Nintendo Switch Brew - User contributions [en]

SVC

2018-06-11T13:33:35Z

Gdkchan:

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano || W0=result
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || svcCancelSynchronization || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || ?
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout || W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=ArbitrationType, X2=? X3=timeout ||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=SignalType, X2=? W3=? ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || svcCreateInterruptEvent || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || svcContinueDebugEvent || W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id || W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, W1=[[#ThreadContextFlags]], X2=ThreadContext* || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || svcSetHardwareBreakPoint || W0=HardwareBreakpointId, X1=watchpoint_flags, X2=watchpoint_value/debug_handle? ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=unk_bool, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=srcaddr, W1=process_handle, X2=dstaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000.

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than 0x18000000.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

If dstaddr >= LowerTreshold, the dst-range is enforced to be within the process' "MapRegion". Code can get the range of this region from [[#svcGetInfo]] id0=2,3.

In this case, the mapped memory will have state 0x5C3C0B.

As long as (dstaddr+size) < LowerThreshold, then you can map anywhere but the mapped memory will have state 0x482907 instead.

LowerTreshold is 0x80000000 for 36-bit address spaces, and 0x40000000 for 32-bit ones.

[2.0.0+] Support for the 0x482907 mappings outside the "MapRegion" were removed.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || ThreadContext
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Nano
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nano=0 means "yield thread".

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40, error on num_handles == 0.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''Port:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''Session (server-side):''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

=== Result codes ===

'''0x0:''' Success. One of the objects was signalled before the timeout expired. Handle index is updated to indicate which object signalled.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signalled within the timeout. Handle index is not updated.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (Out) X0 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must be 0x1000-aligned.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) ? || ? || ?
|}
</div>

When used on retail where inx0 bit31 is clear, the system will throw a [[Error_codes|fatal-error]]. Otherwise when bit31 is set, it will return 0 and notify the debugger?

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || MapRegionBaseAddr
|-
| Process || 3 || 0 || MapRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] NewMapRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] NewMapRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Thread || 0xF0000002 || 0 || Performance counter related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u64 || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessEvent ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessEvent_Created ||
|-
| 1 || ProcessEvent_DebugAttached ||
|-
| 2 || ProcessEvent_DebugDetached ||
|-
| 3 || ProcessEvent_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessEvent_Running ||
|-
| 5 || ProcessEvent_Exiting ||
|-
| 6 || ProcessEvent_Exited ||
|-
| 7 || ProcessEvent_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_ActualPriority
|-
| 1 ||
|-
| 2 || DebugThreadParam_CpuCore
|-
| 3 ||
|-
| 4 || DebugThreadParam_CoreMask
|}

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0 || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || UseSystemMemBlocks
|-
| || || Bit7 || [4.0.0] ?
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| 0x28 || 4 || || ResourceLimitHandle
|-
| 0x2C || 4 || || [3.0.0+] PersonalMmHeapNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_WeirdMappedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_MappedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ContinueDebugFlags ==
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || CancelSynchronization (only if ResumeAllThreads is set; cancels with error 0x6C01)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== DebugEventInfo ==

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || Type (0=PausedThread, 1=RunningThread, 2=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 ||
|-
| 3 || DebugEvent_Exit
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_UndefinedInstruction
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|}

UndefinedInstruction specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
There is userland code for handling exceptions, however this doesn't seem to be executed on retail mode.

When a usermode exception occurs, it jumps to the main code binary entrypoint (main_binary_address + 0 == '''_start''').

During normal boot '''_start''' is invoked with X0=0 and X1=main_thread_handle (triggering normal crt0 setup).
During an usermode exception '''_start''' is invoked with X0=exception_info0_ptr and X1=exception_info1_ptr instead.

The '''_start''' method determines whether to boot normally or handle an exception if X0 is set to 0 or not.

SVC

2018-04-04T17:10:19Z

Gdkchan:

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano || W0=result
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || svcCancelSynchronization || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=event_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || ?
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetNextThreadInfo || X3=timeout || W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || W0=thread_handle, W1=[[#ThreadContext]]* || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=ArbitrationType, X2=? X3=timeout ||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=SignalType, X2=? W3=? ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=client_handle ?, W2=server_handle ?
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcAllocateUnsafeMemory]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcFreeUnsafeMemory || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeAllocationLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || svcCreateInterruptEvent || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=DebugEventInfo*, W1=debug_handle || W0=result
|-
| 0x64 || svcContinueDebugEvent || W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id || W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, W1=[[#ThreadContextFlags]], X2=ThreadContext* || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || svcSetHardwareBreakPoint || W0=HardwareBreakpointId, X1=watchpoint_flags, X2=watchpoint_value/debug_handle? ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] svcGetMemoryInfo || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=unk_bool, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=srcaddr, W1=process_handle, X2=dstaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000.

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than 0x18000000.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

If dstaddr >= LowerTreshold, the dst-range is enforced to be within the process' "MapRegion". Code can get the range of this region from [[#svcGetInfo]] id0=2,3.

In this case, the mapped memory will have state 0x5C3C0B.

As long as (dstaddr+size) < LowerThreshold, then you can map anywhere but the mapped memory will have state 0x482907 instead.

LowerTreshold is 0x80000000 for 36-bit address spaces, and 0x40000000 for 32-bit ones.

[2.0.0+] Support for the 0x482907 mappings outside the "MapRegion" were removed.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || ThreadContext
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Nano
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nano=0 means "yield thread".

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40, error on num_handles == 0.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''Port:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''Session (server-side):''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

=== Result codes ===

'''0x0:''' Success. One of the objects was signalled before the timeout expired. Handle index is updated to indicate which object signalled.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signalled within the timeout. Handle index is not updated.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (Out) X0 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must be 0x1000-aligned.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) ? || ? || ?
|}
</div>

When used on retail where inx0 bit31 is clear, the system will throw a [[Error_codes|fatal-error]]. Otherwise when bit31 is set, it will return 0 and notify the debugger?

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || MapRegionBaseAddr
|-
| Process || 3 || 0 || MapRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] NewMapRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] NewMapRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Thread || 0xF0000002 || 0 || Performance counter related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcAllocateUnsafeMemory ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || SrcAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || DstAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || void* || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u64 || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessEvent ==
{| class=wikitable
! Value || Name
|-
| 0 || ProcessEvent_Created
|-
| 1 || ProcessEvent_DebugAttached
|-
| 2 || ProcessEvent_DebugDetached
|-
| 3 || ProcessEvent_Crashed
|-
| 4 || ProcessEvent_Running
|-
| 5 || ProcessEvent_Exiting
|-
| 6 || ProcessEvent_Exited
|-
| 7 || ProcessEvent_DebugSuspended
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_ActualPriority
|-
| 1 ||
|-
| 2 || DebugThreadParam_CpuCore
|-
| 3 ||
|-
| 4 || DebugThreadParam_CoreMask
|}

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0 || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 ||
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || UseSystemMemBlocks
|-
| || || Bit7 || [4.0.0] ?
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| 0x28 || 4 || || ResourceLimitHandle
|-
| 0x2C || 4 || || [3.0.0+] PersonalMmHeapNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_WeirdMappedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_MappedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ContinueDebugFlags ==
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || CancelSynchronization (only if ResumeAllThreads is set; cancels with error 0x6C01)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== DebugEventInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || Type (0=PausedThread, 1=RunningThread, 2=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 ||
|-
| 3 || DebugEvent_Exit
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_UndefinedInstruction
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|}

UndefinedInstruction specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
There is userland code for handling exceptions, however this doesn't seem to be executed on retail mode.

When a usermode exception occurs, it jumps to the main code binary entrypoint (main_binary_address + 0 == '''_start''').

During normal boot '''_start''' is invoked with X0=0 and X1=main_thread_handle (triggering normal crt0 setup).
During an usermode exception '''_start''' is invoked with X0=exception_info0_ptr and X1=exception_info1_ptr instead.

The '''_start''' method determines whether to boot normally or handle an exception if X0 is set to 0 or not.

GPU

2018-04-01T20:12:20Z

Gdkchan:

GPU

2018-04-01T20:03:15Z

Gdkchan:

GPU

2018-04-01T19:58:22Z

Gdkchan: Remove command lists, since we now have a better, more complete page for the commands, also change the names to use official names instead the ones from nouveau.

GPU

2018-04-01T19:33:54Z

Gdkchan:

== Mapping Memory ==

First, to map a memory region on the GPU Address Space, caching needs to be disabled by using [[SVC#svcSetMemoryAttribute|svcSetMemoryAttribute]]. The Address passed is the Virtual Address of the region that will be mapped, the size is the region size, and State0/1 are both set to 8 to disable caching of the memory region. This is done to ensure that the GPU can actually "see" the data written there, and it doesn't get stuck on some cache.

Then, [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]] is used to create a nvmap object with the desired size. After, [[NV_services#NVMAP_IOC_ALLOC|NVMAP_IOC_ALLOC]] is used to allocate the memory on the GPU Address Space, and map data on the process Address Space into the GPU Address Space, by passing the Virtual Address as the input addr parameter, and also the Handle returned from [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]]. Lastly, the actual mapping is done by using [[NV_services#NVGPU_AS_IOCTL_MAP_BUFFER_EX|NVGPU_AS_IOCTL_MAP_BUFFER_EX]], and the GPU Virtual Address is returned on the offset parameter. It's also possible to manually set the offset where the mapping should be made on the GPU Address Space, by passing the address on the "offset" parameter, and setting the bit 0 of the flags parameter to 1. However, for this to work, the desired GPU Virtual Address needs to be previously reserved using [[NV_services#NVGPU_AS_IOCTL_ALLOC_SPACE|NVGPU_AS_IOCTL_ALLOC_SPACE]].

The above process is used to map all data that will be used by the GPU, like Textures, Command Lists (a.k.a. Push Buffers), Vertex/Index buffers and Shaders. They usually have their own mapping, but Command Lists can share the same mapping.

== FIFO Commands ==

The GPU implements a variation of Tegra's push buffer format for it's PFIFO engine. PFIFO is a special engine responsible for receiving user command lists and routing them to the appropriate engines (2D, 3D, DMA).

Commands are submitted to the GPU's PFIFO engine through [[NV_services#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]].

This ioctl takes an array of gpfifo entries where each entry points to a FIFO command list. This list is composed of alternating 32-bit words containing FIFO commands and their respective arguments.

=== Command Structure ===

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|12-0
|Method
|-
|15-13
|Subchannel
|-
|27-16
|Argument count (in 32-bits Words) or inline data (see below)
|-
|28?
|Hmm?
|-
|31-29
|[[#Submission_mode|Submission mode]]
|}

Note: Methods are treated as 4-byte addressable locations, and hence their numbers are written down multiplied by 4.

Note: The command's arguments, when present, follow the command word immediately.

==== Submission mode ====

{| class="wikitable"
|-
! scope="col"| Mode
! scope="col"| Description
! scope="col"| Offical name
|-
|0
|Increasing mode (old)
|
|-
|1
|Increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count''', while automatically incrementing the '''method''' value. This means that each argument will be written to a different method location.
|INCR
|-
|2
|Non-increasing mode (old)
|
|-
|3
|Non-increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count'''. However, all arguments will be written to the same method location.
|NONINCR
|-
|4
|Inline mode - Tells PFIFO to read '''inline data''' from bits 28-16 of the command word, thus eliminating the need to pass additional words for the arguments.
|IMM
|-
|5
|Increase-once mode - Tells PFIFO to read as much arguments as specified by '''argument count''' and automatically increments the '''method''' value once only.
|
|}

=== Command List ===

All methods with values < 0x100 are special and executed by the PFIFO's DMA puller. The others are forwarded to the engine object currently bound to a given subchannel.

{| class="wikitable" border="1"
|-
! Command || Method || Subchannel || Arg Count || Mode || Name
|-
| 0x2001?000 || 0x0000 || Variable || 1 || 1 || [[#BindObject|BindObject]]
|-
| 0x80000040 || 0x40 || 0 || 0 || 4 || ?
|-
| 0xA???0045 || 0x45 || 0 || Variable || 5 || SetGraphMacroCode
|-
| 0x20020047 || 0x47 || 0 || 2 || 1 || SetGraphMacroEntry
|-
| 0x800?0049 || 0x49 || 0 || Variable || 4 || ?
|-
| 0x20056080 || 0x80 || 3 || Variable || 1 || ?
|-
| 0x20016085 || 0x85 || 3 || 1 || 1 || ?
|-
| 0x20026086 || 0x86 || 3 || 2 || 1 || ?
|-
| 0x20026088 || 0x88 || 3 || 2 || 1 || ?
|-
| 0x2004608C || 0x8C || 3 || Variable || 1 || ?
|-
| 0x20016091 || 0x91 || 3 || 1 || 1 || ?
|-
| 0x20026092 || 0x92 || 3 || 2 || 1 || ?
|-
| 0x20026094 || 0x94 || 3 || 2 || 1 || ?
|-
| 0x800160B5 || 0xB5 || 3 || 1 || 4 || ?
|-
| 0x800000BA || 0xBA || 0 || 0 || 4 || ?
|-
| 0x601000BE || 0xBE || 0 || 16 || 3 || ?
|-
| 0x200100BF || 0xBF || 0 || 1 || 1 || ?
|-
| 0x200180C0 || 0xC0 || 4 || 1 || 1 || ?
|-
| 0x200400C9 || 0xC9 || 0 || 4 || 1 || SetOuterTessellationLevels
|-
| 0x200200CD || 0xCD || 0 || 2 || 1 || SetInnerTessellationLevels
|-
| 0x200100DC || 0xDC || 0 || 1 || 1 || ?
|-
| 0x800?00DF || 0xDF || 0 || Variable || 4 || SetRasterizerDiscard?
|-
| 0x20048100 || 0x100 || 4 || 4 || 1 || ?
|-
| 0x20028102 || 0x102 || 4 || 2 || 1 || ?
|-
| 0x20018104 || 0x104 || 4 || 1 || 1 || ?
|-
| 0x20018105 || 0x105 || 4 || 1 || 1 || ?
|-
| 0x20018106 || 0x106 || 4 || 1 || 1 || ?
|-
| 0x200181C0 || 0x1C0 || 4 || 1 || 1 || ?
|-
| 0x200181C2 || 0x1C2 || 4 || 1 || 1 || ?
|-
| 0x200181C3 || 0x1C3 || 4 || 1 || 1 || ?
|-
| 0x200281C4 || 0x1C4 || 4 || 2 || 1 || ?
|-
| 0x200181C5 || 0x1C5 || 4 || 1 || 1 || ?
|-
| 0x200181C6 || 0x1C6 || 4 || 1 || 1 || ?
|-
| 0x200181C7 || 0x1C7 || 4 || 1 || 1 || ?
|-
| 0x200181C8 || 0x1C8 || 4 || 1 || 1 || ?
|-
| 0x200181CA || 0x1CA || 4 || 1 || 1 || ?
|-
| 0x200181CB || 0x1CB || 4 || 1 || 1 || ?
|-
| 0x200181CC || 0x1CC || 4 || 1 || 1 || ?
|-
| 0x200181CD || 0x1CD || 4 || 1 || 1 || ?
|-
| 0x200181CF || 0x1CF || 4 || 1 || 1 || ?
|-
| 0x800001D1 || 0x1D1 || 0 || 0 || 4 || ?
|-
| 0x200301F0 || 0x1F0 || 0 || 3 || 1 || ?
|-
| 0x800001F3 || 0x1F3 || 0 || 0 || 4 || ?
|-
| 0x200201F8 || 0x1F8 || 0 || 2 || 1 || ?
|-
| 0x200401FA || 0x1FA || 0 || 4 || 1 || ?
|-
| 0x20016223 || 0x223 || 3 || 1 || 1 || ?
|-
| 0x2004622C || 0x22C || 3 || 4 || 1 || ?
|-
| 0x20046230 || 0x230 || 3 || 4 || 1 || ?
|-
| 0x20046234 || 0x234 || 3 || 4 || 1 || ?
|-
| 0x200203?? || 0x3?? Variable || 0 || 2 || 1 || SetScissors?
|-
| 0x20040360 || 0x360 || 0 || 4 || 1 || ?
|-
| 0x20010364 || 0x364 || 0 || 1 || 1 || ?
|-
| 0x800?0368 || 0x368 || 0 || Variable || 4 || ?
|-
| 0x800?036B || 0x36B || 0 || Variable || 4 || ?
|-
| 0x800?036C || 0x36C || 0 || Variable || 4 || ?
|-
| 0x2001036F || 0x36F || 0 || 1 || 1 || ?
|-
| 0x80000370 || 0x370 || 0 || 0 || 4 || ?
|-
| 0x80000371 || 0x371 || 0 || 0 || 4 || ?
|-
| 0x80000372 || 0x372 || 0 || 0 || 4 || ?
|-
| 0x8???0373 || 0x373 || 0 || Variable || 4 || SetPatchSize
|-
| 0x80000374 || 0x374 || 0 || 0 || 4 || ?
|-
| 0x20010376 || 0x376 || 0 || 1 || 1 || ?
|-
| 0x800?03D5 || 0x3D5 || 0 || Variable || 4 || ?
|-
| 0x800?03D6 || 0x3D6 || 0 || Variable || 4 || ?
|-
| 0x800?03D7 || 0x3D7 || 0 || Variable || 4 || ?
|-
| 0x200103D9 || 0x3D9 || 0 || 1 || 1 || SetTiledCacheTileSize
|-
| 0x80?003DE || 0x3DE || 0 || Variable || 4 || ?
|-
| 0x800003E0 || 0x3E0 || 0 || 0 || 4 || ?
|-
| 0x200203E7 || 0x3E7 || 0 || 2 || 1 || ?
|-
| 0x800003ED || 0x3ED || 0 || 0 || 4 || ?
|-
| 0x800203EE || 0x3EE || 0 || 2 || 4 || ?
|-
| 0x200403EF || 0x3EF || 0 || 4 || 1 || SetSampleMask
|-
| 0x800003F5 || 0x3F5 || 0 || 0 || 4 || ?
|-
| 0x800103F6 || 0x3F6 || 0 || 1 || 4 || ?
|-
| 0x200503F8 || 0x3F8 || 0 || 5 || 1 || ?
|-
| 0x200203FD || 0x3FD || 0 || 2 || 1 || ?
|-
| 0x2004040C || 0x40C || 0 || 4 || 1 || ?
|-
| 0x200C0420 || 0x420 || 0 || 12 || 1 || ?
|-
| 0x80000446 || 0x446 || 0 || 0 || 4 || ?
|-
| 0x80000451 || 0x451 || 0 || 0 || 4 || ?
|-
| 0x800?0452 || 0x452 || 0 || Variable || 4 || ?
|-
| 0x20100458 || 0x458 || 0 || 16 || 1 || ?
|-
| 0x20040478 || 0x478 || 0 || 4 || 1 || ?
|-
| 0x8000047C || 0x47C || 0 || 0 || 4 || ?
|-
| 0x8000047E || 0x47E || 0 || 0 || 4 || ?
|-
| 0x8001047F || 0x47F || 0 || 1 || 4 || ResolveDepthBuffer
|-
| 0x2003048A || 0x48A || 0 || 3 || 1 || ?
|-
| 0x800?04B3 || 0x4B3 || 0 || Variable || 4 || ?
|-
| 0x800104B9 || 0x4B9 || 0 || 1 || 4 || ?
|-
| 0x800?04BA || 0x4BA || 0 || Variable || 4 || ?
|-
| 0x800004BB || 0x4BB || 0 || 0 || 4 || ?
|-
| 0x800?04C3 || 0x4C3 || 0 || Variable || 4 || ?
|-
| 0x200104C4 || 0x4C4 || 0 || 1 || 1 || SetAlphaRef
|-
| 0x200404C7 || 0x4C7 || 0 || 4 || 1 || SetBlendColor
|-
| 0x800004E0 || 0x4E0 || 0 || 0 || 4 || ?
|-
| 0x800?04E5 || 0x4E5 || 0 || Variable || 4 || ?
|-
| 0x800?04E6 || 0x4E6 || 0 || Variable || 4 || ?
|-
| 0x800?04E7 || 0x4E7 || 0 || Variable || 4 || ?
|-
| 0x200204EC || 0x4EC || 0 || 2 || 1 || SetLineWidth
|-
| 0x800?050D || 0x50D || 0 || Variable || 4 || ?
|-
| 0x80000519 || 0x519 || 0 || 0 || 4 || ?
|-
| 0x80000540 || 0x540 || 0 || 0 || 4 || ?
|-
| 0x20010546 || 0x546 || 0 || 1 || 1 || SetPointSize
|-
| 0x2001054C || 0x54C || 0 || 1 || 1 || ResetCounter
|-
| 0x800?054E || 0x54E || 0 || Variable || 4 || ?
|-
| 0x20030554 || 0x554 || 0 || 3 || 1 || SetRenderEnableConditional
|-
| 0x800?0556 || 0x556 || 0 || Variable || 4 || SetRenderEnable?
|-
| 0x2001055B || 0x55B || 0 || 1 || 1 || ?
|-
| 0x2001056F || 0x56F || 0 || 1 || 1 || ?
|-
| 0x80000572 || 0x572 || 0 || 0 || 4 || ?
|-
| 0x800?0574 || 0x574 || 0 || Variable || 4 || ?
|-
| 0x8000057F || 0x57F || 0 || 0 || 4 || ?
|-
| 0x80000580 || 0x580 || 0 || 0 || 4 || ?
|-
| 0x80000591 || 0x591 || 0 || 0 || 4 || ?
|-
| 0x20010592 || 0x592 || 0 || 1 || 1 || ?
|-
| 0x200205F2 || 0x5F2 || 0 || 2 || 1 || ?
|-
| 0x800?05F6 || 0x5F6 || 0 || Variable || 4 || ?
|-
| 0x2001061F || 0x61F || 0 || 1 || 1 || ?
|-
| 0x800?0620 || 0x620 || 0 || Variable || 4 || ?
|-
| 0x80010646 || 0x646 || 0 || 1 || 4 || ?
|-
| 0x800?0648 || 0x648 || 0 || Variable || 4 || ?
|-
| 0x2001064F || 0x64F || 0 || 1 || 1 || SetDepthClamp
|-
| 0x800?066F || 0x66F || 0 || Variable || 4 || ?
|-
| 0x120020671 || 0x671 || 0 || 2 || 9 || ?
|-
| 0x20010674 || 0x674 || 0 || 1 || 1 || ?
|-
| 0x8000068B || 0x68B || 0 || 0 || 4 || ?
|-
| 0x200406C0 || 0x6C0 || 0 || 4 || 1 || ?
|-
| 0x20010703 || 0x703 || 0 || 1 || 1 || ?
|-
| 0x200207?? || 0x7?? Variable || 0 || 2 || 1 || ?
|-
| 0x80300830 || 0x830 || 0 || 48 || 4 || ?
|-
| 0x80400840 || 0x840 || 0 || 64 || 4 || ?
|-
| 0x80500850 || 0x850 || 0 || 80 || 4 || ?
|-
| 0x200308E0 || 0x8E0 || 0 || 3 || 1 || ?
|-
| 0x200308E3 || 0x8E3 || 0 || 3 || 1 || CB_POS(Const buffer position)
|-
| 0x200308E4 || 0x8E4 || 0 || 3 || 1 || ?
|-
| 0x80??0904 || 0x904 || 0 || Variable || 4 || ?
|-
| 0x80??090C || 0x90C || 0 || Variable || 4 || ?
|-
| 0x80??0914 || 0x914 || 0 || Variable || 4 || ?
|-
| 0x80??091C || 0x91C || 0 || Variable || 4 || ?
|-
| 0x80??0924 || 0x924 || 0 || Variable || 4 || ?
|-
| 0x80000D1E || 0xD1E || 0 || 0 || 4 || ?
|-
| 0x800?0D28 || 0xD28 || 0 || Variable || 4 || ?
|-
| 0x20010D29 || 0xD29 || 0 || 1 || 1 || ?
|-
| 0x20010D34 || 0xD34 || 0 || 1 || 1 || ?
|-
| 0xA0020E00 || 0xE00 || 0 || 2 || 5 || BeginTransformFeedback
|-
| 0x20010E02 || 0xE02 || 0 || 1 || 1 || ?
|-
| 0x80020E04 || 0xE04 || 0 || 2 || 4 || ?
|-
| 0x20010E06 || 0xE06 || 0 || 1 || 1 || ?
|-
| 0xA0030E0A || 0xE0A || 0 || 3 || 5 || ?
|-
| 0x80050E0C || 0xE0C || 0 || 5 || 4 || ?
|-
| 0x800?0E0E || 0xE0E || 0 || Variable || 4 || ?
|-
| 0x20010E10 || 0xE10 || 0 || 1 || 1 || ?
|-
| 0xA0040E12 || 0xE12 || 0 || 4 || 5 || ?
|-
| 0x20010E1A || 0xE1A || 0 || 1 || 1 || ?
|-
| 0xA0040E1C || 0xE1C || 0 || 4 || 5 || ?
|-
| 0x81900E1E || 0xE1E || 0 || 400 || 4 || ?
|-
| 0x80000E20 || 0xE20 || 0 || 0 || 4 || ?
|-
| 0x80000E24 || 0xE24 || 0 || 0 || 4 || ?
|-
| 0xA0040E2C || 0xE2C || 0 || 4 || 5 || PushDebugGroup
|-
| 0xA0020E2E || 0xE2E || 0 || 2 || 5 || PopDebugGroupId
|-
| 0xA0030E30 || 0xE30 || 0 || 3 || 5 || DrawArrays
|-
| 0xA0050E32 || 0xE32 || 0 || 5 || 5 || DrawArraysIndirect?
|-
| 0xA0050E34 || 0xE34 || 0 || 5 || 5 || DrawArraysInstanced?
|-
| 0xA0050E36 || 0xE36 || 0 || 5 || 5 || DrawElements
|-
| 0xA0060E38 || 0xE38 || 0 || 6 || 5 || DrawElementsIndirect?
|-
| 0xA0060E3A || 0xE3A || 0 || 6 || 5 || DrawElementsInstanced?
|-
| 0xA0050E42 || 0xE42 || 0 || 5 || 5 || ?
|-
| 0xA0060E44 || 0xE44 || 0 || 6 || 5 || ?
|}

Note: These still need to be heavily verified and ''could'' be wrong.

=== BindObject ===

In order to bind an engine object to a specific subchannel, method 0 (BindObject) must be used first. The target subchannel is specified in bits 15-13 of the command word.

After the engine object is bound to the desired subchannel, setting it's value in bits 15-13 of any subsequent command word will make PFIFO forward the command to the target engine.

This method only takes one argument, an [[#Engine_IDs|engine ID]].

==== Engine IDs ====

{| class="wikitable"
|-
! scope="col"| ID
! scope="col"| Engine
|-
|0x902D
|FERMI_TWOD_A (2D)
|-
|0xB197
|MAXWELL_B (3D)
|-
|0xB1C0
|MAXWELL_COMPUTE_B
|-
|0xA140
|KEPLER_INLINE_TO_MEMORY_B
|-
|0xB0B5
|MAXWELL_DMA_COPY_A (DMA)
|}

=== Macro ===

Macros are small programs that can be uploaded to the gpu and are capable of reading and writing to the 3D engine registers on the GPU. The macros also accepts parameters, stored on a FIFO. Macros can be called using methods starting at 0xe00, where the first method triggers the macro execution, and the second one is used to push parameters to the FIFO, that can be read from the macro program using a instruction called ''parm''. This instruction pops the FIFO and reads the next parameter, while also allowing programs to use a variable number of parameters if desired.

The first parameter is written to 0xe00 + n * 2 (where n is the macro index), and all subsequent parameters should be pushed to the FIFO using 0xe01 + n * 2. The first parameter is placed at the general purpose register R1 in the macro program when execution starts.

Official games uses those macros to conditionally write registers, one example of such uses is the macro at 0xe24, that is used to set shader registers (including shader address and binding the c1 Constant Buffer to the shader). In some cases, it's also used to set registers unconditionally.

=== Fences ===

Command lists can contain fences to ensure that commands are executed on the correct order, and subsequent commands are only sent when the previously sent commands were already processed by the GPU. Fences uses the QUERY_* commands, and works like this:

* First, QUERY_ADDRESS_HIGH and QUERY_ADDRESS_LOW commands are added to the Command List, with the High/Low 32 bits part of the 64-bits GPU Virtual Address where the fence is located. This GPU Virtual Address needs to be mapped to the process Virtual Address beforehand.
* Then, QUERY_SEQUENCE is added with a sequential number. This number is basically a incrementing counter, so the first Command List can have QUERY_SEQUENCE = 1, the next one QUERY_SEQUENCE = 2, 3, 4... and so on.
* Finally, QUERY_GET is added and contains the mode and other unknown data.

The above commands are added using the [[#Submission_mode|increasing mode]], since the Ids for all those 4 registers are sequential.

==== QUERY_GET Structure ====

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|1-0
|Mode
|-
|4
|Fence
|-
|15-12
|Unit
|}

==== QUERY_GET Mode ====

{| class="wikitable"
|-
! scope="col"| Value
! scope="col"| Mode
|-
|0
|Write
|-
|1
|Sync
|-
|2
|Write ?
|-
|3
|Write ?
|}

TODO: Move this to a separate page with all GPU Commands with descriptions. Also figure out what the other values mean.

Some of the other fields are still unknown/unobserved.

Official games will set Mode to 0, Fence to 1 and Unit to 0xF. The QUERY_SEQUENCE value is then written by the GPU to the address pointed to by QUERY_ADDRESS.
On the CPU side, the game code should wait until the value at the address pointed to by QUERY_ADDRESS is >= to the last written SEQUENCE value. Official code waits for this condition to be true on a loop, and won't send any further commands before that.

== Vertex Data Submission ==

Note: This is a observation on how the game Puyo Puyo Tetris sends textured squares to the GPU.

# VERTEX_ATTRIB_FORMAT (0-15) are set (only the first 3 are really used, the rest are set float, with Size = 1 and offset at 0).
# VERTEX_ARRAY_FETCH (0) is set with the lower 12 bits set to 0x1c (Stride) and bit 12 to 1 (Enabled).
# VERTEX_ARRAY_START_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located.
# VERTEX_ARRAY_LIMIT_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located, plus the Vertex Data size in bytes minus 1.
# VERTEX_BEGIN_GL is used with the primitive type set to TRIANGLE_STRIP.
# VERTEX_BUFFER_FIRST with value 0 (indicating the index of the first primitive to render?).
# VERTEX_BUFFER_COUNT is set to 4, because the Vertex Buffer with the square has 4 vertices.
# VERTEX_END_GL is used with value 0 (currently unknown what this value means).

== Texture View ==

Texture information such as address, format and size is sent to the GPU through a structure know as Texture View (a.k.a. Texture Image Control, or TIC). Each texture that the game uses needs a separate TIC, and those TICs are written to a table, one after the other. Each [[#TIC_Structure|TIC entry]] has 0x20 bytes, and is composed of 8 32-bits words where the texture information is packed.

The index of the TIC entries that should be used by the shader is sent to the GPU with the CB_POS/CB_DATA (0) methods. Games usually follows the following steps to write the TIC entry indexes:

* Macro 0xe1a is used to set CB_ADDRESS_HIGH/LOW registers to the GPU Virtual Address of the Constant Buffer set on the register 0x982 (the ''Texture Constant Buffer'' index register), and also sets CB_SIZE.
* CB_POS is used to set the write offset of the Constant Buffer to n * 4, where ''n'' is the index of the ''Handle'' being used on the shader program (this index starts at 8, so CB_POS should be at least 8 * 4 = 0x20).
* CB_DATA (0) method is used to write the value into the Constant Buffer. The value is a ''Handle'' where the lower 20 bits is the TIC index, and the higher 12 bits is the TSC (Texture Sampler Control) index.

The address of a given TIC entry can be calculates as:

tic_entry_address = tic_base_address + tic_index * 0x20

Where ''tic_base_address'' is the address written to TIC_ADDRESS_HIGH/LOW (methods 0x1574 and 0x1578), ''tic_index'' is the lower 20 bits of the word written into the Const Buffer with CB_DATA (0), and 0x20 is the size of each TIC entry in bytes.

The texture is accessed on the shader using one of the texture sampling instructions (usually the TEXS instruction). One of the parameters for this instruction is the ''Handle'' index. This index start at 8, so the index 8 will access the handle at 8 * 4 = 0x20 on the ''Texture Constant Buffer''. Each shader stage has a separate Constant Buffer, so for fragment shaders, this is located at CB_ADDRESS + 4 * CB_SIZE + TEXS_index * 4 (where the first 4 is the index of the fragment shader stage, and the second 4 is the size of a word, 4 bytes).

=== TIC Structure ===

{| class="wikitable" border="1"
|-
! Word || Bits || Description
|-
| 0 || 6-0 || [[GPU_Texture_Formats#Texture_Formats|Texture Format]]
|-
| 0 || 9-7 || [[#Channel_Data_Type|R Channel Data Type]]
|-
| 0 || 12-10 || [[#Channel_Data_Type|G Channel Data Type]]
|-
| 0 || 15-13 || [[#Channel_Data_Type|B Channel Data Type]]
|-
| 0 || 18-16 || [[#Channel_Data_Type|A Channel Data Type]]
|-
| 1 || 31-0 || Lower 32-bits of the Texture GPU Virtual Address
|-
| 2 || 15-0 || Higher 16-bits of the Texture GPU Virtual Address
|-
| 4 || 15-0 || Texture Width minus 1
|-
| 5 || 15-0 || Texture Height minus 1
|}

==== Channel Data Type ====

{| class="wikitable" border="1"
|-
! Value || Type
|-
| 1 || SNORM
|-
| 2 || UNORM
|-
| 3 || SINT
|-
| 4 || UINT
|-
| 5 || SNORM_FORCE_FP16
|-
| 6 || UNORM_FORCE_FP16
|-
| 7 || FLOAT
|}

== References ==

FIFO engine overview:
[https://envytools.readthedocs.io/en/latest/hw/fifo/intro.html]

Method values from the Fermi family GPU (a bit older than the Tegra X1, but values seems to be mostly the same):
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gf100_3d.xml]

TIC structure used on a Maxwell GPU:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gm200_texture.xml]

Values for some types used on the above XML:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/nv_3ddefs.xml]

Command word packing code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_winsys.h]

TIC entry pack/write code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_tex.c#n65]

GPU

2018-03-30T19:32:39Z

Gdkchan:

== Mapping Memory ==

First, to map a memory region on the GPU Address Space, caching needs to be disabled by using [[SVC#svcSetMemoryAttribute|svcSetMemoryAttribute]]. The Address passed is the Virtual Address of the region that will be mapped, the size is the region size, and State0/1 are both set to 8 to disable caching of the memory region. This is done to ensure that the GPU can actually "see" the data written there, and it doesn't get stuck on some cache.

Then, [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]] is used to create a nvmap object with the desired size. After, [[NV_services#NVMAP_IOC_ALLOC|NVMAP_IOC_ALLOC]] is used to allocate the memory on the GPU Address Space, and map data on the process Address Space into the GPU Address Space, by passing the Virtual Address as the input addr parameter, and also the Handle returned from [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]]. Lastly, the actual mapping is done by using [[NV_services#NVGPU_AS_IOCTL_MAP_BUFFER_EX|NVGPU_AS_IOCTL_MAP_BUFFER_EX]], and the GPU Virtual Address is returned on the offset parameter. It's also possible to manually set the offset where the mapping should be made on the GPU Address Space, by passing the address on the "offset" parameter, and setting the bit 0 of the flags parameter to 1. However, for this to work, the desired GPU Virtual Address needs to be previously reserved using [[NV_services#NVGPU_AS_IOCTL_ALLOC_SPACE|NVGPU_AS_IOCTL_ALLOC_SPACE]].

The above process is used to map all data that will be used by the GPU, like Textures, Command Lists (a.k.a. Push Buffers), Vertex/Index buffers and Shaders. They usually have their own mapping, but Command Lists can share the same mapping.

== FIFO Commands ==

The GPU implements a variation of Tegra's push buffer format for it's PFIFO engine. PFIFO is a special engine responsible for receiving user command lists and routing them to the appropriate engines (2D, 3D, DMA).

Commands are submitted to the GPU's PFIFO engine through [[NV_services#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]].

This ioctl takes an array of gpfifo entries where each entry points to a FIFO command list. This list is composed of alternating 32-bit words containing FIFO commands and their respective arguments.

=== Command Structure ===

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|12-0
|Method
|-
|15-13
|Subchannel
|-
|27-16
|Argument count (in 32-bits Words) or inline data (see below)
|-
|28?
|Hmm?
|-
|31-29
|[[#Submission_mode|Submission mode]]
|}

Note: Methods are treated as 4-byte addressable locations, and hence their numbers are written down multiplied by 4.

Note: The command's arguments, when present, follow the command word immediately.

==== Submission mode ====

{| class="wikitable"
|-
! scope="col"| Mode
! scope="col"| Description
! scope="col"| Offical name
|-
|0
|Increasing mode (old)
|
|-
|1
|Increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count''', while automatically incrementing the '''method''' value. This means that each argument will be written to a different method location.
|INCR
|-
|2
|Non-increasing mode (old)
|
|-
|3
|Non-increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count'''. However, all arguments will be written to the same method location.
|NONINCR
|-
|4
|Inline mode - Tells PFIFO to read '''inline data''' from bits 28-16 of the command word, thus eliminating the need to pass additional words for the arguments.
|IMM
|-
|5
|Increase-once mode - Tells PFIFO to read as much arguments as specified by '''argument count''' and automatically increments the '''method''' value once only.
|
|}

=== Command List ===

All methods with values < 0x100 are special and executed by the PFIFO's DMA puller. The others are forwarded to the engine object currently bound to a given subchannel.

{| class="wikitable" border="1"
|-
! Command || Method || Subchannel || Arg Count || Mode || Name
|-
| 0x2001?000 || 0x0000 || Variable || 1 || 1 || [[#BindObject|BindObject]]
|-
| 0x80000040 || 0x40 || 0 || 0 || 4 || ?
|-
| 0xA???0045 || 0x45 || 0 || Variable || 5 || SetGraphMacroCode
|-
| 0x20020047 || 0x47 || 0 || 2 || 1 || SetGraphMacroEntry
|-
| 0x800?0049 || 0x49 || 0 || Variable || 4 || ?
|-
| 0x20056080 || 0x80 || 3 || Variable || 1 || ?
|-
| 0x20016085 || 0x85 || 3 || 1 || 1 || ?
|-
| 0x20026086 || 0x86 || 3 || 2 || 1 || ?
|-
| 0x20026088 || 0x88 || 3 || 2 || 1 || ?
|-
| 0x2004608C || 0x8C || 3 || Variable || 1 || ?
|-
| 0x20016091 || 0x91 || 3 || 1 || 1 || ?
|-
| 0x20026092 || 0x92 || 3 || 2 || 1 || ?
|-
| 0x20026094 || 0x94 || 3 || 2 || 1 || ?
|-
| 0x800160B5 || 0xB5 || 3 || 1 || 4 || ?
|-
| 0x800000BA || 0xBA || 0 || 0 || 4 || ?
|-
| 0x601000BE || 0xBE || 0 || 16 || 3 || ?
|-
| 0x200100BF || 0xBF || 0 || 1 || 1 || ?
|-
| 0x200180C0 || 0xC0 || 4 || 1 || 1 || ?
|-
| 0x200400C9 || 0xC9 || 0 || 4 || 1 || SetOuterTessellationLevels
|-
| 0x200200CD || 0xCD || 0 || 2 || 1 || SetInnerTessellationLevels
|-
| 0x200100DC || 0xDC || 0 || 1 || 1 || ?
|-
| 0x800?00DF || 0xDF || 0 || Variable || 4 || SetRasterizerDiscard?
|-
| 0x20048100 || 0x100 || 4 || 4 || 1 || ?
|-
| 0x20028102 || 0x102 || 4 || 2 || 1 || ?
|-
| 0x20018104 || 0x104 || 4 || 1 || 1 || ?
|-
| 0x20018105 || 0x105 || 4 || 1 || 1 || ?
|-
| 0x20018106 || 0x106 || 4 || 1 || 1 || ?
|-
| 0x200181C0 || 0x1C0 || 4 || 1 || 1 || ?
|-
| 0x200181C2 || 0x1C2 || 4 || 1 || 1 || ?
|-
| 0x200181C3 || 0x1C3 || 4 || 1 || 1 || ?
|-
| 0x200281C4 || 0x1C4 || 4 || 2 || 1 || ?
|-
| 0x200181C5 || 0x1C5 || 4 || 1 || 1 || ?
|-
| 0x200181C6 || 0x1C6 || 4 || 1 || 1 || ?
|-
| 0x200181C7 || 0x1C7 || 4 || 1 || 1 || ?
|-
| 0x200181C8 || 0x1C8 || 4 || 1 || 1 || ?
|-
| 0x200181CA || 0x1CA || 4 || 1 || 1 || ?
|-
| 0x200181CB || 0x1CB || 4 || 1 || 1 || ?
|-
| 0x200181CC || 0x1CC || 4 || 1 || 1 || ?
|-
| 0x200181CD || 0x1CD || 4 || 1 || 1 || ?
|-
| 0x200181CF || 0x1CF || 4 || 1 || 1 || ?
|-
| 0x800001D1 || 0x1D1 || 0 || 0 || 4 || ?
|-
| 0x200301F0 || 0x1F0 || 0 || 3 || 1 || ?
|-
| 0x800001F3 || 0x1F3 || 0 || 0 || 4 || ?
|-
| 0x200201F8 || 0x1F8 || 0 || 2 || 1 || ?
|-
| 0x200401FA || 0x1FA || 0 || 4 || 1 || ?
|-
| 0x20016223 || 0x223 || 3 || 1 || 1 || ?
|-
| 0x2004622C || 0x22C || 3 || 4 || 1 || ?
|-
| 0x20046230 || 0x230 || 3 || 4 || 1 || ?
|-
| 0x20046234 || 0x234 || 3 || 4 || 1 || ?
|-
| 0x200203?? || 0x3?? Variable || 0 || 2 || 1 || SetScissors?
|-
| 0x20040360 || 0x360 || 0 || 4 || 1 || ?
|-
| 0x20010364 || 0x364 || 0 || 1 || 1 || ?
|-
| 0x800?0368 || 0x368 || 0 || Variable || 4 || ?
|-
| 0x800?036B || 0x36B || 0 || Variable || 4 || ?
|-
| 0x800?036C || 0x36C || 0 || Variable || 4 || ?
|-
| 0x2001036F || 0x36F || 0 || 1 || 1 || ?
|-
| 0x80000370 || 0x370 || 0 || 0 || 4 || ?
|-
| 0x80000371 || 0x371 || 0 || 0 || 4 || ?
|-
| 0x80000372 || 0x372 || 0 || 0 || 4 || ?
|-
| 0x8???0373 || 0x373 || 0 || Variable || 4 || SetPatchSize
|-
| 0x80000374 || 0x374 || 0 || 0 || 4 || ?
|-
| 0x20010376 || 0x376 || 0 || 1 || 1 || ?
|-
| 0x800?03D5 || 0x3D5 || 0 || Variable || 4 || ?
|-
| 0x800?03D6 || 0x3D6 || 0 || Variable || 4 || ?
|-
| 0x800?03D7 || 0x3D7 || 0 || Variable || 4 || ?
|-
| 0x200103D9 || 0x3D9 || 0 || 1 || 1 || SetTiledCacheTileSize
|-
| 0x80?003DE || 0x3DE || 0 || Variable || 4 || ?
|-
| 0x800003E0 || 0x3E0 || 0 || 0 || 4 || ?
|-
| 0x200203E7 || 0x3E7 || 0 || 2 || 1 || ?
|-
| 0x800003ED || 0x3ED || 0 || 0 || 4 || ?
|-
| 0x800203EE || 0x3EE || 0 || 2 || 4 || ?
|-
| 0x200403EF || 0x3EF || 0 || 4 || 1 || SetSampleMask
|-
| 0x800003F5 || 0x3F5 || 0 || 0 || 4 || ?
|-
| 0x800103F6 || 0x3F6 || 0 || 1 || 4 || ?
|-
| 0x200503F8 || 0x3F8 || 0 || 5 || 1 || ?
|-
| 0x200203FD || 0x3FD || 0 || 2 || 1 || ?
|-
| 0x2004040C || 0x40C || 0 || 4 || 1 || ?
|-
| 0x200C0420 || 0x420 || 0 || 12 || 1 || ?
|-
| 0x80000446 || 0x446 || 0 || 0 || 4 || ?
|-
| 0x80000451 || 0x451 || 0 || 0 || 4 || ?
|-
| 0x800?0452 || 0x452 || 0 || Variable || 4 || ?
|-
| 0x20100458 || 0x458 || 0 || 16 || 1 || ?
|-
| 0x20040478 || 0x478 || 0 || 4 || 1 || ?
|-
| 0x8000047C || 0x47C || 0 || 0 || 4 || ?
|-
| 0x8000047E || 0x47E || 0 || 0 || 4 || ?
|-
| 0x8001047F || 0x47F || 0 || 1 || 4 || ResolveDepthBuffer
|-
| 0x2003048A || 0x48A || 0 || 3 || 1 || ?
|-
| 0x800?04B3 || 0x4B3 || 0 || Variable || 4 || ?
|-
| 0x800104B9 || 0x4B9 || 0 || 1 || 4 || ?
|-
| 0x800?04BA || 0x4BA || 0 || Variable || 4 || ?
|-
| 0x800004BB || 0x4BB || 0 || 0 || 4 || ?
|-
| 0x800?04C3 || 0x4C3 || 0 || Variable || 4 || ?
|-
| 0x200104C4 || 0x4C4 || 0 || 1 || 1 || SetAlphaRef
|-
| 0x200404C7 || 0x4C7 || 0 || 4 || 1 || SetBlendColor
|-
| 0x800004E0 || 0x4E0 || 0 || 0 || 4 || ?
|-
| 0x800?04E5 || 0x4E5 || 0 || Variable || 4 || ?
|-
| 0x800?04E6 || 0x4E6 || 0 || Variable || 4 || ?
|-
| 0x800?04E7 || 0x4E7 || 0 || Variable || 4 || ?
|-
| 0x200204EC || 0x4EC || 0 || 2 || 1 || SetLineWidth
|-
| 0x800?050D || 0x50D || 0 || Variable || 4 || ?
|-
| 0x80000519 || 0x519 || 0 || 0 || 4 || ?
|-
| 0x80000540 || 0x540 || 0 || 0 || 4 || ?
|-
| 0x20010546 || 0x546 || 0 || 1 || 1 || SetPointSize
|-
| 0x2001054C || 0x54C || 0 || 1 || 1 || ResetCounter
|-
| 0x800?054E || 0x54E || 0 || Variable || 4 || ?
|-
| 0x20030554 || 0x554 || 0 || 3 || 1 || SetRenderEnableConditional
|-
| 0x800?0556 || 0x556 || 0 || Variable || 4 || SetRenderEnable?
|-
| 0x2001055B || 0x55B || 0 || 1 || 1 || ?
|-
| 0x2001056F || 0x56F || 0 || 1 || 1 || ?
|-
| 0x80000572 || 0x572 || 0 || 0 || 4 || ?
|-
| 0x800?0574 || 0x574 || 0 || Variable || 4 || ?
|-
| 0x8000057F || 0x57F || 0 || 0 || 4 || ?
|-
| 0x80000580 || 0x580 || 0 || 0 || 4 || ?
|-
| 0x80000591 || 0x591 || 0 || 0 || 4 || ?
|-
| 0x20010592 || 0x592 || 0 || 1 || 1 || ?
|-
| 0x200205F2 || 0x5F2 || 0 || 2 || 1 || ?
|-
| 0x800?05F6 || 0x5F6 || 0 || Variable || 4 || ?
|-
| 0x2001061F || 0x61F || 0 || 1 || 1 || ?
|-
| 0x800?0620 || 0x620 || 0 || Variable || 4 || ?
|-
| 0x80010646 || 0x646 || 0 || 1 || 4 || ?
|-
| 0x800?0648 || 0x648 || 0 || Variable || 4 || ?
|-
| 0x2001064F || 0x64F || 0 || 1 || 1 || SetDepthClamp
|-
| 0x800?066F || 0x66F || 0 || Variable || 4 || ?
|-
| 0x120020671 || 0x671 || 0 || 2 || 9 || ?
|-
| 0x20010674 || 0x674 || 0 || 1 || 1 || ?
|-
| 0x8000068B || 0x68B || 0 || 0 || 4 || ?
|-
| 0x200406C0 || 0x6C0 || 0 || 4 || 1 || ?
|-
| 0x20010703 || 0x703 || 0 || 1 || 1 || ?
|-
| 0x200207?? || 0x7?? Variable || 0 || 2 || 1 || ?
|-
| 0x80300830 || 0x830 || 0 || 48 || 4 || ?
|-
| 0x80400840 || 0x840 || 0 || 64 || 4 || ?
|-
| 0x80500850 || 0x850 || 0 || 80 || 4 || ?
|-
| 0x200308E0 || 0x8E0 || 0 || 3 || 1 || ?
|-
| 0x200308E3 || 0x8E3 || 0 || 3 || 1 || CB_POS(Const buffer position)
|-
| 0x200308E4 || 0x8E4 || 0 || 3 || 1 || ?
|-
| 0x80??0904 || 0x904 || 0 || Variable || 4 || ?
|-
| 0x80??090C || 0x90C || 0 || Variable || 4 || ?
|-
| 0x80??0914 || 0x914 || 0 || Variable || 4 || ?
|-
| 0x80??091C || 0x91C || 0 || Variable || 4 || ?
|-
| 0x80??0924 || 0x924 || 0 || Variable || 4 || ?
|-
| 0x80000D1E || 0xD1E || 0 || 0 || 4 || ?
|-
| 0x800?0D28 || 0xD28 || 0 || Variable || 4 || ?
|-
| 0x20010D29 || 0xD29 || 0 || 1 || 1 || ?
|-
| 0x20010D34 || 0xD34 || 0 || 1 || 1 || ?
|-
| 0xA0020E00 || 0xE00 || 0 || 2 || 5 || BeginTransformFeedback
|-
| 0x20010E02 || 0xE02 || 0 || 1 || 1 || ?
|-
| 0x80020E04 || 0xE04 || 0 || 2 || 4 || ?
|-
| 0x20010E06 || 0xE06 || 0 || 1 || 1 || ?
|-
| 0xA0030E0A || 0xE0A || 0 || 3 || 5 || ?
|-
| 0x80050E0C || 0xE0C || 0 || 5 || 4 || ?
|-
| 0x800?0E0E || 0xE0E || 0 || Variable || 4 || ?
|-
| 0x20010E10 || 0xE10 || 0 || 1 || 1 || ?
|-
| 0xA0040E12 || 0xE12 || 0 || 4 || 5 || ?
|-
| 0x20010E1A || 0xE1A || 0 || 1 || 1 || ?
|-
| 0xA0040E1C || 0xE1C || 0 || 4 || 5 || ?
|-
| 0x81900E1E || 0xE1E || 0 || 400 || 4 || ?
|-
| 0x80000E20 || 0xE20 || 0 || 0 || 4 || ?
|-
| 0x80000E24 || 0xE24 || 0 || 0 || 4 || ?
|-
| 0xA0040E2C || 0xE2C || 0 || 4 || 5 || PushDebugGroup
|-
| 0xA0020E2E || 0xE2E || 0 || 2 || 5 || PopDebugGroupId
|-
| 0xA0030E30 || 0xE30 || 0 || 3 || 5 || DrawArrays
|-
| 0xA0050E32 || 0xE32 || 0 || 5 || 5 || DrawArraysIndirect?
|-
| 0xA0050E34 || 0xE34 || 0 || 5 || 5 || DrawArraysInstanced?
|-
| 0xA0050E36 || 0xE36 || 0 || 5 || 5 || DrawElements
|-
| 0xA0060E38 || 0xE38 || 0 || 6 || 5 || DrawElementsIndirect?
|-
| 0xA0060E3A || 0xE3A || 0 || 6 || 5 || DrawElementsInstanced?
|-
| 0xA0050E42 || 0xE42 || 0 || 5 || 5 || ?
|-
| 0xA0060E44 || 0xE44 || 0 || 6 || 5 || ?
|}

Note: These still need to be heavily verified and ''could'' be wrong.

=== BindObject ===

In order to bind an engine object to a specific subchannel, method 0 (BindObject) must be used first. The target subchannel is specified in bits 15-13 of the command word.

After the engine object is bound to the desired subchannel, setting it's value in bits 15-13 of any subsequent command word will make PFIFO forward the command to the target engine.

This method only takes one argument, an [[#Engine_IDs|engine ID]].

==== Engine IDs ====

{| class="wikitable"
|-
! scope="col"| ID
! scope="col"| Engine
|-
|0x902D
|FERMI_TWOD_A (2D)
|-
|0xB197
|MAXWELL_B (3D)
|-
|0xB1C0
|MAXWELL_COMPUTE_B
|-
|0xA140
|KEPLER_INLINE_TO_MEMORY_B
|-
|0xB0B5
|MAXWELL_DMA_COPY_A (DMA)
|}

=== Macro ===

Macros are small programs that can be uploaded to the gpu and are capable of reading and writing to the 3D engine registers on the GPU. The macros also accepts parameters, stored on a FIFO. Macros can be called using methods starting at 0xe00, where the first method triggers the macro execution, and the second one is used to push parameters to the FIFO, that can be read from the macro program using a instruction called ''parm''. This instruction pops the FIFO and reads the next parameter, while also allowing programs to use a variable number of parameters if desired.

The first parameter is written to 0xe00 + n * 2 (where n is the macro index), and all subsequent parameters should be pushed to the FIFO using 0xe01 + n * 2. The first parameter is placed at the general purpose register R1 in the shader program when execution starts.

Official games uses those macros to conditionally write registers, one example of such uses is the macro at 0xe24, that is used to set shader registers (including shader address and binding the c1 Constant Buffer to the shader). In some cases, it's also used to set registers unconditionally.

=== Fences ===

Command lists can contain fences to ensure that commands are executed on the correct order, and subsequent commands are only sent when the previously sent commands were already processed by the GPU. Fences uses the QUERY_* commands, and works like this:

* First, QUERY_ADDRESS_HIGH and QUERY_ADDRESS_LOW commands are added to the Command List, with the High/Low 32 bits part of the 64-bits GPU Virtual Address where the fence is located. This GPU Virtual Address needs to be mapped to the process Virtual Address beforehand.
* Then, QUERY_SEQUENCE is added with a sequential number. This number is basically a incrementing counter, so the first Command List can have QUERY_SEQUENCE = 1, the next one QUERY_SEQUENCE = 2, 3, 4... and so on.
* Finally, QUERY_GET is added and contains the mode and other unknown data.

The above commands are added using the [[#Submission_mode|increasing mode]], since the Ids for all those 4 registers are sequential.

==== QUERY_GET Structure ====

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|1-0
|Mode
|-
|4
|Fence
|-
|15-12
|Unit
|}

==== QUERY_GET Mode ====

{| class="wikitable"
|-
! scope="col"| Value
! scope="col"| Mode
|-
|0
|Write
|-
|1
|Sync
|-
|2
|Write ?
|-
|3
|Write ?
|}

TODO: Move this to a separate page with all GPU Commands with descriptions. Also figure out what the other values mean.

Some of the other fields are still unknown/unobserved.

Official games will set Mode to 0, Fence to 1 and Unit to 0xF. The QUERY_SEQUENCE value is then written by the GPU to the address pointed to by QUERY_ADDRESS.
On the CPU side, the game code should wait until the value at the address pointed to by QUERY_ADDRESS is >= to the last written SEQUENCE value. Official code waits for this condition to be true on a loop, and won't send any further commands before that.

== Vertex Data Submission ==

Note: This is a observation on how the game Puyo Puyo Tetris sends textured squares to the GPU.

# VERTEX_ATTRIB_FORMAT (0-15) are set (only the first 3 are really used, the rest are set float, with Size = 1 and offset at 0).
# VERTEX_ARRAY_FETCH (0) is set with the lower 12 bits set to 0x1c (Stride) and bit 12 to 1 (Enabled).
# VERTEX_ARRAY_START_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located.
# VERTEX_ARRAY_LIMIT_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located, plus the Vertex Data size in bytes minus 1.
# VERTEX_BEGIN_GL is used with the primitive type set to TRIANGLE_STRIP.
# VERTEX_BUFFER_FIRST with value 0 (indicating the index of the first primitive to render?).
# VERTEX_BUFFER_COUNT is set to 4, because the Vertex Buffer with the square has 4 vertices.
# VERTEX_END_GL is used with value 0 (currently unknown what this value means).

== Texture View ==

Texture information such as address, format and size is sent to the GPU through a structure know as Texture View (a.k.a. Texture Image Control, or TIC). Each texture that the game uses needs a separate TIC, and those TICs are written to a table, one after the other. Each [[#TIC_Structure|TIC entry]] has 0x20 bytes, and is composed of 8 32-bits words where the texture information is packed.

The index of the TIC entries that should be used by the shader is sent to the GPU with the CB_POS/CB_DATA (0) methods. Games usually follows the following steps to write the TIC entry indexes:

* Macro 0xe1a is used to set CB_ADDRESS_HIGH/LOW registers to the GPU Virtual Address of the Constant Buffer set on the register 0x982 (the ''Texture Constant Buffer'' index register), and also sets CB_SIZE.
* CB_POS is used to set the write offset of the Constant Buffer to 0x20 + n * 4, where ''n'' is the index of the ''Handle'' being used on the shader sampler.
* CB_DATA (0) method is used to write the value into the Constant Buffer. The value is a ''Handle'' where the lower 20 bits is the TIC index, and the higher 12 bits is the TSC (Texture Sampler Control) index.

The address of a given TIC entry can be calculates as:

tic_entry_address = tic_base_address + tic_index * 0x20

Where ''tic_base_address'' is the address written to TIC_ADDRESS_HIGH/LOW (methods 0x1574 and 0x1578), ''tic_index'' is the lower 20 bits of the word written into the Const Buffer with CB_DATA (0), and 0x20 is the size of each TIC entry in bytes.

The texture is accessed on the shader using one of the texture sampling instructions (usually the TEXS instruction). One of the parameters for this instruction is the ''Handle'' index. This index start at 8, so the index 8 will access the handle at 8 * 4 = 0x20 on the ''Texture Constant Buffer''. Each shader stage has a separate Constant Buffer, so for fragment shaders, this is located at CB_ADDRESS + 4 * CB_SIZE + TEXS_index * 4 (where the first 4 is the index of the fragment shader stage, and the second 4 is the size of a word, 4 bytes).

=== TIC Structure ===

{| class="wikitable" border="1"
|-
! Word || Bits || Description
|-
| 0 || 6-0 || [[GPU_Texture_Formats#Texture_Formats|Texture Format]]
|-
| 0 || 9-7 || [[#Channel_Data_Type|R Channel Data Type]]
|-
| 0 || 12-10 || [[#Channel_Data_Type|G Channel Data Type]]
|-
| 0 || 15-13 || [[#Channel_Data_Type|B Channel Data Type]]
|-
| 0 || 18-16 || [[#Channel_Data_Type|A Channel Data Type]]
|-
| 1 || 31-0 || Lower 32-bits of the Texture GPU Virtual Address
|-
| 2 || 15-0 || Higher 16-bits of the Texture GPU Virtual Address
|-
| 4 || 15-0 || Texture Width minus 1
|-
| 5 || 15-0 || Texture Height minus 1
|}

==== Channel Data Type ====

{| class="wikitable" border="1"
|-
! Value || Type
|-
| 1 || SNORM
|-
| 2 || UNORM
|-
| 3 || SINT
|-
| 4 || UINT
|-
| 5 || SNORM_FORCE_FP16
|-
| 6 || UNORM_FORCE_FP16
|-
| 7 || FLOAT
|}

== References ==

FIFO engine overview:
[https://envytools.readthedocs.io/en/latest/hw/fifo/intro.html]

Method values from the Fermi family GPU (a bit older than the Tegra X1, but values seems to be mostly the same):
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gf100_3d.xml]

TIC structure used on a Maxwell GPU:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gm200_texture.xml]

Values for some types used on the above XML:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/nv_3ddefs.xml]

Command word packing code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_winsys.h]

TIC entry pack/write code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_tex.c#n65]

GPU

2018-03-30T15:12:50Z

Gdkchan:

== Mapping Memory ==

First, to map a memory region on the GPU Address Space, caching needs to be disabled by using [[SVC#svcSetMemoryAttribute|svcSetMemoryAttribute]]. The Address passed is the Virtual Address of the region that will be mapped, the size is the region size, and State0/1 are both set to 8 to disable caching of the memory region. This is done to ensure that the GPU can actually "see" the data written there, and it doesn't get stuck on some cache.

Then, [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]] is used to create a nvmap object with the desired size. After, [[NV_services#NVMAP_IOC_ALLOC|NVMAP_IOC_ALLOC]] is used to allocate the memory on the GPU Address Space, and map data on the process Address Space into the GPU Address Space, by passing the Virtual Address as the input addr parameter, and also the Handle returned from [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]]. Lastly, the actual mapping is done by using [[NV_services#NVGPU_AS_IOCTL_MAP_BUFFER_EX|NVGPU_AS_IOCTL_MAP_BUFFER_EX]], and the GPU Virtual Address is returned on the offset parameter. It's also possible to manually set the offset where the mapping should be made on the GPU Address Space, by passing the address on the "offset" parameter, and setting the bit 0 of the flags parameter to 1. However, for this to work, the desired GPU Virtual Address needs to be previously reserved using [[NV_services#NVGPU_AS_IOCTL_ALLOC_SPACE|NVGPU_AS_IOCTL_ALLOC_SPACE]].

The above process is used to map all data that will be used by the GPU, like Textures, Command Lists (a.k.a. Push Buffers), Vertex/Index buffers and Shaders. They usually have their own mapping, but Command Lists can share the same mapping.

== FIFO Commands ==

The GPU implements a variation of Tegra's push buffer format for it's PFIFO engine. PFIFO is a special engine responsible for receiving user command lists and routing them to the appropriate engines (2D, 3D, DMA).

Commands are submitted to the GPU's PFIFO engine through [[NV_services#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]].

This ioctl takes an array of gpfifo entries where each entry points to a FIFO command list. This list is composed of alternating 32-bit words containing FIFO commands and their respective arguments.

=== Command Structure ===

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|12-0
|Method
|-
|15-13
|Subchannel
|-
|27-16
|Argument count (in 32-bits Words) or inline data (see below)
|-
|28?
|Hmm?
|-
|31-29
|[[#Submission_mode|Submission mode]]
|}

Note: Methods are treated as 4-byte addressable locations, and hence their numbers are written down multiplied by 4.

Note: The command's arguments, when present, follow the command word immediately.

==== Submission mode ====

{| class="wikitable"
|-
! scope="col"| Mode
! scope="col"| Description
! scope="col"| Offical name
|-
|0
|Increasing mode (old)
|
|-
|1
|Increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count''', while automatically incrementing the '''method''' value. This means that each argument will be written to a different method location.
|INCR
|-
|2
|Non-increasing mode (old)
|
|-
|3
|Non-increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count'''. However, all arguments will be written to the same method location.
|NONINCR
|-
|4
|Inline mode - Tells PFIFO to read '''inline data''' from bits 28-16 of the command word, thus eliminating the need to pass additional words for the arguments.
|IMM
|-
|5
|Increase-once mode - Tells PFIFO to read as much arguments as specified by '''argument count''' and automatically increments the '''method''' value once only.
|
|}

=== Command List ===

All methods with values < 0x100 are special and executed by the PFIFO's DMA puller. The others are forwarded to the engine object currently bound to a given subchannel.

{| class="wikitable" border="1"
|-
! Command || Method || Subchannel || Arg Count || Mode || Name
|-
| 0x2001?000 || 0x0000 || Variable || 1 || 1 || [[#BindObject|BindObject]]
|-
| 0x80000040 || 0x40 || 0 || 0 || 4 || ?
|-
| 0xA???0045 || 0x45 || 0 || Variable || 5 || SetGraphMacroCode
|-
| 0x20020047 || 0x47 || 0 || 2 || 1 || SetGraphMacroEntry
|-
| 0x800?0049 || 0x49 || 0 || Variable || 4 || ?
|-
| 0x20056080 || 0x80 || 3 || Variable || 1 || ?
|-
| 0x20016085 || 0x85 || 3 || 1 || 1 || ?
|-
| 0x20026086 || 0x86 || 3 || 2 || 1 || ?
|-
| 0x20026088 || 0x88 || 3 || 2 || 1 || ?
|-
| 0x2004608C || 0x8C || 3 || Variable || 1 || ?
|-
| 0x20016091 || 0x91 || 3 || 1 || 1 || ?
|-
| 0x20026092 || 0x92 || 3 || 2 || 1 || ?
|-
| 0x20026094 || 0x94 || 3 || 2 || 1 || ?
|-
| 0x800160B5 || 0xB5 || 3 || 1 || 4 || ?
|-
| 0x800000BA || 0xBA || 0 || 0 || 4 || ?
|-
| 0x601000BE || 0xBE || 0 || 16 || 3 || ?
|-
| 0x200100BF || 0xBF || 0 || 1 || 1 || ?
|-
| 0x200180C0 || 0xC0 || 4 || 1 || 1 || ?
|-
| 0x200400C9 || 0xC9 || 0 || 4 || 1 || SetOuterTessellationLevels
|-
| 0x200200CD || 0xCD || 0 || 2 || 1 || SetInnerTessellationLevels
|-
| 0x200100DC || 0xDC || 0 || 1 || 1 || ?
|-
| 0x800?00DF || 0xDF || 0 || Variable || 4 || SetRasterizerDiscard?
|-
| 0x20048100 || 0x100 || 4 || 4 || 1 || ?
|-
| 0x20028102 || 0x102 || 4 || 2 || 1 || ?
|-
| 0x20018104 || 0x104 || 4 || 1 || 1 || ?
|-
| 0x20018105 || 0x105 || 4 || 1 || 1 || ?
|-
| 0x20018106 || 0x106 || 4 || 1 || 1 || ?
|-
| 0x200181C0 || 0x1C0 || 4 || 1 || 1 || ?
|-
| 0x200181C2 || 0x1C2 || 4 || 1 || 1 || ?
|-
| 0x200181C3 || 0x1C3 || 4 || 1 || 1 || ?
|-
| 0x200281C4 || 0x1C4 || 4 || 2 || 1 || ?
|-
| 0x200181C5 || 0x1C5 || 4 || 1 || 1 || ?
|-
| 0x200181C6 || 0x1C6 || 4 || 1 || 1 || ?
|-
| 0x200181C7 || 0x1C7 || 4 || 1 || 1 || ?
|-
| 0x200181C8 || 0x1C8 || 4 || 1 || 1 || ?
|-
| 0x200181CA || 0x1CA || 4 || 1 || 1 || ?
|-
| 0x200181CB || 0x1CB || 4 || 1 || 1 || ?
|-
| 0x200181CC || 0x1CC || 4 || 1 || 1 || ?
|-
| 0x200181CD || 0x1CD || 4 || 1 || 1 || ?
|-
| 0x200181CF || 0x1CF || 4 || 1 || 1 || ?
|-
| 0x800001D1 || 0x1D1 || 0 || 0 || 4 || ?
|-
| 0x200301F0 || 0x1F0 || 0 || 3 || 1 || ?
|-
| 0x800001F3 || 0x1F3 || 0 || 0 || 4 || ?
|-
| 0x200201F8 || 0x1F8 || 0 || 2 || 1 || ?
|-
| 0x200401FA || 0x1FA || 0 || 4 || 1 || ?
|-
| 0x20016223 || 0x223 || 3 || 1 || 1 || ?
|-
| 0x2004622C || 0x22C || 3 || 4 || 1 || ?
|-
| 0x20046230 || 0x230 || 3 || 4 || 1 || ?
|-
| 0x20046234 || 0x234 || 3 || 4 || 1 || ?
|-
| 0x200203?? || 0x3?? Variable || 0 || 2 || 1 || SetScissors?
|-
| 0x20040360 || 0x360 || 0 || 4 || 1 || ?
|-
| 0x20010364 || 0x364 || 0 || 1 || 1 || ?
|-
| 0x800?0368 || 0x368 || 0 || Variable || 4 || ?
|-
| 0x800?036B || 0x36B || 0 || Variable || 4 || ?
|-
| 0x800?036C || 0x36C || 0 || Variable || 4 || ?
|-
| 0x2001036F || 0x36F || 0 || 1 || 1 || ?
|-
| 0x80000370 || 0x370 || 0 || 0 || 4 || ?
|-
| 0x80000371 || 0x371 || 0 || 0 || 4 || ?
|-
| 0x80000372 || 0x372 || 0 || 0 || 4 || ?
|-
| 0x8???0373 || 0x373 || 0 || Variable || 4 || SetPatchSize
|-
| 0x80000374 || 0x374 || 0 || 0 || 4 || ?
|-
| 0x20010376 || 0x376 || 0 || 1 || 1 || ?
|-
| 0x800?03D5 || 0x3D5 || 0 || Variable || 4 || ?
|-
| 0x800?03D6 || 0x3D6 || 0 || Variable || 4 || ?
|-
| 0x800?03D7 || 0x3D7 || 0 || Variable || 4 || ?
|-
| 0x200103D9 || 0x3D9 || 0 || 1 || 1 || SetTiledCacheTileSize
|-
| 0x80?003DE || 0x3DE || 0 || Variable || 4 || ?
|-
| 0x800003E0 || 0x3E0 || 0 || 0 || 4 || ?
|-
| 0x200203E7 || 0x3E7 || 0 || 2 || 1 || ?
|-
| 0x800003ED || 0x3ED || 0 || 0 || 4 || ?
|-
| 0x800203EE || 0x3EE || 0 || 2 || 4 || ?
|-
| 0x200403EF || 0x3EF || 0 || 4 || 1 || SetSampleMask
|-
| 0x800003F5 || 0x3F5 || 0 || 0 || 4 || ?
|-
| 0x800103F6 || 0x3F6 || 0 || 1 || 4 || ?
|-
| 0x200503F8 || 0x3F8 || 0 || 5 || 1 || ?
|-
| 0x200203FD || 0x3FD || 0 || 2 || 1 || ?
|-
| 0x2004040C || 0x40C || 0 || 4 || 1 || ?
|-
| 0x200C0420 || 0x420 || 0 || 12 || 1 || ?
|-
| 0x80000446 || 0x446 || 0 || 0 || 4 || ?
|-
| 0x80000451 || 0x451 || 0 || 0 || 4 || ?
|-
| 0x800?0452 || 0x452 || 0 || Variable || 4 || ?
|-
| 0x20100458 || 0x458 || 0 || 16 || 1 || ?
|-
| 0x20040478 || 0x478 || 0 || 4 || 1 || ?
|-
| 0x8000047C || 0x47C || 0 || 0 || 4 || ?
|-
| 0x8000047E || 0x47E || 0 || 0 || 4 || ?
|-
| 0x8001047F || 0x47F || 0 || 1 || 4 || ResolveDepthBuffer
|-
| 0x2003048A || 0x48A || 0 || 3 || 1 || ?
|-
| 0x800?04B3 || 0x4B3 || 0 || Variable || 4 || ?
|-
| 0x800104B9 || 0x4B9 || 0 || 1 || 4 || ?
|-
| 0x800?04BA || 0x4BA || 0 || Variable || 4 || ?
|-
| 0x800004BB || 0x4BB || 0 || 0 || 4 || ?
|-
| 0x800?04C3 || 0x4C3 || 0 || Variable || 4 || ?
|-
| 0x200104C4 || 0x4C4 || 0 || 1 || 1 || SetAlphaRef
|-
| 0x200404C7 || 0x4C7 || 0 || 4 || 1 || SetBlendColor
|-
| 0x800004E0 || 0x4E0 || 0 || 0 || 4 || ?
|-
| 0x800?04E5 || 0x4E5 || 0 || Variable || 4 || ?
|-
| 0x800?04E6 || 0x4E6 || 0 || Variable || 4 || ?
|-
| 0x800?04E7 || 0x4E7 || 0 || Variable || 4 || ?
|-
| 0x200204EC || 0x4EC || 0 || 2 || 1 || SetLineWidth
|-
| 0x800?050D || 0x50D || 0 || Variable || 4 || ?
|-
| 0x80000519 || 0x519 || 0 || 0 || 4 || ?
|-
| 0x80000540 || 0x540 || 0 || 0 || 4 || ?
|-
| 0x20010546 || 0x546 || 0 || 1 || 1 || SetPointSize
|-
| 0x2001054C || 0x54C || 0 || 1 || 1 || ResetCounter
|-
| 0x800?054E || 0x54E || 0 || Variable || 4 || ?
|-
| 0x20030554 || 0x554 || 0 || 3 || 1 || SetRenderEnableConditional
|-
| 0x800?0556 || 0x556 || 0 || Variable || 4 || SetRenderEnable?
|-
| 0x2001055B || 0x55B || 0 || 1 || 1 || ?
|-
| 0x2001056F || 0x56F || 0 || 1 || 1 || ?
|-
| 0x80000572 || 0x572 || 0 || 0 || 4 || ?
|-
| 0x800?0574 || 0x574 || 0 || Variable || 4 || ?
|-
| 0x8000057F || 0x57F || 0 || 0 || 4 || ?
|-
| 0x80000580 || 0x580 || 0 || 0 || 4 || ?
|-
| 0x80000591 || 0x591 || 0 || 0 || 4 || ?
|-
| 0x20010592 || 0x592 || 0 || 1 || 1 || ?
|-
| 0x200205F2 || 0x5F2 || 0 || 2 || 1 || ?
|-
| 0x800?05F6 || 0x5F6 || 0 || Variable || 4 || ?
|-
| 0x2001061F || 0x61F || 0 || 1 || 1 || ?
|-
| 0x800?0620 || 0x620 || 0 || Variable || 4 || ?
|-
| 0x80010646 || 0x646 || 0 || 1 || 4 || ?
|-
| 0x800?0648 || 0x648 || 0 || Variable || 4 || ?
|-
| 0x2001064F || 0x64F || 0 || 1 || 1 || SetDepthClamp
|-
| 0x800?066F || 0x66F || 0 || Variable || 4 || ?
|-
| 0x120020671 || 0x671 || 0 || 2 || 9 || ?
|-
| 0x20010674 || 0x674 || 0 || 1 || 1 || ?
|-
| 0x8000068B || 0x68B || 0 || 0 || 4 || ?
|-
| 0x200406C0 || 0x6C0 || 0 || 4 || 1 || ?
|-
| 0x20010703 || 0x703 || 0 || 1 || 1 || ?
|-
| 0x200207?? || 0x7?? Variable || 0 || 2 || 1 || ?
|-
| 0x80300830 || 0x830 || 0 || 48 || 4 || ?
|-
| 0x80400840 || 0x840 || 0 || 64 || 4 || ?
|-
| 0x80500850 || 0x850 || 0 || 80 || 4 || ?
|-
| 0x200308E0 || 0x8E0 || 0 || 3 || 1 || ?
|-
| 0x200308E3 || 0x8E3 || 0 || 3 || 1 || CB_POS(Const buffer position)
|-
| 0x200308E4 || 0x8E4 || 0 || 3 || 1 || ?
|-
| 0x80??0904 || 0x904 || 0 || Variable || 4 || ?
|-
| 0x80??090C || 0x90C || 0 || Variable || 4 || ?
|-
| 0x80??0914 || 0x914 || 0 || Variable || 4 || ?
|-
| 0x80??091C || 0x91C || 0 || Variable || 4 || ?
|-
| 0x80??0924 || 0x924 || 0 || Variable || 4 || ?
|-
| 0x80000D1E || 0xD1E || 0 || 0 || 4 || ?
|-
| 0x800?0D28 || 0xD28 || 0 || Variable || 4 || ?
|-
| 0x20010D29 || 0xD29 || 0 || 1 || 1 || ?
|-
| 0x20010D34 || 0xD34 || 0 || 1 || 1 || ?
|-
| 0xA0020E00 || 0xE00 || 0 || 2 || 5 || BeginTransformFeedback
|-
| 0x20010E02 || 0xE02 || 0 || 1 || 1 || ?
|-
| 0x80020E04 || 0xE04 || 0 || 2 || 4 || ?
|-
| 0x20010E06 || 0xE06 || 0 || 1 || 1 || ?
|-
| 0xA0030E0A || 0xE0A || 0 || 3 || 5 || ?
|-
| 0x80050E0C || 0xE0C || 0 || 5 || 4 || ?
|-
| 0x800?0E0E || 0xE0E || 0 || Variable || 4 || ?
|-
| 0x20010E10 || 0xE10 || 0 || 1 || 1 || ?
|-
| 0xA0040E12 || 0xE12 || 0 || 4 || 5 || ?
|-
| 0x20010E1A || 0xE1A || 0 || 1 || 1 || ?
|-
| 0xA0040E1C || 0xE1C || 0 || 4 || 5 || ?
|-
| 0x81900E1E || 0xE1E || 0 || 400 || 4 || ?
|-
| 0x80000E20 || 0xE20 || 0 || 0 || 4 || ?
|-
| 0x80000E24 || 0xE24 || 0 || 0 || 4 || ?
|-
| 0xA0040E2C || 0xE2C || 0 || 4 || 5 || PushDebugGroup
|-
| 0xA0020E2E || 0xE2E || 0 || 2 || 5 || PopDebugGroupId
|-
| 0xA0030E30 || 0xE30 || 0 || 3 || 5 || DrawArrays
|-
| 0xA0050E32 || 0xE32 || 0 || 5 || 5 || DrawArraysIndirect?
|-
| 0xA0050E34 || 0xE34 || 0 || 5 || 5 || DrawArraysInstanced?
|-
| 0xA0050E36 || 0xE36 || 0 || 5 || 5 || DrawElements
|-
| 0xA0060E38 || 0xE38 || 0 || 6 || 5 || DrawElementsIndirect?
|-
| 0xA0060E3A || 0xE3A || 0 || 6 || 5 || DrawElementsInstanced?
|-
| 0xA0050E42 || 0xE42 || 0 || 5 || 5 || ?
|-
| 0xA0060E44 || 0xE44 || 0 || 6 || 5 || ?
|}

Note: These still need to be heavily verified and ''could'' be wrong.

=== BindObject ===

In order to bind an engine object to a specific subchannel, method 0 (BindObject) must be used first. The target subchannel is specified in bits 15-13 of the command word.

After the engine object is bound to the desired subchannel, setting it's value in bits 15-13 of any subsequent command word will make PFIFO forward the command to the target engine.

This method only takes one argument, an [[#Engine_IDs|engine ID]].

==== Engine IDs ====

{| class="wikitable"
|-
! scope="col"| ID
! scope="col"| Engine
|-
|0x902D
|FERMI_TWOD_A (2D)
|-
|0xB197
|MAXWELL_B (3D)
|-
|0xB1C0
|MAXWELL_COMPUTE_B
|-
|0xA140
|KEPLER_INLINE_TO_MEMORY_B
|-
|0xB0B5
|MAXWELL_DMA_COPY_A (DMA)
|}

=== Macro ===

Macros are small programs that can be uploaded to the gpu and are capable of reading and writing to the 3D engine registers on the GPU. The macros also accepts parameters, stored on a FIFO. Macros can be called using methods starting at 0xe00, where the first method triggers the macro execution, and the second one is used to push parameters to the FIFO, that can be read from the macro program using a instruction called ''parm''. This instruction pops the FIFO and reads the next parameter, while also allowing programs to use a variable number of parameters if desired.

The first parameter is written to 0xe00 + n * 2 (where n is the macro index), and all subsequent parameters should be pushed to the FIFO using 0xe01 + n * 2. The first parameter is placed at the general purpose register R1 in the shader program when execution starts.

Official games uses those macros to conditionally write registers, one example of such uses is the macro at 0xe24, that is used to set shader registers (including shader address and binding the c1 Constant Buffer to the shader). In some cases, it's also used to set registers unconditionally.

=== Fences ===

Command lists can contain fences to ensure that commands are executed on the correct order, and subsequent commands are only sent when the previously sent commands were already processed by the GPU. Fences uses the QUERY_* commands, and works like this:

* First, QUERY_ADDRESS_HIGH and QUERY_ADDRESS_LOW commands are added to the Command List, with the High/Low 32 bits part of the 64-bits GPU Virtual Address where the fence is located. This GPU Virtual Address needs to be mapped to the process Virtual Address beforehand.
* Then, QUERY_SEQUENCE is added with a sequential number. This number is basically a incrementing counter, so the first Command List can have QUERY_SEQUENCE = 1, the next one QUERY_SEQUENCE = 2, 3, 4... and so on.
* Finally, QUERY_GET is added and contains the mode and other unknown data.

The above commands are added using the [[#Submission_mode|increasing mode]], since the Ids for all those 4 registers are sequential.

==== QUERY_GET Structure ====

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|1-0
|Mode
|-
|4
|Fence
|-
|15-12
|Unit
|}

==== QUERY_GET Mode ====

{| class="wikitable"
|-
! scope="col"| Value
! scope="col"| Mode
|-
|0
|Write
|-
|1
|Sync
|-
|2
|Write ?
|-
|3
|Write ?
|}

TODO: Move this to a separate page with all GPU Commands with descriptions. Also figure out what the other values mean.

Some of the other fields are still unknown/unobserved.

Official games will set Mode to 0, Fence to 1 and Unit to 0xF. The QUERY_SEQUENCE value is then written by the GPU to the address pointed to by QUERY_ADDRESS.
On the CPU side, the game code should wait until the value at the address pointed to by QUERY_ADDRESS is >= to the last written SEQUENCE value. Official code waits for this condition to be true on a loop, and won't send any further commands before that.

== Vertex Data Submission ==

Note: This is a observation on how the game Puyo Puyo Tetris sends textured squares to the GPU.

# VERTEX_ATTRIB_FORMAT (0-15) are set (only the first 3 are really used, the rest are set float, with Size = 1 and offset at 0).
# VERTEX_ARRAY_FETCH (0) is set with the lower 12 bits set to 0x1c (Stride) and bit 12 to 1 (Enabled).
# VERTEX_ARRAY_START_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located.
# VERTEX_ARRAY_LIMIT_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located, plus the Vertex Data size in bytes minus 1.
# VERTEX_BEGIN_GL is used with the primitive type set to TRIANGLE_STRIP.
# VERTEX_BUFFER_FIRST with value 0 (indicating the index of the first primitive to render?).
# VERTEX_BUFFER_COUNT is set to 4, because the Vertex Buffer with the square has 4 vertices.
# VERTEX_END_GL is used with value 0 (currently unknown what this value means).

== Texture View ==

Texture information such as address, format and size is sent to the GPU through a structure know as Texture View (a.k.a. Texture Image Control, or TIC). Each texture that the game uses needs a separate TIC, and those TICs are written to a table, one after the other. Each [[#TIC_Structure|TIC entry]] has 0x20 bytes, and is composed of 8 32-bits words where the texture information is packed.

The index of the TIC entries that should be used by the shader is sent to the GPU with the CB_POS/CB_DATA (0) methods. Games usually follows the following steps to write the TIC entry indexes:

* Macro 0xe1a is used to set CB_ADDRESS_HIGH/LOW registers to the GPU Virtual Address of the Constant Buffer set on the register 0x982 (the ''Texture Constant Buffer'' index register), and also sets CB_SIZE.
* CB_POS is used to set the write offset of the Constant Buffer to 0x20 + n * 4, where ''n'' is the index of the ''Handle'' being used on the shader sampler.
* CB_DATA (0) method is used to write the value into the Constant Buffer. The value is a ''Handle'' where the lower 20 bits is the TIC index, and the higher 12 bits is the TSC (Texture Sampler Control) index.

The address of a given TIC entry can be calculates as:

tic_entry_address = tic_base_address + tic_index * 0x20

Where ''tic_base_address'' is the address written to TIC_ADDRESS_HIGH/LOW (methods 0x1574 and 0x1578), ''tic_index'' is the lower 20 bits of the word written into the Const Buffer with CB_DATA (0), and 0x20 is the size of each TIC entry in bytes.

The texture is accessed on the shader using one of the texture sampling instructions (usually the TEXS instruction). One of the parameters for this instruction is the ''Handle'' index. This index start at 8, so the index 8 will access the handle at 8 * 4 = 0x20 on the ''Texture Constant Buffer''. Each shader stage has a separate Constant Buffer, so for fragment shaders, this is located at CB_ADDRESS + 4 * CB_SIZE + TEXS_index * 4 (where 4 is the index of the fragment shader stage).

=== TIC Structure ===

{| class="wikitable" border="1"
|-
! Word || Bits || Description
|-
| 0 || 6-0 || [[GPU_Texture_Formats#Texture_Formats|Texture Format]]
|-
| 0 || 9-7 || [[#Channel_Data_Type|R Channel Data Type]]
|-
| 0 || 12-10 || [[#Channel_Data_Type|G Channel Data Type]]
|-
| 0 || 15-13 || [[#Channel_Data_Type|B Channel Data Type]]
|-
| 0 || 18-16 || [[#Channel_Data_Type|A Channel Data Type]]
|-
| 1 || 31-0 || Lower 32-bits of the Texture GPU Virtual Address
|-
| 2 || 15-0 || Higher 16-bits of the Texture GPU Virtual Address
|-
| 4 || 15-0 || Texture Width minus 1
|-
| 5 || 15-0 || Texture Height minus 1
|}

==== Channel Data Type ====

{| class="wikitable" border="1"
|-
! Value || Type
|-
| 1 || SNORM
|-
| 2 || UNORM
|-
| 3 || SINT
|-
| 4 || UINT
|-
| 5 || SNORM_FORCE_FP16
|-
| 6 || UNORM_FORCE_FP16
|-
| 7 || FLOAT
|}

== References ==

FIFO engine overview:
[https://envytools.readthedocs.io/en/latest/hw/fifo/intro.html]

Method values from the Fermi family GPU (a bit older than the Tegra X1, but values seems to be mostly the same):
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gf100_3d.xml]

TIC structure used on a Maxwell GPU:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gm200_texture.xml]

Values for some types used on the above XML:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/nv_3ddefs.xml]

Command word packing code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_winsys.h]

TIC entry pack/write code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_tex.c#n65]

GPU

2018-03-30T15:05:06Z

Gdkchan:

== Mapping Memory ==

First, to map a memory region on the GPU Address Space, caching needs to be disabled by using [[SVC#svcSetMemoryAttribute|svcSetMemoryAttribute]]. The Address passed is the Virtual Address of the region that will be mapped, the size is the region size, and State0/1 are both set to 8 to disable caching of the memory region. This is done to ensure that the GPU can actually "see" the data written there, and it doesn't get stuck on some cache.

Then, [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]] is used to create a nvmap object with the desired size. After, [[NV_services#NVMAP_IOC_ALLOC|NVMAP_IOC_ALLOC]] is used to allocate the memory on the GPU Address Space, and map data on the process Address Space into the GPU Address Space, by passing the Virtual Address as the input addr parameter, and also the Handle returned from [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]]. Lastly, the actual mapping is done by using [[NV_services#NVGPU_AS_IOCTL_MAP_BUFFER_EX|NVGPU_AS_IOCTL_MAP_BUFFER_EX]], and the GPU Virtual Address is returned on the offset parameter. It's also possible to manually set the offset where the mapping should be made on the GPU Address Space, by passing the address on the "offset" parameter, and setting the bit 0 of the flags parameter to 1. However, for this to work, the desired GPU Virtual Address needs to be previously reserved using [[NV_services#NVGPU_AS_IOCTL_ALLOC_SPACE|NVGPU_AS_IOCTL_ALLOC_SPACE]].

The above process is used to map all data that will be used by the GPU, like Textures, Command Lists (a.k.a. Push Buffers), Vertex/Index buffers and Shaders. They usually have their own mapping, but Command Lists can share the same mapping.

== FIFO Commands ==

The GPU implements a variation of Tegra's push buffer format for it's PFIFO engine. PFIFO is a special engine responsible for receiving user command lists and routing them to the appropriate engines (2D, 3D, DMA).

Commands are submitted to the GPU's PFIFO engine through [[NV_services#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]].

This ioctl takes an array of gpfifo entries where each entry points to a FIFO command list. This list is composed of alternating 32-bit words containing FIFO commands and their respective arguments.

=== Command Structure ===

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|12-0
|Method
|-
|15-13
|Subchannel
|-
|27-16
|Argument count (in 32-bits Words) or inline data (see below)
|-
|28?
|Hmm?
|-
|31-29
|[[#Submission_mode|Submission mode]]
|}

Note: Methods are treated as 4-byte addressable locations, and hence their numbers are written down multiplied by 4.

Note: The command's arguments, when present, follow the command word immediately.

==== Submission mode ====

{| class="wikitable"
|-
! scope="col"| Mode
! scope="col"| Description
! scope="col"| Offical name
|-
|0
|Increasing mode (old)
|
|-
|1
|Increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count''', while automatically incrementing the '''method''' value. This means that each argument will be written to a different method location.
|INCR
|-
|2
|Non-increasing mode (old)
|
|-
|3
|Non-increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count'''. However, all arguments will be written to the same method location.
|NONINCR
|-
|4
|Inline mode - Tells PFIFO to read '''inline data''' from bits 28-16 of the command word, thus eliminating the need to pass additional words for the arguments.
|IMM
|-
|5
|Increase-once mode - Tells PFIFO to read as much arguments as specified by '''argument count''' and automatically increments the '''method''' value once only.
|
|}

=== Command List ===

All methods with values < 0x100 are special and executed by the PFIFO's DMA puller. The others are forwarded to the engine object currently bound to a given subchannel.

{| class="wikitable" border="1"
|-
! Command || Method || Subchannel || Arg Count || Mode || Name
|-
| 0x2001?000 || 0x0000 || Variable || 1 || 1 || [[#BindObject|BindObject]]
|-
| 0x80000040 || 0x40 || 0 || 0 || 4 || ?
|-
| 0xA???0045 || 0x45 || 0 || Variable || 5 || SetGraphMacroCode
|-
| 0x20020047 || 0x47 || 0 || 2 || 1 || SetGraphMacroEntry
|-
| 0x800?0049 || 0x49 || 0 || Variable || 4 || ?
|-
| 0x20056080 || 0x80 || 3 || Variable || 1 || ?
|-
| 0x20016085 || 0x85 || 3 || 1 || 1 || ?
|-
| 0x20026086 || 0x86 || 3 || 2 || 1 || ?
|-
| 0x20026088 || 0x88 || 3 || 2 || 1 || ?
|-
| 0x2004608C || 0x8C || 3 || Variable || 1 || ?
|-
| 0x20016091 || 0x91 || 3 || 1 || 1 || ?
|-
| 0x20026092 || 0x92 || 3 || 2 || 1 || ?
|-
| 0x20026094 || 0x94 || 3 || 2 || 1 || ?
|-
| 0x800160B5 || 0xB5 || 3 || 1 || 4 || ?
|-
| 0x800000BA || 0xBA || 0 || 0 || 4 || ?
|-
| 0x601000BE || 0xBE || 0 || 16 || 3 || ?
|-
| 0x200100BF || 0xBF || 0 || 1 || 1 || ?
|-
| 0x200180C0 || 0xC0 || 4 || 1 || 1 || ?
|-
| 0x200400C9 || 0xC9 || 0 || 4 || 1 || SetOuterTessellationLevels
|-
| 0x200200CD || 0xCD || 0 || 2 || 1 || SetInnerTessellationLevels
|-
| 0x200100DC || 0xDC || 0 || 1 || 1 || ?
|-
| 0x800?00DF || 0xDF || 0 || Variable || 4 || SetRasterizerDiscard?
|-
| 0x20048100 || 0x100 || 4 || 4 || 1 || ?
|-
| 0x20028102 || 0x102 || 4 || 2 || 1 || ?
|-
| 0x20018104 || 0x104 || 4 || 1 || 1 || ?
|-
| 0x20018105 || 0x105 || 4 || 1 || 1 || ?
|-
| 0x20018106 || 0x106 || 4 || 1 || 1 || ?
|-
| 0x200181C0 || 0x1C0 || 4 || 1 || 1 || ?
|-
| 0x200181C2 || 0x1C2 || 4 || 1 || 1 || ?
|-
| 0x200181C3 || 0x1C3 || 4 || 1 || 1 || ?
|-
| 0x200281C4 || 0x1C4 || 4 || 2 || 1 || ?
|-
| 0x200181C5 || 0x1C5 || 4 || 1 || 1 || ?
|-
| 0x200181C6 || 0x1C6 || 4 || 1 || 1 || ?
|-
| 0x200181C7 || 0x1C7 || 4 || 1 || 1 || ?
|-
| 0x200181C8 || 0x1C8 || 4 || 1 || 1 || ?
|-
| 0x200181CA || 0x1CA || 4 || 1 || 1 || ?
|-
| 0x200181CB || 0x1CB || 4 || 1 || 1 || ?
|-
| 0x200181CC || 0x1CC || 4 || 1 || 1 || ?
|-
| 0x200181CD || 0x1CD || 4 || 1 || 1 || ?
|-
| 0x200181CF || 0x1CF || 4 || 1 || 1 || ?
|-
| 0x800001D1 || 0x1D1 || 0 || 0 || 4 || ?
|-
| 0x200301F0 || 0x1F0 || 0 || 3 || 1 || ?
|-
| 0x800001F3 || 0x1F3 || 0 || 0 || 4 || ?
|-
| 0x200201F8 || 0x1F8 || 0 || 2 || 1 || ?
|-
| 0x200401FA || 0x1FA || 0 || 4 || 1 || ?
|-
| 0x20016223 || 0x223 || 3 || 1 || 1 || ?
|-
| 0x2004622C || 0x22C || 3 || 4 || 1 || ?
|-
| 0x20046230 || 0x230 || 3 || 4 || 1 || ?
|-
| 0x20046234 || 0x234 || 3 || 4 || 1 || ?
|-
| 0x200203?? || 0x3?? Variable || 0 || 2 || 1 || SetScissors?
|-
| 0x20040360 || 0x360 || 0 || 4 || 1 || ?
|-
| 0x20010364 || 0x364 || 0 || 1 || 1 || ?
|-
| 0x800?0368 || 0x368 || 0 || Variable || 4 || ?
|-
| 0x800?036B || 0x36B || 0 || Variable || 4 || ?
|-
| 0x800?036C || 0x36C || 0 || Variable || 4 || ?
|-
| 0x2001036F || 0x36F || 0 || 1 || 1 || ?
|-
| 0x80000370 || 0x370 || 0 || 0 || 4 || ?
|-
| 0x80000371 || 0x371 || 0 || 0 || 4 || ?
|-
| 0x80000372 || 0x372 || 0 || 0 || 4 || ?
|-
| 0x8???0373 || 0x373 || 0 || Variable || 4 || SetPatchSize
|-
| 0x80000374 || 0x374 || 0 || 0 || 4 || ?
|-
| 0x20010376 || 0x376 || 0 || 1 || 1 || ?
|-
| 0x800?03D5 || 0x3D5 || 0 || Variable || 4 || ?
|-
| 0x800?03D6 || 0x3D6 || 0 || Variable || 4 || ?
|-
| 0x800?03D7 || 0x3D7 || 0 || Variable || 4 || ?
|-
| 0x200103D9 || 0x3D9 || 0 || 1 || 1 || SetTiledCacheTileSize
|-
| 0x80?003DE || 0x3DE || 0 || Variable || 4 || ?
|-
| 0x800003E0 || 0x3E0 || 0 || 0 || 4 || ?
|-
| 0x200203E7 || 0x3E7 || 0 || 2 || 1 || ?
|-
| 0x800003ED || 0x3ED || 0 || 0 || 4 || ?
|-
| 0x800203EE || 0x3EE || 0 || 2 || 4 || ?
|-
| 0x200403EF || 0x3EF || 0 || 4 || 1 || SetSampleMask
|-
| 0x800003F5 || 0x3F5 || 0 || 0 || 4 || ?
|-
| 0x800103F6 || 0x3F6 || 0 || 1 || 4 || ?
|-
| 0x200503F8 || 0x3F8 || 0 || 5 || 1 || ?
|-
| 0x200203FD || 0x3FD || 0 || 2 || 1 || ?
|-
| 0x2004040C || 0x40C || 0 || 4 || 1 || ?
|-
| 0x200C0420 || 0x420 || 0 || 12 || 1 || ?
|-
| 0x80000446 || 0x446 || 0 || 0 || 4 || ?
|-
| 0x80000451 || 0x451 || 0 || 0 || 4 || ?
|-
| 0x800?0452 || 0x452 || 0 || Variable || 4 || ?
|-
| 0x20100458 || 0x458 || 0 || 16 || 1 || ?
|-
| 0x20040478 || 0x478 || 0 || 4 || 1 || ?
|-
| 0x8000047C || 0x47C || 0 || 0 || 4 || ?
|-
| 0x8000047E || 0x47E || 0 || 0 || 4 || ?
|-
| 0x8001047F || 0x47F || 0 || 1 || 4 || ResolveDepthBuffer
|-
| 0x2003048A || 0x48A || 0 || 3 || 1 || ?
|-
| 0x800?04B3 || 0x4B3 || 0 || Variable || 4 || ?
|-
| 0x800104B9 || 0x4B9 || 0 || 1 || 4 || ?
|-
| 0x800?04BA || 0x4BA || 0 || Variable || 4 || ?
|-
| 0x800004BB || 0x4BB || 0 || 0 || 4 || ?
|-
| 0x800?04C3 || 0x4C3 || 0 || Variable || 4 || ?
|-
| 0x200104C4 || 0x4C4 || 0 || 1 || 1 || SetAlphaRef
|-
| 0x200404C7 || 0x4C7 || 0 || 4 || 1 || SetBlendColor
|-
| 0x800004E0 || 0x4E0 || 0 || 0 || 4 || ?
|-
| 0x800?04E5 || 0x4E5 || 0 || Variable || 4 || ?
|-
| 0x800?04E6 || 0x4E6 || 0 || Variable || 4 || ?
|-
| 0x800?04E7 || 0x4E7 || 0 || Variable || 4 || ?
|-
| 0x200204EC || 0x4EC || 0 || 2 || 1 || SetLineWidth
|-
| 0x800?050D || 0x50D || 0 || Variable || 4 || ?
|-
| 0x80000519 || 0x519 || 0 || 0 || 4 || ?
|-
| 0x80000540 || 0x540 || 0 || 0 || 4 || ?
|-
| 0x20010546 || 0x546 || 0 || 1 || 1 || SetPointSize
|-
| 0x2001054C || 0x54C || 0 || 1 || 1 || ResetCounter
|-
| 0x800?054E || 0x54E || 0 || Variable || 4 || ?
|-
| 0x20030554 || 0x554 || 0 || 3 || 1 || SetRenderEnableConditional
|-
| 0x800?0556 || 0x556 || 0 || Variable || 4 || SetRenderEnable?
|-
| 0x2001055B || 0x55B || 0 || 1 || 1 || ?
|-
| 0x2001056F || 0x56F || 0 || 1 || 1 || ?
|-
| 0x80000572 || 0x572 || 0 || 0 || 4 || ?
|-
| 0x800?0574 || 0x574 || 0 || Variable || 4 || ?
|-
| 0x8000057F || 0x57F || 0 || 0 || 4 || ?
|-
| 0x80000580 || 0x580 || 0 || 0 || 4 || ?
|-
| 0x80000591 || 0x591 || 0 || 0 || 4 || ?
|-
| 0x20010592 || 0x592 || 0 || 1 || 1 || ?
|-
| 0x200205F2 || 0x5F2 || 0 || 2 || 1 || ?
|-
| 0x800?05F6 || 0x5F6 || 0 || Variable || 4 || ?
|-
| 0x2001061F || 0x61F || 0 || 1 || 1 || ?
|-
| 0x800?0620 || 0x620 || 0 || Variable || 4 || ?
|-
| 0x80010646 || 0x646 || 0 || 1 || 4 || ?
|-
| 0x800?0648 || 0x648 || 0 || Variable || 4 || ?
|-
| 0x2001064F || 0x64F || 0 || 1 || 1 || SetDepthClamp
|-
| 0x800?066F || 0x66F || 0 || Variable || 4 || ?
|-
| 0x120020671 || 0x671 || 0 || 2 || 9 || ?
|-
| 0x20010674 || 0x674 || 0 || 1 || 1 || ?
|-
| 0x8000068B || 0x68B || 0 || 0 || 4 || ?
|-
| 0x200406C0 || 0x6C0 || 0 || 4 || 1 || ?
|-
| 0x20010703 || 0x703 || 0 || 1 || 1 || ?
|-
| 0x200207?? || 0x7?? Variable || 0 || 2 || 1 || ?
|-
| 0x80300830 || 0x830 || 0 || 48 || 4 || ?
|-
| 0x80400840 || 0x840 || 0 || 64 || 4 || ?
|-
| 0x80500850 || 0x850 || 0 || 80 || 4 || ?
|-
| 0x200308E0 || 0x8E0 || 0 || 3 || 1 || ?
|-
| 0x200308E3 || 0x8E3 || 0 || 3 || 1 || CB_POS(Const buffer position)
|-
| 0x200308E4 || 0x8E4 || 0 || 3 || 1 || ?
|-
| 0x80??0904 || 0x904 || 0 || Variable || 4 || ?
|-
| 0x80??090C || 0x90C || 0 || Variable || 4 || ?
|-
| 0x80??0914 || 0x914 || 0 || Variable || 4 || ?
|-
| 0x80??091C || 0x91C || 0 || Variable || 4 || ?
|-
| 0x80??0924 || 0x924 || 0 || Variable || 4 || ?
|-
| 0x80000D1E || 0xD1E || 0 || 0 || 4 || ?
|-
| 0x800?0D28 || 0xD28 || 0 || Variable || 4 || ?
|-
| 0x20010D29 || 0xD29 || 0 || 1 || 1 || ?
|-
| 0x20010D34 || 0xD34 || 0 || 1 || 1 || ?
|-
| 0xA0020E00 || 0xE00 || 0 || 2 || 5 || BeginTransformFeedback
|-
| 0x20010E02 || 0xE02 || 0 || 1 || 1 || ?
|-
| 0x80020E04 || 0xE04 || 0 || 2 || 4 || ?
|-
| 0x20010E06 || 0xE06 || 0 || 1 || 1 || ?
|-
| 0xA0030E0A || 0xE0A || 0 || 3 || 5 || ?
|-
| 0x80050E0C || 0xE0C || 0 || 5 || 4 || ?
|-
| 0x800?0E0E || 0xE0E || 0 || Variable || 4 || ?
|-
| 0x20010E10 || 0xE10 || 0 || 1 || 1 || ?
|-
| 0xA0040E12 || 0xE12 || 0 || 4 || 5 || ?
|-
| 0x20010E1A || 0xE1A || 0 || 1 || 1 || ?
|-
| 0xA0040E1C || 0xE1C || 0 || 4 || 5 || ?
|-
| 0x81900E1E || 0xE1E || 0 || 400 || 4 || ?
|-
| 0x80000E20 || 0xE20 || 0 || 0 || 4 || ?
|-
| 0x80000E24 || 0xE24 || 0 || 0 || 4 || ?
|-
| 0xA0040E2C || 0xE2C || 0 || 4 || 5 || PushDebugGroup
|-
| 0xA0020E2E || 0xE2E || 0 || 2 || 5 || PopDebugGroupId
|-
| 0xA0030E30 || 0xE30 || 0 || 3 || 5 || DrawArrays
|-
| 0xA0050E32 || 0xE32 || 0 || 5 || 5 || DrawArraysIndirect?
|-
| 0xA0050E34 || 0xE34 || 0 || 5 || 5 || DrawArraysInstanced?
|-
| 0xA0050E36 || 0xE36 || 0 || 5 || 5 || DrawElements
|-
| 0xA0060E38 || 0xE38 || 0 || 6 || 5 || DrawElementsIndirect?
|-
| 0xA0060E3A || 0xE3A || 0 || 6 || 5 || DrawElementsInstanced?
|-
| 0xA0050E42 || 0xE42 || 0 || 5 || 5 || ?
|-
| 0xA0060E44 || 0xE44 || 0 || 6 || 5 || ?
|}

Note: These still need to be heavily verified and ''could'' be wrong.

=== BindObject ===

In order to bind an engine object to a specific subchannel, method 0 (BindObject) must be used first. The target subchannel is specified in bits 15-13 of the command word.

After the engine object is bound to the desired subchannel, setting it's value in bits 15-13 of any subsequent command word will make PFIFO forward the command to the target engine.

This method only takes one argument, an [[#Engine_IDs|engine ID]].

==== Engine IDs ====

{| class="wikitable"
|-
! scope="col"| ID
! scope="col"| Engine
|-
|0x902D
|FERMI_TWOD_A (2D)
|-
|0xB197
|MAXWELL_B (3D)
|-
|0xB1C0
|MAXWELL_COMPUTE_B
|-
|0xA140
|KEPLER_INLINE_TO_MEMORY_B
|-
|0xB0B5
|MAXWELL_DMA_COPY_A (DMA)
|}

=== Macro ===

Macros are small programs that can be uploaded to the gpu and are capable of reading and writing to the 3D engine registers on the GPU. The macros also accepts parameters, stored on a FIFO. Macros can be called using methods starting at 0xe00, where the first method triggers the macro execution, and the second one is used to push parameters to the FIFO, that can be read from the macro program using a instruction called ''parm''. This instruction pops the FIFO and reads the next parameter, while also allowing programs to use a variable number of parameters if desired.

The first parameter is written to 0xe00 + n * 2 (where n is the macro index), and all subsequent parameters should be pushed to the FIFO using 0xe01 + n * 2. The first parameter is placed the general purpose register R1 in the shader program when execution starts.

Official games uses those macros to conditionally write registers, one example of such uses it the macro at 0xe24, that is used to set shader registers (including shader address and binding the c1 Constant Buffer to the shader). In some cases, it's also used to set registers unconditionally.

=== Fences ===

Command lists can contain fences to ensure that commands are executed on the correct order, and subsequent commands are only sent when the previously sent commands were already processed by the GPU. Fences uses the QUERY_* commands, and works like this:

* First, QUERY_ADDRESS_HIGH and QUERY_ADDRESS_LOW commands are added to the Command List, with the High/Low 32 bits part of the 64-bits GPU Virtual Address where the fence is located. This GPU Virtual Address needs to be mapped to the process Virtual Address beforehand.
* Then, QUERY_SEQUENCE is added with a sequential number. This number is basically a incrementing counter, so the first Command List can have QUERY_SEQUENCE = 1, the next one QUERY_SEQUENCE = 2, 3, 4... and so on.
* Finally, QUERY_GET is added and contains the mode and other unknown data.

The above commands are added using the [[#Submission_mode|increasing mode]], since the Ids for all those 4 registers are sequential.

==== QUERY_GET Structure ====

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|1-0
|Mode
|-
|4
|Fence
|-
|15-12
|Unit
|}

==== QUERY_GET Mode ====

{| class="wikitable"
|-
! scope="col"| Value
! scope="col"| Mode
|-
|0
|Write
|-
|1
|Sync
|-
|2
|Write ?
|-
|3
|Write ?
|}

TODO: Move this to a separate page with all GPU Commands with descriptions. Also figure out what the other values mean.

Some of the other fields are still unknown/unobserved.

Official games will set Mode to 0, Fence to 1 and Unit to 0xF. The QUERY_SEQUENCE value is then written by the GPU to the address pointed to by QUERY_ADDRESS.
On the CPU side, the game code should wait until the value at the address pointed to by QUERY_ADDRESS is >= to the last written SEQUENCE value. Official code waits for this condition to be true on a loop, and won't send any further commands before that.

== Vertex Data Submission ==

Note: This is a observation on how the game Puyo Puyo Tetris sends textured squares to the GPU.

# VERTEX_ATTRIB_FORMAT (0-15) are set (only the first 3 are really used, the rest are set float, with Size = 1 and offset at 0).
# VERTEX_ARRAY_FETCH (0) is set with the lower 12 bits set to 0x1c (Stride) and bit 12 to 1 (Enabled).
# VERTEX_ARRAY_START_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located.
# VERTEX_ARRAY_LIMIT_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located, plus the Vertex Data size in bytes minus 1.
# VERTEX_BEGIN_GL is used with the primitive type set to TRIANGLE_STRIP.
# VERTEX_BUFFER_FIRST with value 0 (indicating the index of the first primitive to render?).
# VERTEX_BUFFER_COUNT is set to 4, because the Vertex Buffer with the square has 4 vertices.
# VERTEX_END_GL is used with value 0 (currently unknown what this value means).

== Texture View ==

Texture information such as address, format and size is sent to the GPU through a structure know as Texture View (a.k.a. Texture Image Control, or TIC). Each texture that the game uses needs a separate TIC, and those TICs are written to a table, one after the other. Each [[#TIC_Structure|TIC entry]] has 0x20 bytes, and is composed of 8 32-bits words where the texture information is packed.

The index of the TIC entries that should be used by the shader is sent to the GPU with the CB_POS/CB_DATA (0) methods. Games usually follows the following steps to write the TIC entry indexes:

* Macro 0xe1a is used to set CB_ADDRESS_HIGH/LOW registers to the GPU Virtual Address of the Constant Buffer set on the register 0x982 (the ''Texture Constant Buffer'' index register), and also sets CB_SIZE.
* CB_POS is used to set the write offset of the Constant Buffer to 0x20 + n * 4, where ''n'' is the index of the ''Handle'' being used on the shader sampler.
* CB_DATA (0) method is used to write the value into the Constant Buffer. The value is a ''Handle'' where the lower 20 bits is the TIC index, and the higher 12 bits is the TSC (Texture Sampler Control) index.

The address of a given TIC entry can be calculates as:

tic_entry_address = tic_base_address + tic_index * 0x20

Where ''tic_base_address'' is the address written to TIC_ADDRESS_HIGH/LOW (methods 0x1574 and 0x1578), ''tic_index'' is the lower 20 bits of the word written into the Const Buffer with CB_DATA (0), and 0x20 is the size of each TIC entry in bytes.

The texture is accessed on the shader using one of the texture sampling instructions (usually the TEXS instruction). One of the parameters for this instruction is the ''Handle'' index. This index start at 8, so the index 8 will access the handle at 8 * 4 = 0x20 on the ''Texture Constant Buffer''. Each shader stage has a separate Constant Buffer, so for fragment shaders, this is located at CB_ADDRESS + 4 * CB_SIZE + TEXS_index * 4 (where 4 is the index of the fragment shader stage).

=== TIC Structure ===

{| class="wikitable" border="1"
|-
! Word || Bits || Description
|-
| 0 || 6-0 || [[GPU_Texture_Formats#Texture_Formats|Texture Format]]
|-
| 0 || 9-7 || [[#Channel_Data_Type|R Channel Data Type]]
|-
| 0 || 12-10 || [[#Channel_Data_Type|G Channel Data Type]]
|-
| 0 || 15-13 || [[#Channel_Data_Type|B Channel Data Type]]
|-
| 0 || 18-16 || [[#Channel_Data_Type|A Channel Data Type]]
|-
| 1 || 31-0 || Lower 32-bits of the Texture GPU Virtual Address
|-
| 2 || 15-0 || Higher 16-bits of the Texture GPU Virtual Address
|-
| 4 || 15-0 || Texture Width minus 1
|-
| 5 || 15-0 || Texture Height minus 1
|}

==== Channel Data Type ====

{| class="wikitable" border="1"
|-
! Value || Type
|-
| 1 || SNORM
|-
| 2 || UNORM
|-
| 3 || SINT
|-
| 4 || UINT
|-
| 5 || SNORM_FORCE_FP16
|-
| 6 || UNORM_FORCE_FP16
|-
| 7 || FLOAT
|}

== References ==

FIFO engine overview:
[https://envytools.readthedocs.io/en/latest/hw/fifo/intro.html]

Method values from the Fermi family GPU (a bit older than the Tegra X1, but values seems to be mostly the same):
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gf100_3d.xml]

TIC structure used on a Maxwell GPU:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gm200_texture.xml]

Values for some types used on the above XML:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/nv_3ddefs.xml]

Command word packing code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_winsys.h]

TIC entry pack/write code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_tex.c#n65]

GPU

2018-03-30T15:00:46Z

Gdkchan:

== Mapping Memory ==

First, to map a memory region on the GPU Address Space, caching needs to be disabled by using [[SVC#svcSetMemoryAttribute|svcSetMemoryAttribute]]. The Address passed is the Virtual Address of the region that will be mapped, the size is the region size, and State0/1 are both set to 8 to disable caching of the memory region. This is done to ensure that the GPU can actually "see" the data written there, and it doesn't get stuck on some cache.

Then, [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]] is used to create a nvmap object with the desired size. After, [[NV_services#NVMAP_IOC_ALLOC|NVMAP_IOC_ALLOC]] is used to allocate the memory on the GPU Address Space, and map data on the process Address Space into the GPU Address Space, by passing the Virtual Address as the input addr parameter, and also the Handle returned from [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]]. Lastly, the actual mapping is done by using [[NV_services#NVGPU_AS_IOCTL_MAP_BUFFER_EX|NVGPU_AS_IOCTL_MAP_BUFFER_EX]], and the GPU Virtual Address is returned on the offset parameter. It's also possible to manually set the offset where the mapping should be made on the GPU Address Space, by passing the address on the "offset" parameter, and setting the bit 0 of the flags parameter to 1. However, for this to work, the desired GPU Virtual Address needs to be previously reserved using [[NV_services#NVGPU_AS_IOCTL_ALLOC_SPACE|NVGPU_AS_IOCTL_ALLOC_SPACE]].

The above process is used to map all data that will be used by the GPU, like Textures, Command Lists (a.k.a. Push Buffers), Vertex/Index buffers and Shaders. They usually have their own mapping, but Command Lists can share the same mapping.

== FIFO Commands ==

The GPU implements a variation of Tegra's push buffer format for it's PFIFO engine. PFIFO is a special engine responsible for receiving user command lists and routing them to the appropriate engines (2D, 3D, DMA).

Commands are submitted to the GPU's PFIFO engine through [[NV_services#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]].

This ioctl takes an array of gpfifo entries where each entry points to a FIFO command list. This list is composed of alternating 32-bit words containing FIFO commands and their respective arguments.

=== Command Structure ===

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|12-0
|Method
|-
|15-13
|Subchannel
|-
|27-16
|Argument count (in 32-bits Words) or inline data (see below)
|-
|28?
|Hmm?
|-
|31-29
|[[#Submission_mode|Submission mode]]
|}

Note: Methods are treated as 4-byte addressable locations, and hence their numbers are written down multiplied by 4.

Note: The command's arguments, when present, follow the command word immediately.

==== Submission mode ====

{| class="wikitable"
|-
! scope="col"| Mode
! scope="col"| Description
! scope="col"| Offical name
|-
|0
|Increasing mode (old)
|
|-
|1
|Increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count''', while automatically incrementing the '''method''' value. This means that each argument will be written to a different method location.
|INCR
|-
|2
|Non-increasing mode (old)
|
|-
|3
|Non-increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count'''. However, all arguments will be written to the same method location.
|NONINCR
|-
|4
|Inline mode - Tells PFIFO to read '''inline data''' from bits 28-16 of the command word, thus eliminating the need to pass additional words for the arguments.
|IMM
|-
|5
|Increase-once mode - Tells PFIFO to read as much arguments as specified by '''argument count''' and automatically increments the '''method''' value once only.
|
|}

=== Command List ===

All methods with values < 0x100 are special and executed by the PFIFO's DMA puller. The others are forwarded to the engine object currently bound to a given subchannel.

{| class="wikitable" border="1"
|-
! Command || Method || Subchannel || Arg Count || Mode || Name
|-
| 0x2001?000 || 0x0000 || Variable || 1 || 1 || [[#BindObject|BindObject]]
|-
| 0x80000040 || 0x40 || 0 || 0 || 4 || ?
|-
| 0xA???0045 || 0x45 || 0 || Variable || 5 || SetGraphMacroCode
|-
| 0x20020047 || 0x47 || 0 || 2 || 1 || SetGraphMacroEntry
|-
| 0x800?0049 || 0x49 || 0 || Variable || 4 || ?
|-
| 0x20056080 || 0x80 || 3 || Variable || 1 || ?
|-
| 0x20016085 || 0x85 || 3 || 1 || 1 || ?
|-
| 0x20026086 || 0x86 || 3 || 2 || 1 || ?
|-
| 0x20026088 || 0x88 || 3 || 2 || 1 || ?
|-
| 0x2004608C || 0x8C || 3 || Variable || 1 || ?
|-
| 0x20016091 || 0x91 || 3 || 1 || 1 || ?
|-
| 0x20026092 || 0x92 || 3 || 2 || 1 || ?
|-
| 0x20026094 || 0x94 || 3 || 2 || 1 || ?
|-
| 0x800160B5 || 0xB5 || 3 || 1 || 4 || ?
|-
| 0x800000BA || 0xBA || 0 || 0 || 4 || ?
|-
| 0x601000BE || 0xBE || 0 || 16 || 3 || ?
|-
| 0x200100BF || 0xBF || 0 || 1 || 1 || ?
|-
| 0x200180C0 || 0xC0 || 4 || 1 || 1 || ?
|-
| 0x200400C9 || 0xC9 || 0 || 4 || 1 || SetOuterTessellationLevels
|-
| 0x200200CD || 0xCD || 0 || 2 || 1 || SetInnerTessellationLevels
|-
| 0x200100DC || 0xDC || 0 || 1 || 1 || ?
|-
| 0x800?00DF || 0xDF || 0 || Variable || 4 || SetRasterizerDiscard?
|-
| 0x20048100 || 0x100 || 4 || 4 || 1 || ?
|-
| 0x20028102 || 0x102 || 4 || 2 || 1 || ?
|-
| 0x20018104 || 0x104 || 4 || 1 || 1 || ?
|-
| 0x20018105 || 0x105 || 4 || 1 || 1 || ?
|-
| 0x20018106 || 0x106 || 4 || 1 || 1 || ?
|-
| 0x200181C0 || 0x1C0 || 4 || 1 || 1 || ?
|-
| 0x200181C2 || 0x1C2 || 4 || 1 || 1 || ?
|-
| 0x200181C3 || 0x1C3 || 4 || 1 || 1 || ?
|-
| 0x200281C4 || 0x1C4 || 4 || 2 || 1 || ?
|-
| 0x200181C5 || 0x1C5 || 4 || 1 || 1 || ?
|-
| 0x200181C6 || 0x1C6 || 4 || 1 || 1 || ?
|-
| 0x200181C7 || 0x1C7 || 4 || 1 || 1 || ?
|-
| 0x200181C8 || 0x1C8 || 4 || 1 || 1 || ?
|-
| 0x200181CA || 0x1CA || 4 || 1 || 1 || ?
|-
| 0x200181CB || 0x1CB || 4 || 1 || 1 || ?
|-
| 0x200181CC || 0x1CC || 4 || 1 || 1 || ?
|-
| 0x200181CD || 0x1CD || 4 || 1 || 1 || ?
|-
| 0x200181CF || 0x1CF || 4 || 1 || 1 || ?
|-
| 0x800001D1 || 0x1D1 || 0 || 0 || 4 || ?
|-
| 0x200301F0 || 0x1F0 || 0 || 3 || 1 || ?
|-
| 0x800001F3 || 0x1F3 || 0 || 0 || 4 || ?
|-
| 0x200201F8 || 0x1F8 || 0 || 2 || 1 || ?
|-
| 0x200401FA || 0x1FA || 0 || 4 || 1 || ?
|-
| 0x20016223 || 0x223 || 3 || 1 || 1 || ?
|-
| 0x2004622C || 0x22C || 3 || 4 || 1 || ?
|-
| 0x20046230 || 0x230 || 3 || 4 || 1 || ?
|-
| 0x20046234 || 0x234 || 3 || 4 || 1 || ?
|-
| 0x200203?? || 0x3?? Variable || 0 || 2 || 1 || SetScissors?
|-
| 0x20040360 || 0x360 || 0 || 4 || 1 || ?
|-
| 0x20010364 || 0x364 || 0 || 1 || 1 || ?
|-
| 0x800?0368 || 0x368 || 0 || Variable || 4 || ?
|-
| 0x800?036B || 0x36B || 0 || Variable || 4 || ?
|-
| 0x800?036C || 0x36C || 0 || Variable || 4 || ?
|-
| 0x2001036F || 0x36F || 0 || 1 || 1 || ?
|-
| 0x80000370 || 0x370 || 0 || 0 || 4 || ?
|-
| 0x80000371 || 0x371 || 0 || 0 || 4 || ?
|-
| 0x80000372 || 0x372 || 0 || 0 || 4 || ?
|-
| 0x8???0373 || 0x373 || 0 || Variable || 4 || SetPatchSize
|-
| 0x80000374 || 0x374 || 0 || 0 || 4 || ?
|-
| 0x20010376 || 0x376 || 0 || 1 || 1 || ?
|-
| 0x800?03D5 || 0x3D5 || 0 || Variable || 4 || ?
|-
| 0x800?03D6 || 0x3D6 || 0 || Variable || 4 || ?
|-
| 0x800?03D7 || 0x3D7 || 0 || Variable || 4 || ?
|-
| 0x200103D9 || 0x3D9 || 0 || 1 || 1 || SetTiledCacheTileSize
|-
| 0x80?003DE || 0x3DE || 0 || Variable || 4 || ?
|-
| 0x800003E0 || 0x3E0 || 0 || 0 || 4 || ?
|-
| 0x200203E7 || 0x3E7 || 0 || 2 || 1 || ?
|-
| 0x800003ED || 0x3ED || 0 || 0 || 4 || ?
|-
| 0x800203EE || 0x3EE || 0 || 2 || 4 || ?
|-
| 0x200403EF || 0x3EF || 0 || 4 || 1 || SetSampleMask
|-
| 0x800003F5 || 0x3F5 || 0 || 0 || 4 || ?
|-
| 0x800103F6 || 0x3F6 || 0 || 1 || 4 || ?
|-
| 0x200503F8 || 0x3F8 || 0 || 5 || 1 || ?
|-
| 0x200203FD || 0x3FD || 0 || 2 || 1 || ?
|-
| 0x2004040C || 0x40C || 0 || 4 || 1 || ?
|-
| 0x200C0420 || 0x420 || 0 || 12 || 1 || ?
|-
| 0x80000446 || 0x446 || 0 || 0 || 4 || ?
|-
| 0x80000451 || 0x451 || 0 || 0 || 4 || ?
|-
| 0x800?0452 || 0x452 || 0 || Variable || 4 || ?
|-
| 0x20100458 || 0x458 || 0 || 16 || 1 || ?
|-
| 0x20040478 || 0x478 || 0 || 4 || 1 || ?
|-
| 0x8000047C || 0x47C || 0 || 0 || 4 || ?
|-
| 0x8000047E || 0x47E || 0 || 0 || 4 || ?
|-
| 0x8001047F || 0x47F || 0 || 1 || 4 || ResolveDepthBuffer
|-
| 0x2003048A || 0x48A || 0 || 3 || 1 || ?
|-
| 0x800?04B3 || 0x4B3 || 0 || Variable || 4 || ?
|-
| 0x800104B9 || 0x4B9 || 0 || 1 || 4 || ?
|-
| 0x800?04BA || 0x4BA || 0 || Variable || 4 || ?
|-
| 0x800004BB || 0x4BB || 0 || 0 || 4 || ?
|-
| 0x800?04C3 || 0x4C3 || 0 || Variable || 4 || ?
|-
| 0x200104C4 || 0x4C4 || 0 || 1 || 1 || SetAlphaRef
|-
| 0x200404C7 || 0x4C7 || 0 || 4 || 1 || SetBlendColor
|-
| 0x800004E0 || 0x4E0 || 0 || 0 || 4 || ?
|-
| 0x800?04E5 || 0x4E5 || 0 || Variable || 4 || ?
|-
| 0x800?04E6 || 0x4E6 || 0 || Variable || 4 || ?
|-
| 0x800?04E7 || 0x4E7 || 0 || Variable || 4 || ?
|-
| 0x200204EC || 0x4EC || 0 || 2 || 1 || SetLineWidth
|-
| 0x800?050D || 0x50D || 0 || Variable || 4 || ?
|-
| 0x80000519 || 0x519 || 0 || 0 || 4 || ?
|-
| 0x80000540 || 0x540 || 0 || 0 || 4 || ?
|-
| 0x20010546 || 0x546 || 0 || 1 || 1 || SetPointSize
|-
| 0x2001054C || 0x54C || 0 || 1 || 1 || ResetCounter
|-
| 0x800?054E || 0x54E || 0 || Variable || 4 || ?
|-
| 0x20030554 || 0x554 || 0 || 3 || 1 || SetRenderEnableConditional
|-
| 0x800?0556 || 0x556 || 0 || Variable || 4 || SetRenderEnable?
|-
| 0x2001055B || 0x55B || 0 || 1 || 1 || ?
|-
| 0x2001056F || 0x56F || 0 || 1 || 1 || ?
|-
| 0x80000572 || 0x572 || 0 || 0 || 4 || ?
|-
| 0x800?0574 || 0x574 || 0 || Variable || 4 || ?
|-
| 0x8000057F || 0x57F || 0 || 0 || 4 || ?
|-
| 0x80000580 || 0x580 || 0 || 0 || 4 || ?
|-
| 0x80000591 || 0x591 || 0 || 0 || 4 || ?
|-
| 0x20010592 || 0x592 || 0 || 1 || 1 || ?
|-
| 0x200205F2 || 0x5F2 || 0 || 2 || 1 || ?
|-
| 0x800?05F6 || 0x5F6 || 0 || Variable || 4 || ?
|-
| 0x2001061F || 0x61F || 0 || 1 || 1 || ?
|-
| 0x800?0620 || 0x620 || 0 || Variable || 4 || ?
|-
| 0x80010646 || 0x646 || 0 || 1 || 4 || ?
|-
| 0x800?0648 || 0x648 || 0 || Variable || 4 || ?
|-
| 0x2001064F || 0x64F || 0 || 1 || 1 || SetDepthClamp
|-
| 0x800?066F || 0x66F || 0 || Variable || 4 || ?
|-
| 0x120020671 || 0x671 || 0 || 2 || 9 || ?
|-
| 0x20010674 || 0x674 || 0 || 1 || 1 || ?
|-
| 0x8000068B || 0x68B || 0 || 0 || 4 || ?
|-
| 0x200406C0 || 0x6C0 || 0 || 4 || 1 || ?
|-
| 0x20010703 || 0x703 || 0 || 1 || 1 || ?
|-
| 0x200207?? || 0x7?? Variable || 0 || 2 || 1 || ?
|-
| 0x80300830 || 0x830 || 0 || 48 || 4 || ?
|-
| 0x80400840 || 0x840 || 0 || 64 || 4 || ?
|-
| 0x80500850 || 0x850 || 0 || 80 || 4 || ?
|-
| 0x200308E0 || 0x8E0 || 0 || 3 || 1 || ?
|-
| 0x200308E3 || 0x8E3 || 0 || 3 || 1 || CB_POS(Const buffer position)
|-
| 0x200308E4 || 0x8E4 || 0 || 3 || 1 || ?
|-
| 0x80??0904 || 0x904 || 0 || Variable || 4 || ?
|-
| 0x80??090C || 0x90C || 0 || Variable || 4 || ?
|-
| 0x80??0914 || 0x914 || 0 || Variable || 4 || ?
|-
| 0x80??091C || 0x91C || 0 || Variable || 4 || ?
|-
| 0x80??0924 || 0x924 || 0 || Variable || 4 || ?
|-
| 0x80000D1E || 0xD1E || 0 || 0 || 4 || ?
|-
| 0x800?0D28 || 0xD28 || 0 || Variable || 4 || ?
|-
| 0x20010D29 || 0xD29 || 0 || 1 || 1 || ?
|-
| 0x20010D34 || 0xD34 || 0 || 1 || 1 || ?
|-
| 0xA0020E00 || 0xE00 || 0 || 2 || 5 || BeginTransformFeedback
|-
| 0x20010E02 || 0xE02 || 0 || 1 || 1 || ?
|-
| 0x80020E04 || 0xE04 || 0 || 2 || 4 || ?
|-
| 0x20010E06 || 0xE06 || 0 || 1 || 1 || ?
|-
| 0xA0030E0A || 0xE0A || 0 || 3 || 5 || ?
|-
| 0x80050E0C || 0xE0C || 0 || 5 || 4 || ?
|-
| 0x800?0E0E || 0xE0E || 0 || Variable || 4 || ?
|-
| 0x20010E10 || 0xE10 || 0 || 1 || 1 || ?
|-
| 0xA0040E12 || 0xE12 || 0 || 4 || 5 || ?
|-
| 0x20010E1A || 0xE1A || 0 || 1 || 1 || ?
|-
| 0xA0040E1C || 0xE1C || 0 || 4 || 5 || ?
|-
| 0x81900E1E || 0xE1E || 0 || 400 || 4 || ?
|-
| 0x80000E20 || 0xE20 || 0 || 0 || 4 || ?
|-
| 0x80000E24 || 0xE24 || 0 || 0 || 4 || ?
|-
| 0xA0040E2C || 0xE2C || 0 || 4 || 5 || PushDebugGroup
|-
| 0xA0020E2E || 0xE2E || 0 || 2 || 5 || PopDebugGroupId
|-
| 0xA0030E30 || 0xE30 || 0 || 3 || 5 || DrawArrays
|-
| 0xA0050E32 || 0xE32 || 0 || 5 || 5 || DrawArraysIndirect?
|-
| 0xA0050E34 || 0xE34 || 0 || 5 || 5 || DrawArraysInstanced?
|-
| 0xA0050E36 || 0xE36 || 0 || 5 || 5 || DrawElements
|-
| 0xA0060E38 || 0xE38 || 0 || 6 || 5 || DrawElementsIndirect?
|-
| 0xA0060E3A || 0xE3A || 0 || 6 || 5 || DrawElementsInstanced?
|-
| 0xA0050E42 || 0xE42 || 0 || 5 || 5 || ?
|-
| 0xA0060E44 || 0xE44 || 0 || 6 || 5 || ?
|}

Note: These still need to be heavily verified and ''could'' be wrong.

=== BindObject ===

In order to bind an engine object to a specific subchannel, method 0 (BindObject) must be used first. The target subchannel is specified in bits 15-13 of the command word.

After the engine object is bound to the desired subchannel, setting it's value in bits 15-13 of any subsequent command word will make PFIFO forward the command to the target engine.

This method only takes one argument, an [[#Engine_IDs|engine ID]].

==== Engine IDs ====

{| class="wikitable"
|-
! scope="col"| ID
! scope="col"| Engine
|-
|0x902D
|FERMI_TWOD_A (2D)
|-
|0xB197
|MAXWELL_B (3D)
|-
|0xB1C0
|MAXWELL_COMPUTE_B
|-
|0xA140
|KEPLER_INLINE_TO_MEMORY_B
|-
|0xB0B5
|MAXWELL_DMA_COPY_A (DMA)
|}

=== Macro ===

Macros are small programs that can be uploaded to the gpu and are capable of reading and writing to the 3D engine registers on the GPU. Those macro programs can be executed by calling methods from address 0xe00 onwards on the 3D engine. The macros also accepts parameters, stored on a FIFO that can be read on the macro using a instruction called parm, this instruction pops the FIFO and reads the next parameter. Macros can be called using methods starting at 0xe00, where the first method triggers the macro execution, and the second one is used to push parameters to the FIFO, that can be read from the macro program using parm. This also allows programs to use a variable number of parameters if desired.

The first parameter is written to 0xe00 + n * 2 (where n is the macro index), and all subsequent parameters should be pushed to the FIFO using 0xe01 + n * 2. The first parameter is placed the general purpose register R1 in the shader program when execution starts.

Official games uses those macros to conditionally write registers, one example of such uses it the macro at 0xe24, that is used to set shader registers (including shader address and binding the c1 Constant Buffer to the shader). In some cases, it's also used to set registers unconditionally.

=== Fences ===

Command lists can contain fences to ensure that commands are executed on the correct order, and subsequent commands are only sent when the previously sent commands were already processed by the GPU. Fences uses the QUERY_* commands, and works like this:

* First, QUERY_ADDRESS_HIGH and QUERY_ADDRESS_LOW commands are added to the Command List, with the High/Low 32 bits part of the 64-bits GPU Virtual Address where the fence is located. This GPU Virtual Address needs to be mapped to the process Virtual Address beforehand.
* Then, QUERY_SEQUENCE is added with a sequential number. This number is basically a incrementing counter, so the first Command List can have QUERY_SEQUENCE = 1, the next one QUERY_SEQUENCE = 2, 3, 4... and so on.
* Finally, QUERY_GET is added and contains the mode and other unknown data.

The above commands are added using the [[#Submission_mode|increasing mode]], since the Ids for all those 4 registers are sequential.

==== QUERY_GET Structure ====

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|1-0
|Mode
|-
|4
|Fence
|-
|15-12
|Unit
|}

==== QUERY_GET Mode ====

{| class="wikitable"
|-
! scope="col"| Value
! scope="col"| Mode
|-
|0
|Write
|-
|1
|Sync
|-
|2
|Write ?
|-
|3
|Write ?
|}

TODO: Move this to a separate page with all GPU Commands with descriptions. Also figure out what the other values mean.

Some of the other fields are still unknown/unobserved.

Official games will set Mode to 0, Fence to 1 and Unit to 0xF. The QUERY_SEQUENCE value is then written by the GPU to the address pointed to by QUERY_ADDRESS.
On the CPU side, the game code should wait until the value at the address pointed to by QUERY_ADDRESS is >= to the last written SEQUENCE value. Official code waits for this condition to be true on a loop, and won't send any further commands before that.

== Vertex Data Submission ==

Note: This is a observation on how the game Puyo Puyo Tetris sends textured squares to the GPU.

# VERTEX_ATTRIB_FORMAT (0-15) are set (only the first 3 are really used, the rest are set float, with Size = 1 and offset at 0).
# VERTEX_ARRAY_FETCH (0) is set with the lower 12 bits set to 0x1c (Stride) and bit 12 to 1 (Enabled).
# VERTEX_ARRAY_START_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located.
# VERTEX_ARRAY_LIMIT_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located, plus the Vertex Data size in bytes minus 1.
# VERTEX_BEGIN_GL is used with the primitive type set to TRIANGLE_STRIP.
# VERTEX_BUFFER_FIRST with value 0 (indicating the index of the first primitive to render?).
# VERTEX_BUFFER_COUNT is set to 4, because the Vertex Buffer with the square has 4 vertices.
# VERTEX_END_GL is used with value 0 (currently unknown what this value means).

== Texture View ==

Texture information such as address, format and size is sent to the GPU through a structure know as Texture View (a.k.a. Texture Image Control, or TIC). Each texture that the game uses needs a separate TIC, and those TICs are written to a table, one after the other. Each [[#TIC_Structure|TIC entry]] has 0x20 bytes, and is composed of 8 32-bits words where the texture information is packed.

The index of the TIC entries that should be used by the shader is sent to the GPU with the CB_POS/CB_DATA (0) methods. Games usually follows the following steps to write the TIC entry indexes:

* Macro 0xe1a is used to set CB_ADDRESS_HIGH/LOW registers to the GPU Virtual Address of the Constant Buffer set on the register 0x982 (the ''Texture Constant Buffer'' index register), and also sets CB_SIZE.
* CB_POS is used to set the write offset of the Constant Buffer to 0x20 + n * 4, where ''n'' is the index of the handle being used on the shader sampler.
* CB_DATA (0) method is used to write the value into the Constant Buffer. The value is a ''Handle'' where the lower 20 bits is the TIC index, and the higher 12 bits is the TSC (Texture Sampler Control) index.

The address of a given TIC entry can be calculates as:

tic_entry_address = tic_base_address + tic_index * 0x20

Where ''tic_base_address'' is the address written to TIC_ADDRESS_HIGH/LOW (methods 0x1574 and 0x1578), ''tic_index'' is the lower 20 bits of the word written into the Const Buffer with CB_DATA (0), and 0x20 is the size of each TIC entry in bytes.

The texture is accessed on the shader using one of the texture sampling instructions (usually the TEXS instruction). One of the parameters for this instruction is the ''Handle'' index. This index start at 8, so the index 8 will access the handle at 8 * 4 = 0x20 on the ''Texture Constant Buffer''. Each shader stage has a separate Constant Buffer, so for fragment shaders, this is located at CB_ADDRESS + 4 * CB_SIZE + TEXS_index * 4 (where 4 is the index of the fragment shader stage).

=== TIC Structure ===

{| class="wikitable" border="1"
|-
! Word || Bits || Description
|-
| 0 || 6-0 || [[GPU_Texture_Formats#Texture_Formats|Texture Format]]
|-
| 0 || 9-7 || [[#Channel_Data_Type|R Channel Data Type]]
|-
| 0 || 12-10 || [[#Channel_Data_Type|G Channel Data Type]]
|-
| 0 || 15-13 || [[#Channel_Data_Type|B Channel Data Type]]
|-
| 0 || 18-16 || [[#Channel_Data_Type|A Channel Data Type]]
|-
| 1 || 31-0 || Lower 32-bits of the Texture GPU Virtual Address
|-
| 2 || 15-0 || Higher 16-bits of the Texture GPU Virtual Address
|-
| 4 || 15-0 || Texture Width minus 1
|-
| 5 || 15-0 || Texture Height minus 1
|}

==== Channel Data Type ====

{| class="wikitable" border="1"
|-
! Value || Type
|-
| 1 || SNORM
|-
| 2 || UNORM
|-
| 3 || SINT
|-
| 4 || UINT
|-
| 5 || SNORM_FORCE_FP16
|-
| 6 || UNORM_FORCE_FP16
|-
| 7 || FLOAT
|}

== References ==

FIFO engine overview:
[https://envytools.readthedocs.io/en/latest/hw/fifo/intro.html]

Method values from the Fermi family GPU (a bit older than the Tegra X1, but values seems to be mostly the same):
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gf100_3d.xml]

TIC structure used on a Maxwell GPU:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gm200_texture.xml]

Values for some types used on the above XML:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/nv_3ddefs.xml]

Command word packing code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_winsys.h]

TIC entry pack/write code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_tex.c#n65]

GPU

2018-02-05T17:37:20Z

Gdkchan: Add missing dot

GPU

2018-02-05T17:19:36Z

Gdkchan:

GPU Texture Formats

2018-02-05T12:33:59Z

Gdkchan: Created page with "== Texture Formats == {| class="wikitable" border="1" |- ! Value || Format |- | 0x01 || R32_G32_B32_A32 |- | 0x02 || R32_G32_B32 |- | 0x03 || R16_G16_B16_A16 |- | 0x04 || R32..."

== Texture Formats ==

{| class="wikitable" border="1"
|-
! Value || Format
|-
| 0x01 || R32_G32_B32_A32
|-
| 0x02 || R32_G32_B32
|-
| 0x03 || R16_G16_B16_A16
|-
| 0x04 || R32_G32
|-
| 0x05 || R32_B24G8
|-
| 0x06 || ETC2_RGB
|-
| 0x07 || X8B8G8R8
|-
| 0x08 || A8B8G8R8
|-
| 0x09 || A2B10G10R10
|-
| 0x0a || ETC2_RGB_PTA
|-
| 0x0b || ETC2_RGBA
|-
| 0x0c || R16_G16
|-
| 0x0d || G8R24
|-
| 0x0e || G24R8
|-
| 0x0f || R32
|-
| 0x10 || BC6H_SF16
|-
| 0x11 || BC6H_UF16
|-
| 0x12 || A4B4G4R4
|-
| 0x13 || A5B5G5R1
|-
| 0x14 || A1B5G5R5
|-
| 0x15 || B5G6R5
|-
| 0x16 || B6G5R5
|-
| 0x17 || BC7U
|-
| 0x18 || G8R8
|-
| 0x19 || EAC
|-
| 0x1a || EACX2
|-
| 0x1b || R16
|-
| 0x1c || Y8_VIDEO
|-
| 0x1d || R8
|-
| 0x1e || G4R4
|-
| 0x1f || R1
|-
| 0x20 || E5B9G9R9_SHAREDEXP
|-
| 0x21 || BF10GF11RF11
|-
| 0x22 || G8B8G8R8
|-
| 0x23 || B8G8R8G8
|-
| 0x24 || DXT1 (a.k.a. BC1)
|-
| 0x25 || DXT23 (a.k.a. BC2)
|-
| 0x26 || DXT45 (a.k.a. BC3)
|-
| 0x27 || DXN1
|-
| 0x28 || DXN2
|-
| 0x29 || Z24S8
|-
| 0x2a || X8Z24
|-
| 0x2b || S8Z24
|-
| 0x2c || X4V4Z24__COV4R4V
|-
| 0x2d || X4V4Z24__COV8R8V
|-
| 0x2e || V8Z24__COV4R12V
|-
| 0x2f || ZF32
|-
| 0x30 || ZF32_X24S8
|-
| 0x31 || X8Z24_X20V4S8__COV4R4V
|-
| 0x32 || X8Z24_X20V4S8__COV8R8V
|-
| 0x33 || ZF32_X20V4X8__COV4R4V
|-
| 0x34 || ZF32_X20V4X8__COV8R8V
|-
| 0x35 || ZF32_X20V4S8__COV4R4V
|-
| 0x36 || ZF32_X20V4S8__COV8R8V
|-
| 0x37 || X8Z24_X16V8S8__COV4R12V
|-
| 0x38 || ZF32_X16V8X8__COV4R12V
|-
| 0x39 || ZF32_X16V8S8__COV4R12V
|-
| 0x3a || Z16
|-
| 0x3b || V8Z24__COV8R24V
|-
| 0x3c || X8Z24_X16V8S8__COV8R24V
|-
| 0x3d || ZF32_X16V8X8__COV8R24V
|-
| 0x3e || ZF32_X16V8S8__COV8R24V
|-
| 0x40 || ASTC_2D_4X4
|-
| 0x41 || ASTC_2D_5X5
|-
| 0x42 || ASTC_2D_6X6
|-
| 0x44 || ASTC_2D_8X8
|-
| 0x45 || ASTC_2D_10X10
|-
| 0x46 || ASTC_2D_12X12
|-
| 0x50 || ASTC_2D_5X4
|-
| 0x51 || ASTC_2D_6X5
|-
| 0x52 || ASTC_2D_8X6
|-
| 0x53 || ASTC_2D_10X8
|-
| 0x54 || ASTC_2D_12X10
|-
| 0x55 || ASTC_2D_8X5
|-
| 0x56 || ASTC_2D_10X5
|-
| 0x57 || ASTC_2D_10X6
|}

== Reference ==

Adapted from EnvyTools documentation:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gm200_texture.xml]

SVC

2018-01-18T12:50:18Z

Gdkchan:

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano || W0=result
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || svcCancelSynchronization || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || svcGetSystemTick || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=event_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W0=thread_handle || W0=result, X1=out
|-
| 0x26 || svcBreak || X0,X1,X2=info || ?
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory|| X0=addr, X1=size || W0=result
|- style="border-top: double"
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || W0=thread_handle, W1=[[#ThreadContext]]* || W0=result
|-
| 0x34 || [4.0.0+] || X0=ptr, W1=type, X2=? X3=timeout ||
|-
| 0x35 || [4.0.0+] || X0=ptr, W1=type, X2=? W3=? ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=client_handle ?, W2=server_handle ?
|- style="border-top: double"
| 0x4B || [4.0.0+] [[#svcCreateJitMemory]] || X1=addr, X2=size || W0=result, W1=jit_handle
|-
| 0x4C || [4.0.0+] [[#svcMapJitMemory]] || W0=jit_handle, W1=[[#MapJitOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || svcCreateInterruptEvent || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=DebugEventInfo*, W1=debug_handle || W0=result
|-
| 0x64 || svcContinueDebugEvent || W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id || W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, W1=[[#ThreadContextFlags]], X2=ThreadContext* || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || svcSetHardwareBreakPoint || W0=HardwareBreakpointId, X1=watchpoint_flags, X2=watchpoint_value/debug_handle? ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x70 || svcCreatePort || W2=max_sessions, W3=unk_bool, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=srcaddr, W1=process_handle, X2=dstaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X2=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x2000000.

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

[2.0.0+] Size must be less than 0x18000000.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

If dstaddr >= LowerTreshold, the dst-range is enforced to be within the process' "MapRegion". Code can get the range of this region from [[#svcGetInfo]] id0=2,3.

In this case, the mapped memory will have state 0x5C3C0B.

As long as (dstaddr+size) < LowerThreshold, then you can map anywhere but the mapped memory will have state 0x482907 instead.

LowerTreshold is 0x80000000 for 36-bit address spaces, and 0x40000000 for 32-bit ones.

[2.0.0+] Support for the 0x482907 mappings outside the "MapRegion" were removed.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || ThreadContext
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Nano
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nano=0 means "yield thread".

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40, error on num_handles == 0.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''Port:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''Session (server-side):''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

=== Result codes ===

'''0x0:''' Success. One of the objects was signalled before the timeout expired. Handle index is updated to indicate which object signalled.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signalled within the timeout. Handle index is not updated.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must be 0x1000-aligned.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 ||
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) ? || ? || ?
|}
</div>

When used on retail where inx0 bit31 is clear, the system will throw a [[Error_codes|fatal-error]]. Otherwise when bit31 is set, it will return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || MapRegionBaseAddr
|-
| Process || 3 || 0 || MapRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryUsage
|-
| Process || 7 || 0 || TotalHeapUsage
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] NewMapRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] NewMapRegionSize
|-
| Process || 16 || 0 || [3.0.0+] IsVirtualAddressMemoryEnabled
|-
| Process || 17 || 0 || [3.0.0+] Some size in bytes.
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0+] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0+] PrivilegedProcessId_UpperBound
|-
| Thread || 0xF0000002 || 0 || Performance counter related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcCreateJitMemory ==
Takes an address range with backing memory to create the JIT memory object.

The memory is initially memset to 0xFF after being locked.

== svcMapJitMemory ==
Maps the backing memory for a JIT memory object into the current process.

For [[#MapJitOperation|MapJitOperation_MapOwner]], memory permission must be RW-.

For [[#MapJitOperation|MapJitOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#MapJitOperation|MapJitOperation_UnmapOwner/MapJitOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the memory as RW-, and the other "slave" process to map it R-X.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || SrcAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || DstAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || void* || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u64 || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== MapJitOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || MapJitOperation_MapOwner
|-
| 1 || MapJitOperation_MapSlave
|-
| 2 || MapJitOperation_UnmapOwner
|-
| 3 || MapJitOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessEvent ==
{| class=wikitable
! Value || Name
|-
| 0 || ProcessEvent_Created
|-
| 1 || ProcessEvent_DebugAttached
|-
| 2 || ProcessEvent_DebugDetached
|-
| 3 || ProcessEvent_Crashed
|-
| 4 || ProcessEvent_Running
|-
| 5 || ProcessEvent_Exiting
|-
| 6 || ProcessEvent_Exited
|-
| 7 || ProcessEvent_DebugSuspended
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_ActualPriority
|-
| 1 ||
|-
| 2 || DebugThreadParam_CpuCore
|-
| 3 ||
|-
| 4 || DebugThreadParam_CoreMask
|}

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || Is64bit
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 ||
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsSystem
|-
| 0x28 || 4 || || ResourceLimitHandle
|-
| 0x2C || 4 ||
|}

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] JitMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_WeirdSharedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_MappedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_JitReadOnly || Mapped in kernel during [[#svcMapJitMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_JitWritable || Mapped in kernel during [[#svcMapJitMemory]].
|}

== ContinueDebugFlags ==
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || SwallowException
|-
| 1 || 2 ||
|-
| 2 || 4 || ResumeAllThreads
|}

== DebugEventInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || Type (0=PausedThread, 1=RunningThread, 2=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 ||
|-
| 3 || DebugEvent_Exit
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_UndefinedInstruction
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|}

UndefinedInstruction specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
There is userland code for handling exceptions, however this doesn't seem to be executed on retail mode.

When a usermode exception occurs, it jumps to the main code binary entrypoint (main_binary_address + 0 == '''_start''').

During normal boot '''_start''' is invoked with X0=0 and X1=main_thread_handle (triggering normal crt0 setup).
During an usermode exception '''_start''' is invoked with X0=exception_info0_ptr and X1=exception_info1_ptr instead.

The '''_start''' method determines whether to boot normally or handle an exception if X0 is set to 0 or not.

Switch System Flaws

2018-01-18T12:49:09Z

Gdkchan:

System Flaws are used to execute unofficial code (homebrew) on the Nintendo Switch. This page is a list of known and public Switch System Flaws.

=List of Switch System Flaws=

== Hardware ==
{| class="wikitable" border="1"
! Summary
! Description
! Fixed with hardware model/revision
! Newest hardware model/revision this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| GMMU DMA attack
| The Switch's GPU includes a separate MMU (GMMU) that is allowed to bypass the system's IOMMU (SMMU). By accessing the GPU's MMIO region and manipulating the page table entries in the GMMU, an attacker can read/write any portion of the DRAM (except memory carveouts).
| None
| HAC-001
| Summer 2017
| December 28, 2017
| [[User:hexkyz|hexkyz]], [[User:SciresM|SciresM]] and [[User:qlutoo|qlutoo]]
|-
|}

== System software ==

=== Stage 1 Bootloader ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Null-dereference in panic()
| The Switch's stage 1 bootloader, on panic(), clears the stack and then attempts to clear the Security Engine. However, it does so by dereferencing a pointer to the SE in .bss (initially NULL), and this pointer doesn't get initialized until partway into the bootloader's main() after several functions that might panic() are called. Thus, a panic() caused prior to SE initialization would result in the SE pointer still being NULL when dereferenced. This would cause a data abort, causing the bootloader to clear the stack and then try to clear the security engine...dereferencing NULL again, over and over in a loop.

In 3.0.0, this was fixed by moving the security engine initialization earlier in main(), before the first function that could potentially panic().
| Infinite clear-the-stack-then-data-abort loop very early in boot, before SBK/other keyslots are cleared. Probably useless for anything more interesting.
| [[3.0.0]]
| [[3.0.0]]
| Early July, 2017
| July 30, 2017
| Everyone who diff'd 2.3.0 and 3.0.0 Package1
|-
| FUSE_DIS_PGM not written by package1
| The switch's hardware fuse driver contains a write-once bit in a register called "FUSE_DIS_PGM", which disables burning fuses until the next reboot. While Nintendo's bootloader code for waking up from sleep writes this on all firmware, the actual package1 initial bootloader forgets to write to it on cold reboot.

This isn't too big of a problem because another fuse is burnt on retail devices (production mode), which prevents burning *all* fuses other than ODM_RESERVED ones in hardware.

This was fixed in 3.0.0 by writing to the register on cold boot (although the write happens in TZ instead of package1 where it should take place, possibly to obfuscate the fact that they made this mistake).
| Burning arbitrary ODM reserved fuses with TZ code execution, which should never be possible for non-bootloader code.

Warning: one could irreparably brick one's console by playing with this.
| [[3.0.0]]
| [[3.0.0]]
| late summer/early fall 2017
| December 31, 2017
| SciresM, Motezazer
|-
|}

=== TrustZone ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Non-atomic mutexes
| When an [[SMC]] is called, TrustZone sets a global variable to mark that an SMC is in progress, so that two SMCs using shared resources (like the security engine) do not trample on one another. On 1.0.0, this global variable was written using non-atomic writes, and thus a race condition is possible.

However, the SMC handler enforces that all SMCs must be called from core #3, unless the top-level handler ID is 1 (SMCs internal to the kernel). Thus, the only SMCs that can be run side-by-side are [any userland smc] and smcGetRandomBytesForKernel, and this turns out to not really be abusable.
| Mostly useless. Maybe some oob-write into unused (and thus useless) memory if running smcGetRandomBytesForKernel and smcGetRandomBytesForUser at the same time.
| [[2.0.0]]
| [[2.0.0]]
| December 2017 (Probably earlier by others)
| January 18, 2018
| SciresM, probably others.
|-
|}

=== Kernel ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Syscall Infoleaks
| Many syscalls leaked kernel pointers on sad paths (for example svcSetHeapSize and svcQueryMemory), until they landed a bunch of fixes in 2.0.0.
| Nothing really.
| Unfixed
| 2.0.0
|
|
| ?
|-
| GetLastThreadInfo UAF
| GetLastThreadInfo syscall gets last-scheduled-KThread pointer from KScheduler object. This pointer is not reference counted, and can be pointing to a freed KThread.
| Nothing. There is a theoretical race that might leak from a KThread from a different process, but it's impossible to trigger practically.
| Unfixed
|
| 15 October
| 17 October
| [[User:qlutoo|qlutoo]]
|-
| Bad irq_id check in CreateInterruptEvent
| CreateInterruptEvent syscall is designed to work only for irq_id >= 32. All irq_ids < 32 are "per-core" and reserved for kernel use (watchdog/scheduling/core communications).
On 1.0.0 you could supply irq_id < 32 and it would write outside the SharedIrqs table.
| You can register irq's in the Core3Irqs table, and thus register per-core irqs for core3, that are normally reserved for kernel. Useless.
| 2.0.0
| 2.0.0
| ~October
| 17 October
| [[User:qlutoo|qlutoo]]
|-
| Kernel .text mapped executable in usermode
| Prior to [[3.0.2]] the kernel .text was [[Memory_layout|mapped]] in usermode as executable. This can be used for usermode ROP for bypassing ASLR, but SVCs/IPC are not usable by running kernel .text in usermode.
| Executing kernel .text in usermode
| [[3.0.2]]
| [[3.0.2]]
|
| 34c3 (December 28, 2017)
| [[User:qlutoo|qlutoo]]
|-
| Memory Controller not properly secured
| The Switch OS originally had the memory controller not set to be accessible only by the secure-world, which was problematic because insecure access can compromise the kernel.

This was fixed partially in [[2.0.0]] by blacklisting the memory controller from being mapped by user-processes, and was fixed entirely in [[4.0.0]] by making the memory controller TZ-only and making all kernel accesses go through [[SMC|smcReadWriteRegister]].
| With some way to access the memory controller MMIO, arbitrary kernel code execution.
| [[4.0.0]]
| [[4.0.0]]
| January 2018
| January 2018
| SciresM, yellows8
|-
|}

=== FIRM-package System Modules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Service access control bypass (sm:h, smhax, probably other names)
| Prior to [[3.0.1]], the ''service manager'' (sm) built-in system module treats a user as though it has full permissions if the user creates a new "sm:" port session but bypasses [[Services_API#Initialize|initialization]]. This is due to the other sm commands skipping the service ACL check for Pids <= 7 (i.e. all kernel bundled modules) and that skipping the initialization command leaves the Pid field uninitialized.
In [[3.0.1]], sm returns error code 0x415 if [[Services_API#Initialize|Initialize]] has not been called yet.
| Acquiring, registering, and unregistering arbitrary services
| [[3.0.1]]
| [[3.0.1]]
| May 2017
| August 17, 2017
| Everyone
|-
| Overly permissive SPL service
| The concept behind the switch's [[SMC|Secure Monitor]] is that all cryptographic keydata is located in userspace, but stored as "access keys" encrypted with "keks" that never leave TrustZone. The [[SPL services|spl]] ("security processor liaison"?) service serves as an interface between the rest of the system and the secure monitor. Prior to [[4.0.0]], spl exposed only a single service "spl:", which provided all TrustZone wrapper functions to all sysmodules with access to it. Thus anyone with access to the spl: service (via smhax or by pwning a sysmodule with access) could do crypto with any access keys they knew.

This was fixed in [[4.0.0]] by splitting spl: into spl:, spl:mig, spl:ssl, spl:es, and spl:fs.
| Arbitrary spl: crypto with any access keys one knows. For example, one could use the SSL module's access keys to decrypt their console's SSL certificate private key without having to pwn the SSL sysmodule.
| [[4.0.0]]
| [[4.0.0]]
| Summer 2017 (after smhax was discovered).
| December 23, 2017
| Everyone
|-
| Single session services not really single session
| Several "critical" services (like fsp-ldr, fsp-pr, sm:m, etc) are meant to only ever hold a single session with a specific sysmodule. However, when a sysmodule dies, all its service session handles are released -- and thus killing the holder of a single session handle would allow one (via sm:hax etc) to get access to that service.

This was fixed in [[4.0.0]] by adding a semaphore to these critical single-session services, so that even if one gets access to them an error code will be returned when attempting to use any of their commands.
| With some way to access these services and kill their session holders: dumping sysmodule code, arbitrary service access, elevated filesystem permissions, etc.
| [[4.0.0]]
| [[4.0.0]]
| May/June 2017 (basically immediately after smhax was discovered)
| December 30, 2017
| Everyone
|-
|}

=== System Modules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Out-of-bounds array read for [[BCAT_Content_Container]] secret-data index
| The [[BCAT_Content_Container]] secret-data index is not validated at all. This is handled before the RSA-signature(?) is ever used. Since the field is an u8, a total of 0x800-bytes relative to the array start can be accessed.
This is not useful since the string loaded from this array is only involved with key-generation.
|
| Unknown
| [[2.0.0]]
| August 4, 2017
| August 6, 2017
| [[User: shinyquagsire23|Shiny Quagsire]], [[User:Yellows8|Yellows8]] (independently)
|-
| OOB Read in NS system module (pl:utoohax, pl:utonium, maybe other names)
| Prior to [[3.0.0]], pl:u (Shared Font services implemented in the NS sysmodule) service commands 1,2,3 took in a signed 32-bit index and returned that index of an array but did not check that index at all. This allowed for an arbitrary read within a 34-bit range (33-bit signed) from NS .bss. In [[3.0.0]], sending out of range indexes causes error code 0x60A to be returned.
| Dumping full NS .text, .rodata and .data, infoleak, etc
| [[3.0.0]]
| [[3.0.0]]
| April 2017
| On exploit's fix in [[3.0.0]]
| [[User:qlutoo|qlutoo]], Reswitched team (independently)
|-
| Unchecked domain ID in common IPC code
| Prior to [[2.0.0]], object IDs in [[IPC_Marshalling#Domain_message|domain messages]] are not bounds checked. This out-of-bounds read could be exploited to brute-force ASLR and get PC control in some services that support domain messages.
|
| 2.0.0
| 2.0.0
| ~July 2017
| 20 July 2017‎
| [[User:hthh|hthh]]
|}

GPU

2018-01-15T00:37:23Z

Gdkchan:

GPU

2018-01-15T00:02:16Z

Gdkchan:

GPU

2018-01-14T23:34:17Z

Gdkchan:

GPU

2018-01-14T23:27:42Z

Gdkchan:

GPU

2018-01-14T23:21:49Z

Gdkchan: Created page with "==Mapping Memory== First, to map a memory region on the GPU Address Space, caching needs to be disabled by using svcSetMemoryAttribute. The Addr..."