NV services

nvdrv, nvdrv:a, nvdrv:s, nvdrv:t

This is "nns::nvdrv::INvDrvServices".

Each service is used by:

• "nvdrv": Applications.
  • Permission mask is [11.0.0+] 0xA83B ([1.0.0-2.3.0] 0x2B, [3.0.0+] 0xA82B).
• "nvdrv:a": Applets.
  • Permission mask is [3.0.0+] 0x10A9 ([1.0.0-2.3.0] 0xA9).
• "nvdrv:s": Sysmodules.
  • Permission mask is [3.0.0+] 0x439E ([1.0.0-2.3.0] 0x39E).
• "nvdrv:t": Factory.
  • Permission mask is 0xFFFFFFFF.

Cmd	Name
0	#Open
1	#Ioctl
2	#Close
3	#Initialize
4	#QueryEvent
5	#MapSharedMem
6	#GetStatus
7	#SetAruidWithoutCheck
8	#SetAruid
9	#DumpStatus
10	[3.0.0+] #InitializeDevtools
11	[3.0.0+] #Ioctl2
12	[3.0.0+] #Ioctl3
13	[3.0.0+] #SetGraphicsFirmwareMemoryMarginEnabled

Open

Takes a type-0x5 input buffer Path. Returns two output u32s FdOut and Err.

Ioctl

Takes two input u32s Fd and Iocode, a type-0x21 input buffer and a type-0x22 output buffer. Returns an output u32 Err.

The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).

Close

Takes an input u32 Fd. Returns an output u32 Err.

Initialize

Takes an input Process handle, an input TransferMemory handle and an input u32 Size. Returns an output u32 Err.

Webkit applet creates the TransferMemory with perm == 0 and size == 0x300000.

QueryEvent

Takes two input u32s Fd and EvtId. Returns an output u32 Err and an output Event handle.

QueryEvent is only supported on (and implemented differently on):

• /dev/nvhost-gpu
  • EvtId=1: SmException_BptIntReport
  • EvtId=2: SmException_BptPauseReport
  • EvtId=3: ErrorNotifierEvent
• /dev/nvhost-ctrl: Used to get events for syncpts.
  • EvtId=(event_slot | ((syncpt_id & 0xFFF) << 16) | (is_valid << 28)): New format used by NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT/NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT_EX.
  • EvtId=(event_slot | (syncpt_id << 4)): Old format used by NVHOST_IOCTL_CTRL_SYNCPT_WAITEX.
• /dev/nvhost-ctrl-gpu
  • EvtId=1: Returns error_event_handle.
  • EvtId=2: Returns unknown event.
• /dev/nvhost-dbg-gpu
  • Ignores EvtId.

MapSharedMem

Takes an input TransferMemory handle and two input u32s Fd and HMem. Returns an output u32 Err.

HMem is a /dev/nvmap memory handle.

GetStatus

Takes no input. Returns an output #NvDrvStatus and an output u32 Err.

SetAruidWithoutCheck

Takes an input u64 Aruid. Returns an output u32 Err.

Aruid must match the current AppletResourceUserId.

SetAruid

Takes a PID-descriptor and an input AppletResourceUserId. Returns an output u32 Err.

DumpStatus

No input/output.

InitializeDevtools

Takes an input TransferMemory handle and an input u32 Size. Returns an output u32 Err.

Ioctl2

Takes two input u32s Fd and Iocode, two type-0x21 input buffers and a type-0x22 output buffer. Returns an output u32 Err.

Ioctl3

Takes two input u32s Fd and Iocode, a type-0x21 input buffer and two type-0x22 output buffers. Returns an output u32 Err.

SetGraphicsFirmwareMemoryMarginEnabled

Takes an input u64. No output.

This sets a boolean value based on the input u64 and the value of the "nv!nv_graphics_firmware_memory_margin" system configuration, but only for "nvdrv" (the other services default to false).

[3.0.0+] Official user-processes now use this at the end of nvdrv service init with value 0x1.

nvmemp

This is "nv::MemoryProfiler::IMemoryProfiler".

/dev/nvhost-ctrl sends the ioctl NVHOST_IOCTL_CTRL_GET_CONFIG to check the config "nv!NV_MEMORY_PROFILER". If config_str returns "1", the application attempts to use nvmemp.

Cmd	Name
0	Open
1	GetPid

Open

Takes an input TransferMemory handle and an input u32 Size. No output.

GetPid

No input. Returns an output u32 Pid.

nvdrvdbg

This is "nns::nvdrv::INvDrvDebugFSServices".

Cmd	Name
0	#DebugFSOpen
1	#DebugFSClose
2	#GetDebugFSKeys
3	#GetDebugFSValue
4	#SetDebugFSValue

DebugFSOpen

Takes an input Process handle. Returns an output u32 Handle.

DebugFSClose

Takes an input u32 Handle. No output.

GetDebugFSKeys

Takes an input u32 Handle and a type-0x6 output buffer OutValueBuf. Returns an output u32 Err.

GetDebugFSValue

Takes an input u32 Handle, a type-0x5 input buffer InKeyBuf and a type-0x6 output buffer OutValueBuf. Returns an output u32 Err.

SetDebugFSValue

Takes an input u32 Handle and two type-0x5 input buffers InKeyBuf and InValueBuf. Returns an output u32 Err.

nvgem:c

This is "nv::gemcontrol::INvGemControl".

Cmd	Name
0	Initialize
1	GetEventHandle
2	ControlNotification
3	SetNotificationPerm
4	SetCoreDumpPerm
5	[1.0.0-4.1.0] GetAruid
6	Reset
7	[3.0.0+] GetAruid2

Initialize

No input. Returns an output u32 Err.

GetEventHandle

No input. Returns an output Event handle and an output u32 Err.

ControlNotification

Takes an input bool Enable. Returns an output u32 Err.

SetNotificationPerm

Takes an input u64 Aruid and an input bool Enable. Returns an output u32 Err.

SetCoreDumpPerm

Takes an input u64 Aruid and an input bool Enable. Returns an output u32 Err.

GetAruid

No input. Returns an output u64 Aruid and an output u32 Err.

Reset

No input. Returns an output u32 Err.

GetAruid2

Unofficial name.

No input. Returns an output u64 Aruid, an output bool IsCoreDumpEnabled and an output u32 Err.

nvgem:cd

This is "nv::gemcoredump::INvGemCoreDump".

Cmd	Name
0	Initialize
1	GetAruid
2	[1.0.0-8.1.0] ReadNextBlock
3	[8.0.0+] GetNextBlockSize
4	[8.0.0+] ReadNextBlock2

Initialize

No input. Returns an output u32 Err.

GetAruid

No input. Returns an output u64 Aruid and an output u32 Err.

ReadNextBlock

Takes a type-0x6 output buffer. Returns an output u32 Err.

GetNextBlockSize

Unofficial name.

No input. Returns an output u64 Size and an output u32 Err.

ReadNextBlock2

Unofficial name.

Takes a type-0x6 output buffer and two input u64s Size and Offset. Returns an output u64 OutSize and an output u32 Err.

nvdbg:d

This is "nns::nvdrv::INvDrvDebugSvcServices". This was added with [10.0.0+].

This service has no commands.

Ioctls

The ioctl number is generated with the following primitive (see Linux kernel):

#define _IOC(inout, group, num, len) \
   (inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))

The following table contains all known ioctls.

/dev/nvhost-ctrl

Value	Direction	Size	Description
0xC0080014	Inout	8	#NVHOST_IOCTL_CTRL_SYNCPT_READ
0x40040015	In	4	#NVHOST_IOCTL_CTRL_SYNCPT_INCR
0xC00C0016	Inout	12	#NVHOST_IOCTL_CTRL_SYNCPT_WAIT
0x40080017	In	8	#NVHOST_IOCTL_CTRL_MODULE_MUTEX
0xC0180018	Inout	24	#NVHOST_IOCTL_CTRL_MODULE_REGRDWR
0xC0100019	Inout	16	#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX
0xC008001A	Inout	8	#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX
0xC183001B	Inout	387	#NVHOST_IOCTL_CTRL_GET_CONFIG
0xC004001C	Inout	4	#NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT
0xC010001D	Inout	16	#NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT
0xC010001E	Inout	16	#NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT_EX
0xC004001F	Inout	4	#NVHOST_IOCTL_CTRL_SYNCPT_ALLOC_EVENT
0xC0040020	Inout	4	#NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT
0x40080021	In	8	#NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT_BATCH
0xC0040022	Inout	4	#NVHOST_IOCTL_CTRL_SYNCPT_GET_SHIFT

NVHOST_IOCTL_CTRL_SYNCPT_READ

Identical to Linux driver.

 struct {
   __in  u32 id;
   __out u32 value;
 };

NVHOST_IOCTL_CTRL_SYNCPT_INCR

Identical to Linux driver.

 struct {
   __in u32 id;
 };

NVHOST_IOCTL_CTRL_SYNCPT_WAIT

Identical to Linux driver.

 struct {
   __in u32 id;
   __in u32 thresh;
   __in s32 timeout;
 };

NVHOST_IOCTL_CTRL_MODULE_MUTEX

Identical to Linux driver.

 struct {
   __in u32 id;
   __in u32 lock;        // 0=unlock, 1=lock
 };

NVHOST_IOCTL_CTRL_MODULE_REGRDWR

Identical to Linux driver. Uses 32-bit version and doesn't work.

 struct {
   __in u32 id;
   __in u32 num_offsets;
   __in u32 block_size;
   __in u32 offsets;
   __in u32 values;
   __in u32 write;
 };

NVHOST_IOCTL_CTRL_SYNCPT_WAITEX

Identical to Linux driver.

 struct {
   __in  u32 id;
   __in  u32 thresh;
   __in  s32 timeout;
   __out u32 value;
 };

NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX

Identical to Linux driver.

 struct {
   __in  u32 id;
   __out u32 value;
 };

NVHOST_IOCTL_CTRL_GET_CONFIG

Returns configured settings. Not available in production mode.

 struct {
   __in char name[0x41];       // "nv"
   __in char key[0x41];
   __out char value[0x101];
 };

NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT

Clears the wait signal of a syncpt event.

 struct {
   __in u32 event_slot;       // 0x00 to 0x3F
 };

NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT

Waits on a syncpt using events. If waiting fails, returns error code 0x05 (Timeout) and sets value to (event_slot | ((syncpt_id & 0xFFF) << 16) | (is_valid << 28)).

 struct {
   __in  u32 id;
   __in  u32 thresh;
   __in  s32 timeout;
   __out u32 value;
 };

NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT_EX

Waits on a syncpt using a specific event. If waiting fails, returns error code 0x05 (Timeout) and sets value to (event_slot | (syncpt_id << 4)).

 struct {
   __in    u32 id;
   __in    u32 thresh;
   __in    s32 timeout;
   __inout u32 value;           // in=event_slot; out=syncpt_value
 };

NVHOST_IOCTL_CTRL_SYNCPT_ALLOC_EVENT

Allocates a new syncpt event.

 struct {
   __in u32 event_slot;         // 0x00 to 0x3F
 };

NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT

Frees an existing syncpt event.

 struct {
   __in u32 event_slot;         // 0x00 to 0x3F
 };

NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT_BATCH

Frees multiple syncpt events.

 struct {
   __in u64 event_slot_mask;    // 64-bit bitfield where each bit represents one event
 };

NVHOST_IOCTL_CTRL_SYNCPT_GET_SHIFT

Returns the syncpt shift value.

 struct {
   __out u32 syncpt_shift;      // 0x00 (FIFO disabled) or 0x60 (FIFO enabled)
 };

/dev/nvmap

Value	Direction	Size	Description
0xC0080101	Inout	8	#NVMAP_IOC_CREATE
0x00000102	-	0	#NVMAP_IOC_CLAIM
0xC0080103	Inout	8	#NVMAP_IOC_FROM_ID
0xC0200104	Inout	32	#NVMAP_IOC_ALLOC
0xC0180105	Inout	24	#NVMAP_IOC_FREE
0xC0280106	Inout	40	#NVMAP_IOC_MMAP
0xC0280107	Inout	40	#NVMAP_IOC_WRITE
0xC0280108	Inout	40	#NVMAP_IOC_READ
0xC00C0109	Inout	12	#NVMAP_IOC_PARAM
0xC010010A	Inout	16	#NVMAP_IOC_PIN_MULT
0xC010010B	Inout	16	#NVMAP_IOC_UNPIN_MULT
0xC008010C	Inout	8	#NVMAP_IOC_CACHE
0xC004010D	Inout	4	#NVMAP_IOC_GET_IVC_ID
0xC008010E	Inout	8	#NVMAP_IOC_GET_ID
0xC004010F	Inout	4	#NVMAP_IOC_FROM_IVC_ID
0x40040110	In	4	#NVMAP_IOC_SET_ALLOCATION_TAG_LABEL
0x00000111	-	0	#NVMAP_IOC_RESERVE
0x40100112	In	16	#NVMAP_IOC_EXPORT_FOR_ARUID
0x40100113	In	16	#NVMAP_IOC_IS_OWNED_BY_ARUID
0x40100114	In	16	#NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID

NVMAP_IOC_CREATE

Creates an nvmap object. Identical to Linux driver.

 struct {
   __in  u32 size;
   __out u32 handle;
 };

NVMAP_IOC_CLAIM

Returns NotSupported.

NVMAP_IOC_FROM_ID

Get handle to an existing nvmap object. Identical to Linux driver.

 struct {
   __in  u32 id;
   __out u32 handle;
 };

NVMAP_IOC_ALLOC

Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.

 struct {
   __in u32 handle;
   __in u32 heapmask;
   __in u32 flags;    // (0=read-only, 1=read-write)
   __inout u32 align;
   __in u8  kind;
   u8       pad[7];
   __in u64 addr;
 };

NVMAP_IOC_FREE

This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.

 struct {
   __in  u32 handle;
   u32       pad;
   __out u64 address;  // 0 if the handle wasn't yet freed
   __out u32 size;
   __out u32 flags;    // 1=WAS_UNCACHED (if flags bit 1 was set when NVMAP_IOC_ALLOC was called)
 };

NVMAP_IOC_MMAP

Returns NotSupported.

NVMAP_IOC_WRITE

Returns NotSupported.

NVMAP_IOC_READ

Returns NotSupported.

NVMAP_IOC_PARAM

Returns info about a nvmap object. Identical to Linux driver, but extended with further params.

 struct {
   __in  u32 handle;
   __in  u32 param;  // 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
   __out u32 result;
 };

NVMAP_IOC_PIN_MULT

Returns NotSupported.

NVMAP_IOC_UNPIN_MULT

Returns NotSupported.

NVMAP_IOC_CACHE

Returns NotSupported.

NVMAP_IOC_GET_IVC_ID

Returns NotSupported.

NVMAP_IOC_GET_ID

Returns an id for a nvmap object. Identical to Linux driver.

 struct {
   __out u32 id; //~0 indicates error
   __in  u32 handle;
 };

NVMAP_IOC_FROM_IVC_ID

Returns NotSupported.

NVMAP_IOC_SET_ALLOCATION_TAG_LABEL

Returns NotSupported.

NVMAP_IOC_RESERVE

Returns NotSupported.

NVMAP_IOC_EXPORT_FOR_ARUID

Binds a nvmap object to an AppletResourceUserId.

 struct {
   __in  u64 aruid;
   __in  u32 handle;
   u8        pad[4];
 };

NVMAP_IOC_IS_OWNED_BY_ARUID

Checks if a nvmap object is bound to an AppletResourceUserId.

 struct {
   __in  u64 aruid;
   __in  u32 handle;
   u8        pad[4];
 };

NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID

Unbinds a nvmap object from an AppletResourceUserId.

 struct {
   __in  u64 aruid;
   __in  u32 handle;
   u8        pad[4];
 };

/dev/nvdisp-ctrl

Value	Direction	Size	Description
0x80040212	Out	4	NVDISP_CTRL_NUM_OUTPUTS
0xC0140213	Inout	20	NVDISP_CTRL_GET_DISPLAY_PROPERTIES
0xC1100214	Inout	272	NVDISP_CTRL_QUERY_EDID
0xC0080216 ([1.0.0-3.0.0] 0xC0040216)	Inout	8 ([1.0.0-3.0.0] 4)	NVDISP_CTRL_GET_EXT_HPD_IN_OUT_EVENTS ([1.0.0-3.0.0] NVDISP_CTRL_GET_EXT_HPD_IN_EVENT)
([1.0.0-3.0.0] 0xC0040217)	([1.0.0-3.0.0] Inout)	([1.0.0-3.0.0] 4)	([1.0.0-3.0.0] NVDISP_CTRL_GET_EXT_HPD_OUT_EVENT)
0xC0100218	Inout	16	NVDISP_CTRL_GET_VBLANK_HEAD0_EVENT
0xC0100219	Inout	16	NVDISP_CTRL_GET_VBLANK_HEAD1_EVENT
0xC0040220	Inout	4	NVDISP_CTRL_SUSPEND
0x80010224	Out	1	[11.0.0+] NVDISP_CTRL_IS_DISPLAY_OLED

/dev/nvdisp-disp0, /dev/nvdisp-disp1

Value	Direction	Size	Description
0x40040201	In	4	NVDISP_GET_WINDOW
0x40040202	In	4	NVDISP_PUT_WINDOW
0xC4C80203	In	1224	NVDISP_FLIP
0x80380204	Out	56	NVDISP_GET_MODE
0x40380205	Out	56	NVDISP_SET_MODE
0x430C0206	In	780	NVDISP_SET_LUT
0x40010207	In	1	NVDISP_CONFIG_CRC
0x80040208	Out	4	NVDISP_GET_CRC
0x80040209	Out	4	NVDISP_GET_HEAD_STATUS
0xC038020A	Inout	56	NVDISP_VALIDATE_MODE
0x4018020B	In	24	NVDISP_SET_CSC
0xC004020C	Inout	4	NVDISP_GET_VBLANK_SYNCPT
0x8040020D	Out	64	NVDISP_GET_UNDERFLOWS
0xC99A020E	Inout	2458	NVDISP_SET_CMU
0xC004020F	Inout	4	NVDISP_DPMS
0x80600210	Out	96	NVDISP_GET_AVI_INFOFRAME
0x40600211	In	96	NVDISP_SET_AVI_INFOFRAME
0xEBFC0215	Inout	11260	NVDISP_GET_MODE_DB
0xC003021A	Inout	3	NVDISP_PANEL_GET_VENDOR_ID
0x803C021B	Out	60	NVDISP_GET_MODE2
0x403C021C	In	60	NVDISP_SET_MODE2
0xC03C021D	Inout	60	NVDISP_VALIDATE_MODE2
0xEF20021E	Inout	12064	NVDISP_GET_MODE_DB2
0xC004021F	Inout	4	NVDISP_GET_WINMASK
0x80080221	Out	8	[10.0.0+] #NVDISP_GET_BACKLIGHT_RANGE
0x40040222	In	4	[10.0.0+] #NVDISP_SET_BACKLIGHT_RANGE_MAX
0x40040223	In	4	[11.0.0+] #NVDISP_SET_BACKLIGHT_RANGE_MIN
0x401C0225	In	28	[11.0.0+] #NVDISP_SEND_PANEL_MSG
0xC01C0226	Inout	28	[11.0.0+] #NVDISP_GET_PANEL_DATA

NVDISP_GET_BACKLIGHT_RANGE

Returns the minimum and maximum values for the intensity of the display's backlight.

 struct {
   __out u32 min;
   __out u32 max;
 };

NVDISP_SET_BACKLIGHT_RANGE_MAX

Sets the maximum value for the intensity of the display's backlight.

 struct {
   __in u32 max;
 };

NVDISP_SET_BACKLIGHT_RANGE_MIN

Sets the minimum value for the intensity of the display's backlight.

 struct {
   __in u32 min;
 };

NVDISP_SEND_PANEL_MSG

Sends raw data to the display panel over DPAUX.

 struct {
   __in u32 cmd;          // DPAUX AUXCTL command (1=unk, 2=I2CWR, 4=MOTWR, 7=AUXWR)
   __in u32 addr;         // DPAUX AUXADDR
   __in u32 size;         // message size
   __in u32 msg[4];       // raw AUXDATA message
 };

NVDISP_GET_PANEL_DATA

Receives raw data from the display panel over DPAUX.

 struct {
   __in u32 cmd;          // DPAUX AUXCTL command (3=I2CRD, 5=MOTRD, 6=AUXRD)
   __in u32 addr;         // DPAUX AUXADDR
   __in u32 size;         // message size
   __out u32 msg[4];      // raw AUXDATA message
 };

/dev/nvcec-ctrl

Value	Direction	Size	Description
0x40010301	In	1	NVCEC_CTRL_ENABLE
0x804C0302	Out	76	NVCEC_CTRL_GET_PADDR
0x40040303	In	4	NVCEC_CTRL_SET_LADDR
0xC04C0304	Inout	76	NVCEC_CTRL_WRITE
0xC04C0305	Inout	76	NVCEC_CTRL_READ
0x804C0306	Out	76	NVCEC_CTRL_GET_CONNECTION_STATUS
0x804C0307	Out	76	NVCEC_CTRL_GET_WRITE_STATUS

/dev/nvhdcp_up-ctrl

Value	Direction	Size	Description
0xC4880401	Inout	1160	NVHDCP_READ_STATUS
0xC4880402	Inout	1160	NVHDCP_READ_M
0x40010403	In	1	NVHDCP_ENABLE
0xC0080404	Inout	8	NVHDCP_CTRL_STATE_TRANSIT_EVENT_DATA
0xC0010405	Inout	1	NVHDCP_CTRL_STATE_CB

/dev/nvdcutil-disp0, /dev/nvdcutil-disp1

Value	Direction	Size	Description
0x40010501	In	1	NVDCUTIL_ENABLE_CRC
0x40010502	In	1	NVDCUTIL_VIRTUAL_EDID_ENABLE
0x42040503	In	1056	NVDCUTIL_VIRTUAL_EDID_SET_DATA
0x803C0504	Out	60	NVDCUTIL_GET_MODE
0x40010505	In	1	NVDCUTIL_BEGIN_TELEMETRY_TEST
0x400C0506	In	12	NVDCUTIL_DSI_PACKET_TEST_SHORT_WRITE
0x40F80507	In	248	NVDCUTIL_DSI_PACKET_TEST_LONG_WRITE
0xC0F40508	Inout	244	NVDCUTIL_DSI_PACKET_TEST_READ
0x40010509	In	1	[10.0.0+] NVDCUTIL_DP_ELECTRIC_TEST_EN
0xC020050A	Inout	32	[10.0.0+] NVDCUTIL_DP_ELECTRIC_TEST_SETTINGS
0x8070050B	Out	112	[11.0.0+] NVDCUTIL_DP_CONF_READ

/dev/nvsched-ctrl

This is a customized scheduler device.

The way this device is exposed and configured is exclusive to the Switch, since other sources don't have an actual interface for the scheduler.

Value	Direction	Size	Description
0x00000601	-	0	#NVSCHED_CTRL_ENABLE
0x00000602	-	0	#NVSCHED_CTRL_DISABLE
0x40180603	In	24	#NVSCHED_CTRL_ADD_APPLICATION
0x40180604	In	24	#NVSCHED_CTRL_UPDATE_APPLICATION
0x40080605	In	8	#NVSCHED_CTRL_REMOVE_APPLICATION
0x80080606	Out	8	#NVSCHED_CTRL_GET_ID
0x80080607	Out	8	#NVSCHED_CTRL_ADD_RUNLIST
0x40180608	In	24	#NVSCHED_CTRL_UPDATE_RUNLIST
0x40100609	In	16	#NVSCHED_CTRL_LINK_RUNLIST
0x4010060A	In	16	#NVSCHED_CTRL_UNLINK_RUNLIST
0x4008060B	In	8	#NVSCHED_CTRL_REMOVE_RUNLIST
0x8001060C	Out	1	#NVSCHED_CTRL_HAS_OVERRUN_EVENT
0x8020060D ([1.0.0-3.0.0] 0x8010060D)	Out	32 ([1.0.0-3.0.0] 16)	#NVSCHED_CTRL_GET_NEXT_OVERRUN_EVENT
0x400C060E	In	12	#NVSCHED_CTRL_PUT_CONDUCTOR_FLIP_FENCE
0x4008060F	In	8	#NVSCHED_CTRL_DETACH_APPLICATION
0x40100610	In	16	NVSCHED_CTRL_SET_APPLICATION_MAX_DEBT
0x40100611	In	16	NVSCHED_CTRL_SET_RUNLIST_MAX_DEBT
0x40010612	In	1	NVSCHED_CTRL_OVERRUN_EVENTS_ENABLE

NVSCHED_CTRL_ENABLE

Enables the scheduler.

NVSCHED_CTRL_DISABLE

Disables the scheduler.

NVSCHED_CTRL_ADD_APPLICATION

Adds a new application to the scheduler.

 struct {
   __in u64 application_id;
   __in u64 priority;
   __in u64 timeslice;
 };

NVSCHED_CTRL_UPDATE_APPLICATION

Updates the application parameters in the scheduler.

 struct {
   __in u64 application_id;
   __in u64 priority;
   __in u64 timeslice;
 };

NVSCHED_CTRL_REMOVE_APPLICATION

Removes the application from the scheduler.

 struct {
   __in u64 application_id;
 };

NVSCHED_CTRL_GET_ID

Returns the ID of the last scheduled object.

 struct {
   __out u64 id;
 };

NVSCHED_CTRL_ADD_RUNLIST

Creates a new runlist and returns it's ID.

 struct {
   __out u64 runlist_id;
 };

NVSCHED_CTRL_UPDATE_RUNLIST

Updates the runlist parameters in the scheduler.

 struct {
   __in u64 runlist_id;
   __in u64 priority;
   __in u64 timeslice;
 };

NVSCHED_CTRL_LINK_RUNLIST

Links a runlist to a given application in the scheduler.

 struct {
   __in u64 runlist_id;
   __in u64 application_id;
 };

NVSCHED_CTRL_UNLINK_RUNLIST

Unlinks a runlist from a given application in the scheduler.

 struct {
   __in u64 runlist_id;
   __in u64 application_id;
 };

NVSCHED_CTRL_REMOVE_RUNLIST

Removes the runlist from the scheduler.

 struct {
   __in u64 runlist_id;
 };

NVSCHED_CTRL_HAS_OVERRUN_EVENT

Returns a boolean to tell if the scheduler has an overrun event or not.

 struct {
   __out u8 has_overrun;
 };

NVSCHED_CTRL_GET_NEXT_OVERRUN_EVENT

Returns the overrun event's data from the scheduler.

 struct {
   __out u64 runlist_id;
   __out u64 debt;
   __out u64 unk0;           // 3.0.0+ only
   __out u64 unk1;           // 3.0.0+ only
 };

NVSCHED_CTRL_PUT_CONDUCTOR_FLIP_FENCE

Installs a fence swap event?

 struct {
   __in u32 fence_id;
   __in u32 fence_value;
   __in u32 swap_interval;
 };

NVSCHED_CTRL_DETACH_APPLICATION

Places the given application in detached state.

 struct {
   __in u64 application_id;
 };

/dev/nverpt-ctrl

Added in firmware version 3.0.0.

Value	Direction	Size	Description
0xC1280701	Inout	296	#NVERPT_TELEMETRY_SUBMIT_DATA
0xCF580702	Inout	3928	#NVERPT_TELEMETRY_SUBMIT_DISPLAY_DATA

NVERPT_TELEMETRY_SUBMIT_DATA

Sends test data for creating a new Error Report.

 struct {
   __in u64 TestU64;
   __in u32 TestU32;
   __in u8  padding0[4];
   __in s64 TestI64;
   __in s32 TestI32;
   __in u8  TestString[32];
   __in u8  TestU8Array[8];
   __in u32 TestU8Array_size;
   __in u32 TestU32Array[8];
   __in u32 TestU32Array_size;
   __in u64 TestU64Array[8];
   __in u32 TestU64Array_size;
   __in s32 TestI32Array[8];
   __in u32 TestI32Array_size;
   __in s64 TestI64Array[8];
   __in u32 TestI64Array_size;
   __in u16 TestU16;
   __in u8  TestU8;
   __in s16 TestI16;
   __in s8  TestI8;
   __in u8  padding1[5];
 };

NVERPT_TELEMETRY_SUBMIT_DISPLAY_DATA

Sends display data for creating a new Error Report.

 struct {
   __in u32 CodecType;
   __in u32 DecodeBuffers;
   __in u32 FrameWidth;
   __in u32 FrameHeight;
   __in u8  ColorPrimaries;
   __in u8  TransferCharacteristics;
   __in u8  MatrixCoefficients;
   __in u8  padding;
   __in u32 DisplayWidth;
   __in u32 DisplayHeight;
   __in u32 DARWidth;
   __in u32 DARHeight;
   __in u32 ColorFormat;
   __in u32 ColorSpace[8];
   __in u32 ColorSpace_size;
   __in u32 SurfaceLayout[8];
   __in u32 SurfaceLayout_size;
   __in u8  ErrorString[64];       // must be "Error detected = 0x1000000"
   __in u32 VideoDecState;
   __in u8  VideoLog[3712];
   __in u32 VideoLog_size;
 };

/dev/nvhost-as-gpu

Each fd opened to this device creates an address space. An address space is then later bound with a channel.

Once a nvgpu channel has been bound to an address space it cannot be unbound. There is no support for allowing an nvgpu channel to change from one address space to another (or from one to none).

Value	Direction	Size	Description
0x40044101	In	4	#NVGPU_AS_IOCTL_BIND_CHANNEL
0xC0184102	Inout	24	#NVGPU_AS_IOCTL_ALLOC_SPACE
0xC0104103	Inout	16	#NVGPU_AS_IOCTL_FREE_SPACE
0xC0184104	Inout	24	#NVGPU_AS_IOCTL_MAP_BUFFER
0xC0084105	Inout	8	#NVGPU_AS_IOCTL_UNMAP_BUFFER
0xC0284106	Inout	40	#NVGPU_AS_IOCTL_MAP_BUFFER_EX
0x40104107	In	16	#NVGPU_AS_IOCTL_ALLOC_AS
0xC0404108	Inout	64	#NVGPU_AS_IOCTL_GET_VA_REGIONS
0x40284109	In	40	#NVGPU_AS_IOCTL_ALLOC_AS_EX
0xC038410A	Inout	56	#NVGPU_AS_IOCTL_MAP_BUFFER_EX2
0xC0??4114	Inout	Variable	#NVGPU_AS_IOCTL_REMAP

NVGPU_AS_IOCTL_BIND_CHANNEL

Identical to Linux driver.

 struct {
   __in u32 channel_fd;
 };

NVGPU_AS_IOCTL_ALLOC_SPACE

Reserves pages in the device address space.

 struct {
   __in u32 pages;
   __in u32 page_size;
   __in u32 flags;
   u32      padding;
   union {
     __out u64 offset;
     __in  u64 align;
   };
 };

NVGPU_AS_IOCTL_FREE_SPACE

Frees pages from the device address space.

 struct {
   __in u64 offset;
   __in u32 pages;
   __in u32 page_size;
 };

NVGPU_AS_IOCTL_MAP_BUFFER

Maps a memory region in the device address space.

Unaligned size will cause a #Panic.

On success, the mapped memory region is granted the DeviceShared attribute.

 struct {
   __in    u32 flags;        // bit0: fixed_offset, bit2: cacheable
   u32         reserved0;
   __in    u32 mem_id;       // nvmap handle
   u32         reserved1;
   union {
     __out u64 offset;
     __in  u64 align;
   };
 };

NVGPU_AS_IOCTL_MAP_BUFFER_EX

Maps a memory region in the device address space with extra params.

Unaligned size will cause a #Panic.

On success, the mapped memory region is granted the DeviceShared attribute.

 struct {
   __in      u32 flags;          // bit0: fixed_offset, bit2: cacheable
   __inout   u32 kind;           // -1 is default
   __in      u32 mem_id;         // nvmap handle
   u32           reserved;
   __in      u64 buffer_offset;
   __in      u64 mapping_size;
   union {
     __out   u64 offset;
     __in    u64 align;
   };
 };

NVGPU_AS_IOCTL_UNMAP_BUFFER

Unmaps a memory region from the device address space.

struct {
   __in u64 offset;
 };

NVGPU_AS_IOCTL_ALLOC_AS

Nintendo's custom implementation for allocating an address space.

 struct {
   __in u32 big_page_size;   // depends on GPU's available_big_page_sizes; 0=default
   __in s32 as_fd;           // ignored; passes 0
   __in u64 reserved;        // ignored; passes 0
 };

NVGPU_AS_IOCTL_GET_VA_REGIONS

Nintendo's custom implementation to get rid of pointer in struct.

Uses Ioctl3.

 struct va_region {
   u64 offset;
   u32 page_size;
   u32 reserved;
   u64 pages;
 };
 
 struct {
   u64           buf_addr;    // (contained output user ptr on linux, ignored)
   __inout u32   buf_size;    // forced to 2*sizeof(struct va_region)
   u32           reserved;
   __out struct  va_region regions[2];
 };

NVGPU_AS_IOCTL_ALLOC_AS_EX

Nintendo's custom implementation for allocating an address space with extra params.

 struct {
   __in u32 big_page_size;   // depends on GPU's available_big_page_sizes; 0=default
   __in s32 as_fd;           // ignored; passes 0
   __in u32 flags;           // passes 0
   __in u32 reserved;        // ignored; passes 0
   __in u64 va_range_start;
   __in u64 va_range_end;
   __in u64 va_range_split;
 };

NVGPU_AS_IOCTL_MAP_BUFFER_EX2

Maps a memory region in the device address space with extra params.

Unaligned size will cause a #Panic.

On success, the mapped memory region is granted the DeviceShared attribute.

 struct {
   __in      u32 flags;          // bit0: fixed_offset, bit2: cacheable
   __inout   u32 kind;           // -1 is default
   __in      u32 mem_id;         // nvmap handle
   u32           reserved0;
   __in      u64 buffer_offset;
   __in      u64 mapping_size;
   union {
     __out   u64 offset;
     __in    u64 align;
   };
   __in      u64 vma_addr;
   __in      u32 pages;
   u32           reserved1;
 };

NVGPU_AS_IOCTL_REMAP

Nintendo's custom implementation of address space remapping for sparse pages.

 struct remap_op {
   __in u16 flags;                      // bit2: cacheable
   __in u16 kind;           
   __in u32 mem_handle;
   __in u32 mem_offset_in_pages;
   __in u32 virt_offset_in_pages;       // (alloc_space_offset >> 0x10)
   __in u32 num_pages;                  // alloc_space_pages
 };

struct {
   __in struct remap_op entries[];
};

/dev/nvhost-dbg-gpu

Returns NotSupported on Open unless nn::settings::detail::GetDebugModeFlag is set.

Value	Direction	Size	Description
0x40084401	In	8	NVGPU_DBG_GPU_IOCTL_BIND_CHANNEL
0xC0??4402	Inout	Variable	NVGPU_DBG_GPU_IOCTL_REG_OPS
0x40084403	In	8	NVGPU_DBG_GPU_IOCTL_EVENTS_CTRL
0x40044404	In	4	NVGPU_DBG_GPU_IOCTL_POWERGATE
0x40044405	In	4	NVGPU_DBG_GPU_IOCTL_SMPC_CTXSW_MODE
0x40044406	In	4	NVGPU_DBG_GPU_IOCTL_SUSPEND_RESUME_ALL_SMS
0xC0184407	Inout	24	NVGPU_DBG_GPU_IOCTL_PERFBUF_MAP
0x40084408	In	8	NVGPU_DBG_GPU_IOCTL_PERFBUF_UNMAP
0x40084409	In	8	NVGPU_DBG_GPU_IOCTL_PC_SAMPLING
0x4008440A	In	8	NVGPU_DBG_GPU_IOCTL_TIMEOUT
0x8008440B	Out	8	NVGPU_DBG_GPU_IOCTL_GET_TIMEOUT
0x8004440C	Out	4	NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT_SIZE
0x0000440D	None	0	#NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT
0xC018440E	Inout	24	NVGPU_DBG_GPU_IOCTL_ACCESS_FB_MEMORY
0xC018440F	Inout	24	NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_NUM_PDES
0xC0104410	Inout	16	#NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PDES
0xC0184411	Inout	24	NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_NUM_PTES
0xC0104412	Inout	16	#NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PTES
0xC0684413	Inout	104	NVGPU_DBG_GPU_IOCTL_GET_COMPTAG_INFO
0xC0184414	Inout	24	#NVGPU_DBG_GPU_IOCTL_READ_COMPTAGS
0xC0184415	Inout	24	#NVGPU_DBG_GPU_IOCTL_WRITE_COMPTAGS
0xC0104416	Inout	16	NVGPU_DBG_GPU_IOCTL_RESERVE_COMPTAGS
0xC0104417	Inout	16	NVGPU_DBG_GPU_IOCTL_FREE_RESERVED_COMPTAGS
0xC0104418	Inout	16	NVGPU_DBG_GPU_IOCTL_RESERVE_PA
0xC0104419	Inout	16	NVGPU_DBG_GPU_IOCTL_FREE_RESERVED_PA
0xC018441A	Inout	24	NVGPU_DBG_GPU_IOCTL_LAZY_ALLOC_RESERVED_PA
0xC020441B	Inout	32	[11.0.0+] NVGPU_DBG_GPU_IOCTL_LAZY_ALLOC_RESERVED_PA_EX
0xC084441C	Inout	132	[11.0.0+] NVGPU_DBG_GPU_IOCTL_GET_SETTINGS
0xC018441D	Inout	24	[11.0.0+] NVGPU_DBG_GPU_IOCTL_GET_SERIAL_NUMBER
0xC020441E	Inout	32	[11.0.0+] NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PAGES

NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT

Uses Ioctl3.

NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PDES

Uses Ioctl3.

NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PTES

Uses Ioctl3.

NVGPU_DBG_GPU_IOCTL_READ_COMPTAGS

Uses Ioctl3.

NVGPU_DBG_GPU_IOCTL_WRITE_COMPTAGS

Uses Ioctl2.

/dev/nvhost-prof-gpu

Returns NotSupported on Open unless nn::settings::detail::GetDebugModeFlag is set.

This device is identical to /dev/nvhost-dbg-gpu.

/dev/nvhost-ctrl-gpu

This device is for global (context independent) operations on the gpu.

Value	Direction	Size	Description
0x80044701	Out	4	#NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE
0x80284702	Out	40	#NVGPU_GPU_IOCTL_ZCULL_GET_INFO
0x402C4703	In	44	#NVGPU_GPU_IOCTL_ZBC_SET_TABLE
0xC0344704	Inout	52	#NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE
0xC0B04705	Inout	176	#NVGPU_GPU_IOCTL_GET_CHARACTERISTICS
0xC0184706	Inout	24	#NVGPU_GPU_IOCTL_GET_TPC_MASKS
0x40084707	In	8	#NVGPU_GPU_IOCTL_FLUSH_L2
0x4008470D	In	8	#NVGPU_GPU_IOCTL_INVAL_ICACHE
0x4008470E	In	8	#NVGPU_GPU_IOCTL_SET_MMU_DEBUG_MODE
0x4010470F	In	16	#NVGPU_GPU_IOCTL_SET_SM_DEBUG_MODE
0xC0304710 ([1.0.0-6.1.0] 0xC0084710)	Inout	48 ([1.0.0-6.1.0] 8)	#NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE
0x80084711	Out	8	#NVGPU_GPU_IOCTL_GET_TPC_EXCEPTION_EN_STATUS
0x80084712	Out	8	#NVGPU_GPU_IOCTL_NUM_VSMS
0xC0044713	Inout	4	#NVGPU_GPU_IOCTL_VSMS_MAPPING
0x80084714	Out	8	#NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK
0x80044715	Out	4	#NVGPU_GPU_IOCTL_PMU_GET_GPU_LOAD
0x40084716	In	8	#NVGPU_GPU_IOCTL_SET_CG_CONTROLS
0xC0084717	Inout	8	#NVGPU_GPU_IOCTL_GET_CG_CONTROLS
0x40084718	In	8	#NVGPU_GPU_IOCTL_SET_PG_CONTROLS
0xC0084719	Inout	8	#NVGPU_GPU_IOCTL_GET_PG_CONTROLS
0x8018471A	Out	24	#NVGPU_GPU_IOCTL_PMU_GET_ELPG_RESIDENCY_GATING
0xC008471B	Inout	8	#NVGPU_GPU_IOCTL_GET_ERROR_CHANNEL_USER_DATA
0xC010471C	Inout	16	#NVGPU_GPU_IOCTL_GET_GPU_TIME
0xC108471D	Inout	264	#NVGPU_GPU_IOCTL_GET_CPU_TIME_CORRELATION_INFO

NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE

Returns the GPU's ZCULL context size. Identical to Linux driver.

struct {
   __out u32 size;
 };

NVGPU_GPU_IOCTL_ZCULL_GET_INFO

Returns GPU's ZCULL information. Identical to Linux driver.

struct {
   __out u32 width_align_pixels;
   __out u32 height_align_pixels;
   __out u32 pixel_squares_by_aliquots;
   __out u32 aliquot_total;
   __out u32 region_byte_multiplier;
   __out u32 region_header_size;
   __out u32 subregion_header_size;
   __out u32 subregion_width_align_pixels;
   __out u32 subregion_height_align_pixels;
   __out u32 subregion_count;
 };

NVGPU_GPU_IOCTL_ZBC_SET_TABLE

Sets the active ZBC table. Identical to Linux driver.

struct {
   __in u32 color_ds[4];
   __in u32 color_l2[4];
   __in u32 depth;
   __in u32 format;
   __in u32 type;         // 1=color, 2=depth
 };

NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE

Queries the active ZBC table. Identical to Linux driver.

struct {
   __out u32 color_ds[4];
   __out u32 color_l2[4];
   __out u32 depth;
   __out u32 ref_cnt;
   __out u32 format;
   __out u32 type;
   __inout u32 index_size;
 };

NVGPU_GPU_IOCTL_GET_CHARACTERISTICS

Returns the GPU characteristics. Modified to return inline data instead of using a pointer.

[3.0.0+] Uses either Ioctl or Ioctl3.

 struct gpu_characteristics {
   u32 arch;                       // 0x120 (NVGPU_GPU_ARCH_GM200)
   u32 impl;                       // 0xB (NVGPU_GPU_IMPL_GM20B) or 0xE (NVGPU_GPU_IMPL_GM20B_B)
   u32 rev;                        // 0xA1 (Revision A1)
   u32 num_gpc;                    // 0x1
   u64 l2_cache_size;              // 0x40000
   u64 on_board_video_memory_size; // 0x0 (not used)
   u32 num_tpc_per_gpc;            // 0x2
   u32 bus_type;                   // 0x20 (NVGPU_GPU_BUS_TYPE_AXI)
   u32 big_page_size;              // 0x20000
   u32 compression_page_size;      // 0x20000
   u32 pde_coverage_bit_count;     // 0x1B
   u32 available_big_page_sizes;   // 0x30000
   u32 gpc_mask;                   // 0x1
   u32 sm_arch_sm_version;         // 0x503 (Maxwell Generation 5.0.3)
   u32 sm_arch_spa_version;        // 0x503 (Maxwell Generation 5.0.3)
   u32 sm_arch_warp_count;         // 0x80
   u32 gpu_va_bit_count;           // 0x28
   u32 reserved;                   // NULL
   u64 flags;                      // 0x55 (HAS_SYNCPOINTS | SUPPORT_SPARSE_ALLOCS | SUPPORT_CYCLE_STATS | SUPPORT_CYCLE_STATS_SNAPSHOT)
   u32 twod_class;                 // 0x902D (FERMI_TWOD_A)
   u32 threed_class;               // 0xB197 (MAXWELL_B)
   u32 compute_class;              // 0xB1C0 (MAXWELL_COMPUTE_B)
   u32 gpfifo_class;               // 0xB06F (MAXWELL_CHANNEL_GPFIFO_A)
   u32 inline_to_memory_class;     // 0xA140 (KEPLER_INLINE_TO_MEMORY_B)
   u32 dma_copy_class;             // 0xB0B5 (MAXWELL_DMA_COPY_A)
   u32 max_fbps_count;             // 0x1
   u32 fbp_en_mask;                // 0x0 (disabled)
   u32 max_ltc_per_fbp;            // 0x2
   u32 max_lts_per_ltc;            // 0x1
   u32 max_tex_per_tpc;            // 0x0 (not supported)
   u32 max_gpc_count;              // 0x1
   u32 rop_l2_en_mask_0;           // 0x21D70 (fuse_status_opt_rop_l2_fbp_r)
   u32 rop_l2_en_mask_1;           // 0x0
   u64 chipname;                   // 0x6230326D67 ("gm20b")
   u64 gr_compbit_store_base_hw;   // 0x0 (not supported)
 };

 struct {
   __inout u64 gpu_characteristics_buf_size;   // must not be NULL, but gets overwritten with 0xA0=max_size
   __in    u64 gpu_characteristics_buf_addr;   // ignored, but must not be NULL
   __out struct gpu_characteristics gc;
 };

NVGPU_GPU_IOCTL_GET_TPC_MASKS

Returns the TPC mask value for each GPC. Modified to return inline data instead of using a pointer.

[3.0.0+] Uses either Ioctl or Ioctl3.

 struct {
   __in u32 mask_buf_size;       // ignored, but must not be NULL
   __in u32 reserved[3];
   __out u64 mask_buf;           // receives one 32-bit TPC mask per GPC (GPC 0 and GPC 1)
 };

NVGPU_GPU_IOCTL_FLUSH_L2

Flushes the GPU L2 cache.

 struct {
   __in u32 flush;          // l2_flush | l2_invalidate << 1 | fb_flush << 2
   __in u32 reserved;
 };

NVGPU_GPU_IOCTL_INVAL_ICACHE

Invalidates the GPU instruction cache. Identical to Linux driver.

 struct {
   __in s32 channel_fd;
   __in u32 reserved;
 };

NVGPU_GPU_IOCTL_SET_MMU_DEBUG_MODE

Sets the GPU MMU debug mode. Identical to Linux driver.

 struct {
   __in u32 state;
   __in u32 reserved;
 };

NVGPU_GPU_IOCTL_SET_SM_DEBUG_MODE

Sets the GPU SM debug mode. Identical to Linux driver.

 struct {
   __in s32 channel_fd;
   __in u32 enable;
   __in u64 sms;
 };

NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE

Waits until all valid warps on the GPU SM are paused and returns their current state.

 struct {
   __in u64 pwarpstate;
 };

[6.1.0+] This command was modified to return inline data instead of using a pointer.

 struct {
   __out u64 sm0_valid_warps;
   __out u64 sm0_trapped_warps;
   __out u64 sm0_paused_warps;
   __out u64 sm1_valid_warps;
   __out u64 sm1_trapped_warps;
   __out u64 sm1_paused_warps;
 };

NVGPU_GPU_IOCTL_GET_TPC_EXCEPTION_EN_STATUS

Returns a mask value describing all active TPC exceptions. Identical to Linux driver.

 struct {
   __out u64 tpc_exception_en_sm_mask;
 };

NVGPU_GPU_IOCTL_NUM_VSMS

Returns the number of GPU SM units present. Identical to Linux driver.

 struct {
   __out u32 num_vsms;
   __out u32 reserved;
 };

NVGPU_GPU_IOCTL_VSMS_MAPPING

Returns mapping information on each GPU SM unit. Modified to return inline data instead of using a pointer.

 struct {
   __out u8 sm0_gpc_index;
   __out u8 sm0_tpc_index;
   __out u8 sm1_gpc_index;
   __out u8 sm1_tpc_index;
 };

NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK

Returns the mask value for a ZBC slot.

 struct {
   __out u32 slot;       // always 0x07
   __out u32 mask;
 };

NVGPU_GPU_IOCTL_PMU_GET_GPU_LOAD

Returns the GPU load value from the PMU.

 struct {
   __out u32 pmu_gpu_load;
 };

NVGPU_GPU_IOCTL_SET_CG_CONTROLS

Sets the clock gate control value.

 struct {
   __in u32 cg_mask;
   __in u32 cg_value;
 };

NVGPU_GPU_IOCTL_GET_CG_CONTROLS

Returns the clock gate control value.

 struct {
   __in u32 cg_mask;
   __out u32 cg_value;
 };

NVGPU_GPU_IOCTL_SET_PG_CONTROLS

Sets the power gate control value.

 struct {
   __in u32 pg_mask;
   __in u32 pg_value;
 };

NVGPU_GPU_IOCTL_GET_PG_CONTROLS

Returns the power gate control value.

 struct {
   __in u32 pg_mask;
   __out u32 pg_value;
 };

NVGPU_GPU_IOCTL_PMU_GET_ELPG_RESIDENCY_GATING

Returns the GPU PMU ELPG residency gating values.

 struct {
   __out u64 pg_ingating_time_us;
   __out u64 pg_ungating_time_us;
   __out u64 pg_gating_cnt;
 };

NVGPU_GPU_IOCTL_GET_ERROR_CHANNEL_USER_DATA

Returns user specific data from the error channel, if one exists.

 struct {
   __out u64 data;
 };

NVGPU_GPU_IOCTL_GET_GPU_TIME

Returns the timestamp from the GPU's nanosecond timer (PTIMER). Identical to Linux driver.

 struct {
   __out u64 gpu_timestamp;      // raw GPU counter (PTIMER) value
   __out u64 reserved;
 };

NVGPU_GPU_IOCTL_GET_CPU_TIME_CORRELATION_INFO

Returns CPU/GPU timestamp pairs for correlation analysis. Identical to Linux driver.

struct time_correlation_sample {
  u64 cpu_timestamp;                                  // from CPU's CNTPCT_EL0 register
  u64 gpu_timestamp;                                  // from GPU's PTIMER registers
};

struct {
  __out struct time_correlation_sample samples[16];   // timestamp pairs
  __in u32     count;                                 // number of pairs to read
  __in u32     source_id;                             // cpu clock source id (must be 1)
};

Channels

Channels are a concept for NVIDIA hardware blocks that share a common interface.

Path	Name
/dev/nvhost-gpu	GPU
/dev/nvhost-msenc	Video Encoder
/dev/nvhost-nvdec	Video Decoder
/dev/nvhost-nvjpg	JPEG Decoder
/dev/nvhost-vic	Video Image Compositor
/dev/nvhost-display	Display
/dev/nvhost-tsec	TSEC

Ioctls

Value	Size	Description
0xC0??0001	Variable	#NVHOST_IOCTL_CHANNEL_SUBMIT
0xC0080002	8	#NVHOST_IOCTL_CHANNEL_GET_SYNCPOINT
0xC0080003	8	#NVHOST_IOCTL_CHANNEL_GET_WAITBASE
0xC0080004	8	#NVHOST_IOCTL_CHANNEL_GET_MODMUTEX
0x40040007	4	#NVHOST_IOCTL_CHANNEL_SET_SUBMIT_TIMEOUT
0x40080008	8	#NVHOST_IOCTL_CHANNEL_SET_CLK_RATE
0xC0??0009	Variable	#NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER
0xC0??000A	Variable	#NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER
0x00000013	0	#NVHOST_IOCTL_CHANNEL_SET_TIMEOUT_EX
0xC0080023 ([1.0.0-7.0.1] 0xC0080014)	8	#NVHOST_IOCTL_CHANNEL_GET_CLK_RATE
0xC0??0024	Variable	#NVHOST_IOCTL_CHANNEL_SUBMIT_EX
0xC0??0025	Variable	#NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER_EX
0xC0??0026	Variable	#NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER_EX
0x40044801	4	#NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD
0x40044803	4	#NVGPU_IOCTL_CHANNEL_SET_TIMEOUT
0x40084805	8	#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO
0x40184806	24	#NVGPU_IOCTL_CHANNEL_WAIT
0xC0044807	4	#NVGPU_IOCTL_CHANNEL_CYCLE_STATS
0xC0??4808	Variable	#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO
0xC0104809	16	#NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX
0x4008480A	8	#NVHOST_IOCTL_CHANNEL_FREE_OBJ_CTX
0xC010480B	16	#NVGPU_IOCTL_CHANNEL_ZCULL_BIND
0xC018480C	24	#NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER
0x4004480D	4	#NVGPU_IOCTL_CHANNEL_SET_PRIORITY
0x0000480E	0	#NVGPU_IOCTL_CHANNEL_ENABLE
0x0000480F	0	#NVGPU_IOCTL_CHANNEL_DISABLE
0x00004810	0	#NVGPU_IOCTL_CHANNEL_PREEMPT
0x00004811	0	#NVGPU_IOCTL_CHANNEL_FORCE_RESET
0x40084812	8	#NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL
0xC0104813	16	#NVGPU_IOCTL_CHANNEL_CYCLE_STATS_SNAPSHOT
0x80804816	128	#NVGPU_IOCTL_CHANNEL_GET_ERROR_INFO
0xC0104817	16	#NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION
0x40204818	32	#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX
0xC0??4819	Variable	#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY
0xC020481A	32	#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2
0xC018481B	24	#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2
0xC018481C	24	#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2_RETRY
0xC004481D	4	#NVGPU_IOCTL_CHANNEL_SET_TIMESLICE
0x40084714	8	#NVGPU_IOCTL_CHANNEL_SET_USER_DATA
0x80084715	8	#NVGPU_IOCTL_CHANNEL_GET_USER_DATA

NVHOST_IOCTL_CHANNEL_SUBMIT

Submits data to the channel.

 struct cmdbuf {
   u32 mem;
   u32 offset;
   u32 words;
 };
 
 struct reloc {
   u32 cmdbuf_mem;
   u32 cmdbuf_offset;
   u32 target;
   u32 target_offset;
 };
 
 struct reloc_shift {
   u32 shift;
 };
 
 struct syncpt_incr {
   u32 syncpt_id;
   u32 syncpt_incrs;
   u32 reserved[3];
 };
 
 struct {
   __in    u32 num_cmdbufs;
   __in    u32 num_relocs;
   __in    u32 num_syncpt_incrs;
   __in    u32 num_fences;
   __in    struct cmdbuf cmdbufs[];               // depends on num_cmdbufs
   __in    struct reloc relocs[];                 // depends on num_relocs
   __in    struct reloc_shift reloc_shifts[];     // depends on num_relocs
   __in    struct syncpt_incr syncpt_incrs[];     // depends on num_syncpt_incrs
   __out   u32 fence_thresholds[];                // depends on num_fences
 };

NVHOST_IOCTL_CHANNEL_GET_SYNCPOINT

Returns the current syncpoint value for a given module. Identical to Linux driver.

 struct {
   __in    u32 module_id;
   __out   u32 syncpt_value;
 };

NVHOST_IOCTL_CHANNEL_GET_WAITBASE

Returns the current waitbase value for a given module. Always returns 0.

 struct {
   __in    u32 module_id;
   __out   u32 waitbase_value;
 };

NVHOST_IOCTL_CHANNEL_GET_MODMUTEX

Stubbed. Does a debug print and returns 0.

NVHOST_IOCTL_CHANNEL_SET_SUBMIT_TIMEOUT

Sets the submit timeout value for the channel. Identical to Linux driver.

 struct {
   __in    u32 timeout;
 };

NVHOST_IOCTL_CHANNEL_SET_CLK_RATE

Sets the clock rate value for a given module. Identical to Linux driver.

 struct {
   __in    u32 clk_rate;
   __in    u32 module_id;
 };

NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER

Uses nvmap_pin internally to pin a given number of nvmap handles to an appropriate device physical address.

 struct handle {
   u32 handle_id_in;                 // nvmap handle to map
   u32 phys_addr_out;                // returned device physical address mapped to the handle
 };

 struct {
   __in    u32 num_handles;          // number of nvmap handles to map
   __in    u32 reserved;             // ignored
   __in    u8  is_compr;             // memory to map is compressed
   __in    u8  padding[3];           // ignored
   __inout struct handle handles[];  // depends on num_handles
 };

NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER

Uses nvmap_unpin internally to unpin a given number of nvmap handles from their device physical address.

 struct handle {
   u32 handle_id_in;                 // nvmap handle to unmap
   u32 reserved;                     // ignored
 };

 struct {
   __in    u32 num_handles;          // number of nvmap handles to unmap
   __in    u32 reserved;             // ignored
   __in    u8  is_compr;             // memory to unmap is compressed
   __in    u8  padding[3];           // ignored
   __inout struct handle handles[];  // depends on num_handles
 };

NVHOST_IOCTL_CHANNEL_SET_TIMEOUT_EX

Sets the global timeout value for the channel. Identical to Linux driver.

 struct {
   __in    u32 timeout;
   __in    u32 flags;
 };

NVHOST_IOCTL_CHANNEL_GET_CLK_RATE

Returns the clock rate value for a given module. Identical to Linux driver.

 struct {
   __out   u32 clk_rate;
   __in    u32 module_id;
 };

NVHOST_IOCTL_CHANNEL_SUBMIT_EX

Same as NVHOST_IOCTL_CHANNEL_SUBMIT.

NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER_EX

Same as NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER, but calls nvmap_unpin internally in case of error.

NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER_EX

Same as NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER.

NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD

Binds a nvmap object to this channel. Identical to Linux driver.

 struct {
   __in u32 nvmap_fd;
 };

NVGPU_IOCTL_CHANNEL_SET_TIMEOUT

Sets the timeout value for the GPU channel. Identical to Linux driver.

 struct {
   __in u32 timeout;
 };

NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO

Allocates gpfifo entries. Identical to Linux driver.

 struct {
   __in u32 num_entries;
   __in u32 flags;           // bit0: vpr_enabled
 };

NVGPU_IOCTL_CHANNEL_WAIT

Waits on channel. Identical to Linux driver.

 struct {
   __in u32 type;            // wait type (0=notifier, 1=semaphore)
   __in u32 timeout;         // wait timeout value
   __in u32 dmabuf_fd;       // nvmap handle
   __in u32 offset;          // nvmap memory offset
   __in u32 payload;         // payload data (semaphore only)
   __in u32 padding;         // ignored
 };

NVGPU_IOCTL_CHANNEL_CYCLE_STATS

Maps memory for the cycle stats buffer. Identical to Linux driver.

 struct {
   __in u32 dmabuf_fd;   // nvmap handle
 };

NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO

Submits a gpfifo object. Modified to take inline entry objects instead of a pointer.

 struct fence {
   u32 id;
   u32 value;
 };
 
 struct gpfifo_entry {
   u32 entry0;                              // gpu_iova_lo
   u32 entry1;                              // gpu_iova_hi | (allow_flush << 8) | (is_push_buf << 9) | (size << 10) | (sync << 31)
 };
 
 struct {
   __in    u64 gpfifo;                      // (ignored) pointer to gpfifo fence structs
   __in    u32 num_entries;                 // number of fence objects being submitted
   union {
     __out u32 detailed_error;
     __in  u32 flags;                       // bit0: fence_wait, bit1: fence_get, bit2: hw_format, bit3: sync_fence, bit4: suppress_wfi, bit5: skip_buffer_refcounting
   };
   __inout struct fence fence_out;          // returned new fence object for others to wait on
   __in    struct gpfifo_entry entries[];   // depends on num_entries
 };

NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX

Allocates a graphics context object. Modified to ignore object's ID.

You can only have one object context allocated at a time. You must have bound an address space before using this.

 struct {
   __in  u32 class_num;    // 0x902D=2d, 0xB197=3d, 0xB1C0=compute, 0xA140=kepler, 0xB0B5=DMA, 0xB06F=channel_gpfifo
   __in  u32 flags;        // bit0: LOCKBOOST_ZERO
   __out u64 obj_id;       // (ignored) used for FREE_OBJ_CTX ioctl, which is not supported
 };

NVHOST_IOCTL_CHANNEL_FREE_OBJ_CTX

Frees a graphics context object. Not supported.

 struct {
   __in u64 obj_id;       // ignored
 };

NVGPU_IOCTL_CHANNEL_ZCULL_BIND

Binds a ZCULL context to the channel. Identical to Linux driver.

struct {
   __in u64 gpu_va;
   __in u32 mode;         // 0=global, 1=no_ctxsw, 2=separate_buffer, 3=part_of_regular_buf
   __in u32 reserved;
 };

NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER

Initializes the error notifier for this channel. Unlike for the Linux kernel, the Switch driver cannot write to an arbitrary userspace buffer. Thus new ioctls have been introduced to fetch the error information rather than using a shared memory buffer.

 struct {
   __in u64 offset;   // ignored
   __in u64 size;     // ignored
   __in u32 mem;      // must be non-zero to initialize, zero to de-initialize
   __in u32 reserved; // ignored
 };

NVGPU_IOCTL_CHANNEL_SET_PRIORITY

Changes channel's priority. Identical to Linux driver.

 struct {
   __in u32 priority;    // 0x32 is low, 0x64 is medium and 0x96 is high
 };

NVGPU_IOCTL_CHANNEL_ENABLE

Enables the current channel. Identical to Linux driver.

NVGPU_IOCTL_CHANNEL_DISABLE

Disables the current channel. Identical to Linux driver.

NVGPU_IOCTL_CHANNEL_PREEMPT

Clears the FIFO pipe for this channel. Identical to Linux driver.

NVGPU_IOCTL_CHANNEL_FORCE_RESET

Forces the channel to reset. Identical to Linux driver.

NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL

Controls event notifications.

 struct {
   __in u32 cmd;    // 0=disable, 1=enable, 2=clear
   __in u32 id;     // same id's as for #QueryEvent
 };

NVGPU_IOCTL_CHANNEL_CYCLE_STATS_SNAPSHOT

Controls the cycle stats snapshot buffer. Identical to Linux driver.

 struct {
   __in    u32 cmd;         // command to handle (0=flush, 1=attach, 2=detach)
   __in    u32 dmabuf_fd;   // nvmap handle
   __inout u32 extra;       // extra payload data/result
   __in    u32 padding;     // ignored
 };

NVGPU_IOCTL_CHANNEL_GET_ERROR_INFO

Returns information on the current error notification caught by the error notifier. Exclusive to the Switch.

 struct {
   __out u32 error_info[32];    // first word is an error code (0=no_error, 1=mmu_error, 2=gr_error, 3=pbdma_error, 4=timeout)
 };

NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION

Returns the current error notification caught by the error notifier. Exclusive to the Switch.

 struct {
   __out u64 timestamp;    // fetched straight from armGetSystemTick
   __out u32 info32;       // error code
   __out u16 info16;       // additional error info
   __out u16 status;       // always 0xFFFF
 };

NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX

Allocates gpfifo entries with additional parameters. Exclusive to the Switch.

struct fence {
   u32 id;
   u32 value;
};

struct {
  __in    u32 num_entries;
  __in    u32 num_jobs;
  __in    u32 flags;                       // bit0: vpr_enabled
  __out   struct fence fence_out;          // returned new fence object for others to wait on
  __in    u32 reserved[3];                 // ignored
};

NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY

Same as NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO.

NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2

Same as NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX.

NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2

Same as NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO, but uses Ioctl2.

NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2_RETRY

Same as NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY, but uses Ioctl2.

NVGPU_IOCTL_CHANNEL_SET_TIMESLICE

Changes channel's timeslice. Identical to Linux driver.

 struct {
   __in u32 timeslice;
 };

NVGPU_IOCTL_CHANNEL_SET_USER_DATA

Sets user specific data.

 struct {
   __in u64 data;
 };

NVGPU_IOCTL_CHANNEL_GET_USER_DATA

Returns user specific data.

 struct {
   __out u64 data;
 };

NvDrvPermission

This is "nns::nvdrv::NvDrvPermission".

Bits	Name	Description
0	Gpu	Can access /dev/nvhost-gpu, /dev/nvhost-ctrl-gpu and /dev/nvhost-as-gpu.
1	GpuDebug	Can access /dev/nvhost-dbg-gpu and /dev/nvhost-prof-gpu.
2	GpuSchedule	Can access /dev/nvsched-ctrl.
3	VIC	Can access /dev/nvhost-vic.
4	VideoEncoder	Can access /dev/nvhost-msenc.
5	VideoDecoder	Can access /dev/nvhost-nvdec.
6	TSEC	Can access /dev/nvhost-tsec.
7	JPEG	Can access /dev/nvhost-nvjpg.
8	Display	Can access /dev/nvhost-display, /dev/nvcec-ctrl, /dev/nvhdcp_up-ctrl, /dev/nvdisp-ctrl, /dev/nvdisp-disp0, /dev/nvdisp-disp1, /dev/nvdcutil-disp0 and /dev/nvdcutil-disp1.
9	ImportMemory	Can duplicate nvmap handles from other processes with NVMAP_IOC_FROM_ID.
10	NoCheckedAruid	Can use SetAruidWithoutCheck.
11		Can use SetGraphicsFirmwareMemoryMarginEnabled.
12		Can duplicate exported nvmap handles from other processes with NVMAP_IOC_FROM_ID.
13		Can use the GPU virtual address range 0xC0000 to 0x580000 instead of 0x0 to 0xC0000.
14		Can use NVMAP_IOC_EXPORT_FOR_ARUID and NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID.
15		Can use the virtual address ranges 0x0 to 0x100000000 (GPU) and 0x0 to 0xE0000000 (non-GPU) instead of 0x100000000 to 0x11FA50000 (GPU) and 0xE0000000 to 0xFFFE0000 (non-GPU).

NvError

This is "nns::nvdrv::NvError".

Value	Name
0x0	Success
0x1	NotImplemented
0x2	NotSupported
0x3	NotInitialized
0x4	BadParameter
0x5	Timeout
0x6	InsufficientMemory
0x7	ReadOnlyAttribute
0x8	InvalidState
0x9	InvalidAddress
0xA	InvalidSize
0xB	BadValue
0xD	AlreadyAllocated
0xE	Busy
0xF	ResourceError
0x10	CountMismatch
0x11	OverFlow
0x1000	InsufficientTransferMemory
0x10000	InsufficientVideoMemory
0x10001	BadSurfaceColorScheme
0x10002	InvalidSurface
0x10003	SurfaceNotSupported
0x20000	DispInitFailed
0x20001	DispAlreadyAttached
0x20002	DispTooManyDisplays
0x20003	DispNoDisplaysAttached
0x20004	DispModeNotSupported
0x20005	DispNotFound
0x20006	DispAttachDissallowed
0x20007	DispTypeNotSupported
0x20008	DispAuthenticationFailed
0x20009	DispNotAttached
0x2000A	DispSamePwrState
0x2000B	DispEdidFailure
0x2000C	DispDsiReadAckError
0x2000D	DispDsiReadInvalidResp
0x30000	FileWriteFailed
0x30001	FileReadFailed
0x30002	EndOfFile
0x30003	FileOperationFailed
0x30004	DirOperationFailed
0x30005	EndOfDirList
0x30006	ConfigVarNotFound
0x30007	InvalidConfigVar
0x30008	LibraryNotFound
0x30009	SymbolNotFound
0x3000A	MemoryMapFailed
0x3000F	IoctlFailed
0x30010	AccessDenied
0x30011	DeviceNotFound
0x30012	KernelDriverNotFound
0x30013	FileNotFound
0x30014	PathAlreadyExists
0xA000E	ModuleNotPresent

NvDrvStatus

This is "nns::nvdrv::NvDrvStatus".

Offset	Size	Description
0x0	0x4	FreeSize
0x4	0x4	AllocatableSize
0x8	0x4	MinimumFreeSize
0xC	0x4	MinimumAllocatableSize
0x10	0x10	Reserved

Notes

In some cases, a panic may occur. NV forces a crash by doing:

(void *)0 = 0xCAFE;

End result is that the system hangs with a white-screen.

When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.

GPU rendering (GPFIFO) is only used by applets/Applications. All sysmodules doing any gfx-display uses software rendering. During system-boot, GPU GPFIFO is not used until the applets are launched.