Nintendo Switch Brew

NV services: Difference between revisions

← Older editNewer edit →
No edit summary
(24 intermediate revisions by 2 users not shown)
Line 1: Line 1:
The Switch uses a customized NVIDIA driver.
= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
This is "nns::nvdrv::INvDrvServices".
This is "nns::nvdrv::INvDrvServices".
Main NVIDIA driver service.


Each service is used by:
Each service is used by:
* "nvdrv": Applications.
* "nvdrv": Applications.
** [[#Permissions|Permission]] mask is [3.0.0+] 0xA82B ([1.0.0-2.3.0] 0x2B).
** [[#NvDrvPermission|Permission]] mask is [11.0.0+] 0xA83B ([1.0.0-2.3.0] 0x2B, [3.0.0+] 0xA82B).
* "nvdrv:a": Applets.
* "nvdrv:a": Applets.
** [[#Permissions|Permission]] mask is [3.0.0+] 0x10A9 ([1.0.0-2.3.0] 0xA9).
** [[#NvDrvPermission|Permission]] mask is [3.0.0+] 0x10A9 ([1.0.0-2.3.0] 0xA9).
* "nvdrv:s": Sysmodules.
* "nvdrv:s": Sysmodules.
** [[#Permissions|Permission]] mask is [3.0.0+] 0x439E ([1.0.0-2.3.0] 0x39E).
** [[#NvDrvPermission|Permission]] mask is [3.0.0+] 0x439E ([1.0.0-2.3.0] 0x39E).
* "nvdrv:t": Factory.
* "nvdrv:t": Factory.
** [[#Permissions|Permission]] mask is 0xFFFFFFFF.
** [[#NvDrvPermission|Permission]] mask is 0xFFFFFFFF.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 50: Line 46:


== Open ==
== Open ==
Takes a type-0x5 input buffer for the device-path. Returns the output 32bit '''fd''' and the u32 '''error_code'''.
Takes a type-0x5 input buffer '''Path'''. Returns two output u32s '''FdOut''' and '''Err'''.


== Ioctl ==
== Ioctl ==
Takes a 32bit '''fd''', an u32 '''ioctl_cmd''', a type-0x21 input buffer, and a type-0x22 output buffer. Returns an output u32 ('''error_code''').
Takes two input u32s '''Fd''' and '''Iocode''', a type-0x21 input buffer and a type-0x22 output buffer. Returns an output u32 '''Err'''.


The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).
The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).


== Close ==
== Close ==
Takes a 32bit '''fd'''. Returns an output u32 ('''error_code''').
Takes an input u32 '''Fd'''. Returns an output u32 '''Err'''.


== Initialize ==
== Initialize ==
Takes two copy-handles ('''current_process''' and '''transfer_memory''') and an input u32 ('''transfer_memory_size'''). Returns an output u32 ('''error_code''').
Takes an input Process handle, an input TransferMemory handle and an input u32 '''Size'''. Returns an output u32 '''Err'''.


Webkit applet creates the transfer-memory with perm = 0 and size 0x300000.
Webkit applet creates the TransferMemory with perm == 0 and size == 0x300000.


== QueryEvent ==
== QueryEvent ==
Takes two input u32s ('''fd''' and '''event_id'''), with the second word immediately after the first one. Returns an output u32 ('''error_code''') and a copy-handle ('''event_handle''').
Takes two input u32s '''Fd''' and '''EvtId'''. Returns an output u32 '''Err''' and an output Event handle.


QueryEvent is only supported on (and implemented differently on):
QueryEvent is only supported on (and implemented differently on):
Line 74: Line 70:
** 3: ErrorNotifierEvent
** 3: ErrorNotifierEvent
* /dev/nvhost-ctrl: Used to get events for SyncPts.
* /dev/nvhost-ctrl: Used to get events for SyncPts.
** If bit31-28 is 1, then lower 16-bits contain event_slot, bit27-16 contain syncpt_number.  
** If bit31-28 is 1, then lower 16-bits contain event_id, bit27-16 contain syncpt_id.  
** If bit31-28 is 0, then lower 4-bits contain event_slot, bit31-4 contains syncpt_number.
** If bit31-28 is 0, then lower 4-bits contain event_id, bit31-4 contains syncpt_id.
* /dev/nvhost-ctrl-gpu
* /dev/nvhost-ctrl-gpu
** 1: Returns error_event_handle.
** 1: Returns error_event_handle.
Line 83: Line 79:


== MapSharedMem ==
== MapSharedMem ==
Takes a copy-handle ('''transfer_memory''') and two input u32s ('''fd''' and '''nvmap_handle'''). Returns an output u32 ('''error_code''').
Takes an input TransferMemory handle and two input u32s '''Fd''' and '''HMem'''. Returns an output u32 '''Err'''.
 
'''HMem''' is a [[#/dev/nvmap|/dev/nvmap]] memory handle.


== GetStatus ==
== GetStatus ==
Takes no input. Returns 0x10-bytes and an output u32 ('''error_code''').
Takes no input. Returns an output [[#NvDrvStatus]] and an output u32 '''Err'''.


== SetAruidWithoutCheck ==
== SetAruidWithoutCheck ==
Takes an input u64 which must [[IPC_Marshalling|match]] the user-process PID ([[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]). Returns an output u32 ('''error_code''').
Takes an input u64 '''Aruid'''. Returns an output u32 '''Err'''.
 
'''Aruid''' must [[IPC_Marshalling|match]] the current [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].


== SetAruid ==
== SetAruid ==
Takes a PID-descriptor and an u64 which must [[IPC_Marshalling|match]] the user-process PID ([[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]). Returns an output u32 ('''error_code''').
Takes a PID-descriptor and an input [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]. Returns an output u32 '''Err'''.


== DumpStatus ==
== DumpStatus ==
No input or output.
No input/output.


== InitializeDevtools ==
== InitializeDevtools ==
Takes a copy-handle ('''transfer_memory''') and an input u32 ('''transfer_memory_size'''). Returns an output u32 ('''error_code''').
Takes an input TransferMemory handle and an input u32 '''Size'''. Returns an output u32 '''Err'''.


== Ioctl2 ==
== Ioctl2 ==
Takes a type-0x21 buffer, a type-0x22 buffer, a type-0x21 buffer, and two input u32s. Returns an output u32 ('''error_code''').
Takes two input u32s '''Fd''' and '''Iocode''', two type-0x21 input buffers and a type-0x22 output buffer. Returns an output u32 '''Err'''.


== Ioctl3 ==
== Ioctl3 ==
Takes a type-0x21 buffer, a type-0x22 buffer, another type-0x22 buffer, and two input u32s. Returns an output u32 (error_code).
Takes two input u32s '''Fd''' and '''Iocode''', a type-0x21 input buffer and two type-0x22 output buffers. Returns an output u32 '''Err'''.
Cmdhdr_word1 is 0x100B instead of 0xC0B.


== SetGraphicsFirmwareMemoryMarginEnabled ==
== SetGraphicsFirmwareMemoryMarginEnabled ==
Line 112: Line 111:
This sets a boolean value based on the input u64 and the value of the "nv!nv_graphics_firmware_memory_margin" system configuration, but only for "nvdrv" (the other services default to false).
This sets a boolean value based on the input u64 and the value of the "nv!nv_graphics_firmware_memory_margin" system configuration, but only for "nvdrv" (the other services default to false).


Official user-processes starting with 3.0.0 now use this at the end of nvdrv service init with value 0x1.
[3.0.0+] Official user-processes now use this at the end of nvdrv service init with value 0x1.
 
= nvmemp =
This is "nv::MemoryProfiler::IMemoryProfiler".


= Permissions =
/dev/nvhost-ctrl sends the ioctl NVHOST_IOCTL_CTRL_GET_CONFIG to check the config "nv!NV_MEMORY_PROFILER". If config_str returns "1", the application attempts to use nvmemp.
Each nvdrv service is initialized with a bitfield that controls access to nodes and other operations.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Name
!  Description
|-
|-
| 0
! Cmd || Name
| NvDrvPermission_Gpu
| Can access [[#Channels|/dev/nvhost-gpu]], [[#/dev/nvhost-ctrl-gpu|/dev/nvhost-ctrl-gpu]] and [[#/dev/nvhost-as-gpu|/dev/nvhost-as-gpu]].
|-
|-
| 1
| 0 || [[#Open_2|Open]]
| NvDrvPermission_GpuDebug
| Can access [[#/dev/nvhost-dbg-gpu|/dev/nvhost-dbg-gpu]] and [[#/dev/nvhost-prof-gpu|/dev/nvhost-prof-gpu]].
|-
|-
| 2
| 1 || [[#GetPid|GetPid]]
| NvDrvPermission_GpuSchedule
|}
| Can access [[#/dev/nvsched-ctrl|/dev/nvsched-ctrl]].
 
== Open ==
Takes an input TransferMemory handle and an input u32 '''Size'''. No output.
 
== GetPid ==
No input. Returns an output u32 '''Pid'''.
 
= nvdrvdbg =
This is "nns::nvdrv::INvDrvDebugFSServices".
 
{| class="wikitable" border="1"
|-
|-
| 3
! Cmd || Name
| NvDrvPermission_VIC
| Can access [[#Channels|/dev/nvhost-vic]].
|-
|-
| 4
| 0 || [[#DebugFSOpen]]
| NvDrvPermission_VideoEncoder
|-
| Can access [[#Channels|/dev/nvhost-msenc]].
| 1 || [[#DebugFSClose]]
|-
|-
| 5
| 2 || [[#GetDebugFSKeys]]
| NvDrvPermission_VideoDecoder
| Can access [[#Channels|/dev/nvhost-nvdec]].
|-
|-
| 6
| 3 || [[#GetDebugFSValue]]
| NvDrvPermission_TSEC
| Can access [[#Channels|/dev/nvhost-tsec]].
|-
|-
| 7
| 4 || [[#SetDebugFSValue]]
| NvDrvPermission_JPEG
|}
| Can access [[#Channels|/dev/nvhost-nvjpg]].
 
== DebugFSOpen ==
Takes an input Process handle. Returns an output u32 '''Handle'''.
 
== DebugFSClose ==
Takes an input u32 '''Handle'''. No output.
 
== GetDebugFSKeys ==
Takes an input u32 '''Handle''' and a type-0x6 output buffer '''OutValueBuf'''. Returns an output u32 '''Err'''.
 
== GetDebugFSValue ==
Takes an input u32 '''Handle''', a type-0x5 input buffer '''InKeyBuf''' and a type-0x6 output buffer '''OutValueBuf'''. Returns an output u32 '''Err'''.
 
== SetDebugFSValue ==
Takes an input u32 '''Handle''' and two type-0x5 input buffers '''InKeyBuf''' and '''InValueBuf'''. Returns an output u32 '''Err'''.
 
= nvgem:c =
This is "nv::gemcontrol::INvGemControl".
 
{| class="wikitable" border="1"
|-
|-
| 8
! Cmd || Name
| NvDrvPermission_Display
| Can access [[#Channels|/dev/nvhost-display]], [[#/dev/nvcec-ctrl|/dev/nvcec-ctrl]], [[#/dev/nvhdcp_up-ctrl|/dev/nvhdcp_up-ctrl]], [[#/dev/nvdisp-ctrl|/dev/nvdisp-ctrl]], [[#/dev/nvdisp-disp0, /dev/nvdisp-disp1|/dev/nvdisp-disp0]], [[#/dev/nvdisp-disp0, /dev/nvdisp-disp1|/dev/nvdisp-disp1]], [[#/dev/nvdcutil-disp0, /dev/nvdcutil-disp1|/dev/nvdcutil-disp0]] and [[#/dev/nvdcutil-disp0, /dev/nvdcutil-disp1|/dev/nvdcutil-disp1]].
|-
|-
| 9
| 0 || [[#Initialize_2|Initialize]]
| NvDrvPermission_ImportMemory
| Can duplicate [[#/dev/nvmap|nvmap]] handles from other processes with [[#NVMAP_IOC_FROM_ID|NVMAP_IOC_FROM_ID]].
|-
|-
| 10
| 1 || [[#GetEventHandle|GetEventHandle]]
| NvDrvPermission_NoCheckedAruid
| Can use [[#SetAruidWithoutCheck|SetAruidWithoutCheck]].
|-
|-
| 11
| 2 || [[#ControlNotification|ControlNotification]]
|
|-
| Can use [[#SetGraphicsFirmwareMemoryMarginEnabled|SetGraphicsFirmwareMemoryMarginEnabled]].
| 3 || [[#SetNotificationPerm|SetNotificationPerm]]
|-
|-
| 12
| 4 || [[#SetCoreDumpPerm|SetCoreDumpPerm]]
|
| Can duplicate exported [[#/dev/nvmap|nvmap]] handles from other processes with [[#NVMAP_IOC_FROM_ID|NVMAP_IOC_FROM_ID]].
|-
|-
| 13
| 5 || [1.0.0-4.1.0] [[#GetAruid|GetAruid]]
|
|  
|-
|-
| 14
| 6 || [[#Reset|Reset]]
|
| Can use [[#NVMAP_IOC_EXPORT_FOR_ARUID|NVMAP_IOC_EXPORT_FOR_ARUID]] and [[#NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID|NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID]].
|-
|-
| 15
| 7 || [3.0.0+] [[#GetAruid2|GetAruid2]]
|
|  
|}
|}


Nodes [[#/dev/nvmap|/dev/nvmap]], [[#/dev/nvhost-ctrl|/dev/nvhost-ctrl]] and [[#/dev/nverpt-ctrl|/dev/nverpt-ctrl]] are always accessible.
== Initialize ==
No input. Returns an output u32 '''Err'''.
 
== GetEventHandle ==
No input. Returns an output Event handle and an output u32 '''Err'''.
 
== ControlNotification ==
Takes an input bool '''Enable'''. Returns an output u32 '''Err'''.
 
== SetNotificationPerm ==
Takes an input u64 '''Aruid''' and an input bool '''Enable'''. Returns an output u32 '''Err'''.
 
== SetCoreDumpPerm ==
Takes an input u64 '''Aruid''' and an input bool '''Enable'''. Returns an output u32 '''Err'''.
 
== GetAruid ==
No input. Returns an output u64 '''Aruid''' and an output u32 '''Err'''.
 
== Reset ==
No input. Returns an output u32 '''Err'''.


= Ioctls =
== GetAruid2 ==
The ioctl number is generated with the following primitive (see Linux kernel):
Unofficial name.


#define _IOC(inout, group, num, len) \
No input. Returns an output u64 '''Aruid''', an output bool '''IsCoreDumpEnabled''' and an output u32 '''Err'''.
    (inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))


The following table contains known ioctls.
= nvgem:cd =
This is "nv::gemcoredump::INvGemCoreDump".


== /dev/nvhost-ctrl ==
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
|-
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]]
! Cmd || Name
|-
|-
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]]
| 0 || [[#Initialize_3|Initialize]]
|-
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]]
|-
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]]
|-
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]]
|-
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]]
|-
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]]
|-
| 0xC183001B || Inout || 387 || [[#NVHOST_IOCTL_CTRL_GET_CONFIG]]
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT]]
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_EVENT_WAIT]]
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_EVENT_WAIT_ASYNC]]
|-
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_REGISTER_EVENT]]
| 1 || [[#GetAruid_2|GetAruid]]
|-
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_UNREGISTER_EVENT]]
| 2 || [1.0.0-8.1.0] [[#ReadNextBlock|ReadNextBlock]]
|-
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENTS]]
| 3 || [8.0.0+] [[#GetNextBlockSize|GetNextBlockSize]]
|-
|-
| 0xC0040022 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL]]
| 4 || [8.0.0+] [[#ReadNextBlock2|ReadNextBlock2]]
|}
|}


=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
== Initialize ==
Identical to Linux driver.
No input. Returns an output u32 '''Err'''.


  struct {
== GetAruid ==
    __in  u32 id;
No input. Returns an output u64 '''Aruid''' and an output u32 '''Err'''.
    __out u32 value;
  };


=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
== ReadNextBlock ==
Identical to Linux driver.
Takes a type-0x6 output buffer. Returns an output u32 '''Err'''.


  struct {
== GetNextBlockSize ==
    __in u32 id;
Unofficial name.
  };


=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
No input. Returns an output u64 '''Size''' and an output u32 '''Err'''.
Identical to Linux driver.


  struct {
== ReadNextBlock2 ==
    __in u32 id;
Unofficial name.
    __in u32 thresh;
    __in s32 timeout;
  };


=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
Takes a type-0x6 output buffer and two input u64s '''Size''' and '''Offset'''. Returns an output u64 '''OutSize''' and an output u32 '''Err'''.
Identical to Linux driver.


  struct {
= nvdbg:d =
    __in u32 id;
This is "nns::nvdrv::INvDrvDebugSvcServices". This was added with [10.0.0+].
    __in u32 lock;        // (0==unlock; 1==lock)
  };


=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
This service has no commands.
Identical to Linux driver. Uses 32-bit version and doesn't work.


  struct {
= Ioctls =
    __in u32 id;
The ioctl number is generated with the following primitive (see Linux kernel):
    __in u32 num_offsets;
    __in u32 block_size;
    __in u32 offsets;
    __in u32 values;
    __in u32 write;
  };


=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
#define _IOC(inout, group, num, len) \
Identical to Linux driver.
    (inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))


  struct {
The following table contains all known ioctls.
    __in  u32 id;
    __in  u32 thresh;
    __in  s32 timeout;
    __out u32 value;
  };


=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
== /dev/nvhost-ctrl ==
Identical to Linux driver.
{| class="wikitable" border="1"
 
! Value || Direction || Size || Description
  struct {
|-
    __in  u32 id;
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]]
    __out u32 value;
|-
  };
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]]
 
|-
=== NVHOST_IOCTL_CTRL_GET_CONFIG ===
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]]
Returns configured settings. Not available in production mode.
|-
 
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]]
  struct {
|-
    __in char domain_str[0x41];      // "nv"
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]]
    __in char param_str[0x41];
|-
    __out char config_str[0x101];
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]]
  };
|-
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]]
|-
| 0xC183001B || Inout || 387 || [[#NVHOST_IOCTL_CTRL_GET_CONFIG]]
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT]]
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT]]
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT_SINGLE]]
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_ALLOC_EVENT]]
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT]]
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT_BATCH]]
|-
| 0xC0040022 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL]]
|}


=== NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT ===
=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
Clears the wait signal of an event. Exclusive to the Switch.
Identical to Linux driver.


   struct {
   struct {
     __in u32 event_slot;         // ranges from 0x00 to 0x3F
     __in u32 id;
    __out u32 value;
   };
   };


=== NVHOST_IOCTL_CTRL_SYNCPT_EVENT_WAIT ===
=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
Waits on an event. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to (('''syncpt_id''' << 0x10) | 0x10000000).
Identical to Linux driver.
 
Depending on '''threshold''', an '''event_slot''' may be returned for using with other event ioctls.


   struct {
   struct {
     __in   u32 syncpt_id;
     __in u32 id;
    __in    u32 threshold;
    __in    s32 timeout;
    __inout u32 value;          // in=event_slot (ignored); out=syncpt_value or event_slot
   };
   };


=== NVHOST_IOCTL_CTRL_SYNCPT_EVENT_WAIT_ASYNC ===
=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
Waits on an event (async version). If waiting fails, returns error code 0x0B (BadValue).
Identical to Linux driver.
 
Depending on '''threshold''', an '''event_slot''' may be returned for using with other event ioctls.


   struct {
   struct {
     __in   u32 syncpt_id;
     __in u32 id;
     __in   u32 threshold;
     __in u32 thresh;
     __in   u32 timeout;
     __in s32 timeout;
    __inout u32 value;          // in=event_slot (ignored); out=syncpt_value or event_slot
   };
   };


=== NVHOST_IOCTL_CTRL_SYNCPT_REGISTER_EVENT ===
=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
Registers an event. Exclusive to the Switch.  
Identical to Linux driver.


   struct {
   struct {
     __in u32 event_slot;         // ranges from 0x00 to 0x3F
     __in u32 id;
    __in u32 lock;        // (0==unlock; 1==lock)
   };
   };


=== NVHOST_IOCTL_CTRL_SYNCPT_UNREGISTER_EVENT ===
=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
Unregisters an event. Exclusive to the Switch.  
Identical to Linux driver. Uses 32-bit version and doesn't work.


   struct {
   struct {
     __in u32 event_slot;         // ranges from 0x00 to 0x3F
     __in u32 id;
    __in u32 num_offsets;
    __in u32 block_size;
    __in u32 offsets;
    __in u32 values;
    __in u32 write;
   };
   };


=== NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENTS ===
=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
Frees events. Exclusive to the Switch.  
Identical to Linux driver.


   struct {
   struct {
     __in u64 events;             // 64-bit bitfield where each bit represents one event
     __in u32 id;
    __in  u32 thresh;
    __in  s32 timeout;
    __out u32 value;
   };
   };


=== NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL ===
=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
If event FIFO is enabled, returns the maximum channel number. Exclusive to the Switch.
Identical to Linux driver.


   struct {
   struct {
     __out u32 max_channel;      // 0x00 (FIFO disabled) or 0x60 (FIFO enabled)
    __in  u32 id;
     __out u32 value;
  };
 
=== NVHOST_IOCTL_CTRL_GET_CONFIG ===
Returns configured settings. Not available in production mode.
 
  struct {
    __in char name[0x41];      // "nv"
    __in char key[0x41];
    __out char value[0x101];
   };
   };


== /dev/nvmap ==
=== NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT ===
{| class="wikitable" border="1"
Clears the wait signal of a syncpt event.
! Value || Direction || Size || Description
 
|-
  struct {
| 0xC0080101 || Inout || 8 || [[#NVMAP_IOC_CREATE]]
    __in u32 event_id;          // 0x00 to 0x3F
|-
  };
| 0x00000102 || - || 0 || [[#NVMAP_IOC_CLAIM]]
 
|-
=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT ===
| 0xC0080103 || Inout || 8 || [[#NVMAP_IOC_FROM_ID]]
Waits on a syncpt using events. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to (((('''id''' & 0xFFF) << 0x10) | 0x10000000) | '''event_id''').
|-
 
| 0xC0200104 || Inout || 32 || [[#NVMAP_IOC_ALLOC]]
  struct {
|-
    __in  u32 id;
| 0xC0180105 || Inout || 24 || [[#NVMAP_IOC_FREE]]
    __in  u32 thresh;
|-
    __in  s32 timeout;
| 0xC0280106 || Inout || 40 || [[#NVMAP_IOC_MMAP]]
    __out u32 value;
|-
  };
| 0xC0280107 || Inout || 40 || [[#NVMAP_IOC_WRITE]]
 
|-
=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT_SINGLE ===
| 0xC0280108 || Inout || 40 || [[#NVMAP_IOC_READ]]
Waits on a syncpt using a specific event. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to (('''id''' * 0x10) | '''event_id''').
|-
 
| 0xC00C0109 || Inout || 12 || [[#NVMAP_IOC_PARAM]]
  struct {
|-
    __in    u32 id;
| 0xC010010A || Inout || 16 || [[#NVMAP_IOC_PIN_MULT]]
    __in    u32 thresh;
|-
    __in    s32 timeout;
| 0xC010010B || Inout || 16 || [[#NVMAP_IOC_UNPIN_MULT]]
    __inout u32 value;          // in=event_id; out=syncpt_value
|-
  };
| 0xC008010C || Inout || 8 || [[#NVMAP_IOC_CACHE]]
 
|-
=== NVHOST_IOCTL_CTRL_SYNCPT_ALLOC_EVENT ===
| 0xC004010D || Inout || 4 || [[#NVMAP_IOC_GET_IVC_ID]]
Allocates a new syncpt event.
|-
 
| 0xC008010E || Inout || 8 || [[#NVMAP_IOC_GET_ID]]
  struct {
|-
    __in u32 event_id;          // 0x00 to 0x3F
| 0xC004010F || Inout || 4 || [[#NVMAP_IOC_FROM_IVC_ID]]
  };
|-
 
| 0x40040110 || In || 4 || [[#NVMAP_IOC_SET_ALLOCATION_TAG_LABEL]]
=== NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT ===
|-
Frees an existing syncpt event.
| 0x00000111 || - || 0 || [[#NVMAP_IOC_RESERVE]]
 
|-
  struct {
| 0x40100112 || In || 16 || [[#NVMAP_IOC_EXPORT_FOR_ARUID]]
    __in u32 event_id;          // 0x00 to 0x3F
|-
  };
| 0x40100113 || In || 16 || [[#NVMAP_IOC_IS_OWNED_BY_ARUID]]
|-
| 0x40100114 || In || 16 || [[#NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID]]
|}


=== NVMAP_IOC_CREATE ===
=== NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT_BATCH ===
Creates an nvmap object. Identical to Linux driver.
Frees multiple syncpt events.  


   struct {
   struct {
     __in u32 size;
     __in u64 event_id_mask;     // 64-bit bitfield where each bit represents one event
    __out u32 handle;
   };
   };


=== NVMAP_IOC_CLAIM ===
=== NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL ===
Returns [[#Errors|NotSupported]].
If event FIFO is enabled, returns the maximum channel number.
 
=== NVMAP_IOC_FROM_ID ===
Get handle to an existing nvmap object. Identical to Linux driver.


   struct {
   struct {
    __in  u32 id;
     __out u32 max_channel;       // 0x00 (FIFO disabled) or 0x60 (FIFO enabled)
     __out u32 handle;
   };
   };


=== NVMAP_IOC_ALLOC ===
== /dev/nvmap ==
Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.
{| class="wikitable" border="1"
 
! Value || Direction || Size || Description
  struct {
|-
    __in u32 handle;
| 0xC0080101 || Inout || 8 || [[#NVMAP_IOC_CREATE]]
    __in u32 heapmask;
|-
    __in u32 flags;    // (0=read-only, 1=read-write)
| 0x00000102 || - || 0 || [[#NVMAP_IOC_CLAIM]]
    __in u32 align;
|-
    __in u8  kind;
| 0xC0080103 || Inout || 8 || [[#NVMAP_IOC_FROM_ID]]
    u8      pad[7];
|-
    __inout u64 addr;
| 0xC0200104 || Inout || 32 || [[#NVMAP_IOC_ALLOC]]
  };
|-
 
| 0xC0180105 || Inout || 24 || [[#NVMAP_IOC_FREE]]
=== NVMAP_IOC_FREE ===
|-
This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.
| 0xC0280106 || Inout || 40 || [[#NVMAP_IOC_MMAP]]
 
|-
  struct {
| 0xC0280107 || Inout || 40 || [[#NVMAP_IOC_WRITE]]
    __in  u32 handle;
|-
    u32      pad;
| 0xC0280108 || Inout || 40 || [[#NVMAP_IOC_READ]]
    __out u64 address;
|-
    __out u32 size;
| 0xC00C0109 || Inout || 12 || [[#NVMAP_IOC_PARAM]]
    __out u32 flags;    // 1=NOT_FREED_YET
|-
  };
| 0xC010010A || Inout || 16 || [[#NVMAP_IOC_PIN_MULT]]
 
|-
=== NVMAP_IOC_MMAP ===
| 0xC010010B || Inout || 16 || [[#NVMAP_IOC_UNPIN_MULT]]
Returns [[#Errors|NotSupported]].
|-
 
| 0xC008010C || Inout || 8 || [[#NVMAP_IOC_CACHE]]
=== NVMAP_IOC_WRITE ===
|-
Returns [[#Errors|NotSupported]].
| 0xC004010D || Inout || 4 || [[#NVMAP_IOC_GET_IVC_ID]]
 
|-
=== NVMAP_IOC_READ ===
| 0xC008010E || Inout || 8 || [[#NVMAP_IOC_GET_ID]]
Returns [[#Errors|NotSupported]].
|-
 
| 0xC004010F || Inout || 4 || [[#NVMAP_IOC_FROM_IVC_ID]]
=== NVMAP_IOC_PARAM ===
|-
Returns info about a nvmap object. Identical to Linux driver, but extended with further params.
| 0x40040110 || In || 4 || [[#NVMAP_IOC_SET_ALLOCATION_TAG_LABEL]]
|-
| 0x00000111 || - || 0 || [[#NVMAP_IOC_RESERVE]]
|-
| 0x40100112 || In || 16 || [[#NVMAP_IOC_EXPORT_FOR_ARUID]]
|-
| 0x40100113 || In || 16 || [[#NVMAP_IOC_IS_OWNED_BY_ARUID]]
|-
| 0x40100114 || In || 16 || [[#NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID]]
|}
 
=== NVMAP_IOC_CREATE ===
Creates an nvmap object. Identical to Linux driver.


   struct {
   struct {
     __in  u32 handle;
     __in  u32 size;
    __in  u32 param; // 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
     __out u32 handle;
     __out u32 result;
   };
   };


=== NVMAP_IOC_PIN_MULT ===
=== NVMAP_IOC_CLAIM ===
Returns [[#Errors|NotSupported]].
Returns [[#Errors|NotSupported]].


=== NVMAP_IOC_UNPIN_MULT ===
=== NVMAP_IOC_FROM_ID ===
Returns [[#Errors|NotSupported]].
Get handle to an existing nvmap object. Identical to Linux driver.


=== NVMAP_IOC_CACHE ===
  struct {
Returns [[#Errors|NotSupported]].
    __in  u32 id;
    __out u32 handle;
  };
 
=== NVMAP_IOC_ALLOC ===
Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.


=== NVMAP_IOC_GET_IVC_ID ===
  struct {
Returns [[#Errors|NotSupported]].
    __in u32 handle;
    __in u32 heapmask;
    __in u32 flags;    // (0=read-only, 1=read-write)
    __inout u32 align;
    __in u8  kind;
    u8      pad[7];
    __in u64 addr;
  };


=== NVMAP_IOC_GET_ID ===
=== NVMAP_IOC_FREE ===
Returns an id for a nvmap object. Identical to Linux driver.
This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.


   struct {
   struct {
    __out u32 id; //~0 indicates error
     __in  u32 handle;
     __in  u32 handle;
    u32      pad;
    __out u64 address;  // 0 if the handle wasn't yet freed
    __out u32 size;
    __out u32 flags;    // 1=WAS_UNCACHED (if flags bit 1 was set when NVMAP_IOC_ALLOC was called)
   };
   };


=== NVMAP_IOC_FROM_IVC_ID ===
=== NVMAP_IOC_MMAP ===
Returns [[#Errors|NotSupported]].
Returns [[#Errors|NotSupported]].


=== NVMAP_IOC_SET_ALLOCATION_TAG_LABEL ===
=== NVMAP_IOC_WRITE ===
Returns [[#Errors|NotSupported]].
Returns [[#Errors|NotSupported]].


=== NVMAP_IOC_RESERVE ===
=== NVMAP_IOC_READ ===
Returns [[#Errors|NotSupported]].
Returns [[#Errors|NotSupported]].


=== NVMAP_IOC_EXPORT_FOR_ARUID ===
=== NVMAP_IOC_PARAM ===
Binds a nvmap object to an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].
Returns info about a nvmap object. Identical to Linux driver, but extended with further params.


   struct {
   struct {
    __in  u64 aruid;
     __in  u32 handle;
     __in  u32 handle;
     u8        pad[4];
     __in  u32 param;  // 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
    __out u32 result;
   };
   };


=== NVMAP_IOC_IS_OWNED_BY_ARUID ===
=== NVMAP_IOC_PIN_MULT ===
Checks if a nvmap object is bound to an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].
Returns [[#Errors|NotSupported]].
 
=== NVMAP_IOC_UNPIN_MULT ===
Returns [[#Errors|NotSupported]].
 
=== NVMAP_IOC_CACHE ===
Returns [[#Errors|NotSupported]].
 
=== NVMAP_IOC_GET_IVC_ID ===
Returns [[#Errors|NotSupported]].
 
=== NVMAP_IOC_GET_ID ===
Returns an id for a nvmap object. Identical to Linux driver.


   struct {
   struct {
     __in  u64 aruid;
     __out u32 id; //~0 indicates error
     __in  u32 handle;
     __in  u32 handle;
    u8        pad[4];
   };
   };


=== NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID ===
=== NVMAP_IOC_FROM_IVC_ID ===
Unbinds a nvmap object from an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].
Returns [[#Errors|NotSupported]].
 
=== NVMAP_IOC_SET_ALLOCATION_TAG_LABEL ===
Returns [[#Errors|NotSupported]].
 
=== NVMAP_IOC_RESERVE ===
Returns [[#Errors|NotSupported]].
 
=== NVMAP_IOC_EXPORT_FOR_ARUID ===
Binds a nvmap object to an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].
 
  struct {
    __in  u64 aruid;
    __in  u32 handle;
    u8        pad[4];
  };
 
=== NVMAP_IOC_IS_OWNED_BY_ARUID ===
Checks if a nvmap object is bound to an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].
 
  struct {
    __in  u64 aruid;
    __in  u32 handle;
    u8        pad[4];
  };
 
=== NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID ===
Unbinds a nvmap object from an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].


   struct {
   struct {
Line 599: Line 664:
| 0xC004021F || Inout || 4 || NVDISP_GET_WINMASK
| 0xC004021F || Inout || 4 || NVDISP_GET_WINMASK
|-
|-
| 0x80080221 || Out || 8 || [10.0.0+] NVDISP_GET_BACKLIGHT_RANGE
| 0x80080221 || Out || 8 || [10.0.0+] [[#NVDISP_GET_BACKLIGHT_RANGE]]
|-
|-
| 0x40040222 || In || 4 || [10.0.0+] NVDISP_SET_BACKLIGHT
| 0x40040222 || In || 4 || [10.0.0+] [[#NVDISP_SET_BACKLIGHT]]
|-
|-
| 0x40040223 || In || 4 || [11.0.0+] NVDISP_SEND_PANEL_MSG
| 0x40040223 || In || 4 || [11.0.0+]  
|-
|-
| 0x401C0225 || In || 28 || [11.0.0+] NVDISP_SEND_PANEL_MSG_EX
| 0x401C0225 || In || 28 || [11.0.0+] [[#NVDISP_SEND_PANEL_MSG]]
|-
|-
| 0xC01C0226 || Inout || 28 || [11.0.0+] NVDISP_GET_PANEL_DATA
| 0xC01C0226 || Inout || 28 || [11.0.0+] [[#NVDISP_GET_PANEL_DATA]]
|}
|}


== /dev/nvcec-ctrl ==
=== NVDISP_GET_BACKLIGHT_RANGE ===
Returns the minimum and maximum values for the intensity of the display's backlight.
 
  struct {
    __out u32 min;
    __out u32 max;
  };
 
=== NVDISP_SET_BACKLIGHT ===
Sets the value for the intensity of the display's backlight.
 
  struct {
    __in u32 val;
  };
 
=== NVDISP_SEND_PANEL_MSG ===
Sends raw data to the display panel over DPAUX.
 
  struct {
    __in u32 cmd;          // DPAUX AUXCTL command (1=unk, 2=I2CWR, 4=MOTWR, 7=AUXWR)
    __in u32 addr;        // DPAUX AUXADDR
    __in u32 size;        // message size
    __in u32 msg[4];      // raw AUXDATA message
  };
 
=== NVDISP_GET_PANEL_DATA ===
Receives raw data from the display panel over DPAUX.
 
  struct {
    __in u32 cmd;          // DPAUX AUXCTL command (3=I2CRD, 5=MOTRD, 6=AUXRD)
    __in u32 addr;        // DPAUX AUXADDR
    __in u32 size;        // message size
    __out u32 msg[4];      // raw AUXDATA message
  };
 
== /dev/nvcec-ctrl ==
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Value || Direction || Size || Description
! Value || Direction || Size || Description
Line 664: Line 764:
| 0xC0F40508 || Inout || 244 || NVDCUTIL_DSI_PACKET_TEST_READ
| 0xC0F40508 || Inout || 244 || NVDCUTIL_DSI_PACKET_TEST_READ
|-
|-
| 0x40010509 || In || 1 || [10.0.0+] NVDCUTIL_DP_ELEC_TEST_MODE_ENABLE
| 0x40010509 || In || 1 || [10.0.0+] NVDCUTIL_DP_ELECTRIC_TEST_EN
|-
|-
| 0xC020050A || Inout || 32 || [10.0.0+] NVDCUTIL_DP_ELEC_TEST_SETTINGS
| 0xC020050A || Inout || 32 || [10.0.0+] NVDCUTIL_DP_ELECTRIC_TEST_SETTINGS
|-
|-
| 0x8070050B || Out || 112 || [11.0.0+] NVDCUTIL_DP_CONF_READ
| 0x8070050B || Out || 112 || [11.0.0+] NVDCUTIL_DP_CONF_READ
Line 815: Line 915:
   struct {
   struct {
     __in u32 fence_id;
     __in u32 fence_id;
     __in u32 fence_thresh;
     __in u32 fence_value;
     __in u32 swap_interval;
     __in u32 swap_interval;
   };
   };
Line 917: Line 1,017:
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_ALLOC_AS_EX]]
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_ALLOC_AS_EX]]
|-
|-
| 0xC038410A || Inout || 56 || [[#NVGPU_AS_IOCTL_MODIFY]]
| 0xC038410A || Inout || 56 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX2]]
|-
|-
| 0xC0??4114 || Inout || Variable || [[#NVGPU_AS_IOCTL_REMAP]]
| 0xC0??4114 || Inout || Variable || [[#NVGPU_AS_IOCTL_REMAP]]
Line 953: Line 1,053:


=== NVGPU_AS_IOCTL_MAP_BUFFER ===
=== NVGPU_AS_IOCTL_MAP_BUFFER ===
Maps a memory region in the device address space. Identical to Linux driver pretty much.
Maps a memory region in the device address space.
 
Unaligned size will cause a [[#Panic]].


On success, the mapped memory region is granted the [[SVC#MemoryAttribute|DeviceShared]] attribute.
On success, the mapped memory region is granted the [[SVC#MemoryAttribute|DeviceShared]] attribute.
Line 959: Line 1,061:
   struct {
   struct {
     __in    u32 flags;        // bit0: fixed_offset, bit2: cacheable
     __in    u32 flags;        // bit0: fixed_offset, bit2: cacheable
     u32        reserved;
     u32        reserved0;
     __in    u32 dmabuf_fd;   // nvmap handle
     __in    u32 mem_id;       // nvmap handle
     __inout u32 page_size;   // 0 means don't care
     u32         reserved1;
     union {
     union {
       __out u64 offset;
       __out u64 offset;
Line 977: Line 1,079:
   struct {
   struct {
     __in      u32 flags;          // bit0: fixed_offset, bit2: cacheable
     __in      u32 flags;          // bit0: fixed_offset, bit2: cacheable
     __in      u32 kind;          // -1 is default
     __inout  u32 kind;          // -1 is default
     __in      u32 dmabuf_fd;     // nvmap handle
     __in      u32 mem_id;         // nvmap handle
     __inout  u32 page_size;     // 0 means don't care
     u32           reserved;
     __in      u64 buffer_offset;
     __in      u64 buffer_offset;
     __in      u64 mapping_size;
     __in      u64 mapping_size;
     __inout   u64 offset;
     union {
      __out   u64 offset;
      __in    u64 align;
    };
   };
   };


Line 1,003: Line 1,108:
=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
Nintendo's custom implementation to get rid of pointer in struct.
Nintendo's custom implementation to get rid of pointer in struct.
Uses [[#Ioctl3|Ioctl3]].


   struct va_region {
   struct va_region {
Line 1,031: Line 1,138:
   };
   };


=== NVGPU_AS_IOCTL_MODIFY ===
=== NVGPU_AS_IOCTL_MAP_BUFFER_EX2 ===
Modifies a memory region in the device address space.
Maps a memory region in the device address space with extra params.


    struct {
Unaligned size will cause a [[#Panic]].
 
On success, the mapped memory region is granted the [[SVC#MemoryAttribute|DeviceShared]] attribute.
 
  struct {
     __in      u32 flags;          // bit0: fixed_offset, bit2: cacheable
     __in      u32 flags;          // bit0: fixed_offset, bit2: cacheable
     __in      u32 kind;          // -1 is default
     __inout  u32 kind;          // -1 is default
     __in      u32 dmabuf_fd;     // nvmap handle
     __in      u32 mem_id;         // nvmap handle
     __inout  u32 page_size;     // 0 means don't care
     u32           reserved0;
     __in      u64 buffer_offset;
     __in      u64 buffer_offset;
     __in      u64 mapping_size;
     __in      u64 mapping_size;
     __inout   u64 offset;
     union {
     __in      u64 unk0;
      __out   u64 offset;
     __in      u32 unk1;
      __in    u64 align;
     u32          reserved;
    };
     __in      u64 vma_addr;
     __in      u32 pages;
     u32          reserved1;
   };
   };


=== NVGPU_AS_IOCTL_REMAP ===
=== NVGPU_AS_IOCTL_REMAP ===
Nintendo's custom implementation of address space remapping.
Nintendo's custom implementation of address space remapping for sparse pages.


   struct remap_op {
   struct remap_op {
     __in u16 flags;                   // 0 or 4
     __in u16 flags;                     // bit2: cacheable
     __in u16 kind;           
     __in u16 kind;           
     __in u32 mem_handle;
     __in u32 mem_handle;
     __in u32 mem_offset_in_pages;
     __in u32 mem_offset_in_pages;
     __in u32 virt_offset_in_pages;   // (alloc_space_offset >> 0x10)
     __in u32 virt_offset_in_pages;       // (alloc_space_offset >> 0x10)
     __in u32 num_pages;               // alloc_space_pages
     __in u32 num_pages;                 // alloc_space_pages
   };
   };
   
   
Line 1,122: Line 1,236:
|-
|-
| 0xC020441B || Inout || 32 || [11.0.0+]
| 0xC020441B || Inout || 32 || [11.0.0+]
|-
| 0xC084441C || Inout || 132 || [11.0.0+]
|-
| 0xC018441D || Inout || 24 || [11.0.0+]
|-
|-
| 0xC020441E || Inout || 32 || [11.0.0+]
| 0xC020441E || Inout || 32 || [11.0.0+]
Line 1,469: Line 1,587:
  };
  };


== Channels ==
= Channels =
Channels are a concept for NVIDIA hardware blocks that share a common interface.
Channels are a concept for NVIDIA hardware blocks that share a common interface.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
Line 1,488: Line 1,606:
|}
|}


== Channel Ioctls ==
== Ioctls ==
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Value || Size || Description
! Value || Size || Description
Line 1,562: Line 1,680:
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]]
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]]
|-
|-
| 0xC018481B || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX]]
| 0xC018481B || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2]]
|-
|-
| 0xC018481C || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY_EX]]
| 0xC018481C || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2_RETRY]]
|-
|-
| 0xC004481D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_TIMESLICE]]
| 0xC004481D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_TIMESLICE]]
Line 1,596: Line 1,714:
     u32 syncpt_id;
     u32 syncpt_id;
     u32 syncpt_incrs;
     u32 syncpt_incrs;
  };
     u32 reserved[3];
 
  struct fence {
     u32 id;
    u32 thresh;
   };
   };
    
    
Line 1,612: Line 1,726:
     __in    struct reloc_shift reloc_shifts[];    // depends on num_relocs
     __in    struct reloc_shift reloc_shifts[];    // depends on num_relocs
     __in    struct syncpt_incr syncpt_incrs[];    // depends on num_syncpt_incrs
     __in    struct syncpt_incr syncpt_incrs[];    // depends on num_syncpt_incrs
     __out  struct fence fences[];                 // depends on num_fences
     __out  u32 fence_thresholds[];               // depends on num_fences
   };
   };


Line 1,752: Line 1,866:
   struct fence {
   struct fence {
     u32 id;
     u32 id;
     u32 thresh;
     u32 value;
   };
   };
    
    
   struct gpfifo_entry {
   struct gpfifo_entry {
     u64 entry;                               // gpu_iova | (unk_2bits << 40) | (size << 42) | (unk_flag << 63)
     u32 entry0;                             // gpu_iova_lo
    u32 entry1;                              // gpu_iova_hi | (allow_flush << 8) | (is_push_buf << 9) | (size << 10) | (sync << 31)
   };
   };
    
    
Line 1,762: Line 1,877:
     __in    u64 gpfifo;                      // (ignored) pointer to gpfifo fence structs
     __in    u64 gpfifo;                      // (ignored) pointer to gpfifo fence structs
     __in    u32 num_entries;                // number of fence objects being submitted
     __in    u32 num_entries;                // number of fence objects being submitted
     __in   u32 flags;
     union {
      __out u32 detailed_error;
      __in u32 flags;
    };
     __inout struct fence fence_out;          // returned new fence object for others to wait on
     __inout struct fence fence_out;          // returned new fence object for others to wait on
     __in    struct gpfifo_entry entries[];  // depends on num_entries
     __in    struct gpfifo_entry entries[];  // depends on num_entries
Line 1,863: Line 1,981:
  struct fence {
  struct fence {
     u32 id;
     u32 id;
     u32 thresh;
     u32 value;
  };
  };
   
   
Line 1,880: Line 1,998:
Same as [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX|NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]].
Same as [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX|NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]].


=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX ===
=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2 ===
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]], but uses [[#Ioctl2|Ioctl2]].
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]], but uses [[#Ioctl2|Ioctl2]].


=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY_EX ===
=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2_RETRY ===
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]], but uses [[#Ioctl2|Ioctl2]].
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]], but uses [[#Ioctl2|Ioctl2]].


Line 1,907: Line 2,025:
   };
   };


= nvmemp =
= NvDrvPermission =
This is "nv::MemoryProfiler::IMemoryProfiler".
This is "nns::nvdrv::NvDrvPermission".
 
/dev/nvhost-ctrl sends the ioctl NVHOST_IOCTL_CTRL_GET_CONFIG to check the config "nv!NV_MEMORY_PROFILER". If config_str returns "1", the application attempts to use nvmemp.


{| class="wikitable" border="1"
{| class="wikitable" border="1"
!  Bits
!  Name
!  Description
|-
|-
! Cmd || Name
| 0
| Gpu
| Can access [[#Channels|/dev/nvhost-gpu]], [[#/dev/nvhost-ctrl-gpu|/dev/nvhost-ctrl-gpu]] and [[#/dev/nvhost-as-gpu|/dev/nvhost-as-gpu]].
|-
|-
| 0 || Open
| 1
| GpuDebug
| Can access [[#/dev/nvhost-dbg-gpu|/dev/nvhost-dbg-gpu]] and [[#/dev/nvhost-prof-gpu|/dev/nvhost-prof-gpu]].
|-
|-
| 1 || GetPid
| 2
|}
| GpuSchedule
 
| Can access [[#/dev/nvsched-ctrl|/dev/nvsched-ctrl]].
= nvdrvdbg =
This is "nns::nvdrv::INvDrvDebugFSServices".
 
{| class="wikitable" border="1"
|-
|-
! Cmd || Name
| 3
| VIC
| Can access [[#Channels|/dev/nvhost-vic]].
|-
|-
| 0 || [[#OpenDebugFS]]
| 4
| VideoEncoder
| Can access [[#Channels|/dev/nvhost-msenc]].
|-
|-
| 1 || [[#CloseDebugFS]]
| 5
| VideoDecoder
| Can access [[#Channels|/dev/nvhost-nvdec]].
|-
|-
| 2 || [[#GetDebugFSKeys]]
| 6
| TSEC
| Can access [[#Channels|/dev/nvhost-tsec]].
|-
|-
| 3 || GetDebugFSValue
| 7
| JPEG
| Can access [[#Channels|/dev/nvhost-nvjpg]].
|-
|-
| 4 || SetDebugFSValue
| 8
|}
| Display
 
| Can access [[#Channels|/dev/nvhost-display]], [[#/dev/nvcec-ctrl|/dev/nvcec-ctrl]], [[#/dev/nvhdcp_up-ctrl|/dev/nvhdcp_up-ctrl]], [[#/dev/nvdisp-ctrl|/dev/nvdisp-ctrl]], [[#/dev/nvdisp-disp0, /dev/nvdisp-disp1|/dev/nvdisp-disp0]], [[#/dev/nvdisp-disp0, /dev/nvdisp-disp1|/dev/nvdisp-disp1]], [[#/dev/nvdcutil-disp0, /dev/nvdcutil-disp1|/dev/nvdcutil-disp0]] and [[#/dev/nvdcutil-disp0, /dev/nvdcutil-disp1|/dev/nvdcutil-disp1]].
== OpenDebugFS ==
Takes a process handle. Returns a u32 '''fd'''.
 
== CloseDebugFS ==
Takes a u32 '''fd''' and closes it.
 
== GetDebugFSKeys ==
Takes a u32 '''fd''' and reads debug contents into a type-6 buffer.
 
= nvgem:c =
This is "nv::gemcontrol::INvGemControl".
 
{| class="wikitable" border="1"
|-
|-
! Cmd || Name
| 9
| ImportMemory
| Can duplicate [[#/dev/nvmap|nvmap]] handles from other processes with [[#NVMAP_IOC_FROM_ID|NVMAP_IOC_FROM_ID]].
|-
|-
| 0 || Initialize
| 10
| NoCheckedAruid
| Can use [[#SetAruidWithoutCheck|SetAruidWithoutCheck]].
|-
|-
| 1 || GetEventHandle
| 11
|
| Can use [[#SetGraphicsFirmwareMemoryMarginEnabled|SetGraphicsFirmwareMemoryMarginEnabled]].
|-
|-
| 2 || ControlNotification
| 12
|
| Can duplicate exported [[#/dev/nvmap|nvmap]] handles from other processes with [[#NVMAP_IOC_FROM_ID|NVMAP_IOC_FROM_ID]].
|-
|-
| 3 || SetNotificationPerm
| 13
|
| Can use the GPU virtual address range 0xC0000 to 0x580000 instead of 0x0 to 0xC0000.
|-
|-
| 4 || SetCoreDumpPerm
| 14
|
| Can use [[#NVMAP_IOC_EXPORT_FOR_ARUID|NVMAP_IOC_EXPORT_FOR_ARUID]] and [[#NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID|NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID]].
|-
|-
| 5 || [1.0.0-4.1.0] GetAruid
| 15
|-
|
| 6 || Reset
| Can use the virtual address ranges 0x0 to 0x100000000 (GPU) and 0x0 to 0xE0000000 (non-GPU) instead of 0x100000000 to 0x11FA50000 (GPU) and 0xE0000000 to 0xFFFE0000 (non-GPU).
|-
| 7 || [3.0.0+]
|}
|}


= nvgem:cd =
= NvError =
This is "nv::gemcoredump::INvGemCoreDump".
This is "nns::nvdrv::NvError".


{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Cmd || Name
! Value || Name
|-
|-
| 0 || Initialize
| 0x0 || Success
|-
|-
| 1 || GetAruid
| 0x1 || NotImplemented
|-
|-
| 2 || [1.0.0-8.1.0] ReadNextBlock
| 0x2 || NotSupported
|-
|-
| 3 || [8.0.0+]
| 0x3 || NotInitialized
|-
|-
| 4 || [8.0.0+]
| 0x4 || BadParameter
|}
 
= nvdbg:d =
This is "nns::nvdrv::INvDrvDebugSvcServices". This was added with [10.0.0+].
 
This service has no commands.
 
= Errors =
Most nvidia driver commands return an error code apart from the normal return code.
 
{| class="wikitable" border="1"
|-
|-
! Value || Name
| 0x5 || Timeout
|-
|-
| 0x0 || NvError_Success
| 0x6 || InsufficientMemory
|-
|-
| 0x1 || NvError_NotImplemented
| 0x7 || ReadOnlyAttribute
|-
|-
| 0x2 || NvError_NotSupported
| 0x8 || InvalidState
|-
|-
| 0x3 || NvError_NotInitialized
| 0x9 || InvalidAddress
|-
|-
| 0x4 || NvError_BadParameter
| 0xA || InvalidSize
|-
|-
| 0x5 || NvError_Timeout
| 0xB || BadValue
|-
|-
| 0x6 || NvError_InsufficientMemory
| 0xD || AlreadyAllocated
|-
|-
| 0x7 || NvError_ReadOnlyAttribute
| 0xE || Busy
|-
|-
| 0x8 || NvError_InvalidState
| 0xF || ResourceError
|-
|-
| 0x9 || NvError_InvalidAddress
| 0x10 || CountMismatch
|-
|-
| 0xA || NvError_InvalidSize
| 0x11 || OverFlow
|-
|-
| 0xB || NvError_BadValue
| 0x1000 || InsufficientTransferMemory
|-
|-
| 0xD || NvError_AlreadyAllocated
| 0x10000 || InsufficientVideoMemory
|-
|-
| 0xE || NvError_Busy
| 0x10001 || BadSurfaceColorScheme
|-
|-
| 0xF || NvError_ResourceError
| 0x10002 || InvalidSurface
|-
|-
| 0x10 || NvError_CountMismatch
| 0x10003 || SurfaceNotSupported
|-
|-
| 0x11 || NvError_OverFlow
| 0x20000 || DispInitFailed
|-
|-
| 0x1000 || NvError_InsufficientTransferMemory
| 0x20001 || DispAlreadyAttached
|-
|-
| 0x10000 || NvError_InsufficientVideoMemory
| 0x20002 || DispTooManyDisplays
|-
|-
| 0x10001 || NvError_BadSurfaceColorScheme
| 0x20003 || DispNoDisplaysAttached
|-
|-
| 0x10002 || NvError_InvalidSurface
| 0x20004 || DispModeNotSupported
|-
|-
| 0x10003 || NvError_SurfaceNotSupported
| 0x20005 || DispNotFound
|-
|-
| 0x20000 || NvError_DispInitFailed
| 0x20006 || DispAttachDissallowed
|-
|-
| 0x20001 || NvError_DispAlreadyAttached
| 0x20007 || DispTypeNotSupported
|-
|-
| 0x20002 || NvError_DispTooManyDisplays
| 0x20008 || DispAuthenticationFailed
|-
|-
| 0x20003 || NvError_DispNoDisplaysAttached
| 0x20009 || DispNotAttached
|-
|-
| 0x20004 || NvError_DispModeNotSupported
| 0x2000A || DispSamePwrState
|-
|-
| 0x20005 || NvError_DispNotFound
| 0x2000B || DispEdidFailure
|-
|-
| 0x20006 || NvError_DispAttachDissallowed
| 0x2000C || DispDsiReadAckError
|-
|-
| 0x20007 || NvError_DispTypeNotSupported
| 0x2000D || DispDsiReadInvalidResp
|-
|-
| 0x20008 || NvError_DispAuthenticationFailed
| 0x30000 || FileWriteFailed
|-
|-
| 0x20009 || NvError_DispNotAttached
| 0x30001 || FileReadFailed
|-
|-
| 0x2000A || NvError_DispSamePwrState
| 0x30002 || EndOfFile
|-
|-
| 0x2000B || NvError_DispEdidFailure
| 0x30003 || FileOperationFailed
|-
|-
| 0x2000C || NvError_DispDsiReadAckError
| 0x30004 || DirOperationFailed
|-
|-
| 0x2000D || NvError_DispDsiReadInvalidResp
| 0x30005 || EndOfDirList
|-
|-
| 0x30000 || NvError_FileWriteFailed
| 0x30006 || ConfigVarNotFound
|-
|-
| 0x30001 || NvError_FileReadFailed
| 0x30007 || InvalidConfigVar
|-
|-
| 0x30002 || NvError_EndOfFile
| 0x30008 || LibraryNotFound
|-
|-
| 0x30003 || NvError_FileOperationFailed
| 0x30009 || SymbolNotFound
|-
|-
| 0x30004 || NvError_DirOperationFailed
| 0x3000A || MemoryMapFailed
|-
|-
| 0x30005 || NvError_EndOfDirList
| 0x3000F || IoctlFailed                       
|-
|-
| 0x30006 || NvError_ConfigVarNotFound
| 0x30010 || AccessDenied
|-
|-
| 0x30007 || NvError_InvalidConfigVar
| 0x30011 || DeviceNotFound
|-
|-
| 0x30008 || NvError_LibraryNotFound
| 0x30012 || KernelDriverNotFound
|-
|-
| 0x30009 || NvError_SymbolNotFound
| 0x30013 || FileNotFound
|-
|-
| 0x3000A || NvError_MemoryMapFailed
| 0x30014 || PathAlreadyExists
|-
|-
| 0x3000F || NvError_IoctlFailed                       
| 0xA000E || ModuleNotPresent
|}
 
= NvDrvStatus =
This is "nns::nvdrv::NvDrvStatus".
 
{| class="wikitable" border="1"
|-
|-
| 0x30010 || NvError_AccessDenied
! Offset
! Size
! Description
|-
|-
| 0x30011 || NvError_DeviceNotFound
| 0x0
| 0x4
| FreeSize
|-
|-
| 0x30012 || NvError_KernelDriverNotFound
| 0x4
| 0x4
| AllocatableSize
|-
|-
| 0x30013 || NvError_FileNotFound
| 0x8
| 0x4
| MinimumFreeSize
|-
|-
| 0x30014 || NvError_PathAlreadyExists
| 0xC
| 0x4
| MinimumAllocatableSize
|-
|-
| 0xA000E || NvError_ModuleNotPresent
| 0x10
| 0x10
| Reserved
|}
|}


= Panic =
= Notes =
In some cases, a panic may occur. NV forces a crash by doing:
In some cases, a panic may occur. NV forces a crash by doing:
  (void *)0 = 0xCAFE;
  (void *)0 = 0xCAFE;
End result is that the system hangs with a white-screen.
End result is that the system hangs with a white-screen.


== Gpfifo Panic ==
When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.
When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.


[[Category:Services]]
[[Category:Services]]
Retrieved from "https://switchbrew.org/wiki/NV_services"