NV services

2018-02-20T06:55:15Z

Gabe k: Fixed name for NVGPU_GPU_IOCTL_ZCULL_GET_INFO section

The Switch uses a customized NVIDIA driver.

= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
This is "nns::nvdrv::INvDrvServices".

Main NVIDIA driver service.

Each service is used by:
* "nvdrv": regular applications
* "nvdrv:a": applets
* "nvdrv:s": sysmodules
* "nvdrv:t": factory titles

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Open]]
|-
| 1 || [[#Ioctl]]
|-
| 2 || [[#Close]]
|-
| 3 || [[#Initialize]]
|-
| 4 || [[#QueryEvent]]
|-
| 5 || [[#MapSharedMem]]
|-
| 6 || [[#GetStatus]]
|-
| 7 || [[#ForceSetClientPID]]
|-
| 8 || [[#SetClientPID]]
|-
| 9 || [[#DumpGraphicsMemoryInfo]]
|-
| 10 || [3.0.0+]
|-
| 11 || [3.0.0+] [[#Ioctl2]]
|-
| 12 || [3.0.0+] [[#Ioctl3]]
|-
| 13 || [3.0.0+]
|}

== Open ==
Takes a type-0x5 input buffer for the device-path. Returns the output 32bit '''fd''' and the u32 '''error_code'''.

== Ioctl ==
Takes a 32bit '''fd''', an u32 '''ioctl_cmd''', a type-0x21 input buffer, and a type-0x22 output buffer. Returns an output u32 ('''error_code''').

The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).

== Close ==
Takes a 32bit '''fd'''. Returns an output u32 ('''error_code''').

== Initialize ==
Takes two copy-handles ('''current_process''' and '''transfer_memory''') and an input u32 ('''transfer_memory_size'''). Returns an output u32 ('''error_code''').

Webkit applet creates the transfer-memory with perm = 0 and size 0x300000.

== QueryEvent ==
Takes two input u32s ('''fd''' and '''event_id'''), with the second word immediately after the first one. Returns an output u32 ('''error_code''') and a copy-handle ('''event_handle''').

== MapSharedMem ==
Takes a copy-handle ('''transfer_memory''') and two input u32s ('''fd''' and '''nvmap_handle'''). Returns an output u32 ('''error_code''').

== GetStatus ==
Takes no input. Returns 0x10-bytes and an output u32 ('''error_code''').

== ForceSetClientPID ==
Takes an input u64 which must [[IPC_Marshalling|match]] the user-process PID ([[AM_services|AppletResourceUserId]]). Returns an output u32 ('''error_code''').

== SetClientPID ==
Takes a PID-descriptor and an u64 which must [[IPC_Marshalling|match]] the user-process PID ([[AM_services|AppletResourceUserId]]). Returns an output u32 ('''error_code''').

== DumpGraphicsMemoryInfo ==
No input or output. Does nothing.

== Cmd10 ==
Takes a copy-handle and an input u32. Returns an output u32 ('''error_code''').

== Ioctl2 ==
Takes a type-0x21 buffer, a type-0x22 buffer, a type-0x21 buffer, and two input u32s. Returns an output u32 ('''error_code''').

== Ioctl3 ==
Same input/output as Ioctl2, except cmdhdr_word1 is 0x100B instead of 0xC0B.

== Cmd13 ==
Takes an input u64. No output.

Official user-processes starting with 3.0.0 now use this at the end of nvdrv service init with value 0x1.

= Ioctls =
The ioctl number is generated with the following primitive (see Linux kernel):

#define _IOC(inout, group, num, len) \
(inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))

The following table contains known ioctls.

== /dev/nvhost-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]] ||
|-
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]] ||
|-
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]] ||
|-
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]] ||
|-
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]] ||
|-
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]] ||
|-
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]] ||
|-
| 0xC183001B || Inout || 387 || [[#NVHOST_IOCTL_CTRL_GET_CONFIG]] ||
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_SIGNAL]] ||
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT]] ||
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC]] ||
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_REGISTER]] ||
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_UNREGISTER]] ||
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_EVENT_KILL]] ||
|}

=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
Identical to Linux driver.

struct {
__in u32 id;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
Identical to Linux driver.

struct {
__in u32 id;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
};

=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 lock; // (0==unlock; 1==lock)
};

=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
Identical to Linux driver. Uses 32-bit version and doesn't work.

struct {
__in u32 id;
__in u32 num_offsets;
__in u32 block_size;
__in u32 offsets;
__in u32 values;
__in u32 write;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
Identical to Linux driver.

struct {
__in u32 id;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_GET_CONFIG ===
Gets configured settings. Not available in production mode.

struct {
__in char domain_str[0x41]; // "nv"
__in char param_str[0x41];
__out char config_str[0x101];
};

=== NVHOST_IOCTL_CTRL_EVENT_SIGNAL ===
Signals an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT ===
Waits on an event. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to (('''syncpt_id''' << 0x10) | 0x10000000).

Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.

struct {
__in u32 syncpt_id;
__in u32 threshold;
__in s32 timeout;
__inout u32 value; // in=user_event_id (ignored); out=syncpt_value or user_event_id
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC ===
Waits on an event (async version). If waiting fails, returns error code 0x0B (BadValue).

Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.

struct {
__in u32 syncpt_id;
__in u32 threshold;
__in u32 timeout;
__inout u32 value; // in=user_event_id (ignored); out=syncpt_value or user_event_id
};

=== NVHOST_IOCTL_CTRL_EVENT_REGISTER ===
Registers an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_UNREGISTER ===
Unregisters an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_KILL ===
Kills user events. Exclusive to the Switch.

struct {
__in u64 user_events; // 64-bit bitfield where each bit represents one event
};

== /dev/nvmap ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080101 || Inout || 8 || [[#NVMAP_IOC_CREATE]] ||
|-
| 0x00000102 || - || 0 || NVMAP_IOC_CLAIM || Returns NotSupported
|-
| 0xC0080103 || Inout || 8 || [[#NVMAP_IOC_FROM_ID]] ||
|-
| 0xC0200104 || Inout || 32 || [[#NVMAP_IOC_ALLOC]] ||
|-
| 0xC0180105 || Inout || 24 || [[#NVMAP_IOC_FREE]] ||
|-
| 0xC0280106 || Inout || 40 || NVMAP_IOC_MMAP || Returns NotSupported
|-
| 0xC0280107 || Inout || 40 || NVMAP_IOC_WRITE || Returns NotSupported
|-
| 0xC0280108 || Inout || 40 || NVMAP_IOC_READ || Returns NotSupported
|-
| 0xC00C0109 || Inout || 12 || [[#NVMAP_IOC_PARAM]] ||
|-
| 0xC010010A || Inout || 16 || NVMAP_IOC_PIN_MULT || Returns NotSupported
|-
| 0xC010010B || Inout || 16 || NVMAP_IOC_UNPIN_MULT || Returns NotSupported
|-
| 0xC008010C || Inout || 8 || NVMAP_IOC_CACHE || Returns NotSupported
|-
| 0xC004010D || Inout || 4 || || Returns NotSupported
|-
| 0xC008010E || Inout || 8 || [[#NVMAP_IOC_GET_ID]] ||
|-
| 0xC004010F || Inout || 4 || || Returns NotSupported
|-
| 0x40040110 || In || 4 || || Returns NotSupported
|-
| 0x00000111 || - || 0 || || Returns NotSupported
|}

=== NVMAP_IOC_CREATE ===
Creates an nvmap object. Identical to Linux driver.

struct {
__in u32 size;
__out u32 handle;
};

=== NVMAP_IOC_FROM_ID ===
Get handle to an existing nvmap object. Identical to Linux driver.

struct {
__in u32 id;
__out u32 handle;
};

=== NVMAP_IOC_ALLOC ===
Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.

struct {
__in u32 handle;
__in u32 heapmask;
__in u32 flags; // (0=read-only, 1=read-write)
__in u32 align;
__in u8 kind;
u8 pad[7];
__in u64 addr;
};

=== NVMAP_IOC_FREE ===
This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.

struct {
__in u32 handle;
u32 pad;
__out u64 refcount;
__out u32 size;
__out u32 flags; // 1=NOT_FREED_YET
};

=== NVMAP_IOC_PARAM ===
Returns info about a nvmap object. Identical to Linux driver, but extended with further params.

struct {
__in u32 handle;
__in u32 param; // 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
__out u32 result;
};

=== NVMAP_IOC_GET_ID ===
Returns an id for a nvmap object. Identical to Linux driver.

struct {
__out u32 id; //~0 indicates error
__in u32 handle;
};

== /dev/nvdisp-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80040212 || Out || 4 || TEGRA_DC_EXT_CONTROL_GET_NUM_OUTPUTS ||
|-
| 0xC0140213 || Inout || 20 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_PROPERTIES ||
|-
| 0xC1100214 || Inout || 272 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_EDID ||
|-
| 0xC0040216 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT0 ||
|-
| 0xC0040217 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT1 ||
|-
| 0xC0100218 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT2 ||
|-
| 0xC0100219 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT3 ||
|-
| 0xC0040220 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT4 ||
|-
|}

== /dev/nvdisp-disp0, /dev/nvdisp-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40040201 || In || 4 || TEGRA_DC_EXT_GET_WINDOW ||
|-
| 0x40040202 || In || 4 || TEGRA_DC_EXT_PUT_WINDOW ||
|-
| 0xC4C80203 || In || 1224 || TEGRA_DC_EXT_FLIP ||
|-
| 0x80380204 || Out || 56 || TEGRA_DC_EXT_GET_MODE ||
|-
| 0x40380205 || Out || 56 || TEGRA_DC_EXT_SET_MODE ||
|-
| 0x430C0206 || In || 780 || TEGRA_DC_EXT_SET_LUT ||
|-
| 0x40010207 || In || 1 || TEGRA_DC_EXT_ENABLE_DISABLE_CRC ||
|-
| 0x80040208 || Out || 4 || TEGRA_DC_EXT_GET_CRC ||
|-
| 0x80040209 || Out || 4 || TEGRA_DC_EXT_GET_HEAD_STATUS ||
|-
| 0xC038020A || Inout || 56 || TEGRA_DC_EXT_VALIDATE_MODE ||
|-
| 0x4018020B || In || 24 || TEGRA_DC_EXT_SET_CSC ||
|-
| 0xC004020C || Inout || 4 || TEGRA_DC_EXT_GET_VBLANK_SYNCPT ||
|-
| 0x8040020D || Out || 64 || TEGRA_DC_EXT_GET_UNDERFLOWS ||
|-
| 0xC99A020E || Inout || 2458 || TEGRA_DC_EXT_SET_CMU ||
|-
| 0xC004020F || Inout || 4 || TEGRA_DC_EXT_DPMS ||
|-
| 0x80600210 || Out || 96 || TEGRA_DC_EXT_GET_AVI_INFOFRAME ||
|-
| 0x40600211 || In || 96 || TEGRA_DC_EXT_SET_AVI_INFOFRAME ||
|-
| 0xEBFC0215 || Inout || 11260 || TEGRA_DC_EXT_GET_MODE_DB ||
|-
| 0xC003021A || Inout || 3 || TEGRA_DC_EXT_PANEL_GET_VENDOR_ID ||
|-
| 0x803C021B || Out || 60 || TEGRA_DC_EXT_GET_MODE2 ||
|-
| 0x403C021C || In || 60 || TEGRA_DC_EXT_SET_MODE2 ||
|-
| 0xC03C021D || Inout || 60 || TEGRA_DC_EXT_VALIDATE_MODE2 ||
|-
| 0xEF20021E || Inout || 12064 || TEGRA_DC_EXT_GET_MODE_DB2 ||
|-
| 0xC004021F || Inout || 4 || TEGRA_DC_EXT_GET_WINMASK ||
|-
|}

== /dev/nvcec-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010300 || In || 1 || ||
|-
| 0x40010301 || In || 1 || NVCEC_CTRL_ENABLE ||
|-
| 0x804C0302 || Out || 76 || NVCEC_CTRL_GET_PADDR ||
|-
| 0x40040303 || In || 4 || NVCEC_CTRL_SET_LADDR ||
|-
| 0xC04C0304 || Inout || 76 || NVCEC_CTRL_WRITE ||
|-
| 0xC04C0305 || Inout || 76 || NVCEC_CTRL_READ ||
|-
| 0x804C0306 || Out || 76 || NVCEC_CTRL_GET_CONNECTION_STATUS ||
|-
| 0x804C0307 || Out || 76 || NVCEC_CTRL_GET_WRITE_STATUS ||
|-
|}

== /dev/nvhdcp_up-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC4880401 || Inout || 1160 || TEGRAIO_NVHDCP_READ_M ||
|-
| 0xC4880402 || Inout || 1160 || TEGRAIO_NVHDCP_READ_S ||
|-
| 0x40010403 || In || 1 || TEGRAIO_NVHDCP_ON_OFF ||
|-
|}

== /dev/nvdcutil-disp0, /dev/nvdcutil-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010501 || In || 1 || ||
|-
| 0x40010502 || In || 1 || ||
|-
| 0x42040503 || In || 1056 || ||
|-
| 0x803C0504 || Out || 60 || NVDCUTIL_DISP_IOCTL_GET_DISPLAY_INFO ||
|-
|}

== /dev/nvsched-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x00000601 || - || 0 ||NVSCHED_CTRL_ENABLE||
|-
| 0x00000602 || - || 0 ||NVSCHED_CTRL_DISABLE||
|-
| 0x40180603 || In || 1056 ||NVSCHED_CTRL_ADD_APPLICATION||
|-
| 0x40180604 || In || 60 ||NVSCHED_CTRL_UPDATE_APPLICATION||
|-
| 0x40080605 || In || 60 ||NVSCHED_CTRL_REMOVE_APPLICATION||
|-
| 0x80080606 || Out || 60 ||NVSCHED_CTRL_GET_ID||
|-
| 0x80080607 || Out || 60 ||NVSCHED_CTRL_ADD_RUNLIST||
|-
| 0x40180608 || In || 24 ||NVSCHED_CTRL_UPDATE_RUNLIST||
|-
| 0x40100609 || In || 16 ||NVSCHED_CTRL_LINK_RUNLIST||
|-
| 0x4010060A || In || 16 ||NVSCHED_CTRL_UNLINK_RUNLIST||
|-
| 0x4008060B || In || 8 ||NVSCHED_CTRL_REMOVE_RUNLIST||
|-
| 0x8001060C || Out || 1 ||NVSCHED_CTRL_HAS_OVERRUN_EVENT||
|-
| 0x8010060D || Out || 16 || ||
|-
| 0x400C060E || In || 12 ||NVSCHED_CTRL_PUT_CONDUCTOR_FLIP_FENCE||
|-
| 0x4008060F || In || 8 ||NVSCHED_CTRL_DETACH_APPLICATION||
|-
| 0x40100610 || In || 16 || ||
|-
| 0x40100611 || In || 16 || ||
|-
|}

== /dev/nverpt-ctrl ==
Added in firmware version 3.0.0.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC1280701 || Inout || 296 || ||
|-
| 0xCF580702 || Inout || 3928 || ||
|-
|}

== /dev/nvhost-as-gpu ==
Each fd opened to this device creates an address space. An address space is then later bound with a channel.

Once a nvgpu channel has been bound to an address space it cannot be unbound. There is no support for allowing an nvgpu channel to change from one address space to another (or from one to none).

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40044101 || In || 4 || [[#NVGPU_AS_IOCTL_BIND_CHANNEL]] ||
|-
| 0xC0184102 || Inout || 24 || [[#NVGPU_AS_IOCTL_ALLOC_SPACE]] ||
|-
| 0xC0104103 || Inout || 16 || [[#NVGPU_AS_IOCTL_FREE_SPACE]] ||
|-
| 0xC0184104 || Inout || 24 || [[#NVGPU_AS_IOCTL_MAP_BUFFER]] ||
|-
| 0xC0084105 || Inout || 8 || [[#NVGPU_AS_IOCTL_UNMAP_BUFFER]] ||
|-
| 0xC0284106 || Inout || 40 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX]] ||
|-
| 0x40104107 || In || 16 || [[#NVGPU_AS_IOCTL_INITIALIZE]] ||
|-
| 0xC0404108 || Inout || 64 || [[#NVGPU_AS_IOCTL_GET_VA_REGIONS]] ||
|-
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_INITIALIZE_EX]] ||
|-
| 0xC0??4114 || Inout || Variable || [[#NVGPU_AS_IOCTL_REMAP]] ||
|}

=== NVGPU_AS_IOCTL_BIND_CHANNEL ===
Identical to Linux driver.

struct {
__in u32 fd;
};

=== NVGPU_AS_IOCTL_ALLOC_SPACE ===
This one reserves pages in the device address space.

struct {
__in u32 pages;
__in u32 page_size;
__in u32 flags;
u32 pad;
union {
__out u64 offset;
__in u64 align;
};
};

=== NVGPU_AS_IOCTL_FREE_SPACE ===
struct {
__in u64 offset;
__in u32 pages;
__in u32 page_size;
};

=== NVGPU_AS_IOCTL_MAP_BUFFER ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
u32 pad;
__in u32 nvmap_handle;
__inout u32 page_size; // 0 means don't care
union {
__out u64 offset;
__in u64 align;
};
};

=== NVGPU_AS_IOCTL_MAP_BUFFER_EX ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__in u32 kind; // -1 is default
__in u32 nvmap_handle;
__inout u32 page_size; // 0 means don't care
__in u64 buffer_offset;
__in u64 mapping_size;
__inout u64 offset;
};

=== NVGPU_AS_IOCTL_UNMAP_BUFFER ===
Unmap a memory region from the device address space.

struct {
__in u64 offset;
};

=== NVGPU_AS_IOCTL_INITIALIZE ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable).

struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u32 flags; // ignored; passes 0
__in u32 reserved; // ignored; passes 0
};

=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
Nintendo modified to get rid of pointer in struct.

struct va_region {
u64 offset;
u32 page_size;
u32 pad;
u64 pages;
};

struct {
u64 not_used; // (contained output user ptr on linux, ignored)
__inout u32 bufsize; // forced to 2*sizeof(struct va_region)
u32 pad;
__out struct va_region regions[2];
};

=== NVGPU_AS_IOCTL_INITIALIZE_EX ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable) with extra params.

struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u32 flags; // passes 0
__in u32 reserved; // ignored; passes 0
__in u64 unk0;
__in u64 unk1;
__in u64 unk2;
};

=== NVGPU_AS_IOCTL_REMAP ===
Nintendo's custom implementation of address space remapping.

struct remap_entry {
__in u16 flags; // 0 or 4
__in u16 kind;
__in u32 nvmap_handle;
__in u32 padding;
__in u32 offset; // (alloc_space_offset >> 0x10)
__in u32 pages; // alloc_space_pages
};

struct {
__in struct remap_entry entries[];
};

== /dev/nvhost-dbg-gpu ==
Returns [[#Errors|NotSupported]] on Open unless nn::settings::detail::GetDebugModeFlag is set.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40084401 || In || 8 || NVGPU_DBG_GPU_IOCTL_BIND_CHANNEL ||
|-
| 0xC0??4402 || Inout || Variable || NVGPU_DBG_GPU_IOCTL_REG_OPS ||
|-
| 0x40084403 || In || 8 || NVGPU_DBG_GPU_IOCTL_EVENTS_CTRL ||
|-
| 0x40044404 || In || 4 || NVGPU_DBG_GPU_IOCTL_POWERGATE ||
|-
| 0x40044405 || In || 4 || NVGPU_DBG_GPU_IOCTL_SMPC_CTXSW_MODE ||
|-
| 0xC0184407 || Inout || 24 || NVGPU_DBG_GPU_IOCTL_PERFBUF_MAP ||
|-
| 0x40084408 || In || 8 || NVGPU_DBG_GPU_IOCTL_PERFBUF_UNMAP ||
|-
| 0x40084409 || In || 8 || NVGPU_DBG_GPU_IOCTL_PC_SAMPLING ||
|-
| 0x4008440A || In || 8 || NVGPU_DBG_GPU_IOCTL_TIMEOUT ||
|-
| 0x8008440B || Out || 8 || NVGPU_DBG_GPU_IOCTL_GET_TIMEOUT ||
|-
| 0x8004440C || Out || 4 || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT_SIZE ||
|-
| 0x0000440D || None || 0 || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT (uses Ioctl3) ||
|-
|}

== /dev/nvhost-prof-gpu ==
Returns [[#Errors|NotSupported]] on Open unless nn::settings::detail::GetDebugModeFlag is set.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|}

== /dev/nvhost-ctrl-gpu ==
This device is for global (context independent) operations on the gpu.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80044701 || Out || 4 || [[#NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE]] ||
|-
| 0x80284702 || Out || 40 || [[#NVGPU_GPU_IOCTL_ZCULL_GET_INFO]] ||
|-
| 0x402C4703 || In || 44 || [[#NVGPU_GPU_IOCTL_ZBC_SET_TABLE]] ||
|-
| 0xC0344704 || Inout || 52 || [[#NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE]] ||
|-
| 0xC0B04705 || Inout || 176 || [[#NVGPU_GPU_IOCTL_GET_CHARACTERISTICS]] ||
|-
| 0xC0184706 || Inout || 24 || NVGPU_GPU_IOCTL_GET_TPC_MASKS ||
|-
| 0x40084707 || In || 8 || [[#NVGPU_GPU_IOCTL_FLUSH_L2]] ||
|-
| 0x4008470E || In || 8 || NVGPU_GPU_IOCTL_SET_MMUDEBUG_MODE ||
|-
| 0x4010470F || In || 16 || NVGPU_GPU_IOCTL_SET_SM_DEBUG_MODE ||
|-
| 0xC0084710 || Inout || 8 || NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE ||
|-
| 0x80084711 || Out || 8 || NVGPU_GPU_IOCTL_GET_TPC_EXCEPTION_EN_STATUS ||
|-
| 0x80084712 || Out || 8 || NVGPU_GPU_IOCTL_NUM_VSMS ||
|-
| 0xC0044713 || Inout || 4 || NVGPU_GPU_IOCTL_VSMS_MAPPING ||
|-
| 0x80084714 || Out || 8 || [[#NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK]] ||
|-
| 0x80044715 || Out || 4 || ||
|-
| 0x8018471A || Out || 24 || ||
|-
| 0xC008471B || Inout || 8 || NVGPU_GPU_IOCTL_GET_ERROR_CHANNEL_USER_DATA ||
|-
| 0xC010471C || Inout || 16 || NVGPU_GPU_IOCTL_GET_GPU_TIME ||
|-
| 0xC108471D || Inout || 264 || NVGPU_GPU_IOCTL_GET_CPU_TIME_CORRELATION_INFO ||
|}

=== NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE ===
Returns the GPU's ZCULL context size. Identical to Linux driver.

struct {
__out u32 size;
};

=== NVGPU_GPU_IOCTL_ZCULL_GET_INFO ===
Returns GPU's ZCULL information. Identical to Linux driver.

struct {
__out u32 width_align_pixels;
__out u32 height_align_pixels;
__out u32 pixel_squares_by_aliquots;
__out u32 aliquot_total;
__out u32 region_byte_multiplier;
__out u32 region_header_size;
__out u32 subregion_header_size;
__out u32 subregion_width_align_pixels;
__out u32 subregion_height_align_pixels;
__out u32 subregion_count;
};

=== NVGPU_GPU_IOCTL_ZBC_SET_TABLE ===
Sets the active ZBC table. Identical to Linux driver.

struct {
__in u32 color_ds[4];
__in u32 color_l2[4];
__in u32 depth;
__in u32 format;
__in u32 type; // 1=color, 2=depth
};

=== NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE ===
Queries the active ZBC table. Identical to Linux driver.

struct {
__out u32 color_ds[4];
__out u32 color_l2[4];
__out u32 depth;
__out u32 ref_cnt;
__out u32 format;
__out u32 type;
__inout u32 index_size;
};

=== NVGPU_GPU_IOCTL_GET_CHARACTERISTICS ===
Returns the GPU characteristics. Modified to return inline data instead of using a pointer.

struct gpu_characteristics {
u32 arch; // 0x120 (NVGPU_GPU_ARCH_GM200)
u32 impl; // 0xB (NVGPU_GPU_IMPL_GM20B)
u32 rev; // 0xA1 (Revision A1)
u32 num_gpc; // 0x1
u64 l2_cache_size; // 0x40000
u64 on_board_video_memory_size; // 0x0 (not used)
u32 num_tpc_per_gpc; // 0x2
u32 bus_type; // 0x20 (NVGPU_GPU_BUS_TYPE_AXI)
u32 big_page_size; // 0x20000
u32 compression_page_size; // 0x20000
u32 pde_coverage_bit_count; // 0x1B
u32 available_big_page_sizes; // 0x30000
u32 gpc_mask; // 0x1
u32 sm_arch_sm_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 sm_arch_spa_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 sm_arch_warp_count; // 0x80
u32 gpu_va_bit_count; // 0x28
u32 reserved; // NULL
u64 flags; // 0x55
u32 twod_class; // 0x902D (FERMI_TWOD_A)
u32 threed_class; // 0xB197 (MAXWELL_B)
u32 compute_class; // 0xB1C0 (MAXWELL_COMPUTE_B)
u32 gpfifo_class; // 0xB06F (MAXWELL_CHANNEL_GPFIFO_A)
u32 inline_to_memory_class; // 0xA140 (KEPLER_INLINE_TO_MEMORY_B)
u32 dma_copy_class; // 0xB0B5 (MAXWELL_DMA_COPY_A)
u32 max_fbps_count; // 0x1
u32 fbp_en_mask; // 0x0 (disabled)
u32 max_ltc_per_fbp; // 0x2
u32 max_lts_per_ltc; // 0x1
u32 max_tex_per_tpc; // 0x0 (not supported)
u32 max_gpc_count; // 0x1
u32 rop_l2_en_mask_0; // 0x21D70 (fuse_status_opt_rop_l2_fbp_r)
u32 rop_l2_en_mask_1; // 0x0
u64 chipname; // 0x6230326D67 ("gm20b")
u64 gr_compbit_store_base_hw; // 0x0 (not supported)
};

struct {
__inout u64 gpu_characteristics_buf_size; // must not be NULL, but gets overwritten with 0xA0=max_size
__in u64 gpu_characteristics_buf_addr; // ignored, but must not be NULL
__out struct gpu_characteristics gc;
};

=== NVGPU_GPU_IOCTL_FLUSH_L2 ===
Flushes the GPU L2 cache.

struct {
__in u32 flush; // l2_flush | l2_invalidate << 1 | fb_flush << 2
u32 reserved;
};

=== NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK ===
Returns the mask value for a ZBC slot.

struct {
__out u32 slot; // always 0x07
__out u32 mask;
};

== Channels ==
Channels are a concept for NVIDIA hardware blocks that share a common interface.

{| class="wikitable" border="1"
! Path || Name
|-
| /dev/nvhost-gpu ||
|-
| /dev/nvhost-vic || Video Image Compositor
|-
| /dev/nvhost-nvdec || Video Decoder
|-
| /dev/nvhost-nvjpg || JPEG Decoder
|}

== Channel Ioctls ==
{| class="wikitable" border="1"
! Value || Size || Description || Notes
|-
| 0xC0??0001 || Variable || NVHOST_IOCTL_CHANNEL_SUBMIT ||
|-
| 0xC0080002 || 8 || NVHOST_IOCTL_CHANNEL_GET_SYNCPOINT ||
|-
| 0xC0080003 || 8 || NVHOST_IOCTL_CHANNEL_GET_WAITBASE ||
|-
| 0xC0080004 || 8 || NVHOST_IOCTL_CHANNEL_SET_TIMEOUT_EX ||
|-
| 0x40040007 || 4 || ||
|-
| 0x40080008 || 8 || NVHOST_IOCTL_CHANNEL_SET_CLK_RATE ||
|-
| 0xC0??0009 || Variable || NVHOST_IOCTL_CHANNEL_MAP_BUFFER ||
|-
| 0xC0??000A || Variable || NVHOST_IOCTL_CHANNEL_UNMAP_BUFFER ||
|-
| 0x00000013 || 0 || ||
|- style="border-top: double"
| 0x40044801 || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD]] ||
|-
| 0x40044803 || 4 || NVGPU_IOCTL_CHANNEL_SET_TIMEOUT ||
|-
| 0x40084805 || 8 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO]] ||
|-
| 0xC0044807 || 4 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS ||
|-
| 0xC0??4808 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]] ||
|-
| 0xC0104809 || 16 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX]] ||
|-
| 0xC010480B || 16 || [[#NVGPU_IOCTL_CHANNEL_ZCULL_BIND]] ||
|-
| 0xC018480C || 24 || [[#NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER]] ||
|-
| 0x4004480D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_PRIORITY]] ||
|-
| 0x0000480E || 0 || [[#NVGPU_IOCTL_CHANNEL_ENABLE]] ||
|-
| 0x0000480F || 0 || [[#NVGPU_IOCTL_CHANNEL_DISABLE]] ||
|-
| 0x00004810 || 0 || [[#NVGPU_IOCTL_CHANNEL_PREEMPT]] ||
|-
| 0x00004811 || 0 || [[#NVGPU_IOCTL_CHANNEL_FORCE_RESET]] ||
|-
| 0x40084812 || 8 || [[#NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL]] ||
|-
| 0xC0104813 || 16 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS_SNAPSHOT ||
|-
| 0x80804816 || 128 || NVGPU_IOCTL_CHANNEL_GET_ERROR_INFO ||
|-
| 0xC0104817 || 16 || [[#NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION]] ||
|-
| 0x40204818 || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]] ||
|-
| 0xC0??4819 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]] ||
|-
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]] ||
|-
| 0xC018481B || 24 || (uses Ioctl2) ||
|-
| 0xC018481C || 24 || (uses Ioctl2) ||
|-
|- style="border-top: double"
| 0x40084714 || 8 || NVGPU_IOCTL_CHANNEL_SET_USER_DATA || Sets an unknown user context address
|-
| 0x80084715 || 8 || NVGPU_IOCTL_CHANNEL_GET_USER_DATA || Gets an unknown user context address
|}

=== NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD ===
Binds a nvmap object to this channel. Identical to Linux driver.

struct {
__in u32 nvmap_fd;
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO ===
Allocates gpfifo entries. Identical to Linux driver.

struct {
__in u32 num_entries;
__in u32 flags;
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO ===
Submits a gpfifo object. Modified to take inline entry objects instead of a pointer.

struct fence {
u32 id;
u32 value;
};

struct gpfifo_entry {
u32 entry0; // gpu_va_lo
u32 entry1; // gpu_va_hi | (unk_0x02 << 0x08) | (size << 0x0A) | (unk_0x01 << 0x1F)
};

struct {
__in u64 gpfifo; // (ignored) pointer to gpfifo fence structs
__in u32 num_entries; // number of fence objects being submitted
__in u32 flags;
__out struct fence fence_out; // returned new fence object for others to wait on
__in struct gpfifo_entry entries[]; // depends on num_entries
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX ===
Allocates a graphics context object. Modified to ignore object's ID.

struct {
__in u32 class_num; // 0x902D=2d, 0xB197=3d, 0xB1C0=compute, 0xA140=kepler, 0xB0B5=DMA, 0xB06F=channel_gpfifo
__in u32 flags;
__out u64 obj_id; // (ignored) used for FREE_OBJ_CTX ioctl, which is not supported
};

=== NVGPU_IOCTL_CHANNEL_ZCULL_BIND ===
Binds a ZCULL context to the channel. Identical to Linux driver.

struct {
__in u64 gpu_va;
__in u32 mode; // 0=global, 1=no_ctxsw, 2=separate_buffer, 3=part_of_regular_buf
__in u32 padding;
};

=== NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER ===
Initializes the error notifier for this channel. Identical to Linux driver.

struct {
__in u64 offset;
__in u64 size;
__in u32 mem; // nvmap object handle
__in u32 padding;
};

=== NVGPU_IOCTL_CHANNEL_SET_PRIORITY ===
Change channel's priority. Identical to Linux driver.

struct {
__in u32 priority; // 0x32 is low, 0x64 is medium and 0x96 is high
};

=== NVGPU_IOCTL_CHANNEL_ENABLE ===
Enables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_DISABLE ===
Disables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_PREEMPT ===
Clears the FIFO pipe for this channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_FORCE_RESET ===
Forces the channel to reset. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL ===
Controls event notifications.

struct {
__in u32 cmd; // 0=disable, 1=enable, 2=clear
__in u32 id;
};

=== NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION ===
Returns the current error notification caught by the error notifier. Exclusive to the Switch.

struct {
__out u64 timestamp; // nanoseconds since Jan. 1, 1970
__out u32 info32; // error code
__out u16 info16; // additional error info
__inout u16 status; // always 0xFFFF
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY ===
Allocates gpfifo entries with additional parameters. Exclusive to the Switch.

struct {
__in u32 num_entries;
__in u32 flags;
__in u32 unk0; // 1 works
__in u32 unk1;
__in u32 unk2;
__in u32 unk3;
__in u32 unk4;
__in u32 unk5;
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX ===
Submits a gpfifo object (async version). Exclusive to the Switch.

struct {
u64 __gpfifo; // in (pointer to gpfifo fence structs; ignored)
u32 __num_entries; // in (number of fence objects being submitted)
u32 __flags; // in
struct fence __fence_out; // out (returned new fence object for others to wait on)
struct gpfifo_entry __entries[]; // in (depends on __num_entries)
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2 ===
Allocates gpfifo entries with additional parameters and returns a fence. Exclusive to the Switch.

struct {
u32 __num_entries; // in
u32 __flags; // in
u32 __unk0; // in (1 works)
struct fence __fence_out; // out
u32 __unk1; // in
u32 __unk2; // in
u32 __unk3; // in
};

= nvmemp =
NVIDIA memory profiler (this service is not available on retail units).
/dev/nvhost-ctrl sends the ioctl NVHOST_IOCTL_CTRL_GET_CONFIG to check the config "nv!NV_MEMORY_PROFILER". If config_str returns "1", the applications attempts to talk to use nvmemp.
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Cmd0
|-
| 1 || Cmd1
|}

= nvdrvdbg =
This is "nns::nvdrv::INvDrvDebugFSServices".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenLog]]
|-
| 1 || [[#CloseLog]]
|-
| 2 || [[#ReadLog]]
|}

== OpenLog ==
Takes process handle. Returns an fd.

== CloseLog ==
Takes fd and closes it.

== ReadLog ==
Takes fd and reads log into a type-6 buffer.

= Errors =
Most nvidia driver commands return an error code apart from the normal return code.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Success
|-
| 1 || NotImplemented
|-
| 2 || NotSupported
|-
| 3 || NotInitialized
|-
| 4 || BadParameter
|-
| 5 || Timeout
|-
| 6 || InsufficientMemory
|-
| 7 || ReadOnlyAttribute
|-
| 8 || InvalidState
|-
| 9 || InvalidAddress
|-
| 0xA || InvalidSize
|-
| 0xB || BadValue
|-
| 0xD || AlreadyAllocated
|-
| 0xE || Busy
|-
| 0xF || ResourceError
|-
| 0x10 || CountMismatch
|-
| 0x1000 || SharedMemoryTooSmall
|-
| 0x30003 || FileOperationFailed
|-
| 0x30004 || DirOperationFailed
|-
| 0x3000F || IoctlFailed
|-
| 0x30010 || AccessDenied
|-
| 0x30013 || FileNotFound
|-
| 0xA000E || ModuleNotPresent
|}

= Panic =
In some cases, a panic may occur. NV forces a crash by doing:
(void *)0 = 0xCAFE;
End result is that the system hangs with a white-screen.

== Gpfifo Panic ==
When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.

[[Category:Services]]

Nintendo Switch Brew - User contributions [en]

NV services