Nintendo Switch Brew - User contributions [en]

SVC

2018-05-22T16:08:38Z

Cyuubi: Fix svcGetInfo 16

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano || W0=result
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || svcCancelSynchronization || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || ?
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout || W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || W0=thread_handle, W1=[[#ThreadContext]]* || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=ArbitrationType, X2=? X3=timeout ||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=SignalType, X2=? W3=? ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || svcCreateInterruptEvent || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || svcContinueDebugEvent || W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id || W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, W1=[[#ThreadContextFlags]], X2=ThreadContext* || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || svcSetHardwareBreakPoint || W0=HardwareBreakpointId, X1=watchpoint_flags, X2=watchpoint_value/debug_handle? ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=unk_bool, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=srcaddr, W1=process_handle, X2=dstaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000.

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than 0x18000000.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

If dstaddr >= LowerTreshold, the dst-range is enforced to be within the process' "MapRegion". Code can get the range of this region from [[#svcGetInfo]] id0=2,3.

In this case, the mapped memory will have state 0x5C3C0B.

As long as (dstaddr+size) < LowerThreshold, then you can map anywhere but the mapped memory will have state 0x482907 instead.

LowerTreshold is 0x80000000 for 36-bit address spaces, and 0x40000000 for 32-bit ones.

[2.0.0+] Support for the 0x482907 mappings outside the "MapRegion" were removed.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || ThreadContext
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Nano
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nano=0 means "yield thread".

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40, error on num_handles == 0.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''Port:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''Session (server-side):''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

=== Result codes ===

'''0x0:''' Success. One of the objects was signalled before the timeout expired. Handle index is updated to indicate which object signalled.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signalled within the timeout. Handle index is not updated.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (Out) X0 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must be 0x1000-aligned.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) ? || ? || ?
|}
</div>

When used on retail where inx0 bit31 is clear, the system will throw a [[Error_codes|fatal-error]]. Otherwise when bit31 is set, it will return 0 and notify the debugger?

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || MapRegionBaseAddr
|-
| Process || 3 || 0 || MapRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] NewMapRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] NewMapRegionSize
|-
| Process || 16 || 0 || [3.0.0+] IsVirtualMemoryEnabled
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Thread || 0xF0000002 || 0 || Performance counter related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u64 || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessEvent ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessEvent_Created ||
|-
| 1 || ProcessEvent_DebugAttached ||
|-
| 2 || ProcessEvent_DebugDetached ||
|-
| 3 || ProcessEvent_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessEvent_Running ||
|-
| 5 || ProcessEvent_Exiting ||
|-
| 6 || ProcessEvent_Exited ||
|-
| 7 || ProcessEvent_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_ActualPriority
|-
| 1 ||
|-
| 2 || DebugThreadParam_CpuCore
|-
| 3 ||
|-
| 4 || DebugThreadParam_CoreMask
|}

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0 || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || UseSystemMemBlocks
|-
| || || Bit7 || [4.0.0] ?
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| 0x28 || 4 || || ResourceLimitHandle
|-
| 0x2C || 4 || || [3.0.0+] PersonalMmHeapNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_WeirdMappedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_MappedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ContinueDebugFlags ==
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || CancelSynchronization (only if ResumeAllThreads is set; cancels with error 0x6C01)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== DebugEventInfo ==

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || Type (0=PausedThread, 1=RunningThread, 2=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 ||
|-
| 3 || DebugEvent_Exit
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_UndefinedInstruction
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|}

UndefinedInstruction specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
There is userland code for handling exceptions, however this doesn't seem to be executed on retail mode.

When a usermode exception occurs, it jumps to the main code binary entrypoint (main_binary_address + 0 == '''_start''').

During normal boot '''_start''' is invoked with X0=0 and X1=main_thread_handle (triggering normal crt0 setup).
During an usermode exception '''_start''' is invoked with X0=exception_info0_ptr and X1=exception_info1_ptr instead.

The '''_start''' method determines whether to boot normally or handle an exception if X0 is set to 0 or not.

NV services

2018-05-18T14:31:11Z

Cyuubi: Add FinishInitialize

The Switch uses a customized NVIDIA driver.

= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
This is "nns::nvdrv::INvDrvServices".

Main NVIDIA driver service.

Each service is used by:
* "nvdrv": regular applications
* "nvdrv:a": applets
* "nvdrv:s": sysmodules
* "nvdrv:t": factory titles

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Open]]
|-
| 1 || [[#Ioctl]]
|-
| 2 || [[#Close]]
|-
| 3 || [[#Initialize]]
|-
| 4 || [[#QueryEvent]]
|-
| 5 || [[#MapSharedMem]]
|-
| 6 || [[#GetStatus]]
|-
| 7 || [[#ForceSetClientPID]]
|-
| 8 || [[#SetClientPID]]
|-
| 9 || [[#DumpGraphicsMemoryInfo]]
|-
| 10 || [3.0.0+] [[#InitializeDevtools]]
|-
| 11 || [3.0.0+] [[#Ioctl2]]
|-
| 12 || [3.0.0+] [[#Ioctl3]]
|-
| 13 || [3.0.0+] FinishInitialize
|}

== Open ==
Takes a type-0x5 input buffer for the device-path. Returns the output 32bit '''fd''' and the u32 '''error_code'''.

== Ioctl ==
Takes a 32bit '''fd''', an u32 '''ioctl_cmd''', a type-0x21 input buffer, and a type-0x22 output buffer. Returns an output u32 ('''error_code''').

The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).

== Close ==
Takes a 32bit '''fd'''. Returns an output u32 ('''error_code''').

== Initialize ==
Takes two copy-handles ('''current_process''' and '''transfer_memory''') and an input u32 ('''transfer_memory_size'''). Returns an output u32 ('''error_code''').

Webkit applet creates the transfer-memory with perm = 0 and size 0x300000.

== QueryEvent ==
Takes two input u32s ('''fd''' and '''event_id'''), with the second word immediately after the first one. Returns an output u32 ('''error_code''') and a copy-handle ('''event_handle''').

QueryEvent is only supported on (and implemented differently on):
* /dev/nvhost-gpu
** 1: SmException_BptIntReport
** 2: SmException_BptPauseReport
** 3: ErrorNotifierEvent
* /dev/nvhost-ctrl: Used to get events for SyncPts.
** If bit31-28 is 1, then lower 16-bits contain event_slot, bit27-16 contain syncpt_number.
** If bit31-28 is 0, then lower 4-bits contain event_slot, bit31-4 contains syncpt_number.
* /dev/nvhost-ctrl-gpu
** 1: Returns error_event_handle.
** 2: Returns unknown event.
* /dev/nvhost-dbg-gpu
** Ignores event_id.

== MapSharedMem ==
Takes a copy-handle ('''transfer_memory''') and two input u32s ('''fd''' and '''nvmap_handle'''). Returns an output u32 ('''error_code''').

== GetStatus ==
Takes no input. Returns 0x10-bytes and an output u32 ('''error_code''').

== ForceSetClientPID ==
Takes an input u64 which must [[IPC_Marshalling|match]] the user-process PID ([[AM_services|AppletResourceUserId]]). Returns an output u32 ('''error_code''').

== SetClientPID ==
Takes a PID-descriptor and an u64 which must [[IPC_Marshalling|match]] the user-process PID ([[AM_services|AppletResourceUserId]]). Returns an output u32 ('''error_code''').

== DumpGraphicsMemoryInfo ==
No input or output. Does nothing.

== InitializeDevtools ==
Takes a copy-handle and an input u32. Returns an output u32 ('''error_code''').

== Ioctl2 ==
Takes a type-0x21 buffer, a type-0x22 buffer, a type-0x21 buffer, and two input u32s. Returns an output u32 ('''error_code''').

== Ioctl3 ==
Same input/output as Ioctl2, except cmdhdr_word1 is 0x100B instead of 0xC0B.

== Cmd13 ==
Takes an input u64. No output.

Official user-processes starting with 3.0.0 now use this at the end of nvdrv service init with value 0x1.

= Ioctls =
The ioctl number is generated with the following primitive (see Linux kernel):

#define _IOC(inout, group, num, len) \
(inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))

The following table contains known ioctls.

== /dev/nvhost-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]] ||
|-
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]] ||
|-
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]] ||
|-
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]] ||
|-
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]] ||
|-
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]] ||
|-
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]] ||
|-
| 0xC183001B || Inout || 387 || [[#NVHOST_IOCTL_CTRL_GET_CONFIG]] ||
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_SIGNAL]] ||
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT]] ||
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC]] ||
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_REGISTER]] ||
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_UNREGISTER]] ||
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_EVENT_KILL]] ||
|}

=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
Identical to Linux driver.

struct {
__in u32 id;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
Identical to Linux driver.

struct {
__in u32 id;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
};

=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 lock; // (0==unlock; 1==lock)
};

=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
Identical to Linux driver. Uses 32-bit version and doesn't work.

struct {
__in u32 id;
__in u32 num_offsets;
__in u32 block_size;
__in u32 offsets;
__in u32 values;
__in u32 write;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
Identical to Linux driver.

struct {
__in u32 id;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_GET_CONFIG ===
Gets configured settings. Not available in production mode.

struct {
__in char domain_str[0x41]; // "nv"
__in char param_str[0x41];
__out char config_str[0x101];
};

=== NVHOST_IOCTL_CTRL_EVENT_SIGNAL ===
Signals an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT ===
Waits on an event. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to (('''syncpt_id''' << 0x10) | 0x10000000).

Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.

struct {
__in u32 syncpt_id;
__in u32 threshold;
__in s32 timeout;
__inout u32 value; // in=user_event_id (ignored); out=syncpt_value or user_event_id
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC ===
Waits on an event (async version). If waiting fails, returns error code 0x0B (BadValue).

Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.

struct {
__in u32 syncpt_id;
__in u32 threshold;
__in u32 timeout;
__inout u32 value; // in=user_event_id (ignored); out=syncpt_value or user_event_id
};

=== NVHOST_IOCTL_CTRL_EVENT_REGISTER ===
Registers an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_UNREGISTER ===
Unregisters an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_KILL ===
Kills user events. Exclusive to the Switch.

struct {
__in u64 user_events; // 64-bit bitfield where each bit represents one event
};

== /dev/nvmap ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080101 || Inout || 8 || [[#NVMAP_IOC_CREATE]] ||
|-
| 0x00000102 || - || 0 || NVMAP_IOC_CLAIM || Returns NotSupported
|-
| 0xC0080103 || Inout || 8 || [[#NVMAP_IOC_FROM_ID]] ||
|-
| 0xC0200104 || Inout || 32 || [[#NVMAP_IOC_ALLOC]] ||
|-
| 0xC0180105 || Inout || 24 || [[#NVMAP_IOC_FREE]] ||
|-
| 0xC0280106 || Inout || 40 || NVMAP_IOC_MMAP || Returns NotSupported
|-
| 0xC0280107 || Inout || 40 || NVMAP_IOC_WRITE || Returns NotSupported
|-
| 0xC0280108 || Inout || 40 || NVMAP_IOC_READ || Returns NotSupported
|-
| 0xC00C0109 || Inout || 12 || [[#NVMAP_IOC_PARAM]] ||
|-
| 0xC010010A || Inout || 16 || NVMAP_IOC_PIN_MULT || Returns NotSupported
|-
| 0xC010010B || Inout || 16 || NVMAP_IOC_UNPIN_MULT || Returns NotSupported
|-
| 0xC008010C || Inout || 8 || NVMAP_IOC_CACHE || Returns NotSupported
|-
| 0xC004010D || Inout || 4 || || Returns NotSupported
|-
| 0xC008010E || Inout || 8 || [[#NVMAP_IOC_GET_ID]] ||
|-
| 0xC004010F || Inout || 4 || || Returns NotSupported
|-
| 0x40040110 || In || 4 || || Returns NotSupported
|-
| 0x00000111 || - || 0 || || Returns NotSupported
|-
| 0x40100112 || In || 16 || NVMAP_IOC_EXPORT_FOR_ARUID ||
|-
| 0x40100113 || In || 16 || NVMAP_IOC_IS_OWNED_BY_ARUID ||
|-
| 0x40100114 || In || 16 || NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID ||
|}

=== NVMAP_IOC_CREATE ===
Creates an nvmap object. Identical to Linux driver.

struct {
__in u32 size;
__out u32 handle;
};

=== NVMAP_IOC_FROM_ID ===
Get handle to an existing nvmap object. Identical to Linux driver.

struct {
__in u32 id;
__out u32 handle;
};

=== NVMAP_IOC_ALLOC ===
Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.

struct {
__in u32 handle;
__in u32 heapmask;
__in u32 flags; // (0=read-only, 1=read-write)
__in u32 align;
__in u8 kind;
u8 pad[7];
__inout u64 addr;
};

=== NVMAP_IOC_FREE ===
This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.

struct {
__in u32 handle;
u32 pad;
__out u64 refcount;
__out u32 size;
__out u32 flags; // 1=NOT_FREED_YET
};

=== NVMAP_IOC_PARAM ===
Returns info about a nvmap object. Identical to Linux driver, but extended with further params.

struct {
__in u32 handle;
__in u32 param; // 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
__out u32 result;
};

=== NVMAP_IOC_GET_ID ===
Returns an id for a nvmap object. Identical to Linux driver.

struct {
__out u32 id; //~0 indicates error
__in u32 handle;
};

== /dev/nvdisp-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80040212 || Out || 4 || TEGRA_DC_EXT_CONTROL_GET_NUM_OUTPUTS ||
|-
| 0xC0140213 || Inout || 20 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_PROPERTIES ||
|-
| 0xC1100214 || Inout || 272 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_EDID ||
|-
| 0xC0040216 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT0 ||
|-
| 0xC0040217 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT1 ||
|-
| 0xC0100218 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT2 ||
|-
| 0xC0100219 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT3 ||
|-
| 0xC0040220 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT4 ||
|-
|}

== /dev/nvdisp-disp0, /dev/nvdisp-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40040201 || In || 4 || TEGRA_DC_EXT_GET_WINDOW ||
|-
| 0x40040202 || In || 4 || TEGRA_DC_EXT_PUT_WINDOW ||
|-
| 0xC4C80203 || In || 1224 || TEGRA_DC_EXT_FLIP ||
|-
| 0x80380204 || Out || 56 || TEGRA_DC_EXT_GET_MODE ||
|-
| 0x40380205 || Out || 56 || TEGRA_DC_EXT_SET_MODE ||
|-
| 0x430C0206 || In || 780 || TEGRA_DC_EXT_SET_LUT ||
|-
| 0x40010207 || In || 1 || TEGRA_DC_EXT_ENABLE_DISABLE_CRC ||
|-
| 0x80040208 || Out || 4 || TEGRA_DC_EXT_GET_CRC ||
|-
| 0x80040209 || Out || 4 || TEGRA_DC_EXT_GET_HEAD_STATUS ||
|-
| 0xC038020A || Inout || 56 || TEGRA_DC_EXT_VALIDATE_MODE ||
|-
| 0x4018020B || In || 24 || TEGRA_DC_EXT_SET_CSC ||
|-
| 0xC004020C || Inout || 4 || TEGRA_DC_EXT_GET_VBLANK_SYNCPT ||
|-
| 0x8040020D || Out || 64 || TEGRA_DC_EXT_GET_UNDERFLOWS ||
|-
| 0xC99A020E || Inout || 2458 || TEGRA_DC_EXT_SET_CMU ||
|-
| 0xC004020F || Inout || 4 || TEGRA_DC_EXT_DPMS ||
|-
| 0x80600210 || Out || 96 || TEGRA_DC_EXT_GET_AVI_INFOFRAME ||
|-
| 0x40600211 || In || 96 || TEGRA_DC_EXT_SET_AVI_INFOFRAME ||
|-
| 0xEBFC0215 || Inout || 11260 || TEGRA_DC_EXT_GET_MODE_DB ||
|-
| 0xC003021A || Inout || 3 || TEGRA_DC_EXT_PANEL_GET_VENDOR_ID ||
|-
| 0x803C021B || Out || 60 || TEGRA_DC_EXT_GET_MODE2 ||
|-
| 0x403C021C || In || 60 || TEGRA_DC_EXT_SET_MODE2 ||
|-
| 0xC03C021D || Inout || 60 || TEGRA_DC_EXT_VALIDATE_MODE2 ||
|-
| 0xEF20021E || Inout || 12064 || TEGRA_DC_EXT_GET_MODE_DB2 ||
|-
| 0xC004021F || Inout || 4 || TEGRA_DC_EXT_GET_WINMASK ||
|-
|}

== /dev/nvcec-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010300 || In || 1 || ||
|-
| 0x40010301 || In || 1 || NVCEC_CTRL_ENABLE ||
|-
| 0x804C0302 || Out || 76 || NVCEC_CTRL_GET_PADDR ||
|-
| 0x40040303 || In || 4 || NVCEC_CTRL_SET_LADDR ||
|-
| 0xC04C0304 || Inout || 76 || NVCEC_CTRL_WRITE ||
|-
| 0xC04C0305 || Inout || 76 || NVCEC_CTRL_READ ||
|-
| 0x804C0306 || Out || 76 || NVCEC_CTRL_GET_CONNECTION_STATUS ||
|-
| 0x804C0307 || Out || 76 || NVCEC_CTRL_GET_WRITE_STATUS ||
|-
|}

== /dev/nvhdcp_up-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC4880401 || Inout || 1160 || TEGRAIO_NVHDCP_READ_M ||
|-
| 0xC4880402 || Inout || 1160 || TEGRAIO_NVHDCP_READ_S ||
|-
| 0x40010403 || In || 1 || TEGRAIO_NVHDCP_ON_OFF ||
|-
|}

== /dev/nvdcutil-disp0, /dev/nvdcutil-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010501 || In || 1 || NVDCUTIL_SW_HOTPLUG_IN_OUT ||
|-
| 0x40010502 || In || 1 || NVDCUTIL_VIRTUAL_EDID_ON_OFF ||
|-
| 0x42040503 || In || 1056 || NVDCUTIL_VIRTUAL_EDID_SET_DATA ||
|-
| 0x803C0504 || Out || 60 || NVDCUTIL_GET_MODE ||
|-
| 0x40010505 || In || 1 || NVDCUTIL_TELEMETRY_TEST_ON_OFF ||
|-
|}

== /dev/nvsched-ctrl ==
This is a customized scheduler device.

The way this device is exposed and configured is exclusive to the Switch, since other sources don't have an actual interface for the scheduler.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x00000601 || - || 0 || [[#NVSCHED_CTRL_ENABLE]] ||
|-
| 0x00000602 || - || 0 || [[#NVSCHED_CTRL_DISABLE]] ||
|-
| 0x40180603 || In || 24 || [[#NVSCHED_CTRL_ADD_APPLICATION]] ||
|-
| 0x40180604 || In || 24 || [[#NVSCHED_CTRL_UPDATE_APPLICATION]] ||
|-
| 0x40080605 || In || 8 || [[#NVSCHED_CTRL_REMOVE_APPLICATION]] ||
|-
| 0x80080606 || Out || 8 || [[#NVSCHED_CTRL_GET_ID]] ||
|-
| 0x80080607 || Out || 8 || [[#NVSCHED_CTRL_ADD_RUNLIST]] ||
|-
| 0x40180608 || In || 24 || [[#NVSCHED_CTRL_UPDATE_RUNLIST]] ||
|-
| 0x40100609 || In || 16 || [[#NVSCHED_CTRL_LINK_RUNLIST]] ||
|-
| 0x4010060A || In || 16 || [[#NVSCHED_CTRL_UNLINK_RUNLIST]] ||
|-
| 0x4008060B || In || 8 || [[#NVSCHED_CTRL_REMOVE_RUNLIST]] ||
|-
| 0x8001060C || Out || 1 || [[#NVSCHED_CTRL_HAS_OVERRUN_EVENT]] ||
|-
| 0x8010060D || Out || 16 || [[#NVSCHED_CTRL_GET_NEXT_OVERRUN_EVENT]] ||
|-
| 0x400C060E || In || 12 || [[#NVSCHED_CTRL_PUT_CONDUCTOR_FLIP_FENCE]] ||
|-
| 0x4008060F || In || 8 || [[#NVSCHED_CTRL_DETACH_APPLICATION]] ||
|-
| 0x40100610 || In || 16 || ||
|-
| 0x40100611 || In || 16 || ||
|-
|}

=== NVSCHED_CTRL_ENABLE ===
Enables the scheduler.

=== NVSCHED_CTRL_DISABLE ===
Disables the scheduler.

=== NVSCHED_CTRL_ADD_APPLICATION ===
Adds a new application to the scheduler.

struct {
__in u64 application_id;
__in u64 priority;
__in u64 timeslice;
};

=== NVSCHED_CTRL_UPDATE_APPLICATION ===
Updates the application parameters in the scheduler.

struct {
__in u64 application_id;
__in u64 priority;
__in u64 timeslice;
};

=== NVSCHED_CTRL_REMOVE_APPLICATION ===
Removes the application from the scheduler.

struct {
__in u64 application_id;
};

=== NVSCHED_CTRL_GET_ID ===
Returns the ID of the last scheduled object.

struct {
__out u64 id;
};

=== NVSCHED_CTRL_ADD_RUNLIST ===
Creates a new runlist and returns it's ID.

struct {
__out u64 runlist_id;
};

=== NVSCHED_CTRL_UPDATE_RUNLIST ===
Updates the runlist parameters in the scheduler.

struct {
__in u64 runlist_id;
__in u64 priority;
__in u64 timeslice;
};

=== NVSCHED_CTRL_LINK_RUNLIST ===
Links a runlist to a given application in the scheduler.

struct {
__in u64 runlist_id;
__in u64 application_id;
};

=== NVSCHED_CTRL_UNLINK_RUNLIST ===
Unlinks a runlist from a given application in the scheduler.

struct {
__in u64 runlist_id;
__in u64 application_id;
};

=== NVSCHED_CTRL_REMOVE_RUNLIST ===
Removes the runlist from the scheduler.

struct {
__in u64 runlist_id;
};

=== NVSCHED_CTRL_HAS_OVERRUN_EVENT ===
Returns a boolean to tell if the scheduler has an overrun event or not.

struct {
__out u8 has_overrun;
};

=== NVSCHED_CTRL_GET_NEXT_OVERRUN_EVENT ===
Returns the overrun event's data from the scheduler.

struct {
__out u64 runlist_id;
__out u64 debt;
};

=== NVSCHED_CTRL_PUT_CONDUCTOR_FLIP_FENCE ===
Installs a fence swap event?

struct {
__in u32 fence_id;
__in u32 fence_value;
__in u32 swap_interval;
};

=== NVSCHED_CTRL_DETACH_APPLICATION ===
Places the given application in detached state.

struct {
__in u64 application_id;
};

== /dev/nverpt-ctrl ==
Added in firmware version 3.0.0.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC1280701 || Inout || 296 || NVERPT_TELEMETRY_SUBMIT_DATA ||
|-
| 0xCF580702 || Inout || 3928 || NVERPT_TELEMETRY_SUBMIT_DATA_EX ||
|-
|}

== /dev/nvhost-as-gpu ==
Each fd opened to this device creates an address space. An address space is then later bound with a channel.

Once a nvgpu channel has been bound to an address space it cannot be unbound. There is no support for allowing an nvgpu channel to change from one address space to another (or from one to none).

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40044101 || In || 4 || [[#NVGPU_AS_IOCTL_BIND_CHANNEL]] ||
|-
| 0xC0184102 || Inout || 24 || [[#NVGPU_AS_IOCTL_ALLOC_SPACE]] ||
|-
| 0xC0104103 || Inout || 16 || [[#NVGPU_AS_IOCTL_FREE_SPACE]] ||
|-
| 0xC0184104 || Inout || 24 || [[#NVGPU_AS_IOCTL_MAP_BUFFER]] ||
|-
| 0xC0084105 || Inout || 8 || [[#NVGPU_AS_IOCTL_UNMAP_BUFFER]] ||
|-
| 0xC0284106 || Inout || 40 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX]] ||
|-
| 0x40104107 || In || 16 || [[#NVGPU_AS_IOCTL_INITIALIZE]] ||
|-
| 0xC0404108 || Inout || 64 || [[#NVGPU_AS_IOCTL_GET_VA_REGIONS]] ||
|-
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_INITIALIZE_EX]] ||
|-
| 0xC0??4114 || Inout || Variable || [[#NVGPU_AS_IOCTL_REMAP]] ||
|}

=== NVGPU_AS_IOCTL_BIND_CHANNEL ===
Identical to Linux driver.

struct {
__in u32 fd;
};

=== NVGPU_AS_IOCTL_ALLOC_SPACE ===
This one reserves pages in the device address space.

struct {
__in u32 pages;
__in u32 page_size;
__in u32 flags;
u32 pad;
union {
__out u64 offset;
__in u64 align;
};
};

=== NVGPU_AS_IOCTL_FREE_SPACE ===
This one frees pages from the device address space.

struct {
__in u64 offset;
__in u32 pages;
__in u32 page_size;
};

=== NVGPU_AS_IOCTL_MAP_BUFFER ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
u32 pad;
__in u32 nvmap_handle;
__inout u32 page_size; // 0 means don't care
union {
__out u64 offset;
__in u64 align;
};
};

=== NVGPU_AS_IOCTL_MAP_BUFFER_EX ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

Unaligned size will cause a [[#Panic]].

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__in u32 kind; // -1 is default
__in u32 nvmap_handle;
__inout u32 page_size; // 0 means don't care
__in u64 buffer_offset;
__in u64 mapping_size;
__inout u64 offset;
};

=== NVGPU_AS_IOCTL_UNMAP_BUFFER ===
Unmap a memory region from the device address space.

struct {
__in u64 offset;
};

=== NVGPU_AS_IOCTL_INITIALIZE ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable).

struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u32 flags; // ignored; passes 0
__in u32 reserved; // ignored; passes 0
};

=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
Nintendo modified to get rid of pointer in struct.

struct va_region {
u64 offset;
u32 page_size;
u32 pad;
u64 pages;
};

struct {
u64 not_used; // (contained output user ptr on linux, ignored)
__inout u32 bufsize; // forced to 2*sizeof(struct va_region)
u32 pad;
__out struct va_region regions[2];
};

=== NVGPU_AS_IOCTL_INITIALIZE_EX ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable) with extra params.

struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u32 flags; // passes 0
__in u32 reserved; // ignored; passes 0
__in u64 unk0;
__in u64 unk1;
__in u64 unk2;
};

=== NVGPU_AS_IOCTL_REMAP ===
Nintendo's custom implementation of address space remapping.

struct remap_entry {
__in u16 flags; // 0 or 4
__in u16 kind;
__in u32 nvmap_handle;
__in u32 padding;
__in u32 offset; // (alloc_space_offset >> 0x10)
__in u32 pages; // alloc_space_pages
};

struct {
__in struct remap_entry entries[];
};

== /dev/nvhost-dbg-gpu ==
Returns [[#Errors|NotSupported]] on Open unless nn::settings::detail::GetDebugModeFlag is set.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40084401 || In || 8 || NVGPU_DBG_GPU_IOCTL_BIND_CHANNEL ||
|-
| 0xC0??4402 || Inout || Variable || NVGPU_DBG_GPU_IOCTL_REG_OPS ||
|-
| 0x40084403 || In || 8 || NVGPU_DBG_GPU_IOCTL_EVENTS_CTRL ||
|-
| 0x40044404 || In || 4 || NVGPU_DBG_GPU_IOCTL_POWERGATE ||
|-
| 0x40044405 || In || 4 || NVGPU_DBG_GPU_IOCTL_SMPC_CTXSW_MODE ||
|-
| 0x40044406 || In || 4 || NVGPU_DBG_GPU_IOCTL_SUSPEND_RESUME_SM ||
|-
| 0xC0184407 || Inout || 24 || NVGPU_DBG_GPU_IOCTL_PERFBUF_MAP ||
|-
| 0x40084408 || In || 8 || NVGPU_DBG_GPU_IOCTL_PERFBUF_UNMAP ||
|-
| 0x40084409 || In || 8 || NVGPU_DBG_GPU_IOCTL_PC_SAMPLING ||
|-
| 0x4008440A || In || 8 || NVGPU_DBG_GPU_IOCTL_TIMEOUT ||
|-
| 0x8008440B || Out || 8 || NVGPU_DBG_GPU_IOCTL_GET_TIMEOUT ||
|-
| 0x8004440C || Out || 4 || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT_SIZE ||
|-
| 0x0000440D || None || 0 || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT || Uses Ioctl3.
|-
|}

== /dev/nvhost-prof-gpu ==
Returns [[#Errors|NotSupported]] on Open unless nn::settings::detail::GetDebugModeFlag is set.

This device is identical to [[#/dev/nvhost-dbg-gpu|/dev/nvhost-dbg-gpu]].

== /dev/nvhost-ctrl-gpu ==
This device is for global (context independent) operations on the gpu.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80044701 || Out || 4 || [[#NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE]] ||
|-
| 0x80284702 || Out || 40 || [[#NVGPU_GPU_IOCTL_ZCULL_GET_INFO]] ||
|-
| 0x402C4703 || In || 44 || [[#NVGPU_GPU_IOCTL_ZBC_SET_TABLE]] ||
|-
| 0xC0344704 || Inout || 52 || [[#NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE]] ||
|-
| 0xC0B04705 || Inout || 176 || [[#NVGPU_GPU_IOCTL_GET_CHARACTERISTICS]] ||
|-
| 0xC0184706 || Inout || 24 || NVGPU_GPU_IOCTL_GET_TPC_MASKS ||
|-
| 0x40084707 || In || 8 || [[#NVGPU_GPU_IOCTL_FLUSH_L2]] ||
|-
| 0x4008470D || In || 8 || NVGPU_GPU_IOCTL_INVAL_ICACHE ||
|-
| 0x4008470E || In || 8 || NVGPU_GPU_IOCTL_SET_MMUDEBUG_MODE ||
|-
| 0x4010470F || In || 16 || NVGPU_GPU_IOCTL_SET_SM_DEBUG_MODE ||
|-
| 0xC0084710 || Inout || 8 || NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE ||
|-
| 0x80084711 || Out || 8 || NVGPU_GPU_IOCTL_GET_TPC_EXCEPTION_EN_STATUS ||
|-
| 0x80084712 || Out || 8 || NVGPU_GPU_IOCTL_NUM_VSMS ||
|-
| 0xC0044713 || Inout || 4 || NVGPU_GPU_IOCTL_VSMS_MAPPING ||
|-
| 0x80084714 || Out || 8 || [[#NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK]] ||
|-
| 0x80044715 || Out || 4 || ||
|-
| 0x8018471A || Out || 24 || ||
|-
| 0xC008471B || Inout || 8 || NVGPU_GPU_IOCTL_GET_ERROR_CHANNEL_USER_DATA ||
|-
| 0xC010471C || Inout || 16 || NVGPU_GPU_IOCTL_GET_GPU_TIME ||
|-
| 0xC108471D || Inout || 264 || NVGPU_GPU_IOCTL_GET_CPU_TIME_CORRELATION_INFO ||
|}

=== NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE ===
Returns the GPU's ZCULL context size. Identical to Linux driver.

struct {
__out u32 size;
};

=== NVGPU_GPU_IOCTL_ZCULL_GET_INFO ===
Returns GPU's ZCULL information. Identical to Linux driver.

struct {
__out u32 width_align_pixels;
__out u32 height_align_pixels;
__out u32 pixel_squares_by_aliquots;
__out u32 aliquot_total;
__out u32 region_byte_multiplier;
__out u32 region_header_size;
__out u32 subregion_header_size;
__out u32 subregion_width_align_pixels;
__out u32 subregion_height_align_pixels;
__out u32 subregion_count;
};

=== NVGPU_GPU_IOCTL_ZBC_SET_TABLE ===
Sets the active ZBC table. Identical to Linux driver.

struct {
__in u32 color_ds[4];
__in u32 color_l2[4];
__in u32 depth;
__in u32 format;
__in u32 type; // 1=color, 2=depth
};

=== NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE ===
Queries the active ZBC table. Identical to Linux driver.

struct {
__out u32 color_ds[4];
__out u32 color_l2[4];
__out u32 depth;
__out u32 ref_cnt;
__out u32 format;
__out u32 type;
__inout u32 index_size;
};

=== NVGPU_GPU_IOCTL_GET_CHARACTERISTICS ===
Returns the GPU characteristics. Modified to return inline data instead of using a pointer.

struct gpu_characteristics {
u32 arch; // 0x120 (NVGPU_GPU_ARCH_GM200)
u32 impl; // 0xB (NVGPU_GPU_IMPL_GM20B)
u32 rev; // 0xA1 (Revision A1)
u32 num_gpc; // 0x1
u64 l2_cache_size; // 0x40000
u64 on_board_video_memory_size; // 0x0 (not used)
u32 num_tpc_per_gpc; // 0x2
u32 bus_type; // 0x20 (NVGPU_GPU_BUS_TYPE_AXI)
u32 big_page_size; // 0x20000
u32 compression_page_size; // 0x20000
u32 pde_coverage_bit_count; // 0x1B
u32 available_big_page_sizes; // 0x30000
u32 gpc_mask; // 0x1
u32 sm_arch_sm_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 sm_arch_spa_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 sm_arch_warp_count; // 0x80
u32 gpu_va_bit_count; // 0x28
u32 reserved; // NULL
u64 flags; // 0x55
u32 twod_class; // 0x902D (FERMI_TWOD_A)
u32 threed_class; // 0xB197 (MAXWELL_B)
u32 compute_class; // 0xB1C0 (MAXWELL_COMPUTE_B)
u32 gpfifo_class; // 0xB06F (MAXWELL_CHANNEL_GPFIFO_A)
u32 inline_to_memory_class; // 0xA140 (KEPLER_INLINE_TO_MEMORY_B)
u32 dma_copy_class; // 0xB0B5 (MAXWELL_DMA_COPY_A)
u32 max_fbps_count; // 0x1
u32 fbp_en_mask; // 0x0 (disabled)
u32 max_ltc_per_fbp; // 0x2
u32 max_lts_per_ltc; // 0x1
u32 max_tex_per_tpc; // 0x0 (not supported)
u32 max_gpc_count; // 0x1
u32 rop_l2_en_mask_0; // 0x21D70 (fuse_status_opt_rop_l2_fbp_r)
u32 rop_l2_en_mask_1; // 0x0
u64 chipname; // 0x6230326D67 ("gm20b")
u64 gr_compbit_store_base_hw; // 0x0 (not supported)
};

struct {
__inout u64 gpu_characteristics_buf_size; // must not be NULL, but gets overwritten with 0xA0=max_size
__in u64 gpu_characteristics_buf_addr; // ignored, but must not be NULL
__out struct gpu_characteristics gc;
};

=== NVGPU_GPU_IOCTL_FLUSH_L2 ===
Flushes the GPU L2 cache.

struct {
__in u32 flush; // l2_flush | l2_invalidate << 1 | fb_flush << 2
u32 reserved;
};

=== NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK ===
Returns the mask value for a ZBC slot.

struct {
__out u32 slot; // always 0x07
__out u32 mask;
};

== Channels ==
Channels are a concept for NVIDIA hardware blocks that share a common interface.

{| class="wikitable" border="1"
! Path || Name
|-
| /dev/nvhost-gpu ||
|-
| /dev/nvhost-vic || Video Image Compositor
|-
| /dev/nvhost-nvdec || Video Decoder
|-
| /dev/nvhost-nvjpg || JPEG Decoder
|}

== Channel Ioctls ==
{| class="wikitable" border="1"
! Value || Size || Description || Notes
|-
| 0xC0??0001 || Variable || NVHOST_IOCTL_CHANNEL_SUBMIT || Seen on 1.0.0.
|-
| 0xC0080002 || 8 || NVHOST_IOCTL_CHANNEL_GET_SYNCPOINT || Seen on 1.0.0.
|-
| 0xC0080003 || 8 || NVHOST_IOCTL_CHANNEL_GET_WAITBASE || Seen on 1.0.0.
|-
| 0xC0080004 || 8 || NVHOST_IOCTL_CHANNEL_SET_TIMEOUT_EX || Seen on 1.0.0. Stubbed; does a debug print and returns 0.
|-
| 0x40040007 || 4 || NVHOST_IOCTL_CHANNEL_SET_SUBMIT_TIMEOUT || Seen on 1.0.0.
|-
| 0x40080008 || 8 || NVHOST_IOCTL_CHANNEL_SET_CLK_RATE || Seen on 1.0.0.
|-
| 0xC0??0009 || Variable || NVHOST_IOCTL_CHANNEL_MAP_BUFFER || Seen on 1.0.0.
|-
| 0xC0??000A || Variable || NVHOST_IOCTL_CHANNEL_UNMAP_BUFFER || Seen on 1.0.0.
|-
| 0x00000013 || 0 || || Seen on 1.0.0. This one sets a u32, and bool based on input.
|-
| 0xC0080014 || || NVHOST_IOCTL_CHANNEL_GET_CLK_RATE || Seen on 1.0.0.
|- style="border-top: double"
| 0x40044801 || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD]] || Seen on 1.0.0.
|-
| 0x40044803 || 4 || NVGPU_IOCTL_CHANNEL_SET_TIMEOUT || Seen on 1.0.0.
|-
| 0x40084805 || 8 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO]] || Seen on 1.0.0.
|-
| 0x40184806 || || NVGPU_IOCTL_CHANNEL_WAIT || Seen on 1.0.0.
|-
| 0xC0044807 || 4 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS || Seen on 1.0.0.
|-
| 0xC0??4808 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]] || Seen on 1.0.0.
|-
| 0xC0104809 || 16 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX]] || Seen on 1.0.0.
|-
| 0x4008480A || || NVHOST_IOCTL_CHANNEL_FREE_OBJ_CTX || Seen on 1.0.0.
|-
| 0xC010480B || 16 || [[#NVGPU_IOCTL_CHANNEL_ZCULL_BIND]] || Seen on 1.0.0.
|-
| 0xC018480C || 24 || [[#NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER]] || Seen on 1.0.0.
|-
| 0x4004480D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_PRIORITY]] || Seen on 1.0.0.
|-
| 0x0000480E || 0 || [[#NVGPU_IOCTL_CHANNEL_ENABLE]] || Seen on 1.0.0.
|-
| 0x0000480F || 0 || [[#NVGPU_IOCTL_CHANNEL_DISABLE]] || Seen on 1.0.0.
|-
| 0x00004810 || 0 || [[#NVGPU_IOCTL_CHANNEL_PREEMPT]] || Seen on 1.0.0.
|-
| 0x00004811 || 0 || [[#NVGPU_IOCTL_CHANNEL_FORCE_RESET]] || Seen on 1.0.0.
|-
| 0x40084812 || 8 || [[#NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL]] || Seen on 1.0.0.
|-
| 0xC0104813 || 16 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS_SNAPSHOT || Seen on 1.0.0.
|-
| 0x80804816 || 128 || NVGPU_IOCTL_CHANNEL_GET_ERROR_INFO || Seen on 1.0.0.
|-
| 0xC0104817 || 16 || [[#NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION]] || Seen on 1.0.0.
|-
| 0x40204818 || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]] || Seen on 1.0.0.
|-
| 0xC0??4819 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]] || Seen on 1.0.0.
|-
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]] || Seen on 1.0.0.
|-
| 0xC018481B || 24 || || Uses Ioctl2.
|-
| 0xC018481C || 24 || || Uses Ioctl2.
|-
|- style="border-top: double"
| 0x40084714 || 8 || NVGPU_IOCTL_CHANNEL_SET_USER_DATA || Sets an unknown user context address. Seen on 1.0.0.
|-
| 0x80084715 || 8 || NVGPU_IOCTL_CHANNEL_GET_USER_DATA || Gets an unknown user context address. Seen on 1.0.0.
|}

=== NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD ===
Binds a nvmap object to this channel. Identical to Linux driver.

This ioctl is a no-op in the Linux driver, not sure about Switch?

struct {
__in u32 nvmap_fd;
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO ===
Allocates gpfifo entries. Identical to Linux driver.

struct {
__in u32 num_entries;
__in u32 flags;
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO ===
Submits a gpfifo object. Modified to take inline entry objects instead of a pointer.

struct fence {
u32 syncpt_id;
u32 syncpt_value;
};

struct gpfifo_entry {
u64 entry; // gpu_iova | (unk_2bits << 40) | (size << 42) | (unk_flag << 63)
};

struct {
__in u64 gpfifo; // (ignored) pointer to gpfifo fence structs
__in u32 num_entries; // number of fence objects being submitted
__in u32 flags;
__inout struct fence fence_out; // returned new fence object for others to wait on
__in struct gpfifo_entry entries[]; // depends on num_entries
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX ===
Allocates a graphics context object. Modified to ignore object's ID.

You can only have one object context allocated at a time. You must have bound an address space before using this.

struct {
__in u32 class_num; // 0x902D=2d, 0xB197=3d, 0xB1C0=compute, 0xA140=kepler, 0xB0B5=DMA, 0xB06F=channel_gpfifo
__in u32 flags; // bit0: LOCKBOOST_ZERO
__out u64 obj_id; // (ignored) used for FREE_OBJ_CTX ioctl, which is not supported
};

=== NVGPU_IOCTL_CHANNEL_ZCULL_BIND ===
Binds a ZCULL context to the channel. Identical to Linux driver.

struct {
__in u64 gpu_va;
__in u32 mode; // 0=global, 1=no_ctxsw, 2=separate_buffer, 3=part_of_regular_buf
__in u32 padding;
};

=== NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER ===
Initializes the error notifier for this channel. Unlike for the Linux kernel, the Switch driver cannot write to an arbitrary userspace buffer. Thus new ioctls have been introduced to fetch the error information rather than using a shared memory buffer.

struct {
__in u64 offset; // ignored
__in u64 size; // ignored
__in u32 mem; // must be non-zero to initialize, zero to de-initialize
__in u32 padding; // ignored
};

=== NVGPU_IOCTL_CHANNEL_SET_PRIORITY ===
Change channel's priority. Identical to Linux driver.

struct {
__in u32 priority; // 0x32 is low, 0x64 is medium and 0x96 is high
};

=== NVGPU_IOCTL_CHANNEL_ENABLE ===
Enables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_DISABLE ===
Disables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_PREEMPT ===
Clears the FIFO pipe for this channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_FORCE_RESET ===
Forces the channel to reset. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL ===
Controls event notifications.

struct {
__in u32 cmd; // 0=disable, 1=enable, 2=clear
__in u32 id; // same id's as for [[#QueryEvent]]
};

=== NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION ===
Returns the current error notification caught by the error notifier. Exclusive to the Switch.

Despite being marked as inout this is all output.

struct {
__out u64 timestamp; // fetched straight from armGetSystemTick
__out u32 info32; // error code
__out u16 info16; // additional error info
__out u16 status; // always 0xFFFF
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX ===
Allocates gpfifo entries with additional parameters. Exclusive to the Switch.

struct {
__in u32 num_entries;
__in u32 flags;
__in u32 unk0; // 1 works
__in u32 unk1;
__in u32 unk2;
__in u32 unk3;
__in u32 unk4;
__in u32 unk5;
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY ===
Submits a gpfifo object (async version). Exclusive to the Switch.

struct {
u64 __gpfifo; // in (pointer to gpfifo fence structs; ignored)
u32 __num_entries; // in (number of fence objects being submitted)
u32 __flags; // in
struct fence __fence_out; // out (returned new fence object for others to wait on)
struct gpfifo_entry __entries[]; // in (depends on __num_entries)
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2 ===
Allocates gpfifo entries with additional parameters and returns a fence. Exclusive to the Switch.

struct {
u32 __num_entries; // in
u32 __flags; // in
u32 __unk0; // in (1 works)
struct fence __fence_out; // out
u32 __unk1; // in
u32 __unk2; // in
u32 __unk3; // in
};

= nvmemp =
NVIDIA memory profiler (this service is not available on retail units).
/dev/nvhost-ctrl sends the ioctl NVHOST_IOCTL_CTRL_GET_CONFIG to check the config "nv!NV_MEMORY_PROFILER". If config_str returns "1", the applications attempts to talk to use nvmemp.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Cmd0
|-
| 1 || Cmd1
|}

= nvdrvdbg =
This is "nns::nvdrv::INvDrvDebugFSServices".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenLog]]
|-
| 1 || [[#CloseLog]]
|-
| 2 || [[#ReadLog]]
|-
| 3 ||
|-
| 4 ||
|}

== OpenLog ==
Takes process handle. Returns an fd.

== CloseLog ==
Takes fd and closes it.

== ReadLog ==
Takes fd and reads log into a type-6 buffer.

= nvgem:c =
This is "nv::gemcontrol::INvGemControl".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|-
| 3 ||
|-
| 4 ||
|-
| 5 ||
|-
| 6 ||
|-
| 7 ||
|}

= nvgem:cd =
This is "nv::gemcoredump::INvGemCoreDump".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|}

= Errors =
Most nvidia driver commands return an error code apart from the normal return code.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Success
|-
| 1 || NotImplemented
|-
| 2 || NotSupported
|-
| 3 || NotInitialized
|-
| 4 || BadParameter
|-
| 5 || Timeout
|-
| 6 || InsufficientMemory
|-
| 7 || ReadOnlyAttribute
|-
| 8 || InvalidState
|-
| 9 || InvalidAddress
|-
| 0xA || InvalidSize
|-
| 0xB || BadValue
|-
| 0xD || AlreadyAllocated
|-
| 0xE || Busy
|-
| 0xF || ResourceError
|-
| 0x10 || CountMismatch
|-
| 0x1000 || SharedMemoryTooSmall
|-
| 0x30003 || FileOperationFailed
|-
| 0x30004 || DirOperationFailed
|-
| 0x3000F || IoctlFailed
|-
| 0x30010 || AccessDenied
|-
| 0x30013 || FileNotFound
|-
| 0xA000E || ModuleNotPresent
|}

= Panic =
In some cases, a panic may occur. NV forces a crash by doing:
(void *)0 = 0xCAFE;
End result is that the system hangs with a white-screen.

== Gpfifo Panic ==
When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.

[[Category:Services]]