2,783
edits
Changes
Jump to navigation
Jump to search
Line 1:
Line 1: − The Switch uses a customized NVIDIA driver. − − − Main NVIDIA driver service. − + − + − + − + Line 50:
Line 46: − + − + − + − + − + − + Line 74:
Line 70: − + − + Line 83:
Line 79: − + + + − + − + + + − + − + − + − + − + − Cmdhdr_word1 is 0x100B instead of 0xC0B. Line 112:
Line 111: − Official user-processes starting with 3.0.0 now use this at the end of nvdrv service init with value 0x1.+ + + + − = Permissions =+ − Each nvdrv service is initialized with a bitfield that controls access to nodes and other operations. − ! Bits − ! Name − ! Description − + − − | Can access [[#Channels|/dev/nvhost-gpu]], [[#/dev/nvhost-ctrl-gpu|/dev/nvhost-ctrl-gpu]] and [[#/dev/nvhost-as-gpu|/dev/nvhost-as-gpu]]. − + − − − + − + − + + + + + + + + + + + − + − − | Can access [[#Channels|/dev/nvhost-vic]]. − + − + − + − + − − − + − − − + − + − + + + + + + + + + + + + + + + + + + + + − + − − | Can access [[#Channels|/dev/nvhost-display]], [[#/dev/nvcec-ctrl|/dev/nvcec-ctrl]], [[#/dev/nvhdcp_up-ctrl|/dev/nvhdcp_up-ctrl]], [[#/dev/nvdisp-ctrl|/dev/nvdisp-ctrl]], [[#/dev/nvdisp-disp0, /dev/nvdisp-disp1|/dev/nvdisp-disp0]], [[#/dev/nvdisp-disp0, /dev/nvdisp-disp1|/dev/nvdisp-disp1]], [[#/dev/nvdcutil-disp0, /dev/nvdcutil-disp1|/dev/nvdcutil-disp0]] and [[#/dev/nvdcutil-disp0, /dev/nvdcutil-disp1|/dev/nvdcutil-disp1]]. − + − − − + − − − + − + − + − + − − − + − − − + − − − + − − − Nodes [[#/dev/nvmap|/dev/nvmap]], [[#/dev/nvhost-ctrl|/dev/nvhost-ctrl]] and [[#/dev/nverpt-ctrl|/dev/nverpt-ctrl]] are always accessible.+ + + + + + + + + + + + + + + + + + + + − + − The ioctl number is generated with the following primitive (see Linux kernel):+ − #define _IOC(inout, group, num, len) \+ − (inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num)) − The following table contains known ioctls.+ + − == /dev/nvhost-ctrl == − ! Value || Direction || Size || Description − + − + − |- − | 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]] − |- − | 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]] − |- − | 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]] − |- − | 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]] − |- − | 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]] − |- − | 0xC183001B || Inout || 387 || [[#NVHOST_IOCTL_CTRL_GET_CONFIG]] − − | 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT]] − |- − | 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_EVENT_WAIT]] − |- − | 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_EVENT_WAIT_ASYNC]] − + − + − + − | 0xC0040022 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL]]+ − + − Identical to Linux driver.+ − struct {+ − __in u32 id;+ − __out u32 value; − }; − + − Identical to Linux driver.+ − struct {+ − __in u32 id;+ − }; − === NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===+ − Identical to Linux driver. − struct {+ − __in u32 id;+ − __in u32 thresh; − __in s32 timeout; − }; − === NVHOST_IOCTL_CTRL_MODULE_MUTEX ===+ − Identical to Linux driver. − struct {+ − __in u32 id;+ − __in u32 lock; // (0==unlock; 1==lock) − }; − === NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===+ − Identical to Linux driver. Uses 32-bit version and doesn't work. − struct {+ − __in u32 id;+ − __in u32 num_offsets; − __in u32 block_size; − __in u32 offsets; − __in u32 values; − __in u32 write; − }; − === NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===+ − Identical to Linux driver.+ − struct {+ − __in u32 id; − __in u32 thresh; − __in s32 timeout; − __out u32 value; − }; − + − Identical to Linux driver.+ − + − struct {+ − __in u32 id;+ − __out u32 value;+ − };+ − + − === NVHOST_IOCTL_CTRL_GET_CONFIG ===+ − Returns configured settings. Not available in production mode.+ − + − struct {+ − __in char domain_str[0x41]; // "nv"+ − __in char param_str[0x41];+ − __out char config_str[0x101];+ − };+ + + + + + + + + + + + + + + + + + + − + − Clears the wait signal of an event. Exclusive to the Switch.+ − + + − + − Waits on an event. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to (('''syncpt_id''' << 0x10) | 0x10000000).+ − − Depending on '''threshold''', an '''event_slot''' may be returned for using with other event ioctls. − + − __in u32 threshold; − __in s32 timeout; − __inout u32 value; // in=event_slot (ignored); out=syncpt_value or event_slot − + − Waits on an event (async version). If waiting fails, returns error code 0x0B (BadValue).+ − − Depending on '''threshold''', an '''event_slot''' may be returned for using with other event ioctls. − + − + − + − __inout u32 value; // in=event_slot (ignored); out=syncpt_value or event_slot − + − Registers an event. Exclusive to the Switch. + − + + − + − Unregisters an event. Exclusive to the Switch. + − + + + + + + − + − Frees events. Exclusive to the Switch. + − + + + + − + − If event FIFO is enabled, returns the maximum channel number. Exclusive to the Switch.+ − + + + + + + + + + + + − + − {| class="wikitable" border="1"+ − ! Value || Direction || Size || Description+ − |-+ − | 0xC0080101 || Inout || 8 || [[#NVMAP_IOC_CREATE]]+ − |-+ − | 0x00000102 || - || 0 || [[#NVMAP_IOC_CLAIM]]+ − |-+ − | 0xC0080103 || Inout || 8 || [[#NVMAP_IOC_FROM_ID]]+ − + − + − |-+ − | 0xC0180105 || Inout || 24 || [[#NVMAP_IOC_FREE]]+ − |-+ − | 0xC0280106 || Inout || 40 || [[#NVMAP_IOC_MMAP]]+ − |-+ − | 0xC0280107 || Inout || 40 || [[#NVMAP_IOC_WRITE]]+ − |-+ − | 0xC0280108 || Inout || 40 || [[#NVMAP_IOC_READ]]+ − |-+ − + − |-+ − | 0xC010010A || Inout || 16 || [[#NVMAP_IOC_PIN_MULT]]+ − |-+ − | 0xC010010B || Inout || 16 || [[#NVMAP_IOC_UNPIN_MULT]]+ − |-+ − | 0xC008010C || Inout || 8 || [[#NVMAP_IOC_CACHE]]+ − |-+ − | 0xC004010D || Inout || 4 || [[#NVMAP_IOC_GET_IVC_ID]]+ − |-+ − | 0xC008010E || Inout || 8 || [[#NVMAP_IOC_GET_ID]]+ − |-+ − | 0xC004010F || Inout || 4 || [[#NVMAP_IOC_FROM_IVC_ID]]+ − |-+ − | 0x40040110 || In || 4 || [[#NVMAP_IOC_SET_ALLOCATION_TAG_LABEL]]+ − |-+ − | 0x00000111 || - || 0 || [[#NVMAP_IOC_RESERVE]]+ − |-+ − | 0x40100112 || In || 16 || [[#NVMAP_IOC_EXPORT_FOR_ARUID]]+ − |-+ − | 0x40100113 || In || 16 || [[#NVMAP_IOC_IS_OWNED_BY_ARUID]] − |- − | 0x40100114 || In || 16 || [[#NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID]] − |} − + − Creates an nvmap object. Identical to Linux driver.+ − + − __out u32 handle; − + − Returns [[#Errors|NotSupported]].+ − − === NVMAP_IOC_FROM_ID === − Get handle to an existing nvmap object. Identical to Linux driver. − __in u32 id;+ − − + − Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.+ − + − struct {+ − __in u32 handle;+ − __in u32 heapmask;+ − __in u32 flags; // (0=read-only, 1=read-write)+ − __in u32 align;+ − __in u8 kind;+ − u8 pad[7];+ − __inout u64 addr;+ − };+ − + − === NVMAP_IOC_FREE ===+ − This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.+ − + − struct {+ − __in u32 handle;+ − u32 pad;+ − __out u64 address;+ − __out u32 size;+ − __out u32 flags; // 1=NOT_FREED_YET+ − };+ − + − === NVMAP_IOC_MMAP ===+ − Returns [[#Errors|NotSupported]].+ − + − === NVMAP_IOC_WRITE ===+ − Returns [[#Errors|NotSupported]].+ − + − === NVMAP_IOC_READ ===+ − Returns [[#Errors|NotSupported]].+ − + − + − Returns info about a nvmap object. Identical to Linux driver, but extended with further params.+ + + + + + + + + + + + + − + − __in u32 param; // 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)+ − − + − + − Returns [[#Errors|NotSupported]].+ − + − Returns [[#Errors|NotSupported]].+ + + + + + − + − Returns [[#Errors|NotSupported]].+ + + + + + + + − + − Returns an id for a nvmap object. Identical to Linux driver.+ − __out u32 id; //~0 indicates error + + + + − + − + − + − + − Binds a nvmap object to an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].+ − __in u64 aruid; − u8 pad[4]; + + − + − Checks if a nvmap object is bound to an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].+ + + + + + + + + + + + + − __in u64 aruid; + − u8 pad[4]; − + − + + + + + + + + + + + + + + + + + + + + + + + + + + + + Line 599:
Line 664: − + − + − + − + − + − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Line 664:
Line 764: − + − + Line 815:
Line 915: − + Line 917:
Line 1,017: − + Line 953:
Line 1,053: − + + + Line 959:
Line 1,061: − + − + − __inout u32 page_size; // 0 means don't care + Line 977:
Line 1,079: − __in u32 kind; // -1 is default + − + − __inout u32 page_size; // 0 means don't care + − __inout u64 offset; + + + + Line 1,003:
Line 1,108: + + Line 1,031:
Line 1,138: − + − Modifies a memory region in the device address space.+ − struct {+ + + + + − __in u32 kind; // -1 is default + − + − __inout u32 page_size; // 0 means don't care + − __inout u64 offset; + − + − + − + + + + − + − + − + − + Line 1,122:
Line 1,236: + + + + Line 1,469:
Line 1,587: − == Channels ==+ − + Line 1,488:
Line 1,606: − + Line 1,562:
Line 1,680: − + − + Line 1,596:
Line 1,714: − };+ − − struct fence { − − u32 thresh; Line 1,612:
Line 1,726: − + Line 1,752:
Line 1,866: − + − u64 entry; // gpu_iova | (unk_2bits << 40) | (size << 42) | (unk_flag << 63) + + Line 1,762:
Line 1,877: − + + + + Line 1,863:
Line 1,981: − + Line 1,880:
Line 1,998: − + − + Line 1,907:
Line 2,025: − + − + − − /dev/nvhost-ctrl sends the ioctl NVHOST_IOCTL_CTRL_GET_CONFIG to check the config "nv!NV_MEMORY_PROFILER". If config_str returns "1", the application attempts to use nvmemp. + + + − ! Cmd || Name+ + + − + + + − + − + − + − = nvdrvdbg = − This is "nns::nvdrv::INvDrvDebugFSServices". − − {| class="wikitable" border="1" − ! Cmd || Name+ + + − + + + − + + + − + + + − + + + − + − + − + − == OpenDebugFS == − Takes a process handle. Returns a u32 '''fd'''. − − == CloseDebugFS == − Takes a u32 '''fd''' and closes it. − − == GetDebugFSKeys == − Takes a u32 '''fd''' and reads debug contents into a type-6 buffer. − − = nvgem:c = − This is "nv::gemcontrol::INvGemControl". − − {| class="wikitable" border="1" − ! Cmd || Name+ + + − + + + − + + + − + + + − + + + − + + + − + − + − | 6 || Reset+ − |- − | 7 || [3.0.0+] − + − + − + − + − + − + − + − + − |} − − = nvdbg:d = − This is "nns::nvdrv::INvDrvDebugSvcServices". This was added with [10.0.0+]. − − This service has no commands. − − = Errors = − Most nvidia driver commands return an error code apart from the normal return code. − − {| class="wikitable" border="1" − ! Value || Name+ − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + − + + + + + + + − | 0x30010 || NvError_AccessDenied+ + + − + + + − + + + − + + + − + + + − + + + − + − == Gpfifo Panic ==
no edit summary
= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
This is "nns::nvdrv::INvDrvServices".
This is "nns::nvdrv::INvDrvServices".
Each service is used by:
Each service is used by:
* "nvdrv": Applications.
* "nvdrv": Applications.
** [[#Permissions|Permission]] mask is [3.0.0+] 0xA82B ([1.0.0-2.3.0] 0x2B).
** [[#NvDrvPermission|Permission]] mask is [11.0.0+] 0xA83B ([1.0.0-2.3.0] 0x2B, [3.0.0+] 0xA82B).
* "nvdrv:a": Applets.
* "nvdrv:a": Applets.
** [[#Permissions|Permission]] mask is [3.0.0+] 0x10A9 ([1.0.0-2.3.0] 0xA9).
** [[#NvDrvPermission|Permission]] mask is [3.0.0+] 0x10A9 ([1.0.0-2.3.0] 0xA9).
* "nvdrv:s": Sysmodules.
* "nvdrv:s": Sysmodules.
** [[#Permissions|Permission]] mask is [3.0.0+] 0x439E ([1.0.0-2.3.0] 0x39E).
** [[#NvDrvPermission|Permission]] mask is [3.0.0+] 0x439E ([1.0.0-2.3.0] 0x39E).
* "nvdrv:t": Factory.
* "nvdrv:t": Factory.
** [[#Permissions|Permission]] mask is 0xFFFFFFFF.
** [[#NvDrvPermission|Permission]] mask is 0xFFFFFFFF.
{| class="wikitable" border="1"
{| class="wikitable" border="1"
== Open ==
== Open ==
Takes a type-0x5 input buffer for the device-path. Returns the output 32bit '''fd''' and the u32 '''error_code'''.
Takes a type-0x5 input buffer '''Path'''. Returns two output u32s '''FdOut''' and '''Err'''.
== Ioctl ==
== Ioctl ==
Takes a 32bit '''fd''', an u32 '''ioctl_cmd''', a type-0x21 input buffer, and a type-0x22 output buffer. Returns an output u32 ('''error_code''').
Takes two input u32s '''Fd''' and '''Iocode''', a type-0x21 input buffer and a type-0x22 output buffer. Returns an output u32 '''Err'''.
The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).
The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).
== Close ==
== Close ==
Takes a 32bit '''fd'''. Returns an output u32 ('''error_code''').
Takes an input u32 '''Fd'''. Returns an output u32 '''Err'''.
== Initialize ==
== Initialize ==
Takes two copy-handles ('''current_process''' and '''transfer_memory''') and an input u32 ('''transfer_memory_size'''). Returns an output u32 ('''error_code''').
Takes an input Process handle, an input TransferMemory handle and an input u32 '''Size'''. Returns an output u32 '''Err'''.
Webkit applet creates the transfer-memory with perm = 0 and size 0x300000.
Webkit applet creates the TransferMemory with perm == 0 and size == 0x300000.
== QueryEvent ==
== QueryEvent ==
Takes two input u32s ('''fd''' and '''event_id'''), with the second word immediately after the first one. Returns an output u32 ('''error_code''') and a copy-handle ('''event_handle''').
Takes two input u32s '''Fd''' and '''EvtId'''. Returns an output u32 '''Err''' and an output Event handle.
QueryEvent is only supported on (and implemented differently on):
QueryEvent is only supported on (and implemented differently on):
** 3: ErrorNotifierEvent
** 3: ErrorNotifierEvent
* /dev/nvhost-ctrl: Used to get events for SyncPts.
* /dev/nvhost-ctrl: Used to get events for SyncPts.
** If bit31-28 is 1, then lower 16-bits contain event_slot, bit27-16 contain syncpt_number.
** If bit31-28 is 1, then lower 16-bits contain event_id, bit27-16 contain syncpt_id.
** If bit31-28 is 0, then lower 4-bits contain event_slot, bit31-4 contains syncpt_number.
** If bit31-28 is 0, then lower 4-bits contain event_id, bit31-4 contains syncpt_id.
* /dev/nvhost-ctrl-gpu
* /dev/nvhost-ctrl-gpu
** 1: Returns error_event_handle.
** 1: Returns error_event_handle.
== MapSharedMem ==
== MapSharedMem ==
Takes a copy-handle ('''transfer_memory''') and two input u32s ('''fd''' and '''nvmap_handle'''). Returns an output u32 ('''error_code''').
Takes an input TransferMemory handle and two input u32s '''Fd''' and '''HMem'''. Returns an output u32 '''Err'''.
'''HMem''' is a [[#/dev/nvmap|/dev/nvmap]] memory handle.
== GetStatus ==
== GetStatus ==
Takes no input. Returns 0x10-bytes and an output u32 ('''error_code''').
Takes no input. Returns an output [[#NvDrvStatus]] and an output u32 '''Err'''.
== SetAruidWithoutCheck ==
== SetAruidWithoutCheck ==
Takes an input u64 which must [[IPC_Marshalling|match]] the user-process PID ([[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]). Returns an output u32 ('''error_code''').
Takes an input u64 '''Aruid'''. Returns an output u32 '''Err'''.
'''Aruid''' must [[IPC_Marshalling|match]] the current [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].
== SetAruid ==
== SetAruid ==
Takes a PID-descriptor and an u64 which must [[IPC_Marshalling|match]] the user-process PID ([[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]). Returns an output u32 ('''error_code''').
Takes a PID-descriptor and an input [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]. Returns an output u32 '''Err'''.
== DumpStatus ==
== DumpStatus ==
No input or output.
No input/output.
== InitializeDevtools ==
== InitializeDevtools ==
Takes a copy-handle ('''transfer_memory''') and an input u32 ('''transfer_memory_size'''). Returns an output u32 ('''error_code''').
Takes an input TransferMemory handle and an input u32 '''Size'''. Returns an output u32 '''Err'''.
== Ioctl2 ==
== Ioctl2 ==
Takes a type-0x21 buffer, a type-0x22 buffer, a type-0x21 buffer, and two input u32s. Returns an output u32 ('''error_code''').
Takes two input u32s '''Fd''' and '''Iocode''', two type-0x21 input buffers and a type-0x22 output buffer. Returns an output u32 '''Err'''.
== Ioctl3 ==
== Ioctl3 ==
Takes a type-0x21 buffer, a type-0x22 buffer, another type-0x22 buffer, and two input u32s. Returns an output u32 (error_code).
Takes two input u32s '''Fd''' and '''Iocode''', a type-0x21 input buffer and two type-0x22 output buffers. Returns an output u32 '''Err'''.
== SetGraphicsFirmwareMemoryMarginEnabled ==
== SetGraphicsFirmwareMemoryMarginEnabled ==
This sets a boolean value based on the input u64 and the value of the "nv!nv_graphics_firmware_memory_margin" system configuration, but only for "nvdrv" (the other services default to false).
This sets a boolean value based on the input u64 and the value of the "nv!nv_graphics_firmware_memory_margin" system configuration, but only for "nvdrv" (the other services default to false).
[3.0.0+] Official user-processes now use this at the end of nvdrv service init with value 0x1.
= nvmemp =
This is "nv::MemoryProfiler::IMemoryProfiler".
/dev/nvhost-ctrl sends the ioctl NVHOST_IOCTL_CTRL_GET_CONFIG to check the config "nv!NV_MEMORY_PROFILER". If config_str returns "1", the application attempts to use nvmemp.
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
| 0
! Cmd || Name
| NvDrvPermission_Gpu
|-
|-
| 1
| 0 || [[#Open_2|Open]]
| NvDrvPermission_GpuDebug
| Can access [[#/dev/nvhost-dbg-gpu|/dev/nvhost-dbg-gpu]] and [[#/dev/nvhost-prof-gpu|/dev/nvhost-prof-gpu]].
|-
|-
| 2
| 1 || [[#GetPid|GetPid]]
| NvDrvPermission_GpuSchedule
|}
| Can access [[#/dev/nvsched-ctrl|/dev/nvsched-ctrl]].
== Open ==
Takes an input TransferMemory handle and an input u32 '''Size'''. No output.
== GetPid ==
No input. Returns an output u32 '''Pid'''.
= nvdrvdbg =
This is "nns::nvdrv::INvDrvDebugFSServices".
{| class="wikitable" border="1"
|-
|-
| 3
! Cmd || Name
| NvDrvPermission_VIC
|-
|-
| 4
| 0 || [[#DebugFSOpen]]
| NvDrvPermission_VideoEncoder
|-
| Can access [[#Channels|/dev/nvhost-msenc]].
| 1 || [[#DebugFSClose]]
|-
|-
| 5
| 2 || [[#GetDebugFSKeys]]
| NvDrvPermission_VideoDecoder
| Can access [[#Channels|/dev/nvhost-nvdec]].
|-
|-
| 6
| 3 || [[#GetDebugFSValue]]
| NvDrvPermission_TSEC
| Can access [[#Channels|/dev/nvhost-tsec]].
|-
|-
| 7
| 4 || [[#SetDebugFSValue]]
| NvDrvPermission_JPEG
|}
| Can access [[#Channels|/dev/nvhost-nvjpg]].
== DebugFSOpen ==
Takes an input Process handle. Returns an output u32 '''Handle'''.
== DebugFSClose ==
Takes an input u32 '''Handle'''. No output.
== GetDebugFSKeys ==
Takes an input u32 '''Handle''' and a type-0x6 output buffer '''OutValueBuf'''. Returns an output u32 '''Err'''.
== GetDebugFSValue ==
Takes an input u32 '''Handle''', a type-0x5 input buffer '''InKeyBuf''' and a type-0x6 output buffer '''OutValueBuf'''. Returns an output u32 '''Err'''.
== SetDebugFSValue ==
Takes an input u32 '''Handle''' and two type-0x5 input buffers '''InKeyBuf''' and '''InValueBuf'''. Returns an output u32 '''Err'''.
= nvgem:c =
This is "nv::gemcontrol::INvGemControl".
{| class="wikitable" border="1"
|-
|-
| 8
! Cmd || Name
| NvDrvPermission_Display
|-
|-
| 9
| 0 || [[#Initialize_2|Initialize]]
| NvDrvPermission_ImportMemory
| Can duplicate [[#/dev/nvmap|nvmap]] handles from other processes with [[#NVMAP_IOC_FROM_ID|NVMAP_IOC_FROM_ID]].
|-
|-
| 10
| 1 || [[#GetEventHandle|GetEventHandle]]
| NvDrvPermission_NoCheckedAruid
| Can use [[#SetAruidWithoutCheck|SetAruidWithoutCheck]].
|-
|-
| 11
| 2 || [[#ControlNotification|ControlNotification]]
|
|-
| Can use [[#SetGraphicsFirmwareMemoryMarginEnabled|SetGraphicsFirmwareMemoryMarginEnabled]].
| 3 || [[#SetNotificationPerm|SetNotificationPerm]]
|-
|-
| 12
| 4 || [[#SetCoreDumpPerm|SetCoreDumpPerm]]
|
| Can duplicate exported [[#/dev/nvmap|nvmap]] handles from other processes with [[#NVMAP_IOC_FROM_ID|NVMAP_IOC_FROM_ID]].
|-
|-
| 13
| 5 || [1.0.0-4.1.0] [[#GetAruid|GetAruid]]
|
|
|-
|-
| 14
| 6 || [[#Reset|Reset]]
|
| Can use [[#NVMAP_IOC_EXPORT_FOR_ARUID|NVMAP_IOC_EXPORT_FOR_ARUID]] and [[#NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID|NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID]].
|-
|-
| 15
| 7 || [3.0.0+] [[#GetAruid2|GetAruid2]]
|
|
|}
|}
== Initialize ==
No input. Returns an output u32 '''Err'''.
== GetEventHandle ==
No input. Returns an output Event handle and an output u32 '''Err'''.
== ControlNotification ==
Takes an input bool '''Enable'''. Returns an output u32 '''Err'''.
== SetNotificationPerm ==
Takes an input u64 '''Aruid''' and an input bool '''Enable'''. Returns an output u32 '''Err'''.
== SetCoreDumpPerm ==
Takes an input u64 '''Aruid''' and an input bool '''Enable'''. Returns an output u32 '''Err'''.
== GetAruid ==
No input. Returns an output u64 '''Aruid''' and an output u32 '''Err'''.
== Reset ==
No input. Returns an output u32 '''Err'''.
= Ioctls =
== GetAruid2 ==
Unofficial name.
No input. Returns an output u64 '''Aruid''', an output bool '''IsCoreDumpEnabled''' and an output u32 '''Err'''.
= nvgem:cd =
This is "nv::gemcoredump::INvGemCoreDump".
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]]
! Cmd || Name
|-
|-
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]]
| 0 || [[#Initialize_3|Initialize]]
|-
|-
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_REGISTER_EVENT]]
| 1 || [[#GetAruid_2|GetAruid]]
|-
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_UNREGISTER_EVENT]]
| 2 || [1.0.0-8.1.0] [[#ReadNextBlock|ReadNextBlock]]
|-
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENTS]]
| 3 || [8.0.0+] [[#GetNextBlockSize|GetNextBlockSize]]
|-
|-
| 4 || [8.0.0+] [[#ReadNextBlock2|ReadNextBlock2]]
|}
|}
=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
== Initialize ==
No input. Returns an output u32 '''Err'''.
== GetAruid ==
No input. Returns an output u64 '''Aruid''' and an output u32 '''Err'''.
=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
== ReadNextBlock ==
Takes a type-0x6 output buffer. Returns an output u32 '''Err'''.
== GetNextBlockSize ==
Unofficial name.
No input. Returns an output u64 '''Size''' and an output u32 '''Err'''.
== ReadNextBlock2 ==
Unofficial name.
Takes a type-0x6 output buffer and two input u64s '''Size''' and '''Offset'''. Returns an output u64 '''OutSize''' and an output u32 '''Err'''.
= nvdbg:d =
This is "nns::nvdrv::INvDrvDebugSvcServices". This was added with [10.0.0+].
This service has no commands.
= Ioctls =
The ioctl number is generated with the following primitive (see Linux kernel):
#define _IOC(inout, group, num, len) \
(inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))
The following table contains all known ioctls.
=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
== /dev/nvhost-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]]
|-
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]]
|-
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]]
|-
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]]
|-
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]]
|-
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]]
|-
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]]
|-
| 0xC183001B || Inout || 387 || [[#NVHOST_IOCTL_CTRL_GET_CONFIG]]
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT]]
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT]]
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT_SINGLE]]
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_ALLOC_EVENT]]
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT]]
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT_BATCH]]
|-
| 0xC0040022 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL]]
|}
=== NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT ===
=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
Identical to Linux driver.
struct {
struct {
__in u32 event_slot; // ranges from 0x00 to 0x3F
__in u32 id;
__out u32 value;
};
};
=== NVHOST_IOCTL_CTRL_SYNCPT_EVENT_WAIT ===
=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
Identical to Linux driver.
struct {
struct {
__in u32 syncpt_id;
__in u32 id;
};
};
=== NVHOST_IOCTL_CTRL_SYNCPT_EVENT_WAIT_ASYNC ===
=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
Identical to Linux driver.
struct {
struct {
__in u32 syncpt_id;
__in u32 id;
__in u32 threshold;
__in u32 thresh;
__in u32 timeout;
__in s32 timeout;
};
};
=== NVHOST_IOCTL_CTRL_SYNCPT_REGISTER_EVENT ===
=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
Identical to Linux driver.
struct {
struct {
__in u32 event_slot; // ranges from 0x00 to 0x3F
__in u32 id;
__in u32 lock; // (0==unlock; 1==lock)
};
};
=== NVHOST_IOCTL_CTRL_SYNCPT_UNREGISTER_EVENT ===
=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
Identical to Linux driver. Uses 32-bit version and doesn't work.
struct {
struct {
__in u32 event_slot; // ranges from 0x00 to 0x3F
__in u32 id;
__in u32 num_offsets;
__in u32 block_size;
__in u32 offsets;
__in u32 values;
__in u32 write;
};
};
=== NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENTS ===
=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
Identical to Linux driver.
struct {
struct {
__in u64 events; // 64-bit bitfield where each bit represents one event
__in u32 id;
__in u32 thresh;
__in s32 timeout;
__out u32 value;
};
};
=== NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL ===
=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
Identical to Linux driver.
struct {
struct {
__out u32 max_channel; // 0x00 (FIFO disabled) or 0x60 (FIFO enabled)
__in u32 id;
__out u32 value;
};
=== NVHOST_IOCTL_CTRL_GET_CONFIG ===
Returns configured settings. Not available in production mode.
struct {
__in char name[0x41]; // "nv"
__in char key[0x41];
__out char value[0x101];
};
};
== /dev/nvmap ==
=== NVHOST_IOCTL_CTRL_SYNCPT_CLEAR_EVENT_WAIT ===
Clears the wait signal of a syncpt event.
struct {
__in u32 event_id; // 0x00 to 0x3F
};
=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT ===
Waits on a syncpt using events. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to (((('''id''' & 0xFFF) << 0x10) | 0x10000000) | '''event_id''').
|-
| 0xC0200104 || Inout || 32 || [[#NVMAP_IOC_ALLOC]]
struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
__out u32 value;
};
=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT_EVENT_SINGLE ===
Waits on a syncpt using a specific event. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to (('''id''' * 0x10) | '''event_id''').
| 0xC00C0109 || Inout || 12 || [[#NVMAP_IOC_PARAM]]
struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
__inout u32 value; // in=event_id; out=syncpt_value
};
=== NVHOST_IOCTL_CTRL_SYNCPT_ALLOC_EVENT ===
Allocates a new syncpt event.
struct {
__in u32 event_id; // 0x00 to 0x3F
};
=== NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT ===
Frees an existing syncpt event.
struct {
__in u32 event_id; // 0x00 to 0x3F
};
=== NVMAP_IOC_CREATE ===
=== NVHOST_IOCTL_CTRL_SYNCPT_FREE_EVENT_BATCH ===
Frees multiple syncpt events.
struct {
struct {
__in u32 size;
__in u64 event_id_mask; // 64-bit bitfield where each bit represents one event
};
};
=== NVMAP_IOC_CLAIM ===
=== NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL ===
If event FIFO is enabled, returns the maximum channel number.
struct {
struct {
__out u32 max_channel; // 0x00 (FIFO disabled) or 0x60 (FIFO enabled)
__out u32 handle;
};
};
=== NVMAP_IOC_ALLOC ===
== /dev/nvmap ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0xC0080101 || Inout || 8 || [[#NVMAP_IOC_CREATE]]
|-
| 0x00000102 || - || 0 || [[#NVMAP_IOC_CLAIM]]
|-
| 0xC0080103 || Inout || 8 || [[#NVMAP_IOC_FROM_ID]]
|-
| 0xC0200104 || Inout || 32 || [[#NVMAP_IOC_ALLOC]]
|-
| 0xC0180105 || Inout || 24 || [[#NVMAP_IOC_FREE]]
|-
| 0xC0280106 || Inout || 40 || [[#NVMAP_IOC_MMAP]]
|-
| 0xC0280107 || Inout || 40 || [[#NVMAP_IOC_WRITE]]
|-
| 0xC0280108 || Inout || 40 || [[#NVMAP_IOC_READ]]
|-
| 0xC00C0109 || Inout || 12 || [[#NVMAP_IOC_PARAM]]
|-
| 0xC010010A || Inout || 16 || [[#NVMAP_IOC_PIN_MULT]]
|-
| 0xC010010B || Inout || 16 || [[#NVMAP_IOC_UNPIN_MULT]]
|-
| 0xC008010C || Inout || 8 || [[#NVMAP_IOC_CACHE]]
|-
| 0xC004010D || Inout || 4 || [[#NVMAP_IOC_GET_IVC_ID]]
|-
| 0xC008010E || Inout || 8 || [[#NVMAP_IOC_GET_ID]]
|-
| 0xC004010F || Inout || 4 || [[#NVMAP_IOC_FROM_IVC_ID]]
=== NVMAP_IOC_PARAM ===
|-
| 0x40040110 || In || 4 || [[#NVMAP_IOC_SET_ALLOCATION_TAG_LABEL]]
|-
| 0x00000111 || - || 0 || [[#NVMAP_IOC_RESERVE]]
|-
| 0x40100112 || In || 16 || [[#NVMAP_IOC_EXPORT_FOR_ARUID]]
|-
| 0x40100113 || In || 16 || [[#NVMAP_IOC_IS_OWNED_BY_ARUID]]
|-
| 0x40100114 || In || 16 || [[#NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID]]
|}
=== NVMAP_IOC_CREATE ===
Creates an nvmap object. Identical to Linux driver.
struct {
struct {
__in u32 handle;
__in u32 size;
__out u32 handle;
__out u32 result;
};
};
=== NVMAP_IOC_PIN_MULT ===
=== NVMAP_IOC_CLAIM ===
Returns [[#Errors|NotSupported]].
Returns [[#Errors|NotSupported]].
=== NVMAP_IOC_UNPIN_MULT ===
=== NVMAP_IOC_FROM_ID ===
Get handle to an existing nvmap object. Identical to Linux driver.
=== NVMAP_IOC_CACHE ===
struct {
__in u32 id;
__out u32 handle;
};
=== NVMAP_IOC_ALLOC ===
Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.
=== NVMAP_IOC_GET_IVC_ID ===
struct {
__in u32 handle;
__in u32 heapmask;
__in u32 flags; // (0=read-only, 1=read-write)
__inout u32 align;
__in u8 kind;
u8 pad[7];
__in u64 addr;
};
=== NVMAP_IOC_GET_ID ===
=== NVMAP_IOC_FREE ===
This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.
struct {
struct {
__in u32 handle;
__in u32 handle;
u32 pad;
__out u64 address; // 0 if the handle wasn't yet freed
__out u32 size;
__out u32 flags; // 1=WAS_UNCACHED (if flags bit 1 was set when NVMAP_IOC_ALLOC was called)
};
};
=== NVMAP_IOC_FROM_IVC_ID ===
=== NVMAP_IOC_MMAP ===
Returns [[#Errors|NotSupported]].
Returns [[#Errors|NotSupported]].
=== NVMAP_IOC_SET_ALLOCATION_TAG_LABEL ===
=== NVMAP_IOC_WRITE ===
Returns [[#Errors|NotSupported]].
Returns [[#Errors|NotSupported]].
=== NVMAP_IOC_RESERVE ===
=== NVMAP_IOC_READ ===
Returns [[#Errors|NotSupported]].
Returns [[#Errors|NotSupported]].
=== NVMAP_IOC_EXPORT_FOR_ARUID ===
=== NVMAP_IOC_PARAM ===
Returns info about a nvmap object. Identical to Linux driver, but extended with further params.
struct {
struct {
__in u32 handle;
__in u32 handle;
__in u32 param; // 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
__out u32 result;
};
};
=== NVMAP_IOC_IS_OWNED_BY_ARUID ===
=== NVMAP_IOC_PIN_MULT ===
Returns [[#Errors|NotSupported]].
=== NVMAP_IOC_UNPIN_MULT ===
Returns [[#Errors|NotSupported]].
=== NVMAP_IOC_CACHE ===
Returns [[#Errors|NotSupported]].
=== NVMAP_IOC_GET_IVC_ID ===
Returns [[#Errors|NotSupported]].
=== NVMAP_IOC_GET_ID ===
Returns an id for a nvmap object. Identical to Linux driver.
struct {
struct {
__out u32 id; //~0 indicates error
__in u32 handle;
__in u32 handle;
};
};
=== NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID ===
=== NVMAP_IOC_FROM_IVC_ID ===
Unbinds a nvmap object from an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].
Returns [[#Errors|NotSupported]].
=== NVMAP_IOC_SET_ALLOCATION_TAG_LABEL ===
Returns [[#Errors|NotSupported]].
=== NVMAP_IOC_RESERVE ===
Returns [[#Errors|NotSupported]].
=== NVMAP_IOC_EXPORT_FOR_ARUID ===
Binds a nvmap object to an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].
struct {
__in u64 aruid;
__in u32 handle;
u8 pad[4];
};
=== NVMAP_IOC_IS_OWNED_BY_ARUID ===
Checks if a nvmap object is bound to an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].
struct {
__in u64 aruid;
__in u32 handle;
u8 pad[4];
};
=== NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID ===
Unbinds a nvmap object from an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].
struct {
struct {
| 0xC004021F || Inout || 4 || NVDISP_GET_WINMASK
| 0xC004021F || Inout || 4 || NVDISP_GET_WINMASK
|-
|-
| 0x80080221 || Out || 8 || [10.0.0+] NVDISP_GET_BACKLIGHT_RANGE
| 0x80080221 || Out || 8 || [10.0.0+] [[#NVDISP_GET_BACKLIGHT_RANGE]]
|-
|-
| 0x40040222 || In || 4 || [10.0.0+] NVDISP_SET_BACKLIGHT
| 0x40040222 || In || 4 || [10.0.0+] [[#NVDISP_SET_BACKLIGHT]]
|-
|-
| 0x40040223 || In || 4 || [11.0.0+] NVDISP_SEND_PANEL_MSG
| 0x40040223 || In || 4 || [11.0.0+]
|-
|-
| 0x401C0225 || In || 28 || [11.0.0+] NVDISP_SEND_PANEL_MSG_EX
| 0x401C0225 || In || 28 || [11.0.0+] [[#NVDISP_SEND_PANEL_MSG]]
|-
|-
| 0xC01C0226 || Inout || 28 || [11.0.0+] NVDISP_GET_PANEL_DATA
| 0xC01C0226 || Inout || 28 || [11.0.0+] [[#NVDISP_GET_PANEL_DATA]]
|}
|}
== /dev/nvcec-ctrl ==
=== NVDISP_GET_BACKLIGHT_RANGE ===
Returns the minimum and maximum values for the intensity of the display's backlight.
struct {
__out u32 min;
__out u32 max;
};
=== NVDISP_SET_BACKLIGHT ===
Sets the value for the intensity of the display's backlight.
struct {
__in u32 val;
};
=== NVDISP_SEND_PANEL_MSG ===
Sends raw data to the display panel over DPAUX.
struct {
__in u32 cmd; // DPAUX AUXCTL command (1=unk, 2=I2CWR, 4=MOTWR, 7=AUXWR)
__in u32 addr; // DPAUX AUXADDR
__in u32 size; // message size
__in u32 msg[4]; // raw AUXDATA message
};
=== NVDISP_GET_PANEL_DATA ===
Receives raw data from the display panel over DPAUX.
struct {
__in u32 cmd; // DPAUX AUXCTL command (3=I2CRD, 5=MOTRD, 6=AUXRD)
__in u32 addr; // DPAUX AUXADDR
__in u32 size; // message size
__out u32 msg[4]; // raw AUXDATA message
};
== /dev/nvcec-ctrl ==
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Value || Direction || Size || Description
! Value || Direction || Size || Description
| 0xC0F40508 || Inout || 244 || NVDCUTIL_DSI_PACKET_TEST_READ
| 0xC0F40508 || Inout || 244 || NVDCUTIL_DSI_PACKET_TEST_READ
|-
|-
| 0x40010509 || In || 1 || [10.0.0+] NVDCUTIL_DP_ELEC_TEST_MODE_ENABLE
| 0x40010509 || In || 1 || [10.0.0+] NVDCUTIL_DP_ELECTRIC_TEST_EN
|-
|-
| 0xC020050A || Inout || 32 || [10.0.0+] NVDCUTIL_DP_ELEC_TEST_SETTINGS
| 0xC020050A || Inout || 32 || [10.0.0+] NVDCUTIL_DP_ELECTRIC_TEST_SETTINGS
|-
|-
| 0x8070050B || Out || 112 || [11.0.0+] NVDCUTIL_DP_CONF_READ
| 0x8070050B || Out || 112 || [11.0.0+] NVDCUTIL_DP_CONF_READ
struct {
struct {
__in u32 fence_id;
__in u32 fence_id;
__in u32 fence_thresh;
__in u32 fence_value;
__in u32 swap_interval;
__in u32 swap_interval;
};
};
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_ALLOC_AS_EX]]
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_ALLOC_AS_EX]]
|-
|-
| 0xC038410A || Inout || 56 || [[#NVGPU_AS_IOCTL_MODIFY]]
| 0xC038410A || Inout || 56 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX2]]
|-
|-
| 0xC0??4114 || Inout || Variable || [[#NVGPU_AS_IOCTL_REMAP]]
| 0xC0??4114 || Inout || Variable || [[#NVGPU_AS_IOCTL_REMAP]]
=== NVGPU_AS_IOCTL_MAP_BUFFER ===
=== NVGPU_AS_IOCTL_MAP_BUFFER ===
Maps a memory region in the device address space. Identical to Linux driver pretty much.
Maps a memory region in the device address space.
Unaligned size will cause a [[#Panic]].
On success, the mapped memory region is granted the [[SVC#MemoryAttribute|DeviceShared]] attribute.
On success, the mapped memory region is granted the [[SVC#MemoryAttribute|DeviceShared]] attribute.
struct {
struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
u32 reserved;
u32 reserved0;
__in u32 dmabuf_fd; // nvmap handle
__in u32 mem_id; // nvmap handle
u32 reserved1;
union {
union {
__out u64 offset;
__out u64 offset;
struct {
struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__inout u32 kind; // -1 is default
__in u32 dmabuf_fd; // nvmap handle
__in u32 mem_id; // nvmap handle
u32 reserved;
__in u64 buffer_offset;
__in u64 buffer_offset;
__in u64 mapping_size;
__in u64 mapping_size;
union {
__out u64 offset;
__in u64 align;
};
};
};
=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
Nintendo's custom implementation to get rid of pointer in struct.
Nintendo's custom implementation to get rid of pointer in struct.
Uses [[#Ioctl3|Ioctl3]].
struct va_region {
struct va_region {
};
};
=== NVGPU_AS_IOCTL_MODIFY ===
=== NVGPU_AS_IOCTL_MAP_BUFFER_EX2 ===
Maps a memory region in the device address space with extra params.
Unaligned size will cause a [[#Panic]].
On success, the mapped memory region is granted the [[SVC#MemoryAttribute|DeviceShared]] attribute.
struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__inout u32 kind; // -1 is default
__in u32 dmabuf_fd; // nvmap handle
__in u32 mem_id; // nvmap handle
u32 reserved0;
__in u64 buffer_offset;
__in u64 buffer_offset;
__in u64 mapping_size;
__in u64 mapping_size;
union {
__in u64 unk0;
__out u64 offset;
__in u32 unk1;
__in u64 align;
u32 reserved;
};
__in u64 vma_addr;
__in u32 pages;
u32 reserved1;
};
};
=== NVGPU_AS_IOCTL_REMAP ===
=== NVGPU_AS_IOCTL_REMAP ===
Nintendo's custom implementation of address space remapping.
Nintendo's custom implementation of address space remapping for sparse pages.
struct remap_op {
struct remap_op {
__in u16 flags; // 0 or 4
__in u16 flags; // bit2: cacheable
__in u16 kind;
__in u16 kind;
__in u32 mem_handle;
__in u32 mem_handle;
__in u32 mem_offset_in_pages;
__in u32 mem_offset_in_pages;
__in u32 virt_offset_in_pages; // (alloc_space_offset >> 0x10)
__in u32 virt_offset_in_pages; // (alloc_space_offset >> 0x10)
__in u32 num_pages; // alloc_space_pages
__in u32 num_pages; // alloc_space_pages
};
};
|-
|-
| 0xC020441B || Inout || 32 || [11.0.0+]
| 0xC020441B || Inout || 32 || [11.0.0+]
|-
| 0xC084441C || Inout || 132 || [11.0.0+]
|-
| 0xC018441D || Inout || 24 || [11.0.0+]
|-
|-
| 0xC020441E || Inout || 32 || [11.0.0+]
| 0xC020441E || Inout || 32 || [11.0.0+]
};
};
= Channels =
Channels are a concept for NVIDIA hardware blocks that share a common interface.
Channels are a concept for NVIDIA hardware blocks that share a common interface.
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|}
|}
== Channel Ioctls ==
== Ioctls ==
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Value || Size || Description
! Value || Size || Description
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]]
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]]
|-
|-
| 0xC018481B || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX]]
| 0xC018481B || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2]]
|-
|-
| 0xC018481C || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY_EX]]
| 0xC018481C || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2_RETRY]]
|-
|-
| 0xC004481D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_TIMESLICE]]
| 0xC004481D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_TIMESLICE]]
u32 syncpt_id;
u32 syncpt_id;
u32 syncpt_incrs;
u32 syncpt_incrs;
u32 reserved[3];
u32 id;
};
};
__in struct reloc_shift reloc_shifts[]; // depends on num_relocs
__in struct reloc_shift reloc_shifts[]; // depends on num_relocs
__in struct syncpt_incr syncpt_incrs[]; // depends on num_syncpt_incrs
__in struct syncpt_incr syncpt_incrs[]; // depends on num_syncpt_incrs
__out struct fence fences[]; // depends on num_fences
__out u32 fence_thresholds[]; // depends on num_fences
};
};
struct fence {
struct fence {
u32 id;
u32 id;
u32 thresh;
u32 value;
};
};
struct gpfifo_entry {
struct gpfifo_entry {
u32 entry0; // gpu_iova_lo
u32 entry1; // gpu_iova_hi | (allow_flush << 8) | (is_push_buf << 9) | (size << 10) | (sync << 31)
};
};
__in u64 gpfifo; // (ignored) pointer to gpfifo fence structs
__in u64 gpfifo; // (ignored) pointer to gpfifo fence structs
__in u32 num_entries; // number of fence objects being submitted
__in u32 num_entries; // number of fence objects being submitted
__in u32 flags;
union {
__out u32 detailed_error;
__in u32 flags;
};
__inout struct fence fence_out; // returned new fence object for others to wait on
__inout struct fence fence_out; // returned new fence object for others to wait on
__in struct gpfifo_entry entries[]; // depends on num_entries
__in struct gpfifo_entry entries[]; // depends on num_entries
struct fence {
struct fence {
u32 id;
u32 id;
u32 thresh;
u32 value;
};
};
Same as [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX|NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]].
Same as [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX|NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]].
=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX ===
=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2 ===
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]], but uses [[#Ioctl2|Ioctl2]].
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]], but uses [[#Ioctl2|Ioctl2]].
=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY_EX ===
=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO2_RETRY ===
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]], but uses [[#Ioctl2|Ioctl2]].
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]], but uses [[#Ioctl2|Ioctl2]].
};
};
= nvmemp =
= NvDrvPermission =
This is "nv::MemoryProfiler::IMemoryProfiler".
This is "nns::nvdrv::NvDrvPermission".
{| class="wikitable" border="1"
{| class="wikitable" border="1"
! Bits
! Name
! Description
|-
|-
| 0
| Gpu
| Can access [[#Channels|/dev/nvhost-gpu]], [[#/dev/nvhost-ctrl-gpu|/dev/nvhost-ctrl-gpu]] and [[#/dev/nvhost-as-gpu|/dev/nvhost-as-gpu]].
|-
|-
| 0 || Open
| 1
| GpuDebug
| Can access [[#/dev/nvhost-dbg-gpu|/dev/nvhost-dbg-gpu]] and [[#/dev/nvhost-prof-gpu|/dev/nvhost-prof-gpu]].
|-
|-
| 1 || GetPid
| 2
|}
| GpuSchedule
| Can access [[#/dev/nvsched-ctrl|/dev/nvsched-ctrl]].
|-
|-
| 3
| VIC
| Can access [[#Channels|/dev/nvhost-vic]].
|-
|-
| 0 || [[#OpenDebugFS]]
| 4
| VideoEncoder
| Can access [[#Channels|/dev/nvhost-msenc]].
|-
|-
| 1 || [[#CloseDebugFS]]
| 5
| VideoDecoder
| Can access [[#Channels|/dev/nvhost-nvdec]].
|-
|-
| 2 || [[#GetDebugFSKeys]]
| 6
| TSEC
| Can access [[#Channels|/dev/nvhost-tsec]].
|-
|-
| 3 || GetDebugFSValue
| 7
| JPEG
| Can access [[#Channels|/dev/nvhost-nvjpg]].
|-
|-
| 4 || SetDebugFSValue
| 8
|}
| Display
| Can access [[#Channels|/dev/nvhost-display]], [[#/dev/nvcec-ctrl|/dev/nvcec-ctrl]], [[#/dev/nvhdcp_up-ctrl|/dev/nvhdcp_up-ctrl]], [[#/dev/nvdisp-ctrl|/dev/nvdisp-ctrl]], [[#/dev/nvdisp-disp0, /dev/nvdisp-disp1|/dev/nvdisp-disp0]], [[#/dev/nvdisp-disp0, /dev/nvdisp-disp1|/dev/nvdisp-disp1]], [[#/dev/nvdcutil-disp0, /dev/nvdcutil-disp1|/dev/nvdcutil-disp0]] and [[#/dev/nvdcutil-disp0, /dev/nvdcutil-disp1|/dev/nvdcutil-disp1]].
|-
|-
| 9
| ImportMemory
| Can duplicate [[#/dev/nvmap|nvmap]] handles from other processes with [[#NVMAP_IOC_FROM_ID|NVMAP_IOC_FROM_ID]].
|-
|-
| 0 || Initialize
| 10
| NoCheckedAruid
| Can use [[#SetAruidWithoutCheck|SetAruidWithoutCheck]].
|-
|-
| 1 || GetEventHandle
| 11
|
| Can use [[#SetGraphicsFirmwareMemoryMarginEnabled|SetGraphicsFirmwareMemoryMarginEnabled]].
|-
|-
| 2 || ControlNotification
| 12
|
| Can duplicate exported [[#/dev/nvmap|nvmap]] handles from other processes with [[#NVMAP_IOC_FROM_ID|NVMAP_IOC_FROM_ID]].
|-
|-
| 3 || SetNotificationPerm
| 13
|
| Can use the GPU virtual address range 0xC0000 to 0x580000 instead of 0x0 to 0xC0000.
|-
|-
| 4 || SetCoreDumpPerm
| 14
|
| Can use [[#NVMAP_IOC_EXPORT_FOR_ARUID|NVMAP_IOC_EXPORT_FOR_ARUID]] and [[#NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID|NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID]].
|-
|-
| 5 || [1.0.0-4.1.0] GetAruid
| 15
|-
|
| Can use the virtual address ranges 0x0 to 0x100000000 (GPU) and 0x0 to 0xE0000000 (non-GPU) instead of 0x100000000 to 0x11FA50000 (GPU) and 0xE0000000 to 0xFFFE0000 (non-GPU).
|}
|}
= nvgem:cd =
= NvError =
This is "nv::gemcoredump::INvGemCoreDump".
This is "nns::nvdrv::NvError".
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Cmd || Name
! Value || Name
|-
|-
| 0 || Initialize
| 0x0 || Success
|-
|-
| 1 || GetAruid
| 0x1 || NotImplemented
|-
|-
| 2 || [1.0.0-8.1.0] ReadNextBlock
| 0x2 || NotSupported
|-
|-
| 3 || [8.0.0+]
| 0x3 || NotInitialized
|-
|-
| 4 || [8.0.0+]
| 0x4 || BadParameter
|-
|-
| 0x5 || Timeout
|-
|-
| 0x0 || NvError_Success
| 0x6 || InsufficientMemory
|-
|-
| 0x1 || NvError_NotImplemented
| 0x7 || ReadOnlyAttribute
|-
|-
| 0x2 || NvError_NotSupported
| 0x8 || InvalidState
|-
|-
| 0x3 || NvError_NotInitialized
| 0x9 || InvalidAddress
|-
|-
| 0x4 || NvError_BadParameter
| 0xA || InvalidSize
|-
|-
| 0x5 || NvError_Timeout
| 0xB || BadValue
|-
|-
| 0x6 || NvError_InsufficientMemory
| 0xD || AlreadyAllocated
|-
|-
| 0x7 || NvError_ReadOnlyAttribute
| 0xE || Busy
|-
|-
| 0x8 || NvError_InvalidState
| 0xF || ResourceError
|-
|-
| 0x9 || NvError_InvalidAddress
| 0x10 || CountMismatch
|-
|-
| 0xA || NvError_InvalidSize
| 0x11 || OverFlow
|-
|-
| 0xB || NvError_BadValue
| 0x1000 || InsufficientTransferMemory
|-
|-
| 0xD || NvError_AlreadyAllocated
| 0x10000 || InsufficientVideoMemory
|-
|-
| 0xE || NvError_Busy
| 0x10001 || BadSurfaceColorScheme
|-
|-
| 0xF || NvError_ResourceError
| 0x10002 || InvalidSurface
|-
|-
| 0x10 || NvError_CountMismatch
| 0x10003 || SurfaceNotSupported
|-
|-
| 0x11 || NvError_OverFlow
| 0x20000 || DispInitFailed
|-
|-
| 0x1000 || NvError_InsufficientTransferMemory
| 0x20001 || DispAlreadyAttached
|-
|-
| 0x10000 || NvError_InsufficientVideoMemory
| 0x20002 || DispTooManyDisplays
|-
|-
| 0x10001 || NvError_BadSurfaceColorScheme
| 0x20003 || DispNoDisplaysAttached
|-
|-
| 0x10002 || NvError_InvalidSurface
| 0x20004 || DispModeNotSupported
|-
|-
| 0x10003 || NvError_SurfaceNotSupported
| 0x20005 || DispNotFound
|-
|-
| 0x20000 || NvError_DispInitFailed
| 0x20006 || DispAttachDissallowed
|-
|-
| 0x20001 || NvError_DispAlreadyAttached
| 0x20007 || DispTypeNotSupported
|-
|-
| 0x20002 || NvError_DispTooManyDisplays
| 0x20008 || DispAuthenticationFailed
|-
|-
| 0x20003 || NvError_DispNoDisplaysAttached
| 0x20009 || DispNotAttached
|-
|-
| 0x20004 || NvError_DispModeNotSupported
| 0x2000A || DispSamePwrState
|-
|-
| 0x20005 || NvError_DispNotFound
| 0x2000B || DispEdidFailure
|-
|-
| 0x20006 || NvError_DispAttachDissallowed
| 0x2000C || DispDsiReadAckError
|-
|-
| 0x20007 || NvError_DispTypeNotSupported
| 0x2000D || DispDsiReadInvalidResp
|-
|-
| 0x20008 || NvError_DispAuthenticationFailed
| 0x30000 || FileWriteFailed
|-
|-
| 0x20009 || NvError_DispNotAttached
| 0x30001 || FileReadFailed
|-
|-
| 0x2000A || NvError_DispSamePwrState
| 0x30002 || EndOfFile
|-
|-
| 0x2000B || NvError_DispEdidFailure
| 0x30003 || FileOperationFailed
|-
|-
| 0x2000C || NvError_DispDsiReadAckError
| 0x30004 || DirOperationFailed
|-
|-
| 0x2000D || NvError_DispDsiReadInvalidResp
| 0x30005 || EndOfDirList
|-
|-
| 0x30000 || NvError_FileWriteFailed
| 0x30006 || ConfigVarNotFound
|-
|-
| 0x30001 || NvError_FileReadFailed
| 0x30007 || InvalidConfigVar
|-
|-
| 0x30002 || NvError_EndOfFile
| 0x30008 || LibraryNotFound
|-
|-
| 0x30003 || NvError_FileOperationFailed
| 0x30009 || SymbolNotFound
|-
|-
| 0x30004 || NvError_DirOperationFailed
| 0x3000A || MemoryMapFailed
|-
|-
| 0x30005 || NvError_EndOfDirList
| 0x3000F || IoctlFailed
|-
|-
| 0x30006 || NvError_ConfigVarNotFound
| 0x30010 || AccessDenied
|-
|-
| 0x30007 || NvError_InvalidConfigVar
| 0x30011 || DeviceNotFound
|-
|-
| 0x30008 || NvError_LibraryNotFound
| 0x30012 || KernelDriverNotFound
|-
|-
| 0x30009 || NvError_SymbolNotFound
| 0x30013 || FileNotFound
|-
|-
| 0x3000A || NvError_MemoryMapFailed
| 0x30014 || PathAlreadyExists
|-
|-
| 0x3000F || NvError_IoctlFailed
| 0xA000E || ModuleNotPresent
|}
= NvDrvStatus =
This is "nns::nvdrv::NvDrvStatus".
{| class="wikitable" border="1"
|-
|-
! Offset
! Size
! Description
|-
|-
| 0x30011 || NvError_DeviceNotFound
| 0x0
| 0x4
| FreeSize
|-
|-
| 0x30012 || NvError_KernelDriverNotFound
| 0x4
| 0x4
| AllocatableSize
|-
|-
| 0x30013 || NvError_FileNotFound
| 0x8
| 0x4
| MinimumFreeSize
|-
|-
| 0x30014 || NvError_PathAlreadyExists
| 0xC
| 0x4
| MinimumAllocatableSize
|-
|-
| 0xA000E || NvError_ModuleNotPresent
| 0x10
| 0x10
| Reserved
|}
|}
= Panic =
= Notes =
In some cases, a panic may occur. NV forces a crash by doing:
In some cases, a panic may occur. NV forces a crash by doing:
(void *)0 = 0xCAFE;
(void *)0 = 0xCAFE;
End result is that the system hangs with a white-screen.
End result is that the system hangs with a white-screen.
When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.
When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.
[[Category:Services]]
[[Category:Services]]