Nintendo Switch Brew

NV services: Difference between revisions

← Older editNewer edit →
(42 intermediate revisions by 2 users not shown)
Line 1: Line 1:
The Switch uses a customized NVIDIA driver.
= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
This is "nns::nvdrv::INvDrvServices".
This is "nns::nvdrv::INvDrvServices".
Main NVIDIA driver service.


Each service is used by:
Each service is used by:
* "nvdrv": Applications.
* "nvdrv": Applications.
** [[#Permissions|Permission]] mask is [3.0.0+] 0xA82B ([1.0.0-2.3.0] 0x2B).
** [[#NvDrvPermission|Permission]] mask is [11.0.0+] 0xA83B ([1.0.0-2.3.0] 0x2B, [3.0.0+] 0xA82B).
* "nvdrv:a": Applets.
* "nvdrv:a": Applets.
** [[#Permissions|Permission]] mask is [3.0.0+] 0x10A9 ([1.0.0-2.3.0] 0xA9).
** [[#NvDrvPermission|Permission]] mask is [3.0.0+] 0x10A9 ([1.0.0-2.3.0] 0xA9).
* "nvdrv:s": Sysmodules.
* "nvdrv:s": Sysmodules.
** [[#Permissions|Permission]] mask is [3.0.0+] 0x439E ([1.0.0-2.3.0] 0x39E).
** [[#NvDrvPermission|Permission]] mask is [3.0.0+] 0x439E ([1.0.0-2.3.0] 0x39E).
* "nvdrv:t": Factory.
* "nvdrv:t": Factory.
** [[#Permissions|Permission]] mask is 0xFFFFFFFF.
** [[#NvDrvPermission|Permission]] mask is 0xFFFFFFFF.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 34: Line 30:
| 6 || [[#GetStatus]]
| 6 || [[#GetStatus]]
|-
|-
| 7 || [[#SetAruidForTest]]
| 7 || [[#SetAruidWithoutCheck]]
|-
|-
| 8 || [[#SetAruid]]
| 8 || [[#SetAruid]]
|-
|-
| 9 || [[#DumpGraphicsMemoryInfo]]
| 9 || [[#DumpStatus]]
|-
|-
| 10 || [3.0.0+] [[#InitializeDevtools]]
| 10 || [3.0.0+] [[#InitializeDevtools]]
Line 50: Line 46:


== Open ==
== Open ==
Takes a type-0x5 input buffer for the device-path. Returns the output 32bit '''fd''' and the u32 '''error_code'''.
Takes a type-0x5 input buffer '''Path'''. Returns two output u32s '''FdOut''' and '''Err'''.


== Ioctl ==
== Ioctl ==
Takes a 32bit '''fd''', an u32 '''ioctl_cmd''', a type-0x21 input buffer, and a type-0x22 output buffer. Returns an output u32 ('''error_code''').
Takes two input u32s '''Fd''' and '''Iocode''', a type-0x21 input buffer and a type-0x22 output buffer. Returns an output u32 '''Err'''.


The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).
The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).


== Close ==
== Close ==
Takes a 32bit '''fd'''. Returns an output u32 ('''error_code''').
Takes an input u32 '''Fd'''. Returns an output u32 '''Err'''.


== Initialize ==
== Initialize ==
Takes two copy-handles ('''current_process''' and '''transfer_memory''') and an input u32 ('''transfer_memory_size'''). Returns an output u32 ('''error_code''').
Takes an input Process handle, an input TransferMemory handle and an input u32 '''Size'''. Returns an output u32 '''Err'''.


Webkit applet creates the transfer-memory with perm = 0 and size 0x300000.
Webkit applet creates the TransferMemory with perm == 0 and size == 0x300000.


== QueryEvent ==
== QueryEvent ==
Takes two input u32s ('''fd''' and '''event_id'''), with the second word immediately after the first one. Returns an output u32 ('''error_code''') and a copy-handle ('''event_handle''').
Takes two input u32s '''Fd''' and '''EvtId'''. Returns an output u32 '''Err''' and an output Event handle.


QueryEvent is only supported on (and implemented differently on):
QueryEvent is only supported on (and implemented differently on):
* /dev/nvhost-gpu
* /dev/nvhost-gpu
** 1: SmException_BptIntReport
** EvtId=1: SmException_BptIntReport
** 2: SmException_BptPauseReport
** EvtId=2: SmException_BptPauseReport
** 3: ErrorNotifierEvent
** EvtId=3: ErrorNotifierEvent
* /dev/nvhost-ctrl: Used to get events for SyncPts.
* /dev/nvhost-ctrl: Used to get events for syncpts.
** If bit31-28 is 1, then lower 16-bits contain event_slot, bit27-16 contain syncpt_number.  
** EvtId=(event_slot | ((syncpt_id & 0xFFF) << 16) | (is_valid << 28)): New format used by [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT|NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT]]/[[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT_EX|NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT_EX]].
** If bit31-28 is 0, then lower 4-bits contain event_slot, bit31-4 contains syncpt_number.
** EvtId=(event_slot | (syncpt_id << 4)): Old format used by [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX|NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]].
* /dev/nvhost-ctrl-gpu
* /dev/nvhost-ctrl-gpu
** 1: Returns error_event_handle.
** EvtId=1: Returns error_event_handle.
** 2: Returns unknown event.
** EvtId=2: Returns unknown event.
* /dev/nvhost-dbg-gpu
* /dev/nvhost-dbg-gpu
** Ignores event_id.
** Ignores EvtId.


== MapSharedMem ==
== MapSharedMem ==
Takes a copy-handle ('''transfer_memory''') and two input u32s ('''fd''' and '''nvmap_handle'''). Returns an output u32 ('''error_code''').
Takes an input TransferMemory handle and two input u32s '''Fd''' and '''HMem'''. Returns an output u32 '''Err'''.
 
'''HMem''' is a [[#/dev/nvmap|/dev/nvmap]] memory handle.


== GetStatus ==
== GetStatus ==
Takes no input. Returns 0x10-bytes and an output u32 ('''error_code''').
Takes no input. Returns an output [[#NvDrvStatus]] and an output u32 '''Err'''.
 
== SetAruidWithoutCheck ==
Takes an input u64 '''Aruid'''. Returns an output u32 '''Err'''.


== SetAruidForTest ==
'''Aruid''' must [[IPC_Marshalling|match]] the current [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].
Takes an input u64 which must [[IPC_Marshalling|match]] the user-process PID ([[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]). Returns an output u32 ('''error_code''').


== SetAruid ==
== SetAruid ==
Takes a PID-descriptor and an u64 which must [[IPC_Marshalling|match]] the user-process PID ([[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]). Returns an output u32 ('''error_code''').
Takes a PID-descriptor and an input [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]. Returns an output u32 '''Err'''.


== DumpGraphicsMemoryInfo ==
== DumpStatus ==
No input or output.
No input/output.


== InitializeDevtools ==
== InitializeDevtools ==
Takes a copy-handle ('''transfer_memory''') and an input u32 ('''transfer_memory_size'''). Returns an output u32 ('''error_code''').
Takes an input TransferMemory handle and an input u32 '''Size'''. Returns an output u32 '''Err'''.


== Ioctl2 ==
== Ioctl2 ==
Takes a type-0x21 buffer, a type-0x22 buffer, a type-0x21 buffer, and two input u32s. Returns an output u32 ('''error_code''').
Takes two input u32s '''Fd''' and '''Iocode''', two type-0x21 input buffers and a type-0x22 output buffer. Returns an output u32 '''Err'''.


== Ioctl3 ==
== Ioctl3 ==
Takes a type-0x21 buffer, a type-0x22 buffer, another type-0x22 buffer, and two input u32s. Returns an output u32 (error_code).
Takes two input u32s '''Fd''' and '''Iocode''', a type-0x21 input buffer and two type-0x22 output buffers. Returns an output u32 '''Err'''.
Cmdhdr_word1 is 0x100B instead of 0xC0B.


== SetGraphicsFirmwareMemoryMarginEnabled ==
== SetGraphicsFirmwareMemoryMarginEnabled ==
Line 112: Line 111:
This sets a boolean value based on the input u64 and the value of the "nv!nv_graphics_firmware_memory_margin" system configuration, but only for "nvdrv" (the other services default to false).
This sets a boolean value based on the input u64 and the value of the "nv!nv_graphics_firmware_memory_margin" system configuration, but only for "nvdrv" (the other services default to false).


Official user-processes starting with 3.0.0 now use this at the end of nvdrv service init with value 0x1.
[3.0.0+] Official user-processes now use this at the end of nvdrv service init with value 0x1.
 
= nvmemp =
This is "nv::MemoryProfiler::IMemoryProfiler".


= Permissions =
/dev/nvhost-ctrl sends the ioctl NVHOST_IOCTL_CTRL_GET_CONFIG to check the config "nv!NV_MEMORY_PROFILER". If config_str returns "1", the application attempts to use nvmemp.
Each nvdrv service is initialized with a bitfield that controls access to nodes and other operations.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Description
|-
|-
| 0
! Cmd || Name
| Can access [[#Channels|/dev/nvhost-gpu]], [[#/dev/nvhost-ctrl-gpu|/dev/nvhost-ctrl-gpu]] and [[#/dev/nvhost-as-gpu|/dev/nvhost-as-gpu]].
|-
| 0 || [[#Open_2|Open]]
|-
|-
| 1
| 1 || [[#GetPid|GetPid]]
| Can access [[#/dev/nvhost-dbg-gpu|/dev/nvhost-dbg-gpu]] and [[#/dev/nvhost-prof-gpu|/dev/nvhost-prof-gpu]].
|}
 
== Open ==
Takes an input TransferMemory handle and an input u32 '''Size'''. No output.
 
== GetPid ==
No input. Returns an output u32 '''Pid'''.
 
= nvdrvdbg =
This is "nns::nvdrv::INvDrvDebugFSServices".
 
{| class="wikitable" border="1"
|-
|-
| 2
! Cmd || Name
| Can access [[#/dev/nvsched-ctrl|/dev/nvsched-ctrl]].
|-
|-
| 3
| 0 || [[#DebugFSOpen]]
| Can access [[#Channels|/dev/nvhost-vic]].
|-
|-
| 4
| 1 || [[#DebugFSClose]]
| Can access [[#Channels|/dev/nvhost-msenc]].
|-
| 2 || [[#GetDebugFSKeys]]
|-
|-
| 5
| 3 || [[#GetDebugFSValue]]
| Can access [[#Channels|/dev/nvhost-nvdec]].
|-
|-
| 6
| 4 || [[#SetDebugFSValue]]
|  
|}
 
== DebugFSOpen ==
Takes an input Process handle. Returns an output u32 '''Handle'''.
 
== DebugFSClose ==
Takes an input u32 '''Handle'''. No output.
 
== GetDebugFSKeys ==
Takes an input u32 '''Handle''' and a type-0x6 output buffer '''OutValueBuf'''. Returns an output u32 '''Err'''.
 
== GetDebugFSValue ==
Takes an input u32 '''Handle''', a type-0x5 input buffer '''InKeyBuf''' and a type-0x6 output buffer '''OutValueBuf'''. Returns an output u32 '''Err'''.
 
== SetDebugFSValue ==
Takes an input u32 '''Handle''' and two type-0x5 input buffers '''InKeyBuf''' and '''InValueBuf'''. Returns an output u32 '''Err'''.
 
= nvgem:c =
This is "nv::gemcontrol::INvGemControl".
 
{| class="wikitable" border="1"
|-
|-
| 7
! Cmd || Name
| Can access [[#Channels|/dev/nvhost-nvjpg]].
|-
|-
| 8
| 0 || [[#Initialize_2|Initialize]]
| Can access [[#Channels|/dev/nvhost-display]], [[#/dev/nvcec-ctrl|/dev/nvcec-ctrl]], [[#/dev/nvhdcp_up-ctrl|/dev/nvhdcp_up-ctrl]], [[#/dev/nvdisp-ctrl|/dev/nvdisp-ctrl]], [[#/dev/nvdisp-disp0, /dev/nvdisp-disp1|/dev/nvdisp-disp0]], [[#/dev/nvdisp-disp0, /dev/nvdisp-disp1|/dev/nvdisp-disp1]], [[#/dev/nvdcutil-disp0, /dev/nvdcutil-disp1|/dev/nvdcutil-disp0]] and [[#/dev/nvdcutil-disp0, /dev/nvdcutil-disp1|/dev/nvdcutil-disp1]].
|-
|-
| 9
| 1 || [[#GetEventHandle|GetEventHandle]]
| Can duplicate [[#/dev/nvmap|nvmap]] handles from other processes with [[#NVMAP_IOC_FROM_ID|NVMAP_IOC_FROM_ID]].
|-
|-
| 10
| 2 || [[#ControlNotification|ControlNotification]]
| Can use [[#SetAruidForTest|SetAruidForTest]].
|-
|-
| 11
| 3 || [[#SetNotificationPerm|SetNotificationPerm]]
| Can use [[#SetGraphicsFirmwareMemoryMarginEnabled|SetGraphicsFirmwareMemoryMarginEnabled]].
|-
|-
| 12
| 4 || [[#SetCoreDumpPerm|SetCoreDumpPerm]]
| Can duplicate exported [[#/dev/nvmap|nvmap]] handles from other processes with [[#NVMAP_IOC_FROM_ID|NVMAP_IOC_FROM_ID]].
|-
| 13
|
|-
|-
| 14
| 5 || [1.0.0-4.1.0] [[#GetAruid|GetAruid]]
| Can use [[#NVMAP_IOC_EXPORT_FOR_ARUID|NVMAP_IOC_EXPORT_FOR_ARUID]] and [[#NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID|NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID]].
|-
|-
| 15
| 6 || [[#Reset|Reset]]
|  
|-
|-
| 16-31
| 7 || [3.0.0+] [[#GetAruid2|GetAruid2]]
| Unused.
|}
|}


Nodes [[#/dev/nvmap|/dev/nvmap]], [[#/dev/nvhost-ctrl|/dev/nvhost-ctrl]] and [[#/dev/nverpt-ctrl|/dev/nverpt-ctrl]] are always accessible.
== Initialize ==
No input. Returns an output u32 '''Err'''.


= Ioctls =
== GetEventHandle ==
The ioctl number is generated with the following primitive (see Linux kernel):
No input. Returns an output Event handle and an output u32 '''Err'''.
 
== ControlNotification ==
Takes an input bool '''Enable'''. Returns an output u32 '''Err'''.
 
== SetNotificationPerm ==
Takes an input u64 '''Aruid''' and an input bool '''Enable'''. Returns an output u32 '''Err'''.
 
== SetCoreDumpPerm ==
Takes an input u64 '''Aruid''' and an input bool '''Enable'''. Returns an output u32 '''Err'''.
 
== GetAruid ==
No input. Returns an output u64 '''Aruid''' and an output u32 '''Err'''.
 
== Reset ==
No input. Returns an output u32 '''Err'''.
 
== GetAruid2 ==
Unofficial name.


#define _IOC(inout, group, num, len) \
No input. Returns an output u64 '''Aruid''', an output bool '''IsCoreDumpEnabled''' and an output u32 '''Err'''.
    (inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))


The following table contains known ioctls.
= nvgem:cd =
This is "nv::gemcoredump::INvGemCoreDump".


== /dev/nvhost-ctrl ==
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
|-
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]]
! Cmd || Name
|-
|-
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]]
| 0 || [[#Initialize_3|Initialize]]
|-
|-
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]]
| 1 || [[#GetAruid_2|GetAruid]]
|-
|-
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]]
| 2 || [1.0.0-8.1.0] [[#ReadNextBlock|ReadNextBlock]]
|-
|-
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]]
| 3 || [8.0.0+] [[#GetNextBlockSize|GetNextBlockSize]]
|-
|-
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]]
| 4 || [8.0.0+] [[#ReadNextBlock2|ReadNextBlock2]]
|-
|}
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]]
 
|-
== Initialize ==
| 0xC183001B || Inout || 387 || [[#NVHOST_IOCTL_CTRL_GET_CONFIG]]
No input. Returns an output u32 '''Err'''.
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_SIGNAL]]
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT]]
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC]]
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_REGISTER]]
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_UNREGISTER]]
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_EVENT_KILL]]
|-
| 0xC0040022 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL]]
|}


=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
== GetAruid ==
Identical to Linux driver.
No input. Returns an output u64 '''Aruid''' and an output u32 '''Err'''.


  struct {
== ReadNextBlock ==
    __in  u32 id;
Takes a type-0x6 output buffer. Returns an output u32 '''Err'''.
    __out u32 value;
  };


=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
== GetNextBlockSize ==
Identical to Linux driver.
Unofficial name.


  struct {
No input. Returns an output u64 '''Size''' and an output u32 '''Err'''.
    __in u32 id;
  };


=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
== ReadNextBlock2 ==
Identical to Linux driver.
Unofficial name.


  struct {
Takes a type-0x6 output buffer and two input u64s '''Size''' and '''Offset'''. Returns an output u64 '''OutSize''' and an output u32 '''Err'''.
    __in u32 id;
    __in u32 thresh;
    __in s32 timeout;
  };


=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
= nvdbg:d =
Identical to Linux driver.
This is "nns::nvdrv::INvDrvDebugSvcServices". This was added with [10.0.0+].


  struct {
This service has no commands.
    __in u32 id;
    __in u32 lock;        // (0==unlock; 1==lock)
  };


=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
= Ioctls =
Identical to Linux driver. Uses 32-bit version and doesn't work.
The ioctl number is generated with the following primitive (see Linux kernel):


  struct {
#define _IOC(inout, group, num, len) \
     __in u32 id;
     (inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))
    __in u32 num_offsets;
    __in u32 block_size;
    __in u32 offsets;
    __in u32 values;
    __in u32 write;
  };


=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
The following table contains all known ioctls.
Identical to Linux driver.


  struct {
== /dev/nvhost-ctrl ==
    __in  u32 id;
{| class="wikitable" border="1"
    __in  u32 thresh;
! Value || Direction || Size || Description
    __in  s32 timeout;
|-
    __out u32 value;
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]]
  };
|-
 
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]]
=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
|-
Identical to Linux driver.
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]]
 
|-
  struct {
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]]
    __in  u32 id;
|-
    __out u32 value;
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]]
  };
|-
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]]
|-
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]]
|-
| 0xC183001B || Inout || 387 || [[#NVHOST_IOCTL_CTRL_GET_CONFIG]]
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT]]
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT]]
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT_EX]]
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_ALLOC_EVENT]]
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT]]
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT_BATCH]]
|-
| 0xC0040022 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_GET_SHIFT]]
|}


=== NVHOST_IOCTL_CTRL_GET_CONFIG ===
=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
Returns configured settings. Not available in production mode.
Identical to Linux driver.


   struct {
   struct {
     __in char domain_str[0x41];      // "nv"
     __in u32 id;
    __in char param_str[0x41];
     __out u32 value;
     __out char config_str[0x101];
   };
   };


=== NVHOST_IOCTL_CTRL_EVENT_SIGNAL ===
=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
Signals an user event. Exclusive to the Switch.
Identical to Linux driver.


   struct {
   struct {
     __in u32 user_event_id;     // ranges from 0x00 to 0x3F
     __in u32 id;
   };
   };


=== NVHOST_IOCTL_CTRL_EVENT_WAIT ===
=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
Waits on an event. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to (('''syncpt_id''' << 0x10) | 0x10000000).
Identical to Linux driver.
 
Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.


   struct {
   struct {
     __in   u32 syncpt_id;
     __in u32 id;
     __in   u32 threshold;
     __in u32 thresh;
     __in   s32 timeout;
     __in s32 timeout;
    __inout u32 value;          // in=user_event_id (ignored); out=syncpt_value or user_event_id
   };
   };


=== NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC ===
=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
Waits on an event (async version). If waiting fails, returns error code 0x0B (BadValue).
Identical to Linux driver.


Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.
  struct {
    __in u32 id;
    __in u32 lock;        // 0=unlock, 1=lock
  };
 
=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
Identical to Linux driver. Uses 32-bit version and doesn't work.


   struct {
   struct {
     __in   u32 syncpt_id;
     __in u32 id;
     __in   u32 threshold;
     __in u32 num_offsets;
     __in   u32 timeout;
     __in u32 block_size;
     __inout u32 value;           // in=user_event_id (ignored); out=syncpt_value or user_event_id
     __in u32 offsets;
    __in u32 values;
    __in u32 write;
   };
   };


=== NVHOST_IOCTL_CTRL_EVENT_REGISTER ===
=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
Registers an user event. Exclusive to the Switch.  
Identical to Linux driver.


   struct {
   struct {
     __in u32 user_event_id;     // ranges from 0x00 to 0x3F
     __in u32 id;
    __in  u32 thresh;
    __in  s32 timeout;
    __out u32 value;
   };
   };


=== NVHOST_IOCTL_CTRL_EVENT_UNREGISTER ===
=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
Unregisters an user event. Exclusive to the Switch.  
Identical to Linux driver.


   struct {
   struct {
     __in u32 user_event_id;     // ranges from 0x00 to 0x3F
     __in u32 id;
    __out u32 value;
   };
   };


=== NVHOST_IOCTL_CTRL_EVENT_KILL ===
=== NVHOST_IOCTL_CTRL_GET_CONFIG ===
Kills user events. Exclusive to the Switch.  
Returns configured settings. Not available in production mode.


   struct {
   struct {
     __in u64 user_events;      // 64-bit bitfield where each bit represents one event
     __in char name[0x41];      // "nv"
    __in char key[0x41];
    __out char value[0x101];
   };
   };


=== NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL ===
=== NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT ===
If event FIFO is enabled, returns the maximum channel number. Exclusive to the Switch.
Clears the wait signal of a syncpt event.


   struct {
   struct {
     __out u32 max_channel;     // 0x00 (FIFO disabled) or 0x60 (FIFO enabled)
     __in u32 event_slot;       // 0x00 to 0x3F
   };
   };


== /dev/nvmap ==
=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT ===
{| class="wikitable" border="1"
Waits on a syncpt using events. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to ('''event_slot''' | (('''syncpt_id''' & 0xFFF) << 16) | ('''is_valid''' << 28)).
 
  struct {
    __in  u32 id;
    __in  u32 thresh;
    __in  s32 timeout;
    __out u32 value;
  };
 
=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT_EX ===
Waits on a syncpt using a specific event. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to ('''event_slot''' | ('''syncpt_id''' << 4)).
 
  struct {
    __in    u32 id;
    __in    u32 thresh;
    __in    s32 timeout;
    __inout u32 value;          // in=event_slot; out=syncpt_value
  };
 
=== NVHOST_IOCTL_CTRL_SYNCPT_ALLOC_EVENT ===
Allocates a new syncpt event.
 
  struct {
    __in u32 event_slot;        // 0x00 to 0x3F
  };
 
=== NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT ===
Frees an existing syncpt event.
 
  struct {
    __in u32 event_slot;        // 0x00 to 0x3F
  };
 
=== NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT_BATCH ===
Frees multiple syncpt events.
 
  struct {
    __in u64 event_slot_mask;    // 64-bit bitfield where each bit represents one event
  };
 
=== NVHOST_IOCTL_CTRL_SYNCPT_GET_SHIFT ===
Returns the syncpt shift value.
 
  struct {
    __out u32 syncpt_shift;      // 0x00 (FIFO disabled) or 0x60 (FIFO enabled)
  };
 
== /dev/nvmap ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description
! Value || Direction || Size || Description
|-
|-
Line 419: Line 498:
     __in u32 heapmask;
     __in u32 heapmask;
     __in u32 flags;    // (0=read-only, 1=read-write)
     __in u32 flags;    // (0=read-only, 1=read-write)
     __in u32 align;
     __inout u32 align;
     __in u8  kind;
     __in u8  kind;
     u8      pad[7];
     u8      pad[7];
     __inout u64 addr;
     __in u64 addr;
   };
   };


Line 431: Line 510:
     __in  u32 handle;
     __in  u32 handle;
     u32      pad;
     u32      pad;
     __out u64 address;
     __out u64 address; // 0 if the handle wasn't yet freed
     __out u32 size;
     __out u32 size;
     __out u32 flags;    // 1=NOT_FREED_YET
     __out u32 flags;    // 1=WAS_UNCACHED (if flags bit 1 was set when NVMAP_IOC_ALLOC was called)
   };
   };


Line 514: Line 593:
! Value || Direction || Size || Description
! Value || Direction || Size || Description
|-
|-
| 0x80040212 || Out || 4 || NVDISP_CTRL_GET_NUM_OUTPUTS
| 0x80040212 || Out || 4 || NVDISP_CTRL_NUM_OUTPUTS
|-
|-
| 0xC0140213 || Inout || 20 || NVDISP_CTRL_GET_OUTPUT_PROPERTIES
| 0xC0140213 || Inout || 20 || NVDISP_CTRL_GET_DISPLAY_PROPERTIES
|-
|-
| 0xC1100214 || Inout || 272 || NVDISP_CTRL_GET_OUTPUT_EDID
| 0xC1100214 || Inout || 272 || NVDISP_CTRL_QUERY_EDID
|-
|-
| 0xC0080216</br>([1.0.0-3.0.0] 0xC0040216) || Inout || 8</br>([1.0.0-3.0.0] 4) || NVDISP_CTRL_GET_EXT_HPD_IN_OUT_EVENTS</br>([1.0.0-3.0.0] NVDISP_CTRL_GET_EXT_HPD_IN_EVENT)
| 0xC0080216</br>([1.0.0-3.0.0] 0xC0040216) || Inout || 8</br>([1.0.0-3.0.0] 4) || NVDISP_CTRL_GET_EXT_HPD_IN_OUT_EVENTS</br>([1.0.0-3.0.0] NVDISP_CTRL_GET_EXT_HPD_IN_EVENT)
Line 528: Line 607:
| 0xC0100219 || Inout || 16 || NVDISP_CTRL_GET_VBLANK_HEAD1_EVENT
| 0xC0100219 || Inout || 16 || NVDISP_CTRL_GET_VBLANK_HEAD1_EVENT
|-
|-
| 0xC0040220 || Inout || 4 || NVDISP_CTRL_GET_HPD_IRQ
| 0xC0040220 || Inout || 4 || NVDISP_CTRL_SUSPEND
|-
| 0x80010224 || Out || 1 || [11.0.0+] NVDISP_CTRL_IS_DISPLAY_OLED
|}
|}


Line 547: Line 628:
| 0x430C0206 || In || 780 || NVDISP_SET_LUT
| 0x430C0206 || In || 780 || NVDISP_SET_LUT
|-
|-
| 0x40010207 || In || 1 || NVDISP_ENABLE_DISABLE_CRC
| 0x40010207 || In || 1 || NVDISP_CONFIG_CRC
|-
|-
| 0x80040208 || Out || 4 || NVDISP_GET_CRC
| 0x80040208 || Out || 4 || NVDISP_GET_CRC
Line 583: Line 664:
| 0xC004021F || Inout || 4 || NVDISP_GET_WINMASK
| 0xC004021F || Inout || 4 || NVDISP_GET_WINMASK
|-
|-
| 0x80080221 || Out || 8 || [10.0.0+] NVDISP_GET_BACKLIGHT_RANGE
| 0x80080221 || Out || 8 || [10.0.0+] [[#NVDISP_GET_BACKLIGHT_RANGE]]
|-
| 0x40040222 || In || 4 || [10.0.0+] [[#NVDISP_SET_BACKLIGHT_RANGE_MAX]]
|-
| 0x40040223 || In || 4 || [11.0.0+] [[#NVDISP_SET_BACKLIGHT_RANGE_MIN]]
|-
| 0x401C0225 || In || 28 || [11.0.0+] [[#NVDISP_SEND_PANEL_MSG]]
|-
|-
| 0x40040222 || In || 4 || [10.0.0+] NVDISP_SET_BACKLIGHT
| 0xC01C0226 || Inout || 28 || [11.0.0+] [[#NVDISP_GET_PANEL_DATA]]
|}
|}
=== NVDISP_GET_BACKLIGHT_RANGE ===
Returns the minimum and maximum values for the intensity of the display's backlight.
  struct {
    __out u32 min;
    __out u32 max;
  };
=== NVDISP_SET_BACKLIGHT_RANGE_MAX ===
Sets the maximum value for the intensity of the display's backlight.
  struct {
    __in u32 max;
  };
=== NVDISP_SET_BACKLIGHT_RANGE_MIN ===
Sets the minimum value for the intensity of the display's backlight.
  struct {
    __in u32 min;
  };
=== NVDISP_SEND_PANEL_MSG ===
Sends raw data to the display panel over DPAUX.
  struct {
    __in u32 cmd;          // DPAUX AUXCTL command (1=unk, 2=I2CWR, 4=MOTWR, 7=AUXWR)
    __in u32 addr;        // DPAUX AUXADDR
    __in u32 size;        // message size
    __in u32 msg[4];      // raw AUXDATA message
  };
=== NVDISP_GET_PANEL_DATA ===
Receives raw data from the display panel over DPAUX.
  struct {
    __in u32 cmd;          // DPAUX AUXCTL command (3=I2CRD, 5=MOTRD, 6=AUXRD)
    __in u32 addr;        // DPAUX AUXADDR
    __in u32 size;        // message size
    __out u32 msg[4];      // raw AUXDATA message
  };


== /dev/nvcec-ctrl ==
== /dev/nvcec-ctrl ==
Line 611: Line 740:
! Value || Direction || Size || Description
! Value || Direction || Size || Description
|-
|-
| 0xC4880401 || Inout || 1160 || NVHDCP_READ_M
| 0xC4880401 || Inout || 1160 || NVHDCP_READ_STATUS
|-
|-
| 0xC4880402 || Inout || 1160 || NVHDCP_READ_S
| 0xC4880402 || Inout || 1160 || NVHDCP_READ_M
|-
|-
| 0x40010403 || In || 1 || NVHDCP_ON_OFF
| 0x40010403 || In || 1 || NVHDCP_ENABLE
|-
|-
| 0xC0080404 || Inout || 8 || NVHDCP_READ_EVENT
| 0xC0080404 || Inout || 8 || NVHDCP_CTRL_STATE_TRANSIT_EVENT_DATA
|-
|-
| 0xC0010405 || Inout || 1 || NVHDCP_EVENTS_ON_OFF
| 0xC0010405 || Inout || 1 || NVHDCP_CTRL_STATE_CB
|}
|}


Line 626: Line 755:
! Value || Direction || Size || Description
! Value || Direction || Size || Description
|-
|-
| 0x40010501 || In || 1 || NVDCUTIL_SW_HOTPLUG_IN_OUT
| 0x40010501 || In || 1 || NVDCUTIL_ENABLE_CRC
|-
|-
| 0x40010502 || In || 1 || NVDCUTIL_VIRTUAL_EDID_ON_OFF
| 0x40010502 || In || 1 || NVDCUTIL_VIRTUAL_EDID_ENABLE
|-
|-
| 0x42040503 || In || 1056 || NVDCUTIL_VIRTUAL_EDID_SET_DATA
| 0x42040503 || In || 1056 || NVDCUTIL_VIRTUAL_EDID_SET_DATA
Line 634: Line 763:
| 0x803C0504 || Out || 60 || NVDCUTIL_GET_MODE
| 0x803C0504 || Out || 60 || NVDCUTIL_GET_MODE
|-
|-
| 0x40010505 || In || 1 || NVDCUTIL_TELEMETRY_TEST_ON_OFF
| 0x40010505 || In || 1 || NVDCUTIL_BEGIN_TELEMETRY_TEST
|-
| 0x400C0506 || In || 12 || NVDCUTIL_DSI_PACKET_TEST_SHORT_WRITE
|-
|-
| 0x400C0506 || In || 12 || NVDCUTIL_DSI_PACKET_SHORT_WRITE
| 0x40F80507 || In || 248 || NVDCUTIL_DSI_PACKET_TEST_LONG_WRITE
|-
|-
| 0x40F80507 || In || 248 || NVDCUTIL_DSI_PACKET_LONG_WRITE
| 0xC0F40508 || Inout || 244 || NVDCUTIL_DSI_PACKET_TEST_READ
|-
|-
| 0xC0F40508 || Inout || 244 || NVDCUTIL_DSI_PACKET_READ
| 0x40010509 || In || 1 || [10.0.0+] NVDCUTIL_DP_ELECTRIC_TEST_EN
|-
|-
| 0x40010509 || In || 1 || [10.0.0+] NVDCUTIL_DP_ELEC_TEST_MODE_ENABLE
| 0xC020050A || Inout || 32 || [10.0.0+] NVDCUTIL_DP_ELECTRIC_TEST_SETTINGS
|-
|-
| 0xC020050A || Inout || 32 || [10.0.0+] NVDCUTIL_DP_ELEC_TEST_SETTINGS
| 0x8070050B || Out || 112 || [11.0.0+] NVDCUTIL_DP_CONF_READ
|}
|}


Line 685: Line 816:
| 0x4008060F || In || 8 || [[#NVSCHED_CTRL_DETACH_APPLICATION]]
| 0x4008060F || In || 8 || [[#NVSCHED_CTRL_DETACH_APPLICATION]]
|-
|-
| 0x40100610 || In || 16 || NVSCHED_CTRL_LINK_RUNLIST_EX
| 0x40100610 || In || 16 || NVSCHED_CTRL_SET_APPLICATION_MAX_DEBT
|-
|-
| 0x40100611 || In || 16 || NVSCHED_CTRL_UNLINK_RUNLIST_EX
| 0x40100611 || In || 16 || NVSCHED_CTRL_SET_RUNLIST_MAX_DEBT
|-
|-
| 0x40010612 || In || 1 || NVSCHED_CTRL_OVERRUN_EVENTS_ON_OFF
| 0x40010612 || In || 1 || NVSCHED_CTRL_OVERRUN_EVENTS_ENABLE
|}
|}


Line 791: Line 922:
   struct {
   struct {
     __in u32 fence_id;
     __in u32 fence_id;
     __in u32 fence_thresh;
     __in u32 fence_value;
     __in u32 swap_interval;
     __in u32 swap_interval;
   };
   };
Line 885: Line 1,016:
| 0xC0084105 || Inout || 8 || [[#NVGPU_AS_IOCTL_UNMAP_BUFFER]]
| 0xC0084105 || Inout || 8 || [[#NVGPU_AS_IOCTL_UNMAP_BUFFER]]
|-
|-
| 0xC0284106 || Inout || 40 || [[#NVGPU_AS_IOCTL_MODIFY]]
| 0xC0284106 || Inout || 40 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX]]
|-
|-
| 0x40104107 || In || 16 || [[#NVGPU_AS_IOCTL_INITIALIZE]]
| 0x40104107 || In || 16 || [[#NVGPU_AS_IOCTL_ALLOC_AS]]
|-
|-
| 0xC0404108 || Inout || 64 || [[#NVGPU_AS_IOCTL_GET_VA_REGIONS]]
| 0xC0404108 || Inout || 64 || [[#NVGPU_AS_IOCTL_GET_VA_REGIONS]]
|-
|-
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_INITIALIZE_EX]]
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_ALLOC_AS_EX]]
|-
|-
| 0xC038410A || Inout || 56 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX]]
| 0xC038410A || Inout || 56 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX2]]
|-
|-
| 0xC0??4114 || Inout || Variable || [[#NVGPU_AS_IOCTL_REMAP]]
| 0xC0??4114 || Inout || Variable || [[#NVGPU_AS_IOCTL_REMAP]]
Line 902: Line 1,033:


   struct {
   struct {
     __in u32 fd;
     __in u32 channel_fd;
   };
   };


Line 912: Line 1,043:
     __in u32 page_size;
     __in u32 page_size;
     __in u32 flags;
     __in u32 flags;
     u32      pad;
     u32      padding;
     union {
     union {
       __out u64 offset;
       __out u64 offset;
Line 929: Line 1,060:


=== NVGPU_AS_IOCTL_MAP_BUFFER ===
=== NVGPU_AS_IOCTL_MAP_BUFFER ===
Maps a memory region in the device address space. Identical to Linux driver pretty much.
Maps a memory region in the device address space.
 
Unaligned size will cause a [[#Panic]].


On success, the mapped memory region is granted the [[SVC#MemoryAttribute|DeviceShared]] attribute.
On success, the mapped memory region is granted the [[SVC#MemoryAttribute|DeviceShared]] attribute.
Line 935: Line 1,068:
   struct {
   struct {
     __in    u32 flags;        // bit0: fixed_offset, bit2: cacheable
     __in    u32 flags;        // bit0: fixed_offset, bit2: cacheable
     u32        pad;
     u32        reserved0;
     __in    u32 nvmap_handle;
     __in    u32 mem_id;       // nvmap handle
     __inout u32 page_size;   // 0 means don't care
     u32         reserved1;
     union {
     union {
       __out u64 offset;
       __out u64 offset;
Line 944: Line 1,077:
   };
   };


=== NVGPU_AS_IOCTL_MODIFY ===
=== NVGPU_AS_IOCTL_MAP_BUFFER_EX ===
Modifies a memory region in the device address space.
Maps a memory region in the device address space with extra params.


Unaligned size will cause a [[#Panic]].
Unaligned size will cause a [[#Panic]].
Line 953: Line 1,086:
   struct {
   struct {
     __in      u32 flags;          // bit0: fixed_offset, bit2: cacheable
     __in      u32 flags;          // bit0: fixed_offset, bit2: cacheable
     __in      u32 kind;          // -1 is default
     __inout  u32 kind;          // -1 is default
     __in      u32 nvmap_handle;
     __in      u32 mem_id;         // nvmap handle
     __inout  u32 page_size;     // 0 means don't care
     u32           reserved;
     __in      u64 buffer_offset;
     __in      u64 buffer_offset;
     __in      u64 mapping_size;
     __in      u64 mapping_size;
     __inout   u64 offset;
     union {
      __out   u64 offset;
      __in    u64 align;
    };
   };
   };


Line 968: Line 1,104:
   };
   };


=== NVGPU_AS_IOCTL_INITIALIZE ===
=== NVGPU_AS_IOCTL_ALLOC_AS ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable).
Nintendo's custom implementation for allocating an address space.


   struct {
   struct {
     __in u32 big_page_size;  // depends on GPU's available_big_page_sizes; 0=default
     __in u32 big_page_size;  // depends on GPU's available_big_page_sizes; 0=default
     __in s32 as_fd;          // ignored; passes 0
     __in s32 as_fd;          // ignored; passes 0
     __in u32 flags;          // ignored; passes 0
     __in u64 reserved;        // ignored; passes 0
    __in u32 reserved;        // ignored; passes 0
   };
   };


=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
Nintendo's custom implementation to get rid of pointer in struct.
Nintendo's custom implementation to get rid of pointer in struct.
Uses [[#Ioctl3|Ioctl3]].


   struct va_region {
   struct va_region {
     u64 offset;
     u64 offset;
     u32 page_size;
     u32 page_size;
     u32 pad;
     u32 reserved;
     u64 pages;
     u64 pages;
   };
   };
    
    
   struct {
   struct {
     u64          not_used;   // (contained output user ptr on linux, ignored)
     u64          buf_addr;   // (contained output user ptr on linux, ignored)
     __inout u32  bufsize;    // forced to 2*sizeof(struct va_region)
     __inout u32  buf_size;    // forced to 2*sizeof(struct va_region)
     u32          pad;
     u32          reserved;
     __out struct  va_region regions[2];
     __out struct  va_region regions[2];
   };
   };


=== NVGPU_AS_IOCTL_INITIALIZE_EX ===
=== NVGPU_AS_IOCTL_ALLOC_AS_EX ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable) with extra params.
Nintendo's custom implementation for allocating an address space with extra params.


   struct {
   struct {
Line 1,008: Line 1,145:
   };
   };


=== NVGPU_AS_IOCTL_MAP_BUFFER_EX ===
=== NVGPU_AS_IOCTL_MAP_BUFFER_EX2 ===
Maps a memory region in the device address space with extra params.
Maps a memory region in the device address space with extra params.


    struct {
Unaligned size will cause a [[#Panic]].
 
On success, the mapped memory region is granted the [[SVC#MemoryAttribute|DeviceShared]] attribute.
 
  struct {
     __in      u32 flags;          // bit0: fixed_offset, bit2: cacheable
     __in      u32 flags;          // bit0: fixed_offset, bit2: cacheable
     __in      u32 kind;          // -1 is default
     __inout  u32 kind;          // -1 is default
     __in      u32 nvmap_handle;
     __in      u32 mem_id;         // nvmap handle
     __inout  u32 page_size;     // 0 means don't care
     u32           reserved0;
     __in      u64 buffer_offset;
     __in      u64 buffer_offset;
     __in      u64 mapping_size;
     __in      u64 mapping_size;
     __inout   u64 offset;
     union {
     __in      u64 unk0;
      __out   u64 offset;
     __in      u32 unk1;
      __in    u64 align;
     u32           pad;
    };
     __in      u64 vma_addr;
     __in      u32 pages;
     u32           reserved1;
   };
   };


=== NVGPU_AS_IOCTL_REMAP ===
=== NVGPU_AS_IOCTL_REMAP ===
Nintendo's custom implementation of address space remapping.
Nintendo's custom implementation of address space remapping for sparse pages.


   struct remap_entry {
   struct remap_op {
     __in u16 flags;           // 0 or 4
     __in u16 flags;                     // bit2: cacheable
     __in u16 kind;           
     __in u16 kind;           
     __in u32 nvmap_handle;
     __in u32 mem_handle;
     __in u32 map_offset;
     __in u32 mem_offset_in_pages;
     __in u32 gpu_offset;      // (alloc_space_offset >> 0x10)
     __in u32 virt_offset_in_pages;      // (alloc_space_offset >> 0x10)
     __in u32 pages;           // alloc_space_pages
     __in u32 num_pages;                 // alloc_space_pages
   };
   };
   
   
  struct {
  struct {
     __in struct remap_entry entries[];
     __in struct remap_op entries[];
  };
  };


Line 1,071: Line 1,215:
|-
|-
| 0x0000440D || None || 0 || [[#NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT]]
| 0x0000440D || None || 0 || [[#NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT]]
|-
| 0xC018440E || Inout || 24 || NVGPU_DBG_GPU_IOCTL_ACCESS_FB_MEMORY
|-
|-
| 0xC018440F || Inout || 24 || NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_NUM_PDES
| 0xC018440F || Inout || 24 || NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_NUM_PDES
Line 1,095: Line 1,241:
|-
|-
| 0xC018441A || Inout || 24 || NVGPU_DBG_GPU_IOCTL_LAZY_ALLOC_RESERVED_PA
| 0xC018441A || Inout || 24 || NVGPU_DBG_GPU_IOCTL_LAZY_ALLOC_RESERVED_PA
|-
| 0xC020441B || Inout || 32 || [11.0.0+] NVGPU_DBG_GPU_IOCTL_LAZY_ALLOC_RESERVED_PA_EX
|-
| 0xC084441C || Inout || 132 || [11.0.0+] NVGPU_DBG_GPU_IOCTL_GET_SETTINGS
|-
| 0xC018441D || Inout || 24 || [11.0.0+] NVGPU_DBG_GPU_IOCTL_GET_SERIAL_NUMBER
|-
| 0xC020441E || Inout || 32 || [11.0.0+] NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PAGES
|}
|}


Line 1,440: Line 1,594:
  };
  };


== Channels ==
= Channels =
Channels are a concept for NVIDIA hardware blocks that share a common interface.
Channels are a concept for NVIDIA hardware blocks that share a common interface.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 1,457: Line 1,611:
|-
|-
| /dev/nvhost-display || Display
| /dev/nvhost-display || Display
|-
| /dev/nvhost-tsec || TSEC
|}
|}


== Channel Ioctls ==
== Ioctls ==
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Value || Size || Description
! Value || Size || Description
Line 1,533: Line 1,689:
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]]
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]]
|-
|-
| 0xC018481B || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX]]
| 0xC018481B || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2]]
|-
|-
| 0xC018481C || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY_EX]]
| 0xC018481C || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2_RETRY]]
|-
|-
| 0xC004481D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_TIMESLICE]]
| 0xC004481D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_TIMESLICE]]
Line 1,567: Line 1,723:
     u32 syncpt_id;
     u32 syncpt_id;
     u32 syncpt_incrs;
     u32 syncpt_incrs;
  };
     u32 reserved[3];
 
  struct fence {
     u32 id;
    u32 thresh;
   };
   };
    
    
Line 1,583: Line 1,735:
     __in    struct reloc_shift reloc_shifts[];    // depends on num_relocs
     __in    struct reloc_shift reloc_shifts[];    // depends on num_relocs
     __in    struct syncpt_incr syncpt_incrs[];    // depends on num_syncpt_incrs
     __in    struct syncpt_incr syncpt_incrs[];    // depends on num_syncpt_incrs
     __out  struct fence fences[];                 // depends on num_fences
     __out  u32 fence_thresholds[];               // depends on num_fences
   };
   };


Line 1,696: Line 1,848:
   struct {
   struct {
     __in u32 num_entries;
     __in u32 num_entries;
     __in u32 flags;
     __in u32 flags;           // bit0: vpr_enabled
   };
   };


Line 1,723: Line 1,875:
   struct fence {
   struct fence {
     u32 id;
     u32 id;
     u32 thresh;
     u32 value;
   };
   };
    
    
   struct gpfifo_entry {
   struct gpfifo_entry {
     u64 entry;                               // gpu_iova | (unk_2bits << 40) | (size << 42) | (unk_flag << 63)
     u32 entry0;                             // gpu_iova_lo
    u32 entry1;                              // gpu_iova_hi | (allow_flush << 8) | (is_push_buf << 9) | (size << 10) | (sync << 31)
   };
   };
    
    
Line 1,733: Line 1,886:
     __in    u64 gpfifo;                      // (ignored) pointer to gpfifo fence structs
     __in    u64 gpfifo;                      // (ignored) pointer to gpfifo fence structs
     __in    u32 num_entries;                // number of fence objects being submitted
     __in    u32 num_entries;                // number of fence objects being submitted
     __in   u32 flags;
     union {
      __out u32 detailed_error;
      __in u32 flags;                      // bit0: fence_wait, bit1: fence_get, bit2: hw_format, bit3: sync_fence, bit4: suppress_wfi, bit5: skip_buffer_refcounting
    };
     __inout struct fence fence_out;          // returned new fence object for others to wait on
     __inout struct fence fence_out;          // returned new fence object for others to wait on
     __in    struct gpfifo_entry entries[];  // depends on num_entries
     __in    struct gpfifo_entry entries[];  // depends on num_entries
Line 1,816: Line 1,972:


   struct {
   struct {
     __out u32 error_info[32];    // first word is an error code (0=no_error, 1=gr_error, 2=gr_error, 3=invalid, 4=invalid)
     __out u32 error_info[32];    // first word is an error code (0=no_error, 1=mmu_error, 2=gr_error, 3=pbdma_error, 4=timeout)
   };
   };


Line 1,834: Line 1,990:
  struct fence {
  struct fence {
     u32 id;
     u32 id;
     u32 thresh;
     u32 value;
  };
  };
   
   
Line 1,840: Line 1,996:
   __in    u32 num_entries;
   __in    u32 num_entries;
   __in    u32 num_jobs;
   __in    u32 num_jobs;
   __in    u32 flags;
   __in    u32 flags;                       // bit0: vpr_enabled
   __out  struct fence fence_out;          // returned new fence object for others to wait on
   __out  struct fence fence_out;          // returned new fence object for others to wait on
   __in    u32 reserved[3];                // ignored
   __in    u32 reserved[3];                // ignored
Line 1,851: Line 2,007:
Same as [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX|NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]].
Same as [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX|NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]].


=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX ===
=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2 ===
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]], but uses [[#Ioctl2|Ioctl2]].
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]], but uses [[#Ioctl2|Ioctl2]].


=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY_EX ===
=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2_RETRY ===
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]], but uses [[#Ioctl2|Ioctl2]].
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]], but uses [[#Ioctl2|Ioctl2]].


Line 1,878: Line 2,034:
   };
   };


= nvmemp =
= NvDrvPermission =
NVIDIA memory profiler (this service is not available on retail units).
This is "nns::nvdrv::NvDrvPermission".
/dev/nvhost-ctrl sends the ioctl NVHOST_IOCTL_CTRL_GET_CONFIG to check the config "nv!NV_MEMORY_PROFILER". If config_str returns "1", the application attempts to use nvmemp.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Name
!  Description
|-
|-
! Cmd || Name
| 0
| Gpu
| Can access [[#Channels|/dev/nvhost-gpu]], [[#/dev/nvhost-ctrl-gpu|/dev/nvhost-ctrl-gpu]] and [[#/dev/nvhost-as-gpu|/dev/nvhost-as-gpu]].
|-
|-
| 0 || Open
| 1
| GpuDebug
| Can access [[#/dev/nvhost-dbg-gpu|/dev/nvhost-dbg-gpu]] and [[#/dev/nvhost-prof-gpu|/dev/nvhost-prof-gpu]].
|-
|-
| 1 || GetAruid
| 2
|}
| GpuSchedule
 
| Can access [[#/dev/nvsched-ctrl|/dev/nvsched-ctrl]].
= nvdrvdbg =
This is "nns::nvdrv::INvDrvDebugFSServices".
 
{| class="wikitable" border="1"
|-
|-
! Cmd || Name
| 3
| VIC
| Can access [[#Channels|/dev/nvhost-vic]].
|-
|-
| 0 || [[#OpenDebugFS]]
| 4
| VideoEncoder
| Can access [[#Channels|/dev/nvhost-msenc]].
|-
|-
| 1 || [[#CloseDebugFS]]
| 5
| VideoDecoder
| Can access [[#Channels|/dev/nvhost-nvdec]].
|-
|-
| 2 || [[#GetDebugFSKeys]]
| 6
| TSEC
| Can access [[#Channels|/dev/nvhost-tsec]].
|-
|-
| 3 || GetDebugFSValue
| 7
| JPEG
| Can access [[#Channels|/dev/nvhost-nvjpg]].
|-
|-
| 4 || SetDebugFSValue
| 8
|}
| Display
 
| Can access [[#Channels|/dev/nvhost-display]], [[#/dev/nvcec-ctrl|/dev/nvcec-ctrl]], [[#/dev/nvhdcp_up-ctrl|/dev/nvhdcp_up-ctrl]], [[#/dev/nvdisp-ctrl|/dev/nvdisp-ctrl]], [[#/dev/nvdisp-disp0, /dev/nvdisp-disp1|/dev/nvdisp-disp0]], [[#/dev/nvdisp-disp0, /dev/nvdisp-disp1|/dev/nvdisp-disp1]], [[#/dev/nvdcutil-disp0, /dev/nvdcutil-disp1|/dev/nvdcutil-disp0]] and [[#/dev/nvdcutil-disp0, /dev/nvdcutil-disp1|/dev/nvdcutil-disp1]].
== OpenDebugFS ==
Takes a process handle. Returns a u32 '''fd'''.
 
== CloseDebugFS ==
Takes a u32 '''fd''' and closes it.
 
== GetDebugFSKeys ==
Takes a u32 '''fd''' and reads debug contents into a type-6 buffer.
 
= nvgem:c =
This is "nv::gemcontrol::INvGemControl".
 
{| class="wikitable" border="1"
|-
|-
! Cmd || Name
| 9
| ImportMemory
| Can duplicate [[#/dev/nvmap|nvmap]] handles from other processes with [[#NVMAP_IOC_FROM_ID|NVMAP_IOC_FROM_ID]].
|-
|-
| 0 || Initialize
| 10
| NoCheckedAruid
| Can use [[#SetAruidWithoutCheck|SetAruidWithoutCheck]].
|-
|-
| 1 || GetGemEvent
| 11
|
| Can use [[#SetGraphicsFirmwareMemoryMarginEnabled|SetGraphicsFirmwareMemoryMarginEnabled]].
|-
|-
| 2 ||  
| 12
|
| Can duplicate exported [[#/dev/nvmap|nvmap]] handles from other processes with [[#NVMAP_IOC_FROM_ID|NVMAP_IOC_FROM_ID]].
|-
|-
| 3 || RegisterUnregisterAppIdLocked
| 13
|
| Can use the GPU virtual address range 0xC0000 to 0x580000 instead of 0x0 to 0xC0000.
|-
|-
| 4 ||
| 14
|
| Can use [[#NVMAP_IOC_EXPORT_FOR_ARUID|NVMAP_IOC_EXPORT_FOR_ARUID]] and [[#NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID|NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID]].
|-
|-
| 5 || [1.0.0-4.1.0] GetAruid
| 15
|-
|
| 6 || HandleDeferredErrors
| Can use the virtual address ranges 0x0 to 0x100000000 (GPU) and 0x0 to 0xE0000000 (non-GPU) instead of 0x100000000 to 0x11FA50000 (GPU) and 0xE0000000 to 0xFFFE0000 (non-GPU).
|-
| 7 || [3.0.0+]
|}
|}


= nvgem:cd =
= NvError =
This is "nv::gemcoredump::INvGemCoreDump".
This is "nns::nvdrv::NvError".


{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Cmd || Name
! Value || Name
|-
| 0x0 || Success
|-
| 0x1 || NotImplemented
|-
|-
| 0 || Initialize
| 0x2 || NotSupported
|-
|-
| 1 || GetAruid
| 0x3 || NotInitialized
|-
|-
| 2 || [1.0.0-8.1.0] ReadNextCdBlock
| 0x4 || BadParameter
|-
|-
| 3 || [8.0.0+]
| 0x5 || Timeout
|-
|-
| 4 || [8.0.0+]
| 0x6 || InsufficientMemory
|}
|-
 
| 0x7 || ReadOnlyAttribute
= nvdbg:d =
|-
This is "nns::nvdrv::INvDrvDebugSvcServices". This was added with [10.0.0+].
| 0x8 || InvalidState
 
|-
This service has no commands.
| 0x9 || InvalidAddress
 
|-
= Errors =
| 0xA || InvalidSize
Most nvidia driver commands return an error code apart from the normal return code.
|-
 
| 0xB || BadValue
{| class="wikitable" border="1"
|-
| 0xD || AlreadyAllocated
|-
| 0xE || Busy
|-
| 0xF || ResourceError
|-
| 0x10 || CountMismatch
|-
| 0x11 || OverFlow
|-
| 0x1000 || InsufficientTransferMemory
|-
| 0x10000 || InsufficientVideoMemory
|-
| 0x10001 || BadSurfaceColorScheme
|-
| 0x10002 || InvalidSurface
|-
|-
! Cmd || Name
| 0x10003 || SurfaceNotSupported
|-
|-
| 0 || Success
| 0x20000 || DispInitFailed
|-
|-
| 1 || NotImplemented
| 0x20001 || DispAlreadyAttached
|-
|-
| 2 || NotSupported
| 0x20002 || DispTooManyDisplays
|-
|-
| 3 || NotInitialized
| 0x20003 || DispNoDisplaysAttached
|-
|-
| 4 || BadParameter
| 0x20004 || DispModeNotSupported
|-
|-
| 5 || Timeout
| 0x20005 || DispNotFound
|-
|-
| 6 || InsufficientMemory
| 0x20006 || DispAttachDissallowed
|-
|-
| 7 || ReadOnlyAttribute
| 0x20007 || DispTypeNotSupported
|-
|-
| 8 || InvalidState
| 0x20008 || DispAuthenticationFailed
|-
|-
| 9 || InvalidAddress
| 0x20009 || DispNotAttached
|-
|-
| 0xA || InvalidSize
| 0x2000A || DispSamePwrState
|-
|-
| 0xB || BadValue
| 0x2000B || DispEdidFailure
|-
|-
| 0xD || AlreadyAllocated
| 0x2000C || DispDsiReadAckError
|-
|-
| 0xE || Busy
| 0x2000D || DispDsiReadInvalidResp
|-
|-
| 0xF || ResourceError
| 0x30000 || FileWriteFailed
|-
|-
| 0x10 || CountMismatch
| 0x30001 || FileReadFailed
|-
|-
| 0x1000 || SharedMemoryTooSmall
| 0x30002 || EndOfFile
|-
|-
| 0x30003 || FileOperationFailed
| 0x30003 || FileOperationFailed
|-
|-
| 0x30004 || DirOperationFailed
| 0x30004 || DirOperationFailed
|-
|-
| 0x3000F || IoctlFailed                         
| 0x30005 || EndOfDirList
|-
|-
| 0x30010 || AccessDenied
| 0x30006 || ConfigVarNotFound
|-
|-
| 0x30013 || FileNotFound
| 0x30007 || InvalidConfigVar
|-
|-
| 0xA000E || ModuleNotPresent
| 0x30008 || LibraryNotFound
|}
|-
| 0x30009 || SymbolNotFound
|-
| 0x3000A || MemoryMapFailed
|-
| 0x3000F || IoctlFailed                         
|-
| 0x30010 || AccessDenied
|-
| 0x30011 || DeviceNotFound
|-
| 0x30012 || KernelDriverNotFound
|-
| 0x30013 || FileNotFound
|-
| 0x30014 || PathAlreadyExists
|-
| 0xA000E || ModuleNotPresent
|}
 
= NvDrvStatus =
This is "nns::nvdrv::NvDrvStatus".
 
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| FreeSize
|-
| 0x4
| 0x4
| AllocatableSize
|-
| 0x8
| 0x4
| MinimumFreeSize
|-
| 0xC
| 0x4
| MinimumAllocatableSize
|-
| 0x10
| 0x10
| Reserved
|}
 
= Notes =
In some cases, a panic may occur. NV forces a crash by doing:
(void *)0 = 0xCAFE;
End result is that the system hangs with a white-screen.
 
When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.


= Panic =
GPU rendering (GPFIFO) is only used by applets/Applications. All sysmodules doing any gfx-display uses software rendering. During system-boot, GPU GPFIFO is not used until the applets are launched.
In some cases, a panic may occur. NV forces a crash by doing:
(void *)0 = 0xCAFE;
End result is that the system hangs with a white-screen.
 
== Gpfifo Panic ==
When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.


[[Category:Services]]
[[Category:Services]]
Retrieved from "https://switchbrew.org/wiki/NV_services"