Difference between revisions of "NV services"
| Line 283: | Line 283: | ||
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT_BATCH]] | | 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT_BATCH]] | ||
|- | |- | ||
| − | | 0xC0040022 || Inout || 4 || [[# | + | | 0xC0040022 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL]] |
|} | |} | ||
| Line 405: | Line 405: | ||
}; | }; | ||
| − | === | + | === NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL === |
If event FIFO is enabled, returns the maximum channel number. | If event FIFO is enabled, returns the maximum channel number. | ||
Revision as of 20:08, 8 July 2021
nvdrv, nvdrv:a, nvdrv:s, nvdrv:t
This is "nns::nvdrv::INvDrvServices".
Each service is used by:
- "nvdrv": Applications.
- Permission mask is [11.0.0+] 0xA83B ([1.0.0-2.3.0] 0x2B, [3.0.0+] 0xA82B).
- "nvdrv:a": Applets.
- Permission mask is [3.0.0+] 0x10A9 ([1.0.0-2.3.0] 0xA9).
- "nvdrv:s": Sysmodules.
- Permission mask is [3.0.0+] 0x439E ([1.0.0-2.3.0] 0x39E).
- "nvdrv:t": Factory.
- Permission mask is 0xFFFFFFFF.
| Cmd | Name |
|---|---|
| 0 | #Open |
| 1 | #Ioctl |
| 2 | #Close |
| 3 | #Initialize |
| 4 | #QueryEvent |
| 5 | #MapSharedMem |
| 6 | #GetStatus |
| 7 | #SetAruidWithoutCheck |
| 8 | #SetAruid |
| 9 | #DumpStatus |
| 10 | [3.0.0+] #InitializeDevtools |
| 11 | [3.0.0+] #Ioctl2 |
| 12 | [3.0.0+] #Ioctl3 |
| 13 | [3.0.0+] #SetGraphicsFirmwareMemoryMarginEnabled |
Open
Takes a type-0x5 input buffer Path. Returns two output u32s FdOut and Err.
Ioctl
Takes two input u32s Fd and Iocode, a type-0x21 input buffer and a type-0x22 output buffer. Returns an output u32 Err.
The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).
Close
Takes an input u32 Fd. Returns an output u32 Err.
Initialize
Takes an input Process handle, an input TransferMemory handle and an input u32 Size. Returns an output u32 Err.
Webkit applet creates the TransferMemory with perm == 0 and size == 0x300000.
QueryEvent
Takes two input u32s Fd and EvtId. Returns an output u32 Err and an output Event handle.
QueryEvent is only supported on (and implemented differently on):
- /dev/nvhost-gpu
- 1: SmException_BptIntReport
- 2: SmException_BptPauseReport
- 3: ErrorNotifierEvent
- /dev/nvhost-ctrl: Used to get events for SyncPts.
- If bit31-28 is 1, then lower 16-bits contain event_id, bit27-16 contain syncpt_id.
- If bit31-28 is 0, then lower 4-bits contain event_id, bit31-4 contains syncpt_id.
- /dev/nvhost-ctrl-gpu
- 1: Returns error_event_handle.
- 2: Returns unknown event.
- /dev/nvhost-dbg-gpu
- Ignores event_id.
Takes an input TransferMemory handle and two input u32s Fd and HMem. Returns an output u32 Err.
HMem is a /dev/nvmap memory handle.
GetStatus
Takes no input. Returns an output #NvDrvStatus and an output u32 Err.
SetAruidWithoutCheck
Takes an input u64 Aruid. Returns an output u32 Err.
Aruid must match the current AppletResourceUserId.
SetAruid
Takes a PID-descriptor and an input AppletResourceUserId. Returns an output u32 Err.
DumpStatus
No input/output.
InitializeDevtools
Takes an input TransferMemory handle and an input u32 Size. Returns an output u32 Err.
Ioctl2
Takes two input u32s Fd and Iocode, two type-0x21 input buffers and a type-0x22 output buffer. Returns an output u32 Err.
Ioctl3
Takes two input u32s Fd and Iocode, a type-0x21 input buffer and two type-0x22 output buffers. Returns an output u32 Err.
SetGraphicsFirmwareMemoryMarginEnabled
Takes an input u64. No output.
This sets a boolean value based on the input u64 and the value of the "nv!nv_graphics_firmware_memory_margin" system configuration, but only for "nvdrv" (the other services default to false).
[3.0.0+] Official user-processes now use this at the end of nvdrv service init with value 0x1.
nvmemp
This is "nv::MemoryProfiler::IMemoryProfiler".
/dev/nvhost-ctrl sends the ioctl NVHOST_IOCTL_CTRL_GET_CONFIG to check the config "nv!NV_MEMORY_PROFILER". If config_str returns "1", the application attempts to use nvmemp.
| Cmd | Name |
|---|---|
| 0 | Open |
| 1 | GetPid |
Open
Takes an input TransferMemory handle and an input u32 Size. No output.
GetPid
No input. Returns an output u32 Pid.
nvdrvdbg
This is "nns::nvdrv::INvDrvDebugFSServices".
| Cmd | Name |
|---|---|
| 0 | #DebugFSOpen |
| 1 | #DebugFSClose |
| 2 | #GetDebugFSKeys |
| 3 | #GetDebugFSValue |
| 4 | #SetDebugFSValue |
DebugFSOpen
Takes an input Process handle. Returns an output u32 Handle.
DebugFSClose
Takes an input u32 Handle. No output.
GetDebugFSKeys
Takes an input u32 Handle and a type-0x6 output buffer OutValueBuf. Returns an output u32 Err.
GetDebugFSValue
Takes an input u32 Handle, a type-0x5 input buffer InKeyBuf and a type-0x6 output buffer OutValueBuf. Returns an output u32 Err.
SetDebugFSValue
Takes an input u32 Handle and two type-0x5 input buffers InKeyBuf and InValueBuf. Returns an output u32 Err.
nvgem:c
This is "nv::gemcontrol::INvGemControl".
| Cmd | Name |
|---|---|
| 0 | Initialize |
| 1 | GetEventHandle |
| 2 | ControlNotification |
| 3 | SetNotificationPerm |
| 4 | SetCoreDumpPerm |
| 5 | [1.0.0-4.1.0] GetAruid |
| 6 | Reset |
| 7 | [3.0.0+] |
Initialize
No input. Returns an output u32 Err.
GetEventHandle
No input. Returns an output Event handle and an output u32 Err.
ControlNotification
Takes an input bool Enable. Returns an output u32 Err.
SetNotificationPerm
Takes an input u64 Aruid and an input bool Enable. Returns an output u32 Err.
SetCoreDumpPerm
Takes an input u64 Aruid and an input bool Enable. Returns an output u32 Err.
GetAruid
No input. Returns an output u64 Aruid and an output u32 Err.
Reset
No input. Returns an output u32 Err.
nvgem:cd
This is "nv::gemcoredump::INvGemCoreDump".
| Cmd | Name |
|---|---|
| 0 | Initialize |
| 1 | GetAruid |
| 2 | [1.0.0-8.1.0] ReadNextBlock |
| 3 | [8.0.0+] |
| 4 | [8.0.0+] |
Initialize
No input. Returns an output u32 Err.
GetAruid
No input. Returns an output u64 Aruid and an output u32 Err.
ReadNextBlock
Takes a type-0x6 output buffer. Returns an output u32 Err.
nvdbg:d
This is "nns::nvdrv::INvDrvDebugSvcServices". This was added with [10.0.0+].
This service has no commands.
Ioctls
The ioctl number is generated with the following primitive (see Linux kernel):
#define _IOC(inout, group, num, len) \ (inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))
The following table contains all known ioctls.
/dev/nvhost-ctrl
| Value | Direction | Size | Description |
|---|---|---|---|
| 0xC0080014 | Inout | 8 | #NVHOST_IOCTL_CTRL_SYNCPT_READ |
| 0x40040015 | In | 4 | #NVHOST_IOCTL_CTRL_SYNCPT_INCR |
| 0xC00C0016 | Inout | 12 | #NVHOST_IOCTL_CTRL_SYNCPT_WAIT |
| 0x40080017 | In | 8 | #NVHOST_IOCTL_CTRL_MODULE_MUTEX |
| 0xC0180018 | Inout | 24 | #NVHOST_IOCTL_CTRL_MODULE_REGRDWR |
| 0xC0100019 | Inout | 16 | #NVHOST_IOCTL_CTRL_SYNCPT_WAITEX |
| 0xC008001A | Inout | 8 | #NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX |
| 0xC183001B | Inout | 387 | #NVHOST_IOCTL_CTRL_GET_CONFIG |
| 0xC004001C | Inout | 4 | #NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT |
| 0xC010001D | Inout | 16 | #NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT |
| 0xC010001E | Inout | 16 | #NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT_SINGLE |
| 0xC004001F | Inout | 4 | #NVHOST_IOCTL_CTRL_SYNCPT_ALLOC_EVENT |
| 0xC0040020 | Inout | 4 | #NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT |
| 0x40080021 | In | 8 | #NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT_BATCH |
| 0xC0040022 | Inout | 4 | #NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL |
NVHOST_IOCTL_CTRL_SYNCPT_READ
Identical to Linux driver.
struct {
__in u32 id;
__out u32 value;
};
NVHOST_IOCTL_CTRL_SYNCPT_INCR
Identical to Linux driver.
struct {
__in u32 id;
};
NVHOST_IOCTL_CTRL_SYNCPT_WAIT
Identical to Linux driver.
struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
};
NVHOST_IOCTL_CTRL_MODULE_MUTEX
Identical to Linux driver.
struct {
__in u32 id;
__in u32 lock; // (0==unlock; 1==lock)
};
NVHOST_IOCTL_CTRL_MODULE_REGRDWR
Identical to Linux driver. Uses 32-bit version and doesn't work.
struct {
__in u32 id;
__in u32 num_offsets;
__in u32 block_size;
__in u32 offsets;
__in u32 values;
__in u32 write;
};
NVHOST_IOCTL_CTRL_SYNCPT_WAITEX
Identical to Linux driver.
struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
__out u32 value;
};
NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX
Identical to Linux driver.
struct {
__in u32 id;
__out u32 value;
};
NVHOST_IOCTL_CTRL_GET_CONFIG
Returns configured settings. Not available in production mode.
struct {
__in char name[0x41]; // "nv"
__in char key[0x41];
__out char value[0x101];
};
NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT
Clears the wait signal of a syncpt event.
struct {
__in u32 event_id; // 0x00 to 0x3F
};
NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT
Waits on a syncpt using events. If waiting fails, returns error code 0x05 (Timeout) and sets value to ((((id & 0xFFF) << 0x10) | 0x10000000) | event_id).
struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
__out u32 value;
};
NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT_SINGLE
Waits on a syncpt using a specific event. If waiting fails, returns error code 0x05 (Timeout) and sets value to ((id * 0x10) | event_id).
struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
__inout u32 value; // in=event_id; out=syncpt_value
};
NVHOST_IOCTL_CTRL_SYNCPT_ALLOC_EVENT
Allocates a new syncpt event.
struct {
__in u32 event_id; // 0x00 to 0x3F
};
NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT
Frees an existing syncpt event.
struct {
__in u32 event_id; // 0x00 to 0x3F
};
NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT_BATCH
Frees multiple syncpt events.
struct {
__in u64 event_id_mask; // 64-bit bitfield where each bit represents one event
};
NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL
If event FIFO is enabled, returns the maximum channel number.
struct {
__out u32 max_channel; // 0x00 (FIFO disabled) or 0x60 (FIFO enabled)
};
/dev/nvmap
| Value | Direction | Size | Description |
|---|---|---|---|
| 0xC0080101 | Inout | 8 | #NVMAP_IOC_CREATE |
| 0x00000102 | - | 0 | #NVMAP_IOC_CLAIM |
| 0xC0080103 | Inout | 8 | #NVMAP_IOC_FROM_ID |
| 0xC0200104 | Inout | 32 | #NVMAP_IOC_ALLOC |
| 0xC0180105 | Inout | 24 | #NVMAP_IOC_FREE |
| 0xC0280106 | Inout | 40 | #NVMAP_IOC_MMAP |
| 0xC0280107 | Inout | 40 | #NVMAP_IOC_WRITE |
| 0xC0280108 | Inout | 40 | #NVMAP_IOC_READ |
| 0xC00C0109 | Inout | 12 | #NVMAP_IOC_PARAM |
| 0xC010010A | Inout | 16 | #NVMAP_IOC_PIN_MULT |
| 0xC010010B | Inout | 16 | #NVMAP_IOC_UNPIN_MULT |
| 0xC008010C | Inout | 8 | #NVMAP_IOC_CACHE |
| 0xC004010D | Inout | 4 | #NVMAP_IOC_GET_IVC_ID |
| 0xC008010E | Inout | 8 | #NVMAP_IOC_GET_ID |
| 0xC004010F | Inout | 4 | #NVMAP_IOC_FROM_IVC_ID |
| 0x40040110 | In | 4 | #NVMAP_IOC_SET_ALLOCATION_TAG_LABEL |
| 0x00000111 | - | 0 | #NVMAP_IOC_RESERVE |
| 0x40100112 | In | 16 | #NVMAP_IOC_EXPORT_FOR_ARUID |
| 0x40100113 | In | 16 | #NVMAP_IOC_IS_OWNED_BY_ARUID |
| 0x40100114 | In | 16 | #NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID |
NVMAP_IOC_CREATE
Creates an nvmap object. Identical to Linux driver.
struct {
__in u32 size;
__out u32 handle;
};
NVMAP_IOC_CLAIM
Returns NotSupported.
NVMAP_IOC_FROM_ID
Get handle to an existing nvmap object. Identical to Linux driver.
struct {
__in u32 id;
__out u32 handle;
};
NVMAP_IOC_ALLOC
Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.
struct {
__in u32 handle;
__in u32 heapmask;
__in u32 flags; // (0=read-only, 1=read-write)
__inout u32 align;
__in u8 kind;
u8 pad[7];
__in u64 addr;
};
NVMAP_IOC_FREE
This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.
struct {
__in u32 handle;
u32 pad;
__out u64 address; // 0 if the handle wasn't yet freed
__out u32 size;
__out u32 flags; // 1=WAS_UNCACHED (if flags bit 1 was set when NVMAP_IOC_ALLOC was called)
};
NVMAP_IOC_MMAP
Returns NotSupported.
NVMAP_IOC_WRITE
Returns NotSupported.
NVMAP_IOC_READ
Returns NotSupported.
NVMAP_IOC_PARAM
Returns info about a nvmap object. Identical to Linux driver, but extended with further params.
struct {
__in u32 handle;
__in u32 param; // 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
__out u32 result;
};
NVMAP_IOC_PIN_MULT
Returns NotSupported.
NVMAP_IOC_UNPIN_MULT
Returns NotSupported.
NVMAP_IOC_CACHE
Returns NotSupported.
NVMAP_IOC_GET_IVC_ID
Returns NotSupported.
NVMAP_IOC_GET_ID
Returns an id for a nvmap object. Identical to Linux driver.
struct {
__out u32 id; //~0 indicates error
__in u32 handle;
};
NVMAP_IOC_FROM_IVC_ID
Returns NotSupported.
NVMAP_IOC_SET_ALLOCATION_TAG_LABEL
Returns NotSupported.
NVMAP_IOC_RESERVE
Returns NotSupported.
NVMAP_IOC_EXPORT_FOR_ARUID
Binds a nvmap object to an AppletResourceUserId.
struct {
__in u64 aruid;
__in u32 handle;
u8 pad[4];
};
NVMAP_IOC_IS_OWNED_BY_ARUID
Checks if a nvmap object is bound to an AppletResourceUserId.
struct {
__in u64 aruid;
__in u32 handle;
u8 pad[4];
};
NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID
Unbinds a nvmap object from an AppletResourceUserId.
struct {
__in u64 aruid;
__in u32 handle;
u8 pad[4];
};
/dev/nvdisp-ctrl
| Value | Direction | Size | Description |
|---|---|---|---|
| 0x80040212 | Out | 4 | NVDISP_CTRL_NUM_OUTPUTS |
| 0xC0140213 | Inout | 20 | NVDISP_CTRL_GET_DISPLAY_PROPERTIES |
| 0xC1100214 | Inout | 272 | NVDISP_CTRL_QUERY_EDID |
| 0xC0080216 ([1.0.0-3.0.0] 0xC0040216) |
Inout | 8 ([1.0.0-3.0.0] 4) |
NVDISP_CTRL_GET_EXT_HPD_IN_OUT_EVENTS ([1.0.0-3.0.0] NVDISP_CTRL_GET_EXT_HPD_IN_EVENT) |
| ([1.0.0-3.0.0] 0xC0040217) | ([1.0.0-3.0.0] Inout) | ([1.0.0-3.0.0] 4) | ([1.0.0-3.0.0] NVDISP_CTRL_GET_EXT_HPD_OUT_EVENT) |
| 0xC0100218 | Inout | 16 | NVDISP_CTRL_GET_VBLANK_HEAD0_EVENT |
| 0xC0100219 | Inout | 16 | NVDISP_CTRL_GET_VBLANK_HEAD1_EVENT |
| 0xC0040220 | Inout | 4 | NVDISP_CTRL_SUSPEND |
| 0x80010224 | Out | 1 | [11.0.0+] |
/dev/nvdisp-disp0, /dev/nvdisp-disp1
| Value | Direction | Size | Description |
|---|---|---|---|
| 0x40040201 | In | 4 | NVDISP_GET_WINDOW |
| 0x40040202 | In | 4 | NVDISP_PUT_WINDOW |
| 0xC4C80203 | In | 1224 | NVDISP_FLIP |
| 0x80380204 | Out | 56 | NVDISP_GET_MODE |
| 0x40380205 | Out | 56 | NVDISP_SET_MODE |
| 0x430C0206 | In | 780 | NVDISP_SET_LUT |
| 0x40010207 | In | 1 | NVDISP_CONFIG_CRC |
| 0x80040208 | Out | 4 | NVDISP_GET_CRC |
| 0x80040209 | Out | 4 | NVDISP_GET_HEAD_STATUS |
| 0xC038020A | Inout | 56 | NVDISP_VALIDATE_MODE |
| 0x4018020B | In | 24 | NVDISP_SET_CSC |
| 0xC004020C | Inout | 4 | NVDISP_GET_VBLANK_SYNCPT |
| 0x8040020D | Out | 64 | NVDISP_GET_UNDERFLOWS |
| 0xC99A020E | Inout | 2458 | NVDISP_SET_CMU |
| 0xC004020F | Inout | 4 | NVDISP_DPMS |
| 0x80600210 | Out | 96 | NVDISP_GET_AVI_INFOFRAME |
| 0x40600211 | In | 96 | NVDISP_SET_AVI_INFOFRAME |
| 0xEBFC0215 | Inout | 11260 | NVDISP_GET_MODE_DB |
| 0xC003021A | Inout | 3 | NVDISP_PANEL_GET_VENDOR_ID |
| 0x803C021B | Out | 60 | NVDISP_GET_MODE2 |
| 0x403C021C | In | 60 | NVDISP_SET_MODE2 |
| 0xC03C021D | Inout | 60 | NVDISP_VALIDATE_MODE2 |
| 0xEF20021E | Inout | 12064 | NVDISP_GET_MODE_DB2 |
| 0xC004021F | Inout | 4 | NVDISP_GET_WINMASK |
| 0x80080221 | Out | 8 | [10.0.0+] #NVDISP_GET_BACKLIGHT_RANGE |
| 0x40040222 | In | 4 | [10.0.0+] #NVDISP_SET_BACKLIGHT |
| 0x40040223 | In | 4 | [11.0.0+] |
| 0x401C0225 | In | 28 | [11.0.0+] #NVDISP_SEND_PANEL_MSG |
| 0xC01C0226 | Inout | 28 | [11.0.0+] #NVDISP_GET_PANEL_DATA |
NVDISP_GET_BACKLIGHT_RANGE
Returns the minimum and maximum values for the intensity of the display's backlight.
struct {
__out u32 min;
__out u32 max;
};
NVDISP_SET_BACKLIGHT
Sets the value for the intensity of the display's backlight.
struct {
__in u32 val;
};
NVDISP_SEND_PANEL_MSG
Sends raw data to the display panel over DPAUX.
struct {
__in u32 cmd; // DPAUX AUXCTL command (1=unk, 2=I2CWR, 4=MOTWR, 7=AUXWR)
__in u32 addr; // DPAUX AUXADDR
__in u32 size; // message size
__in u32 msg[4]; // raw AUXDATA message
};
NVDISP_GET_PANEL_DATA
Receives raw data from the display panel over DPAUX.
struct {
__in u32 cmd; // DPAUX AUXCTL command (3=I2CRD, 5=MOTRD, 6=AUXRD)
__in u32 addr; // DPAUX AUXADDR
__in u32 size; // message size
__out u32 msg[4]; // raw AUXDATA message
};
/dev/nvcec-ctrl
| Value | Direction | Size | Description |
|---|---|---|---|
| 0x40010301 | In | 1 | NVCEC_CTRL_ENABLE |
| 0x804C0302 | Out | 76 | NVCEC_CTRL_GET_PADDR |
| 0x40040303 | In | 4 | NVCEC_CTRL_SET_LADDR |
| 0xC04C0304 | Inout | 76 | NVCEC_CTRL_WRITE |
| 0xC04C0305 | Inout | 76 | NVCEC_CTRL_READ |
| 0x804C0306 | Out | 76 | NVCEC_CTRL_GET_CONNECTION_STATUS |
| 0x804C0307 | Out | 76 | NVCEC_CTRL_GET_WRITE_STATUS |
/dev/nvhdcp_up-ctrl
| Value | Direction | Size | Description |
|---|---|---|---|
| 0xC4880401 | Inout | 1160 | NVHDCP_READ_STATUS |
| 0xC4880402 | Inout | 1160 | NVHDCP_READ_M |
| 0x40010403 | In | 1 | NVHDCP_ENABLE |
| 0xC0080404 | Inout | 8 | NVHDCP_CTRL_STATE_TRANSIT_EVENT_DATA |
| 0xC0010405 | Inout | 1 | NVHDCP_CTRL_STATE_CB |
/dev/nvdcutil-disp0, /dev/nvdcutil-disp1
| Value | Direction | Size | Description |
|---|---|---|---|
| 0x40010501 | In | 1 | NVDCUTIL_ENABLE_CRC |
| 0x40010502 | In | 1 | NVDCUTIL_VIRTUAL_EDID_ENABLE |
| 0x42040503 | In | 1056 | NVDCUTIL_VIRTUAL_EDID_SET_DATA |
| 0x803C0504 | Out | 60 | NVDCUTIL_GET_MODE |
| 0x40010505 | In | 1 | NVDCUTIL_BEGIN_TELEMETRY_TEST |
| 0x400C0506 | In | 12 | NVDCUTIL_DSI_PACKET_TEST_SHORT_WRITE |
| 0x40F80507 | In | 248 | NVDCUTIL_DSI_PACKET_TEST_LONG_WRITE |
| 0xC0F40508 | Inout | 244 | NVDCUTIL_DSI_PACKET_TEST_READ |
| 0x40010509 | In | 1 | [10.0.0+] NVDCUTIL_DP_ELECTRIC_TEST_EN |
| 0xC020050A | Inout | 32 | [10.0.0+] NVDCUTIL_DP_ELECTRIC_TEST_SETTINGS |
| 0x8070050B | Out | 112 | [11.0.0+] NVDCUTIL_DP_CONF_READ |
/dev/nvsched-ctrl
This is a customized scheduler device.
The way this device is exposed and configured is exclusive to the Switch, since other sources don't have an actual interface for the scheduler.
| Value | Direction | Size | Description |
|---|---|---|---|
| 0x00000601 | - | 0 | #NVSCHED_CTRL_ENABLE |
| 0x00000602 | - | 0 | #NVSCHED_CTRL_DISABLE |
| 0x40180603 | In | 24 | #NVSCHED_CTRL_ADD_APPLICATION |
| 0x40180604 | In | 24 | #NVSCHED_CTRL_UPDATE_APPLICATION |
| 0x40080605 | In | 8 | #NVSCHED_CTRL_REMOVE_APPLICATION |
| 0x80080606 | Out | 8 | #NVSCHED_CTRL_GET_ID |
| 0x80080607 | Out | 8 | #NVSCHED_CTRL_ADD_RUNLIST |
| 0x40180608 | In | 24 | #NVSCHED_CTRL_UPDATE_RUNLIST |
| 0x40100609 | In | 16 | #NVSCHED_CTRL_LINK_RUNLIST |
| 0x4010060A | In | 16 | #NVSCHED_CTRL_UNLINK_RUNLIST |
| 0x4008060B | In | 8 | #NVSCHED_CTRL_REMOVE_RUNLIST |
| 0x8001060C | Out | 1 | #NVSCHED_CTRL_HAS_OVERRUN_EVENT |
| 0x8020060D ([1.0.0-3.0.0] 0x8010060D) |
Out | 32 ([1.0.0-3.0.0] 16) |
#NVSCHED_CTRL_GET_NEXT_OVERRUN_EVENT |
| 0x400C060E | In | 12 | #NVSCHED_CTRL_PUT_CONDUCTOR_FLIP_FENCE |
| 0x4008060F | In | 8 | #NVSCHED_CTRL_DETACH_APPLICATION |
| 0x40100610 | In | 16 | NVSCHED_CTRL_SET_APPLICATION_MAX_DEBT |
| 0x40100611 | In | 16 | NVSCHED_CTRL_SET_RUNLIST_MAX_DEBT |
| 0x40010612 | In | 1 | NVSCHED_CTRL_OVERRUN_EVENTS_ENABLE |
NVSCHED_CTRL_ENABLE
Enables the scheduler.
NVSCHED_CTRL_DISABLE
Disables the scheduler.
NVSCHED_CTRL_ADD_APPLICATION
Adds a new application to the scheduler.
struct {
__in u64 application_id;
__in u64 priority;
__in u64 timeslice;
};
NVSCHED_CTRL_UPDATE_APPLICATION
Updates the application parameters in the scheduler.
struct {
__in u64 application_id;
__in u64 priority;
__in u64 timeslice;
};
NVSCHED_CTRL_REMOVE_APPLICATION
Removes the application from the scheduler.
struct {
__in u64 application_id;
};
NVSCHED_CTRL_GET_ID
Returns the ID of the last scheduled object.
struct {
__out u64 id;
};
NVSCHED_CTRL_ADD_RUNLIST
Creates a new runlist and returns it's ID.
struct {
__out u64 runlist_id;
};
NVSCHED_CTRL_UPDATE_RUNLIST
Updates the runlist parameters in the scheduler.
struct {
__in u64 runlist_id;
__in u64 priority;
__in u64 timeslice;
};
NVSCHED_CTRL_LINK_RUNLIST
Links a runlist to a given application in the scheduler.
struct {
__in u64 runlist_id;
__in u64 application_id;
};
NVSCHED_CTRL_UNLINK_RUNLIST
Unlinks a runlist from a given application in the scheduler.
struct {
__in u64 runlist_id;
__in u64 application_id;
};
NVSCHED_CTRL_REMOVE_RUNLIST
Removes the runlist from the scheduler.
struct {
__in u64 runlist_id;
};
NVSCHED_CTRL_HAS_OVERRUN_EVENT
Returns a boolean to tell if the scheduler has an overrun event or not.
struct {
__out u8 has_overrun;
};
NVSCHED_CTRL_GET_NEXT_OVERRUN_EVENT
Returns the overrun event's data from the scheduler.
struct {
__out u64 runlist_id;
__out u64 debt;
__out u64 unk0; // 3.0.0+ only
__out u64 unk1; // 3.0.0+ only
};
NVSCHED_CTRL_PUT_CONDUCTOR_FLIP_FENCE
Installs a fence swap event?
struct {
__in u32 fence_id;
__in u32 fence_thresh;
__in u32 swap_interval;
};
NVSCHED_CTRL_DETACH_APPLICATION
Places the given application in detached state.
struct {
__in u64 application_id;
};
/dev/nverpt-ctrl
Added in firmware version 3.0.0.
| Value | Direction | Size | Description |
|---|---|---|---|
| 0xC1280701 | Inout | 296 | #NVERPT_TELEMETRY_SUBMIT_DATA |
| 0xCF580702 | Inout | 3928 | #NVERPT_TELEMETRY_SUBMIT_DISPLAY_DATA |
NVERPT_TELEMETRY_SUBMIT_DATA
Sends test data for creating a new Error Report.
struct {
__in u64 TestU64;
__in u32 TestU32;
__in u8 padding0[4];
__in s64 TestI64;
__in s32 TestI32;
__in u8 TestString[32];
__in u8 TestU8Array[8];
__in u32 TestU8Array_size;
__in u32 TestU32Array[8];
__in u32 TestU32Array_size;
__in u64 TestU64Array[8];
__in u32 TestU64Array_size;
__in s32 TestI32Array[8];
__in u32 TestI32Array_size;
__in s64 TestI64Array[8];
__in u32 TestI64Array_size;
__in u16 TestU16;
__in u8 TestU8;
__in s16 TestI16;
__in s8 TestI8;
__in u8 padding1[5];
};
NVERPT_TELEMETRY_SUBMIT_DISPLAY_DATA
Sends display data for creating a new Error Report.
struct {
__in u32 CodecType;
__in u32 DecodeBuffers;
__in u32 FrameWidth;
__in u32 FrameHeight;
__in u8 ColorPrimaries;
__in u8 TransferCharacteristics;
__in u8 MatrixCoefficients;
__in u8 padding;
__in u32 DisplayWidth;
__in u32 DisplayHeight;
__in u32 DARWidth;
__in u32 DARHeight;
__in u32 ColorFormat;
__in u32 ColorSpace[8];
__in u32 ColorSpace_size;
__in u32 SurfaceLayout[8];
__in u32 SurfaceLayout_size;
__in u8 ErrorString[64]; // must be "Error detected = 0x1000000"
__in u32 VideoDecState;
__in u8 VideoLog[3712];
__in u32 VideoLog_size;
};
/dev/nvhost-as-gpu
Each fd opened to this device creates an address space. An address space is then later bound with a channel.
Once a nvgpu channel has been bound to an address space it cannot be unbound. There is no support for allowing an nvgpu channel to change from one address space to another (or from one to none).
| Value | Direction | Size | Description |
|---|---|---|---|
| 0x40044101 | In | 4 | #NVGPU_AS_IOCTL_BIND_CHANNEL |
| 0xC0184102 | Inout | 24 | #NVGPU_AS_IOCTL_ALLOC_SPACE |
| 0xC0104103 | Inout | 16 | #NVGPU_AS_IOCTL_FREE_SPACE |
| 0xC0184104 | Inout | 24 | #NVGPU_AS_IOCTL_MAP_BUFFER |
| 0xC0084105 | Inout | 8 | #NVGPU_AS_IOCTL_UNMAP_BUFFER |
| 0xC0284106 | Inout | 40 | #NVGPU_AS_IOCTL_MAP_BUFFER_EX |
| 0x40104107 | In | 16 | #NVGPU_AS_IOCTL_ALLOC_AS |
| 0xC0404108 | Inout | 64 | #NVGPU_AS_IOCTL_GET_VA_REGIONS |
| 0x40284109 | In | 40 | #NVGPU_AS_IOCTL_ALLOC_AS_EX |
| 0xC038410A | Inout | 56 | #NVGPU_AS_IOCTL_MODIFY |
| 0xC0??4114 | Inout | Variable | #NVGPU_AS_IOCTL_REMAP |
NVGPU_AS_IOCTL_BIND_CHANNEL
Identical to Linux driver.
struct {
__in u32 channel_fd;
};
NVGPU_AS_IOCTL_ALLOC_SPACE
Reserves pages in the device address space.
struct {
__in u32 pages;
__in u32 page_size;
__in u32 flags;
u32 padding;
union {
__out u64 offset;
__in u64 align;
};
};
NVGPU_AS_IOCTL_FREE_SPACE
Frees pages from the device address space.
struct {
__in u64 offset;
__in u32 pages;
__in u32 page_size;
};
NVGPU_AS_IOCTL_MAP_BUFFER
Maps a memory region in the device address space. Identical to Linux driver pretty much.
On success, the mapped memory region is granted the DeviceShared attribute.
struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
u32 reserved;
__in u32 dmabuf_fd; // nvmap handle
__inout u32 page_size; // 0 means don't care
union {
__out u64 offset;
__in u64 align;
};
};
NVGPU_AS_IOCTL_MAP_BUFFER_EX
Maps a memory region in the device address space with extra params.
Unaligned size will cause a #Panic.
On success, the mapped memory region is granted the DeviceShared attribute.
struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__in u32 kind; // -1 is default
__in u32 dmabuf_fd; // nvmap handle
__inout u32 page_size; // 0 means don't care
__in u64 buffer_offset;
__in u64 mapping_size;
__inout u64 offset;
};
NVGPU_AS_IOCTL_UNMAP_BUFFER
Unmaps a memory region from the device address space.
struct {
__in u64 offset;
};
NVGPU_AS_IOCTL_ALLOC_AS
Nintendo's custom implementation for allocating an address space.
struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u64 reserved; // ignored; passes 0
};
NVGPU_AS_IOCTL_GET_VA_REGIONS
Nintendo's custom implementation to get rid of pointer in struct.
struct va_region {
u64 offset;
u32 page_size;
u32 reserved;
u64 pages;
};
struct {
u64 buf_addr; // (contained output user ptr on linux, ignored)
__inout u32 buf_size; // forced to 2*sizeof(struct va_region)
u32 reserved;
__out struct va_region regions[2];
};
NVGPU_AS_IOCTL_ALLOC_AS_EX
Nintendo's custom implementation for allocating an address space with extra params.
struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u32 flags; // passes 0
__in u32 reserved; // ignored; passes 0
__in u64 va_range_start;
__in u64 va_range_end;
__in u64 va_range_split;
};
NVGPU_AS_IOCTL_MODIFY
Modifies a memory region in the device address space.
struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__in u32 kind; // -1 is default
__in u32 dmabuf_fd; // nvmap handle
__inout u32 page_size; // 0 means don't care
__in u64 buffer_offset;
__in u64 mapping_size;
__inout u64 offset;
__in u64 unk0;
__in u32 unk1;
u32 reserved;
};
NVGPU_AS_IOCTL_REMAP
Nintendo's custom implementation of address space remapping for sparse pages.
struct remap_op {
__in u16 flags; // bit2: cacheable
__in u16 kind;
__in u32 mem_handle;
__in u32 mem_offset_in_big_pages;
__in u32 virt_offset_in_big_pages; // (alloc_space_offset >> 0x10)
__in u32 num_pages; // alloc_space_pages
};
struct {
__in struct remap_op entries[];
};
/dev/nvhost-dbg-gpu
Returns NotSupported on Open unless nn::settings::detail::GetDebugModeFlag is set.
| Value | Direction | Size | Description |
|---|---|---|---|
| 0x40084401 | In | 8 | NVGPU_DBG_GPU_IOCTL_BIND_CHANNEL |
| 0xC0??4402 | Inout | Variable | NVGPU_DBG_GPU_IOCTL_REG_OPS |
| 0x40084403 | In | 8 | NVGPU_DBG_GPU_IOCTL_EVENTS_CTRL |
| 0x40044404 | In | 4 | NVGPU_DBG_GPU_IOCTL_POWERGATE |
| 0x40044405 | In | 4 | NVGPU_DBG_GPU_IOCTL_SMPC_CTXSW_MODE |
| 0x40044406 | In | 4 | NVGPU_DBG_GPU_IOCTL_SUSPEND_RESUME_ALL_SMS |
| 0xC0184407 | Inout | 24 | NVGPU_DBG_GPU_IOCTL_PERFBUF_MAP |
| 0x40084408 | In | 8 | NVGPU_DBG_GPU_IOCTL_PERFBUF_UNMAP |
| 0x40084409 | In | 8 | NVGPU_DBG_GPU_IOCTL_PC_SAMPLING |
| 0x4008440A | In | 8 | NVGPU_DBG_GPU_IOCTL_TIMEOUT |
| 0x8008440B | Out | 8 | NVGPU_DBG_GPU_IOCTL_GET_TIMEOUT |
| 0x8004440C | Out | 4 | NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT_SIZE |
| 0x0000440D | None | 0 | #NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT |
| 0xC018440E | Inout | 24 | NVGPU_DBG_GPU_IOCTL_ACCESS_FB_MEMORY |
| 0xC018440F | Inout | 24 | NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_NUM_PDES |
| 0xC0104410 | Inout | 16 | #NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PDES |
| 0xC0184411 | Inout | 24 | NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_NUM_PTES |
| 0xC0104412 | Inout | 16 | #NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PTES |
| 0xC0684413 | Inout | 104 | NVGPU_DBG_GPU_IOCTL_GET_COMPTAG_INFO |
| 0xC0184414 | Inout | 24 | #NVGPU_DBG_GPU_IOCTL_READ_COMPTAGS |
| 0xC0184415 | Inout | 24 | #NVGPU_DBG_GPU_IOCTL_WRITE_COMPTAGS |
| 0xC0104416 | Inout | 16 | NVGPU_DBG_GPU_IOCTL_RESERVE_COMPTAGS |
| 0xC0104417 | Inout | 16 | NVGPU_DBG_GPU_IOCTL_FREE_RESERVED_COMPTAGS |
| 0xC0104418 | Inout | 16 | NVGPU_DBG_GPU_IOCTL_RESERVE_PA |
| 0xC0104419 | Inout | 16 | NVGPU_DBG_GPU_IOCTL_FREE_RESERVED_PA |
| 0xC018441A | Inout | 24 | NVGPU_DBG_GPU_IOCTL_LAZY_ALLOC_RESERVED_PA |
| 0xC020441B | Inout | 32 | [11.0.0+] |
| 0xC084441C | Inout | 132 | [11.0.0+] |
| 0xC018441D | Inout | 24 | [11.0.0+] |
| 0xC020441E | Inout | 32 | [11.0.0+] |
NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT
Uses Ioctl3.
NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PDES
Uses Ioctl3.
NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PTES
Uses Ioctl3.
NVGPU_DBG_GPU_IOCTL_READ_COMPTAGS
Uses Ioctl3.
NVGPU_DBG_GPU_IOCTL_WRITE_COMPTAGS
Uses Ioctl2.
/dev/nvhost-prof-gpu
Returns NotSupported on Open unless nn::settings::detail::GetDebugModeFlag is set.
This device is identical to /dev/nvhost-dbg-gpu.
/dev/nvhost-ctrl-gpu
This device is for global (context independent) operations on the gpu.
NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE
Returns the GPU's ZCULL context size. Identical to Linux driver.
struct {
__out u32 size;
};
NVGPU_GPU_IOCTL_ZCULL_GET_INFO
Returns GPU's ZCULL information. Identical to Linux driver.
struct {
__out u32 width_align_pixels;
__out u32 height_align_pixels;
__out u32 pixel_squares_by_aliquots;
__out u32 aliquot_total;
__out u32 region_byte_multiplier;
__out u32 region_header_size;
__out u32 subregion_header_size;
__out u32 subregion_width_align_pixels;
__out u32 subregion_height_align_pixels;
__out u32 subregion_count;
};
NVGPU_GPU_IOCTL_ZBC_SET_TABLE
Sets the active ZBC table. Identical to Linux driver.
struct {
__in u32 color_ds[4];
__in u32 color_l2[4];
__in u32 depth;
__in u32 format;
__in u32 type; // 1=color, 2=depth
};
NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE
Queries the active ZBC table. Identical to Linux driver.
struct {
__out u32 color_ds[4];
__out u32 color_l2[4];
__out u32 depth;
__out u32 ref_cnt;
__out u32 format;
__out u32 type;
__inout u32 index_size;
};
NVGPU_GPU_IOCTL_GET_CHARACTERISTICS
Returns the GPU characteristics. Modified to return inline data instead of using a pointer.
[3.0.0+] Uses either Ioctl or Ioctl3.
struct gpu_characteristics {
u32 arch; // 0x120 (NVGPU_GPU_ARCH_GM200)
u32 impl; // 0xB (NVGPU_GPU_IMPL_GM20B) or 0xE (NVGPU_GPU_IMPL_GM20B_B)
u32 rev; // 0xA1 (Revision A1)
u32 num_gpc; // 0x1
u64 l2_cache_size; // 0x40000
u64 on_board_video_memory_size; // 0x0 (not used)
u32 num_tpc_per_gpc; // 0x2
u32 bus_type; // 0x20 (NVGPU_GPU_BUS_TYPE_AXI)
u32 big_page_size; // 0x20000
u32 compression_page_size; // 0x20000
u32 pde_coverage_bit_count; // 0x1B
u32 available_big_page_sizes; // 0x30000
u32 gpc_mask; // 0x1
u32 sm_arch_sm_version; // 0x503 (Maxwell Generation 5.0.3)
u32 sm_arch_spa_version; // 0x503 (Maxwell Generation 5.0.3)
u32 sm_arch_warp_count; // 0x80
u32 gpu_va_bit_count; // 0x28
u32 reserved; // NULL
u64 flags; // 0x55 (HAS_SYNCPOINTS | SUPPORT_SPARSE_ALLOCS | SUPPORT_CYCLE_STATS | SUPPORT_CYCLE_STATS_SNAPSHOT)
u32 twod_class; // 0x902D (FERMI_TWOD_A)
u32 threed_class; // 0xB197 (MAXWELL_B)
u32 compute_class; // 0xB1C0 (MAXWELL_COMPUTE_B)
u32 gpfifo_class; // 0xB06F (MAXWELL_CHANNEL_GPFIFO_A)
u32 inline_to_memory_class; // 0xA140 (KEPLER_INLINE_TO_MEMORY_B)
u32 dma_copy_class; // 0xB0B5 (MAXWELL_DMA_COPY_A)
u32 max_fbps_count; // 0x1
u32 fbp_en_mask; // 0x0 (disabled)
u32 max_ltc_per_fbp; // 0x2
u32 max_lts_per_ltc; // 0x1
u32 max_tex_per_tpc; // 0x0 (not supported)
u32 max_gpc_count; // 0x1
u32 rop_l2_en_mask_0; // 0x21D70 (fuse_status_opt_rop_l2_fbp_r)
u32 rop_l2_en_mask_1; // 0x0
u64 chipname; // 0x6230326D67 ("gm20b")
u64 gr_compbit_store_base_hw; // 0x0 (not supported)
};
struct {
__inout u64 gpu_characteristics_buf_size; // must not be NULL, but gets overwritten with 0xA0=max_size
__in u64 gpu_characteristics_buf_addr; // ignored, but must not be NULL
__out struct gpu_characteristics gc;
};
NVGPU_GPU_IOCTL_GET_TPC_MASKS
Returns the TPC mask value for each GPC. Modified to return inline data instead of using a pointer.
[3.0.0+] Uses either Ioctl or Ioctl3.
struct {
__in u32 mask_buf_size; // ignored, but must not be NULL
__in u32 reserved[3];
__out u64 mask_buf; // receives one 32-bit TPC mask per GPC (GPC 0 and GPC 1)
};
NVGPU_GPU_IOCTL_FLUSH_L2
Flushes the GPU L2 cache.
struct {
__in u32 flush; // l2_flush | l2_invalidate << 1 | fb_flush << 2
__in u32 reserved;
};
NVGPU_GPU_IOCTL_INVAL_ICACHE
Invalidates the GPU instruction cache. Identical to Linux driver.
struct {
__in s32 channel_fd;
__in u32 reserved;
};
NVGPU_GPU_IOCTL_SET_MMU_DEBUG_MODE
Sets the GPU MMU debug mode. Identical to Linux driver.
struct {
__in u32 state;
__in u32 reserved;
};
NVGPU_GPU_IOCTL_SET_SM_DEBUG_MODE
Sets the GPU SM debug mode. Identical to Linux driver.
struct {
__in s32 channel_fd;
__in u32 enable;
__in u64 sms;
};
NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE
Waits until all valid warps on the GPU SM are paused and returns their current state.
struct {
__in u64 pwarpstate;
};
[6.1.0+] This command was modified to return inline data instead of using a pointer.
struct {
__out u64 sm0_valid_warps;
__out u64 sm0_trapped_warps;
__out u64 sm0_paused_warps;
__out u64 sm1_valid_warps;
__out u64 sm1_trapped_warps;
__out u64 sm1_paused_warps;
};
NVGPU_GPU_IOCTL_GET_TPC_EXCEPTION_EN_STATUS
Returns a mask value describing all active TPC exceptions. Identical to Linux driver.
struct {
__out u64 tpc_exception_en_sm_mask;
};
NVGPU_GPU_IOCTL_NUM_VSMS
Returns the number of GPU SM units present. Identical to Linux driver.
struct {
__out u32 num_vsms;
__out u32 reserved;
};
NVGPU_GPU_IOCTL_VSMS_MAPPING
Returns mapping information on each GPU SM unit. Modified to return inline data instead of using a pointer.
struct {
__out u8 sm0_gpc_index;
__out u8 sm0_tpc_index;
__out u8 sm1_gpc_index;
__out u8 sm1_tpc_index;
};
NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK
Returns the mask value for a ZBC slot.
struct {
__out u32 slot; // always 0x07
__out u32 mask;
};
NVGPU_GPU_IOCTL_PMU_GET_GPU_LOAD
Returns the GPU load value from the PMU.
struct {
__out u32 pmu_gpu_load;
};
NVGPU_GPU_IOCTL_SET_CG_CONTROLS
Sets the clock gate control value.
struct {
__in u32 cg_mask;
__in u32 cg_value;
};
NVGPU_GPU_IOCTL_GET_CG_CONTROLS
Returns the clock gate control value.
struct {
__in u32 cg_mask;
__out u32 cg_value;
};
NVGPU_GPU_IOCTL_SET_PG_CONTROLS
Sets the power gate control value.
struct {
__in u32 pg_mask;
__in u32 pg_value;
};
NVGPU_GPU_IOCTL_GET_PG_CONTROLS
Returns the power gate control value.
struct {
__in u32 pg_mask;
__out u32 pg_value;
};
NVGPU_GPU_IOCTL_PMU_GET_ELPG_RESIDENCY_GATING
Returns the GPU PMU ELPG residency gating values.
struct {
__out u64 pg_ingating_time_us;
__out u64 pg_ungating_time_us;
__out u64 pg_gating_cnt;
};
NVGPU_GPU_IOCTL_GET_ERROR_CHANNEL_USER_DATA
Returns user specific data from the error channel, if one exists.
struct {
__out u64 data;
};
NVGPU_GPU_IOCTL_GET_GPU_TIME
Returns the timestamp from the GPU's nanosecond timer (PTIMER). Identical to Linux driver.
struct {
__out u64 gpu_timestamp; // raw GPU counter (PTIMER) value
__out u64 reserved;
};
NVGPU_GPU_IOCTL_GET_CPU_TIME_CORRELATION_INFO
Returns CPU/GPU timestamp pairs for correlation analysis. Identical to Linux driver.
struct time_correlation_sample {
u64 cpu_timestamp; // from CPU's CNTPCT_EL0 register
u64 gpu_timestamp; // from GPU's PTIMER registers
};
struct {
__out struct time_correlation_sample samples[16]; // timestamp pairs
__in u32 count; // number of pairs to read
__in u32 source_id; // cpu clock source id (must be 1)
};
Channels
Channels are a concept for NVIDIA hardware blocks that share a common interface.
| Path | Name |
|---|---|
| /dev/nvhost-gpu | GPU |
| /dev/nvhost-msenc | Video Encoder |
| /dev/nvhost-nvdec | Video Decoder |
| /dev/nvhost-nvjpg | JPEG Decoder |
| /dev/nvhost-vic | Video Image Compositor |
| /dev/nvhost-display | Display |
Ioctls
NVHOST_IOCTL_CHANNEL_SUBMIT
Submits data to the channel.
struct cmdbuf {
u32 mem;
u32 offset;
u32 words;
};
struct reloc {
u32 cmdbuf_mem;
u32 cmdbuf_offset;
u32 target;
u32 target_offset;
};
struct reloc_shift {
u32 shift;
};
struct syncpt_incr {
u32 syncpt_id;
u32 syncpt_incrs;
};
struct fence {
u32 id;
u32 thresh;
};
struct {
__in u32 num_cmdbufs;
__in u32 num_relocs;
__in u32 num_syncpt_incrs;
__in u32 num_fences;
__in struct cmdbuf cmdbufs[]; // depends on num_cmdbufs
__in struct reloc relocs[]; // depends on num_relocs
__in struct reloc_shift reloc_shifts[]; // depends on num_relocs
__in struct syncpt_incr syncpt_incrs[]; // depends on num_syncpt_incrs
__out struct fence fences[]; // depends on num_fences
};
NVHOST_IOCTL_CHANNEL_GET_SYNCPOINT
Returns the current syncpoint value for a given module. Identical to Linux driver.
struct {
__in u32 module_id;
__out u32 syncpt_value;
};
NVHOST_IOCTL_CHANNEL_GET_WAITBASE
Returns the current waitbase value for a given module. Always returns 0.
struct {
__in u32 module_id;
__out u32 waitbase_value;
};
NVHOST_IOCTL_CHANNEL_GET_MODMUTEX
Stubbed. Does a debug print and returns 0.
NVHOST_IOCTL_CHANNEL_SET_SUBMIT_TIMEOUT
Sets the submit timeout value for the channel. Identical to Linux driver.
struct {
__in u32 timeout;
};
NVHOST_IOCTL_CHANNEL_SET_CLK_RATE
Sets the clock rate value for a given module. Identical to Linux driver.
struct {
__in u32 clk_rate;
__in u32 module_id;
};
NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER
Uses nvmap_pin internally to pin a given number of nvmap handles to an appropriate device physical address.
struct handle {
u32 handle_id_in; // nvmap handle to map
u32 phys_addr_out; // returned device physical address mapped to the handle
};
struct {
__in u32 num_handles; // number of nvmap handles to map
__in u32 reserved; // ignored
__in u8 is_compr; // memory to map is compressed
__in u8 padding[3]; // ignored
__inout struct handle handles[]; // depends on num_handles
};
NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER
Uses nvmap_unpin internally to unpin a given number of nvmap handles from their device physical address.
struct handle {
u32 handle_id_in; // nvmap handle to unmap
u32 reserved; // ignored
};
struct {
__in u32 num_handles; // number of nvmap handles to unmap
__in u32 reserved; // ignored
__in u8 is_compr; // memory to unmap is compressed
__in u8 padding[3]; // ignored
__inout struct handle handles[]; // depends on num_handles
};
NVHOST_IOCTL_CHANNEL_SET_TIMEOUT_EX
Sets the global timeout value for the channel. Identical to Linux driver.
struct {
__in u32 timeout;
__in u32 flags;
};
NVHOST_IOCTL_CHANNEL_GET_CLK_RATE
Returns the clock rate value for a given module. Identical to Linux driver.
struct {
__out u32 clk_rate;
__in u32 module_id;
};
NVHOST_IOCTL_CHANNEL_SUBMIT_EX
Same as NVHOST_IOCTL_CHANNEL_SUBMIT.
NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER_EX
Same as NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER, but calls nvmap_unpin internally in case of error.
NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER_EX
Same as NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER.
NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD
Binds a nvmap object to this channel. Identical to Linux driver.
struct {
__in u32 nvmap_fd;
};
NVGPU_IOCTL_CHANNEL_SET_TIMEOUT
Sets the timeout value for the GPU channel. Identical to Linux driver.
struct {
__in u32 timeout;
};
NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO
Allocates gpfifo entries. Identical to Linux driver.
struct {
__in u32 num_entries;
__in u32 flags;
};
NVGPU_IOCTL_CHANNEL_WAIT
Waits on channel. Identical to Linux driver.
struct {
__in u32 type; // wait type (0=notifier, 1=semaphore)
__in u32 timeout; // wait timeout value
__in u32 dmabuf_fd; // nvmap handle
__in u32 offset; // nvmap memory offset
__in u32 payload; // payload data (semaphore only)
__in u32 padding; // ignored
};
NVGPU_IOCTL_CHANNEL_CYCLE_STATS
Maps memory for the cycle stats buffer. Identical to Linux driver.
struct {
__in u32 dmabuf_fd; // nvmap handle
};
NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO
Submits a gpfifo object. Modified to take inline entry objects instead of a pointer.
struct fence {
u32 id;
u32 thresh;
};
struct gpfifo_entry {
u64 entry; // gpu_iova | (unk_2bits << 40) | (size << 42) | (unk_flag << 63)
};
struct {
__in u64 gpfifo; // (ignored) pointer to gpfifo fence structs
__in u32 num_entries; // number of fence objects being submitted
__in u32 flags;
__inout struct fence fence_out; // returned new fence object for others to wait on
__in struct gpfifo_entry entries[]; // depends on num_entries
};
NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX
Allocates a graphics context object. Modified to ignore object's ID.
You can only have one object context allocated at a time. You must have bound an address space before using this.
struct {
__in u32 class_num; // 0x902D=2d, 0xB197=3d, 0xB1C0=compute, 0xA140=kepler, 0xB0B5=DMA, 0xB06F=channel_gpfifo
__in u32 flags; // bit0: LOCKBOOST_ZERO
__out u64 obj_id; // (ignored) used for FREE_OBJ_CTX ioctl, which is not supported
};
NVHOST_IOCTL_CHANNEL_FREE_OBJ_CTX
Frees a graphics context object. Not supported.
struct {
__in u64 obj_id; // ignored
};
NVGPU_IOCTL_CHANNEL_ZCULL_BIND
Binds a ZCULL context to the channel. Identical to Linux driver.
struct {
__in u64 gpu_va;
__in u32 mode; // 0=global, 1=no_ctxsw, 2=separate_buffer, 3=part_of_regular_buf
__in u32 reserved;
};
NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER
Initializes the error notifier for this channel. Unlike for the Linux kernel, the Switch driver cannot write to an arbitrary userspace buffer. Thus new ioctls have been introduced to fetch the error information rather than using a shared memory buffer.
struct {
__in u64 offset; // ignored
__in u64 size; // ignored
__in u32 mem; // must be non-zero to initialize, zero to de-initialize
__in u32 reserved; // ignored
};
NVGPU_IOCTL_CHANNEL_SET_PRIORITY
Changes channel's priority. Identical to Linux driver.
struct {
__in u32 priority; // 0x32 is low, 0x64 is medium and 0x96 is high
};
NVGPU_IOCTL_CHANNEL_ENABLE
Enables the current channel. Identical to Linux driver.
NVGPU_IOCTL_CHANNEL_DISABLE
Disables the current channel. Identical to Linux driver.
NVGPU_IOCTL_CHANNEL_PREEMPT
Clears the FIFO pipe for this channel. Identical to Linux driver.
NVGPU_IOCTL_CHANNEL_FORCE_RESET
Forces the channel to reset. Identical to Linux driver.
NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL
Controls event notifications.
struct {
__in u32 cmd; // 0=disable, 1=enable, 2=clear
__in u32 id; // same id's as for #QueryEvent
};
NVGPU_IOCTL_CHANNEL_CYCLE_STATS_SNAPSHOT
Controls the cycle stats snapshot buffer. Identical to Linux driver.
struct {
__in u32 cmd; // command to handle (0=flush, 1=attach, 2=detach)
__in u32 dmabuf_fd; // nvmap handle
__inout u32 extra; // extra payload data/result
__in u32 padding; // ignored
};
NVGPU_IOCTL_CHANNEL_GET_ERROR_INFO
Returns information on the current error notification caught by the error notifier. Exclusive to the Switch.
struct {
__out u32 error_info[32]; // first word is an error code (0=no_error, 1=gr_error, 2=gr_error, 3=invalid, 4=invalid)
};
NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION
Returns the current error notification caught by the error notifier. Exclusive to the Switch.
struct {
__out u64 timestamp; // fetched straight from armGetSystemTick
__out u32 info32; // error code
__out u16 info16; // additional error info
__out u16 status; // always 0xFFFF
};
NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX
Allocates gpfifo entries with additional parameters. Exclusive to the Switch.
struct fence {
u32 id;
u32 thresh;
};
struct {
__in u32 num_entries;
__in u32 num_jobs;
__in u32 flags;
__out struct fence fence_out; // returned new fence object for others to wait on
__in u32 reserved[3]; // ignored
};
NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY
Same as NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO.
NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2
Same as NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX.
NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2
Same as NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO, but uses Ioctl2.
NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2_RETRY
Same as NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY, but uses Ioctl2.
NVGPU_IOCTL_CHANNEL_SET_TIMESLICE
Changes channel's timeslice. Identical to Linux driver.
struct {
__in u32 timeslice;
};
NVGPU_IOCTL_CHANNEL_SET_USER_DATA
Sets user specific data.
struct {
__in u64 data;
};
NVGPU_IOCTL_CHANNEL_GET_USER_DATA
Returns user specific data.
struct {
__out u64 data;
};
NvDrvPermission
This is "nns::nvdrv::NvDrvPermission".
| Bits | Name | Description |
|---|---|---|
| 0 | Gpu | Can access /dev/nvhost-gpu, /dev/nvhost-ctrl-gpu and /dev/nvhost-as-gpu. |
| 1 | GpuDebug | Can access /dev/nvhost-dbg-gpu and /dev/nvhost-prof-gpu. |
| 2 | GpuSchedule | Can access /dev/nvsched-ctrl. |
| 3 | VIC | Can access /dev/nvhost-vic. |
| 4 | VideoEncoder | Can access /dev/nvhost-msenc. |
| 5 | VideoDecoder | Can access /dev/nvhost-nvdec. |
| 6 | TSEC | Can access /dev/nvhost-tsec. |
| 7 | JPEG | Can access /dev/nvhost-nvjpg. |
| 8 | Display | Can access /dev/nvhost-display, /dev/nvcec-ctrl, /dev/nvhdcp_up-ctrl, /dev/nvdisp-ctrl, /dev/nvdisp-disp0, /dev/nvdisp-disp1, /dev/nvdcutil-disp0 and /dev/nvdcutil-disp1. |
| 9 | ImportMemory | Can duplicate nvmap handles from other processes with NVMAP_IOC_FROM_ID. |
| 10 | NoCheckedAruid | Can use SetAruidWithoutCheck. |
| 11 | Can use SetGraphicsFirmwareMemoryMarginEnabled. | |
| 12 | Can duplicate exported nvmap handles from other processes with NVMAP_IOC_FROM_ID. | |
| 13 | ||
| 14 | Can use NVMAP_IOC_EXPORT_FOR_ARUID and NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID. | |
| 15 |
NvError
This is "nns::nvdrv::NvError".
| Value | Name |
|---|---|
| 0x0 | Success |
| 0x1 | NotImplemented |
| 0x2 | NotSupported |
| 0x3 | NotInitialized |
| 0x4 | BadParameter |
| 0x5 | Timeout |
| 0x6 | InsufficientMemory |
| 0x7 | ReadOnlyAttribute |
| 0x8 | InvalidState |
| 0x9 | InvalidAddress |
| 0xA | InvalidSize |
| 0xB | BadValue |
| 0xD | AlreadyAllocated |
| 0xE | Busy |
| 0xF | ResourceError |
| 0x10 | CountMismatch |
| 0x11 | OverFlow |
| 0x1000 | InsufficientTransferMemory |
| 0x10000 | InsufficientVideoMemory |
| 0x10001 | BadSurfaceColorScheme |
| 0x10002 | InvalidSurface |
| 0x10003 | SurfaceNotSupported |
| 0x20000 | DispInitFailed |
| 0x20001 | DispAlreadyAttached |
| 0x20002 | DispTooManyDisplays |
| 0x20003 | DispNoDisplaysAttached |
| 0x20004 | DispModeNotSupported |
| 0x20005 | DispNotFound |
| 0x20006 | DispAttachDissallowed |
| 0x20007 | DispTypeNotSupported |
| 0x20008 | DispAuthenticationFailed |
| 0x20009 | DispNotAttached |
| 0x2000A | DispSamePwrState |
| 0x2000B | DispEdidFailure |
| 0x2000C | DispDsiReadAckError |
| 0x2000D | DispDsiReadInvalidResp |
| 0x30000 | FileWriteFailed |
| 0x30001 | FileReadFailed |
| 0x30002 | EndOfFile |
| 0x30003 | FileOperationFailed |
| 0x30004 | DirOperationFailed |
| 0x30005 | EndOfDirList |
| 0x30006 | ConfigVarNotFound |
| 0x30007 | InvalidConfigVar |
| 0x30008 | LibraryNotFound |
| 0x30009 | SymbolNotFound |
| 0x3000A | MemoryMapFailed |
| 0x3000F | IoctlFailed |
| 0x30010 | AccessDenied |
| 0x30011 | DeviceNotFound |
| 0x30012 | KernelDriverNotFound |
| 0x30013 | FileNotFound |
| 0x30014 | PathAlreadyExists |
| 0xA000E | ModuleNotPresent |
NvDrvStatus
This is "nns::nvdrv::NvDrvStatus".
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | FreeSize |
| 0x4 | 0x4 | AllocatableSize |
| 0x8 | 0x4 | MinimumFreeSize |
| 0xC | 0x4 | MinimumAllocatableSize |
| 0x10 | 0x10 | Reserved |
Notes
In some cases, a panic may occur. NV forces a crash by doing:
(void *)0 = 0xCAFE;
End result is that the system hangs with a white-screen.
When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.