diff --git a/artiq/gateware/amp/kernel_cpu.py b/artiq/gateware/amp/kernel_cpu.py
index b8aa29803..2736027e3 100644
--- a/artiq/gateware/amp/kernel_cpu.py
+++ b/artiq/gateware/amp/kernel_cpu.py
@@ -7,7 +7,7 @@ from misoc.integration.soc_core import mem_decoder
 
 class KernelCPU(Module):
     def __init__(self, platform,
-                 exec_address=0x42000000,
+                 exec_address=0x40400000,
                  main_mem_origin=0x40000000,
                  l2_size=8192):
         self._reset = CSRStorage(reset=1)
diff --git a/artiq/runtime.rs/src/kernel.rs b/artiq/runtime.rs/src/kernel.rs
index bffc2c12e..8f796ebe5 100644
--- a/artiq/runtime.rs/src/kernel.rs
+++ b/artiq/runtime.rs/src/kernel.rs
@@ -2,7 +2,7 @@ use core::ptr;
 use board::csr;
 use mailbox;
 
-const KERNELCPU_EXEC_ADDRESS:    usize = 0x42000000;
+const KERNELCPU_EXEC_ADDRESS:    usize = 0x40400000;
 const KERNELCPU_LAST_ADDRESS:    usize = (0x4fffffff - 1024*1024);
 const KSUPPORT_HEADER_SIZE:      usize = 0x80;
 
diff --git a/artiq/runtime/ksupport.c b/artiq/runtime/ksupport.c
index 5de733c5e..959d61623 100644
--- a/artiq/runtime/ksupport.c
+++ b/artiq/runtime/ksupport.c
@@ -16,8 +16,8 @@
 #include "dds.h"
 #include "i2c.h"
 
-#define KERNELCPU_EXEC_ADDRESS    0x42000000
-#define KERNELCPU_PAYLOAD_ADDRESS 0x42020000
+#define KERNELCPU_EXEC_ADDRESS    0x40400000
+#define KERNELCPU_PAYLOAD_ADDRESS 0x40420000
 #define KERNELCPU_LAST_ADDRESS    (0x4fffffff - 1024*1024)
 #define KSUPPORT_HEADER_SIZE      0x80
 
diff --git a/artiq/runtime/ksupport.ld b/artiq/runtime/ksupport.ld
index da231b69b..4985009fe 100644
--- a/artiq/runtime/ksupport.ld
+++ b/artiq/runtime/ksupport.ld
@@ -3,18 +3,16 @@ ENTRY(_start)
 
 INCLUDE generated/regions.ld
 
-/* First 32M of main memory are reserved for runtime
+/* First 4M of main memory are reserved for runtime
  * code/data/heap, then comes kernel memory.
  * First 128K of kernel memory are for support code.
  */
 MEMORY {
-    ksupport (RWX) : ORIGIN = 0x42000000, LENGTH = 0x20000
+    ksupport (RWX) : ORIGIN = 0x40400000, LENGTH = 0x20000
 }
 
-/* On AMP systems, kernel stack is at the end of main RAM,
- * before the runtime stack. Leave 1M for runtime stack.
- */
-PROVIDE(_fstack = 0x40000000 + LENGTH(main_ram) - 1024*1024 - 4);
+/* Kernel stack is at the end of main RAM. */
+PROVIDE(_fstack = ORIGIN(main_ram) + LENGTH(main_ram) - 4);
 
 /* Force ld to make the ELF header as loadable. */
 PHDRS
@@ -73,7 +71,5 @@ SECTIONS
         *(COMMON)
         . = ALIGN(4);
         _ebss = .;
-        . = ALIGN(8);
-        _heapstart = .;
     }
 }
diff --git a/artiq/runtime/runtime.ld b/artiq/runtime/runtime.ld
index b912c23c8..eee37d9cf 100644
--- a/artiq/runtime/runtime.ld
+++ b/artiq/runtime/runtime.ld
@@ -7,75 +7,78 @@ INCLUDE generated/regions.ld
  * ld does not allow this expression here.
  */
 MEMORY {
-	runtime : ORIGIN = 0x40000000, LENGTH = 0x2000000 /* 32M */
+    runtime (RWX) : ORIGIN = 0x40000000, LENGTH = 0x400000 /* 4M */
 }
 
-/* Kernel memory space start right after the runtime,
- * and ends before the runtime stack.
- * Runtime stack is always at the end of main_ram.
- * This stack is shared with the kernel on UP systems.
- */
-PROVIDE(_fstack = 0x40000000 + LENGTH(main_ram) - 4);
-
 SECTIONS
 {
-	.text :
-	{
-		_ftext = .;
-		*(.text .stub .text.* .gnu.linkonce.t.*)
-		_etext = .;
-	} > runtime
+    .text :
+    {
+        _ftext = .;
+        *(.text .stub .text.* .gnu.linkonce.t.*)
+        _etext = .;
+    } > runtime
 
-	/* https://sourceware.org/bugzilla/show_bug.cgi?id=20475 */
-	.got : {
-		_GLOBAL_OFFSET_TABLE_ = .;
-		*(.got)
-	} > runtime
+    /* https://sourceware.org/bugzilla/show_bug.cgi?id=20475 */
+    .got : {
+        _GLOBAL_OFFSET_TABLE_ = .;
+        *(.got)
+    } > runtime
 
-	.got.plt : {
-		*(.got.plt)
-	} > runtime
+    .got.plt : {
+        *(.got.plt)
+    } > runtime
 
-	.rodata :
-	{
-		. = ALIGN(4);
-		_frodata = .;
-		*(.rodata .rodata.* .gnu.linkonce.r.*)
-		*(.rodata1)
-		_erodata = .;
-	} > runtime
+    .rodata :
+    {
+        . = ALIGN(4);
+        _frodata = .;
+        *(.rodata .rodata.* .gnu.linkonce.r.*)
+        *(.rodata1)
+        _erodata = .;
+    } > runtime
 
-	.data :
-	{
-		. = ALIGN(4);
-		_fdata = .;
-		*(.data .data.* .gnu.linkonce.d.*)
-		*(.data1)
-		*(.sdata .sdata.* .gnu.linkonce.s.*)
-		_edata = .;
-	} > runtime
+    .data :
+    {
+        . = ALIGN(4);
+        _fdata = .;
+        *(.data .data.* .gnu.linkonce.d.*)
+        *(.data1)
+        *(.sdata .sdata.* .gnu.linkonce.s.*)
+        _edata = .;
+    } > runtime
 
-	.bss :
-	{
-		. = ALIGN(4);
-		_fbss = .;
-		*(.dynsbss)
-		*(.sbss .sbss.* .gnu.linkonce.sb.*)
-		*(.scommon)
-		*(.dynbss)
-		*(.bss .bss.* .gnu.linkonce.b.*)
-		*(COMMON)
-		. = ALIGN(4);
-		_ebss = .;
-		. = ALIGN(8);
-	} > runtime
+    .bss :
+    {
+        . = ALIGN(4);
+        _fbss = .;
+        *(.dynsbss)
+        *(.sbss .sbss.* .gnu.linkonce.sb.*)
+        *(.scommon)
+        *(.dynbss)
+        *(.bss .bss.* .gnu.linkonce.b.*)
+        *(COMMON)
+        . = ALIGN(4);
+        _ebss = .;
+    } > runtime
 
-	/DISCARD/ :
-	{
-		*(.eh_frame)
-	}
+    .stack :
+    {
+        . = ALIGN(0x1000);
+        _estack = .;
+        . += 0x4000;
+        _fstack = . - 4;
+    } > runtime
 
-	_fheap = .;
-	. += 0x1800000;
-	_eheap = .;
+    .heap :
+    {
+        _fheap = .;
+        . = ORIGIN(runtime) + LENGTH(runtime) - 0x1000;
+        _eheap = .;
+    } > runtime
+
+    /DISCARD/ :
+    {
+        *(.eh_frame)
+    }
 }