Nintendo Switch Brew - User contributions [en]

Shared Database services

2018-04-22T21:07:14Z

OgniK:

= pl:u =
This is "nn::pl::detail::ISharedFontManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestLoad]]
|-
| 1 || [[#GetLoadState]]
|-
| 2 || [[#GetSize]]
|-
| 3 || [[#GetSharedMemoryAddressOffset]]
|-
| 4 || [[#GetSharedMemoryNativeHandle]]
|-
| 5 || [[#GetSharedFontInOrderOfPriority]]
|}

== RequestLoad ==
Takes a [[#SharedFontType]] (uint32), no output.

== GetLoadState ==
Takes a [[#SharedFontType]] (uint32), returns the [[#LoadState]] (uint32).

=== LoadState ===
{| class="wikitable" border="1"
|-
! Value || Description
|-
| 0x00 || Loading
|-
| 0x01 || Loaded
|}

== GetSize ==
Takes a [[#SharedFontType]] (uint32), returns the Font Size (uint32).

== GetSharedMemoryAddressOffset ==
Takes a [[#SharedFontType]] (uint32), returns the offset (uint32) to the Font Address.

== GetSharedMemoryNativeHandle ==
No input, returns an output SharedMemory handle.

User-processes map this SharedMemory with size=0x1100000 and permissions=R--.

Font data is TTF, located at the offset returned by [[#GetSharedMemoryAddressOffset]].

== GetSharedFontInOrderOfPriority ==
Takes an input u64 [[Settings_services#LanguageCode|LanguageCode]] and 3 type-0x6 output buffers, returns an output u8 and u32. The u8 is a bool to specify if the fonts are loaded or not and the u32 is the font count.
The first buffer contains a list of [[#SharedFontType|Shared font types]], the second buffer contains the font offsets and the final buffer contains the font sizes.
The buffers are an array of u32s which specify information about a specific font. Buffer1[n] is related to Buffer2[n] and Buffer3[n].
Example: Font index 0s offset is at Buffer2[0], size is at Buffer3[0].
The fonts are relative to the shared memory created by [[#GetSharedMemoryNativeHandle]]

== SharedFontType ==
{| class="wikitable" border="1"
|-
! Value || Description
|-
| 0x00 || Japan, US and Europe (Standard)
|-
| 0x01 || Chinese Simplified
|-
| 0x02 || Extended Chinese Simplified
|-
| 0x03 || Chinese Traditional
|-
| 0x04 || Korean (Hangul)
|-
| 0x05 || Nintendo Extended
|}

= mii:u, mii:e =
This is "nn::mii::detail::IStaticService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetDatabaseService
|}

== IDatabaseService ==
This is "nn::mii::detail::IDatabaseService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsUpdated
|-
| 1 || IsFullDatabase
|-
| 2 || GetCount
|-
| 3 || Get
|-
| 4 || Get1
|-
| 5 || UpdateLatest
|-
| 6 || BuildRandom
|-
| 7 || BuildDefault
|-
| 8 || Get2
|-
| 9 || Get3
|-
| 10 || UpdateLatest1
|-
| 11 || FindIndex
|-
| 12 || Move
|-
| 13 || AddOrReplace
|-
| 14 || Delete
|-
| 15 || DestroyFile
|-
| 16 || DeleteFile
|-
| 17 || Format
|-
| 18 || Import
|-
| 19 || Export
|-
| 20 || IsBrokenDatabaseWithClearFlag
|-
| 21 || GetIndex
|-
| 22 || [5.0.0+] SetInterfaceVersion
|-
| 23 || [5.0.0+] Convert
|}

= miiimg =
This is "nn::mii::detail::IImageDatabaseService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Initialize
|-
| 10 || Reload
|-
| 11 || GetCount
|-
| 12 || IsEmpty
|-
| 13 || IsFull
|-
| 14 || GetAttribute
|-
| 15 || LoadImage
|-
| 16 || AddOrUpdateImage
|-
| 17 || DeleteImages
|-
| 100 || DeleteFile
|-
| 101 || DestroyFile
|-
| 102 || ImportFile
|-
| 103 || ExportFile
|-
| 104 || ForceInitialize
|}

[[Category:Services]]

Shared Database services

2018-04-22T20:59:59Z

OgniK: spelling error

= pl:u =
This is "nn::pl::detail::ISharedFontManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestLoad]]
|-
| 1 || [[#GetLoadState]]
|-
| 2 || [[#GetSize]]
|-
| 3 || [[#GetSharedMemoryAddressOffset]]
|-
| 4 || [[#GetSharedMemoryNativeHandle]]
|-
| 5 || [[#GetSharedFontInOrderOfPriority]]
|}

== RequestLoad ==
Takes a [[#SharedFontType]] (uint32), no output.

== GetLoadState ==
Takes a [[#SharedFontType]] (uint32), returns the [[#LoadState]] (uint32).

=== LoadState ===
{| class="wikitable" border="1"
|-
! Value || Description
|-
| 0x00 || Loading
|-
| 0x01 || Loaded
|}

== GetSize ==
Takes a [[#SharedFontType]] (uint32), returns the Font Size (uint32).

== GetSharedMemoryAddressOffset ==
Takes a [[#SharedFontType]] (uint32), returns the offset (uint32) to the Font Address.

== GetSharedMemoryNativeHandle ==
No input, returns an output SharedMemory handle.

User-processes map this SharedMemory with size=0x1100000 and permissions=R--.

Font data is TTF, located at the offset returned by [[#GetSharedMemoryAddressOffset]].

== GetSharedFontInOrderOfPriority ==
Takes an input u64 [[Settings_services#LanguageCode|LanguageCode]] and 3 type-0x6 output buffers, returns an output u8 and u32. The u8 is a bool to specify if the fonts are loaded or not and the u32 is the font count.
The first buffer contains the font indexes, the second buffer contains the font offsets and the final buffer contains the font sizes.
The buffers are an array of u32s which specify information about a specific font. Buffer1[n] is related to Buffer2[n] and Buffer3[n].
Example: Font index 0s offset is at Buffer2[0], size is at Buffer3[0].

== SharedFontType ==
{| class="wikitable" border="1"
|-
! Value || Description
|-
| 0x00 || Japan, US and Europe (Standard)
|-
| 0x01 || Chinese Simplified
|-
| 0x02 || Extended Chinese Simplified
|-
| 0x03 || Chinese Traditional
|-
| 0x04 || Korean (Hangul)
|-
| 0x05 || Nintendo Extended
|}

= mii:u, mii:e =
This is "nn::mii::detail::IStaticService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetDatabaseService
|}

== IDatabaseService ==
This is "nn::mii::detail::IDatabaseService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsUpdated
|-
| 1 || IsFullDatabase
|-
| 2 || GetCount
|-
| 3 || Get
|-
| 4 || Get1
|-
| 5 || UpdateLatest
|-
| 6 || BuildRandom
|-
| 7 || BuildDefault
|-
| 8 || Get2
|-
| 9 || Get3
|-
| 10 || UpdateLatest1
|-
| 11 || FindIndex
|-
| 12 || Move
|-
| 13 || AddOrReplace
|-
| 14 || Delete
|-
| 15 || DestroyFile
|-
| 16 || DeleteFile
|-
| 17 || Format
|-
| 18 || Import
|-
| 19 || Export
|-
| 20 || IsBrokenDatabaseWithClearFlag
|-
| 21 || GetIndex
|-
| 22 || [5.0.0+] SetInterfaceVersion
|-
| 23 || [5.0.0+] Convert
|}

= miiimg =
This is "nn::mii::detail::IImageDatabaseService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Initialize
|-
| 10 || Reload
|-
| 11 || GetCount
|-
| 12 || IsEmpty
|-
| 13 || IsFull
|-
| 14 || GetAttribute
|-
| 15 || LoadImage
|-
| 16 || AddOrUpdateImage
|-
| 17 || DeleteImages
|-
| 100 || DeleteFile
|-
| 101 || DestroyFile
|-
| 102 || ImportFile
|-
| 103 || ExportFile
|-
| 104 || ForceInitialize
|}

[[Category:Services]]

Shared Database services

2018-04-22T20:56:11Z

OgniK: /* GetSharedFontInOrderOfPriority */

= pl:u =
This is "nn::pl::detail::ISharedFontManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestLoad]]
|-
| 1 || [[#GetLoadState]]
|-
| 2 || [[#GetSize]]
|-
| 3 || [[#GetSharedMemoryAddressOffset]]
|-
| 4 || [[#GetSharedMemoryNativeHandle]]
|-
| 5 || [[#GetSharedFontInOrderOfPriority]]
|}

== RequestLoad ==
Takes a [[#SharedFontType]] (uint32), no output.

== GetLoadState ==
Takes a [[#SharedFontType]] (uint32), returns the [[#LoadState]] (uint32).

=== LoadState ===
{| class="wikitable" border="1"
|-
! Value || Description
|-
| 0x00 || Loading
|-
| 0x01 || Loaded
|}

== GetSize ==
Takes a [[#SharedFontType]] (uint32), returns the Font Size (uint32).

== GetSharedMemoryAddressOffset ==
Takes a [[#SharedFontType]] (uint32), returns the offset (uint32) to the Font Address.

== GetSharedMemoryNativeHandle ==
No input, returns an output SharedMemory handle.

User-processes map this SharedMemory with size=0x1100000 and permissions=R--.

Font data is TTF, located at the offset returned by [[#GetSharedMemoryAddressOffset]].

== GetSharedFontInOrderOfPriority ==
Takes an input u64 [[Settings_services#LanguageCode|LanguageCode]] and 3 type-0x6 output buffers, returns an output u8 and u32. The u8 is a bool to specify if the fonts are loaded or not and the u32 is the font count.
The first buffer the font indexes, the second buffer contains the font offsets and the final buffer contains the font sizes.
The buffers are arrays of u32 which give information about a specific font. Buffer1[n] is related to Buffer2[n] and Buffer3[n].
Example: Font index 0s offset is at Buffer2[0], size is at Buffer3[0].

== SharedFontType ==
{| class="wikitable" border="1"
|-
! Value || Description
|-
| 0x00 || Japan, US and Europe (Standard)
|-
| 0x01 || Chinese Simplified
|-
| 0x02 || Extended Chinese Simplified
|-
| 0x03 || Chinese Traditional
|-
| 0x04 || Korean (Hangul)
|-
| 0x05 || Nintendo Extended
|}

= mii:u, mii:e =
This is "nn::mii::detail::IStaticService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetDatabaseService
|}

== IDatabaseService ==
This is "nn::mii::detail::IDatabaseService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsUpdated
|-
| 1 || IsFullDatabase
|-
| 2 || GetCount
|-
| 3 || Get
|-
| 4 || Get1
|-
| 5 || UpdateLatest
|-
| 6 || BuildRandom
|-
| 7 || BuildDefault
|-
| 8 || Get2
|-
| 9 || Get3
|-
| 10 || UpdateLatest1
|-
| 11 || FindIndex
|-
| 12 || Move
|-
| 13 || AddOrReplace
|-
| 14 || Delete
|-
| 15 || DestroyFile
|-
| 16 || DeleteFile
|-
| 17 || Format
|-
| 18 || Import
|-
| 19 || Export
|-
| 20 || IsBrokenDatabaseWithClearFlag
|-
| 21 || GetIndex
|-
| 22 || [5.0.0+] SetInterfaceVersion
|-
| 23 || [5.0.0+] Convert
|}

= miiimg =
This is "nn::mii::detail::IImageDatabaseService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Initialize
|-
| 10 || Reload
|-
| 11 || GetCount
|-
| 12 || IsEmpty
|-
| 13 || IsFull
|-
| 14 || GetAttribute
|-
| 15 || LoadImage
|-
| 16 || AddOrUpdateImage
|-
| 17 || DeleteImages
|-
| 100 || DeleteFile
|-
| 101 || DestroyFile
|-
| 102 || ImportFile
|-
| 103 || ExportFile
|-
| 104 || ForceInitialize
|}

[[Category:Services]]

NV services

2018-04-19T22:55:01Z

OgniK: /* NVMAP_IOC_ALLOC */ Observed in yuzu.

The Switch uses a customized NVIDIA driver.

= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
This is "nns::nvdrv::INvDrvServices".

Main NVIDIA driver service.

Each service is used by:
* "nvdrv": regular applications
* "nvdrv:a": applets
* "nvdrv:s": sysmodules
* "nvdrv:t": factory titles

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Open]]
|-
| 1 || [[#Ioctl]]
|-
| 2 || [[#Close]]
|-
| 3 || [[#Initialize]]
|-
| 4 || [[#QueryEvent]]
|-
| 5 || [[#MapSharedMem]]
|-
| 6 || [[#GetStatus]]
|-
| 7 || [[#ForceSetClientPID]]
|-
| 8 || [[#SetClientPID]]
|-
| 9 || [[#DumpGraphicsMemoryInfo]]
|-
| 10 || [3.0.0+] [[#InitializeDevtools]]
|-
| 11 || [3.0.0+] [[#Ioctl2]]
|-
| 12 || [3.0.0+] [[#Ioctl3]]
|-
| 13 || [3.0.0+]
|}

== Open ==
Takes a type-0x5 input buffer for the device-path. Returns the output 32bit '''fd''' and the u32 '''error_code'''.

== Ioctl ==
Takes a 32bit '''fd''', an u32 '''ioctl_cmd''', a type-0x21 input buffer, and a type-0x22 output buffer. Returns an output u32 ('''error_code''').

The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).

== Close ==
Takes a 32bit '''fd'''. Returns an output u32 ('''error_code''').

== Initialize ==
Takes two copy-handles ('''current_process''' and '''transfer_memory''') and an input u32 ('''transfer_memory_size'''). Returns an output u32 ('''error_code''').

Webkit applet creates the transfer-memory with perm = 0 and size 0x300000.

== QueryEvent ==
Takes two input u32s ('''fd''' and '''event_id'''), with the second word immediately after the first one. Returns an output u32 ('''error_code''') and a copy-handle ('''event_handle''').

QueryEvent is only supported on (and implemented differently on):
* /dev/nvhost-gpu
** 1: SmException_BptIntReport
** 2: SmException_BptPauseReport
** 3: ErrorNotifierEvent
* /dev/nvhost-ctrl: Used to get events for SyncPts.
** If bit31-28 is 1, then lower 16-bits contain event_slot, bit27-16 contain syncpt_number.
** If bit31-28 is 0, then lower 4-bits contain event_slot, bit31-4 contains syncpt_number.
* /dev/nvhost-ctrl-gpu
** 1: Returns error_event_handle.
** 2: Returns unknown event.
* /dev/nvhost-dbg-gpu
** Ignores event_id.

== MapSharedMem ==
Takes a copy-handle ('''transfer_memory''') and two input u32s ('''fd''' and '''nvmap_handle'''). Returns an output u32 ('''error_code''').

== GetStatus ==
Takes no input. Returns 0x10-bytes and an output u32 ('''error_code''').

== ForceSetClientPID ==
Takes an input u64 which must [[IPC_Marshalling|match]] the user-process PID ([[AM_services|AppletResourceUserId]]). Returns an output u32 ('''error_code''').

== SetClientPID ==
Takes a PID-descriptor and an u64 which must [[IPC_Marshalling|match]] the user-process PID ([[AM_services|AppletResourceUserId]]). Returns an output u32 ('''error_code''').

== DumpGraphicsMemoryInfo ==
No input or output. Does nothing.

== InitializeDevtools ==
Takes a copy-handle and an input u32. Returns an output u32 ('''error_code''').

== Ioctl2 ==
Takes a type-0x21 buffer, a type-0x22 buffer, a type-0x21 buffer, and two input u32s. Returns an output u32 ('''error_code''').

== Ioctl3 ==
Same input/output as Ioctl2, except cmdhdr_word1 is 0x100B instead of 0xC0B.

== Cmd13 ==
Takes an input u64. No output.

Official user-processes starting with 3.0.0 now use this at the end of nvdrv service init with value 0x1.

= Ioctls =
The ioctl number is generated with the following primitive (see Linux kernel):

#define _IOC(inout, group, num, len) \
(inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))

The following table contains known ioctls.

== /dev/nvhost-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]] ||
|-
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]] ||
|-
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]] ||
|-
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]] ||
|-
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]] ||
|-
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]] ||
|-
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]] ||
|-
| 0xC183001B || Inout || 387 || [[#NVHOST_IOCTL_CTRL_GET_CONFIG]] ||
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_SIGNAL]] ||
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT]] ||
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC]] ||
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_REGISTER]] ||
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_UNREGISTER]] ||
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_EVENT_KILL]] ||
|}

=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
Identical to Linux driver.

struct {
__in u32 id;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
Identical to Linux driver.

struct {
__in u32 id;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
};

=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 lock; // (0==unlock; 1==lock)
};

=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
Identical to Linux driver. Uses 32-bit version and doesn't work.

struct {
__in u32 id;
__in u32 num_offsets;
__in u32 block_size;
__in u32 offsets;
__in u32 values;
__in u32 write;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
Identical to Linux driver.

struct {
__in u32 id;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_GET_CONFIG ===
Gets configured settings. Not available in production mode.

struct {
__in char domain_str[0x41]; // "nv"
__in char param_str[0x41];
__out char config_str[0x101];
};

=== NVHOST_IOCTL_CTRL_EVENT_SIGNAL ===
Signals an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT ===
Waits on an event. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to (('''syncpt_id''' << 0x10) | 0x10000000).

Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.

struct {
__in u32 syncpt_id;
__in u32 threshold;
__in s32 timeout;
__inout u32 value; // in=user_event_id (ignored); out=syncpt_value or user_event_id
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC ===
Waits on an event (async version). If waiting fails, returns error code 0x0B (BadValue).

Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.

struct {
__in u32 syncpt_id;
__in u32 threshold;
__in u32 timeout;
__inout u32 value; // in=user_event_id (ignored); out=syncpt_value or user_event_id
};

=== NVHOST_IOCTL_CTRL_EVENT_REGISTER ===
Registers an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_UNREGISTER ===
Unregisters an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_KILL ===
Kills user events. Exclusive to the Switch.

struct {
__in u64 user_events; // 64-bit bitfield where each bit represents one event
};

== /dev/nvmap ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080101 || Inout || 8 || [[#NVMAP_IOC_CREATE]] ||
|-
| 0x00000102 || - || 0 || NVMAP_IOC_CLAIM || Returns NotSupported
|-
| 0xC0080103 || Inout || 8 || [[#NVMAP_IOC_FROM_ID]] ||
|-
| 0xC0200104 || Inout || 32 || [[#NVMAP_IOC_ALLOC]] ||
|-
| 0xC0180105 || Inout || 24 || [[#NVMAP_IOC_FREE]] ||
|-
| 0xC0280106 || Inout || 40 || NVMAP_IOC_MMAP || Returns NotSupported
|-
| 0xC0280107 || Inout || 40 || NVMAP_IOC_WRITE || Returns NotSupported
|-
| 0xC0280108 || Inout || 40 || NVMAP_IOC_READ || Returns NotSupported
|-
| 0xC00C0109 || Inout || 12 || [[#NVMAP_IOC_PARAM]] ||
|-
| 0xC010010A || Inout || 16 || NVMAP_IOC_PIN_MULT || Returns NotSupported
|-
| 0xC010010B || Inout || 16 || NVMAP_IOC_UNPIN_MULT || Returns NotSupported
|-
| 0xC008010C || Inout || 8 || NVMAP_IOC_CACHE || Returns NotSupported
|-
| 0xC004010D || Inout || 4 || || Returns NotSupported
|-
| 0xC008010E || Inout || 8 || [[#NVMAP_IOC_GET_ID]] ||
|-
| 0xC004010F || Inout || 4 || || Returns NotSupported
|-
| 0x40040110 || In || 4 || || Returns NotSupported
|-
| 0x00000111 || - || 0 || || Returns NotSupported
|-
| 0x40100112 || In || 16 || NVMAP_IOC_EXPORT_FOR_ARUID ||
|-
| 0x40100113 || In || 16 || NVMAP_IOC_IS_OWNED_BY_ARUID ||
|-
| 0x40100114 || In || 16 || NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID ||
|}

=== NVMAP_IOC_CREATE ===
Creates an nvmap object. Identical to Linux driver.

struct {
__in u32 size;
__out u32 handle;
};

=== NVMAP_IOC_FROM_ID ===
Get handle to an existing nvmap object. Identical to Linux driver.

struct {
__in u32 id;
__out u32 handle;
};

=== NVMAP_IOC_ALLOC ===
Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.

struct {
__in u32 handle;
__in u32 heapmask;
__in u32 flags; // (0=read-only, 1=read-write)
__in u32 align;
__in u8 kind;
u8 pad[7];
__inout u64 addr;
};

=== NVMAP_IOC_FREE ===
This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.

struct {
__in u32 handle;
u32 pad;
__out u64 refcount;
__out u32 size;
__out u32 flags; // 1=NOT_FREED_YET
};

=== NVMAP_IOC_PARAM ===
Returns info about a nvmap object. Identical to Linux driver, but extended with further params.

struct {
__in u32 handle;
__in u32 param; // 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
__out u32 result;
};

=== NVMAP_IOC_GET_ID ===
Returns an id for a nvmap object. Identical to Linux driver.

struct {
__out u32 id; //~0 indicates error
__in u32 handle;
};

== /dev/nvdisp-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80040212 || Out || 4 || TEGRA_DC_EXT_CONTROL_GET_NUM_OUTPUTS ||
|-
| 0xC0140213 || Inout || 20 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_PROPERTIES ||
|-
| 0xC1100214 || Inout || 272 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_EDID ||
|-
| 0xC0040216 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT0 ||
|-
| 0xC0040217 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT1 ||
|-
| 0xC0100218 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT2 ||
|-
| 0xC0100219 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT3 ||
|-
| 0xC0040220 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT4 ||
|-
|}

== /dev/nvdisp-disp0, /dev/nvdisp-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40040201 || In || 4 || TEGRA_DC_EXT_GET_WINDOW ||
|-
| 0x40040202 || In || 4 || TEGRA_DC_EXT_PUT_WINDOW ||
|-
| 0xC4C80203 || In || 1224 || TEGRA_DC_EXT_FLIP ||
|-
| 0x80380204 || Out || 56 || TEGRA_DC_EXT_GET_MODE ||
|-
| 0x40380205 || Out || 56 || TEGRA_DC_EXT_SET_MODE ||
|-
| 0x430C0206 || In || 780 || TEGRA_DC_EXT_SET_LUT ||
|-
| 0x40010207 || In || 1 || TEGRA_DC_EXT_ENABLE_DISABLE_CRC ||
|-
| 0x80040208 || Out || 4 || TEGRA_DC_EXT_GET_CRC ||
|-
| 0x80040209 || Out || 4 || TEGRA_DC_EXT_GET_HEAD_STATUS ||
|-
| 0xC038020A || Inout || 56 || TEGRA_DC_EXT_VALIDATE_MODE ||
|-
| 0x4018020B || In || 24 || TEGRA_DC_EXT_SET_CSC ||
|-
| 0xC004020C || Inout || 4 || TEGRA_DC_EXT_GET_VBLANK_SYNCPT ||
|-
| 0x8040020D || Out || 64 || TEGRA_DC_EXT_GET_UNDERFLOWS ||
|-
| 0xC99A020E || Inout || 2458 || TEGRA_DC_EXT_SET_CMU ||
|-
| 0xC004020F || Inout || 4 || TEGRA_DC_EXT_DPMS ||
|-
| 0x80600210 || Out || 96 || TEGRA_DC_EXT_GET_AVI_INFOFRAME ||
|-
| 0x40600211 || In || 96 || TEGRA_DC_EXT_SET_AVI_INFOFRAME ||
|-
| 0xEBFC0215 || Inout || 11260 || TEGRA_DC_EXT_GET_MODE_DB ||
|-
| 0xC003021A || Inout || 3 || TEGRA_DC_EXT_PANEL_GET_VENDOR_ID ||
|-
| 0x803C021B || Out || 60 || TEGRA_DC_EXT_GET_MODE2 ||
|-
| 0x403C021C || In || 60 || TEGRA_DC_EXT_SET_MODE2 ||
|-
| 0xC03C021D || Inout || 60 || TEGRA_DC_EXT_VALIDATE_MODE2 ||
|-
| 0xEF20021E || Inout || 12064 || TEGRA_DC_EXT_GET_MODE_DB2 ||
|-
| 0xC004021F || Inout || 4 || TEGRA_DC_EXT_GET_WINMASK ||
|-
|}

== /dev/nvcec-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010300 || In || 1 || ||
|-
| 0x40010301 || In || 1 || NVCEC_CTRL_ENABLE ||
|-
| 0x804C0302 || Out || 76 || NVCEC_CTRL_GET_PADDR ||
|-
| 0x40040303 || In || 4 || NVCEC_CTRL_SET_LADDR ||
|-
| 0xC04C0304 || Inout || 76 || NVCEC_CTRL_WRITE ||
|-
| 0xC04C0305 || Inout || 76 || NVCEC_CTRL_READ ||
|-
| 0x804C0306 || Out || 76 || NVCEC_CTRL_GET_CONNECTION_STATUS ||
|-
| 0x804C0307 || Out || 76 || NVCEC_CTRL_GET_WRITE_STATUS ||
|-
|}

== /dev/nvhdcp_up-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC4880401 || Inout || 1160 || TEGRAIO_NVHDCP_READ_M ||
|-
| 0xC4880402 || Inout || 1160 || TEGRAIO_NVHDCP_READ_S ||
|-
| 0x40010403 || In || 1 || TEGRAIO_NVHDCP_ON_OFF ||
|-
|}

== /dev/nvdcutil-disp0, /dev/nvdcutil-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010501 || In || 1 || NVDCUTIL_SW_HOTPLUG_IN_OUT ||
|-
| 0x40010502 || In || 1 || NVDCUTIL_VIRTUAL_EDID_ON_OFF ||
|-
| 0x42040503 || In || 1056 || NVDCUTIL_VIRTUAL_EDID_SET_DATA ||
|-
| 0x803C0504 || Out || 60 || NVDCUTIL_GET_MODE ||
|-
| 0x40010505 || In || 1 || NVDCUTIL_TELEMETRY_TEST_ON_OFF ||
|-
|}

== /dev/nvsched-ctrl ==
This is a customized scheduler device.

The way this device is exposed and configured is exclusive to the Switch, since other sources don't have an actual interface for the scheduler.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x00000601 || - || 0 || [[#NVSCHED_CTRL_ENABLE]] ||
|-
| 0x00000602 || - || 0 || [[#NVSCHED_CTRL_DISABLE]] ||
|-
| 0x40180603 || In || 24 || [[#NVSCHED_CTRL_ADD_APPLICATION]] ||
|-
| 0x40180604 || In || 24 || [[#NVSCHED_CTRL_UPDATE_APPLICATION]] ||
|-
| 0x40080605 || In || 8 || [[#NVSCHED_CTRL_REMOVE_APPLICATION]] ||
|-
| 0x80080606 || Out || 8 || [[#NVSCHED_CTRL_GET_ID]] ||
|-
| 0x80080607 || Out || 8 || [[#NVSCHED_CTRL_ADD_RUNLIST]] ||
|-
| 0x40180608 || In || 24 || [[#NVSCHED_CTRL_UPDATE_RUNLIST]] ||
|-
| 0x40100609 || In || 16 || [[#NVSCHED_CTRL_LINK_RUNLIST]] ||
|-
| 0x4010060A || In || 16 || [[#NVSCHED_CTRL_UNLINK_RUNLIST]] ||
|-
| 0x4008060B || In || 8 || [[#NVSCHED_CTRL_REMOVE_RUNLIST]] ||
|-
| 0x8001060C || Out || 1 || [[#NVSCHED_CTRL_HAS_OVERRUN_EVENT]] ||
|-
| 0x8010060D || Out || 16 || [[#NVSCHED_CTRL_GET_NEXT_OVERRUN_EVENT]] ||
|-
| 0x400C060E || In || 12 || [[#NVSCHED_CTRL_PUT_CONDUCTOR_FLIP_FENCE]] ||
|-
| 0x4008060F || In || 8 || [[#NVSCHED_CTRL_DETACH_APPLICATION]] ||
|-
| 0x40100610 || In || 16 || ||
|-
| 0x40100611 || In || 16 || ||
|-
|}

=== NVSCHED_CTRL_ENABLE ===
Enables the scheduler.

=== NVSCHED_CTRL_DISABLE ===
Disables the scheduler.

=== NVSCHED_CTRL_ADD_APPLICATION ===
Adds a new application to the scheduler.

struct {
__in u64 application_id;
__in u64 priority;
__in u64 timeslice;
};

=== NVSCHED_CTRL_UPDATE_APPLICATION ===
Updates the application parameters in the scheduler.

struct {
__in u64 application_id;
__in u64 priority;
__in u64 timeslice;
};

=== NVSCHED_CTRL_REMOVE_APPLICATION ===
Removes the application from the scheduler.

struct {
__in u64 application_id;
};

=== NVSCHED_CTRL_GET_ID ===
Returns the ID of the last scheduled object.

struct {
__out u64 id;
};

=== NVSCHED_CTRL_ADD_RUNLIST ===
Creates a new runlist and returns it's ID.

struct {
__out u64 runlist_id;
};

=== NVSCHED_CTRL_UPDATE_RUNLIST ===
Updates the runlist parameters in the scheduler.

struct {
__in u64 runlist_id;
__in u64 priority;
__in u64 timeslice;
};

=== NVSCHED_CTRL_LINK_RUNLIST ===
Links a runlist to a given application in the scheduler.

struct {
__in u64 runlist_id;
__in u64 application_id;
};

=== NVSCHED_CTRL_UNLINK_RUNLIST ===
Unlinks a runlist from a given application in the scheduler.

struct {
__in u64 runlist_id;
__in u64 application_id;
};

=== NVSCHED_CTRL_REMOVE_RUNLIST ===
Removes the runlist from the scheduler.

struct {
__in u64 runlist_id;
};

=== NVSCHED_CTRL_HAS_OVERRUN_EVENT ===
Returns a boolean to tell if the scheduler has an overrun event or not.

struct {
__out u8 has_overrun;
};

=== NVSCHED_CTRL_GET_NEXT_OVERRUN_EVENT ===
Returns the overrun event's data from the scheduler.

struct {
__out u64 runlist_id;
__out u64 debt;
};

=== NVSCHED_CTRL_PUT_CONDUCTOR_FLIP_FENCE ===
Installs a fence swap event?

struct {
__in u32 fence_id;
__in u32 fence_value;
__in u32 swap_interval;
};

=== NVSCHED_CTRL_DETACH_APPLICATION ===
Places the given application in detached state.

struct {
__in u64 application_id;
};

== /dev/nverpt-ctrl ==
Added in firmware version 3.0.0.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC1280701 || Inout || 296 || NVERPT_TELEMETRY_SUBMIT_DATA ||
|-
| 0xCF580702 || Inout || 3928 || NVERPT_TELEMETRY_SUBMIT_DATA_EX ||
|-
|}

== /dev/nvhost-as-gpu ==
Each fd opened to this device creates an address space. An address space is then later bound with a channel.

Once a nvgpu channel has been bound to an address space it cannot be unbound. There is no support for allowing an nvgpu channel to change from one address space to another (or from one to none).

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40044101 || In || 4 || [[#NVGPU_AS_IOCTL_BIND_CHANNEL]] ||
|-
| 0xC0184102 || Inout || 24 || [[#NVGPU_AS_IOCTL_ALLOC_SPACE]] ||
|-
| 0xC0104103 || Inout || 16 || [[#NVGPU_AS_IOCTL_FREE_SPACE]] ||
|-
| 0xC0184104 || Inout || 24 || [[#NVGPU_AS_IOCTL_MAP_BUFFER]] ||
|-
| 0xC0084105 || Inout || 8 || [[#NVGPU_AS_IOCTL_UNMAP_BUFFER]] ||
|-
| 0xC0284106 || Inout || 40 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX]] ||
|-
| 0x40104107 || In || 16 || [[#NVGPU_AS_IOCTL_INITIALIZE]] ||
|-
| 0xC0404108 || Inout || 64 || [[#NVGPU_AS_IOCTL_GET_VA_REGIONS]] ||
|-
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_INITIALIZE_EX]] ||
|-
| 0xC0??4114 || Inout || Variable || [[#NVGPU_AS_IOCTL_REMAP]] ||
|}

=== NVGPU_AS_IOCTL_BIND_CHANNEL ===
Identical to Linux driver.

struct {
__in u32 fd;
};

=== NVGPU_AS_IOCTL_ALLOC_SPACE ===
This one reserves pages in the device address space.

struct {
__in u32 pages;
__in u32 page_size;
__in u32 flags;
u32 pad;
union {
__out u64 offset;
__in u64 align;
};
};

=== NVGPU_AS_IOCTL_FREE_SPACE ===
This one frees pages from the device address space.

struct {
__in u64 offset;
__in u32 pages;
__in u32 page_size;
};

=== NVGPU_AS_IOCTL_MAP_BUFFER ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
u32 pad;
__in u32 nvmap_handle;
__inout u32 page_size; // 0 means don't care
union {
__out u64 offset;
__in u64 align;
};
};

=== NVGPU_AS_IOCTL_MAP_BUFFER_EX ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

Unaligned size will cause a [[#Panic]].

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__in u32 kind; // -1 is default
__in u32 nvmap_handle;
__inout u32 page_size; // 0 means don't care
__in u64 buffer_offset;
__in u64 mapping_size;
__inout u64 offset;
};

=== NVGPU_AS_IOCTL_UNMAP_BUFFER ===
Unmap a memory region from the device address space.

struct {
__in u64 offset;
};

=== NVGPU_AS_IOCTL_INITIALIZE ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable).

struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u32 flags; // ignored; passes 0
__in u32 reserved; // ignored; passes 0
};

=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
Nintendo modified to get rid of pointer in struct.

struct va_region {
u64 offset;
u32 page_size;
u32 pad;
u64 pages;
};

struct {
u64 not_used; // (contained output user ptr on linux, ignored)
__inout u32 bufsize; // forced to 2*sizeof(struct va_region)
u32 pad;
__out struct va_region regions[2];
};

=== NVGPU_AS_IOCTL_INITIALIZE_EX ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable) with extra params.

struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u32 flags; // passes 0
__in u32 reserved; // ignored; passes 0
__in u64 unk0;
__in u64 unk1;
__in u64 unk2;
};

=== NVGPU_AS_IOCTL_REMAP ===
Nintendo's custom implementation of address space remapping.

struct remap_entry {
__in u16 flags; // 0 or 4
__in u16 kind;
__in u32 nvmap_handle;
__in u32 padding;
__in u32 offset; // (alloc_space_offset >> 0x10)
__in u32 pages; // alloc_space_pages
};

struct {
__in struct remap_entry entries[];
};

== /dev/nvhost-dbg-gpu ==
Returns [[#Errors|NotSupported]] on Open unless nn::settings::detail::GetDebugModeFlag is set.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40084401 || In || 8 || NVGPU_DBG_GPU_IOCTL_BIND_CHANNEL ||
|-
| 0xC0??4402 || Inout || Variable || NVGPU_DBG_GPU_IOCTL_REG_OPS ||
|-
| 0x40084403 || In || 8 || NVGPU_DBG_GPU_IOCTL_EVENTS_CTRL ||
|-
| 0x40044404 || In || 4 || NVGPU_DBG_GPU_IOCTL_POWERGATE ||
|-
| 0x40044405 || In || 4 || NVGPU_DBG_GPU_IOCTL_SMPC_CTXSW_MODE ||
|-
| 0x40044406 || In || 4 || NVGPU_DBG_GPU_IOCTL_SUSPEND_RESUME_SM ||
|-
| 0xC0184407 || Inout || 24 || NVGPU_DBG_GPU_IOCTL_PERFBUF_MAP ||
|-
| 0x40084408 || In || 8 || NVGPU_DBG_GPU_IOCTL_PERFBUF_UNMAP ||
|-
| 0x40084409 || In || 8 || NVGPU_DBG_GPU_IOCTL_PC_SAMPLING ||
|-
| 0x4008440A || In || 8 || NVGPU_DBG_GPU_IOCTL_TIMEOUT ||
|-
| 0x8008440B || Out || 8 || NVGPU_DBG_GPU_IOCTL_GET_TIMEOUT ||
|-
| 0x8004440C || Out || 4 || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT_SIZE ||
|-
| 0x0000440D || None || 0 || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT || Uses Ioctl3.
|-
|}

== /dev/nvhost-prof-gpu ==
Returns [[#Errors|NotSupported]] on Open unless nn::settings::detail::GetDebugModeFlag is set.

This device is identical to [[#/dev/nvhost-dbg-gpu|/dev/nvhost-dbg-gpu]].

== /dev/nvhost-ctrl-gpu ==
This device is for global (context independent) operations on the gpu.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80044701 || Out || 4 || [[#NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE]] ||
|-
| 0x80284702 || Out || 40 || [[#NVGPU_GPU_IOCTL_ZCULL_GET_INFO]] ||
|-
| 0x402C4703 || In || 44 || [[#NVGPU_GPU_IOCTL_ZBC_SET_TABLE]] ||
|-
| 0xC0344704 || Inout || 52 || [[#NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE]] ||
|-
| 0xC0B04705 || Inout || 176 || [[#NVGPU_GPU_IOCTL_GET_CHARACTERISTICS]] ||
|-
| 0xC0184706 || Inout || 24 || NVGPU_GPU_IOCTL_GET_TPC_MASKS ||
|-
| 0x40084707 || In || 8 || [[#NVGPU_GPU_IOCTL_FLUSH_L2]] ||
|-
| 0x4008470D || In || 8 || NVGPU_GPU_IOCTL_INVAL_ICACHE ||
|-
| 0x4008470E || In || 8 || NVGPU_GPU_IOCTL_SET_MMUDEBUG_MODE ||
|-
| 0x4010470F || In || 16 || NVGPU_GPU_IOCTL_SET_SM_DEBUG_MODE ||
|-
| 0xC0084710 || Inout || 8 || NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE ||
|-
| 0x80084711 || Out || 8 || NVGPU_GPU_IOCTL_GET_TPC_EXCEPTION_EN_STATUS ||
|-
| 0x80084712 || Out || 8 || NVGPU_GPU_IOCTL_NUM_VSMS ||
|-
| 0xC0044713 || Inout || 4 || NVGPU_GPU_IOCTL_VSMS_MAPPING ||
|-
| 0x80084714 || Out || 8 || [[#NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK]] ||
|-
| 0x80044715 || Out || 4 || ||
|-
| 0x8018471A || Out || 24 || ||
|-
| 0xC008471B || Inout || 8 || NVGPU_GPU_IOCTL_GET_ERROR_CHANNEL_USER_DATA ||
|-
| 0xC010471C || Inout || 16 || NVGPU_GPU_IOCTL_GET_GPU_TIME ||
|-
| 0xC108471D || Inout || 264 || NVGPU_GPU_IOCTL_GET_CPU_TIME_CORRELATION_INFO ||
|}

=== NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE ===
Returns the GPU's ZCULL context size. Identical to Linux driver.

struct {
__out u32 size;
};

=== NVGPU_GPU_IOCTL_ZCULL_GET_INFO ===
Returns GPU's ZCULL information. Identical to Linux driver.

struct {
__out u32 width_align_pixels;
__out u32 height_align_pixels;
__out u32 pixel_squares_by_aliquots;
__out u32 aliquot_total;
__out u32 region_byte_multiplier;
__out u32 region_header_size;
__out u32 subregion_header_size;
__out u32 subregion_width_align_pixels;
__out u32 subregion_height_align_pixels;
__out u32 subregion_count;
};

=== NVGPU_GPU_IOCTL_ZBC_SET_TABLE ===
Sets the active ZBC table. Identical to Linux driver.

struct {
__in u32 color_ds[4];
__in u32 color_l2[4];
__in u32 depth;
__in u32 format;
__in u32 type; // 1=color, 2=depth
};

=== NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE ===
Queries the active ZBC table. Identical to Linux driver.

struct {
__out u32 color_ds[4];
__out u32 color_l2[4];
__out u32 depth;
__out u32 ref_cnt;
__out u32 format;
__out u32 type;
__inout u32 index_size;
};

=== NVGPU_GPU_IOCTL_GET_CHARACTERISTICS ===
Returns the GPU characteristics. Modified to return inline data instead of using a pointer.

struct gpu_characteristics {
u32 arch; // 0x120 (NVGPU_GPU_ARCH_GM200)
u32 impl; // 0xB (NVGPU_GPU_IMPL_GM20B)
u32 rev; // 0xA1 (Revision A1)
u32 num_gpc; // 0x1
u64 l2_cache_size; // 0x40000
u64 on_board_video_memory_size; // 0x0 (not used)
u32 num_tpc_per_gpc; // 0x2
u32 bus_type; // 0x20 (NVGPU_GPU_BUS_TYPE_AXI)
u32 big_page_size; // 0x20000
u32 compression_page_size; // 0x20000
u32 pde_coverage_bit_count; // 0x1B
u32 available_big_page_sizes; // 0x30000
u32 gpc_mask; // 0x1
u32 sm_arch_sm_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 sm_arch_spa_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 sm_arch_warp_count; // 0x80
u32 gpu_va_bit_count; // 0x28
u32 reserved; // NULL
u64 flags; // 0x55
u32 twod_class; // 0x902D (FERMI_TWOD_A)
u32 threed_class; // 0xB197 (MAXWELL_B)
u32 compute_class; // 0xB1C0 (MAXWELL_COMPUTE_B)
u32 gpfifo_class; // 0xB06F (MAXWELL_CHANNEL_GPFIFO_A)
u32 inline_to_memory_class; // 0xA140 (KEPLER_INLINE_TO_MEMORY_B)
u32 dma_copy_class; // 0xB0B5 (MAXWELL_DMA_COPY_A)
u32 max_fbps_count; // 0x1
u32 fbp_en_mask; // 0x0 (disabled)
u32 max_ltc_per_fbp; // 0x2
u32 max_lts_per_ltc; // 0x1
u32 max_tex_per_tpc; // 0x0 (not supported)
u32 max_gpc_count; // 0x1
u32 rop_l2_en_mask_0; // 0x21D70 (fuse_status_opt_rop_l2_fbp_r)
u32 rop_l2_en_mask_1; // 0x0
u64 chipname; // 0x6230326D67 ("gm20b")
u64 gr_compbit_store_base_hw; // 0x0 (not supported)
};

struct {
__inout u64 gpu_characteristics_buf_size; // must not be NULL, but gets overwritten with 0xA0=max_size
__in u64 gpu_characteristics_buf_addr; // ignored, but must not be NULL
__out struct gpu_characteristics gc;
};

=== NVGPU_GPU_IOCTL_FLUSH_L2 ===
Flushes the GPU L2 cache.

struct {
__in u32 flush; // l2_flush | l2_invalidate << 1 | fb_flush << 2
u32 reserved;
};

=== NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK ===
Returns the mask value for a ZBC slot.

struct {
__out u32 slot; // always 0x07
__out u32 mask;
};

== Channels ==
Channels are a concept for NVIDIA hardware blocks that share a common interface.

{| class="wikitable" border="1"
! Path || Name
|-
| /dev/nvhost-gpu ||
|-
| /dev/nvhost-vic || Video Image Compositor
|-
| /dev/nvhost-nvdec || Video Decoder
|-
| /dev/nvhost-nvjpg || JPEG Decoder
|}

== Channel Ioctls ==
{| class="wikitable" border="1"
! Value || Size || Description || Notes
|-
| 0xC0??0001 || Variable || NVHOST_IOCTL_CHANNEL_SUBMIT || Seen on 1.0.0.
|-
| 0xC0080002 || 8 || NVHOST_IOCTL_CHANNEL_GET_SYNCPOINT || Seen on 1.0.0.
|-
| 0xC0080003 || 8 || NVHOST_IOCTL_CHANNEL_GET_WAITBASE || Seen on 1.0.0.
|-
| 0xC0080004 || 8 || NVHOST_IOCTL_CHANNEL_SET_TIMEOUT_EX || Seen on 1.0.0. Stubbed; does a debug print and returns 0.
|-
| 0x40040007 || 4 || NVHOST_IOCTL_CHANNEL_SET_SUBMIT_TIMEOUT || Seen on 1.0.0.
|-
| 0x40080008 || 8 || NVHOST_IOCTL_CHANNEL_SET_CLK_RATE || Seen on 1.0.0.
|-
| 0xC0??0009 || Variable || NVHOST_IOCTL_CHANNEL_MAP_BUFFER || Seen on 1.0.0.
|-
| 0xC0??000A || Variable || NVHOST_IOCTL_CHANNEL_UNMAP_BUFFER || Seen on 1.0.0.
|-
| 0x00000013 || 0 || || Seen on 1.0.0. This one sets a u32, and bool based on input.
|-
| 0xC0080014 || || NVHOST_IOCTL_CHANNEL_GET_CLK_RATE || Seen on 1.0.0.
|- style="border-top: double"
| 0x40044801 || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD]] || Seen on 1.0.0.
|-
| 0x40044803 || 4 || NVGPU_IOCTL_CHANNEL_SET_TIMEOUT || Seen on 1.0.0.
|-
| 0x40084805 || 8 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO]] || Seen on 1.0.0.
|-
| 0x40184806 || || NVGPU_IOCTL_CHANNEL_WAIT || Seen on 1.0.0.
|-
| 0xC0044807 || 4 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS || Seen on 1.0.0.
|-
| 0xC0??4808 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]] || Seen on 1.0.0.
|-
| 0xC0104809 || 16 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX]] || Seen on 1.0.0.
|-
| 0x4008480A || || NVHOST_IOCTL_CHANNEL_FREE_OBJ_CTX || Seen on 1.0.0.
|-
| 0xC010480B || 16 || [[#NVGPU_IOCTL_CHANNEL_ZCULL_BIND]] || Seen on 1.0.0.
|-
| 0xC018480C || 24 || [[#NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER]] || Seen on 1.0.0.
|-
| 0x4004480D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_PRIORITY]] || Seen on 1.0.0.
|-
| 0x0000480E || 0 || [[#NVGPU_IOCTL_CHANNEL_ENABLE]] || Seen on 1.0.0.
|-
| 0x0000480F || 0 || [[#NVGPU_IOCTL_CHANNEL_DISABLE]] || Seen on 1.0.0.
|-
| 0x00004810 || 0 || [[#NVGPU_IOCTL_CHANNEL_PREEMPT]] || Seen on 1.0.0.
|-
| 0x00004811 || 0 || [[#NVGPU_IOCTL_CHANNEL_FORCE_RESET]] || Seen on 1.0.0.
|-
| 0x40084812 || 8 || [[#NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL]] || Seen on 1.0.0.
|-
| 0xC0104813 || 16 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS_SNAPSHOT || Seen on 1.0.0.
|-
| 0x80804816 || 128 || NVGPU_IOCTL_CHANNEL_GET_ERROR_INFO || Seen on 1.0.0.
|-
| 0xC0104817 || 16 || [[#NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION]] || Seen on 1.0.0.
|-
| 0x40204818 || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]] || Seen on 1.0.0.
|-
| 0xC0??4819 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]] || Seen on 1.0.0.
|-
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]] || Seen on 1.0.0.
|-
| 0xC018481B || 24 || || Uses Ioctl2.
|-
| 0xC018481C || 24 || || Uses Ioctl2.
|-
|- style="border-top: double"
| 0x40084714 || 8 || NVGPU_IOCTL_CHANNEL_SET_USER_DATA || Sets an unknown user context address. Seen on 1.0.0.
|-
| 0x80084715 || 8 || NVGPU_IOCTL_CHANNEL_GET_USER_DATA || Gets an unknown user context address. Seen on 1.0.0.
|}

=== NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD ===
Binds a nvmap object to this channel. Identical to Linux driver.

This ioctl is a no-op in the Linux driver, not sure about Switch?

struct {
__in u32 nvmap_fd;
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO ===
Allocates gpfifo entries. Identical to Linux driver.

struct {
__in u32 num_entries;
__in u32 flags;
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO ===
Submits a gpfifo object. Modified to take inline entry objects instead of a pointer.

struct fence {
u32 syncpt_id;
u32 syncpt_value;
};

struct gpfifo_entry {
u64 entry; // gpu_iova | (unk_2bits << 40) | (size << 42) | (unk_flag << 63)
};

struct {
__in u64 gpfifo; // (ignored) pointer to gpfifo fence structs
__in u32 num_entries; // number of fence objects being submitted
__in u32 flags;
__inout struct fence fence_out; // returned new fence object for others to wait on
__in struct gpfifo_entry entries[]; // depends on num_entries
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX ===
Allocates a graphics context object. Modified to ignore object's ID.

You can only have one object context allocated at a time. You must have bound an address space before using this.

struct {
__in u32 class_num; // 0x902D=2d, 0xB197=3d, 0xB1C0=compute, 0xA140=kepler, 0xB0B5=DMA, 0xB06F=channel_gpfifo
__in u32 flags; // bit0: LOCKBOOST_ZERO
__out u64 obj_id; // (ignored) used for FREE_OBJ_CTX ioctl, which is not supported
};

=== NVGPU_IOCTL_CHANNEL_ZCULL_BIND ===
Binds a ZCULL context to the channel. Identical to Linux driver.

struct {
__in u64 gpu_va;
__in u32 mode; // 0=global, 1=no_ctxsw, 2=separate_buffer, 3=part_of_regular_buf
__in u32 padding;
};

=== NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER ===
Initializes the error notifier for this channel. Unlike for the Linux kernel, the Switch driver cannot write to an arbitrary userspace buffer. Thus new ioctls have been introduced to fetch the error information rather than using a shared memory buffer.

struct {
__in u64 offset; // ignored
__in u64 size; // ignored
__in u32 mem; // must be non-zero to initialize, zero to de-initialize
__in u32 padding; // ignored
};

=== NVGPU_IOCTL_CHANNEL_SET_PRIORITY ===
Change channel's priority. Identical to Linux driver.

struct {
__in u32 priority; // 0x32 is low, 0x64 is medium and 0x96 is high
};

=== NVGPU_IOCTL_CHANNEL_ENABLE ===
Enables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_DISABLE ===
Disables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_PREEMPT ===
Clears the FIFO pipe for this channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_FORCE_RESET ===
Forces the channel to reset. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL ===
Controls event notifications.

struct {
__in u32 cmd; // 0=disable, 1=enable, 2=clear
__in u32 id; // same id's as for [[#QueryEvent]]
};

=== NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION ===
Returns the current error notification caught by the error notifier. Exclusive to the Switch.

Despite being marked as inout this is all output.

struct {
__out u64 timestamp; // fetched straight from armGetSystemTick
__out u32 info32; // error code
__out u16 info16; // additional error info
__out u16 status; // always 0xFFFF
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX ===
Allocates gpfifo entries with additional parameters. Exclusive to the Switch.

struct {
__in u32 num_entries;
__in u32 flags;
__in u32 unk0; // 1 works
__in u32 unk1;
__in u32 unk2;
__in u32 unk3;
__in u32 unk4;
__in u32 unk5;
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY ===
Submits a gpfifo object (async version). Exclusive to the Switch.

struct {
u64 __gpfifo; // in (pointer to gpfifo fence structs; ignored)
u32 __num_entries; // in (number of fence objects being submitted)
u32 __flags; // in
struct fence __fence_out; // out (returned new fence object for others to wait on)
struct gpfifo_entry __entries[]; // in (depends on __num_entries)
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2 ===
Allocates gpfifo entries with additional parameters and returns a fence. Exclusive to the Switch.

struct {
u32 __num_entries; // in
u32 __flags; // in
u32 __unk0; // in (1 works)
struct fence __fence_out; // out
u32 __unk1; // in
u32 __unk2; // in
u32 __unk3; // in
};

= nvmemp =
NVIDIA memory profiler (this service is not available on retail units).
/dev/nvhost-ctrl sends the ioctl NVHOST_IOCTL_CTRL_GET_CONFIG to check the config "nv!NV_MEMORY_PROFILER". If config_str returns "1", the applications attempts to talk to use nvmemp.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Cmd0
|-
| 1 || Cmd1
|}

= nvdrvdbg =
This is "nns::nvdrv::INvDrvDebugFSServices".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenLog]]
|-
| 1 || [[#CloseLog]]
|-
| 2 || [[#ReadLog]]
|-
| 3 ||
|-
| 4 ||
|}

== OpenLog ==
Takes process handle. Returns an fd.

== CloseLog ==
Takes fd and closes it.

== ReadLog ==
Takes fd and reads log into a type-6 buffer.

= nvgem:c =
This is "nv::gemcontrol::INvGemControl".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|-
| 3 ||
|-
| 4 ||
|-
| 5 ||
|-
| 6 ||
|-
| 7 ||
|}

= nvgem:cd =
This is "nv::gemcoredump::INvGemCoreDump".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|}

= Errors =
Most nvidia driver commands return an error code apart from the normal return code.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Success
|-
| 1 || NotImplemented
|-
| 2 || NotSupported
|-
| 3 || NotInitialized
|-
| 4 || BadParameter
|-
| 5 || Timeout
|-
| 6 || InsufficientMemory
|-
| 7 || ReadOnlyAttribute
|-
| 8 || InvalidState
|-
| 9 || InvalidAddress
|-
| 0xA || InvalidSize
|-
| 0xB || BadValue
|-
| 0xD || AlreadyAllocated
|-
| 0xE || Busy
|-
| 0xF || ResourceError
|-
| 0x10 || CountMismatch
|-
| 0x1000 || SharedMemoryTooSmall
|-
| 0x30003 || FileOperationFailed
|-
| 0x30004 || DirOperationFailed
|-
| 0x3000F || IoctlFailed
|-
| 0x30010 || AccessDenied
|-
| 0x30013 || FileNotFound
|-
| 0xA000E || ModuleNotPresent
|}

= Panic =
In some cases, a panic may occur. NV forces a crash by doing:
(void *)0 = 0xCAFE;
End result is that the system hangs with a white-screen.

== Gpfifo Panic ==
When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.

[[Category:Services]]

NIM services

2018-04-09T01:34:09Z

OgniK: /* nim */

= nim =
This is "nn::nim::detail::INetworkInstallManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|-
| 3 ||
|-
| 4 ||
|-
| 5 ||
|-
| 6 ||
|-
| 7 ||
|-
| 8 ||
|-
| 9 ||
|-
| 10 ||
|-
| 11 ||
|-
| 12 ||
|-
| 14 ||
|-
| 15 ||
|-
| 16 ||
|-
| 17 ||
|-
| 18 ||
|-
| 19 ||
|-
| 20 ||
|-
| 21 ||
|-
| 22 ||
|-
| 23 || [2.0.0+]
|-
| 24 || [2.0.0+]
|-
| 25 || [2.0.0+]
|-
| 26 || [2.0.0+]
|-
| 27 || [2.0.0+]
|-
| 28 || [2.0.0+]
|-
| 29 || [2.0.0+]
|-
| 30 || [2.0.0+]
|-
| 31 || [2.0.0+]
|-
| 32 || [2.0.0+]
|-
| 33 || [2.0.0+]
|-
| 34 || [2.0.0+]
|-
| 35 || [2.0.0+]
|-
| 36 || [2.0.0+]
|-
| 37 || [2.0.0+]
|-
| 38 || [2.0.0+]
|-
| 39 || [2.0.0+]
|-
| 40 || [2.0.0+]
|-
| 41 || [2.0.0+]
|-
| 42 || [3.0.0+]
|-
| 43 || [3.0.0+]
|-
| 44 || [3.0.0+]
|-
| 45 || [3.0.0+]
|-
| 46 || [3.0.0+]
|}

== Cmd1 ==
Takes a 0x10-byte input struct, from the output of cmd2.

== Cmd2 ==
Takes a type-0x6 output buffer, for an array of 0x10-byte entries. Returns an u32 for total output entries.

Doesn't return anything on a v2.1 system where sysupdate domains are blocked.

= nim:shp =
This is "nn::nim::detail::IShopServiceManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestDeviceAuthenticationToken
|-
| 1 || RequestCachedDeviceAuthenticationToken
|-
| 100 || RequestRegisterDeviceAccount
|-
| 101 || RequestUnregisterDeviceAccount
|-
| 102 || RequestDeviceAccountStatus
|-
| 103 || GetDeviceAccountInfo
|-
| 104 || RequestDeviceRegistrationInfo
|-
| 105 || RequestTransferDeviceAccount
|-
| 106 || RequestSyncRegistration
|-
| 107 || IsOwnDeviceId
|-
| 200 || RequestRegisterNotificationToken
|-
| 300 || RequestUnlinkDevice
|-
| 301 || RequestUnlinkDeviceIntegrated
|-
| 302 || RequestLinkDevice
|-
| 303 || HasDeviceLink
|-
| 304 || RequestUnlinkDeviceAll
|-
| 305 || RequestCreateVirtualAccount
|-
| 306 || RequestDeviceLinkStatus
|-
| 400 || GetAccountByVirtualAccount
|-
| 500 || RequestSyncTicket
|-
| 501 || RequestDownloadTicket
|-
| 502 || [4.0.0+] RequestDownloadTicketForPrepurchasedContents
|-
|}

= ntc =
This is "nn::ntc::detail::service::IStaticService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || OpenEnsureNetworkClockAvailabilityService
|-
| 100 || SuspendAutonomicTimeCorrection
|-
| 101 || ResumeAutonomicTimeCorrection
|}

Network-time-sync uses the "<...>/time" HTTPS URL listed in the below Network section. This just returns an UTC Unix time string.

== IEnsureNetworkClockAvailabilityService ==
This is "nn::ntc::detail::service::IEnsureNetworkClockAvailabilityService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || StartTask
|-
| 1 || GetFinishNotificationEvent
|-
| 2 || GetResult
|-
| 3 || Cancel
|-
| 4 || IsProcessing
|-
| 5 || GetServerTime
|}

= Network =
* <nowiki>https://sun.hac.%%.d4c.nintendo.net/v1/system_update_meta?device_id=%016llx</nowiki>
* <nowiki>https://aqua.hac.%%.d4c.nintendo.net/required_system_update_meta?device_id=%016llx</nowiki>
* <nowiki>https://%s.hac.%%.d4c.nintendo.net/t/%c/%016llx/%u?device_id=%016llx</nowiki> Returns content like the below URL. This is the content for [[NCA]]-type0. See below for %c. %016llx is titleID, %u is title-version.
* <nowiki>https://%s.hac.%%.d4c.nintendo.net/c/%c/%s</nowiki> Used for downloading content. First %s is atumn or atum. %c is one of: 'c', 'a', or 's'. %s is just the hex-string NcaId. The server also returns two HTTP headers: "X-Nintendo-Content-Hash: {entire lowercase hex-string of the content SHA256 hash}" and "X-Nintendo-Content-ID: {lowercase hex-string for NcaId}"
* <nowiki>https://superfly.hac.%%.d4c.nintendo.net/v1/t/%016llx/dv</nowiki> %016llx is titleID, only for eShop titles it appears. Returns .json title-info.
* <nowiki>https://superfly.hac.%%.d4c.nintendo.net/v1/a/%016llx/dv</nowiki> %016llx is titleID, only for eShop titles it appears. Output is similar to above URL.
* <nowiki>https://aauth-%.ndas.srv.nintendo.net/v1/time</nowiki>
* <nowiki>https://beach.hac.%.eshop.nintendo.net/v1/rom_cards?application_id=%016llx&rom_card_cert=%s</nowiki>
* <nowiki>https://beach.hac.%.eshop.nintendo.net/v1/rom_cards/register?application_id=%016llx&rom_card_cert=%s&expected_gold_point=%d</nowiki>
* <nowiki>https://beach.hac.%.eshop.nintendo.net/v1/my/devices/hac/link?lang=en</nowiki>
* <nowiki>https://beach.hac.%.eshop.nintendo.net/v1/my/virtual_account?lang=en</nowiki>
* <nowiki>https://tagaya.hac.%.eshop.nintendo.net/tagaya/hac_versionlist</nowiki>
* ...
* <nowiki>"https://dauth-%.ndas.srv.nintendo.net/v1/device_auth_token"</nowiki> CURLOPT_POSTFIELDS is set to the output from: snprintf(..., "system_version=%08x&client_id=%s", <byte-swapped first 3 bytes from [[System_Version_Title]] loaded via [[Settings_services|settings]] cmd>, "<hard-coded hex string>");
* <nowiki>https://ecs-%.hac.shop.nintendo.net/ecs/services/rest/AccountGetETickets</nowiki>
* <nowiki>https://ecs-%.hac.shop.nintendo.net/ecs/services/rest/GetAccountStatus</nowiki>
* <nowiki>https://ias-%.hac.shop.nintendo.net/ias/services/rest/Register</nowiki>
* <nowiki>https://ias-%.hac.shop.nintendo.net/ias/services/rest/GetChallenge</nowiki>
* <nowiki>https://ias-%.hac.shop.nintendo.net/ias/services/rest/Unregister</nowiki>
* <nowiki>https://ias-%.hac.shop.nintendo.net/ias/services/rest/GetRegistrationInfo</nowiki>
* <nowiki>https://ias-%.hac.shop.nintendo.net/ias/services/rest/CompleteETicketSync</nowiki>
* <nowiki>https://ias-%.hac.shop.nintendo.net/ias/services/rest/AccountTransfer</nowiki>
* <nowiki>https://ias-%.hac.shop.nintendo.net/ias/services/rest/SyncRegistration</nowiki>

* [5.0.0]+ <nowiki>https://pearljam.hac.%.eshop.nintendo.net/sugar</nowiki>
* [5.0.0]+ <nowiki>https://pearljam.hac.%.eshop.nintendo.net/civil</nowiki>

These are not accessible without the required TLS client cert+privk, minus the time URL which can be accessed without any client cert+privk at all.

The returned content data from CDN, for both system-titles and eShop-titles, is identical to the data readable by [[Content_Manager_services#ReadEntryRaw]].

While atumn seems to be for system-titles, and atum for eShop titles, the latter titles are accessible fine with atumn(with "/t/" for NCA-type0 at least).

'a' is used when an input u8 is not 0x3, otherwise 's' is used. This is [[Content_Manager_services#Title_Types|title-type]]? A seperate function using the ".../c/" URL is hard-coded to use 'c'. This appears to match 's' usage attempts: the only URL that returned actual data with 's' was with titleID 0100000000000816.

As of June 30, 2017, accessing old content via the atumn "/c/" and "/t/" URLs works fine.

Going by strings in NIM, it appears SOAP isn't used anymore. ecs appears to use REST API?

== User-Agent ==
NIM generates two User-Agent strings:
snprintf(..., "User-Agent: NintendoSDK Firmware/%s-%u (platform:%s; did:%016llx; eid:%s)", <string at [[System_Version_Title|sysver]]+0x68>, {u32 from [[System_Version_Title|sysver]]+4}, "NX", DeviceId, {[[NSD_services|NSD]] cmd11 output});
snprintf(..., "User-Agent: NintendoSDK Firmware/%s-%u (platform:%s; eid:%s)", <string at [[System_Version_Title|sysver]]+0x68>, {u32 from [[System_Version_Title|sysver]]+4}, "NX", DeviceId, {[[NSD_services|NSD]] cmd11 output});

Where the 64bit DeviceId is parsed from the 0x10-bytes at outbuf+0xC6 from [[Settings_services|set:cal]] GetDeviceCert(DeviceCert_certname+2, aka where the hex string for the DeviceId is).

== sun ==
NIM sends a HTTP GET with the sun URL listed above to get the title-listing of the latest system-titles, as .json. The deviceid in the URL is the same one in the above User-Agent section. HTTP header "Accept:application/json" is sent in the request.

The response is json with a "system_update_metas" block, containing "title_id" and "title_version" entries. The actual server response only contains 1 title.

Example, from 2.0 system:

<code>{"timestamp":REDACTED-TIMESTSAMP,"system_update_metas":[{"title_id":"0100000000000816","title_version":201327002}]}</code>

== aqua ==
The following response is json from accessing the above aqua URL:

<code>{
"contents_delivery_required_title_id": "0100000000000816",
"contents_delivery_required_title_version": 0
}</code>

A while after [[3.0.0]] release, the above title-version was changed to the one for v3.0("Last-Modified: Thu, 29 Jun 2017 00:00:04 GMT").

[[Category:Services]]

NPDM

2018-03-02T05:38:31Z

OgniK: /* ACI0 */

This is the Switch equivalent of 3DS [https://www.3dbrew.org/wiki/NCCH/Extended_Header exheader]. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| META
|-
| 0x80
| <Varies>
| ACID
|-
| <See META>
| <See META>
| ACI0
|}

= META =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "META".
|-
| 0x4
|
|
|-
| 0x8
|
|
|-
| 0xC
| 0x1
| Flags, bit0: 64-bit instructions, bits1-3: address space width (1=64-bit, 2=32-bit). Needs to be <= 0xF
|-
| 0xE
| 0x1
| MainThreadPrio
|-
| 0xF
| 0x1
| DefaultCpuId
|-
| 0x10
|
|
|-
| 0x18
| 0x4
| ProcessCategory (0: regular title, 1: kernel built-in). Should be 0 here.
|-
| 0x1C
| 0x4
| MainStackSize
|-
| 0x20
| ?
| Title name
|-
| 0x70
| 0x4
| [[#ACI0]] offset
|-
| 0x74
| 0x4
| [[#ACI0]] size
|-
| 0x78
| 0x4
| [[#ACID]] offset
|-
| 0x7C
| 0x4
| [[#ACID]] size
|}

= ACID =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 signature, seems to verify the data starting at 0x100 with the size field from 0x204.
|-
| 0x100
| 0x100
| RSA-2048 public key, seems to be used for the second [[NCA_Format|NCA]] signature.
|-
| 0x200
| 0x4
| Magic "ACID".
|-
| 0x204
| 0x4
| s32 Size field used with the above signature(?).
|-
| 0x208
| 0x4
| Zeroes
|-
| 0x20C
| 0x4
| Flags. Bit0 must be 1 on retail, on devunit 0 is also allowed. Bit1 is unknown, set 1 for ARMS?
|-
| 0x210
| 0x8
| TitleIdRange_Min
|-
| 0x218
| 0x8
| TitleIdRange_Max
|-
| 0x220
| 0x4
| [[#FS Access Control]] offset
|-
| 0x224
| 0x4
| [[#FS Access Control]] size
|-
| 0x228
| 0x4
| [[#Service Access Control]] offset
|-
| 0x22C
| 0x4
| [[#Service Access Control]] size
|-
| 0x230
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x234
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x238
| 0x8
| Padding
|}

= ACI0 =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "ACI0".
|-
| 0x4
| 0xC
| Zeroes
|-
| 0x10
| 0x8
| Title id
|-
| 0x18
| 0x8
| Lowest allowed title id? Always 0?
|-
| 0x20
| 0x4
| [[#FS Access Header]] offset
|-
| 0x24
| 0x4
| [[#FS Access Header]] size
|-
| 0x28
| 0x4
| [[#Service Access Control]] offset
|-
| 0x2C
| 0x4
| [[#Service Access Control]] size
|-
| 0x30
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x34
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x38
| 0x8
| Padding
|}

= FS Access Header =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x4
| Usually 0x1C
|-
| 0x10
| 0x4
| Usually 0x0
|-
| 0x14
| 0x4
| Usually 0x1C
|-
| 0x18
| 0x4
| Usually 0x0
|-
|}

= FS Access Control =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x20
| Usually all zeroes for applications
|}

[[Filesystem_services#Permissions|Permissions]] bitmask:
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| MountContent* is accessible when set.
|-
| 34
| Enables access to [[Filesystem_services|Bis]] partitionID 27 and 28?
|-
| 63
| Enables access to everything: all [[Filesystem_services#Permissions|permission-types]] which check a bitmask have this bit set.
|}

For bit62 in permissions, see [[SPL_services#GetConfig|here]].

Web-applets permissions:
* "LibAppletWeb" and "LibAppletOff" have same access control: bit0 and bit3 set, and bit62 set.
* Rest of the web-applets: Same as above except bit0 isn't set.

= Service Access Control =
This is a list of [[Services_API|service]]-name strings which the title has access to, with the following structure:
+0: control_byte
+1: {service-name without nul-terminator}

Bitmask 0x0F in control_byte is the {length of the service-name without nul-terminator} - 1.

Bitmask 0x80 in control_byte means service is allowed to be registered.

The service string can contain a wildcard <code>*</code> character.

= Kernel Access Control =
On Switch, descriptors are identified by pattern 01..11 in low bits.

{| class="wikitable" border="1"
|-
! Pattern of lower bits
! Lowest clear bitmask/bit
! Type
! Fields
|-
| <code>0bxxxxxxxxxxxx0111</code>
| Bit3
| KernelFlags
| Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio
|-
| <code>0bxxxxxxxxxxx01111</code>
| Bit4
| SyscallMask
| Bits 29-31: Syscall mask table index; Bits 5-28: Mask
|-
| <code>0bxxxxxxxxx0111111</code>
| Bit6
| MapIoOrNormalRange
| Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag
|-
| <code>0bxxxxxxxx01111111</code>
| Bit7
| MapNormalPage (RW)
| Bits 8-31: Page
|-
| <code>0bxxxx011111111111</code>
| Bit11
| InterruptPair
| Bits 12-21: Irq0, bits 20-31: Irq1, 0x3FF means empty.
|-
| <code>0bxx01111111111111</code>
| Bit13
| ApplicationType
| Bit16-14: ApplicationType (0=sysmodule, 1=application, 2=applet), bit16 ignored. Parsed by [[Process Manager services]]. Defaults to 0 if descriptor doesn't exist. Can only run 1 application at a time.
|-
| <code>0bx011111111111111</code>
| Bit14
| KernelReleaseVersion
| Bits 15-X: Version. The raw descriptor is compared with 0x80000, when less than an error is returned. This is equivalent to comparing the bits starting at bit15 with 0x10. This enforces a minimum required version, not a maximum.
|-
| <code>0b0111111111111111</code>
| Bit15
| HandleTableSize
| Bit25-16: Number of handles the table shall fit.
|-
| <code>0b1111111111111111</code>
| Bit16
| DebugFlags
| Bit17: can be debugged, bit18: can debug others
|-
| All ones
|
| Ignored
|
|}

== Mapping restrictions ==
The physaddr range 0x80060000-0x2000000000 is not allowed to be mapped as IO.
The physaddr range 0x80000000-0x2000000000 is not allowed to be mapped as Normal.

[2.0.0+] The range for IO was changed into 0x80060000-0x81D3FFFF.

[2.0.0+] A blacklist was added for IO and Normal mappings:
* 0x50040000-0x50060000 (ARM, Interrupt Controller)
* 0x6000F000 (Exception Vectors)
* 0x6001DC00-0x6001E000 (IPATCH)
* 0x7000E000 (RTC/PMC)
* 0x70019000 (MC)
* 0x7001C000 (MC0)
* 0x7001D000 (MC1)

== Kernel versions ==
{| class="wikitable" border="1"
|-
! Firmware || Kernel Version || Minimum Allowed
|-
| 1.0.0 || 5.0.0 || 3.0.0
|-
| 2.0.0 || 6.1.0 || 3.0.0
|-
| 3.0.0 || 7.4.0 || 3.0.0
|-
| 3.0.2 || 7.4.0 || 3.0.0
|}

Bit31-19: Major version
Bit18-15: Minor version
Bit14-0: Zeroes

Loader services

2018-03-02T02:36:22Z

OgniK: ClearLaunchQueue & ClearDebugLaunchQueue both call the same functions without any differences/checks?

= ldr:dmnt =
This is "nn::ldr::detail::IDebugMonitorInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || AddProcessToDebugLaunchQueue
|-
| 1 || ClearDebugLaunchQueue
|-
| 2 ||
|}

== AddProcessToDebugLaunchQueue ==
Same as [[Loader_services#AddProcessToLaunchQueue|AddProcessToLaunchQueue]] but for processes marked as debug.

== ClearDebugLaunchQueue ==
Same as [[Loader_services#ClearLaunchQueue|ClearLaunchQueue]].

= ldr:pm =
This is "nn::ldr::detail::IProcessManagerInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateProcess
|-
| 1 || [[#GetProgramInfo]]
|-
| 2 || [[#RegisterTitle]]
|-
| 3 || [[#UnregisterTitle]]
|}

== GetProgramInfo ==
Takes a TitleId + StorageId, parses the NPDM, and writes output to a C descriptor buffer as follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| MainThreadPrio. Arg1 to svcStartProcess
|-
| 0x1
| 0x1
| DefaultCpuId. Arg2 to svcStartProcess
|-
| 0x2
| 0x1
| ApplicationType, see [[Process Manager services|here]].
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| MainThreadStackSize. Arg3 to svcStartProcess
|-
| 0x8
| 0x8
| TitleIdRange_Min
|-
| 0x10
| 0x4
| ACID [[NPDM#Service Access Control|Service Access Control]] list size
|-
| 0x14
| 0x4
| ACI0 [[NPDM#Service Access Control|Service Access Control]] list size
|-
| 0x18
| 0x4
| ACID [[NPDM#FS Access Control|FS Access Control]] buffer size
|-
| 0x1C
| 0x4
| ACI0 [[NPDM#FS Access Control|FS Access Control]] buffer size
|-
| 0x20
| <Varies>
| ACID [[NPDM#Service Access Control|Service Access Control]] list
|-
| <Varies>
| <Varies>
| ACI0 [[NPDM#Service Access Control|Service Access Control]] list
|-
| <Varies>
| <Varies>
| ACID [[NPDM#FS Access Control|FS Access Control]] buffer
|-
| <Varies>
| <Varies>
| ACI0 [[NPDM#FS Access Control|FS Access Control]]
|}

== RegisterTitle ==
Takes a TitleId + StorageId, returns an index.

== UnregisterTitle ==
Takes the index from [[#RegisterTitle]].

= ldr:shel =
This is "nn::ldr::detail::IShellInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#AddProcessToLaunchQueue]]
|-
| 1 || [[#ClearLaunchQueue]]
|}

== AddProcessToLaunchQueue ==
Takes a type-0x19 input buffer with launch arguments (as string), an u32 (size of arguments string), and an input title-id.

Loads a process for the specified title-id and passes along the supplied arguments.
Loaded processes are kept in a queue waiting for PM to launch them. The maximum number of waiting processes in this list is 10.

== ClearLaunchQueue ==
Clears the loaded processes waiting queue.

= ldr:ro =
[1.0.0-2.3.0] This is "nn::ldr::detail::IRoInterface"

[3.0.0+] This is "nn::ro::detail::IRoInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#LoadNro]]
|-
| 1 || UnloadNro
|-
| 2 || [[#LoadNrr]]
|-
| 3 || UnloadNrr
|-
| 4 || [[#Initialize]]
|}

== LoadNro ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x80000012
|-
| 2 || 0x00000001
|- style="border-top: double"
| 0-1 || Pid
|- style="border-top: double"
| 0 || "SCFI"
|-
| 1 || 0x00000000
|-
| 2 || Always 0.
|-
| 3 || Nro heap address
|-
| 4 || Nro size
|-
| 5 || Bss backing heap address
|-
| 6 || Bss size
|}

== LoadNrr ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x8000000E
|-
| 2 || 0x00000001
|-
|- style="border-top: double"
| 0-1 || Pid
|- style="border-top: double"
| 0 || "SFCI"
|-
| 1 || 0x00000002
|-
| 2 || Always 0.
|-
| 3 || Nrr address
|-
| 4 || Nrr size
|}

== Initialize ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x8000000A
|-
| 2 || 0x00000003
|- style="border-top: double"
| 0-1 || Pid
|-
| 2 || Process handle (0xFFFF8001)
|- style="border-top: double"
| 0 || "SFCI"
|-
| 1 || 0x00000004
|-
| 2 || Always 0.
|}

[[Category:Services]]

Loader services

2018-03-02T01:34:42Z

OgniK: /* GetProgramInfo */

= ldr:dmnt =
This is "nn::ldr::detail::IDebugMonitorInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || AddProcessToDebugLaunchQueue
|-
| 1 || ClearDebugLaunchQueue
|-
| 2 ||
|}

== AddProcessToDebugLaunchQueue ==
Same as [[Loader_services#AddProcessToLaunchQueue|AddProcessToLaunchQueue]] but for processes marked as debug.

== ClearDebugLaunchQueue ==
Same as [[Loader_services#ClearLaunchQueue|ClearLaunchQueue]] but for processes marked as debug.

= ldr:pm =
This is "nn::ldr::detail::IProcessManagerInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateProcess
|-
| 1 || [[#GetProgramInfo]]
|-
| 2 || [[#RegisterTitle]]
|-
| 3 || [[#UnregisterTitle]]
|}

== GetProgramInfo ==
Takes a TitleId + StorageId, parses the NPDM, and writes output to a C descriptor buffer as follows:

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| MainThreadPrio. Arg1 to svcStartProcess
|-
| 0x1
| 0x1
| DefaultCpuId. Arg2 to svcStartProcess
|-
| 0x2
| 0x1
| ApplicationType, see [[Process Manager services|here]].
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| MainThreadStackSize. Arg3 to svcStartProcess
|-
| 0x8
| 0x8
| TitleIdRange_Min
|-
| 0x10
| 0x4
| ACID [[NPDM#Service Access Control|Service Access Control]] list size
|-
| 0x14
| 0x4
| ACI0 [[NPDM#Service Access Control|Service Access Control]] list size
|-
| 0x18
| 0x4
| ACID [[NPDM#FS Access Control|FS Access Control]] buffer size
|-
| 0x1C
| 0x4
| ACI0 [[NPDM#FS Access Control|FS Access Control]] buffer size
|-
| 0x20
| <Varies>
| ACID [[NPDM#Service Access Control|Service Access Control]] list
|-
| <Varies>
| <Varies>
| ACI0 [[NPDM#Service Access Control|Service Access Control]] list
|-
| <Varies>
| <Varies>
| ACID [[NPDM#FS Access Control|FS Access Control]] buffer
|-
| <Varies>
| <Varies>
| ACI0 [[NPDM#FS Access Control|FS Access Control]]
|}

== RegisterTitle ==
Takes a TitleId + StorageId, returns an index.

== UnregisterTitle ==
Takes the index from [[#RegisterTitle]].

= ldr:shel =
This is "nn::ldr::detail::IShellInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#AddProcessToLaunchQueue]]
|-
| 1 || [[#ClearLaunchQueue]]
|}

== AddProcessToLaunchQueue ==
Takes a type-0x19 input buffer with launch arguments (as string), an u32 (size of arguments string), and an input title-id.

Loads a process for the specified title-id and passes along the supplied arguments.
Loaded processes are kept in a queue waiting for PM to launch them. The maximum number of waiting processes in this list is 10.

== ClearLaunchQueue ==
Clears the loaded processes waiting queue.

= ldr:ro =
[1.0.0-2.3.0] This is "nn::ldr::detail::IRoInterface"

[3.0.0+] This is "nn::ro::detail::IRoInterface".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#LoadNro]]
|-
| 1 || UnloadNro
|-
| 2 || [[#LoadNrr]]
|-
| 3 || UnloadNrr
|-
| 4 || [[#Initialize]]
|}

== LoadNro ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x80000012
|-
| 2 || 0x00000001
|- style="border-top: double"
| 0-1 || Pid
|- style="border-top: double"
| 0 || "SCFI"
|-
| 1 || 0x00000000
|-
| 2 || Always 0.
|-
| 3 || Nro heap address
|-
| 4 || Nro size
|-
| 5 || Bss backing heap address
|-
| 6 || Bss size
|}

== LoadNrr ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x8000000E
|-
| 2 || 0x00000001
|-
|- style="border-top: double"
| 0-1 || Pid
|- style="border-top: double"
| 0 || "SFCI"
|-
| 1 || 0x00000002
|-
| 2 || Always 0.
|-
| 3 || Nrr address
|-
| 4 || Nrr size
|}

== Initialize ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x8000000A
|-
| 2 || 0x00000003
|- style="border-top: double"
| 0-1 || Pid
|-
| 2 || Process handle (0xFFFF8001)
|- style="border-top: double"
| 0 || "SFCI"
|-
| 1 || 0x00000004
|-
| 2 || Always 0.
|}

[[Category:Services]]

NPDM

2018-03-02T01:21:23Z

OgniK: Consistency fixes

This is the Switch equivalent of 3DS [https://www.3dbrew.org/wiki/NCCH/Extended_Header exheader]. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| META
|-
| 0x80
| <Varies>
| ACID
|-
| <See META>
| <See META>
| ACI0
|}

= META =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "META".
|-
| 0x4
|
|
|-
| 0x8
|
|
|-
| 0xC
| 0x1
| Flags, bit0: 64-bit instructions, bits1-3: address space width (1=64-bit, 2=32-bit). Needs to be <= 0xF
|-
| 0xE
| 0x1
| MainThreadPrio
|-
| 0xF
| 0x1
| DefaultCpuId
|-
| 0x10
|
|
|-
| 0x18
| 0x4
| ProcessCategory (0: regular title, 1: kernel built-in). Should be 0 here.
|-
| 0x1C
| 0x4
| MainStackSize
|-
| 0x20
| ?
| Title name
|-
| 0x70
| 0x4
| [[#ACI0]] offset
|-
| 0x74
| 0x4
| [[#ACI0]] size
|-
| 0x78
| 0x4
| [[#ACID]] offset
|-
| 0x7C
| 0x4
| [[#ACID]] size
|}

= ACID =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 signature, seems to verify the data starting at 0x100 with the size field from 0x204.
|-
| 0x100
| 0x100
| RSA-2048 public key, seems to be used for the second [[NCA_Format|NCA]] signature.
|-
| 0x200
| 0x4
| Magic "ACID".
|-
| 0x204
| 0x4
| s32 Size field used with the above signature(?).
|-
| 0x208
| 0x4
| Zeroes
|-
| 0x20C
| 0x4
| Flags. Bit0 must be 1 on retail, on devunit 0 is also allowed. Bit1 is unknown, set 1 for ARMS?
|-
| 0x210
| 0x8
| TitleIdRange_Min
|-
| 0x218
| 0x8
| TitleIdRange_Max
|-
| 0x220
| 0x4
| [[#FS Access Control]] offset
|-
| 0x224
| 0x4
| [[#FS Access Control]] size
|-
| 0x228
| 0x4
| [[#Service Access Control]] offset
|-
| 0x22C
| 0x4
| [[#Service Access Control]] size
|-
| 0x230
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x234
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x238
| 0x8
| Padding
|}

= ACI0 =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "ACI0".
|-
| 0x4
| 0xC
| Zeroes
|-
| 0x10
| 0x8
| Title id
|-
| 0x18
| 0x8
| Padding
|-
| 0x20
| 0x4
| [[#FS Access Header]] offset
|-
| 0x24
| 0x4
| [[#FS Access Header]] size
|-
| 0x28
| 0x4
| [[#Service Access Control]] offset
|-
| 0x2C
| 0x4
| [[#Service Access Control]] size
|-
| 0x30
| 0x4
| [[#Kernel Access Control]] offset
|-
| 0x34
| 0x4
| [[#Kernel Access Control]] size
|-
| 0x38
| 0x8
| Padding
|}

= FS Access Header =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x4
| Usually 0x1C
|-
| 0x10
| 0x4
| Usually 0x0
|-
| 0x14
| 0x4
| Usually 0x1C
|-
| 0x18
| 0x4
| Usually 0x0
|-
|}

= FS Access Control =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x20
| Usually all zeroes for applications
|}

[[Filesystem_services#Permissions|Permissions]] bitmask:
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| MountContent* is accessible when set.
|-
| 34
| Enables access to [[Filesystem_services|Bis]] partitionID 27 and 28?
|-
| 63
| Enables access to everything: all [[Filesystem_services#Permissions|permission-types]] which check a bitmask have this bit set.
|}

For bit62 in permissions, see [[SPL_services#GetConfig|here]].

Web-applets permissions:
* "LibAppletWeb" and "LibAppletOff" have same access control: bit0 and bit3 set, and bit62 set.
* Rest of the web-applets: Same as above except bit0 isn't set.

= Service Access Control =
This is a list of [[Services_API|service]]-name strings which the title has access to, with the following structure:
+0: control_byte
+1: {service-name without nul-terminator}

Bitmask 0x0F in control_byte is the {length of the service-name without nul-terminator} - 1.

Bitmask 0x80 in control_byte means service is allowed to be registered.

The service string can contain a wildcard <code>*</code> character.

= Kernel Access Control =
On Switch, descriptors are identified by pattern 01..11 in low bits.

{| class="wikitable" border="1"
|-
! Pattern of lower bits
! Lowest clear bitmask/bit
! Type
! Fields
|-
| <code>0bxxxxxxxxxxxx0111</code>
| Bit3
| KernelFlags
| Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio
|-
| <code>0bxxxxxxxxxxx01111</code>
| Bit4
| SyscallMask
| Bits 29-31: Syscall mask table index; Bits 5-28: Mask
|-
| <code>0bxxxxxxxxx0111111</code>
| Bit6
| MapIoOrNormalRange
| Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag
|-
| <code>0bxxxxxxxx01111111</code>
| Bit7
| MapNormalPage (RW)
| Bits 8-31: Page
|-
| <code>0bxxxx011111111111</code>
| Bit11
| InterruptPair
| Bits 12-21: Irq0, bits 20-31: Irq1, 0x3FF means empty.
|-
| <code>0bxx01111111111111</code>
| Bit13
| ApplicationType
| Bit16-14: ApplicationType (0=sysmodule, 1=application, 2=applet), bit16 ignored. Parsed by [[Process Manager services]]. Defaults to 0 if descriptor doesn't exist. Can only run 1 application at a time.
|-
| <code>0bx011111111111111</code>
| Bit14
| KernelReleaseVersion
| Bits 15-X: Version. The raw descriptor is compared with 0x80000, when less than an error is returned. This is equivalent to comparing the bits starting at bit15 with 0x10. This enforces a minimum required version, not a maximum.
|-
| <code>0b0111111111111111</code>
| Bit15
| HandleTableSize
| Bit25-16: Number of handles the table shall fit.
|-
| <code>0b1111111111111111</code>
| Bit16
| DebugFlags
| Bit17: can be debugged, bit18: can debug others
|-
| All ones
|
| Ignored
|
|}

== Mapping restrictions ==
The physaddr range 0x80060000-0x2000000000 is not allowed to be mapped as IO.
The physaddr range 0x80000000-0x2000000000 is not allowed to be mapped as Normal.

[2.0.0+] The range for IO was changed into 0x80060000-0x81D3FFFF.

[2.0.0+] A blacklist was added for IO and Normal mappings:
* 0x50040000-0x50060000 (ARM, Interrupt Controller)
* 0x6000F000 (Exception Vectors)
* 0x6001DC00-0x6001E000 (IPATCH)
* 0x7000E000 (RTC/PMC)
* 0x70019000 (MC)
* 0x7001C000 (MC0)
* 0x7001D000 (MC1)

== Kernel versions ==
{| class="wikitable" border="1"
|-
! Firmware || Kernel Version || Minimum Allowed
|-
| 1.0.0 || 5.0.0 || 3.0.0
|-
| 2.0.0 || 6.1.0 || 3.0.0
|-
| 3.0.0 || 7.4.0 || 3.0.0
|-
| 3.0.2 || 7.4.0 || 3.0.0
|}

Bit31-19: Major version
Bit18-15: Minor version
Bit14-0: Zeroes

Error codes

2018-03-02T00:26:59Z

OgniK: /* Error codes */

= Structure =
These have been redesigned from the 3DS so that they fit within a Aarch64 MOV instruction immediate most of the time (without requiring the additional MOVK).

{| class=wikitable
! Bits || Field
|-
| 8-0 || Module
|-
| 21-9 || Description
|}

When a fatal-error is received the error code is outputted using the following formatter:
%04d-%04d

.. where the first code is <code>2000 + Module</code>, and the other being <code>Description</code>. Bits >=22 from the error-code are unused when displaying fatal-errors, since the Description ends with bit21.

= Modules =
{| class=wikitable
! Value || Name
|-
| 1 || Kernel
|-
| 2 || FS
|-
| 3 || NVIDIA, TransferMemory
|-
| 5 || NCM
|-
| 6 || DD
|-
| 8 || LR
|-
| 9 || Loader
|-
| 10 || CMIF (IPC command interface)
|-
| 11 || HIPC (IPC)
|-
| 15 || PM
|-
| 16 || NS
|-
| 18 || HTC
|-
| 21 || SM
|-
| 22 || RO userland
|-
| 24 || SDMMC
|-
| 26 || SPL
|-
| 100 || ETHC
|-
| 101 || I2C
|-
| 105 || Settings
|-
| 110 || NIFM
|-
| 111 || HwOpus
|-
| 114 || Display
|-
| 116 || NTC
|-
| 117 || FGM
|-
| 120 || PCIE
|-
| 121 || Friends
|-
| 123 || SSL
|-
| 124 || Account
|-
| 126 || Mii
|-
| 128 || AM
|-
| 129 || Play Report
|-
| 133 || PCV
|-
| 134 || OMM
|-
| 137 || NIM
|-
| 138 || PSC
|-
| 140 || USB
|-
| 141 || NSD
|-
| 143 || BTM
|-
| 147 || ERPT
|-
| 148 || APM
|-
| 153 || Audio
|-
| 154 || NPNS
|-
| 157 || ARP
|-
| 158 || BOOT
|-
| 161 || NFC
|-
| 162 || Userland assert
|-
| 168 || Userland crash
|-
| 203 || HID
|-
| 206 || Capture
|-
| 345 || libnx
|-
| 346 || [[Homebrew ABI]]
|-
| 347 || Homebrew Loader
|-
| 348 || libnx Nvidia errors
|-
| 651 || TC
|-
| 800 || [[Internet_Browser|General web-applet]]
|-
| 809 || [[Internet_Browser|WifiWebAuthApplet]]
|-
| 810 || [[Internet_Browser|Whitelisted-applet]]
|-
| 811 || [[Internet_Browser|ShopN]]
|}

8XX is for/includes system applets.

= Error codes =
{| class=wikitable
! Value || Description || Description
|-
| 0x1C01 || 14 || Invalid kernel capability descriptor
|-
| 0x4201 || 33 || [[SPL_services#GetConfig|IsDebugMode]] isn't set.
|-
| 0xCA01 || 101 || Invalid size
|-
| 0xCC01 || 102 || Invalid address
|-
| 0xCE01 || 103 || Slabheap full
|-
| 0xD001 || 104 || Memory full
|-
| 0xD201 || 105 || Handle-table full.
|-
| 0xD401 || 106 || Invalid memory state / invalid memory permissions.
|-
| 0xD801 || 108 || Invalid memory permissions.
|-
| 0xDC01 || 110 || Invalid memory range
|-
| 0xE001 || 112 || Invalid thread priority.
|-
| 0xE201 || 113 || Invalid processor id.
|-
| 0xE401 || 114 || Invalid handle.
|-
| 0xE601 || 115 || Syscall copy from user failed.
|-
| 0xE801 || 116 || Invalid combination
|-
| 0xEA01 || 117 || Time out. Also when you give 0 handles to svcWaitSynchronizationN.
|-
| 0xEC01 || 118 || Canceled/interrupted [?]
|-
| 0xEE01 || 119 || Exceeding maximum
|-
| 0xF001 || 120 || Invalid enum
|-
| 0xF201 || 121 || No such entry
|-
| 0xF401 || 122 || Irq/DeviceAddressSpace/{...} already registered
|-
| 0xF601 || 123 || Port remote dead
|-
| 0xF801 || 124 || [Usermode] Unhandled interrupt
|-
| 0xFA01 || 125 || Wrong memory permission?
|-
| 0xFC01 || 126 || Reserved value
|-
| 0xFE01 || 127 || Invalid hardware breakpoint
|-
| 0x10001 || 128 || [Usermode] Fatal exception
|-
| 0x10201 || 129 || Last thread didn't belong to your process
|-
| 0x10601 || 131 || Port max sessions exceeded
|-
| 0x10801 || 132 || Resource limit exceeded
|-
| 0x20801 || 260 || Command buffer too small
|-
| 0x41001 || 520 || Process not being debugged
|-
| 0xE02 || 7 || Savedata [[Filesystem_services|already]] mounted
|-
| 0x7802 || 60 || The specified [[NCA]]-type doesn't exist for this title.
|-
| 0x7D202 || 1001 || Process does not have RomFs
|-
| 0x7D402 || 1002 || Title-id not found / savedata not found.
|-
| 0xFA202 || 2001 || SD card not inserted
|-
| 0x13B002 || 2520 || Gamecard not inserted
|-
| 0x13DA02 || 2541 || Version check failed when mounting gamecard sysupdate partition?
|-
| 0x171402 || 2954 || Invalid gamecard handle.
|-
| 0x196002 || 3248 || Out of memory
|-
| 0x196202 || 3249 || Out of memory
|-
| 0x1A4A02 || 3365 || Out of memory
|-
| 0x235202 || 4521 || Invalid NCA Key index
|-
| 0x235E02 || 4527 || NCA-path used with the wrong titleID.
|-
| 0x250E02 || 4743 || [[NAX0|Corrupted]] NAX0 header.
|-
| 0x251002 || 4744 || Invalid [[NAX0]] magicnum.
|-
| 0x2EE202 || 6001 || Invalid input
|-
| 0x2EE602 || 6003 || Path too long
|-
| 0x2F5A02 || 6061 || Offset outside storage
|-
| 0x313802 || 6300 || Operation not supported
|-
| 0x320002 || 6400 || Permission denied
|-
| 0x326602 || 6451 || Missing titlekey(?) required to mount content
|-
| 0x3EA03 || 501 || Invalid handle
|-
| 0x3EE03 || 503 || Invalid memory mirror
|-
| 0xA05 || 5 || [[Content_Manager_services|NcaID]] not found. Returned when attempting to mount titles which exist that aren't *8XX titles, the same way *8XX titles are mounted.
|-
| 0xE05 || 7 || TitleId not found
|-
| 0x1805 || 12 || Invalid StorageId
|-
| 0xDC05 || 110 || Gamecard not inserted
|-
| 0x17C05 || 190 || Gamecard not initialized
|-
| 0x1F405 || 250 || Sdcard not inserted
|-
| 0x20805 || 260 || Storage not mounted
|-
| 0x806 || 4 || Converted from error 0xD401.
|-
| 0x1006 || 8 || Converted from error 0xE401.
|-
| 0x408 || 2 || Not initialized.
|-
| 0x608 || 3 || Invalid control StorageID.
|-
| 0x808 || 4 || Storage not found.
|-
| 0xA08 || 5 || Access denied.
|-
| 0xE08 || 7 || Title is not registered.
|-
| 0x209 || 1 || Args too long.
|-
| 0x409 || 2 || Maximum processes loaded.
|-
| 0x609 || 3 || NPDM too big.
|-
| 0x19009 || || Invalid access control sizes in NPDM.
|-
| 0x809 || 4 || Invalid NPDM.
|-
| 0xA09 || 5 || Invalid files.
|-
| 0xE09 || 7 || Already registered.
|-
| 0x1009 || 8 || Title not found.
|-
| 0x1209 || 9 || Title-id in ACI0 doesn't match range in ACID.
|-
| 0x6609 || 51 || Invalid memory state/permission
|-
| 0x6A09 || 53 || Invalid NRR
|-
| 0xA209 || 81 || Unaligned NRR address
|-
| 0xA409 || 82 || Bad NRR size
|-
| 0xAA09 || 85 || Bad NRR address
|-
| 0xAE09 || 87 || Bad initialization
|-
| 0xC809 || 100 || Unknown ACI0 descriptor
|-
| 0xCE09 || 103 || ACID/ACI0 don't match for descriptor "KernelFlags"
|-
| 0xD009 || 104 || ACID/ACI0 don't match for descriptor "SyscallMask"
|-
| 0xD409 || 106 || ACID/ACI0 don't match for descriptor "MapIoOrNormalRange"
|-
| 0xD609 || 107 || ACID/ACI0 don't match for descriptor "MapNormalPage"
|-
| 0xDE09 || 111 || ACID/ACI0 don't match for descriptor "InterruptPair"
|-
| 0xE209 || 113 || ACID/ACI0 don't match for descriptor "ApplicationType"
|-
| 0xE409 || 114 || ACID/ACI0 don't match for descriptor "KernelReleaseVersion"
|-
| 0xE609 || 115 || ACID/ACI0 don't match for descriptor "HandleTableSize"
|-
| 0xE809 || 116 || ACID/ACI0 don't match for descriptor "DebugFlags"
|-
| 0x1A80A || 212 || Bad magic (expected 'SFCO')
|-
| 0x20B || 1 || Size too big to fit to marshal.
|-
| 0x11A0B || 141 || Went past maximum during marshalling.
|-
| 0x1900B || 200 || Session doesn't support domains.
|-
| 0x25A0B || 301 || Remote process is dead.
|-
| 0x3D60B || 491 || IPC Query 1 failed.
|-
| 0x20F || 1 || Pid not found
|-
| 0x60F || 3 || Process has no pending events
|-
| 0xA0F || 5 || Application already running
|-
| 0x410 || 2 || Title-id not found
|-
| 0xF010 || 120 || Gamecard sysupdate not required
|-
| 0x1F610 || 251 || Unexpected StorageId
|-
| 0x415 || 2 || Not initialized.
|-
| 0x615 || 3 || Max sessions
|-
| 0xC15 || 6 || Invalid name (all zeroes)
|-
| 0x1015 || 8 || Permission denied
|-
| 0x416 || 2 || Address space is full
|-
| 0x616 || 3 || NRO already loaded
|-
| 0x816 || 4 || Invalid NRO header values
|-
| 0xC16 || 6 || Bad NRR magic
|-
| 0x1016 || 8 || Reached max NRR count
|-
| 0x1216 || 9 || Unable to verify NRO hash or NRR signature
|-
| 0x80216 || 1025 || Address not page-aligned
|-
| 0x80416 || 1026 || Incorrect NRO size
|-
| 0x80816 || 1028 || NRO not loaded
|-
| 0x80A16 || 1029 || NRR not loaded
|-
| 0x80C16 || 1030 || Already initialized
|-
| 0x80E16 || 1031 || Not initialized
|-
| 0x41A || 2 || Argument is invalid
|-
| 0xC81A || 100 || Incorrect buffer size
|-
| 0xCA1A || 101 || Unknown TZ error
|-
| 0xD01A || 104 || All AES engines busy
|-
| 0xD21A || 105 || Invalid AES engine-id
|-
| 0x272 || 1 || Generic error
|-
| 0xCC74 || 102 || Time not set
|-
| 0x287C || 20 || Argument is NULL
|-
| 0x2C7C || 22 || Argument is invalid
|-
| 0x3C7C || 30 || Bad input buffer size
|-
| 0x407C || 32 || Invalid input buffer
|-
| 0x668C || 51 || USB data-transfer in progress
|-
| 0x299 || 1 || Invalid audio device
|-
| 0x499 || 2 || Invalid buffer address
|-
| 0x699 || 3 || Invalid sample rate
|-
| 0x1499 || 10 || Invalid channel count
|-
| 0xC0899 || 1540 || Audio output was already started
|-
| 0x3C9D || 30 || Address is NULL
|-
| 0x3E9D || 31 || PID is NULL
|-
| 0x549D || 42 || Already bound
|-
| 0xCC9D || 102 || Invalid PID
|-
| 0x3CF089 || 7800 || Unknown/invalid libcurl error.
|-
| 0x3E8289-0x3F4089 || 8001-8096 || libcurl error 1-96. Some of the libcurl errors in the error-table map to the above unknown-libcurl-error however.
|-
| 0x35B || 1 || Failed to init SM.
|-
| 0x55B || 2 || Failed to init FS.
|-
| 0x95B || 4 || Failed to read NRO header.
|-
| 0xB5B || 5 || Invalid NRO magic.
|-
| 0xD5B || 6 || Invalid NRO segments.
|-
| 0xF5B || 7 || Failed to read NRO.
|-
| 0x135B || 9 || Failed to allocate heap.
|-
| 0x275B || 19 || Failed to map code memory (.text).
|-
| 0x295B || 20 || Failed to map code memory (.rodata).
|-
| 0x2B5B || 21 || Failed to map code memory (.data+.bss).
|-
| 0x315B || 24 || Failed to unmap code memory (.text).
|-
| 0x335B || 25 || Failed to unmap code memory (.rodata).
|-
| 0x355B || 26 || Failed to unmap code memory (.data+.bss).
|}

== FS Error Codes ==

The following are the error codes recognized by nn::fs::detail::LogErrorMessage found in some [[Factory Setup|factory]] titles:

{| class=wikitable
! Error Code || Description || Message
|-
| 0x7802 || 60 || Error: Specified mount name already exists.
|-
| 0xD401 || 106 || Error: Passed buffer is not usable for fs library.
|-
| 0x7D202 || 1001 || Error: Specified partition is not found.
|-
| 0x7D402 || 1002 || Error: Specified target is not found.
|-
| 0xFA002 - 0x138602 || 2000 - 2499 || Error: Failed to access SD card.
|-
| 0x136802 - 0x176E02 || 2500 - 2999 || Error: Failed to access game card.
|-
| 0x177202 || 3001 || Error: Specified operation is not implemented.
|-
| 0x177A02 || 3005 || Error: Specified value is out of range.
|-
| 0x1B5802 - 0x1F3E02 || 3500 - 3999 || Error: Failed to access MMC.
|-
| 0x1F4202 - 0x219602 || 4001 - 4299 || Error: ROM is corrupted.
|-
| 0x219A02 - 0x232602 || 4301 - 4499 || Error: Save data is corrupted.
|-
| 0x232A02 - 0x23EE02 || 4501 - 4599 || Error: NCA is corrupted.
|-
| 0x23F202 - 0x243E02 || 4601 - 4639 || Error: Integrity verification failed.
|-
| 0x244202 - 0x246602 || 4641 - 4659 || Error: Partition FS is corrupted.
|-
| 0x246A02 - 0x248E02 || 4661 - 4679 || Error: Built-in-storage is corrupted.
|-
| 0x249202 - 0x24B602 || 4681 - 4699 || Error: FAT FS is corrupted.
|-
| 0x24BA02 - 0x24DE02 || 4701 - 4719 || Error: HOST FS is corrupted.
|-
| 0x1F4002 - 0x270E02 || 4000, 4300, 4500, 4600, 4640, 4660, 4680, 4700, 4720-4999 || Error: Data is corrupted.
|-
| 0x271002 - 0x2EDE02 || 5000-5999 || Error: Unexpected failure occurred.
|-
| 0x2EE402 - 0x2F1A02 || 6002-6029 || Error: Invalid path was specified.
|-
| 0x2F5A02 || 6061 || Error: Invalid offset was specified.
|-
| 0x2F5C02 || 6062 || Error: Invalid size was specified.
|-
| 0x2F5E02 || 6063 || Error: Null pointer argument was specified.
|-
| 0x2EE002 || 6000 || Error: Precondition violation.
|-
| 0x2EE202 - 0x306E02 || 6001-6199 || Error: Invalid argument was specified.
|-
| 0x307202 || 6201 || Error: OpenMode_AllowAppend is required for implicit extension of file size by WriteFile().
|-
| 0x307002 - 0x313602 || 6200, 6202 - 6299 || Error: Invalid operation for the open mode.
|-
| 0x313802 - 0x31FE02 || 6300-6399 || Error: Unsupported operation.
|-
| 0x320002 - 0x32C602 || 6400-6499 || Error: Permission denied.
|-
| 0x346402 || 6706 || Error: Enough journal space is not left.
|-
| 0x346A02 || 6709 || Error: The open count of files and directories reached the limitation.
|}

= Fatal Errors =
{| class=wikitable
! Error || Description
|-
| 2162-0002
| Can be triggered by running [[SVC|svcBreak]]. The svcBreak params have no affect on the value of the thrown error-code.
|-
| 2168-0000
| Userland ARM undefined instruction exception
|-
| 2168-0001
| Userland ARM prefetch-abort due to PC set to non-executable region
|-
| 2168-0002
| Userland ARM data abort. Also caused by abnormal process termination via [[SVC|svcExitProcess]]. Note: directly jumping to nnMain()-retaddr from non-main-thread has the same result.
|-
| 2168-0003
| Userland PC address not aligned to 4 bytes
|-
| 2168-0008
| Can occur when attempting to call an svc outside the whitelist
|}

= Support Errors =
{| class=wikitable
! Error !! Module !! Description !! Notes
|-
|
| {web-applets listed above}
| 2750
| MP4 parsing failed.
|}
Normal error-codes displayed by the system also use the same format as fatal-errors.

NPDM

2018-02-21T05:06:26Z

OgniK: /* META */

This is the Switch equivalent of 3DS [https://www.3dbrew.org/wiki/NCCH/Extended_Header exheader]. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| META
|-
| 0x80
| <Varies>
| ACID
|-
| <See META>
| <See META>
| ACI0
|}

= META =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "META".
|-
| 0x4
|
|
|-
| 0x8
|
|
|-
| 0xC
| 1
| Needs to be <= 0xF
|-
| 0xE
| 1
| MainThreadPrio
|-
| 0xF
| 1
| DefaultCpuId
|-
| 0x10
|
|
|-
| 0x18
| 4
| ProcessCategory (0: regular title, 1: kernel built-in). Should be 0 here.
|-
| 0x1C
| 4
| MainStackSize
|-
| 0x20
| ?
| Title name
|-
| 0x70
| 0x4
| [[#ACI0]] offset
|-
| 0x74
| 0x4
| [[#ACI0]] size
|-
| 0x78
| 0x4
| [[#ACID]] offset
|-
| 0x7C
| 0x4
| [[#ACID]] size
|}

= ACID =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0
| 0x100
| RSA-2048 signature, seems to verify the data starting at 0x100 with the size field from 0x204.
|-
| 0x100
| 0x100
| RSA-2048 public key, seems to be used for the second [[NCA_Format|NCA]] signature.
|-
| 0x200
| 0x4
| Magic "ACID".
|-
| 0x204
| 0x4
| s32 Size field used with the above signature(?).
|-
| 0x208
| 0x4
| Zeroes
|-
| 0x20C
| 0x4
| Retail flag. Must be 1 on retail, on devunit 0 is also allowed.
|-
| 0x210
| 0x8
| TitleIdRange_Min
|-
| 0x218
| 0x8
| TitleIdRange_Max
|-
| 0x220
| 0x4
| [[#FS Access Control]] offset
|-
| 0x224
| 0x4
| [[#FS Access Control]] size
|-
| 0x228
| 0x4
| [[#Service Access Control]] offset
|-
| 0x22C
| 0x4
| [[#Service Access Control]] size
|-
| 0x230
| 4
| [[#Kernel Access Control]] offset
|-
| 0x234
| 4
| [[#Kernel Access Control]] size
|-
| 0x238
| 0x8
| Padding
|}

= ACI0 =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magic "ACI0".
|-
| 0x4
| 0xC
| Zeroes
|-
| 0x10
| 0x8
| Title id
|-
| 0x18
| 0x8
| Padding
|-
| 0x20
| 0x4
| [[#FS Access Header]] offset
|-
| 0x24
| 0x4
| [[#FS Access Header]] size
|-
| 0x28
| 0x4
| [[#Service Access Control]] offset
|-
| 0x2C
| 0x4
| [[#Service Access Control]] size
|-
| 0x30
| 4
| [[#Kernel Access Control]] offset
|-
| 0x34
| 4
| [[#Kernel Access Control]] size
|-
| 0x38
| 0x8
| Padding
|}

= FS Access Header =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x4
| Usually 0x1C
|-
| 0x10
| 0x4
| Usually 0x0
|-
| 0x14
| 0x4
| Usually 0x1C
|-
| 0x18
| 0x4
| Usually 0x0
|-
|}

= FS Access Control =

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version? Always 1. Must be non-zero.
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| Permissions bitmask
|-
| 0xC
| 0x20
| Usually all zeroes for applications
|}

[[Filesystem_services#Permissions|Permissions]] bitmask:
{| class="wikitable" border="1"
|-
! Bit
! Description
|-
| 0
| MountContent* is accessible when set.
|-
| 34
| Enables access to [[Filesystem_services|Bis]] partitionID 27 and 28?
|-
| 63
| Enables access to everything: all [[Filesystem_services#Permissions|permission-types]] which check a bitmask have this bit set.
|}

For bit62 in permissions, see [[SPL_services#GetConfig|here]].

Web-applets permissions:
* "LibAppletWeb" and "LibAppletOff" have same access control: bit0 and bit3 set, and bit62 set.
* Rest of the web-applets: Same as above except bit0 isn't set.

= Service Access Control =
This is a list of [[Services_API|service]]-name strings which the title has access to, with the following structure:
+0: control_byte
+1: {service-name without nul-terminator}

Bitmask 0x0F in control_byte is the {length of the service-name without nul-terminator} - 1.

Bitmask 0x80 in control_byte means service is allowed to be registered.

The service string can contain a wildcard <code>*</code> character.

= Kernel Access Control =
On Switch, descriptors are identified by pattern 01..11 in low bits.

{| class="wikitable" border="1"
|-
! Pattern of lower bits
! Lowest clear bitmask/bit
! Type
! Fields
|-
| <code>0bxxxxxxxxxxxx0111</code>
| Bit3
| KernelFlags
| Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio
|-
| <code>0bxxxxxxxxxxx01111</code>
| Bit4
| SyscallMask
| Bits 29-31: Syscall mask table index; Bits 5-28: Mask
|-
| <code>0bxxxxxxxxx0111111</code>
| Bit6
| MapIoOrNormalRange
| Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag
|-
| <code>0bxxxxxxxx01111111</code>
| Bit7
| MapNormalPage (RW)
| Bits 8-31: Page
|-
| <code>0bxxxx011111111111</code>
| Bit11
| InterruptPair
| Bits 12-21: Irq0, bits 20-31: Irq1, 0x3FF means empty.
|-
| <code>0bxx01111111111111</code>
| Bit13
| ApplicationType
| Bit16-14: ApplicationType (0=sysmodule, 1=application, 2=applet), bit16 ignored. Parsed by [[Process Manager services]]. Defaults to 0 if descriptor doesn't exist. Can only run 1 application at a time.
|-
| <code>0bx011111111111111</code>
| Bit14
| KernelReleaseVersion
| Bits 15-X: Version. The raw descriptor is compared with 0x80000, when less than an error is returned. This is equivalent to comparing the bits starting at bit15 with 0x10. This enforces a minimum required version, not a maximum.
|-
| <code>0b0111111111111111</code>
| Bit15
| HandleTableSize
| Bit25-16: Number of handles the table shall fit.
|-
| <code>0b1111111111111111</code>
| Bit16
| DebugFlags
| Bit17: can be debugged, bit18: can debug others
|-
| All ones
|
| Ignored
|
|}

== Mapping restrictions ==
The physaddr range 0x80060000-0x2000000000 is not allowed to be mapped as IO.
The physaddr range 0x80000000-0x2000000000 is not allowed to be mapped as Normal.

[2.0.0+] The range for IO was changed into 0x80060000-0x81D3FFFF.

[2.0.0+] A blacklist was added for IO and Normal mappings:
* 0x50040000-0x50060000 (ARM, Interrupt Controller)
* 0x6000F000 (Exception Vectors)
* 0x6001DC00-0x6001E000 (IPATCH)
* 0x7000E000 (RTC/PMC)
* 0x70019000 (MC)
* 0x7001C000 (MC0)
* 0x7001D000 (MC1)

== Kernel versions ==
{| class="wikitable" border="1"
|-
! Firmware || Kernel Version || Minimum Allowed
|-
| 1.0.0 || 5.0.0 || 3.0.0
|-
| 2.0.0 || 6.1.0 || 3.0.0
|-
| 3.0.0 || 7.4.0 || 3.0.0
|-
| 3.0.2 || 7.4.0 || 3.0.0
|}

Bit31-19: Major version
Bit18-15: Minor version
Bit14-0: Zeroes

GPU

2018-02-10T04:28:57Z

OgniK: educated guesses for draw gpfifo

== Mapping Memory ==

First, to map a memory region on the GPU Address Space, caching needs to be disabled by using [[SVC#svcSetMemoryAttribute|svcSetMemoryAttribute]]. The Address passed is the Virtual Address of the region that will be mapped, the size is the region size, and State0/1 are both set to 8 to disable caching of the memory region. This is done to ensure that the GPU can actually "see" the data written there, and it doesn't get stuck on some cache.

Then, [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]] is used to create a nvmap object with the desired size. After, [[NV_services#NVMAP_IOC_ALLOC|NVMAP_IOC_ALLOC]] is used to allocate the memory on the GPU Address Space, and map data on the process Address Space into the GPU Address Space, by passing the Virtual Address as the input addr parameter, and also the Handle returned from [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]]. Lastly, the actual mapping is done by using [[NV_services#NVGPU_AS_IOCTL_MAP_BUFFER_EX|NVGPU_AS_IOCTL_MAP_BUFFER_EX]], and the GPU Virtual Address is returned on the offset parameter. It's also possible to manually set the offset where the mapping should be made on the GPU Address Space, by passing the address on the "offset" parameter, and setting the bit 0 of the flags parameter to 1. However, for this to work, the desired GPU Virtual Address needs to be previously reserved using [[NV_services#NVGPU_AS_IOCTL_ALLOC_SPACE|NVGPU_AS_IOCTL_ALLOC_SPACE]].

The above process is used to map all data that will be used by the GPU, like Textures, Command Lists (a.k.a. Push Buffers), Vertex/Index buffers and Shaders. They usually have their own mapping, but Command Lists can share the same mapping.

== FIFO Commands ==

The GPU implements a variation of Tegra's push buffer format for it's PFIFO engine. PFIFO is a special engine responsible for receiving user command lists and routing them to the appropriate engines (2D, 3D, DMA).

Commands are submitted to the GPU's PFIFO engine through [[NV_services#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]].

This ioctl takes an array of gpfifo entries where each entry points to a FIFO command list. This list is composed of alternating 32-bit words containing FIFO commands and their respective arguments.

=== Command Structure ===

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|12-0
|Method
|-
|15-13
|Subchannel
|-
|28-16
|Argument count (in 32-bits Words) or inline data (see below)
|-
|31-29
|[[#Submission_mode|Submission mode]]
|}

Note: Methods are treated as 4-byte addressable locations, and hence their numbers are written down multiplied by 4.

Note: The command's arguments, when present, follow the command word immediately.

==== Submission mode ====

{| class="wikitable"
|-
! scope="col"| Mode
! scope="col"| Description
! scope="col"| Offical name
|-
|0
|Increasing mode (old)
|
|-
|1
|Increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count''', while automatically incrementing the '''method''' value. This means that each argument will be written to a different method location.
|INCR
|-
|2
|Non-increasing mode (old)
|
|-
|3
|Non-increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count'''. However, all arguments will be written to the same method location.
|NONINCR
|-
|4
|Inline mode - Tells PFIFO to read '''inline data''' from bits 28-16 of the command word, thus eliminating the need to pass additional words for the arguments.
|IMM
|-
|5
|Increase-once mode - Tells PFIFO to read as much arguments as specified by '''argument count''' and automatically increments the '''method''' value once only.
|
|}

=== Command List ===

All methods with values < 0x100 are special and executed by the PFIFO's DMA puller. The others are forwarded to the engine object currently bound to a given subchannel.

{| class="wikitable" border="1"
|-
! Command || Method || Subchannel || Arg Count || Mode || Name
|-
| 0x2001?000 || 0x0000 || Variable || 1 || 1 || [[#BindObject|BindObject]]
|-
| 0x80000040 || 0x40 || 0 || 0 || 4 || ?
|-
| 0xA???0045 || 0x45 || 0 || Variable || 5 || SetGraphMacroCode
|-
| 0x20020047 || 0x47 || 0 || 2 || 1 || SetGraphMacroEntry
|-
| 0x800?0049 || 0x49 || 0 || Variable || 4 || ?
|-
| 0x20056080 || 0x80 || 3 || Variable || 1 || ?
|-
| 0x20016085 || 0x85 || 3 || 1 || 1 || ?
|-
| 0x20026086 || 0x86 || 3 || 2 || 1 || ?
|-
| 0x20026088 || 0x88 || 3 || 2 || 1 || ?
|-
| 0x2004608C || 0x8C || 3 || Variable || 1 || ?
|-
| 0x20016091 || 0x91 || 3 || 1 || 1 || ?
|-
| 0x20026092 || 0x92 || 3 || 2 || 1 || ?
|-
| 0x20026094 || 0x94 || 3 || 2 || 1 || ?
|-
| 0x800160B5 || 0xB5 || 3 || 1 || 4 || ?
|-
| 0x800000BA || 0xBA || 0 || 0 || 4 || ?
|-
| 0x601000BE || 0xBE || 0 || 16 || 3 || ?
|-
| 0x200100BF || 0xBF || 0 || 1 || 1 || ?
|-
| 0x200180C0 || 0xC0 || 4 || 1 || 1 || ?
|-
| 0x200400C9 || 0xC9 || 0 || 4 || 1 || SetOuterTessellationLevels
|-
| 0x200200CD || 0xCD || 0 || 2 || 1 || SetInnerTessellationLevels
|-
| 0x200100DC || 0xDC || 0 || 1 || 1 || ?
|-
| 0x800?00DF || 0xDF || 0 || Variable || 4 || SetRasterizerDiscard?
|-
| 0x20048100 || 0x100 || 4 || 4 || 1 || ?
|-
| 0x20028102 || 0x102 || 4 || 2 || 1 || ?
|-
| 0x20018104 || 0x104 || 4 || 1 || 1 || ?
|-
| 0x20018105 || 0x105 || 4 || 1 || 1 || ?
|-
| 0x20018106 || 0x106 || 4 || 1 || 1 || ?
|-
| 0x200181C0 || 0x1C0 || 4 || 1 || 1 || ?
|-
| 0x200181C2 || 0x1C2 || 4 || 1 || 1 || ?
|-
| 0x200181C3 || 0x1C3 || 4 || 1 || 1 || ?
|-
| 0x200281C4 || 0x1C4 || 4 || 2 || 1 || ?
|-
| 0x200181C5 || 0x1C5 || 4 || 1 || 1 || ?
|-
| 0x200181C6 || 0x1C6 || 4 || 1 || 1 || ?
|-
| 0x200181C7 || 0x1C7 || 4 || 1 || 1 || ?
|-
| 0x200181C8 || 0x1C8 || 4 || 1 || 1 || ?
|-
| 0x200181CA || 0x1CA || 4 || 1 || 1 || ?
|-
| 0x200181CB || 0x1CB || 4 || 1 || 1 || ?
|-
| 0x200181CC || 0x1CC || 4 || 1 || 1 || ?
|-
| 0x200181CD || 0x1CD || 4 || 1 || 1 || ?
|-
| 0x200181CF || 0x1CF || 4 || 1 || 1 || ?
|-
| 0x800001D1 || 0x1D1 || 0 || 0 || 4 || ?
|-
| 0x200301F0 || 0x1F0 || 0 || 3 || 1 || ?
|-
| 0x800001F3 || 0x1F3 || 0 || 0 || 4 || ?
|-
| 0x200201F8 || 0x1F8 || 0 || 2 || 1 || ?
|-
| 0x200401FA || 0x1FA || 0 || 4 || 1 || ?
|-
| 0x20016223 || 0x223 || 3 || 1 || 1 || ?
|-
| 0x2004622C || 0x22C || 3 || 4 || 1 || ?
|-
| 0x20046230 || 0x230 || 3 || 4 || 1 || ?
|-
| 0x20046234 || 0x234 || 3 || 4 || 1 || ?
|-
| 0x200203?? || 0x3?? Variable || 0 || 2 || 1 || SetScissors?
|-
| 0x20040360 || 0x360 || 0 || 4 || 1 || ?
|-
| 0x20010364 || 0x364 || 0 || 1 || 1 || ?
|-
| 0x800?0368 || 0x368 || 0 || Variable || 4 || ?
|-
| 0x800?036B || 0x36B || 0 || Variable || 4 || ?
|-
| 0x800?036C || 0x36C || 0 || Variable || 4 || ?
|-
| 0x2001036F || 0x36F || 0 || 1 || 1 || ?
|-
| 0x80000370 || 0x370 || 0 || 0 || 4 || ?
|-
| 0x80000371 || 0x371 || 0 || 0 || 4 || ?
|-
| 0x80000372 || 0x372 || 0 || 0 || 4 || ?
|-
| 0x8???0373 || 0x373 || 0 || Variable || 4 || SetPatchSize
|-
| 0x80000374 || 0x374 || 0 || 0 || 4 || ?
|-
| 0x20010376 || 0x376 || 0 || 1 || 1 || ?
|-
| 0x800?03D5 || 0x3D5 || 0 || Variable || 4 || ?
|-
| 0x800?03D6 || 0x3D6 || 0 || Variable || 4 || ?
|-
| 0x800?03D7 || 0x3D7 || 0 || Variable || 4 || ?
|-
| 0x200103D9 || 0x3D9 || 0 || 1 || 1 || SetTiledCacheTileSize
|-
| 0x80?003DE || 0x3DE || 0 || Variable || 4 || ?
|-
| 0x800003E0 || 0x3E0 || 0 || 0 || 4 || ?
|-
| 0x200203E7 || 0x3E7 || 0 || 2 || 1 || ?
|-
| 0x800003ED || 0x3ED || 0 || 0 || 4 || ?
|-
| 0x800203EE || 0x3EE || 0 || 2 || 4 || ?
|-
| 0x200403EF || 0x3EF || 0 || 4 || 1 || SetSampleMask
|-
| 0x800003F5 || 0x3F5 || 0 || 0 || 4 || ?
|-
| 0x800103F6 || 0x3F6 || 0 || 1 || 4 || ?
|-
| 0x200503F8 || 0x3F8 || 0 || 5 || 1 || ?
|-
| 0x200203FD || 0x3FD || 0 || 2 || 1 || ?
|-
| 0x2004040C || 0x40C || 0 || 4 || 1 || ?
|-
| 0x200C0420 || 0x420 || 0 || 12 || 1 || ?
|-
| 0x80000446 || 0x446 || 0 || 0 || 4 || ?
|-
| 0x80000451 || 0x451 || 0 || 0 || 4 || ?
|-
| 0x800?0452 || 0x452 || 0 || Variable || 4 || ?
|-
| 0x20100458 || 0x458 || 0 || 16 || 1 || ?
|-
| 0x20040478 || 0x478 || 0 || 4 || 1 || ?
|-
| 0x8000047C || 0x47C || 0 || 0 || 4 || ?
|-
| 0x8000047E || 0x47E || 0 || 0 || 4 || ?
|-
| 0x8001047F || 0x47F || 0 || 1 || 4 || ResolveDepthBuffer
|-
| 0x2003048A || 0x48A || 0 || 3 || 1 || ?
|-
| 0x800?04B3 || 0x4B3 || 0 || Variable || 4 || ?
|-
| 0x800104B9 || 0x4B9 || 0 || 1 || 4 || ?
|-
| 0x800?04BA || 0x4BA || 0 || Variable || 4 || ?
|-
| 0x800004BB || 0x4BB || 0 || 0 || 4 || ?
|-
| 0x800?04C3 || 0x4C3 || 0 || Variable || 4 || ?
|-
| 0x200104C4 || 0x4C4 || 0 || 1 || 1 || SetAlphaRef
|-
| 0x200404C7 || 0x4C7 || 0 || 4 || 1 || SetBlendColor
|-
| 0x800004E0 || 0x4E0 || 0 || 0 || 4 || ?
|-
| 0x800?04E5 || 0x4E5 || 0 || Variable || 4 || ?
|-
| 0x800?04E6 || 0x4E6 || 0 || Variable || 4 || ?
|-
| 0x800?04E7 || 0x4E7 || 0 || Variable || 4 || ?
|-
| 0x200204EC || 0x4EC || 0 || 2 || 1 || SetLineWidth
|-
| 0x800?050D || 0x50D || 0 || Variable || 4 || ?
|-
| 0x80000519 || 0x519 || 0 || 0 || 4 || ?
|-
| 0x80000540 || 0x540 || 0 || 0 || 4 || ?
|-
| 0x20010546 || 0x546 || 0 || 1 || 1 || SetPointSize
|-
| 0x2001054C || 0x54C || 0 || 1 || 1 || ResetCounter
|-
| 0x800?054E || 0x54E || 0 || Variable || 4 || ?
|-
| 0x20030554 || 0x554 || 0 || 3 || 1 || SetRenderEnableConditional
|-
| 0x800?0556 || 0x556 || 0 || Variable || 4 || SetRenderEnable?
|-
| 0x2001055B || 0x55B || 0 || 1 || 1 || ?
|-
| 0x2001056F || 0x56F || 0 || 1 || 1 || ?
|-
| 0x80000572 || 0x572 || 0 || 0 || 4 || ?
|-
| 0x800?0574 || 0x574 || 0 || Variable || 4 || ?
|-
| 0x8000057F || 0x57F || 0 || 0 || 4 || ?
|-
| 0x80000580 || 0x580 || 0 || 0 || 4 || ?
|-
| 0x80000591 || 0x591 || 0 || 0 || 4 || ?
|-
| 0x20010592 || 0x592 || 0 || 1 || 1 || ?
|-
| 0x200205F2 || 0x5F2 || 0 || 2 || 1 || ?
|-
| 0x800?05F6 || 0x5F6 || 0 || Variable || 4 || ?
|-
| 0x2001061F || 0x61F || 0 || 1 || 1 || ?
|-
| 0x800?0620 || 0x620 || 0 || Variable || 4 || ?
|-
| 0x80010646 || 0x646 || 0 || 1 || 4 || ?
|-
| 0x800?0648 || 0x648 || 0 || Variable || 4 || ?
|-
| 0x2001064F || 0x64F || 0 || 1 || 1 || SetDepthClamp
|-
| 0x800?066F || 0x66F || 0 || Variable || 4 || ?
|-
| 0x120020671 || 0x671 || 0 || 2 || 9 || ?
|-
| 0x20010674 || 0x674 || 0 || 1 || 1 || ?
|-
| 0x8000068B || 0x68B || 0 || 0 || 4 || ?
|-
| 0x200406C0 || 0x6C0 || 0 || 4 || 1 || ?
|-
| 0x20010703 || 0x703 || 0 || 1 || 1 || ?
|-
| 0x200207?? || 0x7?? Variable || 0 || 2 || 1 || ?
|-
| 0x80300830 || 0x830 || 0 || 48 || 4 || ?
|-
| 0x80400840 || 0x840 || 0 || 64 || 4 || ?
|-
| 0x80500850 || 0x850 || 0 || 80 || 4 || ?
|-
| 0x200308E0 || 0x8E0 || 0 || 3 || 1 || ?
|-
| 0x200308E3 || 0x8E3 || 0 || 3 || 1 || CB_POS(Const buffer position)
|-
| 0x200308E4 || 0x8E4 || 0 || 3 || 1 || ?
|-
| 0x80??0904 || 0x904 || 0 || Variable || 4 || ?
|-
| 0x80??090C || 0x90C || 0 || Variable || 4 || ?
|-
| 0x80??0914 || 0x914 || 0 || Variable || 4 || ?
|-
| 0x80??091C || 0x91C || 0 || Variable || 4 || ?
|-
| 0x80??0924 || 0x924 || 0 || Variable || 4 || ?
|-
| 0x80000D1E || 0xD1E || 0 || 0 || 4 || ?
|-
| 0x800?0D28 || 0xD28 || 0 || Variable || 4 || ?
|-
| 0x20010D29 || 0xD29 || 0 || 1 || 1 || ?
|-
| 0x20010D34 || 0xD34 || 0 || 1 || 1 || ?
|-
| 0xA0020E00 || 0xE00 || 0 || 2 || 5 || BeginTransformFeedback
|-
| 0x20010E02 || 0xE02 || 0 || 1 || 1 || ?
|-
| 0x80020E04 || 0xE04 || 0 || 2 || 4 || ?
|-
| 0x20010E06 || 0xE06 || 0 || 1 || 1 || ?
|-
| 0xA0030E0A || 0xE0A || 0 || 3 || 5 || ?
|-
| 0x80050E0C || 0xE0C || 0 || 5 || 4 || ?
|-
| 0x800?0E0E || 0xE0E || 0 || Variable || 4 || ?
|-
| 0x20010E10 || 0xE10 || 0 || 1 || 1 || ?
|-
| 0xA0040E12 || 0xE12 || 0 || 4 || 5 || ?
|-
| 0x20010E1A || 0xE1A || 0 || 1 || 1 || ?
|-
| 0xA0040E1C || 0xE1C || 0 || 4 || 5 || ?
|-
| 0x81900E1E || 0xE1E || 0 || 400 || 4 || ?
|-
| 0x80000E20 || 0xE20 || 0 || 0 || 4 || ?
|-
| 0x80000E24 || 0xE24 || 0 || 0 || 4 || ?
|-
| 0xA0040E2C || 0xE2C || 0 || 4 || 5 || PushDebugGroup
|-
| 0xA0020E2E || 0xE2E || 0 || 2 || 5 || PopDebugGroupId
|-
| 0xA0030E30 || 0xE30 || 0 || 3 || 5 || DrawArrays
|-
| 0xA0050E32 || 0xE32 || 0 || 5 || 5 || DrawArraysIndirect?
|-
| 0xA0050E34 || 0xE34 || 0 || 5 || 5 || DrawArraysInstanced?
|-
| 0xA0050E36 || 0xE36 || 0 || 5 || 5 || DrawElements
|-
| 0xA0060E38 || 0xE38 || 0 || 6 || 5 || DrawElementsIndirect?
|-
| 0xA0060E3A || 0xE3A || 0 || 6 || 5 || DrawElementsInstanced?
|-
| 0xA0050E42 || 0xE42 || 0 || 5 || 5 || ?
|-
| 0xA0060E44 || 0xE44 || 0 || 6 || 5 || ?
|}

Note: These still need to be heavily verified and ''could'' be wrong.

=== BindObject ===

In order to bind an engine object to a specific subchannel, method 0 (BindObject) must be used first. The target subchannel is specified in bits 15-13 of the command word.

After the engine object is bound to the desired subchannel, setting it's value in bits 15-13 of any subsequent command word will make PFIFO forward the command to the target engine.

This method only takes one argument, an [[#Engine_IDs|engine ID]].

==== Engine IDs ====

{| class="wikitable"
|-
! scope="col"| ID
! scope="col"| Engine
|-
|0x902D
|FERMI_TWOD_A (2D)
|-
|0xB197
|MAXWELL_B (3D)
|-
|0xB1C0
|MAXWELL_COMPUTE_B
|-
|0xA140
|KEPLER_INLINE_TO_MEMORY_B
|-
|0xB0B5
|MAXWELL_DMA_COPY_A (DMA)
|}

=== Fences ===

Command lists can contain fences to ensure that commands are executed on the correct order, and subsequent commands are only sent when the previously sent commands were already processed by the GPU. Fences uses the QUERY_* commands, and works like this:

* First, QUERY_ADDRESS_HIGH and QUERY_ADDRESS_LOW commands are added to the Command List, with the High/Low 32 bits part of the 64-bits GPU Virtual Address where the fence is located. This GPU Virtual Address needs to be mapped to the process Virtual Address beforehand.
* Then, QUERY_SEQUENCE is added with a sequential number. This number is basically a incrementing counter, so the first Command List can have QUERY_SEQUENCE = 1, the next one QUERY_SEQUENCE = 2, 3, 4... and so on.
* Finally, QUERY_GET is added and contains the mode and other unknown data.

The above commands are added using the [[#Submission_mode|increasing mode]], since the Ids for all those 4 registers are sequential.

==== QUERY_GET Structure ====

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|1-0
|Mode
|-
|4
|Fence
|-
|15-12
|Unit
|}

==== QUERY_GET Mode ====

{| class="wikitable"
|-
! scope="col"| Value
! scope="col"| Mode
|-
|0
|Write
|-
|1
|Sync
|-
|2
|Write ?
|-
|3
|Write ?
|}

TODO: Move this to a separate page with all GPU Commands with descriptions. Also figure out what the other values mean.

Some of the other fields are still unknown/unobserved.

Official games will set Mode to 0, Fence to 1 and Unit to 0xF. The QUERY_SEQUENCE value is then written by the GPU to the address pointed to by QUERY_ADDRESS.
On the CPU side, the game code should wait until the value at the address pointed to by QUERY_ADDRESS is >= to the last written SEQUENCE value. Official code waits for this condition to be true on a loop, and won't send any further commands before that.

== Vertex Data Submission ==

Note: This is a observation on how the game Puyo Puyo Tetris sends textured squares to the GPU.

# VERTEX_ATTRIB_FORMAT (0-15) are set (only the first 3 are really used, the rest are set float, with Size = 1 and offset at 0).
# VERTEX_ARRAY_FETCH (0) is set with the lower 12 bits set to 0x1c (Stride) and bit 12 to 1 (Enabled).
# VERTEX_ARRAY_START_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located.
# VERTEX_ARRAY_LIMIT_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located, plus the Vertex Data size in bytes minus 1.
# VERTEX_BEGIN_GL is used with the primitive type set to TRIANGLE_STRIP.
# VERTEX_BUFFER_FIRST with value 0 (indicating the index of the first primitive to render?).
# VERTEX_BUFFER_COUNT is set to 4, because the Vertex Buffer with the square has 4 vertices.
# VERTEX_END_GL is used with value 0 (currently unknown what this value means).

== Texture View ==

Texture information such as address, format and size is sent to the GPU through a structure know as Texture View (a.k.a. Texture Image Control, or TIC). Each texture that the game uses needs a separate TIC, and those TICs are written to a table, one after the other. Each [[#TIC_Structure|TIC entry]] has 0x20 bytes, and is composed of 8 32-bits words where the texture information is packed.

The index of the TIC entries that should be used by the shader is sent to the GPU with the CB_POS/CB_DATA (0) methods. Games usually follows the following steps to write the TIC entry indexes:

* CB_ADDRESS_HIGH/LOW method is used to set the GPU Virtual Address of the Const Buffer.
* CB_POS is used to set the write offset of the Const Buffer to 0x20 + n * 4, where ''n'' is the is the index of the active texture that will be used by the shader (?).
* CB_DATA (0) method is used to write the value into the Const Buffer. The value is a word where the lower 20 bits is the TIC index.

The address of a given TIC entry can be calculates as:

tic_entry_address = tic_base_address + tic_index * 0x20

Where ''tic_base_address'' is the address written to TIC_ADDRESS_HIGH/LOW (methods 0x1574 and 0x1578), ''tic_index'' is the lower 20 bits of the word written into the Const Buffer with CB_DATA (0), and 0x20 is the size of each TIC entry in bytes.

Note: More research still needs to be done on the Const Buffer and how it is used by the shader.

=== TIC Structure ===

{| class="wikitable" border="1"
|-
! Word || Bits || Description
|-
| 0 || 6-0 || [[GPU_Texture_Formats#Texture_Formats|Texture Format]]
|-
| 0 || 9-7 || [[#Channel_Data_Type|R Channel Data Type]]
|-
| 0 || 12-10 || [[#Channel_Data_Type|G Channel Data Type]]
|-
| 0 || 15-13 || [[#Channel_Data_Type|B Channel Data Type]]
|-
| 0 || 18-16 || [[#Channel_Data_Type|A Channel Data Type]]
|-
| 1 || 31-0 || Lower 32-bits of the Texture GPU Virtual Address
|-
| 2 || 15-0 || Higher 16-bits of the Texture GPU Virtual Address
|-
| 4 || 15-0 || Texture Width minus 1
|-
| 5 || 15-0 || Texture Height minus 1
|}

==== Channel Data Type ====

{| class="wikitable" border="1"
|-
! Value || Type
|-
| 1 || SNORM
|-
| 2 || UNORM
|-
| 3 || SINT
|-
| 4 || UINT
|-
| 5 || SNORM_FORCE_FP16
|-
| 6 || UNORM_FORCE_FP16
|-
| 7 || FLOAT
|}

== References ==

FIFO engine overview:
[https://envytools.readthedocs.io/en/latest/hw/fifo/intro.html]

Method values from the Fermi family GPU (a bit older than the Tegra X1, but values seems to be mostly the same):
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gf100_3d.xml]

TIC structure used on a Maxwell GPU:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gm200_texture.xml]

Values for some types used on the above XML:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/nv_3ddefs.xml]

Command word packing code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_winsys.h]

TIC entry pack/write code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_tex.c#n65]

GPU

2018-02-10T04:23:40Z

OgniK: gpu command list sorted by method

== Mapping Memory ==

First, to map a memory region on the GPU Address Space, caching needs to be disabled by using [[SVC#svcSetMemoryAttribute|svcSetMemoryAttribute]]. The Address passed is the Virtual Address of the region that will be mapped, the size is the region size, and State0/1 are both set to 8 to disable caching of the memory region. This is done to ensure that the GPU can actually "see" the data written there, and it doesn't get stuck on some cache.

Then, [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]] is used to create a nvmap object with the desired size. After, [[NV_services#NVMAP_IOC_ALLOC|NVMAP_IOC_ALLOC]] is used to allocate the memory on the GPU Address Space, and map data on the process Address Space into the GPU Address Space, by passing the Virtual Address as the input addr parameter, and also the Handle returned from [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]]. Lastly, the actual mapping is done by using [[NV_services#NVGPU_AS_IOCTL_MAP_BUFFER_EX|NVGPU_AS_IOCTL_MAP_BUFFER_EX]], and the GPU Virtual Address is returned on the offset parameter. It's also possible to manually set the offset where the mapping should be made on the GPU Address Space, by passing the address on the "offset" parameter, and setting the bit 0 of the flags parameter to 1. However, for this to work, the desired GPU Virtual Address needs to be previously reserved using [[NV_services#NVGPU_AS_IOCTL_ALLOC_SPACE|NVGPU_AS_IOCTL_ALLOC_SPACE]].

The above process is used to map all data that will be used by the GPU, like Textures, Command Lists (a.k.a. Push Buffers), Vertex/Index buffers and Shaders. They usually have their own mapping, but Command Lists can share the same mapping.

== FIFO Commands ==

The GPU implements a variation of Tegra's push buffer format for it's PFIFO engine. PFIFO is a special engine responsible for receiving user command lists and routing them to the appropriate engines (2D, 3D, DMA).

Commands are submitted to the GPU's PFIFO engine through [[NV_services#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]].

This ioctl takes an array of gpfifo entries where each entry points to a FIFO command list. This list is composed of alternating 32-bit words containing FIFO commands and their respective arguments.

=== Command Structure ===

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|12-0
|Method
|-
|15-13
|Subchannel
|-
|28-16
|Argument count (in 32-bits Words) or inline data (see below)
|-
|31-29
|[[#Submission_mode|Submission mode]]
|}

Note: Methods are treated as 4-byte addressable locations, and hence their numbers are written down multiplied by 4.

Note: The command's arguments, when present, follow the command word immediately.

==== Submission mode ====

{| class="wikitable"
|-
! scope="col"| Mode
! scope="col"| Description
! scope="col"| Offical name
|-
|0
|Increasing mode (old)
|
|-
|1
|Increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count''', while automatically incrementing the '''method''' value. This means that each argument will be written to a different method location.
|INCR
|-
|2
|Non-increasing mode (old)
|
|-
|3
|Non-increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count'''. However, all arguments will be written to the same method location.
|NONINCR
|-
|4
|Inline mode - Tells PFIFO to read '''inline data''' from bits 28-16 of the command word, thus eliminating the need to pass additional words for the arguments.
|IMM
|-
|5
|Increase-once mode - Tells PFIFO to read as much arguments as specified by '''argument count''' and automatically increments the '''method''' value once only.
|
|}

=== Command List ===

All methods with values < 0x100 are special and executed by the PFIFO's DMA puller. The others are forwarded to the engine object currently bound to a given subchannel.

{| class="wikitable" border="1"
|-
! Command || Method || Subchannel || Arg Count || Mode || Name
|-
| 0x2001?000 || 0x0000 || Variable || 1 || 1 || [[#BindObject|BindObject]]
|-
| 0x80000040 || 0x40 || 0 || 0 || 4 || ?
|-
| 0xA???0045 || 0x45 || 0 || Variable || 5 || SetGraphMacroCode
|-
| 0x20020047 || 0x47 || 0 || 2 || 1 || SetGraphMacroEntry
|-
| 0x800?0049 || 0x49 || 0 || Variable || 4 || ?
|-
| 0x20056080 || 0x80 || 3 || Variable || 1 || ?
|-
| 0x20016085 || 0x85 || 3 || 1 || 1 || ?
|-
| 0x20026086 || 0x86 || 3 || 2 || 1 || ?
|-
| 0x20026088 || 0x88 || 3 || 2 || 1 || ?
|-
| 0x2004608C || 0x8C || 3 || Variable || 1 || ?
|-
| 0x20016091 || 0x91 || 3 || 1 || 1 || ?
|-
| 0x20026092 || 0x92 || 3 || 2 || 1 || ?
|-
| 0x20026094 || 0x94 || 3 || 2 || 1 || ?
|-
| 0x800160B5 || 0xB5 || 3 || 1 || 4 || ?
|-
| 0x800000BA || 0xBA || 0 || 0 || 4 || ?
|-
| 0x601000BE || 0xBE || 0 || 16 || 3 || ?
|-
| 0x200100BF || 0xBF || 0 || 1 || 1 || ?
|-
| 0x200180C0 || 0xC0 || 4 || 1 || 1 || ?
|-
| 0x200400C9 || 0xC9 || 0 || 4 || 1 || SetOuterTessellationLevels
|-
| 0x200200CD || 0xCD || 0 || 2 || 1 || SetInnerTessellationLevels
|-
| 0x200100DC || 0xDC || 0 || 1 || 1 || ?
|-
| 0x800?00DF || 0xDF || 0 || Variable || 4 || SetRasterizerDiscard?
|-
| 0x20048100 || 0x100 || 4 || 4 || 1 || ?
|-
| 0x20028102 || 0x102 || 4 || 2 || 1 || ?
|-
| 0x20018104 || 0x104 || 4 || 1 || 1 || ?
|-
| 0x20018105 || 0x105 || 4 || 1 || 1 || ?
|-
| 0x20018106 || 0x106 || 4 || 1 || 1 || ?
|-
| 0x200181C0 || 0x1C0 || 4 || 1 || 1 || ?
|-
| 0x200181C2 || 0x1C2 || 4 || 1 || 1 || ?
|-
| 0x200181C3 || 0x1C3 || 4 || 1 || 1 || ?
|-
| 0x200281C4 || 0x1C4 || 4 || 2 || 1 || ?
|-
| 0x200181C5 || 0x1C5 || 4 || 1 || 1 || ?
|-
| 0x200181C6 || 0x1C6 || 4 || 1 || 1 || ?
|-
| 0x200181C7 || 0x1C7 || 4 || 1 || 1 || ?
|-
| 0x200181C8 || 0x1C8 || 4 || 1 || 1 || ?
|-
| 0x200181CA || 0x1CA || 4 || 1 || 1 || ?
|-
| 0x200181CB || 0x1CB || 4 || 1 || 1 || ?
|-
| 0x200181CC || 0x1CC || 4 || 1 || 1 || ?
|-
| 0x200181CD || 0x1CD || 4 || 1 || 1 || ?
|-
| 0x200181CF || 0x1CF || 4 || 1 || 1 || ?
|-
| 0x800001D1 || 0x1D1 || 0 || 0 || 4 || ?
|-
| 0x200301F0 || 0x1F0 || 0 || 3 || 1 || ?
|-
| 0x800001F3 || 0x1F3 || 0 || 0 || 4 || ?
|-
| 0x200201F8 || 0x1F8 || 0 || 2 || 1 || ?
|-
| 0x200401FA || 0x1FA || 0 || 4 || 1 || ?
|-
| 0x20016223 || 0x223 || 3 || 1 || 1 || ?
|-
| 0x2004622C || 0x22C || 3 || 4 || 1 || ?
|-
| 0x20046230 || 0x230 || 3 || 4 || 1 || ?
|-
| 0x20046234 || 0x234 || 3 || 4 || 1 || ?
|-
| 0x200203?? || 0x3?? Variable || 0 || 2 || 1 || SetScissors?
|-
| 0x20040360 || 0x360 || 0 || 4 || 1 || ?
|-
| 0x20010364 || 0x364 || 0 || 1 || 1 || ?
|-
| 0x800?0368 || 0x368 || 0 || Variable || 4 || ?
|-
| 0x800?036B || 0x36B || 0 || Variable || 4 || ?
|-
| 0x800?036C || 0x36C || 0 || Variable || 4 || ?
|-
| 0x2001036F || 0x36F || 0 || 1 || 1 || ?
|-
| 0x80000370 || 0x370 || 0 || 0 || 4 || ?
|-
| 0x80000371 || 0x371 || 0 || 0 || 4 || ?
|-
| 0x80000372 || 0x372 || 0 || 0 || 4 || ?
|-
| 0x8???0373 || 0x373 || 0 || Variable || 4 || SetPatchSize
|-
| 0x80000374 || 0x374 || 0 || 0 || 4 || ?
|-
| 0x20010376 || 0x376 || 0 || 1 || 1 || ?
|-
| 0x800?03D5 || 0x3D5 || 0 || Variable || 4 || ?
|-
| 0x800?03D6 || 0x3D6 || 0 || Variable || 4 || ?
|-
| 0x800?03D7 || 0x3D7 || 0 || Variable || 4 || ?
|-
| 0x200103D9 || 0x3D9 || 0 || 1 || 1 || SetTiledCacheTileSize
|-
| 0x80?003DE || 0x3DE || 0 || Variable || 4 || ?
|-
| 0x800003E0 || 0x3E0 || 0 || 0 || 4 || ?
|-
| 0x200203E7 || 0x3E7 || 0 || 2 || 1 || ?
|-
| 0x800003ED || 0x3ED || 0 || 0 || 4 || ?
|-
| 0x800203EE || 0x3EE || 0 || 2 || 4 || ?
|-
| 0x200403EF || 0x3EF || 0 || 4 || 1 || SetSampleMask
|-
| 0x800003F5 || 0x3F5 || 0 || 0 || 4 || ?
|-
| 0x800103F6 || 0x3F6 || 0 || 1 || 4 || ?
|-
| 0x200503F8 || 0x3F8 || 0 || 5 || 1 || ?
|-
| 0x200203FD || 0x3FD || 0 || 2 || 1 || ?
|-
| 0x2004040C || 0x40C || 0 || 4 || 1 || ?
|-
| 0x200C0420 || 0x420 || 0 || 12 || 1 || ?
|-
| 0x80000446 || 0x446 || 0 || 0 || 4 || ?
|-
| 0x80000451 || 0x451 || 0 || 0 || 4 || ?
|-
| 0x800?0452 || 0x452 || 0 || Variable || 4 || ?
|-
| 0x20100458 || 0x458 || 0 || 16 || 1 || ?
|-
| 0x20040478 || 0x478 || 0 || 4 || 1 || ?
|-
| 0x8000047C || 0x47C || 0 || 0 || 4 || ?
|-
| 0x8000047E || 0x47E || 0 || 0 || 4 || ?
|-
| 0x8001047F || 0x47F || 0 || 1 || 4 || ResolveDepthBuffer
|-
| 0x2003048A || 0x48A || 0 || 3 || 1 || ?
|-
| 0x800?04B3 || 0x4B3 || 0 || Variable || 4 || ?
|-
| 0x800104B9 || 0x4B9 || 0 || 1 || 4 || ?
|-
| 0x800?04BA || 0x4BA || 0 || Variable || 4 || ?
|-
| 0x800004BB || 0x4BB || 0 || 0 || 4 || ?
|-
| 0x800?04C3 || 0x4C3 || 0 || Variable || 4 || ?
|-
| 0x200104C4 || 0x4C4 || 0 || 1 || 1 || SetAlphaRef
|-
| 0x200404C7 || 0x4C7 || 0 || 4 || 1 || SetBlendColor
|-
| 0x800004E0 || 0x4E0 || 0 || 0 || 4 || ?
|-
| 0x800?04E5 || 0x4E5 || 0 || Variable || 4 || ?
|-
| 0x800?04E6 || 0x4E6 || 0 || Variable || 4 || ?
|-
| 0x800?04E7 || 0x4E7 || 0 || Variable || 4 || ?
|-
| 0x200204EC || 0x4EC || 0 || 2 || 1 || SetLineWidth
|-
| 0x800?050D || 0x50D || 0 || Variable || 4 || ?
|-
| 0x80000519 || 0x519 || 0 || 0 || 4 || ?
|-
| 0x80000540 || 0x540 || 0 || 0 || 4 || ?
|-
| 0x20010546 || 0x546 || 0 || 1 || 1 || SetPointSize
|-
| 0x2001054C || 0x54C || 0 || 1 || 1 || ResetCounter
|-
| 0x800?054E || 0x54E || 0 || Variable || 4 || ?
|-
| 0x20030554 || 0x554 || 0 || 3 || 1 || SetRenderEnableConditional
|-
| 0x800?0556 || 0x556 || 0 || Variable || 4 || SetRenderEnable?
|-
| 0x2001055B || 0x55B || 0 || 1 || 1 || ?
|-
| 0x2001056F || 0x56F || 0 || 1 || 1 || ?
|-
| 0x80000572 || 0x572 || 0 || 0 || 4 || ?
|-
| 0x800?0574 || 0x574 || 0 || Variable || 4 || ?
|-
| 0x8000057F || 0x57F || 0 || 0 || 4 || ?
|-
| 0x80000580 || 0x580 || 0 || 0 || 4 || ?
|-
| 0x80000591 || 0x591 || 0 || 0 || 4 || ?
|-
| 0x20010592 || 0x592 || 0 || 1 || 1 || ?
|-
| 0x200205F2 || 0x5F2 || 0 || 2 || 1 || ?
|-
| 0x800?05F6 || 0x5F6 || 0 || Variable || 4 || ?
|-
| 0x2001061F || 0x61F || 0 || 1 || 1 || ?
|-
| 0x800?0620 || 0x620 || 0 || Variable || 4 || ?
|-
| 0x80010646 || 0x646 || 0 || 1 || 4 || ?
|-
| 0x800?0648 || 0x648 || 0 || Variable || 4 || ?
|-
| 0x2001064F || 0x64F || 0 || 1 || 1 || SetDepthClamp
|-
| 0x800?066F || 0x66F || 0 || Variable || 4 || ?
|-
| 0x120020671 || 0x671 || 0 || 2 || 9 || ?
|-
| 0x20010674 || 0x674 || 0 || 1 || 1 || ?
|-
| 0x8000068B || 0x68B || 0 || 0 || 4 || ?
|-
| 0x200406C0 || 0x6C0 || 0 || 4 || 1 || ?
|-
| 0x20010703 || 0x703 || 0 || 1 || 1 || ?
|-
| 0x200207?? || 0x7?? Variable || 0 || 2 || 1 || ?
|-
| 0x80300830 || 0x830 || 0 || 48 || 4 || ?
|-
| 0x80400840 || 0x840 || 0 || 64 || 4 || ?
|-
| 0x80500850 || 0x850 || 0 || 80 || 4 || ?
|-
| 0x200308E0 || 0x8E0 || 0 || 3 || 1 || ?
|-
| 0x200308E3 || 0x8E3 || 0 || 3 || 1 || CB_POS(Const buffer position)
|-
| 0x200308E4 || 0x8E4 || 0 || 3 || 1 || ?
|-
| 0x80??0904 || 0x904 || 0 || Variable || 4 || ?
|-
| 0x80??090C || 0x90C || 0 || Variable || 4 || ?
|-
| 0x80??0914 || 0x914 || 0 || Variable || 4 || ?
|-
| 0x80??091C || 0x91C || 0 || Variable || 4 || ?
|-
| 0x80??0924 || 0x924 || 0 || Variable || 4 || ?
|-
| 0x80000D1E || 0xD1E || 0 || 0 || 4 || ?
|-
| 0x800?0D28 || 0xD28 || 0 || Variable || 4 || ?
|-
| 0x20010D29 || 0xD29 || 0 || 1 || 1 || ?
|-
| 0x20010D34 || 0xD34 || 0 || 1 || 1 || ?
|-
| 0xA0020E00 || 0xE00 || 0 || 2 || 5 || BeginTransformFeedback
|-
| 0x20010E02 || 0xE02 || 0 || 1 || 1 || ?
|-
| 0x80020E04 || 0xE04 || 0 || 2 || 4 || ?
|-
| 0x20010E06 || 0xE06 || 0 || 1 || 1 || ?
|-
| 0xA0030E0A || 0xE0A || 0 || 3 || 5 || ?
|-
| 0x80050E0C || 0xE0C || 0 || 5 || 4 || ?
|-
| 0x800?0E0E || 0xE0E || 0 || Variable || 4 || ?
|-
| 0x20010E10 || 0xE10 || 0 || 1 || 1 || ?
|-
| 0xA0040E12 || 0xE12 || 0 || 4 || 5 || ?
|-
| 0x20010E1A || 0xE1A || 0 || 1 || 1 || ?
|-
| 0xA0040E1C || 0xE1C || 0 || 4 || 5 || ?
|-
| 0x81900E1E || 0xE1E || 0 || 400 || 4 || ?
|-
| 0x80000E20 || 0xE20 || 0 || 0 || 4 || ?
|-
| 0x80000E24 || 0xE24 || 0 || 0 || 4 || ?
|-
| 0xA0040E2C || 0xE2C || 0 || 4 || 5 || PushDebugGroup
|-
| 0xA0020E2E || 0xE2E || 0 || 2 || 5 || PopDebugGroupId
|-
| 0xA0030E30 || 0xE30 || 0 || 3 || 5 || DrawArrays
|-
| 0xA0050E32 || 0xE32 || 0 || 5 || 5 || ?
|-
| 0xA0050E34 || 0xE34 || 0 || 5 || 5 || ?
|-
| 0xA0050E36 || 0xE36 || 0 || 5 || 5 || DrawElements
|-
| 0xA0060E38 || 0xE38 || 0 || 6 || 5 || ?
|-
| 0xA0060E3A || 0xE3A || 0 || 6 || 5 || ?
|-
| 0xA0050E42 || 0xE42 || 0 || 5 || 5 || ?
|-
| 0xA0060E44 || 0xE44 || 0 || 6 || 5 || ?
|}

Note: These still need to be heavily verified and ''could'' be wrong.

=== BindObject ===

In order to bind an engine object to a specific subchannel, method 0 (BindObject) must be used first. The target subchannel is specified in bits 15-13 of the command word.

After the engine object is bound to the desired subchannel, setting it's value in bits 15-13 of any subsequent command word will make PFIFO forward the command to the target engine.

This method only takes one argument, an [[#Engine_IDs|engine ID]].

==== Engine IDs ====

{| class="wikitable"
|-
! scope="col"| ID
! scope="col"| Engine
|-
|0x902D
|FERMI_TWOD_A (2D)
|-
|0xB197
|MAXWELL_B (3D)
|-
|0xB1C0
|MAXWELL_COMPUTE_B
|-
|0xA140
|KEPLER_INLINE_TO_MEMORY_B
|-
|0xB0B5
|MAXWELL_DMA_COPY_A (DMA)
|}

=== Fences ===

Command lists can contain fences to ensure that commands are executed on the correct order, and subsequent commands are only sent when the previously sent commands were already processed by the GPU. Fences uses the QUERY_* commands, and works like this:

* First, QUERY_ADDRESS_HIGH and QUERY_ADDRESS_LOW commands are added to the Command List, with the High/Low 32 bits part of the 64-bits GPU Virtual Address where the fence is located. This GPU Virtual Address needs to be mapped to the process Virtual Address beforehand.
* Then, QUERY_SEQUENCE is added with a sequential number. This number is basically a incrementing counter, so the first Command List can have QUERY_SEQUENCE = 1, the next one QUERY_SEQUENCE = 2, 3, 4... and so on.
* Finally, QUERY_GET is added and contains the mode and other unknown data.

The above commands are added using the [[#Submission_mode|increasing mode]], since the Ids for all those 4 registers are sequential.

==== QUERY_GET Structure ====

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|1-0
|Mode
|-
|4
|Fence
|-
|15-12
|Unit
|}

==== QUERY_GET Mode ====

{| class="wikitable"
|-
! scope="col"| Value
! scope="col"| Mode
|-
|0
|Write
|-
|1
|Sync
|-
|2
|Write ?
|-
|3
|Write ?
|}

TODO: Move this to a separate page with all GPU Commands with descriptions. Also figure out what the other values mean.

Some of the other fields are still unknown/unobserved.

Official games will set Mode to 0, Fence to 1 and Unit to 0xF. The QUERY_SEQUENCE value is then written by the GPU to the address pointed to by QUERY_ADDRESS.
On the CPU side, the game code should wait until the value at the address pointed to by QUERY_ADDRESS is >= to the last written SEQUENCE value. Official code waits for this condition to be true on a loop, and won't send any further commands before that.

== Vertex Data Submission ==

Note: This is a observation on how the game Puyo Puyo Tetris sends textured squares to the GPU.

# VERTEX_ATTRIB_FORMAT (0-15) are set (only the first 3 are really used, the rest are set float, with Size = 1 and offset at 0).
# VERTEX_ARRAY_FETCH (0) is set with the lower 12 bits set to 0x1c (Stride) and bit 12 to 1 (Enabled).
# VERTEX_ARRAY_START_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located.
# VERTEX_ARRAY_LIMIT_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located, plus the Vertex Data size in bytes minus 1.
# VERTEX_BEGIN_GL is used with the primitive type set to TRIANGLE_STRIP.
# VERTEX_BUFFER_FIRST with value 0 (indicating the index of the first primitive to render?).
# VERTEX_BUFFER_COUNT is set to 4, because the Vertex Buffer with the square has 4 vertices.
# VERTEX_END_GL is used with value 0 (currently unknown what this value means).

== Texture View ==

Texture information such as address, format and size is sent to the GPU through a structure know as Texture View (a.k.a. Texture Image Control, or TIC). Each texture that the game uses needs a separate TIC, and those TICs are written to a table, one after the other. Each [[#TIC_Structure|TIC entry]] has 0x20 bytes, and is composed of 8 32-bits words where the texture information is packed.

The index of the TIC entries that should be used by the shader is sent to the GPU with the CB_POS/CB_DATA (0) methods. Games usually follows the following steps to write the TIC entry indexes:

* CB_ADDRESS_HIGH/LOW method is used to set the GPU Virtual Address of the Const Buffer.
* CB_POS is used to set the write offset of the Const Buffer to 0x20 + n * 4, where ''n'' is the is the index of the active texture that will be used by the shader (?).
* CB_DATA (0) method is used to write the value into the Const Buffer. The value is a word where the lower 20 bits is the TIC index.

The address of a given TIC entry can be calculates as:

tic_entry_address = tic_base_address + tic_index * 0x20

Where ''tic_base_address'' is the address written to TIC_ADDRESS_HIGH/LOW (methods 0x1574 and 0x1578), ''tic_index'' is the lower 20 bits of the word written into the Const Buffer with CB_DATA (0), and 0x20 is the size of each TIC entry in bytes.

Note: More research still needs to be done on the Const Buffer and how it is used by the shader.

=== TIC Structure ===

{| class="wikitable" border="1"
|-
! Word || Bits || Description
|-
| 0 || 6-0 || [[GPU_Texture_Formats#Texture_Formats|Texture Format]]
|-
| 0 || 9-7 || [[#Channel_Data_Type|R Channel Data Type]]
|-
| 0 || 12-10 || [[#Channel_Data_Type|G Channel Data Type]]
|-
| 0 || 15-13 || [[#Channel_Data_Type|B Channel Data Type]]
|-
| 0 || 18-16 || [[#Channel_Data_Type|A Channel Data Type]]
|-
| 1 || 31-0 || Lower 32-bits of the Texture GPU Virtual Address
|-
| 2 || 15-0 || Higher 16-bits of the Texture GPU Virtual Address
|-
| 4 || 15-0 || Texture Width minus 1
|-
| 5 || 15-0 || Texture Height minus 1
|}

==== Channel Data Type ====

{| class="wikitable" border="1"
|-
! Value || Type
|-
| 1 || SNORM
|-
| 2 || UNORM
|-
| 3 || SINT
|-
| 4 || UINT
|-
| 5 || SNORM_FORCE_FP16
|-
| 6 || UNORM_FORCE_FP16
|-
| 7 || FLOAT
|}

== References ==

FIFO engine overview:
[https://envytools.readthedocs.io/en/latest/hw/fifo/intro.html]

Method values from the Fermi family GPU (a bit older than the Tegra X1, but values seems to be mostly the same):
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gf100_3d.xml]

TIC structure used on a Maxwell GPU:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gm200_texture.xml]

Values for some types used on the above XML:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/nv_3ddefs.xml]

Command word packing code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_winsys.h]

TIC entry pack/write code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_tex.c#n65]

GPU

2018-02-10T04:02:27Z

OgniK: gpu command list part 3

== Mapping Memory ==

First, to map a memory region on the GPU Address Space, caching needs to be disabled by using [[SVC#svcSetMemoryAttribute|svcSetMemoryAttribute]]. The Address passed is the Virtual Address of the region that will be mapped, the size is the region size, and State0/1 are both set to 8 to disable caching of the memory region. This is done to ensure that the GPU can actually "see" the data written there, and it doesn't get stuck on some cache.

Then, [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]] is used to create a nvmap object with the desired size. After, [[NV_services#NVMAP_IOC_ALLOC|NVMAP_IOC_ALLOC]] is used to allocate the memory on the GPU Address Space, and map data on the process Address Space into the GPU Address Space, by passing the Virtual Address as the input addr parameter, and also the Handle returned from [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]]. Lastly, the actual mapping is done by using [[NV_services#NVGPU_AS_IOCTL_MAP_BUFFER_EX|NVGPU_AS_IOCTL_MAP_BUFFER_EX]], and the GPU Virtual Address is returned on the offset parameter. It's also possible to manually set the offset where the mapping should be made on the GPU Address Space, by passing the address on the "offset" parameter, and setting the bit 0 of the flags parameter to 1. However, for this to work, the desired GPU Virtual Address needs to be previously reserved using [[NV_services#NVGPU_AS_IOCTL_ALLOC_SPACE|NVGPU_AS_IOCTL_ALLOC_SPACE]].

The above process is used to map all data that will be used by the GPU, like Textures, Command Lists (a.k.a. Push Buffers), Vertex/Index buffers and Shaders. They usually have their own mapping, but Command Lists can share the same mapping.

== FIFO Commands ==

The GPU implements a variation of Tegra's push buffer format for it's PFIFO engine. PFIFO is a special engine responsible for receiving user command lists and routing them to the appropriate engines (2D, 3D, DMA).

Commands are submitted to the GPU's PFIFO engine through [[NV_services#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]].

This ioctl takes an array of gpfifo entries where each entry points to a FIFO command list. This list is composed of alternating 32-bit words containing FIFO commands and their respective arguments.

=== Command Structure ===

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|12-0
|Method
|-
|15-13
|Subchannel
|-
|28-16
|Argument count (in 32-bits Words) or inline data (see below)
|-
|31-29
|[[#Submission_mode|Submission mode]]
|}

Note: Methods are treated as 4-byte addressable locations, and hence their numbers are written down multiplied by 4.

Note: The command's arguments, when present, follow the command word immediately.

==== Submission mode ====

{| class="wikitable"
|-
! scope="col"| Mode
! scope="col"| Description
! scope="col"| Offical name
|-
|0
|Increasing mode (old)
|
|-
|1
|Increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count''', while automatically incrementing the '''method''' value. This means that each argument will be written to a different method location.
|INCR
|-
|2
|Non-increasing mode (old)
|
|-
|3
|Non-increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count'''. However, all arguments will be written to the same method location.
|NONINCR
|-
|4
|Inline mode - Tells PFIFO to read '''inline data''' from bits 28-16 of the command word, thus eliminating the need to pass additional words for the arguments.
|IMM
|-
|5
|Increase-once mode - Tells PFIFO to read as much arguments as specified by '''argument count''' and automatically increments the '''method''' value once only.
|
|}

=== Command List ===

All methods with values < 0x100 are special and executed by the PFIFO's DMA puller. The others are forwarded to the engine object currently bound to a given subchannel.

{| class="wikitable" border="1"
|-
! Command || Method || Subchannel || Arg Count || Mode || Name
|-
| 0x2001?000 || 0x0000 || Variable || 1 || 1 || [[#BindObject|BindObject]]
|-
| 0xA0020E00 || 0xE00 || 0 || 2 || 5 || BeginTransformFeedback
|-
| 0xA0030E30 || 0xE30 || 0 || 3 || 5 || DrawArrays
|-
| 0xA0050E36 || 0xE36 || 0 || 5 || 5 || DrawElements
|-
| 0xA0020E2E || 0xE2E || 0 || 2 || 5 || PopDebugGroupId
|-
| 0xA0040E2C || 0xE2C || 0 || 4 || 5 || PushDebugGroup
|-
| 0x2001054C || 0x54C || 0 || 1 || 1 || ResetCounter
|-
| 0x8001047F || 0x47F || 0 || 1 || 4 || ResolveDepthBuffer
|-
| 0x200104C4 || 0x4C4 || 0 || 1 || 1 || SetAlphaRef
|-
| 0x200404C7 || 0x4C7 || 0 || 4 || 1 || SetBlendColor
|-
| 0x2001064F || 0x64F || 0 || 1 || 1 || SetDepthClamp
|-
| 0x200200CD || 0xCD || 0 || 2 || 1 || SetInnerTessellationLevels
|-
| 0x200204EC || 0x4EC || 0 || 2 || 1 || SetLineWidth
|-
| 0x200400C9 || 0xC9 || 0 || 4 || 1 || SetOuterTessellationLevels
|-
| 0x8???0373 || 0x373 || 0 || Variable || 4 || SetPatchSize
|-
| 0x20010546 || 0x546 || 0 || 1 || 1 || SetPointSize
|-
| 0x20030554 || 0x554 || 0 || 3 || 1 || SetRenderEnableConditional
|-
| 0x200403EF || 0x3EF || 0 || 4 || 1 || SetSampleMask
|-
| 0x200103D9 || 0x3D9 || 0 || 1 || 1 || SetTiledCacheTileSize
|-
| 0x20020047 || 0x47 || 0 || 2 || 1 || SetGraphMacroEntry
|-
| 0xA???0045 || 0x45 || 0 || Variable || 5 || SetGraphMacroCode
|-
| 0x800104B9 || 0x4B9 || 0 || 1 || 4 || ?
|-
| 0x80000374 || 0x374 || 0 || 0 || 4 || ?
|-
| 0xA0040E12 || 0xE12 || 0 || 4 || 5 || ?
|-
| 0x20010E10 || 0xE10 || 0 || 1 || 1 || ?
|-
| 0x120020671 || 0x671 || 0 || 2 || 9 || ?
|-
| 0x800004BB || 0x4BB || 0 || 0 || 4 || ?
|-
| 0x2004040C || 0x40C || 0 || 4 || 1 || ?
|-
| 0x800103F6 || 0x3F6 || 0 || 1 || 4 || ?
|-
| 0x800?04BA || 0x4BA || 0 || Variable || 4 || ?
|-
| 0x800?04B3 || 0x4B3 || 0 || Variable || 4 || ?
|-
| 0x800?04C3 || 0x4C3 || 0 || Variable || 4 || ?
|-
| 0x800004E0 || 0x4E0 || 0 || 0 || 4 || ?
|-
| 0x20010E1A || 0xE1A || 0 || 1 || 1 || ?
|-
| 0x8000068B || 0x68B || 0 || 0 || 4 || ?
|-
| 0x200308E3 || 0x8E3 || 0 || 3 || 1 || CB_POS(Const buffer position)
|-
| 0x800?0E0E || 0xE0E || 0 || Variable || 4 || ?
|-
| 0x20040478 || 0x478 || 0 || 4 || 1 || ?
|-
| 0x800003ED || 0x3ED || 0 || 0 || 4 || ?
|-
| 0x800203EE || 0x3EE || 0 || 2 || 4 || ?
|-
| 0x800003F5 || 0x3F5 || 0 || 0 || 4 || ?
|-
| 0x80000370 || 0x370 || 0 || 0 || 4 || ?
|-
| 0x80000371 || 0x371 || 0 || 0 || 4 || ?
|-
| 0x80000372 || 0x372 || 0 || 0 || 4 || ?
|-
| 0x80010646 || 0x646 || 0 || 1 || 4 || ?
|-
| 0x800?036B || 0x36B || 0 || Variable || 4 || ?
|-
| 0x800?036C || 0x36C || 0 || Variable || 4 || ?
|-
| 0x800?0648 || 0x648 || 0 || Variable || 4 || ?
|-
| 0x80000D1E || 0xD1E || 0 || 0 || 4 || ?
|-
| 0x80300830 || 0x830 || 0 || 48 || 4 || ?
|-
| 0x80400840 || 0x840 || 0 || 64 || 4 || ?
|-
| 0x80500850 || 0x850 || 0 || 80 || 4 || ?
|-
| 0x8000047C || 0x47C || 0 || 0 || 4 || ?
|-
| 0x200308E4 || 0x8E4 || 0 || 3 || 1 || ?
|-
| 0x200308E0 || 0x8E0 || 0 || 3 || 1 || ?
|-
| 0x80??0924 || 0x924 || 0 || Variable || 4 || ?
|-
| 0x80??0904 || 0x904 || 0 || Variable || 4 || ?
|-
| 0x80??091C || 0x91C || 0 || Variable || 4 || ?
|-
| 0x80??090C || 0x90C || 0 || Variable || 4 || ?
|-
| 0x80??0914 || 0x914 || 0 || Variable || 4 || ?
|-
| 0x20100458 || 0x458 || 0 || 16 || 1 || ?
|-
| 0x200207?? || 0x7?? Variable || 0 || 2 || 1 || ?
|-
| 0x20010703 || 0x703 || 0 || 1 || 1 || ?
|-
| 0x800?0620 || 0x620 || 0 || Variable || 4 || ?
|-
| 0x80000040 || 0x40 || 0 || 0 || 4 || ?
|-
| 0x200181C0 || 0x1C0 || 4 || 1 || 1 || ?
|-
| 0x200181C2 || 0x1C2 || 4 || 1 || 1 || ?
|-
| 0x20048100 || 0x100 || 4 || 4 || 1 || ?
|-
| 0x200281C4 || 0x1C4 || 4 || 2 || 1 || ?
|-
| 0x20018106 || 0x106 || 4 || 1 || 1 || ?
|-
| 0x200180C0 || 0xC0 || 4 || 1 || 1 || ?
|-
| 0x20040360 || 0x360 || 0 || 4 || 1 || ?
|-
| 0x20010E02 || 0xE02 || 0 || 1 || 1 || ?
|-
| 0x800?0049 || 0x49 || 0 || Variable || 4 || ?
|-
| 0x2001036F || 0x36F || 0 || 1 || 1 || ?
|-
| 0x20010376 || 0x376 || 0 || 1 || 1 || ?
|-
| 0x80000E24 || 0xE24 || 0 || 0 || 4 || ?
|-
| 0x20010364 || 0x364 || 0 || 1 || 1 || ?
|-
| 0x800?04E7 || 0x4E7 || 0 || Variable || 4 || ?
|-
| 0x800?0368 || 0x368 || 0 || Variable || 4 || ?
|-
| 0x80020E04 || 0xE04 || 0 || 2 || 4 || ?
|-
| 0xA0040E1C || 0xE1C || 0 || 4 || 5 || ?
|-
| 0x200203FD || 0x3FD || 0 || 2 || 1 || ?
|-
| 0x20010674 || 0x674 || 0 || 1 || 1 || ?
|-
| 0x200181CC || 0x1CC || 4 || 1 || 1 || ?
|-
| 0x200181CA || 0x1CA || 4 || 1 || 1 || ?
|-
| 0x200181CD || 0x1CD || 4 || 1 || 1 || ?
|-
| 0x200181CB || 0x1CB || 4 || 1 || 1 || ?
|-
| 0x200181CF || 0x1CF || 4 || 1 || 1 || ?
|-
| 0x200181C3 || 0x1C3 || 4 || 1 || 1 || ?
|-
| 0x20018104 || 0x104 || 4 || 1 || 1 || ?
|-
| 0x200181C5 || 0x1C5 || 4 || 1 || 1 || ?
|-
| 0x200181C6 || 0x1C6 || 4 || 1 || 1 || ?
|-
| 0x200181C7 || 0x1C7 || 4 || 1 || 1 || ?
|-
| 0x200181C8 || 0x1C8 || 4 || 1 || 1 || ?
|-
| 0x20028102 || 0x102 || 4 || 2 || 1 || ?
|-
| 0x20018105 || 0x105 || 4 || 1 || 1 || ?
|-
| 0x20016223 || 0x223 || 3 || 1 || 1 || ?
|-
| 0x20016085 || 0x85 || 3 || 1 || 1 || ?
|-
| 0x20026086 || 0x86 || 3 || 2 || 1 || ?
|-
| 0x20026088 || 0x88 || 3 || 2 || 1 || ?
|-
| 0x20056080 || 0x80 || 3 || Variable || 1 || ?
|-
| 0x2004608C || 0x8C || 3 || Variable || 1 || ?
|-
| 0x20046230 || 0x230 || 3 || 4 || 1 || ?
|-
| 0x20016091 || 0x91 || 3 || 1 || 1 || ?
|-
| 0x20026092 || 0x92 || 3 || 2 || 1 || ?
|-
| 0x20026094 || 0x94 || 3 || 2 || 1 || ?
|-
| 0x800160B5 || 0xB5 || 3 || 1 || 4 || ?
|-
| 0x20046234 || 0x234 || 3 || 4 || 1 || ?
|-
| 0x2004622C || 0x22C || 3 || 4 || 1 || ?
|-
| 0x80?003DE || 0x3DE || 0 || Variable || 4 || ?
|-
| 0xA0050E32 || 0xE32 || 0 || 5 || 5 || ?
|-
| 0x81900E1E || 0xE1E || 0 || 400 || 4 || ?
|-
| 0xA0050E42 || 0xE42 || 0 || 5 || 5 || ?
|-
| 0xA0050E34 || 0xE34 || 0 || 5 || 5 || ?
|-
| 0x80000446 || 0x446 || 0 || 0 || 4 || ?
|-
| 0x800?050D || 0x50D || 0 || Variable || 4 || ?
|-
| 0x800?05F6 || 0x5F6 || 0 || Variable || 4 || ?
|-
| 0xA0060E38 || 0xE38 || 0 || 6 || 5 || ?
|-
| 0xA0060E3A || 0xE3A || 0 || 6 || 5 || ?
|-
| 0xA0060E44 || 0xE44 || 0 || 6 || 5 || ?
|-
| 0x200205F2 || 0x5F2 || 0 || 2 || 1 || ?
|-
| 0x80050E0C || 0xE0C || 0 || 5 || 4 || ?
|-
| 0x8000047E || 0x47E || 0 || 0 || 4 || ?
|-
| 0x200C0420 || 0x420 || 0 || 12 || 1 || ?
|-
| 0x200406C0 || 0x6C0 || 0 || 4 || 1 || ?
|-
| 0x800001D1 || 0x1D1 || 0 || 0 || 4 || ?
|-
| 0x800003E0 || 0x3E0 || 0 || 0 || 4 || ?
|-
| 0x80000451 || 0x451 || 0 || 0 || 4 || ?
|-
| 0x200401FA || 0x1FA || 0 || 4 || 1 || ?
|-
| 0x80000540 || 0x540 || 0 || 0 || 4 || ?
|-
| 0x80000519 || 0x519 || 0 || 0 || 4 || ?
|-
| 0xA0030E0A || 0xE0A || 0 || 3 || 5 || ?
|-
| 0x20010D34 || 0xD34 || 0 || 1 || 1 || ?
|-
| 0x80000E20 || 0xE20 || 0 || 0 || 4 || ?
|-
| 0x800?0452 || 0x452 || 0 || Variable || 4 || ?
|-
| 0x800?066F || 0x66F || 0 || Variable || 4 || ?
|-
| 0x200203E7 || 0x3E7 || 0 || 2 || 1 || ?
|-
| 0x2001055B || 0x55B || 0 || 1 || 1 || ?
|-
| 0x2001056F || 0x56F || 0 || 1 || 1 || ?
|-
| 0x2001061F || 0x61F || 0 || 1 || 1 || ?
|-
| 0x80000591 || 0x591 || 0 || 0 || 4 || ?
|-
| 0x20010592 || 0x592 || 0 || 1 || 1 || ?
|-
| 0x800?00DF || 0xDF || 0 || Variable || 4 || SetRasterizerDiscard?
|-
| 0x800?0556 || 0x556 || 0 || Variable || 4 || SetRenderEnable?
|-
| 0x800?0574 || 0x574 || 0 || Variable || 4 || ?
|-
| 0x800?0D28 || 0xD28 || 0 || Variable || 4 || ?
|-
| 0x800000BA || 0xBA || 0 || 0 || 4 || ?
|-
| 0x20010E06 || 0xE06 || 0 || 1 || 1 || ?
|-
| 0x200100BF || 0xBF || 0 || 1 || 1 || ?
|-
| 0x200100DC || 0xDC || 0 || 1 || 1 || ?
|-
| 0x601000BE || 0xBE || 0 || 16 || 3 || ?
|-
| 0x200503F8 || 0x3F8 || 0 || 5 || 1 || ?
|-
| 0x800?054E || 0x54E || 0 || Variable || 4 || ?
|-
| 0x2003048A || 0x48A || 0 || 3 || 1 || ?
|-
| 0x200201F8 || 0x1F8 || 0 || 2 || 1 || ?
|-
| 0x200301F0 || 0x1F0 || 0 || 3 || 1 || ?
|-
| 0x80000572 || 0x572 || 0 || 0 || 4 || ?
|-
| 0x8000057F || 0x57F || 0 || 0 || 4 || ?
|-
| 0x80000580 || 0x580 || 0 || 0 || 4 || ?
|-
| 0x800001F3 || 0x1F3 || 0 || 0 || 4 || ?
|-
| 0x20010D29 || 0xD29 || 0 || 1 || 1 || ?
|-
| 0x200203?? || 0x3?? Variable || 0 || 2 || 1 || SetScissors?
|-
| 0x800?03D6 || 0x3D6 || 0 || Variable || 4 || ?
|-
| 0x800?03D5 || 0x3D5 || 0 || Variable || 4 || ?
|-
| 0x800?04E5 || 0x4E5 || 0 || Variable || 4 || ?
|-
| 0x800?03D7 || 0x3D7 || 0 || Variable || 4 || ?
|-
| 0x800?04E6 || 0x4E6 || 0 || Variable || 4 || ?
|}

Note: These still need to be heavily verified and ''could'' be wrong.

=== BindObject ===

In order to bind an engine object to a specific subchannel, method 0 (BindObject) must be used first. The target subchannel is specified in bits 15-13 of the command word.

After the engine object is bound to the desired subchannel, setting it's value in bits 15-13 of any subsequent command word will make PFIFO forward the command to the target engine.

This method only takes one argument, an [[#Engine_IDs|engine ID]].

==== Engine IDs ====

{| class="wikitable"
|-
! scope="col"| ID
! scope="col"| Engine
|-
|0x902D
|FERMI_TWOD_A (2D)
|-
|0xB197
|MAXWELL_B (3D)
|-
|0xB1C0
|MAXWELL_COMPUTE_B
|-
|0xA140
|KEPLER_INLINE_TO_MEMORY_B
|-
|0xB0B5
|MAXWELL_DMA_COPY_A (DMA)
|}

=== Fences ===

Command lists can contain fences to ensure that commands are executed on the correct order, and subsequent commands are only sent when the previously sent commands were already processed by the GPU. Fences uses the QUERY_* commands, and works like this:

* First, QUERY_ADDRESS_HIGH and QUERY_ADDRESS_LOW commands are added to the Command List, with the High/Low 32 bits part of the 64-bits GPU Virtual Address where the fence is located. This GPU Virtual Address needs to be mapped to the process Virtual Address beforehand.
* Then, QUERY_SEQUENCE is added with a sequential number. This number is basically a incrementing counter, so the first Command List can have QUERY_SEQUENCE = 1, the next one QUERY_SEQUENCE = 2, 3, 4... and so on.
* Finally, QUERY_GET is added and contains the mode and other unknown data.

The above commands are added using the [[#Submission_mode|increasing mode]], since the Ids for all those 4 registers are sequential.

==== QUERY_GET Structure ====

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|1-0
|Mode
|-
|4
|Fence
|-
|15-12
|Unit
|}

==== QUERY_GET Mode ====

{| class="wikitable"
|-
! scope="col"| Value
! scope="col"| Mode
|-
|0
|Write
|-
|1
|Sync
|-
|2
|Write ?
|-
|3
|Write ?
|}

TODO: Move this to a separate page with all GPU Commands with descriptions. Also figure out what the other values mean.

Some of the other fields are still unknown/unobserved.

Official games will set Mode to 0, Fence to 1 and Unit to 0xF. The QUERY_SEQUENCE value is then written by the GPU to the address pointed to by QUERY_ADDRESS.
On the CPU side, the game code should wait until the value at the address pointed to by QUERY_ADDRESS is >= to the last written SEQUENCE value. Official code waits for this condition to be true on a loop, and won't send any further commands before that.

== Vertex Data Submission ==

Note: This is a observation on how the game Puyo Puyo Tetris sends textured squares to the GPU.

# VERTEX_ATTRIB_FORMAT (0-15) are set (only the first 3 are really used, the rest are set float, with Size = 1 and offset at 0).
# VERTEX_ARRAY_FETCH (0) is set with the lower 12 bits set to 0x1c (Stride) and bit 12 to 1 (Enabled).
# VERTEX_ARRAY_START_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located.
# VERTEX_ARRAY_LIMIT_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located, plus the Vertex Data size in bytes minus 1.
# VERTEX_BEGIN_GL is used with the primitive type set to TRIANGLE_STRIP.
# VERTEX_BUFFER_FIRST with value 0 (indicating the index of the first primitive to render?).
# VERTEX_BUFFER_COUNT is set to 4, because the Vertex Buffer with the square has 4 vertices.
# VERTEX_END_GL is used with value 0 (currently unknown what this value means).

== Texture View ==

Texture information such as address, format and size is sent to the GPU through a structure know as Texture View (a.k.a. Texture Image Control, or TIC). Each texture that the game uses needs a separate TIC, and those TICs are written to a table, one after the other. Each [[#TIC_Structure|TIC entry]] has 0x20 bytes, and is composed of 8 32-bits words where the texture information is packed.

The index of the TIC entries that should be used by the shader is sent to the GPU with the CB_POS/CB_DATA (0) methods. Games usually follows the following steps to write the TIC entry indexes:

* CB_ADDRESS_HIGH/LOW method is used to set the GPU Virtual Address of the Const Buffer.
* CB_POS is used to set the write offset of the Const Buffer to 0x20 + n * 4, where ''n'' is the is the index of the active texture that will be used by the shader (?).
* CB_DATA (0) method is used to write the value into the Const Buffer. The value is a word where the lower 20 bits is the TIC index.

The address of a given TIC entry can be calculates as:

tic_entry_address = tic_base_address + tic_index * 0x20

Where ''tic_base_address'' is the address written to TIC_ADDRESS_HIGH/LOW (methods 0x1574 and 0x1578), ''tic_index'' is the lower 20 bits of the word written into the Const Buffer with CB_DATA (0), and 0x20 is the size of each TIC entry in bytes.

Note: More research still needs to be done on the Const Buffer and how it is used by the shader.

=== TIC Structure ===

{| class="wikitable" border="1"
|-
! Word || Bits || Description
|-
| 0 || 6-0 || [[GPU_Texture_Formats#Texture_Formats|Texture Format]]
|-
| 0 || 9-7 || [[#Channel_Data_Type|R Channel Data Type]]
|-
| 0 || 12-10 || [[#Channel_Data_Type|G Channel Data Type]]
|-
| 0 || 15-13 || [[#Channel_Data_Type|B Channel Data Type]]
|-
| 0 || 18-16 || [[#Channel_Data_Type|A Channel Data Type]]
|-
| 1 || 31-0 || Lower 32-bits of the Texture GPU Virtual Address
|-
| 2 || 15-0 || Higher 16-bits of the Texture GPU Virtual Address
|-
| 4 || 15-0 || Texture Width minus 1
|-
| 5 || 15-0 || Texture Height minus 1
|}

==== Channel Data Type ====

{| class="wikitable" border="1"
|-
! Value || Type
|-
| 1 || SNORM
|-
| 2 || UNORM
|-
| 3 || SINT
|-
| 4 || UINT
|-
| 5 || SNORM_FORCE_FP16
|-
| 6 || UNORM_FORCE_FP16
|-
| 7 || FLOAT
|}

== References ==

FIFO engine overview:
[https://envytools.readthedocs.io/en/latest/hw/fifo/intro.html]

Method values from the Fermi family GPU (a bit older than the Tegra X1, but values seems to be mostly the same):
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gf100_3d.xml]

TIC structure used on a Maxwell GPU:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gm200_texture.xml]

Values for some types used on the above XML:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/nv_3ddefs.xml]

Command word packing code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_winsys.h]

TIC entry pack/write code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_tex.c#n65]

GPU

2018-02-10T03:36:13Z

OgniK: gpu command list part 2

== Mapping Memory ==

First, to map a memory region on the GPU Address Space, caching needs to be disabled by using [[SVC#svcSetMemoryAttribute|svcSetMemoryAttribute]]. The Address passed is the Virtual Address of the region that will be mapped, the size is the region size, and State0/1 are both set to 8 to disable caching of the memory region. This is done to ensure that the GPU can actually "see" the data written there, and it doesn't get stuck on some cache.

Then, [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]] is used to create a nvmap object with the desired size. After, [[NV_services#NVMAP_IOC_ALLOC|NVMAP_IOC_ALLOC]] is used to allocate the memory on the GPU Address Space, and map data on the process Address Space into the GPU Address Space, by passing the Virtual Address as the input addr parameter, and also the Handle returned from [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]]. Lastly, the actual mapping is done by using [[NV_services#NVGPU_AS_IOCTL_MAP_BUFFER_EX|NVGPU_AS_IOCTL_MAP_BUFFER_EX]], and the GPU Virtual Address is returned on the offset parameter. It's also possible to manually set the offset where the mapping should be made on the GPU Address Space, by passing the address on the "offset" parameter, and setting the bit 0 of the flags parameter to 1. However, for this to work, the desired GPU Virtual Address needs to be previously reserved using [[NV_services#NVGPU_AS_IOCTL_ALLOC_SPACE|NVGPU_AS_IOCTL_ALLOC_SPACE]].

The above process is used to map all data that will be used by the GPU, like Textures, Command Lists (a.k.a. Push Buffers), Vertex/Index buffers and Shaders. They usually have their own mapping, but Command Lists can share the same mapping.

== FIFO Commands ==

The GPU implements a variation of Tegra's push buffer format for it's PFIFO engine. PFIFO is a special engine responsible for receiving user command lists and routing them to the appropriate engines (2D, 3D, DMA).

Commands are submitted to the GPU's PFIFO engine through [[NV_services#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]].

This ioctl takes an array of gpfifo entries where each entry points to a FIFO command list. This list is composed of alternating 32-bit words containing FIFO commands and their respective arguments.

=== Command Structure ===

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|12-0
|Method
|-
|15-13
|Subchannel
|-
|28-16
|Argument count (in 32-bits Words) or inline data (see below)
|-
|31-29
|[[#Submission_mode|Submission mode]]
|}

Note: Methods are treated as 4-byte addressable locations, and hence their numbers are written down multiplied by 4.

Note: The command's arguments, when present, follow the command word immediately.

==== Submission mode ====

{| class="wikitable"
|-
! scope="col"| Mode
! scope="col"| Description
! scope="col"| Offical name
|-
|0
|Increasing mode (old)
|
|-
|1
|Increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count''', while automatically incrementing the '''method''' value. This means that each argument will be written to a different method location.
|INCR
|-
|2
|Non-increasing mode (old)
|
|-
|3
|Non-increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count'''. However, all arguments will be written to the same method location.
|NONINCR
|-
|4
|Inline mode - Tells PFIFO to read '''inline data''' from bits 28-16 of the command word, thus eliminating the need to pass additional words for the arguments.
|IMM
|-
|5
|Increase-once mode - Tells PFIFO to read as much arguments as specified by '''argument count''' and automatically increments the '''method''' value once only.
|
|}

=== Command List ===

All methods with values < 0x100 are special and executed by the PFIFO's DMA puller. The others are forwarded to the engine object currently bound to a given subchannel.

{| class="wikitable" border="1"
|-
! Command || Method || Subchannel || Arg Count || Mode || Name
|-
| 0x2001?000 || 0x0000 || Variable || 1 || 1 || [[#BindObject|BindObject]]
|-
| 0xA0020E00 || 0xE00 || 0 || 2 || 5 || BeginTransformFeedback
|-
| 0xA0030E30 || 0xE30 || 0 || 3 || 5 || DrawArrays
|-
| 0xA0050E36 || 0xE36 || 0 || 5 || 5 || DrawElements
|-
| 0xA0020E2E || 0xE2E || 0 || 2 || 5 || PopDebugGroupId
|-
| 0xA0040E2C || 0xE2C || 0 || 4 || 5 || PushDebugGroup
|-
| 0x2001054C || 0x54C || 0 || 1 || 1 || ResetCounter
|-
| 0x8001047F || 0x47F || 0 || 1 || 4 || ResolveDepthBuffer
|-
| 0x200104C4 || 0x4C4 || 0 || 1 || 1 || SetAlphaRef
|-
| 0x200404C7 || 0x4C7 || 0 || 4 || 1 || SetBlendColor
|-
| 0x2001064F || 0x64F || 0 || 1 || 1 || SetDepthClamp
|-
| 0x200200CD || 0xCD || 0 || 2 || 1 || SetInnerTessellationLevels
|-
| 0x200204EC || 0x4EC || 0 || 2 || 1 || SetLineWidth
|-
| 0x200400C9 || 0xC9 || 0 || 4 || 1 || SetOuterTessellationLevels
|-
| 0x8???0373 || 0x373 || 0 || Variable || 4 || SetPatchSize
|-
| 0x20010546 || 0x546 || 0 || 1 || 1 || SetPointSize
|-
| 0x20030554 || 0x554 || 0 || 3 || 1 || SetRenderEnableConditional
|-
| 0x200403EF || 0x3EF || 0 || 4 || 1 || SetSampleMask
|-
| 0x200103D9 || 0x3D9 || 0 || 1 || 1 || SetTiledCacheTileSize
|-
| 0x20020047 || 0x47 || 0 || 2 || 1 || SetGraphMacroEntry
|-
| 0xA???0045 || 0x45 || 0 || Variable || 5 || SetGraphMacroCode
|-
| 0x800104B9 || 0x4B9 || 0 || 1 || 4 || ?
|-
| 0x80000374 || 0x374 || 0 || 0 || 4 || ?
|-
| 0xA0040E12 || 0xE12 || 0 || 4 || 5 || ?
|-
| 0x20010E10 || 0xE10 || 0 || 1 || 1 || ?
|-
| 0x120020671 || 0x671 || 0 || 2 || 9 || ?
|-
| 0x800004BB || 0x4BB || 0 || 0 || 4 || ?
|-
| 0x2004040C || 0x40C || 0 || 4 || 1 || ?
|-
| 0x800103F6 || 0x3F6 || 0 || 1 || 4 || ?
|-
| 0x800?04BA || 0x4BA || 0 || Variable || 4 || ?
|-
| 0x800?04B3 || 0x4B3 || 0 || Variable || 4 || ?
|-
| 0x800?04C3 || 0x4C3 || 0 || Variable || 4 || ?
|-
| 0x800004E0 || 0x4E0 || 0 || 0 || 4 || ?
|-
| 0x20010E1A || 0xE1A || 0 || 1 || 1 || ?
|-
| 0x8000068B || 0x68B || 0 || 0 || 4 || ?
|-
| 0x200308E3 || 0x8E3 || 0 || 3 || 1 || CB_POS(Const buffer position)
|-
| 0x800?0E0E || 0xE0E || 0 || Variable || 4 || ?
|-
| 0x20040478 || 0x478 || 0 || 4 || 1 || ?
|-
| 0x800003ED || 0x3ED || 0 || 0 || 4 || ?
|-
| 0x800203EE || 0x3EE || 0 || 2 || 4 || ?
|-
| 0x800003F5 || 0x3F5 || 0 || 0 || 4 || ?
|-
| 0x80000370 || 0x370 || 0 || 0 || 4 || ?
|-
| 0x80000371 || 0x371 || 0 || 0 || 4 || ?
|-
| 0x80000372 || 0x372 || 0 || 0 || 4 || ?
|-
| 0x80010646 || 0x646 || 0 || 1 || 4 || ?
|-
| 0x800?036B || 0x36B || 0 || Variable || 4 || ?
|-
| 0x800?036C || 0x36C || 0 || Variable || 4 || ?
|-
| 0x800?0648 || 0x648 || 0 || Variable || 4 || ?
|-
| 0x80000D1E || 0xD1E || 0 || 0 || 4 || ?
|-
| 0x80300830 || 0x830 || 0 || 48 || 4 || ?
|-
| 0x80400840 || 0x840 || 0 || 64 || 4 || ?
|-
| 0x80500850 || 0x850 || 0 || 80 || 4 || ?
|-
| 0x8000047C || 0x47C || 0 || 0 || 4 || ?
|-
| 0x200308E4 || 0x8E4 || 0 || 3 || 1 || ?
|-
| 0x200308E0 || 0x8E0 || 0 || 3 || 1 || ?
|-
| 0x80??0924 || 0x924 || 0 || Variable || 4 || ?
|-
| 0x80??0904 || 0x904 || 0 || Variable || 4 || ?
|-
| 0x80??091C || 0x91C || 0 || Variable || 4 || ?
|-
| 0x80??090C || 0x90C || 0 || Variable || 4 || ?
|-
| 0x80??0914 || 0x914 || 0 || Variable || 4 || ?
|-
| 0x20100458 || 0x458 || 0 || 16 || 1 || ?
|-
| 0x200207?? || 0x7?? Variable || 0 || 2 || 1 || ?
|-
| 0x20010703 || 0x703 || 0 || 1 || 1 || ?
|-
| 0x800?0620 || 0x620 || 0 || Variable || 4 || ?
|-
| 0x80000040 || 0x40 || 0 || 0 || 4 || ?
|-
| 0x200181C0 || 0x1C0 || 4 || 1 || 1 || ?
|-
| 0x200181C2 || 0x1C2 || 4 || 1 || 1 || ?
|-
| 0x20048100 || 0x100 || 4 || 4 || 1 || ?
|-
| 0x200281C4 || 0x1C4 || 4 || 2 || 1 || ?
|-
| 0x20018106 || 0x106 || 4 || 1 || 1 || ?
|-
| 0x200180C0 || 0xC0 || 4 || 1 || 1 || ?
|-
| 0x20040360 || 0x360 || 0 || 4 || 1 || ?
|-
| 0x20010E02 || 0xE02 || 0 || 1 || 1 || ?
|-
| 0x800?0049 || 0x49 || 0 || Variable || 4 || ?
|-
| 0x2001036F || 0x36F || 0 || 1 || 1 || ?
|-
| 0x20010376 || 0x376 || 0 || 1 || 1 || ?
|-
| 0x80000E24 || 0xE24 || 0 || 0 || 4 || ?
|-
| 0x20010364 || 0x364 || 0 || 1 || 1 || ?
|-
| 0x800?04E7 || 0x4E7 || 0 || Variable || 4 || ?
|-
| 0x800?0368 || 0x368 || 0 || Variable || 4 || ?
|-
| 0x80020E04 || 0xE04 || 0 || 2 || 4 || ?
|-
| 0xA0040E1C || 0xE1C || 0 || 4 || 5 || ?
|-
| 0x200203FD || 0x3FD || 0 || 2 || 1 || ?
|-
| 0x20010674 || 0x674 || 0 || 1 || 1 || ?
|-
| 0x200181CC || 0x1CC || 4 || 1 || 1 || ?
|-
| 0x200181CA || 0x1CA || 4 || 1 || 1 || ?
|-
| 0x200181CD || 0x1CD || 4 || 1 || 1 || ?
|-
| 0x200181CB || 0x1CB || 4 || 1 || 1 || ?
|-
| 0x200181CF || 0x1CF || 4 || 1 || 1 || ?
|-
| 0x200181C3 || 0x1C3 || 4 || 1 || 1 || ?
|-
| 0x20018104 || 0x104 || 4 || 1 || 1 || ?
|-
| 0x200181C5 || 0x1C5 || 4 || 1 || 1 || ?
|-
| 0x200181C6 || 0x1C6 || 4 || 1 || 1 || ?
|-
| 0x200181C7 || 0x1C7 || 4 || 1 || 1 || ?
|-
| 0x200181C8 || 0x1C8 || 4 || 1 || 1 || ?
|-
| 0x20028102 || 0x102 || 4 || 2 || 1 || ?
|-
| 0x20018105 || 0x105 || 4 || 1 || 1 || ?
|-
| 0x20016223 || 0x223 || 3 || 1 || 1 || ?
|-
| 0x20016085 || 0x85 || 3 || 1 || 1 || ?
|-
| 0x20026086 || 0x86 || 3 || 2 || 1 || ?
|-
| 0x20026088 || 0x88 || 3 || 2 || 1 || ?
|-
| 0x20056080 || 0x80 || 3 || Variable || 1 || ?
|-
| 0x2004608C || 0x8C || 3 || Variable || 1 || ?
|-
| 0x20046230 || 0x230 || 3 || 4 || 1 || ?
|-
| 0x20016091 || 0x91 || 3 || 1 || 1 || ?
|-
| 0x20026092 || 0x92 || 3 || 2 || 1 || ?
|-
| 0x20026094 || 0x94 || 3 || 2 || 1 || ?
|-
| 0x800160B5 || 0xB5 || 3 || 1 || 4 || ?
|-
| 0x20046234 || 0x234 || 3 || 4 || 1 || ?
|-
| 0x2004622C || 0x22C || 3 || 4 || 1 || ?
|-
| 0x80?003DE || 0x3DE || 0 || Variable || 4 || ?
|-
| 0xA0050E32 || 0xE32 || 0 || 5 || 5 || ?
|-
| 0x81900E1E || 0xE1E || 0 || 400 || 4 || ?
|-
| 0xA0050E42 || 0xE42 || 0 || 5 || 5 || ?
|-
| 0xA0050E34 || 0xE34 || 0 || 5 || 5 || ?
|-
| 0x80000446 || 0x446 || 0 || 0 || 4 || ?
|-
| 0x800?050D || 0x50D || 0 || Variable || 4 || ?
|-
| 0x800?05F6 || 0x5F6 || 0 || Variable || 4 || ?
|-
| 0xA0060E38 || 0xE38 || 0 || 6 || 5 || ?
|-
| 0xA0060E3A || 0xE3A || 0 || 6 || 5 || ?
|-
| 0xA0060E44 || 0xE44 || 0 || 6 || 5 || ?
|-
| 0x200205F2 || 0x5F2 || 0 || 2 || 1 || ?
|-
| 0x80050E0C || 0xE0C || 0 || 5 || 4 || ?
|-
| 0x8000047E || 0x47E || 0 || 0 || 4 || ?
|-
| 0x200C0420 || 0x420 || 0 || 12 || 1 || ?
|-
| 0x200406C0 || 0x6C0 || 0 || 4 || 1 || ?
|-
| 0x800001D1 || 0x1D1 || 0 || 0 || 4 || ?
|-
| 0x800003E0 || 0x3E0 || 0 || 0 || 4 || ?
|-
| 0x80000451 || 0x451 || 0 || 0 || 4 || ?
|-
| 0x200401FA || 0x1FA || 0 || 4 || 1 || ?
|-
| 0x80000540 || 0x540 || 0 || 0 || 4 || ?
|-
| 0x80000519 || 0x519 || 0 || 0 || 4 || ?
|-
| 0xA0030E0A || 0xE0A || 0 || 3 || 5 || ?
|}

Note: These still need to be heavily verified and ''could'' be wrong.

=== BindObject ===

In order to bind an engine object to a specific subchannel, method 0 (BindObject) must be used first. The target subchannel is specified in bits 15-13 of the command word.

After the engine object is bound to the desired subchannel, setting it's value in bits 15-13 of any subsequent command word will make PFIFO forward the command to the target engine.

This method only takes one argument, an [[#Engine_IDs|engine ID]].

==== Engine IDs ====

{| class="wikitable"
|-
! scope="col"| ID
! scope="col"| Engine
|-
|0x902D
|FERMI_TWOD_A (2D)
|-
|0xB197
|MAXWELL_B (3D)
|-
|0xB1C0
|MAXWELL_COMPUTE_B
|-
|0xA140
|KEPLER_INLINE_TO_MEMORY_B
|-
|0xB0B5
|MAXWELL_DMA_COPY_A (DMA)
|}

=== Fences ===

Command lists can contain fences to ensure that commands are executed on the correct order, and subsequent commands are only sent when the previously sent commands were already processed by the GPU. Fences uses the QUERY_* commands, and works like this:

* First, QUERY_ADDRESS_HIGH and QUERY_ADDRESS_LOW commands are added to the Command List, with the High/Low 32 bits part of the 64-bits GPU Virtual Address where the fence is located. This GPU Virtual Address needs to be mapped to the process Virtual Address beforehand.
* Then, QUERY_SEQUENCE is added with a sequential number. This number is basically a incrementing counter, so the first Command List can have QUERY_SEQUENCE = 1, the next one QUERY_SEQUENCE = 2, 3, 4... and so on.
* Finally, QUERY_GET is added and contains the mode and other unknown data.

The above commands are added using the [[#Submission_mode|increasing mode]], since the Ids for all those 4 registers are sequential.

==== QUERY_GET Structure ====

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|1-0
|Mode
|-
|4
|Fence
|-
|15-12
|Unit
|}

==== QUERY_GET Mode ====

{| class="wikitable"
|-
! scope="col"| Value
! scope="col"| Mode
|-
|0
|Write
|-
|1
|Sync
|-
|2
|Write ?
|-
|3
|Write ?
|}

TODO: Move this to a separate page with all GPU Commands with descriptions. Also figure out what the other values mean.

Some of the other fields are still unknown/unobserved.

Official games will set Mode to 0, Fence to 1 and Unit to 0xF. The QUERY_SEQUENCE value is then written by the GPU to the address pointed to by QUERY_ADDRESS.
On the CPU side, the game code should wait until the value at the address pointed to by QUERY_ADDRESS is >= to the last written SEQUENCE value. Official code waits for this condition to be true on a loop, and won't send any further commands before that.

== Vertex Data Submission ==

Note: This is a observation on how the game Puyo Puyo Tetris sends textured squares to the GPU.

# VERTEX_ATTRIB_FORMAT (0-15) are set (only the first 3 are really used, the rest are set float, with Size = 1 and offset at 0).
# VERTEX_ARRAY_FETCH (0) is set with the lower 12 bits set to 0x1c (Stride) and bit 12 to 1 (Enabled).
# VERTEX_ARRAY_START_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located.
# VERTEX_ARRAY_LIMIT_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located, plus the Vertex Data size in bytes minus 1.
# VERTEX_BEGIN_GL is used with the primitive type set to TRIANGLE_STRIP.
# VERTEX_BUFFER_FIRST with value 0 (indicating the index of the first primitive to render?).
# VERTEX_BUFFER_COUNT is set to 4, because the Vertex Buffer with the square has 4 vertices.
# VERTEX_END_GL is used with value 0 (currently unknown what this value means).

== Texture View ==

Texture information such as address, format and size is sent to the GPU through a structure know as Texture View (a.k.a. Texture Image Control, or TIC). Each texture that the game uses needs a separate TIC, and those TICs are written to a table, one after the other. Each [[#TIC_Structure|TIC entry]] has 0x20 bytes, and is composed of 8 32-bits words where the texture information is packed.

The index of the TIC entries that should be used by the shader is sent to the GPU with the CB_POS/CB_DATA (0) methods. Games usually follows the following steps to write the TIC entry indexes:

* CB_ADDRESS_HIGH/LOW method is used to set the GPU Virtual Address of the Const Buffer.
* CB_POS is used to set the write offset of the Const Buffer to 0x20 + n * 4, where ''n'' is the is the index of the active texture that will be used by the shader (?).
* CB_DATA (0) method is used to write the value into the Const Buffer. The value is a word where the lower 20 bits is the TIC index.

The address of a given TIC entry can be calculates as:

tic_entry_address = tic_base_address + tic_index * 0x20

Where ''tic_base_address'' is the address written to TIC_ADDRESS_HIGH/LOW (methods 0x1574 and 0x1578), ''tic_index'' is the lower 20 bits of the word written into the Const Buffer with CB_DATA (0), and 0x20 is the size of each TIC entry in bytes.

Note: More research still needs to be done on the Const Buffer and how it is used by the shader.

=== TIC Structure ===

{| class="wikitable" border="1"
|-
! Word || Bits || Description
|-
| 0 || 6-0 || [[GPU_Texture_Formats#Texture_Formats|Texture Format]]
|-
| 0 || 9-7 || [[#Channel_Data_Type|R Channel Data Type]]
|-
| 0 || 12-10 || [[#Channel_Data_Type|G Channel Data Type]]
|-
| 0 || 15-13 || [[#Channel_Data_Type|B Channel Data Type]]
|-
| 0 || 18-16 || [[#Channel_Data_Type|A Channel Data Type]]
|-
| 1 || 31-0 || Lower 32-bits of the Texture GPU Virtual Address
|-
| 2 || 15-0 || Higher 16-bits of the Texture GPU Virtual Address
|-
| 4 || 15-0 || Texture Width minus 1
|-
| 5 || 15-0 || Texture Height minus 1
|}

==== Channel Data Type ====

{| class="wikitable" border="1"
|-
! Value || Type
|-
| 1 || SNORM
|-
| 2 || UNORM
|-
| 3 || SINT
|-
| 4 || UINT
|-
| 5 || SNORM_FORCE_FP16
|-
| 6 || UNORM_FORCE_FP16
|-
| 7 || FLOAT
|}

== References ==

FIFO engine overview:
[https://envytools.readthedocs.io/en/latest/hw/fifo/intro.html]

Method values from the Fermi family GPU (a bit older than the Tegra X1, but values seems to be mostly the same):
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gf100_3d.xml]

TIC structure used on a Maxwell GPU:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gm200_texture.xml]

Values for some types used on the above XML:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/nv_3ddefs.xml]

Command word packing code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_winsys.h]

TIC entry pack/write code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_tex.c#n65]

GPU

2018-02-10T01:10:25Z

OgniK: gpu command list part 1

== Mapping Memory ==

First, to map a memory region on the GPU Address Space, caching needs to be disabled by using [[SVC#svcSetMemoryAttribute|svcSetMemoryAttribute]]. The Address passed is the Virtual Address of the region that will be mapped, the size is the region size, and State0/1 are both set to 8 to disable caching of the memory region. This is done to ensure that the GPU can actually "see" the data written there, and it doesn't get stuck on some cache.

Then, [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]] is used to create a nvmap object with the desired size. After, [[NV_services#NVMAP_IOC_ALLOC|NVMAP_IOC_ALLOC]] is used to allocate the memory on the GPU Address Space, and map data on the process Address Space into the GPU Address Space, by passing the Virtual Address as the input addr parameter, and also the Handle returned from [[NV_services#NVMAP_IOC_CREATE|NVMAP_IOC_CREATE]]. Lastly, the actual mapping is done by using [[NV_services#NVGPU_AS_IOCTL_MAP_BUFFER_EX|NVGPU_AS_IOCTL_MAP_BUFFER_EX]], and the GPU Virtual Address is returned on the offset parameter. It's also possible to manually set the offset where the mapping should be made on the GPU Address Space, by passing the address on the "offset" parameter, and setting the bit 0 of the flags parameter to 1. However, for this to work, the desired GPU Virtual Address needs to be previously reserved using [[NV_services#NVGPU_AS_IOCTL_ALLOC_SPACE|NVGPU_AS_IOCTL_ALLOC_SPACE]].

The above process is used to map all data that will be used by the GPU, like Textures, Command Lists (a.k.a. Push Buffers), Vertex/Index buffers and Shaders. They usually have their own mapping, but Command Lists can share the same mapping.

== FIFO Commands ==

The GPU implements a variation of Tegra's push buffer format for it's PFIFO engine. PFIFO is a special engine responsible for receiving user command lists and routing them to the appropriate engines (2D, 3D, DMA).

Commands are submitted to the GPU's PFIFO engine through [[NV_services#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]].

This ioctl takes an array of gpfifo entries where each entry points to a FIFO command list. This list is composed of alternating 32-bit words containing FIFO commands and their respective arguments.

=== Command Structure ===

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|12-0
|Method
|-
|15-13
|Subchannel
|-
|28-16
|Argument count (in 32-bits Words) or inline data (see below)
|-
|31-29
|[[#Submission_mode|Submission mode]]
|}

Note: Methods are treated as 4-byte addressable locations, and hence their numbers are written down multiplied by 4.

Note: The command's arguments, when present, follow the command word immediately.

==== Submission mode ====

{| class="wikitable"
|-
! scope="col"| Mode
! scope="col"| Description
! scope="col"| Offical name
|-
|0
|Increasing mode (old)
|
|-
|1
|Increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count''', while automatically incrementing the '''method''' value. This means that each argument will be written to a different method location.
|INCR
|-
|2
|Non-increasing mode (old)
|
|-
|3
|Non-increasing mode - Tells PFIFO to read as much arguments as specified by '''argument count'''. However, all arguments will be written to the same method location.
|NONINCR
|-
|4
|Inline mode - Tells PFIFO to read '''inline data''' from bits 28-16 of the command word, thus eliminating the need to pass additional words for the arguments.
|IMM
|-
|5
|Increase-once mode - Tells PFIFO to read as much arguments as specified by '''argument count''' and automatically increments the '''method''' value once only.
|
|}

=== Command List ===

All methods with values < 0x100 are special and executed by the PFIFO's DMA puller. The others are forwarded to the engine object currently bound to a given subchannel.

{| class="wikitable" border="1"
|-
! Command || Method || Subchannel || Arg Count || Mode || Name
|-
| 0x2001?000 || 0x0000 || Variable || 1 || 1 || [[#BindObject|BindObject]]
|-
| 0xA0020E00 || 0x3800 || 0 || 2 || 5 || BeginTransformFeedback
|-
| 0xA0030E30 || 0x38C0 || 0 || 3 || 5 || DrawArrays
|-
| 0xA0050E36 || 0x38D8 || 0 || 5 || 5 || DrawElements
|-
| 0xA0020E2E || 0x38B8 || 0 || 2 || 5 || PopDebugGroupId
|-
| 0xA0040E2C || 0x38B0 || 0 || 4 || 5 || PushDebugGroup
|-
| 0x2001054C || 0x1530 || 0 || 1 || 1 || ResetCounter
|-
| 0x8001047F || 0x11FC || 0 || 1 || 4 || ResolveDepthBuffer
|-
| 0x200104C4 || 0x1310 || 0 || 1 || 1 || SetAlphaRef
|-
| 0x200404C7 || 0x131C || 0 || 4 || 1 || SetBlendColor
|-
| 0x2001064F || 0x1BD0 || 0 || 1 || 1 || SetDepthClamp
|-
| 0x200200CD || 0x0334 || 0 || 2 || 1 || SetInnerTessellationLevels
|-
| 0x200204EC || 0x13B0 || 0 || 2 || 1 || SetLineWidth
|-
| 0x200400C9 || 0x0324 || 0 || 4 || 1 || SetOuterTessellationLevels
|-
| 0x8???0373 || 0x0DCC || 0 || Variable || 4 || SetPatchSize
|-
| 0x20010546 || 0x1518 || 0 || 1 || 1 || SetPointSize
|-
| 0x20030554 || 0x1550 || 0 || 3 || 1 || SetRenderEnableConditional
|-
| 0x200403EF || 0x0FBC || 0 || 4 || 1 || SetSampleMask
|-
| 0x200103D9 || 0x0F64 || 0 || 1 || 1 || SetTiledCacheTileSize
|-
| 0x20020047 || 0x011C || 0 || 2 || 1 || SetGraphMacroEntry
|-
| 0xA???0045 || 0x0114 || 0 || Variable || 5 || SetGraphMacroCode
|-
| 0x800104B9 || 0x4B9 || 0 || 1 || 4 || ?
|-
| 0x80000374 || 0x374 || 0 || 0 || 4 || ?
|-
| 0xA0040E12 || 0xE12 || 0 || 4 || 5 || ?
|-
| 0x20010E10 || 0xE10 || 0 || 1 || 1 || ?
|-
| 0x120020671 || 0x671 || 0 || 2 || 9 || ?
|-
| 0x800004BB || 0x4BB || 0 || 0 || 4 || ?
|-
| 0x2004040C || 0x40C || 0 || 4 || 1 || ?
|-
| 0x800103F6 || 0x3F6 || 0 || 1 || 4 || ?
|-
| 0x800?04BA || 0x4BA || 0 || Variable || 4 || ?
|-
| 0x800?04B3 || 0x4B3 || 0 || Variable || 4 || ?
|-
| 0x800?04C3 || 0x4C3 || 0 || Variable || 4 || ?
|-
| 0x800004E0 || 0x4E0 || 0 || 0 || 4 || ?
|-
| 0x20010E1A || 0xE1A || 0 || 1 || 1 || ?
|-
| 0x8000068B || 0x68B || 0 || 0 || 4 || ?
|-
| 0x200308E3 || 0x8E3 || 0 || 3 || 1 || ?
|-
| 0x800?0E0E || 0xE0E || 0 || Variable || 4 || ?
|-
| 0x20040478 || 0x478 || 0 || 4 || 1 || ?
|-
| 0x800003ED || 0x3ED || 0 || 0 || 4 || ?
|-
| 0x800203EE || 0x3EE || 0 || 2 || 4 || ?
|-
| 0x800003F5 || 0x3F5 || 0 || 0 || 4 || ?
|-
| 0x80000370 || 0x370 || 0 || 0 || 4 || ?
|-
| 0x80000371 || 0x371 || 0 || 0 || 4 || ?
|-
| 0x80000372 || 0x372 || 0 || 0 || 4 || ?
|-
| 0x80010646 || 0x646 || 0 || 1 || 4 || ?
|-
| 0x800?036B || 0x36B || 0 || Variable || 4 || ?
|-
| 0x800?036C || 0x36C || 0 || Variable || 4 || ?
|-
| 0x800?0648 || 0x648 || 0 || Variable || 4 || ?
|-
| 0x80000D1E || 0xD1E || 0 || 0 || 4 || ?
|-
| 0x80300830 || 0x830 || 0 || 48 || 4 || ?
|-
| 0x80400840 || 0x840 || 0 || 64 || 4 || ?
|-
| 0x80500850 || 0x850 || 0 || 80 || 4 || ?
|-
| 0x8000047C || 0x47C || 0 || 0 || 4 || ?
|-
| 0x200308E4 || 0x8E4 || 0 || 3 || 1 || ?
|-
| 0x200308E0 || 0x8E0 || 0 || 3 || 1 || ?
|-
| 0x80??0924 || 0x924 || 0 || Variable || 4 || ?
|-
| 0x80??0904 || 0x904 || 0 || Variable || 4 || ?
|-
| 0x80??091C || 0x91C || 0 || Variable || 4 || ?
|-
| 0x80??090C || 0x90C || 0 || Variable || 4 || ?
|-
| 0x80??0914 || 0x914 || 0 || Variable || 4 || ?
|}

Note: These still need to be heavily verified and ''could'' be wrong.

=== BindObject ===

In order to bind an engine object to a specific subchannel, method 0 (BindObject) must be used first. The target subchannel is specified in bits 15-13 of the command word.

After the engine object is bound to the desired subchannel, setting it's value in bits 15-13 of any subsequent command word will make PFIFO forward the command to the target engine.

This method only takes one argument, an [[#Engine_IDs|engine ID]].

==== Engine IDs ====

{| class="wikitable"
|-
! scope="col"| ID
! scope="col"| Engine
|-
|0x902D
|FERMI_TWOD_A (2D)
|-
|0xB197
|MAXWELL_B (3D)
|-
|0xB1C0
|MAXWELL_COMPUTE_B
|-
|0xA140
|KEPLER_INLINE_TO_MEMORY_B
|-
|0xB0B5
|MAXWELL_DMA_COPY_A (DMA)
|}

=== Fences ===

Command lists can contain fences to ensure that commands are executed on the correct order, and subsequent commands are only sent when the previously sent commands were already processed by the GPU. Fences uses the QUERY_* commands, and works like this:

* First, QUERY_ADDRESS_HIGH and QUERY_ADDRESS_LOW commands are added to the Command List, with the High/Low 32 bits part of the 64-bits GPU Virtual Address where the fence is located. This GPU Virtual Address needs to be mapped to the process Virtual Address beforehand.
* Then, QUERY_SEQUENCE is added with a sequential number. This number is basically a incrementing counter, so the first Command List can have QUERY_SEQUENCE = 1, the next one QUERY_SEQUENCE = 2, 3, 4... and so on.
* Finally, QUERY_GET is added and contains the mode and other unknown data.

The above commands are added using the [[#Submission_mode|increasing mode]], since the Ids for all those 4 registers are sequential.

==== QUERY_GET Structure ====

{| class="wikitable"
|-
! scope="col"| Bits
! scope="col"| Description
|-
|1-0
|Mode
|-
|4
|Fence
|-
|15-12
|Unit
|}

==== QUERY_GET Mode ====

{| class="wikitable"
|-
! scope="col"| Value
! scope="col"| Mode
|-
|0
|Write
|-
|1
|Sync
|-
|2
|Write ?
|-
|3
|Write ?
|}

TODO: Move this to a separate page with all GPU Commands with descriptions. Also figure out what the other values mean.

Some of the other fields are still unknown/unobserved.

Official games will set Mode to 0, Fence to 1 and Unit to 0xF. The QUERY_SEQUENCE value is then written by the GPU to the address pointed to by QUERY_ADDRESS.
On the CPU side, the game code should wait until the value at the address pointed to by QUERY_ADDRESS is >= to the last written SEQUENCE value. Official code waits for this condition to be true on a loop, and won't send any further commands before that.

== Vertex Data Submission ==

Note: This is a observation on how the game Puyo Puyo Tetris sends textured squares to the GPU.

# VERTEX_ATTRIB_FORMAT (0-15) are set (only the first 3 are really used, the rest are set float, with Size = 1 and offset at 0).
# VERTEX_ARRAY_FETCH (0) is set with the lower 12 bits set to 0x1c (Stride) and bit 12 to 1 (Enabled).
# VERTEX_ARRAY_START_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located.
# VERTEX_ARRAY_LIMIT_HIGH/LOW (0) are set to the GPU Virtual Address where the Vertex Data is located, plus the Vertex Data size in bytes minus 1.
# VERTEX_BEGIN_GL is used with the primitive type set to TRIANGLE_STRIP.
# VERTEX_BUFFER_FIRST with value 0 (indicating the index of the first primitive to render?).
# VERTEX_BUFFER_COUNT is set to 4, because the Vertex Buffer with the square has 4 vertices.
# VERTEX_END_GL is used with value 0 (currently unknown what this value means).

== Texture View ==

Texture information such as address, format and size is sent to the GPU through a structure know as Texture View (a.k.a. Texture Image Control, or TIC). Each texture that the game uses needs a separate TIC, and those TICs are written to a table, one after the other. Each [[#TIC_Structure|TIC entry]] has 0x20 bytes, and is composed of 8 32-bits words where the texture information is packed.

The index of the TIC entries that should be used by the shader is sent to the GPU with the CB_POS/CB_DATA (0) methods. Games usually follows the following steps to write the TIC entry indexes:

* CB_ADDRESS_HIGH/LOW method is used to set the GPU Virtual Address of the Const Buffer.
* CB_POS is used to set the write offset of the Const Buffer to 0x20 + n * 4, where ''n'' is the is the index of the active texture that will be used by the shader (?).
* CB_DATA (0) method is used to write the value into the Const Buffer. The value is a word where the lower 20 bits is the TIC index.

The address of a given TIC entry can be calculates as:

tic_entry_address = tic_base_address + tic_index * 0x20

Where ''tic_base_address'' is the address written to TIC_ADDRESS_HIGH/LOW (methods 0x1574 and 0x1578), ''tic_index'' is the lower 20 bits of the word written into the Const Buffer with CB_DATA (0), and 0x20 is the size of each TIC entry in bytes.

Note: More research still needs to be done on the Const Buffer and how it is used by the shader.

=== TIC Structure ===

{| class="wikitable" border="1"
|-
! Word || Bits || Description
|-
| 0 || 6-0 || [[GPU_Texture_Formats#Texture_Formats|Texture Format]]
|-
| 0 || 9-7 || [[#Channel_Data_Type|R Channel Data Type]]
|-
| 0 || 12-10 || [[#Channel_Data_Type|G Channel Data Type]]
|-
| 0 || 15-13 || [[#Channel_Data_Type|B Channel Data Type]]
|-
| 0 || 18-16 || [[#Channel_Data_Type|A Channel Data Type]]
|-
| 1 || 31-0 || Lower 32-bits of the Texture GPU Virtual Address
|-
| 2 || 15-0 || Higher 16-bits of the Texture GPU Virtual Address
|-
| 4 || 15-0 || Texture Width minus 1
|-
| 5 || 15-0 || Texture Height minus 1
|}

==== Channel Data Type ====

{| class="wikitable" border="1"
|-
! Value || Type
|-
| 1 || SNORM
|-
| 2 || UNORM
|-
| 3 || SINT
|-
| 4 || UINT
|-
| 5 || SNORM_FORCE_FP16
|-
| 6 || UNORM_FORCE_FP16
|-
| 7 || FLOAT
|}

== References ==

FIFO engine overview:
[https://envytools.readthedocs.io/en/latest/hw/fifo/intro.html]

Method values from the Fermi family GPU (a bit older than the Tegra X1, but values seems to be mostly the same):
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gf100_3d.xml]

TIC structure used on a Maxwell GPU:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/gm200_texture.xml]

Values for some types used on the above XML:
[https://github.com/envytools/envytools/blob/master/rnndb/graph/nv_3ddefs.xml]

Command word packing code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_winsys.h]

TIC entry pack/write code used on Mesa3d:
[https://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nvc0/nvc0_tex.c#n65]

GPU

2018-02-02T10:05:29Z

OgniK: Likely command list for gpu stuff(unfinished)

SVC

2018-01-25T07:10:40Z

OgniK: svcBreak BreakReason

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano || W0=result
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || svcCancelSynchronization || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || svcGetSystemTick || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=event_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W0=thread_handle || W0=result, X1=out
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || ?
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory|| X0=addr, X1=size || W0=result
|- style="border-top: double"
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || W0=thread_handle, W1=[[#ThreadContext]]* || W0=result
|-
| 0x34 || [4.0.0+] || X0=ptr, W1=type, X2=? X3=timeout ||
|-
| 0x35 || [4.0.0+] || X0=ptr, W1=type, X2=? W3=? ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=client_handle ?, W2=server_handle ?
|- style="border-top: double"
| 0x4B || [4.0.0+] [[#svcCreateJitMemory]] || X1=addr, X2=size || W0=result, W1=jit_handle
|-
| 0x4C || [4.0.0+] [[#svcMapJitMemory]] || W0=jit_handle, W1=[[#MapJitOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || svcCreateInterruptEvent || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=DebugEventInfo*, W1=debug_handle || W0=result
|-
| 0x64 || svcContinueDebugEvent || W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id || W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, W1=[[#ThreadContextFlags]], X2=ThreadContext* || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || svcSetHardwareBreakPoint || W0=HardwareBreakpointId, X1=watchpoint_flags, X2=watchpoint_value/debug_handle? ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x70 || svcCreatePort || W2=max_sessions, W3=unk_bool, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=srcaddr, W1=process_handle, X2=dstaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X2=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x2000000.

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

[2.0.0+] Size must be less than 0x18000000.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

If dstaddr >= LowerTreshold, the dst-range is enforced to be within the process' "MapRegion". Code can get the range of this region from [[#svcGetInfo]] id0=2,3.

In this case, the mapped memory will have state 0x5C3C0B.

As long as (dstaddr+size) < LowerThreshold, then you can map anywhere but the mapped memory will have state 0x482907 instead.

LowerTreshold is 0x80000000 for 36-bit address spaces, and 0x40000000 for 32-bit ones.

[2.0.0+] Support for the 0x482907 mappings outside the "MapRegion" were removed.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || ThreadContext
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Nano
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nano=0 means "yield thread".

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40, error on num_handles == 0.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''Port:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''Session (server-side):''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

=== Result codes ===

'''0x0:''' Success. One of the objects was signalled before the timeout expired. Handle index is updated to indicate which object signalled.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signalled within the timeout. Handle index is not updated.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must be 0x1000-aligned.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) ? || ? || ?
|}
</div>

When used on retail where inx0 bit31 is clear, the system will throw a [[Error_codes|fatal-error]]. Otherwise when bit31 is set, it will return 0 and notify the debugger?

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || MapRegionBaseAddr
|-
| Process || 3 || 0 || MapRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryUsage
|-
| Process || 7 || 0 || TotalHeapUsage
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] NewMapRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] NewMapRegionSize
|-
| Process || 16 || 0 || [3.0.0+] IsVirtualAddressMemoryEnabled
|-
| Process || 17 || 0 || [3.0.0+] Some size in bytes.
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0+] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0+] PrivilegedProcessId_UpperBound
|-
| Thread || 0xF0000002 || 0 || Performance counter related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcCreateJitMemory ==
Takes an address range with backing memory to create the JIT memory object.

The memory is initially memset to 0xFF after being locked.

== svcMapJitMemory ==
Maps the backing memory for a JIT memory object into the current process.

For [[#MapJitOperation|MapJitOperation_MapOwner]], memory permission must be RW-.

For [[#MapJitOperation|MapJitOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#MapJitOperation|MapJitOperation_UnmapOwner/MapJitOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the memory as RW-, and the other "slave" process to map it R-X.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || SrcAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || DstAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || void* || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u64 || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== MapJitOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || MapJitOperation_MapOwner
|-
| 1 || MapJitOperation_MapSlave
|-
| 2 || MapJitOperation_UnmapOwner
|-
| 3 || MapJitOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessEvent ==
{| class=wikitable
! Value || Name
|-
| 0 || ProcessEvent_Created
|-
| 1 || ProcessEvent_DebugAttached
|-
| 2 || ProcessEvent_DebugDetached
|-
| 3 || ProcessEvent_Crashed
|-
| 4 || ProcessEvent_Running
|-
| 5 || ProcessEvent_Exiting
|-
| 6 || ProcessEvent_Exited
|-
| 7 || ProcessEvent_DebugSuspended
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_ActualPriority
|-
| 1 ||
|-
| 2 || DebugThreadParam_CpuCore
|-
| 3 ||
|-
| 4 || DebugThreadParam_CoreMask
|}

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0 || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 ||
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsSystem
|-
| 0x28 || 4 || || ResourceLimitHandle
|-
| 0x2C || 4 ||
|}

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] JitMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_WeirdSharedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_MappedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_JitReadOnly || Mapped in kernel during [[#svcMapJitMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_JitWritable || Mapped in kernel during [[#svcMapJitMemory]].
|}

== ContinueDebugFlags ==
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || SwallowException
|-
| 1 || 2 ||
|-
| 2 || 4 || ResumeAllThreads
|}

== DebugEventInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || Type (0=PausedThread, 1=RunningThread, 2=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 ||
|-
| 3 || DebugEvent_Exit
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_UndefinedInstruction
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|}

UndefinedInstruction specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
There is userland code for handling exceptions, however this doesn't seem to be executed on retail mode.

When a usermode exception occurs, it jumps to the main code binary entrypoint (main_binary_address + 0 == '''_start''').

During normal boot '''_start''' is invoked with X0=0 and X1=main_thread_handle (triggering normal crt0 setup).
During an usermode exception '''_start''' is invoked with X0=exception_info0_ptr and X1=exception_info1_ptr instead.

The '''_start''' method determines whether to boot normally or handle an exception if X0 is set to 0 or not.

SVC

2018-01-25T07:09:25Z

OgniK: svcBreak

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano || W0=result
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || svcCancelSynchronization || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || svcGetSystemTick || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=event_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W0=thread_handle || W0=result, X1=out
|-
| 0x26 || [[#svcBreak]] || X0,X1,X2=info || ?
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory|| X0=addr, X1=size || W0=result
|- style="border-top: double"
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || W0=thread_handle, W1=[[#ThreadContext]]* || W0=result
|-
| 0x34 || [4.0.0+] || X0=ptr, W1=type, X2=? X3=timeout ||
|-
| 0x35 || [4.0.0+] || X0=ptr, W1=type, X2=? W3=? ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=client_handle ?, W2=server_handle ?
|- style="border-top: double"
| 0x4B || [4.0.0+] [[#svcCreateJitMemory]] || X1=addr, X2=size || W0=result, W1=jit_handle
|-
| 0x4C || [4.0.0+] [[#svcMapJitMemory]] || W0=jit_handle, W1=[[#MapJitOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || svcCreateInterruptEvent || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=DebugEventInfo*, W1=debug_handle || W0=result
|-
| 0x64 || svcContinueDebugEvent || W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id || W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, W1=[[#ThreadContextFlags]], X2=ThreadContext* || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || svcSetHardwareBreakPoint || W0=HardwareBreakpointId, X1=watchpoint_flags, X2=watchpoint_value/debug_handle? ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x70 || svcCreatePort || W2=max_sessions, W3=unk_bool, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=srcaddr, W1=process_handle, X2=dstaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X2=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x2000000.

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

[2.0.0+] Size must be less than 0x18000000.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

If dstaddr >= LowerTreshold, the dst-range is enforced to be within the process' "MapRegion". Code can get the range of this region from [[#svcGetInfo]] id0=2,3.

In this case, the mapped memory will have state 0x5C3C0B.

As long as (dstaddr+size) < LowerThreshold, then you can map anywhere but the mapped memory will have state 0x482907 instead.

LowerTreshold is 0x80000000 for 36-bit address spaces, and 0x40000000 for 32-bit ones.

[2.0.0+] Support for the 0x482907 mappings outside the "MapRegion" were removed.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || ThreadContext
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Nano
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nano=0 means "yield thread".

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40, error on num_handles == 0.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''Port:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''Session (server-side):''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

=== Result codes ===

'''0x0:''' Success. One of the objects was signalled before the timeout expired. Handle index is updated to indicate which object signalled.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signalled within the timeout. Handle index is not updated.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must be 0x1000-aligned.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 ||
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) ? || ? || ?
|}
</div>

When used on retail where inx0 bit31 is clear, the system will throw a [[Error_codes|fatal-error]]. Otherwise when bit31 is set, it will return 0 and notify the debugger?

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || MapRegionBaseAddr
|-
| Process || 3 || 0 || MapRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryUsage
|-
| Process || 7 || 0 || TotalHeapUsage
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] NewMapRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] NewMapRegionSize
|-
| Process || 16 || 0 || [3.0.0+] IsVirtualAddressMemoryEnabled
|-
| Process || 17 || 0 || [3.0.0+] Some size in bytes.
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0+] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0+] PrivilegedProcessId_UpperBound
|-
| Thread || 0xF0000002 || 0 || Performance counter related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcCreateJitMemory ==
Takes an address range with backing memory to create the JIT memory object.

The memory is initially memset to 0xFF after being locked.

== svcMapJitMemory ==
Maps the backing memory for a JIT memory object into the current process.

For [[#MapJitOperation|MapJitOperation_MapOwner]], memory permission must be RW-.

For [[#MapJitOperation|MapJitOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#MapJitOperation|MapJitOperation_UnmapOwner/MapJitOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the memory as RW-, and the other "slave" process to map it R-X.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || SrcAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || DstAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || void* || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u64 || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== MapJitOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || MapJitOperation_MapOwner
|-
| 1 || MapJitOperation_MapSlave
|-
| 2 || MapJitOperation_UnmapOwner
|-
| 3 || MapJitOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessEvent ==
{| class=wikitable
! Value || Name
|-
| 0 || ProcessEvent_Created
|-
| 1 || ProcessEvent_DebugAttached
|-
| 2 || ProcessEvent_DebugDetached
|-
| 3 || ProcessEvent_Crashed
|-
| 4 || ProcessEvent_Running
|-
| 5 || ProcessEvent_Exiting
|-
| 6 || ProcessEvent_Exited
|-
| 7 || ProcessEvent_DebugSuspended
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_ActualPriority
|-
| 1 ||
|-
| 2 || DebugThreadParam_CpuCore
|-
| 3 ||
|-
| 4 || DebugThreadParam_CoreMask
|}

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0 || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 ||
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsSystem
|-
| 0x28 || 4 || || ResourceLimitHandle
|-
| 0x2C || 4 ||
|}

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] JitMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_WeirdSharedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_MappedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_JitReadOnly || Mapped in kernel during [[#svcMapJitMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_JitWritable || Mapped in kernel during [[#svcMapJitMemory]].
|}

== ContinueDebugFlags ==
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || SwallowException
|-
| 1 || 2 ||
|-
| 2 || 4 || ResumeAllThreads
|}

== DebugEventInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || Type (0=PausedThread, 1=RunningThread, 2=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 ||
|-
| 3 || DebugEvent_Exit
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_UndefinedInstruction
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|}

UndefinedInstruction specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
There is userland code for handling exceptions, however this doesn't seem to be executed on retail mode.

When a usermode exception occurs, it jumps to the main code binary entrypoint (main_binary_address + 0 == '''_start''').

During normal boot '''_start''' is invoked with X0=0 and X1=main_thread_handle (triggering normal crt0 setup).
During an usermode exception '''_start''' is invoked with X0=exception_info0_ptr and X1=exception_info1_ptr instead.

The '''_start''' method determines whether to boot normally or handle an exception if X0 is set to 0 or not.

NV services

2018-01-19T03:50:27Z

OgniK: /* nvmemp */

The Switch uses a customized NVIDIA driver.

= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
Main NVIDIA driver service.

Each service is used by:
* "nvdrv": regular applications
* "nvdrv:a": applets
* "nvdrv:s": sysmodules
* "nvdrv:t": factory titles

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Open]]
|-
| 1 || [[#Ioctl]]
|-
| 2 || [[#Close]]
|-
| 3 || [[#Initialize]]
|-
| 4 || [[#QueryEvent]]
|-
| 5 || [[#MapSharedMem]]
|-
| 6 || [[#GetStatus]]
|-
| 7 || [[#ForceSetClientPID]]
|-
| 8 || [[#SetClientPID]]
|-
| 9 || [[#DumpGraphicsMemoryInfo]]
|-
| 10 || [3.0.0+]
|-
| 11 || [3.0.0+] [[#Ioctl2]]
|-
| 12 || [3.0.0+] [[#Ioctl3]]
|-
| 13 || [3.0.0+]
|}

== Open ==
Takes a type-0x5 input buffer for the device-path. Returns the output 32bit '''fd''' and the u32 '''error_code'''.

== Ioctl ==
Takes a 32bit '''fd''', an u32 '''ioctl_cmd''', a type-0x21 input buffer, and a type-0x22 output buffer. Returns an output u32 ('''error_code''').

The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).

== Close ==
Takes a 32bit '''fd'''. Returns an output u32 ('''error_code''').

== Initialize ==
Takes two copy-handles ('''current_process''' and '''transfer_memory''') and an input u32 ('''transfer_memory_size'''). Returns an output u32 ('''error_code''').

Webkit applet creates the transfer-memory with perm = 0 and size 0x300000.

== QueryEvent ==
Takes two input u32s ('''fd''' and '''event_id'''), with the second word immediately after the first one. Returns an output u32 ('''error_code''') and a copy-handle ('''event_handle''').

== MapSharedMem ==
Takes a copy-handle ('''transfer_memory''') and two input u32s ('''fd''' and '''nvmap_handle'''). Returns an output u32 ('''error_code''').

== GetStatus ==
Takes no input. Returns 0x10-bytes and an output u32 ('''error_code''').

== ForceSetClientPID ==
Takes an input u64 which must [[IPC_Marshalling|match]] the user-process PID ([[AM_services|AppletResourceUserId]]). Returns an output u32 ('''error_code''').

== SetClientPID ==
Takes a PID-descriptor and an u64 which must [[IPC_Marshalling|match]] the user-process PID ([[AM_services|AppletResourceUserId]]). Returns an output u32 ('''error_code''').

== DumpGraphicsMemoryInfo ==
No input or output. Does nothing.

== Cmd10 ==
Takes a copy-handle and an input u32. Returns an output u32 ('''error_code''').

== Ioctl2 ==
Takes a type-0x21 buffer, a type-0x22 buffer, a type-0x21 buffer, and two input u32s. Returns an output u32 ('''error_code''').

== Ioctl3 ==
Same input/output as Ioctl2, except cmdhdr_word1 is 0x100B instead of 0xC0B.

== Cmd13 ==
Takes an input u64. No output.

Official user-processes starting with 3.0.0 now use this at the end of nvdrv service init with value 0x1.

= Ioctls =
The ioctl number is generated with the following primitive (see Linux kernel):

#define _IOC(inout, group, num, len) \
(inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))

The following table contains known ioctls.

== /dev/nvhost-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]] ||
|-
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]] ||
|-
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]] ||
|-
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]] ||
|-
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]] ||
|-
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]] ||
|-
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]] ||
|-
| 0xC183001B || Inout || 387 || [[#NVHOST_IOCTL_CTRL_GET_CONFIG]] ||
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_SIGNAL]] ||
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT]] ||
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC]] ||
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_REGISTER]] ||
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_UNREGISTER]] ||
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_EVENT_KILL]] ||
|}

=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
Identical to Linux driver.

struct {
__in u32 id;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
Identical to Linux driver.

struct {
__in u32 id;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
};

=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 lock; // (0==unlock; 1==lock)
};

=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
Identical to Linux driver. Uses 32-bit version and doesn't work.

struct {
__in u32 id;
__in u32 num_offsets;
__in u32 block_size;
__in u32 offsets;
__in u32 values;
__in u32 write;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
Identical to Linux driver.

struct {
__in u32 id;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_GET_CONFIG ===
Gets configured settings. Not available in production mode.

struct {
__in char domain_str[0x41]; // "nv"
__in char param_str[0x41];
__out char config_str[0x101];
};

=== NVHOST_IOCTL_CTRL_EVENT_SIGNAL ===
Signals an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT ===
Waits on an event. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to (('''syncpt_id''' << 0x10) | 0x10000000).

Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.

struct {
__in u32 syncpt_id;
__in u32 threshold;
__in s32 timeout;
__inout u32 value; // in=user_event_id (ignored); out=syncpt_value or user_event_id
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC ===
Waits on an event (async version). If waiting fails, returns error code 0x0B (BadValue).

Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.

struct {
__in u32 syncpt_id;
__in u32 threshold;
__in u32 timeout;
__inout u32 value; // in=user_event_id (ignored); out=syncpt_value or user_event_id
};

=== NVHOST_IOCTL_CTRL_EVENT_REGISTER ===
Registers an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_UNREGISTER ===
Unregisters an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_KILL ===
Kills user events. Exclusive to the Switch.

struct {
__in u64 user_events; // 64-bit bitfield where each bit represents one event
};

== /dev/nvmap ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080101 || Inout || 8 || [[#NVMAP_IOC_CREATE]] ||
|-
| 0x00000102 || - || 0 || NVMAP_IOC_CLAIM || Returns NotSupported
|-
| 0xC0080103 || Inout || 8 || [[#NVMAP_IOC_FROM_ID]] ||
|-
| 0xC0200104 || Inout || 32 || [[#NVMAP_IOC_ALLOC]] ||
|-
| 0xC0180105 || Inout || 24 || [[#NVMAP_IOC_FREE]] ||
|-
| 0xC0280106 || Inout || 40 || NVMAP_IOC_MMAP || Returns NotSupported
|-
| 0xC0280107 || Inout || 40 || NVMAP_IOC_WRITE || Returns NotSupported
|-
| 0xC0280108 || Inout || 40 || NVMAP_IOC_READ || Returns NotSupported
|-
| 0xC00C0109 || Inout || 12 || [[#NVMAP_IOC_PARAM]] ||
|-
| 0xC010010A || Inout || 16 || NVMAP_IOC_PIN_MULT || Returns NotSupported
|-
| 0xC010010B || Inout || 16 || NVMAP_IOC_UNPIN_MULT || Returns NotSupported
|-
| 0xC008010C || Inout || 8 || NVMAP_IOC_CACHE || Returns NotSupported
|-
| 0xC004010D || Inout || 4 || || Returns NotSupported
|-
| 0xC008010E || Inout || 8 || [[#NVMAP_IOC_GET_ID]] ||
|-
| 0xC004010F || Inout || 4 || || Returns NotSupported
|-
| 0x40040110 || In || 4 || || Returns NotSupported
|-
| 0x00000111 || - || 0 || || Returns NotSupported
|}

=== NVMAP_IOC_CREATE ===
Creates an nvmap object. Identical to Linux driver.

struct {
__in u32 size;
__out u32 handle;
};

=== NVMAP_IOC_FROM_ID ===
Get handle to an existing nvmap object. Identical to Linux driver.

struct {
__in u32 id;
__out u32 handle;
};

=== NVMAP_IOC_ALLOC ===
Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.

struct {
__in u32 handle;
__in u32 heapmask;
__in u32 flags; // (0=read-only, 1=read-write)
__in u32 align;
__in u8 kind;
u8 pad[7];
__in u64 addr;
};

=== NVMAP_IOC_FREE ===
This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.

struct {
__in u32 handle;
u32 pad;
__out u64 refcount;
__out u32 size;
__out u32 flags; // 1=NOT_FREED_YET
};

=== NVMAP_IOC_PARAM ===
Returns info about a nvmap object. Identical to Linux driver, but extended with further params.

struct {
__in u32 handle;
__in u32 param; // 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
__out u32 result;
};

=== NVMAP_IOC_GET_ID ===
Returns an id for a nvmap object. Identical to Linux driver.

struct {
__out u32 id; //~0 indicates error
__in u32 handle;
};

== /dev/nvdisp-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80040212 || Out || 4 || TEGRA_DC_EXT_CONTROL_GET_NUM_OUTPUTS ||
|-
| 0xC0140213 || Inout || 20 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_PROPERTIES ||
|-
| 0xC1100214 || Inout || 272 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_EDID ||
|-
| 0xC0040216 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT0 ||
|-
| 0xC0040217 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT1 ||
|-
| 0xC0100218 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT2 ||
|-
| 0xC0100219 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT3 ||
|-
| 0xC0040220 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT4 ||
|-
|}

== /dev/nvdisp-disp0, /dev/nvdisp-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40040201 || In || 4 || TEGRA_DC_EXT_GET_WINDOW ||
|-
| 0x40040202 || In || 4 || TEGRA_DC_EXT_PUT_WINDOW ||
|-
| 0xC4C80203 || In || 1224 || TEGRA_DC_EXT_FLIP ||
|-
| 0x80380204 || Out || 56 || TEGRA_DC_EXT_GET_MODE ||
|-
| 0x40380205 || Out || 56 || TEGRA_DC_EXT_SET_MODE ||
|-
| 0x430C0206 || In || 780 || TEGRA_DC_EXT_SET_LUT ||
|-
| 0x40010207 || In || 1 || TEGRA_DC_EXT_ENABLE_DISABLE_CRC ||
|-
| 0x80040208 || Out || 4 || TEGRA_DC_EXT_GET_CRC ||
|-
| 0x80040209 || Out || 4 || TEGRA_DC_EXT_GET_HEAD_STATUS ||
|-
| 0xC038020A || Inout || 56 || TEGRA_DC_EXT_VALIDATE_MODE ||
|-
| 0x4018020B || In || 24 || TEGRA_DC_EXT_SET_CSC ||
|-
| 0xC004020C || Inout || 4 || TEGRA_DC_EXT_GET_VBLANK_SYNCPT ||
|-
| 0x8040020D || Out || 64 || TEGRA_DC_EXT_GET_UNDERFLOWS ||
|-
| 0xC99A020E || Inout || 2458 || TEGRA_DC_EXT_SET_CMU ||
|-
| 0xC004020F || Inout || 4 || TEGRA_DC_EXT_DPMS ||
|-
| 0x80600210 || Out || 96 || TEGRA_DC_EXT_GET_AVI_INFOFRAME ||
|-
| 0x40600211 || In || 96 || TEGRA_DC_EXT_SET_AVI_INFOFRAME ||
|-
| 0xEBFC0215 || Inout || 11260 || TEGRA_DC_EXT_GET_MODE_DB ||
|-
| 0xC003021A || Inout || 3 || TEGRA_DC_EXT_PANEL_GET_VENDOR_ID ||
|-
| 0x803C021B || Out || 60 || TEGRA_DC_EXT_GET_MODE2 ||
|-
| 0x403C021C || In || 60 || TEGRA_DC_EXT_SET_MODE2 ||
|-
| 0xC03C021D || Inout || 60 || TEGRA_DC_EXT_VALIDATE_MODE2 ||
|-
| 0xEF20021E || Inout || 12064 || TEGRA_DC_EXT_GET_MODE_DB2 ||
|-
| 0xC004021F || Inout || 4 || TEGRA_DC_EXT_GET_WINMASK ||
|-
|}

== /dev/nvcec-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010300 || In || 1 || ||
|-
| 0x40010301 || In || 1 || NVCEC_CTRL_ENABLE ||
|-
| 0x804C0302 || Out || 76 || NVCEC_CTRL_GET_PADDR ||
|-
| 0x40040303 || In || 4 || NVCEC_CTRL_SET_LADDR ||
|-
| 0xC04C0304 || Inout || 76 || NVCEC_CTRL_WRITE ||
|-
| 0xC04C0305 || Inout || 76 || NVCEC_CTRL_READ ||
|-
| 0x804C0306 || Out || 76 || NVCEC_CTRL_GET_CONNECTION_STATUS ||
|-
| 0x804C0307 || Out || 76 || NVCEC_CTRL_GET_WRITE_STATUS ||
|-
|}

== /dev/nvhdcp_up-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC4880401 || Inout || 1160 || TEGRAIO_NVHDCP_READ_M ||
|-
| 0xC4880402 || Inout || 1160 || TEGRAIO_NVHDCP_READ_S ||
|-
| 0x40010403 || In || 1 || TEGRAIO_NVHDCP_ON_OFF ||
|-
|}

== /dev/nvdcutil-disp0, /dev/nvdcutil-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010501 || In || 1 || ||
|-
| 0x40010502 || In || 1 || ||
|-
| 0x42040503 || In || 1056 || ||
|-
| 0x803C0504 || Out || 60 || NVDCUTIL_DISP_IOCTL_GET_DISPLAY_INFO ||
|-
|}

== /dev/nvsched-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x00000601 || - || 0 || ||
|-
| 0x00000602 || - || 0 || ||
|-
| 0x40180603 || In || 1056 || ||
|-
| 0x40180604 || In || 60 || ||
|-
| 0x40080605 || In || 60 || ||
|-
| 0x80080606 || Out || 60 || ||
|-
| 0x80080607 || Out || 60 || ||
|-
| 0x40180608 || In || 24 || ||
|-
| 0x40100609 || In || 16 || ||
|-
| 0x4010060A || In || 16 || ||
|-
| 0x4008060B || In || 8 || ||
|-
| 0x8001060C || Out || 1 || ||
|-
| 0x8010060D || Out || 16 || ||
|-
| 0x400C060E || In || 12 || ||
|-
| 0x4008060F || In || 8 || ||
|-
| 0x40100610 || In || 16 || ||
|-
| 0x40100611 || In || 16 || ||
|-
|}

== /dev/nverpt-ctrl ==
Added in firmware version 4.0.0.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC1280701 || Inout || 296 || ||
|-
| 0xCF580702 || Inout || 3928 || ||
|-
|}

== /dev/nvhost-as-gpu ==
Each fd opened to this device creates an address space. An address space is then later bound with a channel.

Once a nvgpu channel has been bound to an address space it cannot be unbound. There is no support for allowing an nvgpu channel to change from one address space to another (or from one to none).

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40044101 || In || 4 || [[#NVGPU_AS_IOCTL_BIND_CHANNEL]] ||
|-
| 0xC0184102 || Inout || 24 || [[#NVGPU_AS_IOCTL_ALLOC_SPACE]] ||
|-
| 0xC0104103 || Inout || 16 || [[#NVGPU_AS_IOCTL_FREE_SPACE]] ||
|-
| 0xC0184104 || Inout || 24 || [[#NVGPU_AS_IOCTL_MAP_BUFFER]] ||
|-
| 0xC0084105 || Inout || 8 || [[#NVGPU_AS_IOCTL_UNMAP_BUFFER]] ||
|-
| 0xC0284106 || Inout || 40 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX]] ||
|-
| 0x40104107 || In || 16 || [[#NVGPU_AS_IOCTL_INITIALIZE]] ||
|-
| 0xC0404108 || Inout || 64 || [[#NVGPU_AS_IOCTL_GET_VA_REGIONS]] ||
|-
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_INITIALIZE_EX]] ||
|-
| 0xC0??4114 || Inout || Variable || [[#NVGPU_AS_IOCTL_REMAP]] ||
|}

=== NVGPU_AS_IOCTL_BIND_CHANNEL ===
Identical to Linux driver.

struct {
__in u32 fd;
};

=== NVGPU_AS_IOCTL_ALLOC_SPACE ===
This one reserves pages in the device address space.

struct {
__in u32 pages;
__in u32 page_size;
__in u32 flags;
u32 pad;
union {
__out u64 offset;
__in u64 align;
};
};

=== NVGPU_AS_IOCTL_FREE_SPACE ===
struct {
__in u64 offset;
__in u32 pages;
__in u32 page_size;
};

=== NVGPU_AS_IOCTL_MAP_BUFFER ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
u32 pad;
__in u32 nvmap_handle;
__inout u32 page_size; // 0 means don't care
union {
__out u64 offset;
__in u64 align;
};
};

=== NVGPU_AS_IOCTL_MAP_BUFFER_EX ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__in u32 kind; // -1 is default
__in u32 nvmap_handle;
__inout u32 page_size; // 0 means don't care
__in u64 buffer_offset;
__in u64 mapping_size;
__inout u64 offset;
};

=== NVGPU_AS_IOCTL_UNMAP_BUFFER ===
Unmap a memory region from the device address space.

struct {
__in u64 offset;
};

=== NVGPU_AS_IOCTL_INITIALIZE ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable).

struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u32 flags; // ignored; passes 0
__in u32 reserved; // ignored; passes 0
};

=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
Nintendo modified to get rid of pointer in struct.

struct va_region {
u64 offset;
u32 page_size;
u32 pad;
u64 pages;
};

struct {
u64 not_used; // (contained output user ptr on linux, ignored)
__inout u32 bufsize; // forced to 2*sizeof(struct va_region)
u32 pad;
__out struct va_region regions[2];
};

=== NVGPU_AS_IOCTL_INITIALIZE_EX ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable) with extra params.

struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u32 flags; // passes 0
__in u32 reserved; // ignored; passes 0
__in u64 unk0;
__in u64 unk1;
__in u64 unk2;
};

=== NVGPU_AS_IOCTL_REMAP ===
Nintendo's custom implementation of address space remapping.

struct remap_entry {
__in u16 flags; // 0 or 4
__in u16 kind;
__in u32 nvmap_handle;
__in u32 padding;
__in u32 offset; // (alloc_space_offset >> 0x10)
__in u32 pages; // alloc_space_pages
};

struct {
__in struct remap_entry entries[];
};

== /dev/nvhost-dbg-gpu ==
Not accessible, but there is code to invoke it.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40084401 || In || 8 || NVGPU_DBG_GPU_IOCTL_BIND_CHANNEL ||
|-
| 0xC0??4402 || Inout || Variable || NVGPU_DBG_GPU_IOCTL_REG_OPS ||
|-
| 0x40084403 || In || 8 || NVGPU_DBG_GPU_IOCTL_EVENTS_CTRL ||
|-
| 0x40044404 || In || 4 || NVGPU_DBG_GPU_IOCTL_POWERGATE ||
|-
| 0x40044405 || In || 4 || NVGPU_DBG_GPU_IOCTL_SMPC_CTXSW_MODE ||
|-
| 0xC0184407 || Inout || 24 || NVGPU_DBG_GPU_IOCTL_PERFBUF_MAP ||
|-
| 0x40084408 || In || 8 || NVGPU_DBG_GPU_IOCTL_PERFBUF_UNMAP ||
|-
| 0x40084409 || In || 8 || NVGPU_DBG_GPU_IOCTL_PC_SAMPLING ||
|-
| 0x4008440A || In || 8 || NVGPU_DBG_GPU_IOCTL_TIMEOUT ||
|-
| 0x8008440B || Out || 8 || NVGPU_DBG_GPU_IOCTL_GET_TIMEOUT ||
|-
| 0x8004440C || Out || 4 || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT_SIZE ||
|-
| 0x0000440D || None || 0 || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT (uses Ioctl3) ||
|-
|}

== /dev/nvhost-ctrl-gpu ==
This device is for global (context independent) operations on the gpu.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80044701 || Out || 4 || [[#NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE]] ||
|-
| 0x80284702 || Out || 40 || [[#NVGPU_GPU_IOCTL_ZCULL_GET_INFO]] ||
|-
| 0x402C4703 || In || 44 || [[#NVGPU_GPU_IOCTL_ZBC_SET_TABLE]] ||
|-
| 0xC0344704 || Inout || 52 || [[#NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE]] ||
|-
| 0xC0B04705 || Inout || 176 || [[#NVGPU_GPU_IOCTL_GET_CHARACTERISTICS]] ||
|-
| 0xC0184706 || Inout || 24 || NVGPU_GPU_IOCTL_GET_TPC_MASKS ||
|-
| 0x40084707 || In || 8 || [[#NVGPU_GPU_IOCTL_FLUSH_L2]] ||
|-
| 0x4008470E || In || 8 || NVGPU_GPU_IOCTL_SET_MMUDEBUG_MODE ||
|-
| 0x4010470F || In || 16 || NVGPU_GPU_IOCTL_SET_SM_DEBUG_MODE ||
|-
| 0xC0084710 || Inout || 8 || NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE ||
|-
| 0x80084711 || Out || 8 || NVGPU_GPU_IOCTL_GET_TPC_EXCEPTION_EN_STATUS ||
|-
| 0x80084712 || Out || 8 || NVGPU_GPU_IOCTL_NUM_VSMS ||
|-
| 0xC0044713 || Inout || 4 || NVGPU_GPU_IOCTL_VSMS_MAPPING ||
|-
| 0x80084714 || Out || 8 || [[#NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK]] ||
|-
| 0x80044715 || Out || 4 || ||
|-
| 0x8018471A || Out || 24 || ||
|-
| 0xC008471B || Inout || 8 || NVGPU_GPU_IOCTL_GET_ERROR_CHANNEL_USER_DATA ||
|-
| 0xC010471C || Inout || 16 || NVGPU_GPU_IOCTL_GET_GPU_TIME ||
|-
| 0xC108471D || Inout || 264 || NVGPU_GPU_IOCTL_GET_CPU_TIME_CORRELATION_INFO ||
|}

=== NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE ===
Returns the GPU's ZCULL context size. Identical to Linux driver.

struct {
__out u32 size;
};

=== NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE ===
Returns GPU's ZCULL information. Identical to Linux driver.

struct {
__out u32 width_align_pixels;
__out u32 height_align_pixels;
__out u32 pixel_squares_by_aliquots;
__out u32 aliquot_total;
__out u32 region_byte_multiplier;
__out u32 region_header_size;
__out u32 subregion_header_size;
__out u32 subregion_width_align_pixels;
__out u32 subregion_height_align_pixels;
__out u32 subregion_count;
};

=== NVGPU_GPU_IOCTL_ZBC_SET_TABLE ===
Sets the active ZBC table. Identical to Linux driver.

struct {
__in u32 color_ds[4];
__in u32 color_l2[4];
__in u32 depth;
__in u32 format;
__in u32 type; // 1=color, 2=depth
};

=== NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE ===
Queries the active ZBC table. Identical to Linux driver.

struct {
__out u32 color_ds[4];
__out u32 color_l2[4];
__out u32 depth;
__out u32 ref_cnt;
__out u32 format;
__out u32 type;
__inout u32 index_size;
};

=== NVGPU_GPU_IOCTL_GET_CHARACTERISTICS ===
Returns the GPU characteristics. Modified to return inline data instead of using a pointer.

struct gpu_characteristics {
u32 arch; // 0x120 (NVGPU_GPU_ARCH_GM200)
u32 impl; // 0xB (NVGPU_GPU_IMPL_GM20B)
u32 rev; // 0xA1 (Revision A1)
u32 num_gpc; // 0x1
u64 l2_cache_size; // 0x40000
u64 on_board_video_memory_size; // 0x0 (not used)
u32 num_tpc_per_gpc; // 0x2
u32 bus_type; // 0x20 (NVGPU_GPU_BUS_TYPE_AXI)
u32 big_page_size; // 0x20000
u32 compression_page_size; // 0x20000
u32 pde_coverage_bit_count; // 0x1B
u32 available_big_page_sizes; // 0x30000
u32 gpc_mask; // 0x1
u32 sm_arch_sm_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 sm_arch_spa_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 sm_arch_warp_count; // 0x80
u32 gpu_va_bit_count; // 0x28
u32 reserved; // NULL
u64 flags; // 0x55
u32 twod_class; // 0x902D (FERMI_TWOD_A)
u32 threed_class; // 0xB197 (MAXWELL_B)
u32 compute_class; // 0xB1C0 (MAXWELL_COMPUTE_B)
u32 gpfifo_class; // 0xB06F (MAXWELL_CHANNEL_GPFIFO_A)
u32 inline_to_memory_class; // 0xA140 (KEPLER_INLINE_TO_MEMORY_B)
u32 dma_copy_class; // 0xB0B5 (MAXWELL_DMA_COPY_A)
u32 max_fbps_count; // 0x1
u32 fbp_en_mask; // 0x0 (disabled)
u32 max_ltc_per_fbp; // 0x2
u32 max_lts_per_ltc; // 0x1
u32 max_tex_per_tpc; // 0x0 (not supported)
u32 max_gpc_count; // 0x1
u32 rop_l2_en_mask_0; // 0x21D70 (fuse_status_opt_rop_l2_fbp_r)
u32 rop_l2_en_mask_1; // 0x0
u64 chipname; // 0x6230326D67 ("gm20b")
u64 gr_compbit_store_base_hw; // 0x0 (not supported)
};

struct {
__inout u64 gpu_characteristics_buf_size; // must not be NULL, but gets overwritten with 0xA0=max_size
__in u64 gpu_characteristics_buf_addr; // ignored, but must not be NULL
__out struct gpu_characteristics gc;
};

=== NVGPU_GPU_IOCTL_FLUSH_L2 ===
Flushes the GPU L2 cache.

struct {
__in u32 flush; // l2_flush | l2_invalidate << 1 | fb_flush << 2
u32 reserved;
};

=== NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK ===
Returns the mask value for a ZBC slot.

struct {
__out u32 slot; // always 0x07
__out u32 mask;
};

== Channels ==
Channels are a concept for NVIDIA hardware blocks that share a common interface.

{| class="wikitable" border="1"
! Path || Name
|-
| /dev/nvhost-gpu ||
|-
| /dev/nvhost-vic || Video Image Compositor
|-
| /dev/nvhost-nvdec || Video Decoder
|-
| /dev/nvhost-nvjpg || JPEG Decoder
|}

== Channel Ioctls ==
{| class="wikitable" border="1"
! Value || Size || Description || Notes
|-
| 0xC0??0001 || Variable || NVHOST_IOCTL_CHANNEL_SUBMIT ||
|-
| 0xC0080002 || 8 || NVHOST_IOCTL_CHANNEL_GET_SYNCPOINT ||
|-
| 0xC0080003 || 8 || NVHOST_IOCTL_CHANNEL_GET_WAITBASE ||
|-
| 0xC0080004 || 8 || NVHOST_IOCTL_CHANNEL_SET_TIMEOUT_EX ||
|-
| 0x40040007 || 4 || ||
|-
| 0x40080008 || 8 || NVHOST_IOCTL_CHANNEL_SET_CLK_RATE ||
|-
| 0xC0??0009 || Variable || NVHOST_IOCTL_CHANNEL_MAP_BUFFER ||
|-
| 0xC0??000A || Variable || NVHOST_IOCTL_CHANNEL_UNMAP_BUFFER ||
|-
| 0x00000013 || 0 || ||
|- style="border-top: double"
| 0x40044801 || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD]] ||
|-
| 0x40044803 || 4 || NVGPU_IOCTL_CHANNEL_SET_TIMEOUT ||
|-
| 0x40084805 || 8 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO]] ||
|-
| 0xC0044807 || 4 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS ||
|-
| 0xC0??4808 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]] ||
|-
| 0xC0104809 || 16 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX]] ||
|-
| 0xC010480B || 16 || [[#NVGPU_IOCTL_CHANNEL_ZCULL_BIND]] ||
|-
| 0xC018480C || 24 || [[#NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER]] ||
|-
| 0x4004480D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_PRIORITY]] ||
|-
| 0x0000480E || 0 || [[#NVGPU_IOCTL_CHANNEL_ENABLE]] ||
|-
| 0x0000480F || 0 || [[#NVGPU_IOCTL_CHANNEL_DISABLE]] ||
|-
| 0x00004810 || 0 || [[#NVGPU_IOCTL_CHANNEL_PREEMPT]] ||
|-
| 0x00004811 || 0 || [[#NVGPU_IOCTL_CHANNEL_FORCE_RESET]] ||
|-
| 0x40084812 || 8 || [[#NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL]] ||
|-
| 0xC0104813 || 16 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS_SNAPSHOT ||
|-
| 0x80804816 || 128 || NVGPU_IOCTL_CHANNEL_GET_ERROR_INFO ||
|-
| 0xC0104817 || 16 || [[#NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION]] ||
|-
| 0x40204818 || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]] ||
|-
| 0xC0??4819 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]] ||
|-
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]] ||
|-
| 0xC018481B || 24 || (uses Ioctl2) ||
|-
| 0xC018481C || 24 || (uses Ioctl2) ||
|-
|- style="border-top: double"
| 0x40084714 || 8 || NVGPU_IOCTL_CHANNEL_SET_USER_DATA || Sets an unknown user context address
|-
| 0x80084715 || 8 || NVGPU_IOCTL_CHANNEL_GET_USER_DATA || Gets an unknown user context address
|}

=== NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD ===
Binds a nvmap object to this channel. Identical to Linux driver.

struct {
__in u32 nvmap_fd;
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO ===
Allocates gpfifo entries. Identical to Linux driver.

struct {
__in u32 num_entries;
__in u32 flags;
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO ===
Submits a gpfifo object. Modified to take inline entry objects instead of a pointer.

struct fence {
u32 id;
u32 value;
};

struct gpfifo_entry {
u32 entry0; // gpu_va_lo
u32 entry1; // gpu_va_hi | (unk_0x02 << 0x08) | (size << 0x0A) | (unk_0x01 << 0x1F)
};

struct {
__in u64 gpfifo; // (ignored) pointer to gpfifo fence structs
__in u32 num_entries; // number of fence objects being submitted
__in u32 flags;
__out struct fence fence_out; // returned new fence object for others to wait on
__in struct gpfifo_entry entries[]; // depends on num_entries
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX ===
Allocates a graphics context object. Modified to ignore object's ID.

struct {
__in u32 class_num; // 0x902D=2d, 0xB197=3d, 0xB1C0=compute, 0xA140=kepler, 0xB0B5=DMA, 0xB06F=channel_gpfifo
__in u32 flags;
__out u64 obj_id; // (ignored) used for FREE_OBJ_CTX ioctl, which is not supported
};

=== NVGPU_IOCTL_CHANNEL_ZCULL_BIND ===
Binds a ZCULL context to the channel. Identical to Linux driver.

struct {
__in u64 gpu_va;
__in u32 mode; // 0=global, 1=no_ctxsw, 2=separate_buffer, 3=part_of_regular_buf
__in u32 padding;
};

=== NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER ===
Initializes the error notifier for this channel. Identical to Linux driver.

struct {
__in u64 offset;
__in u64 size;
__in u32 mem; // nvmap object handle
__in u32 padding;
};

=== NVGPU_IOCTL_CHANNEL_SET_PRIORITY ===
Change channel's priority. Identical to Linux driver.

struct {
__in u32 priority; // 0x32 is low, 0x64 is medium and 0x96 is high
};

=== NVGPU_IOCTL_CHANNEL_ENABLE ===
Enables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_DISABLE ===
Disables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_PREEMPT ===
Clears the FIFO pipe for this channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_FORCE_RESET ===
Forces the channel to reset. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL ===
Controls event notifications.

struct {
__in u32 cmd; // 0=disable, 1=enable, 2=clear
__in u32 id;
};

=== NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION ===
Returns the current error notification caught by the error notifier. Exclusive to the Switch.

struct {
__out u64 timestamp; // nanoseconds since Jan. 1, 1970
__out u32 info32; // error code
__out u16 info16; // additional error info
__inout u16 status; // always 0xFFFF
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY ===
Allocates gpfifo entries with additional parameters. Exclusive to the Switch.

struct {
__in u32 num_entries;
__in u32 flags;
__in u32 unk0; // 1 works
__in u32 unk1;
__in u32 unk2;
__in u32 unk3;
__in u32 unk4;
__in u32 unk5;
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX ===
Submits a gpfifo object (async version). Exclusive to the Switch.

struct {
u64 __gpfifo; // in (pointer to gpfifo fence structs; ignored)
u32 __num_entries; // in (number of fence objects being submitted)
u32 __flags; // in
struct fence __fence_out; // out (returned new fence object for others to wait on)
struct gpfifo_entry __entries[]; // in (depends on __num_entries)
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2 ===
Allocates gpfifo entries with additional parameters and returns a fence. Exclusive to the Switch.

struct {
u32 __num_entries; // in
u32 __flags; // in
u32 __unk0; // in (1 works)
struct fence __fence_out; // out
u32 __unk1; // in
u32 __unk2; // in
u32 __unk3; // in
};

= nvmemp =
NVIDIA memory profiler (this service is not available on retail units).
/dev/nvhost-ctrl sends the ioctl NVHOST_IOCTL_CTRL_GET_CONFIG to check the config "nv!NV_MEMORY_PROFILER". If config_str returns "1", the applications attempts to talk to use nvmemp.
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Cmd0
|-
| 1 || Cmd1
|}

= nvdrvdbg =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenLog]]
|-
| 1 || [[#CloseLog]]
|-
| 2 || [[#ReadLog]]
|}

== OpenLog ==
Takes process handle. Returns an fd.

== CloseLog ==
Takes fd and closes it.

== ReadLog ==
Takes fd and reads log into a type-6 buffer.

= Errors =
Most nvidia driver commands return an error code apart from the normal return code.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Success
|-
| 1 || NotImplemented
|-
| 2 || NotSupported
|-
| 3 || NotInitialized
|-
| 4 || BadParameter
|-
| 5 || Timeout
|-
| 6 || InsufficientMemory
|-
| 7 || ReadOnlyAttribute
|-
| 8 || InvalidState
|-
| 9 || InvalidAddress
|-
| 0xA || InvalidSize
|-
| 0xB || BadValue
|-
| 0xD || AlreadyAllocated
|-
| 0xE || Busy
|-
| 0xF || ResourceError
|-
| 0x10 || CountMismatch
|-
| 0x1000 || SharedMemoryTooSmall
|-
| 0x30003 || FileOperationFailed
|-
| 0x3000F || IoctlFailed
|}

= Panic =
In some cases, a panic may occur. NV forces a crash by doing:
(void *)0 = 0xCAFE;
End result is that the system hangs with a white-screen.

== Gpfifo Panic ==
When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.

[[Category:Services]]

NV services

2018-01-19T03:46:13Z

OgniK: /* nvmemp */

The Switch uses a customized NVIDIA driver.

= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
Main NVIDIA driver service.

Each service is used by:
* "nvdrv": regular applications
* "nvdrv:a": applets
* "nvdrv:s": sysmodules
* "nvdrv:t": factory titles

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Open]]
|-
| 1 || [[#Ioctl]]
|-
| 2 || [[#Close]]
|-
| 3 || [[#Initialize]]
|-
| 4 || [[#QueryEvent]]
|-
| 5 || [[#MapSharedMem]]
|-
| 6 || [[#GetStatus]]
|-
| 7 || [[#ForceSetClientPID]]
|-
| 8 || [[#SetClientPID]]
|-
| 9 || [[#DumpGraphicsMemoryInfo]]
|-
| 10 || [3.0.0+]
|-
| 11 || [3.0.0+] [[#Ioctl2]]
|-
| 12 || [3.0.0+] [[#Ioctl3]]
|-
| 13 || [3.0.0+]
|}

== Open ==
Takes a type-0x5 input buffer for the device-path. Returns the output 32bit '''fd''' and the u32 '''error_code'''.

== Ioctl ==
Takes a 32bit '''fd''', an u32 '''ioctl_cmd''', a type-0x21 input buffer, and a type-0x22 output buffer. Returns an output u32 ('''error_code''').

The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).

== Close ==
Takes a 32bit '''fd'''. Returns an output u32 ('''error_code''').

== Initialize ==
Takes two copy-handles ('''current_process''' and '''transfer_memory''') and an input u32 ('''transfer_memory_size'''). Returns an output u32 ('''error_code''').

Webkit applet creates the transfer-memory with perm = 0 and size 0x300000.

== QueryEvent ==
Takes two input u32s ('''fd''' and '''event_id'''), with the second word immediately after the first one. Returns an output u32 ('''error_code''') and a copy-handle ('''event_handle''').

== MapSharedMem ==
Takes a copy-handle ('''transfer_memory''') and two input u32s ('''fd''' and '''nvmap_handle'''). Returns an output u32 ('''error_code''').

== GetStatus ==
Takes no input. Returns 0x10-bytes and an output u32 ('''error_code''').

== ForceSetClientPID ==
Takes an input u64 which must [[IPC_Marshalling|match]] the user-process PID ([[AM_services|AppletResourceUserId]]). Returns an output u32 ('''error_code''').

== SetClientPID ==
Takes a PID-descriptor and an u64 which must [[IPC_Marshalling|match]] the user-process PID ([[AM_services|AppletResourceUserId]]). Returns an output u32 ('''error_code''').

== DumpGraphicsMemoryInfo ==
No input or output. Does nothing.

== Cmd10 ==
Takes a copy-handle and an input u32. Returns an output u32 ('''error_code''').

== Ioctl2 ==
Takes a type-0x21 buffer, a type-0x22 buffer, a type-0x21 buffer, and two input u32s. Returns an output u32 ('''error_code''').

== Ioctl3 ==
Same input/output as Ioctl2, except cmdhdr_word1 is 0x100B instead of 0xC0B.

== Cmd13 ==
Takes an input u64. No output.

Official user-processes starting with 3.0.0 now use this at the end of nvdrv service init with value 0x1.

= Ioctls =
The ioctl number is generated with the following primitive (see Linux kernel):

#define _IOC(inout, group, num, len) \
(inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))

The following table contains known ioctls.

== /dev/nvhost-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]] ||
|-
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]] ||
|-
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]] ||
|-
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]] ||
|-
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]] ||
|-
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]] ||
|-
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]] ||
|-
| 0xC183001B || Inout || 387 || [[#NVHOST_IOCTL_CTRL_GET_CONFIG]] ||
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_SIGNAL]] ||
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT]] ||
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC]] ||
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_REGISTER]] ||
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_UNREGISTER]] ||
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_EVENT_KILL]] ||
|}

=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
Identical to Linux driver.

struct {
__in u32 id;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
Identical to Linux driver.

struct {
__in u32 id;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
};

=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 lock; // (0==unlock; 1==lock)
};

=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
Identical to Linux driver. Uses 32-bit version and doesn't work.

struct {
__in u32 id;
__in u32 num_offsets;
__in u32 block_size;
__in u32 offsets;
__in u32 values;
__in u32 write;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
Identical to Linux driver.

struct {
__in u32 id;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_GET_CONFIG ===
Gets configured settings. Not available in production mode.

struct {
__in char domain_str[0x41]; // "nv"
__in char param_str[0x41];
__out char config_str[0x101];
};

=== NVHOST_IOCTL_CTRL_EVENT_SIGNAL ===
Signals an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT ===
Waits on an event. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to (('''syncpt_id''' << 0x10) | 0x10000000).

Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.

struct {
__in u32 syncpt_id;
__in u32 threshold;
__in s32 timeout;
__inout u32 value; // in=user_event_id (ignored); out=syncpt_value or user_event_id
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC ===
Waits on an event (async version). If waiting fails, returns error code 0x0B (BadValue).

Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.

struct {
__in u32 syncpt_id;
__in u32 threshold;
__in u32 timeout;
__inout u32 value; // in=user_event_id (ignored); out=syncpt_value or user_event_id
};

=== NVHOST_IOCTL_CTRL_EVENT_REGISTER ===
Registers an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_UNREGISTER ===
Unregisters an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_KILL ===
Kills user events. Exclusive to the Switch.

struct {
__in u64 user_events; // 64-bit bitfield where each bit represents one event
};

== /dev/nvmap ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080101 || Inout || 8 || [[#NVMAP_IOC_CREATE]] ||
|-
| 0x00000102 || - || 0 || NVMAP_IOC_CLAIM || Returns NotSupported
|-
| 0xC0080103 || Inout || 8 || [[#NVMAP_IOC_FROM_ID]] ||
|-
| 0xC0200104 || Inout || 32 || [[#NVMAP_IOC_ALLOC]] ||
|-
| 0xC0180105 || Inout || 24 || [[#NVMAP_IOC_FREE]] ||
|-
| 0xC0280106 || Inout || 40 || NVMAP_IOC_MMAP || Returns NotSupported
|-
| 0xC0280107 || Inout || 40 || NVMAP_IOC_WRITE || Returns NotSupported
|-
| 0xC0280108 || Inout || 40 || NVMAP_IOC_READ || Returns NotSupported
|-
| 0xC00C0109 || Inout || 12 || [[#NVMAP_IOC_PARAM]] ||
|-
| 0xC010010A || Inout || 16 || NVMAP_IOC_PIN_MULT || Returns NotSupported
|-
| 0xC010010B || Inout || 16 || NVMAP_IOC_UNPIN_MULT || Returns NotSupported
|-
| 0xC008010C || Inout || 8 || NVMAP_IOC_CACHE || Returns NotSupported
|-
| 0xC004010D || Inout || 4 || || Returns NotSupported
|-
| 0xC008010E || Inout || 8 || [[#NVMAP_IOC_GET_ID]] ||
|-
| 0xC004010F || Inout || 4 || || Returns NotSupported
|-
| 0x40040110 || In || 4 || || Returns NotSupported
|-
| 0x00000111 || - || 0 || || Returns NotSupported
|}

=== NVMAP_IOC_CREATE ===
Creates an nvmap object. Identical to Linux driver.

struct {
__in u32 size;
__out u32 handle;
};

=== NVMAP_IOC_FROM_ID ===
Get handle to an existing nvmap object. Identical to Linux driver.

struct {
__in u32 id;
__out u32 handle;
};

=== NVMAP_IOC_ALLOC ===
Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.

struct {
__in u32 handle;
__in u32 heapmask;
__in u32 flags; // (0=read-only, 1=read-write)
__in u32 align;
__in u8 kind;
u8 pad[7];
__in u64 addr;
};

=== NVMAP_IOC_FREE ===
This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.

struct {
__in u32 handle;
u32 pad;
__out u64 refcount;
__out u32 size;
__out u32 flags; // 1=NOT_FREED_YET
};

=== NVMAP_IOC_PARAM ===
Returns info about a nvmap object. Identical to Linux driver, but extended with further params.

struct {
__in u32 handle;
__in u32 param; // 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
__out u32 result;
};

=== NVMAP_IOC_GET_ID ===
Returns an id for a nvmap object. Identical to Linux driver.

struct {
__out u32 id; //~0 indicates error
__in u32 handle;
};

== /dev/nvdisp-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80040212 || Out || 4 || TEGRA_DC_EXT_CONTROL_GET_NUM_OUTPUTS ||
|-
| 0xC0140213 || Inout || 20 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_PROPERTIES ||
|-
| 0xC1100214 || Inout || 272 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_EDID ||
|-
| 0xC0040216 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT0 ||
|-
| 0xC0040217 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT1 ||
|-
| 0xC0100218 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT2 ||
|-
| 0xC0100219 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT3 ||
|-
| 0xC0040220 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT4 ||
|-
|}

== /dev/nvdisp-disp0, /dev/nvdisp-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40040201 || In || 4 || TEGRA_DC_EXT_GET_WINDOW ||
|-
| 0x40040202 || In || 4 || TEGRA_DC_EXT_PUT_WINDOW ||
|-
| 0xC4C80203 || In || 1224 || TEGRA_DC_EXT_FLIP ||
|-
| 0x80380204 || Out || 56 || TEGRA_DC_EXT_GET_MODE ||
|-
| 0x40380205 || Out || 56 || TEGRA_DC_EXT_SET_MODE ||
|-
| 0x430C0206 || In || 780 || TEGRA_DC_EXT_SET_LUT ||
|-
| 0x40010207 || In || 1 || TEGRA_DC_EXT_ENABLE_DISABLE_CRC ||
|-
| 0x80040208 || Out || 4 || TEGRA_DC_EXT_GET_CRC ||
|-
| 0x80040209 || Out || 4 || TEGRA_DC_EXT_GET_HEAD_STATUS ||
|-
| 0xC038020A || Inout || 56 || TEGRA_DC_EXT_VALIDATE_MODE ||
|-
| 0x4018020B || In || 24 || TEGRA_DC_EXT_SET_CSC ||
|-
| 0xC004020C || Inout || 4 || TEGRA_DC_EXT_GET_VBLANK_SYNCPT ||
|-
| 0x8040020D || Out || 64 || TEGRA_DC_EXT_GET_UNDERFLOWS ||
|-
| 0xC99A020E || Inout || 2458 || TEGRA_DC_EXT_SET_CMU ||
|-
| 0xC004020F || Inout || 4 || TEGRA_DC_EXT_DPMS ||
|-
| 0x80600210 || Out || 96 || TEGRA_DC_EXT_GET_AVI_INFOFRAME ||
|-
| 0x40600211 || In || 96 || TEGRA_DC_EXT_SET_AVI_INFOFRAME ||
|-
| 0xEBFC0215 || Inout || 11260 || TEGRA_DC_EXT_GET_MODE_DB ||
|-
| 0xC003021A || Inout || 3 || TEGRA_DC_EXT_PANEL_GET_VENDOR_ID ||
|-
| 0x803C021B || Out || 60 || TEGRA_DC_EXT_GET_MODE2 ||
|-
| 0x403C021C || In || 60 || TEGRA_DC_EXT_SET_MODE2 ||
|-
| 0xC03C021D || Inout || 60 || TEGRA_DC_EXT_VALIDATE_MODE2 ||
|-
| 0xEF20021E || Inout || 12064 || TEGRA_DC_EXT_GET_MODE_DB2 ||
|-
| 0xC004021F || Inout || 4 || TEGRA_DC_EXT_GET_WINMASK ||
|-
|}

== /dev/nvcec-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010300 || In || 1 || ||
|-
| 0x40010301 || In || 1 || NVCEC_CTRL_ENABLE ||
|-
| 0x804C0302 || Out || 76 || NVCEC_CTRL_GET_PADDR ||
|-
| 0x40040303 || In || 4 || NVCEC_CTRL_SET_LADDR ||
|-
| 0xC04C0304 || Inout || 76 || NVCEC_CTRL_WRITE ||
|-
| 0xC04C0305 || Inout || 76 || NVCEC_CTRL_READ ||
|-
| 0x804C0306 || Out || 76 || NVCEC_CTRL_GET_CONNECTION_STATUS ||
|-
| 0x804C0307 || Out || 76 || NVCEC_CTRL_GET_WRITE_STATUS ||
|-
|}

== /dev/nvhdcp_up-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC4880401 || Inout || 1160 || TEGRAIO_NVHDCP_READ_M ||
|-
| 0xC4880402 || Inout || 1160 || TEGRAIO_NVHDCP_READ_S ||
|-
| 0x40010403 || In || 1 || TEGRAIO_NVHDCP_ON_OFF ||
|-
|}

== /dev/nvdcutil-disp0, /dev/nvdcutil-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010501 || In || 1 || ||
|-
| 0x40010502 || In || 1 || ||
|-
| 0x42040503 || In || 1056 || ||
|-
| 0x803C0504 || Out || 60 || NVDCUTIL_DISP_IOCTL_GET_DISPLAY_INFO ||
|-
|}

== /dev/nvsched-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x00000601 || - || 0 || ||
|-
| 0x00000602 || - || 0 || ||
|-
| 0x40180603 || In || 1056 || ||
|-
| 0x40180604 || In || 60 || ||
|-
| 0x40080605 || In || 60 || ||
|-
| 0x80080606 || Out || 60 || ||
|-
| 0x80080607 || Out || 60 || ||
|-
| 0x40180608 || In || 24 || ||
|-
| 0x40100609 || In || 16 || ||
|-
| 0x4010060A || In || 16 || ||
|-
| 0x4008060B || In || 8 || ||
|-
| 0x8001060C || Out || 1 || ||
|-
| 0x8010060D || Out || 16 || ||
|-
| 0x400C060E || In || 12 || ||
|-
| 0x4008060F || In || 8 || ||
|-
| 0x40100610 || In || 16 || ||
|-
| 0x40100611 || In || 16 || ||
|-
|}

== /dev/nverpt-ctrl ==
Added in firmware version 4.0.0.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC1280701 || Inout || 296 || ||
|-
| 0xCF580702 || Inout || 3928 || ||
|-
|}

== /dev/nvhost-as-gpu ==
Each fd opened to this device creates an address space. An address space is then later bound with a channel.

Once a nvgpu channel has been bound to an address space it cannot be unbound. There is no support for allowing an nvgpu channel to change from one address space to another (or from one to none).

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40044101 || In || 4 || [[#NVGPU_AS_IOCTL_BIND_CHANNEL]] ||
|-
| 0xC0184102 || Inout || 24 || [[#NVGPU_AS_IOCTL_ALLOC_SPACE]] ||
|-
| 0xC0104103 || Inout || 16 || [[#NVGPU_AS_IOCTL_FREE_SPACE]] ||
|-
| 0xC0184104 || Inout || 24 || [[#NVGPU_AS_IOCTL_MAP_BUFFER]] ||
|-
| 0xC0084105 || Inout || 8 || [[#NVGPU_AS_IOCTL_UNMAP_BUFFER]] ||
|-
| 0xC0284106 || Inout || 40 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX]] ||
|-
| 0x40104107 || In || 16 || [[#NVGPU_AS_IOCTL_INITIALIZE]] ||
|-
| 0xC0404108 || Inout || 64 || [[#NVGPU_AS_IOCTL_GET_VA_REGIONS]] ||
|-
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_INITIALIZE_EX]] ||
|-
| 0xC0??4114 || Inout || Variable || [[#NVGPU_AS_IOCTL_REMAP]] ||
|}

=== NVGPU_AS_IOCTL_BIND_CHANNEL ===
Identical to Linux driver.

struct {
__in u32 fd;
};

=== NVGPU_AS_IOCTL_ALLOC_SPACE ===
This one reserves pages in the device address space.

struct {
__in u32 pages;
__in u32 page_size;
__in u32 flags;
u32 pad;
union {
__out u64 offset;
__in u64 align;
};
};

=== NVGPU_AS_IOCTL_FREE_SPACE ===
struct {
__in u64 offset;
__in u32 pages;
__in u32 page_size;
};

=== NVGPU_AS_IOCTL_MAP_BUFFER ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
u32 pad;
__in u32 nvmap_handle;
__inout u32 page_size; // 0 means don't care
union {
__out u64 offset;
__in u64 align;
};
};

=== NVGPU_AS_IOCTL_MAP_BUFFER_EX ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__in u32 kind; // -1 is default
__in u32 nvmap_handle;
__inout u32 page_size; // 0 means don't care
__in u64 buffer_offset;
__in u64 mapping_size;
__inout u64 offset;
};

=== NVGPU_AS_IOCTL_UNMAP_BUFFER ===
Unmap a memory region from the device address space.

struct {
__in u64 offset;
};

=== NVGPU_AS_IOCTL_INITIALIZE ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable).

struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u32 flags; // ignored; passes 0
__in u32 reserved; // ignored; passes 0
};

=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
Nintendo modified to get rid of pointer in struct.

struct va_region {
u64 offset;
u32 page_size;
u32 pad;
u64 pages;
};

struct {
u64 not_used; // (contained output user ptr on linux, ignored)
__inout u32 bufsize; // forced to 2*sizeof(struct va_region)
u32 pad;
__out struct va_region regions[2];
};

=== NVGPU_AS_IOCTL_INITIALIZE_EX ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable) with extra params.

struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u32 flags; // passes 0
__in u32 reserved; // ignored; passes 0
__in u64 unk0;
__in u64 unk1;
__in u64 unk2;
};

=== NVGPU_AS_IOCTL_REMAP ===
Nintendo's custom implementation of address space remapping.

struct remap_entry {
__in u16 flags; // 0 or 4
__in u16 kind;
__in u32 nvmap_handle;
__in u32 padding;
__in u32 offset; // (alloc_space_offset >> 0x10)
__in u32 pages; // alloc_space_pages
};

struct {
__in struct remap_entry entries[];
};

== /dev/nvhost-dbg-gpu ==
Not accessible, but there is code to invoke it.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40084401 || In || 8 || NVGPU_DBG_GPU_IOCTL_BIND_CHANNEL ||
|-
| 0xC0??4402 || Inout || Variable || NVGPU_DBG_GPU_IOCTL_REG_OPS ||
|-
| 0x40084403 || In || 8 || NVGPU_DBG_GPU_IOCTL_EVENTS_CTRL ||
|-
| 0x40044404 || In || 4 || NVGPU_DBG_GPU_IOCTL_POWERGATE ||
|-
| 0x40044405 || In || 4 || NVGPU_DBG_GPU_IOCTL_SMPC_CTXSW_MODE ||
|-
| 0xC0184407 || Inout || 24 || NVGPU_DBG_GPU_IOCTL_PERFBUF_MAP ||
|-
| 0x40084408 || In || 8 || NVGPU_DBG_GPU_IOCTL_PERFBUF_UNMAP ||
|-
| 0x40084409 || In || 8 || NVGPU_DBG_GPU_IOCTL_PC_SAMPLING ||
|-
| 0x4008440A || In || 8 || NVGPU_DBG_GPU_IOCTL_TIMEOUT ||
|-
| 0x8008440B || Out || 8 || NVGPU_DBG_GPU_IOCTL_GET_TIMEOUT ||
|-
| 0x8004440C || Out || 4 || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT_SIZE ||
|-
| 0x0000440D || None || 0 || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT (uses Ioctl3) ||
|-
|}

== /dev/nvhost-ctrl-gpu ==
This device is for global (context independent) operations on the gpu.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80044701 || Out || 4 || [[#NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE]] ||
|-
| 0x80284702 || Out || 40 || [[#NVGPU_GPU_IOCTL_ZCULL_GET_INFO]] ||
|-
| 0x402C4703 || In || 44 || [[#NVGPU_GPU_IOCTL_ZBC_SET_TABLE]] ||
|-
| 0xC0344704 || Inout || 52 || [[#NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE]] ||
|-
| 0xC0B04705 || Inout || 176 || [[#NVGPU_GPU_IOCTL_GET_CHARACTERISTICS]] ||
|-
| 0xC0184706 || Inout || 24 || NVGPU_GPU_IOCTL_GET_TPC_MASKS ||
|-
| 0x40084707 || In || 8 || [[#NVGPU_GPU_IOCTL_FLUSH_L2]] ||
|-
| 0x4008470E || In || 8 || NVGPU_GPU_IOCTL_SET_MMUDEBUG_MODE ||
|-
| 0x4010470F || In || 16 || NVGPU_GPU_IOCTL_SET_SM_DEBUG_MODE ||
|-
| 0xC0084710 || Inout || 8 || NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE ||
|-
| 0x80084711 || Out || 8 || NVGPU_GPU_IOCTL_GET_TPC_EXCEPTION_EN_STATUS ||
|-
| 0x80084712 || Out || 8 || NVGPU_GPU_IOCTL_NUM_VSMS ||
|-
| 0xC0044713 || Inout || 4 || NVGPU_GPU_IOCTL_VSMS_MAPPING ||
|-
| 0x80084714 || Out || 8 || [[#NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK]] ||
|-
| 0x80044715 || Out || 4 || ||
|-
| 0x8018471A || Out || 24 || ||
|-
| 0xC008471B || Inout || 8 || NVGPU_GPU_IOCTL_GET_ERROR_CHANNEL_USER_DATA ||
|-
| 0xC010471C || Inout || 16 || NVGPU_GPU_IOCTL_GET_GPU_TIME ||
|-
| 0xC108471D || Inout || 264 || NVGPU_GPU_IOCTL_GET_CPU_TIME_CORRELATION_INFO ||
|}

=== NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE ===
Returns the GPU's ZCULL context size. Identical to Linux driver.

struct {
__out u32 size;
};

=== NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE ===
Returns GPU's ZCULL information. Identical to Linux driver.

struct {
__out u32 width_align_pixels;
__out u32 height_align_pixels;
__out u32 pixel_squares_by_aliquots;
__out u32 aliquot_total;
__out u32 region_byte_multiplier;
__out u32 region_header_size;
__out u32 subregion_header_size;
__out u32 subregion_width_align_pixels;
__out u32 subregion_height_align_pixels;
__out u32 subregion_count;
};

=== NVGPU_GPU_IOCTL_ZBC_SET_TABLE ===
Sets the active ZBC table. Identical to Linux driver.

struct {
__in u32 color_ds[4];
__in u32 color_l2[4];
__in u32 depth;
__in u32 format;
__in u32 type; // 1=color, 2=depth
};

=== NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE ===
Queries the active ZBC table. Identical to Linux driver.

struct {
__out u32 color_ds[4];
__out u32 color_l2[4];
__out u32 depth;
__out u32 ref_cnt;
__out u32 format;
__out u32 type;
__inout u32 index_size;
};

=== NVGPU_GPU_IOCTL_GET_CHARACTERISTICS ===
Returns the GPU characteristics. Modified to return inline data instead of using a pointer.

struct gpu_characteristics {
u32 arch; // 0x120 (NVGPU_GPU_ARCH_GM200)
u32 impl; // 0xB (NVGPU_GPU_IMPL_GM20B)
u32 rev; // 0xA1 (Revision A1)
u32 num_gpc; // 0x1
u64 l2_cache_size; // 0x40000
u64 on_board_video_memory_size; // 0x0 (not used)
u32 num_tpc_per_gpc; // 0x2
u32 bus_type; // 0x20 (NVGPU_GPU_BUS_TYPE_AXI)
u32 big_page_size; // 0x20000
u32 compression_page_size; // 0x20000
u32 pde_coverage_bit_count; // 0x1B
u32 available_big_page_sizes; // 0x30000
u32 gpc_mask; // 0x1
u32 sm_arch_sm_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 sm_arch_spa_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 sm_arch_warp_count; // 0x80
u32 gpu_va_bit_count; // 0x28
u32 reserved; // NULL
u64 flags; // 0x55
u32 twod_class; // 0x902D (FERMI_TWOD_A)
u32 threed_class; // 0xB197 (MAXWELL_B)
u32 compute_class; // 0xB1C0 (MAXWELL_COMPUTE_B)
u32 gpfifo_class; // 0xB06F (MAXWELL_CHANNEL_GPFIFO_A)
u32 inline_to_memory_class; // 0xA140 (KEPLER_INLINE_TO_MEMORY_B)
u32 dma_copy_class; // 0xB0B5 (MAXWELL_DMA_COPY_A)
u32 max_fbps_count; // 0x1
u32 fbp_en_mask; // 0x0 (disabled)
u32 max_ltc_per_fbp; // 0x2
u32 max_lts_per_ltc; // 0x1
u32 max_tex_per_tpc; // 0x0 (not supported)
u32 max_gpc_count; // 0x1
u32 rop_l2_en_mask_0; // 0x21D70 (fuse_status_opt_rop_l2_fbp_r)
u32 rop_l2_en_mask_1; // 0x0
u64 chipname; // 0x6230326D67 ("gm20b")
u64 gr_compbit_store_base_hw; // 0x0 (not supported)
};

struct {
__inout u64 gpu_characteristics_buf_size; // must not be NULL, but gets overwritten with 0xA0=max_size
__in u64 gpu_characteristics_buf_addr; // ignored, but must not be NULL
__out struct gpu_characteristics gc;
};

=== NVGPU_GPU_IOCTL_FLUSH_L2 ===
Flushes the GPU L2 cache.

struct {
__in u32 flush; // l2_flush | l2_invalidate << 1 | fb_flush << 2
u32 reserved;
};

=== NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK ===
Returns the mask value for a ZBC slot.

struct {
__out u32 slot; // always 0x07
__out u32 mask;
};

== Channels ==
Channels are a concept for NVIDIA hardware blocks that share a common interface.

{| class="wikitable" border="1"
! Path || Name
|-
| /dev/nvhost-gpu ||
|-
| /dev/nvhost-vic || Video Image Compositor
|-
| /dev/nvhost-nvdec || Video Decoder
|-
| /dev/nvhost-nvjpg || JPEG Decoder
|}

== Channel Ioctls ==
{| class="wikitable" border="1"
! Value || Size || Description || Notes
|-
| 0xC0??0001 || Variable || NVHOST_IOCTL_CHANNEL_SUBMIT ||
|-
| 0xC0080002 || 8 || NVHOST_IOCTL_CHANNEL_GET_SYNCPOINT ||
|-
| 0xC0080003 || 8 || NVHOST_IOCTL_CHANNEL_GET_WAITBASE ||
|-
| 0xC0080004 || 8 || NVHOST_IOCTL_CHANNEL_SET_TIMEOUT_EX ||
|-
| 0x40040007 || 4 || ||
|-
| 0x40080008 || 8 || NVHOST_IOCTL_CHANNEL_SET_CLK_RATE ||
|-
| 0xC0??0009 || Variable || NVHOST_IOCTL_CHANNEL_MAP_BUFFER ||
|-
| 0xC0??000A || Variable || NVHOST_IOCTL_CHANNEL_UNMAP_BUFFER ||
|-
| 0x00000013 || 0 || ||
|- style="border-top: double"
| 0x40044801 || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD]] ||
|-
| 0x40044803 || 4 || NVGPU_IOCTL_CHANNEL_SET_TIMEOUT ||
|-
| 0x40084805 || 8 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO]] ||
|-
| 0xC0044807 || 4 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS ||
|-
| 0xC0??4808 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]] ||
|-
| 0xC0104809 || 16 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX]] ||
|-
| 0xC010480B || 16 || [[#NVGPU_IOCTL_CHANNEL_ZCULL_BIND]] ||
|-
| 0xC018480C || 24 || [[#NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER]] ||
|-
| 0x4004480D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_PRIORITY]] ||
|-
| 0x0000480E || 0 || [[#NVGPU_IOCTL_CHANNEL_ENABLE]] ||
|-
| 0x0000480F || 0 || [[#NVGPU_IOCTL_CHANNEL_DISABLE]] ||
|-
| 0x00004810 || 0 || [[#NVGPU_IOCTL_CHANNEL_PREEMPT]] ||
|-
| 0x00004811 || 0 || [[#NVGPU_IOCTL_CHANNEL_FORCE_RESET]] ||
|-
| 0x40084812 || 8 || [[#NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL]] ||
|-
| 0xC0104813 || 16 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS_SNAPSHOT ||
|-
| 0x80804816 || 128 || NVGPU_IOCTL_CHANNEL_GET_ERROR_INFO ||
|-
| 0xC0104817 || 16 || [[#NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION]] ||
|-
| 0x40204818 || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]] ||
|-
| 0xC0??4819 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]] ||
|-
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]] ||
|-
| 0xC018481B || 24 || (uses Ioctl2) ||
|-
| 0xC018481C || 24 || (uses Ioctl2) ||
|-
|- style="border-top: double"
| 0x40084714 || 8 || NVGPU_IOCTL_CHANNEL_SET_USER_DATA || Sets an unknown user context address
|-
| 0x80084715 || 8 || NVGPU_IOCTL_CHANNEL_GET_USER_DATA || Gets an unknown user context address
|}

=== NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD ===
Binds a nvmap object to this channel. Identical to Linux driver.

struct {
__in u32 nvmap_fd;
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO ===
Allocates gpfifo entries. Identical to Linux driver.

struct {
__in u32 num_entries;
__in u32 flags;
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO ===
Submits a gpfifo object. Modified to take inline entry objects instead of a pointer.

struct fence {
u32 id;
u32 value;
};

struct gpfifo_entry {
u32 entry0; // gpu_va_lo
u32 entry1; // gpu_va_hi | (unk_0x02 << 0x08) | (size << 0x0A) | (unk_0x01 << 0x1F)
};

struct {
__in u64 gpfifo; // (ignored) pointer to gpfifo fence structs
__in u32 num_entries; // number of fence objects being submitted
__in u32 flags;
__out struct fence fence_out; // returned new fence object for others to wait on
__in struct gpfifo_entry entries[]; // depends on num_entries
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX ===
Allocates a graphics context object. Modified to ignore object's ID.

struct {
__in u32 class_num; // 0x902D=2d, 0xB197=3d, 0xB1C0=compute, 0xA140=kepler, 0xB0B5=DMA, 0xB06F=channel_gpfifo
__in u32 flags;
__out u64 obj_id; // (ignored) used for FREE_OBJ_CTX ioctl, which is not supported
};

=== NVGPU_IOCTL_CHANNEL_ZCULL_BIND ===
Binds a ZCULL context to the channel. Identical to Linux driver.

struct {
__in u64 gpu_va;
__in u32 mode; // 0=global, 1=no_ctxsw, 2=separate_buffer, 3=part_of_regular_buf
__in u32 padding;
};

=== NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER ===
Initializes the error notifier for this channel. Identical to Linux driver.

struct {
__in u64 offset;
__in u64 size;
__in u32 mem; // nvmap object handle
__in u32 padding;
};

=== NVGPU_IOCTL_CHANNEL_SET_PRIORITY ===
Change channel's priority. Identical to Linux driver.

struct {
__in u32 priority; // 0x32 is low, 0x64 is medium and 0x96 is high
};

=== NVGPU_IOCTL_CHANNEL_ENABLE ===
Enables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_DISABLE ===
Disables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_PREEMPT ===
Clears the FIFO pipe for this channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_FORCE_RESET ===
Forces the channel to reset. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL ===
Controls event notifications.

struct {
__in u32 cmd; // 0=disable, 1=enable, 2=clear
__in u32 id;
};

=== NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION ===
Returns the current error notification caught by the error notifier. Exclusive to the Switch.

struct {
__out u64 timestamp; // nanoseconds since Jan. 1, 1970
__out u32 info32; // error code
__out u16 info16; // additional error info
__inout u16 status; // always 0xFFFF
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY ===
Allocates gpfifo entries with additional parameters. Exclusive to the Switch.

struct {
__in u32 num_entries;
__in u32 flags;
__in u32 unk0; // 1 works
__in u32 unk1;
__in u32 unk2;
__in u32 unk3;
__in u32 unk4;
__in u32 unk5;
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX ===
Submits a gpfifo object (async version). Exclusive to the Switch.

struct {
u64 __gpfifo; // in (pointer to gpfifo fence structs; ignored)
u32 __num_entries; // in (number of fence objects being submitted)
u32 __flags; // in
struct fence __fence_out; // out (returned new fence object for others to wait on)
struct gpfifo_entry __entries[]; // in (depends on __num_entries)
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2 ===
Allocates gpfifo entries with additional parameters and returns a fence. Exclusive to the Switch.

struct {
u32 __num_entries; // in
u32 __flags; // in
u32 __unk0; // in (1 works)
struct fence __fence_out; // out
u32 __unk1; // in
u32 __unk2; // in
u32 __unk3; // in
};

= nvmemp =
NVIDIA memory profiler (this service is not available on retail units).

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Cmd0
|-
| 1 || Cmd1
|}

= nvdrvdbg =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenLog]]
|-
| 1 || [[#CloseLog]]
|-
| 2 || [[#ReadLog]]
|}

== OpenLog ==
Takes process handle. Returns an fd.

== CloseLog ==
Takes fd and closes it.

== ReadLog ==
Takes fd and reads log into a type-6 buffer.

= Errors =
Most nvidia driver commands return an error code apart from the normal return code.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Success
|-
| 1 || NotImplemented
|-
| 2 || NotSupported
|-
| 3 || NotInitialized
|-
| 4 || BadParameter
|-
| 5 || Timeout
|-
| 6 || InsufficientMemory
|-
| 7 || ReadOnlyAttribute
|-
| 8 || InvalidState
|-
| 9 || InvalidAddress
|-
| 0xA || InvalidSize
|-
| 0xB || BadValue
|-
| 0xD || AlreadyAllocated
|-
| 0xE || Busy
|-
| 0xF || ResourceError
|-
| 0x10 || CountMismatch
|-
| 0x1000 || SharedMemoryTooSmall
|-
| 0x30003 || FileOperationFailed
|-
| 0x3000F || IoctlFailed
|}

= Panic =
In some cases, a panic may occur. NV forces a crash by doing:
(void *)0 = 0xCAFE;
End result is that the system hangs with a white-screen.

== Gpfifo Panic ==
When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.

[[Category:Services]]

SVC

2018-01-14T23:15:29Z

OgniK: Added idle tick count

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano || W0=result
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || svcCancelSynchronization || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || svcGetSystemTick || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=event_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W0=thread_handle || W0=result, X1=out
|-
| 0x26 || svcBreak || X0,X1,X2=info || ?
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory|| X0=addr, X1=size || W0=result
|- style="border-top: double"
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || W0=thread_handle, W1=[[#ThreadContext]]* || W0=result
|-
| 0x34 || [4.0.0+] || X0=ptr, W1=type, X2=? X3=timeout ||
|-
| 0x35 || [4.0.0+] || X0=ptr, W1=type, X2=? W3=? ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=client_handle ?, W2=server_handle ?
|- style="border-top: double"
| 0x4B || [4.0.0+] [[#svcCreateJitMemory]] || X1=addr, X2=size || W0=result, W1=jit_handle
|-
| 0x4C || [4.0.0+] [[#svcMapJitMemory]] || W0=jit_handle, W1=[[#MapJitOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || svcCreateInterruptEvent || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=DebugEventInfo*, W1=debug_handle || W0=result
|-
| 0x64 || svcContinueDebugEvent || W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id || W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, W1=[[#ThreadContextFlags]], X2=ThreadContext* || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || svcSetHardwareBreakPoint || W0=HardwareBreakpointId, X1=watchpoint_flags, X2=watchpoint_value/debug_handle? ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x70 || svcCreatePort || W2=max_sessions, W3=unk_bool, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=srcaddr, W1=process_handle, X2=dstaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X2=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x2000000.

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

[2.0.0+] Size must be less than 0x18000000.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

If dstaddr >= LowerTreshold, the dst-range is enforced to be within the process' "MapRegion". Code can get the range of this region from [[#svcGetInfo]] id0=2,3.

In this case, the mapped memory will have state 0x5C3C0B.

As long as (dstaddr+size) < LowerThreshold, then you can map anywhere but the mapped memory will have state 0x482907 instead.

LowerTreshold is 0x80000000 for 36-bit address spaces, and 0x40000000 for 32-bit ones.

[2.0.0+] Support for the 0x482907 mappings outside the "MapRegion" were removed.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || ThreadContext
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Nano
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nano=0 means "yield thread".

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40, error on num_handles == 0.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''Port:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''Session (server-side):''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

=== Result codes ===

'''0x0:''' Success. One of the objects was signalled before the timeout expired. Handle index is updated to indicate which object signalled.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signalled within the timeout. Handle index is not updated.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must be 0x1000-aligned.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 ||
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) ? || ? || ?
|}
</div>

When used on retail where inx0 bit31 is clear, the system will throw a [[Error_codes|fatal-error]]. Otherwise when bit31 is set, it will return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || MapRegionBaseAddr
|-
| Process || 3 || 0 || MapRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryUsage
|-
| Process || 7 || 0 || TotalHeapUsage
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] NewMapRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] NewMapRegionSize
|-
| Process || 16 || 0 || [3.0.0+] IsVirtualAddressMemoryEnabled
|-
| Process || 17 || 0 || [3.0.0+] Some size in bytes.
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0+] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0+] PrivilegedProcessId_UpperBound
|-
| Thread || 0xF0000002 || 0 || Performance counter related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcCreateJitMemory ==
Takes an address range with backing memory to create the JIT memory object.

The memory is initially memset to 0xFF after being locked.

== svcMapJitMemory ==
Maps the backing memory for a JIT memory object into the current process.

For [[#MapJitOperation|MapJitOperation_MapOwner]], memory permission must be RW-.

For [[#MapJitOperation|MapJitOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#MapJitOperation|MapJitOperation_UnmapOwner/MapJitOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the memory as RW-, and the other "slave" process to map it R-X.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || SrcAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || DstAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || void* || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u64 || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== MapJitOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || MapJitOperation_MapOwner
|-
| 1 || MapJitOperation_MapSlave
|-
| 2 || MapJitOperation_UnmapOwner
|-
| 3 || MapJitOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessEvent ==
{| class=wikitable
! Value || Name
|-
| 0 || ProcessEvent_Created
|-
| 1 || ProcessEvent_DebugAttached
|-
| 2 || ProcessEvent_DebugDetached
|-
| 3 || ProcessEvent_Crashed
|-
| 4 || ProcessEvent_Running
|-
| 5 || ProcessEvent_Exiting
|-
| 6 || ProcessEvent_Exited
|-
| 7 || ProcessEvent_DebugSuspended
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_ActualPriority
|-
| 1 ||
|-
| 2 || DebugThreadParam_CpuCore
|-
| 3 ||
|-
| 4 || DebugThreadParam_CoreMask
|}

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || Is64bit
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 ||
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsSystem
|-
| 0x28 || 4 || || ResourceLimitHandle
|-
| 0x2C || 4 ||
|}

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] JitMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_WeirdSharedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_MappedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_JitReadOnly || Mapped in kernel during [[#svcMapJitMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_JitWritable || Mapped in kernel during [[#svcMapJitMemory]].
|}

== ContinueDebugFlags ==
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || SwallowException
|-
| 1 || 2 ||
|-
| 2 || 4 || ResumeAllThreads
|}

== DebugEventInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || Type (0=PausedThread, 1=RunningThread, 2=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 ||
|-
| 3 || DebugEvent_Exit
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_UndefinedInstruction
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|}

UndefinedInstruction specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
There is userland code for handling exceptions, however this doesn't seem to be executed on retail mode.

When a usermode exception occurs, it jumps to the main code binary entrypoint (main_binary_address + 0 == '''_start''').

During normal boot '''_start''' is invoked with X0=0 and X1=main_thread_handle (triggering normal crt0 setup).
During an usermode exception '''_start''' is invoked with X0=exception_info0_ptr and X1=exception_info1_ptr instead.

The '''_start''' method determines whether to boot normally or handle an exception if X0 is set to 0 or not.

Filesystem services

2018-01-14T22:48:54Z

OgniK: Added cmd names to IDeviceOperator

= fsp-ldr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Notes
|-
| 0 || MountCode || u64 TitleId + X descriptor [[#ContentPath]] || Returns an [[#IFileSystem]].
|-
| 1 || IsCodeMounted || u64 ProcessId || Returns a bool (1 if code is mounted).
|-
| 2 || [4.0.0+] Initialize || PID descriptor ||
|}

= fsp-pr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#SetFsPermissions]] ||
|-
| 1 || [[#ClearFsPermissions]] ||
|-
| 2 || [4.0.0+] Initialize ||
|-
| 256 || [[#SetEnabledProgramVerification]] ||
|}

== SetFsPermissions ==
Takes a storageID, a pid, a titleID, a 0x1C type-A buffer for the [[NPDM#FS_Access_Header| FS Access Header]], and a 0x2C type-A buffer for the [[NPDM#FS_Access_Control| FS Access Control]]

Final FS permissions are stored as (ACI0_perms & ACID_perms). Will panic(svcBreak) when buffer sizes from ipc-rawdata are invalid.

== ClearFsPermissions ==
Takes a pid. Removes registered FS permissions for that PID.

== SetEnabledProgramVerification ==
Seems to sets a global flag to inputval & 1.

When the flag is zero, it will set ret=0 instead of ret={error} when verifying a RSA signature fails. This RSA signature seems to be the signature in the [[NPDM]] ACID. It then skips verifying what seems to be the second signature in the [[NCA_Format|NCA header]]. Note that if verifying the NPDM(?) signature is successful, and verifying that second signature fails, it will throw an error and abort.

= fsp-srv =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0] [[#MountContent]]
|-
| 1 || [[#Initialize]]
|-
| 2 || OpenDataFileSystemByCurrentProcess
|-
| 7 || [2.0.0+] [[#MountContent7]]
|-
| 8 || [2.0.0+] [[#MountContent]]
|-
| 9 || [3.0.0+] OpenDataFileSystemByApplicationId
|-
| 11 || [[#MountBis]]
|-
| 12 || [[#OpenBisPartition]]
|-
| 13 || InvalidateBisCache
|-
| 17 || OpenHostFileSystemImpl
|-
| 18 || MountSdCard
|-
| 19 || [2.0.0+] FormatSdCard
|-
| 21 || [[#DeleteSaveData]]
|-
| 22 || [[#CreateSaveData]]
|-
| 23 || [[#CreateSystemSaveData]]
|-
| 24 || RegisterSaveDataAtomicDeletion
|-
| 25 || [2.0.0+] DeleteSaveDataWithSpaceId
|-
| 26 || [2.0.0+] FormatSdCardDryRun
|-
| 27 || [2.0.0+] IsExFatSupported
|-
| 28 || [4.0.0+] DeleteSystemSaveData
|-
| 30 || [[#OpenGameCardPartition]]
|-
| 31 || [[#MountGameCardPartition]]
|-
| 32 || [3.0.0+] ExtendSaveData
|-
| 51 || [[#MountSaveData]]
|-
| 52 || [[#MountSystemSaveData]]
|-
| 53 || [2.0.0+] MountSaveDataReadOnly
|-
| 57 || [3.0.0+] ReadSaveDataFileSystemExtraDataWithSpaceId
|-
| 58 || ReadSaveDataFileSystemExtraData
|-
| 59 || [2.0.0+] WriteSaveDataFileSystemExtraData
|-
| 60 || OpenSaveDataInfoReader
|-
| 61 || OpenSaveDataIterator
|-
| 80 || OpenSaveDataThumbnailFile
|-
| 81 || [4.0.0+] OpenSaveDataTransferManager
|-
| 100 || MountImageDirectory
|-
| 110 || [[#MountContentStorage]]
|-
| 200 || OpenDataStorageByCurrentProcess
|-
| 201 || [3.0.0+] OpenDataStorageByApplicationId
|-
| 202 || [[#OpenDataStorageByDataId]]
|-
| 203 || Returns an [[#IStorage]]
|-
| 400 || [[#OpenDeviceOperator]]
|-
| 500 || [[#OpenSdCardDetectionEventNotifier]]
|-
| 501 || [[#OpenGameCardDetectionEventNotifier]]
|-
| 600 || [1.0.0-3.0.2] SetCurrentPosixTime
|-
| 601 || QuerySaveDataTotalSize
|-
| 602 || [[#VerifySaveData]]
|-
| 603 || CorruptSaveDataForDebug
|-
| 604 || CreatePaddingFile
|-
| 605 || DeleteAllPaddingFiles
|-
| 606 || [2.0.0+] GetRightsId
|-
| 607 || [2.0.0+] RegisterExternalKey
|-
| 608 || [2.0.0+] UnregisterExternalKey
|-
| 609 || [2.0.0+] GetRightsIdByPath
|-
| 610 || [3.0.0+] GetRightsIdByPath2 (returns extra byte)
|-
| 611 || [4.0.0+] SetCurrentPosixTime
|-
| 612 || [4.0.0+] GetFreeSpaceSize
|-
| 613 || [4.0.0+]
|-
| 614 || [4.0.0+]
|-
| 620 || [2.0.0+] [[#SetSdCardEncryptionSeed]]
|-
| 630 || [4.0.0+] SetSdCardAccessibility
|-
| 631 || [4.0.0+] IsSdCardAccessible
|-
| 640 || [4.0.0+] IsSignedSystemPartitionOnSdCardValid
|-
| 800 || [2.0.0+] GetAndClearFileSystemProxyErrorInfo
|-
| 1000 || SetBisRootForHost
|-
| 1001 || SetSaveDataSize
|-
| 1002 || SetSaveDataRootPath
|-
| 1003 || DisableAutoSaveDataCreation
|-
| 1004 || [[#SetGlobalAccessLogMode]]
|-
| 1005 || [[#GetGlobalAccessLogMode]]
|-
| 1006 || [[#OutputAccessLogToSdCard]]
|-
| 1007 || [4.0.0+] RegisterUpdatePartition
|-
| 1008 || [4.0.0+] MountRegisteredUpdatePartition
|-
| 1009 || [4.0.0+]
|-
| 1100 || [4.0.0+] OverrideSaveDataTransferTokenSignVerificationKey
|}

== Permissions ==
Every time permissions are checked, the process registration [[#fsp-pr]] is loaded using the session processID. The permission data is populated with data from the [[NPDM]],

If the processID is <= 6 (which happens only for built-in sysmodules), it will use a hardcoded registration data. The default mask in this case is 0x8000000000000000.

Note that the functions check whether or not at least one bit is set in the mask. This means that, you don't need to set 0xFFFFFFFFFFFFFFFF to get all permissions: it suffices to set 0x8000000000000000.

If the code were to request an invalid input type, panic. But this never happens.

=== RwPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Value || Used by
|-
| 0x0 || 0x8000000000000801 || MountContentType2 || 1 || [[#MountContent]]
|-
| 0x1 || 0x8000000000000801 || MountContentType5 || 1 || [[#MountContent]]
|-
| 0x2 || 0x8000000000000801 || MountContentType3 || 1 || [[#MountContent]]
|-
| 0x3 || 0x8000000000000801 || MountContentType4 || 1 || [[#MountContent]]
|-
| 0x4 || 0x8000000000000801 || MountContentType6 || 1 || [[#MountContent]]
|-
| 0x5 || 0x8000000000000801 || MountContentType7 || 1 || [[#MountContent]]
|-
| 0x6 || 0x8000000000000000 || || 3 ||
|-
| 0x7 || 0x8000000000000800 || ContentStorageAccess || 3 || [[#MountContentStorage]]
|-
| 0x8 || 0x8000000000001000 || ImageDirectoryAccess || 3 || [[#MountImageDirectory]]
|-
| 0x9 || 0x8000000000000084 || MountBisType28 || 3 || [[#MountBis]]
|-
| 0xA || 0x8000000000000080 || MountBisType29 || 3 || [[#MountBis]]
|-
| 0xB || 0x8000000000008080 || MountBisType30 || 3 || [[#MountBis]]
|-
| 0xC || 0x8000000000008080 || MountBisType31 || 3 || [[#MountBis]]
|-
| 0xD || 0x8000000000000080 || || 3 ||
|-
| 0xE || 0xC000000000200000 || SdCardAccess || 3 || [[#MountSdCard]]
|-
| 0xF || 0x8000000000000010 || GameCardUser || 3 || [[#MountGameCardPartition]]
|-
| 0x10 || 0x8000000000040020 || SaveDataAccess0 || 3 || [[#MountSaveData]]
|-
| 0x11 || 0x8000000000000028 || SystemSaveDataAccess0 || 3 || [[#MountSystemSaveData]]
|-
| 0x12 || 0x8000000000000020 || SaveDataAccess1 || 3 || [[#MountSaveData]]
|-
| 0x13 || 0x8000000000000020 || SystemSaveDataAccess1 || 3 || [[#MountSystemSaveData]]
|-
| 0x14 || 0x8000000000010082 || BisPartition0 || 3 || [[#OpenBisPartition]]
|-
| 0x15 || 0x8000000000010080 || BisPartition10 || 3 || [[#OpenBisPartition]]
|-
| 0x17 || 0x8000000000010080 || BisPartition20 || 3 || [[#OpenBisPartition]]
|-
| 0x18 || 0x8000000000010080 || BisPartition21 || 3 || [[#OpenBisPartition]]
|-
| 0x19 || 0x8000000000010080 || BisPartition22 || 3 || [[#OpenBisPartition]]
|-
| 0x1A || 0x8000000000010080 || BisPartition23 || 3 || [[#OpenBisPartition]]
|-
| 0x1B || 0x8000000000010080 || BisPartition24 || 3 || [[#OpenBisPartition]]
|-
| 0x1C || 0x8000000000010080 || BisPartition25 || 3 || [[#OpenBisPartition]]
|-
| 0x16 || 0x8000000000000080 || BisPartition26 || 3 || [[#OpenBisPartition]]
|-
| 0x1D || 0x8000000000000084 || BisPartition27 || 3 || [[#OpenBisPartition]]
|-
| 0x1E || 0x8000000000000084 || BisPartition28 || 3 || [[#OpenBisPartition]]
|-
| 0x1F || 0x8000000000000080 || BisPartition29 || 3 || [[#OpenBisPartition]]
|-
| 0x20 || 0x8000000000000080 || BisPartition30 || 3 || [[#OpenBisPartition]]
|-
| 0x21 || 0x8000000000000080 || BisPartition31 || 3 || [[#OpenBisPartition]]
|-
| 0x22 || 0x8000000000000080 || BisPartition32 || 3 || [[#OpenBisPartition]]
|-
| 0x23 || 0xC000000000200000 || || 3 ||
|-
| 0x24 || 0x8000000000000100 || GameCard_System || 3 || [[#OpenGameCardPartition]], [[#EraseGameCard]] (bit1), [[#WriteToGameCard]] (bit1)
|-
| 0x25 || 0x8000000000100008 || MountContent_System || 1 || [[#MountContent]], [[#OpenDataStorageByDataId]]
|-
| 0x26 || 0xC000000000400000 || HostAccess || 3 || [[#OpenHostFileSystemImpl]]
|}

=== BoolPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Used by
|-
| 0x0 || 0x8000000000000080 || BisCache || [[#InvalidateBisCache]]
|-
| 0x1 || 0x8000000000000080 || EraseMmc || [[#EraseMmc]]
|-
| 0x2 || 0x8000000000000010 || GameCardCertificate || [[#GetGameCardDeviceCertificate]]
|-
| 0x3 || 0x8000000000000010 || GameCardIdSet || [[#GetGameCardIdSet]]
|-
| 0x4 || 0x8000000000000200 || GameCardDriver || [[#FinalizeGameCardDriver]]
|-
| 0x5 || 0x8000000000000200 || GameCardAsic || [[#GetGameCardAsicInfo]]
|-
| 0x6 || 0x8000000000002020 || SaveDataCreate || [[#CreateSaveData]]
|-
| 0x7 || 0x8000000000000060 || SaveDataDelete0 || [[#DeleteSaveData]], [[#RegisterSaveDataAtomicDeletion]]
|-
| 0x8 || 0x8000000000000028 || SystemSaveDataCreate0 || [[#CreateSystemSaveData]]
|-
| 0x9 || 0x8000000000000020 || SystemSaveDataCreate1 || [[#CreateSystemSaveData]]
|-
| 0xA || 0x8000000000004028 || SaveDataDelete1 || [[#DeleteSaveData]], [[#RegisterSaveDataAtomicDeletion]]
|-
| 0xB || 0x8000000000000060 || SaveDataIterators0 || [[#OpenSaveDataIterator]], [[#OpenSaveDataInfoIterator]]
|-
| 0xC || 0x8000000000004020 || SaveDataIterators1 || [[#OpenSaveDataIterator]], [[#OpenSaveDataInfoIterator]]
|-
| 0xD || 0x8000000000020000 || SaveThumbnails || [[#OpenSaveDataThumbnailFile]]
|-
| 0xE || 0x8000000000000400 || PosixTime || [[#SetCurrentPosixTime]]
|-
| 0xF || 0x8000000000004060 || SaveDataExtraData || [[#ReadSaveDataFileSystemExtraData]]
|-
| 0x10 || 0x8000000000080000 || GlobalMode || [[#SetGlobalAccessMode]]
|-
| 0x11 || 0x8000000000080000 || SpeedEmulation || [[#SetSpeedEmulationMode]]
|-
| 0x12 || Invalid || ||
|-
| 0x13 || 0xC000000000800000 || PaddingFiles || [[#CreatePaddingFile]], [[#DeletePaddingFiles]]
|-
| 0x14 || 0xC000000001000000 || SaveData_Debug || [[#CorruptSaveDataForDebug]]
|-
| 0x15 || 0xC000000002000000 || SaveData_SystemManagement || [[#CreateSaveData]], [[#MountSaveData]], [[#SetSaveDataRootPath]]
|-
| [2.0.0+] 0x16 || 0x8000000004000000 || ||
|-
| [2.0.0+] 0x17 || 0x8000000008000000 || ||
|-
| [2.0.0+] 0x18 || 0x8000000010000000 || ||
|-
| [2.0.0+] 0x19 || 0x8000000000000800 || ||
|-
| [2.0.0+] 0x1A || 0x8000000000004020 || ||
|}

== Initialize ==
Takes a pid-descriptor.

== MountContent7 ==
Takes an input u32 (same as [[#MountContent]]) and an u64 title-id. Web-applet loads the u32 from u32_table[inparam]. The in32 must be 4.

Returns an [[#IFileSystem]].

Note: web-applet strings refer to both this cmd and the below "MountContent" as "MountContent".

== MountContent ==
Takes a type-0x19 input buffer, an in32, and an input title-id.

The in32 must be 5 if the NCA type is 0 (control).

The in32 must be 2..7.

The input buffer is the output string path from nsam [[NS_Services#GetContentNcaPath|GetContentNcaPath]].

Returns an [[#IFileSystem]].

May return errors when attempting to access NCA-paths for an update-title with a gamecard, when the gamecard isn't inserted. May return error 0x7D402 in some cases with update-titles. Non-val2 in32 values with NCA-type1 are unusable, even for normal titles.

The official "MountApplicationPackage" func uses this with in64=0 and in32=7.

After the in32-specific permissions are checked, it then gets the func retval for permissions-type 0x25 and func0.

When in32=5, it uses in64=0xffffffffffffffff internally, otherwise it checks if in64 is set to 0xffffffffffffffff then throws an error if so. When the in64 used internally is not 0xffffffffffffffff, it's compared with the NCA titleID, then an error is thrown on mismatch.

== MountBis ==
Takes a type-0x19 input buffer string and a u32 Bis partitionID(see below). Official user-process code sets instr[0] = 0 normally.

Returns an [[#IFileSystem]].

Only partitionIDs for FAT partitions are usable with this, otherwise error 0x2EE202 is returned. Seems to be about the same as [[#OpenBisPartition]] except this mounts the partition filesystem instead of allowing direct access to the partition sectors.

== OpenBisPartition ==
Takes a u32 partition ID, returns 0x2EE202 for partitions which do not exist, 0x320002 for partitions which cannot be opened and a valid [[#IStorage]] handle otherwise.

== InvalidateBisCache ==
Seems to invalidate the Bis cache for MBR/GPT after overwriting that data via the OpenBisPartition IStorage. Used by [[SystemInitializer]].

== DeleteSaveData ==
Takes an input u64.

== CreateSaveData ==
Takes a 0x40-byte Save-struct entry, a 0x40-byte SaveCreate-struct entry, and a 0x10-byte input struct.

Only the first 0x5-bytes in the 0x10-byte struct are initialized: all-zero when automatically creating savedata during savecommon mount by official user-processes. In the dedicated save-creation code in official user-processes: +0 u32 = 0x40060, +4 u8 = 1.

Creates regular savedata.

== CreateSystemSaveData ==
Takes a 0x40-byte Save-struct entry and a 0x40-byte SaveCreate-struct entry.

Creates savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== OpenGameCardPartition ==

Takes an input u32 (partition ID), and returns an [[#IStorage]] for the [[Gamecard_Format|partition]].

== MountGameCardPartition ==
Takes two input u32s, with the second u32 located at +4 in rawdata after the first u32.

Returns an [[#IFileSystem]].

Mounts a gamecard [[Gamecard_Partition|partition]].

== MountSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Official user-process code is only known to use value 1 for the u8.

Returns an [[#IFileSystem]].

Permissions aren't checked until the specified save is successfully found.

Only one process can mount a given savedata at any given time (this includes systemsavedata).

== MountSystemSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Web-applet only uses value0 for the input u8.

Returns an [[#IFileSystem]].

Mounts savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== MountContentStorage ==
Takes a [[#ContentStorageId]]. Invalid values return 0x2EE202.

Returns an [[#IFileSystem]] with NCA files. The read data from these files is identical to the data read by [[Content_Manager_services#ReadEntryRaw]].

== OpenDataStorageByDataId ==
Takes a [[#StorageId]] and a TitleID.

Returns a [[IPC_Marshalling#Domain_message|domain object ID]] implementing the [[#IStorage]] interface for data archives.

== OpenDeviceOperator ==
This command returns a session to a port implementing the [[#IDeviceOperator]] interface.

== OpenSdCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== OpenGameCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== VerifySaveData ==
Takes an unknown input u64 and a type-0x6 output buffer.

The input u64 high-byte must be non-zero, otherwise an [[Error_codes|error]] is returned(0xE02).

== SetSdCardEncryptionSeed ==
Takes 0x10-bytes of input.

Appears to be used to load the seed into FS-module state, since FS-module itself doesn't seem to have file-reading code to handle this itself.

[[NS_Services|NS]]-module uses this with data read from a file.

== SetGlobalAccessLogMode ==
Takes an input u32.

== GetGlobalAccessLogMode ==
Returns an output u32.

GlobalAccessLogMode is normally 0.

== OutputAccessLogToSdCard ==
Takes a type-0x5 input buffer.

The input buffer is the string to output to the log. User-processes normally include a newline at the end.

User-processes only use this when the value previously loaded from [[#GetGlobalAccessLogMode]] has bit1 set.

When bit1 in GlobalAccessLogMode is clear, FS-module will just return 0 for OutputAccessLogToSdCard. However even with that set the log doesn't show up SD, unknown why.

The input buffer is written to the "$FsAccessLog:/FsAccessLog.txt" file, where "$FsAccessLog" is the SD-card mount-name. It's written to the current end of the file(appended).

= IStorage =
This is the interface for a raw device, usually a block device.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments
|-
| 0 || Read || Takes a type-0x46 buffer, an offset and length
|-
| 1 || Write || Takes a type-0x45 buffer, an offset and length
|-
| 2 || Flush || None
|-
| 3 || SetSize || Takes a size
|-
| 4 || GetSize || None
|-
| 5 || [4.0.0+] OperateRange ||
|}

= IFileSystem =
There are two main implementations of this interface:

* '''RomFS''': Filesystem implementation statically linked in the binary. Uses an [[#IStorage]] interface as underlying raw device.
* '''IPC proxy''': Used for all non-RomFS filesystems. In this case, actual filesystem implementation is in the FS process.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateFile
|-
| 1 || DeleteFile
|-
| 2 || CreateDirectory
|-
| 3 || DeleteDirectory
|-
| 4 || DeleteDirectoryRecursively
|-
| 5 || RenameFile
|-
| 6 || RenameDirectory
|-
| 7 || [[#GetEntryType]]
|-
| 8 || OpenFile
|-
| 9 || [[#OpenDirectory]]
|-
| 10 || [[#Commit]]
|-
| 11 || [[#GetFreeSpaceSize]]
|-
| 12 || [[#GetTotalSpaceSize]]
|-
| 13 || CleanDirectoryRecursively [3.0.0+]
|-
| 14 || GetFileTimeStampRaw [3.0.0+]
|-
| 15 || [4.0.0+] QueryEntry
|}

== GetEntryType ==
Takes a type-0x9 input buffer for the path and returns [[#DirectoryEntryType]] as an output u32.

==OpenDirectory==
Takes a type-0x9 input buffer for the path and an u64 '''filter_flags'''. '''filter_flags''' controls what type of entries are read by the [[#IDirectory]]: bitmask 0x1 = directories, bitmask 0x2 = files.

== Commit ==
Like [https://3dbrew.org/wiki/FS:ControlArchive 3DS], this has to be used after writing to savedata for the changes to take affect.

== GetFreeSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total free space with this FS.

== GetTotalSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total space available with this FS(free+used).

= IDirectory =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Read]]
|-
| 1 || [[#GetEntryCount]]
|}

== Read ==
Takes a type-0x6 output buffer and an input u64. Unknown what the u64 is for, doesn't(?) seem to affect output. Returns an output u64(?) for the total number of read entries, this is 0 when no more entries are available.

The output buffer contains the read array of [[#DirectoryEntry]]. This doesn't include entries for "." and "..".

== GetEntryCount ==
Returns an u64 for the total number of readable entries.

= DirectoryEntry =
{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x300 || Path
|-
| 0x300 || 0x4 || ?
|-
| 0x304 || 0x1 || [[#DirectoryEntryType]]
|-
| 0x305 || 0x3 || Padding?
|-
| 0x308 || 0x8? || Filesize, 0 for directories.
|}

= DirectoryEntryType =
s8 type: 0 = directory, 1 = file.

= IFile =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Read
|-
| 1 || Write
|-
| 2 || Flush
|-
| 3 || SetSize
|-
| 4 || GetSize
|-
| 5 || [4.0.0+]
|}

= ISaveDataInfoReader =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|}

= IDeviceOperator =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsSdCardInserted
|-
| 1 || GetSdCardSpeedMode
|-
| 2 || [2.0.0+] GetSdCardCid
|-
| 3 || [2.0.0+] GetSdCardUserAreaSize
|-
| 4 || [2.0.0+] GetSdCardProtectedAreaSize
|-
| 5 || [2.0.0+] GetAndClearSdCardErrorInfo
|-
| 6 || [2.0.0->3.0.0]
|-
| 100 || GetMmcCid
|-
| 101 || GetMmcSpeedMode
|-
| 110 || EraseMmc
|-
| 111 || GetMmcPartitionSize
|-
| 112 || [2.0.0+] GetMmcPatrolCount
|-
| 113 || [2.0.0+] GetAndClearMmcErrorInfo
|-
| 114 || [2.0.0+] GetMmcExtendedCsd
|-
| 115 || [4.0.0+] SuspendMmcPatrol
|-
| 116 || [4.0.0+] ResumeMmcPatrol
|-
| 200 || IsGameCardInserted
|-
| 201 || EraseGameCard
|-
| 202 || GetGameCardHandle
|-
| 203 || [[#GetGameCardUpdatePartitionInfo]]
|-
| 204 || FinalizeGameCardDriver
|-
| 205 || GetGameCardAttribute
|-
| 206 || GetGameCardDeviceCertificate
|-
| 207 || GetGameCardAsicInfo
|-
| 208 || GetGameCardIdSet
|-
| 209 || WriteToGameCard
|-
| 210 || SetVerifyWriteEnalbleFlag
|-
| 211 || GetGameCardImageHash
|-
| 212 || [2.0.0+] GetGameCardErrorInfo
|-
| 213 || [2.0.0+] EraseAndWriteParamDirectly
|-
| 214 || [2.0.0+] ReadParamDirectly
|-
| 215 || [2.0.0+] ForceEraseGameCard
|-
| 216 || [2.0.0+] GetGameCardErrorInfo
|-
| 217 || [2.1.0+] GetGameCardErrorReportInfo
|-
| 218 || [3.0.1+]
|-
| 300 || SetSpeedEmulationMode
|-
| 301 || GetSpeedEmulationMode
|}

== GetGameCardUpdatePartitionInfo ==

Returns a titleID and the title-version for it.

* Output u32 with ARMS-gamecard: title-version v131162. This is the title-version for [[2.1.0]], which is the sysupdate included with this gamecard. Launch-day gamecards return title-version v450.
* Output u64 with ARMS-gamecard: titleID 0100000000000816.

[[NS_Services|NS]] appears to only use this with [[Content_Manager_services#GetTitleIdInfo]] and [[Content_Manager_services#GetUpdateTitleList]] with storageid=nandsys, for checking whether a sysupdate is required.

= IEventNotifier =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || BindEvent
|}

= StorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || None
|-
| 1 || Host
|-
| 2 || GameCard
|-
| 3 || NandSystem
|-
| 4 || NandUser
|-
| 5 || SdCard
|}

= ContentStorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || NandSystem
|-
| 1 || NandUser
|-
| 2 || SdCard
|}

= ContentPath =
These are the 0x300 paths to NCA files for the various filesystems FS can access, beginning with @. They're passed via X descriptors, and returned via various [[Location Resolver services|ncm/lr]] commands.

{| class="wikitable" border="1"
|-
! Path || Notes
|-
| @SystemContent ||
|-
| @UserContent ||
|-
| @SdCardContent ||
|-
| @CalibFile ||
|-
| @Safe ||
|-
| @User ||
|-
| @System ||
|-
| @Sdcard ||
|-
| @Host ||
|-
| @GcApp || Gamecard App partition (Partition 2)
|-
| @GcS00000001 || Gamecard Contents.
|-
| @upp || Gamecard update partition (Partition 0)
|}

=BisPartitionID=
* 0: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 0.
* 10: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 1.
* Rest: see [[Flash_Filesystem|here]].

=Save Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| 0 for SystemSaveData. SaveData: 0 can be used for accessing the savedata associated with the current FS session titleID, otherwise when set this is the titleID associated with the savedata to access.
|-
| 0x8
| 0x10
| userID for user-specific savedata(saveuser) when set, otherwise when zero this indicates the common savedata(savecommon). This is loaded from [[Account_services]].
|-
| 0x18
| 0x8
| u64 [[Flash_Filesystem|saveID]]. 0 for SaveData.
|-
| 0x20
| 0x8
| ContentStorageId? 0 for SystemSaveData. 1 for SaveData. 2 for DeviceSaveData(with official user-processes all other fields are 0 for DeviceSaveData).
|-
| 0x28
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x30
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x38
| 0x8
| 0 for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=SaveCreate Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[Savegames|IVFC]] level4 size?
|-
| 0x8
| 0x8
| Same as offset 0x0 normally? Hard-coded to 0x80000 for BcatSaveData.
|-
| 0x10
| 0x8
| 0x4000 for SystemSaveData/SaveData/DeviceSaveData/BcatSaveData. [[Savegames|IVFC]] level4 block-size in bytes?
|-
| 0x18
| 0x8
| Official user-processes only uses 0 here for SystemSaveData/SaveData. For the dedicated save-creation code with SaveData/DeviceSaveData, this value comes from an input param with official user-processes. For BcatSaveData, this is the hard-coded [[Title_list|titleID]] of the bcat-sysmodule.
|-
| 0x20
| 0x4
| Written using an input param for official user-processes. Hard-coded 0 for BcatSaveData.
|-
| 0x24
| 0x1
| Official user-processes only uses 0 here for SystemSaveData, 1 for SaveData/DeviceSaveData/BcatSaveData.
|-
| 0x25
| 0x1
| 0 for SystemSaveData/SaveData.
|-
| 0x26
| 0x1A
| Not initialized for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=DeviceSaveData=
This is accessed using the same commands for SaveData with the same input u8, the only difference compared to SaveData is the Save-struct.

=BcatSaveData=
This is accessed using the same commands for SaveData with the same input u8. The Save-struct is the same as DeviceSaveData, except that the titleID field is set to <input titleID>. See above regarding SaveCreate-struct.

The 0x10-byte struct passed to [[#CreateSaveData]] has the first 0x5-bytes set to all-zero.

[[Category:Services]]

Filesystem services

2018-01-14T01:58:05Z

OgniK: Added cmd#0 for ISaveDataInfoReader

= fsp-ldr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Notes
|-
| 0 || MountCode || u64 TitleId + X descriptor [[#ContentPath]] || Returns an [[#IFileSystem]].
|-
| 1 || IsCodeMounted || u64 ProcessId || Returns a bool (1 if code is mounted).
|-
| 2 || [4.0.0+] Initialize || PID descriptor ||
|}

= fsp-pr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#SetFsPermissions]] ||
|-
| 1 || [[#ClearFsPermissions]] ||
|-
| 2 || [4.0.0+] Initialize ||
|-
| 256 || [[#SetEnabledProgramVerification]] ||
|}

== SetFsPermissions ==
Takes a storageID, a pid, a titleID, a 0x1C type-A buffer for the [[NPDM#FS_Access_Header| FS Access Header]], and a 0x2C type-A buffer for the [[NPDM#FS_Access_Control| FS Access Control]]

Final FS permissions are stored as (ACI0_perms & ACID_perms). Will panic(svcBreak) when buffer sizes from ipc-rawdata are invalid.

== ClearFsPermissions ==
Takes a pid. Removes registered FS permissions for that PID.

== SetEnabledProgramVerification ==
Seems to sets a global flag to inputval & 1.

When the flag is zero, it will set ret=0 instead of ret={error} when verifying a RSA signature fails. This RSA signature seems to be the signature in the [[NPDM]] ACID. It then skips verifying what seems to be the second signature in the [[NCA_Format|NCA header]]. Note that if verifying the NPDM(?) signature is successful, and verifying that second signature fails, it will throw an error and abort.

= fsp-srv =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0] [[#MountContent]]
|-
| 1 || [[#Initialize]]
|-
| 2 || OpenDataFileSystemByCurrentProcess
|-
| 7 || [2.0.0+] [[#MountContent7]]
|-
| 8 || [2.0.0+] [[#MountContent]]
|-
| 9 || [3.0.0+] OpenDataFileSystemByApplicationId
|-
| 11 || [[#MountBis]]
|-
| 12 || [[#OpenBisPartition]]
|-
| 13 || InvalidateBisCache
|-
| 17 || OpenHostFileSystemImpl
|-
| 18 || MountSdCard
|-
| 19 || [2.0.0+] FormatSdCard
|-
| 21 || [[#DeleteSaveData]]
|-
| 22 || [[#CreateSaveData]]
|-
| 23 || [[#CreateSystemSaveData]]
|-
| 24 || RegisterSaveDataAtomicDeletion
|-
| 25 || [2.0.0+] DeleteSaveDataWithSpaceId
|-
| 26 || [2.0.0+] FormatSdCardDryRun
|-
| 27 || [2.0.0+] IsExFatSupported
|-
| 28 || [4.0.0+] DeleteSystemSaveData
|-
| 30 || [[#OpenGameCardPartition]]
|-
| 31 || [[#MountGameCardPartition]]
|-
| 32 || [3.0.0+] ExtendSaveData
|-
| 51 || [[#MountSaveData]]
|-
| 52 || [[#MountSystemSaveData]]
|-
| 53 || [2.0.0+] MountSaveDataReadOnly
|-
| 57 || [3.0.0+] ReadSaveDataFileSystemExtraDataWithSpaceId
|-
| 58 || ReadSaveDataFileSystemExtraData
|-
| 59 || [2.0.0+] WriteSaveDataFileSystemExtraData
|-
| 60 || OpenSaveDataInfoReader
|-
| 61 || OpenSaveDataIterator
|-
| 80 || OpenSaveDataThumbnailFile
|-
| 81 || [4.0.0+] OpenSaveDataTransferManager
|-
| 100 || MountImageDirectory
|-
| 110 || [[#MountContentStorage]]
|-
| 200 || OpenDataStorageByCurrentProcess
|-
| 201 || [3.0.0+] OpenDataStorageByApplicationId
|-
| 202 || [[#OpenDataStorageByDataId]]
|-
| 203 || Returns an [[#IStorage]]
|-
| 400 || [[#OpenDeviceOperator]]
|-
| 500 || [[#OpenSdCardDetectionEventNotifier]]
|-
| 501 || [[#OpenGameCardDetectionEventNotifier]]
|-
| 600 || [1.0.0-3.0.2] SetCurrentPosixTime
|-
| 601 || QuerySaveDataTotalSize
|-
| 602 || [[#VerifySaveData]]
|-
| 603 || CorruptSaveDataForDebug
|-
| 604 || CreatePaddingFile
|-
| 605 || DeleteAllPaddingFiles
|-
| 606 || [2.0.0+] GetRightsId
|-
| 607 || [2.0.0+] RegisterExternalKey
|-
| 608 || [2.0.0+] UnregisterExternalKey
|-
| 609 || [2.0.0+] GetRightsIdByPath
|-
| 610 || [3.0.0+] GetRightsIdByPath2 (returns extra byte)
|-
| 611 || [4.0.0+] SetCurrentPosixTime
|-
| 612 || [4.0.0+] GetFreeSpaceSize
|-
| 613 || [4.0.0+]
|-
| 614 || [4.0.0+]
|-
| 620 || [2.0.0+] [[#SetSdCardEncryptionSeed]]
|-
| 630 || [4.0.0+] SetSdCardAccessibility
|-
| 631 || [4.0.0+] IsSdCardAccessible
|-
| 640 || [4.0.0+] IsSignedSystemPartitionOnSdCardValid
|-
| 800 || [2.0.0+] GetAndClearFileSystemProxyErrorInfo
|-
| 1000 || SetBisRootForHost
|-
| 1001 || SetSaveDataSize
|-
| 1002 || SetSaveDataRootPath
|-
| 1003 || DisableAutoSaveDataCreation
|-
| 1004 || [[#SetGlobalAccessLogMode]]
|-
| 1005 || [[#GetGlobalAccessLogMode]]
|-
| 1006 || [[#OutputAccessLogToSdCard]]
|-
| 1007 || [4.0.0+] RegisterUpdatePartition
|-
| 1008 || [4.0.0+] MountRegisteredUpdatePartition
|-
| 1009 || [4.0.0+]
|-
| 1100 || [4.0.0+] OverrideSaveDataTransferTokenSignVerificationKey
|}

== Permissions ==
Every time permissions are checked, the process registration [[#fsp-pr]] is loaded using the session processID. The permission data is populated with data from the [[NPDM]],

If the processID is <= 6 (which happens only for built-in sysmodules), it will use a hardcoded registration data. The default mask in this case is 0x8000000000000000.

Note that the functions check whether or not at least one bit is set in the mask. This means that, you don't need to set 0xFFFFFFFFFFFFFFFF to get all permissions: it suffices to set 0x8000000000000000.

If the code were to request an invalid input type, panic. But this never happens.

=== RwPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Value || Used by
|-
| 0x0 || 0x8000000000000801 || MountContentType2 || 1 || [[#MountContent]]
|-
| 0x1 || 0x8000000000000801 || MountContentType5 || 1 || [[#MountContent]]
|-
| 0x2 || 0x8000000000000801 || MountContentType3 || 1 || [[#MountContent]]
|-
| 0x3 || 0x8000000000000801 || MountContentType4 || 1 || [[#MountContent]]
|-
| 0x4 || 0x8000000000000801 || MountContentType6 || 1 || [[#MountContent]]
|-
| 0x5 || 0x8000000000000801 || MountContentType7 || 1 || [[#MountContent]]
|-
| 0x6 || 0x8000000000000000 || || 3 ||
|-
| 0x7 || 0x8000000000000800 || ContentStorageAccess || 3 || [[#MountContentStorage]]
|-
| 0x8 || 0x8000000000001000 || ImageDirectoryAccess || 3 || [[#MountImageDirectory]]
|-
| 0x9 || 0x8000000000000084 || MountBisType28 || 3 || [[#MountBis]]
|-
| 0xA || 0x8000000000000080 || MountBisType29 || 3 || [[#MountBis]]
|-
| 0xB || 0x8000000000008080 || MountBisType30 || 3 || [[#MountBis]]
|-
| 0xC || 0x8000000000008080 || MountBisType31 || 3 || [[#MountBis]]
|-
| 0xD || 0x8000000000000080 || || 3 ||
|-
| 0xE || 0xC000000000200000 || SdCardAccess || 3 || [[#MountSdCard]]
|-
| 0xF || 0x8000000000000010 || GameCardUser || 3 || [[#MountGameCardPartition]]
|-
| 0x10 || 0x8000000000040020 || SaveDataAccess0 || 3 || [[#MountSaveData]]
|-
| 0x11 || 0x8000000000000028 || SystemSaveDataAccess0 || 3 || [[#MountSystemSaveData]]
|-
| 0x12 || 0x8000000000000020 || SaveDataAccess1 || 3 || [[#MountSaveData]]
|-
| 0x13 || 0x8000000000000020 || SystemSaveDataAccess1 || 3 || [[#MountSystemSaveData]]
|-
| 0x14 || 0x8000000000010082 || BisPartition0 || 3 || [[#OpenBisPartition]]
|-
| 0x15 || 0x8000000000010080 || BisPartition10 || 3 || [[#OpenBisPartition]]
|-
| 0x17 || 0x8000000000010080 || BisPartition20 || 3 || [[#OpenBisPartition]]
|-
| 0x18 || 0x8000000000010080 || BisPartition21 || 3 || [[#OpenBisPartition]]
|-
| 0x19 || 0x8000000000010080 || BisPartition22 || 3 || [[#OpenBisPartition]]
|-
| 0x1A || 0x8000000000010080 || BisPartition23 || 3 || [[#OpenBisPartition]]
|-
| 0x1B || 0x8000000000010080 || BisPartition24 || 3 || [[#OpenBisPartition]]
|-
| 0x1C || 0x8000000000010080 || BisPartition25 || 3 || [[#OpenBisPartition]]
|-
| 0x16 || 0x8000000000000080 || BisPartition26 || 3 || [[#OpenBisPartition]]
|-
| 0x1D || 0x8000000000000084 || BisPartition27 || 3 || [[#OpenBisPartition]]
|-
| 0x1E || 0x8000000000000084 || BisPartition28 || 3 || [[#OpenBisPartition]]
|-
| 0x1F || 0x8000000000000080 || BisPartition29 || 3 || [[#OpenBisPartition]]
|-
| 0x20 || 0x8000000000000080 || BisPartition30 || 3 || [[#OpenBisPartition]]
|-
| 0x21 || 0x8000000000000080 || BisPartition31 || 3 || [[#OpenBisPartition]]
|-
| 0x22 || 0x8000000000000080 || BisPartition32 || 3 || [[#OpenBisPartition]]
|-
| 0x23 || 0xC000000000200000 || || 3 ||
|-
| 0x24 || 0x8000000000000100 || GameCard_System || 3 || [[#OpenGameCardPartition]], [[#EraseGameCard]] (bit1), [[#WriteToGameCard]] (bit1)
|-
| 0x25 || 0x8000000000100008 || MountContent_System || 1 || [[#MountContent]], [[#OpenDataStorageByDataId]]
|-
| 0x26 || 0xC000000000400000 || HostAccess || 3 || [[#OpenHostFileSystemImpl]]
|}

=== BoolPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Used by
|-
| 0x0 || 0x8000000000000080 || BisCache || [[#InvalidateBisCache]]
|-
| 0x1 || 0x8000000000000080 || EraseMmc || [[#EraseMmc]]
|-
| 0x2 || 0x8000000000000010 || GameCardCertificate || [[#GetGameCardDeviceCertificate]]
|-
| 0x3 || 0x8000000000000010 || GameCardIdSet || [[#GetGameCardIdSet]]
|-
| 0x4 || 0x8000000000000200 || GameCardDriver || [[#FinalizeGameCardDriver]]
|-
| 0x5 || 0x8000000000000200 || GameCardAsic || [[#GetGameCardAsicInfo]]
|-
| 0x6 || 0x8000000000002020 || SaveDataCreate || [[#CreateSaveData]]
|-
| 0x7 || 0x8000000000000060 || SaveDataDelete0 || [[#DeleteSaveData]], [[#RegisterSaveDataAtomicDeletion]]
|-
| 0x8 || 0x8000000000000028 || SystemSaveDataCreate0 || [[#CreateSystemSaveData]]
|-
| 0x9 || 0x8000000000000020 || SystemSaveDataCreate1 || [[#CreateSystemSaveData]]
|-
| 0xA || 0x8000000000004028 || SaveDataDelete1 || [[#DeleteSaveData]], [[#RegisterSaveDataAtomicDeletion]]
|-
| 0xB || 0x8000000000000060 || SaveDataIterators0 || [[#OpenSaveDataIterator]], [[#OpenSaveDataInfoIterator]]
|-
| 0xC || 0x8000000000004020 || SaveDataIterators1 || [[#OpenSaveDataIterator]], [[#OpenSaveDataInfoIterator]]
|-
| 0xD || 0x8000000000020000 || SaveThumbnails || [[#OpenSaveDataThumbnailFile]]
|-
| 0xE || 0x8000000000000400 || PosixTime || [[#SetCurrentPosixTime]]
|-
| 0xF || 0x8000000000004060 || SaveDataExtraData || [[#ReadSaveDataFileSystemExtraData]]
|-
| 0x10 || 0x8000000000080000 || GlobalMode || [[#SetGlobalAccessMode]]
|-
| 0x11 || 0x8000000000080000 || SpeedEmulation || [[#SetSpeedEmulationMode]]
|-
| 0x12 || Invalid || ||
|-
| 0x13 || 0xC000000000800000 || PaddingFiles || [[#CreatePaddingFile]], [[#DeletePaddingFiles]]
|-
| 0x14 || 0xC000000001000000 || SaveData_Debug || [[#CorruptSaveDataForDebug]]
|-
| 0x15 || 0xC000000002000000 || SaveData_SystemManagement || [[#CreateSaveData]], [[#MountSaveData]], [[#SetSaveDataRootPath]]
|-
| [2.0.0+] 0x16 || 0x8000000004000000 || ||
|-
| [2.0.0+] 0x17 || 0x8000000008000000 || ||
|-
| [2.0.0+] 0x18 || 0x8000000010000000 || ||
|-
| [2.0.0+] 0x19 || 0x8000000000000800 || ||
|-
| [2.0.0+] 0x1A || 0x8000000000004020 || ||
|}

== Initialize ==
Takes a pid-descriptor.

== MountContent7 ==
Takes an input u32 (same as [[#MountContent]]) and an u64 title-id. Web-applet loads the u32 from u32_table[inparam]. The in32 must be 4.

Returns an [[#IFileSystem]].

Note: web-applet strings refer to both this cmd and the below "MountContent" as "MountContent".

== MountContent ==
Takes a type-0x19 input buffer, an in32, and an input title-id.

The in32 must be 5 if the NCA type is 0 (control).

The in32 must be 2..7.

The input buffer is the output string path from nsam [[NS_Services#GetContentNcaPath|GetContentNcaPath]].

Returns an [[#IFileSystem]].

May return errors when attempting to access NCA-paths for an update-title with a gamecard, when the gamecard isn't inserted. May return error 0x7D402 in some cases with update-titles. Non-val2 in32 values with NCA-type1 are unusable, even for normal titles.

The official "MountApplicationPackage" func uses this with in64=0 and in32=7.

After the in32-specific permissions are checked, it then gets the func retval for permissions-type 0x25 and func0.

When in32=5, it uses in64=0xffffffffffffffff internally, otherwise it checks if in64 is set to 0xffffffffffffffff then throws an error if so. When the in64 used internally is not 0xffffffffffffffff, it's compared with the NCA titleID, then an error is thrown on mismatch.

== MountBis ==
Takes a type-0x19 input buffer string and a u32 Bis partitionID(see below). Official user-process code sets instr[0] = 0 normally.

Returns an [[#IFileSystem]].

Only partitionIDs for FAT partitions are usable with this, otherwise error 0x2EE202 is returned. Seems to be about the same as [[#OpenBisPartition]] except this mounts the partition filesystem instead of allowing direct access to the partition sectors.

== OpenBisPartition ==
Takes a u32 partition ID, returns 0x2EE202 for partitions which do not exist, 0x320002 for partitions which cannot be opened and a valid [[#IStorage]] handle otherwise.

== InvalidateBisCache ==
Seems to invalidate the Bis cache for MBR/GPT after overwriting that data via the OpenBisPartition IStorage. Used by [[SystemInitializer]].

== DeleteSaveData ==
Takes an input u64.

== CreateSaveData ==
Takes a 0x40-byte Save-struct entry, a 0x40-byte SaveCreate-struct entry, and a 0x10-byte input struct.

Only the first 0x5-bytes in the 0x10-byte struct are initialized: all-zero when automatically creating savedata during savecommon mount by official user-processes. In the dedicated save-creation code in official user-processes: +0 u32 = 0x40060, +4 u8 = 1.

Creates regular savedata.

== CreateSystemSaveData ==
Takes a 0x40-byte Save-struct entry and a 0x40-byte SaveCreate-struct entry.

Creates savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== OpenGameCardPartition ==

Takes an input u32 (partition ID), and returns an [[#IStorage]] for the [[Gamecard_Format|partition]].

== MountGameCardPartition ==
Takes two input u32s, with the second u32 located at +4 in rawdata after the first u32.

Returns an [[#IFileSystem]].

Mounts a gamecard [[Gamecard_Partition|partition]].

== MountSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Official user-process code is only known to use value 1 for the u8.

Returns an [[#IFileSystem]].

Permissions aren't checked until the specified save is successfully found.

Only one process can mount a given savedata at any given time (this includes systemsavedata).

== MountSystemSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Web-applet only uses value0 for the input u8.

Returns an [[#IFileSystem]].

Mounts savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== MountContentStorage ==
Takes a [[#ContentStorageId]]. Invalid values return 0x2EE202.

Returns an [[#IFileSystem]] with NCA files. The read data from these files is identical to the data read by [[Content_Manager_services#ReadEntryRaw]].

== OpenDataStorageByDataId ==
Takes a [[#StorageId]] and a TitleID.

Returns a [[IPC_Marshalling#Domain_message|domain object ID]] implementing the [[#IStorage]] interface for data archives.

== OpenDeviceOperator ==
This command returns a session to a port implementing the [[#IDeviceOperator]] interface.

== OpenSdCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== OpenGameCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== VerifySaveData ==
Takes an unknown input u64 and a type-0x6 output buffer.

The input u64 high-byte must be non-zero, otherwise an [[Error_codes|error]] is returned(0xE02).

== SetSdCardEncryptionSeed ==
Takes 0x10-bytes of input.

Appears to be used to load the seed into FS-module state, since FS-module itself doesn't seem to have file-reading code to handle this itself.

[[NS_Services|NS]]-module uses this with data read from a file.

== SetGlobalAccessLogMode ==
Takes an input u32.

== GetGlobalAccessLogMode ==
Returns an output u32.

GlobalAccessLogMode is normally 0.

== OutputAccessLogToSdCard ==
Takes a type-0x5 input buffer.

The input buffer is the string to output to the log. User-processes normally include a newline at the end.

User-processes only use this when the value previously loaded from [[#GetGlobalAccessLogMode]] has bit1 set.

When bit1 in GlobalAccessLogMode is clear, FS-module will just return 0 for OutputAccessLogToSdCard. However even with that set the log doesn't show up SD, unknown why.

The input buffer is written to the "$FsAccessLog:/FsAccessLog.txt" file, where "$FsAccessLog" is the SD-card mount-name. It's written to the current end of the file(appended).

= IStorage =
This is the interface for a raw device, usually a block device.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments
|-
| 0 || Read || Takes a type-0x46 buffer, an offset and length
|-
| 1 || Write || Takes a type-0x45 buffer, an offset and length
|-
| 2 || Flush || None
|-
| 3 || SetSize || Takes a size
|-
| 4 || GetSize || None
|-
| 5 || [4.0.0+] OperateRange ||
|}

= IFileSystem =
There are two main implementations of this interface:

* '''RomFS''': Filesystem implementation statically linked in the binary. Uses an [[#IStorage]] interface as underlying raw device.
* '''IPC proxy''': Used for all non-RomFS filesystems. In this case, actual filesystem implementation is in the FS process.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateFile
|-
| 1 || DeleteFile
|-
| 2 || CreateDirectory
|-
| 3 || DeleteDirectory
|-
| 4 || DeleteDirectoryRecursively
|-
| 5 || RenameFile
|-
| 6 || RenameDirectory
|-
| 7 || [[#GetEntryType]]
|-
| 8 || OpenFile
|-
| 9 || [[#OpenDirectory]]
|-
| 10 || [[#Commit]]
|-
| 11 || [[#GetFreeSpaceSize]]
|-
| 12 || [[#GetTotalSpaceSize]]
|-
| 13 || CleanDirectoryRecursively [3.0.0+]
|-
| 14 || GetFileTimeStampRaw [3.0.0+]
|-
| 15 || [4.0.0+] QueryEntry
|}

== GetEntryType ==
Takes a type-0x9 input buffer for the path and returns [[#DirectoryEntryType]] as an output u32.

==OpenDirectory==
Takes a type-0x9 input buffer for the path and an u64 '''filter_flags'''. '''filter_flags''' controls what type of entries are read by the [[#IDirectory]]: bitmask 0x1 = directories, bitmask 0x2 = files.

== Commit ==
Like [https://3dbrew.org/wiki/FS:ControlArchive 3DS], this has to be used after writing to savedata for the changes to take affect.

== GetFreeSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total free space with this FS.

== GetTotalSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total space available with this FS(free+used).

= IDirectory =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Read]]
|-
| 1 || [[#GetEntryCount]]
|}

== Read ==
Takes a type-0x6 output buffer and an input u64. Unknown what the u64 is for, doesn't(?) seem to affect output. Returns an output u64(?) for the total number of read entries, this is 0 when no more entries are available.

The output buffer contains the read array of [[#DirectoryEntry]]. This doesn't include entries for "." and "..".

== GetEntryCount ==
Returns an u64 for the total number of readable entries.

= DirectoryEntry =
{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x300 || Path
|-
| 0x300 || 0x4 || ?
|-
| 0x304 || 0x1 || [[#DirectoryEntryType]]
|-
| 0x305 || 0x3 || Padding?
|-
| 0x308 || 0x8? || Filesize, 0 for directories.
|}

= DirectoryEntryType =
s8 type: 0 = directory, 1 = file.

= IFile =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Read
|-
| 1 || Write
|-
| 2 || Flush
|-
| 3 || SetSize
|-
| 4 || GetSize
|-
| 5 || [4.0.0+]
|}

= ISaveDataInfoReader =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|}

= IDeviceOperator =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsSdCardInserted
|-
| 1 || GetSdCardSpeedMode
|-
| 2 || [2.0.0+] GetSdCardCid
|-
| 3 || [2.0.0+] GetSdCardUserAreaSize
|-
| 4 || [2.0.0+] GetSdCardProtectedAreaSize
|-
| 5 || [2.0.0+] GetAndClearSdCardErrorInfo
|-
| 6 || [2.0.0->3.0.0]
|-
| 100 || GetMmcCid
|-
| 101 || GetMmcSpeedMode
|-
| 110 || EraseMmc
|-
| 111 || GetMmcPartitionSize
|-
| 112 || [2.0.0+] GetMmcPatrolCount
|-
| 113 || [2.0.0+] GetAndClearMmcErrorInfo
|-
| 114 || [2.0.0+] GetMmcExtendedCsd
|-
| 115 || [4.0.0+] SuspendMmcPatrol
|-
| 116 || [4.0.0+] ResumeMmcPatrol
|-
| 200 || IsGameCardInserted
|-
| 201 || EraseGameCard
|-
| 202 || GetGameCardHandle
|-
| 203 || [[#GetGameCardUpdatePartitionInfo]]
|-
| 204 || FinalizeGameCardDriver
|-
| 205 || GetGameCardAttribute
|-
| 206 || GetGameCardDeviceCertificate
|-
| 207 || GetGameCardAsicInfo
|-
| 208 || GetGameCardIdSet
|-
| 209 || WriteToGameCard
|-
| 210 || SetVerifyWriteEnalbleFlag
|-
| 211 || GetGameCardImageHash
|-
| 212 || [2.0.0+] GetGameCardErrorInfo
|-
| 213 || [2.0.0+]
|-
| 214 || [2.0.0+] GetGameCardCid
|-
| 215 || [2.0.0+]
|-
| 216 || [2.0.0+]
|-
| 217 || [2.1.0+] Returns 0x40-bytes of output data.
|-
| 218 || [3.0.1+]
|-
| 300 || SetSpeedEmulationMode
|-
| 301 || GetSpeedEmulationMode
|}

== GetGameCardUpdatePartitionInfo ==

Returns a titleID and the title-version for it.

* Output u32 with ARMS-gamecard: title-version v131162. This is the title-version for [[2.1.0]], which is the sysupdate included with this gamecard. Launch-day gamecards return title-version v450.
* Output u64 with ARMS-gamecard: titleID 0100000000000816.

[[NS_Services|NS]] appears to only use this with [[Content_Manager_services#GetTitleIdInfo]] and [[Content_Manager_services#GetUpdateTitleList]] with storageid=nandsys, for checking whether a sysupdate is required.

= IEventNotifier =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || BindEvent
|}

= StorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || None
|-
| 1 || Host
|-
| 2 || GameCard
|-
| 3 || NandSystem
|-
| 4 || NandUser
|-
| 5 || SdCard
|}

= ContentStorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || NandSystem
|-
| 1 || NandUser
|-
| 2 || SdCard
|}

= ContentPath =
These are the 0x300 paths to NCA files for the various filesystems FS can access, beginning with @. They're passed via X descriptors, and returned via various [[Location Resolver services|ncm/lr]] commands.

{| class="wikitable" border="1"
|-
! Path || Notes
|-
| @SystemContent ||
|-
| @UserContent ||
|-
| @SdCardContent ||
|-
| @CalibFile ||
|-
| @Safe ||
|-
| @User ||
|-
| @System ||
|-
| @Sdcard ||
|-
| @Host ||
|-
| @GcApp || Gamecard App partition (Partition 2)
|-
| @GcS00000001 || Gamecard Contents.
|-
| @upp || Gamecard update partition (Partition 0)
|}

=BisPartitionID=
* 0: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 0.
* 10: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 1.
* Rest: see [[Flash_Filesystem|here]].

=Save Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| 0 for SystemSaveData. SaveData: 0 can be used for accessing the savedata associated with the current FS session titleID, otherwise when set this is the titleID associated with the savedata to access.
|-
| 0x8
| 0x10
| userID for user-specific savedata(saveuser) when set, otherwise when zero this indicates the common savedata(savecommon). This is loaded from [[Account_services]].
|-
| 0x18
| 0x8
| u64 [[Flash_Filesystem|saveID]]. 0 for SaveData.
|-
| 0x20
| 0x8
| ContentStorageId? 0 for SystemSaveData. 1 for SaveData. 2 for DeviceSaveData(with official user-processes all other fields are 0 for DeviceSaveData).
|-
| 0x28
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x30
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x38
| 0x8
| 0 for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=SaveCreate Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[Savegames|IVFC]] level4 size?
|-
| 0x8
| 0x8
| Same as offset 0x0 normally? Hard-coded to 0x80000 for BcatSaveData.
|-
| 0x10
| 0x8
| 0x4000 for SystemSaveData/SaveData/DeviceSaveData/BcatSaveData. [[Savegames|IVFC]] level4 block-size in bytes?
|-
| 0x18
| 0x8
| Official user-processes only uses 0 here for SystemSaveData/SaveData. For the dedicated save-creation code with SaveData/DeviceSaveData, this value comes from an input param with official user-processes. For BcatSaveData, this is the hard-coded [[Title_list|titleID]] of the bcat-sysmodule.
|-
| 0x20
| 0x4
| Written using an input param for official user-processes. Hard-coded 0 for BcatSaveData.
|-
| 0x24
| 0x1
| Official user-processes only uses 0 here for SystemSaveData, 1 for SaveData/DeviceSaveData/BcatSaveData.
|-
| 0x25
| 0x1
| 0 for SystemSaveData/SaveData.
|-
| 0x26
| 0x1A
| Not initialized for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=DeviceSaveData=
This is accessed using the same commands for SaveData with the same input u8, the only difference compared to SaveData is the Save-struct.

=BcatSaveData=
This is accessed using the same commands for SaveData with the same input u8. The Save-struct is the same as DeviceSaveData, except that the titleID field is set to <input titleID>. See above regarding SaveCreate-struct.

The 0x10-byte struct passed to [[#CreateSaveData]] has the first 0x5-bytes set to all-zero.

[[Category:Services]]

SVC

2018-01-14T01:52:58Z

OgniK: Made "arg" more clear for svcCreateThread

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano || W0=result
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || svcCancelSynchronization || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || svcGetSystemTick || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=event_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W0=thread_handle || W0=result, X1=out
|-
| 0x26 || svcBreak || X0,X1,X2=info || ?
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory|| X0=addr, X1=size || W0=result
|- style="border-top: double"
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || W0=thread_handle, W1=[[#ThreadContext]]* || W0=result
|-
| 0x34 || [4.0.0+] || X0=ptr, W1=type, X2=? X3=timeout ||
|-
| 0x35 || [4.0.0+] || X0=ptr, W1=type, X2=? W3=? ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=client_handle ?, W2=server_handle ?
|- style="border-top: double"
| 0x4B || [4.0.0+] [[#svcCreateJitMemory]] || X1=addr, X2=size || W0=result, W1=jit_handle
|-
| 0x4C || [4.0.0+] [[#svcMapJitMemory]] || W0=jit_handle, W1=[[#MapJitOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || svcCreateInterruptEvent || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=DebugEventInfo*, W1=debug_handle || W0=result
|-
| 0x64 || svcContinueDebugEvent || W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id || W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, W1=[[#ThreadContextFlags]], X2=ThreadContext* || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || svcSetHardwareBreakPoint || W0=HardwareBreakpointId, X1=watchpoint_flags, X2=watchpoint_value/debug_handle? ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x70 || svcCreatePort || W2=max_sessions, W3=unk_bool, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=srcaddr, W1=process_handle, X2=dstaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X2=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x2000000.

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

[2.0.0+] Size must be less than 0x18000000.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

If dstaddr >= LowerTreshold, the dst-range is enforced to be within the process' "MapRegion". Code can get the range of this region from [[#svcGetInfo]] id0=2,3.

In this case, the mapped memory will have state 0x5C3C0B.

As long as (dstaddr+size) < LowerThreshold, then you can map anywhere but the mapped memory will have state 0x482907 instead.

LowerTreshold is 0x80000000 for 36-bit address spaces, and 0x40000000 for 32-bit ones.

[2.0.0+] Support for the 0x482907 mappings outside the "MapRegion" were removed.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || ThreadContext
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Nano
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nano=0 means "yield thread".

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40, error on num_handles == 0.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''Port:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''Session (server-side):''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

=== Result codes ===

'''0x0:''' Success. One of the objects was signalled before the timeout expired. Handle index is updated to indicate which object signalled.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signalled within the timeout. Handle index is not updated.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must be 0x1000-aligned.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 ||
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) ? || ? || ?
|}
</div>

When used on retail where inx0 bit31 is clear, the system will throw a [[Error_codes|fatal-error]]. Otherwise when bit31 is set, it will return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || MapRegionBaseAddr
|-
| Process || 3 || 0 || MapRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryUsage
|-
| Process || 7 || 0 || TotalHeapUsage
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || Unknown. Output data changes each time this SVC is used. Global and core-specific tick-count?
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] NewMapRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] NewMapRegionSize
|-
| Process || 16 || 0 || [3.0.0+] IsVirtualAddressMemoryEnabled
|-
| Process || 17 || 0 || [3.0.0+] Some size in bytes.
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0+] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0+] PrivilegedProcessId_UpperBound
|-
| Thread || 0xF0000002 || 0 || Performance counter related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcCreateJitMemory ==
Takes an address range with backing memory to create the JIT memory object.

The memory is initially memset to 0xFF after being locked.

== svcMapJitMemory ==
Maps the backing memory for a JIT memory object into the current process.

For [[#MapJitOperation|MapJitOperation_MapOwner]], memory permission must be RW-.

For [[#MapJitOperation|MapJitOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#MapJitOperation|MapJitOperation_UnmapOwner/MapJitOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the memory as RW-, and the other "slave" process to map it R-X.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || SrcAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || DstAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || void* || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u64 || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== MapJitOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || MapJitOperation_MapOwner
|-
| 1 || MapJitOperation_MapSlave
|-
| 2 || MapJitOperation_UnmapOwner
|-
| 3 || MapJitOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessEvent ==
{| class=wikitable
! Value || Name
|-
| 0 || ProcessEvent_Created
|-
| 1 || ProcessEvent_DebugAttached
|-
| 2 || ProcessEvent_DebugDetached
|-
| 3 || ProcessEvent_Crashed
|-
| 4 || ProcessEvent_Running
|-
| 5 || ProcessEvent_Exiting
|-
| 6 || ProcessEvent_Exited
|-
| 7 || ProcessEvent_DebugSuspended
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_ActualPriority
|-
| 1 ||
|-
| 2 || DebugThreadParam_CpuCore
|-
| 3 ||
|-
| 4 || DebugThreadParam_CoreMask
|}

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || Is64bit
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 ||
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsSystem
|-
| 0x28 || 4 || || ResourceLimitHandle
|-
| 0x2C || 4 ||
|}

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] JitMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_WeirdSharedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_MappedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_JitReadOnly || Mapped in kernel during [[#svcMapJitMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_JitWritable || Mapped in kernel during [[#svcMapJitMemory]].
|}

== ContinueDebugFlags ==
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || SwallowException
|-
| 1 || 2 ||
|-
| 2 || 4 || ResumeAllThreads
|}

== DebugEventInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || Type (0=PausedThread, 1=RunningThread, 2=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 ||
|-
| 3 || DebugEvent_Exit
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_UndefinedInstruction
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|}

UndefinedInstruction specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
There is userland code for handling exceptions, however this doesn't seem to be executed on retail mode.

When a usermode exception occurs, it jumps to the main code binary entrypoint (main_binary_address + 0 == '''_start''').

During normal boot '''_start''' is invoked with X0=0 and X1=main_thread_handle (triggering normal crt0 setup).
During an usermode exception '''_start''' is invoked with X0=exception_info0_ptr and X1=exception_info1_ptr instead.

The '''_start''' method determines whether to boot normally or handle an exception if X0 is set to 0 or not.

SVC

2018-01-14T01:50:43Z

OgniK: Added IsVirtualAddressMemoryEnabled

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=arg, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano || W0=result
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || svcCancelSynchronization || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || svcGetSystemTick || None || X0={value of cntpct_el0}
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=event_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
|-
| 0x25 || svcGetThreadId || W0=thread_handle || W0=result, X1=out
|-
| 0x26 || svcBreak || X0,X1,X2=info || ?
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory|| X0=addr, X1=size || W0=result
|- style="border-top: double"
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || W0=thread_handle, W1=[[#ThreadContext]]* || W0=result
|-
| 0x34 || [4.0.0+] || X0=ptr, W1=type, X2=? X3=timeout ||
|-
| 0x35 || [4.0.0+] || X0=ptr, W1=type, X2=? W3=? ||
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=? || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=client_handle ?, W2=server_handle ?
|- style="border-top: double"
| 0x4B || [4.0.0+] [[#svcCreateJitMemory]] || X1=addr, X2=size || W0=result, W1=jit_handle
|-
| 0x4C || [4.0.0+] [[#svcMapJitMemory]] || W0=jit_handle, W1=[[#MapJitOperation]], X2=dstaddr, X3=size, W4=perm || W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val || W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || svcCreateInterruptEvent || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size || W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr || W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm || W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr || W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size || W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid || W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=DebugEventInfo*, W1=debug_handle || W0=result
|-
| 0x64 || svcContinueDebugEvent || W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id || W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]] || W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, W1=[[#ThreadContextFlags]], X2=ThreadContext* || W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || svcSetHardwareBreakPoint || W0=HardwareBreakpointId, X1=watchpoint_flags, X2=watchpoint_value/debug_handle? ||
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x70 || svcCreatePort || W2=max_sessions, W3=unk_bool, X4=name_ptr || W0=result, W1=clientport_handle, W2=serverport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=srcaddr, W1=process_handle, X2=dstaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X2=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || svcCallSecureMonitor || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x2000000.

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

[2.0.0+] Size must be less than 0x18000000.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

If dstaddr >= LowerTreshold, the dst-range is enforced to be within the process' "MapRegion". Code can get the range of this region from [[#svcGetInfo]] id0=2,3.

In this case, the mapped memory will have state 0x5C3C0B.

As long as (dstaddr+size) < LowerThreshold, then you can map anywhere but the mapped memory will have state 0x482907 instead.

LowerTreshold is 0x80000000 for 36-bit address spaces, and 0x40000000 for 32-bit ones.

[2.0.0+] Support for the 0x482907 mappings outside the "MapRegion" were removed.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void(*)(void*) || Entry
|-
| (In) X2 || void* || Arg
|-
| (In) X3 || void* || StackTop
|-
| (In) W4 || u32 || Priority
|-
| (In) W5 || u32 || ProcessorId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Nano
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nano=0 means "yield thread".

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u32 || Out0
|-
| (Out) X2 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (In) W1 || u32 || In0
|-
| (In) X2 || u64 || In1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || Handle* || HandlesPtr
|-
| (In) W2 || u64 || HandlesNum
|-
| (In) X3 || u64 || Timeout
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || HandleIndex
|}
</div>

Works with num_handles <= 0x40, error on num_handles == 0.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''Port:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''Session (server-side):''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

=== Result codes ===

'''0x0:''' Success. One of the objects was signalled before the timeout expired. Handle index is updated to indicate which object signalled.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signalled within the timeout. Handle index is not updated.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must be 0x1000-aligned.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 ||
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) ? || ? || ?
|}
</div>

When used on retail where inx0 bit31 is clear, the system will throw a [[Error_codes|fatal-error]]. Otherwise when bit31 is set, it will return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || MapRegionBaseAddr
|-
| Process || 3 || 0 || MapRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryUsage
|-
| Process || 7 || 0 || TotalHeapUsage
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || Unknown. Output data changes each time this SVC is used. Global and core-specific tick-count?
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] NewMapRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] NewMapRegionSize
|-
| Process || 16 || 0 || [3.0.0+] IsVirtualAddressMemoryEnabled
|-
| Process || 17 || 0 || [3.0.0+] Some size in bytes.
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0+] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0+] PrivilegedProcessId_UpperBound
|-
| Thread || 0xF0000002 || 0 || Performance counter related.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || u32 || NumHandles
|-
| (In) W3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcCreateJitMemory ==
Takes an address range with backing memory to create the JIT memory object.

The memory is initially memset to 0xFF after being locked.

== svcMapJitMemory ==
Maps the backing memory for a JIT memory object into the current process.

For [[#MapJitOperation|MapJitOperation_MapOwner]], memory permission must be RW-.

For [[#MapJitOperation|MapJitOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#MapJitOperation|MapJitOperation_UnmapOwner/MapJitOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the memory as RW-, and the other "slave" process to map it R-X.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || RegAddr
|-
| (In) W2 || u64 || RwMask
|-
| (In) W3 || u64 || InValue
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1|| u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || PhysAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || StartAddr
|-
| (In) X2 || u64 || EndAddr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (In) W5 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || DeviceAsSize
|-
| (In) X4 || u64 || DeviceAsAddr
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || SrcAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || DstAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || void* || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u64 || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

= Enum/Structures =
== ThreadContextRequestFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name
|-
| 0 || 1 || NormalContext
|-
| 1 || 2 ||
|-
| 2 || 4 ||
|-
| 3 || 8 ||
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== MapJitOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || MapJitOperation_MapOwner
|-
| 1 || MapJitOperation_MapSlave
|-
| 2 || MapJitOperation_UnmapOwner
|-
| 3 || MapJitOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name
|-
| 0 || LimitableResource_Memory
|-
| 1 || LimitableResource_Threads
|-
| 2 || LimitableResource_Events
|-
| 3 || LimitableResource_TransferMemories
|-
| 4 || LimitableResource_Sessions
|}

== ProcessEvent ==
{| class=wikitable
! Value || Name
|-
| 0 || ProcessEvent_Created
|-
| 1 || ProcessEvent_DebugAttached
|-
| 2 || ProcessEvent_DebugDetached
|-
| 3 || ProcessEvent_Crashed
|-
| 4 || ProcessEvent_Running
|-
| 5 || ProcessEvent_Exiting
|-
| 6 || ProcessEvent_Exited
|-
| 7 || ProcessEvent_DebugSuspended
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_ActualPriority
|-
| 1 ||
|-
| 2 || DebugThreadParam_CpuCore
|-
| 3 ||
|-
| 4 || DebugThreadParam_CoreMask
|}

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || MmuFlags
|-
| || || Bit0 || Is64bit
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 ||
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsSystem
|-
| 0x28 || 4 || || ResourceLimitHandle
|-
| 0x2C || 4 ||
|}

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Description
|-
| 0 || IsBorrowed
|-
| 1 || IsIpcMapped: when IpcRefCount > 0.
|-
| 2 || IsDeviceMapped: when DeviceRefCount > 0.
|-
| 3 || IsUncached
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed_Type0
|-
| 11 || IpcSendAllowed_Type3
|-
| 12 || IpcSendAllowed_Type1
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] JitMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_WeirdSharedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_IpcBuffer0]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_MappedMemory || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_IpcBuffer1]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_IpcBuffer3]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_JitReadOnly || Mapped in kernel during [[#svcMapJitMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_JitWritable || Mapped in kernel during [[#svcMapJitMemory]].
|}

== ContinueDebugFlags ==
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || SwallowException
|-
| 1 || 2 ||
|-
| 2 || 4 || ResumeAllThreads
|}

== DebugEventInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || Type (0=PausedThread, 1=RunningThread, 2=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 ||
|-
| 3 || DebugEvent_Exit
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_UndefinedInstruction
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|}

UndefinedInstruction specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
There is userland code for handling exceptions, however this doesn't seem to be executed on retail mode.

When a usermode exception occurs, it jumps to the main code binary entrypoint (main_binary_address + 0 == '''_start''').

During normal boot '''_start''' is invoked with X0=0 and X1=main_thread_handle (triggering normal crt0 setup).
During an usermode exception '''_start''' is invoked with X0=exception_info0_ptr and X1=exception_info1_ptr instead.

The '''_start''' method determines whether to boot normally or handle an exception if X0 is set to 0 or not.

Thread Local Region

2018-01-14T01:43:30Z

OgniK: Updated thread local storage

This is the 0x200-byte TLS (thread local storage). It's base address is loaded via ARM threadid register tpidrro_el0. TLS for multiple threads are stored in the same page, with the first TLS normally located at page+0x200, because the first TLS spot is reserved for usermode exception handling.

= Structure =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| [[IPC_Marshalling|IPC]] command buffer.
|-
| 0x100
| 0xF8
| Unknown.
|-
| 0x1F8
| 0x8
| Pointer to [[Thread_Local_Storage#Thread_context|thread context]].
|}

= Userland context =
== Boot paramter ==
This is "nn::os::detail::g_OsBootParamter".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| Main thread handle.
|-
| 0x04
| 0x04
| Always 0.
|-
| 0x08
| 0x30
| Empty.
|}

== Resource manager storage ==
This is "nn::os::detail::g_OsResourceManagerStorage".

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| Always 0.
|-
| 0x04
| 0x10
| Process PRNG.
|-
| 0x14
| 0x04
| Padding.
|-
| 0x18
| 0x08
| Always set to 0.
|-
| 0x20
| 0x08
| [[SVC#svcGetInfo|AddressSpaceStart]] right shifted by 0x0C.
|-
| 0x28
| 0x08
| AddressSpaceEnd ([[SVC#svcGetInfo|AddressSpaceStart]] + [[SVC#svcGetInfo|AddressSpaceSize]]) right shifted by 0x0C and aligned to AddressSpaceAlign.
|-
| 0x30
| 0x08
| AddressSpaceAlign right shifted by 0x0C.
|-
| 0x38
| 0x08
| Always 0.
|-
| 0x40
| 0x08
| Always set to 0.
|-
| 0x48
| 0x08
| [[SVC#svcGetInfo|MapRegionBased]] right shifted by 0x0C.
|-
| 0x50
| 0x08
| MapRegionEnd ([[SVC#svcGetInfo|MapRegionBased]] + [[SVC#svcGetInfo|MapRegionSize]]) right shifted by 0x0C and aligned to MapRegionAlign.
|-
| 0x58
| 0x08
| MapRegionAlign right shifted by 0x0C.
|-
| 0x60
| 0x08
| Always 0.
|-
| 0x68
| 0x08
| Always 0.
|-
| 0x70
| 0x1D0
| Main [[Thread_Local_Storage#Thread_context|thread context]].
|-
| 0x240
| 0x08
| Pointer to main [[Thread_Local_Storage#Thread_context|thread context]].
|-
| 0x248
| 0x08
| Unknown.
|-
| 0x250
| 0x08
| Unknown.
|-
| 0x258
| 0x130
| Always empty?
|-
| 0x388
| 0x08
| Pointer to [[Thread_Local_Storage#Resource_manager_storage|resource manager storage]] + 0x388.
|-
| 0x390
| 0x08
| Pointer to [[Thread_Local_Storage#Resource_manager_storage|resource manager storage]] + 0x388.
|-
| 0x398
| 0x08
| Always 0.
|-
| 0x3A0
| 0x08
| Always 0.
|}

== Thread context ==
This structure is used for describing each thread's context. In the main thread's case, this structure comes from the [[Thread_Local_Storage#Resource_manager_storage|resource manager storage]].

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x08
| Pointer to [[Thread_Local_Storage#Thread_context|thread context]] + 0x1C8.
|-
| 0x08
| 0x08
| Pointer to [[Thread_Local_Storage#Thread_context|thread context]]
|-
| 0x10
| 0x08
| Pointer to [[Thread_Local_Storage#Thread_context|thread context]] + 0x10.
|-
| 0x18
| 0x08
| Pointer to [[Thread_Local_Storage#Thread_context|thread context]] + 0x10.
|-
| 0x20
| 0x20
| Empty.
|-
| 0x40
| 0x04
| Thread status.
|-
| 0x44
| 0x04
| Thread priority minus 0x1C.
|-
| 0x48
| 0x08
| Thread stack base address.
|-
| 0x50
| 0x08
| Thread stack base address mirror.
|-
| 0x58
| 0x08
| Thread stack size.
|-
| 0x60
| 0x08
| Thread stub pointer.
|-
| 0x68
| 0x08
| Thread ID.
|-
| 0x70
| 0x08
| Always 0?
|-
| 0x78
| 0x08
| Always 0?
|-
| 0x80
| 0x08
| Always 0?
|-
| 0x88
| 0x100
| Initially empty (contains unknown pointers).
|-
| 0x188
| 0x20
| Thread name.
|-
| 0x1A8
| 0x08
| Thread name address.
|-
| 0x1B0
| 0x04
| Critical Section.
|-
| 0x1B4
| 0x04
| Conditional Variable.
|-
| 0x1B8
| 0x04
| Thread handle.
|-
| 0x1BC
| 0x04
| Always 0.
|-
| 0x1C0
| 0x08
| Thread global mutex.
|-
| 0x1C8
| 0x08
| Unknown.
|}

Error codes

2018-01-14T01:37:12Z

OgniK: Added invalid nca key index error

= Structure =
These have been redesigned from the 3DS so that they fit within a Aarch64 MOV instruction immediate most of the time (without requiring the additional MOVK).

{| class=wikitable
! Bits || Field
|-
| 8-0 || Module
|-
| 21-9 || Description
|}

When a fatal-error is received the error code is outputted using the following formatter:
%04d-%04x

.. where the first code is <code>2000 + Module</code>, and the other being <code>Description</code>. Bits >=22 from the error-code are unused when displaying fatal-errors, since the Description ends with bit21.

= Modules =
{| class=wikitable
! Value || Name
|-
| 1 || Kernel
|-
| 2 || FS
|-
| 3 || NVIDIA, TransferMemory
|-
| 5 || NCM
|-
| 6 || DD
|-
| 8 || LR
|-
| 9 || Loader
|-
| 10 || CMIF (IPC command interface)
|-
| 11 || HIPC (IPC)
|-
| 15 || PM
|-
| 16 || NS
|-
| 18 || HTC
|-
| 21 || SM
|-
| 22 || RO userland
|-
| 24 || SDMMC
|-
| 26 || SPL
|-
| 100 || ETHC
|-
| 101 || I2C
|-
| 105 || Settings
|-
| 110 || NIFM
|-
| 114 || Display
|-
| 116 || NTC
|-
| 117 || FGM
|-
| 120 || PCIE
|-
| 121 || Friends
|-
| 123 || SSL
|-
| 124 || Account
|-
| 126 || Mii
|-
| 128 || AM
|-
| 129 || Play Report
|-
| 133 || PCV
|-
| 134 || OMM
|-
| 137 || NIM
|-
| 138 || PSC
|-
| 140 || USB
|-
| 143 || BTM
|-
| 147 || ERPT
|-
| 148 || APM
|-
| 153 || Audio
|-
| 154 || NPNS
|-
| 157 || ARP
|-
| 158 || BOOT
|-
| 161 || NFC
|-
| 162 || Userland assert
|-
| 168 || Userland crash
|-
| 203 || HID
|-
| 206 || Capture
|-
| 345 || libnx
|-
| 346 || HomebrewLoader
|-
| 651 || TC
|-
| 800 || [[Internet_Browser|General web-applet]]
|-
| 809 || [[Internet_Browser|WifiWebAuthApplet]]
|-
| 810 || [[Internet_Browser|Whitelisted-applet]]
|-
| 811 || [[Internet_Browser|ShopN]]
|}

8XX is for/includes system applets.

= Error codes =
{| class=wikitable
! Value || Description || Description
|-
| 0x1C01 || 14 || Invalid kernel capability descriptor
|-
| 0x4201 || 33 || [[SPL_services#GetConfig|IsDebugMode]] isn't set.
|-
| 0xCA01 || 101 || Invalid size
|-
| 0xCC01 || 102 || Invalid address
|-
| 0xCE01 || 103 || Slabheap full
|-
| 0xD001 || 104 || Memory full
|-
| 0xD201 || 105 || Handle-table full.
|-
| 0xD401 || 106 || Invalid memory state / invalid memory permissions.
|-
| 0xD801 || 108 || Invalid memory permissions.
|-
| 0xDC01 || 110 || Invalid memory range
|-
| 0xE001 || 112 || Invalid thread priority.
|-
| 0xE201 || 113 || Invalid processor id.
|-
| 0xE401 || 114 || Invalid handle.
|-
| 0xE601 || 115 || Syscall copy from user failed.
|-
| 0xE801 || 116 || Invalid combination
|-
| 0xEA01 || 117 || Time out. Also when you give 0 handles to svcWaitSynchronizationN.
|-
| 0xEC01 || 118 || Canceled/interrupted [?]
|-
| 0xEE01 || 119 || Exceeding maximum
|-
| 0xF001 || 120 || Invalid enum
|-
| 0xF201 || 121 || No such entry
|-
| 0xF401 || 122 || Irq/DeviceAddressSpace/{...} already registered
|-
| 0xF601 || 123 || Port remote dead
|-
| 0xF801 || 124 || [Usermode] Unhandled interrupt
|-
| 0xFA01 || 125 || Wrong memory permission?
|-
| 0xFC01 || 126 || Reserved value
|-
| 0xFE01 || 127 || Invalid hardware breakpoint
|-
| 0x10001 || 128 || [Usermode] Fatal exception
|-
| 0x10201 || 129 || Last thread didn't belong to your process
|-
| 0x10601 || 131 || Port max sessions exceeded
|-
| 0x10801 || 132 || Resource limit exceeded
|-
| 0x20801 || 260 || Command buffer too small
|-
| 0x41001 || 520 || Process not being debugged
|-
| 0xE02 || 7 || Savedata [[Filesystem_services|already]] mounted
|-
| 0x7802 || 60 || The specified [[NCA]]-type doesn't exist for this title.
|-
| 0x7D202 || 1001 || Process does not have RomFs
|-
| 0x7D402 || 1002 || Title-id not found / savedata not found.
|-
| 0xFA202 || 2001 || SD card not inserted
|-
| 0x13B002 || 2520 || Gamecard not inserted
|-
| 0x13DA02 || 2541 || Version check failed when mounting gamecard sysupdate partition?
|-
| 0x171402 || 2954 || Invalid gamecard handle.
|-
| 0x196002 || 3248 || Out of memory
|-
| 0x196202 || 3249 || Out of memory
|-
| 0x1A4A02 || 3365 || Out of memory
|-
| 0x235E02 || 4527 || NCA-path used with the wrong titleID.
|-
| 0x235202 || || Invalid NCA Key index
|-
| 0x250E02 || 4743 || [[NAX0|Corrupted]] NAX0 header.
|-
| 0x251002 || 4744 || Invalid [[NAX0]] magicnum.
|-
| 0x2EE202 || 6001 || Invalid input
|-
| 0x2EE602 || 6003 || Path too long
|-
| 0x2F5A02 || 6061 || Offset outside storage
|-
| 0x313802 || 6300 || Operation not supported
|-
| 0x320002 || 6400 || Permission denied
|-
| 0x326602 || 6451 || Missing titlekey(?) required to mount content
|-
| 0x3EA03 || 501 || Invalid handle
|-
| 0x3EE03 || 503 || Invalid memory mirror
|-
| 0xA05 || 5 || [[Content_Manager_services|NcaID]] not found. Returned when attempting to mount titles which exist that aren't *8XX titles, the same way *8XX titles are mounted.
|-
| 0xE05 || 7 || TitleId not found
|-
| 0x1805 || 12 || Invalid StorageId
|-
| 0xDC05 || 110 || Gamecard not inserted
|-
| 0x17C05 || 190 || Gamecard not initialized
|-
| 0x1F405 || 250 || Sdcard not inserted
|-
| 0x20805 || 260 || Storage not mounted
|-
| 0x806 || 4 || Converted from error 0xD401.
|-
| 0x1006 || 8 || Converted from error 0xE401.
|-
| 0x408 || 2 || Not initialized.
|-
| 0x608 || 3 || Invalid control StorageID.
|-
| 0x808 || 4 || Storage not found.
|-
| 0xA08 || 5 || Access denied.
|-
| 0xE08 || 7 || Title is not registered.
|-
| 0x209 || 1 || Args too long.
|-
| 0x409 || 2 || Maximum processes loaded.
|-
| 0x609 || 3 || NPDM too big.
|-
| 0x809 || 4 || Invalid NPDM.
|-
| 0xA09 || 5 || Invalid files.
|-
| 0xE09 || 7 || Already registered.
|-
| 0x1009 || 8 || Title not found.
|-
| 0x1209 || 9 || Title-id in ACI0 doesn't match range in ACID.
|-
| 0x6609 || 51 || Invalid memory state/permission
|-
| 0x6A09 || 53 || Invalid NRR
|-
| 0xA209 || 81 || Unaligned NRR address
|-
| 0xA409 || 82 || Bad NRR size
|-
| 0xAA09 || 85 || Bad NRR address
|-
| 0xAE09 || 87 || Bad initialization
|-
| 0xC809 || 100 || Unknown ACI0 descriptor
|-
| 0xCE09 || 103 || ACID/ACI0 don't match for descriptor "KernelFlags"
|-
| 0xD009 || 104 || ACID/ACI0 don't match for descriptor "SyscallMask"
|-
| 0xD409 || 106 || ACID/ACI0 don't match for descriptor "MapIoOrNormalRange"
|-
| 0xD609 || 107 || ACID/ACI0 don't match for descriptor "MapNormalPage"
|-
| 0xDE09 || 111 || ACID/ACI0 don't match for descriptor "InterruptPair"
|-
| 0xE209 || || ACID/ACI0 don't match for descriptor "ApplicationType"
|-
| 0xE409 || || ACID/ACI0 don't match for descriptor "KernelReleaseVersion"
|-
| 0xE609 || || ACID/ACI0 don't match for descriptor "HandleTableSize"
|-
| 0xE809 || || ACID/ACI0 don't match for descriptor "DebugFlags"

|-
| 0x1A80A || 212 || Bad magic (expected 'SFCO')
|-
| 0x20B || 1 || Size too big to fit to marshal.
|-
| 0x11A0B || 141 || Went past maximum during marshalling.
|-
| 0x1900B || 200 || Session doesn't support domains.
|-
| 0x25A0B || 301 || Remote process is dead.
|-
| 0x3D60B || 491 || IPC Query 1 failed.
|-
| 0x20F || 1 || Pid not found
|-
| 0x60F || 3 || Process has no pending events
|-
| 0x410 || 2 || Title-id not found
|-
| 0xF010 || 120 || Gamecard sysupdate not required
|-
| 0x1F610 || 251 || Unexpected StorageId
|-
| 0x415 || 2 || Not initialized.
|-
| 0x615 || 3 || Max sessions
|-
| 0xC15 || 6 || Invalid name (all zeroes)
|-
| 0x1015 || 8 || Permission denied
|-
| 0x416 || 2 || Address space is full
|-
| 0x616 || 3 || NRO already loaded
|-
| 0x816 || 4 || Invalid NRO header values
|-
| 0xC16 || 6 || Bad NRR magic
|-
| 0x1016 || 8 || Reached max NRR count
|-
| 0x1216 || 9 || Unable to verify NRO hash or NRR signature
|-
| 0x80216 || 1025 || Address not page-aligned
|-
| 0x80416 || 1026 || Incorrect NRO size
|-
| 0x80816 || 1028 || NRO not loaded
|-
| 0x80A16 || 1029 || NRR not loaded
|-
| 0x80C16 || 1030 || Already initialized
|-
| 0x80E16 || 1031 || Not initialized
|-
| 0x41A || 2 || Argument is invalid
|-
| 0xC81A || 100 || Incorrect buffer size
|-
| 0xCA1A || 101 || Unknown TZ error
|-
| 0xD01A || 104 || All AES engines busy
|-
| 0xD21A || 105 || Invalid AES engine-id
|-
| 0x272 || 1 || Generic error
|-
| 0xCC74 || 102 || Time not set
|-
| 0x287C || 20 || Argument is NULL
|-
| 0x2C7C || 22 || Argument is invalid
|-
| 0x3C7C || 30 || Bad input buffer size
|-
| 0x407C || 32 || Invalid input buffer
|-
| 0x668C || 51 || USB data-transfer in progress
|-
| 0xC0899 || 1540 || Audio output was already started
|-
| 0x3C9D || 30 || Address is NULL
|-
| 0x3E9D || 31 || PID is NULL
|-
| 0x549D || 42 || Already bound
|-
| 0xCC9D || 102 || Invalid PID
|-
| 0x3CF089 || 7800 || Unknown/invalid libcurl error.
|-
| 0x3E8289-0x3F4089 || 8001-8096 || libcurl error 1-96. Some of the libcurl errors in the error-table map to the above unknown-libcurl-error however.
|}

== FS Error Codes ==

The following are the error codes recognized by nn::fs::detail::LogErrorMessage found in some [[Factory Setup|factory]] titles:

{| class=wikitable
! Error Code || Description || Message
|-
| 0x7802 || 60 || Error: Specified mount name already exists.
|-
| 0xD401 || 106 || Error: Passed buffer is not usable for fs library.
|-
| 0x7D202 || 1001 || Error: Specified partition is not found.
|-
| 0x7D402 || 1002 || Error: Specified target is not found.
|-
| 0xFA002 - 0x138602 || 2000 - 2499 || Error: Failed to access SD card.
|-
| 0x136802 - 0x176E02 || 2500 - 2999 || Error: Failed to access game card.
|-
| 0x177202 || 3001 || Error: Specified operation is not implemented.
|-
| 0x177A02 || 3005 || Error: Specified value is out of range.
|-
| 0x1B5802 - 0x1F3E02 || 3500 - 3999 || Error: Failed to access MMC.
|-
| 0x1F4202 - 0x219602 || 4001 - 4299 || Error: ROM is corrupted.
|-
| 0x219A02 - 0x232602 || 4301 - 4499 || Error: Save data is corrupted.
|-
| 0x232A02 - 0x23EE02 || 4501 - 4599 || Error: NCA is corrupted.
|-
| 0x23F202 - 0x243E02 || 4601 - 4639 || Error: Integrity verification failed.
|-
| 0x244202 - 0x246602 || 4641 - 4659 || Error: Partition FS is corrupted.
|-
| 0x246A02 - 0x248E02 || 4661 - 4679 || Error: Built-in-storage is corrupted.
|-
| 0x249202 - 0x24B602 || 4681 - 4699 || Error: FAT FS is corrupted.
|-
| 0x24BA02 - 0x24DE02 || 4701 - 4719 || Error: HOST FS is corrupted.
|-
| 0x1F4002 - 0x270E02 || 4000, 4300, 4500, 4600, 4640, 4660, 4680, 4700, 4720-4999 || Error: Data is corrupted.
|-
| 0x271002 - 0x2EDE02 || 5000-5999 || Error: Unexpected failure occurred.
|-
| 0x2EE402 - 0x2F1A02 || 6002-6029 || Error: Invalid path was specified.
|-
| 0x2F5A02 || 6061 || Error: Invalid offset was specified.
|-
| 0x2F5C02 || 6062 || Error: Invalid size was specified.
|-
| 0x2F5E02 || 6063 || Error: Null pointer argument was specified.
|-
| 0x2EE002 || 6000 || Error: Precondition violation.
|-
| 0x2EE202 - 0x306E02 || 6001-6199 || Error: Invalid argument was specified.
|-
| 0x307202 || 6201 || Error: OpenMode_AllowAppend is required for implicit extension of file size by WriteFile().
|-
| 0x307002 - 0x313602 || 6200, 6202 - 6299 || Error: Invalid operation for the open mode.
|-
| 0x313802 - 0x31FE02 || 6300-6399 || Error: Unsupported operation.
|-
| 0x320002 - 0x32C602 || 6400-6499 || Error: Permission denied.
|-
| 0x346402 || 6706 || Error: Enough journal space is not left.
|-
| 0x346A02 || 6709 || Error: The open count of files and directories reached the limitation.
|}

= Fatal Errors =
{| class=wikitable
! Error || Description
|-
| 2162-0002
| Can be triggered by running [[SVC|svcBreak]]. The svcBreak params have no affect on the value of the thrown error-code.
|-
| 2168-0000
| Userland ARM undefined instruction exception
|-
| 2168-0001
| Userland ARM prefetch-abort due to PC set to non-executable region
|-
| 2168-0002
| Userland ARM data abort. Also caused by abnormal process termination via [[SVC|svcExitProcess]]. Note: directly jumping to nnMain()-retaddr from non-main-thread has the same result.
|-
| 2168-0003
| Userland PC address not aligned to 4 bytes
|-
| 2168-0008
| Can occur when attempting to call an svc outside the whitelist
|}

= Support Errors =
{| class=wikitable
! Error !! Module !! Description !! Notes
|-
|
| {web-applets listed above}
| 2750
| MP4 parsing failed.
|}
Normal error-codes displayed by the system also use the same format as fatal-errors.

Filesystem services

2018-01-14T00:53:14Z

OgniK: Added cmd#218 and updated cmd#6 for IDeviceOperator

= fsp-ldr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Notes
|-
| 0 || MountCode || u64 TitleId + X descriptor [[#ContentPath]] || Returns an [[#IFileSystem]].
|-
| 1 || IsCodeMounted || u64 ProcessId || Returns a bool (1 if code is mounted).
|-
| 2 || [4.0.0+] Initialize || PID descriptor ||
|}

= fsp-pr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#SetFsPermissions]] ||
|-
| 1 || [[#ClearFsPermissions]] ||
|-
| 2 || [4.0.0+] Initialize ||
|-
| 256 || [[#SetEnabledProgramVerification]] ||
|}

== SetFsPermissions ==
Takes a storageID, a pid, a titleID, a 0x1C type-A buffer for the [[NPDM#FS_Access_Header| FS Access Header]], and a 0x2C type-A buffer for the [[NPDM#FS_Access_Control| FS Access Control]]

Final FS permissions are stored as (ACI0_perms & ACID_perms). Will panic(svcBreak) when buffer sizes from ipc-rawdata are invalid.

== ClearFsPermissions ==
Takes a pid. Removes registered FS permissions for that PID.

== SetEnabledProgramVerification ==
Seems to sets a global flag to inputval & 1.

When the flag is zero, it will set ret=0 instead of ret={error} when verifying a RSA signature fails. This RSA signature seems to be the signature in the [[NPDM]] ACID. It then skips verifying what seems to be the second signature in the [[NCA_Format|NCA header]]. Note that if verifying the NPDM(?) signature is successful, and verifying that second signature fails, it will throw an error and abort.

= fsp-srv =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0] [[#MountContent]]
|-
| 1 || [[#Initialize]]
|-
| 2 || OpenDataFileSystemByCurrentProcess
|-
| 7 || [2.0.0+] [[#MountContent7]]
|-
| 8 || [2.0.0+] [[#MountContent]]
|-
| 9 || [3.0.0+] OpenDataFileSystemByApplicationId
|-
| 11 || [[#MountBis]]
|-
| 12 || [[#OpenBisPartition]]
|-
| 13 || InvalidateBisCache
|-
| 17 || OpenHostFileSystemImpl
|-
| 18 || MountSdCard
|-
| 19 || [2.0.0+] FormatSdCard
|-
| 21 || [[#DeleteSaveData]]
|-
| 22 || [[#CreateSaveData]]
|-
| 23 || [[#CreateSystemSaveData]]
|-
| 24 || RegisterSaveDataAtomicDeletion
|-
| 25 || [2.0.0+] DeleteSaveDataWithSpaceId
|-
| 26 || [2.0.0+] FormatSdCardDryRun
|-
| 27 || [2.0.0+] IsExFatSupported
|-
| 28 || [4.0.0+] DeleteSystemSaveData
|-
| 30 || [[#OpenGameCardPartition]]
|-
| 31 || [[#MountGameCardPartition]]
|-
| 32 || [3.0.0+] ExtendSaveData
|-
| 51 || [[#MountSaveData]]
|-
| 52 || [[#MountSystemSaveData]]
|-
| 53 || [2.0.0+] MountSaveDataReadOnly
|-
| 57 || [3.0.0+] ReadSaveDataFileSystemExtraDataWithSpaceId
|-
| 58 || ReadSaveDataFileSystemExtraData
|-
| 59 || [2.0.0+] WriteSaveDataFileSystemExtraData
|-
| 60 || OpenSaveDataInfoReader
|-
| 61 || OpenSaveDataIterator
|-
| 80 || OpenSaveDataThumbnailFile
|-
| 81 || [4.0.0+] OpenSaveDataTransferManager
|-
| 100 || MountImageDirectory
|-
| 110 || [[#MountContentStorage]]
|-
| 200 || OpenDataStorageByCurrentProcess
|-
| 201 || [3.0.0+] OpenDataStorageByApplicationId
|-
| 202 || [[#OpenDataStorageByDataId]]
|-
| 203 || Returns an [[#IStorage]]
|-
| 400 || [[#OpenDeviceOperator]]
|-
| 500 || [[#OpenSdCardDetectionEventNotifier]]
|-
| 501 || [[#OpenGameCardDetectionEventNotifier]]
|-
| 600 || [1.0.0-3.0.2] SetCurrentPosixTime
|-
| 601 || QuerySaveDataTotalSize
|-
| 602 || [[#VerifySaveData]]
|-
| 603 || CorruptSaveDataForDebug
|-
| 604 || CreatePaddingFile
|-
| 605 || DeleteAllPaddingFiles
|-
| 606 || [2.0.0+] GetRightsId
|-
| 607 || [2.0.0+] RegisterExternalKey
|-
| 608 || [2.0.0+] UnregisterExternalKey
|-
| 609 || [2.0.0+] GetRightsIdByPath
|-
| 610 || [3.0.0+] GetRightsIdByPath2 (returns extra byte)
|-
| 611 || [4.0.0+] SetCurrentPosixTime
|-
| 612 || [4.0.0+] GetFreeSpaceSize
|-
| 613 || [4.0.0+]
|-
| 614 || [4.0.0+]
|-
| 620 || [2.0.0+] [[#SetSdCardEncryptionSeed]]
|-
| 630 || [4.0.0+] SetSdCardAccessibility
|-
| 631 || [4.0.0+] IsSdCardAccessible
|-
| 640 || [4.0.0+] IsSignedSystemPartitionOnSdCardValid
|-
| 800 || [2.0.0+] GetAndClearFileSystemProxyErrorInfo
|-
| 1000 || SetBisRootForHost
|-
| 1001 || SetSaveDataSize
|-
| 1002 || SetSaveDataRootPath
|-
| 1003 || DisableAutoSaveDataCreation
|-
| 1004 || [[#SetGlobalAccessLogMode]]
|-
| 1005 || [[#GetGlobalAccessLogMode]]
|-
| 1006 || [[#OutputAccessLogToSdCard]]
|-
| 1007 || [4.0.0+] RegisterUpdatePartition
|-
| 1008 || [4.0.0+] MountRegisteredUpdatePartition
|-
| 1009 || [4.0.0+]
|-
| 1100 || [4.0.0+] OverrideSaveDataTransferTokenSignVerificationKey
|}

== Permissions ==
Every time permissions are checked, the process registration [[#fsp-pr]] is loaded using the session processID. The permission data is populated with data from the [[NPDM]],

If the processID is <= 6 (which happens only for built-in sysmodules), it will use a hardcoded registration data. The default mask in this case is 0x8000000000000000.

Note that the functions check whether or not at least one bit is set in the mask. This means that, you don't need to set 0xFFFFFFFFFFFFFFFF to get all permissions: it suffices to set 0x8000000000000000.

If the code were to request an invalid input type, panic. But this never happens.

=== RwPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Value || Used by
|-
| 0x0 || 0x8000000000000801 || MountContentType2 || 1 || [[#MountContent]]
|-
| 0x1 || 0x8000000000000801 || MountContentType5 || 1 || [[#MountContent]]
|-
| 0x2 || 0x8000000000000801 || MountContentType3 || 1 || [[#MountContent]]
|-
| 0x3 || 0x8000000000000801 || MountContentType4 || 1 || [[#MountContent]]
|-
| 0x4 || 0x8000000000000801 || MountContentType6 || 1 || [[#MountContent]]
|-
| 0x5 || 0x8000000000000801 || MountContentType7 || 1 || [[#MountContent]]
|-
| 0x6 || 0x8000000000000000 || || 3 ||
|-
| 0x7 || 0x8000000000000800 || ContentStorageAccess || 3 || [[#MountContentStorage]]
|-
| 0x8 || 0x8000000000001000 || ImageDirectoryAccess || 3 || [[#MountImageDirectory]]
|-
| 0x9 || 0x8000000000000084 || MountBisType28 || 3 || [[#MountBis]]
|-
| 0xA || 0x8000000000000080 || MountBisType29 || 3 || [[#MountBis]]
|-
| 0xB || 0x8000000000008080 || MountBisType30 || 3 || [[#MountBis]]
|-
| 0xC || 0x8000000000008080 || MountBisType31 || 3 || [[#MountBis]]
|-
| 0xD || 0x8000000000000080 || || 3 ||
|-
| 0xE || 0xC000000000200000 || SdCardAccess || 3 || [[#MountSdCard]]
|-
| 0xF || 0x8000000000000010 || GameCardUser || 3 || [[#MountGameCardPartition]]
|-
| 0x10 || 0x8000000000040020 || SaveDataAccess0 || 3 || [[#MountSaveData]]
|-
| 0x11 || 0x8000000000000028 || SystemSaveDataAccess0 || 3 || [[#MountSystemSaveData]]
|-
| 0x12 || 0x8000000000000020 || SaveDataAccess1 || 3 || [[#MountSaveData]]
|-
| 0x13 || 0x8000000000000020 || SystemSaveDataAccess1 || 3 || [[#MountSystemSaveData]]
|-
| 0x14 || 0x8000000000010082 || BisPartition0 || 3 || [[#OpenBisPartition]]
|-
| 0x15 || 0x8000000000010080 || BisPartition10 || 3 || [[#OpenBisPartition]]
|-
| 0x17 || 0x8000000000010080 || BisPartition20 || 3 || [[#OpenBisPartition]]
|-
| 0x18 || 0x8000000000010080 || BisPartition21 || 3 || [[#OpenBisPartition]]
|-
| 0x19 || 0x8000000000010080 || BisPartition22 || 3 || [[#OpenBisPartition]]
|-
| 0x1A || 0x8000000000010080 || BisPartition23 || 3 || [[#OpenBisPartition]]
|-
| 0x1B || 0x8000000000010080 || BisPartition24 || 3 || [[#OpenBisPartition]]
|-
| 0x1C || 0x8000000000010080 || BisPartition25 || 3 || [[#OpenBisPartition]]
|-
| 0x16 || 0x8000000000000080 || BisPartition26 || 3 || [[#OpenBisPartition]]
|-
| 0x1D || 0x8000000000000084 || BisPartition27 || 3 || [[#OpenBisPartition]]
|-
| 0x1E || 0x8000000000000084 || BisPartition28 || 3 || [[#OpenBisPartition]]
|-
| 0x1F || 0x8000000000000080 || BisPartition29 || 3 || [[#OpenBisPartition]]
|-
| 0x20 || 0x8000000000000080 || BisPartition30 || 3 || [[#OpenBisPartition]]
|-
| 0x21 || 0x8000000000000080 || BisPartition31 || 3 || [[#OpenBisPartition]]
|-
| 0x22 || 0x8000000000000080 || BisPartition32 || 3 || [[#OpenBisPartition]]
|-
| 0x23 || 0xC000000000200000 || || 3 ||
|-
| 0x24 || 0x8000000000000100 || GameCard_System || 3 || [[#OpenGameCardPartition]], [[#EraseGameCard]] (bit1), [[#WriteToGameCard]] (bit1)
|-
| 0x25 || 0x8000000000100008 || MountContent_System || 1 || [[#MountContent]], [[#OpenDataStorageByDataId]]
|-
| 0x26 || 0xC000000000400000 || HostAccess || 3 || [[#OpenHostFileSystemImpl]]
|}

=== BoolPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Used by
|-
| 0x0 || 0x8000000000000080 || BisCache || [[#InvalidateBisCache]]
|-
| 0x1 || 0x8000000000000080 || EraseMmc || [[#EraseMmc]]
|-
| 0x2 || 0x8000000000000010 || GameCardCertificate || [[#GetGameCardDeviceCertificate]]
|-
| 0x3 || 0x8000000000000010 || GameCardIdSet || [[#GetGameCardIdSet]]
|-
| 0x4 || 0x8000000000000200 || GameCardDriver || [[#FinalizeGameCardDriver]]
|-
| 0x5 || 0x8000000000000200 || GameCardAsic || [[#GetGameCardAsicInfo]]
|-
| 0x6 || 0x8000000000002020 || SaveDataCreate || [[#CreateSaveData]]
|-
| 0x7 || 0x8000000000000060 || SaveDataDelete0 || [[#DeleteSaveData]], [[#RegisterSaveDataAtomicDeletion]]
|-
| 0x8 || 0x8000000000000028 || SystemSaveDataCreate0 || [[#CreateSystemSaveData]]
|-
| 0x9 || 0x8000000000000020 || SystemSaveDataCreate1 || [[#CreateSystemSaveData]]
|-
| 0xA || 0x8000000000004028 || SaveDataDelete1 || [[#DeleteSaveData]], [[#RegisterSaveDataAtomicDeletion]]
|-
| 0xB || 0x8000000000000060 || SaveDataIterators0 || [[#OpenSaveDataIterator]], [[#OpenSaveDataInfoIterator]]
|-
| 0xC || 0x8000000000004020 || SaveDataIterators1 || [[#OpenSaveDataIterator]], [[#OpenSaveDataInfoIterator]]
|-
| 0xD || 0x8000000000020000 || SaveThumbnails || [[#OpenSaveDataThumbnailFile]]
|-
| 0xE || 0x8000000000000400 || PosixTime || [[#SetCurrentPosixTime]]
|-
| 0xF || 0x8000000000004060 || SaveDataExtraData || [[#ReadSaveDataFileSystemExtraData]]
|-
| 0x10 || 0x8000000000080000 || GlobalMode || [[#SetGlobalAccessMode]]
|-
| 0x11 || 0x8000000000080000 || SpeedEmulation || [[#SetSpeedEmulationMode]]
|-
| 0x12 || Invalid || ||
|-
| 0x13 || 0xC000000000800000 || PaddingFiles || [[#CreatePaddingFile]], [[#DeletePaddingFiles]]
|-
| 0x14 || 0xC000000001000000 || SaveData_Debug || [[#CorruptSaveDataForDebug]]
|-
| 0x15 || 0xC000000002000000 || SaveData_SystemManagement || [[#CreateSaveData]], [[#MountSaveData]], [[#SetSaveDataRootPath]]
|-
| [2.0.0+] 0x16 || 0x8000000004000000 || ||
|-
| [2.0.0+] 0x17 || 0x8000000008000000 || ||
|-
| [2.0.0+] 0x18 || 0x8000000010000000 || ||
|-
| [2.0.0+] 0x19 || 0x8000000000000800 || ||
|-
| [2.0.0+] 0x1A || 0x8000000000004020 || ||
|}

== Initialize ==
Takes a pid-descriptor.

== MountContent7 ==
Takes an input u32 (same as [[#MountContent]]) and an u64 title-id. Web-applet loads the u32 from u32_table[inparam]. The in32 must be 4.

Returns an [[#IFileSystem]].

Note: web-applet strings refer to both this cmd and the below "MountContent" as "MountContent".

== MountContent ==
Takes a type-0x19 input buffer, an in32, and an input title-id.

The in32 must be 5 if the NCA type is 0 (control).

The in32 must be 2..7.

The input buffer is the output string path from nsam [[NS_Services#GetContentNcaPath|GetContentNcaPath]].

Returns an [[#IFileSystem]].

May return errors when attempting to access NCA-paths for an update-title with a gamecard, when the gamecard isn't inserted. May return error 0x7D402 in some cases with update-titles. Non-val2 in32 values with NCA-type1 are unusable, even for normal titles.

The official "MountApplicationPackage" func uses this with in64=0 and in32=7.

After the in32-specific permissions are checked, it then gets the func retval for permissions-type 0x25 and func0.

When in32=5, it uses in64=0xffffffffffffffff internally, otherwise it checks if in64 is set to 0xffffffffffffffff then throws an error if so. When the in64 used internally is not 0xffffffffffffffff, it's compared with the NCA titleID, then an error is thrown on mismatch.

== MountBis ==
Takes a type-0x19 input buffer string and a u32 Bis partitionID(see below). Official user-process code sets instr[0] = 0 normally.

Returns an [[#IFileSystem]].

Only partitionIDs for FAT partitions are usable with this, otherwise error 0x2EE202 is returned. Seems to be about the same as [[#OpenBisPartition]] except this mounts the partition filesystem instead of allowing direct access to the partition sectors.

== OpenBisPartition ==
Takes a u32 partition ID, returns 0x2EE202 for partitions which do not exist, 0x320002 for partitions which cannot be opened and a valid [[#IStorage]] handle otherwise.

== InvalidateBisCache ==
Seems to invalidate the Bis cache for MBR/GPT after overwriting that data via the OpenBisPartition IStorage. Used by [[SystemInitializer]].

== DeleteSaveData ==
Takes an input u64.

== CreateSaveData ==
Takes a 0x40-byte Save-struct entry, a 0x40-byte SaveCreate-struct entry, and a 0x10-byte input struct.

Only the first 0x5-bytes in the 0x10-byte struct are initialized: all-zero when automatically creating savedata during savecommon mount by official user-processes. In the dedicated save-creation code in official user-processes: +0 u32 = 0x40060, +4 u8 = 1.

Creates regular savedata.

== CreateSystemSaveData ==
Takes a 0x40-byte Save-struct entry and a 0x40-byte SaveCreate-struct entry.

Creates savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== OpenGameCardPartition ==

Takes an input u32 (partition ID), and returns an [[#IStorage]] for the [[Gamecard_Format|partition]].

== MountGameCardPartition ==
Takes two input u32s, with the second u32 located at +4 in rawdata after the first u32.

Returns an [[#IFileSystem]].

Mounts a gamecard [[Gamecard_Partition|partition]].

== MountSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Official user-process code is only known to use value 1 for the u8.

Returns an [[#IFileSystem]].

Permissions aren't checked until the specified save is successfully found.

Only one process can mount a given savedata at any given time (this includes systemsavedata).

== MountSystemSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Web-applet only uses value0 for the input u8.

Returns an [[#IFileSystem]].

Mounts savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== MountContentStorage ==
Takes a [[#ContentStorageId]]. Invalid values return 0x2EE202.

Returns an [[#IFileSystem]] with NCA files. The read data from these files is identical to the data read by [[Content_Manager_services#ReadEntryRaw]].

== OpenDataStorageByDataId ==
Takes a [[#StorageId]] and a TitleID.

Returns a [[IPC_Marshalling#Domain_message|domain object ID]] implementing the [[#IStorage]] interface for data archives.

== OpenDeviceOperator ==
This command returns a session to a port implementing the [[#IDeviceOperator]] interface.

== OpenSdCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== OpenGameCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== VerifySaveData ==
Takes an unknown input u64 and a type-0x6 output buffer.

The input u64 high-byte must be non-zero, otherwise an [[Error_codes|error]] is returned(0xE02).

== SetSdCardEncryptionSeed ==
Takes 0x10-bytes of input.

Appears to be used to load the seed into FS-module state, since FS-module itself doesn't seem to have file-reading code to handle this itself.

[[NS_Services|NS]]-module uses this with data read from a file.

== SetGlobalAccessLogMode ==
Takes an input u32.

== GetGlobalAccessLogMode ==
Returns an output u32.

GlobalAccessLogMode is normally 0.

== OutputAccessLogToSdCard ==
Takes a type-0x5 input buffer.

The input buffer is the string to output to the log. User-processes normally include a newline at the end.

User-processes only use this when the value previously loaded from [[#GetGlobalAccessLogMode]] has bit1 set.

When bit1 in GlobalAccessLogMode is clear, FS-module will just return 0 for OutputAccessLogToSdCard. However even with that set the log doesn't show up SD, unknown why.

The input buffer is written to the "$FsAccessLog:/FsAccessLog.txt" file, where "$FsAccessLog" is the SD-card mount-name. It's written to the current end of the file(appended).

= IStorage =
This is the interface for a raw device, usually a block device.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments
|-
| 0 || Read || Takes a type-0x46 buffer, an offset and length
|-
| 1 || Write || Takes a type-0x45 buffer, an offset and length
|-
| 2 || Flush || None
|-
| 3 || SetSize || Takes a size
|-
| 4 || GetSize || None
|-
| 5 || [4.0.0+] OperateRange ||
|}

= IFileSystem =
There are two main implementations of this interface:

* '''RomFS''': Filesystem implementation statically linked in the binary. Uses an [[#IStorage]] interface as underlying raw device.
* '''IPC proxy''': Used for all non-RomFS filesystems. In this case, actual filesystem implementation is in the FS process.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateFile
|-
| 1 || DeleteFile
|-
| 2 || CreateDirectory
|-
| 3 || DeleteDirectory
|-
| 4 || DeleteDirectoryRecursively
|-
| 5 || RenameFile
|-
| 6 || RenameDirectory
|-
| 7 || [[#GetEntryType]]
|-
| 8 || OpenFile
|-
| 9 || [[#OpenDirectory]]
|-
| 10 || [[#Commit]]
|-
| 11 || [[#GetFreeSpaceSize]]
|-
| 12 || [[#GetTotalSpaceSize]]
|-
| 13 || CleanDirectoryRecursively [3.0.0+]
|-
| 14 || GetFileTimeStampRaw [3.0.0+]
|-
| 15 || [4.0.0+] QueryEntry
|}

== GetEntryType ==
Takes a type-0x9 input buffer for the path and returns [[#DirectoryEntryType]] as an output u32.

==OpenDirectory==
Takes a type-0x9 input buffer for the path and an u64 '''filter_flags'''. '''filter_flags''' controls what type of entries are read by the [[#IDirectory]]: bitmask 0x1 = directories, bitmask 0x2 = files.

== Commit ==
Like [https://3dbrew.org/wiki/FS:ControlArchive 3DS], this has to be used after writing to savedata for the changes to take affect.

== GetFreeSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total free space with this FS.

== GetTotalSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total space available with this FS(free+used).

= IDirectory =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Read]]
|-
| 1 || [[#GetEntryCount]]
|}

== Read ==
Takes a type-0x6 output buffer and an input u64. Unknown what the u64 is for, doesn't(?) seem to affect output. Returns an output u64(?) for the total number of read entries, this is 0 when no more entries are available.

The output buffer contains the read array of [[#DirectoryEntry]]. This doesn't include entries for "." and "..".

== GetEntryCount ==
Returns an u64 for the total number of readable entries.

= DirectoryEntry =
{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x300 || Path
|-
| 0x300 || 0x4 || ?
|-
| 0x304 || 0x1 || [[#DirectoryEntryType]]
|-
| 0x305 || 0x3 || Padding?
|-
| 0x308 || 0x8? || Filesize, 0 for directories.
|}

= DirectoryEntryType =
s8 type: 0 = directory, 1 = file.

= IFile =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Read
|-
| 1 || Write
|-
| 2 || Flush
|-
| 3 || SetSize
|-
| 4 || GetSize
|-
| 5 || [4.0.0+]
|}

= ISaveDataInfoReader =

= IDeviceOperator =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsSdCardInserted
|-
| 1 || GetSdCardSpeedMode
|-
| 2 || [2.0.0+] GetSdCardCid
|-
| 3 || [2.0.0+] GetSdCardUserAreaSize
|-
| 4 || [2.0.0+] GetSdCardProtectedAreaSize
|-
| 5 || [2.0.0+] GetAndClearSdCardErrorInfo
|-
| 6 || [2.0.0->3.0.0]
|-
| 100 || GetMmcCid
|-
| 101 || GetMmcSpeedMode
|-
| 110 || EraseMmc
|-
| 111 || GetMmcPartitionSize
|-
| 112 || [2.0.0+] GetMmcPatrolCount
|-
| 113 || [2.0.0+] GetAndClearMmcErrorInfo
|-
| 114 || [2.0.0+] GetMmcExtendedCsd
|-
| 115 || [4.0.0+] SuspendMmcPatrol
|-
| 116 || [4.0.0+] ResumeMmcPatrol
|-
| 200 || IsGameCardInserted
|-
| 201 || EraseGameCard
|-
| 202 || GetGameCardHandle
|-
| 203 || [[#GetGameCardUpdatePartitionInfo]]
|-
| 204 || FinalizeGameCardDriver
|-
| 205 || GetGameCardAttribute
|-
| 206 || GetGameCardDeviceCertificate
|-
| 207 || GetGameCardAsicInfo
|-
| 208 || GetGameCardIdSet
|-
| 209 || WriteToGameCard
|-
| 210 || SetVerifyWriteEnalbleFlag
|-
| 211 || GetGameCardImageHash
|-
| 212 || [2.0.0+] GetGameCardErrorInfo
|-
| 213 || [2.0.0+]
|-
| 214 || [2.0.0+] GetGameCardCid
|-
| 215 || [2.0.0+]
|-
| 216 || [2.0.0+]
|-
| 217 || [2.1.0+] Returns 0x40-bytes of output data.
|-
| 218 || [3.0.1+]
|-
| 300 || SetSpeedEmulationMode
|-
| 301 || GetSpeedEmulationMode
|}

== GetGameCardUpdatePartitionInfo ==

Returns a titleID and the title-version for it.

* Output u32 with ARMS-gamecard: title-version v131162. This is the title-version for [[2.1.0]], which is the sysupdate included with this gamecard. Launch-day gamecards return title-version v450.
* Output u64 with ARMS-gamecard: titleID 0100000000000816.

[[NS_Services|NS]] appears to only use this with [[Content_Manager_services#GetTitleIdInfo]] and [[Content_Manager_services#GetUpdateTitleList]] with storageid=nandsys, for checking whether a sysupdate is required.

= IEventNotifier =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || BindEvent
|}

= StorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || None
|-
| 1 || Host
|-
| 2 || GameCard
|-
| 3 || NandSystem
|-
| 4 || NandUser
|-
| 5 || SdCard
|}

= ContentStorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || NandSystem
|-
| 1 || NandUser
|-
| 2 || SdCard
|}

= ContentPath =
These are the 0x300 paths to NCA files for the various filesystems FS can access, beginning with @. They're passed via X descriptors, and returned via various [[Location Resolver services|ncm/lr]] commands.

{| class="wikitable" border="1"
|-
! Path || Notes
|-
| @SystemContent ||
|-
| @UserContent ||
|-
| @SdCardContent ||
|-
| @CalibFile ||
|-
| @Safe ||
|-
| @User ||
|-
| @System ||
|-
| @Sdcard ||
|-
| @Host ||
|-
| @GcApp || Gamecard App partition (Partition 2)
|-
| @GcS00000001 || Gamecard Contents.
|-
| @upp || Gamecard update partition (Partition 0)
|}

=BisPartitionID=
* 0: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 0.
* 10: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 1.
* Rest: see [[Flash_Filesystem|here]].

=Save Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| 0 for SystemSaveData. SaveData: 0 can be used for accessing the savedata associated with the current FS session titleID, otherwise when set this is the titleID associated with the savedata to access.
|-
| 0x8
| 0x10
| userID for user-specific savedata(saveuser) when set, otherwise when zero this indicates the common savedata(savecommon). This is loaded from [[Account_services]].
|-
| 0x18
| 0x8
| u64 [[Flash_Filesystem|saveID]]. 0 for SaveData.
|-
| 0x20
| 0x8
| ContentStorageId? 0 for SystemSaveData. 1 for SaveData. 2 for DeviceSaveData(with official user-processes all other fields are 0 for DeviceSaveData).
|-
| 0x28
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x30
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x38
| 0x8
| 0 for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=SaveCreate Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[Savegames|IVFC]] level4 size?
|-
| 0x8
| 0x8
| Same as offset 0x0 normally? Hard-coded to 0x80000 for BcatSaveData.
|-
| 0x10
| 0x8
| 0x4000 for SystemSaveData/SaveData/DeviceSaveData/BcatSaveData. [[Savegames|IVFC]] level4 block-size in bytes?
|-
| 0x18
| 0x8
| Official user-processes only uses 0 here for SystemSaveData/SaveData. For the dedicated save-creation code with SaveData/DeviceSaveData, this value comes from an input param with official user-processes. For BcatSaveData, this is the hard-coded [[Title_list|titleID]] of the bcat-sysmodule.
|-
| 0x20
| 0x4
| Written using an input param for official user-processes. Hard-coded 0 for BcatSaveData.
|-
| 0x24
| 0x1
| Official user-processes only uses 0 here for SystemSaveData, 1 for SaveData/DeviceSaveData/BcatSaveData.
|-
| 0x25
| 0x1
| 0 for SystemSaveData/SaveData.
|-
| 0x26
| 0x1A
| Not initialized for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=DeviceSaveData=
This is accessed using the same commands for SaveData with the same input u8, the only difference compared to SaveData is the Save-struct.

=BcatSaveData=
This is accessed using the same commands for SaveData with the same input u8. The Save-struct is the same as DeviceSaveData, except that the titleID field is set to <input titleID>. See above regarding SaveCreate-struct.

The 0x10-byte struct passed to [[#CreateSaveData]] has the first 0x5-bytes set to all-zero.

[[Category:Services]]

Fatal services

2017-10-04T01:31:47Z

OgniK: Added TransitionToFatalError

= fatal:u =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 || [[#TransitionToFatalError]]
|}

== TransitionToFatalError ==
Takes an input u64 errorcode and an unknown u64(TID maybe?). It also takes a type-0x15 error buffer and a pid-descriptor. The error buffer contains a stack trace.
The stack trace address count is stored at errorbuffer+0x240 and the addresses are stored at errorbuffer+0x130+i*8 where i = 0->address count
= fatal:p =

Title list/Games

2017-09-02T04:24:14Z

OgniK: Added Mario + Rabbids TID

{| class="wikitable sortable"
! Title-id || Versions || Required/included system-version || Media/Serial# || Description || Region || Type
|-
| 010000A00218E000 || v0 || || || Splatoon 2 Global Testfire || ALL || Timed Demo
|-
| 010002900294A000 || v0 || || || NBA Playgrounds || ALL || Game
|-
| 01000320000CC000 || v0 || None || Gamecard Front: LA-H-AACCA-{region} Back: AACCA22Y000 || 1-2 Switch || ALL || Game
|-
| 010009E001D90000 || v0 || || || World of Goo || EUR || Game
|-
| 010009E001D90800 || v65536 (0.1.0.0) || || || World of Goo || EUR || Update
|-
| 01000D10038E6000 || v0 || || || ACA NeoGeo Last Resort || ALL || VC
|-
| 01000DC003740000 || v0 || || Gamecard Front: LA-H-BAACB-USA Back: LG || Puyo Puyo Tetris || USA || Game
|-
| 01000E2003FA0000 || v0 || || || Mighty Gun Volt Burst || JPN || Game
|-
| 01001180021FA000 || v0 || || || Shovel Knight: Specter of Torment || ALL || Game
|-
| 01001180021FA800 || v131072 (0.2.0.0) || || || Shovel Knight: Specter of Torment || ALL || Update
|-
| 0100125002060000 || v0 || || || Battle Sports Meguru || JPN || Game
|-
| 0100152000022000 || v0 || None || Gamecard Front: LA-H-AABPA-{region} Back: AABPA22A000 || Mario Kart 8 Deluxe || ALL || Game
|-
| 0100152000022800 || v65536 (0.1.0.0) || || || Mario Kart 8 Deluxe || ALL || Update
|-
| 01001FA0034E2000 || v0 || || || Dark Witch Music Episode: Rudymical || ALL || Game
|-
| 010021B002EEA000 || v0 || || || Puyo Puyo Tetris || JPN || Demo
|-
| 010021C000B6A000 || v0 || || Gamecard Front: LA-H-BAAZA-USA Back: BAAZA20Y000 || The Binding of Isaac: Afterbirth+ || USA || Game
|-
| 010021C000B6A800 || v65536 (0.1.0.0) || || || The Binding of Isaac: Afterbirth+ || USA || Update
|-
| 0100225000FEE000 || v0 || || || Blaster Master Zero || ALL || Demo
|-
| 0100225000FEE800 || v65536 (0.1.0.0), v131072 (0.2.0.0) || || || Blaster Master Zero || ALL || Update
|-
| 01002580038DE000 || v0 || || || ACA NeoGeo Galaxy Fight: Universal Warriors || ALL || VC
|-
| 010025B002E92000 || v0 || || || Blaster Master Zero || ALL || Demo
|-
| 01002E70032E8000 || v0 || || || ACA NeoGeo Turf Masters || ALL || VC
|-
| 01002E70032E8800 || v65536 (0.1.0.0) || || || ACA NeoGeo Turf Masters || ALL || Update
|-
| 010031F002B66000 || v0 || || || Mr. Shifty || USA, EUR || Game
|-
| 010031F002B66800 || v65536 (0.1.0.0) || || || Mr. Shifty || USA, EUR || Update
|-
| 010035B00412A000 || v0 || || || Human Resource Machine || JPN || Game
|-
| 01003A30012C0000 || v0 || || || LEGO® CITY Undercover || USA || Game
|-
| 01003A30012C0800 || v131072 (0.2.0.0) || || || LEGO® CITY Undercover || USA || Update
|-
| 01003A5001DBA000 || v0 || || || ACA NeoGeo Over Top || ALL || VC
|-
| 01003D60012BE000 || v0 || || || Nobunaga's Nozomi - Creating with Power Up Kit || JPN || Game
|-
| 01003D60012BE800 || v65536 (0.1.0.0) || || || Nobunaga's Nozomi - Creating with Power Up Kit || JPN || Update
|-
| 0100404002F52000 || v0 || || || Silver Star Shogi Ten Tenshi Battle Raijin || JPN || Game
|-
| 010043F004126000 || v0 || || || Little Inferno || JPN || Game
|-
| 010047F001DBC000 || v0 || || || ACA NeoGeo Samurai Shodown IV || ALL || VC
|-
| 010048D000BFC000 || || || || ? || ? || Demo
|-
| 010048D000BFC800 || v131072 (0.2.0.0) || || || ? || ? || Update
|-
| 01004B1001D22000 || v0 || || || TumbleSeed || ALL || Game
|-
| 01004B1001D22800 || v65536 (0.1.0.0) || || || TumbleSeed || ALL || Update
|-
| 01004B10031BE000 || v0 || || || Puyo Puyo Tetris || EUR || Game
|-
| 01004B3004062000 || v0 || || || World of Goo || JPN || Game
|-
| 01004C200100E000 || v0 || || || New Frontier Days: Founding Pioneers || ALL || Game
|-
| 01004D10020F2000 || v0 || || || Graceful Explosion Machine || EUR || Game
|-
| 01004D10020F2800 || v131072 (0.2.0.0) || || || Graceful Explosion Machine || EUR || Update
|-
| 01004DE001DC8000 || v0 || || || ACA NeoGeo Shock Trooper's Second Scud || ALL || Game
|-
| 01004E90028A2000 || v0 || || || Vroom in the night sky || ALL || Game
|-
| 01004E90028A2800 || v65536 (0.1.0.0) || || || Vroom in the night sky || ALL || Update
|-
| 01004F7003726000 || v0 || || || Disgaea 5 Complete || JPN || Demo
|-
| 010053D0001BE000 || v0 || || || Puyo Puyo Tetris || JPN || Game
|-
| 010053D0001BE800 || v65536 (0.1.0.0) || || || Puyo Puyo Tetris || JPN || Update
|-
| 01005700031AE000 || v0 || || || Disgaea 5 Complete || EUR || Game
|-
| 01005700031AE800 || v65536 (0.1.0.0) || || || Disgaea 5 Complete || EUR || Update
|-
| 010057D0021E8000 || v0 || || || Shovel Knight: Treasure Trove || ALL || Game
|-
| 010057D0021E8800 || v131072 (0.2.0.0) || || || Shovel Knight: Treasure Trove || ALL || Update
|-
| 0100583001DCA000 || v0 || || || ACA NeoGeo The King Of Fighters '99 || ALL || VC
|-
| 010065A00213C000 || v0 || || || Sora Damu Flowering Declaration || JPN || Game
|-
| 010065A00213C800 || v65536 (0.1.0.0) || || || Sora Damu Flowering Declaration || JPN || Update
|-
| 01006740034F6000 || v0 || || || Just Dance 2017 || ALL || Game
|-
| 0100BCE000598000 || v0 || || || Just Dance 2017 || ALL || Demo
|-
| 0100BCE000598800 || v65536 (0.1.0.0) || || || Just Dance 2017 || ALL || Update
|-
| 01006A5003698000 || v0 || || || Maison De MAOU || JPN || Game
|-
| 01006BD001E06000 || v0 || || || Minecraft: Nintendo Switch Edition || ALL || Game
|-
| 01006BD001E06800 || v196608 (0.3.0.0) || || || Minecraft: Nintendo Switch Edition || ALL || Update
|-
| 01006F6002840000 || v0 || || || Thumper for Nintendo Switch || ALL || Game
|-
| 0100701001D92000 || v0 || || || Human Resource Machine || EUR || Game
|-
| 0100701001D92800 || v65536 (0.1.0.0), v131072 (0.2.0.0) || || || Human Resource Machine || EUR || Update
|-
| 0100704000B3A000 || v0 || || || Snipperclips || ALL || Game
|-
| 01007330027EE000 || v0 || || || ULTRA STREET FIGHTER II: The Final Challengers || USA || Game
|-
| 01007330027EE800 || v65536 (0.1.0.0) || || || ULTRA STREET FIGHTER II: The Final Challengers || USA || Update
|-
| 010073C001D5E000 || v0 || || (Digital Download) || Puyo Puyo Tetris || USA || Game
|-
| 0100744001588000 || v0 || || || Cars 3: Driven to Win || EUR || Game
|-
| 0100744001588800 || v65536 (0.1.0.0) || || || Cars 3: Driven to Win || EUR || Update
|-
| 01007AD00013E000 || v0 || None || || Super Bomberman R || ALL || Game
|-
| 01007AD00013E800 || v65536 (0.1.0.0), v131072 (0.2.0.0), v196608 (0.3.0.0), v262144 (0.4.0.0) || || || Super Bomberman R || ALL || Update
|-
| 01007D7001D0E000 || v0 || || || Oceanhorn: Monster of Uncharted Seas || ALL || Game
|-
| 01007EF00011E000 || v0 || None || Gamecard Front: LA-H-AAAAA-{region} Back: AAAAA13A000 || The Legend of Zelda: Breath of the Wild || ALL || Game
|-
| 01007EF00011E800 || v262144 (0.4.0.0) || || || The Legend of Zelda: Breath of the Wild || ALL || Update
|-
| 0100849000BDA000 || v0 || || || I Am Setsuna || ALL || Game
|-
| 0100849000BDA800 || v65536 (0.1.0.0) || || || I Am Setsuna || ALL || Update
|-
| 010085300314E000 || v0 || || || Kamiko || USA || Game
|-
| 010085500130A000 || v0 || || || LEGO® CITY Undercover || EUR || Game
|-
| 010085500130A800 || v131072 (0.2.0.0) || || || LEGO® CITY Undercover || EUR || Update
|-
| 0100882001380000 || v0 || || || Romance of the Three Kingdoms XIII || JPN || Game
|-
| 0100882001380800 || v131072 (0.2.0.0) || || || Romance of the Three Kingdoms XIII || JPN || Update
|-
| 01008A9001DC2000 || v0 || || || ACA NeoGeo Shock Troopers || ALL || VC
|-
| 01008A9001DC2800 || v65536 (0.1.0.0) || || || ACA NeoGeo Shock Troopers || ALL || Update
|-
| 01008D1001512000 || v0 || || || Cars 3: Driven to Win || USA || Game
|-
| 01008D1001512800 || v65536 (0.1.0.0) || || || Cars 3: Driven to Win || USA || Update
|-
| 0100902001014000 || v0 || || || Othello || JPN || Game
|-
| 0100930002EAA000 || v0 || || || Dragon Quest Heroes 1 & 2 || USA || Game
|-
| 01009400030D6000 || v0 || || || Seiken Legend Collection || JPN || Game
|-
| 01009510001CA000 || v0 || || || FAST RMX || JPN || Game
|-
| 01009510001CA800 || v131072 (0.2.0.0) || || || FAST RMX || JPN || Update
|-
| 01009B500007C000 || v0 || Gamecard: [[2.1.0]] || || ARMS || ALL || Game
|-
| 01009D4001DC4000 || v0 || || || ACA NeoGeo World Heroes Perfect || ALL || VC
|-
| 01009D4001DC4800 || v65536 (0.1.0.0) || || || ACA NeoGeo World Heroes Perfect || ALL || Update
|-
| 0100A6300150C000 || v0 || || || Wonder Boy: The Dragon's Trap || EUR || Game
|-
| 0100A76002B46000 || v0 || || || ACA NeoGeo Alpha Mission II || ALL || VC
|-
| 0100A7F002830000 || v0 || || || VOEZ || ALL || Game
|-
| 0100A7F002830800 || v65536 (0.1.0.0) || || || VOEZ || ALL || Update
|-
| 0100A8C001DCE000 || v0 || || || ACA NeoGeo NAM-1975 || ALL || VC
|-
| 0100A8C001DCE800 || v65536 (0.1.0.0) || || || ACA NeoGeo NAM-1975 || ALL || Update
|-
| 0100AE0003424000 || v0 || || || Shantae: Half-Genie Hero || EUR || Game
|-
| 0100AED003A60000 || v0 || || || Plantera Garden Life DX Edition || JPN || Game
|-
| 0100B18001D8E000 || v0 || || || Little Inferno || EUR || Game
|-
| 0100B18001D8E800 || v131072 (0.2.0.0) || || || Little Inferno || EUR || Update
|-
| 0100B42001DB4000 || v0 || || || ACA NeoGeo The King of Fighters '98 || ALL || VC
|-
| 0100B42001DB4800 || v65536 (0.1.0.0) || || || ACA NeoGeo The King of Fighters '98 || ALL || Update
|-
| 0100B7D0022EE000 || v0 || || || Cave Story+ for Nintendo Switch || USA || Game
|-
| 0100BA8001DC6000 || v0 || || || ACA NeoGeo Metal Slug 3 || ALL || VC
|-
| 0100BA8001DC6800 || v65536 (0.1.0.0) || || || ACA NeoGeo Metal Slug 3 || ALL || Update
|-
| 0100BBF0027EC000 || v0 || || || ULTRA STREET FIGHTER II: The Final Challengers || EUR || Game
|-
| 0100BBF0027EC800 || v65536 (0.1.0.0) || || || ULTRA STREET FIGHTER II: The Final Challengers || EUR || Update
|-
| 0100C0F0020E8000 || v0 || || || Snake Pass || ALL || Game
|-
| 0100C0F0020E8800 || v65536 (0.1.0.0) || || || Snake Pass || ALL || Update
|-
| 0100C220040C0000 || v0 || || || Mr. Shifty || JPN || Game
|-
| 0100C3F000BD8000 || v0 || || || Everyone Party! Spelunker || JPN || Demo
|-
| 0100C5E003B40000 || v0 || None || || ARMS Global Testpunch || ALL || Timed Demo
|-
| 0100C5E003B40800 || v65536 (0.1.0.0) || None || || ARMS Global Testpunch || ALL || Update
|-
| 0100C86000B58000 || v0 || || || ULTRA STREET FIGHTER II: The Final Challengers || JPN || Game
|-
| 0100C86000B58800 || v65536 (0.1.0.0) || || || ULTRA STREET FIGHTER II: The Final Challengers || JPN || Update
|-
| 0100CB2001DB8000 || v0 || || || ACA NeoGeo Garou: Mark of the Wolves || ALL || VC
|-
| 0100CC80013D6000 || v0 || || || The JackBox Party Pack 3 || ALL || Game
|-
| 0100CCC0002E6000 || v0 || || || Skylanders Imaginators || USA || Game
|-
| 0100CCC0002E6800 || v131072 (0.2.0.0) || || || Skylanders Imaginators || USA || Update
|-
| 0100CD3000BDC000 || v0 || || || Dragon Quest Heroes 1 & 2 || JPN || Game
|-
| 0100CD3000BDC800 || v196608 (0.3.0.0) || || || Dragon Quest Heroes 1 & 2 || JPN || Update
|-
| 0100CEF001DC0000 || v0 || || || ACA NeoGeo Waku Waku 7 || ALL || VC
|-
| 0100CEF001DC0800 || v65536 (0.1.0.0) || || || ACA NeoGeo Waku Waku 7 || ALL || Update
|-
| 0100D170038EA000 || v0 || || || ACA NeoGeo Sengoku || ALL || VC
|-
| 0100D87002EE0000 || v0 || || || Snipperclips - Cut it out, together! || ALL || Game
|-
| 0100D87002EE0800 || v0, v65536 (0.1.0.0) || || || Snipperclips - Cut it out, together! || ALL || Update
|-
| 0100DFC003398000 || v0 || || || ACA NeoGeo Blazing Star || ALL || VC
|-
| 0100E29001298000 || v0 || || Gamecard Front: LA-H-ABMKA-{region} Back: ABMKA09Y000 || Has-Been Heroes || ALL || Game
|-
| 0100E29001298800 || v131072 (0.2.0.0) || || || Has-Been Heroes || ALL || Update
|-
| 0100E5F0000C0000 || v0 || || || Disgaea 5 Complete || JPN || Game
|-
| 0100E5F0000C0800 || v131072 (0.2.0.0) || || || Disgaea 5 Complete || JPN || Update
|-
| 0100E67003A86000 || v0 || || Gamecard Front: LA-H-AACAC-{region} Back: AACAC41A000 || Disgaea 5 Complete || USA || Game
|-
| 0100EB2001DCC000 || v0 || || || ACA NeoGeo The King of Fighters '94 || ALL || VC
|-
| 0100EBE002B3E000 || v0 || || || ACA NeoGeo Metal Slug || ALL || VC
|-
| 0100EE6002B48000 || v0 || || || ACA NeoGeo Fatal Fury || ALL || VC
|-
| 0100F0400351C000 || v0 || || || Astro Duel Deluxe || USA, EUR || Game
|-
| 0100F0400351C800 || v65536 (0.1.0.0) || || || Astro Duel Deluxe || USA, EUR || Update
|-
| 0100F12002FC8000 || v0 || || || Everyone Party! Spelunker || JPN || Game
|-
| 0100F3D001DEE000 || v0 || || || Puyo Puyo Tetris || EUR || Game
|-
| 01002B6001364000 || || || || LEGO® CITY Undercover || JPN || Game
|-
| 01002B6001364800 || || || || LEGO® CITY Undercover || JPN || Update
|-
| 0100AE9003FAC000 || || || || Touch Battle Tank SP || JPN || Game
|-
| 0100AE9003FAC800 || || || || Touch Battle Tank SP || JPN || Update
|-
| 010024D0032F2000 || || || || PHOTON³ (Photon Cube) || JPN || Game
|-
| 010024D0032F2800 || || || || PHOTON³ (Photon Cube) || JPN || Update
|-
| 01007C2002B3C000 || || || || GoNNER || JPN, USA || Game
|-
| 01007C2002B3C800 || || || || GoNNER || JPN, USA || Update
|-
| 0100737003190000 || || || || IMPLOSION || JPN, USA || Game
|-
| 0100737003190800 || || || || IMPLOSION || JPN, USA || Update
|-
| 0100737003190000 || || || || IMPLOSION || EUR || Game
|-
| 0100737003190800 || || || || IMPLOSION || EUR || Update
|-
| 01004040033CE000 || || || NicoNico Video Sharing Application || niconico || JPN || Application
|-
| 01004040033CE800 || || || NicoNico Video Sharing Application || niconico || JPN || Update
|-
| 010019A0038FA000 || || || || ACA NeoGeo Fatal Fury SPECIAL || ALL || VC
|-
| 010019A0038FA800 || || || || ACA NeoGeo Fatal Fury SPECIAL || ALL || Update
|-
| 01003C700009C000 || || || || Splatoon 2 || JPN || Game
|-
| 01003C700009C800 || || || || Splatoon 2 || JPN || Update
|-
| 0100C3700416A000 || || || || SUPER PING PONG TRICKSHOT || JPN || Game
|-
| 0100C3700416A800 || || || || SUPER PING PONG TRICKSHOT || JPN || Update
|-
| 01003BC0000A0000 || || Gamecard: 2.3.0 || Gamecard Front: LA-H-AAB6B-USA || Splatoon 2 || USA || Game
|-
| 01003BC0000A0800 || v262144(Display-ver 1.2.0 - uses [[3.0.1]] NCA crypto([[NCA|nca-type0]])) || || || Splatoon 2 || USA || Update
|-
| 010067300059A000 || || || || Mario + Rabbids Kingdom Battle || USA || Game
|}
Game updates have the same titleID as the main application, except with bitmask 0x800 set.

The following data was found in [[NS_Services|NS]](NUL-terminators removed):
{tasks":[{id":xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",titles":[{id":0100c5e003b40000",version":0,type":Application"},{id":0100c5e003b40800",version":65536,type":Patch"}],owner_application":0100c5e003b40000"}],format_version":1,last_modified":1497023220,required_system_version":0"}.

"xxx..." Is where lowercase hex is in the original data.

=VersionList=
The following was parsed from data dumped on June 10, 2017. This is located after strings "nsaccache:/cache/lru_list.dat", "nsaccache", and "ns_appman" in memory. Format is similar to 3DS eShop VersionList: header is 0x20-bytes instead of 0x10(due to word size presumably). The structure of the title entries are still 0x10-bytes, with the unk field being used now. The unk field is presumably the minimum required title-version for this TID when non-zero, refusing to launch the app otherwise. That's only enforced when that version was already installed on the system at some point however. The order of the below titles is the same as what was in memory.

u64 titleID version unk
01000320000CC000 0 0
0100704000B3A000 0 0
01007EF00011E000 0 0
01007EF00011E800 262144 262144
0100D87002EE0000 0 0
0100CD3000BDC000 0 0
010053D0001BE000 0 0
0100BCE000598800 65536 65536
0100930002EAA000 0 0
010053D0001BE800 65536 65536
0100BCE000598000 0 0
0100CD3000BDC800 196608 196608
010021B002EEA000 0 0
01007AD00013E800 262144 262144
01001180021FA000 0 0
0100225000FEE000 0 0
01003D60012BE000 0 0
010048D000BFC800 131072 131072
01004C200100E000 0 0
01004E90028A2000 0 0
010057D0021E8000 0 0
010065A00213C000 0 0
01007AD00013E000 0 0
0100849000BDA000 0 0
01008A9001DC2000 0 0
0100902001014000 0 0
01009510001CA000 0 0
01009510001CA800 131072 131072
01009D4001DC4000 0 0
0100A7F002830000 0 0
0100B42001DB4000 0 0
0100BA8001DC6000 0 0
0100CCC0002E6800 131072 131072
0100CEF001DC0000 0 0
0100E5F0000C0000 0 0
0100A8C001DCE000 0 0
010021C000B6A000 0 0
0100E29001298000 0 0
010073C001D5E000 0 0
010009E001D90000 0 0
0100701001D92000 0 0
0100B18001D8E000 0 0
010000A00218E000 0 0
01008A9001DC2800 65536 65536
01009D4001DC4800 65536 65536
0100A8C001DCE800 65536 65536
0100B42001DB4800 65536 65536
0100BA8001DC6800 65536 65536
0100CEF001DC0800 65536 65536
0100225000FEE800 131072 131072
0100EB2001DCC000 0 0
01003A30012C0000 0 0
010021C000B6A800 65536 65536
0100C0F0020E8000 1 0
01002E70032E8000 0 0
010085500130A000 0 0
0100701001D92800 131072 65536
0100B18001D8E800 131072 131072
01004D10020F2000 0 0
0100882001380800 131072 131072
0100E29001298800 131072 131072
0100EBE002B3E000 0 0
0100882001380000 0 0
01001180021FA800 131072 0
010057D0021E8800 131072 131072
0100C0F0020E8800 65536 65536
01004D10020F2800 131072 131072
01006740034F6000 0 0
0100A76002B46000 0 0
010085500130A800 131072 131072
01003A30012C0800 131072 131072
01004E90028A2800 65536 65536
0100E5F0000C0800 131072 131072
0100F12002FC8000 0 0
010031F002B66000 0 0
0100CC80013D6000 0 0
0100F3D001DEE000 0 0
01002E70032E8800 65536 65536
0100D87002EE0800 65536 0
01000DC003740000 0 0
0100849000BDA800 65536 65536
010047F001DBC000 0 0
01004B10031BE000 0 0
01006A5003698000 0 0
010085300314E000 0 0
0100A6300150C000 0 0
0100152000022000 0 0
0100EE6002B48000 0 0
010065A00213C800 65536 65536
0100C3F000BD8000 0 0
01004B1001D22000 0 0
01007330027EE000 0 0
01003A5001DBA000 0 0
0100404002F52000 0 0
01003D60012BE800 65536 65536
0100DFC003398000 0 0
01005700031AE000 0 0
01004B1001D22800 65536 65536
010002900294A000 0 0
010025B002E92000 0 0
0100BBF0027EC000 0 0
010009E001D90800 65536 0
01006BD001E06000 0 0
0100CB2001DB8000 0 0
01001FA0034E2000 0 0
01006BD001E06800 196608 196608
01006F6002840000 0 0
0100E67003A86000 0 0
0100125002060000 0 0
01002580038DE000 0 0
01004F7003726000 0 0
0100C5E003B40000 0 0
0100152000022800 65536 65536
0100B7D0022EE000 0 0
0100583001DCA000 0 0
0100F0400351C000 0 0
01009B500007C000 0 0
01005700031AE800 65536 65536
01004B3004062000 0 0
0100C220040C0000 0 0
0100BBF0027EC800 65536 65536
0100C86000B58000 0 0
0100C86000B58800 65536 65536
01007330027EE800 65536 0
01008D1001512000 0 0
0100F0400351C800 65536 65536
01000D10038E6000 0 0
0100AE0003424000 0 0
010043F004126000 0 0
01009400030D6000 0 0
0100A7F002830800 65536 65536
0100C5E003B40800 65536 65536
0100744001588800 65536 65536
010035B00412A000 0 0
01004DE001DC8000 0 0
0100AED003A60000 0 0
0100D170038EA000 0 0
01008D1001512800 65536 0
010031F002B66800 65536 0
01000E2003FA0000 0 0

Title list/Games

2017-07-22T22:52:54Z

OgniK: Added splatoon 2 tid

{| class="wikitable sortable"
! Title-id || Versions || Required/included system-version || Media/Serial# || Description || Region || Type
|-
| 010000A00218E000 || v0 || || || Splatoon 2 Global Testfire || ALL || Timed Demo
|-
| 010002900294A000 || v0 || || || NBA Playgrounds || ALL || Game
|-
| 01000320000CC000 || v0 || None || Gamecard Front: LA-H-AACCA-{region} Back: AACCA22Y000 || 1-2 Switch || ALL || Game
|-
| 010009E001D90000 || v0 || || || World of Goo || EUR || Game
|-
| 010009E001D90800 || v65536 (0.1.0.0) || || || World of Goo || EUR || Update
|-
| 01000D10038E6000 || v0 || || || ACA NeoGeo Last Resort || ALL || VC
|-
| 01000DC003740000 || v0 || || Gamecard Front: LA-H-BAACB-USA Back: LG || Puyo Puyo Tetris || USA || Game
|-
| 01000E2003FA0000 || v0 || || || Mighty Gun Volt Burst || JPN || Game
|-
| 01001180021FA000 || v0 || || || Shovel Knight: Specter of Torment || ALL || Game
|-
| 01001180021FA800 || v131072 (0.2.0.0) || || || Shovel Knight: Specter of Torment || ALL || Update
|-
| 0100125002060000 || v0 || || || Battle Sports Meguru || JPN || Game
|-
| 0100152000022000 || v0 || None || Gamecard Front: LA-H-AABPA-{region} Back: AABPA22A000 || Mario Kart 8 Deluxe || ALL || Game
|-
| 0100152000022800 || v65536 (0.1.0.0) || || || Mario Kart 8 Deluxe || ALL || Update
|-
| 01001FA0034E2000 || v0 || || || Dark Witch Music Episode: Rudymical || ALL || Game
|-
| 010021B002EEA000 || v0 || || || Puyo Puyo Tetris || JPN || Demo
|-
| 010021C000B6A000 || v0 || || Gamecard Front: LA-H-BAAZA-USA Back: BAAZA20Y000 || The Binding of Isaac: Afterbirth+ || USA || Game
|-
| 010021C000B6A800 || v65536 (0.1.0.0) || || || The Binding of Isaac: Afterbirth+ || USA || Update
|-
| 0100225000FEE000 || v0 || || || Blaster Master Zero || ALL || Demo
|-
| 0100225000FEE800 || v65536 (0.1.0.0), v131072 (0.2.0.0) || || || Blaster Master Zero || ALL || Update
|-
| 01002580038DE000 || v0 || || || ACA NeoGeo Galaxy Fight: Universal Warriors || ALL || VC
|-
| 010025B002E92000 || v0 || || || Blaster Master Zero || ALL || Demo
|-
| 01002E70032E8000 || v0 || || || ACA NeoGeo Turf Masters || ALL || VC
|-
| 01002E70032E8800 || v65536 (0.1.0.0) || || || ACA NeoGeo Turf Masters || ALL || Update
|-
| 010031F002B66000 || v0 || || || Mr. Shifty || USA, EUR || Game
|-
| 010031F002B66800 || v65536 (0.1.0.0) || || || Mr. Shifty || USA, EUR || Update
|-
| 010035B00412A000 || v0 || || || Human Resource Machine || JPN || Game
|-
| 01003A30012C0000 || v0 || || || LEGO® CITY Undercover || USA || Game
|-
| 01003A30012C0800 || v131072 (0.2.0.0) || || || LEGO® CITY Undercover || USA || Update
|-
| 01003A5001DBA000 || v0 || || || ACA NeoGeo Over Top || ALL || VC
|-
| 01003D60012BE000 || v0 || || || Nobunaga's Nozomi - Creating with Power Up Kit || JPN || Game
|-
| 01003D60012BE800 || v65536 (0.1.0.0) || || || Nobunaga's Nozomi - Creating with Power Up Kit || JPN || Update
|-
| 0100404002F52000 || v0 || || || Silver Star Shogi Ten Tenshi Battle Raijin || JPN || Game
|-
| 010043F004126000 || v0 || || || Little Inferno || JPN || Game
|-
| 010047F001DBC000 || v0 || || || ACA NeoGeo Samurai Shodown IV || ALL || VC
|-
| 010048D000BFC000 || || || || ? || ? || Demo
|-
| 010048D000BFC800 || v131072 (0.2.0.0) || || || ? || ? || Update
|-
| 01004B1001D22000 || v0 || || || TumbleSeed || ALL || Game
|-
| 01004B1001D22800 || v65536 (0.1.0.0) || || || TumbleSeed || ALL || Update
|-
| 01004B10031BE000 || v0 || || || Puyo Puyo Tetris || EUR || Game
|-
| 01004B3004062000 || v0 || || || World of Goo || JPN || Game
|-
| 01004C200100E000 || v0 || || || New Frontier Days: Founding Pioneers || ALL || Game
|-
| 01004D10020F2000 || v0 || || || Graceful Explosion Machine || EUR || Game
|-
| 01004D10020F2800 || v131072 (0.2.0.0) || || || Graceful Explosion Machine || EUR || Update
|-
| 01004DE001DC8000 || v0 || || || ACA NeoGeo Shock Trooper's Second Scud || ALL || Game
|-
| 01004E90028A2000 || v0 || || || Vroom in the night sky || ALL || Game
|-
| 01004E90028A2800 || v65536 (0.1.0.0) || || || Vroom in the night sky || ALL || Update
|-
| 01004F7003726000 || v0 || || || Disgaea 5 Complete || JPN || Demo
|-
| 010053D0001BE000 || v0 || || || Puyo Puyo Tetris || JPN || Game
|-
| 010053D0001BE800 || v65536 (0.1.0.0) || || || Puyo Puyo Tetris || JPN || Update
|-
| 01005700031AE000 || v0 || || || Disgaea 5 Complete || EUR || Game
|-
| 01005700031AE800 || v65536 (0.1.0.0) || || || Disgaea 5 Complete || EUR || Update
|-
| 010057D0021E8000 || v0 || || || Shovel Knight: Treasure Trove || ALL || Game
|-
| 010057D0021E8800 || v131072 (0.2.0.0) || || || Shovel Knight: Treasure Trove || ALL || Update
|-
| 0100583001DCA000 || v0 || || || ACA NeoGeo The King Of Fighters '99 || ALL || VC
|-
| 010065A00213C000 || v0 || || || Sora Damu Flowering Declaration || JPN || Game
|-
| 010065A00213C800 || v65536 (0.1.0.0) || || || Sora Damu Flowering Declaration || JPN || Update
|-
| 01006740034F6000 || v0 || || || Just Dance 2017 || ALL || Game
|-
| 0100BCE000598000 || v0 || || || Just Dance 2017 || ALL || Demo
|-
| 0100BCE000598800 || v65536 (0.1.0.0) || || || Just Dance 2017 || ALL || Update
|-
| 01006A5003698000 || v0 || || || Maison De MAOU || JPN || Game
|-
| 01006BD001E06000 || v0 || || || Minecraft: Nintendo Switch Edition || ALL || Game
|-
| 01006BD001E06800 || v196608 (0.3.0.0) || || || Minecraft: Nintendo Switch Edition || ALL || Update
|-
| 01006F6002840000 || v0 || || || Thumper for Nintendo Switch || ALL || Game
|-
| 0100701001D92000 || v0 || || || Human Resource Machine || EUR || Game
|-
| 0100701001D92800 || v65536 (0.1.0.0), v131072 (0.2.0.0) || || || Human Resource Machine || EUR || Update
|-
| 0100704000B3A000 || v0 || || || Snipperclips || ALL || Game
|-
| 01007330027EE000 || v0 || || || ULTRA STREET FIGHTER II: The Final Challengers || USA || Game
|-
| 01007330027EE800 || v65536 (0.1.0.0) || || || ULTRA STREET FIGHTER II: The Final Challengers || USA || Update
|-
| 010073C001D5E000 || v0 || || (Digital Download) || Puyo Puyo Tetris || USA || Game
|-
| 0100744001588000 || v0 || || || Cars 3: Driven to Win || EUR || Game
|-
| 0100744001588800 || v65536 (0.1.0.0) || || || Cars 3: Driven to Win || EUR || Update
|-
| 01007AD00013E000 || v0 || None || || Super Bomberman R || ALL || Game
|-
| 01007AD00013E800 || v65536 (0.1.0.0), v131072 (0.2.0.0), v196608 (0.3.0.0), v262144 (0.4.0.0) || || || Super Bomberman R || ALL || Update
|-
| 01007D7001D0E000 || v0 || || || Oceanhorn: Monster of Uncharted Seas || ALL || Game
|-
| 01007EF00011E000 || v0 || None || Gamecard Front: LA-H-AAAAA-{region} Back: AAAAA13A000 || The Legend of Zelda: Breath of the Wild || ALL || Game
|-
| 01007EF00011E800 || v262144 (0.4.0.0) || || || The Legend of Zelda: Breath of the Wild || ALL || Update
|-
| 0100849000BDA000 || v0 || || || I Am Setsuna || ALL || Game
|-
| 0100849000BDA800 || v65536 (0.1.0.0) || || || I Am Setsuna || ALL || Update
|-
| 010085300314E000 || v0 || || || Kamiko || USA || Game
|-
| 010085500130A000 || v0 || || || LEGO® CITY Undercover || EUR || Game
|-
| 010085500130A800 || v131072 (0.2.0.0) || || || LEGO® CITY Undercover || EUR || Update
|-
| 0100882001380000 || v0 || || || Romance of the Three Kingdoms XIII || JPN || Game
|-
| 0100882001380800 || v131072 (0.2.0.0) || || || Romance of the Three Kingdoms XIII || JPN || Update
|-
| 01008A9001DC2000 || v0 || || || ACA NeoGeo Shock Troopers || ALL || VC
|-
| 01008A9001DC2800 || v65536 (0.1.0.0) || || || ACA NeoGeo Shock Troopers || ALL || Update
|-
| 01008D1001512000 || v0 || || || Cars 3: Driven to Win || USA || Game
|-
| 01008D1001512800 || v65536 (0.1.0.0) || || || Cars 3: Driven to Win || USA || Update
|-
| 0100902001014000 || v0 || || || Othello || JPN || Game
|-
| 0100930002EAA000 || v0 || || || Dragon Quest Heroes 1 & 2 || USA || Game
|-
| 01009400030D6000 || v0 || || || Seiken Legend Collection || JPN || Game
|-
| 01009510001CA000 || v0 || || || FAST RMX || JPN || Game
|-
| 01009510001CA800 || v131072 (0.2.0.0) || || || FAST RMX || JPN || Update
|-
| 01009B500007C000 || v0 || Gamecard: [[2.1.0]] || || ARMS || ALL || Game
|-
| 01009D4001DC4000 || v0 || || || ACA NeoGeo World Heroes Perfect || ALL || VC
|-
| 01009D4001DC4800 || v65536 (0.1.0.0) || || || ACA NeoGeo World Heroes Perfect || ALL || Update
|-
| 0100A6300150C000 || v0 || || || Wonder Boy: The Dragon's Trap || EUR || Game
|-
| 0100A76002B46000 || v0 || || || ACA NeoGeo Alpha Mission II || ALL || VC
|-
| 0100A7F002830000 || v0 || || || VOEZ || ALL || Game
|-
| 0100A7F002830800 || v65536 (0.1.0.0) || || || VOEZ || ALL || Update
|-
| 0100A8C001DCE000 || v0 || || || ACA NeoGeo NAM-1975 || ALL || VC
|-
| 0100A8C001DCE800 || v65536 (0.1.0.0) || || || ACA NeoGeo NAM-1975 || ALL || Update
|-
| 0100AE0003424000 || v0 || || || Shantae: Half-Genie Hero || EUR || Game
|-
| 0100AED003A60000 || v0 || || || Plantera Garden Life DX Edition || JPN || Game
|-
| 0100B18001D8E000 || v0 || || || Little Inferno || EUR || Game
|-
| 0100B18001D8E800 || v131072 (0.2.0.0) || || || Little Inferno || EUR || Update
|-
| 0100B42001DB4000 || v0 || || || ACA NeoGeo The King of Fighters '98 || ALL || VC
|-
| 0100B42001DB4800 || v65536 (0.1.0.0) || || || ACA NeoGeo The King of Fighters '98 || ALL || Update
|-
| 0100B7D0022EE000 || v0 || || || Cave Story+ for Nintendo Switch || USA || Game
|-
| 0100BA8001DC6000 || v0 || || || ACA NeoGeo Metal Slug 3 || ALL || VC
|-
| 0100BA8001DC6800 || v65536 (0.1.0.0) || || || ACA NeoGeo Metal Slug 3 || ALL || Update
|-
| 0100BBF0027EC000 || v0 || || || ULTRA STREET FIGHTER II: The Final Challengers || EUR || Game
|-
| 0100BBF0027EC800 || v65536 (0.1.0.0) || || || ULTRA STREET FIGHTER II: The Final Challengers || EUR || Update
|-
| 0100C0F0020E8000 || v0 || || || Snake Pass || ALL || Game
|-
| 0100C0F0020E8800 || v65536 (0.1.0.0) || || || Snake Pass || ALL || Update
|-
| 0100C220040C0000 || v0 || || || Mr. Shifty || JPN || Game
|-
| 0100C3F000BD8000 || v0 || || || Everyone Party! Spelunker || JPN || Demo
|-
| 0100C5E003B40000 || v0 || None || || ARMS Global Testpunch || ALL || Timed Demo
|-
| 0100C5E003B40800 || v65536 (0.1.0.0) || None || || ARMS Global Testpunch || ALL || Update
|-
| 0100C86000B58000 || v0 || || || ULTRA STREET FIGHTER II: The Final Challengers || JPN || Game
|-
| 0100C86000B58800 || v65536 (0.1.0.0) || || || ULTRA STREET FIGHTER II: The Final Challengers || JPN || Update
|-
| 0100CB2001DB8000 || v0 || || || ACA NeoGeo Garou: Mark of the Wolves || ALL || VC
|-
| 0100CC80013D6000 || v0 || || || The JackBox Party Pack 3 || ALL || Game
|-
| 0100CCC0002E6000 || v0 || || || Skylanders Imaginators || USA || Game
|-
| 0100CCC0002E6800 || v131072 (0.2.0.0) || || || Skylanders Imaginators || USA || Update
|-
| 0100CD3000BDC000 || v0 || || || Dragon Quest Heroes 1 & 2 || JPN || Game
|-
| 0100CD3000BDC800 || v196608 (0.3.0.0) || || || Dragon Quest Heroes 1 & 2 || JPN || Update
|-
| 0100CEF001DC0000 || v0 || || || ACA NeoGeo Waku Waku 7 || ALL || VC
|-
| 0100CEF001DC0800 || v65536 (0.1.0.0) || || || ACA NeoGeo Waku Waku 7 || ALL || Update
|-
| 0100D170038EA000 || v0 || || || ACA NeoGeo Sengoku || ALL || VC
|-
| 0100D87002EE0000 || v0 || || || Snipperclips - Cut it out, together! || ALL || Game
|-
| 0100D87002EE0800 || v0, v65536 (0.1.0.0) || || || Snipperclips - Cut it out, together! || ALL || Update
|-
| 0100DFC003398000 || v0 || || || ACA NeoGeo Blazing Star || ALL || VC
|-
| 0100E29001298000 || v0 || || Gamecard Front: LA-H-ABMKA-{region} Back: ABMKA09Y000 || Has-Been Heroes || ALL || Game
|-
| 0100E29001298800 || v131072 (0.2.0.0) || || || Has-Been Heroes || ALL || Update
|-
| 0100E5F0000C0000 || v0 || || || Disgaea 5 Complete || JPN || Game
|-
| 0100E5F0000C0800 || v131072 (0.2.0.0) || || || Disgaea 5 Complete || JPN || Update
|-
| 0100E67003A86000 || v0 || || Gamecard Front: LA-H-AACAC-{region} Back: AACAC41A000 || Disgaea 5 Complete || USA || Game
|-
| 0100EB2001DCC000 || v0 || || || ACA NeoGeo The King of Fighters '94 || ALL || VC
|-
| 0100EBE002B3E000 || v0 || || || ACA NeoGeo Metal Slug || ALL || VC
|-
| 0100EE6002B48000 || v0 || || || ACA NeoGeo Fatal Fury || ALL || VC
|-
| 0100F0400351C000 || v0 || || || Astro Duel Deluxe || USA, EUR || Game
|-
| 0100F0400351C800 || v65536 (0.1.0.0) || || || Astro Duel Deluxe || USA, EUR || Update
|-
| 0100F12002FC8000 || v0 || || || Everyone Party! Spelunker || JPN || Game
|-
| 0100F3D001DEE000 || v0 || || || Puyo Puyo Tetris || EUR || Game
|-
| 01002B6001364000 || || || || LEGO® CITY Undercover || JPN || Game
|-
| 01002B6001364800 || || || || LEGO® CITY Undercover || JPN || Update
|-
| 0100AE9003FAC000 || || || || Touch Battle Tank SP || JPN || Game
|-
| 0100AE9003FAC800 || || || || Touch Battle Tank SP || JPN || Update
|-
| 010024D0032F2000 || || || || PHOTON³ (Photon Cube) || JPN || Game
|-
| 010024D0032F2800 || || || || PHOTON³ (Photon Cube) || JPN || Update
|-
| 01007C2002B3C000 || || || || GoNNER || JPN, USA || Game
|-
| 01007C2002B3C800 || || || || GoNNER || JPN, USA || Update
|-
| 0100737003190000 || || || || IMPLOSION || JPN, USA || Game
|-
| 0100737003190800 || || || || IMPLOSION || JPN, USA || Update
|-
| 0100737003190000 || || || || IMPLOSION || EUR || Game
|-
| 0100737003190800 || || || || IMPLOSION || EUR || Update
|-
| 01004040033CE000 || || || NicoNico Video Sharing Application || niconico || JPN || Application
|-
| 01004040033CE800 || || || NicoNico Video Sharing Application || niconico || JPN || Update
|-
| 010019A0038FA000 || || || || ACA NeoGeo Fatal Fury SPECIAL || ALL || VC
|-
| 010019A0038FA800 || || || || ACA NeoGeo Fatal Fury SPECIAL || ALL || Update
|-
| 01003C700009C000 || || || || Splatoon 2 || JPN || Game
|-
| 01003C700009C800 || || || || Splatoon 2 || JPN || Update
|-
| 0100C3700416A000 || || || || SUPER PING PONG TRICKSHOT || JPN || Game
|-
| 0100C3700416A800 || || || || SUPER PING PONG TRICKSHOT || JPN || Update
|-
| 01003BC0000A0000 || || || Gamecard Front: LA-H-AAB6B-USA || Splatoon 2 || USA || Game
|}
Game updates have the same titleID as the main application, except with bitmask 0x800 set.

The following data was found in [[NS_Services|NS]](NUL-terminators removed):
{tasks":[{id":xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",titles":[{id":0100c5e003b40000",version":0,type":Application"},{id":0100c5e003b40800",version":65536,type":Patch"}],owner_application":0100c5e003b40000"}],format_version":1,last_modified":1497023220,required_system_version":0"}.

"xxx..." Is where lowercase hex is in the original data.

=VersionList=
The following was parsed from data dumped on June 10, 2017. This is located after strings "nsaccache:/cache/lru_list.dat", "nsaccache", and "ns_appman" in memory. Format is similar to 3DS eShop VersionList: header is 0x20-bytes instead of 0x10(due to word size presumably). The structure of the title entries are still 0x10-bytes, with the unk field being used now. The unk field is presumably the minimum required title-version for this TID when non-zero, refusing to launch the app otherwise. That's only enforced when that version was already installed on the system at some point however. The order of the below titles is the same as what was in memory.

u64 titleID version unk
01000320000CC000 0 0
0100704000B3A000 0 0
01007EF00011E000 0 0
01007EF00011E800 262144 262144
0100D87002EE0000 0 0
0100CD3000BDC000 0 0
010053D0001BE000 0 0
0100BCE000598800 65536 65536
0100930002EAA000 0 0
010053D0001BE800 65536 65536
0100BCE000598000 0 0
0100CD3000BDC800 196608 196608
010021B002EEA000 0 0
01007AD00013E800 262144 262144
01001180021FA000 0 0
0100225000FEE000 0 0
01003D60012BE000 0 0
010048D000BFC800 131072 131072
01004C200100E000 0 0
01004E90028A2000 0 0
010057D0021E8000 0 0
010065A00213C000 0 0
01007AD00013E000 0 0
0100849000BDA000 0 0
01008A9001DC2000 0 0
0100902001014000 0 0
01009510001CA000 0 0
01009510001CA800 131072 131072
01009D4001DC4000 0 0
0100A7F002830000 0 0
0100B42001DB4000 0 0
0100BA8001DC6000 0 0
0100CCC0002E6800 131072 131072
0100CEF001DC0000 0 0
0100E5F0000C0000 0 0
0100A8C001DCE000 0 0
010021C000B6A000 0 0
0100E29001298000 0 0
010073C001D5E000 0 0
010009E001D90000 0 0
0100701001D92000 0 0
0100B18001D8E000 0 0
010000A00218E000 0 0
01008A9001DC2800 65536 65536
01009D4001DC4800 65536 65536
0100A8C001DCE800 65536 65536
0100B42001DB4800 65536 65536
0100BA8001DC6800 65536 65536
0100CEF001DC0800 65536 65536
0100225000FEE800 131072 131072
0100EB2001DCC000 0 0
01003A30012C0000 0 0
010021C000B6A800 65536 65536
0100C0F0020E8000 1 0
01002E70032E8000 0 0
010085500130A000 0 0
0100701001D92800 131072 65536
0100B18001D8E800 131072 131072
01004D10020F2000 0 0
0100882001380800 131072 131072
0100E29001298800 131072 131072
0100EBE002B3E000 0 0
0100882001380000 0 0
01001180021FA800 131072 0
010057D0021E8800 131072 131072
0100C0F0020E8800 65536 65536
01004D10020F2800 131072 131072
01006740034F6000 0 0
0100A76002B46000 0 0
010085500130A800 131072 131072
01003A30012C0800 131072 131072
01004E90028A2800 65536 65536
0100E5F0000C0800 131072 131072
0100F12002FC8000 0 0
010031F002B66000 0 0
0100CC80013D6000 0 0
0100F3D001DEE000 0 0
01002E70032E8800 65536 65536
0100D87002EE0800 65536 0
01000DC003740000 0 0
0100849000BDA800 65536 65536
010047F001DBC000 0 0
01004B10031BE000 0 0
01006A5003698000 0 0
010085300314E000 0 0
0100A6300150C000 0 0
0100152000022000 0 0
0100EE6002B48000 0 0
010065A00213C800 65536 65536
0100C3F000BD8000 0 0
01004B1001D22000 0 0
01007330027EE000 0 0
01003A5001DBA000 0 0
0100404002F52000 0 0
01003D60012BE800 65536 65536
0100DFC003398000 0 0
01005700031AE000 0 0
01004B1001D22800 65536 65536
010002900294A000 0 0
010025B002E92000 0 0
0100BBF0027EC000 0 0
010009E001D90800 65536 0
01006BD001E06000 0 0
0100CB2001DB8000 0 0
01001FA0034E2000 0 0
01006BD001E06800 196608 196608
01006F6002840000 0 0
0100E67003A86000 0 0
0100125002060000 0 0
01002580038DE000 0 0
01004F7003726000 0 0
0100C5E003B40000 0 0
0100152000022800 65536 65536
0100B7D0022EE000 0 0
0100583001DCA000 0 0
0100F0400351C000 0 0
01009B500007C000 0 0
01005700031AE800 65536 65536
01004B3004062000 0 0
0100C220040C0000 0 0
0100BBF0027EC800 65536 65536
0100C86000B58000 0 0
0100C86000B58800 65536 65536
01007330027EE800 65536 0
01008D1001512000 0 0
0100F0400351C800 65536 65536
01000D10038E6000 0 0
0100AE0003424000 0 0
010043F004126000 0 0
01009400030D6000 0 0
0100A7F002830800 65536 65536
0100C5E003B40800 65536 65536
0100744001588800 65536 65536
010035B00412A000 0 0
01004DE001DC8000 0 0
0100AED003A60000 0 0
0100D170038EA000 0 0
01008D1001512800 65536 0
010031F002B66800 65536 0
01000E2003FA0000 0 0