [[NS]] with [[8.0.0-18]]. These configurations are only supported in the [[New_3DS]] ARM11-kernel, and are in fact the only ones supported there at all. Applications only get access to the larger memory regions when this is specified in their [[NCCH/Extended Header#New3DS System Mode|extended header]].

{| class="wikitable" border="1"
! APPMEMTYPE
! APPLICATION starting address (relative to FCRAM)
! APPLICATION region size
! SYSTEM starting address (relative to FCRAM)
! SYSTEM region size
! BASE starting address (relative to FCRAM)
! BASE region size
|-
| 0 (default with regular 3DS kernel, used when the type is not 2-5)
| 0x0
| 0x04000000(64MB)
| 0x04000000
| 0x02C00000
| 0x06C00000
| 0x01400000
|-
| 2
| 0x0
| 0x06000000(96MB)
| 0x06000000
| 0x00C00000
| 0x06C00000
| 0x01400000
|-
| 3
| 0x0
| 0x05000000(80MB)
| 0x05000000
| 0x01C00000
| 0x06C00000
| 0x01400000
|-
| 4
| 0x0
| 0x04800000(72MB)
| 0x04800000
| 0x02400000
| 0x06C00000
| 0x01400000
|-
| 5
| 0x0
| 0x02000000(32MB)
| 0x02000000
| 0x04C00000
| 0x06C00000
| 0x01400000
|-
| 6 (This is the default on New3DS. With [[New_3DS]] kernel this is the type used when the value is not 7)
| 0x0
| 0x07C00000(124MB)
| 0x07C00000
| 0x06400000
| 0x0E000000
| 0x02000000
|-
| 7
| 0x0
| 0x0B200000(178MB)
| 0x0B200000
| 0x02E00000
| 0x0E000000
| 0x02000000
|}

The SYSTEM mem-region size is calculated with: size = FCRAMTOTALSIZE - (APPLICATION_MEMREGIONSIZE + BASE_MEMREGIONSIZE).

All memory allocated by the kernel itself for kernel use is located under BASE. Most system-modules run under the BASE memregion too.

Free/used memory on [[4.5.0-10]] with Home Menu / Internet Browser, with the default APPMEMTYPE on retail:
{| class="wikitable" border="1"
! Region
! Base address relative to FCRAM+0
! Region size
! Used memory once [[Home Menu]] finishes loading for system boot, on [[4.5.0-10]]
! Used memory with [[Internet Browser]] running instead of [[Home Menu]], on [[4.5.0-10]]
! Free memory once [[Home Menu]] finishes loading for system boot, on [[4.5.0-10]]
! Free memory with [[Internet Browser]] running instead of [[Home Menu]], on [[4.5.0-10]]
|-
| APPLICATION
| 0x0
| 0x04000000
| 0x0
|
| 0x04000000
|
|-
| SYSTEM
| 0x04000000
| 0x02C00000
| 0x01488000
| 0x02A50000
| 0x01778000
| 0x001B0000
|-
| BASE
| 0x06C00000
| 0x01400000
| 0x01202000
| 0x01236000
| 0x001FE000
| 0x001CA000
|}

=ARM11 Detailed virtual memory map=
(valid only for FW0B, see [[#Memory map by firmware|Memory map by firmware]] for subsequent versions)

E8000000 - E8600000: mapped VRAM (18000000 - 18600000)

EFF00000 - F0000000: mapped Internal memory (1FF00000 - 20000000)
F0000000 - F8000000: mapped Main memory

FF401000 - FF402000: mapped ? (27FC7000 - 27FC8000)

FF403000 - FF404000: mapped ? (27FC2000 - 27FC3000)

FF405000 - FF406000: mapped ? (27FBB000 - 27FBC000)

FF407000 - FF408000: mapped ? (27FB3000 - 27FB4000)

FF409000 - FF40A000: mapped ? (27F8E000 - 27F8F000)

FFF00000 - FFF45000: mapped SlabHeap

FFF60000 - FFF8B000: mapped Kernel code

FFFCC000 - FFFCD000: mapped IO [[I2C|I2C]] second bus (10144000 - 10145000)

FFFCE000 - FFFCF000: mapped IO PDC([[LCD]]) (10400000 - 10401000)

FFFD0000 - FFFD1000: mapped IO PDN (10141000 - 10142000)

FFFD2000 - FFFD3000: mapped IO PXI (10163000 - 10164000)

FFFD4000 - FFFD5000: mapped IO PAD (10146000 - 10147000)

FFFD6000 - FFFD7000: mapped IO LCD (10202000 - 10203000)

FFFD8000 - FFFD9000: mapped IO DSP (10140000 - 10141000)

FFFDA000 - FFFDB000: mapped IO XDMA (10200000 - 10201000)

FFFDC000 - FFFE0000: mapped ? (1FFF8000 - 1FFFC000)

FFFE1000 - FFFE2000: mapped ? (1FFF0000 - 1FFF1000)

FFFE3000 - FFFE4000: mapped ? (1FFF2000 - 1FFF3000)

FFFE5000 - FFFE9000: mapped L1 MMU table for VA xxx00000

FFFEA000 - FFFEB000: mapped ? (1FFF1000 - 1FFF2000)

FFFEC000 - FFFED000: mapped ? (1FFF3000 - 1FFF4000)

FFFEE000 - FFFF0000: mapped IO IRQ (17E00000 - 17E02000)

FFFF0000 - FFFF1000: mapped Exception vectors

FFFF2000 - FFFF6000: mapped L1 MMU table for VA xxx00000

FFFF7000 - FFFF8000: mapped ? (1FFF1000 - 1FFF2000)

FFFF9000 - FFFFA000: mapped ? (1FFF3000 - 1FFF4000)

FFFFB000 - FFFFE000: mapped L2 MMU tables (1FFF5000 - 1FFF8000)

==0xFF4XX000==
Each [[KThread|thread]] is allocated a 0x1000-byte page in this region for the [[KThreadContext|thread context]]: the first page at 0xFF401000 is for the first created thread, 0xFF403000 for the second thread. This region is used to store the SVC-mode stack for the thread, and thread context data used for context switching. When the IRQ handler, prefetch/data abort handlers, and undefined instruction handler are entered where the SPSR-mode=user, these handlers then store LR+SPSR for the current mode on the SVC-mode stack, then these handlers switch to SVC-mode.

This page does not contain a dedicated block for storing R0-PC(etc). For user-mode, the user-mode regs are instead saved on the SVC-mode stack when IRQs such as timers for context switching are triggered.

For NATIVE_FIRM the memory pages for this region are located in FCRAM, however for TWL_FIRM these are located in AXI WRAM. For TWL_FIRM v6704 the first thread's page for this region is located at physical address 0x1FF93000, the next one at 0x1FF92000, etc.

== IO Process virtual addressing equivalence ==
It seems an IO register's process virtual address can be calculated by adding 0xEB00000 to its physical address. However for kernel mappings there is no fixed address equivalence.

=ARM11 User-land memory regions=
==NATIVE_FIRM/SAFE_MODE_FIRM Userland Memory==
{| class="wikitable" border="1"
|-
! Virtual Address Base
! Physical Address Base
! Region Max Size
! Address-range available for svcMapMemoryBlock
! Description
|-
| 0x00100000 / 0x14000000
|
| 0x03F00000
| No
| The [[ExeFS]]:/.code is loaded here, executables must be loaded to the 0x00100000 region when the exheader "special memory" flag is clear. The 0x03F00000-byte size restriction only applies when this flag is clear. Executables are usually loaded to 0x14000000 when the exheader "special memory" flag is set, however this address can be arbitrary.
|-
| 0x04000000
| ?
| ?
| No
| Used for mapping buffers during IPC, see [[IPC Command Structure]].
|-
| 0x08000000
| Main stack physaddr - <heap size for the allocated vaddr 0x08000000 memory>
| 0x08000000
| Yes
| Heap mapped by [[SVC|ControlMemory]]
|-
| 0x10000000-StackSize
| .bss physical address - total stack pages
| StackSize from process exheader
|
| Stack for the main-thread, initialized by the ARM11 kernel. The StackSize from the exheader is usually 0x4000, therefore the stack-bottom is usually 0x0FFFC000. The stack for the other threads is normally located in the process .data section however this can be arbitrary.
|-
| 0x10000000
|
| 0x04000000
| Yes
| [[SVC|Shared]] memory
|-
| 0x14000000
| FCRAM+0
| 0x08000000
| No
| Can be mapped by [[SVC|ControlMemory]], this is used for processes' [[SVC|LINEAR]]/GSP heap.
|-
| 0x1E800000
| 0x1F000000
| 0x00400000
| No
| [[New_3DS]] additional memory, access to this is specified by the exheader. Added with [[8.0.0-18]], see above section regarding this memory.
|-
| 0x1EC00000
| 0x10100000
| 0x00400000
| No
| [[IO]] registers, the mapped IO pages which each process can access is specified in the [[NCCH/Extended_Header|exheader]]. (Applications normally don't have access to registers in this range)
|-
| 0x1F000000
| 0x18000000
| 0x00600000
| No
| VRAM, access to this is specified by the exheader.
|-
| 0x1FF00000
| 0x1FF00000
| 0x00080000
| No
| DSP memory, access to this is specified by the exheader.
|-
| 0x1FF80000
| FCRAM memory page allocated by the ARM11 kernel.
| 0x1000
| No
| [[Configuration Memory]], all processes have read-only access to this.
|-
| 0x1FF81000
| FCRAM memory page allocated by the ARM11 kernel.
| 0x1000
| No
| [[Configuration Memory|Shared]] page, all processes have read-access to this. Write access to this is specified by the exheader "Shared page writing" kernel flag.
|-
| 0x1FF82000
| Dynamically taken from the BASE region of FCRAM
| Number of threads * 0x1000 / 8
| No
| [[Thread Local Storage]]
|-
| 0x30000000
| FCRAM+0
| 0x08000000(Old3DS) / 0x10000000([[New_3DS]])
| No
| This LINEAR memory mapping was added with [[8.0.0-18]], see [[SVC#enum_MemoryOperation|here]]. This replaces the original 0x14000000 mapping, for system(memory-region=BASE)/newer titles. The Old3DS kernel uses size 0x08000000 for LINEAR-memory address range checks, while the New3DS kernel uses size 0x10000000 for those range checks. Old3DS/New3DS system-module code doing vaddr->phys-addr conversion uses size 0x10000000.
|-
| 0x20000000 / 0x40000000
|
|
|
| This is the end-address of userland memory, memory under this address is process-unique. Memory starting at this address is only accessible in privileged-mode. This address was changed from 0x20000000 to 0x40000000 with [[8.0.0-18]].
|}

All executable pages are read-only, and data pages have the execute-never permission set. Normally .text from the loaded ExeFS:/.code is the only mapped executable memory. Executable [[RO Services|CROs]] can be loaded into memory, once loaded the CRO .text section memory page permissions are changed via [[SVC|ControlProcessMemory]] from RW- to R-X. The address and size of each ExeFS:/.code section is stored in the exheader, the permissions for each section is: .text R-X, .rodata R--, .data RW-, and .bss RW-. The loaded .code is mapped to the addresses specified in the exheader by the ARM11 kernel. The stack permissions is initialized by the ARM11 kernel: RW-. The heap permissions is normally RW-.

All userland memory is mapped with RW permissions for privileged-mode. However, normally the ARM11 kernel only uses userland read/write instructions(or checks that the memory can be written from userland first) for accessing memory specified by [[SVC|SVCs]].

Processes can't directly access memory for other processes. When service [[Services API|commands]] are used, the kernel maps memory in the destination process for input/output buffers, where the addresses in the command received by the process is replaced by this mapped memory. When this is an input buffer, the buffer data is copied to the mapped memory. When this is an output buffer, the data stored in the mapped memory is copied to the destination buffer specified in the command.

The physical address which memory for the application memory-type is mapped to begins at FCRAM+0, the total memory allocated for this memory-type is stored in [[Configuration_Memory]]. Applications' .text + .rodata + .data under the application memory-type is mapped at FCRAM + APPMEMALLOC - (aligned page-size for .text + .rodata + .data). The application .bss is mapped at CODEADDR - .bss size aligned down to the page size.

==TWL_FIRM Userland Memory==
{| class="wikitable" border="1"
|-
! Virtual Address Base
! Physical Address Base
! Size
! Description
|-
| 0x00100000
| 0x1FFAB000 (with newer TWL_FIRM such as v6704 this is located at 0x1FFAC000)
| 0x00055000
| Code + .(ro)data copied from the process 0x00300000 region is located here(.bss is located here as well).
|-
| 0x00155000
| 0x18555000
| 0x000AB000
|
|-
| 0x00200000
| 0x18500000
| 0x00100000
|
|-
| 0x00300000
| 0x24000000
| 0x04000000
| The beginning of the ARM11 process .text is located here.
|-
| 0x08000000
| 0x20000000
| 0x07E00000
|
|-
| 0x1EC00000
| 0x10100000
| 0x00400000
| [[IO]]
|-
| 0x1F000000
| 0x18000000
| 0x00600000
| VRAM
|-
| 0x1FF00000
| 0x1FF00000
| 0x00080000
| This is mapped to the DSP memory.
|}

The above regions are mapped by the ARM11 kernel. Later when the ARM11 process uses [[SVC|svcKernelSetState]] with type4, the kernel unmaps(?) the following regions: 0x00300000..0x04300000, 0x08000000..0x0FE00000, and 0x10000000..0xF8000000.

=== Detailed TWL_FIRM ARM11 Memory ===
{| class="wikitable" border="1"
|-
! Process Virtual Address
! Physical Address
! Size
! Description
|-
| 0x08000000
| 0x20000000
| 0x01000000*4
| DS(i) 0x02000000 RAM. Vaddr = (DSRAMOffset*4) + 0x08000000, where DSRAMOffset is DSRAMAddr-0x02000000.
|-
| 0x0FC00000
| 0x27C00000
|
| Loaded SRL binary, initially the dev DSi launcher SRL is located here(copied here by the ARM11 process).
|-
| 0x0FD00000
| 0x27D00000
|
| The data located here is copied to here by the ARM11 process. The data located here is a TWL NAND [http://dsibrew.org/wiki/Bootloader bootloader] image, using the same format+encryption/verification methods as the DSi NAND bootloader(stage2). The keyX for this bootloader keyslot is initially set to the retail DSi key-data, however when TWL_FIRM is launched this keyX key-data is replaced with a separate keyX. TWL_FIRM can use either the retail DSi bootloader RSA-1024 modulus, or a seperate modulus: normally only the latter is used(the former is only used when loading the image from FS instead of FCRAM). When using the image from FCRAM(default code-path), TWL_FIRM will not calculate+check the hashes for the bootloader code binaries(this is done when loading from FS however).
|-
| 0x0FDF7000
| 0x27DF7000
| 0x1000
| SRL header
|}

= System memory details =
0xFFFF9000 Pointer to the current KThread instance
0xFFFF9004 Pointer to the current KProcess instance
0xFFFF9008 Pointer to the current KScheduler instance
0xFFFF9010 Pointer to the last KThread to encounter an exception

0x8000040 Pointer to the current KThread instance on the ARM9
0x8000044 Pointer to the current KProcess instance on the ARM9
0x8000048 Pointer to the current KScheduler instance on the ARM9

= VRAM Map While Running System Applets =
*0x1E6000-0x22C500 -- top screen 3D left framebuffer 0(240x400x3) (The "3D right first-framebuf" addr stored in the LCD register is set to this, when the 3D is set to "off")
*0x22C800-0x272D00 -- top screen 3D right framebuffer 0(240x400x3)
*0x273000-0x2B9500 -- top screen 3D left framebuffer 1(240x400x3)
*0x2B9800-0x2FFD00 -- top screen 3D right framebuffer 1(240x400x3)
*0x48F000-0x4C7400 -- bottom screen framebuffer 0(240x320x3)
*0x4C7800-0x4FF800 -- bottom screen framebuffer 1(240x320x3)

These LCD framebuffer addresses are not changed by the system when launching regular applications, the application itself handles that if needed. These VRAM framebuffers are cleared when launching regular applications.

Virtual address mapping New3DS v11.1

2016-09-25T23:33:06Z

Bond697: Created page with " [L1 ] VA 1f300000..1f400000 -> PA 1f300000..1f400000 [ X ] [ Priv: RW, User: -- ] [L1 ] VA d8000000..d8600000 -> PA 18000000..18600000 [ XN ] [ Priv: RW, User: -- ] [L1 ]..."

[L1 ] VA 1f300000..1f400000 -> PA 1f300000..1f400000 [ X ] [ Priv: RW, User: -- ]
[L1 ] VA d8000000..d8600000 -> PA 18000000..18600000 [ XN ] [ Priv: RW, User: -- ]
[L1 ] VA df000000..df400000 -> PA 1f000000..1f400000 [ XN ] [ Priv: RW, User: -- ]
[L1 ] VA dff00000..e0000000 -> PA 1ff00000..20000000 [ XN ] [ Priv: RW, User: -- ]
[L1 ] VA e0000000..f0000000 -> PA 20000000..30000000 [ XN ] [ Priv: RW, User: -- ]
...
[L2L] VA fff00000..fff20000 -> PA 1ff80000..1ffa0000 [ X ] [ Priv: R-, User: -- ]
[L2S] VA fff20000..fff2e000 -> PA 1ffde000..1ffec000 [ X ] [ Priv: R-, User: -- ]
[L2S] VA fff2e000..fff2f000 -> PA 1ffec000..1ffed000 [ XN ] [ Priv: R-, User: -- ]
[L2S] VA fff2f000..fff34000 -> PA 1ffed000..1fff2000 [ XN ] [ Priv: RW, User: -- ]
[L2L] VA fff70000..fffa0000 -> PA 1ffa0000..1ffd0000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffa0000..fffae000 -> PA 1ffd0000..1ffde000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffaf000..fffb0000 -> PA 1f3f1000..1f3f2000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffb8000..fffb9000 -> PA 17e10000..17e11000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffba000..fffbb000 -> PA 10144000..10145000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffbc000..fffbd000 -> PA 10400000..10401000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffbe000..fffbf000 -> PA 10141000..10142000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffc0000..fffc1000 -> PA 10163000..10164000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffc2000..fffc3000 -> PA 10146000..10147000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffc4000..fffc5000 -> PA 10202000..10203000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffc6000..fffc7000 -> PA 10140000..10141000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffc8000..fffc9000 -> PA 10206000..10207000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffca000..fffce000 -> PA 1fff8000..1fffc000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffcf000..fffd0000 -> PA 1fff2000..1fff3000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffd1000..fffd2000 -> PA 1fff3000..1fff4000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffd3000..fffd7000 -> PA 1fffc000..20000000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffd8000..fffd9000 -> PA 1f3f2000..1f3f3000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffda000..fffdb000 -> PA 1f3f5000..1f3f6000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffdc000..fffe0000 -> PA 1f3f8000..1f3fc000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffe1000..fffe2000 -> PA 1f3f3000..1f3f4000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffe3000..fffe4000 -> PA 1f3f6000..1f3f7000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffe5000..fffe9000 -> PA 1f3fc000..1f400000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffea000..fffeb000 -> PA 1f3f4000..1f3f5000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffec000..fffed000 -> PA 1f3f7000..1f3f8000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA fffee000..ffff0000 -> PA 17e00000..17e02000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA ffff0000..ffff1000 -> PA 1fff4000..1fff5000 [ X ] [ Priv: R-, User: -- ]
[L2S] VA ffff2000..ffff6000 -> PA 1fff8000..1fffc000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA ffff7000..ffff8000 -> PA 1fff2000..1fff3000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA ffff9000..ffffa000 -> PA 1fff3000..1fff4000 [ XN ] [ Priv: RW, User: -- ]
[L2S] VA ffffb000..ffffe000 -> PA 1fff5000..1fff8000 [ XN ] [ Priv: RW, User: -- ]

Main Page/Navigation

2016-09-25T14:51:21Z

Bond697:

{{Main page box|Navigation|Main Page/Navigation}}
<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="33%" | '''General''' 
! width="33%" | '''Homebrew''' 
! width="33%" | '''3DS hardware''' 
|- valign="top" style="background: #F5FAFF;"
|
*[[Glossary]]
*[[Friend code]]
*[[Games]]
*[[Serials]]
*[[:Category:PC utilities|PC Utilities]]
|
*[[Homebrew Exploits]]
*[[Homebrew Applications]]
*[[Homebrew Libraries and Tools]]
*[[3DS System Flaws]]
*[[3DS Userland Flaws]]
|
*[[Hardware|Overview]] ([[IO|IO registers]])
*[[GPU]]
*[[:Category:DSP|DSP]]
*[[Peripherals]]
*[[Gamecards]]
*[[Video Capture]]
|}
</div>

<div style="margin: -.3em -1em -1em -1em; margin-top: +1em">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="33%" | '''3DS operating system''' 
! width="33%" | '''3DS software stack''' 
! width="33%" | '''3DS content''' 
|- valign="top" style="background: #F5FAFF;"
|
*[[Memory layout]]
*[[Services API]]
*[[CTR API]]
*[[Kernel]] ([[SVC|system calls]], [[:Category:Kernel_objects|objects]])
*[[Bootloader]]
|
*[[Nintendo Software]]
*[[3DS Development Unit Software]]
*[[Titles]] ([[Title list|list]], [[Title metadata|metadata]], [[Ticket|tickets]])
*[[Update Data]]
|
*[[SD Filesystem]]
*[[Flash Filesystem]]
*[[Savegames]]
*[[:Category:File_formats|File Formats]] ([[NCSD|CCI]]/[[NCCH#CXI|CXI]]/[[CIA]])
* [[PRUDP|PRUDP (network protocol)]]
|}
</div>
{{box-footer-empty}}

KAutoObject

2016-08-31T12:45:45Z

Bond697:

[[Category:Kernel objects]]

KAutoObject represents a reference counted object that destroys itself when there are no more references to it.

Size : 0x8 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|}

=Class Definition=

class KAutoObject { 
public:
u32 m_referenceCount; // 0x4 
protected:
virtual ~KAutoObject() { }
};

Multi-threading

2016-08-31T12:29:05Z

Bond697:

This page documents all kernel functionality for managing multiple processes and threads as well as handling synchronization between them.

= Processes =

Each process is given an array of [[NCCH/Extended_Header#ARM11_Kernel_Capabilities|kernel capability descriptors]] upon creation (see CreateProcess). Official software forwards the descriptors specified in the [[NCCH#Extended_Header|NCCH exheader]].

Any process can only use SVCs which are enabled in its kernel capability descriptors. This is enforced by the ARM11 kernel SVC handler by checking the syscall access control mask stored on the SVC-mode stack. If the SVC isn't enabled, a kernelpanic() is triggered. Each process has a separate SVC-mode stack; this stack and the syscall access mask stored here are initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of which is stored in the kernel capability descriptor. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current process.

Calling svcBreak on retail will only terminate the process which called this SVC.

== Usage ==

=== CreateCodeSet ===
(behavior unconfirmed)

Allocates memory for a process according to the given CodeSetInfo contents and copies the segment data from the given memory locations to the allocated memory.

=== CreateProcess ===
(behavior unconfirmed)

Sets up a process using the segments managed by the given CodeSet handle.

This system call furthermore processes the [[NCCH/Extended_Header#ARM11_Kernel_Capabilities|kernel capabilities]] from the [[NCCH/Extended_Header|ExHeader]], hence setting up virtual address mappings, CPU clock frequency/L2 cache configuration, and other things.

=== Run ===
(behavior unconfirmed)

Sets up the main process thread and appends it to the scheduler queue.

The argc, argv, and envp fields from the given StartupInfo structure are ignored.

== struct CodeSetInfo ==
All addresses are given virtual for the process to be created.
All sizes are given in 0x1000-pages.

{| class="wikitable" border="1"
! Type
! Field
|-
| u8[8]
| Codeset Name
|-
| u16
| Unknown, this is written to field 0x5A of KCodeSet
|-
| u16
| Unknown/padding
|-
| u32
| Unknown/padding
|-
| u32
| .text addr
|-
| u32
| .text size
|-
| u32
| .rodata start
|-
| u32
| .rodata size
|-
| u32
| RW addr (.data + .bss)
|-
| u32
| RW size (.data + .bss)
|-
| u32
| Total .text pages
|-
| u32
| Total .rodata pages
|-
| u32
| Total RW pages (.data + .bss)
|-
| u32
| Unknown/padding
|-
| u8[8]
| Program ID
|}

= Threads =

For Kernel implementation details, see [[KThread]].

Though it is possible to run multi-threaded programs, running those on different cores is not possible "as-is". One core is always dedicated to the OS, hence you will never get 100% of both cores.

Using CloseHandle() with a KThread handle will terminate the specified thread only if the reference count reaches 0.

Lower priority values give the thread higher priority. For userland apps, priorities between 0x18 and 0x3F are allowed. The priority of the app's main thread seems to be 0x30.

The thread scheduler is cooperative, therefore if a thread takes up all the CPU time (for example if it enters an endless loop), all the other threads that run on the same CPU core won't get a chance to run. The main way of yielding another thread is using an address arbiter.

0xFFFF8000 is a handle alias for the currently active thread.

== Usage ==

=== CreateThread ===
'''svc''' : 0x08

'''Signature'''
Result CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stacktop, s32 threadpriority, s32 processorid);

'''Configuration'''
R0=s32 threadpriority
R1=func entrypoint
R2=u32 arg
R3=u32 stacktop
R4=s32 processorid

Result result=R0
Handle* thread=R1

'''Details'''

Creates a new thread in the current process which will begin execution at the given entrypoint. The SP CPU register will be initialized to stacktop, while r0 will be initialized to the given arg.

The input address used for Entrypoint_Param and StackTop are normally the same, but they may be chosen arbitrarily. For the main thread (created in svcRun), the Entrypoint_Param is value 0.

The stacktop must be aligned to 0x8-bytes, otherwise when not aligned to 0x8-bytes the ARM11 kernel clears the low 3-bits of the stacktop address.

The processorid parameter specifies which processor the thread can run on. Non-negative values correspond to a specific CPU. (e.g. 0 for the Appcore and 1 for the Syscore on Old3DS) Special value -1 means all CPUs, and -2 means the default CPU for the process (Read from the [[NCCH/Extended Header|Exheader]], usually 0 for applications, 1 for system services). Games usually create threads using -2.

The thread priority value must be in the range 0x0..0x3F. Otherwise, error 0xE0E01BFD is returned.

With the Old3DS kernel, the s32 processorid must be <=2 (for the processorid validation check in the kernel). With the New3DS kernel, the processorid validation check requires processorid to be less than or equal to <total cores(MPCore "SCU Configuration Register" CPU number value + 1)>, and a number of additional constraints apply: When processorid==0x2 and the process is not a BASE mem-region process, exheader kernel-flags bitmask 0x2000 must be set (otherwise error 0xD9001BEA is returned). When processorid==0x3 and the process is not a BASE mem-region process, error 0xD9001BEA is returned. These are the only restriction checks done by the kernel for processorid.

=== ExitThread ===
'''svc''' : 0x09

'''Signature'''
void ExitThread(void);

=== SleepThread ===
'''svc''' : 0x0A

'''Signature'''
void SleepThread(s64 nanoseconds);

=== GetThreadPriority ===
'''svc''' : 0x0B

'''Signature'''
Result GetThreadPriority(s32* priority, Handle thread);

'''asm'''
.global svcGetThreadPriority
.type svcGetThreadPriority, %function
svcGetThreadPriority:
str r0, [sp, #-0x4]!
svc 0x0B
ldr r3, [sp], #4
str r1, [r3]
bx lr

=== SetThreadPriority ===
'''svc''' : 0x0C

'''Signature'''
Result SetThreadPriority(Handle thread, s32 priority);

=== OpenThread ===
'''svc''' : 0x34

'''Signature'''
Result OpenThread(Handle* thread, Handle process, u32 threadId);

=== GetProcessIdOfThread ===
'''svc''' : 0x36

'''Signature'''
Result GetProcessIdOfThread(u32* processId, Handle thread);

=== GetThreadId ===
'''svc''' : 0x37

'''Signature'''
Result GetThreadId(u32* threadId, Handle thread);

'''Details'''
It seems that only the thread itself or one of its parent can get the ID. Calling this on the handle of a sibling or parent seems to always yield the ID 0.

=== GetThreadInfo ===
'''svc''' : 0x2C

'''Signature'''
Result GetThreadInfo(s64* out, Handle thread, ThreadInfoType type);

''' Details '''
This requests always return an error when called, it only checks if the handle is a thread or not.
Hence, it will return 0xD8E007ED (BAD_ENUM) if the Handle is a Thread Handle, 0xD8E007F7 (BAD_HANDLE) if it isn't.

=== GetThreadContext ===
'''svc''' : 0x3B

'''Signature'''
Result GetThreadContext(ThreadContext* context, Handle thread);

'''Details'''
Stubbed?

== Core affinity ==

The cores are numbered from 0 to 1 for Old 3DS and 0 to 3 for the new 3DS.

=== GetThreadAffinityMask ===
'''svc''' : 0x0D

'''Signature'''
Result GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount);

=== SetThreadAffinityMask ===
'''svc''' : 0x0E

'''Signature'''
Result SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount);

=== GetThreadIdealProcessor ===
'''svc''' : 0x0F

'''Signature'''
Result GetThreadIdealProcessor(s32* processorid, Handle thread);

=== SetThreadIdealProcessor ===
'''svc''' : 0x10

=== APT:SetApplicationCpuTimeLimit ===

See [[APT:SetApplicationCpuTimeLimit]].

You are not able to use the system core (core1) by default. You have to first assign the amount of time dedicated to the system.
The value is in percent, the higher it is, the more the system will be available for your application.

For example if you set this value to 25%, it means that your application will be able to use 25% of the system core at most, even if you never issue system calls.

If you set the value to a non-zero value, you will not be able to set it back to 0%.
Keep in mind that if your application is heavily dependant on the system, setting a high value for your application might yield poorer performance than if you had set a low value.

=== APT:GetApplicationCpuTimeLimit ===

See [[APT:GetApplicationCpuTimeLimit]].

== Debug ==

=== GetThreadList ===

=== GetDebugThreadContext ===

=== SetDebugThreadContext ===

=== GetDebugThreadParam ===

= Synchronization =

Synchronization can be performed via WaitSynchronization on any handles deriving from [[KSynchronizationObject]]. The semantic meaning of the call depends on the particular object type referred to by the given handle:

* KClientPort: Wakes if max sessions not reached (free session available)
* KClientSession: Always false?
* KDebug: ???
* KDmaObject: ???
* KEvent: Waits until the event is signaled
* KInterruptEvent: ???
* KMutex: Acquires a lock on the mutex (blocks until this succeeds)
* KProcess: Waits until the process exits
* KSemaphore: This consumes a value from the semaphore count, if possible, otherwise continues to wait
* KServerPort: Waits for a new client connection, upon which svcAcceptSession is ready to be called
* KServerSession: Waits for an IPC command to be submitted to the server process
* KThread: Waits until the thread terminates
* KTimer: Wakes when timer activates (this also clears the timer if it is oneshot)

Most synchronization systems seem to have both a "normal" and "light-weight" version

== Mutex ==

For Kernel implementation details, see [[KMutex]]

=== CreateMutex ===

/!\ It seems that the mutex will not be available once the thread that created it is destroyed

=== ReleaseMutex ===

== Critical Section (light-weight mutex) ==

Similar to a mutex, but faster and no priority inheritance. Therefore problems such as priority inversion may occur.

=== CriticalSection::Initialize ===

Creates an object

=== CriticalSection::Enter ===

Locks out threads from accessing a critical section.

=== CriticalSection::Leave ===

Unlocks and allows for access to a critical section.

== Semaphore ==

== Light Semaphore ==

== Event ==

== Light Event ==

== Address Arbiters ==

Address arbiters are a low-level primitive to implement synchronization based on a counter stored at some user-specified virtual memory address. Address arbiters are used to put the current thread to sleep until the counter is signaled. Both of these tasks are implemented in ArbitrateAddress.

Address arbiters are implemented by [[KAddressArbiter]].

===CreateAddressArbiter===
Result CreateAddressArbiter(Handle* arbiter)

Creates an address arbiter handle for use with ArbitrateAddress.

=== ArbitrateAddress ===
Result ArbitrateAddress(Handle arbiter, u32 addr, ArbitrationType type, s32 value, s64 nanoseconds)

if <code>type</code> is SIGNAL, the ArbitrateAddress call will resume up to <code>value</code> of the threads waiting on <code>addr</code> using an arbiter, starting with the highest-priority threads. If <code>value</code> is negative, all of these threads are released. <code>nanoseconds</code> remains unused in this mode.

The other modes are used to (conditionally) put the current thread to sleep based on the memory word at virtual address <code>addr</code> until another thread signals that address using ArbitrateAddress with the <code>type</code> SIGNAL. WAIT_IF_LESS_THAN will put the current thread to sleep if that word is smaller than <code>value</code>. DECREMENT_AND_WAIT_IF_LESS_THAN will furthermore decrement the memory value before the comparison. WAIT_IF_LESS_THAN_TIMEOUT and DECREMENT_AND_WAIT_IF_LESS_THAN_TIMEOUT will do the same as their counterparts, but will have thread execution resume if <code>nanoseconds</code> nanoseconds pass without <code>addr</code> being signaled.

=== enum ArbitrationType ===
{| class="wikitable" border="1"
! Address arbitration type
! Value
|-
| SIGNAL
| 0
|-
| WAIT_IF_LESS_THAN
| 1
|-
| DECREMENT_AND_WAIT_IF_LESS_THAN
| 2
|-
| WAIT_IF_LESS_THAN_TIMEOUT
| 3
|-
| DECREMENT_AND_WAIT_IF_LESS_THAN_TIMEOUT
| 4
|}

KThreadContext

2016-08-31T03:23:33Z

Bond697:

[[Category:Kernel objects]]

Size : 0x1000 bytes (1 page)

Each [[KThread|thread]] is allocated a 0x1000-byte page in this region for the [[KThreadContext|thread context]]. Each thread has its context address stored as 2 members:

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x88
| u32*
| Ptr to svc mode register storage for KThread inside the thread context.
|-
| 0x8C
| u32*
| End-address of the page for this thread context allocated in the [[Memory_layout|0xFF4XX000]] region.
|}

KThread offset 0x88 points to offset 0xF50 in the thread context and 0x8C points to the end of the thread context page. The kernel refers to the thread context page by subtracting from the end instead of adding from the beginning.

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0xF38 (page_end - 0xC8)
| u32[4]
| SVC access control data copied from KThread's owner process
|-
| 0xF50 (page_end - 0xB0)
| u32[10]
| SVC mode registers, r4-r11, r13, r14
|-
| 0xF78
| f64[16]
| VFP registers aliased as 16 double precision, 64-bit registers
|-
| 0xFF8
| u32
| FPEXC, floating point exception register for thread- stored and loaded on context switches
|-
| 0xFFC
| u32
| FPSCR, floating point status and control register
|}

When switching thread contexts the kernel does, in order:

* Load FPEXC
* Save the LR to r1- this LR is the return back to the main scheduling and context switching function
* Load r4-r11, SP, LR
* Branch back to r1, preserving the LR which was just reloaded, back to the main scheduling function, but in the context of the newly switched-to thread
* Disable Interrupts
* Check if that core's KScheduler object indicates that it needs switching again and exit if it does not
* Otherwise, run the thread scheduler again and repeat all the steps to switch contexts again

KThreadContext

2016-08-30T01:22:59Z

Bond697:

[[Category:Kernel objects]]

Size : 0x1000 bytes (1 page)

Each [[KThread|thread]] is allocated a 0x1000-byte page in this region for the [[KThreadContext|thread context]]. Each thread has its context address stored as 2 members:

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x88
| u32*
| Ptr to svc mode register storage for KThread inside the thread context.
|-
| 0x8C
| u32*
| End-address of the page for this thread context allocated in the [[Memory_layout|0xFF4XX000]] region.
|}

KThread offset 0x88 points to offset 0xF50 in the thread context and 0x8C points to the end of the thread context page. The kernel refers to the thread context page by subtracting from the end instead of adding from the beginning.

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0xF38 (page_end - 0xC8)
| u32[4]
| SVC access control data copied from KThread's owner process
|-
| 0xF50 (page_end - 0xB0)
| u32[10]
| SVC mode registers, r4-r11, r13, r14
|-
| 0xFF8
| u32
| FPEXC, floating point exception register for thread- stored and loaded on context switches
|}

When switching thread contexts the kernel does, in order:

* Load FPEXC
* Save the LR to r1- this LR is the return back to the main scheduling and context switching function
* Load r4-r11, SP, LR
* Branch back to r1, preserving the LR which was just reloaded, back to the main scheduling function, but in the context of the newly switched-to thread
* Disable Interrupts
* Check if that core's KScheduler object indicates that it needs switching again and exit if it does not
* Otherwise, run the thread scheduler again and repeat all the steps to switch contexts again

KThreadContext

2016-08-29T14:24:42Z

Bond697:

[[Category:Kernel objects]]

Size : 0x1000 bytes (1 page)

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0xF38 (page_end - 0xC8)
| u32[4]
| SVC access control data copied from KThread's owner process
|-
| 0xF50 (page_end - 0xB0)
| u32[10]
| SVC mode registers, r4-r11, r13, r14
|-
| 0xFF8
| u32
| FPEXC, floating point exception register for thread- stored and loaded on context switches
|}

When switching thread contexts the kernel does, in order:

* Load FPEXC
* Save the LR to r1- this LR is the return back to the main scheduling and context switching function
* Load r4-r11, SP, LR
* Branch back to r1, preserving the LR which was just reloaded, back to the main scheduling function, but in the context of the newly switched-to thread
* Disable Interrupts
* Check if that core's KScheduler object indicates that it needs switching again and exit if it does not
* Otherwise, run the thread scheduler again and repeat all the steps to switch contexts again

Memory layout

2016-08-29T14:22:25Z

Bond697: /* 0xFF4XX000 */

= Physical Memory =

== ARM11 ==
{| class="wikitable" border="1"
|-
! Old 3DS
! Address
! Size
! Description
|-
| style="background: green" | Yes
| 0x00000000
| 0x00010000
| Bootrom (super secret code/data @ 0x8000)
|-
| style="background: green" | Yes
| 0x00010000
| 0x00010000
| Bootrom mirror
|-
| style="background: green" | Yes
| 0x10000000
|?
| [[IO]] memory
|-
| style="background: green" | Yes
| 0x17E00000
| 0x00002000
| MPCore private memory region

|-
| style="background: red" | No
| 0x17E10000
| 0x00001000
| L2C-310 Level 2 Cache Controller (2MB)
|-
| style="background: green" | Yes
| 0x18000000
| 0x00600000
| VRAM (divided in two banks, VRAM and VRAMB)
|-
| style="background: red" | No
| 0x1F000000
| 0x00400000
| [[New_3DS]] additional memory
|-
| style="background: green" | Yes
| 0x1FF00000
| 0x00080000
| DSP memory
|-
| style="background: green" | Yes
| 0x1FF80000
| 0x00080000
| AXI WRAM
|-
| style="background: green" | Yes
| 0x20000000
| 0x08000000
| FCRAM
|-
| style="background: red" | No
| 0x28000000
| 0x08000000
| [[New_3DS]] FCRAM extension
|-
| style="background: green" | Yes
| 0xFFFF0000
| 0x00010000
| Bootrom mirror
|}

===0x17E10000===
The 32-bit register at <code>0x17E10000</code>+<code>0x100</code> only has bit 0 set when, on New 3DS, [[PTMSYSM:ConfigureNew3DSCPU]] was used with bit 1 set for the input value (the L2 cache flag). All other bits in this register are normally all-zero. Therefore, bit 0 set = new cache hardware enabled, bit 0 clear = new cache hardware disabled. This bit is how the ARM11 kernel checks whether the additional cache hardware is enabled).

To enable the additional cache hardware, the following is used by the ARM11 kernel:
* Sets bit 0 in 32-bit register <code>0x17E10000</code>+<code>0x100</code>.

To disable the additional cache hardware, the following is used by the ARM11 kernel:
* Writes value <code>0xFFFF</code> to 32-bit register <code>0x17E10000</code>+<code>0x77C</code>.
* Waits for bit 0 in 32-bit register <code>0x17E10000</code>+<code>0x730</code> to become clear.
* Writes value <code>0x0<code> to 32-bit register <code>0x17E10000</code>+<code>0x0</code>.
* Clears bit 0 in 32-bit register <code>0x17E10000</code>+<code>0x100</code>.

=== <code>0x1F000000</code> ([[New 3DS]] only) ===
This area is used by [[QTM Services]],starting at offset <code>0x200000</code>, size <code>0x180000</code>. This area is not accessible to the GPU on the old 3DS. The old 3DS and New 3DS GSP module has <code>vaddr->physaddr</code> conversion code for this entire region. On the New 3DS, only the first <code>0x200000</code> bytes (half of this memory) are accessible to the GPU.

== ARM9 ==
{| class="wikitable" border="1"
|-
! Old 3DS
! Address
! Size
! Description
|-
| style="background: green" | Yes
| 0x00000000
| 0x08000000
| Instruction TCM, repeating each 0x8000 bytes.
|-
| style="background: green" | Yes
| 0x01FF8000
| 0x00008000
| Instruction TCM (Accessed by the kernel and process by this address)
|-
| style="background: green" | Yes
| 0x07FF8000
| 0x00008000
| Instruction TCM (Accessed by bootrom by this address)
|-
| style="background: green" | Yes
| 0x08000000
| 0x00100000
| ARM9-only internal memory (ARM7's internal regions are mapped here as well)
|-
| style="background: red" | No
| 0x08100000
| 0x00080000
| [[New_3DS]] ARM9-only extension, only enabled when a certain [[CONFIG_Registers|CONFIG]] register is set.
|-
| style="background: green" | Yes
| 0x10000000
| 0x08000000
| [[IO]] memory
|-
| style="background: green" | Yes
| 0x18000000
| 0x00600000
| VRAM (divided in two banks, VRAM and VRAMB)
|-
| style="background: green" | Yes
| 0x1FF00000
| 0x00080000
| DSP memory
|-
| style="background: green" | Yes
| 0x1FF80000
| 0x00080000
| AXI WRAM
|-
| style="background: green" | Yes
| 0x20000000
| 0x08000000
| FCRAM
|-
| style="background: red" | No
| 0x28000000
| 0x08000000
| [[New_3DS]] FCRAM extension
|-
| style="background: green" | Yes
| 0xFFF00000
| 0x00004000
| Data TCM (Mapped during bootrom)
|-
| style="background: green" | Yes
| 0xFFFF0000
| 0x00010000
| Bootrom, the main region is at +0x8000, which is disabled during system boot.
|}

==ARM9 MPU Regions==
For the below instruction permissions: RO = memory is executable, while None = not-executable.

===NATIVE_FIRM/SAFE_MODE_FIRM ARM9 kernel===
{| class="wikitable" border="1"
|-
! Region
! Address
! Size
! Privileged-mode data permissions
! User-mode data permissions
! Privileged-mode instruction permissions
! User-mode instruction permissions
|-
| 0
| 0xFFFF0000
| 32KB/0x8000
| RO
| None
| RO
| None
|-
| 1
| 0x01FF8000
| 32KB/0x8000
| RW
| RW
| RO
| RO
|-
| 2
| 0x08000000
| 1MB/0x100000. >=[[8.0.0-18|8.0.0-X]]: 2MB/0x200000.
| RW
| RW
| RO
| RO
|-
| 3
| 0x10000000
| 128KB/0x20000
| RW
| RW
| None
| None
|-
| 4
| 0x10100000
| 512KB/0x80000
| RW
| RW
| None
| None
|-
| 5
| 0x20000000
| 128MB/0x8000000. >=[[8.0.0-18|8.0.0-X]]: 256MB/0x10000000.
| RW
| RW
| None
| None
|-
| 6
| 0x08000000
| 128KB/0x20000
| RW
| None
| RO
| None
|-
| 7
| 0x08020000
| <[[3.0.0-5]]: 64KB/0x10000. >=[[3.0.0-5]]: 32KB/0x8000.
| RW
| None
| RO
| None
|}

The above is the MPU region settings setup by the ARM9-kernel in the crt0.

The New3DS ARM9-kernel MPU region settings are the same as the Old3DS MPU region settings for >=[[8.0.0-18|8.0.0-X]].

At the start of the Process9 function executed in kernel-mode via svc7b during firm-launching, it changes some MPU region settings. At the end of that function, before it uses the ARM9/ARM11 entrypoint fields, it disables MPU.

===New3DS [[FIRM|ARM9-loader]]===
{| class="wikitable" border="1"
|-
! Region
! Address
! Size
! Privileged-mode data permissions
! User-mode data permissions
! Privileged-mode instruction permissions
! User-mode instruction permissions
|-
| 0
| 0xFFFF0000
| 32KB/0x8000
| RO
| None
| RO
| None
|-
| 1
| 0x01FF8000
| 32KB/0x8000
| RW
| None
| RO
| None
|-
| 2
| 0x08000000
| 2MB/0x200000
| RW
| None
| RO
| None
|-
| 3
| 0x10000000
| 128KB/0x20000
| RW
| None
| None
| None
|}

MPU regions 4-7 are disabled. Note that the entire ARM9-loader runs in SVC-mode.

===TWL_FIRM/AGB_FIRM ARM9 kernel===
{| class="wikitable" border="1"
|-
! Region
! Address
! Size
! Privileged-mode data permissions
! User-mode data permissions
! Privileged-mode instruction permissions
! User-mode instruction permissions
|-
| 0
| 0xFFFF0000
| 32KB/0x8000
| RO
| None
| RO
| None
|-
| 1
| 0x01FF8000
| 32KB/0x8000
| RW
| RW
| RO
| RO
|-
| 2
| 0x08000000
| 1MB/0x100000. New3DS: 2MB/0x200000.
| RW
| RW
| RO
| RO
|-
| 3
| 0x10000000
| 2MB/0x200000.
| RW
| RW
| None
| None
|-
| 4
| 0x1FF00000
| 512KB/0x80000
| RW
| RW
| None
| None
|-
| 5
| 0x20000000
| 128MB/0x8000000. New3DS: 256MB/0x10000000.
| RW
| RW
| None
| None
|-
| 6
| 0x08000000
| <[[3.0.0-5|3.0.0-X]]: 256KB/0x40000. >=[[3.0.0-5|3.0.0-X]]: 128KB/0x20000
| RW
| None
| RO
| None
|-
| 7
| 0x08080000
| 128KB/0x20000
| RW
| RW
| RO
| RO
|}

==ARM9 ITCM==
{| class="wikitable" border="1"
|-
! ITCM mirror address
! ITCM bootrom mirror address
! Offset
! Size
! Description
|-
| 0x01FF8000
|
| 0x0
| 0x3700
| Uninitialized memory.
|-
| 0x01FFB700
| 0x07FFB700
| 0x3700
| 0x100
| The unprotected ARM9-bootrom code copies code from unprotected bootrom to 0x07FFB700(ITCM mirror) size 0x100, then calls the code at 0x07FFB700. The code located here is the code used for disabling access to the bootroms.
|-
| 0x01FFB800
|
| 0x3800
| 0x4
| This is always 0xDEADB00F.
|-
| 0x01FFB804
|
| 0x3804
| 0x4
| This is the u32 DeviceId.
|-
| 0x01FFB808
|
| 0x3808
| 0x10
| This is the fall-back keyY used for movable.sed keyY when movable.sed doesn't exist in NAND(the last two words here are used on retail for generating console-unique TWL keydata/etc). This is also used for "LocalFriendCodeSeed", etc.
|-
| 0x01FFB818
|
| 0x3818
| 0x1
| ?
|-
| 0x01FFB819
|
| 0x3819
| 0x1
| This is the [[CTCert]] issuer type: 0 = retail "Nintendo CA - G3_NintendoCTR2prod", non-zero = dev "Nintendo CA - G3_NintendoCTR2dev".
|-
| 0x01FFB81A
|
| 0x381A
| 0x6
| ?
|-
| 0x01FFB820
|
| 0x3820
| 0x4
| This is the CTCert ECDSA exponent, this is byte-swapped when *((u8*)(0x01FFB800+0x18)) is >=5.
|-
| 0x01FFB824
|
| 0x3824
| 0x2
| ?
|-
| 0x01FFB826
|
| 0x3826
| 0x1E
| This is the CTCert ECDSA privk.
|-
| 0x01FFB844
|
| 0x3844
| 0x3C
| This is the CTCert ECDSA signature.
|-
| 0x01FFB880
|
| 0x3880
| 0x80
| This is all-zero.
|-
| 0x01FFB900
|
| 0x3900
| 0x200
| This is the 0x200-bytes from NAND sector0.
|-
| 0x01FFBB00
|
| 0x3B00
| 0x200
| This is the 0x200-bytes from the plaintext NAND firm partition FIRM header, read by bootrom.
|-
| 0x01FFBD00
|
| 0x3D00
| 0x100
| This is the RSA-2048 modulus for [[RSA_Registers|RSA]]-engine slot0 set by bootrom.
|-
| 0x01FFBE00
|
| 0x3E00
| 0x100
| This is the RSA-2048 modulus for RSA-engine slot1 set by bootrom.
|-
| 0x01FFBF00
|
| 0x3F00
| 0x100
| This is the RSA-2048 modulus for RSA-engine slot2.
|-
| 0x01FFC000
|
| 0x4000
| 0x100
| This is the RSA-2048 modulus for RSA-engine slot3.
|-
| 0x01FFC100
|
| 0x4100
| 0x800
| These are RSA-2048 keys: 4 slots, each slot is 0x200-bytes. Slot+0 is the modulus, slot+0x100 is the private exponent. This can be confirmed by RSA-decrypting a message into a signature, then RSA-encrypting the signature back into a message, and comparing the original message with the output from the last operation.

[[FIRM]] doesn't seem to ever use these. None of these are related to RSA-keyslot0 used for v6.0/v7.0 key generation. These moduli are separate from all other moduli used elsewhere.
|-
| 0x01FFC900
| 0x07FFC900
| 0x4900
| 0x400
| The unprotected ARM9-bootrom copies data to 0x07FFC900(mirror of 0x01FFC900) size 0x400. This data is copied from AXI WRAM, initialized by ARM11-bootrom(the addr used for the src is determined by [[CONFIG_Registers|REG_UNITINFO]]). These are RSA moduli: retailsrcptr = 0x1FFFD000, devsrvptr = 0x1FFFD400.
* The first 0x100-bytes here is the RSA-2048 modulus for the CFA NCCH header, and for the gamecard NCSD header.
* 0x01FFCA00 is the RSA-2048 modulus for the CXI accessdesc signature, written to rsaengine keyslot1 by NATIVE_FIRM.
* 0x01FFCB00 size 0x200 is unknown, probably RSA related, these aren't used by [[FIRM]](these are not console-unique).
|-
| 0x01FFCD00
|
| 0x4D00
| 0x80
| Unknown, not used by [[FIRM]]. This isn't console-unique.
The first 0x10-bytes are checked by the v6.0/v7.0 NATIVE_FIRM keyinit function, when non-zero it clears this block and continues to do the key generation. Otherwise when this block was already all-zero, it immediately returns. This memclear was probably an attempt at destroying the RSA slot0 modulus, that missed (exactly 0x1000-bytes away). Even though they "failed" here, one would still need to derive the private exponent, which would require obtaining a ciphertext and plaintext.
|-
| 0x01FFCD80
|
| 0x4D80
| 0x64
| 0x01FFCD84 size 0x10-bytes is the NAND CID(the 0x64-byte region at 0x01FFCD80 is initialized by Process9 + ARM9-bootrom). The u32 at 0x01FFCDC4 is the total number of NAND sectors, read from a MMC command.
|-
| 0x01FFCDE4
|
| 0x4DE4
| 0x21C
| Uninitialized memory.
|-
| 0x01FFD000
| 0x07FFD000
| 0x5000
| 0x2470
| The unprotected ARM9-bootrom copies 0x1FFFA000(AXIWRAM mem initialized by ARM11-bootrom) size 0x2470 to 0x07FFD000(mirror of 0x01FFD000). This block contains DSi keys.
* 0x01FFD000 is the RSA-1024 modulus for the retail System Menu
* 0x01FFD080 is the RSA-1024 modulus for DSi Wifi firmware and DSi Sound
* 0x01FFD100 is the RSA-1024 modulus for base DSi apps (Settings, Shop, etc.)
* 0x01FFD180 is the RSA-1024 modulus for DSiWare and RSA-signed cartridge headers
* 0x01FFD210 is the keyY for per-console-encrypted ES blocks
* 0x01FFD220 is the keyY for fixed-keyX ES blocks
* 0x01FFD300 is the DSi common (normal)key
* 0x01FFD350 is a normalkey set on keyslot 0x02, and is likely only used during boot
* 0x01FFD380 is the keyslot 0x00 keyX and the first half of the retail keyX for modcrypt crypto "Nintendo"
* 0x01FFD398 is the keyX used for 'Tad' crypto, usually in keyslot 0x02 "Nintendo DS", ..
* 0x01FFD3A8 is set as the middle two words of keyslot 0x03's keyX, before being overwritten "NINTENDO"
* 0x01FFD3BC is the keyY for keyslot 0x01, see below
* 0x01FFD3C8 is the fixed keyY used for eMMC partition crypto on retail DSi, see below (keyslot 0x03)
* 0x01FFD3E0 is the 0x1048-byte Blowfish data for DSi cart crypto
* 0x01FFE428 is the 0x1048-byte Blowfish data for DS cart crypto
On the 3DS, keyslots 0x01 and 0x03 have the last word set as 0xE1A00005 instead of the next word in ITCM. This is consistent with retail DSis.
|-
| 0x01FFF470
|
| 0x7470
| 0xB90
| Uninitialized memory.
0x01FFFC00 size 0x100-bytes starting with [[9.5.0-22|9.5.0-X]] is the FIRM header used during FIRM-launching.
|}

=Memory map by firmware=
* [[Virtual address mapping FW0B]]
* [[Virtual address mapping FW1F]]
* [[Virtual address mapping FW25]]
* [[Virtual address mapping FW2E]]
* [[Virtual address mapping FW37]]
* [[Virtual address mapping FW38‎]]
* [[Virtual address mapping FW3F]]
* FW49([[9.6.0-24|9.6.0-X]]) and [[10.0.0-27|10.0.0-X]] ARM11-kernel vmem mapping is identical to FW40([[9.5.0-22|9.5.0-X]]).

* [[Virtual address mapping TWLFIRM04]]

* [[Virtual address mapping New3DS v8.1]]
* [[Virtual address mapping New3DS v9.0]]
* [[Virtual address mapping New3DS v9.2]]

=ARM11 Detailed physical memory map=
18000000 - 18600000: VRAM

1FF80000 - 1FFAB000: Kernel code
1FFAB000 - 1FFF0000: SlabHeap [temporarily contains boot processes]
1FFF0000 - 1FFF1000: ?
1FFF1000 - 1FFF2000: ?
1FFF2000 - 1FFF3000: ?
1FFF3000 - 1FFF4000: ?
1FFF4000 - 1FFF5000: Exception vectors
1FFF5000 - 1FFF5800: Unused?
1FFF5800 - 1FFF5C00: 256-entry L2 MMU table for VA FF4xx000
1FFF5C00 - 1FFF6000: 256-entry L2 MMU table for VA FF5xx000
1FFF6000 - 1FFF6400: 256-entry L2 MMU table for VA FF6xx000
1FFF6400 - 1FFF6800: 256-entry L2 MMU table for VA FF7xx000
1FFF6800 - 1FFF6C00: 256-entry L2 MMU table for VA FF8xx000
1FFF6C00 - 1FFF7000: 256-entry L2 MMU table for VA FF9xx000
1FFF7000 - 1FFF7400: 256-entry L2 MMU table for VA FFAxx000
1FFF7400 - 1FFF7800: 256-entry L2 MMU table for VA FFBxx000
1FFF7800 - 1FFF7C00: MMU table but unused?
1FFF7C00 - 1FFF8000: 256-entry L2 MMU table for VA FFFxx000
1FFF8000 - 1FFFC000: 4096-entry L1 MMU table for VA xxx00000 (CPU 0)
1FFFC000 - 20000000: 4096-entry L1 MMU table for VA xxx00000 (CPU 1)
20000000 - 28000000: Main memory

The entire FCRAM is cleared during NATIVE_FIRM boot. This is done by the ARM11 kernel in order by region as it initializes after loading [[FIRM]] launch parameters from FCRAM.

== FCRAM memory-regions layout ==
{| class="wikitable" border="1"
! [[Configuration_Memory#APPMEMTYPE|Configmem-APPMEMTYPE]] Value
! Base address relative to FCRAM+0, for APPLICATION mem-region
! Region size, for APPLICATION mem-region
! Base address relative to FCRAM+0, for SYSTEM mem-region
! Region size, for SYSTEM mem-region
! Base address relative to FCRAM+0, for BASE mem-region
! Region size, for BASE mem-region
|-
| 0 (default with regular 3DS kernel, used when the type is not 2-5)
| 0x0
| 0x04000000(64MB)
| 0x04000000
| 0x02C00000
| 0x06C00000
| 0x01400000
|-
| 2
| 0x0
| 0x06000000(96MB)
| 0x06000000
| 0x00C00000
| 0x06C00000
| 0x01400000
|-
| 3
| 0x0
| 0x05000000(80MB)
| 0x05000000
| 0x01C00000
| 0x06C00000
| 0x01400000
|-
| 4
| 0x0
| 0x04800000(72MB)
| 0x04800000
| 0x02400000
| 0x06C00000
| 0x01400000
|-
| 5
| 0x0
| 0x02000000(32MB)
| 0x02000000
| 0x04C00000
| 0x06C00000
| 0x01400000
|-
| 6 (This is the default on New3DS. With [[New_3DS]] kernel this is the type used when the value is not 7)
| 0x0
| 0x07C00000(124MB)
| 0x07C00000
| 0x06400000
| 0x0E000000
| 0x02000000
|-
| 7
| 0x0
| 0x0B200000(178MB)
| 0x0B200000
| 0x02E00000
| 0x0E000000
| 0x02000000
|}

The SYSTEM mem-region size is calculated with: size = FCRAMTOTALSIZE - (APPLICATION_MEMREGIONSIZE + BASE_MEMREGIONSIZE).

Support for type6/7 was [[NCCH/Extended Header|implemented]] in [[NS]] with [[8.0.0-18]], these are only supported in the [[New_3DS]] ARM11-kernel not the regular 3DS kernel. These two types are the only ones supported by the New3DS kernel.

All memory allocated by the kernel itself for kernel use is located under BASE. Most system-modules run under the BASE memregion too.

Free/used memory on [[4.5.0-10]] with Home Menu / Internet Browser, with the default APPMEMTYPE on retail:
{| class="wikitable" border="1"
! Region
! Base address relative to FCRAM+0
! Region size
! Used memory once [[Home Menu]] finishes loading for system boot, on [[4.5.0-10]]
! Used memory with [[Internet Browser]] running instead of [[Home Menu]], on [[4.5.0-10]]
! Free memory once [[Home Menu]] finishes loading for system boot, on [[4.5.0-10]]
! Free memory with [[Internet Browser]] running instead of [[Home Menu]], on [[4.5.0-10]]
|-
| APPLICATION
| 0x0
| 0x04000000
| 0x0
|
| 0x04000000
|
|-
| SYSTEM
| 0x04000000
| 0x02C00000
| 0x01488000
| 0x02A50000
| 0x01778000
| 0x001B0000
|-
| BASE
| 0x06C00000
| 0x01400000
| 0x01202000
| 0x01236000
| 0x001FE000
| 0x001CA000
|}

=ARM11 Detailed virtual memory map=
(valid only for FW0B, see [[#Memory map by firmware|Memory map by firmware]] for subsequent versions)

E8000000 - E8600000: mapped VRAM (18000000 - 18600000)

EFF00000 - F0000000: mapped Internal memory (1FF00000 - 20000000)
F0000000 - F8000000: mapped Main memory

FF401000 - FF402000: mapped ? (27FC7000 - 27FC8000)

FF403000 - FF404000: mapped ? (27FC2000 - 27FC3000)

FF405000 - FF406000: mapped ? (27FBB000 - 27FBC000)

FF407000 - FF408000: mapped ? (27FB3000 - 27FB4000)

FF409000 - FF40A000: mapped ? (27F8E000 - 27F8F000)

FFF00000 - FFF45000: mapped SlabHeap

FFF60000 - FFF8B000: mapped Kernel code

FFFCC000 - FFFCD000: mapped IO [[I2C|I2C]] second bus (10144000 - 10145000)

FFFCE000 - FFFCF000: mapped IO PDC([[LCD]]) (10400000 - 10401000)

FFFD0000 - FFFD1000: mapped IO PDN (10141000 - 10142000)

FFFD2000 - FFFD3000: mapped IO PXI (10163000 - 10164000)

FFFD4000 - FFFD5000: mapped IO PAD (10146000 - 10147000)

FFFD6000 - FFFD7000: mapped IO LCD (10202000 - 10203000)

FFFD8000 - FFFD9000: mapped IO DSP (10140000 - 10141000)

FFFDA000 - FFFDB000: mapped IO XDMA (10200000 - 10201000)

FFFDC000 - FFFE0000: mapped ? (1FFF8000 - 1FFFC000)

FFFE1000 - FFFE2000: mapped ? (1FFF0000 - 1FFF1000)

FFFE3000 - FFFE4000: mapped ? (1FFF2000 - 1FFF3000)

FFFE5000 - FFFE9000: mapped L1 MMU table for VA xxx00000

FFFEA000 - FFFEB000: mapped ? (1FFF1000 - 1FFF2000)

FFFEC000 - FFFED000: mapped ? (1FFF3000 - 1FFF4000)

FFFEE000 - FFFF0000: mapped IO IRQ (17E00000 - 17E02000)

FFFF0000 - FFFF1000: mapped Exception vectors

FFFF2000 - FFFF6000: mapped L1 MMU table for VA xxx00000

FFFF7000 - FFFF8000: mapped ? (1FFF1000 - 1FFF2000)

FFFF9000 - FFFFA000: mapped ? (1FFF3000 - 1FFF4000)

FFFFB000 - FFFFE000: mapped L2 MMU tables (1FFF5000 - 1FFF8000)

==0xFF4XX000==
Each [[KThread|thread]] is allocated a 0x1000-byte page in this region for the [[KThreadContext|thread context]]: the first page at 0xFF401000 is for the first created thread, 0xFF403000 for the second thread. This region is used to store the SVC-mode stack for the thread, and thread context data used for context switching. When the IRQ handler, prefetch/data abort handlers, and undefined instruction handler are entered where the SPSR-mode=user, these handlers then store LR+SPSR for the current mode on the SVC-mode stack, then these handlers switch to SVC-mode.

This page does not contain a dedicated block for storing R0-PC(etc). For user-mode, the user-mode regs are instead saved on the SVC-mode stack when IRQs such as timers for context switching are triggered.

For NATIVE_FIRM the memory pages for this region are located in FCRAM, however for TWL_FIRM these are located in AXI WRAM. For TWL_FIRM v6704 the first thread's page for this region is located at physical address 0x1FF93000, the next one at 0x1FF92000, etc.

== IO Process virtual addressing equivalence ==
It seems an IO register's process virtual address can be calculated by adding 0xEB00000 to its physical address. However for kernel mappings there is no fixed address equivalence.

=ARM11 User-land memory regions=
==NATIVE_FIRM/SAFE_MODE_FIRM Userland Memory==
{| class="wikitable" border="1"
|-
! Virtual Address Base
! Physical Address Base
! Region Max Size
! Address-range available for svcMapMemoryBlock
! Description
|-
| 0x00100000 / 0x14000000
|
| 0x03F00000
| No
| The [[ExeFS]]:/.code is loaded here, executables must be loaded to the 0x00100000 region when the exheader "special memory" flag is clear. The 0x03F00000-byte size restriction only applies when this flag is clear. Executables are usually loaded to 0x14000000 when the exheader "special memory" flag is set, however this address can be arbitrary.
|-
| 0x04000000
| ?
| ?
| No
| Used for mapping buffers during IPC, see [[IPC Command Structure]].
|-
| 0x08000000
| Main stack physaddr - <heap size for the allocated vaddr 0x08000000 memory>
| 0x08000000
| Yes
| Heap mapped by [[SVC|ControlMemory]]
|-
| 0x10000000-StackSize
| .bss physical address - total stack pages
| StackSize from process exheader
|
| Stack for the main-thread, initialized by the ARM11 kernel. The StackSize from the exheader is usually 0x4000, therefore the stack-bottom is usually 0x0FFFC000. The stack for the other threads is normally located in the process .data section however this can be arbitrary.
|-
| 0x10000000
|
| 0x04000000
| Yes
| [[SVC|Shared]] memory
|-
| 0x14000000
| FCRAM+0
| 0x08000000
| No
| Can be mapped by [[SVC|ControlMemory]], this is used for processes' [[SVC|LINEAR]]/GSP heap.
|-
| 0x1E800000
| 0x1F000000
| 0x00400000
| No
| [[New_3DS]] additional memory, access to this is specified by the exheader. Added with [[8.0.0-18]], see above section regarding this memory.
|-
| 0x1EC00000
| 0x10100000
| 0x00400000
| No
| [[IO]] registers, the mapped IO pages which each process can access is specified in the [[NCCH/Extended_Header|exheader]]. (Applications normally don't have access to registers in this range)
|-
| 0x1F000000
| 0x18000000
| 0x00600000
| No
| VRAM, access to this is specified by the exheader.
|-
| 0x1FF00000
| 0x1FF00000
| 0x00080000
| No
| DSP memory, access to this is specified by the exheader.
|-
| 0x1FF80000
| FCRAM memory page allocated by the ARM11 kernel.
| 0x1000
| No
| [[Configuration Memory]], all processes have read-only access to this.
|-
| 0x1FF81000
| FCRAM memory page allocated by the ARM11 kernel.
| 0x1000
| No
| [[Configuration Memory|Shared]] page, all processes have read-access to this. Write access to this is specified by the exheader "Shared page writing" kernel flag.
|-
| 0x1FF82000
| Dynamically taken from the BASE region of FCRAM
| Number of threads * 0x1000 / 8
| No
| [[Thread Local Storage]]
|-
| 0x30000000
| FCRAM+0
| 0x08000000(Old3DS) / 0x10000000([[New_3DS]])
| No
| This LINEAR memory mapping was added with [[8.0.0-18]], see [[SVC#enum_MemoryOperation|here]]. This replaces the original 0x14000000 mapping, for system(memory-region=BASE)/newer titles. The Old3DS kernel uses size 0x08000000 for LINEAR-memory address range checks, while the New3DS kernel uses size 0x10000000 for those range checks. Old3DS/New3DS system-module code doing vaddr->phys-addr conversion uses size 0x10000000.
|-
| 0x20000000 / 0x40000000
|
|
|
| This is the end-address of userland memory, memory under this address is process-unique. Memory starting at this address is only accessible in privileged-mode. This address was changed from 0x20000000 to 0x40000000 with [[8.0.0-18]].
|}

All executable pages are read-only, and data pages have the execute-never permission set. Normally .text from the loaded ExeFS:/.code is the only mapped executable memory. Executable [[RO Services|CROs]] can be loaded into memory, once loaded the CRO .text section memory page permissions are changed via [[SVC|ControlProcessMemory]] from RW- to R-X. The address and size of each ExeFS:/.code section is stored in the exheader, the permissions for each section is: .text R-X, .rodata R--, .data RW-, and .bss RW-. The loaded .code is mapped to the addresses specified in the exheader by the ARM11 kernel. The stack permissions is initialized by the ARM11 kernel: RW-. The heap permissions is normally RW-.

All userland memory is mapped with RW permissions for privileged-mode. However, normally the ARM11 kernel only uses userland read/write instructions(or checks that the memory can be written from userland first) for accessing memory specified by [[SVC|SVCs]].

Processes can't directly access memory for other processes. When service [[Services API|commands]] are used, the kernel maps memory in the destination process for input/output buffers, where the addresses in the command received by the process is replaced by this mapped memory. When this is an input buffer, the buffer data is copied to the mapped memory. When this is an output buffer, the data stored in the mapped memory is copied to the destination buffer specified in the command.

The physical address which memory for the application memory-type is mapped to begins at FCRAM+0, the total memory allocated for this memory-type is stored in [[Configuration_Memory]]. Applications' .text + .rodata + .data under the application memory-type is mapped at FCRAM + APPMEMALLOC - (aligned page-size for .text + .rodata + .data). The application .bss is mapped at CODEADDR - .bss size aligned down to the page size.

==TWL_FIRM Userland Memory==
{| class="wikitable" border="1"
|-
! Virtual Address Base
! Physical Address Base
! Size
! Description
|-
| 0x00100000
| 0x1FFAB000 (with newer TWL_FIRM such as v6704 this is located at 0x1FFAC000)
| 0x00055000
| Code + .(ro)data copied from the process 0x00300000 region is located here(.bss is located here as well).
|-
| 0x00155000
| 0x18555000
| 0x000AB000
|
|-
| 0x00200000
| 0x18500000
| 0x00100000
|
|-
| 0x00300000
| 0x24000000
| 0x04000000
| The beginning of the ARM11 process .text is located here.
|-
| 0x08000000
| 0x20000000
| 0x07E00000
|
|-
| 0x1EC00000
| 0x10100000
| 0x00400000
| [[IO]]
|-
| 0x1F000000
| 0x18000000
| 0x00600000
| VRAM
|-
| 0x1FF00000
| 0x1FF00000
| 0x00080000
| This is mapped to the DSP memory.
|}

The above regions are mapped by the ARM11 kernel. Later when the ARM11 process uses [[SVC|svcKernelSetState]] with type4, the kernel unmaps(?) the following regions: 0x00300000..0x04300000, 0x08000000..0x0FE00000, and 0x10000000..0xF8000000.

=== Detailed TWL_FIRM ARM11 Memory ===
{| class="wikitable" border="1"
|-
! Process Virtual Address
! Physical Address
! Size
! Description
|-
| 0x08000000
| 0x20000000
| 0x01000000*4
| DS(i) 0x02000000 RAM. Vaddr = (DSRAMOffset*4) + 0x08000000, where DSRAMOffset is DSRAMAddr-0x02000000.
|-
| 0x0FC00000
| 0x27C00000
|
| Loaded SRL binary, initially the dev DSi launcher SRL is located here(copied here by the ARM11 process).
|-
| 0x0FD00000
| 0x27D00000
|
| The data located here is copied to here by the ARM11 process. The data located here is a TWL NAND [http://dsibrew.org/wiki/Bootloader bootloader] image, using the same format+encryption/verification methods as the DSi NAND bootloader(stage2). The keyX for this bootloader keyslot is initially set to the retail DSi key-data, however when TWL_FIRM is launched this keyX key-data is replaced with a separate keyX. TWL_FIRM can use either the retail DSi bootloader RSA-1024 modulus, or a seperate modulus: normally only the latter is used(the former is only used when loading the image from FS instead of FCRAM). When using the image from FCRAM(default code-path), TWL_FIRM will not calculate+check the hashes for the bootloader code binaries(this is done when loading from FS however).
|-
| 0x0FDF7000
| 0x27DF7000
| 0x1000
| SRL header
|}

= System memory details =
0xFFFF9000 Pointer to the current KThread instance
0xFFFF9004 Pointer to the current KProcess instance
0xFFFF9008 Pointer to the current KScheduler instance
0xFFFF9010 Pointer to the last KThread to encounter an exception

0x8000040 Pointer to the current KThread instance on the ARM9
0x8000044 Pointer to the current KProcess instance on the ARM9
0x8000048 Pointer to the current KScheduler instance on the ARM9

= VRAM Map While Running System Applets =
*0x1E6000-0x22C500 -- top screen 3D left framebuffer 0(240x400x3) (The "3D right first-framebuf" addr stored in the LCD register is set to this, when the 3D is set to "off")
*0x22C800-0x272D00 -- top screen 3D right framebuffer 0(240x400x3)
*0x273000-0x2B9500 -- top screen 3D left framebuffer 1(240x400x3)
*0x2B9800-0x2FFD00 -- top screen 3D right framebuffer 1(240x400x3)
*0x48F000-0x4C7400 -- bottom screen framebuffer 0(240x320x3)
*0x4C7800-0x4FF800 -- bottom screen framebuffer 1(240x320x3)

These LCD framebuffer addresses are not changed by the system when launching regular applications, the application itself handles that if needed. These VRAM framebuffers are cleared when launching regular applications.

KThreadContext

2016-08-29T12:45:21Z

Bond697: Undo revision 18002 by Neobrain (talk)

[[Category:Kernel objects]]

Size : 0x1000 bytes (1 page)

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0xF38
| u32[4]
| SVC access control data copied from KThread's owner process
|-
| 0xF50
| u32[10]
| SVC mode registers, r4-r11, r13, r14
|-
| 0xFF8
| u32
| FPEXC, floating point exception register for thread- stored and loaded on context switches
|}

When switching thread contexts the kernel does, in order:

* Load FPEXC
* Save the LR to r1- this LR is the return back to the main scheduling and context switching function
* Load r4-r11, SP, LR
* Branch back to r1, preserving the LR which was just reloaded, back to the main scheduling function, but in the context of the newly switched-to thread
* Disable Interrupts
* Check if that core's KScheduler object indicates that it needs switching again and exit if it does not
* Otherwise, run the thread scheduler again and repeat all the steps to switch contexts again

KThreadContext

2016-08-28T21:11:09Z

Bond697:

KThreadContext

2016-08-28T17:46:22Z

Bond697:

[[Category:Kernel objects]]

Size : 0x1000 bytes (1 page)

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0xF50
| u32[10]
| SVC mode registers, r4-r11, r13, r14
|-
| 0xFF8
| u32
| FPEXC, floating point exception register for thread- stored and loaded on context switches
|}

When switching thread contexts the kernel does, in order:

* Load FPEXC
* Save the LR to r1- this LR is the return back to the main scheduling and context switching function
* Load r4-r11, SP, LR
* Branch back to r1, preserving the LR which was just reloaded, back to the main scheduling function, but in the context of the newly switched-to thread

KAddressArbiter

2016-08-23T11:41:08Z

Bond697:

[[Category:Kernel objects]]
class [[KAddressArbiter]] extends [[KAutoObject]];

Size : 0x14 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| [[KThread]]*
| Last
|-
| 0xC
| [[KThread]]*
| First
|-
| 0x10
| [[KProcess]]*
| Process
|}

KSynchronizationObject

2016-08-22T21:53:02Z

Bond697:

[[Category:Kernel objects]]
class [[KSynchronizationObject]] extends [[KAutoObject]];

Size : 0x14 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Count of KThreads that sync with this object - number of nodes in the linked list below
|-
| 0xC
| KLinkedListNode*
| Pointer to first KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x10
| KLinkedListNode*
| Pointer to last KLinkedListNode in node list of KThreads that sync with this object
|}

KSharedMemory

2016-08-22T21:43:13Z

Bond697:

[[Category:Kernel objects]]
class [[KSharedMemory]] extends [[KAutoObject]] and [[KLinkedList]];

Size : 0x28 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Node count for [[KBlockInfo]] objects
|-
| 0xC
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of [[KBlockInfo]] objects associated with this KSharedMemory object
|-
| 0x10
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of [[KBlockInfo]] objects associated with this KSharedMemory object
|-
| 0x14
| [[KProcess]]*
| Owner
|-
| 0x18
| u32
| Owner permissions
|-
| 0x1C
| u32
| Other processes' permissions for this block
|-
| 0x20
| u8
| Set after KBlockInfo is generated for the KSharedMemory
|-
| 0x21
| s8
| Set after all KBlockInfo is generated
|-
| 0x22
| u8
| Unknown
|-
| 0x24
| u32
| Address
|-

KSession

2016-08-22T21:39:41Z

Bond697:

[[Category:Kernel objects]]
class [[KSession]] extends [[KAutoObject]];

Size : 0x4C bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x20
| [[KThread]]*
| X ?
|-
| 0x24
| [[KThread]]*
| Y ?
|-
| 0x2C
| [[KThread]]*
| Z ?
|}
It seems X=Y=Z. X, Y and Z can be NULL.

Structure for [[7.0.0-13]] NATIVE_FIRM upward:

Size : 0x4C bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Pointer to vtable
|-
| 0xC
| u32
| Reference count
|-
| 0x10
| u32
| Node count for threads
|-
| 0x14
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x18
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x1C
| KSession*
| Pointer to parent session
|-
| 0x20
| [[KThread]]*
| Last stolen KThread during sync request- current thread when KServerSession code is running during svc - noted in KThread+0xA8 as well
|-
| 0x24
| [[KThread]]*
| First stolen KThread during sync request
|-
| 0x28
| [[KThread]]*
| KThread that originated the session
|-
| 0x2C
| u32
| Pointer to vtable
|-
| 0x30
| u32
| Reference count
|-
| 0x34
| u32
| KLinkedListNode count for object
|-
| 0x38
| KLinkedListNode*
| Pointer to first KLinkedListNode in list of KThreads using this client session
|-
| 0x3C
| KLinkedListNode*
| Pointer to last KLinkedListNode in list of KThreads using this client session
|-
| 0x40
| KSession*
| Pointer to parent session
|-
| 0x44
| u32
| Session status
|-
| 0x48
| KClientPort*
| Pointer to associated client port inside parent KPort
|-

KSession

2016-08-22T21:38:46Z

Bond697:

[[Category:Kernel objects]]
class [[KSession]] extends [[KAutoObject]];

Size : 0x4C bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x20
| [[KThread]]*
| X ?
|-
| 0x24
| [[KThread]]*
| Y ?
|-
| 0x2C
| [[KThread]]*
| Z ?
|}
It seems X=Y=Z. X, Y and Z can be NULL.

Structure for [[7.0.0-13]] NATIVE_FIRM upward:

Size : 0x4C bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Pointer to vtable
|-
| 0xC
| u32
| Reference count
|-
| 0x10
| u32
| Node count for threads
|-
| 0x14
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x18
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x1C
| [[KSession]]*
| Pointer to parent session
|-
| 0x20
| [[KThread]]*
| Last stolen KThread during sync request- current thread when KServerSession code is running during svc - noted in KThread+0xA8 as well
|-
| 0x24
| [[KThread]]*
| First stolen KThread during sync request
|-
| 0x28
| [[KThread]]*
| KThread that originated the session
|-
| 0x2C
| u32
| Pointer to vtable
|-
| 0x30
| u32
| Reference count
|-
| 0x34
| u32
| KLinkedListNode count for object
|-
| 0x38
| KLinkedListNode*
| Pointer to first KLinkedListNode in list of KThreads using this client session
|-
| 0x3C
| KLinkedListNode*
| Pointer to last KLinkedListNode in list of KThreads using this client session
|-
| 0x40
| KSession*
| Pointer to parent session
|-
| 0x44
| u32
| Session status
|-
| 0x48
| KClientPort*
| Pointer to associated client port inside parent KPort
|-

KServerSession

2016-08-22T21:24:39Z

Bond697:

[[Category:Kernel objects]]
class [[KServerSession]] extends [[KSynchronizationObject]];

Size : 0x24 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Node count for threads
|-
| 0xC
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x10
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x14
| [[KSession]]*
| Pointer to parent session
|-
| 0x18
| [[KThread]]*
| Last stolen KThread during sync request- current thread when KServerSession code is running during svc - noted in KThread+0xA8 as well
|-
| 0x1C
| [[KThread]]*
| First stolen KThread during sync request
|-
| 0x20
| [[KThread]]*
| KThread that originated the session
|-

KServerPort

2016-08-22T21:23:05Z

Bond697:

[[Category:Kernel objects]]
class [[KServerPort]] extends [[KSynchronizationObject]];

Size : 0x24 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Node count for threads
|-
| 0xC
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x10
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x14
| u32
| Node count for threads
|-
| 0x18
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x1C
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x20
| [[KPort]]*
| Pointer to parent KPort
|-

KProcess

2016-08-22T21:19:30Z

Bond697:

[[Category:Kernel objects]]
class [[KProcess]] extends [[KSynchronizationObject]];

Size : 0x260 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Count of KThreads that sync with this object - number of nodes in the linked list below
|-
| 0xC
| KLinkedListNode*
| Pointer to first KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x10
| KLinkedListNode*
| Pointer to last KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x14
| u32
| Unknown
|-
| 0x18
| u32
| Unknown
|-
| 0x1C
| [[KThread]]*
| 0 or pointer to the thread the currently does something with the process object.
|-
| 0x20
| s16
| ?
|-
| 0x30
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in list of KMemoryBlocks used by the process
|-
| 0x34
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in list of KMemoryBlocks used by the process
|-
| 0x40
| u32
| Translation table base
|-
| 0x44
| u8
| Context ID
|-
| 0x50
| u32
| Size of the MMU table
|-
| 0x54
| u32
| Virtual address of the MMU table for this process
|-
| 0x58
| u32
| Total size of all thread context pages (0xFF4xxxxx) owned by threads that belong to this process
|-
| 0x5C
| u32
| Number of [[KThreadLocalPage|KThreadLocalPages]] used by this KProcess
|-
| 0x60
| KLinkedListNode*
| Pointer to first KLinkedListNode in the list of KThreadLocalPages
|-
| 0x64
| KLinkedListNode*
| Pointer to last KLinkedListNode in the list of KThreadLocalPages
|-
| 0x6C
| s32
| Ideal processor
|-
| 0x74
| u32
| Pointer to resource limits for process.
|-
| 0x79
| u8
| Proc affinity mask
|-
| 0x7C
| u32
| Number of threads which belong to this process.
|-
| 0x80
| 0x10-bytes
| SVC access control mask from the exheader kernel descriptors. This is copied to the [[Memory_layout#0xFF4XX000|0xFF4XX000]] area when creating threads, which is the actual data the SVC-handler checks for SVC-access-control.
|-
| 0x90
| 0x10-bytes
| Interrupt flags- 32 interrupts per word, 4 words, 0x80 interrupts total divided evenly across 4 words
|-
| 0xA0
| u32
| Kernel flags from the exheader kernel descriptors.
|-
| 0xA4
| u16
| Handle table size from the exheader kernel descriptors. When this is 0, handle table is stored in WRAM.
|-
| 0xA6
| u16
| Kernel release version field, from the exheader kernel descriptors.
|-
| 0xA8
| u32
| Pointer to [[KCodeSet]] instance
|-
| 0xAC
| u32
| Process id, this always begins at 0x0 for the first process.
|-
| 0xB0
| u32
| Kernel flags from the exheader kernel descriptors.
|-
| 0xB8
| [[KThread]]*
| Pointer to the process's main (?) thread.
|-
| 0xCC
| KProcessHandleTable
| Process handle table. until 0x1C4 or longer
|-
| 0x224
| u32
| ?
|}

Structure starting with [[8.0.0-18]] NATIVE_FIRM:

Size : 0x268 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Count of KThreads that sync with this object - number of nodes in the linked list below
|-
| 0xC
| KLinkedListNode*
| Pointer to first KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x10
| KLinkedListNode*
| Pointer to last KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x1C
| KThread*
| Thread currently running kernel code to act on this process
|-
| 0x20
| s16
| This is used to record errors that occur when the thread above is set as the thread running code for the process
|-
| 0x22
| u16
| Unused, alignment
|-
| 0x24
| u8
| TLB entries for process need invalidating on core0
|-
| 0x28
| u8
| TLB entries for process need invalidating on core1
|-
| 0x2C
| u32
| Count of KMemoryBlocks owned by the process
|-
| 0x30
| KLinkedListNode*
| Pointer to first KLinkedListNode in list of KMemoryBlocks used by the process
|-
| 0x34
| KLinkedListNode*
| Pointer to last KLinkedListNode in list of KMemoryBlocks used by the process
|-
| 0x40
| u32
| Translation table base
|-
| 0x44
| u8
| Context ID
|-
| 0x46
| bool
| Process is the currently loaded game/app
|-
| 0x4C
| u32
| End of userland virtual memory for the process
|-
| 0x50
| u32*
| [[Memory_layout|LINEAR]] memory virtual address(userland) base for this process.
|-
| 0x58
| u32
| Size of the MMU table
|-
| 0x5C
| u32
| Virtual address of the MMU table for this process
|-
| 0x60
| u32
| Total size of all thread context pages (0xFF4xxxxx) owned by threads that belong to this process
|-
| 0x64
| u32
| Number of [[KThreadLocalPage|KThreadLocalPages]] used by this KProcess
|-
| 0x68
| KLinkedListNode*
| Pointer to first KLinkedListNode in the list of KThreadLocalPages
|-
| 0x6C
| KLinkedListNode*
| Pointer to last KLinkedListNode in the list of KThreadLocalPages
|-
| 0x74
| s32
| Ideal processor for this process
|-
| 0x78
| KDebug*
| KDebug object created from svc 60 to debug the process
|-
| 0x7C
| KResourceLimit*
| Pointer to resource limits for process.
|-
| 0x80
| u8
| Normally 1 to indicate process is open/available. Set to 2 to indicate process is exiting/closing and 3 to indicate exited/closed.
|-
| 0x81
| u8
| Process affinity mask
|-
| 0x82
| u16
| Unused, alignment
|-
| 0x84
| s16
| Number of threads which belong to this process.
|-
| 0x86
| s16
| Max number of threads which can belong to this process.
|-
| 0x88
| 0x10-bytes
| SVC access control mask from the exheader kernel descriptors. This is copied to the [[Memory_layout#0xFF4XX000|0xFF4XX000]] area when creating threads, which is the actual data the SVC-handler checks for SVC-access-control.
|-
| 0x98
| u32[4]
| Interrupt available flags- 32 interrupts per word, 4 words, 0x80 interrupts total divided evenly across 4 words
|-
| 0xA8
| u32
| Kernel flags from the exheader kernel descriptors.
|-
| 0xAC
| u16
| Handle table size from the exheader kernel descriptors. When this is 0, handle table is stored in WRAM.
|-
| 0xAE
| u16
| Kernel release version field, from the exheader kernel descriptors.
|-
| 0xB0
| u32
| Pointer to [[KCodeSet]] instance
|-
| 0xB4
| u32
| Process id, this always begins at 0x0 for the first process.
|-
| 0xB8
| s64
| Process creation time as tick count
|-
| 0xC0
| KThread*
| Pointer to the process's main thread.
|-
| 0xC4
| u32[4]
| Interrupt enabled flags- 32 interrupts per word, 4 words, 0x80 interrupts total divided evenly across 4 words
|-
| 0xD4
| KProcessHandleTable
| This is the data for tracking and using all of the KProcess's handles.
|-
| 0xEC
| HandleDescriptor[0x28]
| These internal HandleDescriptor entries are only used if the exheader's handle table size is 0
|-
| 0x22C
| u32
| Unused (From here up, everything is set to 0 on creation, has 0 written to it again during process creation, and is never used again.)
|-
| 0x230
| u64
| Unused
|-
| 0x238
| u64
| Unused
|-
| 0x240
| u64
| Unused
|-
| 0x248
| u64
| Unused
|-
| 0x250
| u64
| Unused
|-
| 0x258
| u64
| Unused
|-
| 0x260
| u64
| Unused
|}

Structure starting with [[8.1.0-0 New3DS]] NATIVE_FIRM:

Size : 0x270 bytes (0x4D8 bytes on ARM9)

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Count of KThreads that sync with this object - number of nodes in the linked list below
|-
| 0xC
| KLinkedListNode*
| Pointer to first KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x10
| KLinkedListNode*
| Pointer to last KLinkedListNode in node list of KThreads that sync with this object
|-
| 0x14
| u32
| Unknown
|-
| 0x18
| u32
| Unknown
|-
| 0x1C
| KThread*
| Thread currently running code to act on this process
|-
| 0x20
| s16
| This is used to record errors that occur when the thread above is set as the thread running code for the process
|-
| 0x22
| u16
| Unused, alignment
|-
| 0x24
| u8
| TLB entries for process need invalidating on core0
|-
| 0x28
| u8
| TLB entries for process need invalidating on core1
|-
| 0x2C
| u8
| TLB entries for process need invalidating on core2
|-
| 0x30
| u8
| TLB entries for process need invalidating on core3
|-
| 0x34
| u32
| Count of KMemoryBlocks owned by the process
|-
| 0x38
| KLinkedListNode*
| Pointer to first KLinkedListNode in list of KMemoryBlocks used by the process
|-
| 0x3C
| KLinkedListNode*
| Pointer to last KLinkedListNode in list of KMemoryBlocks used by the process
|-
| 0x40
| u32
| Unknown
|-
| 0x44
| u32
| Unknown
|-
| 0x48
| u32
| Translation table base
|-
| 0x4C
| u8
| Context ID
|-
| 0x4D
| u8
| Something to do with memory allocation
|-
| 0x4E
| bool
| Process is the currently loaded game/app
|-
| 0x50
| u32
| Unknown
|-
| 0x54
| u32
| End of userland virtual memory for the process
|-
| 0x58
| u32*
| [[Memory_layout|LINEAR]] memory virtual address(userland) base for this process.
|-
| 0x5C
| u32
| Unknown
|-
| 0x60
| u32
| Size of the MMU table
|-
| 0x64
| u32
| Virtual address of the MMU table for this process
|-
| 0x68
| u32
| Total size of all [[Memory_layout#0xFF4XX000|Thread Context]] pages owned by threads that belong to this process
|-
| 0x6C
| u32
| Number of [[KThreadLocalPage|KThreadLocalPages]] used by this KProcess
|-
| 0x70
| KLinkedListNode*
| Pointer to first KLinkedListNode in the list of KThreadLocalPages
|-
| 0x74
| KLinkedListNode*
| Pointer to last KLinkedListNode in the list of KThreadLocalPages
|-
| 0x78
| u32
| Unknown
|-
| 0x7C
| s32
| Ideal processor for this process
|-
| 0x80
| KDebug*
| KDebug object created from [[SVC|svc 0x60]] to debug the process
|-
| 0x84
| KResourceLimit*
| Pointer to resource limits for process.
|-
| 0x88
| u8
| Normally 1 to indicate process is open/available. Set to 2 to indicate process is exiting/closing and 3 to indicate exited/closed.
|-
| 0x89
| u8
| Process affinity mask
|-
| 0x8A
| u16
| Unused, alignment
|-
| 0x8C
| s16
| Number of threads which belong to this process.
|-
| 0x8E
| s16
| Max number of threads which can belong to this process. This is always 0.
|-
| 0x90
| 0x10-bytes
| SVC access control mask from the exheader kernel descriptors. This is copied to the [[Memory_layout#0xFF4XX000|Thread Context]] area when creating threads, which is the actual data the SVC-handler checks for SVC-access-control.
|-
| 0xA0
| u32[4]
| Interrupt flags- 32 interrupts per word, 4 words, 0x80 interrupts total divided evenly across 4 words
|-
| 0xB0
| u32
| Kernel flags from the exheader kernel descriptors.
|-
| 0xB4
| u16
| Handle table size from the exheader kernel descriptors. When this is 0, handle table is stored in WRAM.
|-
| 0xB6
| u16
| Kernel release version field, from the exheader kernel descriptors.
|-
| 0xB8
| KCodeSet*
| Pointer to [[KCodeSet]] instance
|-
| 0xBC
| u32
| Process id, this always begins at 0x0 for the first process.
|-
| 0xC0
| s64
| Process creation time as tick count
|-
| 0xC8
| KThread*
| Pointer to the process's main thread.
|-
| 0xCC
| u32[4]
| Interrupt enabled flags- 32 interrupts per word, 4 words, 0x80 interrupts total divided evenly across 4 words
|-
| 0xDC
| [[KProcess#KProcessHandleTable|KProcessHandleTable]]
| This is the data for tracking and using all of the KProcess's handles.
|-
| 0xF4
| HandleDescriptor[0x28]
| These internal HandleDescriptor entries are only used if the exheader's handle table size is 0
|-
| 0x234
| u32
| Unused (From here up, everything is set to 0 on creation, has 0 written to it again during process creation, and is never used again.)
|-
| 0x238
| u64
| Unused
|-
| 0x240
| u64
| Unused
|-
| 0x248
| u64
| Unused
|-
| 0x250
| u64
| Unused
|-
| 0x258
| u64
| Unused
|-
| 0x260
| u64
| Unused
|-
| 0x268
| u64
| Unused
|}

= KProcessHandleTable =

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| HandleDescriptor*
| Pointer to the process's handle table.
|-
| 0x4
| s16
| The max number of handles that can be open at once - usually 0x200.
|-
| 0x6
| s16
| The highest count of handles that have been open at once
|-
| 0x8
| HandleDescriptor*
| Pointer to the next open HandleDescriptor entry in the handle table.
|-
| 0xC
| s16
| Total handles used by this KProcess.
|-
| 0xE
| s16
| The current number of handles in use.
|-
| 0x10
| KThread*
| Thread currently running code acting on this object.
|-
| 0x14
| s16
| Track errors for the running thread above.
|-
| 0x16
| s16
| Unused, alignment
|-
| 0x18
| HandleDescriptor[0x28]
| This small handle data table, internal to the KProcess, is only used in certain processes that don't have an external handle descriptor table in FCRAM. It is all zeros in most processes.
|}

= HandleDescriptor =
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Handle info
|-
| 0x4
| u32
| Pointer to the kernel object that the handle references.
|}

The handle info u32 works as such:

The high byte is a remainder from the pointer to the next entry that originally occupied the handle table entry. It is unused. Byte 2 is either the class type token starting with firmware version 9.0 or the lowest byte of the char* that points to the class type name in firmware versions below 9.0. The lower halfword is the handle number of the current handle taken from the total handle count for the KProcess that owns the table.

On table creation, each entry in the handle data table is populated with a pointer to the next entry in the table. When a new handle is created, that pointer is moved into offset 0x8 of the KProcessHandleTable info struct to use for generation of the next handle.

The final handle that gets returned when a handle is created is (handle_index | (handle_total << 15)), basically they take the index into the handle data table and OR that with the total handle count << 15. This returned value is the one that gets passed back to the running application and is used to look up the HandleDescriptor entry in the table.

KMutex

2016-08-22T21:10:27Z

Bond697:

[[Category:Kernel objects]]
class [[KMutex]] extends [[KSynchronizationObject]];

Size : 0x2C bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Node count for threads
|-
| 0xC
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x10
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x14
| ?
| ?
|-
| 0x18
| ?
| ?
|-
| 0x1C
| u32
| Threads using this mutex
|-
| 0x20
| [[KThread]] *
| Thread that has the KMutex locked
|-
| 0x24
| u32
| Priority
|-
| 0x28
| [[KProcess]]*
| Owner
|-
|}

KCodeSet

2016-08-22T20:30:04Z

Bond697:

[[Category:Kernel objects]]

class [[KCodeSet]] extends [[KAutoObject]];

Size : 0x64 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| KCodeSetMemDescriptor
| Memory section info for .text
|-
| 0x1C
| KCodeSetMemDescriptor
| Memory section info for .rodata
|-
| 0x30
| KCodeSetMemDescriptor
| Memory section info for .data
|-
| 0x44
| u32
| Total .text pages
|-
| 0x48
| u32
| Total .rodata pages
|-
| 0x4C
| u32
| Total RW pages (.bss + .data)
|-
| 0x50
| u64
| Process name as 8-byte string
|-
| 0x58
| u16
| ?
|-
| 0x5A
| u16
| ?
|-
| 0x5C
| u64
| TitleID
|}

=KCodeSetMemDescriptor=

Sections too large to fit into any available memory blocks will be split across multiple memory blocks with a [[KBlockInfo]] instance for each. This is described by the memory section info struct:
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Start address (virtual)
|-
| 0x4
| u32
| Total pages
|-
| 0x8
| u32
| [[KBlockInfo]] count
|-
| 0xC
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of objects
|-
| 0x10
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of objects
|}

KCodeSet

2016-08-22T20:23:19Z

Bond697:

[[Category:Kernel objects]]

class [[KCodeSet]] extends [[KAutoObject]];

Size : 0x64 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| Struct size is 0x14
| Memory section info for .text
|-
| 0x1C
| Struct size is 0x14
| Memory section info for .rodata
|-
| 0x30
| Struct size is 0x14
| Memory section info for .data
|-
| 0x44
| u32
| Total .text pages
|-
| 0x48
| u32
| Total .rodata pages
|-
| 0x4C
| u32
| Total RW pages (.bss + .data)
|-
| 0x50
| u64
| Process name as 8-byte string
|-
| 0x58
| u16
| ?
|-
| 0x5A
| u16
| ?
|-
| 0x5C
| u64
| TitleID
|}

Sections too large to fit into any available memory blocks will be split across multiple memory blocks with a [[KBlockInfo]] instance for each. This is described by the memory section info struct:
{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Start address (virtual)
|-
| 0x4
| u32
| Total pages
|-
| 0x8
| [[KLinkedList]]
| List of [[KBlockInfo]] objects for this section
|}

KClientPort

2016-08-22T20:21:37Z

Bond697:

[[Category:Kernel objects]]
class [[KClientPort]] extends [[KSynchronizationObject]];

Size : 0x1C bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Node count for threads
|-
| 0xC
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x10
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x14
| s16
| Current connection count to port
|-
| 0x16
| s16
| Max connection count to port
|-
| 0x18
| [[KPort]]*
| Pointer to the parent port object;
|-

KPort

2016-08-22T20:08:52Z

Bond697: Undo revision 17962 by Neobrain (talk)

[[Category:Kernel objects]]
class [[KPort]] extends [[KAutoObject]];

Size : 0x48 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Pointer to [[KServerPort]] vtable
|-
| 0xC
| u32
| [[KServerPort]] Reference count
|-
| 0x10
| u32
| Node count for threads
|-
| 0x14
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x18
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x1C
| u32
| Node count for sessions
|-
| 0x20
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of KServerSessions associated with this port
|-
| 0x24
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of KServerSessions associated with this port
|-
| 0x28
| KPort*
| Pointer to parent KPort
|-
| 0x2C
| u32
| Pointer to [[KClientPort]] vtable
|-
| 0x30
| u32
| [[KClientPort]] Reference count
|-
| 0x34
| u32
| Node count for threads
|-
| 0x38
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x3C
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x40
| s16
| Current connection count to port
|-
| 0x42
| s16
| Max connection count to port
|-
| 0x44
| KPort*
| Pointer to the parent port object;
|}

KClientSession

2016-08-22T20:08:20Z

Bond697: Undo revision 17963 by Neobrain (talk)

[[Category:Kernel objects]]
class [[KClientSession]] extends [[KSynchronizationObject]];

Size : 0x20 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| KLinkedListNode count for object
|-
| 0xC
| KLinkedListNode*
| Pointer to first KLinkedListNode in list of KThreads using this client session
|-
| 0x10
| KLinkedListNode*
| Pointer to last KLinkedListNode in list of KThreads using this client session
|-
| 0x14
| KSession*
| Pointer to parent session
|-
| 0x18
| u32
| Session status
|-
| 0x1C
| KClientPort*
| Pointer to associated client port inside parent KPort
|}

Session status:

1: open 
2: closed by client 
3: closed by server?

KPort

2016-08-22T19:53:46Z

Bond697: Undo revision 17939 by Neobrain (talk)

KClientSession

2016-08-22T19:53:21Z

Bond697: Undo revision 17940 by Neobrain (talk)

SVC

2016-08-10T19:10:53Z

Bond697:

= System calls =
'''Note: The argument-lists here apply to the official syscall wrapper-functions that are found in userland processes. The actual ordering passed to the kernel via the SVC instruction is documented in [[Kernel_ABI|Kernel ABI]].'''

{| class="wikitable" border="1"
|-
! Id
! NF ARM11
! NF ARM9
! TF ARM11
! Description
! scope="col" width="200" | Notes
|-
| 0x01
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Memory Management|ControlMemory]](u32* outaddr, u32 addr0, u32 addr1, u32 size, [[Memory Management#enum_MemoryOperation|MemoryOperation]] operation, [[Memory Management#enum_MemoryPermission|MemoryPermission]] permissions)
| Outaddr is usually the same as the input addr0.
|-
| 0x02
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Memory Management|QueryMemory]]([[Memory Management#struct MemoryInfo|MemoryInfo]]* info, [[Memory Management#struct PageInfo|PageInfo]]* out, u32 Addr)
|
|-
| 0x03
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| void ExitProcess(void)
|
|-
| 0x04
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
|
|-
| 0x05
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
|
|-
| 0x06
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
|
|-
| 0x07
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result SetProcessIdealProcessor(Handle process, s32 idealprocessor)
|
|-
| 0x08
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#CreateThread|CreateThread]](Handle* thread, func entrypoint, u32 arg, u32 stacktop, s32 threadpriority, s32 processorid)
|
|-
| 0x09
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| void [[Multi-threading#ExitThread|ExitThread]](void)
|
|-
| 0x0A
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| void [[Multi-threading#SleepThread|SleepThread]](s64 nanoseconds)
|
|-
| 0x0B
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#GetThreadPriority|GetThreadPriority]](s32* priority, Handle thread)
|
|-
| 0x0C
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#SetThreadPriority|SetThreadPriority]](Handle thread, s32 priority)
|
|-
| 0x0D
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Multi-threading#GetThreadAffinityMask|GetThreadAffinityMask]](u8* affinitymask, Handle thread, s32 processorcount)
|
|-
| 0x0E
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Multi-threading#SetThreadAffinityMask|SetThreadAffinityMask]](Handle thread, u8* affinitymask, s32 processorcount)
| Replaced with a stub in ARM11 NATIVE_FIRM kernel beginning with [[8.0.0-18]].
|-
| 0x0F
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Multi-threading#GetThreadIdealProcessor|GetThreadIdealProcessor]](s32* processorid, Handle thread)
|
|-
| 0x10
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Multi-threading#SetThreadIdealProcessor|SetThreadIdealProcessor]](Handle thread, s32 processorid)
| Replaced with a stub in ARM11 NATIVE_FIRM kernel beginning with [[8.0.0-18]].
|-
| 0x11
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| s32 GetCurrentProcessorNumber(void)
|
|-
| 0x12
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Multi-threading#Run|Run]](Handle process, StartupInfo* info)
| This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.
|-
| 0x13
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#CreateMutex|CreateMutex]](Handle* mutex, bool initialLocked)
|
|-
| 0x14
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#ReleaseMutex|ReleaseMutex]](Handle mutex)
|
|-
| 0x15
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#CreateSemaphore|CreateSemaphore]](Handle* semaphore, s32 initialCount, s32 maxCount)
|
|-
| 0x16
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#ReleaseSemaphore|ReleaseSemaphore]](s32* count, Handle semaphore, s32 releaseCount)
|
|-
| 0x17
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#CreateEvent|CreateEvent]](Handle* event, ResetType resettype)
|
|-
| 0x18
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#SignalEvent|SignalEvent]](Handle event)
|
|-
| 0x19
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#ClearEvent|ClearEvent]](Handle event)
|
|-
| 0x1A
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result CreateTimer(Handle* timer, ResetType resettype)
|
|-
| 0x1B
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result SetTimer(Handle timer, s64 initial_nanoseconds, s64 interval)
|
|-
| 0x1C
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result CancelTimer(Handle timer)
|
|-
| 0x1D
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result ClearTimer(Handle timer)
|
|-
| 0x1E
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Memory Management|CreateMemoryBlock]](Handle* memblock, u32 addr, u32 size, [[Memory Management#enum_MemoryPermission|MemoryPermission]] mypermission, [[Memory Management#enum_MemoryPermission|MemoryPermission]] otherpermission)
|
|-
| 0x1F
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Memory Management|MapMemoryBlock]](Handle memblock, u32 addr, [[Memory Management#enum_MemoryPermission|MemoryPermission]] mypermissions, [[Memory Management#enum_MemoryPermission|MemoryPermission]] otherpermission)
|
|-
| 0x20
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Memory Management|UnmapMemoryBlock]](Handle memblock, u32 addr)
|
|-
| 0x21
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#Address_Arbiters|CreateAddressArbiter]](Handle* arbiter)
|
|-
| 0x22
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#Address_Arbiters|ArbitrateAddress]](Handle arbiter, u32 addr, ArbitrationType type, s32 value, s64 nanoseconds)
|
|-
| 0x23
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result CloseHandle(Handle handle)
|
|-
| 0x24
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result WaitSynchronization1(Handle handle, s64 timeout_nanoseconds)
|
|-
| 0x25
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result WaitSynchronizationN(s32* out, Handle* handles, s32 handlecount, bool waitAll, s64 timeout_nanoseconds)
|
|-
| 0x26
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result SignalAndWait(s32* out, Handle signal, Handle* handles, s32 handleCount, bool waitAll, s64 nanoseconds)
| Stubbed
|-
| 0x27
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result DuplicateHandle(Handle* out, Handle original)
|
|-
| 0x28
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| s64 GetSystemTick(void) (This returns the total CPU ticks elapsed since the CPU was powered-on)
|
|-
| 0x29
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result GetHandleInfo(s64* out, Handle handle, HandleInfoType type)
|
|-
| 0x2A
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result GetSystemInfo(s64* out, SystemInfoType type, s32 param)
|
|-
| 0x2B
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result GetProcessInfo(s64* out, Handle process, ProcessInfoType type)
|
|-
| 0x2C
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#GetThreadInfo|GetThreadInfo]](s64* out, Handle thread, ThreadInfoType type)
|
|-
| 0x2D
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result ConnectToPort(Handle* out, const char* portName)
|
|-
| 0x2E
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result SendSyncRequest1(Handle session)
| Stubbed
|
|-
| 0x2F
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result SendSyncRequest2(Handle session)
| Stubbed
|
|-
| 0x30
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result SendSyncRequest3(Handle session)
| Stubbed
|
|-
| 0x31
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result SendSyncRequest4(Handle session)
| Stubbed
|
|-
| 0x32
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result SendSyncRequest(Handle session)
|
|-
| 0x33
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result OpenProcess(Handle* process, u32 processId)
|
|-
| 0x34
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Multi-threading#OpenThread|OpenThread]](Handle* thread, Handle process, u32 threadId)
|
|-
| 0x35
| style="background: green" | Yes
| style="background: red" | No
| style="background: green" | Yes
| Result GetProcessId(u32* processId, Handle process)
|
|-
| 0x36
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Multi-threading#GetProcessIdOfThread|GetProcessIdOfThread]](u32* processId, Handle thread)
|
|-
| 0x37
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Multi-threading#GetThreadId|GetThreadId]](u32* threadId, Handle thread)
|
|-
| 0x38
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result GetResourceLimit(Handle* resourceLimit, Handle process)
|
|-
| 0x39
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result GetResourceLimitLimitValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
|
|-
| 0x3A
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result GetResourceLimitCurrentValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
|
|-
| 0x3B
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Multi-threading#GetThreadContext|GetThreadContext]](ThreadContext* context, Handle thread)
| Stubbed
|-
| 0x3C
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Break(BreakReason)
|
|-
| 0x3D
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| OutputDebugString(void const, int)
| Does nothing on non-debug units.
|-
| 0x3E
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|
|- style="border-top: double"
| 0x47
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result CreatePort(Handle* portServer, Handle* portClient, const char* name, s32 maxSessions)
| Setting name=NULL creates a private port not accessible from svcConnectToPort.
|-
| 0x48
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result CreateSessionToPort(Handle* session, Handle port)
|
|-
| 0x49
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result CreateSession(Handle* sessionServer, Handle* sessionClient)
|
|-
| 0x4A
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result AcceptSession(Handle* session, Handle port)
|
|-
| 0x4B
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result ReplyAndReceive1(s32* index, Handle* handles, s32 handleCount, Handle replyTarget)
| Stubbed.
|-
| 0x4C
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result ReplyAndReceive2(s32* index, Handle* handles, s32 handleCount, Handle replyTarget)
| Stubbed.
|-
| 0x4D
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result ReplyAndReceive3(s32* index, Handle* handles, s32 handleCount, Handle replyTarget)
| Stubbed.
|-
| 0x4E
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result ReplyAndReceive4(s32* index, Handle* handles, s32 handleCount, Handle replyTarget)
| Stubbed.
|-
| 0x4F
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result ReplyAndReceive(s32* index, Handle* handles, s32 handleCount, Handle replyTarget)
|
|-
| 0x50
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[#Interrupt Handling|BindInterrupt]](Interrupt name, Handle syncObject, s32 priority, bool isManualClear)
|
|-
| 0x51
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result UnbindInterrupt(Interrupt name, Handle syncObject)
|
|-
| 0x52
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result InvalidateProcessDataCache(Handle process, void* addr, u32 size)
|
|-
| 0x53
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result StoreProcessDataCache(Handle process, void const* addr, u32 size)
|
|-
| 0x54
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result FlushProcessDataCache(Handle process, void const* addr, u32 size)
|
|-
| 0x55
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result [[Corelink DMA Engines|StartInterProcessDma]](Handle* dma, Handle dstProcess, void* dst, Handle srcProcess, const void* src, u32 size, const DmaConfig* config)
|
|-
| 0x56
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result StopDma(Handle dma)
|
|-
| 0x57
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| Result GetDmaState(DmaState* state, Handle dma)
|
|-
| 0x58
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|
|- style="border-top: double"
| 0x60
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result DebugActiveProcess(Handle* debug, u32 processID)
|
|-
| 0x61
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result BreakDebugProcess(Handle debug)
|
|-
| 0x62
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result TerminateDebugProcess(Handle debug)
|
|-
| 0x63
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result GetProcessDebugEvent(DebugEventInfo* info, Handle debug)
|
|-
| 0x64
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result ContinueDebugEvent(Handle debug, u32 flags)
|
|-
| 0x65
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result GetProcessList(s32* processCount, u32* processIds, s32 processIdMaxCount)
|
|-
| 0x66
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result GetThreadList(s32* threadCount, u32* threadIds, s32 threadIdMaxCount, Handle domain)
|
|-
| 0x67
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result GetDebugThreadContext(ThreadContext* context, Handle debug, u32 threadId, u32 controlFlags)
|
|-
| 0x68
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result SetDebugThreadContext(Handle debug, u32 threadId, ThreadContext* context, u32 controlFlags)
|
|-
| 0x69
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result QueryDebugProcessMemory(MemoryInfo* blockInfo, PageInfo* pageInfo, Handle process, u32 addr)
|
|-
| 0x6A
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result ReadProcessMemory(void* buffer, Handle debug, u32 addr, u32 size)
|
|-
| 0x6B
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result WriteProcessMemory(Handle debug, void const* buffer, u32 addr, u32 size)
|
|-
| 0x6C
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result SetHardwareBreakPoint(s32 registerId, u32 control, u32 value)
|
|-
| 0x6D
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| [[Multi-threading#GetDebugThreadParam|GetDebugThreadParam]](s64* unused, u32* out, Handle kdebug, u32 threadId, DebugThreadParam param)
| Disabled on regular kernel.
|- style="border-top: double"
| 0x70
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|
|-
| 0x71
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Memory Management#Memory_Mapping|MapProcessMemory]](Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|
|-
| 0x72
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Memory Management#Memory_Mapping|UnmapProcessMemory]](Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|
|-
| 0x73
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Multi-threading#CreateCodeSet|CreateCodeSet]](Handle* handle_out, struct CodeSetInfo, u32 code_ptr, u32 ro_ptr, u32 data_ptr)
|
|-
| 0x74
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result RandomStub()
| Stubbed
|-
| 0x75
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result [[Multi-threading#CreateProcess|CreateProcess]](Handle* handle_out, Handle codeset_handle, u32 [[NCCH/Extended_Header#ARM11_Kernel_Capabilities|arm11kernelcaps_ptr]], u32 arm11kernelcaps_num)
|
|-
| 0x76
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| TerminateProcess(Handle)
|
|-
| 0x77
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result SetProcessResourceLimits(Handle KProcess, Handle KResourceLimit)
|
|-
| 0x78
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result CreateResourceLimit(Handle *KResourceLimit)
|
|-
| 0x79
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result SetResourceLimitValues(Handle res_limit, LimitableResource* resource_type_list, s64* resource_list, u32 count)
|
|-
| 0x7A
| style="background: green" | Yes
| style="background: red" | No
| style="background: green" | Yes
| AddCodeSegment (unsigned int Addr, unsigned int Size)
| Stubbed on NATIVE_FIRM beginning with [[2.0.0-2]]. Used during TWL_FIRM boot.
|-
| 0x7B
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: red" | No
| Backdoor(unsigned int CodeAddress)
| This is used on ARM9 NATIVE_FIRM.
No ARM11 processes have access to it without some form of kernelhax, and this was removed on [[11.0.0-33]] (for ARM11).

|-
| 0x7C
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2)
| The type determines the meaning of each param
|-
| 0x7D
| style="background: green" | Yes
| style="background: red" | No
| style="background: red" | No
| Result QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|
|- style="border-top: double"
| 0xFF
| style="background: green" | Yes
| style="background: green" | Yes
| style="background: green" | Yes
| ???
| Debug related? The svcaccesscontrol mask doesn't apply for this SVC. Stubbed on ARM9 NATIVE_FIRM.
|}
NF: NATIVE_FIRM. TF: TWL_FIRM.

Note that "stubbed" here means that the SVC only returns an error, as in the following snippet:

<pre>ROM:FFF04D98 LDR R0, =0xF8C007F4
ROM:FFF04D9C BX LR</pre>

= Types and structures =

== enum ResetType ==

{| class="wikitable" border="1"
! Reset type
! Id
|-
| ONESHOT
| 0
|-
| STICKY
| 1
|-
| PULSE
| 2
|}

Timers/Events may be waited on by a thread using svcWaitSynchronization. Once the timer runs out/the event gets signaled, threads waiting on the respective handles until the timer/event is reset. STICKY timers/events wake up threads until they are explicitly reset by some thread. ONESHOT timers/events will wake up exactly one thread and then are reset automatically. PULSE timers will be reset after waking up one thread too, but will also be started again immediately. It's unknown whether PULSE is a valid reset type for events.

== struct StartupInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| s32
| Priority
|-
| u32
| Stack size
|-
| s32
| argc
|-
| s16*
| argv
|-
| s16*
| envp
|}

== enum BreakReason ==
{| class="wikitable" border="1"
! Break Reason
! Value
|-
| PANIC
| 0
|-
| ASSERT
| 1
|-
| USER
| 2
|}

== struct DebugEventInfo ==

{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Event type
|-
| u32
| Thread ID (not used in all events)
|-
| u32[2]
| Unknown/padding
|-
| u32[6]
| Event-specific data (see below)
|}

{| class="wikitable" border="1"
! Event type
! Id
|-
| PROCESS
| 0
|-
| CREATE THREAD
| 1
|-
| EXIT THREAD
| 2
|-
| EXIT PROCESS
| 3
|-
| EXCEPTION
| 4
|-
| DLL LOAD
| 5
|-
| DLL UNLOAD
| 6
|-
| SCHEDULE IN
| 7
|-
| SCHEDULE OUT
| 8
|-
| SYSCALL IN
| 9
|-
| SYSCALL OUT
| 10
|-
| OUTPUT STRING
| 11
|-
| MAP
| 12
|}

=== PROCESS event ===

{| class="wikitable" border="1"
! Type
! Field
|-
| u64
| Program ID
|-
| char[8]
| Process name
|-
| u32
| Process ID
|-
| u32
| 0 = newly created process, 1 = attached process
|}

=== CREATE THREAD event ===

{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Creator thread ID
|-
| u32
| Base address (?)
|-
| u32
| Entrypoint
|}

=== EXIT THREAD/PROCESS events ===

A single u32 reason field is used.

Thread exit reasons:
{| class="wikitable" border="1"
! Reason
! Id
|-
| (None)
| 0
|-
| TERMINATE
| 1
|-
| EXIT PROCESS
| 2
|-
| TERMINATE PROCESS
| 3
|}

Process exit reasons:
{| class="wikitable" border="1"
! Reason
! Id
|-
| (None)
| 0
|-
| TERMINATE
| 1
|-
| UNHANDLED EXCEPTION
| 2
|}

=== EXCEPTION event ===

{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Exception type
|-
| u32
| Exception address
|-
| u32
| Argument (type-specific)
|}

Exception types:
{| class="wikitable" border="1"
! Reason
! Id
! Argument
|-
| UNDEFINED INSTRUCTION
| 0
| (None)
|-
| (Unknown)
| 1
| (None)
|-
| (Unknown, mem-related)
| 2
| Address
|-
| (Unknown, mem-related)
| 3
| Address
|-
| ATTACH BREAK
| 4
| (None)
|-
| BREAKPOINT
| 5
| (None)
|-
| USER BREAK
| 6
| User break type
|-
| DEBUGGER BREAK
| 7
| (None)
|-
| UNDEFINED SYSCALL
| 8
| Attempted syscall ID
|}

User break types:
{| class="wikitable" border="1"
! Reason
! Id
|-
| PANIC
| 0
|-
| ASSERT
| 1
|-
| USER
| 2
|}

=== SCHEDULER/SYSCALL IN/OUT events ===

{| class="wikitable" border="1"
! Type
! Field
|-
| u64
| Clock tick
|-
| u32
| Syscall (only for SYSCALL events)
|}

=== OUTPUT STRING event ===

{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| String address
|-
| u32
| String size
|}

=== MAP event ===

{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Mapped address
|-
| u32
| Mapped size
|-
| u32
| MemoryPermission
|-
| u32
| MemoryState
|}

== enum DebugThreadParam ==

{| class="wikitable" border="1"
! Parameter
! Id
|-
| PRIORITY
| 0
|-
| SCHEDULE
| 1
|-
| CPU_IDEAL
| 2
|-
| CPU_CREATOR
| 3
|}

== typedef Handle ==

User-visible references to internal objects are represented by 32-bit integers called handles. Handles are only valid in the process they have been created in; hence, they cannot be exchanged between processes directly (the [[IPC]] functions provide a mean to copy handles to other processes, though).

There are a number of special-purpose handles, which provide easy access to information on objects in the current process:
{| class="wikitable" border="1"
! Handle
! Description
|-
| 0xFFFF8000
| Handle to the active thread
|-
| 0xFFFF8001
| Handle to the active process
|}

=svcSetHardwareBreakPoint=
This is essentially an interface for writing values to the debug-unit (B/W)RP registers. registerId range 0..5 = breakpoints(BRP0-5), 0x100..0x101 = watchpoints(WRP0-1), anything outside of these ranges will result in an error. This is used for both adding and removing/disabling breakpoints/watchpoints, hence the raw control value parameter.

Here the kernel sets bit15 in the DSCR, to enable monitor-mode debugging.

Regardless of whether this is for a BRP, when bit21 is set in the control input parameter(BRP type = contextID), the kernel will load the target process [[KProcess|contextID]] and use that internally for the value field. The target process is specified via a [[KDebug]] handle passed as the "value" parameter.

Lastly, the kernel disables the specified (B/W)RP, then writes the value parameter / loaded contextID to the (B/W)VR, then writes the input control value to the (B/W)CR.

= [[DMA]] =
The CTRSDK code for using svcStartInterProcessDma will execute svcBreak when svcStartInterProcessDma returns an error(except for certain error value(s)). Therefore on retail, triggering a svcStartInterProcessDma via a system-module which results in an error from svcStartInterProcessDma will result in the system-module terminating.

= Interrupt Handling =

BindInterrupt adds the given event handle to an internal list for the given interrupt ID. Whenever the given interrupt is triggered, the kernel's interrupt handler will signal all events in the list corresponding to that interrupt.

Applications hence can wait for specific interrupts to happen by calling WaitSynchronization(N) on the event handles.

It is unknown whether BindInterrupt may be used with non-event handles.

The set of existing ARM11 interrupts is listed on [[ARM11 Interrupts|this page]].

= Debugging =
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

This SVC can only be used when a certain kernel state debug flag is non-zero(it's set to zero for retail).

= KernelSetState =
{| class="wikitable" border="1"
|-
! Type
! Enabled for the NATIVE_FIRM ARM11 kernel
! Enabled for the TWL_FIRM ARM11 kernel
! Description
|-
| 0
| Yes
| No
| This initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 is unused. Param1 is the programID-low, and the programID-high is 0x00040138. Param2 is used only with the [[New_3DS]] kernel, pm-module uses value 0 with this. With New3DS kernel, it forces the programIDlow to be the New3DS NATIVE_FIRM, when the input programIDlow is for the Old3DS NATIVE_FIRM and Param2==0.
On New3DS, the kernel disables the additional New3DS cache hw prior to calling the firmlaunch function from the <handler for the KernelSetState-types called via funcptr>.
|-
| 1
| Yes
| Yes
| Unknown, does nothing with the TWL_FIRM ARM11 kernel.
|-
| 2
| Yes
| Yes
| Unknown.
On New3DS, the kernel disables the additional New3DS cache hw, when it's actually enabled, prior to executing the rest of the code from the <handler for the KernelSetState-types called via funcptr>.
|-
| 3
| Yes
| No
| This used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.
|-
| 4
| No
| Yes
| Param0-Param3 are unused. This unmaps(?) the following virtual memory by writing value physaddr(where physaddr base is 0x80000000) to the L1 MMU table entries: 0x00300000..0x04300000, 0x08000000..0x0FE00000, and 0x10000000..0xF8000000.
|-
| 5
| Yes
| Yes
| ?
|-
| 6
| Yes
| No
| Debug related?
|-
| 7
| Yes
| No
| This triggers an MCU (hard) reboot. Param0-3 are unused. This reboot is triggered via device address 0x4A on the second [[I2C]] bus (the MCU). Register address 0x20 is written to with value 4. This code will not return.
On New3DS, the kernel disables the additional New3DS cache hw prior to calling the reboot function from the <handler for the KernelSetState-types called via funcptr>.
|-
| 8
| Yes
| No
| Alternate FIRM launch code-path, with different [[PXI]] FIFO word constants. Usually not used. PTM-sysmodule can use this but it's unknown what exactly triggers that in PTM-sysmodule.
|-
| 9
| Yes, implemented at some point after system-version v4.5.
| ?
| Unknown
|-
| 10
| Yes
| ?
| ConfigureNew3DSCPU. Only available for the [[New_3DS]] kernel. The actual code for processing this runs under the <handler for the KernelSetState-types called via funcptr>, which runs on all ARM11 cores. Param0 = input value. Only bit0-1 are used here. Bit 0 enables higher core clock, and bit 1 enables additional (L2) cache. This configures the hardware [[PDN_Registers|register]] for the flags listed [[NCCH/Extended_Header#Flag1|here]], among other code which uses the MPCore private memory region registers.
|}

= GetSystemInfo =
{| class="wikitable" border="1"
! SystemInfoType value
! s32 param
! Description
|-
| 0
| 0
| This writes the total used memory size in the following memory regions to out: APPLICATION, SYSTEM, and BASE.
|-
| 0
| 1
| This writes the total used memory size in the APPLICATION memory region to out.
|-
| 0
| 2
| This writes the total used memory size in the SYSTEM memory region to out.
|-
| 0
| 3
| This writes the total used memory size in the BASE memory region to out.
|-
| 2
| Unused
| This writes the FCRAM memory [[Memory_Allocation#FCRAM_Region_Data|used by the kernel]] to out.
|-
| 25
| Unused
| This writes the total number of threads which were directly launched by the kernel, to out. No longer exists with some kernel version?
|-
| 26
| Unused
| This writes the total number of processes which were directly launched by the kernel, to out. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.
|}

= GetProcessInfo =
Input:
R0 = unused
R1 = Handle process
R2 = ProcessInfoType type

Output:
R0 = Result
R1 = output value lower word
R2 = output value upper word

{| class="wikitable" border="1"
! ProcessInfoType value
! Available since system version
! Description
|-
| 9-19
| [[8.0.0-18]]
| This only returns error 0xD8E007ED.
|-
| 20
| [[8.0.0-18]]
| low u32 = (0x20000000 - <LINEAR virtual-memory base for this process>). That is, the output value is the value which can be added to LINEAR memory vaddrs for converting to physical-memory addrs.
|-
| 21-23
| [[8.0.0-18]]
| This only returns error 0xE0E01BF4.
|}

= GetHandleInfo =

{| class="wikitable" border="1"
! HandleInfoType value
! Description
|-
| 0
| This returns the time in ticks the KProcess referenced by the handle was created. If a KProcess handle was not given, it will write whatever was in r5, r6 when the svc was called.
|-
| 1
| Get internal refcount-1 for kernel object (u32), and also a boolean if the refcount-1 is negative (u32).
|-
| 0x32107
| Returns (u64) 0.
|}

= svc7B Backdoor =
This saves SVC-mode SP+LR on the user-mode stack, then sets the SVC-mode SP to the user-mode SP. This then calls the specified code in SVC-mode. Once the called code returns, this pops the saved SP+LR off the stack for restoring the SVC-mode SP, then returns from the svc7b handler. Note that this svc7b handler does not disable IRQs, if any IRQs/context-switches occur while the SVC-mode SP is set to the user-mode one here, the ARM11-kernel will crash(which hangs the whole ARM11-side system).

= Kernel error-codes =
See [[Error codes]].

{| class="wikitable" border="1"
! Error-code value
! Description
|-
| 0x09401BFE
| Timeout occurred with svcWaitSynchronization*, when timeout is not ~0.
|-
| 0xC8601801
| No more unused/free synchronization objects left to use in a given object's linked list. (KEvent, KMutex, KTimer, KSemaphore, KAddressArbiter, KThread)
|-
| 0xC8601802
| No more unused/free KSharedMemory objects left to use in the KSharedMemory linked list - out of blocks
|-
| 0xC8601809
| No more unused/free KSessions left to use in the KSession linked list - out of sessions
|-
| 0xC860180A
| Not enough free memory available for memory allocation.
|-
| 0xC920181A
| The session was closed by the other process..
|-
| 0xD0401834
| Max connections to port have been exceeded
|-
| 0xD8609013
| Unknown, probably reslimit related?
|-
| 0xD88007FA
| Returned if no KObjectName object in the linked list of such objects matches the port name provided to the svc.
|-
| 0xD8E007ED
| This indicates that a value is outside of the enum being used.
|-
| 0xD8E007F1
| This error indicates Misaligned address.
|-
| 0xD8E007F7
| This error indicates that the input handle used with the SVC does not exist in the process handle-table, or that the handle kernel object type does not match the type used by the SVC.
|-
| 0xD9000402
| Invalid memory permissions for input/output buffers, for svcStartInterProcessDma.
|-
| 0xD9001814
| Failed unprivileged load or store - wrong permissions on memory
|-
| 0xD9001BF7
| This error is returned when the kernel retrieves a pointer to a kernel object, but the object type doesn't match the desired one.
|-
| 0xD92007EA
| This error is returned when a process attempts to use svcCreateMemoryBlock when the process memorytype is the application memorytype, and when addr=0.
|-
| 0xE0E01BF5
| This indicates an invalid address was used.
|-
| 0xF8C007F4
| Invalid type/param0-param3 input for svcKernelSetState. This is also returned for those syscalls marked as stubs.
|}

KPort

2016-08-09T14:13:05Z

Bond697:

KPort

2016-08-09T14:12:31Z

Bond697: Undo revision 15689 by Neobrain (talk)

[[Category:Kernel objects]]
class [[KPort]] extends [[KAutoObject]];

Size : 0x48 bytes

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0x0
| u32
| Pointer to vtable
|-
| 0x4
| u32
| Reference count
|-
| 0x8
| u32
| Pointer to [[KServerPort]] vtable
|-
| 0xC
| u32
| [[KServerPort]] Reference count
|-
| 0x10
| u32
| Node count for threads
|-
| 0x14
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x18
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x1C
| u32
| Node count for sessions
|-
| 0x20
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of KServerSessions associated with this port
|-
| 0x24
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of KServerSessions associated with this port
|-
| 0x28
| [[KPort]]*
| Pointer to parent KPort
|-
| 0x2C
| u32
| Pointer to [[KClientPort]] vtable
|-
| 0x30
| u32
| [[KClientPort]] Reference count
|-
| 0x34
| u32
| Node count for threads
|-
| 0x38
| [[KLinkedListNode]]*
| Pointer to first KLinkedListNode in the list of threads that sync with this object
|-
| 0x3C
| [[KLinkedListNode]]*
| Pointer to last KLinkedListNode in the list of threads that sync with this object
|-
| 0x40
| s16
| Current connection count to port
|-
| 0x42
| s16
| Max connection count to port
|-
| 0x44
| [[KPort]]*
| Pointer to the parent port object;
|}