Memory map

The Wii U has a variety of physical memory sources. There is the 2 GiB of DDR3 split into 4 chips (MEM2), 32 MiB of fast 1T SRAM (MEM1), and the old GX framebuffer (MEM0).

Address	Size	Type	Description
0x00000000	0x2000000	MEM1	MEM1-A: 0x00000000 to 0x00000FFF (0x1000) MEM1-B: 0x00001000 to 0x01FFFFFF (0x1FFF000) MEM1 foreground: 0x00000000 to 0x01FFFFFF (0x2000000) Used by Cafe OS apps
0x08000000	0x120000	MEM0	MEM0-A: 0x08000000 to 0x080FFFFF (0x100000) MEM0-B: 0x08100000 to 0x0811FFFF (0x20000) MEM0 foreground: 0x080C0000 to 0x0811FFFF (0x60000) Cafe OS kernel ancast image
0x08120000	0xA0000	MEM0	IOS-KERNEL
0x081C0000	0xC0000	MEM0	IOS-MCP
0x08280000	0x30000	MEM0	IOS-CRYPTO
0x082C0000	0x20000	MEM0	Reserved
0x0C000000	0x6000	MMIO	PI
0x0C006000	0x400	MMIO	IO_DI
0x0C006400	0x400	MMIO	IO_SI
0x0C006800	0x400	MMIO	IO_EXI
0x0C0C0000	0x120000	MMIO	MEM
0x0C1E0000	0x20000	MMIO	VI
0x0C200000	0x80000	MMIO	GFXSP
0x0C280000	0x20000	MMIO	DSP
0x0C2A0000	0x20000	MMIO	WG0
0x0C2C0000	0x20000	MMIO	WG1
0x0C2E0000	0x20000	MMIO	WG2
0x0C300000	0x20000	MMIO
0x0C320000	0x20000	MMIO
0x0C340000	0xC00	MMIO
0x0C340C00	0x400	MMIO	IO_AI
0x0D000000	0x6000	MMIO	ACR_REGS
0x0D006000	0x400	MMIO	AIP_DI
0x0D006400	0x400	MMIO	AIP_SI
0x0D006800	0x400	MMIO	AIP_EXI
0x0D006C00	0x200	MMIO	AIP_AI_I2S3
0x0D006E00	0x200	MMIO	AIP_AI_I2S5
0x0D010000	0x10000	MMIO	FLA
0x0D020000	0x10000	MMIO	AES
0x0D030000	0x10000	MMIO	SHA
0x0D040000	0x10000	MMIO	EH0
0x0D050000	0x10000	MMIO	OH00
0x0D060000	0x10000	MMIO	OH01
0x0D070000	0x10000	MMIO	SD0
0x0D080000	0x10000	MMIO	SD1 (802.11 Wireless)
0x0D090000	0x10000	MMIO	BMD
0x0D0A0000	0x10000	MMIO	SRN
0x0D0B0000	0x4000	MMIO	AHM
0x0D0B4000	0xC000	MMIO	MEM_REGS
0x0D0C0000	0x10000	MMIO	BMC
0x0D100000	0x10000	MMIO	SD2 (eMMC)
0x0D110000	0x10000	MMIO	SD3 (Toucan)
0x0D120000	0x10000	MMIO	EH1
0x0D130000	0x10000	MMIO	OH10
0x0D140000	0x10000	MMIO	EH2
0x0D150000	0x10000	MMIO	OH20
0x0D160000	0x10000	MMIO	SATA
0x0D180000	0x10000	MMIO	AESS
0x0D190000	0x10000	MMIO	SHAS
0x0D1A0000	0x10000	MMIO	BMD2
0x0D1B0000	0x10000	MMIO	BMC2
0x0D400000	0x10000	SRAM1	boot1
0x0D410000	0x10000	SRAM0	boot0
0x0D800000	0x400000	MMIO	Mirror of 0x0D000000 (AHB_TRUSTED)
0x10000000	0x100000	MEM2	PRSH/PRST
0x10100000	0x3D0000	MEM2	IOS-USB
0x10800000	0x16E0000	MEM2	IOS-FS
0x11F00000	0x260000	MEM2	IOS-PAD
0x12300000	0x590000	MEM2	IOS-NET
0x12900000	0x270000	MEM2	IOS-ACP
0x12BC0000	0x2F0000	MEM2	IOS-NSEC
0x12EC0000	0x6D0000	MEM2	IOS-NIM-BOSS
0x13640000	0x300000	MEM2	IOS-FPD
0x13A40000	0x160000	MEM2	IOS-TEST
0x13C00000	0x70000	MEM2	IOS-AUXIL
0x13CC0000	0xC0000	MEM2	IOS-BSP
0x13D80000	0x40000	MEM2	IOS-MCP (development and recovery mode)
0x14000000	0x9000000	MEM2	MEM2-A: 0x14000000 to 0x1CFFFFFF (0x9000000) - Loader data: 0x1B900000 to 0x1B97FFFF (0x80000) PPC region The loader's data is allocated here
0x1D000000	0x2B00000	MEM2	IOS global heap
0x1FB00000	0x300000	MEM2	IOS global IOB (input/output block)
0x1FE00000	0x40000	MEM2	IOS-MCP shared region
0x1FE40000	0x1C0000	MEM2	IOS-MCP setup region (launch, ramdisk and file system cache)
0x20000000	0x8000000	MEM2	RAMDISK
0x28000000	0xA8000000	MEM2	MEM2-B: 0x28000000 to 0xCFFFFFFF (0xA8000000). The 0x10000000 vmem is mapped to the following areas depending on the RAMPID: - Home Menu (RAMPID 5): 0x28000000 to 0x2FFFFFFF (0x8000000) - root.rpx (RAMPID 1): 0x30000000 to 0x31FFFFFF (0x2000000) - Cafe OS loader and libraries: 0x32000000 to 0x327FFFFF (0x800000) - Error display (RAMPID 6): 0x33000000 to 0x33FFFFFF (0x1000000) - Background app memory (RAMPID 4): 0x34000000 to 0x4FFFFFFF (0x1C000000) - Foreground app memory (RAMPID 7): 0x50000000 to 0x8FFFFFFF (0x40000000) - Extra app memory for devkits: 0x90000000 to 0xCFFFFFFF (0x40000000) PPC region Cafe OS loader, libraries and apps
0xFFC00000	0x280000	UNK	Used by Cafe OS (codegen and PPC kernel ancast image mirror)
0xFFF00000	0x8000	SRAM1	C2W (cafe2wii) boot heap (used to store the old Wii SEEPROM data)
0xFFFE0000	0x8000	SRAM1	Mirror of SRAM1. Hai C2W uses this one for (some) Hai params instead of the former? IOS80 also uses this one for SEEPROM data despite the data being written to the former.
0xFFFF0000	0x10000	SRAM0	IOS-KERNEL SRAM / C2W (cafe2wii)