Nintendo Switch Brew - User contributions [en]

Shared Database services

2019-04-17T07:50:14Z

Hthh:

= pl:u =
This is "nn::pl::detail::ISharedFontManager".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestLoad]]
|-
| 1 || [[#GetLoadState]]
|-
| 2 || [[#GetSize]]
|-
| 3 || [[#GetSharedMemoryAddressOffset]]
|-
| 4 || [[#GetSharedMemoryNativeHandle]]
|-
| 5 || [[#GetSharedFontInOrderOfPriority]]
|-
| 6 || [4.0.0+] GetSharedFontInOrderOfPriorityForSystem
|-
| 100 || [8.0.0+]
|-
| 101 || [8.0.0+]
|}

== RequestLoad ==
Takes a [[#SharedFontType]] (uint32), no output.

== GetLoadState ==
Takes a [[#SharedFontType]] (uint32), returns the [[#LoadState]] (uint32).

=== LoadState ===
{| class="wikitable" border="1"
|-
! Value || Description
|-
| 0x00 || Loading
|-
| 0x01 || Loaded
|}

== GetSize ==
Takes a [[#SharedFontType]] (uint32), returns the Font Size (uint32).

== GetSharedMemoryAddressOffset ==
Takes a [[#SharedFontType]] (uint32), returns the offset (uint32) to the Font Address.

== GetSharedMemoryNativeHandle ==
No input, returns an output SharedMemory handle.

User-processes map this SharedMemory with size=0x1100000 and permissions=R--.

Font data is TTF, located at the offset returned by [[#GetSharedMemoryAddressOffset]].

== GetSharedFontInOrderOfPriority ==
Takes an input u64 [[Settings_services#LanguageCode|LanguageCode]] and 3 type-0x6 output buffers, returns an output u8 and u32. The u8 is a bool to specify if the fonts are loaded or not and the u32 is the font count.
The first buffer contains a list of [[#SharedFontType|Shared font types]], the second buffer contains the font offsets and the final buffer contains the font sizes.
The buffers are an array of u32s which specify information about a specific font. Buffer1[n] is related to Buffer2[n] and Buffer3[n].
Example: Font index 0s offset is at Buffer2[0], size is at Buffer3[0].
The fonts are relative to the shared memory created by [[#GetSharedMemoryNativeHandle]]

== SharedFontType ==
{| class="wikitable" border="1"
|-
! Value || Description
|-
| 0x00 || Japan, US and Europe (Standard)
|-
| 0x01 || Chinese Simplified
|-
| 0x02 || Extended Chinese Simplified
|-
| 0x03 || Chinese Traditional
|-
| 0x04 || Korean (Hangul)
|-
| 0x05 || Nintendo Extended
|}

* Nintendo Extended: Contains Nintendo-specific characters, including HID buttons, HID controller styles, applet icons, Wii(U) icons, etc.

= mii:u, mii:e =
This is "nn::mii::detail::IStaticService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetDatabaseService
|}

== IDatabaseService ==
This is "nn::mii::detail::IDatabaseService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsUpdated
|-
| 1 || IsFullDatabase
|-
| 2 || GetCount
|-
| 3 || Get
|-
| 4 || Get1
|-
| 5 || UpdateLatest
|-
| 6 || BuildRandom
|-
| 7 || BuildDefault
|-
| 8 || Get2
|-
| 9 || Get3
|-
| 10 || UpdateLatest1
|-
| 11 || FindIndex
|-
| 12 || Move
|-
| 13 || AddOrReplace
|-
| 14 || Delete
|-
| 15 || DestroyFile
|-
| 16 || DeleteFile
|-
| 17 || Format
|-
| 18 || Import
|-
| 19 || Export
|-
| 20 || IsBrokenDatabaseWithClearFlag
|-
| 21 || GetIndex
|-
| 22 || [5.0.0+] SetInterfaceVersion
|-
| 23 || [5.0.0+] Convert
|-
| 24 || [7.0.0+] ConvertCoreDataToCharInfo
|-
| 25 || [7.0.0+] ConvertCharInfoToCoreData
|}

= miiimg =
This is "nn::mii::detail::IImageDatabaseService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Initialize
|-
| 10 || Reload
|-
| 11 || GetCount
|-
| 12 || IsEmpty
|-
| 13 || IsFull
|-
| 14 || GetAttribute
|-
| 15 || LoadImage
|-
| 16 || AddOrUpdateImage
|-
| 17 || DeleteImages
|-
| 100 || DeleteFile
|-
| 101 || DestroyFile
|-
| 102 || ImportFile
|-
| 103 || ExportFile
|-
| 104 || ForceInitialize
|}

= pdm:ntfy =
This is "nn::pdm::detail::INotifyService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 2 ||
|-
| 3 ||
|-
| 4 ||
|-
| 5 ||
|-
| 6 ||
|-
| 7 ||
|-
| 8 || [6.0.0+]
|-
| 9 || [8.0.0+]
|}

= pdm:qry =
This is "nn::pdm::detail::IQueryService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| [1.0.0-6.2.0] 1 ||
|-
| [1.0.0-6.2.0] 2 ||
|-
| [1.0.0-6.2.0] 3 ||
|-
| 4 ||
|-
| 5 ||
|-
| [1.0.0-6.2.0] 6 ||
|-
| 7 ||
|-
| 8 ||
|-
| 9 ||
|-
| 10 ||
|-
| 11 ||
|-
| 12 ||
|-
| 13 ||
|-
| 14 || [6.0.0+]
|-
| 15 || [6.0.0+]
|-
| 16 || [6.0.0+]
|}

= avm =
This is "nn::avm::srv::IAvmService".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 100 ||
|-
| 101 ||
|-
| 102 ||
|-
| 103 || No input, returns an [[#IVersionListImporter]].
|-
| 200 ||
|-
| 202 ||
|-
| 1000 ||
|-
| 1001 ||
|-
| 1002 ||
|}

== IVersionListImporter ==
This is "nn::avm::srv::IVersionListImporter".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|}

[[Category:Services]]

BCAT services

2019-04-16T03:08:59Z

Hthh:

BCAT (Background Content Asymmetric synchronized delivery and Transmission) encompasses a set of content download/upload related services.

= bcat:a, bcat:m, bcat:u, bcat:s =
These are "nn::bcat::detail::ipc::IServiceCreator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateBcatService
|-
| 1 || CreateDeliveryCacheStorageService
|-
| 2 || CreateDeliveryCacheStorageServiceWithApplicationId
|}

Equivalent to 3DS BOSS(SpotPass). See [[BCAT_Content_Container|here]] for BCAT-content-container.

== IBcatService ==
This is "nn::bcat::detail::ipc::IBcatService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 10100 || RequestSyncDeliveryCache
|-
| 10101 || [5.0.0+] RequestSyncDeliveryCacheWithDirectoryName
|-
| 10200 || [5.0.0+] CancelSyncDeliveryCacheRequest
|-
| 20100 || RequestSyncDeliveryCacheWithApplicationId
|-
| 20101 || [5.0.0+] RequestSyncDeliveryCacheWithApplicationIdAndDirectoryName
|-
| 20300 || [8.0.0+] ? (Takes a total of 8-bytes of input, returns an [[#INotifierService]])
|-
| 20301 || [8.0.0+] ? (Takes a total of 8-bytes of input, returns an [[#IDeliveryTaskSuspensionService]])
|-
| 30100 || SetPassphrase
|-
| 30200 || RegisterBackgroundDeliveryTask
|-
| 30201 || UnregisterBackgroundDeliveryTask
|-
| 30202 || BlockDeliveryTask
|-
| 30203 || UnblockDeliveryTask
|-
| 30300 || [8.0.0+]
|-
| 90100 || EnumerateBackgroundDeliveryTask
|-
| 90200 || GetDeliveryList
|-
| 90201 || ClearDeliveryCacheStorage
|-
| 90202 || [8.0.0+]
|-
| 90300 || GetPushNotificationLog
|}

=== IDeliveryCacheProgressService ===
This is "nn::bcat::detail::ipc::IDeliveryCacheProgressService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetEvent
|-
| 1 || GetImpl
|}

== IDeliveryCacheStorageService ==
This is "nn::bcat::detail::ipc::IDeliveryCacheStorageService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateFileService
|-
| 1 || CreateDirectoryService
|-
| 10 || EnumerateDeliveryCacheDirectory
|}

=== IDeliveryCacheFileService ===
This is "nn::bcat::detail::ipc::IDeliveryCacheFileService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Open
|-
| 1 || Read
|-
| 2 || GetSize
|-
| 3 || GetDigest
|}

=== IDeliveryCacheDirectoryService ===
This is "nn::bcat::detail::ipc::IDeliveryCacheDirectoryService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Open
|-
| 1 || Read
|-
| 2 || GetCount
|}

=== INotifierService ===
This is "nn::bcat::detail::ipc::INotifierService".

Added with [8.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || ||
|-
|}

=== IDeliveryTaskSuspensionService ===
This is "nn::bcat::detail::ipc::IDeliveryTaskSuspensionService".

Added with [8.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || ||
|-
|}

= <nowiki>news:a, news:c, news:m, news:p, news:v</nowiki> =
These are <nowiki>"nn::news::detail::ipc::IServiceCreator"</nowiki>.

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || || No input, returns an [[#INewsService]].
|-
| 1 || || No input, returns an [[#INewlyArrivedEventHolder]].
|-
| 2 || || No input, returns an [[#INewsDataService]].
|-
| 3 || || No input, returns an [[#INewsDatabaseService]].
|-
| 4 || || No input, returns an [[#IOverwriteEventHolder]].
|}

== INewsService ==
This is <nowiki>"nn::news::detail::ipc::INewsService"</nowiki>.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 10100 ||
|-
| 20100 ||
|-
| 30100 ||
|-
| 30101 ||
|-
| 30110 || [6.0.0+]
|-
| 30200 ||
|-
| 30201 || [8.0.0+]
|-
| 30300 ||
|-
| 30400 ||
|-
| 30500 || [8.0.0+] ? (Takes a total of 8-bytes of input, a handle, and a type-0x9 input buffer, returns an [[#IUnknown2]])
|-
| 40100 ||
|-
| 40101 ||
|-
| 40200 ||
|-
| 40201 ||
|-
| 90100 ||
|}

== INewlyArrivedEventHolder ==
This is <nowiki>"nn::news::detail::ipc::INewlyArrivedEventHolder"</nowiki>.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|}

== INewsDataService ==
This is <nowiki>"nn::news::detail::ipc::INewsDataService"</nowiki>.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|-
| 3 ||
|-
| 1001 || [6.0.0+]
|}

== INewsDatabaseService ==
This is <nowiki>"nn::news::detail::ipc::INewsDatabaseService"</nowiki>.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|-
| 3 ||
|-
| 4 ||
|-
| 5 ||
|-
| 1000 || [6.0.0+]
|}

== IOverwriteEventHolder ==
This is <nowiki>"nn::news::detail::ipc::IOverwriteEventHolder"</nowiki>.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|}

== IUnknown2 ==
This was added with [8.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|-
| 3 ||
|}

= prepo:a, prepo:a2, prepo:m, prepo:u, prepo:s =
These are "nn::prepo::detail::ipc::IPrepoService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 10100 || SaveReportOld ([1.0.0-5.1.0] SaveReport)
|-
| 10101 || SaveReportWithUserOld ([1.0.0-5.1.0] SaveReportWithUser)
|-
| 10102 || [6.0.0+] SaveReport
|-
| 10103 || [6.0.0+] SaveReportWithUser
|-
| 10200 || RequestImmediateTransmission
|-
| 10300 || GetTransmissionStatus
|-
| 20100 || SaveSystemReport
|-
| 20101 || SaveSystemReportWithUser
|-
| 20200 || [4.0.0+] SetOperationMode
|-
| 30100 || ClearStorage
|-
| 30200 || [6.0.0+] ClearStatistics
|-
| 30300 || [6.0.0+] GetStorageUsage
|-
| 30400 || [6.0.0+] GetStatistics
|-
| 30401 || [6.0.0+] GetThroughputHistory
|-
| 30500 || [6.0.0+] GetLastUploadError
|-
| 40100 || IsUserAgreementCheckEnabled
|-
| 40101 || SetUserAgreementCheckEnabled
|-
| 90100 || [6.0.0+] ReadAllReportFiles ([1.0.0-5.1.0] GetStorageUsage)
|-
| [5.0.0-5.1.0] 90200 ||
|-
| [5.0.0-5.1.0] 90201 ||
|-
| [5.0.0-5.1.0] 90300 ||
|}

== Data reporting ==
The "Play Report" (prepo) service uploads system and user information to a cloud server.
This includes the following fields:
sys_info
data
application_id
event_id
operation_mode
lc_recorded_at (followed by a timestamp)
nc_recorded_at (followed by a timestamp)
nsa_id
os_version

And the contents of the following file:
is_user_agreement_check_enabled.bin

All the information is periodically uploaded to the following URL: 
* <nowiki>https://receive-%.dg.srv.nintendo.net/post</nowiki>

It also checks the validity of the device's authentication token using the following URL: 
* <nowiki>https://dauth-%.ndas.srv.nintendo.net/v1/device_auth_token</nowiki>

[[Category:Services]]

Account services

2019-04-16T02:15:03Z

Hthh:

= acc:su =
This is "nn::account::IAccountServiceForAdministrator".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Returns an [[#IProfile]].
|-
| 6 || GetProfileDigest ||
|-
| 50 || IsUserRegistrationRequestPermitted ||
|-
| 51 || TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || GetUserRegistrationNotifier || Returns an [[#INotifier]].
|-
| 101 || GetUserStateChangeNotifier || Returns an [[#INotifier]].
|-
| 102 || GetBaasAccountManagerForSystemService || Returns an [[#IManagerForSystemService]].
|-
| 103 || GetBaasUserAvailabilityChangeNotifier || Returns an [[#INotifier]].
|-
| 104 || GetProfileUpdateNotifier || Returns an [[#INotifier]].
|-
| 105 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 112 || LoadSaveDataThumbnail ||
|-
| 113 || GetSaveDataThumbnailExistence ||
|-
| 130 || [6.0.0+] ActivateOpenContextRetention || Takes a total of 0x8-bytes of input, returns an [[#ISessionObject]].
|-
| 140 || [6.0.0+] ListQualifiedUsers ||
|-
| 190 || GetUserLastOpenedApplication ||
|-
| 191 || [7.0.0+] UpdateNotificationReceiverInfo ([5.0.0-5.1.0] ActivateOpenContextHolder) ||
|-
| 200 || BeginUserRegistration ||
|-
| 201 || CompleteUserRegistration ||
|-
| 202 || CancelUserRegistration ||
|-
| 203 || DeleteUser ||
|-
| 204 || SetUserPosition ||
|-
| 205 || GetProfileEditor || Takes an input userID and returns an [[#IProfileEditor]].
|-
| 206 || CompleteUserRegistrationForcibly ||
|-
| 210 || CreateFloatingRegistrationRequest || Returns an [[#IFloatingRegistrationRequest]].
|-
| 211 || [8.0.0+] || Takes a total of 0x4-bytes of input and a handle, returns an [[#IOAuthProcedureForUserRegistration]].
|-
| 212 || [8.0.0+] || Takes a total of 0x14-bytes of input and a handle, returns an [[#IOAuthProcedureForUserRegistration]].
|-
| 230 || AuthenticateServiceAsync || Returns an [[#IAsyncContext]].
|-
| 250 || GetBaasAccountAdministrator || Returns an [[#IAdministrator]].
|-
| 290 || ProxyProcedureForGuestLoginWithNintendoAccount || Returns an [[#IOAuthProcedureForExternalNsa]].
|-
| 291 || ProxyProcedureForFloatingRegistrationWithNintendoAccount || Returns an [[#IOAuthProcedureForExternalNsa]].
|-
| 299 || SuspendBackgroundDaemon || Returns an [[#ISessionObject]].
|-
| 997 || DebugInvalidateTokenCacheForUser ||
|-
| 998 || DebugSetUserStateClose ||
|-
| 999 || DebugSetUserStateOpen ||
|}

== IManagerForSystemService ==
This is "nn::account::baas::IManagerForSystemService".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || LoadIdTokenCache ||
|-
| 100 || SetSystemProgramIdentification ||
|-
| 101 || [7.0.0+] RefreshNotificationTokenAsync ||
|-
| 110 || [4.0.0+] GetServiceEntryRequirementCache ||
|-
| 111 || [4.0.0+] InvalidateServiceEntryRequirementCache ||
|-
| 112 || [4.0.0-6.2.0] InvalidateTokenCache ||
|-
| 113 || [6.1.0+] GetServiceEntryRequirementCacheForOnlinePlay || Takes a total of 0x8-bytes of input, returns a total of 0x4-bytes of output.
|-
| 120 || GetNintendoAccountId ||
|-
| 130 || GetNintendoAccountUserResourceCache ||
|-
| 131 || RefreshNintendoAccountUserResourceCacheAsync || Returns an [[#IAsyncContext]].
|-
| 132 || RefreshNintendoAccountUserResourceCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 140 || [5.0.0+] GetNetworkServiceLicenseCache ||
|-
| 141 || [5.0.0+] RefreshNetworkServiceLicenseCacheAsync || Returns an [[#IAsyncContext]].
|-
| 142 || [5.0.0+] RefreshNetworkServiceLicenseCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|}

== IFloatingRegistrationRequest ==
This is "nn::account::baas::IFloatingRegistrationRequest".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSessionId ||
|-
| 12 || GetAccountId ||
|-
| 13 || GetLinkedNintendoAccountId ||
|-
| 14 || GetNickname ||
|-
| 15 || GetProfileImage ||
|-
| 21 || LoadIdTokenCache ||
|-
| 100 || RegisterUser ([1.0.0-3.0.2] RegisterAsync) || [1.0.0-3.0.2] Used to return an [[#IAsyncContext]].
|-
| 101 || RegisterUserWithUid ([1.0.0-3.0.2] RegisterWithUidAsync) || [1.0.0-3.0.2] Used to return an [[#IAsyncContext]].
|-
| 102 || [4.0.0+] RegisterNetworkServiceAccountAsync || Returns an [[#IAsyncContext]].
|-
| 103 || [4.0.0+] RegisterNetworkServiceAccountWithUidAsync || Returns an [[#IAsyncContext]].
|-
| 110 || SetSystemProgramIdentification ||
|-
| 111 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|}

== IAdministrator ==
This is "nn::account::baas::IAdministrator".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || LoadIdTokenCache ||
|-
| 100 || SetSystemProgramIdentification ||
|-
| 101 || [7.0.0+] RefreshNotificationTokenAsync
|-
| 110 || [4.0.0+] GetServiceEntryRequirementCache ||
|-
| 111 || [4.0.0+] InvalidateServiceEntryRequirementCache ||
|-
| [4.0.0-6.2.0] 112 || InvalidateTokenCache ||
|-
| 113 || [6.1.0+] GetServiceEntryRequirementCacheForOnlinePlay || Takes a total of 0x8-bytes of input, returns a total of 0x4-bytes of output.
|-
| 120 || GetNintendoAccountId ||
|-
| 130 || GetNintendoAccountUserResourceCache ||
|-
| 131 || RefreshNintendoAccountUserResourceCacheAsync || Returns an [[#IAsyncContext]].
|-
| 132 || RefreshNintendoAccountUserResourceCacheAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 140 || [5.0.0+] GetNetworkServiceLicenseCache ||
|-
| 141 || [5.0.0+] RefreshNetworkServiceLicenseCacheAsync ||
|-
| 142 || [5.0.0+] RefreshNetworkServiceLicenseCacheAsyncIfSecondsElapsed ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 200 || IsRegistered ||
|-
| 201 || RegisterAsync || Returns an [[#IAsyncContext]].
|-
| 202 || UnregisterAsync || Returns an [[#IAsyncContext]].
|-
| 203 || DeleteRegistrationInfoLocally ||
|-
| 220 || SynchronizeProfileAsync || Returns an [[#IAsyncContext]].
|-
| 221 || UploadProfileAsync || Returns an [[#IAsyncContext]].
|-
| 222 || SynchronizeProfileAsyncIfSecondsElapsed || Returns an [[#IAsyncContext]].
|-
| 250 || IsLinkedWithNintendoAccount ||
|-
| 251 || CreateProcedureToLinkWithNintendoAccount || Returns an [[#IOAuthProcedureForNintendoAccountLinkage]].
|-
| 252 || ResumeProcedureToLinkWithNintendoAccount || Returns an [[#IOAuthProcedureForNintendoAccountLinkage]].
|-
| 255 || CreateProcedureToUpdateLinkageStateOfNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 256 || ResumeProcedureToUpdateLinkageStateOfNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 260 || CreateProcedureToLinkNnidWithNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 261 || ResumeProcedureToLinkNnidWithNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 280 || ProxyProcedureToAcquireApplicationAuthorizationForNintendoAccount || Returns an [[#IOAuthProcedure]].
|-
| 290 || [8.0.0+] ||
|-
| 300 || [6.0.0+] TryRecoverNintendoAccountUserStateAsync || Returns an [[#IAsyncContext]].
|-
| 400 || [6.1.0+] IsServiceEntryRequirementCacheRefreshRequiredForOnlinePlay || Takes a total of 0x8-bytes of input, returns an output u8.
|-
| 401 || [6.1.0+] RefreshServiceEntryRequirementCacheForOnlinePlayAsync || Takes a total of 0x8-bytes of input, returns an [[#IAsyncContext]].
|-
| 997 || DebugUnlinkNintendoAccountAsync || Returns an [[#IAsyncContext]].
|-
| 998 || DebugSetAvailabilityErrorDetail ||
|}

== IAuthorizationRequest ==
This is "nn::account::nas::IAuthorizationRequest".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSessionId ||
|-
| 10 || InvokeWithoutInteractionAsync || Returns an [[#IAsyncContext]].
|-
| 19 || IsAuthorized ||
|-
| 20 || GetAuthorizationCode ||
|-
| 21 || GetIdToken ||
|-
| 22 || GetState ||
|}

== IOAuthProcedure ==
This is "nn::account::http::IOAuthProcedure".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|}

== IOAuthProcedureForExternalNsa ==
This is "nn::account::nas::IOAuthProcedureForExternalNsa".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetAccountId ||
|-
| 101 || GetLinkedNintendoAccountId ||
|-
| 102 || GetNickname ||
|-
| 103 || GetProfileImage ||
|}

== IOAuthProcedureForNintendoAccountLinkage ==
This is "nn::account::nas::IOAuthProcedureForNintendoAccountLinkage".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || PrepareAsync || Returns an [[#IAsyncContext]].
|-
| 1 || GetRequest ||
|-
| 2 || ApplyResponse ||
|-
| 3 || ApplyResponseAsync || Returns an [[#IAsyncContext]].
|-
| 10 || Suspend ||
|-
| 100 || GetRequestWithTheme ||
|-
| 101 || IsNetworkServiceAccountReplaced ||
|-
| [?-5.1.0] 199 || GetUrlForIntroductionOfExtraMembership ||
|}

== INotifier ==
This is "nn::account::detail::INotifier".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|}

== IProfile ==
This is "nn::account::profile::IProfile".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Get]]
|-
| 1 || [[#GetBase]]
|-
| 10 || [[#GetImageSize]]
|-
| 11 || [[#LoadImage]]
|}

=== Get ===
Takes an output type-0x1A buffer for [[#UserData]], returns an output [[#ProfileBase]].

=== GetBase ===
No input, returns an output [[#ProfileBase]].

=== GetImageSize ===
No input, returns an output u32 for the size of the image buffer.

=== LoadImage ===
Takes an output type-0x6 buffer, returns the same output u32 as [[#GetImageSize]].

The output buffer contains the JPEG profile image icon. This is valid for both Miis and character icons.

== IProfileEditor ==
This is "nn::account::profile::IProfileEditor".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Get]]
|-
| 1 || [[#GetBase]]
|-
| 10 || [[#GetImageSize]]
|-
| 11 || [[#LoadImage]]
|-
| 100 || [[#Store]]
|-
| 101 || [[#StoreWithImage]]
|}

=== Store ===
Takes a [[#ProfileBase]] and an input type-0x19 buffer for [[#UserData]].

=== StoreWithImage ===
Takes a [[#ProfileBase]], an input type-0x19 buffer for [[#UserData]], and an input type-0x5 buffer.

== IAsyncContext ==
This is "nn::account::detail::IAsyncContext".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSystemEvent
|-
| 1 || Cancel
|-
| 2 || HasDone
|-
| 3 || GetResult
|}

== ISessionObject ==
This is "nn::account::detail::ISessionObject".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 999 || Dummy
|}

= acc:u0 =
This is "nn::account::IAccountServiceForApplication".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Takes an input userID, returns an [[#IProfile]].
|-
| 6 || GetProfileDigest ||
|-
| 50 || IsUserRegistrationRequestPermitted ||
|-
| 51 || TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || InitializeApplicationInfo ||
|-
| 101 || GetBaasAccountManagerForApplication || Returns an [[#IManagerForApplication]].
|-
| 102 || AuthenticateApplicationAsync || Returns an [[#IAsyncContext]].
|-
| 103 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 120 || CreateGuestLoginRequest || Returns an [[#IGuestLoginRequest]].
|-
| 130 || [5.0.0+] LoadOpenContext ||
|-
| 131 || [6.0.0+] ListOpenContextStoredUsers ||
|-
| 140 || [6.0.0+] InitializeApplicationInfo ||
|-
| 141 || [6.0.0+] ListQualifiedUsers ||
|-
| 150 || [6.0.0+] IsUserAccountSwitchLocked ||
|}

== IGuestLoginRequest ==
This is "nn::account::baas::IGuestLoginRequest".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetSessionId
|-
| 12 || GetAccountId
|-
| 13 || GetLinkedNintendoAccountId
|-
| 14 || GetNickname
|-
| 15 || GetProfileImage
|-
| 21 || LoadIdTokenCache
|}

== IManagerForApplication ==
This is "nn::account::baas::IManagerForApplication".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || CheckAvailability ||
|-
| 1 || GetAccountId ||
|-
| 2 || EnsureIdTokenCacheAsync || Returns an [[#IAsyncContext]].
|-
| 3 || LoadIdTokenCache ||
|-
| 130 || GetNintendoAccountUserResourceCacheForApplication ||
|-
| 150 || CreateAuthorizationRequest || Returns an [[#IAuthorizationRequest]].
|-
| 160 || [5.0.0+] StoreOpenContext ||
|-
| 170 || [6.0.0+] LoadNetworkServiceLicenseKindAsync || No input, returns an [[#IAsyncNetworkServiceLicenseKindContext]].
|}

== IAsyncNetworkServiceLicenseKindContext ==
This is "nn::account::detail::IAsyncNetworkServiceLicenseKindContext".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetSystemEvent ||
|-
| 1 || Cancel ||
|-
| 2 || HasDone ||
|-
| 3 || GetResult ||
|-
| 100 || GetNetworkServiceLicenseKind ||
|}

= acc:u1 =
This is "nn::account::IAccountServiceForSystemService".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetUserCount ||
|-
| 1 || GetUserExistence ||
|-
| 2 || ListAllUsers ||
|-
| 3 || ListOpenUsers ||
|-
| 4 || GetLastOpenedUser ||
|-
| 5 || GetProfile || Returns an [[#IProfile]].
|-
| 6 || GetProfileDigest ||
|-
| 50 || IsUserRegistrationRequestPermitted ||
|-
| 51 || TrySelectUserWithoutInteraction ||
|-
| 60 || [5.0.0-5.1.0] ListOpenContextStoredUsers ||
|-
| 99 || [6.0.0+] DebugActivateOpenContextRetention || No input, returns an [[#ISessionObject]].
|-
| 100 || GetUserRegistrationNotifier || Returns an [[#INotifier]].
|-
| 101 || GetUserStateChangeNotifier || Returns an [[#INotifier]].
|-
| 102 || GetBaasAccountManagerForSystemService || Returns an [[#IManagerForSystemService]].
|-
| 103 || GetBaasUserAvailabilityChangeNotifier || Returns an [[#INotifier]].
|-
| 104 || GetProfileUpdateNotifier || Returns an [[#INotifier]].
|-
| 105 || [4.0.0+] CheckNetworkServiceAvailabilityAsync || Returns an [[#IAsyncContext]].
|-
| 110 || StoreSaveDataThumbnail ||
|-
| 111 || ClearSaveDataThumbnail ||
|-
| 112 || LoadSaveDataThumbnail ||
|-
| 113 || [5.0.0+] GetSaveDataThumbnailExistence ||
|-
| 130 || [6.0.0+] ActivateOpenContextRetention || Takes a total of 0x8-bytes of input, returns an [[#ISessionObject]].
|-
| 140 || [6.0.0+] ListQualifiedUsers ||
|-
| 190 || GetUserLastOpenedApplication ||
|-
| 191 || [7.0.0+] UpdateNotificationReceiverInfo ([5.0.0-5.1.0] ActivateOpenContextHolder) ||
|-
| 997 || DebugInvalidateTokenCacheForUser ||
|-
| 998 || DebugSetUserStateClose ||
|-
| 999 || DebugSetUserStateOpen ||
|}

== IOAuthProcedureForUserRegistration ==
This is "nn::account::nas::IOAuthProcedureForUserRegistration".

This was added with [8.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || || No input, returns an [[#IAsyncContext]].
|-
| 1 || ||
|-
| 2 || ||
|-
| 3 || || Takes a type-0x9 input buffer, returns an [[#IAsyncContext]].
|-
| 10 || ||
|-
| 100 || ||
|-
| 101 || ||
|-
| 102 || ||
|-
| 103 || ||
|-
| 110 || || No input, returns an [[#IAsyncContext]].
|-
| 111 || ||
|}

= acc:aa =
This is "nn::account::IBaasAccessTokenAccessor".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || EnsureCacheAsync || Returns an [[#IAsyncContext]].
|-
| 1 || LoadCache ||
|-
| 2 || GetDeviceAccountId ||
|-
| [1.0.0-6.2.0] 50 || RegisterNotificationTokenAsync || Returns an [[#IAsyncContext]].
|-
| [1.0.0-6.2.0] 51 || UnregisterNotificationTokenAsync || Returns an [[#IAsyncContext]].
|}

= dauth:0 =
This is "nn::dauth::detail::IService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || ? ([5.0.0-5.1.0] ?)
|-
| 1 || [6.0.0+]
|-
| 2 || [6.0.0+]
|-
| 10 || [6.0.0+]
|-
| 11 || [6.0.0+]
|-
| 12 || [6.0.0+]
|}

== IAsyncResult ==
This is "nn::dauth::detail::IAsyncResult".

This was added with [6.0.0+].

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|-
| 3 ||
|}

= UserData =
{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x4? || ?
|-
| 0x4 || 0x4? || Icon ID. 0 = Mii, the rest are character icon IDs.
|-
| 0x8 || 0x1? || Profile icon background color ID
|-
| 0x9 || 0x7 || ?
|-
| 0x10 || 0x10 || Some ID related to the Mii? All zeros when a character icon is used.
|-
| 0x20 || 0x60 || Usually zeros?
|}

This is a 0x80-byte struct.

= ProfileBase =
{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x10 || userID
|-
| 0x10 || 0x8 || POSIX UTC timestamp, for last account edit.
|-
| 0x18 || 0x20 || UTF-8 Username
|-
|}

This is a 0x38-byte struct.

[[Category:Services]]

Settings services

2019-03-26T02:52:56Z

Hthh: doesn't look like set:cal ever had a command 33

= set =
This is "nn::settings::ISettingsServer".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || GetLanguageCode || No input, returns an output [[#LanguageCode]]. This is the current system language.
|-
| 1 || GetAvailableLanguageCodes || Takes a type-0xA buffer containing the [[#LanguageCode]] output array, returns an output s32.
|-
| 2 || [4.0.0+] MakeLanguageCode || Takes an input [[#Language]], returns an output [[#LanguageCode]].
|-
| 3 || GetAvailableLanguageCodeCount || No input, returns an output s32.
|-
| 4 || GetRegionCode || No input, returns a [[#RegionCode]].
|-
| 5 || [4.0.0+] GetAvailableLanguageCodes2 || Takes a type-0x6 buffer containing the [[#LanguageCode]] output array, returns an output s32.
|-
| 6 || [4.0.0+] GetAvailableLanguageCodeCount2 || No input, returns an output s32.
|-
| 7 || [4.0.0+] GetKeyCodeMap ||
|-
| 8 || [5.0.0+] GetQuestFlag || Identical to "set:sys" [[#set:sys|GetQuestFlag]].
|-
| 9 || [6.0.0+] GetKeyCodeMap2 ||
|}

[4.0.0+] Official user-processes now use GetAvailableLanguageCodes2/GetAvailableLanguageCodeCount2 instead of {original commands}.

In official user-processes in the [[#Language]]->[[#LanguageCode]] conversion function (MakeLanguageCode):
* During one-time init, GetAvailableLanguageCodes is used to initialize the LanguageCodes array cache, with max_entries=0xF (buffer size in u64s). [4.0.0+] GetAvailableLanguageCodes2 is now used with max_entries 0x40.
* [4.0.0+] When the input [[#Language]] is larger than the cached total_entries from the above command output, or [[#Language]] is negative, command MakeLanguageCode is used instead of the array.

== GetKeyCodeMap ==
Takes a type-0x16 output buffer containing KeyCodeMap, official sw uses fixed size 0x1000. This is probably related to HID keyboard.

== Language ==
"nn::settings::Language" (s32) is basically array indices in the output array from GetAvailableLanguageCodes.

== LanguageCode ==
This is "nn::settings::LanguageCode".

This is an u64, which is a NUL-terminated string.

{| class="wikitable" border="1"
|-
! Array-index / [[#Language]] || [[#LanguageCode]] || Icon [[NCA_Content_FS#FS-type3|language]] filename
|-
| 0 || ja || "Japanese"
|-
| 1 || en-US || "AmericanEnglish"
|-
| 2 || fr || "French"
|-
| 3 || de || "German"
|-
| 4 || it || "Italian"
|-
| 5 || es || "Spanish"
|-
| 6 || zh-CN || "Chinese"
|-
| 7 || ko || "Korean"
|-
| 8 || nl || "Dutch"
|-
| 9 || pt || "Portuguese"
|-
| 10 || ru || "Russian"
|-
| 11 || zh-TW || "Taiwanese"
|-
| 12 || en-GB || "BritishEnglish"
|-
| 13 || fr-CA || "CanadianFrench"
|-
| 14 || es-419 || "LatinAmericanSpanish"
|-
| [4.0.0+] 15 || zh-Hans || "SimplifiedChinese"
|-
| [4.0.0+] 16 || zh-Hant || "TraditionalChinese"
|}

== RegionCode ==
A region code is a signed 32-bit value representing a particular region. Currently the available regions defined by the system are as follows:

{| class="wikitable" border="1"
|-
! Value || Region
|-
| 0 || Japan
|-
| 1 || USA
|-
| 2 || Europe
|-
| 3 || Australia
|-
| 4 || China
|-
| 5 || Korea
|-
| 6 || Taiwan
|-
| Any other value || Considered an unknown region
|-
|}

= set:fd =
This is "nn::settings::IFirmwareDebugSettingsServer".

[4.0.0+] Only exposed if in [[SPL_services#IsDebugMode|debug mode]].

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 2 || SetSettingsItemValue ||
|-
| 3 || ResetSettingsItemValue ||
|-
| 4 || CreateSettingsItemKeyIterator || Returns an [[#ISettingsItemKeyIterator]].
|-
| 10 || [4.0.0+] ReadSettings ||
|-
| 11 || [4.0.0+] ResetSettings ||
|-
| 20 || [4.0.0+] SetWebInspectorFlag ||
|-
| 21 || [4.0.0+] SetAllowedSslHosts ||
|-
| 22 || [4.0.0+] SetHostFsMountPoint ||
|}

== ISettingsItemKeyIterator ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GoNext
|-
| 1 || GetKeySize
|-
| 2 || GetKey
|}

= set:cal =
This is "nn::settings::IFactorySettingsServer".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetBluetoothBdAddress
|-
| 1 || GetConfigurationId1
|-
| 2 || GetAccelerometerOffset
|-
| 3 || GetAccelerometerScale
|-
| 4 || GetGyroscopeOffset
|-
| 5 || GetGyroscopeScale
|-
| 6 || GetWirelessLanMacAddress
|-
| 7 || GetWirelessLanCountryCodeCount
|-
| 8 || GetWirelessLanCountryCodes
|-
| 9 || GetSerialNumber
|-
| 10 || SetInitialSystemAppletProgramId
|-
| 11 || SetOverlayDispProgramId
|-
| 12 || GetBatteryLot
|-
| 14 || [[#GetEciDeviceCertificate]]
|-
| 15 || [[#GetEticketDeviceCertificate]]
|-
| 16 || [[#GetSslKey]]
|-
| 17 || [[#GetSslCertificate]]
|-
| 18 || [[#GetGameCardKey]]
|-
| 19 || [[#GetGameCardCertificate]]
|-
| 20 || [[#GetEciDeviceKey]]
|-
| 21 || [[#GetEticketDeviceKey]]
|-
| 22 || GetSpeakerParameter
|-
| 23 || [4.0.0+] GetLcdVendorId
|-
| 24 || [5.0.0+] [[#GetEciDeviceCertificate2]]
|-
| 25 || [5.0.0+] [[#GetEciDeviceKey2]]
|-
| 26 || [5.0.0+] GetAmiiboKey
|-
| 27 || [5.0.0+] GetAmiiboEcqvCertificate
|-
| 28 || [5.0.0+] GetAmiiboEcdsaCertificate
|-
| 29 || [5.0.0+] GetAmiiboEcqvBlsKey
|-
| 30 || [5.0.0+] GetAmiiboEcqvBlsCertificate
|-
| 31 || [5.0.0+] GetAmiiboEcqvBlsRootCertificate
|-
| 32 || [5.0.0+] GetUsbTypeCPowerSourceCircuitVersion
|-
| 41 || [6.0.0+] GetBatteryVersion
|}

Used for accessing data calibrated at the factory.

== GetEciDeviceCertificate ==
Takes a type-0x16 output buffer with fixed size 0x180.

Returns the device certificate (ECC signed). This is identical to 3DS DeviceCert/CTCert besides the strings. NIM loads the DeviceId from this.

== GetEticketDeviceCertificate ==
Takes a type-0x16 output buffer with fixed size 0x240.

Returns the ETicket certificate (RSA signed).

== GetSslKey ==
Takes a type-0x16 output buffer with fixed size 0x134.

Returns the extended SSL key (0x130 bytes) from [[Calibration#CAL0|CAL0]]. If the extended key is not programmed then it falls back to the normal SSL key (0x110 bytes).

Used by SSL-sysmodule, see [[SSL_services|here]].

== GetSslCertificate ==
Takes a type-0x16 output buffer with fixed size 0x804.

Returns a [[Settings_services#setcal_Container_Structure|container]] with the plaintext SSL certificate.

Used by SSL-sysmodule, see [[SSL_services|here]].

== GetGameCardKey ==
Takes a type-0x16 output buffer with fixed size 0x134.

Returns the extended GameCard key (0x130 bytes) from [[Calibration#CAL0|CAL0]]. If the extended key is not programmed then it falls back to the normal GameCard key (0x110 bytes).

== GetGameCardCertificate ==
Takes a type-0x16 output buffer with fixed size 0x404.

Returns a [[Settings_services#setcal_Container_Structure|container]] with the GameCard certificate.

== GetEciDeviceKey ==
Returns the extended device ECC-B233 key (0x50 bytes) from [[Calibration#CAL0|CAL0]]. If the extended key is not programmed then it falls back to the normal device ECC-B233 key (0x30 bytes).

== GetEticketDeviceKey ==
Takes a type-0x16 output buffer with fixed size 0x244.

Returns the extended ETicket RSA-2048 key (0x240 bytes) from [[Calibration#CAL0|CAL0]]. If the extended key is not programmed then it falls back to the normal ETicket RSA-2048 key (0x220 bytes).

== GetEciDeviceCertificate2 ==
Same as [[#GetEciDeviceCertificate]], but returns a RSA-2048 variant of the device certificate.

== GetEciDeviceKey2 ==
Same as [[#GetEciDeviceKey]], but returns a RSA-2048 variant of the device key.

== setcal Container Structure ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Name
|-
| 0x0
| 0x4
| Size (same size used for decryption if needed)
|-
| 0x4
| {above size}
| Actual data starts here.
|}

This container is used for returning data with variable sizes.

= set:sys =
This is "nn::settings::ISystemSettingsServer".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || SetLanguageCode
|-
| 1 || SetNetworkSettings
|-
| 2 || GetNetworkSettings
|-
| 3 || [[#GetFirmwareVersion]]
|-
| 4 || [3.0.0+] GetFirmwareVersion2
|-
| 5 || [5.0.0+] GetFirmwareVersionDigest
|-
| 7 || GetLockScreenFlag
|-
| 8 || SetLockScreenFlag
|-
| 9 || GetBacklightSettings
|-
| 10 || SetBacklightSettings
|-
| 11 || SetBluetoothDevicesSettings
|-
| 12 || GetBluetoothDevicesSettings
|-
| 13 || GetExternalSteadyClockSourceId
|-
| 14 || SetExternalSteadyClockSourceId
|-
| 15 || GetUserSystemClockContext
|-
| 16 || SetUserSystemClockContext
|-
| 17 || GetAccountSettings
|-
| 18 || SetAccountSettings
|-
| 19 || GetAudioVolume
|-
| 20 || SetAudioVolume
|-
| 21 || GetEulaVersions
|-
| 22 || SetEulaVersions
|-
| 23 || [[#GetColorSetId]]
|-
| 24 || [[#SetColorSetId]]
|-
| 25 || GetConsoleInformationUploadFlag
|-
| 26 || SetConsoleInformationUploadFlag
|-
| 27 || GetAutomaticApplicationDownloadFlag
|-
| 28 || SetAutomaticApplicationDownloadFlag
|-
| 29 || GetNotificationSettings
|-
| 30 || SetNotificationSettings
|-
| 31 || GetAccountNotificationSettings
|-
| 32 || SetAccountNotificationSettings
|-
| 35 || GetVibrationMasterVolume
|-
| 36 || SetVibrationMasterVolume
|-
| 37 || GetSettingsItemValueSize
|-
| 38 || [[#GetSettingsItemValue]]
|-
| 39 || GetTvSettings
|-
| 40 || SetTvSettings
|-
| 41 || GetEdid
|-
| 42 || SetEdid
|-
| 43 || GetAudioOutputMode
|-
| 44 || SetAudioOutputMode
|-
| 45 || IsForceMuteOnHeadphoneRemoved
|-
| 46 || SetForceMuteOnHeadphoneRemoved
|-
| 47 || [[#GetQuestFlag]]
|-
| 48 || SetQuestFlag
|-
| 49 || GetDataDeletionSettings
|-
| 50 || SetDataDeletionSettings
|-
| 51 || GetInitialSystemAppletProgramId
|-
| 52 || GetOverlayDispProgramId
|-
| 53 || GetDeviceTimeZoneLocationName
|-
| 54 || SetDeviceTimeZoneLocationName
|-
| 55 || GetWirelessCertificationFileSize
|-
| 56 || [[Flash_Filesystem#PRODINFOF|GetWirelessCertificationFile]]
|-
| 57 || SetRegionCode
|-
| 58 || GetNetworkSystemClockContext
|-
| 59 || SetNetworkSystemClockContext
|-
| 60 || IsUserSystemClockAutomaticCorrectionEnabled
|-
| 61 || SetUserSystemClockAutomaticCorrectionEnabled
|-
| 62 || [[#GetDebugModeFlag]]
|-
| 63 || GetPrimaryAlbumStorage
|-
| 64 || SetPrimaryAlbumStorage
|-
| 65 || GetUsb30EnableFlag
|-
| 66 || SetUsb30EnableFlag
|-
| 67 || GetBatteryLot
|-
| 68 || [[#GetSerialNumber]]
|-
| 69 || GetNfcEnableFlag
|-
| 70 || SetNfcEnableFlag
|-
| 71 || GetSleepSettings
|-
| 72 || SetSleepSettings
|-
| 73 || GetWirelessLanEnableFlag
|-
| 74 || SetWirelessLanEnableFlag
|-
| 75 || GetInitialLaunchSettings
|-
| 76 || SetInitialLaunchSettings
|-
| 77 || GetDeviceNickName
|-
| 78 || SetDeviceNickName
|-
| 79 || GetProductModel
|-
| 80 || GetLdnChannel
|-
| 81 || SetLdnChannel
|-
| 82 || AcquireTelemetryDirtyFlagEventHandle
|-
| 83 || GetTelemetryDirtyFlags
|-
| 84 || GetPtmBatteryLot
|-
| 85 || SetPtmBatteryLot
|-
| 86 || GetPtmFuelGaugeParameter
|-
| 87 || SetPtmFuelGaugeParameter
|-
| 88 || GetBluetoothEnableFlag
|-
| 89 || SetBluetoothEnableFlag
|-
| 90 || GetMiiAuthorId
|-
| 91 || SetShutdownRtcValue
|-
| 92 || GetShutdownRtcValue
|-
| 93 || AcquireFatalDirtyFlagEventHandle
|-
| 94 || GetFatalDirtyFlags
|-
| 95 || [2.0.0+] GetAutoUpdateEnableFlag
|-
| 96 || [2.0.0+] SetAutoUpdateEnableFlag
|-
| 97 || [2.0.0+] GetNxControllerSettings
|-
| 98 || [2.0.0+] SetNxControllerSettings
|-
| 99 || [2.0.0+] GetBatteryPercentageFlag
|-
| 100 || [2.0.0+] SetBatteryPercentageFlag
|-
| 101 || [2.0.0+] GetExternalRtcResetFlag
|-
| 102 || [2.0.0+] SetExternalRtcResetFlag
|-
| 103 || [3.0.0+] GetUsbFullKeyEnableFlag
|-
| 104 || [3.0.0+] SetUsbFullKeyEnableFlag
|-
| 105 || [3.0.0+] SetExternalSteadyClockInternalOffset
|-
| 106 || [3.0.0+] GetExternalSteadyClockInternalOffset
|-
| 107 || [3.0.0+] GetBacklightSettingsEx
|-
| 108 || [3.0.0+] SetBacklightSettingsEx
|-
| 109 || [3.0.0+] GetHeadphoneVolumeWarningCount
|-
| 110 || [3.0.0+] SetHeadphoneVolumeWarningCount
|-
| 111 || [3.0.0+] GetBluetoothAfhEnableFlag
|-
| 112 || [3.0.0+] SetBluetoothAfhEnableFlag
|-
| 113 || [3.0.0+] GetBluetoothBoostEnableFlag
|-
| 114 || [3.0.0+] SetBluetoothBoostEnableFlag
|-
| 115 || [3.0.0+] GetInRepairProcessEnableFlag
|-
| 116 || [3.0.0+] SetInRepairProcessEnableFlag
|-
| 117 || [3.0.0+] GetHeadphoneVolumeUpdateFlag
|-
| 118 || [3.0.0+] SetHeadphoneVolumeUpdateFlag
|-
| 119 || [3.0.0+] NeedsToUpdateHeadphoneVolume
|-
| 120 || [3.0.0+] GetPushNotificationActivityModeOnSleep
|-
| 121 || [3.0.0+] SetPushNotificationActivityModeOnSleep
|-
| 122 || [4.0.0+] [[#GetServiceDiscoveryControlSettings]]
|-
| 123 || [4.0.0+] SetServiceDiscoveryControlSettings
|-
| 124 || [4.0.0+] GetErrorReportSharePermission
|-
| 125 || [4.0.0+] SetErrorReportSharePermission
|-
| 126 || [4.0.0+] GetAppletLaunchFlags
|-
| 127 || [4.0.0+] SetAppletLaunchFlags
|-
| 128 || [4.0.0+] GetConsoleSixAxisSensorAccelerationBias
|-
| 129 || [4.0.0+] SetConsoleSixAxisSensorAccelerationBias
|-
| 130 || [4.0.0+] GetConsoleSixAxisSensorAngularVelocityBias
|-
| 131 || [4.0.0+] SetConsoleSixAxisSensorAngularVelocityBias
|-
| 132 || [4.0.0+] GetConsoleSixAxisSensorAccelerationGain
|-
| 133 || [4.0.0+] SetConsoleSixAxisSensorAccelerationGain
|-
| 134 || [4.0.0+] GetConsoleSixAxisSensorAngularVelocityGain
|-
| 135 || [4.0.0+] SetConsoleSixAxisSensorAngularVelocityGain
|-
| 136 || [4.0.0+] GetKeyboardLayout
|-
| 137 || [4.0.0+] SetKeyboardLayout
|-
| 138 || [4.0.0+] GetWebInspectorFlag
|-
| 139 || [4.0.0+] [[#GetAllowedSslHosts]]
|-
| 140 || [4.0.0+] GetHostFsMountPoint
|-
| 141 || [5.0.0+] GetRequiresRunRepairTimeReviser
|-
| 142 || [5.0.0+] SetRequiresRunRepairTimeReviser
|-
| 143 || [5.0.0+] SetBlePairingSettings
|-
| 144 || [5.0.0+] GetBlePairingSettings
|-
| 145 || [5.0.0+] GetConsoleSixAxisSensorAngularVelocityTimeBias
|-
| 146 || [5.0.0+] SetConsoleSixAxisSensorAngularVelocityTimeBias
|-
| 147 || [5.0.0+] GetConsoleSixAxisSensorAngularAcceleration
|-
| 148 || [5.0.0+] SetConsoleSixAxisSensorAngularAcceleration
|-
| 149 || [5.0.0+] GetRebootlessSystemUpdateVersion
|-
| 150 || [5.0.0+] GetDeviceTimeZoneLocationUpdatedTime
|-
| 151 || [5.0.0+] SetDeviceTimeZoneLocationUpdatedTime
|-
| 152 || [6.0.0+] GetUserSystemClockAutomaticCorrectionUpdatedTime
|-
| 153 || [6.0.0+] SetUserSystemClockAutomaticCorrectionUpdatedTime
|-
| 154 || [6.0.0+] GetAccountOnlineStorageSettings
|-
| 155 || [6.0.0+] SetAccountOnlineStorageSettings
|-
| 156 || [6.0.0+] GetPctlReadyFlag
|-
| 157 || [6.0.0+] SetPctlReadyFlag
|-
| 162 || [6.0.0+] GetPtmBatteryVersion
|-
| 163 || [6.0.0+] SetPtmBatteryVersion
|-
| 164 || [6.0.0+] GetUsb30HostEnableFlag
|-
| 165 || [6.0.0+] SetUsb30HostEnableFlag
|-
| 166 || [6.0.0+] GetUsb30DeviceEnableFlag
|-
| 167 || [6.0.0+] SetUsb30DeviceEnableFlag
|-
| 168 || [7.0.0+] GetThemeId
|-
| 169 || [7.0.0+] SetThemeId
|-
| 170 || [7.0.0+] GetChineseTraditionalInputMethod
|-
| 171 || [7.0.0+] SetChineseTraditionalInputMethod
|-
| 172 || [7.0.0+] GetPtmCycleCountReliability
|-
| 173 || [7.0.0+] SetPtmCycleCountReliability
|-
| 175 || [7.0.0+] GetThemeSettings
|-
| 176 || [7.0.0+] SetThemeSettings
|-
| 177 || [7.0.0+] GetThemeKey
|-
| 178 || [7.0.0+] SetThemeKey
|}

Official user-processes get a new service session handle each time a set:sys cmd is used, with the session being closed aftewards.

== GetFirmwareVersion ==
Takes a type-0x1A output buffer. User-processes use hard-coded size 0x100.

If needed, reads the content of the [[System_Version_Title]] "/file" into state. This is only done once.

Then the above 0x100-byte data is copied to the output buffer.

== GetColorSetId ==
No input, returns an output s32.

This is the current Theme set by System Settings.

* 0: "Basic White"
* 1: "Basic Black"

== SetColorSetId ==
Takes an input s32, no output.

== GetSettingsItemValue ==
Takes two type-0x19 input buffers and a type-0x6 output buffer. Returns an output u64 for the actual size written to the outbuf.

The outbuf_size is compared with the config_size. When config_size is larger than outbuf_size, outbuf_size is used for the memcpy, otherwise config_size is used. Afterwards the size used for the memcpy is written to output(see above).

If loading from main config fails, it will also attempt to load config from various state if the input strings match hard-coded strings.

== GetDebugModeFlag ==
Returns an output u8.

Loads the 1-byte config for <"settings_debug", "is_debug_mode_enabled">. If that fails, value 0x1 is written to output. This uses the same func as ReadSetting internally.

Returned retval is always 0.

== GetSerialNumber ==
Returns the 0x18-byte SerialNumber string.

== GetServiceDiscoveryControlSettings ==
Returns 0x01 if [[Safemode|safemode]] needs to be launched.

== GetAllowedSslHosts ==
Takes a type-0x6 output buffer, returns an output s32. This buffer contains an array of 0x8-byte "nn::settings::system::AllowedSslHost" entries.

== GetQuestFlag ==
Gets a flag determining whether the console is a kiosk unit (codenamed "Quest"). Used by qlaunch to determine whether to launch Retail Interactive Display Menu.

= System Config =
There's a common config title (*818), and a config title for each [[SPL_services|HardwareType]].

[5.0.0+] New config fields were added to the HardwareType-specific config:

* "systeminitializer!eks_enabled" 1 for non-Mariko, 0 otherwise.
* "systeminitializer!bct_eks_offset" Offset within the [[BCT]] where the [[Flash_Filesystem|keyblob]]/"EKS" is stored.
* "systeminitializer!bct_version_offset" Offset within the [[BCT]] where the keyblob version is stored (bootloader0_info.version).
* "systeminitializer!boot_image_update_type" 0 for non-Mariko, 1 otherwise.

"bct_eks_offset" and "bct_version_offset" are only present in non-Mariko config, since (?) Mariko "eks_enabled" is 0. This presumably means the [[Flash_Filesystem|keyblob]]/"EKS" is not embedded in [[BCT]] with Mariko?

[[Category:Services]]

Capture services

2019-03-05T11:00:17Z

Hthh: names for IAlbumAccessorService (thanks Splatoon 2)

= caps:a =
This is "nn::capsrv::sf::IAlbumAccessorService".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetAlbumFileCount
|-
| 1 || GetAlbumFileList
|-
| 2 || LoadAlbumFile
|-
| 3 || DeleteAlbumFile
|-
| 4 || StorageCopyAlbumFile
|-
| 5 || IsAlbumMounted
|-
| 6 || GetAlbumUsage
|-
| 7 || GetAlbumFileSize
|-
| 8 || LoadAlbumFileThumbnail
|-
| 9 || [2.0.0+] LoadAlbumScreenShotImage
|-
| 10 || [2.0.0+] LoadAlbumScreenShotThumbnailImage
|-
| 11 || [2.0.0+] GetAlbumEntryFromApplicationAlbumEntry
|-
| 12 || [3.0.0+]
|-
| 13 || [3.0.0+]
|-
| 14 || [3.0.0+]
|-
| 15 || [4.0.0+]
|-
| 16 || [4.0.0+]
|-
| 17 || [4.0.0+]
|-
| 202 || [1.0.0-2.3.0] SaveEditedScreenShot
|-
| 301 || GetLastThumbnail
|-
| 401 || GetAutoSavingStorage
|-
| 501 || GetRequiredStorageSpaceSizeToCopyAll
|-
| 1001 || [3.0.0+]
|-
| 1002 || [3.0.0+]
|-
| 1003 || [4.0.0+]
|-
| 8001 || ForceAlbumUnmounted
|-
| 8002 || ResetAlbumMountStatus
|-
| 8011 || RefreshAlbumCache
|-
| 8012 || GetAlbumCache
|-
| 8013 || [4.0.0+]
|-
| 8021 || GetAlbumEntryFromApplicationAlbumEntryAruid
|-
| 10011 || SetInternalErrorConversionEnabled
|-
| 60002 || [4.0.0+]
|}

= caps:c =
This is "nn::capsrv::sf::IAlbumControlService".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 33 || [7.0.0+] || Takes a total of 0x10-bytes of input, no output.
|-
| 2001 || ||
|-
| 2002 || ||
|-
| 2011 || ||
|-
| 2012 || ||
|-
| 2013 || ||
|-
| 2014 || ||
|-
| 2101 || || Takes an input u8 and u64, returns a 0x18-byte struct.
|-
| 2102 || ||
|-
| 2201 || ||
|-
| 2301 || ||
|}

= caps:u =
This is "nn::capsrv::sf::IAlbumApplicationService".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 32 || [7.0.0+] || Takes a total of 0x10-bytes of input and a PID, no output.
|-
| 102 || GetAlbumFileListByAruid ||
|-
| 103 || DeleteAlbumFileByAruid ||
|-
| 104 || GetAlbumFileSizeByAruid ||
|-
| 110 || LoadAlbumScreenShotImageByAruid ||
|-
| 120 || LoadAlbumScreenShotThumbnailImageByAruid ||
|-
| 140 || [6.0.0+] ||
|-
| 141 || [6.0.0+] ||
|-
| 60002 || OpenAccessorSessionForApplication ||
|}

== IAlbumAccessorApplicationSession ==
This is "nn::capsrv::sf::IAlbumAccessorApplicationSession".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 2001 || OpenAlbumMovieReadStream
|-
| 2002 || CloseAlbumMovieReadStream
|-
| 2003 || GetAlbumMovieReadStreamMovieDataSize
|-
| 2004 || ReadMovieDataFromAlbumMovieReadStream
|-
| 2005 || GetAlbumMovieReadStreamBrokenReason
|}

= Notes =
capsrv is responsible for validating the MACs for screenshots stored on the SD card, if the setting capsrv!enable_album_screenshot_filedata_verification is non-zero.

Screenshots are validated as follows: The JPEG's MAC is extracted from the EXIF maker note, and stored. A timestamp string is generated by calling snprintf(&str, 20, "%04d:%02d:%02d %02d:%02d:%02d", ...); with stored timestamp values. If this doesn't match the timestamp string stored in EXIF, then an error 0xA34CE is returned. Otherwise, the entire JPEG is loaded into memory, and the stored EXIF maker note is cleared to zeroes. Then, an HMAC-SHA256 is computed over the entire JPEG using a hardcoded secret key. if (memcmp(calculated_hmac, stored_hmac, 0x10) == 0), the screenshot is valid, else 0xA3ACE is returned.

In [[3.0.0]], MAC calculation was changed: now, instead of calculating an HMAC, a plain SHA256 hash is calculated. capsrv basically does screenshot_kek = spl::GenerateAesKek(<hardcoded screenshot_kek_source>); spl::LoadAesKey(screenshot_kek, <hardcoded screenshot_key_source>); MAC = spl::ComputeCmac(hash);

== Videos ==
[[4.0.0]] includes video playback etc support in Album via mp4. These include a JPEG thumbnail, which is used for video "validation". The EXIF is also much larger: the MakerNote is 0x498-bytes, with encrypted data starting at offset +0x8. This encryption uses AES-CTR with hardcoded key/ctr. MAC calculation works the same way as the [[3.0.0]]+ JPEG MAC calculation, except with a different movie_kek_source/movie_key_source.

Note: the Album process itself uses libstagefright for video playback.

[[Category:Services]]

Filesystem services

2019-02-26T07:57:07Z

Hthh:

= fsp-ldr =
This is "nn::fssrv::sf::IFileSystemProxyForLoader".

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Notes
|-
| 0 || OpenCodeFileSystem || u64 TitleId + X descriptor [[#ContentPath]] || Returns an [[#IFileSystem]].
|-
| 1 || IsArchivedProgram || u64 ProcessId || Returns a bool (1 if the process id's [[#ContentPath]] ends in ".nca").
|-
| 2 || [4.0.0+] SetCurrentProcess || PID descriptor ||
|}

= fsp-pr =
This is "nn::fssrv::sf::IProgramRegistry".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#RegisterProgram]] ||
|-
| 1 || [[#UnregisterProgram]] ||
|-
| 2 || [4.0.0+] SetCurrentProcess ||
|-
| 256 || [[#SetEnabledProgramVerification]] ||
|}

== RegisterProgram ==
Takes a storageID, a pid, a titleID, a 0x1C type-A buffer for the [[NPDM#FS_Access_Header| FS Access Header]], and a 0x2C type-A buffer for the [[NPDM#FS_Access_Control| FS Access Control]]

Final FS permissions are stored as (ACI0_perms & ACID_perms). Will panic(svcBreak) when buffer sizes from ipc-rawdata are invalid.

== UnregisterProgram ==
Takes a pid. Removes registered FS permissions for that PID.

== SetEnabledProgramVerification ==
Seems to sets a global flag to inputval & 1.

When the flag is zero, it will set ret=0 instead of ret={error} when verifying the fixed-key [[NPDM]] ACID signature fails. This also skips verifying the [[NCA_Format|NCA Header]] signature using the ACID key. Note that if verifying the fixed-key ACID signature is successful, and verifying the ACID-key NCA header signature fails, it will throw an error and abort.

= fsp-srv =
This is "nn::fssrv::sf::IFileSystemProxy".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0] [[#OpenFileSystem]]
|-
| 1 || [[#SetCurrentProcess]]
|-
| 2 || OpenDataFileSystemByCurrentProcess
|-
| 7 || [2.0.0+] [[#OpenFileSystemWithPatch]]
|-
| 8 || [2.0.0+] [[#OpenFileSystemWithId]]
|-
| 9 || [3.0.0+] OpenDataFileSystemByApplicationId
|-
| 11 || [[#OpenBisFileSystem]]
|-
| 12 || [[#OpenBisStorage]]
|-
| 13 || InvalidateBisCache
|-
| 17 || OpenHostFileSystem
|-
| 18 || OpenSdCardFileSystem
|-
| 19 || [2.0.0+] FormatSdCardFileSystem
|-
| 21 || [[#DeleteSaveDataFileSystem]]
|-
| 22 || [[#CreateSaveDataFileSystem]]
|-
| 23 || [[#CreateSaveDataFileSystemBySystemSaveDataId]]
|-
| 24 || RegisterSaveDataFileSystemAtomicDeletion
|-
| 25 || [2.0.0+] DeleteSaveDataFileSystemBySaveDataSpaceId
|-
| 26 || [2.0.0+] FormatSdCardDryRun
|-
| 27 || [2.0.0+] IsExFatSupported
|-
| 28 || [4.0.0+] DeleteSaveDataFileSystemBySaveDataAttribute
|-
| 30 || [[#OpenGameCardStorage]]
|-
| 31 || [[#OpenGameCardFileSystem]]
|-
| 32 || [3.0.0+] ExtendSaveDataFileSystem
|-
| 33 || [5.0.0+] DeleteCacheStorage
|-
| 34 || [5.0.0+] GetCacheStorageSize
|-
| 35 || [6.0.0+] CreateSaveDataFileSystemByHashSalt (Unofficial name, takes a total of 0xB0-bytes of input, no output)
|-
| 51 || [[#OpenSaveDataFileSystem]]
|-
| 52 || [[#OpenSaveDataFileSystemBySystemSaveDataId]]
|-
| 53 || [2.0.0+] OpenReadOnlySaveDataFileSystem
|-
| 57 || [3.0.0+] [[#ReadSaveDataFileSystemExtraDataBySaveDataSpaceId]]
|-
| 58 || [[#ReadSaveDataFileSystemExtraData]]
|-
| 59 || [2.0.0+] WriteSaveDataFileSystemExtraData
|-
| 60 || [[#OpenSaveDataInfoReader]]
|-
| 61 || [[#OpenSaveDataInfoReaderBySaveDataSpaceId]]
|-
| 62 || [5.0.0+] OpenCacheStorageList
|-
| 64 || [5.0.0+] OpenSaveDataInternalStorageFileSystem
|-
| 65 || [5.0.0+] UpdateSaveDataMacForDebug
|-
| 66 || [5.0.0+] WriteSaveDataFileSystemExtraData2
|-
| 67 || [6.0.0+] FindSaveDataWithFilter (Takes a total of 0x50-bytes of input, returns 8-bytes of output, and a type-0x6 output buffer)
|-
| 68 || [6.0.0+] OpenSaveDataInfoReaderBySaveDataFilter (Unofficial name, takes a total of 0x50-bytes of input, returns an #ISaveDataInfoReader)
|-
| 80 || OpenSaveDataMetaFile
|-
| 81 || [4.0.0+] OpenSaveDataTransferManager (No input, returns an [[#ISaveDataTransferManager]])
|-
| 82 || [5.0.0+] OpenSaveDataTransferManagerVersion2 (No input, returns an [[#ISaveDataTransferManagerWithDivision]])
|-
| 83 || [6.0.0+] OpenSaveDataTransferProhibiterForCloudBackUp (Takes an input u64, returns an [[#ISaveDataTransferProhibiter]])
|-
| 84 || [6.0.0+] ListApplicationAccessibleSaveDataOwnerId (Takes a total of 0x10-bytes of input, returns 4-bytes of output, and a type-0x6 output buffer)
|-
| 100 || OpenImageDirectoryFileSystem
|-
| 110 || [[#OpenContentStorageFileSystem]]
|-
| 120 || [6.0.0+] OpenCloudBackupWorkStorageFileSystem (Takes 4-bytes of input, returns an [[#IFileSystem]])
|-
| 130 || [7.0.0+] OpenCustomStorageFileSystem (Takes 4-bytes of input, returns an [[#IFileSystem]])
|-
| 200 || OpenDataStorageByCurrentProcess
|-
| 201 || [3.0.0+] OpenDataStorageByProgramId
|-
| 202 || [[#OpenDataStorageByDataId]]
|-
| 203 || OpenPatchDataStorageByCurrentProcess
|-
| 204 || [7.0.0+] ? (Takes an input u8, returns an [[#IFileSystem]])
|-
| 205 || [7.0.0+] ? (Takes an input u8, returns an [[#IStorage]])
|-
| 400 || [[#OpenDeviceOperator]]
|-
| 500 || [[#OpenSdCardDetectionEventNotifier]]
|-
| 501 || [[#OpenGameCardDetectionEventNotifier]]
|-
| 510 || [5.0.0+] OpenSystemDataUpdateEventNotifier
|-
| 511 || [5.0.0+] NotifySystemDataUpdateEvent
|-
| 520 || [6.0.0+] SimulateGameCardDetectionEvent (Takes a total of 0xC-bytes of input, no output)
|-
| 600 || [1.0.0-3.0.2] SetCurrentPosixTime
|-
| 601 || QuerySaveDataTotalSize
|-
| 602 || [[#VerifySaveDataFileSystem]]
|-
| 603 || CorruptSaveDataFileSystem
|-
| 604 || CreatePaddingFile
|-
| 605 || DeleteAllPaddingFiles
|-
| 606 || [2.0.0+] GetRightsId
|-
| 607 || [2.0.0+] RegisterExternalKey
|-
| 608 || [2.0.0+] UnregisterAllExternalKey
|-
| 609 || [2.0.0+] GetRightsIdByPath
|-
| 610 || [3.0.0+] GetRightsIdAndKeyGenerationByPath
|-
| 611 || [4.0.0+] SetCurrentPosixTimeWithTimeDifference
|-
| 612 || [4.0.0+] GetFreeSpaceSizeForSaveData
|-
| 613 || [4.0.0+] VerifySaveDataFileSystemBySaveDataSpaceId
|-
| 614 || [4.0.0+] CorruptSaveDataFileSystemBySaveDataSpaceId
|-
| 615 || [5.0.0+] QuerySaveDataInternalStorageTotalSize
|-
| 616 || [6.0.0+] [[#GetSaveDataCommitId]]
|-
| 617 || [7.0.0+] UnregisterExternalKey
|-
| 620 || [2.0.0+] [[#SetSdCardEncryptionSeed]]
|-
| 630 || [4.0.0+] SetSdCardAccessibility
|-
| 631 || [4.0.0+] IsSdCardAccessible
|-
| 640 || [4.0.0+] IsSignedSystemPartitionOnSdCardValid
|-
| 700 || [5.0.0+] OpenAccessFailureResolver
|-
| 701 || [5.0.0+] GetAccessFailureDetectionEvent
|-
| 702 || [5.0.0+] IsAccessFailureDetected
|-
| 710 || [5.0.0+] ResolveAccessFailure
|-
| 720 || [5.0.0+] AbandonAccessFailure
|-
| 800 || [2.0.0+] GetAndClearFileSystemProxyErrorInfo
|-
| 810 || [7.0.0+] RegisterProgramIndexMapInfo
|-
| 1000 || SetBisRootForHost
|-
| 1001 || SetSaveDataSize
|-
| 1002 || SetSaveDataRootPath
|-
| 1003 || DisableAutoSaveDataCreation
|-
| 1004 || [[#SetGlobalAccessLogMode]]
|-
| 1005 || [[#GetGlobalAccessLogMode]]
|-
| 1006 || [[#OutputAccessLogToSdCard]]
|-
| 1007 || [4.0.0+] RegisterUpdatePartition
|-
| 1008 || [4.0.0+] OpenRegisteredUpdatePartition
|-
| 1009 || [4.0.0+] GetAndClearMemoryReportInfo
|-
| 1010 || [5.1.0-6.2.0] SetDataStorageRedirectTarget
|-
| 1011 || [7.0.0+] (no input, returns two 32-bit values, second is "program_index")
|-
| 1100 || [4.0.0+] OverrideSaveDataTransferTokenSignVerificationKey
|-
| 1110 || [6.0.0+] CorruptSaveDataFileSystemBySaveDataSpaceId2
|-
| 1200 || [6.0.0+] OpenMultiCommitManager (No input, returns an output #IMultiCommitManager)
|}

== Permissions ==
Every time permissions are checked, the process registration [[#fsp-pr]] is loaded using the session processID. The permission data is populated with data from the [[NPDM]].

If the processID is <= 6 (which happens only for built-in sysmodules), it will use a hardcoded registration data. The default mask in this case is 0x8000000000000000.

Note that the functions check whether or not at least one bit is set in the mask. This means that, you don't need to set 0xFFFFFFFFFFFFFFFF to get all permissions: it suffices to set 0x8000000000000000.

If the code were to request an invalid input type, panic. But this never happens.

=== RwPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Value || Used by
|-
| 0x0 || 0x8000000000000801 || CanMountLogo || 1 || [[#OpenFileSystem]], [[#OpenFileSystemWithPatch]], [[#OpenFileSystemWithId]]
|-
| 0x1 || 0x8000000000000801 || CanMountContentMeta || 1 || [[#OpenFileSystem]], [[#OpenFileSystemWithPatch]], [[#OpenFileSystemWithId]]
|-
| 0x2 || 0x8000000000000801 || CanMountContentControl || 1 || [[#OpenFileSystem]], [[#OpenFileSystemWithPatch]], [[#OpenFileSystemWithId]]
|-
| 0x3 || 0x8000000000000801 || CanMountContentManual || 1 || [[#OpenFileSystem]], [[#OpenFileSystemWithPatch]], [[#OpenFileSystemWithId]]
|-
| 0x4 || 0x8000000000000801 || CanMountContentData || 1 || [[#OpenFileSystem]], [[#OpenFileSystemWithPatch]], [[#OpenFileSystemWithId]]
|-
| 0x5 || 0x8000000000000801 || CanMountApplicationPackage || 1 || [[#OpenFileSystem]], [[#OpenFileSystemWithPatch]], [[#OpenFileSystemWithId]]
|-
| 0x6 || 0x8000000000000000 || CanMountSaveDataStorage || 3 ||
|-
| 0x7 || 0x8000000000000800 || CanMountContentStorage || 3 || [[#OpenContentStorageFileSystem]]
|-
| 0x8 || 0x8000000000001000 || CanMountImageAndVideoStorage || 3 || [[#OpenImageDirectoryFileSystem]]
|-
| 0x9 || 0x8000000200000000 ([1.0.0-5.1.0] 0x8000000000000084) || CanMountCloudBackupWorkStorage || 3 || OpenCloudBackupWorkStorageFileSystem
|-
| 0xA || 0x8000000000000084 ([1.0.0-5.1.0] 0x8000000000000080) || CanMountBisCalibrationFile || 3 || [[#OpenBisFileSystem]]
|-
| 0xB || 0x8000000000000080 ([1.0.0-5.1.0] 0x8000000000008080) || CanMountBisSafeMode || 3 || [[#OpenBisFileSystem]]
|-
| 0xC || 0x8000000000008080 || CanMountBisUser || 3 || [[#OpenBisFileSystem]]
|-
| 0xD || 0x8000000000008080 ([1.0.0-5.1.0] 0x8000000000000080) || CanMountBisSystem || 3 || [[#OpenBisFileSystem]]
|-
| 0xE || 0x8000000000000080 ([1.0.0-2.3.0] 0xC000000000200000) || CanMountBisSystemProperEncryption || 3 || [[#OpenBisFileSystem]]
|-
| 0xF || 0x8000000000000080 ([3.0.0-5.1.0] 0xC000000000200000) ([1.0.0-2.3.0] 0x8000000000000010) || CanMountBisSystemProperPartition || 3 || [[#OpenBisFileSystem]]
|-
| 0x10 || 0xC000000000200000 ([3.0.0-5.1.0] 0x8000000000000010) ([1.0.0-2.3.0] 0x8000000000040020) || CanMountSdCard || 3 || [[#OpenSdCardFileSystem]]
|-
| 0x11 || 0x8000000000000010 ([3.0.0-5.1.0] 0x8000000000040020) ([1.0.0-2.3.0] 0x8000000000000028) || CanMountGameCard || 3 || [[#OpenGameCardFileSystem]]
|-
| 0x12 || 0x8000000000040020 ([3.0.0-5.1.0] 0x8000000000000028) ([1.0.0-2.3.0] 0x8000000000000020) || CanMountDeviceSaveData || 3 || [[#OpenSaveDataFileSystem]]
|-
| 0x13 || 0x8000000000000028 ([1.0.0-5.1.0] 0x8000000000000020) || CanMountSystemSaveData || 3 || [[#OpenSaveDataFileSystemBySystemSaveDataId]]
|-
| 0x14 || 0x8000000000000020 ([1.0.0-2.3.0] 0x8000000000010082) || CanMountOthersSaveData || 3 || [[#OpenSaveDataFileSystem]]
|-
| 0x15 || 0x8000000000000020 ([3.0.0-5.1.0] 0x8000000000010082) ([1.0.0-2.3.0] 0x8000000000010080) || CanMountOthersSystemSaveData || 3 || [[#OpenSaveDataFileSystemBySystemSaveDataId]]
|-
| 0x16 || 0x8000000000010082 ([1.0.0-5.1.0] 0x8000000000010080) || CanOpenBisPartitionBootPartition1Root || 3 || [[#OpenBisStorage]]
|-
| 0x17 || 0x8000000000010080 ([3.0.0-5.1.0] 0x8000000000000080) ([1.0.0-2.3.0] 0x8000000000010080) || CanOpenBisPartitionBootPartition2Root || 3 || [[#OpenBisStorage]]
|-
| 0x18 || 0x8000000000000080 ([1.0.0-5.1.0] 0x8000000000010080) || CanOpenBisPartitionUserDataRoot || 3 || [[#OpenBisStorage]]
|-
| 0x19 || 0x8000000000010080 || CanOpenBisPartitionBootConfigAndPackage2Part1 || 3 || [[#OpenBisStorage]]
|-
| 0x1A || 0x8000000000010080 || CanOpenBisPartitionBootConfigAndPackage2Part2 || 3 || [[#OpenBisStorage]]
|-
| 0x1B || 0x8000000000010080 || CanOpenBisPartitionBootConfigAndPackage2Part3 || 3 || [[#OpenBisStorage]]
|-
| 0x1C || 0x8000000000010080 || CanOpenBisPartitionBootConfigAndPackage2Part4 || 3 || [[#OpenBisStorage]]
|-
| 0x1D || 0x8000000000010080 ([1.0.0-2.3.0] 0x8000000000000084) || CanOpenBisPartitionBootConfigAndPackage2Part5 || 3 || [[#OpenBisStorage]]
|-
| 0x1E || 0x8000000000010080 ([1.0.0-5.1.0] 0x8000000000000084) || CanOpenBisPartitionBootConfigAndPackage2Part6 || 3 || [[#OpenBisStorage]]
|-
| 0x1F || 0x8000000000000084 ([1.0.0-2.3.0] 0x8000000000000080) || CanOpenBisPartitionCalibrationBinary || 3 || [[#OpenBisStorage]]
|-
| 0x20 || 0x8000000000000084 ([1.0.0-5.1.0] 0x8000000000000080) || CanOpenBisPartitionCalibrationFile || 3 || [[#OpenBisStorage]]
|-
| 0x21 || 0x8000000000000080 || CanOpenBisPartitionSafeMode || 3 || [[#OpenBisStorage]]
|-
| 0x22 || 0x8000000000000080 || CanOpenBisPartitionUser || 3 || [[#OpenBisStorage]]
|-
| 0x23 || 0x8000000000000080 ([1.0.0-2.3.0] 0xC000000000200000) || CanOpenBisPartitionSystem || 3 || [[#OpenBisStorage]]
|-
| 0x24 || 0x8000000000000080 ([1.0.0-2.3.0] 0x8000000000000100) || CanOpenBisPartitionSystemProperEncryption || 3 || [[#OpenBisStorage]]
|-
| 0x25 || 0x8000000000000080 ([3.0.0-5.1.0] 0xC000000000200000) ([1.0.0-2.3.0] 0x8000000000100008) || CanOpenBisPartitionSystemProperPartition || 3 || [[#OpenBisStorage]]
|-
| 0x26 || 0xC000000000200000 ([3.0.0-5.1.0] 0x8000000000000100) ([1.0.0-2.3.0] 0xC000000000400000) || CanOpenSdCardStorage || ||
|-
| [3.0.0+] 0x27 || 0x8000000000000100 ([1.0.0-5.1.0] 0x8000000000100008) || CanOpenGameCardStorage || 3 || [[#OpenGameCardStorage]], [[#EraseGameCard]] (bit1), [[#WriteToGameCard]] (bit1), [[#GetGameCardErrorInfo]] (bit1), [[#EraseAndWriteParamDirectly]] (bit1), [[#ReadParamDirectly]] (bit1), [[#ForceEraseGameCard]] (bit1)
|-
| [3.0.0+] 0x28 || 0x8000000000100008 ([1.0.0-5.1.0] 0xC000000000400000) || CanMountSystemDataPrivate || 1 || [[#OpenFileSystem]], [[#OpenDataStorageByDataId]]
|-
| [4.0.0+] 0x29 || 0xC000000000400000 ([1.0.0-5.1.0] 0x8000000000010000) || CanMountHost || 3 || [[#OpenHostFileSystem]]
|-
| [5.0.0+] 0x2A || 0x8000000000010000 ([1.0.0-5.1.0] 0x8000000000000000) || CanMountRegisteredUpdatePartition || 1 || [[#OpenRegisteredUpdatePartition]]
|-
| [6.0.0+] 0x2B || 0x8000000000000000 || CanOpenSaveDataInternalStorage || 3 || [[#OpenSaveDataInternalStorageFileSystem]]
|}

=== BoolPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Used by
|-
| 0x0 || 0x8000000000000080 || CanInvalidateBisCache || [[#InvalidateBisCache]]
|-
| 0x1 || 0x8000000000000080 || CanEraseMmc || [[#EraseMmc]]
|-
| 0x2 || 0x8000000000000010 || CanGetGameCardDeviceCertificate || [[#GetGameCardDeviceCertificate]]
|-
| 0x3 || 0x8000000000000010 || CanGetGameCardIdSet || [[#GetGameCardIdSet]]
|-
| 0x4 || 0x8000000000000200 || CanFinalizeGameCardDriver || [[#FinalizeGameCardDriver]]
|-
| 0x5 || 0x8000000000000200 || CanGetGameCardAsicInfo || [[#GetGameCardAsicInfo]]
|-
| 0x6 || 0x8000000000002020 || CanCreateSaveData || [[#CreateSaveDataFileSystem]]
|-
| 0x7 || 0x8000000000000060 || CanDeleteSaveData || [[#DeleteSaveDataFileSystem]], [[#RegisterSaveDataFileSystemAtomicDeletion]]
|-
| 0x8 || 0x8000000000000028 || CanCreateSystemSaveData || [[#CreateSaveDataFileSystemBySystemSaveDataId]]
|-
| 0x9 || 0x8000000000000020 || CanCreateOthersSystemSaveData || [[#CreateSaveDataFileSystemBySystemSaveDataId]]
|-
| 0xA || 0x8000000000004028 || CanDeleteSystemSaveData || [[#DeleteSaveDataFileSystem]], [[#RegisterSaveDataFileSystemAtomicDeletion]]
|-
| 0xB || 0x8000000000000060 || CanOpenSaveDataInfoReader || [[#OpenSaveDataInfoReaderBySaveDataSpaceId]], [[#OpenSaveDataInfoReader]]
|-
| 0xC || 0x8000000000004020 || CanOpenSaveDataInfoReaderForSystem || [[#OpenSaveDataInfoReaderBySaveDataSpaceId]], [[#OpenSaveDataInfoReader]]
|-
| 0xD || 0x8000000000000040 ([1.0.0-5.1.0] 0x8000000000020000) || || OpenSaveDataInfoReaderBySaveDataFilter
|-
| 0xE || 0x8000000000020000 ([1.0.0-5.1.0] 0x8000000000000400) || CanOpenSaveDataMetaFile || [[#OpenSaveDataMetaFile]]
|-
| 0xF || 0x8000000000000400 ([1.0.0-5.1.0] 0x8000000000004060) || CanSetCurrentPosixTime || [[#SetCurrentPosixTime]], [[#SetCurrentPosixTimeWithTimeDifference]]
|-
| 0x10 || 0x8000000000004060 ([1.0.0-5.1.0] 0x8000000000080000) || CanReadSaveDataFileSystemExtraData || [[#ReadSaveDataFileSystemExtraData]]
|-
| 0x11 || 0x8000000000080000 || CanSetGlobalAccessLogMode || [[#SetGlobalAccessMode]]
|-
| 0x12 || 0x8000000000080000 ([1.0.0-5.1.0] Invalid) || CanSetSpeedEmulationMode || [[#SetSpeedEmulationMode]]
|-
| 0x13 || Invalid ([1.0.0-5.1.0] 0xC000000000800000) || ||
|-
| 0x14 || 0xC000000000800000 ([1.0.0-5.1.0] 0xC000000001000000) || CanFillBis || [[#CreatePaddingFile]], [[#DeleteAllPaddingFiles]]
|-
| 0x15 || 0xC000000001000000 ([5.0.0-5.1.0] 0x8000000001000060) ([1.0.0-4.1.0] 0xC000000002000000) || CanCorruptSaveData || [[#CorruptSaveDataFileSystem]], [[#CorruptSaveDataFileSystemBySaveDataSpaceId]]
|-
| [2.0.0+] 0x16 || 0x8000000001000060 ([5.0.0-5.1.0] 0x8000000000000060) ([1.0.0-4.1.0] 0x8000000004000000) || CanCorruptSystemSaveData || [[#CorruptSaveDataFileSystem]], [[#CorruptSaveDataFileSystemBySaveDataSpaceId]]
|-
| [2.0.0+] 0x17 || 0x8000000000000060 ([5.0.0-5.1.0] 0xC000000002000000) ([1.0.0-4.1.0] 0x8000000008000000) || CanVerifySaveData || [[#VerifySaveDataFileSystem]], [[#VerifySaveDataFileSystemBySaveDataSpaceId]]
|-
| [2.0.0+] 0x18 || 0xC000000002000000 ([5.0.0-5.1.0] 0x8000000004000000) ([1.0.0-4.1.0] 0x8000000010000000) || CanDebugSaveData || [[#CreateSaveDataFileSystem]], [[#OpenSaveDataFileSystem]], [[#SetSaveDataRootPath]]
|-
| [2.0.0+] 0x19 || 0x8000000004000000 ([5.0.0-5.1.0] 0x8000000008000000) ([1.0.0-4.1.0] 0x8000000000000800) || CanFormatSdCard || [[#FormatSdCardFileSystem]]
|-
| [2.0.0+] 0x1A || 0x8000000008000000 ([5.0.0-5.1.0] 0x8000000010000000) ([1.0.0-4.1.0] 0x8000000000004020) || CanGetRightsId || [[#GetRightsId]], [[#GetRightsIdAndKeyGenerationByPath]], [[#GetRightsIdByPath]]
|-
| [3.0.0+] 0x1B || 0x8000000010000000 ([5.0.0-5.1.0] 0x8000000000000800) ([1.0.0-4.1.0] 0x8000000000002020) || CanRegisterExternalKey || [[#RegisterExternalKey]], [[#UnregisterAllExternalKey]]
|-
| [3.0.0+] 0x1C || 0x8000000000000800 ([5.0.0-5.1.0] 0x8000000000004020) ([1.0.0-4.1.0] 0x8000000000000028) || CanSetEncryptionSeed || [[#SetSdCardEncryptionSeed]]
|-
| [4.0.0+] 0x1D || 0x8000000000000020 ([5.0.0-5.1.0] 0x8000000000000000) ([1.0.0-4.1.0] 0x8000000020000000) || SaveDataExtraData_Write0 || [[#WriteSaveDataFileSystemExtraData]], [[#WriteSaveDataFileSystemExtraData2]]
|-
| [4.0.0+] 0x1E || 0x8000000000004020 ([5.0.0-5.1.0] 0x8000000000002020) ([1.0.0-4.1.0] 0x8000000040000000) || CanWriteSaveDataFileSystemExtraDataFlags || [[#WriteSaveDataFileSystemExtraData]], [[#WriteSaveDataFileSystemExtraData2]]
|-
| [4.0.0+] 0x1F || 0x8000000000000020 ([5.0.0-5.1.0] 0x8000000000000028) ([1.0.0-4.1.0] 0x8000000000000000) || SaveDataExtraData_Write1 || [[#WriteSaveDataFileSystemExtraData]], [[#WriteSaveDataFileSystemExtraData2]]
|-
| [4.0.0+] 0x20 || 0x8000000000000000 ([5.0.0-5.1.0] 0x8000000020000000) ([1.0.0-4.1.0] 0x8000000000000000) || CanWriteSaveDataFileSystemExtraDataAll || [[#WriteSaveDataFileSystemExtraData]], [[#WriteSaveDataFileSystemExtraData2]]
|-
| [5.0.0+] 0x21 || 0x8000000000002020 ([1.0.0-5.1.0] 0x8000000040000000) || CanExtendSaveData || [[#ExtendSaveDataFileSystem]]
|-
| [5.0.0+] 0x22 || 0x8000000000000028 ([1.0.0-5.1.0] 0x0000000080000002) || CanExtendSystemSaveData || [[#ExtendSaveDataFileSystem]]
|-
| [5.0.0+] 0x23 || 0x8000000020000000 ([1.0.0-5.1.0] 0x8000000000000000) || CanRegisterUpdatePartition || [[#RegisterUpdatePartition]]
|-
| [5.0.0+] 0x24 || 0x8000000040000000 ([1.0.0-5.1.0] 0x8000000000000000) || CanOpenSaveDataTransferManager || [[#OpenSaveDataTransferManager]]
|-
| [5.0.0+] 0x25 || 0x8000000200000000 ([1.0.0-5.1.0] 0x8000000080200000) || CanOpenSaveDataTransferManagerVersion2 || [[#OpenSaveDataTransferManagerVersion2]]
|-
| [5.0.0+] 0x26 || 0x8000000200002000 ([1.0.0-5.1.0] 0x8000000080000110) || CanOpenSaveDataTransferProhibiterForCloudBackUp || [[#OpenSaveDataTransferProhibiterForCloudBackUp]]
|-
| [5.0.0+] 0x27 || 0x8000000200002000 ([1.0.0-5.1.0] 0x8000000000100008) || CanListApplicationAccessibleSaveDataOwnerId || ListApplicationAccessibleSaveDataOwnerId
|-
| [5.0.0+] 0x28 || 0x8000000000000000 ([1.0.0-5.1.0] 0x8000000080010000) || CanControlMmcPatrol || [[#SuspendMmcPatrol]], [[#ResumeMmcPatrol]]
|-
| [5.0.0+] 0x29 || 0x8000000000000000 ([1.0.0-5.1.0] 0x0000000080000001) || CanOverrideSaveDataTransferTokenSignVerificationKey || [[#OverrideSaveDataTransferTokenSignVerificationKey]]
|-
| [5.0.0+] 0x2A || 0x8000000080200000 ([1.0.0-5.1.0] 0x0000000080000001) || CanOpenSdCardDetectionEventNotifier || [[#OpenSdCardDetectionEventNotifier]]
|-
| [5.0.0+] 0x2B || 0x8000000080000110 ([1.0.0-5.1.0] 0x0000000080000001) || CanOpenGameCardDetectionEventNotifier || [[#OpenGameCardDetectionEventNotifier]]
|-
| [5.0.0+] 0x2C || 0x8000000000100008 ([1.0.0-5.1.0] 0x0000000080000001) || CanOpenSystemDataUpdateEventNotifier || [[#OpenSystemDataUpdateEventNotifier]]
|-
| [5.0.0+] 0x2D || 0x8000000000010000 ([1.0.0-5.1.0] 0x0000000080000001) || CanNotifySystemDataUpdateEvent || [[#NotifySystemDataUpdateEvent]]
|-
| [5.0.0+] 0x2E || 0x8000000100000000 ([1.0.0-5.1.0] 0x8000000040000000) || CanOpenAccessFailureDetectionEventNotifier || [[#OpenAccessFailureResolver]]
|-
| [5.0.0+] 0x2F || 0x8000000100000000 ([1.0.0-5.1.0] 0x8000000080200000) || CanGetAccessFailureDetectionEvent || [[#GetAccessFailureDetectionEvent]]
|-
| [5.1.0+] 0x30 || 0x8000000100000000 ([1.0.0-5.1.0] 0x8000000080080000) || CanIsAccessFailureDetected || [[#IsAccessFailureDetected]]
|-
| [6.0.0+] 0x31 || 0x8000000100000000 || CanResolveAccessFailure || [[#ResolveAccessFailure]]
|-
| [6.0.0+] 0x32 || 0x8000000100000000 || CanAbandonAccessFailure || [[#AbandonAccessFailure]]
|-
| [6.0.0+] 0x33 || 0x8000000040000000 || CanQuerySaveDataInternalStorageTotalSize || [[#QuerySaveDataInternalStorageTotalSize]]
|-
| [6.0.0+] 0x34 || 0x8000000200000020 || CanGetSaveDataCommitId || [[#GetSaveDataCommitId]]
|-
| [6.0.0+] 0x35 || 0x8000000000200000 || CanSetSdCardAccessibility || [[#SetSdCardAccessibility]]
|-
| [6.0.0+] 0x36 || 0x4000000000000000 || || SimulateGameCardDetectionEvent, SetGameCardSimulationEvent, ClearGameCardSimulationEvent
|-
| [6.0.0+] 0x37 || 0x8000000000080000 || CanSetDataStorageRedirectTarget || SetDataStorageRedirectTarget
|-
| [6.0.0+] 0x38 || 0x8000000000000000 || || [[#CreateSaveDataFileSystem]], CreateSaveDataFileSystemByHashSalt
|}

== OpenFileSystem ==
Takes a type-0x19 input buffer (ContentPath) and a [[#FileSystemType]] as parameters. Returns an [[#IFileSystem]].

[2.0.0+] This function was removed.

== SetCurrentProcess ==
Takes a pid-descriptor.

== OpenFileSystemWithPatch ==
Takes an input [[#FileSystemType]] and an u64 title-id. Returns an [[#IFileSystem]].

Web-applet loads the [[#FileSystemType]] (which must be '''ContentManual''') from u32_table[inparam].

Note: web-applet strings refer to both this cmd and [[#OpenFileSystemWithId]] as "MountContent", but official nn_sf_sync symbols use "OpenXX" names.

== OpenFileSystemWithId ==
Takes a type-0x19 input buffer, an [[#FileSystemType]] and an u64 title-id. Returns an [[#IFileSystem]].

The [[#IFileSystem]] must be '''ContentMeta''' if the NCA type is 0 (control).

The input buffer is the output string path from [[NS_Services#GetApplicationContentPath|GetApplicationContentPath]].

May return errors when attempting to access NCA-paths for an update-title with a gamecard, when the gamecard isn't inserted. May return error 0x7D402 in some cases with update-titles. Non-val2 in32 values with NCA-type1 are unusable, even for normal titles.

The official "MountApplicationPackage" func uses this with in64=0 and [[#FileSystemType]] '''ApplicationPackage'''.

After the [[#FileSystemType]] specific permissions are checked, it then gets the func retval for permissions-type 0x25 and func0.

When [[#FileSystemType]] is '''ContentMeta''', it uses in64=0xffffffffffffffff internally, otherwise it checks if in64 is set to 0xffffffffffffffff then throws an error if so. When the in64 used internally is not 0xffffffffffffffff, it's compared with the NCA titleID, then an error is thrown on mismatch.

== OpenBisFileSystem ==
Takes a type-0x19 input buffer string and a u32 [[Flash_Filesystem|Bis partitionID]]. Official user-process code sets instr[0] = 0 normally. Returns an [[#IFileSystem]].

Only partitionIDs for FAT partitions are usable with this, otherwise error 0x2EE202 is returned. Seems to be about the same as [[#OpenBisStorage]] except this mounts the partition filesystem instead of allowing direct access to the partition sectors.

== OpenBisStorage ==
Takes a u32 partition ID, returns 0x2EE202 for partitions which do not exist, 0x320002 for partitions which cannot be opened and a valid [[#IStorage]] handle otherwise.

== InvalidateBisCache ==
Seems to invalidate the Bis cache for MBR/GPT after overwriting that data via the OpenBisStorage IStorage. Used by [[SystemInitializer]].

== DeleteSaveDataFileSystem ==
Takes an input u64.

== CreateSaveDataFileSystem ==
Takes a 0x40-byte Save-struct entry, a 0x40-byte SaveCreate-struct entry, and a 0x10-byte input struct.

Only the first 0x5-bytes in the 0x10-byte struct are initialized: all-zero when automatically creating savedata during savecommon mount by official user-processes. In the dedicated save-creation code in official user-processes: +0 u32 = 0x40060, +4 u8 = 1.

Creates regular savedata.

== CreateSaveDataFileSystemBySystemSaveDataId ==
Takes a 0x40-byte Save-struct entry and a 0x40-byte SaveCreate-struct entry.

Creates savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== OpenGameCardStorage ==
Takes two input u32s (gamecard handle, partition ID), and returns an [[#IStorage]] for the [[Gamecard_Format|partition]].

== OpenGameCardFileSystem ==
Takes two input u32s, with the second u32 located at +4 in rawdata after the first u32. Returns an [[#IFileSystem]].

Mounts a [[Gamecard_Partition|gamecard partition]].

== OpenSaveDataFileSystem ==
Takes an input u8 [[#SaveDataSpaceId]] and a 0x40-byte Save-struct entry. Official user-process code is only known to use value 1 for the u8.

Returns an [[#IFileSystem]].

Permissions aren't checked until the specified save is successfully found.

Only one process (specifically only one [[#IFileSystem]] session) can mount a given savedata at any given time (this includes SystemSaveData).

== OpenSaveDataFileSystemBySystemSaveDataId ==
Takes an input u8 [[#SaveDataSpaceId]] and a 0x40-byte Save-struct entry. Web-applet only uses value0 for the input u8.

Returns an [[#IFileSystem]].

Mounts savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== ReadSaveDataFileSystemExtraDataBySaveDataSpaceId ==
Takes an input u8 [[#SaveDataSpaceId]], an input u64 saveID, and a type-0x6 output buffer containing the [[#SaveDataFileSystemExtraData]].

== ReadSaveDataFileSystemExtraData ==
Takes an input u64 saveID and a type-0x6 output buffer containing the [[#SaveDataFileSystemExtraData]].

== OpenSaveDataInfoReader ==
No input, returns an output [[#ISaveDataInfoReader]].

== OpenSaveDataInfoReaderBySaveDataSpaceId ==
Takes an input u8 [[#SaveDataSpaceId]], returns an output [[#ISaveDataInfoReader]].

== OpenContentStorageFileSystem ==
Takes a [[#ContentStorageId]]. Invalid values return 0x2EE202.

Returns an [[#IFileSystem]] with NCA files. The read data from these files is identical to the data read by [[NCM_services#ReadContentIdFile]].

== OpenDataStorageByDataId ==
Takes a [[#StorageId]] and a TitleID.

Returns a [[IPC_Marshalling#Domain_message|domain object ID]] implementing the [[#IStorage]] interface for data archives.

== OpenDeviceOperator ==
This command returns a session to a port implementing the [[#IDeviceOperator]] interface.

== OpenSdCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== OpenGameCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== VerifySaveDataFileSystem ==
Takes an unknown input u64 and a type-0x6 output buffer.

The input u64 high-byte must be non-zero, otherwise an [[Error_codes|error]] is returned(0xE02).

== GetSaveDataCommitId ==
Takes an input u8 and u64, returns an output u64.

== SetSdCardEncryptionSeed ==
Takes in the 0x10 byte SD card encryption seed, and loads it into FS-module state.

[[NS_Services|NS]]-module reads the 0x10 bytes from SdCard:/Nintendo/Contents/private, and compares them to the first 0x10 bytes of the ns_appman:/private (in [[Flash_Filesystem#System_Savegames|system savedata]] 0x8000000000000043). If they match, NS calls this command using bytes 0x10-0x20 from ns_appman:/private. The rest of this file (0x1F0 bytes total) is (usually/always?) all-zero (however in some cases the byte at offset 0x20 is value 0x1).

== SetGlobalAccessLogMode ==
Takes an input u32.

== GetGlobalAccessLogMode ==
Returns an output u32.

GlobalAccessLogMode is normally 0.

== OutputAccessLogToSdCard ==
Takes a type-0x5 input buffer.

The input buffer is the string to output to the log. User-processes normally include a newline at the end.

User-processes only use this when the value previously loaded from [[#GetGlobalAccessLogMode]] has bit1 set.

When bit1 in GlobalAccessLogMode is clear, FS-module will just return 0 for OutputAccessLogToSdCard. However even with that set the log doesn't show up SD, unknown why.

The input buffer is written to the "$FsAccessLog:/FsAccessLog.txt" file, where "$FsAccessLog" is the SD-card mount-name. It's written to the current end of the file(appended).

= IStorage =
This is "nn::fssrv::sf::IStorage".

This is the interface for a raw device, usually a block device.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments
|-
| 0 || Read || Takes a type-0x46 buffer, an offset and length
|-
| 1 || Write || Takes a type-0x45 buffer, an offset and length
|-
| 2 || Flush || None
|-
| 3 || SetSize || Takes a size
|-
| 4 || GetSize || None
|-
| 5 || [4.0.0+] OperateRange ||
|}

= IFileSystem =
This is "nn::fssrv::sf::IFileSystem".

There are two main implementations of this interface:

* '''RomFS''': Filesystem implementation statically linked in the binary. Uses an [[#IStorage]] interface as underlying raw device.
* '''IPC proxy''': Used for all non-RomFS filesystems. In this case, actual filesystem implementation is in the FS process.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateFile
|-
| 1 || DeleteFile
|-
| 2 || CreateDirectory
|-
| 3 || DeleteDirectory
|-
| 4 || DeleteDirectoryRecursively
|-
| 5 || RenameFile
|-
| 6 || RenameDirectory
|-
| 7 || [[#GetEntryType]]
|-
| 8 || [[#OpenFile]]
|-
| 9 || [[#OpenDirectory]]
|-
| 10 || [[#Commit]]
|-
| 11 || [[#GetFreeSpaceSize]]
|-
| 12 || [[#GetTotalSpaceSize]]
|-
| 13 || [3.0.0+] [[#CleanDirectoryRecursively]]
|-
| 14 || [3.0.0+] [[#GetFileTimeStampRaw]]
|-
| 15 || [4.0.0+] QueryEntry
|}

== GetEntryType ==
Takes a type-0x9 input buffer for the path and returns [[#DirectoryEntryType]] as an output u32.

== OpenFile ==
Takes a type-0x19 input buffer for the path, and an u32 '''mode'''. '''mode''' controls how the file is opened, based on which bits are set:

* When bit 0 is set, the file is Readable: you can use the Read operation.
* When bit 1 is set, the file is Writable: you can use the Write operation.
* When bit 2 is set, the file is Appendable: unless this bit is set, you will not be able to write beyond the end of a file (such writes will result in an error 0x307202)

== OpenDirectory ==
Takes a type-0x9 input buffer for the path and an u64 '''filter_flags'''. '''filter_flags''' controls what type of entries are read by the [[#IDirectory]]: bitmask 0x1 = directories, bitmask 0x2 = files.

== Commit ==
Like [https://3dbrew.org/wiki/FS:ControlArchive 3DS], this has to be used after writing to savedata for the changes to take affect.

== GetFreeSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total free space with this FS.

== GetTotalSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total space available with this FS(free+used).

== CleanDirectoryRecursively ==
Takes a type-0x9 input buffer for the path and clears the contents of the directory specified in the path.

== GetFileTimeStampRaw ==
Takes a type-0x19 input buffer for the path and returns a 0x20-byte struct. This contains 3 u64s and an u8.

= IDirectory =
This is "nn::fssrv::sf::IDirectory".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Read]]
|-
| 1 || [[#GetEntryCount]]
|}

== Read ==
Takes a type-0x6 output buffer. Returns an output u64(?) for the total number of read entries, this is 0 when no more entries are available.

The output buffer contains the read array of [[#DirectoryEntry]]. This doesn't include entries for "." and "..".

== GetEntryCount ==
Returns an u64 for the total number of readable entries.

= DirectoryEntry =
{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x301 || Path
|-
| 0x301 || 0x3 || ?
|-
| 0x304 || 0x1 || [[#DirectoryEntryType]]
|-
| 0x305 || 0x3 || Padding?
|-
| 0x308 || 0x8 || Filesize, 0 for directories.
|}

= DirectoryEntryType =

An s8 value indicating a directory entry type. The current values are:

{| class="wikitable" border="1"
|-
! Value || Description
|-
| 0 || Directory
|-
| 1 || File
|}

= IFile =
This is "nn::fssrv::sf::IFile".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Read
|-
| 1 || Write
|-
| 2 || Flush
|-
| 3 || SetSize
|-
| 4 || GetSize
|-
| 5 || [4.0.0+] OperateRange
|}

= ISaveDataInfoReader =
This is "nn::fssrv::sf::ISaveDataInfoReader".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ReadSaveDataInfo]]
|}

== ReadSaveDataInfo ==
Takes a type-0x6 output buffer. Returns an output u64 for total output entries. This buffer contains an array of [[#SaveDataInfo]].

This is used to get [[#SaveDataInfo]] for all savedata on the system (or all savedata for the current [[#SaveDataSpaceId]]). When used multiple times, it will resume reading where it left off, until no more entries are available (in that case the out u64 is value 0).

= IDeviceOperator =
This is "nn::fssrv::sf::IDeviceOperator".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsSdCardInserted
|-
| 1 || GetSdCardSpeedMode
|-
| 2 || [2.0.0+] GetSdCardCid
|-
| 3 || [2.0.0+] GetSdCardUserAreaSize
|-
| 4 || [2.0.0+] GetSdCardProtectedAreaSize
|-
| 5 || [2.0.0+] GetAndClearSdCardErrorInfo
|-
| 100 || GetMmcCid
|-
| 101 || GetMmcSpeedMode
|-
| 110 || EraseMmc
|-
| 111 || GetMmcPartitionSize
|-
| 112 || [2.0.0+] GetMmcPatrolCount
|-
| 113 || [2.0.0+] GetAndClearMmcErrorInfo
|-
| 114 || [2.0.0+] GetMmcExtendedCsd
|-
| 115 || [4.0.0+] SuspendMmcPatrol
|-
| 116 || [4.0.0+] ResumeMmcPatrol
|-
| 200 || IsGameCardInserted
|-
| 201 || EraseGameCard
|-
| 202 || GetGameCardHandle
|-
| 203 || [[#GetGameCardUpdatePartitionInfo]]
|-
| 204 || FinalizeGameCardDriver
|-
| 205 || GetGameCardAttribute
|-
| 206 || GetGameCardDeviceCertificate
|-
| 207 || GetGameCardAsicInfo
|-
| 208 || GetGameCardIdSet
|-
| 209 || WriteToGameCard
|-
| 210 || SetVerifyWriteEnalbleFlag
|-
| 211 || GetGameCardImageHash
|-
| 212 || [2.0.0+] GetGameCardDeviceIdForProdCard
|-
| 213 || [2.0.0+] EraseAndWriteParamDirectly
|-
| 214 || [2.0.0+] ReadParamDirectly
|-
| 215 || [2.0.0+] ForceEraseGameCard
|-
| 216 || [2.0.0+] GetGameCardErrorInfo
|-
| 217 || [2.1.0+] GetGameCardErrorReportInfo
|-
| 218 || [3.0.0+] GetGameCardDeviceId
|-
| 300 || SetSpeedEmulationMode
|-
| 301 || GetSpeedEmulationMode
|-
| 400 || [5.0.0+] SuspendSdmmcControl
|-
| 401 || [5.0.0+] ResumeSdmmcControl
|-
| 402 || [6.0.0+] GetSdmmcConnectionStatus (Takes a total of 4-bytes of input, returns a total of 8-bytes of output)
|-
| 500 || [6.0.0+] SetSimulationEvent (Takes a total of 0x14-bytes of input, no output)
|-
| 501 || [6.0.0+] ClearSimulationEvent (Takes a total of 4-bytes of input, no output)
|}

== GetGameCardUpdatePartitionInfo ==
Returns a titleID and the title-version for it.

* Output u32 with ARMS-gamecard: title-version v131162. This is the title-version for [[2.1.0]], which is the sysupdate included with this gamecard. Launch-day gamecards return title-version v450.
* Output u64 with ARMS-gamecard: titleID 0100000000000816.

[[NS_Services|NS]] appears to only use this with [[Content_Manager_services#GetTitleIdInfo]] and [[Content_Manager_services#GetUpdateTitleList]] with storageid=nandsys, for checking whether a sysupdate is required.

= IEventNotifier =
This is "nn::fssrv::sf::IEventNotifier".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetEventHandle
|}

= ISaveDataTransferManager =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetChallenge]]
|-
| 16 || [[#SetToken]]
|-
| 32 || [[#OpenSaveDataExporter]]
|-
| 64 || [[#OpenSaveDataImporter]]
|}

This was added with [[4.0.0]].

== GetChallenge ==
No input/output, takes a type-0x6 output buffer.

== SetToken ==
No input/output, takes a type-0x5 input buffer.

== OpenSaveDataExporter ==
Takes an input u8 [[#SaveDataSpaceId]] and u64, returns an [[#ISaveDataExporter]].

== OpenSaveDataImporter ==
Takes an input u8 [[#SaveDataSpaceId]] and a 0x10-byte userID, and a type-0x5 input buffer. Returns an output u64 and an [[#ISaveDataImporter]].

= ISaveDataExporter =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize]]
|-
| 1 || [[#GetRestSize]]
|-
| 16 || [[#Pull]]
|-
| 17 || [[#PullInitialData]]
|}

This was added with [[4.0.0]].

== Initialize ==
No input/output, takes a type-0x1A [[#SaveDataInfo]] output buffer.

The actual name for this is the SaveDataExporter constructor. This is used automatically after [[#OpenSaveDataExporter]] by official sw.

== GetRestSize ==
No input, returns an output u64.

== Pull ==
Takes a type-0x6 output buffer, returns an output u64.

== PullInitialData ==
No input/output, takes a type-0x6 output buffer.

= ISaveDataImporter =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize]]
|-
| 1 || [[#GetRestSize]]
|-
| 16 || [[#Push]]
|-
| 17 || [[#Finalize]]
|}

This was added with [[4.0.0]].

== Initialize ==
No input/output, takes a type-0x1A [[#SaveDataInfo]] output buffer.

The actual name for this is the SaveDataImporter constructor. This is used automatically after [[#OpenSaveDataImporter]] by official sw.

== GetRestSize ==
No input, returns an output u64.

== Push ==
No input/output, takes a type-0x5 input buffer.

== Finalize ==
No input/output.

= ISaveDataTransferManagerWithDivision =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetChallenge]]
|-
| 16 || [[#SetKeySeedPackage]]
|-
| 32 || [[#OpenSaveDataFullExporter]]
|-
| 33 || [[#OpenSaveDataDiffExporter]]
|-
| 34 || [6.0.0+] [[#OpenSaveDataExporterByContext]]
|-
| 64 || [[#OpenSaveDataFullImporter]]
|-
| 65 || [[#OpenSaveDataDiffImporter]]
|-
| 66 || [6.0.0+] [[#OpenSaveDataDuplicateDiffImporter]]
|-
| 67 || [6.0.0+] [[#OpenSaveDataImporter]]
|-
| 68 || [6.0.0+] [[#OpenSaveDataImporterByContext]]
|-
| 69 || [6.0.0+] [[#CancelSuspendingImport]]
|}

This was added with [[5.0.0]].

== GetChallenge ==
No input/output, takes a type-0x6 output buffer containing the '''Challenge'''.

== SetKeySeedPackage ==
No input/output, takes a type-0x5 input buffer containing the '''KeySeedPackage'''.

== OpenSaveDataFullExporter ==
Takes an input u8 [[#SaveDataSpaceId]] and u64. Returns an [[#ISaveDataDivisionExporter]].

== OpenSaveDataDiffExporter ==
Takes an input u8 [[#SaveDataSpaceId]], an u64, and a type-0x5 input buffer [[#InitialDataVersion2]]. Returns an [[#ISaveDataDivisionExporter]].

== OpenSaveDataExporterByContext ==
No input/output, takes a type-0x5 input buffer, returns an [[#ISaveDataDivisionExporter]].

== OpenSaveDataFullImporter ==
Takes an input u8 [[#SaveDataSpaceId]], a 0x10-byte userID, and a type-0x5 input buffer [[#InitialDataVersion2]]. Returns an [[#ISaveDataDivisionImporter]].

== OpenSaveDataDiffImporter ==
Takes an input u8 [[#SaveDataSpaceId]], an u64, and a type-0x5 input buffer [[#InitialDataVersion2]], returns an [[#ISaveDataDivisionImporter]].

== OpenSaveDataDuplicateDiffImporter ==
Takes an input u8 and an u64, and a type-0x5 input buffer, returns an [[#ISaveDataDivisionImporter]].

== OpenSaveDataImporter ==
Takes an input u8, an u8(bool), a 0x10-byte struct, and a type-0x5 input buffer, returns an [[#ISaveDataDivisionImporter]].

== OpenSaveDataImporterByContext ==
No input/output, takes a type-0x5 input buffer, returns an [[#ISaveDataDivisionImporter]].

== CancelSuspendingImport ==
Takes an input u64 and a 0x10-byte struct, no output.

= ISaveDataDivisionExporter =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || SetDivisionCount (Takes an input u32, no output)
|-
| 1 || [6.0.0+] GetSaveDataInfo (No input/output, takes a type-0x6 output buffer)
|-
| 16 || OpenSaveDataDiffChunkIterator (No input, returns an [[#ISaveDataChunkIterator]])
|-
| 48 || OpenSaveDataChunkExporter (Takes an input u32, returns an [[#ISaveDataChunkExporter]])
|-
| 64 || [6.0.0+] FinalizeFullExport (No input, returns two 0x10-byte output structs)
|-
| 65 || [6.0.0+] FinalizeDiffExport (No input, returns an output 0x10-byte struct)
|-
| 66 || [6.0.0+] CancelExport (No input/output)
|-
| 67 || [6.0.0+] SuspendExport (No input/output, takes a type-0x6 output buffer)
|-
| 70 || [6.0.0+] GetKeySeed (No input, returns an output 0x10-byte struct)
|-
| 71 || [6.0.0+] GetInitialDataMac (No input, returns an output 0x10-byte struct)
|-
| 72 || [6.0.0+] FinalizeExport (No input/output)
|-
| 80 || [6.0.0+] GetImportInitialDataAad (No input, returns an output 0x20-byte struct)
|-
| 81 || [6.0.0+] SetExportInitialDataAad (Takes an input 0x20-byte struct, no output)
|-
| 96 || [6.0.0+] GetReportInfo (No input, returns an output 0x20-byte struct)
|}

This was added with [[5.0.0]].

= ISaveDataDivisionImporter =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [6.0.0+] GetSaveDataInfo (No input/output, takes a type-0x6 output buffer)
|-
| 16 || OpenSaveDataDiffChunkIterator (No input, returns an [[#ISaveDataChunkIterator]])
|-
| 32 || InitializeImport (No input, returns an output u64)
|-
| 33 || FinalizeImport (No input/output)
|-
| 34 || [6.0.0+] CancelImport (No input/output)
|-
| 35 || [6.0.0+] GetImportContext (No input/output, takes a type-0x6 output buffer)
|-
| 36 || [6.0.0+] SuspendImport (No input/output)
|-
| 48 || OpenSaveDataChunkImporter (Takes an input u32, returns an [[#ISaveDataChunkImporter]])
|-
| 64 || [6.0.0+] GetImportInitialDataAad (No input, returns an output 0x20-byte struct)
|-
| 80 || [6.0.0+] GetReportInfo (No input, returns an output 0x20-byte struct)
|}

This was added with [[5.0.0]].

= ISaveDataChunkIterator =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Next (No input/output)
|-
| 1 || IsEnd (No input, returns an output u8)
|-
| 16 || GetId (No input, returns an output u32)
|}

This was added with [[5.0.0]].

= ISaveDataChunkExporter =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Pull (Takes an input u64 and a type-0x6 output buffer, returns an output u64)
|-
| 16 || [6.0.0+] GetRestRawDataSize (No input, returns an output u64)
|-
|}

This was added with [[5.0.0]].

= ISaveDataChunkImporter =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Push (Takes an input u64 and a type-0x5 input buffer, no output)
|}

This was added with [[5.0.0]].

= ISaveDataTransferProhibiter =
This was added with [[6.0.0]].

This doesn't seem to handle any commands (?).

= IMultiCommitManager =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 || ? (Takes an input [[#IFilesystem]], no output)
|-
| 2 || ? (No input/output)
|}

This was added with [[6.0.0]].

= FileSystemType =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || Invalid
|-
| 1 || Invalid
|-
| 2 || Logo
|-
| 3 || ContentControl
|-
| 4 || ContentManual
|-
| 5 || ContentMeta
|-
| 6 || ContentData
|-
| 7 || ApplicationPackage
|}

= StorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || None
|-
| 1 || Host
|-
| 2 || GameCard
|-
| 3 || NandSystem
|-
| 4 || NandUser
|-
| 5 || SdCard
|}

= ContentStorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || System
|-
| 1 || User
|-
| 2 || SdCard
|}

= SaveDataSpaceId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || System
|-
| 1 || User
|-
| 2 || SdSystem
|-
| 100 || [3.0.0+] ProperSystem
|}

Determines the storage where the savedata is stored.

= SaveDataType =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || SystemSaveData
|-
| 1 || SaveData
|-
| 2 || BcatDeliveryCacheStorage
|-
| 3 || DeviceSaveData
|-
| 4 || [3.0.0+] TemporaryStorage
|-
| 5 || [3.0.0+] CacheStorage
|}

= ImageDirectoryId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || Nand
|-
| 1 || SdCard
|}

= CloudBackupWorkStorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || Nand
|-
| 1 || SdCard
|}

= ContentPath =
These are the 0x300 paths to NCA files for the various filesystems FS can access, beginning with @. They're passed via X descriptors, and returned via various [[Location Resolver services|ncm/lr]] commands.

{| class="wikitable" border="1"
|-
! Path || Notes
|-
| @SystemContent ||
|-
| @UserContent ||
|-
| @SdCardContent ||
|-
| @CalibFile ||
|-
| @Safe ||
|-
| @User ||
|-
| @System ||
|-
| @Sdcard ||
|-
| @Host ||
|-
| @GcApp || Gamecard App partition (Partition 2)
|-
| @GcS00000001 || Gamecard Contents.
|-
| @upp || Gamecard update partition (Partition 0)
|-
| [4.0.0+] @RegUpdate || Registered update partition
|}

= Save Struct =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| 0 for SystemSaveData. SaveData: 0 can be used for accessing the savedata associated with the current FS session titleID, otherwise when set this is the titleID associated with the savedata to access.
|-
| 0x8
| 0x10
| userID for user-specific savedata(saveuser) when set, otherwise when zero this indicates the common savedata(savecommon). This is loaded from [[Account_services]].
|-
| 0x18
| 0x8
| u64 [[Flash_Filesystem|saveID]]. 0 for SaveData.
|-
| 0x20
| 0x1
| [[#SaveDataType]]
|-
| 0x21
| 0x1
| Save data 'rank' or 'precedence'. 0 if this save data is considered the primary save data. 1 if it's considered the secondary save data.
|-
| 0x22
| 0x2
| Save data index
|-
| 0x24
| 0x4
| Padding
|-
| 0x28
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x30
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x38
| 0x8
| 0 for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

For DeviceSaveData, this struct is all-zero except for the [[#SaveDataType]] field.

= SaveCreate Struct =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[Savegames|IVFC]] level4 size?
|-
| 0x8
| 0x8
| Same as offset 0x0 normally? Hard-coded to 0x80000 for BcatSaveData.
|-
| 0x10
| 0x8
| 0x4000 for SystemSaveData/SaveData/DeviceSaveData/BcatSaveData. [[Savegames|IVFC]] level4 block-size in bytes?
|-
| 0x18
| 0x8
| Official user-processes only uses 0 here for SystemSaveData/SaveData. For the dedicated save-creation code with SaveData/DeviceSaveData, this value comes from an input param with official user-processes. For BcatSaveData, this is the hard-coded [[Title_list|titleID]] of the bcat-sysmodule.
|-
| 0x20
| 0x4
| Written using an input param for official user-processes. Hard-coded 0 for BcatSaveData.
|-
| 0x24
| 0x1
| Official user-processes only uses 0 here for SystemSaveData, 1 for SaveData/DeviceSaveData/BcatSaveData.
|-
| 0x25
| 0x1
| 0 for SystemSaveData/SaveData.
|-
| 0x26
| 0x1A
| Not initialized for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

= DeviceSaveData =
This is accessed using the same commands for SaveData with the same input u8, the only difference compared to SaveData is the Save-struct.

= BcatSaveData =
This is accessed using the same commands for SaveData with the same input u8. The Save-struct is the same as DeviceSaveData, except that the titleID field is set to <input titleID>. See above regarding SaveCreate-struct.

The 0x10-byte struct passed to [[#CreateSaveDataFileSystem]] has the first 0x5-bytes set to all-zero.

= SaveDataInfo =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| Unknown saveID
|-
| 0x8
| 0x1
| [[#SaveDataSpaceId]]
|-
| 0x9
| 0x1
| [[#SaveDataType]]
|-
| 0xA
| 0x6
| Padding?
|-
| 0x10
| 0x10
| userID
|-
| 0x20
| 0x8
| saveID, 0 for regular SaveData.
|-
| 0x28
| 0x8
| Application titleID, for regular SaveData.
|-
| 0x30
| 0x8
| Raw saveimage size
|-
| 0x38
| 0x2
| Save data index
|-
| 0x40
| 0x1
| Save data 'rank' or 'precedence'. 0 if this save data is considered the primary save data. 1 if it's considered the secondary save data.
|-
| 0x41
| 0x25
| Unknown. Usually zeros?
|}

This is a 0x60-byte struct.

= SaveDataFileSystemExtraData =
This is a 0x200-byte struct. Appears to match [[Savegames#Extra_data]].

= InitialDataVersion2 =
This is a 0x8210-byte struct used by [[#ISaveDataTransferManagerWithDivision]].

[[Category:Services]]

HIPC

2018-01-24T02:46:45Z

Hthh: /* Domain message */

== IPC Command Structure ==
This is an array of u32's, usually located in [[Thread Local Storage]].

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 15-0 || Type. 4=Request, 5=Control
|-
| 0 || 19-16 || Number of buf X descriptors (each: 2 words).
|-
| 0 || 23-20 || Number of buf A descriptors (each: 3 words).
|-
| 0 || 27-24 || Number of buf B descriptors (each: 3 words).
|-
| 0 || 31-28 || Number of buf W desciptors (each: 3 words), never observed.
|-
| 1 || 9-0 || Size of raw data section in u32s.
|-
| 1 || 13-10 || Flags for buf C descriptor.
|-
| 1 || 30-20 || ?
|-
| 1 || 31 || Enable handle descriptor.
|-
| ... || || [[#Handle descriptor|Handle descriptor]], if enabled.
|-
| ... || || [[#Buffer descriptor X "Pointer"|Buf X descriptors]], each one 2 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf A descriptors]], each one 3 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf B descriptors]], each one 3 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Type W descriptors]], each one 3 words.
|-
| ... || || [[#Raw_data_section|Raw data section]] (including padding before and after aligned data section).
|-
| ... || || [[#Buffer descriptor C "ReceiveList"|Buf C descriptors]], each one 2 words.
|}

First two header u32's and handle descriptor (if enabled) are copied as-is from one process to the other.

=== Handle descriptor ===
There can only be one of this descriptor type. It is enabled by bit31 of the second word.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 0 || Send current PID.
|-
| 0 || 4-1 || Number of handles to copy
|-
| 0 || 8-5 || Number of handles to move
|-
| ... || || 8-byte PID if enabled
|-
| ... || || Handles to copy
|-
| ... || || Handles to move
|}

Sysmodules load the last u64 of rawdata when handling the PID. This is not written by kernel. For sysmodule handling:
* In some cases: these commands require a placeholder u64 value passed in the input parameters, as mentioned above. In these cases the OverwriteClientProcessId method is called to replace the value before it is used.
* In other cases: The rawdata_u64 is compared with the PID from the descriptor. On mismatch and when rawdata_u64!=0, error 0x60A is returned. The PID value passed to the cmdhandler vtable funcptr is the rawdata_u64.

Handle 0 is allowed, and just means no handle was sent.

=== Buffer descriptor X "Pointer" ===
This one is packed even worse than A, they inserted the bit38-36 of the address ''on top'' of the counter field.

Officially, the counter is known as "receive index". This one writes to the buffer described in the ReceiveList.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 5-0 || Bits 5-0 of counter.
|-
| 0 || 8-6 || Bit 38-36 of address.
|-
| 0 || 11-9 || Bits 11-9 of counter.
|-
| 0 || 15-12 || Bit 35-32 of address.
|-
| 0 || 31-16 || Size
|-
| 1 || || Lower 32-bits of address.
|}

=== Buffer descriptor A/B/W "Send"/"Receive"/"Exchange" ===
This packing is so unnecessarily complex.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of size.
|-
| 1 || || Lower 32-bits of address.
|-
| 2 || 1-0 || Flags. Always set to 0, 1 or 3.
|-
| 2 || 4-2 || Bit 38-36 of address.
|-
| 2 || 27-24 || Bit 35-32 of size.
|-
| 2 || 31-28 || Bit 35-32 of address.
|}

A reply must not use A/B/W, svcReplyAndReceive will return 0xE801.

[[SVC|MemoryAttribute]] IsBorrowed and IsUncached are never allowed for the source address.

"Send" means buffer is sent from source process into service process.

"Receive" means that data is copied from service process into user process.

"Exchange" means both "Send" and "Receive".

==== Flags ====
Determines what [[SVC|MemoryState]] to use with the mapped memory in the sysmodule.

Used to enforce whether or not device mapping is allowed for src and dst buffers respectively.

* Flag0: Device mapping *not* allowed for src or dst.
* Flag1: Device mapping allowed for src and dst.
* Flag3: Device mapping allowed for src but not for dst.

=== Buffer descriptor C "ReceiveList" ===
There's a 4-bit flag in the main header controlling the behavior of C descriptors.

If it has value 0, the C descriptor functionality is disabled.

If it has value 1, there is an "inlined" C buffer after the raw data. Received data is copied to ROUND_UP(cmdbuf+raw_size+index, 16)

If it has value 2, there is a single C descriptor.

Otherwise it has (flag-2) C descriptors. In this case, index picks which C descriptor to copy received data to [instead of picking the offset into the buffer].

Data sent with this method must have MemoryState 0x4000000 mask set.

After reply, X descriptors are written to the sender containing the address, size and index that were copied to.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of address.
|-
| 1 || 15-0 || Rest of address.
|-
| 1 || 31-16 || Size
|}

=== IPC buffers ===
Buffer descriptor A/B/... map memory into the sysmodule process. For the mapped memory in the sysmodule the permissions are: desc-A = R--, desc-B = RW-. The buffer is automatically unmapped while the kernel handles the cmdreply, the sysmodule doesn't need to specify anything in the cmdreply to trigger this.

This memory is mapped in the sysmodule to the same vaddr from the original user-process cmd-request, except with with bits >=(~28(?)) changed to a different ASLR'd region.

No user-process->sysmodule memcpy is done for outbufs, only sysmodule->user-process.

== Raw data section ==

[[File:Ipc msg buffer type a example.png|thumb|An example of an IPC message with a type 0xA buffer in it. Red is headers/descriptors, yellow is padding, and blue is data/buffer lengths. Note that the size of the u16 array for type A lengths is padded to fill up a whole word.]]

{| class="wikitable" border="1"
! Word || Description
|-
| ... || Padding to align to 16 bytes.
|-
| ... || If sent to an object domain, a [[#Domain_message|domain message]], otherwise a [[#Data payload|data payload]]
|-
| ... || Padding
|-
| ... || Buffer type 0xA lengths (u16 array)
|}

The total amount of padding within the raw data section is always 0x10 bytes. This means that if no padding is required before the message, there will be 0x10 bytes of padding after the message (before the buffer type 0xA lengths).

=== Domain message ===
This header is used to wrap up requests sent to domains instead of sessions.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 7-0 || Command. 1=send message, 2=close virtual handle
|-
| 0 || 8-15 || Input object count
|-
| 0 || 31-16 || Length of [[IPC_Marshalling#Data_payload|data payload]] in bytes.
|-
| 1 || || Object ID (from cmd 0 in [[IPC_Marshalling#Control|Control]]).
|-
| 2
|rowspan="2"|
|rowspan="2"| Padding to align to u64
|-
| 3
|-
| 4... || || [[#Data payload|Data payload]]
|-
| ... || || Input object IDs (u32s, not aligned)
|}

=== Data payload ===

This is an array of u32's, but individual parameters are generally stored as u64's.

{| class="wikitable" border="1"
! Word || Description
|-
| 0 || Magic ("SFCI" for requests, "SFCO" for responses) as u64.
|-
| 2 || Command id as u64 for requests, [[Error_codes|error code]] as u64 for responses.
|-
| 4... || Input parameters or return values
|}

== Official marshalling code ==
The official marshalling function takes an array of (buf_ptr, size) pairs and a type-field for each such pair.

Bitmask 0x10 seems to indicate null-terminated strings, but that flag is ignored by the marshalling code.

{| class="wikitable" border="1"
! Type Mask || Description || Direction
|-
| 4 + 1 || Creates a A descriptor with flags=0. || In
|-
| 0x40 + 4 + 1 || Creates a A descriptor with flags=1. || In
|-
| 0x80 + 4 + 1 || Creates a A descriptor with flags=3. || In
|-
| 4 + 2 || Creates a B descriptor with flags=0. || Out
|-
| 0x40 + 4 + 2 || Creates a B descriptor with flags=1. || Out
|-
| 0x80 + 4 + 2 || Creates a B descriptor with flags=3. || Out
|-
| 8 + 1 || Creates an X descriptor || In
|-
| 8 + 2 || Creates a C descriptor, and writes the u16 size to an offset into raw data. || Out
|-
| 0x10 + 8 + 2 || Creates a C descriptor || Out
|-
| 0x20 + 1 || Creates both an A and X descriptor || In
|-
| 0x20 + 2 || Creates both an B and C descriptor || Out
|}

C and X (Pointer and ReceiveList) descriptors are backed by the "pointer buffer", a buffer in the service process. Its size is a u16, which is retrieved using the "QueryPointerBufferSize" control message. If the client code determines all buffers with flag 8 do not fit in the pointer buffer, it returns error 0x11A0B.

For buffers with flag 0x20 it creates two descriptors (A+X or B+C), but one descriptor is NULL (zero size and pointer), while the other holds the expected values. X/C descriptors are used as the non-NULL descriptor where possible, but if they don't fit in the pointer buffer, A/B descriptors are used instead. The code defers processing of type 0x20 buffers with sizes that fit in a u16 (and may therefore fit in the pointer buffer). This ensures all type 8 buffers get pointer-buffer space before any type 0x20.

(The order in which the deferred type 0x20 buffers are processed is determined by a convoluted loop.)

== Official IPC Cmd Structure ==
Official struct that is stored for each IPC command. It contains precalculated offsets for different portions of the command structure.

All offsets are given is in number of u32 words.

struct IpcCmdStruct {
u8 unk0;
u8 has_handle_descriptor;
u8 pad0[2];
u32 cmd0;
u32 cmd1;
u32 offset_handle_descriptor;
u32 pad1;
u32 offset_handles;
u32 pad2;
u32 offset_x_descriptors;
u32 offset_a_descriptors;
u32 offset_b_descriptors;
u32 offset_w_descriptors; /* this is a guess */
u32 offset_raw_data;
u32 offset_c_descriptors;
u32 unk2;
u32 unk3;
}

== Control ==
When type == 5 you are talking to the IPC manager. These are processed by the sysmodule.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Output
|-
| 0 || ConvertSessionToDomain || None ||
|-
| 1 || ConvertDomainToSession || u32 domain ||
|-
| 2 || DuplicateSession || None ||
|-
| 3 || QueryPointerBufferSize || None || u32 as u16-size
|-
| 4 || DuplicateSessionEx || u32 unknown ||
|}

Filesystem services

2018-01-22T08:02:14Z

Hthh:

= fsp-ldr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Notes
|-
| 0 || MountCode || u64 TitleId + X descriptor [[#ContentPath]] || Returns an [[#IFileSystem]].
|-
| 1 || IsCodeMounted || u64 ProcessId || Returns a bool (1 if code is mounted).
|-
| 2 || [4.0.0+] Initialize || PID descriptor ||
|}

= fsp-pr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#SetFsPermissions]] ||
|-
| 1 || [[#ClearFsPermissions]] ||
|-
| 2 || [4.0.0+] Initialize ||
|-
| 256 || [[#SetEnabledProgramVerification]] ||
|}

== SetFsPermissions ==
Takes a storageID, a pid, a titleID, a 0x1C type-A buffer for the [[NPDM#FS_Access_Header| FS Access Header]], and a 0x2C type-A buffer for the [[NPDM#FS_Access_Control| FS Access Control]]

Final FS permissions are stored as (ACI0_perms & ACID_perms). Will panic(svcBreak) when buffer sizes from ipc-rawdata are invalid.

== ClearFsPermissions ==
Takes a pid. Removes registered FS permissions for that PID.

== SetEnabledProgramVerification ==
Seems to sets a global flag to inputval & 1.

When the flag is zero, it will set ret=0 instead of ret={error} when verifying a RSA signature fails. This RSA signature seems to be the signature in the [[NPDM]] ACID. It then skips verifying what seems to be the second signature in the [[NCA_Format|NCA header]]. Note that if verifying the NPDM(?) signature is successful, and verifying that second signature fails, it will throw an error and abort.

= fsp-srv =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0] [[#MountContent]]
|-
| 1 || [[#Initialize]]
|-
| 2 || OpenDataFileSystemByCurrentProcess
|-
| 7 || [2.0.0+] [[#MountContent7]]
|-
| 8 || [2.0.0+] [[#MountContent]]
|-
| 9 || [3.0.0+] OpenDataFileSystemByApplicationId
|-
| 11 || [[#MountBis]]
|-
| 12 || [[#OpenBisPartition]]
|-
| 13 || InvalidateBisCache
|-
| 17 || OpenHostFileSystemImpl
|-
| 18 || MountSdCard
|-
| 19 || [2.0.0+] FormatSdCard
|-
| 21 || [[#DeleteSaveData]]
|-
| 22 || [[#CreateSaveData]]
|-
| 23 || [[#CreateSystemSaveData]]
|-
| 24 || RegisterSaveDataAtomicDeletion
|-
| 25 || [2.0.0+] DeleteSaveDataWithSpaceId
|-
| 26 || [2.0.0+] FormatSdCardDryRun
|-
| 27 || [2.0.0+] IsExFatSupported
|-
| 28 || [4.0.0+] DeleteSystemSaveData
|-
| 30 || [[#OpenGameCardPartition]]
|-
| 31 || [[#MountGameCardPartition]]
|-
| 32 || [3.0.0+] ExtendSaveData
|-
| 51 || [[#MountSaveData]]
|-
| 52 || [[#MountSystemSaveData]]
|-
| 53 || [2.0.0+] MountSaveDataReadOnly
|-
| 57 || [3.0.0+] ReadSaveDataFileSystemExtraDataWithSpaceId
|-
| 58 || ReadSaveDataFileSystemExtraData
|-
| 59 || [2.0.0+] WriteSaveDataFileSystemExtraData
|-
| 60 || OpenSaveDataInfoReader
|-
| 61 || OpenSaveDataIterator
|-
| 80 || OpenSaveDataThumbnailFile
|-
| 81 || [4.0.0+] OpenSaveDataTransferManager
|-
| 100 || MountImageDirectory
|-
| 110 || [[#MountContentStorage]]
|-
| 200 || OpenDataStorageByCurrentProcess
|-
| 201 || [3.0.0+] OpenDataStorageByApplicationId
|-
| 202 || [[#OpenDataStorageByDataId]]
|-
| 203 || Returns an [[#IStorage]]
|-
| 400 || [[#OpenDeviceOperator]]
|-
| 500 || [[#OpenSdCardDetectionEventNotifier]]
|-
| 501 || [[#OpenGameCardDetectionEventNotifier]]
|-
| 600 || [1.0.0-3.0.2] SetCurrentPosixTime
|-
| 601 || QuerySaveDataTotalSize
|-
| 602 || [[#VerifySaveData]]
|-
| 603 || CorruptSaveDataForDebug
|-
| 604 || CreatePaddingFile
|-
| 605 || DeleteAllPaddingFiles
|-
| 606 || [2.0.0+] GetRightsId
|-
| 607 || [2.0.0+] RegisterExternalKey
|-
| 608 || [2.0.0+] UnregisterExternalKey
|-
| 609 || [2.0.0+] GetRightsIdByPath
|-
| 610 || [3.0.0+] GetRightsIdByPath2 (returns extra byte)
|-
| 611 || [4.0.0+] SetCurrentPosixTime
|-
| 612 || [4.0.0+] GetFreeSpaceSize
|-
| 613 || [4.0.0+]
|-
| 614 || [4.0.0+]
|-
| 620 || [2.0.0+] [[#SetSdCardEncryptionSeed]]
|-
| 630 || [4.0.0+] SetSdCardAccessibility
|-
| 631 || [4.0.0+] IsSdCardAccessible
|-
| 640 || [4.0.0+] IsSignedSystemPartitionOnSdCardValid
|-
| 800 || [2.0.0+] GetAndClearFileSystemProxyErrorInfo
|-
| 1000 || SetBisRootForHost
|-
| 1001 || SetSaveDataSize
|-
| 1002 || SetSaveDataRootPath
|-
| 1003 || DisableAutoSaveDataCreation
|-
| 1004 || [[#SetGlobalAccessLogMode]]
|-
| 1005 || [[#GetGlobalAccessLogMode]]
|-
| 1006 || [[#OutputAccessLogToSdCard]]
|-
| 1007 || [4.0.0+] RegisterUpdatePartition
|-
| 1008 || [4.0.0+] MountRegisteredUpdatePartition
|-
| 1009 || [4.0.0+]
|-
| 1100 || [4.0.0+] OverrideSaveDataTransferTokenSignVerificationKey
|}

== Permissions ==
Every time permissions are checked, the process registration [[#fsp-pr]] is loaded using the session processID. The permission data is populated with data from the [[NPDM]],

If the processID is <= 6 (which happens only for built-in sysmodules), it will use a hardcoded registration data. The default mask in this case is 0x8000000000000000.

Note that the functions check whether or not at least one bit is set in the mask. This means that, you don't need to set 0xFFFFFFFFFFFFFFFF to get all permissions: it suffices to set 0x8000000000000000.

If the code were to request an invalid input type, panic. But this never happens.

=== RwPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Value || Used by
|-
| 0x0 || 0x8000000000000801 || MountContentType2 || 1 || [[#MountContent]]
|-
| 0x1 || 0x8000000000000801 || MountContentType5 || 1 || [[#MountContent]]
|-
| 0x2 || 0x8000000000000801 || MountContentType3 || 1 || [[#MountContent]]
|-
| 0x3 || 0x8000000000000801 || MountContentType4 || 1 || [[#MountContent]]
|-
| 0x4 || 0x8000000000000801 || MountContentType6 || 1 || [[#MountContent]]
|-
| 0x5 || 0x8000000000000801 || MountContentType7 || 1 || [[#MountContent]]
|-
| 0x6 || 0x8000000000000000 || || 3 ||
|-
| 0x7 || 0x8000000000000800 || ContentStorageAccess || 3 || [[#MountContentStorage]]
|-
| 0x8 || 0x8000000000001000 || ImageDirectoryAccess || 3 || [[#MountImageDirectory]]
|-
| 0x9 || 0x8000000000000084 || MountBisType28 || 3 || [[#MountBis]]
|-
| 0xA || 0x8000000000000080 || MountBisType29 || 3 || [[#MountBis]]
|-
| 0xB || 0x8000000000008080 || MountBisType30 || 3 || [[#MountBis]]
|-
| 0xC || 0x8000000000008080 || MountBisType31 || 3 || [[#MountBis]]
|-
| 0xD || 0x8000000000000080 || || 3 ||
|-
| 0xE || 0xC000000000200000 || SdCardAccess || 3 || [[#MountSdCard]]
|-
| 0xF || 0x8000000000000010 || GameCardUser || 3 || [[#MountGameCardPartition]]
|-
| 0x10 || 0x8000000000040020 || SaveDataAccess0 || 3 || [[#MountSaveData]]
|-
| 0x11 || 0x8000000000000028 || SystemSaveDataAccess0 || 3 || [[#MountSystemSaveData]]
|-
| 0x12 || 0x8000000000000020 || SaveDataAccess1 || 3 || [[#MountSaveData]]
|-
| 0x13 || 0x8000000000000020 || SystemSaveDataAccess1 || 3 || [[#MountSystemSaveData]]
|-
| 0x14 || 0x8000000000010082 || BisPartition0 || 3 || [[#OpenBisPartition]]
|-
| 0x15 || 0x8000000000010080 || BisPartition10 || 3 || [[#OpenBisPartition]]
|-
| 0x17 || 0x8000000000010080 || BisPartition20 || 3 || [[#OpenBisPartition]]
|-
| 0x18 || 0x8000000000010080 || BisPartition21 || 3 || [[#OpenBisPartition]]
|-
| 0x19 || 0x8000000000010080 || BisPartition22 || 3 || [[#OpenBisPartition]]
|-
| 0x1A || 0x8000000000010080 || BisPartition23 || 3 || [[#OpenBisPartition]]
|-
| 0x1B || 0x8000000000010080 || BisPartition24 || 3 || [[#OpenBisPartition]]
|-
| 0x1C || 0x8000000000010080 || BisPartition25 || 3 || [[#OpenBisPartition]]
|-
| 0x16 || 0x8000000000000080 || BisPartition26 || 3 || [[#OpenBisPartition]]
|-
| 0x1D || 0x8000000000000084 || BisPartition27 || 3 || [[#OpenBisPartition]]
|-
| 0x1E || 0x8000000000000084 || BisPartition28 || 3 || [[#OpenBisPartition]]
|-
| 0x1F || 0x8000000000000080 || BisPartition29 || 3 || [[#OpenBisPartition]]
|-
| 0x20 || 0x8000000000000080 || BisPartition30 || 3 || [[#OpenBisPartition]]
|-
| 0x21 || 0x8000000000000080 || BisPartition31 || 3 || [[#OpenBisPartition]]
|-
| 0x22 || 0x8000000000000080 || BisPartition32 || 3 || [[#OpenBisPartition]]
|-
| 0x23 || 0xC000000000200000 || || 3 ||
|-
| 0x24 || 0x8000000000000100 || GameCard_System || 3 || [[#OpenGameCardPartition]], [[#EraseGameCard]] (bit1), [[#WriteToGameCard]] (bit1)
|-
| 0x25 || 0x8000000000100008 || MountContent_System || 1 || [[#MountContent]], [[#OpenDataStorageByDataId]]
|-
| 0x26 || 0xC000000000400000 || HostAccess || 3 || [[#OpenHostFileSystemImpl]]
|}

=== BoolPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Used by
|-
| 0x0 || 0x8000000000000080 || BisCache || [[#InvalidateBisCache]]
|-
| 0x1 || 0x8000000000000080 || EraseMmc || [[#EraseMmc]]
|-
| 0x2 || 0x8000000000000010 || GameCardCertificate || [[#GetGameCardDeviceCertificate]]
|-
| 0x3 || 0x8000000000000010 || GameCardIdSet || [[#GetGameCardIdSet]]
|-
| 0x4 || 0x8000000000000200 || GameCardDriver || [[#FinalizeGameCardDriver]]
|-
| 0x5 || 0x8000000000000200 || GameCardAsic || [[#GetGameCardAsicInfo]]
|-
| 0x6 || 0x8000000000002020 || SaveDataCreate || [[#CreateSaveData]]
|-
| 0x7 || 0x8000000000000060 || SaveDataDelete0 || [[#DeleteSaveData]], [[#RegisterSaveDataAtomicDeletion]]
|-
| 0x8 || 0x8000000000000028 || SystemSaveDataCreate0 || [[#CreateSystemSaveData]]
|-
| 0x9 || 0x8000000000000020 || SystemSaveDataCreate1 || [[#CreateSystemSaveData]]
|-
| 0xA || 0x8000000000004028 || SaveDataDelete1 || [[#DeleteSaveData]], [[#RegisterSaveDataAtomicDeletion]]
|-
| 0xB || 0x8000000000000060 || SaveDataIterators0 || [[#OpenSaveDataIterator]], [[#OpenSaveDataInfoIterator]]
|-
| 0xC || 0x8000000000004020 || SaveDataIterators1 || [[#OpenSaveDataIterator]], [[#OpenSaveDataInfoIterator]]
|-
| 0xD || 0x8000000000020000 || SaveThumbnails || [[#OpenSaveDataThumbnailFile]]
|-
| 0xE || 0x8000000000000400 || PosixTime || [[#SetCurrentPosixTime]]
|-
| 0xF || 0x8000000000004060 || SaveDataExtraData || [[#ReadSaveDataFileSystemExtraData]]
|-
| 0x10 || 0x8000000000080000 || GlobalMode || [[#SetGlobalAccessMode]]
|-
| 0x11 || 0x8000000000080000 || SpeedEmulation || [[#SetSpeedEmulationMode]]
|-
| 0x12 || Invalid || ||
|-
| 0x13 || 0xC000000000800000 || PaddingFiles || [[#CreatePaddingFile]], [[#DeletePaddingFiles]]
|-
| 0x14 || 0xC000000001000000 || SaveData_Debug || [[#CorruptSaveDataForDebug]]
|-
| 0x15 || 0xC000000002000000 || SaveData_SystemManagement || [[#CreateSaveData]], [[#MountSaveData]], [[#SetSaveDataRootPath]]
|-
| [2.0.0+] 0x16 || 0x8000000004000000 || ||
|-
| [2.0.0+] 0x17 || 0x8000000008000000 || ||
|-
| [2.0.0+] 0x18 || 0x8000000010000000 || ||
|-
| [2.0.0+] 0x19 || 0x8000000000000800 || ||
|-
| [2.0.0+] 0x1A || 0x8000000000004020 || ||
|}

== Initialize ==
Takes a pid-descriptor.

== MountContent7 ==
Takes an input u32 (same as [[#MountContent]]) and an u64 title-id. Web-applet loads the u32 from u32_table[inparam]. The in32 must be 4.

Returns an [[#IFileSystem]].

Note: web-applet strings refer to both this cmd and the below "MountContent" as "MountContent".

== MountContent ==
Takes a type-0x19 input buffer, an in32, and an input title-id.

The in32 must be 5 if the NCA type is 0 (control).

The in32 must be 2..7.

The input buffer is the output string path from nsam [[NS_Services#GetContentNcaPath|GetContentNcaPath]].

Returns an [[#IFileSystem]].

May return errors when attempting to access NCA-paths for an update-title with a gamecard, when the gamecard isn't inserted. May return error 0x7D402 in some cases with update-titles. Non-val2 in32 values with NCA-type1 are unusable, even for normal titles.

The official "MountApplicationPackage" func uses this with in64=0 and in32=7.

After the in32-specific permissions are checked, it then gets the func retval for permissions-type 0x25 and func0.

When in32=5, it uses in64=0xffffffffffffffff internally, otherwise it checks if in64 is set to 0xffffffffffffffff then throws an error if so. When the in64 used internally is not 0xffffffffffffffff, it's compared with the NCA titleID, then an error is thrown on mismatch.

== MountBis ==
Takes a type-0x19 input buffer string and a u32 Bis partitionID(see below). Official user-process code sets instr[0] = 0 normally.

Returns an [[#IFileSystem]].

Only partitionIDs for FAT partitions are usable with this, otherwise error 0x2EE202 is returned. Seems to be about the same as [[#OpenBisPartition]] except this mounts the partition filesystem instead of allowing direct access to the partition sectors.

== OpenBisPartition ==
Takes a u32 partition ID, returns 0x2EE202 for partitions which do not exist, 0x320002 for partitions which cannot be opened and a valid [[#IStorage]] handle otherwise.

== InvalidateBisCache ==
Seems to invalidate the Bis cache for MBR/GPT after overwriting that data via the OpenBisPartition IStorage. Used by [[SystemInitializer]].

== DeleteSaveData ==
Takes an input u64.

== CreateSaveData ==
Takes a 0x40-byte Save-struct entry, a 0x40-byte SaveCreate-struct entry, and a 0x10-byte input struct.

Only the first 0x5-bytes in the 0x10-byte struct are initialized: all-zero when automatically creating savedata during savecommon mount by official user-processes. In the dedicated save-creation code in official user-processes: +0 u32 = 0x40060, +4 u8 = 1.

Creates regular savedata.

== CreateSystemSaveData ==
Takes a 0x40-byte Save-struct entry and a 0x40-byte SaveCreate-struct entry.

Creates savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== OpenGameCardPartition ==

Takes an input u32 (partition ID), and returns an [[#IStorage]] for the [[Gamecard_Format|partition]].

== MountGameCardPartition ==
Takes two input u32s, with the second u32 located at +4 in rawdata after the first u32.

Returns an [[#IFileSystem]].

Mounts a gamecard [[Gamecard_Partition|partition]].

== MountSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Official user-process code is only known to use value 1 for the u8.

Returns an [[#IFileSystem]].

Permissions aren't checked until the specified save is successfully found.

Only one process can mount a given savedata at any given time (this includes systemsavedata).

== MountSystemSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Web-applet only uses value0 for the input u8.

Returns an [[#IFileSystem]].

Mounts savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== MountContentStorage ==
Takes a [[#ContentStorageId]]. Invalid values return 0x2EE202.

Returns an [[#IFileSystem]] with NCA files. The read data from these files is identical to the data read by [[Content_Manager_services#ReadEntryRaw]].

== OpenDataStorageByDataId ==
Takes a [[#StorageId]] and a TitleID.

Returns a [[IPC_Marshalling#Domain_message|domain object ID]] implementing the [[#IStorage]] interface for data archives.

== OpenDeviceOperator ==
This command returns a session to a port implementing the [[#IDeviceOperator]] interface.

== OpenSdCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== OpenGameCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== VerifySaveData ==
Takes an unknown input u64 and a type-0x6 output buffer.

The input u64 high-byte must be non-zero, otherwise an [[Error_codes|error]] is returned(0xE02).

== SetSdCardEncryptionSeed ==
Takes 0x10-bytes of input.

Appears to be used to load the seed into FS-module state, since FS-module itself doesn't seem to have file-reading code to handle this itself.

[[NS_Services|NS]]-module uses this with data read from a file.

== SetGlobalAccessLogMode ==
Takes an input u32.

== GetGlobalAccessLogMode ==
Returns an output u32.

GlobalAccessLogMode is normally 0.

== OutputAccessLogToSdCard ==
Takes a type-0x5 input buffer.

The input buffer is the string to output to the log. User-processes normally include a newline at the end.

User-processes only use this when the value previously loaded from [[#GetGlobalAccessLogMode]] has bit1 set.

When bit1 in GlobalAccessLogMode is clear, FS-module will just return 0 for OutputAccessLogToSdCard. However even with that set the log doesn't show up SD, unknown why.

The input buffer is written to the "$FsAccessLog:/FsAccessLog.txt" file, where "$FsAccessLog" is the SD-card mount-name. It's written to the current end of the file(appended).

= IStorage =
This is the interface for a raw device, usually a block device.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments
|-
| 0 || Read || Takes a type-0x46 buffer, an offset and length
|-
| 1 || Write || Takes a type-0x45 buffer, an offset and length
|-
| 2 || Flush || None
|-
| 3 || SetSize || Takes a size
|-
| 4 || GetSize || None
|-
| 5 || [4.0.0+] OperateRange ||
|}

= IFileSystem =
There are two main implementations of this interface:

* '''RomFS''': Filesystem implementation statically linked in the binary. Uses an [[#IStorage]] interface as underlying raw device.
* '''IPC proxy''': Used for all non-RomFS filesystems. In this case, actual filesystem implementation is in the FS process.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateFile
|-
| 1 || DeleteFile
|-
| 2 || CreateDirectory
|-
| 3 || DeleteDirectory
|-
| 4 || DeleteDirectoryRecursively
|-
| 5 || RenameFile
|-
| 6 || RenameDirectory
|-
| 7 || [[#GetEntryType]]
|-
| 8 || OpenFile
|-
| 9 || [[#OpenDirectory]]
|-
| 10 || [[#Commit]]
|-
| 11 || [[#GetFreeSpaceSize]]
|-
| 12 || [[#GetTotalSpaceSize]]
|-
| 13 || CleanDirectoryRecursively [3.0.0+]
|-
| 14 || GetFileTimeStampRaw [3.0.0+]
|-
| 15 || [4.0.0+] QueryEntry
|}

== GetEntryType ==
Takes a type-0x9 input buffer for the path and returns [[#DirectoryEntryType]] as an output u32.

==OpenDirectory==
Takes a type-0x9 input buffer for the path and an u64 '''filter_flags'''. '''filter_flags''' controls what type of entries are read by the [[#IDirectory]]: bitmask 0x1 = directories, bitmask 0x2 = files.

== Commit ==
Like [https://3dbrew.org/wiki/FS:ControlArchive 3DS], this has to be used after writing to savedata for the changes to take affect.

== GetFreeSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total free space with this FS.

== GetTotalSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total space available with this FS(free+used).

= IDirectory =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Read]]
|-
| 1 || [[#GetEntryCount]]
|}

== Read ==
Takes a type-0x6 output buffer and an input u64. Unknown what the u64 is for, doesn't(?) seem to affect output. Returns an output u64(?) for the total number of read entries, this is 0 when no more entries are available.

The output buffer contains the read array of [[#DirectoryEntry]]. This doesn't include entries for "." and "..".

== GetEntryCount ==
Returns an u64 for the total number of readable entries.

= DirectoryEntry =
{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x300 || Path
|-
| 0x300 || 0x4 || ?
|-
| 0x304 || 0x1 || [[#DirectoryEntryType]]
|-
| 0x305 || 0x3 || Padding?
|-
| 0x308 || 0x8? || Filesize, 0 for directories.
|}

= DirectoryEntryType =
s8 type: 0 = directory, 1 = file.

= IFile =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Read
|-
| 1 || Write
|-
| 2 || Flush
|-
| 3 || SetSize
|-
| 4 || GetSize
|-
| 5 || [4.0.0+]
|}

= ISaveDataInfoReader =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|}

= IDeviceOperator =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsSdCardInserted
|-
| 1 || GetSdCardSpeedMode
|-
| 2 || [2.0.0+] GetSdCardCid
|-
| 3 || [2.0.0+] GetSdCardUserAreaSize
|-
| 4 || [2.0.0+] GetSdCardProtectedAreaSize
|-
| 5 || [2.0.0+] GetAndClearSdCardErrorInfo
|-
| 100 || GetMmcCid
|-
| 101 || GetMmcSpeedMode
|-
| 110 || EraseMmc
|-
| 111 || GetMmcPartitionSize
|-
| 112 || [2.0.0+] GetMmcPatrolCount
|-
| 113 || [2.0.0+] GetAndClearMmcErrorInfo
|-
| 114 || [2.0.0+] GetMmcExtendedCsd
|-
| 115 || [4.0.0+] SuspendMmcPatrol
|-
| 116 || [4.0.0+] ResumeMmcPatrol
|-
| 200 || IsGameCardInserted
|-
| 201 || EraseGameCard
|-
| 202 || GetGameCardHandle
|-
| 203 || [[#GetGameCardUpdatePartitionInfo]]
|-
| 204 || FinalizeGameCardDriver
|-
| 205 || GetGameCardAttribute
|-
| 206 || GetGameCardDeviceCertificate
|-
| 207 || GetGameCardAsicInfo
|-
| 208 || GetGameCardIdSet
|-
| 209 || WriteToGameCard
|-
| 210 || SetVerifyWriteEnalbleFlag
|-
| 211 || GetGameCardImageHash
|-
| 212 || [2.0.0+] GetGameCardErrorInfo
|-
| 213 || [2.0.0+] EraseAndWriteParamDirectly
|-
| 214 || [2.0.0+] ReadParamDirectly
|-
| 215 || [2.0.0+] ForceEraseGameCard
|-
| 216 || [2.0.0+] GetGameCardErrorInfo
|-
| 217 || [2.1.0+] GetGameCardErrorReportInfo
|-
| 218 || [3.0.0+]
|-
| 300 || SetSpeedEmulationMode
|-
| 301 || GetSpeedEmulationMode
|}

== GetGameCardUpdatePartitionInfo ==

Returns a titleID and the title-version for it.

* Output u32 with ARMS-gamecard: title-version v131162. This is the title-version for [[2.1.0]], which is the sysupdate included with this gamecard. Launch-day gamecards return title-version v450.
* Output u64 with ARMS-gamecard: titleID 0100000000000816.

[[NS_Services|NS]] appears to only use this with [[Content_Manager_services#GetTitleIdInfo]] and [[Content_Manager_services#GetUpdateTitleList]] with storageid=nandsys, for checking whether a sysupdate is required.

= IEventNotifier =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || BindEvent
|}

= StorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || None
|-
| 1 || Host
|-
| 2 || GameCard
|-
| 3 || NandSystem
|-
| 4 || NandUser
|-
| 5 || SdCard
|}

= ContentStorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || NandSystem
|-
| 1 || NandUser
|-
| 2 || SdCard
|}

= ContentPath =
These are the 0x300 paths to NCA files for the various filesystems FS can access, beginning with @. They're passed via X descriptors, and returned via various [[Location Resolver services|ncm/lr]] commands.

{| class="wikitable" border="1"
|-
! Path || Notes
|-
| @SystemContent ||
|-
| @UserContent ||
|-
| @SdCardContent ||
|-
| @CalibFile ||
|-
| @Safe ||
|-
| @User ||
|-
| @System ||
|-
| @Sdcard ||
|-
| @Host ||
|-
| @GcApp || Gamecard App partition (Partition 2)
|-
| @GcS00000001 || Gamecard Contents.
|-
| @upp || Gamecard update partition (Partition 0)
|}

=BisPartitionID=
* 0: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 0.
* 10: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 1.
* Rest: see [[Flash_Filesystem|here]].

=Save Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| 0 for SystemSaveData. SaveData: 0 can be used for accessing the savedata associated with the current FS session titleID, otherwise when set this is the titleID associated with the savedata to access.
|-
| 0x8
| 0x10
| userID for user-specific savedata(saveuser) when set, otherwise when zero this indicates the common savedata(savecommon). This is loaded from [[Account_services]].
|-
| 0x18
| 0x8
| u64 [[Flash_Filesystem|saveID]]. 0 for SaveData.
|-
| 0x20
| 0x8
| ContentStorageId? 0 for SystemSaveData. 1 for SaveData. 2 for DeviceSaveData(with official user-processes all other fields are 0 for DeviceSaveData).
|-
| 0x28
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x30
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x38
| 0x8
| 0 for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=SaveCreate Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[Savegames|IVFC]] level4 size?
|-
| 0x8
| 0x8
| Same as offset 0x0 normally? Hard-coded to 0x80000 for BcatSaveData.
|-
| 0x10
| 0x8
| 0x4000 for SystemSaveData/SaveData/DeviceSaveData/BcatSaveData. [[Savegames|IVFC]] level4 block-size in bytes?
|-
| 0x18
| 0x8
| Official user-processes only uses 0 here for SystemSaveData/SaveData. For the dedicated save-creation code with SaveData/DeviceSaveData, this value comes from an input param with official user-processes. For BcatSaveData, this is the hard-coded [[Title_list|titleID]] of the bcat-sysmodule.
|-
| 0x20
| 0x4
| Written using an input param for official user-processes. Hard-coded 0 for BcatSaveData.
|-
| 0x24
| 0x1
| Official user-processes only uses 0 here for SystemSaveData, 1 for SaveData/DeviceSaveData/BcatSaveData.
|-
| 0x25
| 0x1
| 0 for SystemSaveData/SaveData.
|-
| 0x26
| 0x1A
| Not initialized for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=DeviceSaveData=
This is accessed using the same commands for SaveData with the same input u8, the only difference compared to SaveData is the Save-struct.

=BcatSaveData=
This is accessed using the same commands for SaveData with the same input u8. The Save-struct is the same as DeviceSaveData, except that the titleID field is set to <input titleID>. See above regarding SaveCreate-struct.

The 0x10-byte struct passed to [[#CreateSaveData]] has the first 0x5-bytes set to all-zero.

[[Category:Services]]

Title list

2018-01-01T08:42:05Z

Hthh:

== System Modules ==
Note: Unlike 3DS, Switch doesn't have a dedicated HTTP-sysmodule. Instead, processes using HTTP(S) just use libcurl + socket/ssl services.

As of [[2.0.0]], the only sysmodule with a RomFS is [[HID_services|hid-sysmodule]].

Decimal versions use the format:
* Bit31-Bit26: Major
* Bit25-Bit20: Middle
* Bit19-Bit16: Minor
* Bit15-Bit0: Build?

{| class=wikitable
! Title-id || Versions || Description
|-
| 0100000000000000 || [bundled with kernel] || FS
|-
| 0100000000000001 || [bundled with kernel] || Loader
|-
| 0100000000000002 || [bundled with kernel] || NCM
|-
| 0100000000000003 || [bundled with kernel] || ProcessMana
|-
| 0100000000000004 || [bundled with kernel] || sm
|-
| 0100000000000005 || [bundled with kernel] || [[boot]]
|-
| 0100000000000006 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || usb
|-
| 0100000000000007 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || tma
|-
| 0100000000000008 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || [[Boot2|boot2]]
|-
| 0100000000000009 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || settings
|-
| 010000000000000A || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || bus
|-
| 010000000000000B || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || bluetooth
|-
| 010000000000000C || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) || bcat
|-
| 010000000000000D || || Launched by maintenance mode [[Boot2|boot2.manuBoot]], but not present in retail or [[Factory Setup|factory firmware]].
|-
| 010000000000000E || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || friends
|-
| 010000000000000F || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || nifm
|-
| 0100000000000010 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || ptm
|-
| 0100000000000011 || || Launched by maintenance mode [[Boot2|boot2.manuBoot]], but not present in retail or [[Factory Setup|factory firmware]].
|-
| 0100000000000012 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.3.0|v131092]] (0.0.2.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) || bsdsockets
|-
| 0100000000000013 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) || hid
|-
| 0100000000000014 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || audio
|-
| 0100000000000015 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || LogManager.Prod
|-
| 0100000000000016 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[2.2.0|v196608]] (0.0.3.0) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) || wlan
|-
| 0100000000000017 || || Launched by maintenance mode [[Boot2|boot2.manuBoot]], but not present in retail or [[Factory Setup|factory firmware]].
|-
| 0100000000000018 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || ldn
|-
| 0100000000000019 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[2.3.0|v196628]] (0.0.3.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[4.0.1|v268501002]] (4.0.1.10) [[4.1.0|v269484082]] (4.1.0.50) || nvservices
|-
| 010000000000001A || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || pcv
|-
| 010000000000001B || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || ppc
|-
| 010000000000001C || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) || nvnflinger
|-
| 010000000000001D || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || pcie.withoutHb
|-
| 010000000000001E || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) || account
|-
| 010000000000001F || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || ns
|-
| 0100000000000020 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.2.0|v131072]] (0.0.2.0) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || nfc
|-
| 0100000000000021 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || psc
|-
| 0100000000000022 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || capsrv
|-
| 0100000000000023 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || am
|-
| 0100000000000024 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || ssl
|-
| 0100000000000025 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) || nim
|-
| 0100000000000028 || [bundled with kernel] || spl
|-
| 0100000000000029 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || lbl
|-
| 010000000000002A || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || btm
|-
| 010000000000002B || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || erpt
|-
| 010000000000002D || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || vi
|-
| 010000000000002E || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || pctl
|-
| 010000000000002F || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || npns
|-
| 0100000000000030 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || [[Eupld_services|eupld]]
|-
| 0100000000000031 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || glue
|-
| 0100000000000032 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || eclct
|-
| 0100000000000033 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || es
|-
| 0100000000000034 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) || fatal
|-
| 0100000000000035 || [[4.0.0|v268435656]] (4.0.0.200) || grc, added with [[4.0.0|4.0.0 System Update]]
|-
| 0100000000000036 || [[2.0.0|v260]] (0.0.0.260) [[2.1.0|v65596]] (0.0.1.60) [[2.3.0|v131092]] (0.0.2.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) || [[creport]]
|-
| 0100000000000037 || [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || ro
|-
| 0100000000000038 || || This title is referenced by [[3.0.0]] boot2.prodBoot, but does not exist on retail systems.
|-
| 0100000000000039 || [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || sdb
|-
| 010000000000003A || [[4.0.0|v268435656]] (4.0.0.200) || migration, added with [[4.0.0|4.0.0 System Update]]
|-
| 010000000000003C || [[4.0.0|v268435656]] (4.0.0.200) || jpegdec, added with [[4.0.0|4.0.0 System Update]]
|-
| 010000000000003D || [[4.0.0|v268435656]] (4.0.0.200) || [[safemode]], added with [[4.0.0|4.0.0 System Update]]
|}

== System Debug Applets ==
Note: No 01000000000020XX titles exist on retail systems.

{| class=wikitable
! Title-id || Versions || Description
|-
| 0100000000002000 || || "BoardTest"
|-
| 0100000000002001 || || "BoardWireless"
|-
| 0100000000002002 || || C1LcdAndKey ("LcdAndKey") - LCD/Keyboard testing.
|-
| 0100000000002003 || || C2UsbHpmic ("UsbAndHPMicTest") - USB and audio testing.
|-
| 0100000000002004 || || C3Aging ("Aging") - Graphics/Framerate testing.
|-
| 0100000000002005 || || C4SixAxis ("6axisTest") - Sixaxis (controller peripheral) testing.
|-
| 0100000000002006 || || C5Wireless ("AssembledWireless") - Wireless testing.
|-
| 0100000000002007 || || "FinalCheck"
|-
| 0100000000002044 || || "HB-TBIntegrationTest"
|-
| 010000000000204E || || A4BoardCalWriti ("BoardCalWriting") - Writes calibration data to NAND.
|-
| 010000000000209B || || "am.debug" - Used by [[AM_services|AM]].
|-
| 010000000000209C || || TestApplication ("TestApplicationLauncher") - Factory qlaunch replacement. Used to launch other tests.
|-
| 0100000000002071 || || "snap_shot_dump" - Used by [[NS_Services|NS]].
|-
| 01000000000020F0 || || "devmenuapp_installer" - Launched by [[Boot2|boot2]].
|}

== System Data Archives ==
{| class=wikitable
! Title-id || Versions || Description
|-
| 0100000000000800 || [[1.0.0|v260]] (0.0.0.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || SSL trusted certificates
|-
| 0100000000000801 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.2.0|v196628]] (0.0.3.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) || Stores the message strings for Support Error Codes. There's "/DatabaseInfo" at FS root, then the rest is stored at "/{first 4 error digits}/{last 4 error digits}/".
|-
| 0100000000000802 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Random textures?
|-
| 0100000000000803 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v196628]] (0.0.3.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || Mounted as "shareddata:/". Contains various browser data: emojis, OSS NROs, "buildinfo/buildinfo.dat", ...
|-
| 0100000000000804 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || HTML resources: Open-source licenses("Intellectual Property Notices") and seizure warnings("Health & Safety Information"). The former is stored at FS "/legallines.htdocs/" while the latter is at "/safe.htdocs/".
|-
| 0100000000000805 || [[1.0.0|v450]] (0.0.0.450) || Chinese and Korean dictionaries
|-
| 0100000000000806 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) || Bad words
|-
| 0100000000000807 || [[1.0.0|v260]] (0.0.0.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || [[Hotspot List]]
|-
| 0100000000000808 || [[1.0.0|v450]] (0.0.0.450) || European, English, and Japanese dictionaries
|-
| 0100000000000809 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v196628]] (0.0.3.20) [[2.2.0|v196628]] (0.0.3.20) [[2.3.0|v262164]] (0.0.4.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[4.0.1|v268501002]] (4.0.1.10) [[4.1.0|v269484082]] (4.1.0.50) || [[System Version Title]]
|-
| 010000000000080A || [[1.0.0|v450]] (0.0.0.450) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Chara?
|-
| 010000000000080B || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Tutorial images and strings. Used for the offline news by the News applet.
|-
| 010000000000080C || [[1.0.0|v450]] (0.0.0.450) || EULA. Also accessed by [[NS_Services|NS]].
|-
| 010000000000080D || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[4.0.0|v268435656]] (4.0.0.200) || Blacklist URL
|-
| 010000000000080E || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Geo Zoneinfo
|-
| 0100000000000810 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Extended font
|-
| 0100000000000811 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Standard font
|-
| 0100000000000812 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Korean font
|-
| 0100000000000813 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Taiwanese font
|-
| 0100000000000814 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Chinese font
|-
| 0100000000000816 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[2.2.0|v196628]] (0.0.3.20) [[2.3.0|v262164]] (0.0.4.20) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[4.0.1|v268501002]] (4.0.1.10) [[4.1.0|v269484082]] (4.1.0.50) || Contains the title-listing for the associated sysupdate in the [[NCA]]-type0 .cnmt.
|-
| 0100000000000818 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.3.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) || System config
|-
| 0100000000000819 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) || Firmware Package A: Normal Firmware.
|-
| 010000000000081A || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) || Firmware Package B: SafeMode Firmware.
|-
| 010000000000081B || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131082]] (0.0.2.10) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) || Firmware Package C: Normal Firmware (exFAT variant). Identical to 0100000000000819 with different package2. Requires a device ID to download from CDN.
|-
| 010000000000081C || [[4.0.0|v268435656]] (4.0.0.200) [[4.1.0|v269484082]] (4.1.0.50) || Firmware Package D: SafeMode Firmware (exFAT variant). Identical to 010000000000081A with different package2.
|-
| 010000000000081D || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Errdisp strings
|-
| 010000000000081E || [[2.0.0|v260]] (0.0.0.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Dummy file
|-
| 010000000000081F || [[2.0.0|v260]] (0.0.0.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Icosa system config
|-
| 0100000000000820 || [[2.0.0|v260]] (0.0.0.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Copper system config
|-
| 0100000000000821 || [[2.0.0|v260]] (0.0.0.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Hoag system config
|-
| 0100000000000822 || [[3.0.0|v201327002]] (3.0.0.410) [[3.0.2|v201457684]] (3.0.2.20) [[4.0.0|v268435656]] (4.0.0.200) || Firmware binaries for peripherals (hardware within Joy-Cons/etc).
|-
| 0100000000000823 || [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || Contains version.dat and ac_*_nx files. All of the *_nx files stored under here are compressed with gzip.
|}

== System Applets ==
{| class=wikitable
! Title-id || Versions || Description
|-
| 0100000000001000 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "[[qlaunch]]" System applet (Launched by NS with TID loaded from system-config-title)
|-
| 0100000000001001 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "auth"
|-
| 0100000000001002 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "cabinet"
|-
| 0100000000001003 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "controller"
|-
| 0100000000001004 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "dataErase"
|-
| 0100000000001005 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "error"
|-
| 0100000000001006 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "netConnect"
|-
| 0100000000001007 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "playerSelect"
|-
| 0100000000001008 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131132]] (0.0.2.60) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "swkbd"
|-
| 0100000000001009 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "miiEdit"
|-
| 010000000000100A || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || "LibAppletWeb" [[Internet_Browser|WebApplet]]
|-
| 010000000000100B || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || "LibAppletShop" [[Internet_Browser|ShopN]] applet
|-
| 010000000000100C || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "overlayDisp" Overlay applet (TID is loaded by NS from system-config-title)
|-
| 010000000000100D || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "photoViewer"
|-
| 010000000000100F || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || "LibAppletOff" [[Internet_Browser|Offline]] web-applet
|-
| 0100000000001010 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || "LibAppletLns" [[Internet_Browser|Whitelisted]] applet (LoginApplet+ShareApplet+LobbyApplet)
|-
| 0100000000001011 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[2.1.0|v131162]] (0.0.2.90) [[3.0.0|v201327002]] (3.0.0.410) [[3.0.1|v201392178]] (3.0.1.50) [[4.0.0|v268435656]] (4.0.0.200) || "LibAppletAuth" [[Internet_Browser|WifiWebAuth]] applet
|-
| 0100000000001012 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "starter"
|-
| 0100000000001013 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "myPage"
|-
| 0100000000001015 || [[1.0.0|v450]] (0.0.0.450) [[2.0.0|v65796]] (0.0.1.260) [[3.0.0|v201327002]] (3.0.0.410) [[4.0.0|v268435656]] (4.0.0.200) || "maintenance" Initial applet displayed when booting into [[Recovery_Mode]]. This title is launched by [[NS_Services|NS]] when a state flag is val1 indicating that this title should be launched instead of the above "System applet" title.
|-
| 0100000000001016 || || TitleID used by [[NS_Services|NS]] when a certain flag is non-zero, in multiple places including around code using string "application_install". This title doesn't seem to exist for retail.
|}

== Factory System Modules ==
{| class=wikitable
! Title-id || Versions || Description
|-
| 100000000000B120 || || Launched by maintenance mode [[Boot2|boot2.manuBoot]], but not present in retail or [[Factory Setup|factory firmware]].
|-
| 100000000000B14A || || [[Manu Services|manu]] - installed in [[Factory Setup|factory firmware]].
|}

== Target Tools ==
{| class=wikitable
! Title-id || Versions || Description
|-
| 1000000000000001 || || [[Factory Setup|SystemInitializ]]
|-
| 1000000000000004 || || [[Factory Setup|CalWriterManu]]
|-
| 1000000000000007 || || "ApplicationLauncer"
|}

== System Applications ==
{| class=wikitable
! Title-id || Versions || Description
|-
| 01008BB00013C000 || [[1.0.0|v450]] (0.0.0.450) [[4.0.0|v268435656]] (4.0.0.200) || "[[flog]]" NES emulator.
|-
| 0100069000078000 || v0 || "Retail Interactive Display Menu". This title can be launched by [[qlaunch]], but is not normally installed on retail systems.
|}

== eShop Games / Applications ==
Note: Nintendo Switch game and application titles follow a higher entropy TitleID scheme than previous generation consoles. Refer to the [[Title_list/Games|Games List]] for more information.

Title list

2018-01-01T07:20:16Z

Hthh:

== System Modules ==
Note: Unlike 3DS, Switch doesn't have a dedicated HTTP-sysmodule. Instead, processes using HTTP(S) just use libcurl + socket/ssl services.

As of [[2.0.0]], the only sysmodule with a RomFS is [[HID_services|hid-sysmodule]].

Decimal versions are shown here as an 8.8.8.8 bitfield, but the values fit a 6.10.16 bitfield better.

{| class=wikitable
! Title-id || Versions || Description
|-
| 0100000000000000 || [bundled with kernel] || FS
|-
| 0100000000000001 || [bundled with kernel] || Loader
|-
| 0100000000000002 || [bundled with kernel] || NCM
|-
| 0100000000000003 || [bundled with kernel] || ProcessMana
|-
| 0100000000000004 || [bundled with kernel] || sm
|-
| 0100000000000005 || [bundled with kernel] || [[boot]]
|-
| 0100000000000006 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || usb
|-
| 0100000000000007 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || tma
|-
| 0100000000000008 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || [[Boot2|boot2]]
|-
| 0100000000000009 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || settings
|-
| 010000000000000A || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || bus
|-
| 010000000000000B || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || bluetooth
|-
| 010000000000000C || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) || bcat
|-
| 010000000000000D || || Launched by maintenance mode [[Boot2|boot2.manuBoot]], but not present in retail or [[Factory Setup|factory firmware]].
|-
| 010000000000000E || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || friends
|-
| 010000000000000F || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131082]] (0.2.0.10) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || nifm
|-
| 0100000000000010 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131132]] (0.2.0.60) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || ptm
|-
| 0100000000000011 || || Launched by maintenance mode [[Boot2|boot2.manuBoot]], but not present in retail or [[Factory Setup|factory firmware]].
|-
| 0100000000000012 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.3.0|v131092]] (0.2.0.20) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) || bsdsockets
|-
| 0100000000000013 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131132]] (0.2.0.60) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) [[4.1.0|v269484082]] (16.16.0.50) || hid
|-
| 0100000000000014 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || audio
|-
| 0100000000000015 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || LogManager.Prod
|-
| 0100000000000016 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131082]] (0.2.0.10) [[2.2.0|v196608]] (0.3.0.0) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) || wlan
|-
| 0100000000000017 || || Launched by maintenance mode [[Boot2|boot2.manuBoot]], but not present in retail or [[Factory Setup|factory firmware]].
|-
| 0100000000000018 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || ldn
|-
| 0100000000000019 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131082]] (0.2.0.10) [[2.3.0|v196628]] (0.3.0.20) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) [[4.0.1|v268501002]] (16.1.0.10) [[4.1.0|v269484082]] (16.16.0.50) || nvservices
|-
| 010000000000001A || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || pcv
|-
| 010000000000001B || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || ppc
|-
| 010000000000001C || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131082]] (0.2.0.10) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) [[4.1.0|v269484082]] (16.16.0.50) || nvnflinger
|-
| 010000000000001D || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || pcie.withoutHb
|-
| 010000000000001E || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) || account
|-
| 010000000000001F || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131132]] (0.2.0.60) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || ns
|-
| 0100000000000020 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.2.0|v131072]] (0.2.0.0) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || nfc
|-
| 0100000000000021 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || psc
|-
| 0100000000000022 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || capsrv
|-
| 0100000000000023 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131132]] (0.2.0.60) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || am
|-
| 0100000000000024 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || ssl
|-
| 0100000000000025 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131082]] (0.2.0.10) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) [[4.1.0|v269484082]] (16.16.0.50) || nim
|-
| 0100000000000028 || [bundled with kernel] || spl
|-
| 0100000000000029 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || lbl
|-
| 010000000000002A || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || btm
|-
| 010000000000002B || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131132]] (0.2.0.60) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || erpt
|-
| 010000000000002D || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || vi
|-
| 010000000000002E || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131082]] (0.2.0.10) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || pctl
|-
| 010000000000002F || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || npns
|-
| 0100000000000030 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131132]] (0.2.0.60) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || [[Eupld_services|eupld]]
|-
| 0100000000000031 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || glue
|-
| 0100000000000032 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || eclct
|-
| 0100000000000033 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || es
|-
| 0100000000000034 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131132]] (0.2.0.60) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) [[4.1.0|v269484082]] (16.16.0.50) || fatal
|-
| 0100000000000035 || [[4.0.0|v268435656]] (16.0.0.200) || grc, added with [[4.0.0|4.0.0 System Update]]
|-
| 0100000000000036 || [[2.0.0|v260]] (0.0.1.4) [[2.1.0|v65596]] (0.1.0.60) [[2.3.0|v131092]] (0.2.0.20) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) || [[creport]]
|-
| 0100000000000037 || [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || ro
|-
| 0100000000000038 || || This title is referenced by [[3.0.0]] boot2.prodBoot, but does not exist on retail systems.
|-
| 0100000000000039 || [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || sdb
|-
| 010000000000003A || [[4.0.0|v268435656]] (16.0.0.200) || migration, added with [[4.0.0|4.0.0 System Update]]
|-
| 010000000000003C || [[4.0.0|v268435656]] (16.0.0.200) || jpegdec, added with [[4.0.0|4.0.0 System Update]]
|-
| 010000000000003D || [[4.0.0|v268435656]] (16.0.0.200) || [[safemode]], added with [[4.0.0|4.0.0 System Update]]
|}

== System Debug Applets ==
Note: No 01000000000020XX titles exist on retail systems.

{| class=wikitable
! Title-id || Versions || Description
|-
| 0100000000002000 || || "BoardTest"
|-
| 0100000000002001 || || "BoardWireless"
|-
| 0100000000002002 || || C1LcdAndKey ("LcdAndKey") - LCD/Keyboard testing.
|-
| 0100000000002003 || || C2UsbHpmic ("UsbAndHPMicTest") - USB and audio testing.
|-
| 0100000000002004 || || C3Aging ("Aging") - Graphics/Framerate testing.
|-
| 0100000000002005 || || C4SixAxis ("6axisTest") - Sixaxis (controller peripheral) testing.
|-
| 0100000000002006 || || C5Wireless ("AssembledWireless") - Wireless testing.
|-
| 0100000000002007 || || "FinalCheck"
|-
| 0100000000002044 || || "HB-TBIntegrationTest"
|-
| 010000000000204E || || A4BoardCalWriti ("BoardCalWriting") - Writes calibration data to NAND.
|-
| 010000000000209B || || "am.debug" - Used by [[AM_services|AM]].
|-
| 010000000000209C || || TestApplication ("TestApplicationLauncher") - Factory qlaunch replacement. Used to launch other tests.
|-
| 0100000000002071 || || "snap_shot_dump" - Used by [[NS_Services|NS]].
|-
| 01000000000020F0 || || "devmenuapp_installer" - Launched by [[Boot2|boot2]].
|}

== System Data Archives ==
{| class=wikitable
! Title-id || Versions || Description
|-
| 0100000000000800 || [[1.0.0|v260]] (0.0.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || SSL trusted certificates
|-
| 0100000000000801 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.2.0|v196628]] (0.3.0.20) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) || Stores the message strings for Support Error Codes. There's "/DatabaseInfo" at FS root, then the rest is stored at "/{first 4 error digits}/{last 4 error digits}/".
|-
| 0100000000000802 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Random textures?
|-
| 0100000000000803 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v196628]] (0.3.0.20) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || Mounted as "shareddata:/". Contains various browser data: emojis, OSS NROs, "buildinfo/buildinfo.dat", ...
|-
| 0100000000000804 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || HTML resources: Open-source licenses("Intellectual Property Notices") and seizure warnings("Health & Safety Information"). The former is stored at FS "/legallines.htdocs/" while the latter is at "/safe.htdocs/".
|-
| 0100000000000805 || [[1.0.0|v450]] (0.0.1.194) || Chinese and Korean dictionaries
|-
| 0100000000000806 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) || Bad words
|-
| 0100000000000807 || [[1.0.0|v260]] (0.0.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || [[Hotspot List]]
|-
| 0100000000000808 || [[1.0.0|v450]] (0.0.1.194) || European, English, and Japanese dictionaries
|-
| 0100000000000809 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v196628]] (0.3.0.20) [[2.2.0|v196628]] (0.3.0.20) [[2.3.0|v262164]] (0.4.0.20) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) [[4.0.1|v268501002]] (16.1.0.10) [[4.1.0|v269484082]] (16.16.0.50) || [[System Version Title]]
|-
| 010000000000080A || [[1.0.0|v450]] (0.0.1.194) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Chara?
|-
| 010000000000080B || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Tutorial images and strings. Used for the offline news by the News applet.
|-
| 010000000000080C || [[1.0.0|v450]] (0.0.1.194) || EULA. Also accessed by [[NS_Services|NS]].
|-
| 010000000000080D || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[4.0.0|v268435656]] (16.0.0.200) || Blacklist URL
|-
| 010000000000080E || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Geo Zoneinfo
|-
| 0100000000000810 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Extended font
|-
| 0100000000000811 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Standard font
|-
| 0100000000000812 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Korean font
|-
| 0100000000000813 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Taiwanese font
|-
| 0100000000000814 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Chinese font
|-
| 0100000000000816 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131162]] (0.2.0.90) [[2.2.0|v196628]] (0.3.0.20) [[2.3.0|v262164]] (0.4.0.20) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) [[4.0.1|v268501002]] (16.1.0.10) [[4.1.0|v269484082]] (16.16.0.50) || Contains the title-listing for the associated sysupdate in the [[NCA]]-type0 .cnmt.
|-
| 0100000000000818 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.3.0|v131082]] (0.2.0.10) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) [[4.1.0|v269484082]] (16.16.0.50) || System config
|-
| 0100000000000819 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131082]] (0.2.0.10) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) [[4.1.0|v269484082]] (16.16.0.50) || Firmware Package A: Normal Firmware.
|-
| 010000000000081A || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131082]] (0.2.0.10) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) [[4.1.0|v269484082]] (16.16.0.50) || Firmware Package B: SafeMode Firmware.
|-
| 010000000000081B || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131082]] (0.2.0.10) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) [[4.1.0|v269484082]] (16.16.0.50) || Firmware Package C: Normal Firmware (exFAT variant). Identical to 0100000000000819 with different package2. Requires a device ID to download from CDN.
|-
| 010000000000081C || [[4.0.0|v268435656]] (16.0.0.200) [[4.1.0|v269484082]] (16.16.0.50) || Firmware Package D: SafeMode Firmware (exFAT variant). Identical to 010000000000081A with different package2.
|-
| 010000000000081D || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Errdisp strings
|-
| 010000000000081E || [[2.0.0|v260]] (0.0.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Dummy file
|-
| 010000000000081F || [[2.0.0|v260]] (0.0.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Icosa system config
|-
| 0100000000000820 || [[2.0.0|v260]] (0.0.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Copper system config
|-
| 0100000000000821 || [[2.0.0|v260]] (0.0.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Hoag system config
|-
| 0100000000000822 || [[3.0.0|v201327002]] (12.0.1.154) [[3.0.2|v201457684]] (12.2.0.20) [[4.0.0|v268435656]] (16.0.0.200) || Firmware binaries for peripherals (hardware within Joy-Cons/etc).
|-
| 0100000000000823 || [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || Contains version.dat and ac_*_nx files. All of the *_nx files stored under here are compressed with gzip.
|}

== System Applets ==
{| class=wikitable
! Title-id || Versions || Description
|-
| 0100000000001000 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131162]] (0.2.0.90) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "[[qlaunch]]" System applet (Launched by NS with TID loaded from system-config-title)
|-
| 0100000000001001 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "auth"
|-
| 0100000000001002 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "cabinet"
|-
| 0100000000001003 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "controller"
|-
| 0100000000001004 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "dataErase"
|-
| 0100000000001005 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "error"
|-
| 0100000000001006 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "netConnect"
|-
| 0100000000001007 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "playerSelect"
|-
| 0100000000001008 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131132]] (0.2.0.60) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "swkbd"
|-
| 0100000000001009 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "miiEdit"
|-
| 010000000000100A || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131162]] (0.2.0.90) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || "LibAppletWeb" [[Internet_Browser|WebApplet]]
|-
| 010000000000100B || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131162]] (0.2.0.90) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || "LibAppletShop" [[Internet_Browser|ShopN]] applet
|-
| 010000000000100C || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "overlayDisp" Overlay applet (TID is loaded by NS from system-config-title)
|-
| 010000000000100D || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "photoViewer"
|-
| 010000000000100F || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131162]] (0.2.0.90) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || "LibAppletOff" [[Internet_Browser|Offline]] web-applet
|-
| 0100000000001010 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131162]] (0.2.0.90) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || "LibAppletLns" [[Internet_Browser|Whitelisted]] applet (LoginApplet+ShareApplet+LobbyApplet)
|-
| 0100000000001011 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[2.1.0|v131162]] (0.2.0.90) [[3.0.0|v201327002]] (12.0.1.154) [[3.0.1|v201392178]] (12.1.0.50) [[4.0.0|v268435656]] (16.0.0.200) || "LibAppletAuth" [[Internet_Browser|WifiWebAuth]] applet
|-
| 0100000000001012 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "starter"
|-
| 0100000000001013 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "myPage"
|-
| 0100000000001015 || [[1.0.0|v450]] (0.0.1.194) [[2.0.0|v65796]] (0.1.1.4) [[3.0.0|v201327002]] (12.0.1.154) [[4.0.0|v268435656]] (16.0.0.200) || "maintenance" Initial applet displayed when booting into [[Recovery_Mode]]. This title is launched by [[NS_Services|NS]] when a state flag is val1 indicating that this title should be launched instead of the above "System applet" title.
|-
| 0100000000001016 || || TitleID used by [[NS_Services|NS]] when a certain flag is non-zero, in multiple places including around code using string "application_install". This title doesn't seem to exist for retail.
|}

== Factory System Modules ==
{| class=wikitable
! Title-id || Versions || Description
|-
| 100000000000B120 || || Launched by maintenance mode [[Boot2|boot2.manuBoot]], but not present in retail or [[Factory Setup|factory firmware]].
|-
| 100000000000B14A || || [[Manu Services|manu]] - installed in [[Factory Setup|factory firmware]].
|}

== Target Tools ==
{| class=wikitable
! Title-id || Versions || Description
|-
| 1000000000000001 || || [[Factory Setup|SystemInitializ]]
|-
| 1000000000000004 || || [[Factory Setup|CalWriterManu]]
|-
| 1000000000000007 || || "ApplicationLauncer"
|}

== System Applications ==
{| class=wikitable
! Title-id || Versions || Description
|-
| 01008BB00013C000 || [[1.0.0|v450]] (0.0.1.194) [[4.0.0|v268435656]] (16.0.0.200) || "[[flog]]" NES emulator.
|-
| 0100069000078000 || v0 || "Retail Interactive Display Menu". This title can be launched by [[qlaunch]], but is not normally installed on retail systems.
|}

== eShop Games / Applications ==
Note: Nintendo Switch game and application titles follow a higher entropy TitleID scheme than previous generation consoles. Refer to the [[Title_list/Games|Games List]] for more information.

Audio services

2017-12-30T21:09:56Z

Hthh: Undo revision 3309 by Hthh (talk)

= audout:u =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || ListAudioOuts
|-
| 1 || [[#OpenAudioOut]]
|}

== OpenAudioOut ==
Takes two u64s (an interface ID and a PID placeholder?), a PID, a process handle, and the name of the interface you want to connect to. Returns an [[#IAudioOut]] object and four u32s: the sample rate, channel count, PCM format, and an unknown field. PCM format 2 is INT16.

== IAudioOut ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetAudioOutState]]
|-
| 1 || StartAudioOut
|-
| 2 || StopAudioOut
|-
| 3 || [[#AppendAudioOutBuffer]] taking a type 0x5 (A descriptor) buffer
|-
| 4 || [[#RegisterBufferEvent]]
|-
| 5 || [[#GetReleasedAudioOutBuffer]] taking a type 0x6 (B descriptor) buffer
|-
| 6 || ContainsAudioOutBuffer
|-
| 7 || [[#AppendAudioOutBuffer]] taking a type 0x21 buffer
|-
| 8 || [[#GetReleasedAudioOutBuffer]] taking a type 0x22 buffer
|}

=== GetAudioOutState ===

Returns an AudioOutState, 0x00=Started 0x01=Stopped

=== AppendAudioOutBuffer ===

Takes a u64 (not sure what this is, might act as some sort of identifier for the audio buffer? official applications seem to use the address of the audio buffer struct for this) and a buffer.
The format of said buffer is as follows:

{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x00 || 8 || Pointer to the sample data pointer.
|-
| 0x08 || 8 || Pointer to sample data.
|-
| 0x10 || 8 || Capacity of sample buffer
|-
| 0x18 || 8 || Size of data in sample buffer
|-
| 0x20 || 8 || Unknown. Zero works.
|}

=== RegisterBufferEvent ===

Returns an event handle that is signalled when a buffer is released

=== GetReleasedAudioOutBuffer ===

Takes a buffer, which it will fill with the identifiers passed from [[#AppendAudioOutBuffer]] of audio buffers that have been released. Will return a u32 (may indicate how many buffers were released?)

= audin:u =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || ListAudioIns
|-
| 1 || OpenAudioIn
|}

== IAudioIn ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetAudioInState]]
|-
| 1 || StartAudioIn
|-
| 2 || StopAudioIn
|-
| 3 || AppendAudioInBuffer
|-
| 4 || RegisterBufferEvent
|-
| 5 || GetReleasedAudioInBuffer
|-
| 6 || ContainsAudioInBuffer
|}

=== GetAudioInState ===

Returns an AudioInState, 0x00=Started 0x01=Stopped

= audrec:u =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || OpenFinalOutputRecorder
|}

== IFinalOutputRecorder ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetFinalOutputRecorderState
|-
| 1 || StartFinalOutputRecorder
|-
| 2 || StopFinalOutputRecorder
|-
| 3 || AppendFinalOutputRecorderBuffer
|-
| 4 || RegisterBufferEvent
|-
| 5 || GetReleasedFinalOutputRecorderBuffer
|-
| 6 || ContainsFinalOutputRecorderBuffer
|}

= audren:u =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || OpenAudioRenderer
|-
| 1 || GetAudioRendererWorkBufferSize
|-
| 2 || GetAudioRenderersProcessMasterVolume
|-
| 3 || SetAudioRenderersProcessMasterVolume
|}

== IAudioRenderer ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetAudioRendererSampleRate
|-
| 1 || GetAudioRendererSampleCount
|-
| 2 || GetAudioRendererMixBufferCount
|-
| 3 || GetAudioRendererState
|-
| 4 || RequestUpdateAudioRenderer
|-
| 5 || StartAudioRenderer
|-
| 6 || StopAudioRenderer
|-
| 7 || Unknown
|-
| 8 || SetAudioRendererRenderingTimeLimit
|-
| 9 || GetAudioRendererRenderingTimeLimit
|}

= audout:a, audin:a, audrec:a and audren:a =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestSuspend
|-
| 1 || RequestResume
|}

= audout:d, audin:d, audrec:d and audren:d =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestSuspendForDebug]]
|-
| 1 || [[#RequestResumeForDebug]]
|}

== RequestSuspendForDebug ==

Takes an [[AM_services#AppletResourceUserId|AppletResourceUserId]]. (u64)

== RequestResumeForDebug ==

Takes an [[AM_services#AppletResourceUserId|AppletResourceUserId]]. (u64)

= codecctl =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || InitializeCodecController
|-
| 1 || FinalizeCodecController
|-
| 2 || SleepCodecController
|-
| 3 || WakeCodecController
|-
| 4 || [[#SetCodecVolume]]
|-
| 5 || GetCodecVolumeMax
|-
| 6 || GetCodecVolumeMin
|-
| 7 || SetCodecActiveTarget
|-
| 8 || Unknown
|-
| 9 || BindCodecHeadphoneMicJackInterrupt
|-
| 10 || IsCodecHeadphoneMicJackInserted
|-
| 11 || ClearCodecHeadphoneMicJackInterrupt
|-
| 12 || IsCodecDeviceRequested
|}

== SetCodecVolume ==

Takes a Volume (uint32)

[[Category:Services]]

Audio services

2017-12-30T20:13:52Z

Hthh:

= audout:u =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || ListAudioOuts
|-
| 1 || [[#OpenAudioOut]]
|}

== OpenAudioOut ==
Takes two u64s (an interface ID and a PID placeholder?), a PID, a process handle, and the name of the interface you want to connect to. Returns an [[#IAudioOut]] object.

== IAudioOut ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetAudioOutState]]
|-
| 1 || StartAudioOut
|-
| 2 || StopAudioOut
|-
| 3 || AppendAudioOutBuffer
|-
| 4 || RegisterBufferEvent
|-
| 5 || GetReleasedAudioOutBuffer
|-
| 6 || ContainsAudioOutBuffer
|}

=== GetAudioOutState ===

Returns an AudioOutState, 0x00=Started 0x01=Stopped

= audout:a =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestSuspendAudioOuts
|-
| 1 || RequestResumeAudioOuts
|}

= audout:d =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestSuspendAudioOutsForDebug]]
|-
| 1 || [[#RequestResumeAudioOutsForDebug]]
|}

== RequestSuspendAudioOutsForDebug ==

Takes an [[AM_services#AppletResourceUserId|AppletResourceUserId]]. (u64)

== RequestResumeAudioOutsForDebug ==

Takes an [[AM_services#AppletResourceUserId|AppletResourceUserId]]. (u64)

= audin:u =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || ListAudioIns
|-
| 1 || OpenAudioIn
|}

== IAudioIn ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#GetAudioInState]]
|-
| 1 || StartAudioIn
|-
| 2 || StopAudioIn
|-
| 3 || AppendAudioInBuffer
|-
| 4 || RegisterBufferEvent
|-
| 5 || GetReleasedAudioInBuffer
|-
| 6 || ContainsAudioInBuffer
|}

=== GetAudioInState ===

Returns an AudioInState, 0x00=Started 0x01=Stopped

= audin:a =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestSuspendAudioIns
|-
| 1 || RequestResumeAudioIns
|}

= audin:d =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RequestSuspendAudioInsForDebug]]
|-
| 1 || [[#RequestResumeAudioInsForDebug]]
|}

== RequestSuspendAudioInsForDebug ==

Takes an [[AM_services#AppletResourceUserId|AppletResourceUserId]]. (u64)

== RequestResumeAudioInsForDebug ==

Takes an [[AM_services#AppletResourceUserId|AppletResourceUserId]]. (u64)

= audrec:u =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || OpenFinalOutputRecorder
|}

== IFinalOutputRecorder ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetFinalOutputRecorderState
|-
| 1 || StartFinalOutputRecorder
|-
| 2 || StopFinalOutputRecorder
|-
| 3 || AppendFinalOutputRecorderBuffer
|-
| 4 || RegisterBufferEvent
|-
| 5 || GetReleasedFinalOutputRecorderBuffer
|-
| 6 || ContainsFinalOutputRecorderBuffer
|}

= audren:u =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || OpenAudioRenderer
|-
| 1 || GetAudioRendererWorkBufferSize
|-
| 2 || GetAudioRenderersProcessMasterVolume
|-
| 3 || SetAudioRenderersProcessMasterVolume
|}

== IAudioRenderer ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetAudioRendererSampleRate
|-
| 1 || GetAudioRendererSampleCount
|-
| 2 || GetAudioRendererMixBufferCount
|-
| 3 || GetAudioRendererState
|-
| 4 || RequestUpdateAudioRenderer
|-
| 5 || StartAudioRenderer
|-
| 6 || StopAudioRenderer
|-
| 7 || QuerySystemEvent
|-
| 8 || SetAudioRendererRenderingTimeLimit
|-
| 9 || GetAudioRendererRenderingTimeLimit
|}

= codecctl =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || InitializeCodecController
|-
| 1 || FinalizeCodecController
|-
| 2 || SleepCodecController
|-
| 3 || WakeCodecController
|-
| 4 || [[#SetCodecVolume]]
|-
| 5 || GetCodecVolumeMax
|-
| 6 || GetCodecVolumeMin
|-
| 7 || SetCodecActiveTarget
|-
| 8 || Unknown
|-
| 9 || BindCodecHeadphoneMicJackInterrupt
|-
| 10 || IsCodecHeadphoneMicJackInserted
|-
| 11 || ClearCodecHeadphoneMicJackInterrupt
|-
| 12 || IsCodecDeviceRequested
|}

== SetCodecVolume ==

Takes a Volume (uint32)

[[Category:Services]]

Filesystem services

2017-12-26T02:53:30Z

Hthh:

= fsp-ldr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Notes
|-
| 0 || MountCode || u64 TitleId + X descriptor [[#ContentPath]] || Returns an [[#IFileSystem]].
|-
| 1 || IsCodeMounted || u64 ProcessId || Returns a bool (1 if code is mounted).
|-
| 2 || [4.0.0+] Initialize || PID descriptor ||
|}

= fsp-pr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#SetFsPermissions]] ||
|-
| 1 || [[#ClearFsPermissions]] ||
|-
| 2 || [4.0.0+] Initialize ||
|-
| 256 || [[#SetEnabledProgramVerification]] ||
|}

== SetFsPermissions ==
Takes a storageID, a pid, a titleID, a 0x1C type-A buffer for the [[NPDM#FS_Access_Header| FS Access Header]], and a 0x2C type-A buffer for the [[NPDM#FS_Access_Control| FS Access Control]]

Final FS permissions are stored as (ACI0_perms & ACID_perms). Will panic(svcBreak) when buffer sizes from ipc-rawdata are invalid.

== ClearFsPermissions ==
Takes a pid. Removes registered FS permissions for that PID.

== SetEnabledProgramVerification ==
Seems to sets a global flag to inputval & 1.

When the flag is zero, it will set ret=0 instead of ret={error} when verifying a RSA signature fails. This RSA signature seems to be the signature in the [[NPDM]] ACID. It then skips verifying what seems to be the second signature in the [[NCA_Format|NCA header]]. Note that if verifying the NPDM(?) signature is successful, and verifying that second signature fails, it will throw an error and abort.

= fsp-srv =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0] [[#MountContent]]
|-
| 1 || [[#Initialize]]
|-
| 2 || OpenDataFileSystemByCurrentProcess
|-
| 7 || [2.0.0+] [[#MountContent7]]
|-
| 8 || [2.0.0+] [[#MountContent]]
|-
| 9 || [3.0.0+] OpenDataFileSystemByApplicationId
|-
| 11 || [[#MountBis]]
|-
| 12 || [[#OpenBisPartition]]
|-
| 13 || InvalidateBisCache
|-
| 17 || OpenHostFileSystemImpl
|-
| 18 || MountSdCard
|-
| 19 || [2.0.0+] FormatSdCard
|-
| 21 || [[#DeleteSaveData]]
|-
| 22 || [[#CreateSaveData]]
|-
| 23 || [[#CreateSystemSaveData]]
|-
| 24 || RegisterSaveDataAtomicDeletion
|-
| 25 || [2.0.0+] DeleteSaveDataWithSpaceId
|-
| 26 || [2.0.0+] FormatSdCardDryRun
|-
| 27 || [2.0.0+] IsExFatSupported
|-
| 28 || [4.0.0+] DeleteSystemSaveData
|-
| 30 || [[#OpenGameCardPartition]]
|-
| 31 || [[#MountGameCardPartition]]
|-
| 32 || [3.0.0+] ExtendSaveData
|-
| 51 || [[#MountSaveData]]
|-
| 52 || [[#MountSystemSaveData]]
|-
| 53 || [2.0.0+] MountSaveDataReadOnly
|-
| 57 || [3.0.0+] ReadSaveDataFileSystemExtraDataWithSpaceId
|-
| 58 || ReadSaveDataFileSystemExtraData
|-
| 59 || [2.0.0+] WriteSaveDataFileSystemExtraData
|-
| 60 || OpenSaveDataInfoReader
|-
| 61 || OpenSaveDataIterator
|-
| 80 || OpenSaveDataThumbnailFile
|-
| 81 || [4.0.0+] OpenSaveDataTransferManager
|-
| 100 || MountImageDirectory
|-
| 110 || [[#MountContentStorage]]
|-
| 200 || OpenDataStorageByCurrentProcess
|-
| 201 || [3.0.0+] OpenDataStorageByApplicationId
|-
| 202 || [[#OpenDataStorageByDataId]]
|-
| 203 || Returns an [[#IStorage]]
|-
| 400 || [[#OpenDeviceOperator]]
|-
| 500 || [[#OpenSdCardDetectionEventNotifier]]
|-
| 501 || [[#OpenGameCardDetectionEventNotifier]]
|-
| 600 || [1.0.0-3.0.2] SetCurrentPosixTime
|-
| 601 || QuerySaveDataTotalSize
|-
| 602 || [[#VerifySaveData]]
|-
| 603 || CorruptSaveDataForDebug
|-
| 604 || CreatePaddingFile
|-
| 605 || DeleteAllPaddingFiles
|-
| 606 || [2.0.0+] GetRightsId
|-
| 607 || [2.0.0+] RegisterExternalKey
|-
| 608 || [2.0.0+] UnregisterExternalKey
|-
| 609 || [2.0.0+] GetRightsIdByPath
|-
| 610 || [3.0.0+] GetRightsIdByPath2 (returns extra byte)
|-
| 611 || [4.0.0+] SetCurrentPosixTime
|-
| 612 || [4.0.0+] GetFreeSpaceSize
|-
| 613 || [4.0.0+]
|-
| 614 || [4.0.0+]
|-
| 620 || [2.0.0+] [[#SetSdCardEncryptionSeed]]
|-
| 630 || [4.0.0+] SetSdCardAccessibility
|-
| 631 || [4.0.0+] IsSdCardAccessible
|-
| 640 || [4.0.0+] IsSignedSystemPartitionOnSdCardValid
|-
| 800 || [2.0.0+] GetAndClearFileSystemProxyErrorInfo
|-
| 1000 || SetBisRootForHost
|-
| 1001 || SetSaveDataSize
|-
| 1002 || SetSaveDataRootPath
|-
| 1003 || DisableAutoSaveDataCreation
|-
| 1004 || [[#SetGlobalAccessLogMode]]
|-
| 1005 || [[#GetGlobalAccessLogMode]]
|-
| 1006 || [[#OutputAccessLogToSdCard]]
|-
| 1007 || [4.0.0+] RegisterUpdatePartition
|-
| 1008 || [4.0.0+] MountRegisteredUpdatePartition
|-
| 1009 || [4.0.0+]
|-
| 1100 || [4.0.0+] OverrideSaveDataTransferTokenSignVerificationKey
|}

== Permissions ==
Every time permissions are checked, the process registration [[#fsp-pr]] is loaded using the session processID. The permission data is populated with data from the [[NPDM]],

If the processID is <= 6 (which happens only for built-in sysmodules), it will use a hardcoded registration data. The default mask in this case is 0x8000000000000000.

Note that the functions check whether or not at least one bit is set in the mask. This means that, you don't need to set 0xFFFFFFFFFFFFFFFF to get all permissions: it suffices to set 0x8000000000000000.

If the code were to request an invalid input type, panic. But this never happens.

=== RwPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Value || Used by
|-
| 0x0 || 0x8000000000000801 || MountContentType2 || 1 || [[#MountContent]]
|-
| 0x1 || 0x8000000000000801 || MountContentType5 || 1 || [[#MountContent]]
|-
| 0x2 || 0x8000000000000801 || MountContentType3 || 1 || [[#MountContent]]
|-
| 0x3 || 0x8000000000000801 || MountContentType4 || 1 || [[#MountContent]]
|-
| 0x4 || 0x8000000000000801 || MountContentType6 || 1 || [[#MountContent]]
|-
| 0x5 || 0x8000000000000801 || MountContentType7 || 1 || [[#MountContent]]
|-
| 0x6 || 0x8000000000000000 || || 3 ||
|-
| 0x7 || 0x8000000000000800 || ContentStorageAccess || 3 || [[#MountContentStorage]]
|-
| 0x8 || 0x8000000000001000 || ImageDirectoryAccess || 3 || [[#MountImageDirectory]]
|-
| 0x9 || 0x8000000000000084 || MountBisType28 || 3 || [[#MountBis]]
|-
| 0xA || 0x8000000000000080 || MountBisType29 || 3 || [[#MountBis]]
|-
| 0xB || 0x8000000000008080 || MountBisType30 || 3 || [[#MountBis]]
|-
| 0xC || 0x8000000000008080 || MountBisType31 || 3 || [[#MountBis]]
|-
| 0xD || 0x8000000000000080 || || 3 ||
|-
| 0xE || 0xC000000000200000 || SdCardAccess || 3 || [[#MountSdCard]]
|-
| 0xF || 0x8000000000000010 || GameCardUser || 3 || [[#MountGameCardPartition]]
|-
| 0x10 || 0x8000000000040020 || SaveDataAccess0 || 3 || [[#MountSaveData]]
|-
| 0x11 || 0x8000000000000028 || SystemSaveDataAccess0 || 3 || [[#MountSystemSaveData]]
|-
| 0x12 || 0x8000000000000020 || SaveDataAccess1 || 3 || [[#MountSaveData]]
|-
| 0x13 || 0x8000000000000020 || SystemSaveDataAccess1 || 3 || [[#MountSystemSaveData]]
|-
| 0x14 || 0x8000000000010082 || BisPartition0 || 3 || [[#OpenBisPartition]]
|-
| 0x15 || 0x8000000000010080 || BisPartition10 || 3 || [[#OpenBisPartition]]
|-
| 0x17 || 0x8000000000010080 || BisPartition20 || 3 || [[#OpenBisPartition]]
|-
| 0x18 || 0x8000000000010080 || BisPartition21 || 3 || [[#OpenBisPartition]]
|-
| 0x19 || 0x8000000000010080 || BisPartition22 || 3 || [[#OpenBisPartition]]
|-
| 0x1A || 0x8000000000010080 || BisPartition23 || 3 || [[#OpenBisPartition]]
|-
| 0x1B || 0x8000000000010080 || BisPartition24 || 3 || [[#OpenBisPartition]]
|-
| 0x1C || 0x8000000000010080 || BisPartition25 || 3 || [[#OpenBisPartition]]
|-
| 0x16 || 0x8000000000000080 || BisPartition26 || 3 || [[#OpenBisPartition]]
|-
| 0x1D || 0x8000000000000084 || BisPartition27 || 3 || [[#OpenBisPartition]]
|-
| 0x1E || 0x8000000000000084 || BisPartition28 || 3 || [[#OpenBisPartition]]
|-
| 0x1F || 0x8000000000000080 || BisPartition29 || 3 || [[#OpenBisPartition]]
|-
| 0x20 || 0x8000000000000080 || BisPartition30 || 3 || [[#OpenBisPartition]]
|-
| 0x21 || 0x8000000000000080 || BisPartition31 || 3 || [[#OpenBisPartition]]
|-
| 0x22 || 0x8000000000000080 || BisPartition32 || 3 || [[#OpenBisPartition]]
|-
| 0x23 || 0xC000000000200000 || || 3 ||
|-
| 0x24 || 0x8000000000000100 || GameCard_System || 3 || [[#OpenGameCardPartition]], [[#EraseGameCard]] (bit1), [[#WriteToGameCard]] (bit1)
|-
| 0x25 || 0x8000000000100008 || MountContent_System || 1 || [[#MountContent]], [[#OpenDataStorageByDataId]]
|-
| 0x26 || 0xC000000000400000 || HostAccess || 3 || [[#OpenHostFileSystemImpl]]
|}

=== BoolPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Used by
|-
| 0x0 || 0x8000000000000080 || BisCache || [[#InvalidateBisCache]]
|-
| 0x1 || 0x8000000000000080 || EraseMmc || [[#EraseMmc]]
|-
| 0x2 || 0x8000000000000010 || GameCardCertificate || [[#GetGameCardDeviceCertificate]]
|-
| 0x3 || 0x8000000000000010 || GameCardIdSet || [[#GetGameCardIdSet]]
|-
| 0x4 || 0x8000000000000200 || GameCardDriver || [[#FinalizeGameCardDriver]]
|-
| 0x5 || 0x8000000000000200 || GameCardAsic || [[#GetGameCardAsicInfo]]
|-
| 0x6 || 0x8000000000002020 || SaveDataCreate || [[#CreateSaveData]]
|-
| 0x7 || 0x8000000000000060 || SaveDataDelete0 || [[#DeleteSaveData]], [[#RegisterSaveDataAtomicDeletion]]
|-
| 0x8 || 0x8000000000000028 || SystemSaveDataCreate0 || [[#CreateSystemSaveData]]
|-
| 0x9 || 0x8000000000000020 || SystemSaveDataCreate1 || [[#CreateSystemSaveData]]
|-
| 0xA || 0x8000000000004028 || SaveDataDelete1 || [[#DeleteSaveData]], [[#RegisterSaveDataAtomicDeletion]]
|-
| 0xB || 0x8000000000000060 || SaveDataIterators0 || [[#OpenSaveDataIterator]], [[#OpenSaveDataInfoIterator]]
|-
| 0xC || 0x8000000000004020 || SaveDataIterators1 || [[#OpenSaveDataIterator]], [[#OpenSaveDataInfoIterator]]
|-
| 0xD || 0x8000000000020000 || SaveThumbnails || [[#OpenSaveDataThumbnailFile]]
|-
| 0xE || 0x8000000000000400 || PosixTime || [[#SetCurrentPosixTime]]
|-
| 0xF || 0x8000000000004060 || SaveDataExtraData || [[#ReadSaveDataFileSystemExtraData]]
|-
| 0x10 || 0x8000000000080000 || GlobalMode || [[#SetGlobalAccessMode]]
|-
| 0x11 || 0x8000000000080000 || SpeedEmulation || [[#SetSpeedEmulationMode]]
|-
| 0x12 || Invalid || ||
|-
| 0x13 || 0xC000000000800000 || PaddingFiles || [[#CreatePaddingFile]], [[#DeletePaddingFiles]]
|-
| 0x14 || 0xC000000001000000 || SaveData_Debug || [[#CorruptSaveDataForDebug]]
|-
| 0x15 || 0xC000000002000000 || SaveData_SystemManagement || [[#CreateSaveData]], [[#MountSaveData]], [[#SetSaveDataRootPath]]
|-
| [2.0.0+] 0x16 || 0x8000000004000000 || ||
|-
| [2.0.0+] 0x17 || 0x8000000008000000 || ||
|-
| [2.0.0+] 0x18 || 0x8000000010000000 || ||
|-
| [2.0.0+] 0x19 || 0x8000000000000800 || ||
|-
| [2.0.0+] 0x1A || 0x8000000000004020 || ||
|}

== Initialize ==
Takes a pid-descriptor.

== MountContent7 ==
Takes an input u32 (same as [[#MountContent]]) and an u64 title-id. Web-applet loads the u32 from u32_table[inparam]. The in32 must be 4.

Returns an [[#IFileSystem]].

Note: web-applet strings refer to both this cmd and the below "MountContent" as "MountContent".

== MountContent ==
Takes a type-0x19 input buffer, an in32, and an input title-id.

The in32 must be 5 if the NCA type is 0 (control).

The in32 must be 2..7.

The input buffer is the output string path from nsam [[NS_Services#GetContentNcaPath|GetContentNcaPath]].

Returns an [[#IFileSystem]].

May return errors when attempting to access NCA-paths for an update-title with a gamecard, when the gamecard isn't inserted. May return error 0x7D402 in some cases with update-titles. Non-val2 in32 values with NCA-type1 are unusable, even for normal titles.

The official "MountApplicationPackage" func uses this with in64=0 and in32=7.

After the in32-specific permissions are checked, it then gets the func retval for permissions-type 0x25 and func0.

When in32=5, it uses in64=0xffffffffffffffff internally, otherwise it checks if in64 is set to 0xffffffffffffffff then throws an error if so. When the in64 used internally is not 0xffffffffffffffff, it's compared with the NCA titleID, then an error is thrown on mismatch.

== MountBis ==
Takes a type-0x19 input buffer string and a u32 Bis partitionID(see below). Official user-process code sets instr[0] = 0 normally.

Returns an [[#IFileSystem]].

Only partitionIDs for FAT partitions are usable with this, otherwise error 0x2EE202 is returned. Seems to be about the same as [[#OpenBisPartition]] except this mounts the partition filesystem instead of allowing direct access to the partition sectors.

== OpenBisPartition ==
Takes a u32 partition ID, returns 0x2EE202 for partitions which do not exist, 0x320002 for partitions which cannot be opened and a valid [[#IStorage]] handle otherwise.

== InvalidateBisCache ==
Seems to invalidate the Bis cache for MBR/GPT after overwriting that data via the OpenBisPartition IStorage. Used by [[SystemInitializer]].

== DeleteSaveData ==
Takes an input u64.

== CreateSaveData ==
Takes a 0x40-byte Save-struct entry, a 0x40-byte SaveCreate-struct entry, and a 0x10-byte input struct.

Only the first 0x5-bytes in the 0x10-byte struct are initialized: all-zero when automatically creating savedata during savecommon mount by official user-processes. In the dedicated save-creation code in official user-processes: +0 u32 = 0x40060, +4 u8 = 1.

Creates regular savedata.

== CreateSystemSaveData ==
Takes a 0x40-byte Save-struct entry and a 0x40-byte SaveCreate-struct entry.

Creates savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== OpenGameCardPartition ==

Takes an input u32 (partition ID), and returns an [[#IStorage]] for the [[Gamecard_Format|partition]].

== MountGameCardPartition ==
Takes two input u32s, with the second u32 located at +4 in rawdata after the first u32.

Returns an [[#IFileSystem]].

Mounts a gamecard [[Gamecard_Partition|partition]].

== MountSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Official user-process code is only known to use value 1 for the u8.

Returns an [[#IFileSystem]].

Permissions aren't checked until the specified save is successfully found.

Only one process can mount a given savedata at any given time (this includes systemsavedata).

== MountSystemSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Web-applet only uses value0 for the input u8.

Returns an [[#IFileSystem]].

Mounts savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== MountContentStorage ==
Takes a [[#ContentStorageId]]. Invalid values return 0x2EE202.

Returns an [[#IFileSystem]] with NCA files. The read data from these files is identical to the data read by [[Content_Manager_services#ReadEntryRaw]].

== OpenDataStorageByDataId ==
Takes a [[#StorageId]] and a TitleID.

Returns a [[IPC_Marshalling#Domain_message|domain object ID]] implementing the [[#IStorage]] interface for data archives.

== OpenDeviceOperator ==
This command returns a session to a port implementing the [[#IDeviceOperator]] interface.

== OpenSdCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== OpenGameCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== VerifySaveData ==
Takes an unknown input u64 and a type-0x6 output buffer.

The input u64 high-byte must be non-zero, otherwise an [[Error_codes|error]] is returned(0xE02).

== SetSdCardEncryptionSeed ==
Takes 0x10-bytes of input.

Appears to be used to load the seed into FS-module state, since FS-module itself doesn't seem to have file-reading code to handle this itself.

[[NS_Services|NS]]-module uses this with data read from a file.

== SetGlobalAccessLogMode ==
Takes an input u32.

== GetGlobalAccessLogMode ==
Returns an output u32.

GlobalAccessLogMode is normally 0.

== OutputAccessLogToSdCard ==
Takes a type-0x5 input buffer.

The input buffer is the string to output to the log. User-processes normally include a newline at the end.

User-processes only use this when the value previously loaded from [[#GetGlobalAccessLogMode]] has bit1 set.

When bit1 in GlobalAccessLogMode is clear, FS-module will just return 0 for OutputAccessLogToSdCard. However even with that set the log doesn't show up SD, unknown why.

The input buffer is written to the "$FsAccessLog:/FsAccessLog.txt" file, where "$FsAccessLog" is the SD-card mount-name. It's written to the current end of the file(appended).

= IStorage =
This is the interface for a raw device, usually a block device.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments
|-
| 0 || Read || Takes a type-0x46 buffer, an offset and length
|-
| 1 || Write || Takes a type-0x45 buffer, an offset and length
|-
| 2 || Flush || None
|-
| 3 || SetSize || Takes a size
|-
| 4 || GetSize || None
|-
| 5 || [4.0.0+] OperateRange ||
|}

= IFileSystem =
There are two main implementations of this interface:

* '''RomFS''': Filesystem implementation statically linked in the binary. Uses an [[#IStorage]] interface as underlying raw device.
* '''IPC proxy''': Used for all non-RomFS filesystems. In this case, actual filesystem implementation is in the FS process.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateFile
|-
| 1 || DeleteFile
|-
| 2 || CreateDirectory
|-
| 3 || DeleteDirectory
|-
| 4 || DeleteDirectoryRecursively
|-
| 5 || RenameFile
|-
| 6 || RenameDirectory
|-
| 7 || [[#GetEntryType]]
|-
| 8 || OpenFile
|-
| 9 || [[#OpenDirectory]]
|-
| 10 || [[#Commit]]
|-
| 11 || [[#GetFreeSpaceSize]]
|-
| 12 || [[#GetTotalSpaceSize]]
|-
| 13 || CleanDirectoryRecursively [3.0.0+]
|-
| 14 || GetFileTimeStampRaw [3.0.0+]
|-
| 15 || [4.0.0+] QueryEntry
|}

== GetEntryType ==
Takes a type-0x9 input buffer for the path and returns [[#DirectoryEntryType]] as an output u32.

==OpenDirectory==
Takes a type-0x9 input buffer for the path and an u64 '''filter_flags'''. '''filter_flags''' controls what type of entries are read by the [[#IDirectory]]: bitmask 0x1 = directories, bitmask 0x2 = files.

== Commit ==
Like [https://3dbrew.org/wiki/FS:ControlArchive 3DS], this has to be used after writing to savedata for the changes to take affect.

== GetFreeSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total free space with this FS.

== GetTotalSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total space available with this FS(free+used).

= IDirectory =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Read]]
|-
| 1 || [[#GetEntryCount]]
|}

== Read ==
Takes a type-0x6 output buffer and an input u64. Unknown what the u64 is for, doesn't(?) seem to affect output. Returns an output u64(?) for the total number of read entries, this is 0 when no more entries are available.

The output buffer contains the read array of [[#DirectoryEntry]]. This doesn't include entries for "." and "..".

== GetEntryCount ==
Returns an u64 for the total number of readable entries.

= DirectoryEntry =
{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x300 || Path
|-
| 0x300 || 0x4 || ?
|-
| 0x304 || 0x1 || [[#DirectoryEntryType]]
|-
| 0x305 || 0x3 || Padding?
|-
| 0x308 || 0x8? || Filesize, 0 for directories.
|}

= DirectoryEntryType =
s8 type: 0 = directory, 1 = file.

= IFile =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Read
|-
| 1 || Write
|-
| 2 || Flush
|-
| 3 || SetSize
|-
| 4 || GetSize
|-
| 5 || [4.0.0+]
|}

= ISaveDataInfoReader =

= IDeviceOperator =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsSdCardInserted
|-
| 1 || GetSdCardSpeedMode
|-
| 2 || [2.0.0+] GetSdCardCid
|-
| 3 || [2.0.0+] GetSdCardUserAreaSize
|-
| 4 || [2.0.0+] GetSdCardProtectedAreaSize
|-
| 5 || [2.0.0+] GetAndClearSdCardErrorInfo
|-
| 6 || [2.0.0+]
|-
| 100 || GetMmcCid
|-
| 101 || GetMmcSpeedMode
|-
| 110 || EraseMmc
|-
| 111 || GetMmcPartitionSize
|-
| 112 || [2.0.0+] GetMmcPatrolCount
|-
| 113 || [2.0.0+] GetAndClearMmcErrorInfo
|-
| 114 || [2.0.0+] GetMmcExtendedCsd
|-
| 115 || [4.0.0+] SuspendMmcPatrol
|-
| 116 || [4.0.0+] ResumeMmcPatrol
|-
| 200 || IsGameCardInserted
|-
| 201 || EraseGameCard
|-
| 202 || GetGameCardHandle
|-
| 203 || [[#GetGameCardUpdatePartitionInfo]]
|-
| 204 || FinalizeGameCardDriver
|-
| 205 || GetGameCardAttribute
|-
| 206 || GetGameCardDeviceCertificate
|-
| 207 || GetGameCardAsicInfo
|-
| 208 || GetGameCardIdSet
|-
| 209 || WriteToGameCard
|-
| 210 || SetVerifyWriteEnalbleFlag
|-
| 211 || GetGameCardImageHash
|-
| 212 || [2.0.0+] GetGameCardErrorInfo
|-
| 213 || [2.0.0+]
|-
| 214 || [2.0.0+] GetGameCardCid
|-
| 215 || [2.0.0+]
|-
| 216 || [2.0.0+]
|-
| 217 || [2.1.0+] Returns 0x40-bytes of output data.
|-
| 300 || SetSpeedEmulationMode
|-
| 301 || GetSpeedEmulationMode
|}

== GetGameCardUpdatePartitionInfo ==

Returns a titleID and the title-version for it.

* Output u32 with ARMS-gamecard: title-version v131162. This is the title-version for [[2.1.0]], which is the sysupdate included with this gamecard. Launch-day gamecards return title-version v450.
* Output u64 with ARMS-gamecard: titleID 0100000000000816.

[[NS_Services|NS]] appears to only use this with [[Content_Manager_services#GetTitleIdInfo]] and [[Content_Manager_services#GetUpdateTitleList]] with storageid=nandsys, for checking whether a sysupdate is required.

= IEventNotifier =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || BindEvent
|}

= StorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || None
|-
| 1 || Host
|-
| 2 || GameCard
|-
| 3 || NandSystem
|-
| 4 || NandUser
|-
| 5 || SdCard
|}

= ContentStorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || NandSystem
|-
| 1 || NandUser
|-
| 2 || SdCard
|}

= ContentPath =
These are the 0x300 paths to NCA files for the various filesystems FS can access, beginning with @. They're passed via X descriptors, and returned via various [[Location Resolver services|ncm/lr]] commands.

{| class="wikitable" border="1"
|-
! Path || Notes
|-
| @SystemContent ||
|-
| @UserContent ||
|-
| @SdCardContent ||
|-
| @CalibFile ||
|-
| @Safe ||
|-
| @User ||
|-
| @System ||
|-
| @Sdcard ||
|-
| @Host ||
|-
| @GcApp || Gamecard App partition (Partition 2)
|-
| @GcS00000001 || Gamecard Contents.
|-
| @upp || Gamecard update partition (Partition 0)
|}

=BisPartitionID=
* 0: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 0.
* 10: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 1.
* Rest: see [[Flash_Filesystem|here]].

=Save Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| 0 for SystemSaveData. SaveData: 0 can be used for accessing the savedata associated with the current FS session titleID, otherwise when set this is the titleID associated with the savedata to access.
|-
| 0x8
| 0x10
| userID for user-specific savedata(saveuser) when set, otherwise when zero this indicates the common savedata(savecommon). This is loaded from [[Account_services]].
|-
| 0x18
| 0x8
| u64 [[Flash_Filesystem|saveID]]. 0 for SaveData.
|-
| 0x20
| 0x8
| ContentStorageId? 0 for SystemSaveData. 1 for SaveData. 2 for DeviceSaveData(with official user-processes all other fields are 0 for DeviceSaveData).
|-
| 0x28
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x30
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x38
| 0x8
| 0 for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=SaveCreate Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[Savegames|IVFC]] level4 size?
|-
| 0x8
| 0x8
| Same as offset 0x0 normally? Hard-coded to 0x80000 for BcatSaveData.
|-
| 0x10
| 0x8
| 0x4000 for SystemSaveData/SaveData/DeviceSaveData/BcatSaveData. [[Savegames|IVFC]] level4 block-size in bytes?
|-
| 0x18
| 0x8
| Official user-processes only uses 0 here for SystemSaveData/SaveData. For the dedicated save-creation code with SaveData/DeviceSaveData, this value comes from an input param with official user-processes. For BcatSaveData, this is the hard-coded [[Title_list|titleID]] of the bcat-sysmodule.
|-
| 0x20
| 0x4
| Written using an input param for official user-processes. Hard-coded 0 for BcatSaveData.
|-
| 0x24
| 0x1
| Official user-processes only uses 0 here for SystemSaveData, 1 for SaveData/DeviceSaveData/BcatSaveData.
|-
| 0x25
| 0x1
| 0 for SystemSaveData/SaveData.
|-
| 0x26
| 0x1A
| Not initialized for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=DeviceSaveData=
This is accessed using the same commands for SaveData with the same input u8, the only difference compared to SaveData is the Save-struct.

=BcatSaveData=
This is accessed using the same commands for SaveData with the same input u8. The Save-struct is the same as DeviceSaveData, except that the titleID field is set to <input titleID>. See above regarding SaveCreate-struct.

The 0x10-byte struct passed to [[#CreateSaveData]] has the first 0x5-bytes set to all-zero.

[[Category:Services]]

Services API

2017-12-26T02:16:32Z

Hthh:

Services are system processes running in the background which wait for incoming requests. When a process wants to communicate with a service, it first needs to get a handle to the named service, and then it can communicate with the service via inter-process communication (each service has a name up to 8 characters).

Handles for services are retrieved from the service manager port, "sm:", and are released via svcCloseHandle or when a process is terminated or crashes. Manager service "sm:m" also exists. Services are an abstraction of ports, they operate the same way except regular ports can have their handles retrieved directly from a SVC. Services are also able to limit the number of handles given to other processes.

= sm: =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize]]
|-
| 1 || [[#GetService]]
|-
| 2 || [[#RegisterService]]
|-
| 3 || [[#UnregisterService]]
|}

== Initialize ==
Takes a pid descriptor and a reserved input u64.

== GetService ==
Takes a zero-padded service name encoded as an u64 integer. Returns a handle.

== RegisterService ==
Takes a zero-padded service name encoded as an u64 integer, an u8 bool, and an u32 (session count) at the next word. Returns a handle.

== UnregisterService ==
Takes a zero-padded service name encoded as an u64 integer.

= sm:m =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#RegisterProcess]]
|-
| 1 || [[#UnregisterProcess]]
|}

== RegisterProcess ==
Takes a pid and two A descriptors with the ACID and ACI0 service lists. That data originates from [[NPDM]].

== UnregisterProcess ==
Takes a pid.

= Service List =
{| class="wikitable" border="1"
|-
! Service names
! scope="col" width="200" | Description
! scope="col" width="200" | Notes
|-
| acc:u0, acc:u1, acc:aa, acc:su
| [[Account services]]
| u0: System, u1: User, su: Admin, aa: Baas
|-
| ahid:cd, ahid:hdr, hid, hid:dbg, hid:sys, irs, irs:sys, xcd:sys
| [[HID services]]
|
|-
| appletAE, appletOE, idle:sys, omm, spsm
| [[AM services]]
|
|-
| [1.0.0+] aoc:u, mii:u, mii:e, ns:am, ns:su, ns:dev, pl:u, ovln:rcv, ovln:snd, pdm:ntfy, pdm:qry

[3.0.0+] aoc:u, ns:am2, ns:dev, ns:ec, ns:rid, ns:rt, ns:su, ns:vm, ns:web, ovln:rcv, ovln:snd
| [[NS Services]]
| am: Application Manager, su: System Update
|-
| apm, apm:p, apm:sys, fgm, fgm:0, fgm:9, (fgm:dbg?), (aoc:apm??)
| [[APM services]]
|
|-
| arp:r, arp:w, bgtc:t, bgtc:sc
| [[Glue services]]
| r: Reader, w: Writer
|-
| audin:a, audin:d, audin:u, audout:a, audout:d, audout:u, audren:a, audren:d, audren:u, audrec:a, audrec:d, audrec:u, audctl, codecctl, hwopus
| [[Audio services]]
|
|-
| <nowiki>banana</nowiki>
| ?
| Some games on [3.0.0+] have access to this service, but it doesn't appear to be present on retail devices.
|-
| <nowiki>bcat:a, bcat:u, bcat:m, bcat:s, news:a, news:c, news:m, news:p, news:v, prepo:u, prepo:s, prepo:m, prepo:a</nowiki>
| [[BCAT services]]
|
|-
| bpc, bpc:r, pcv, pcv:arb, pcv:imm, time:u, time:a, time:s
| [[PCV services]]
|
|-
| bsd:u, bsd:s, bsdcfg, ethc:c, ethc:i, nsd:u, nsd:a, sfdnsres
| [[Sockets services]], [[NSD services]]
|
|-
| btdrv
| [[Bluetooth Driver services]]
|
|-
| btm, btm:dbg, btm:sys
| Battery services
|
|-
| caps:a, caps:c
| [[Capture services]]
| a: AlbumAccessor, c: AlbumControl
|-
| caps:sc, caps:ss, mm:u, vi:m, vi:s, vi:u, cec-mgr
| [[Display services]]
|
|-
| dispdrv
| [[Nvnflinger services]]
|
|-
| erpt:c, erpt:r
| [[Error Report services]]
|
|-
| es
| ETicket services
|
|-
| fan, psm, tc, ts
| [[PTM services]]
|
|-
| fatal:u, fatal:p
| [[Fatal services]]
| u: User, p: Privileged
|-
| friend:u, friend:v, friend:m, friend:s, friend:a
| Friend services
|
|-
| fsp-srv, fsp-ldr, fsp-pr
| [[Filesystem services]]
| srv: Main, ldr: Loader, pr: Program Registry
|-
| gpio, i2c, i2c:pcv, pinmux, pwm, uart, [3.0.0+] sasbus
| [[Bus services]]
|
|-
| htc, htcs, htc:tenv
| [[TMA services]]
|
|-
| lbl
| [[Backlight services]]
|
|-
| ldn:m, ldn:s, ldn:u
| [[LDN services]]
|
|-
| [1.0.0+] ldr:pm, ldr:ro, ldr:shel, ldr:dmnt

[3.0.0+] ldr:pm, ldr:shel, ldr:dmnt
| [[Loader services]]
|
|-
| lm
| [[Log services]]
|
|-
| manu
| [[Manu Services]]
| "Manufacturing", present in factory firmware but not installed on retail systems.
|-
| lr, ncm, ncm:v
| [[NCM services]]
|
|-
| nfc:am, nfc:mf:u, nfc:user, nfc:sys, nfp:user, nfp:dbg, nfp:sys
| NFC services
|
|-
| nifm:u, nifm:a, nifm:s
| [[Network Interface services]]
|
|-
| nim, nim:shp, ntc
| [[NIM services]]
| shp: eShop
|-
| npns:u, npns:s
| NPNS services
|
|-
| nvdrv:a, nvdrv:s, nvdrv:t, nvdrv, nvdrvdbg, nvgem:c, nvgem:cd, nvmemp
| [[NV services]]
|
|-
| pcie
| [[PCIe services]]
|
|-
| pctl, pctl:a, pctl:s, pctl:r
| [[Parental Control services]]
|
|-
| pm:bm, pm:info, pm:shell
| [[Process Manager services]]
|
|-
| psc:c, psc:m
| [[PSC services]]
|
|-
| [3.0.0+] ldr:ro, ro:dmnt
| [[Loader services|RO services]]
|
|-
| set, set:fd, set:cal, set:sys
| [[Settings services]]
| cal: calibration, sys: System Settings
|-
| [3.0.0+] mii:u, mii:e, pdm:ntfy, pdm:qry, pl:u
| [[Shared Database services]]
|
|-
| ssl
| [[SSL services]]
|
|-
| [1.0.0+] csrng, spl:

[4.0.0+] csrng, spl:, spl:mig, spl:fs, spl:ssl, spl:es
| [[SPL services]]
|
|-
| usb:ds, usb:hs, usb:pd, usb:pd:c, usb:pm
| [[USB services]]
|
|-
| wlan:inf, wlan:lcl, wlan:lg, wlan:lga, wlan:sg, wlan:soc
| WLAN services
|
|-
| [4.0.0+] grc:c
| [[GRC services]]
|
|-
| [4.0.0+] mig:usr
| [[Migration services]]
|
|-
| [4.0.0+] caps:dc
| [[Jpegdec services]]
|
|}

[[Category:Services]]

Network Interface services

2017-12-26T00:05:06Z

Hthh:

= nifm:a =
This is "nn::nifm::detail::IStaticService".

== IStaticService ==
{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 4 || CreateGeneralService ([3.0.0+] CreateGeneralServiceOld) || Returns an [[#IGeneralService]].
|-
| 5 || [3.0.0+] CreateGeneralService || Returns an [[#IGeneralService]].
|-
|}

=== IGeneralService ===
{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 1 || GetClientId ||
|-
| 2 || CreateScanRequest || Returns an [[#IScanRequest]].
|-
| 4 || CreateRequest || Returns an [[#IRequest]].
|-
| 5 || GetCurrentNetworkProfile ||
|-
| 6 || EnumerateNetworkInterfaces ||
|-
| 7 || EnumerateNetworkProfiles ||
|-
| 8 || GetNetworkProfile ||
|-
| 9 || SetNetworkProfile ||
|-
| 10 || RemoveNetworkProfile ||
|-
| 11
| [1.0.0-3.0.2] GetScanData
[4.0.0+] GetScanDataOld
|
|-
| 12 || GetCurrentIpAddress ||
|-
| 13
| [1.0.0-3.0.2] GetCurrentAccessPoint
[4.0.0+] GetCurrentAccessPointOld
|
|-
| 14 || CreateTemporaryNetworkProfile || Returns an [[#INetworkProfile]].
|-
| 15 || GetCurrentIpConfigInfo ||
|-
| 16 || SetWirelessCommunicationEnabled ||
|-
| 17 || IsWirelessCommunicationEnabled ||
|-
| 18 || GetInternetConnectionStatus ||
|-
| 19 || SetEthernetCommunicationEnabled ||
|-
| 20 || IsEthernetCommunicationEnabled ||
|-
| 21 || IsAnyInternetRequestAccepted ||
|-
| 22 || IsAnyForegroundRequestAccepted ||
|-
| 23 || PutToSleep ||
|-
| 24 || WakeUp ||
|-
| 25 || GetSsidListVersion ||
|-
| 26 || SetExclusiveClient ||
|-
| 27 || GetDefaultIpSetting ||
|-
| 28 || SetDefaultIpSetting ||
|-
| 29 || SetWirelessCommunicationEnabledForTest ||
|-
| 30 || SetEthernetCommunicationEnabledForTest ||
|-
| 31 || [2.0.0+] GetTelemetorySystemEventReadableHandle ||
|-
| 32 || [2.0.0+] GetTelemetryInfo ||
|-
| 33 || [2.0.0+] ConfirmSystemAvailability ||
|-
| 34 || [4.0.0+] SetBackgroundRequestEnabled ||
|-
| 35 || [4.0.0+] GetScanData ||
|-
| 36 || [4.0.0+] GetCurrentAccessPoint ||
|-
| 37 || [4.0.0+] Shutdown ||
|-
|}

==== IScanRequest ====
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Submit
|-
| 1 || IsProcessing
|-
| 2 || GetResult
|-
| 3 || GetSystemEventReadableHandle
|-
|}

==== IRequest ====
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetRequestState
|-
| 1 || GetResult
|-
| 2 || GetSystemEventReadableHandles
|-
| 3 || Cancel
|-
| 4 || Submit
|-
| 5 || SetRequirement
|-
| 6 || SetRequirementPreset
|-
| 8 || SetPriority
|-
| 9 || SetNetworkProfileId
|-
| 10 || SetRejectable
|-
| 11 || SetConnectionConfirmationOption
|-
| 12 || SetPersistent
|-
| 13 || SetInstant
|-
| 14 || SetSustainable
|-
| 15 || SetRawPriority
|-
| 16 || SetGreedy
|-
| 17 || SetSharable
|-
| 18 || SetRequirementByRevision
|-
| 19 || GetRequirement
|-
| 20 || GetRevision
|-
| 21 || GetAppletInfo
|-
| 22 || GetAdditionalInfo
|-
| 23 || SetKeptInSleep
|-
| 24 || RegisterSocketDescriptor
|-
| 25 || UnregisterSocketDescriptor
|-
|}

==== INetworkProfile ====
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Update
|-
| 1 || Persist ([3.0.0+] PersistOld)
|-
| 2 || [3.0.0+] Persist
|-
|}

= nifm:s =
Same as [[#nifm:a|nifm:a]].

= nifm:u =
Same as [[#nifm:a|nifm:a]].

[[Category:Services]]

Network Interface services

2017-12-26T00:03:27Z

Hthh:

= nifm:a =
This is "nn::nifm::detail::IStaticService".

== IStaticService ==
{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 4 || CreateGeneralService ([3.0.0+] CreateGeneralServiceOld) || Returns an [[#IGeneralService]].
|-
| 5 || [3.0.0+] CreateGeneralService || Returns an [[#IGeneralService]].
|-
|}

=== IGeneralService ===
{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 1 || GetClientId ||
|-
| 2 || CreateScanRequest || Returns an [[#IScanRequest]].
|-
| 4 || CreateRequest || Returns an [[#IRequest]].
|-
| 5 || GetCurrentNetworkProfile ||
|-
| 6 || EnumerateNetworkInterfaces ||
|-
| 7 || EnumerateNetworkProfiles ||
|-
| 8 || GetNetworkProfile ||
|-
| 9 || SetNetworkProfile ||
|-
| 10 || RemoveNetworkProfile ||
|-
| 11
| [1.0.0-3.0.2] GetScanData
[4.0.0+] GetScanDataOld
|
|-
| 12 || GetCurrentIpAddress ||
|-
| 13 || GetCurrentAccessPoint ||
|-
| 14 || CreateTemporaryNetworkProfile || Returns an [[#INetworkProfile]].
|-
| 15 || GetCurrentIpConfigInfo ||
|-
| 16 || SetWirelessCommunicationEnabled ||
|-
| 17 || IsWirelessCommunicationEnabled ||
|-
| 18 || GetInternetConnectionStatus ||
|-
| 19 || SetEthernetCommunicationEnabled ||
|-
| 20 || IsEthernetCommunicationEnabled ||
|-
| 21 || IsAnyInternetRequestAccepted ||
|-
| 22 || IsAnyForegroundRequestAccepted ||
|-
| 23 || PutToSleep ||
|-
| 24 || WakeUp ||
|-
| 25 || GetSsidListVersion ||
|-
| 26 || SetExclusiveClient ||
|-
| 27 || GetDefaultIpSetting ||
|-
| 28 || SetDefaultIpSetting ||
|-
| 29 || SetWirelessCommunicationEnabledForTest ||
|-
| 30 || SetEthernetCommunicationEnabledForTest ||
|-
| 31 || [2.0.0+] GetTelemetorySystemEventReadableHandle ||
|-
| 32 || [2.0.0+] GetTelemetryInfo ||
|-
| 33 || [2.0.0+] ConfirmSystemAvailability ||
|-
| 34 || [4.0.0+] SetBackgroundRequestEnabled ||
|-
| 35 || [4.0.0+] GetScanData ||
|-
| 36 || [4.0.0+] GetCurrentAccessPoint ||
|-
| 37 || [4.0.0+] Shutdown ||
|-
|}

==== IScanRequest ====
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Submit
|-
| 1 || IsProcessing
|-
| 2 || GetResult
|-
| 3 || GetSystemEventReadableHandle
|-
|}

==== IRequest ====
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetRequestState
|-
| 1 || GetResult
|-
| 2 || GetSystemEventReadableHandles
|-
| 3 || Cancel
|-
| 4 || Submit
|-
| 5 || SetRequirement
|-
| 6 || SetRequirementPreset
|-
| 8 || SetPriority
|-
| 9 || SetNetworkProfileId
|-
| 10 || SetRejectable
|-
| 11 || SetConnectionConfirmationOption
|-
| 12 || SetPersistent
|-
| 13 || SetInstant
|-
| 14 || SetSustainable
|-
| 15 || SetRawPriority
|-
| 16 || SetGreedy
|-
| 17 || SetSharable
|-
| 18 || SetRequirementByRevision
|-
| 19 || GetRequirement
|-
| 20 || GetRevision
|-
| 21 || GetAppletInfo
|-
| 22 || GetAdditionalInfo
|-
| 23 || SetKeptInSleep
|-
| 24 || RegisterSocketDescriptor
|-
| 25 || UnregisterSocketDescriptor
|-
|}

==== INetworkProfile ====
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Update
|-
| 1 || Persist ([3.0.0+] PersistOld)
|-
| 2 || [3.0.0+] Persist
|-
|}

= nifm:s =
Same as [[#nifm:a|nifm:a]].

= nifm:u =
Same as [[#nifm:a|nifm:a]].

[[Category:Services]]

Settings services

2017-12-25T23:26:09Z

Hthh:

= set =
This is "nn::settings::ISettingsServer".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetLanguageCode
|-
| 1 || GetAvailableLanguageCodes
|-
| 2 || [4.0.0+] MakeLanguageCode
|-
| 3 || GetAvailableLanguageCodeCount
|-
| 4 || GetRegionCode
|-
| 5 || [4.0.0+] GetAvailableLanguageCodes2
|-
| 6 || [4.0.0+] GetAvailableLanguageCodeCount2
|-
| 7 || [4.0.0+] GetKeyCodeMap
|}

= set:fd =
This is "nn::settings::IFirmwareDebugSettingsServer".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 2 || SetSettingsItemValue ||
|-
| 3 || ResetSettingsItemValue ||
|-
| 4 || CreateSettingsItemKeyIterator || Returns an [[#ISettingsItemKeyIterator]].
|-
| 10 || [4.0.0+] ReadSettings ||
|-
| 11 || [4.0.0+] ResetSettings ||
|-
| 20 || [4.0.0+] SetWebInspectorFlag ||
|-
| 21 || [4.0.0+] SetAllowedSslHosts ||
|-
| 22 || [4.0.0+] SetHostFsMountPoint ||
|}

== ISettingsItemKeyIterator ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GoNext
|-
| 1 || GetKeySize
|-
| 2 || GetKey
|}

= set:cal =
This is "nn::settings::IFactorySettingsServer".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetBluetoothBdAddress
|-
| 1 || GetConfigurationId1
|-
| 2 || GetAccelerometerOffset
|-
| 3 || GetAccelerometerScale
|-
| 4 || GetGyroscopeOffset
|-
| 5 || GetGyroscopeScale
|-
| 6 || GetWirelessLanMacAddress
|-
| 7 || GetWirelessLanCountryCodeCount
|-
| 8 || GetWirelessLanCountryCodes
|-
| 9 || GetSerialNumber
|-
| 10 || SetInitialSystemAppletProgramId
|-
| 11 || SetOverlayDispProgramId
|-
| 12 || GetBatteryLot
|-
| 14 || [[#GetEciDeviceCertificate]]
|-
| 15 || [[#GetEticketDeviceCertificate]]
|-
| 16 || [[#GetSslKey]]
|-
| 17 || [[#GetSslCertificate]]
|-
| 18 || [[#GetGameCardKey]]
|-
| 19 || [[#GetGameCardCertificate]]
|-
| 20 || [[#GetEciDeviceKey]]
|-
| 21 || [[#GetEticketDeviceKey]]
|-
| 22 || GetSpeakerParameter
|-
| 23 || [4.0.0+] GetLcdVendorId
|-
|}

Used for accessing data calibrated at the factory.

== GetEciDeviceCertificate ==
Takes a type-0x16 output buffer with fixed size 0x180.

Returns the device certificate (ECC signed). This is identical to 3DS DeviceCert/CTCert besides the strings. NIM loads the DeviceId from this.

== GetEticketDeviceCertificate ==
Takes a type-0x16 output buffer with fixed size 0x240.

Returns the ETicket certificate (RSA signed).

== GetSslKey ==
Takes a type-0x16 output buffer with fixed size 0x134.

Returns the extended SSL key (0x130 bytes) from [[Calibration#CAL0|CAL0]]. If the extended key is not programmed then it falls back to the normal SSL key (0x110 bytes).

Used by SSL-sysmodule, see [[SSL_services|here]].

== GetSslCertificate ==
Takes a type-0x16 output buffer with fixed size 0x804.

Returns a [[Settings_services#setcal_Container_Structure|container]] with the plaintext SSL certificate.

Used by SSL-sysmodule, see [[SSL_services|here]].

== GetGameCardKey ==
Takes a type-0x16 output buffer with fixed size 0x134.

Returns the extended GameCard key (0x130 bytes) from [[Calibration#CAL0|CAL0]]. If the extended key is not programmed then it falls back to the normal GameCard key (0x110 bytes).

== GetGameCardCertificate ==
Takes a type-0x16 output buffer with fixed size 0x404.

Returns a [[Settings_services#setcal_Container_Structure|container]] with the GameCard certificate.

== GetEciDeviceKey ==
Returns the extended device ECC-B233 key (0x50 bytes) from [[Calibration#CAL0|CAL0]]. If the extended key is not programmed then it falls back to the normal device ECC-B233 key (0x30 bytes).

== GetEticketDeviceKey ==
Takes a type-0x16 output buffer with fixed size 0x244.

Returns the extended ETicket RSA-2048 key (0x240 bytes) from [[Calibration#CAL0|CAL0]]. If the extended key is not programmed then it falls back to the normal ETicket RSA-2048 key (0x220 bytes).

== setcal Container Structure ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Name
|-
| 0x0
| 0x4
| Size (same size used for decryption if needed)
|-
| 0x4
| {above size}
| Actual data starts here.
|}

This container is used for returning data with variable sizes.

= set:sys =
This is "nn::settings::ISystemSettingsServer".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || SetLanguageCode
|-
| 1 || SetNetworkSettings
|-
| 2 || GetNetworkSettings
|-
| 3 || [[#GetFirmwareVersion]]
|-
| 4 || [3.0.0+] GetFirmwareVersion2
|-
| 7 || GetLockScreenFlag
|-
| 8 || SetLockScreenFlag
|-
| 9 || GetBacklightSettings
|-
| 10 || SetBacklightSettings
|-
| 11 || SetBluetoothDevicesSettings
|-
| 12 || GetBluetoothDevicesSettings
|-
| 13 || GetExternalSteadyClockSourceId
|-
| 14 || SetExternalSteadyClockSourceId
|-
| 15 || GetUserSystemClockContext
|-
| 16 || SetUserSystemClockContext
|-
| 17 || GetAccountSettings
|-
| 18 || SetAccountSettings
|-
| 19 || GetAudioVolume
|-
| 20 || SetAudioVolume
|-
| 21 || GetEulaVersions
|-
| 22 || SetEulaVersions
|-
| 23 || GetColorSetId
|-
| 24 || SetColorSetId
|-
| 25 || GetConsoleInformationUploadFlag
|-
| 26 || SetConsoleInformationUploadFlag
|-
| 27 || GetAutomaticApplicationDownloadFlag
|-
| 28 || SetAutomaticApplicationDownloadFlag
|-
| 29 || GetNotificationSettings
|-
| 30 || SetNotificationSettings
|-
| 31 || GetAccountNotificationSettings
|-
| 32 || SetAccountNotificationSettings
|-
| 35 || GetVibrationMasterVolume
|-
| 36 || SetVibrationMasterVolume
|-
| 37 || GetSettingsItemValueSize
|-
| 38 || [[#GetSettingsItemValue]]
|-
| 39 || GetTvSettings
|-
| 40 || SetTvSettings
|-
| 41 || GetEdid
|-
| 42 || SetEdid
|-
| 43 || GetAudioOutputMode
|-
| 44 || SetAudioOutputMode
|-
| 45 || IsForceMuteOnHeadphoneRemoved
|-
| 46 || SetForceMuteOnHeadphoneRemoved
|-
| 47 || GetQuestFlag
|-
| 48 || SetQuestFlag
|-
| 49 || GetDataDeletionSettings
|-
| 50 || SetDataDeletionSettings
|-
| 51 || GetInitialSystemAppletProgramId
|-
| 52 || GetOverlayDispProgramId
|-
| 53 || GetDeviceTimeZoneLocationName
|-
| 54 || SetDeviceTimeZoneLocationName
|-
| 55 || GetWirelessCertificationFileSize
|-
| 56 || [[Flash_Filesystem#PRODINFOF|GetWirelessCertificationFile]]
|-
| 57 || SetRegionCode
|-
| 58 || GetNetworkSystemClockContext
|-
| 59 || SetNetworkSystemClockContext
|-
| 60 || IsUserSystemClockAutomaticCorrectionEnabled
|-
| 61 || SetUserSystemClockAutomaticCorrectionEnabled
|-
| 62 || [[#GetDebugModeFlag]]
|-
| 63 || GetPrimaryAlbumStorage
|-
| 64 || SetPrimaryAlbumStorage
|-
| 65 || GetUsb30EnableFlag
|-
| 66 || SetUsb30EnableFlag
|-
| 67 || GetBatteryLot
|-
| 68 || [[#GetSerialNumber]]
|-
| 69 || GetNfcEnableFlag
|-
| 70 || SetNfcEnableFlag
|-
| 71 || GetSleepSettings
|-
| 72 || SetSleepSettings
|-
| 73 || GetWirelessLanEnableFlag
|-
| 74 || SetWirelessLanEnableFlag
|-
| 75 || GetInitialLaunchSettings
|-
| 76 || SetInitialLaunchSettings
|-
| 77 || GetDeviceNickName
|-
| 78 || SetDeviceNickName
|-
| 79 || GetProductModel
|-
| 80 || GetLdnChannel
|-
| 81 || SetLdnChannel
|-
| 82 || AcquireTelemetryDirtyFlagEventHandle
|-
| 83 || GetTelemetryDirtyFlags
|-
| 84 || GetPtmBatteryLot
|-
| 85 || SetPtmBatteryLot
|-
| 86 || GetPtmFuelGaugeParameter
|-
| 87 || SetPtmFuelGaugeParameter
|-
| 88 || GetBluetoothEnableFlag
|-
| 89 || SetBluetoothEnableFlag
|-
| 90 || GetMiiAuthorId
|-
| 91 || SetShutdownRtcValue
|-
| 92 || GetShutdownRtcValue
|-
| 93 || AcquireFatalDirtyFlagEventHandle
|-
| 94 || GetFatalDirtyFlags
|-
| 95 || [2.0.0+] GetAutoUpdateEnableFlag
|-
| 96 || [2.0.0+] SetAutoUpdateEnableFlag
|-
| 97 || [2.0.0+] GetNxControllerSettings
|-
| 98 || [2.0.0+] SetNxControllerSettings
|-
| 99 || [2.0.0+] GetBatteryPercentageFlag
|-
| 100 || [2.0.0+] SetBatteryPercentageFlag
|-
| 101 || [2.0.0+] GetExternalRtcResetFlag
|-
| 102 || [2.0.0+] SetExternalRtcResetFlag
|-
| 103 || [3.0.0+] GetUsbFullKeyEnableFlag
|-
| 104 || [3.0.0+] SetUsbFullKeyEnableFlag
|-
| 105 || [3.0.0+] SetExternalSteadyClockInternalOffset
|-
| 106 || [3.0.0+] GetExternalSteadyClockInternalOffset
|-
| 107 || [3.0.0+] GetBacklightSettingsEx
|-
| 108 || [3.0.0+] SetBacklightSettingsEx
|-
| 109 || [3.0.0+] GetHeadphoneVolumeWarningCount
|-
| 110 || [3.0.0+] SetHeadphoneVolumeWarningCount
|-
| 111 || [3.0.0+] GetBluetoothAfhEnableFlag
|-
| 112 || [3.0.0+] SetBluetoothAfhEnableFlag
|-
| 113 || [3.0.0+] GetBluetoothBoostEnableFlag
|-
| 114 || [3.0.0+] SetBluetoothBoostEnableFlag
|-
| 115 || [3.0.0+] GetInRepairProcessEnableFlag
|-
| 116 || [3.0.0+] SetInRepairProcessEnableFlag
|-
| 117 || [3.0.0+] GetHeadphoneVolumeUpdateFlag
|-
| 118 || [3.0.0+] SetHeadphoneVolumeUpdateFlag
|-
| 119 || [3.0.0+] NeedsToUpdateHeadphoneVolume
|-
| 120 || [3.0.0+] GetPushNotificationActivityModeOnSleep
|-
| 121 || [3.0.0+] SetPushNotificationActivityModeOnSleep
|-
| 122 || [4.0.0+] [[#GetServiceDiscoveryControlSettings]]
|-
| 123 || [4.0.0+] SetServiceDiscoveryControlSettings
|-
| 124 || [4.0.0+] GetErrorReportSharePermission
|-
| 125 || [4.0.0+] SetErrorReportSharePermission
|-
| 126 || [4.0.0+] GetAppletLaunchFlags
|-
| 127 || [4.0.0+] SetAppletLaunchFlags
|-
| 128 || [4.0.0+] GetConsoleSixAxisSensorAccelerationBias
|-
| 129 || [4.0.0+] SetConsoleSixAxisSensorAccelerationBias
|-
| 130 || [4.0.0+] GetConsoleSixAxisSensorAngularVelocityBias
|-
| 131 || [4.0.0+] SetConsoleSixAxisSensorAngularVelocityBias
|-
| 132 || [4.0.0+] GetConsoleSixAxisSensorAccelerationGain
|-
| 133 || [4.0.0+] SetConsoleSixAxisSensorAccelerationGain
|-
| 134 || [4.0.0+] GetConsoleSixAxisSensorAngularVelocityGain
|-
| 135 || [4.0.0+] SetConsoleSixAxisSensorAngularVelocityGain
|-
| 136 || [4.0.0+] GetKeyboardLayout
|-
| 137 || [4.0.0+] SetKeyboardLayout
|-
| 138 || [4.0.0+] GetWebInspectorFlag
|-
| 139 || [4.0.0+] GetAllowedSslHosts
|-
| 140 || [4.0.0+] GetHostFsMountPoint
|}

Official user-processes get a new service session handle each time a set:sys cmd is used, with the session being closed aftewards.

== GetFirmwareVersion ==
Takes a type-0x1A output buffer. User-processes use hard-coded size 0x100.

If needed, reads the content of the [[System_Version_Title]] "/file" into state. This is only done once.

Then the above 0x100-byte data is copied to the output buffer.

== GetSettingsItemValue ==
Takes two type-0x19 input buffers and a type-0x6 output buffer. Returns an output u64 for the actual size written to the outbuf.

The outbuf_size is compared with the config_size. When config_size is larger than outbuf_size, outbuf_size is used for the memcpy, otherwise config_size is used. Afterwards the size used for the memcpy is written to output(see above).

If loading from main config fails, it will also attempt to load config from various state if the input strings match hard-coded strings.

== GetDebugModeFlag ==
Returns an output u8.

Loads the 1-byte config for <"settings_debug", "is_debug_mode_enabled">. If that fails, value 0x1 is written to output. This uses the same func as ReadSetting internally.

Returned retval is always 0.

== GetSerialNumber ==
Returns the 0x18-byte SerialNumber string.

== GetServiceDiscoveryControlSettings ==
Returns 0x01 if [[Safemode|safemode]] needs to be launched.

[[Category:Services]]

GRC services

2017-12-25T10:40:22Z

Hthh:

GRC (Game Recording) uses libstagefright and the NvMMLite TVMR library for writing [[4.0.0|recorded]] video to MP4s.

Error reporting is done using the new [[NV_services#/dev/nverpt-ctrl|/dev/nverpt-ctrl]] ioctls.

= grc:c =

This is "nn::grcsrv::IGrcService"

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 || GetContinuousRecorder
|-
| 2 || GetGameMovieTrimmer
|}

= nn::grcsrv::IContinuousRecorder =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 ||
|-
| 2 ||
|-
| 10 ||
|-
| 11 ||
|-
| 12 ||
|-
| 13 ||
|}

= nn::grcsrv::IGameMovieTrimmer =

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 ||
|-
| 2 ||
|-
| 10 ||
|-
| 20 ||
|}

Settings services

2017-12-24T23:11:33Z

Hthh:

= set =
This is "nn::settings::ISettingsServer".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetLanguageCode
|-
| 1 || GetAvailableLanguageCodes
|-
| 3 || GetAvailableLanguageCodeCount
|-
| 4 || GetRegionCode
|}

= set:fd =
This is "nn::settings::IFirmwareDebugSettingsServer".

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 2 || SetSettingsItemValue ||
|-
| 3 || ResetSettingsItemValue ||
|-
| 4 || CreateSettingsItemKeyIterator || Returns an [[#ISettingsItemKeyIterator]].
|}

== ISettingsItemKeyIterator ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GoNext
|-
| 1 || GetKeySize
|-
| 2 || GetKey
|}

= set:cal =
This is "nn::settings::IFactorySettingsServer".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || GetBluetoothBdAddress
|-
| 1 || GetConfigurationId1
|-
| 2 || GetAccelerometerOffset
|-
| 3 || GetAccelerometerScale
|-
| 4 || GetGyroscopeOffset
|-
| 5 || GetGyroscopeScale
|-
| 6 || GetWirelessLanMacAddress
|-
| 7 || GetWirelessLanCountryCodeCount
|-
| 8 || GetWirelessLanCountryCodes
|-
| 9 || GetSerialNumber
|-
| 10 || SetInitialSystemAppletProgramId
|-
| 11 || SetOverlayDispProgramId
|-
| 12 || GetBatteryLot
|-
| 14 || [[#GetEciDeviceCertificate]]
|-
| 15 || [[#GetEticketDeviceCertificate]]
|-
| 16 || [[#GetSslKey]]
|-
| 17 || [[#GetSslCertificate]]
|-
| 18 || [[#GetGameCardKey]]
|-
| 19 || [[#GetGameCardCertificate]]
|-
| 20 || [[#GetEciDeviceKey]]
|-
| 21 || [[#GetEticketDeviceKey]]
|-
| 22 || GetSpeakerParameter
|-
|}

Used for accessing data calibrated at the factory.

== GetEciDeviceCertificate ==
Takes a type-0x16 output buffer with fixed size 0x180.

Returns the device certificate (ECC signed). This is identical to 3DS DeviceCert/CTCert besides the strings. NIM loads the DeviceId from this.

== GetEticketDeviceCertificate ==
Takes a type-0x16 output buffer with fixed size 0x240.

Returns the ETicket certificate (RSA signed).

== GetSslKey ==
Takes a type-0x16 output buffer with fixed size 0x134.

Returns the extended SSL key (0x130 bytes) from [[Calibration#CAL0|CAL0]]. If the extended key is not programmed then it falls back to the normal SSL key (0x110 bytes).

Used by SSL-sysmodule, see [[SSL_services|here]].

== GetSslCertificate ==
Takes a type-0x16 output buffer with fixed size 0x804.

Returns a [[Settings_services#setcal_Container_Structure|container]] with the plaintext SSL certificate.

Used by SSL-sysmodule, see [[SSL_services|here]].

== GetGameCardKey ==
Takes a type-0x16 output buffer with fixed size 0x134.

Returns the extended GameCard key (0x130 bytes) from [[Calibration#CAL0|CAL0]]. If the extended key is not programmed then it falls back to the normal GameCard key (0x110 bytes).

== GetGameCardCertificate ==
Takes a type-0x16 output buffer with fixed size 0x404.

Returns a [[Settings_services#setcal_Container_Structure|container]] with the GameCard certificate.

== GetEciDeviceKey ==
Returns the extended device ECC-B233 key (0x50 bytes) from [[Calibration#CAL0|CAL0]]. If the extended key is not programmed then it falls back to the normal device ECC-B233 key (0x30 bytes).

== GetEticketDeviceKey ==
Takes a type-0x16 output buffer with fixed size 0x244.

Returns the extended ETicket RSA-2048 key (0x240 bytes) from [[Calibration#CAL0|CAL0]]. If the extended key is not programmed then it falls back to the normal ETicket RSA-2048 key (0x220 bytes).

== setcal Container Structure ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Name
|-
| 0x0
| 0x4
| Size (same size used for decryption if needed)
|-
| 0x4
| {above size}
| Actual data starts here.
|}

This container is used for returning data with variable sizes.

= set:sys =
This is "nn::settings::ISystemSettingsServer".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || SetLanguageCode
|-
| 1 || SetNetworkSettings
|-
| 2 || GetNetworkSettings
|-
| 3 || [[#GetFirmwareVersion]]
|-
| 4 || GetFirmwareVersion2
|-
| 7 || GetLockScreenFlag
|-
| 8 || SetLockScreenFlag
|-
| 9 || GetBacklightSettings
|-
| 10 || SetBacklightSettings
|-
| 11 || SetBluetoothDevicesSettings
|-
| 12 || GetBluetoothDevicesSettings
|-
| 13 || GetExternalSteadyClockSourceId
|-
| 14 || SetExternalSteadyClockSourceId
|-
| 15 || GetUserSystemClockContext
|-
| 16 || SetUserSystemClockContext
|-
| 17 || GetAccountSettings
|-
| 18 || SetAccountSettings
|-
| 19 || GetAudioVolume
|-
| 20 || SetAudioVolume
|-
| 21 || GetEulaVersions
|-
| 22 || SetEulaVersions
|-
| 23 || GetColorSetId
|-
| 24 || SetColorSetId
|-
| 25 || GetConsoleInformationUploadFlag
|-
| 26 || SetConsoleInformationUploadFlag
|-
| 27 || GetAutomaticApplicationDownloadFlag
|-
| 28 || SetAutomaticApplicationDownloadFlag
|-
| 29 || GetNotificationSettings
|-
| 30 || SetNotificationSettings
|-
| 31 || GetAccountNotificationSettings
|-
| 32 || SetAccountNotificationSettings
|-
| 35 || GetVibrationMasterVolume
|-
| 36 || SetVibrationMasterVolume
|-
| 37 || GetSettingsItemValueSize
|-
| 38 || [[#GetSettingsItemValue]]
|-
| 39 || GetTvSettings
|-
| 40 || SetTvSettings
|-
| 41 || GetEdid
|-
| 42 || SetEdid
|-
| 43 || GetAudioOutputMode
|-
| 44 || SetAudioOutputMode
|-
| 45 || IsForceMuteOnHeadphoneRemoved
|-
| 46 || SetForceMuteOnHeadphoneRemoved
|-
| 47 || GetQuestFlag
|-
| 48 || SetQuestFlag
|-
| 49 || GetDataDeletionSettings
|-
| 50 || SetDataDeletionSettings
|-
| 51 || GetInitialSystemAppletProgramId
|-
| 52 || GetOverlayDispProgramId
|-
| 53 || GetDeviceTimeZoneLocationName
|-
| 54 || SetDeviceTimeZoneLocationName
|-
| 55 || GetWirelessCertificationFileSize
|-
| 56 || [[Flash_Filesystem#PRODINFOF|GetWirelessCertificationFile]]
|-
| 57 || SetRegionCode
|-
| 58 || GetNetworkSystemClockContext
|-
| 59 || SetNetworkSystemClockContext
|-
| 60 || IsUserSystemClockAutomaticCorrectionEnabled
|-
| 61 || SetUserSystemClockAutomaticCorrectionEnabled
|-
| 62 || [[#GetDebugModeFlag]]
|-
| 63 || GetPrimaryAlbumStorage
|-
| 64 || SetPrimaryAlbumStorage
|-
| 65 || GetUsb30EnableFlag
|-
| 66 || SetUsb30EnableFlag
|-
| 67 || GetBatteryLot
|-
| 68 || [[#GetSerialNumber]]
|-
| 69 || GetNfcEnableFlag
|-
| 70 || SetNfcEnableFlag
|-
| 71 || GetSleepSettings
|-
| 72 || SetSleepSettings
|-
| 73 || GetWirelessLanEnableFlag
|-
| 74 || SetWirelessLanEnableFlag
|-
| 75 || GetInitialLaunchSettings
|-
| 76 || SetInitialLaunchSettings
|-
| 77 || GetDeviceNickName
|-
| 78 || SetDeviceNickName
|-
| 79 || GetProductModel
|-
| 80 || GetLdnChannel
|-
| 81 || SetLdnChannel
|-
| 82 || AcquireTelemetryDirtyFlagEventHandle
|-
| 83 || GetTelemetryDirtyFlags
|-
| 84 || GetPtmBatteryLot
|-
| 85 || SetPtmBatteryLot
|-
| 86 || GetPtmFuelGaugeParameter
|-
| 87 || SetPtmFuelGaugeParameter
|-
| 88 || GetBluetoothEnableFlag
|-
| 89 || SetBluetoothEnableFlag
|-
| 90 || GetMiiAuthorId
|-
| 91 || SetShutdownRtcValue
|-
| 92 || GetShutdownRtcValue
|-
| 93 || AcquireFatalDirtyFlagEventHandle
|-
| 94 || GetFatalDirtyFlags
|-
| 95 || GetAutoUpdateEnableFlag
|-
| 96 || SetAutoUpdateEnableFlag
|-
| 97 || GetNxControllerSettings
|-
| 98 || SetNxControllerSettings
|-
| 99 || GetBatteryPercentageFlag
|-
| 100 || SetBatteryPercentageFlag
|-
| 101 || GetExternalRtcResetFlag
|-
| 102 || SetExternalRtcResetFlag
|-
| 103 || GetUsbFullKeyEnableFlag
|-
| 104 || SetUsbFullKeyEnableFlag
|-
| 105 || SetExternalSteadyClockInternalOffset
|-
| 106 || GetExternalSteadyClockInternalOffset
|-
| 107 || GetBacklightSettingsEx
|-
| 108 || SetBacklightSettingsEx
|-
| 109 || GetHeadphoneVolumeWarningCount
|-
| 110 || SetHeadphoneVolumeWarningCount
|-
| 111 || GetBluetoothAfhEnableFlag
|-
| 112 || SetBluetoothAfhEnableFlag
|-
| 113 || GetBluetoothBoostEnableFlag
|-
| 114 || SetBluetoothBoostEnableFlag
|-
| 115 || GetInRepairProcessEnableFlag
|-
| 116 || SetInRepairProcessEnableFlag
|-
| 117 || GetHeadphoneVolumeUpdateFlag
|-
| 118 || SetHeadphoneVolumeUpdateFlag
|-
| 119 || NeedsToUpdateHeadphoneVolume
|-
| 120 || GetPushNotificationActivityModeOnSleep
|-
| 121 || SetPushNotificationActivityModeOnSleep
|-
| 122 || [4.0.0+] GetServiceDiscoveryControlSettings (aka [[#GetSafemodeFlag]])
|-
| 123 || [4.0.0+] SetServiceDiscoveryControlSettings
|-
| 124 || [4.0.0+] GetErrorReportSharePermission
|-
| 125 || [4.0.0+] SetErrorReportSharePermission
|-
| 126 || [4.0.0+] GetAppletLaunchFlags
|-
| 127 || [4.0.0+] SetAppletLaunchFlags
|-
| 128 || [4.0.0+] GetConsoleSixAxisSensorAccelerationBias
|-
| 129 || [4.0.0+] SetConsoleSixAxisSensorAccelerationBias
|-
| 130 || [4.0.0+] GetConsoleSixAxisSensorAngularVelocityBias
|-
| 131 || [4.0.0+] SetConsoleSixAxisSensorAngularVelocityBias
|-
| 132 || [4.0.0+] GetConsoleSixAxisSensorAccelerationGain
|-
| 133 || [4.0.0+] SetConsoleSixAxisSensorAccelerationGain
|-
| 134 || [4.0.0+] GetConsoleSixAxisSensorAngularVelocityGain
|-
| 135 || [4.0.0+] SetConsoleSixAxisSensorAngularVelocityGain
|-
| 136 || [4.0.0+] GetKeyboardLayout
|-
| 137 || [4.0.0+] SetKeyboardLayout
|-
| 138 || [4.0.0+] GetWebInspectorFlag
|-
| 139 || [4.0.0+] GetAllowedSslHosts
|-
| 140 || [4.0.0+] GetHostFsMountPoint
|}

Official user-processes get a new service session handle each time a set:sys cmd is used, with the session being closed aftewards.

== GetFirmwareVersion ==
Takes a type-0x1A output buffer. User-processes use hard-coded size 0x100.

If needed, reads the content of the [[System_Version_Title]] "/file" into state. This is only done once.

Then the above 0x100-byte data is copied to the output buffer.

== GetSettingsItemValue ==
Takes two type-0x19 input buffers and a type-0x6 output buffer. Returns an output u64 for the actual size written to the outbuf.

The outbuf_size is compared with the config_size. When config_size is larger than outbuf_size, outbuf_size is used for the memcpy, otherwise config_size is used. Afterwards the size used for the memcpy is written to output(see above).

If loading from main config fails, it will also attempt to load config from various state if the input strings match hard-coded strings.

== GetDebugModeFlag ==
Returns an output u8.

Loads the 1-byte config for <"settings_debug", "is_debug_mode_enabled">. If that fails, value 0x1 is written to output. This uses the same func as ReadSetting internally.

Returned retval is always 0.

== GetSerialNumber ==
Returns the 0x18-byte SerialNumber string.

== GetSafemodeFlag ==
Returns 0x01 if [[Safemode|safemode]] needs to be launched. (officially "GetServiceDiscoveryControlSettings")

[[Category:Services]]

Filesystem services

2017-12-24T01:17:31Z

Hthh:

= fsp-ldr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Notes
|-
| 0 || MountCode || u64 TID + X descriptor [[#ContentPath]] || Returns an [[#IFileSystem]].
|-
| 1 || IsCodeMounted || u64 PID || Returns a bool (1 if code is mounted).
|-
| 2 || [4.0.0+]
|}

= fsp-pr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || [[#SetFsPermissions]] ||
|-
| 1 || [[#ClearFsPermissions]] ||
|-
| 2 || [4.0.0+]
|-
| 256 || [[#SetEnabledProgramVerification]] ||
|}

== SetFsPermissions ==
Takes a storageID, a pid, a titleID, a 0x1C type-A buffer for the [[NPDM#FS_Access_Header| FS Access Header]], and a 0x2C type-A buffer for the [[NPDM#FS_Access_Control| FS Access Control]]

Final FS permissions are stored as (ACI0_perms & ACID_perms). Will panic(svcBreak) when buffer sizes from ipc-rawdata are invalid.

== ClearFsPermissions ==
Takes a pid. Removes registered FS permissions for that PID.

== SetEnabledProgramVerification ==
Seems to sets a global flag to inputval & 1.

When the flag is zero, it will set ret=0 instead of ret={error} when verifying a RSA signature fails. This RSA signature seems to be the signature in the [[NPDM]] ACID. It then skips verifying what seems to be the second signature in the [[NCA_Format|NCA header]]. Note that if verifying the NPDM(?) signature is successful, and verifying that second signature fails, it will throw an error and abort.

= fsp-srv =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [1.0.0] [[#MountContent]]
|-
| 1 || [[#Initialize]]
|-
| 2 || OpenDataFileSystemByCurrentProcess
|-
| 7 || [2.0.0+] [[#MountContent7]]
|-
| 8 || [2.0.0+] [[#MountContent]]
|-
| 9 || [3.0.0+] OpenDataFileSystemByApplicationId
|-
| 11 || [[#MountBis]]
|-
| 12 || [[#OpenBisPartition]]
|-
| 13 || InvalidateBisCache
|-
| 17 || OpenHostFileSystemImpl
|-
| 18 || MountSdCard
|-
| 19 || [2.0.0+] FormatSdCard
|-
| 21 || [[#DeleteSaveData]]
|-
| 22 || [[#CreateSaveData]]
|-
| 23 || [[#CreateSystemSaveData]]
|-
| 24 || RegisterSaveDataAtomicDeletion
|-
| 25 || [2.0.0+] DeleteSaveDataWithSpaceId
|-
| 26 || [2.0.0+] FormatSdCardDryRun
|-
| 27 || [2.0.0+] IsExFatSupported
|-
| 28 || [4.0.0+] DeleteSystemSaveData
|-
| 30 || [[#OpenGameCardPartition]]
|-
| 31 || [[#MountGameCardPartition]]
|-
| 32 || [3.0.0+] ExtendSaveData
|-
| 51 || [[#MountSaveData]]
|-
| 52 || [[#MountSystemSaveData]]
|-
| 53 || [2.0.0+] MountSaveDataReadOnly
|-
| 57 || [3.0.0+] ReadSaveDataFileSystemExtraDataWithSpaceId
|-
| 58 || ReadSaveDataFileSystemExtraData
|-
| 59 || [2.0.0+] WriteSaveDataFileSystemExtraData
|-
| 60 || OpenSaveDataInfoReader
|-
| 61 || OpenSaveDataIterator
|-
| 80 || OpenSaveDataThumbnailFile
|-
| 81 || [4.0.0+]
|-
| 100 || MountImageDirectory
|-
| 110 || [[#MountContentStorage]]
|-
| 200 || OpenDataStorageByCurrentProcess
|-
| 201 || [3.0.0+] OpenDataStorageByApplicationId
|-
| 202 || [[#OpenDataStorageByDataId]]
|-
| 203 || Returns an [[#IStorage]]
|-
| 400 || [[#OpenDeviceOperator]]
|-
| 500 || [[#OpenSdCardDetectionEventNotifier]]
|-
| 501 || [[#OpenGameCardDetectionEventNotifier]]
|-
| 600 || SetCurrentPosixTime
|-
| 601 || QuerySaveDataTotalSize
|-
| 602 || [[#VerifySaveData]]
|-
| 603 || CorruptSaveDataForDebug
|-
| 604 || CreatePaddingFile
|-
| 605 || DeleteAllPaddingFiles
|-
| 606 || [2.0.0+] GetRightsId
|-
| 607 || [2.0.0+] RegisterExternalKey
|-
| 608 || [2.0.0+] UnregisterExternalKey
|-
| 609 || [2.0.0+] GetRightsIdByPath
|-
| 610 || [3.0.0+] GetRightsIdByPath2 (returns extra byte)
|-
| 611 || [4.0.0+]
|-
| 612 || [4.0.0+]
|-
| 613 || [4.0.0+]
|-
| 614 || [4.0.0+]
|-
| 620 || [2.0.0+] [[#SetSdCardEncryptionSeed]]
|-
| 630 || [4.0.0+]
|-
| 631 || [4.0.0+]
|-
| 640 || [4.0.0+] IsSignedSystemPartitionOnSdCardValid
|-
| 800 || [2.0.0+] GetAndClearFileSystemProxyErrorInfo
|-
| 1000 || SetBisRootForHost
|-
| 1001 || SetSaveDataSize
|-
| 1002 || SetSaveDataRootPath
|-
| 1003 || DisableAutoSaveDataCreation
|-
| 1004 || [[#SetGlobalAccessLogMode]]
|-
| 1005 || [[#GetGlobalAccessLogMode]]
|-
| 1006 || [[#OutputAccessLogToSdCard]]
|-
| 1007 || [4.0.0+]
|-
| 1008 || [4.0.0+] MountRegisteredUpdatePartition
|-
| 1009 || [4.0.0+]
|-
| 1100 || [4.0.0+]
|}

== Permissions ==
Every time permissions are checked, the process registration [[#fsp-pr]] is loaded using the session processID. The permission data is populated with data from the [[NPDM]],

If the processID is <= 6 (which happens only for built-in sysmodules), it will use a hardcoded registration data. The default mask in this case is 0x8000000000000000.

Note that the functions check whether or not at least one bit is set in the mask. This means that, you don't need to set 0xFFFFFFFFFFFFFFFF to get all permissions: it suffices to set 0x8000000000000000.

If the code were to request an invalid input type, panic. But this never happens.

=== RwPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Value || Used by
|-
| 0x0 || 0x8000000000000801 || MountContentType2 || 1 || [[#MountContent]]
|-
| 0x1 || 0x8000000000000801 || MountContentType5 || 1 || [[#MountContent]]
|-
| 0x2 || 0x8000000000000801 || MountContentType3 || 1 || [[#MountContent]]
|-
| 0x3 || 0x8000000000000801 || MountContentType4 || 1 || [[#MountContent]]
|-
| 0x4 || 0x8000000000000801 || MountContentType6 || 1 || [[#MountContent]]
|-
| 0x5 || 0x8000000000000801 || MountContentType7 || 1 || [[#MountContent]]
|-
| 0x6 || 0x8000000000000000 || || 3 ||
|-
| 0x7 || 0x8000000000000800 || ContentStorageAccess || 3 || [[#MountContentStorage]]
|-
| 0x8 || 0x8000000000001000 || ImageDirectoryAccess || 3 || [[#MountImageDirectory]]
|-
| 0x9 || 0x8000000000000084 || MountBisType28 || 3 || [[#MountBis]]
|-
| 0xA || 0x8000000000000080 || MountBisType29 || 3 || [[#MountBis]]
|-
| 0xB || 0x8000000000008080 || MountBisType30 || 3 || [[#MountBis]]
|-
| 0xC || 0x8000000000008080 || MountBisType31 || 3 || [[#MountBis]]
|-
| 0xD || 0x8000000000000080 || || 3 ||
|-
| 0xE || 0xC000000000200000 || SdCardAccess || 3 || [[#MountSdCard]]
|-
| 0xF || 0x8000000000000010 || GameCardUser || 3 || [[#MountGameCardPartition]]
|-
| 0x10 || 0x8000000000040020 || SaveDataAccess0 || 3 || [[#MountSaveData]]
|-
| 0x11 || 0x8000000000000028 || SystemSaveDataAccess0 || 3 || [[#MountSystemSaveData]]
|-
| 0x12 || 0x8000000000000020 || SaveDataAccess1 || 3 || [[#MountSaveData]]
|-
| 0x13 || 0x8000000000000020 || SystemSaveDataAccess1 || 3 || [[#MountSystemSaveData]]
|-
| 0x14 || 0x8000000000010082 || BisPartition0 || 3 || [[#OpenBisPartition]]
|-
| 0x15 || 0x8000000000010080 || BisPartition10 || 3 || [[#OpenBisPartition]]
|-
| 0x17 || 0x8000000000010080 || BisPartition20 || 3 || [[#OpenBisPartition]]
|-
| 0x18 || 0x8000000000010080 || BisPartition21 || 3 || [[#OpenBisPartition]]
|-
| 0x19 || 0x8000000000010080 || BisPartition22 || 3 || [[#OpenBisPartition]]
|-
| 0x1A || 0x8000000000010080 || BisPartition23 || 3 || [[#OpenBisPartition]]
|-
| 0x1B || 0x8000000000010080 || BisPartition24 || 3 || [[#OpenBisPartition]]
|-
| 0x1C || 0x8000000000010080 || BisPartition25 || 3 || [[#OpenBisPartition]]
|-
| 0x16 || 0x8000000000000080 || BisPartition26 || 3 || [[#OpenBisPartition]]
|-
| 0x1D || 0x8000000000000084 || BisPartition27 || 3 || [[#OpenBisPartition]]
|-
| 0x1E || 0x8000000000000084 || BisPartition28 || 3 || [[#OpenBisPartition]]
|-
| 0x1F || 0x8000000000000080 || BisPartition29 || 3 || [[#OpenBisPartition]]
|-
| 0x20 || 0x8000000000000080 || BisPartition30 || 3 || [[#OpenBisPartition]]
|-
| 0x21 || 0x8000000000000080 || BisPartition31 || 3 || [[#OpenBisPartition]]
|-
| 0x22 || 0x8000000000000080 || BisPartition32 || 3 || [[#OpenBisPartition]]
|-
| 0x23 || 0xC000000000200000 || || 3 ||
|-
| 0x24 || 0x8000000000000100 || GameCard_System || 3 || [[#OpenGameCardPartition]], [[#EraseGameCard]] (bit1), [[#WriteToGameCard]] (bit1)
|-
| 0x25 || 0x8000000000100008 || MountContent_System || 1 || [[#MountContent]], [[#OpenDataStorageByDataId]]
|-
| 0x26 || 0xC000000000400000 || HostAccess || 3 || [[#OpenHostFileSystemImpl]]
|}

=== BoolPermissions ===
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Name || Used by
|-
| 0x0 || 0x8000000000000080 || BisCache || [[#InvalidateBisCache]]
|-
| 0x1 || 0x8000000000000080 || EraseMmc || [[#EraseMmc]]
|-
| 0x2 || 0x8000000000000010 || GameCardCertificate || [[#GetGameCardDeviceCertificate]]
|-
| 0x3 || 0x8000000000000010 || GameCardIdSet || [[#GetGameCardIdSet]]
|-
| 0x4 || 0x8000000000000200 || GameCardDriver || [[#FinalizeGameCardDriver]]
|-
| 0x5 || 0x8000000000000200 || GameCardAsic || [[#GetGameCardAsicInfo]]
|-
| 0x6 || 0x8000000000002020 || SaveDataCreate || [[#CreateSaveData]]
|-
| 0x7 || 0x8000000000000060 || SaveDataDelete0 || [[#DeleteSaveData]], [[#RegisterSaveDataAtomicDeletion]]
|-
| 0x8 || 0x8000000000000028 || SystemSaveDataCreate0 || [[#CreateSystemSaveData]]
|-
| 0x9 || 0x8000000000000020 || SystemSaveDataCreate1 || [[#CreateSystemSaveData]]
|-
| 0xA || 0x8000000000004028 || SaveDataDelete1 || [[#DeleteSaveData]], [[#RegisterSaveDataAtomicDeletion]]
|-
| 0xB || 0x8000000000000060 || SaveDataIterators0 || [[#OpenSaveDataIterator]], [[#OpenSaveDataInfoIterator]]
|-
| 0xC || 0x8000000000004020 || SaveDataIterators1 || [[#OpenSaveDataIterator]], [[#OpenSaveDataInfoIterator]]
|-
| 0xD || 0x8000000000020000 || SaveThumbnails || [[#OpenSaveDataThumbnailFile]]
|-
| 0xE || 0x8000000000000400 || PosixTime || [[#SetCurrentPosixTime]]
|-
| 0xF || 0x8000000000004060 || SaveDataExtraData || [[#ReadSaveDataFileSystemExtraData]]
|-
| 0x10 || 0x8000000000080000 || GlobalMode || [[#SetGlobalAccessMode]]
|-
| 0x11 || 0x8000000000080000 || SpeedEmulation || [[#SetSpeedEmulationMode]]
|-
| 0x12 || Invalid || ||
|-
| 0x13 || 0xC000000000800000 || PaddingFiles || [[#CreatePaddingFile]], [[#DeletePaddingFiles]]
|-
| 0x14 || 0xC000000001000000 || SaveData_Debug || [[#CorruptSaveDataForDebug]]
|-
| 0x15 || 0xC000000002000000 || SaveData_SystemManagement || [[#CreateSaveData]], [[#MountSaveData]], [[#SetSaveDataRootPath]]
|-
| [2.0.0+] 0x16 || 0x8000000004000000 || ||
|-
| [2.0.0+] 0x17 || 0x8000000008000000 || ||
|-
| [2.0.0+] 0x18 || 0x8000000010000000 || ||
|-
| [2.0.0+] 0x19 || 0x8000000000000800 || ||
|-
| [2.0.0+] 0x1A || 0x8000000000004020 || ||
|}

== Initialize ==
Takes a pid-descriptor.

== MountContent7 ==
Takes an input u32 (same as [[#MountContent]]) and an u64 title-id. Web-applet loads the u32 from u32_table[inparam]. The in32 must be 4.

Returns an [[#IFileSystem]].

Note: web-applet strings refer to both this cmd and the below "MountContent" as "MountContent".

== MountContent ==
Takes a type-0x19 input buffer, an in32, and an input title-id.

The in32 must be 5 if the NCA type is 0 (control).

The in32 must be 2..7.

The input buffer is the output string path from nsam [[NS_Services#GetContentNcaPath|GetContentNcaPath]].

Returns an [[#IFileSystem]].

May return errors when attempting to access NCA-paths for an update-title with a gamecard, when the gamecard isn't inserted. May return error 0x7D402 in some cases with update-titles. Non-val2 in32 values with NCA-type1 are unusable, even for normal titles.

The official "MountApplicationPackage" func uses this with in64=0 and in32=7.

After the in32-specific permissions are checked, it then gets the func retval for permissions-type 0x25 and func0.

When in32=5, it uses in64=0xffffffffffffffff internally, otherwise it checks if in64 is set to 0xffffffffffffffff then throws an error if so. When the in64 used internally is not 0xffffffffffffffff, it's compared with the NCA titleID, then an error is thrown on mismatch.

== MountBis ==
Takes a type-0x19 input buffer string and a u32 Bis partitionID(see below). Official user-process code sets instr[0] = 0 normally.

Returns an [[#IFileSystem]].

Only partitionIDs for FAT partitions are usable with this, otherwise error 0x2EE202 is returned. Seems to be about the same as [[#OpenBisPartition]] except this mounts the partition filesystem instead of allowing direct access to the partition sectors.

== OpenBisPartition ==
Takes a u32 partition ID, returns 0x2EE202 for partitions which do not exist, 0x320002 for partitions which cannot be opened and a valid [[#IStorage]] handle otherwise.

== InvalidateBisCache ==
Seems to invalidate the Bis cache for MBR/GPT after overwriting that data via the OpenBisPartition IStorage. Used by [[SystemInitializer]].

== DeleteSaveData ==
Takes an input u64.

== CreateSaveData ==
Takes a 0x40-byte Save-struct entry, a 0x40-byte SaveCreate-struct entry, and a 0x10-byte input struct.

Only the first 0x5-bytes in the 0x10-byte struct are initialized: all-zero when automatically creating savedata during savecommon mount by official user-processes. In the dedicated save-creation code in official user-processes: +0 u32 = 0x40060, +4 u8 = 1.

Creates regular savedata.

== CreateSystemSaveData ==
Takes a 0x40-byte Save-struct entry and a 0x40-byte SaveCreate-struct entry.

Creates savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== OpenGameCardPartition ==

Takes an input u32 (partition ID), and returns an [[#IStorage]] for the [[Gamecard_Format|partition]].

== MountGameCardPartition ==
Takes two input u32s, with the second u32 located at +4 in rawdata after the first u32.

Returns an [[#IFileSystem]].

Mounts a gamecard [[Gamecard_Partition|partition]].

== MountSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Official user-process code is only known to use value 1 for the u8.

Returns an [[#IFileSystem]].

Permissions aren't checked until the specified save is successfully found.

Only one process can mount a given savedata at any given time (this includes systemsavedata).

== MountSystemSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Web-applet only uses value0 for the input u8.

Returns an [[#IFileSystem]].

Mounts savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== MountContentStorage ==
Takes a [[#ContentStorageId]]. Invalid values return 0x2EE202.

Returns an [[#IFileSystem]] with NCA files. The read data from these files is identical to the data read by [[Content_Manager_services#ReadEntryRaw]].

== OpenDataStorageByDataId ==
Takes a [[#StorageId]] and a TitleID.

Returns a [[IPC_Marshalling#Domain_message|domain object ID]] implementing the [[#IStorage]] interface for data archives.

== OpenDeviceOperator ==
This command returns a session to a port implementing the [[#IDeviceOperator]] interface.

== OpenSdCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== OpenGameCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== VerifySaveData ==
Takes an unknown input u64 and a type-0x6 output buffer.

The input u64 high-byte must be non-zero, otherwise an [[Error_codes|error]] is returned(0xE02).

== SetSdCardEncryptionSeed ==
Takes 0x10-bytes of input.

Appears to be used to load the seed into FS-module state, since FS-module itself doesn't seem to have file-reading code to handle this itself.

[[NS_Services|NS]]-module uses this with data read from a file.

== SetGlobalAccessLogMode ==
Takes an input u32.

== GetGlobalAccessLogMode ==
Returns an output u32.

GlobalAccessLogMode is normally 0.

== OutputAccessLogToSdCard ==
Takes a type-0x5 input buffer.

The input buffer is the string to output to the log. User-processes normally include a newline at the end.

User-processes only use this when the value previously loaded from [[#GetGlobalAccessLogMode]] has bit1 set.

When bit1 in GlobalAccessLogMode is clear, FS-module will just return 0 for OutputAccessLogToSdCard. However even with that set the log doesn't show up SD, unknown why.

The input buffer is written to the "$FsAccessLog:/FsAccessLog.txt" file, where "$FsAccessLog" is the SD-card mount-name. It's written to the current end of the file(appended).

= IStorage =
This is the interface for a raw device, usually a block device.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments
|-
| 0 || Read || Takes a type-0x46 buffer, an offset and length
|-
| 1 || Write || Takes a type-0x45 buffer, an offset and length
|-
| 2 || Flush || None
|-
| 3 || SetSize || Takes a size
|-
| 4 || GetSize || None
|-
| 5 || [4.0.0+] ||
|}

= IFileSystem =
There are two main implementations of this interface:

* '''RomFS''': Filesystem implementation statically linked in the binary. Uses an [[#IStorage]] interface as underlying raw device.
* '''IPC proxy''': Used for all non-RomFS filesystems. In this case, actual filesystem implementation is in the FS process.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateFile
|-
| 1 || DeleteFile
|-
| 2 || CreateDirectory
|-
| 3 || DeleteDirectory
|-
| 4 || DeleteDirectoryRecursively
|-
| 5 || RenameFile
|-
| 6 || RenameDirectory
|-
| 7 || [[#GetEntryType]]
|-
| 8 || OpenFile
|-
| 9 || [[#OpenDirectory]]
|-
| 10 || [[#Commit]]
|-
| 11 || [[#GetFreeSpaceSize]]
|-
| 12 || [[#GetTotalSpaceSize]]
|-
| 13 || CleanDirectoryRecursively [3.0.0+]
|-
| 14 || GetFileTimeStampRaw [3.0.0+]
|-
| 15 || [4.0.0+]
|}

== GetEntryType ==
Takes a type-0x9 input buffer for the path and returns [[#DirectoryEntryType]] as an output u32.

==OpenDirectory==
Takes a type-0x9 input buffer for the path and an u64 '''filter_flags'''. '''filter_flags''' controls what type of entries are read by the [[#IDirectory]]: bitmask 0x1 = directories, bitmask 0x2 = files.

== Commit ==
Like [https://3dbrew.org/wiki/FS:ControlArchive 3DS], this has to be used after writing to savedata for the changes to take affect.

== GetFreeSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total free space with this FS.

== GetTotalSpaceSize ==
Takes a type-0x9 input buffer for the path and returns an output byte-size u64 for the total space available with this FS(free+used).

= IDirectory =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Read]]
|-
| 1 || [[#GetEntryCount]]
|}

== Read ==
Takes a type-0x6 output buffer and an input u64. Unknown what the u64 is for, doesn't(?) seem to affect output. Returns an output u64(?) for the total number of read entries, this is 0 when no more entries are available.

The output buffer contains the read array of [[#DirectoryEntry]]. This doesn't include entries for "." and "..".

== GetEntryCount ==
Returns an u64 for the total number of readable entries.

= DirectoryEntry =
{| class="wikitable" border="1"
|-
! Offset || Size || Description
|-
| 0x0 || 0x300 || Path
|-
| 0x300 || 0x4 || ?
|-
| 0x304 || 0x1 || [[#DirectoryEntryType]]
|-
| 0x305 || 0x3 || Padding?
|-
| 0x308 || 0x8? || Filesize, 0 for directories.
|}

= DirectoryEntryType =
s8 type: 0 = directory, 1 = file.

= IFile =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Read
|-
| 1 || Write
|-
| 2 || Flush
|-
| 3 || SetSize
|-
| 4 || GetSize
|-
| 5 || [4.0.0+]
|}

= ISaveDataInfoReader =

= IDeviceOperator =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsSdCardInserted
|-
| 1 || GetSdCardSpeedMode
|-
| 2 || [2.0.0+] GetSdCardCid
|-
| 3 || [2.0.0+] GetSdCardUserAreaSize
|-
| 4 || [2.0.0+] GetSdCardProtectedAreaSize
|-
| 5 || [2.0.0+] GetAndClearSdCardErrorInfo
|-
| 6 || [2.0.0+]
|-
| 100 || GetMmcCid
|-
| 101 || GetMmcSpeedMode
|-
| 110 || EraseMmc
|-
| 111 || GetMmcPartitionSize
|-
| 112 || [2.0.0+] GetMmcPatrolCount
|-
| 113 || [2.0.0+] GetAndClearMmcErrorInfo
|-
| 114 || [2.0.0+] GetMmcExtendedCsd
|-
| 115 || [4.0.0+]
|-
| 116 || [4.0.0+]
|-
| 200 || IsGameCardInserted
|-
| 201 || EraseGameCard
|-
| 202 || GetGameCardHandle
|-
| 203 || [[#GetGameCardUpdatePartitionInfo]]
|-
| 204 || FinalizeGameCardDriver
|-
| 205 || GetGameCardAttribute
|-
| 206 || GetGameCardDeviceCertificate
|-
| 207 || GetGameCardAsicInfo
|-
| 208 || GetGameCardIdSet
|-
| 209 || WriteToGameCard
|-
| 210 || SetVerifyWriteEnalbleFlag
|-
| 211 || GetGameCardImageHash
|-
| 212 || [2.0.0+] GetGameCardErrorInfo
|-
| 213 || [2.0.0+]
|-
| 214 || [2.0.0+] GetGameCardCid
|-
| 215 || [2.0.0+]
|-
| 216 || [2.0.0+]
|-
| 217 || [2.1.0+] Returns 0x40-bytes of output data.
|-
| 300 || SetSpeedEmulationMode
|-
| 301 || GetSpeedEmulationMode
|}

== GetGameCardUpdatePartitionInfo ==

Returns a titleID and the title-version for it.

* Output u32 with ARMS-gamecard: title-version v131162. This is the title-version for [[2.1.0]], which is the sysupdate included with this gamecard. Launch-day gamecards return title-version v450.
* Output u64 with ARMS-gamecard: titleID 0100000000000816.

[[NS_Services|NS]] appears to only use this with [[Content_Manager_services#GetTitleIdInfo]] and [[Content_Manager_services#GetUpdateTitleList]] with storageid=nandsys, for checking whether a sysupdate is required.

= IEventNotifier =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || BindEvent
|}

= StorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || None
|-
| 1 || Host
|-
| 2 || GameCard
|-
| 3 || NandSystem
|-
| 4 || NandUser
|-
| 5 || SdCard
|}

= ContentStorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || NandSystem
|-
| 1 || NandUser
|-
| 2 || SdCard
|}

= ContentPath =
These are the 0x300 paths to NCA files for the various filesystems FS can access, beginning with @. They're passed via X descriptors, and returned via various [[Location Resolver services|ncm/lr]] commands.

{| class="wikitable" border="1"
|-
! Path || Notes
|-
| @SystemContent ||
|-
| @UserContent ||
|-
| @SdCardContent ||
|-
| @CalibFile ||
|-
| @Safe ||
|-
| @User ||
|-
| @System ||
|-
| @Sdcard ||
|-
| @Host ||
|-
| @GcApp || Gamecard App partition (Partition 2)
|-
| @GcS00000001 || Gamecard Contents.
|-
| @upp || Gamecard update partition (Partition 0)
|}

=BisPartitionID=
* 0: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 0.
* 10: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 1.
* Rest: see [[Flash_Filesystem|here]].

=Save Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| 0 for SystemSaveData. SaveData: 0 can be used for accessing the savedata associated with the current FS session titleID, otherwise when set this is the titleID associated with the savedata to access.
|-
| 0x8
| 0x10
| userID for user-specific savedata(saveuser) when set, otherwise when zero this indicates the common savedata(savecommon). This is loaded from [[Account_services]].
|-
| 0x18
| 0x8
| u64 [[Flash_Filesystem|saveID]]. 0 for SaveData.
|-
| 0x20
| 0x8
| ContentStorageId? 0 for SystemSaveData. 1 for SaveData. 2 for DeviceSaveData(with official user-processes all other fields are 0 for DeviceSaveData).
|-
| 0x28
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x30
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x38
| 0x8
| 0 for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=SaveCreate Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[Savegames|IVFC]] level4 size?
|-
| 0x8
| 0x8
| Same as offset 0x0 normally? Hard-coded to 0x80000 for BcatSaveData.
|-
| 0x10
| 0x8
| 0x4000 for SystemSaveData/SaveData/DeviceSaveData/BcatSaveData. [[Savegames|IVFC]] level4 block-size in bytes?
|-
| 0x18
| 0x8
| Official user-processes only uses 0 here for SystemSaveData/SaveData. For the dedicated save-creation code with SaveData/DeviceSaveData, this value comes from an input param with official user-processes. For BcatSaveData, this is the hard-coded [[Title_list|titleID]] of the bcat-sysmodule.
|-
| 0x20
| 0x4
| Written using an input param for official user-processes. Hard-coded 0 for BcatSaveData.
|-
| 0x24
| 0x1
| Official user-processes only uses 0 here for SystemSaveData, 1 for SaveData/DeviceSaveData/BcatSaveData.
|-
| 0x25
| 0x1
| 0 for SystemSaveData/SaveData.
|-
| 0x26
| 0x1A
| Not initialized for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=DeviceSaveData=
This is accessed using the same commands for SaveData with the same input u8, the only difference compared to SaveData is the Save-struct.

=BcatSaveData=
This is accessed using the same commands for SaveData with the same input u8. The Save-struct is the same as DeviceSaveData, except that the titleID field is set to <input titleID>. See above regarding SaveCreate-struct.

The 0x10-byte struct passed to [[#CreateSaveData]] has the first 0x5-bytes set to all-zero.

[[Category:Services]]

GRC services

2017-12-24T01:06:07Z

Hthh:

This appears to use libstagefright for writing [[4.0.0|recorded]] video to MP4s.

=grc:c =
This is "nn::grcsrv::IContinuousRecorder".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 1 ||
|-
| 2 ||
|-
| 10 ||
|-
| 11 ||
|-
| 12 ||
|-
| 13 ||
|}

Switch System Flaws

2017-10-17T17:59:52Z

Hthh: Since you can discover bugs Nintendo found first :)

System Flaws are used to execute unofficial code (homebrew) on the Nintendo Switch. This page is a list of known and public Switch System Flaws.

=List of Switch System Flaws=

== Hardware ==
{| class="wikitable" border="1"
! Summary
! Description
! Fixed with hardware model/revision
! Newest hardware model/revision this flaw was checked for
! Timeframe this was discovered
! Discovered by
|-
| No public hardware exploits
|
|
|
|
|
|-
|}

== System software ==

=== Stage 1 Bootloader ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Null-dereference in panic()
| The Switch's stage 1 bootloader, on panic(), clears the stack and then attempts to clear the Security Engine. However, it does so by dereferencing a pointer to the SE in .bss (initially NULL), and this pointer doesn't get initialized until partway into the bootloader's main() after several functions that might panic() are called. Thus, a panic() caused prior to SE initialization would result in the SE pointer still being NULL when dereferenced. This would cause a data abort, causing the bootloader to clear the stack and then try to clear the security engine...dereferencing NULL again, over and over in a loop.

In 3.0.0, this was fixed by moving the security engine initialization earlier in main(), before the first function that could potentially panic().
| Infinite clear-the-stack-then-data-abort loop very early in boot, before SBK/other keyslots are cleared. Probably useless for anything more interesting.
| [[3.0.0]]
| [[3.0.0]]
| Early July, 2017
| July 30, 2017
| Everyone who diff'd 2.3.0 and 3.0.0 Package1
|-
|}

=== TrustZone ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| No public ARM TrustZone exploits
|
|
|
|
|
|
|
|-
|}

=== Kernel ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| GetLastThreadInfo UAF
| GetLastThreadInfo syscall gets last-scheduled-KThread pointer from KScheduler object. This pointer is not reference counted, and can be pointing to a freed KThread.
| Nothing. There is a theoretical race that might leak from a KThread from a different process, but it's impossible to trigger practically.
| Unfixed
|
| 15 October
| 17 October
| plutoo
|-
| Bad irq_id check in CreateInterruptEvent
| CreateInterruptEvent syscall is designed to work only for irq_id >= 32. All irq_ids < 32 are "per-core" and reserved for kernel use (watchdog/scheduling/core communications).
On 1.0.0 you could supply irq_id < 32 and it would write outside the SharedIrqs table.
| You can register irq's in the Core3Irqs table, and thus register per-core irqs for core3, that are normally reserved for kernel. Useless.
| 2.0.0
| 2.0.0
| ~October
| 17 October
| plutoo
|-
|}

=== FIRM-package System Modules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Service access control bypass (sm:h, smhax, probably other names)
| Prior to [[3.0.1]], the ''service manager'' (sm) built-in system module treats a user as though it has full permissions if the user creates a new "sm:" port session but bypasses [[Services_API#Initialize|initialization]]. This is due to the other sm commands skipping the service ACL check for Pids <= 7 (i.e. all kernel bundled modules) and that skipping the initialization command leaves the Pid field uninitialized.
In [[3.0.1]], sm returns error code 0x415 if [[Services_API#Initialize|Initialize]] has not been called yet.
| Acquiring, registering, and unregistering arbitrary services
| [[3.0.1]]
| [[3.0.1]]
| May 2017
| August 17, 2017
| Everyone
|}

=== System Modules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Successful exploitation result
! Fixed in system version
! Last system version this flaw was checked for
! Timeframe this was discovered
! Public disclosure timeframe
! Discovered by
|-
| Out-of-bounds array read for [[BCAT_Content_Container]] secret-data index
| The [[BCAT_Content_Container]] secret-data index is not validated at all. This is handled before the RSA-signature(?) is ever used. Since the field is an u8, a total of 0x800-bytes relative to the array start can be accessed.
This is not useful since the string loaded from this array is only involved with key-generation.
|
| Unknown
| [[2.0.0]]
| August 4, 2017
| August 6, 2017
| [[User: shinyquagsire23|Shiny Quagsire]], [[User:Yellows8|Yellows8]] (independently)
|-
| OOB Read in NS system module (pl:utoohax, pl:utonium, maybe other names)
| Prior to [[3.0.0]], pl:u (Shared Font services implemented in the NS sysmodule) service commands 1,2,3 took in a signed 32-bit index and returned that index of an array but did not check that index at all. This allowed for an arbitrary read within a 34-bit range (33-bit signed) from NS .bss. In [[3.0.0]], sending out of range indexes causes error code 0x60A to be returned.
| Dumping full NS .text, .rodata and .data, infoleak, etc
| [[3.0.0]]
| [[3.0.0]]
| April 2017
| On exploit's fix in [[3.0.0]]
| qlutoo, Reswitched team (independently)
|-
| Unchecked domain ID in common IPC code
| Prior to [[2.0.0]], object IDs in [[IPC_Marshalling#Domain_message|domain messages]] are not bounds checked. This out-of-bounds read could be exploited to brute-force ASLR and get PC control in some services that support domain messages.
|
| 2.0.0
| 2.0.0
| ~July 2017
| 20 July 2017‎
| hthh
|}

Bus services

2017-10-06T07:07:11Z

Hthh:

= gpio =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenSessionForDev]]
|-
| 1 || [[#OpenSession]]
|-
| 2 || [[#OpenSessionForTest]]
|-
| 3 || IsWakeEventActive
|-
| 4 || GetWakeEventActiveFlagSet
|-
| 5 || SetWakeEventActiveFlagSetForDebug
|-
| 6 ||
|}

== OpenSessionForDev ==
Takes a raw GpioPadDescriptor and returns a [[#IPadSession]] session for it.

== OpenSession ==
Same thing as OpenSessionForDev except the descriptor is looked up in the table below.
Returns an [[#IPadSession]] session.

{| class="wikitable" border="1"
|-
! GpioPadName || GpioPadDescriptor || Description || Direction || Used by
|-
| 1 || 0xCC || || ||
|-
| 2 || 0x24 || || ||
|-
| 4 || 0xDA || || ||
|-
| 5 || 0xDB || || ||
|-
| 6 || 0xDC || || ||
|-
| 7 || 0x25 || || ||
|-
| 8 || 0x90 || || In || [[HID services]]
|-
| 9 || 0x91 || || ||
|-
| 0xA || 0x96 || || ||
|-
| 0xB || 0x97 || || ||
|-
| 0xD || 6 || || ||
|-
| 0xE || 0x78 || || ||
|-
| 0xF || 0x93 || || ||
|-
| 0x10 || 0x7D || || ||
|-
| 0x11 || 0x7C || || ||
|-
| 0x12 || 0x7B || || ||
|-
| 0x13 || 0x7A || || ||
|-
| 0x14 || 0xBC || || ||
|-
| 0x15 || 0xAE || || ||
|-
| 0x17 || 0xB9 || || In || [[HID services]]
|-
| 0x18 || 0xBD || || Out || [[HID services]]
|-
| 0x19 || 0xBE || Volume key || In || [[Boot2]]
|-
| 0x1A || 0xBF || Volume key || In || [[Boot2]]
|-
| 0x1B || 0xC0 || || ||
|-
| 0x1C || 0xC1 || || ||
|-
| 0x1D || 0xA9 || || ||
|-
| 0x1E || 0xAA || || ||
|-
| 0x20 || 0xAD || || ||
|-
| 0x21 || 0xC8 || || ||
|-
| 0x22 || 0xCA || || ||
|-
| 0x23 || 0xCB || || ||
|-
| 0x24 || 0x4F || || ||
|-
| 0x25 || 0x50 || || ||
|-
| 0x26 || 0x51 || || ||
|-
| 0x27 || 0x52 || || ||
|-
| 0x28 || 0x54 || || ||
|-
| 0x29 || 0x56 || || ||
|-
| 0x2A || 0x57 || || ||
|-
| .. || .. || .. || .. || ..
|}

== OpenSessionForTest ==
Same as [[#OpenSession]] but panics on failure.

== IPadSession ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || SetDirection
|-
| 1 || GetDirection
|-
| 2 || SetInterruptMode
|-
| 3 || GetInterruptMode
|-
| 4 || SetInterruptEnable
|-
| 5 || GetInterruptEnable
|-
| 6 || GetInterruptStatus
|-
| 7 || ClearInterruptStatus
|-
| 8 || SetValue
|-
| 9 || GetValue
|-
| 10 || BindInterrupt
|-
| 11 || UnbindInterrupt
|-
| 12 || SetDebounceEnabled
|-
| 13 || GetDebounceEnabled
|-
| 14 || SetDebounceTime
|-
| 15 || GetDebounceTime
|}

== GpioPadDescriptor ==
{| class="wikitable" border="1"
|-
! Bits || Description
|-
| 7-5 || Controller index
|-
| 4-3 || Port index
|-
| 2-0 || Pin number
|}

= i2c =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || OpenSessionForDev
|-
| 1 || OpenSession
|-
| 2 || HasDevice
|-
| 3 || HasDeviceForDev
|}

== II2cSession ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|-
| 3 || Send
|-
| 4 || Receive
|-
| 5 || ExecuteCommandList
|}

= i2c:pcv =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 ||
|-
| 2 ||
|-
| 10 ||
|-
| 11 ||
|-
| 12 ||
|}

= uart =
{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || || Returns a u8/bool.
|-
| 1 || || Returns a u8/bool.
|-
| 2 || || Returns a u8/bool.
|-
| 3 || || Returns a u8/bool.
|-
| 4 || || Takes marshalled arguments.
|-
| 5 || || Takes marshalled arguments.
|-
| 6 || GetIPortSession ||
|-
| 7 || ||
|-
| 8 || ||
|-
|}

== IPortSession ==

{| class="wikitable" border="1"
|-
! Cmd || Name || Notes
|-
| 0 || || Takes marshalled arguments
|-
| 1 || || Takes marshalled arguments
|-
| 2 || ||
|-
| 3 || || Takes marshalled arguments
|-
| 4 || || Returns 2x u64. Both zero.
|-
| 5 || ||
|-
| 6 || ||
|-
| 7 || ||
|-
|}

= pwm =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || OpenSessionForDev
|-
| 1 || OpenSession
|}

== IChannelSession ==
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || SetPeriod
|-
| 1 || GetPeriod
|-
| 2 || SetDuty
|-
| 3 || GetDuty
|-
| 4 || SetEnabled
|-
| 5 || GetEnabled
|}

Sockets services

2017-10-06T06:54:38Z

Hthh:

= bsd:u / bsd:s =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RegisterClient (Initialize)
|-
| 1 || StartMonitoring
|-
| 2 || Socket
|-
| 3 || SocketExempt
|-
| 4 || Open
|-
| 5 || Select
|-
| 6 || Poll
|-
| 7 || Sysctl
|-
| 8 || Recv
|-
| 9 || RecvFrom
|-
| 10 || Send
|-
| 11 || SendTo
|-
| 12 || Accept
|-
| 13 || Bind
|-
| 14 || Connect
|-
| 15 || GetPeerName
|-
| 16 || GetSockName
|-
| 17 || GetSockOpt
|-
| 18 || Listen
|-
| 19 || Ioctl
|-
| 20 || Fcntl
|-
| 21 || SetSockOpt
|-
| 22 || Shutdown
|-
| 23 || ShutdownAllSockets
|-
| 24 || Write
|-
| 25 || Read
|-
| 26 || Close
|-
| 27 || DuplicateSocket
|-
| 28 || GetResourceStatistics
|-
| 29 || [3.0.0+] RecvMMsg
|-
| 30 || [3.0.0+] SendMMsg
|}

= sfdnsres =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || SetDnsAddressesPrivate
|-
| 1 || GetDnsAddressPrivate
|-
| 2 || GetHostByName
|-
| 3 || GetHostByAddr
|-
| 4 || GetHostStringError
|-
| 5 || GetGaiStringError
|-
| 6 || GetAddrInfo
|-
| 7 || GetNameInfo
|-
| 8 || RequestCancelHandle
|-
| 9 || CancelSocketCall
|}

= nsd:u / nsd:a =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 10 || GetSettingName
|-
| 11 || GetEnvironmentIdentifier
|-
| 12 || GetDeviceId
|-
| 13 || DeleteSettings
|-
| 14 || ImportSettings
|-
| 20 || Resolve
|-
| 21 || ResolveEx
|-
| 30 || GetNasServiceSetting
|-
| 31 || GetNasServiceSettingEx
|-
| 40 || GetNasRequestFqdn
|-
| 41 || GetNasRequestFqdnEx
|-
| 42 || GetNasApiFqdn
|-
| 43 || GetNasApiFqdnEx
|-
| 50 || GetCurrentSetting
|-
| 60 || ReadSaveDataFromFsForTest
|-
| 61 || WriteSaveDataToFsForTest
|-
| 62 || DeleteSaveDataOfFsForTest
|}

Sockets services

2017-10-05T01:06:47Z

Hthh:

= bsd:u =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RegisterClient (Initialize)
|-
| 1 || StartMonitoring
|-
| 2 || Socket
|-
| 3 || SocketExempt
|-
| 4 || Open
|-
| 5 || Select
|-
| 6 || Poll
|-
| 7 || Sysctl
|-
| 8 || Recv
|-
| 9 || RecvFrom
|-
| 10 || Send
|-
| 11 || SendTo
|-
| 12 || Accept
|-
| 13 || Bind
|-
| 14 || Connect
|-
| 15 || GetPeerName
|-
| 16 || GetSockName
|-
| 17 || GetSockOpt
|-
| 18 || Listen
|-
| 19 || Ioctl
|-
| 20 || Fcntl
|-
| 21 || SetSockOpt
|-
| 22 || Shutdown
|-
| 23 || ShutdownAllSockets
|-
| 24 || Write
|-
| 25 || Read
|-
| 26 || Close
|-
| 27 || DuplicateSocket
|-
| 28 || GetResourceStatistics
|-
| 29 || [3.0.0+] RecvMMsg
|-
| 30 || [3.0.0+] SendMMsg
|}

Sockets services

2017-10-05T00:37:10Z

Hthh: /* bsd:u */

NV services

2017-09-30T04:18:59Z

Hthh: /* /dev/nvhost-dbg-gpu */

The Switch makes use of a customized NVIDIA driver.

= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
Main NVIDIA driver service.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Open]]
|-
| 1 || [[#Ioctl]]
|-
| 2 || [[#Close]]
|-
| 3 || [[#Initialize]]
|-
| 4 || QueryEvent
|-
| 5 || MapSharedMem
|-
| 6 || GetStatus
|-
| 7 || ForceSetClientPID
|-
| 8 || SetClientPID
|-
| 9 || DumpGraphicsMemoryInfo
|-
| 10 || [3.0.0+]
|-
| 11 || [3.0.0+] Ioctl2
|-
| 12 || [3.0.0+] Ioctl3
|-
| 13 || [3.0.0+]
|}

== Open ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00100004
|-
| 1 || 0x00000008
|-
| 2-4 || Type 5 descriptor: Device path
|- style="border-top: double"
| 0-1 || "SFCI"
|-
| 2-3 || Cmd id (0)
|}

== Ioctl ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x11100004
|-
| 1 || 0x00000C0B
|-
| ? || Type 0x21 descriptor: Input buffer
|-
| ? || Type 0x22 descriptor: Output buffer
|- style="border-top: double"
| 0-1 || "SFCI"
|-
| 2-3 || Cmd id (1)
|-
| 4 || Device fd
|-
| 5 || Ioctl Cmd
|}

== Close ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x00000009
|- style="border-top: double"
| 0-1 || "SFCI"
|-
| 2-3 || Cmd id (2)
|-
| 4 || Device fd
|}

== Initialize ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x80000009
|-
| ? || Handle descriptor: Current process
|-
| ? || Handle descriptor: Shared memory mirror
|- style="border-top: double"
| 0-1 || "SFCI"
|-
| 2-3 || Cmd id (3)
|-
| 4 || Shared memory size
|}

Webkit applet creates the shared memory with perm = 0 and size 0x300000.

= Ioctls =
The ioctl number is generated with the following primitive (see Linux kernel):

#define _IOC(inout, group, num, len) \
(inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))

The following table contains known ioctls.

== /dev/nvhost-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]] ||
|-
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]] ||
|-
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]] ||
|-
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]] ||
|-
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]] ||
|-
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]] ||
|-
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]] ||
|-
| 0xC183001B || Inout || 387 || NVHOST_IOCTL_CTRL_GET_CONFIG ||
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_SIGNAL]] ||
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT]] ||
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC]] ||
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_REGISTER]] ||
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_UNREGISTER]] ||
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_EVENT_KILL]] ||
|}

=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __value; // out
};

=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
Identical to Linux driver.

struct {
u32 __id; // in
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __thresh; // in
s32 __timeout; // in
};

=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __lock; // in (0==unlock; 1==lock)
};

=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
Identical to Linux driver. Uses 32-bit version and doesn't work.

struct {
u32 __id; // in
u32 __num_offsets; // in
u32 __block_size; // in
u32 __offsets; // in
u32 __values; // in
u32 __write; // in
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __thresh; // in
s32 __timeout; // in
u32 __value; // out
};

=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __value; // out
};

=== NVHOST_IOCTL_CTRL_EVENT_SIGNAL ===
Signals an event. Exclusive to the Switch.

struct {
u32 __event_id; // in (ranges from 0x01 to 0x3F)
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT ===
Waits on an event. Exclusive to the Switch.

struct {
u32 __unk0; // in
u32 __unk1; // in
s32 __timeout; // in
u32 __event; // inout (in=event_id; out=result)
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC ===
Waits on an event (async version). Exclusive to the Switch.

struct {
u32 __unk0; // in
u32 __unk1; // in
s32 __timeout; // in
u32 __event; // inout (in=event_id; out=result)
};

=== NVHOST_IOCTL_CTRL_EVENT_REGISTER ===
Registers an event. Exclusive to the Switch.

struct {
u32 __event_id; // in (ranges from 0x01 to 0x3F)
};

=== NVHOST_IOCTL_CTRL_EVENT_UNREGISTER ===
Unregisters an event. Exclusive to the Switch.

struct {
u32 __event_id; // in (ranges from 0x01 to 0x3F)
};

=== NVHOST_IOCTL_CTRL_EVENT_KILL ===
Kills events. Exclusive to the Switch.

struct {
u64 __events; // in (64-bit flag where each bit represents one event)
};

== /dev/nvmap ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080101 || Inout || 8 || [[#NVMAP_IOC_CREATE]] ||
|-
| 0x00000102 || - || 0 || NVMAP_IOC_CLAIM || Returns NotSupported
|-
| 0xC0080103 || Inout || 8 || [[#NVMAP_IOC_FROM_ID]] ||
|-
| 0xC0200104 || Inout || 32 || [[#NVMAP_IOC_ALLOC]] ||
|-
| 0xC0180105 || Inout || 24 || [[#NVMAP_IOC_FREE]] ||
|-
| 0xC0280106 || Inout || 40 || NVMAP_IOC_MMAP || Returns NotSupported
|-
| 0xC0280107 || Inout || 40 || NVMAP_IOC_WRITE || Returns NotSupported
|-
| 0xC0280108 || Inout || 40 || NVMAP_IOC_READ || Returns NotSupported
|-
| 0xC00C0109 || Inout || 12 || [[#NVMAP_IOC_PARAM]] ||
|-
| 0xC010010A || Inout || 16 || NVMAP_IOC_PIN_MULT || Returns NotSupported
|-
| 0xC010010B || Inout || 16 || NVMAP_IOC_UNPIN_MULT || Returns NotSupported
|-
| 0xC008010C || Inout || 8 || NVMAP_IOC_CACHE || Returns NotSupported
|-
| 0xC004010D || Inout || 4 || || Returns NotSupported
|-
| 0xC008010E || Inout || 8 || [[#NVMAP_IOC_GET_ID]] ||
|-
| 0xC004010F || Inout || 4 || || Returns NotSupported
|-
| 0x40040110 || In || 4 || || Returns NotSupported
|-
| 0x00000111 || - || 0 || || Returns NotSupported
|}

=== NVMAP_IOC_CREATE ===
Creates an nvmap object. Identical to Linux driver.

struct {
u32 __size; // in
u32 __handle; // out
};

=== NVMAP_IOC_FROM_ID ===
Get handle to an existing nvmap object. Identical to Linux driver.

struct {
u32 __id; // in
u32 __handle; // out
};

=== NVMAP_IOC_ALLOC ===
Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.

struct {
u32 __handle; // in
u32 __heapmask; // in
u32 __flags; // in (0=read-only, 1=read-write)
u32 __align; // in
u8 __kind; // in
u8 __pad[7];
u64 __addr; // in
};

=== NVMAP_IOC_FREE ===
This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.

struct {
u32 __handle; // in
u32 __pad;
u64 __refcount; // out
u32 __size; // out
u32 __flags; // out, 1=NOT_FREED_YET
};

=== NVMAP_IOC_PARAM ===
Returns info about a nvmap object. Identical to Linux driver, but extended with further params.

struct {
u32 __handle; // in
u32 __param; // in, 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
u32 __result; // out
};

=== NVMAP_IOC_GET_ID ===
Returns an id for a nvmap object. Identical to Linux driver.

struct {
u32 __id; // out
u32 __handle; // in
};

== /dev/nvdisp-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80040212 || Out || 4 || TEGRA_DC_EXT_CONTROL_GET_NUM_OUTPUTS ||
|-
| 0xC0140213 || Inout || 20 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_PROPERTIES ||
|-
| 0xC1100214 || Inout || 272 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_EDID ||
|-
| 0xC0040216 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT0 ||
|-
| 0xC0040217 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT1 ||
|-
| 0xC0100218 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT2 ||
|-
| 0xC0100219 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT3 ||
|-
| 0xC0040220 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT4 ||
|-
|}

== /dev/nvdisp-disp0, /dev/nvdisp-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40040201 || In || 4 || TEGRA_DC_EXT_GET_WINDOW ||
|-
| 0x40040202 || In || 4 || TEGRA_DC_EXT_PUT_WINDOW ||
|-
| 0xC4C80203 || In || 1224 || TEGRA_DC_EXT_FLIP ||
|-
| 0x80380204 || Out || 56 || TEGRA_DC_EXT_GET_MODE ||
|-
| 0x40380205 || Out || 56 || TEGRA_DC_EXT_SET_MODE ||
|-
| 0x430C0206 || In || 780 || TEGRA_DC_EXT_SET_LUT ||
|-
| 0x40010207 || In || 1 || TEGRA_DC_EXT_ENABLE_DISABLE_CRC ||
|-
| 0x80040208 || Out || 4 || TEGRA_DC_EXT_GET_CRC ||
|-
| 0x80040209 || Out || 4 || TEGRA_DC_EXT_GET_HEAD_STATUS ||
|-
| 0xC038020A || Inout || 56 || TEGRA_DC_EXT_VALIDATE_MODE ||
|-
| 0x4018020B || In || 24 || TEGRA_DC_EXT_SET_CSC ||
|-
| 0xC004020C || Inout || 4 || TEGRA_DC_EXT_GET_VBLANK_SYNCPT ||
|-
| 0x8040020D || Out || 64 || TEGRA_DC_EXT_GET_UNDERFLOWS ||
|-
| 0xC99A020E || Inout || 2458 || TEGRA_DC_EXT_SET_CMU ||
|-
| 0xC004020F || Inout || 4 || TEGRA_DC_EXT_DPMS ||
|-
| 0x80600210 || Out || 96 || TEGRA_DC_EXT_GET_AVI_INFOFRAME ||
|-
| 0x40600211 || In || 96 || TEGRA_DC_EXT_SET_AVI_INFOFRAME ||
|-
| 0xEBFC0215 || Inout || 11260 || TEGRA_DC_EXT_GET_MODE_DB ||
|-
| 0xC003021A || Inout || 3 || TEGRA_DC_EXT_PANEL_GET_VENDOR_ID ||
|-
| 0x803C021B || Out || 60 || TEGRA_DC_EXT_GET_MODE2 ||
|-
| 0x403C021C || In || 60 || TEGRA_DC_EXT_SET_MODE2 ||
|-
| 0xC03C021D || Inout || 60 || TEGRA_DC_EXT_VALIDATE_MODE2 ||
|-
| 0xEF20021E || Inout || 12064 || TEGRA_DC_EXT_GET_MODE_DB2 ||
|-
| 0xC004021F || Inout || 4 || TEGRA_DC_EXT_GET_WINMASK ||
|-
|}

== /dev/nvcec-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010300 || In || 1 || ||
|-
| 0x40010301 || In || 1 || NVCEC_CTRL_ENABLE ||
|-
| 0x804C0302 || Out || 76 || NVCEC_CTRL_GET_PADDR ||
|-
| 0x40040303 || In || 4 || NVCEC_CTRL_SET_LADDR ||
|-
| 0xC04C0304 || Inout || 76 || NVCEC_CTRL_WRITE ||
|-
| 0xC04C0305 || Inout || 76 || NVCEC_CTRL_READ ||
|-
| 0x804C0306 || Out || 76 || NVCEC_CTRL_GET_CONNECTION_STATUS ||
|-
| 0x804C0307 || Out || 76 || NVCEC_CTRL_GET_WRITE_STATUS ||
|-
|}

== /dev/nvhdcp_up-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC4880401 || Inout || 1160 || ||
|-
| 0xC4880402 || Inout || 1160 || ||
|-
| 0x40010403 || In || 1 || ||
|-
|}

== /dev/nvdcutil-disp0, /dev/nvdcutil-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010501 || In || 1 || ||
|-
| 0x40010502 || In || 1 || ||
|-
| 0x42040503 || In || 1056 || ||
|-
| 0x803C0504 || Out || 60 || ||
|-
|}

== /dev/nvsched-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x00000601 || - || 0 || ||
|-
| 0x00000602 || - || 0 || ||
|-
| 0x40180603 || In || 1056 || ||
|-
| 0x40180604 || In || 60 || ||
|-
| 0x40080605 || In || 60 || ||
|-
| 0x80080606 || Out || 60 || ||
|-
| 0x80080607 || Out || 60 || ||
|-
| 0x40180608 || In || 24 || ||
|-
| 0x40100609 || In || 16 || ||
|-
| 0x4010060A || In || 16 || ||
|-
| 0x4008060B || In || 8 || ||
|-
| 0x8001060C || Out || 1 || ||
|-
| 0x8010060D || Out || 16 || ||
|-
| 0x400C060E || In || 12 || ||
|-
| 0x4008060F || In || 8 || ||
|-
| 0x40100610 || In || 16 || ||
|-
| 0x40100611 || In || 16 || ||
|-
|}

== /dev/nvhost-as-gpu ==
Each fd opened to this device creates an address space. An address space is then later bound with a channel.

Once a nvgpu channel has been bound to an address space it cannot be unbound. There is no support for allowing an nvgpu channel to change from one address space to another (or from one to none).

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40044101 || In || 4 || [[#NVGPU_AS_IOCTL_BIND_CHANNEL]] ||
|-
| 0xC0184102 || Inout || 24 || [[#NVGPU_AS_IOCTL_ALLOC_SPACE]] ||
|-
| 0xC0104103 || Inout || 16 || [[#NVGPU_AS_IOCTL_FREE_SPACE]] ||
|-
| 0xC0184104 || Inout || 24 || [[#NVGPU_AS_IOCTL_MAP_BUFFER]] ||
|-
| 0xC0084105 || Inout || 8 || [[#NVGPU_AS_IOCTL_UNMAP_BUFFER]] ||
|-
| 0xC0284106 || Inout || 40 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX]] ||
|-
| 0x40104107 || In || 16 || [[#NVGPU_AS_IOCTL_INITIALIZE]] ||
|-
| 0xC0404108 || Inout || 64 || [[#NVGPU_AS_IOCTL_GET_VA_REGIONS]] ||
|-
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_INITIALIZE_EX]] ||
|-
| 0xC0144114 || Inout || 20 || NVGPU_AS_IOCTL_REMAP ||
|}

=== NVGPU_AS_IOCTL_BIND_CHANNEL ===
Identical to Linux driver.

struct {
u32 __fd; // in
};

=== NVGPU_AS_IOCTL_ALLOC_SPACE ===
This one reserves pages in the device address space.

struct {
u32 __pages; // in
u32 __page_size; // in
u32 __flags; // in
u32 __pad;
union {
u64 __offset; // out
u64 __align; // in
};
};

=== NVGPU_AS_IOCTL_FREE_SPACE ===
struct {
u64 __offset; // in
u32 __pages; // in
u32 __page_size; // in
};

=== NVGPU_AS_IOCTL_MAP_BUFFER ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
u32 __flags; // in, 4 works
u32 __reserved;
u32 __nvmap_handle; // in
u32 __page_size; // inout, 0 means don't care
union {
u64 __offset; // out
u64 __align; // in
};
};

=== NVGPU_AS_IOCTL_MAP_BUFFER_EX ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
u32 __flags; // in, 4 works
u32 __kind; // in, -1 is default
u32 __nvmap_handle; // in
u32 __page_size; // inout, 0 means don't care
u64 __buffer_offset; // in
u64 __mapping_size; // in
u64 __offset; // out
};

=== NVGPU_AS_IOCTL_UNMAP_BUFFER ===
Doesn't do shit.

=== NVGPU_AS_IOCTL_INITIALIZE ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable).

struct {
u32 __big_page_size; // in (depends on GPU's available_big_page_sizes; 0=default)
s32 __as_fd; // in (ignored; passes 0)
u32 __flags; // in (ignored; passes 0)
u32 __reserved; // in (ignored; passes 0)
};

=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
Nintendo modified to get rid of pointer in struct.

struct va_region {
u64 __offset;
u32 __page_size;
u32 __reserved;
u64 __pages;
};

struct {
u64 __not_used; // (contained output user ptr on linux, ignored)
u32 __bufsize; // inout, forced to 2*sizeof(struct va_region)
u32 __reserved;
struct va_region __regions[2]; // out
};

=== NVGPU_AS_IOCTL_INITIALIZE_EX ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable) with extra params.

struct {
u32 __big_page_size; // in (depends on GPU's available_big_page_sizes; 0=default)
s32 __as_fd; // in (ignored; passes 0)
u32 __flags; // in (ignored; passes 0)
u32 __reserved; // in (ignored; passes 0)
u64 __unk0; // in
u64 __unk1; // in
u64 __unk2; // in
};

== /dev/nvhost-dbg-gpu ==
Not accessible, but there is code to invoke it.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40084401 || In || 8 || NVGPU_DBG_GPU_IOCTL_BIND_CHANNEL ||
|-
| 0xC0??4402 || Inout || Variable || NVGPU_DBG_GPU_IOCTL_REG_OPS ||
|-
| 0x40084403 || In || 8 || NVGPU_DBG_GPU_IOCTL_EVENTS_CTRL ||
|-
| 0x40044404 || In || 4 || NVGPU_DBG_GPU_IOCTL_POWERGATE ||
|-
| 0x40044405 || In || 4 || NVGPU_DBG_GPU_IOCTL_SMPC_CTXSW_MODE ||
|-
| 0xC0184407 || Inout || 24 || NVGPU_DBG_GPU_IOCTL_PERFBUF_MAP ||
|-
| 0x40084408 || In || 8 || NVGPU_DBG_GPU_IOCTL_PERFBUF_UNMAP ||
|-
| 0x40084409 || In || 8 || NVGPU_DBG_GPU_IOCTL_PC_SAMPLING ||
|-
| 0x4008440A || In || 8 || NVGPU_DBG_GPU_IOCTL_TIMEOUT ||
|-
| 0x8008440B || Out || 8 || NVGPU_DBG_GPU_IOCTL_GET_TIMEOUT ||
|-
| 0x8004440C || Out || 4 || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT_SIZE ||
|-
| 0x0000440D || ? || ? || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT (uses Ioctl3)
|-
|}

== /dev/nvhost-ctrl-gpu ==
This device is for global (context independent) operations on the gpu.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80044701 || Out || 4 || NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE ||
|-
| 0x80284702 || Out || 40 || NVGPU_GPU_IOCTL_ZCULL_GET_INFO ||
|-
| 0x402C4703 || In || 44 || NVGPU_GPU_IOCTL_ZBC_SET_TABLE ||
|-
| 0xC0344704 || Inout || 52 || NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE ||
|-
| 0xC0B04705 || Inout || 176 || [[#NVGPU_GPU_IOCTL_GET_CHARACTERISTICS]] ||
|-
| 0xC0184706 || Inout || 24 || NVGPU_GPU_IOCTL_GET_TPC_MASKS ||
|-
| 0x40084707 || In || 8 || [[#NVGPU_GPU_IOCTL_FLUSH_L2]] ||
|-
| 0x4008470E || In || 8 || NVGPU_GPU_IOCTL_SET_MMUDEBUG_MODE ||
|-
| 0x4010470F || In || 16 || NVGPU_GPU_IOCTL_SET_SM_DEBUG_MODE ||
|-
| 0xC0084710 || Inout || 8 || NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE ||
|-
| 0x80084711 || Out || 8 || NVGPU_GPU_IOCTL_GET_TPC_EXCEPTION_EN_STATUS ||
|-
| 0x80084712 || Out || 8 || ||
|-
| 0xC0044713 || Inout || 4 || ||
|-
| 0x80084714 || Out || 8 || [[#NVGPU_GPU_IOCTL_GET_L2_STATE]] ||
|-
| 0x80044715 || Out || 4 || ||
|-
| 0x8018471A || Out || 24 || ||
|-
| 0xC008471B || Inout || 8 || NVGPU_GPU_IOCTL_GET_ERROR_CHANNEL_USER_DATA ||
|-
| 0xC010471C || Inout || 16 || NVGPU_GPU_IOCTL_GET_GPU_TIME ||
|-
| 0xC108471D || Inout || 264 || NVGPU_GPU_IOCTL_GET_CPU_TIME_CORRELATION_INFO ||
|}

=== NVGPU_GPU_IOCTL_GET_CHARACTERISTICS ===
Returns the GPU characteristics. Modified to return inline data instead of using a pointer.

struct __gpu_characteristics {
u32 __arch; // 0x120 (NVGPU_GPU_ARCH_GM200)
u32 __impl; // 0xB (NVGPU_GPU_IMPL_GM20B)
u32 __rev; // 0xA1 (Revision A1)
u32 __num_gpc; // 0x1
u64 __L2_cache_size; // 0x40000
u64 __on_board_video_memory_size; // 0x0 (not used)
u32 __num_tpc_per_gpc; // 0x2
u32 __bus_type; // 0x20 (NVGPU_GPU_BUS_TYPE_AXI)
u32 __big_page_size; // 0x20000
u32 __compression_page_size; // 0x20000
u32 __pde_coverage_bit_count; // 0x1B
u32 __available_big_page_sizes; // 0x30000
u32 __gpc_mask; // 0x1
u32 __sm_arch_sm_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 __sm_arch_spa_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 __sm_arch_warp_count; // 0x80
u32 __gpu_va_bit_count; // 0x28
u32 __reserved; // NULL
u64 __flags; // 0x55
u32 __twod_class; // 0x902D (FERMI_TWOD_A)
u32 __threed_class; // 0xB197 (MAXWELL_B)
u32 __compute_class; // 0xB1C0 (MAXWELL_COMPUTE_B)
u32 __gpfifo_class; // 0xB06F (MAXWELL_CHANNEL_GPFIFO_A)
u32 __inline_to_memory_class; // 0xA140 (KEPLER_INLINE_TO_MEMORY_B)
u32 __dma_copy_class; // 0xB0B5 (MAXWELL_DMA_COPY_A)
u32 __max_fbps_count; // 0x1
u32 __fbp_en_mask; // 0x0 (disabled)
u32 __max_ltc_per_fbp; // 0x2
u32 __max_lts_per_ltc; // 0x1
u32 __max_tex_per_tpc; // 0x0 (not supported)
u32 __max_gpc_count; // 0x1
u32 __rop_l2_en_mask_0; // 0x21D70 (fuse_status_opt_rop_l2_fbp_r)
u32 __rop_l2_en_mask_1; // 0x0
u64 __chipname; // 0x6230326D67 ("gm20b")
u64 __gr_compbit_store_base_hw; // 0x0 (not supported)
};

struct {
u64 __gpu_characteristics_buf_size; // in/out (must not be NULL, but gets overwritten with 0xA0=max_size)
u64 __gpu_characteristics_buf_addr; // in (ignored, but must not be NULL)
struct __gpu_characteristics gc; // out
};

=== NVGPU_GPU_IOCTL_FLUSH_L2 ===
Flushes the GPU L2 cache.

struct {
u32 __flush; // in (l2_flush | l2_invalidate << 1 | fb_flush << 2)
u32 __reserved; // in
};

=== NVGPU_GPU_IOCTL_GET_L2_STATE ===
Returns the GPU L2 cache state.

struct {
u32 __mask; // out (always 0x07)
u32 __flush; // out (active flush bit field)
};

== Channels ==
Channels are a concept for NVIDIA hardware blocks that share a common interface.

{| class="wikitable" border="1"
! Path || Name
|-
| /dev/nvhost-gpu ||
|-
| /dev/nvhost-vic || Video Image Compositor
|-
| /dev/nvhost-nvdec || Video Decoder
|-
| /dev/nvhost-nvjpg || JPEG Decoder
|}

== Channel Ioctls ==
{| class="wikitable" border="1"
! Value || Size || Description || Notes
|-
| 0xC0??0001 || Variable || NVHOST_IOCTL_CHANNEL_SUBMIT ||
|-
| 0xC0080002 || 8 || NVHOST_IOCTL_CHANNEL_GET_SYNCPOINT ||
|-
| 0xC0080003 || 8 || NVHOST_IOCTL_CHANNEL_GET_WAITBASE ||
|-
| 0xC0080004 || 8 || NVHOST_IOCTL_CHANNEL_SET_TIMEOUT_EX ||
|-
| 0x40040007 || 4 || ||
|-
| 0x40080008 || 8 || NVHOST_IOCTL_CHANNEL_SET_CLK_RATE ||
|-
| 0xC0??0009 || Variable || NVHOST_IOCTL_CHANNEL_MAP_BUFFER ||
|-
| 0xC0??000A || Variable || NVHOST_IOCTL_CHANNEL_UNMAP_BUFFER ||
|-
| 0x00000013 || 0 || ||
|- style="border-top: double"
| 0x40044801 || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD]] ||
|-
| 0x40044803 || 4 || NVGPU_IOCTL_CHANNEL_SET_TIMEOUT ||
|-
| 0x40084805 || 8 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO]] ||
|-
| 0xC0044807 || 4 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS ||
|-
| 0xC0??4808 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]] ||
|-
| 0xC0104809 || 16 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX]] ||
|-
| 0xC010480B || 16 || NVGPU_IOCTL_CHANNEL_ZCULL_BIND ||
|-
| 0xC018480C || 24 || [[#NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER]] ||
|-
| 0x4004480D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_PRIORITY]] ||
|-
| 0x0000480E || 0 || [[#NVGPU_IOCTL_CHANNEL_ENABLE]] ||
|-
| 0x0000480F || 0 || [[#NVGPU_IOCTL_CHANNEL_DISABLE]] ||
|-
| 0x00004810 || 0 || [[#NVGPU_IOCTL_CHANNEL_PREEMPT]] ||
|-
| 0x00004811 || 0 || [[#NVGPU_IOCTL_CHANNEL_FORCE_RESET]] ||
|-
| 0x40084812 || 8 || [[#NVGPU_IOCTL_CHANNEL_EVENTS_CTRL]] ||
|-
| 0xC0104813 || 16 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS_SNAPSHOT ||
|-
| 0x80804816 || 128 || NVGPU_IOCTL_CHANNEL_GET_ERROR_INFO || Only works when the channel is busy
|-
| 0xC0104817 || 16 || [[#NVGPU_IOCTL_CHANNEL_GET_ERROR]] ||
|-
| 0x40204818 || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]] ||
|-
| 0xC0??4819 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]] ||
|-
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]] ||
|-
|- style="border-top: double"
| 0x40084714 || 8 || NVGPU_IOCTL_CHANNEL_SET_USER_DATA || Sets an unknown user context address
|-
| 0x80084715 || 8 || NVGPU_IOCTL_CHANNEL_GET_USER_DATA || Gets an unknown user context address
|}

=== NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD ===
Binds a nvmap object to this channel. Identical to Linux driver.

struct {
u32 __nvmap_fd; // in
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO ===
Allocates gpfifo entries. Identical to Linux driver.

struct {
u32 __num_entries; // in
u32 __flags; // in
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO ===
Submits a gpfifo object. Modified to take inline entry objects instead of a pointer.

struct fence {
u32 __id;
u32 __value;
};

struct gpfifo_entry {
u32 __entry0;
u32 __entry1;
};

struct {
u64 __gpfifo; // in (pointer to gpfifo fence structs; ignored)
u32 __num_entries; // in (number of fence objects being submitted)
u32 __flags; // in
struct fence __fence_out; // out (returned new fence object for others to wait on)
struct gpfifo_entry __entries[]; // in (depends on __num_entries)
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX ===
Allocates a graphics context object. Modified to ignore object's ID.

struct {
u32 __class_num; // in (0x902D=2d, 0xB197=3d, 0xB1C0=compute, 0xA140=kepler, 0xB0B5=DMA, 0xB06F=channel_gpfifo)
u32 __flags; // in
u64 __obj_id; // out (ignored; used for FREE_OBJ_CTX ioctl, which is not supported)
};

=== NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER ===
Initializes the error notifier for this channel. Identical to Linux driver.

struct {
u64 __offset; // in
u64 __size; // in
u32 __mem; // in (nvmap object handle)
u32 __padding; // in
};

=== NVGPU_IOCTL_CHANNEL_SET_PRIORITY ===
Change channel's priority. Identical to Linux driver.

struct {
u32 __priority; // in (0x32 is low, 0x64 is medium and 0x96 is high)
};

=== NVGPU_IOCTL_CHANNEL_ENABLE ===
Enables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_DISABLE ===
Disables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_PREEMPT ===
Clears the FIFO pipe for this channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_FORCE_RESET ===
Forces the channel to reset. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_EVENTS_CTRL ===
Controls event notifications. Modified to take an additional argument.

struct {
u32 __cmd; // in (0=disable, 1=enable, 2=clear)
u32 __unk; // in (accepts 1 or 2)
};

=== NVGPU_IOCTL_CHANNEL_GET_ERROR ===
Returns the current error notification caught by the error notifier. Exclusive to the Switch.

struct {
u64 __timestamp; // out (nanoseconds since Jan. 1, 1970)
u32 __info32; // out (error code)
u16 __info16; // out (additional error info)
u16 __status; // inout (always 0xFFFF)
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY ===
Allocates gpfifo entries with additional parameters. Exclusive to the Switch.

struct {
u32 __num_entries; // in
u32 __flags; // in
u32 __unk0; // in (1 works)
u32 __unk1; // in
u32 __unk2; // in
u32 __unk3; // in
u32 __unk4; // in
u32 __unk5; // in
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX ===
Submits a gpfifo object (async version). Exclusive to the Switch.

struct {
u64 __gpfifo; // in (pointer to gpfifo fence structs; ignored)
u32 __num_entries; // in (number of fence objects being submitted)
u32 __flags; // in
struct fence __fence_out; // out (returned new fence object for others to wait on)
struct gpfifo_entry __entries[]; // in (depends on __num_entries)
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2 ===
Allocates gpfifo entries with additional parameters and returns a fence. Exclusive to the Switch.

struct {
u32 __num_entries; // in
u32 __flags; // in
u32 __unk0; // in (1 works)
struct fence __fence_out; // out
u32 __unk1; // in
u32 __unk2; // in
u32 __unk3; // in
};

= nvmemp =
NVIDIA memory profiler (this service is not available on retail units).

= nvdrvdbg =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenLog]]
|-
| 1 || [[#CloseLog]]
|-
| 2 || [[#ReadLog]]
|}

== OpenLog ==
Takes process handle. Returns an fd.

== CloseLog ==
Takes fd and closes it.

== ReadLog ==
Takes fd and reads log into a type-6 buffer.

= Errors =
Most nvidia driver commands return an error code apart from the normal return code.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Success
|-
| 1 || NotImplemented
|-
| 2 || NotSupported
|-
| 3 || NotInitialized
|-
| 4 || BadParameter
|-
| 5 || Timeout
|-
| 6 || InsufficientMemory
|-
| 7 || ReadOnlyAttribute
|-
| 8 || InvalidState
|-
| 9 || InvalidAddress
|-
| 0xA || InvalidSize
|-
| 0xB || BadValue
|-
| 0xD || AlreadyAllocated
|-
| 0xE || Busy
|-
| 0xF || ResourceError
|-
| 0x10 || CountMismatch
|-
| 0x1000 || SharedMemoryTooSmall
|-
| 0x30003 || FileOperationFailed
|-
| 0x3000F || IoctlFailed
|}

[[Category:Services]]

NV services

2017-09-30T01:35:20Z

Hthh:

The Switch makes use of a customized NVIDIA driver.

= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
Main NVIDIA driver service.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Open]]
|-
| 1 || [[#Ioctl]]
|-
| 2 || [[#Close]]
|-
| 3 || [[#Initialize]]
|-
| 4 || QueryEvent
|-
| 5 || MapSharedMem
|-
| 6 || GetStatus
|-
| 7 || ForceSetClientPID
|-
| 8 || SetClientPID
|-
| 9 || DumpGraphicsMemoryInfo
|-
| 10 || [3.0.0+]
|-
| 11 || [3.0.0+] Ioctl2
|-
| 12 || [3.0.0+] Ioctl3
|-
| 13 || [3.0.0+]
|}

== Open ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00100004
|-
| 1 || 0x00000008
|-
| 2-4 || Type 5 descriptor: Device path
|- style="border-top: double"
| 0-1 || "SFCI"
|-
| 2-3 || Cmd id (0)
|}

== Ioctl ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x11100004
|-
| 1 || 0x00000C0B
|-
| ? || Type 0x21 descriptor: Input buffer
|-
| ? || Type 0x22 descriptor: Output buffer
|- style="border-top: double"
| 0-1 || "SFCI"
|-
| 2-3 || Cmd id (1)
|-
| 4 || Device fd
|-
| 5 || Ioctl Cmd
|}

== Close ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x00000009
|- style="border-top: double"
| 0-1 || "SFCI"
|-
| 2-3 || Cmd id (2)
|-
| 4 || Device fd
|}

== Initialize ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x80000009
|-
| ? || Handle descriptor: Current process
|-
| ? || Handle descriptor: Shared memory mirror
|- style="border-top: double"
| 0-1 || "SFCI"
|-
| 2-3 || Cmd id (3)
|-
| 4 || Shared memory size
|}

Webkit applet creates the shared memory with perm = 0 and size 0x300000.

= Ioctls =
The ioctl number is generated with the following primitive (see Linux kernel):

#define _IOC(inout, group, num, len) \
(inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))

The following table contains known ioctls.

== /dev/nvhost-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]] ||
|-
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]] ||
|-
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]] ||
|-
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]] ||
|-
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]] ||
|-
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]] ||
|-
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]] ||
|-
| 0xC183001B || Inout || 387 || NVHOST_IOCTL_CTRL_GET_CONFIG ||
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_SIGNAL]] ||
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT]] ||
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC]] ||
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_REGISTER]] ||
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_UNREGISTER]] ||
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_EVENT_KILL]] ||
|}

=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __value; // out
};

=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
Identical to Linux driver.

struct {
u32 __id; // in
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __thresh; // in
s32 __timeout; // in
};

=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __lock; // in (0==unlock; 1==lock)
};

=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
Identical to Linux driver. Uses 32-bit version and doesn't work.

struct {
u32 __id; // in
u32 __num_offsets; // in
u32 __block_size; // in
u32 __offsets; // in
u32 __values; // in
u32 __write; // in
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __thresh; // in
s32 __timeout; // in
u32 __value; // out
};

=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __value; // out
};

=== NVHOST_IOCTL_CTRL_EVENT_SIGNAL ===
Signals an event. Exclusive to the Switch.

struct {
u32 __event_id; // in (ranges from 0x01 to 0x3F)
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT ===
Waits on an event. Exclusive to the Switch.

struct {
u32 __unk0; // in
u32 __unk1; // in
s32 __timeout; // in
u32 __event; // inout (in=event_id; out=result)
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC ===
Waits on an event (async version). Exclusive to the Switch.

struct {
u32 __unk0; // in
u32 __unk1; // in
s32 __timeout; // in
u32 __event; // inout (in=event_id; out=result)
};

=== NVHOST_IOCTL_CTRL_EVENT_REGISTER ===
Registers an event. Exclusive to the Switch.

struct {
u32 __event_id; // in (ranges from 0x01 to 0x3F)
};

=== NVHOST_IOCTL_CTRL_EVENT_UNREGISTER ===
Unregisters an event. Exclusive to the Switch.

struct {
u32 __event_id; // in (ranges from 0x01 to 0x3F)
};

=== NVHOST_IOCTL_CTRL_EVENT_KILL ===
Kills events. Exclusive to the Switch.

struct {
u64 __events; // in (64-bit flag where each bit represents one event)
};

== /dev/nvmap ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080101 || Inout || 8 || [[#NVMAP_IOC_CREATE]] ||
|-
| 0x00000102 || - || 0 || NVMAP_IOC_CLAIM || Returns NotSupported
|-
| 0xC0080103 || Inout || 8 || [[#NVMAP_IOC_FROM_ID]] ||
|-
| 0xC0200104 || Inout || 32 || [[#NVMAP_IOC_ALLOC]] ||
|-
| 0xC0180105 || Inout || 24 || [[#NVMAP_IOC_FREE]] ||
|-
| 0xC0280106 || Inout || 40 || NVMAP_IOC_MMAP || Returns NotSupported
|-
| 0xC0280107 || Inout || 40 || NVMAP_IOC_WRITE || Returns NotSupported
|-
| 0xC0280108 || Inout || 40 || NVMAP_IOC_READ || Returns NotSupported
|-
| 0xC00C0109 || Inout || 12 || [[#NVMAP_IOC_PARAM]] ||
|-
| 0xC010010A || Inout || 16 || NVMAP_IOC_PIN_MULT || Returns NotSupported
|-
| 0xC010010B || Inout || 16 || NVMAP_IOC_UNPIN_MULT || Returns NotSupported
|-
| 0xC008010C || Inout || 8 || NVMAP_IOC_CACHE || Returns NotSupported
|-
| 0xC004010D || Inout || 4 || || Returns NotSupported
|-
| 0xC008010E || Inout || 8 || [[#NVMAP_IOC_GET_ID]] ||
|-
| 0xC004010F || Inout || 4 || || Returns NotSupported
|-
| 0x40040110 || In || 4 || || Returns NotSupported
|-
| 0x00000111 || - || 0 || || Returns NotSupported
|}

=== NVMAP_IOC_CREATE ===
Creates an nvmap object. Identical to Linux driver.

struct {
u32 __size; // in
u32 __handle; // out
};

=== NVMAP_IOC_FROM_ID ===
Get handle to an existing nvmap object. Identical to Linux driver.

struct {
u32 __id; // in
u32 __handle; // out
};

=== NVMAP_IOC_ALLOC ===
Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.

struct {
u32 __handle; // in
u32 __heapmask; // in
u32 __flags; // in (0=read-only, 1=read-write)
u32 __align; // in
u8 __kind; // in
u8 __pad[7];
u64 __addr; // in
};

=== NVMAP_IOC_FREE ===
This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.

struct {
u32 __handle; // in
u32 __pad;
u64 __refcount; // out
u32 __size; // out
u32 __flags; // out, 1=NOT_FREED_YET
};

=== NVMAP_IOC_PARAM ===
Returns info about a nvmap object. Identical to Linux driver, but extended with further params.

struct {
u32 __handle; // in
u32 __param; // in, 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
u32 __result; // out
};

=== NVMAP_IOC_GET_ID ===
Returns an id for a nvmap object. Identical to Linux driver.

struct {
u32 __id; // out
u32 __handle; // in
};

== /dev/nvdisp-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80040212 || Out || 4 || TEGRA_DC_EXT_CONTROL_GET_NUM_OUTPUTS ||
|-
| 0xC0140213 || Inout || 20 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_PROPERTIES ||
|-
| 0xC1100214 || Inout || 272 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_EDID ||
|-
| 0xC0040216 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT0 ||
|-
| 0xC0040217 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT1 ||
|-
| 0xC0100218 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT2 ||
|-
| 0xC0100219 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT3 ||
|-
| 0xC0040220 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT4 ||
|-
|}

== /dev/nvdisp-disp0, /dev/nvdisp-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40040201 || In || 4 || TEGRA_DC_EXT_GET_WINDOW ||
|-
| 0x40040202 || In || 4 || TEGRA_DC_EXT_PUT_WINDOW ||
|-
| 0xC4C80203 || In || 1224 || TEGRA_DC_EXT_FLIP ||
|-
| 0x80380204 || Out || 56 || TEGRA_DC_EXT_GET_MODE ||
|-
| 0x40380205 || Out || 56 || TEGRA_DC_EXT_SET_MODE ||
|-
| 0x430C0206 || In || 780 || TEGRA_DC_EXT_SET_LUT ||
|-
| 0x40010207 || In || 1 || TEGRA_DC_EXT_ENABLE_DISABLE_CRC ||
|-
| 0x80040208 || Out || 4 || TEGRA_DC_EXT_GET_CRC ||
|-
| 0x80040209 || Out || 4 || TEGRA_DC_EXT_GET_HEAD_STATUS ||
|-
| 0xC038020A || Inout || 56 || TEGRA_DC_EXT_VALIDATE_MODE ||
|-
| 0x4018020B || In || 24 || TEGRA_DC_EXT_SET_CSC ||
|-
| 0xC004020C || Inout || 4 || TEGRA_DC_EXT_GET_VBLANK_SYNCPT ||
|-
| 0x8040020D || Out || 64 || TEGRA_DC_EXT_GET_UNDERFLOWS ||
|-
| 0xC99A020E || Inout || 2458 || TEGRA_DC_EXT_SET_CMU ||
|-
| 0xC004020F || Inout || 4 || TEGRA_DC_EXT_DPMS ||
|-
| 0x80600210 || Out || 96 || TEGRA_DC_EXT_GET_AVI_INFOFRAME ||
|-
| 0x40600211 || In || 96 || TEGRA_DC_EXT_SET_AVI_INFOFRAME ||
|-
| 0xEBFC0215 || Inout || 11260 || TEGRA_DC_EXT_GET_MODE_DB ||
|-
| 0xC003021A || Inout || 3 || TEGRA_DC_EXT_PANEL_GET_VENDOR_ID ||
|-
| 0x803C021B || Out || 60 || TEGRA_DC_EXT_GET_MODE2 ||
|-
| 0x403C021C || In || 60 || TEGRA_DC_EXT_SET_MODE2 ||
|-
| 0xC03C021D || Inout || 60 || TEGRA_DC_EXT_VALIDATE_MODE2 ||
|-
| 0xEF20021E || Inout || 12064 || TEGRA_DC_EXT_GET_MODE_DB2 ||
|-
| 0xC004021F || Inout || 4 || TEGRA_DC_EXT_GET_WINMASK ||
|-
|}

== /dev/nvcec-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010300 || In || 1 || ||
|-
| 0x40010301 || In || 1 || NVCEC_CTRL_ENABLE ||
|-
| 0x804C0302 || Out || 76 || NVCEC_CTRL_GET_PADDR ||
|-
| 0x40040303 || In || 4 || NVCEC_CTRL_SET_LADDR ||
|-
| 0xC04C0304 || Inout || 76 || NVCEC_CTRL_WRITE ||
|-
| 0xC04C0305 || Inout || 76 || NVCEC_CTRL_READ ||
|-
| 0x804C0306 || Out || 76 || NVCEC_CTRL_GET_CONNECTION_STATUS ||
|-
| 0x804C0307 || Out || 76 || NVCEC_CTRL_GET_WRITE_STATUS ||
|-
|}

== /dev/nvhdcp_up-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC4880401 || Inout || 1160 || ||
|-
| 0xC4880402 || Inout || 1160 || ||
|-
| 0x40010403 || In || 1 || ||
|-
|}

== /dev/nvdcutil-disp0, /dev/nvdcutil-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010501 || In || 1 || ||
|-
| 0x40010502 || In || 1 || ||
|-
| 0x42040503 || In || 1056 || ||
|-
| 0x803C0504 || Out || 60 || ||
|-
|}

== /dev/nvsched-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x00000601 || - || 0 || ||
|-
| 0x00000602 || - || 0 || ||
|-
| 0x40180603 || In || 1056 || ||
|-
| 0x40180604 || In || 60 || ||
|-
| 0x40080605 || In || 60 || ||
|-
| 0x80080606 || Out || 60 || ||
|-
| 0x80080607 || Out || 60 || ||
|-
| 0x40180608 || In || 24 || ||
|-
| 0x40100609 || In || 16 || ||
|-
| 0x4010060A || In || 16 || ||
|-
| 0x4008060B || In || 8 || ||
|-
| 0x8001060C || Out || 1 || ||
|-
| 0x8010060D || Out || 16 || ||
|-
| 0x400C060E || In || 12 || ||
|-
| 0x4008060F || In || 8 || ||
|-
| 0x40100610 || In || 16 || ||
|-
| 0x40100611 || In || 16 || ||
|-
|}

== /dev/nvhost-as-gpu ==
Each fd opened to this device creates an address space. An address space is then later bound with a channel.

Once a nvgpu channel has been bound to an address space it cannot be unbound. There is no support for allowing an nvgpu channel to change from one address space to another (or from one to none).

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40044101 || In || 4 || [[#NVGPU_AS_IOCTL_BIND_CHANNEL]] ||
|-
| 0xC0184102 || Inout || 24 || [[#NVGPU_AS_IOCTL_ALLOC_SPACE]] ||
|-
| 0xC0104103 || Inout || 16 || [[#NVGPU_AS_IOCTL_FREE_SPACE]] ||
|-
| 0xC0184104 || Inout || 24 || [[#NVGPU_AS_IOCTL_MAP_BUFFER]] ||
|-
| 0xC0084105 || Inout || 8 || [[#NVGPU_AS_IOCTL_UNMAP_BUFFER]] ||
|-
| 0xC0284106 || Inout || 40 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX]] ||
|-
| 0x40104107 || In || 16 || [[#NVGPU_AS_IOCTL_INITIALIZE]] ||
|-
| 0xC0404108 || Inout || 64 || [[#NVGPU_AS_IOCTL_GET_VA_REGIONS]] ||
|-
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_INITIALIZE_EX]] ||
|-
| 0xC0144114 || Inout || 20 || NVGPU_AS_IOCTL_REMAP ||
|}

=== NVGPU_AS_IOCTL_BIND_CHANNEL ===
Identical to Linux driver.

struct {
u32 __fd; // in
};

=== NVGPU_AS_IOCTL_ALLOC_SPACE ===
This one reserves pages in the device address space.

struct {
u32 __pages; // in
u32 __page_size; // in
u32 __flags; // in
u32 __pad;
union {
u64 __offset; // out
u64 __align; // in
};
};

=== NVGPU_AS_IOCTL_FREE_SPACE ===
struct {
u64 __offset; // in
u32 __pages; // in
u32 __page_size; // in
};

=== NVGPU_AS_IOCTL_MAP_BUFFER ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
u32 __flags; // in, 4 works
u32 __reserved;
u32 __nvmap_handle; // in
u32 __page_size; // inout, 0 means don't care
union {
u64 __offset; // out
u64 __align; // in
};
};

=== NVGPU_AS_IOCTL_MAP_BUFFER_EX ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
u32 __flags; // in, 4 works
u32 __kind; // in, -1 is default
u32 __nvmap_handle; // in
u32 __page_size; // inout, 0 means don't care
u64 __buffer_offset; // in
u64 __mapping_size; // in
u64 __offset; // out
};

=== NVGPU_AS_IOCTL_UNMAP_BUFFER ===
Doesn't do shit.

=== NVGPU_AS_IOCTL_INITIALIZE ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable).

struct {
u32 __big_page_size; // in (depends on GPU's available_big_page_sizes; 0=default)
s32 __as_fd; // in (ignored; passes 0)
u32 __flags; // in (ignored; passes 0)
u32 __reserved; // in (ignored; passes 0)
};

=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
Nintendo modified to get rid of pointer in struct.

struct va_region {
u64 __offset;
u32 __page_size;
u32 __reserved;
u64 __pages;
};

struct {
u64 __not_used; // (contained output user ptr on linux, ignored)
u32 __bufsize; // inout, forced to 2*sizeof(struct va_region)
u32 __reserved;
struct va_region __regions[2]; // out
};

=== NVGPU_AS_IOCTL_INITIALIZE_EX ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable) with extra params.

struct {
u32 __big_page_size; // in (depends on GPU's available_big_page_sizes; 0=default)
s32 __as_fd; // in (ignored; passes 0)
u32 __flags; // in (ignored; passes 0)
u32 __reserved; // in (ignored; passes 0)
u64 __unk0; // in
u64 __unk1; // in
u64 __unk2; // in
};

== /dev/nvhost-dbg-gpu ==
Not accessible, but there is code to invoke it.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40084401 || In || 8 || NVGPU_DBG_GPU_IOCTL_BIND_CHANNEL ||
|-
| 0xC0??4402 || Inout || Variable || NVGPU_DBG_GPU_IOCTL_REG_OPS ||
|-
| 0x40084403 || In || 8 || NVGPU_DBG_GPU_IOCTL_EVENTS_CTRL ||
|-
| 0x40044404 || In || 4 || NVGPU_DBG_GPU_IOCTL_POWERGATE ||
|-
| 0x40044405 || In || 4 || NVGPU_DBG_GPU_IOCTL_SMPC_CTXSW_MODE ||
|-
| 0xC0184407 || Inout || 24 || NVGPU_DBG_GPU_IOCTL_PERFBUF_MAP ||
|-
| 0x40084408 || In || 8 || NVGPU_DBG_GPU_IOCTL_PERFBUF_UNMAP ||
|-
| 0x40084409 || In || 8 || NVGPU_DBG_GPU_IOCTL_PC_SAMPLING ||
|-
| 0x4008440A || In || 8 || NVGPU_DBG_GPU_IOCTL_TIMEOUT ||
|-
| 0x8008440B || Out || 8 || NVGPU_DBG_GPU_IOCTL_GET_TIMEOUT ||
|-
| 0x8004440C || Out || 8 || NVGPU_DBG_GPU_IOCTL_GET_TIMEOUT ||
|-
| 0x0000440D || ? || ? || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT (uses Ioctl3)
|-
|}

== /dev/nvhost-ctrl-gpu ==
This device is for global (context independent) operations on the gpu.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80044701 || Out || 4 || NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE ||
|-
| 0x80284702 || Out || 40 || NVGPU_GPU_IOCTL_ZCULL_GET_INFO ||
|-
| 0x402C4703 || In || 44 || NVGPU_GPU_IOCTL_ZBC_SET_TABLE ||
|-
| 0xC0344704 || Inout || 52 || NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE ||
|-
| 0xC0B04705 || Inout || 176 || [[#NVGPU_GPU_IOCTL_GET_CHARACTERISTICS]] ||
|-
| 0xC0184706 || Inout || 24 || NVGPU_GPU_IOCTL_GET_TPC_MASKS ||
|-
| 0x40084707 || In || 8 || [[#NVGPU_GPU_IOCTL_FLUSH_L2]] ||
|-
| 0x4008470E || In || 8 || NVGPU_GPU_IOCTL_SET_MMUDEBUG_MODE ||
|-
| 0x4010470F || In || 16 || NVGPU_GPU_IOCTL_SET_SM_DEBUG_MODE ||
|-
| 0xC0084710 || Inout || 8 || NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE ||
|-
| 0x80084711 || Out || 8 || NVGPU_GPU_IOCTL_GET_TPC_EXCEPTION_EN_STATUS ||
|-
| 0x80084712 || Out || 8 || ||
|-
| 0xC0044713 || Inout || 4 || ||
|-
| 0x80084714 || Out || 8 || [[#NVGPU_GPU_IOCTL_GET_L2_STATE]] ||
|-
| 0x80044715 || Out || 4 || ||
|-
| 0x8018471A || Out || 24 || ||
|-
| 0xC008471B || Inout || 8 || NVGPU_GPU_IOCTL_GET_ERROR_CHANNEL_USER_DATA ||
|-
| 0xC010471C || Inout || 16 || NVGPU_GPU_IOCTL_GET_GPU_TIME ||
|-
| 0xC108471D || Inout || 264 || NVGPU_GPU_IOCTL_GET_CPU_TIME_CORRELATION_INFO ||
|}

=== NVGPU_GPU_IOCTL_GET_CHARACTERISTICS ===
Returns the GPU characteristics. Modified to return inline data instead of using a pointer.

struct __gpu_characteristics {
u32 __arch; // 0x120 (NVGPU_GPU_ARCH_GM200)
u32 __impl; // 0xB (NVGPU_GPU_IMPL_GM20B)
u32 __rev; // 0xA1 (Revision A1)
u32 __num_gpc; // 0x1
u64 __L2_cache_size; // 0x40000
u64 __on_board_video_memory_size; // 0x0 (not used)
u32 __num_tpc_per_gpc; // 0x2
u32 __bus_type; // 0x20 (NVGPU_GPU_BUS_TYPE_AXI)
u32 __big_page_size; // 0x20000
u32 __compression_page_size; // 0x20000
u32 __pde_coverage_bit_count; // 0x1B
u32 __available_big_page_sizes; // 0x30000
u32 __gpc_mask; // 0x1
u32 __sm_arch_sm_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 __sm_arch_spa_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 __sm_arch_warp_count; // 0x80
u32 __gpu_va_bit_count; // 0x28
u32 __reserved; // NULL
u64 __flags; // 0x55
u32 __twod_class; // 0x902D (FERMI_TWOD_A)
u32 __threed_class; // 0xB197 (MAXWELL_B)
u32 __compute_class; // 0xB1C0 (MAXWELL_COMPUTE_B)
u32 __gpfifo_class; // 0xB06F (MAXWELL_CHANNEL_GPFIFO_A)
u32 __inline_to_memory_class; // 0xA140 (KEPLER_INLINE_TO_MEMORY_B)
u32 __dma_copy_class; // 0xB0B5 (MAXWELL_DMA_COPY_A)
u32 __max_fbps_count; // 0x1
u32 __fbp_en_mask; // 0x0 (disabled)
u32 __max_ltc_per_fbp; // 0x2
u32 __max_lts_per_ltc; // 0x1
u32 __max_tex_per_tpc; // 0x0 (not supported)
u32 __max_gpc_count; // 0x1
u32 __rop_l2_en_mask_0; // 0x21D70 (fuse_status_opt_rop_l2_fbp_r)
u32 __rop_l2_en_mask_1; // 0x0
u64 __chipname; // 0x6230326D67 ("gm20b")
u64 __gr_compbit_store_base_hw; // 0x0 (not supported)
};

struct {
u64 __gpu_characteristics_buf_size; // in/out (must not be NULL, but gets overwritten with 0xA0=max_size)
u64 __gpu_characteristics_buf_addr; // in (ignored, but must not be NULL)
struct __gpu_characteristics gc; // out
};

=== NVGPU_GPU_IOCTL_FLUSH_L2 ===
Flushes the GPU L2 cache.

struct {
u32 __flush; // in (l2_flush | l2_invalidate << 1 | fb_flush << 2)
u32 __reserved; // in
};

=== NVGPU_GPU_IOCTL_GET_L2_STATE ===
Returns the GPU L2 cache state.

struct {
u32 __mask; // out (always 0x07)
u32 __flush; // out (active flush bit field)
};

== Channels ==
Channels are a concept for NVIDIA hardware blocks that share a common interface.

{| class="wikitable" border="1"
! Path || Name
|-
| /dev/nvhost-gpu ||
|-
| /dev/nvhost-vic || Video Image Compositor
|-
| /dev/nvhost-nvdec || Video Decoder
|-
| /dev/nvhost-nvjpg || JPEG Decoder
|}

== Channel Ioctls ==
{| class="wikitable" border="1"
! Value || Size || Description || Notes
|-
| 0xC0??0001 || Variable || NVHOST_IOCTL_CHANNEL_SUBMIT ||
|-
| 0xC0080002 || 8 || NVHOST_IOCTL_CHANNEL_GET_SYNCPOINT ||
|-
| 0xC0080003 || 8 || NVHOST_IOCTL_CHANNEL_GET_WAITBASE ||
|-
| 0xC0080004 || 8 || NVHOST_IOCTL_CHANNEL_SET_TIMEOUT_EX ||
|-
| 0x40040007 || 4 || ||
|-
| 0x40080008 || 8 || NVHOST_IOCTL_CHANNEL_SET_CLK_RATE ||
|-
| 0xC0??0009 || Variable || NVHOST_IOCTL_CHANNEL_MAP_BUFFER ||
|-
| 0xC0??000A || Variable || NVHOST_IOCTL_CHANNEL_UNMAP_BUFFER ||
|-
| 0x00000013 || 0 || ||
|- style="border-top: double"
| 0x40044801 || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD]] ||
|-
| 0x40044803 || 4 || NVGPU_IOCTL_CHANNEL_SET_TIMEOUT ||
|-
| 0x40084805 || 8 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO]] ||
|-
| 0xC0044807 || 4 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS ||
|-
| 0xC0??4808 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]] ||
|-
| 0xC0104809 || 16 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX]] ||
|-
| 0xC010480B || 16 || NVGPU_IOCTL_CHANNEL_ZCULL_BIND ||
|-
| 0xC018480C || 24 || [[#NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER]] ||
|-
| 0x4004480D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_PRIORITY]] ||
|-
| 0x0000480E || 0 || [[#NVGPU_IOCTL_CHANNEL_ENABLE]] ||
|-
| 0x0000480F || 0 || [[#NVGPU_IOCTL_CHANNEL_DISABLE]] ||
|-
| 0x00004810 || 0 || [[#NVGPU_IOCTL_CHANNEL_PREEMPT]] ||
|-
| 0x00004811 || 0 || [[#NVGPU_IOCTL_CHANNEL_FORCE_RESET]] ||
|-
| 0x40084812 || 8 || [[#NVGPU_IOCTL_CHANNEL_EVENTS_CTRL]] ||
|-
| 0xC0104813 || 16 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS_SNAPSHOT ||
|-
| 0x80804816 || 128 || NVGPU_IOCTL_CHANNEL_GET_ERROR_INFO || Only works when the channel is busy
|-
| 0xC0104817 || 16 || [[#NVGPU_IOCTL_CHANNEL_GET_ERROR]] ||
|-
| 0x40204818 || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]] ||
|-
| 0xC0??4819 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]] ||
|-
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]] ||
|-
|- style="border-top: double"
| 0x40084714 || 8 || NVGPU_IOCTL_CHANNEL_SET_USER_DATA || Sets an unknown user context address
|-
| 0x80084715 || 8 || NVGPU_IOCTL_CHANNEL_GET_USER_DATA || Gets an unknown user context address
|}

=== NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD ===
Binds a nvmap object to this channel. Identical to Linux driver.

struct {
u32 __nvmap_fd; // in
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO ===
Allocates gpfifo entries. Identical to Linux driver.

struct {
u32 __num_entries; // in
u32 __flags; // in
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO ===
Submits a gpfifo object. Modified to take inline entry objects instead of a pointer.

struct fence {
u32 __id;
u32 __value;
};

struct gpfifo_entry {
u32 __entry0;
u32 __entry1;
};

struct {
u64 __gpfifo; // in (pointer to gpfifo fence structs; ignored)
u32 __num_entries; // in (number of fence objects being submitted)
u32 __flags; // in
struct fence __fence_out; // out (returned new fence object for others to wait on)
struct gpfifo_entry __entries[]; // in (depends on __num_entries)
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX ===
Allocates a graphics context object. Modified to ignore object's ID.

struct {
u32 __class_num; // in (0x902D=2d, 0xB197=3d, 0xB1C0=compute, 0xA140=kepler, 0xB0B5=DMA, 0xB06F=channel_gpfifo)
u32 __flags; // in
u64 __obj_id; // out (ignored; used for FREE_OBJ_CTX ioctl, which is not supported)
};

=== NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER ===
Initializes the error notifier for this channel. Identical to Linux driver.

struct {
u64 __offset; // in
u64 __size; // in
u32 __mem; // in (nvmap object handle)
u32 __padding; // in
};

=== NVGPU_IOCTL_CHANNEL_SET_PRIORITY ===
Change channel's priority. Identical to Linux driver.

struct {
u32 __priority; // in (0x32 is low, 0x64 is medium and 0x96 is high)
};

=== NVGPU_IOCTL_CHANNEL_ENABLE ===
Enables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_DISABLE ===
Disables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_PREEMPT ===
Clears the FIFO pipe for this channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_FORCE_RESET ===
Forces the channel to reset. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_EVENTS_CTRL ===
Controls event notifications. Modified to take an additional argument.

struct {
u32 __cmd; // in (0=disable, 1=enable, 2=clear)
u32 __unk; // in (accepts 1 or 2)
};

=== NVGPU_IOCTL_CHANNEL_GET_ERROR ===
Returns the current error notification caught by the error notifier. Exclusive to the Switch.

struct {
u64 __timestamp; // out (nanoseconds since Jan. 1, 1970)
u32 __info32; // out (error code)
u16 __info16; // out (additional error info)
u16 __status; // inout (always 0xFFFF)
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY ===
Allocates gpfifo entries with additional parameters. Exclusive to the Switch.

struct {
u32 __num_entries; // in
u32 __flags; // in
u32 __unk0; // in (1 works)
u32 __unk1; // in
u32 __unk2; // in
u32 __unk3; // in
u32 __unk4; // in
u32 __unk5; // in
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX ===
Submits a gpfifo object (async version). Exclusive to the Switch.

struct {
u64 __gpfifo; // in (pointer to gpfifo fence structs; ignored)
u32 __num_entries; // in (number of fence objects being submitted)
u32 __flags; // in
struct fence __fence_out; // out (returned new fence object for others to wait on)
struct gpfifo_entry __entries[]; // in (depends on __num_entries)
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2 ===
Allocates gpfifo entries with additional parameters and returns a fence. Exclusive to the Switch.

struct {
u32 __num_entries; // in
u32 __flags; // in
u32 __unk0; // in (1 works)
struct fence __fence_out; // out
u32 __unk1; // in
u32 __unk2; // in
u32 __unk3; // in
};

= nvmemp =
NVIDIA memory profiler (this service is not available on retail units).

= nvdrvdbg =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenLog]]
|-
| 1 || [[#CloseLog]]
|-
| 2 || [[#ReadLog]]
|}

== OpenLog ==
Takes process handle. Returns an fd.

== CloseLog ==
Takes fd and closes it.

== ReadLog ==
Takes fd and reads log into a type-6 buffer.

= Errors =
Most nvidia driver commands return an error code apart from the normal return code.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Success
|-
| 1 || NotImplemented
|-
| 2 || NotSupported
|-
| 3 || NotInitialized
|-
| 4 || BadParameter
|-
| 5 || Timeout
|-
| 6 || InsufficientMemory
|-
| 7 || ReadOnlyAttribute
|-
| 8 || InvalidState
|-
| 9 || InvalidAddress
|-
| 0xA || InvalidSize
|-
| 0xB || BadValue
|-
| 0xD || AlreadyAllocated
|-
| 0xE || Busy
|-
| 0xF || ResourceError
|-
| 0x10 || CountMismatch
|-
| 0x1000 || SharedMemoryTooSmall
|-
| 0x30003 || FileOperationFailed
|-
| 0x3000F || IoctlFailed
|}

[[Category:Services]]

NV services

2017-09-30T01:12:57Z

Hthh:

The Switch makes use of a customized NVIDIA driver.

= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
Main NVIDIA driver service.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Open]]
|-
| 1 || [[#Ioctl]]
|-
| 2 || [[#Close]]
|-
| 3 || [[#Initialize]]
|-
| 4 || QueryEvent
|-
| 5 || MapSharedMem
|-
| 6 || GetStatus
|-
| 7 || ForceSetClientPID
|-
| 8 || SetClientPID
|-
| 9 || DumpGraphicsMemoryInfo
|}

== Open ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00100004
|-
| 1 || 0x00000008
|-
| 2-4 || Type 5 descriptor: Device path
|- style="border-top: double"
| 0-1 || "SFCI"
|-
| 2-3 || Cmd id (0)
|}

== Ioctl ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x11100004
|-
| 1 || 0x00000C0B
|-
| ? || Type 0x21 descriptor: Input buffer
|-
| ? || Type 0x22 descriptor: Output buffer
|- style="border-top: double"
| 0-1 || "SFCI"
|-
| 2-3 || Cmd id (1)
|-
| 4 || Device fd
|-
| 5 || Ioctl Cmd
|}

== Close ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x00000009
|- style="border-top: double"
| 0-1 || "SFCI"
|-
| 2-3 || Cmd id (2)
|-
| 4 || Device fd
|}

== Initialize ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x80000009
|-
| ? || Handle descriptor: Current process
|-
| ? || Handle descriptor: Shared memory mirror
|- style="border-top: double"
| 0-1 || "SFCI"
|-
| 2-3 || Cmd id (3)
|-
| 4 || Shared memory size
|}

Webkit applet creates the shared memory with perm = 0 and size 0x300000.

= Ioctls =
The ioctl number is generated with the following primitive (see Linux kernel):

#define _IOC(inout, group, num, len) \
(inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))

The following table contains known ioctls.

== /dev/nvhost-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]] ||
|-
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]] ||
|-
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]] ||
|-
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]] ||
|-
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]] ||
|-
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]] ||
|-
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]] ||
|-
| 0xC183001B || Inout || 387 || NVHOST_IOCTL_CTRL_GET_CONFIG ||
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_SIGNAL]] ||
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT]] ||
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC]] ||
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_REGISTER]] ||
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_UNREGISTER]] ||
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_EVENT_KILL]] ||
|}

=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __value; // out
};

=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
Identical to Linux driver.

struct {
u32 __id; // in
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __thresh; // in
s32 __timeout; // in
};

=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __lock; // in (0==unlock; 1==lock)
};

=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
Identical to Linux driver. Uses 32-bit version and doesn't work.

struct {
u32 __id; // in
u32 __num_offsets; // in
u32 __block_size; // in
u32 __offsets; // in
u32 __values; // in
u32 __write; // in
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __thresh; // in
s32 __timeout; // in
u32 __value; // out
};

=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
Identical to Linux driver.

struct {
u32 __id; // in
u32 __value; // out
};

=== NVHOST_IOCTL_CTRL_EVENT_SIGNAL ===
Signals an event. Exclusive to the Switch.

struct {
u32 __event_id; // in (ranges from 0x01 to 0x3F)
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT ===
Waits on an event. Exclusive to the Switch.

struct {
u32 __unk0; // in
u32 __unk1; // in
s32 __timeout; // in
u32 __event; // inout (in=event_id; out=result)
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC ===
Waits on an event (async version). Exclusive to the Switch.

struct {
u32 __unk0; // in
u32 __unk1; // in
s32 __timeout; // in
u32 __event; // inout (in=event_id; out=result)
};

=== NVHOST_IOCTL_CTRL_EVENT_REGISTER ===
Registers an event. Exclusive to the Switch.

struct {
u32 __event_id; // in (ranges from 0x01 to 0x3F)
};

=== NVHOST_IOCTL_CTRL_EVENT_UNREGISTER ===
Unregisters an event. Exclusive to the Switch.

struct {
u32 __event_id; // in (ranges from 0x01 to 0x3F)
};

=== NVHOST_IOCTL_CTRL_EVENT_KILL ===
Kills events. Exclusive to the Switch.

struct {
u64 __events; // in (64-bit flag where each bit represents one event)
};

== /dev/nvmap ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC0080101 || Inout || 8 || [[#NVMAP_IOC_CREATE]] ||
|-
| 0x00000102 || - || 0 || NVMAP_IOC_CLAIM || Returns NotSupported
|-
| 0xC0080103 || Inout || 8 || [[#NVMAP_IOC_FROM_ID]] ||
|-
| 0xC0200104 || Inout || 32 || [[#NVMAP_IOC_ALLOC]] ||
|-
| 0xC0180105 || Inout || 24 || [[#NVMAP_IOC_FREE]] ||
|-
| 0xC0280106 || Inout || 40 || NVMAP_IOC_MMAP || Returns NotSupported
|-
| 0xC0280107 || Inout || 40 || NVMAP_IOC_WRITE || Returns NotSupported
|-
| 0xC0280108 || Inout || 40 || NVMAP_IOC_READ || Returns NotSupported
|-
| 0xC00C0109 || Inout || 12 || [[#NVMAP_IOC_PARAM]] ||
|-
| 0xC010010A || Inout || 16 || NVMAP_IOC_PIN_MULT || Returns NotSupported
|-
| 0xC010010B || Inout || 16 || NVMAP_IOC_UNPIN_MULT || Returns NotSupported
|-
| 0xC008010C || Inout || 8 || NVMAP_IOC_CACHE || Returns NotSupported
|-
| 0xC004010D || Inout || 4 || || Returns NotSupported
|-
| 0xC008010E || Inout || 8 || [[#NVMAP_IOC_GET_ID]] ||
|-
| 0xC004010F || Inout || 4 || || Returns NotSupported
|-
| 0x40040110 || In || 4 || || Returns NotSupported
|-
| 0x00000111 || - || 0 || || Returns NotSupported
|}

=== NVMAP_IOC_CREATE ===
Creates an nvmap object. Identical to Linux driver.

struct {
u32 __size; // in
u32 __handle; // out
};

=== NVMAP_IOC_FROM_ID ===
Get handle to an existing nvmap object. Identical to Linux driver.

struct {
u32 __id; // in
u32 __handle; // out
};

=== NVMAP_IOC_ALLOC ===
Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.

struct {
u32 __handle; // in
u32 __heapmask; // in
u32 __flags; // in (0=read-only, 1=read-write)
u32 __align; // in
u8 __kind; // in
u8 __pad[7];
u64 __addr; // in
};

=== NVMAP_IOC_FREE ===
This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.

struct {
u32 __handle; // in
u32 __pad;
u64 __refcount; // out
u32 __size; // out
u32 __flags; // out, 1=NOT_FREED_YET
};

=== NVMAP_IOC_PARAM ===
Returns info about a nvmap object. Identical to Linux driver, but extended with further params.

struct {
u32 __handle; // in
u32 __param; // in, 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
u32 __result; // out
};

=== NVMAP_IOC_GET_ID ===
Returns an id for a nvmap object. Identical to Linux driver.

struct {
u32 __id; // out
u32 __handle; // in
};

== /dev/nvdisp-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80040212 || Out || 4 || TEGRA_DC_EXT_CONTROL_GET_NUM_OUTPUTS ||
|-
| 0xC0140213 || Inout || 20 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_PROPERTIES ||
|-
| 0xC1100214 || Inout || 272 || TEGRA_DC_EXT_CONTROL_GET_OUTPUT_EDID ||
|-
| 0xC0040216 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT0 ||
|-
| 0xC0040217 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT1 ||
|-
| 0xC0100218 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT2 ||
|-
| 0xC0100219 || Inout || 16 || TEGRA_DC_EXT_CONTROL_SET_EVENT3 ||
|-
| 0xC0040220 || Inout || 4 || TEGRA_DC_EXT_CONTROL_SET_EVENT4 ||
|-
|}

== /dev/nvdisp-disp0, /dev/nvdisp-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40040201 || In || 4 || TEGRA_DC_EXT_GET_WINDOW ||
|-
| 0x40040202 || In || 4 || TEGRA_DC_EXT_PUT_WINDOW ||
|-
| 0xC4C80203 || In || 1224 || TEGRA_DC_EXT_FLIP ||
|-
| 0x80380204 || Out || 56 || TEGRA_DC_EXT_GET_MODE ||
|-
| 0x40380205 || Out || 56 || TEGRA_DC_EXT_SET_MODE ||
|-
| 0x430C0206 || In || 780 || TEGRA_DC_EXT_SET_LUT ||
|-
| 0x40010207 || In || 1 || TEGRA_DC_EXT_ENABLE_DISABLE_CRC ||
|-
| 0x80040208 || Out || 4 || TEGRA_DC_EXT_GET_CRC ||
|-
| 0x80040209 || Out || 4 || TEGRA_DC_EXT_GET_HEAD_STATUS ||
|-
| 0xC038020A || Inout || 56 || TEGRA_DC_EXT_VALIDATE_MODE ||
|-
| 0x4018020B || In || 24 || TEGRA_DC_EXT_SET_CSC ||
|-
| 0xC004020C || Inout || 4 || TEGRA_DC_EXT_GET_VBLANK_SYNCPT ||
|-
| 0x8040020D || Out || 64 || TEGRA_DC_EXT_GET_UNDERFLOWS ||
|-
| 0xC99A020E || Inout || 2458 || TEGRA_DC_EXT_SET_CMU ||
|-
| 0xC004020F || Inout || 4 || TEGRA_DC_EXT_DPMS ||
|-
| 0x80600210 || Out || 96 || TEGRA_DC_EXT_GET_AVI_INFOFRAME ||
|-
| 0x40600211 || In || 96 || TEGRA_DC_EXT_SET_AVI_INFOFRAME ||
|-
| 0xEBFC0215 || Inout || 11260 || TEGRA_DC_EXT_GET_MODE_DB ||
|-
| 0xC003021A || Inout || 3 || TEGRA_DC_EXT_PANEL_GET_VENDOR_ID ||
|-
| 0x803C021B || Out || 60 || TEGRA_DC_EXT_GET_MODE2 ||
|-
| 0x403C021C || In || 60 || TEGRA_DC_EXT_SET_MODE2 ||
|-
| 0xC03C021D || Inout || 60 || TEGRA_DC_EXT_VALIDATE_MODE2 ||
|-
| 0xEF20021E || Inout || 12064 || TEGRA_DC_EXT_GET_MODE_DB2 ||
|-
| 0xC004021F || Inout || 4 || TEGRA_DC_EXT_GET_WINMASK ||
|-
|}

== /dev/nvcec-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010300 || In || 1 || ||
|-
| 0x40010301 || In || 1 || NVCEC_CTRL_ENABLE ||
|-
| 0x804C0302 || Out || 76 || NVCEC_CTRL_GET_PADDR ||
|-
| 0x40040303 || In || 4 || NVCEC_CTRL_SET_LADDR ||
|-
| 0xC04C0304 || Inout || 76 || NVCEC_CTRL_WRITE ||
|-
| 0xC04C0305 || Inout || 76 || NVCEC_CTRL_READ ||
|-
| 0x804C0306 || Out || 76 || NVCEC_CTRL_GET_CONNECTION_STATUS ||
|-
| 0x804C0307 || Out || 76 || NVCEC_CTRL_GET_WRITE_STATUS ||
|-
|}

== /dev/nvhdcp_up-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0xC4880401 || Inout || 1160 || ||
|-
| 0xC4880402 || Inout || 1160 || ||
|-
| 0x40010403 || In || 1 || ||
|-
|}

== /dev/nvdcutil-disp0, /dev/nvdcutil-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40010501 || In || 1 || ||
|-
| 0x40010502 || In || 1 || ||
|-
| 0x42040503 || In || 1056 || ||
|-
| 0x803C0504 || Out || 60 || ||
|-
|}

== /dev/nvsched-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x00000601 || - || 0 || ||
|-
| 0x00000602 || - || 0 || ||
|-
| 0x40180603 || In || 1056 || ||
|-
| 0x40180604 || In || 60 || ||
|-
| 0x40080605 || In || 60 || ||
|-
| 0x80080606 || Out || 60 || ||
|-
| 0x80080607 || Out || 60 || ||
|-
| 0x40180608 || In || 24 || ||
|-
| 0x40100609 || In || 16 || ||
|-
| 0x4010060A || In || 16 || ||
|-
| 0x4008060B || In || 8 || ||
|-
| 0x8001060C || Out || 1 || ||
|-
| 0x8010060D || Out || 16 || ||
|-
| 0x400C060E || In || 12 || ||
|-
| 0x4008060F || In || 8 || ||
|-
| 0x40100610 || In || 16 || ||
|-
| 0x40100611 || In || 16 || ||
|-
|}

== /dev/nvhost-as-gpu ==
Each fd opened to this device creates an address space. An address space is then later bound with a channel.

Once a nvgpu channel has been bound to an address space it cannot be unbound. There is no support for allowing an nvgpu channel to change from one address space to another (or from one to none).

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40044101 || In || 4 || [[#NVGPU_AS_IOCTL_BIND_CHANNEL]] ||
|-
| 0xC0184102 || Inout || 24 || [[#NVGPU_AS_IOCTL_ALLOC_SPACE]] ||
|-
| 0xC0104103 || Inout || 16 || [[#NVGPU_AS_IOCTL_FREE_SPACE]] ||
|-
| 0xC0184104 || Inout || 24 || [[#NVGPU_AS_IOCTL_MAP_BUFFER]] ||
|-
| 0xC0084105 || Inout || 8 || [[#NVGPU_AS_IOCTL_UNMAP_BUFFER]] ||
|-
| 0xC0284106 || Inout || 40 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX]] ||
|-
| 0x40104107 || In || 16 || [[#NVGPU_AS_IOCTL_INITIALIZE]] ||
|-
| 0xC0404108 || Inout || 64 || [[#NVGPU_AS_IOCTL_GET_VA_REGIONS]] ||
|-
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_INITIALIZE_EX]] ||
|-
| 0xC0144114 || Inout || 20 || NVGPU_AS_IOCTL_REMAP ||
|}

=== NVGPU_AS_IOCTL_BIND_CHANNEL ===
Identical to Linux driver.

struct {
u32 __fd; // in
};

=== NVGPU_AS_IOCTL_ALLOC_SPACE ===
This one reserves pages in the device address space.

struct {
u32 __pages; // in
u32 __page_size; // in
u32 __flags; // in
u32 __pad;
union {
u64 __offset; // out
u64 __align; // in
};
};

=== NVGPU_AS_IOCTL_FREE_SPACE ===
struct {
u64 __offset; // in
u32 __pages; // in
u32 __page_size; // in
};

=== NVGPU_AS_IOCTL_MAP_BUFFER ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
u32 __flags; // in, 4 works
u32 __reserved;
u32 __nvmap_handle; // in
u32 __page_size; // inout, 0 means don't care
union {
u64 __offset; // out
u64 __align; // in
};
};

=== NVGPU_AS_IOCTL_MAP_BUFFER_EX ===
Map a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
u32 __flags; // in, 4 works
u32 __kind; // in, -1 is default
u32 __nvmap_handle; // in
u32 __page_size; // inout, 0 means don't care
u64 __buffer_offset; // in
u64 __mapping_size; // in
u64 __offset; // out
};

=== NVGPU_AS_IOCTL_UNMAP_BUFFER ===
Doesn't do shit.

=== NVGPU_AS_IOCTL_INITIALIZE ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable).

struct {
u32 __big_page_size; // in (depends on GPU's available_big_page_sizes; 0=default)
s32 __as_fd; // in (ignored; passes 0)
u32 __flags; // in (ignored; passes 0)
u32 __reserved; // in (ignored; passes 0)
};

=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
Nintendo modified to get rid of pointer in struct.

struct va_region {
u64 __offset;
u32 __page_size;
u32 __reserved;
u64 __pages;
};

struct {
u64 __not_used; // (contained output user ptr on linux, ignored)
u32 __bufsize; // inout, forced to 2*sizeof(struct va_region)
u32 __reserved;
struct va_region __regions[2]; // out
};

=== NVGPU_AS_IOCTL_INITIALIZE_EX ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable) with extra params.

struct {
u32 __big_page_size; // in (depends on GPU's available_big_page_sizes; 0=default)
s32 __as_fd; // in (ignored; passes 0)
u32 __flags; // in (ignored; passes 0)
u32 __reserved; // in (ignored; passes 0)
u64 __unk0; // in
u64 __unk1; // in
u64 __unk2; // in
};

== /dev/nvhost-dbg-gpu ==
Not accessible, but there is code to invoke it.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x40084401 || In || 8 || NVGPU_DBG_GPU_IOCTL_BIND_CHANNEL ||
|-
| 0xC0??4402 || Inout || Variable || NVGPU_DBG_GPU_IOCTL_REG_OPS ||
|-
| 0x40084403 || In || 8 || NVGPU_DBG_GPU_IOCTL_EVENTS_CTRL ||
|-
| 0x40044404 || In || 4 || NVGPU_DBG_GPU_IOCTL_POWERGATE ||
|-
| 0x40044405 || In || 4 || NVGPU_DBG_GPU_IOCTL_SMPC_CTXSW_MODE ||
|-
| 0xC0184407 || Inout || 24 || NVGPU_DBG_GPU_IOCTL_PERFBUF_MAP ||
|-
| 0x40084408 || In || 8 || NVGPU_DBG_GPU_IOCTL_PERFBUF_UNMAP ||
|-
| 0x40084409 || In || 8 || NVGPU_DBG_GPU_IOCTL_PC_SAMPLING ||
|-
| 0x4008440A || In || 8 || NVGPU_DBG_GPU_IOCTL_TIMEOUT ||
|-
| 0x8008440B || Out || 8 || NVGPU_DBG_GPU_IOCTL_GET_TIMEOUT ||
|-
| 0x8004440C || Out || 8 || NVGPU_DBG_GPU_IOCTL_GET_TIMEOUT ||
|-
|}

== /dev/nvhost-ctrl-gpu ==
This device is for global (context independent) operations on the gpu.

{| class="wikitable" border="1"
! Value || Direction || Size || Description || Notes
|-
| 0x80044701 || Out || 4 || NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE ||
|-
| 0x80284702 || Out || 40 || NVGPU_GPU_IOCTL_ZCULL_GET_INFO ||
|-
| 0x402C4703 || In || 44 || NVGPU_GPU_IOCTL_ZBC_SET_TABLE ||
|-
| 0xC0344704 || Inout || 52 || NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE ||
|-
| 0xC0B04705 || Inout || 176 || [[#NVGPU_GPU_IOCTL_GET_CHARACTERISTICS]] ||
|-
| 0xC0184706 || Inout || 24 || NVGPU_GPU_IOCTL_GET_TPC_MASKS ||
|-
| 0x40084707 || In || 8 || [[#NVGPU_GPU_IOCTL_FLUSH_L2]] ||
|-
| 0x4008470E || In || 8 || NVGPU_GPU_IOCTL_SET_MMUDEBUG_MODE ||
|-
| 0x4010470F || In || 16 || NVGPU_GPU_IOCTL_SET_SM_DEBUG_MODE ||
|-
| 0xC0084710 || Inout || 8 || NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE ||
|-
| 0x80084711 || Out || 8 || NVGPU_GPU_IOCTL_GET_TPC_EXCEPTION_EN_STATUS ||
|-
| 0x80084712 || Out || 8 || ||
|-
| 0xC0044713 || Inout || 4 || ||
|-
| 0x80084714 || Out || 8 || [[#NVGPU_GPU_IOCTL_GET_L2_STATE]] ||
|-
| 0x80044715 || Out || 4 || ||
|-
| 0x8018471A || Out || 24 || ||
|-
| 0xC008471B || Inout || 8 || NVGPU_GPU_IOCTL_GET_ERROR_CHANNEL_USER_DATA ||
|-
| 0xC010471C || Inout || 16 || NVGPU_GPU_IOCTL_GET_GPU_TIME ||
|-
| 0xC108471D || Inout || 264 || NVGPU_GPU_IOCTL_GET_CPU_TIME_CORRELATION_INFO ||
|}

=== NVGPU_GPU_IOCTL_GET_CHARACTERISTICS ===
Returns the GPU characteristics. Modified to return inline data instead of using a pointer.

struct __gpu_characteristics {
u32 __arch; // 0x120 (NVGPU_GPU_ARCH_GM200)
u32 __impl; // 0xB (NVGPU_GPU_IMPL_GM20B)
u32 __rev; // 0xA1 (Revision A1)
u32 __num_gpc; // 0x1
u64 __L2_cache_size; // 0x40000
u64 __on_board_video_memory_size; // 0x0 (not used)
u32 __num_tpc_per_gpc; // 0x2
u32 __bus_type; // 0x20 (NVGPU_GPU_BUS_TYPE_AXI)
u32 __big_page_size; // 0x20000
u32 __compression_page_size; // 0x20000
u32 __pde_coverage_bit_count; // 0x1B
u32 __available_big_page_sizes; // 0x30000
u32 __gpc_mask; // 0x1
u32 __sm_arch_sm_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 __sm_arch_spa_version; // 0x503 (Maxwell Generation 5.0.3?)
u32 __sm_arch_warp_count; // 0x80
u32 __gpu_va_bit_count; // 0x28
u32 __reserved; // NULL
u64 __flags; // 0x55
u32 __twod_class; // 0x902D (FERMI_TWOD_A)
u32 __threed_class; // 0xB197 (MAXWELL_B)
u32 __compute_class; // 0xB1C0 (MAXWELL_COMPUTE_B)
u32 __gpfifo_class; // 0xB06F (MAXWELL_CHANNEL_GPFIFO_A)
u32 __inline_to_memory_class; // 0xA140 (KEPLER_INLINE_TO_MEMORY_B)
u32 __dma_copy_class; // 0xB0B5 (MAXWELL_DMA_COPY_A)
u32 __max_fbps_count; // 0x1
u32 __fbp_en_mask; // 0x0 (disabled)
u32 __max_ltc_per_fbp; // 0x2
u32 __max_lts_per_ltc; // 0x1
u32 __max_tex_per_tpc; // 0x0 (not supported)
u32 __max_gpc_count; // 0x1
u32 __rop_l2_en_mask_0; // 0x21D70 (fuse_status_opt_rop_l2_fbp_r)
u32 __rop_l2_en_mask_1; // 0x0
u64 __chipname; // 0x6230326D67 ("gm20b")
u64 __gr_compbit_store_base_hw; // 0x0 (not supported)
};

struct {
u64 __gpu_characteristics_buf_size; // in/out (must not be NULL, but gets overwritten with 0xA0=max_size)
u64 __gpu_characteristics_buf_addr; // in (ignored, but must not be NULL)
struct __gpu_characteristics gc; // out
};

=== NVGPU_GPU_IOCTL_FLUSH_L2 ===
Flushes the GPU L2 cache.

struct {
u32 __flush; // in (l2_flush | l2_invalidate << 1 | fb_flush << 2)
u32 __reserved; // in
};

=== NVGPU_GPU_IOCTL_GET_L2_STATE ===
Returns the GPU L2 cache state.

struct {
u32 __mask; // out (always 0x07)
u32 __flush; // out (active flush bit field)
};

== Channels ==
Channels are a concept for NVIDIA hardware blocks that share a common interface.

{| class="wikitable" border="1"
! Path || Name
|-
| /dev/nvhost-gpu ||
|-
| /dev/nvhost-vic || Video Image Compositor
|-
| /dev/nvhost-nvdec || Video Decoder
|-
| /dev/nvhost-nvjpg || JPEG Decoder
|}

== Channel Ioctls ==
{| class="wikitable" border="1"
! Value || Size || Description || Notes
|-
| 0xC0??0001 || Variable || NVHOST_IOCTL_CHANNEL_SUBMIT ||
|-
| 0xC0080002 || 8 || NVHOST_IOCTL_CHANNEL_GET_SYNCPOINT ||
|-
| 0xC0080003 || 8 || NVHOST_IOCTL_CHANNEL_GET_WAITBASE ||
|-
| 0xC0080004 || 8 || NVHOST_IOCTL_CHANNEL_SET_TIMEOUT_EX ||
|-
| 0x40040007 || 4 || ||
|-
| 0x40080008 || 8 || NVHOST_IOCTL_CHANNEL_SET_CLK_RATE ||
|-
| 0xC0??0009 || Variable || NVHOST_IOCTL_CHANNEL_MAP_BUFFER ||
|-
| 0xC0??000A || Variable || NVHOST_IOCTL_CHANNEL_UNMAP_BUFFER ||
|-
| 0x00000013 || 0 || ||
|- style="border-top: double"
| 0x40044801 || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD]] ||
|-
| 0x40044803 || 4 || NVGPU_IOCTL_CHANNEL_SET_TIMEOUT ||
|-
| 0x40084805 || 8 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO]] ||
|-
| 0xC0044807 || 4 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS ||
|-
| 0xC0??4808 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]] ||
|-
| 0xC0104809 || 16 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX]] ||
|-
| 0xC010480B || 16 || NVGPU_IOCTL_CHANNEL_ZCULL_BIND ||
|-
| 0xC018480C || 24 || [[#NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER]] ||
|-
| 0x4004480D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_PRIORITY]] ||
|-
| 0x0000480E || 0 || [[#NVGPU_IOCTL_CHANNEL_ENABLE]] ||
|-
| 0x0000480F || 0 || [[#NVGPU_IOCTL_CHANNEL_DISABLE]] ||
|-
| 0x00004810 || 0 || [[#NVGPU_IOCTL_CHANNEL_PREEMPT]] ||
|-
| 0x00004811 || 0 || [[#NVGPU_IOCTL_CHANNEL_FORCE_RESET]] ||
|-
| 0x40084812 || 8 || [[#NVGPU_IOCTL_CHANNEL_EVENTS_CTRL]] ||
|-
| 0xC0104813 || 16 || NVGPU_IOCTL_CHANNEL_CYCLE_STATS_SNAPSHOT ||
|-
| 0x80804816 || 128 || NVGPU_IOCTL_CHANNEL_GET_ERROR_INFO || Only works when the channel is busy
|-
| 0xC0104817 || 16 || [[#NVGPU_IOCTL_CHANNEL_GET_ERROR]] ||
|-
| 0x40204818 || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]] ||
|-
| 0xC0??4819 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]] ||
|-
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]] ||
|-
|- style="border-top: double"
| 0x40084714 || 8 || NVGPU_IOCTL_CHANNEL_SET_USER_DATA || Sets an unknown user context address
|-
| 0x80084715 || 8 || NVGPU_IOCTL_CHANNEL_GET_USER_DATA || Gets an unknown user context address
|}

=== NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD ===
Binds a nvmap object to this channel. Identical to Linux driver.

struct {
u32 __nvmap_fd; // in
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO ===
Allocates gpfifo entries. Identical to Linux driver.

struct {
u32 __num_entries; // in
u32 __flags; // in
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO ===
Submits a gpfifo object. Modified to take inline entry objects instead of a pointer.

struct fence {
u32 __id;
u32 __value;
};

struct gpfifo_entry {
u32 __entry0;
u32 __entry1;
};

struct {
u64 __gpfifo; // in (pointer to gpfifo fence structs; ignored)
u32 __num_entries; // in (number of fence objects being submitted)
u32 __flags; // in
struct fence __fence_out; // out (returned new fence object for others to wait on)
struct gpfifo_entry __entries[]; // in (depends on __num_entries)
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX ===
Allocates a graphics context object. Modified to ignore object's ID.

struct {
u32 __class_num; // in (0x902D=2d, 0xB197=3d, 0xB1C0=compute, 0xA140=kepler, 0xB0B5=DMA, 0xB06F=channel_gpfifo)
u32 __flags; // in
u64 __obj_id; // out (ignored; used for FREE_OBJ_CTX ioctl, which is not supported)
};

=== NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER ===
Initializes the error notifier for this channel. Identical to Linux driver.

struct {
u64 __offset; // in
u64 __size; // in
u32 __mem; // in (nvmap object handle)
u32 __padding; // in
};

=== NVGPU_IOCTL_CHANNEL_SET_PRIORITY ===
Change channel's priority. Identical to Linux driver.

struct {
u32 __priority; // in (0x32 is low, 0x64 is medium and 0x96 is high)
};

=== NVGPU_IOCTL_CHANNEL_ENABLE ===
Enables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_DISABLE ===
Disables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_PREEMPT ===
Clears the FIFO pipe for this channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_FORCE_RESET ===
Forces the channel to reset. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_EVENTS_CTRL ===
Controls event notifications. Modified to take an additional argument.

struct {
u32 __cmd; // in (0=disable, 1=enable, 2=clear)
u32 __unk; // in (accepts 1 or 2)
};

=== NVGPU_IOCTL_CHANNEL_GET_ERROR ===
Returns the current error notification caught by the error notifier. Exclusive to the Switch.

struct {
u64 __timestamp; // out (nanoseconds since Jan. 1, 1970)
u32 __info32; // out (error code)
u16 __info16; // out (additional error info)
u16 __status; // inout (always 0xFFFF)
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY ===
Allocates gpfifo entries with additional parameters. Exclusive to the Switch.

struct {
u32 __num_entries; // in
u32 __flags; // in
u32 __unk0; // in (1 works)
u32 __unk1; // in
u32 __unk2; // in
u32 __unk3; // in
u32 __unk4; // in
u32 __unk5; // in
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX ===
Submits a gpfifo object (async version). Exclusive to the Switch.

struct {
u64 __gpfifo; // in (pointer to gpfifo fence structs; ignored)
u32 __num_entries; // in (number of fence objects being submitted)
u32 __flags; // in
struct fence __fence_out; // out (returned new fence object for others to wait on)
struct gpfifo_entry __entries[]; // in (depends on __num_entries)
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2 ===
Allocates gpfifo entries with additional parameters and returns a fence. Exclusive to the Switch.

struct {
u32 __num_entries; // in
u32 __flags; // in
u32 __unk0; // in (1 works)
struct fence __fence_out; // out
u32 __unk1; // in
u32 __unk2; // in
u32 __unk3; // in
};

= nvmemp =
NVIDIA memory profiler (this service is not available on retail units).

= nvdrvdbg =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenLog]]
|-
| 1 || [[#CloseLog]]
|-
| 2 || [[#ReadLog]]
|}

== OpenLog ==
Takes process handle. Returns an fd.

== CloseLog ==
Takes fd and closes it.

== ReadLog ==
Takes fd and reads log into a type-6 buffer.

= Errors =
Most nvidia driver commands return an error code apart from the normal return code.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Success
|-
| 1 || NotImplemented
|-
| 2 || NotSupported
|-
| 3 || NotInitialized
|-
| 4 || BadParameter
|-
| 5 || Timeout
|-
| 6 || InsufficientMemory
|-
| 7 || ReadOnlyAttribute
|-
| 8 || InvalidState
|-
| 9 || InvalidAddress
|-
| 0xA || InvalidSize
|-
| 0xB || BadValue
|-
| 0xD || AlreadyAllocated
|-
| 0xE || Busy
|-
| 0xF || ResourceError
|-
| 0x10 || CountMismatch
|-
| 0x1000 || SharedMemoryTooSmall
|-
| 0x30003 || FileOperationFailed
|-
| 0x3000F || IoctlFailed
|}

[[Category:Services]]

HIPC

2017-09-25T10:25:13Z

Hthh:

== IPC Command Structure ==
This is an array of u32's, usually located in [[Thread Local Storage]].

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 15-0 || Type. 4=Request, 5=Control
|-
| 0 || 19-16 || Number of buf X descriptors (each: 2 words).
|-
| 0 || 23-20 || Number of buf A descriptors (each: 3 words).
|-
| 0 || 27-24 || Number of buf B descriptors (each: 3 words).
|-
| 0 || 31-28 || Number of buf W desciptors (each: 3 words), never observed.
|-
| 1 || 9-0 || Size of raw data section in u32s.
|-
| 1 || 13-10 || Flags for buf C descriptor.
|-
| 1 || 31 || Enable handle descriptor.
|-
| ... || || [[#Handle descriptor|Handle descriptor]], if enabled.
|-
| ... || || [[#Buffer descriptor X "Pointer"|Buf X descriptors]], each one 2 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf A descriptors]], each one 3 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf B descriptors]], each one 3 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Type W descriptors]], each one 3 words.
|-
| ... || || [[#Raw_data_section|Raw data section]] (including padding before and after aligned data section).
|-
| ... || || [[#Buffer descriptor C "ReceiveList"|Buf C descriptors]], each one 2 words.
|}

=== Handle descriptor ===
There can only be one of this descriptor type. It is enabled by bit31 of the second word.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 0 || Send current PID.
|-
| 0 || 4-1 || Number of handles to copy
|-
| 0 || 8-5 || Number of handles to move
|-
| ... || || 8-byte PID if enabled
|-
| ... || || Handles to copy
|-
| ... || || Handles to move
|}

=== Buffer descriptor X "Pointer" ===
This one is packed even worse than A, they inserted the bit38-36 of the address ''on top'' of the counter field.

Officially, the counter is known as "receive index". This one writes to the buffer described in the ReceiveList.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 5-0 || Bits 5-0 of counter.
|-
| 0 || 8-6 || Bit 38-36 of address.
|-
| 0 || 11-9 || Bits 11-9 of counter.
|-
| 0 || 15-12 || Bit 35-32 of address.
|-
| 0 || 31-16 || Size
|-
| 1 || || Lower 32-bits of address.
|}

=== Buffer descriptor A/B/W "Send"/"Receive"/"Exchange" ===
This packing is so unnecessarily complex.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of size.
|-
| 1 || || Lower 32-bits of address.
|-
| 2 || 1-0 || Flags. Always set to 0, 1 or 3. Determines what [[SVC|MemoryState]] to use with the mapped memory in the sysmodule.
|-
| 2 || 4-2 || Bit 38-36 of address.
|-
| 2 || 27-24 || Bit 35-32 of size.
|-
| 2 || 31-28 || Bit 35-32 of address.
|}

=== Buffer descriptor C "ReceiveList" ===
There's a 4-bit flag in the main header controlling the behavior of C descriptors.

If it has value 0, the C descriptor functionality is disabled. If it has value 1, there is no C descriptor. If it has value 2, there is a single C descriptor.

Otherwise it has (flag-2) C descriptors.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of address.
|-
| 1 || 15-0 || Rest of address.
|-
| 1 || 31-16 || Size
|}

=== IPC buffers ===
Buffer descriptor A/B/... map memory into the sysmodule process. For the mapped memory in the sysmodule the permissions are: desc-A = R--, desc-B = RW-. The buffer is automatically unmapped while the kernel handles the cmdreply, the sysmodule doesn't need to specify anything in the cmdreply to trigger this.

This memory is mapped in the sysmodule to the same vaddr from the original user-process cmd-request, except with with bits >=(~28(?)) changed to a different ASLR'd region.

== Raw data section ==

[[File:Ipc msg buffer type a example.png|thumb|An example of an IPC message with a type 0xA buffer in it. Red is headers/descriptors, yellow is padding, and blue is data/buffer lengths. Note that the size of the u16 array for type A lengths is padded to fill up a whole word.]]

{| class="wikitable" border="1"
! Word || Description
|-
| ... || Padding to align to 16 bytes.
|-
| ... || If sent to an object domain, a [[#Domain_message|domain message]], otherwise a [[#Data payload|data payload]]
|-
| ... || Padding
|-
| ... || Buffer type 0xA lengths (u16 array)
|}

The total amount of padding within the raw data section is always 0x10 bytes. This means that if no padding is required before the message, there will be 0x10 bytes of padding after the message (before the buffer type 0xA lengths).

=== Domain message ===
This header is used to wrap up requests sent to domains instead of sessions.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 7-0 || Command. 1=send message, 2=close virtual handle
|-
| 0 || 31-16 || Length of [[IPC_Marshalling#Data_payload|data payload]] in bytes.
|-
| 1 || || Object ID (from cmd 0 in [[IPC_Marshalling#Control|Control]]).
|-
| 2
|rowspan="2"|
|rowspan="2"| Padding to align to u64
|-
| 3
|-
| 4... || || [[#Data payload|Data payload]]
|}

=== Data payload ===

This is an array of u32's, but individual parameters are generally stored as u64's.

{| class="wikitable" border="1"
! Word || Description
|-
| 0 || Magic ("SFCI" for requests, "SFCO" for responses) as u64.
|-
| 2 || Command id as u64 for requests, [[Error_codes|error code]] as u64 for responses.
|-
| 4... || Input parameters or return values
|}

Many messages which require the PID also require a placeholder u64 value passed in the input parameters. In these cases the OverwriteClientProcessId method is called to replace the value before it is used.

== Official marshalling code ==
The official marshalling function takes an array of (buf_ptr, size) pairs and a type-field for each such pair.

Bitmask 0x10 seems to indicate null-terminated strings, but that flag is ignored by the marshalling code.

{| class="wikitable" border="1"
! Type Mask || Description || Direction
|-
| 4 + 1 || Creates a A descriptor with flags=0. || In
|-
| 0x40 + 4 + 1 || Creates a A descriptor with flags=1. || In
|-
| 0x80 + 4 + 1 || Creates a A descriptor with flags=3. || In
|-
| 4 + 2 || Creates a B descriptor with flags=0. || Out
|-
| 0x40 + 4 + 2 || Creates a B descriptor with flags=1. || Out
|-
| 0x80 + 4 + 2 || Creates a B descriptor with flags=3. || Out
|-
| 8 + 1 || Creates an X descriptor || In
|-
| 8 + 2 || Creates a C descriptor, and writes the u16 size to an offset into raw data. || Out
|-
| 0x10 + 8 + 2 || Creates a C descriptor || Out
|-
| 0x20 + 1 || Creates both an A and X descriptor || In
|-
| 0x20 + 2 || Creates both an B and C descriptor || Out
|}

C and X (Pointer and ReceiveList) descriptors are backed by the "pointer buffer", a buffer in the service process. Its size is a u16, which is retrieved using the "QueryPointerBufferSize" control message. If the client code determines all buffers with flag 8 do not fit in the pointer buffer, it returns error 0x11A0B.

For buffers with flag 0x20 it creates two descriptors (A+X or B+C), but one descriptor is NULL (zero size and pointer), while the other holds the expected values. X/C descriptors are used as the non-NULL descriptor where possible, but if they don't fit in the pointer buffer, A/B descriptors are used instead. The code defers processing of type 0x20 buffers with sizes that fit in a u16 (and may therefore fit in the pointer buffer). This ensures all type 8 buffers get pointer-buffer space before any type 0x20.

(The order in which the deferred type 0x20 buffers are processed is determined by a convoluted loop.)

== Official IPC Cmd Structure ==
Official struct that is stored for each IPC command. It contains precalculated offsets for different portions of the command structure.

All offsets are given is in number of u32 words.

struct IpcCmdStruct {
u8 unk0;
u8 has_handle_descriptor;
u8 pad0[2];
u32 cmd0;
u32 cmd1;
u32 offset_handle_descriptor;
u32 pad1;
u32 offset_handles;
u32 pad2;
u32 offset_x_descriptors;
u32 offset_a_descriptors;
u32 offset_b_descriptors;
u32 offset_w_descriptors; /* this is a guess */
u32 offset_raw_data;
u32 offset_c_descriptors;
u32 unk2;
u32 unk3;
}

== Control ==
When type == 5 you are talking to the IPC manager.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments
|-
| 0 || ConvertSessionToDomain || None
|-
| 1 || ConvertDomainToSession || u32 domain
|-
| 2 || DuplicateSession || None
|-
| 3 || QueryPointerBufferSize || None
|-
| 4 || DuplicateSessionEx || u32 unknown
|}

HIPC

2017-09-25T10:24:37Z

Hthh:

== IPC Command Structure ==
This is an array of u32's, usually located in [[Thread Local Storage]].

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 15-0 || Type. 4=Request, 5=Control
|-
| 0 || 19-16 || Number of buf X descriptors (each: 2 words).
|-
| 0 || 23-20 || Number of buf A descriptors (each: 3 words).
|-
| 0 || 27-24 || Number of buf B descriptors (each: 3 words).
|-
| 0 || 31-28 || Number of buf W desciptors (each: 3 words), never observed.
|-
| 1 || 9-0 || Size of raw data section in u32s.
|-
| 1 || 13-10 || Flags for buf C descriptor.
|-
| 1 || 31 || Enable handle descriptor.
|-
| ... || || [[#Handle descriptor|Handle descriptor]], if enabled.
|-
| ... || || [[#Buffer descriptor X "Pointer"|Buf X descriptors]], each one 2 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf A descriptors]], each one 3 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf B descriptors]], each one 3 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Type W descriptors]], each one 3 words.
|-
| ... || || [[#Raw_data_section|Raw data section]] (including padding before and after aligned data section).
|-
| ... || || [[#Buffer descriptor C "ReceiveList"|Buf C descriptors]], each one 2 words.
|}

=== Handle descriptor ===
There can only be one of this descriptor type. It is enabled by bit31 of the second word.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 0 || Send current PID.
|-
| 0 || 4-1 || Number of handles to copy
|-
| 0 || 8-5 || Number of handles to move
|-
| ... || || 8-byte PID if enabled
|-
| ... || || Handles to copy
|-
| ... || || Handles to move
|}

=== Buffer descriptor X "Pointer" ===
This one is packed even worse than A, they inserted the bit38-36 of the address ''on top'' of the counter field.

Officially, the counter is known as "receive index". This one writes to the buffer described in the ReceiveList.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 5-0 || Bits 5-0 of counter.
|-
| 0 || 8-6 || Bit 38-36 of address.
|-
| 0 || 11-9 || Bits 11-9 of counter.
|-
| 0 || 15-12 || Bit 35-32 of address.
|-
| 0 || 31-16 || Size
|-
| 1 || || Lower 32-bits of address.
|}

=== Buffer descriptor A/B/W "Send"/"Receive"/"Exchange" ===
This packing is so unnecessarily complex.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of size.
|-
| 1 || || Lower 32-bits of address.
|-
| 2 || 1-0 || Flags. Always set to 0, 1 or 3. Determines what [[SVC|MemoryState]] to use with the mapped memory in the sysmodule.
|-
| 2 || 4-2 || Bit 38-36 of address.
|-
| 2 || 27-24 || Bit 35-32 of size.
|-
| 2 || 31-28 || Bit 35-32 of address.
|}

=== Buffer descriptor C "ReceiveList" ===
There's a 4-bit flag in the main header controlling the behavior of C descriptors.

If it has value 0, the C descriptor functionality is disabled. If it has value 1, there is no C descriptor. If it has value 2, there is a single C descriptor.

Otherwise it has (flag-2) C descriptors.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of address.
|-
| 1 || 15-0 || Rest of address.
|-
| 1 || 31-16 || Size
|}

=== IPC buffers ===
Buffer descriptor A/B/... map memory into the sysmodule process. For the mapped memory in the sysmodule the permissions are: desc-A = R--, desc-B = RW-. The buffer is automatically unmapped while the kernel handles the cmdreply, the sysmodule doesn't need to specify anything in the cmdreply to trigger this.

This memory is mapped in the sysmodule to the same vaddr from the original user-process cmd-request, except with with bits >=(~28(?)) changed to a different ASLR'd region.

== Raw data section ==

[[File:Ipc msg buffer type a example.png|thumb|An example of an IPC message with a type 0xA buffer in it. Red is headers/descriptors, yellow is padding, and blue is data/buffer lengths. Note that the size of the u16 array for type A lengths is padded to fill up a whole word.]]

{| class="wikitable" border="1"
! Word || Description
|-
| ... || Padding to align to 16 bytes.
|-
| ... || If sent to an object domain, a [[#Domain_message|domain message]], otherwise a [[#Data payload|data payload]]
|-
| ... || Padding
|-
| ... || Buffer type 0xA lengths (u16 array)
|}

The total amount of padding within the raw data section is always 0x10 bytes. This means that if no padding is required before the message, there will be 0x10 bytes of padding after the message (before the buffer type 0xA lengths).

=== Domain message ===
This header is used to wrap up requests sent to domains instead of sessions.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 7-0 || Command. 1=send message, 2=close virtual handle
|-
| 0 || 31-16 || Length of [[IPC_Marshalling#Data_payload|data payload]] in bytes.
|-
| 1 || || Object ID (from cmd 0 in [[IPC_Marshalling#Control|Control]]).
|-
| 2
|rowspan="2"|
|rowspan="2"| Padding to align to u64
|-
| 3
|-
| 4... || || [[#Data payload|Data payload]]
|}

=== Data payload ===

This is an array of u32's, but individual parameters are generally stored as u64's.

{| class="wikitable" border="1"
! Word || Description
|-
| 0 || Magic ("SFCI" for requests, "SFCO" for responses) as u64.
|-
| 2 || Command id as u64 for requests, [[Error_codes|error code]] as u64 for responses.
|-
| 4... || Input parameters or return values
|}

Many messages which require the PID also require a placeholder u64 value passed in the input parameters. In these cases the OverwriteClientProcessId method is called to replace the value before it is used.

== Official marshalling code ==
The official marshalling function takes an array of (buf_ptr, size) pairs and a type-field for each such pair.

Bitmask 0x10 seems to indicate null-terminated strings, but that flag is ignored by the marshalling code.

{| class="wikitable" border="1"
! Type Mask || Description || Direction
|-
| 4 + 1 || Creates a A descriptor with flags=0. || In
|-
| 0x40 + 4 + 1 || Creates a A descriptor with flags=1. || In
|-
| 0x80 + 4 + 1 || Creates a A descriptor with flags=3. || In
|-
| 4 + 2 || Creates a B descriptor with flags=0. || Out
|-
| 0x40 + 4 + 2 || Creates a B descriptor with flags=1. || Out
|-
| 0x80 + 4 + 2 || Creates a B descriptor with flags=3. || Out
|-
| 8 + 1 || Creates an X descriptor || In
|-
| 8 + 2 || Creates a C descriptor, and writes the u16 size to an offset into raw data. || Out
|-
| 0x10 + 8 + 2 || Creates a C descriptor || Out
|-
| 0x20 + 1 || Creates both an A and X descriptor || In
|-
| 0x20 + 2 || Creates both an B and C descriptor || Out
|}

C and X (Pointer and ReceiveList) descriptors are backed by the "pointer buffer", a buffer in the service process. Its size is a u16, which is retrieved using the "QueryPointerBufferSize" control message. If the client code determines all buffers with flag 8 do not fit in the pointer buffer, it returns error 0x11A0B.

For buffers with flag 0x20 it creates two descriptors (A+X or B+C), but one descriptor is NULL (zero size and pointer), while the other holds the expected values. X/C descriptors are used as the non-NULL descriptor where possible, but if they don't fit in the pointer buffer, A/B descriptors are used instead. The code defers processing of type 0x20 buffers with sizes that fit in a u16 (and may therefore fit in the pointer buffer). This ensures all type 8 buffers get pointer-buffer space before any type 0x20.

(The order in which the deferred type 0x20 buffers are processed is determined by a convoluted loop.)

== Official IPC Cmd Structure ==
Official struct that is stored for each IPC command. It contains precalculated offsets for different portions of the command structure.

All offsets are given is in number of u32 words.

struct IpcCmdStruct {
u8 unk0;
u8 has_handle_descriptor;
u8 pad0[2];
u32 cmd0;
u32 cmd1;
u32 offset_handle_descriptor;
u32 pad1;
u32 offset_handles;
u32 pad2;
u32 offset_x_descriptors;
u32 offset_a_descriptors;
u32 offset_b_descriptors;
u32 offset_w_descriptors; /* this is a guess */
u32 offset_raw_data;
u32 offset_c_descriptors;
u32 unk2;
u32 unk3;
}

== Control ==
When type == 5 you are talking to the IPC manager.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments
|-
| 0 || ConvertSessionToDomain || None
|-
| 1 || ConvertDomainToSession || u32 domain
|-
| 2 || DuplicateSession || None
|-
| 3 || QueryPointerBufferSize || None
|-
| 4 || DuplicateSessionEx || u32 unknown
|}

HIPC

2017-09-24T10:28:00Z

Hthh:

== IPC Command Structure ==
This is an array of u32's, usually located in [[Thread Local Storage]].

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 15-0 || Type. 4=Request, 5=Control
|-
| 0 || 19-16 || Number of buf X descriptors (each: 2 words).
|-
| 0 || 23-20 || Number of buf A descriptors (each: 3 words).
|-
| 0 || 27-24 || Number of buf B descriptors (each: 3 words).
|-
| 0 || 31-28 || Number of buf W desciptors (each: 3 words), never observed.
|-
| 1 || 9-0 || Size of raw data section in u32s.
|-
| 1 || 13-10 || Flags for buf C descriptor.
|-
| 1 || 31 || Enable handle descriptor.
|-
| ... || || [[#Handle descriptor|Handle descriptor]], if enabled.
|-
| ... || || [[#Buffer descriptor X "Pointer"|Buf X descriptors]], each one 2 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf A descriptors]], each one 3 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf B descriptors]], each one 3 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Type W descriptors]], each one 3 words.
|-
| ... || || [[#Raw_data_section|Raw data section]] (including padding before and after aligned data section).
|-
| ... || || [[#Buffer descriptor C "ReceiveList"|Buf C descriptors]], each one 2 words.
|}

=== Handle descriptor ===
There can only be one of this descriptor type. It is enabled by bit31 of the second word.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 0 || Send current PID.
|-
| 0 || 4-1 || Number of handles to copy
|-
| 0 || 8-5 || Number of handles to move
|-
| ... || || 8-byte PID if enabled
|-
| ... || || Handles to copy
|-
| ... || || Handles to move
|}

=== Buffer descriptor X "Pointer" ===
This one is packed even worse than A, they inserted the bit38-36 of the address ''on top'' of the counter field.

Officially, the counter is known as "receive index". This one writes to the buffer described in the ReceiveList.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 5-0 || Bits 5-0 of counter.
|-
| 0 || 8-6 || Bit 38-36 of address.
|-
| 0 || 11-9 || Bits 11-9 of counter.
|-
| 0 || 15-12 || Bit 35-32 of address.
|-
| 0 || 31-16 || Size
|-
| 1 || || Lower 32-bits of address.
|}

=== Buffer descriptor A/B/W "Send"/"Receive"/"Exchange" ===
This packing is so unnecessarily complex.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of size.
|-
| 1 || || Lower 32-bits of address.
|-
| 2 || 1-0 || Flags. Always set to 0, 1 or 3. Determines what [[SVC|MemoryState]] to use with the mapped memory in the sysmodule.
|-
| 2 || 4-2 || Bit 38-36 of address.
|-
| 2 || 27-24 || Bit 35-32 of size.
|-
| 2 || 31-28 || Bit 35-32 of address.
|}

=== Buffer descriptor C "ReceiveList" ===
There's a 4-bit flag in the main header controlling the behavior of C descriptors.

If it has value 0, the C descriptor functionality is disabled. If it has value 1, there is no C descriptor. If it has value 2, there is a single C descriptor.

Otherwise it has (flag-2) C descriptors.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of address.
|-
| 1 || 15-0 || Rest of address.
|-
| 1 || 31-16 || Size
|}

=== IPC buffers ===
Buffer descriptor A/B/... map memory into the sysmodule process. For the mapped memory in the sysmodule the permissions are: desc-A = R--, desc-B = RW-. The buffer is automatically unmapped while the kernel handles the cmdreply, the sysmodule doesn't need to specify anything in the cmdreply to trigger this.

This memory is mapped in the sysmodule to the same vaddr from the original user-process cmd-request, except with with bits >=(~28(?)) changed to a different ASLR'd region.

== Raw data section ==

[[File:Ipc msg buffer type a example.png|thumb|An example of an IPC message with a type 0xA buffer in it. Red is headers/descriptors, yellow is padding, and blue is data/buffer lengths. Note that the size of the u16 array for type A lengths is padded to fill up a whole word.]]

{| class="wikitable" border="1"
! Word || Description
|-
| ... || Padding to align to 16 bytes.
|-
| ... || If sent to an object domain, a [[#Domain_message|domain message]], otherwise a [[#Data payload|data payload]]
|-
| ... || Padding
|-
| ... || Buffer type 0xA lengths (u16 array)
|}

The total amount of padding within the raw data section is always 0x10 bytes. This means that if no padding is required before the message, there will be 0x10 bytes of padding after the message (before the buffer type 0xA lengths).

=== Domain message ===
This header is used to wrap up requests sent to domains instead of sessions.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 7-0 || Command. 1=send message, 2=close virtual handle
|-
| 0 || 31-16 || Length of [[IPC_Marshalling#Data_payload|data payload]] in bytes.
|-
| 1 || || Object ID (from cmd 0 in [[IPC_Marshalling#Control|Control]]).
|-
| 2
|rowspan="2"|
|rowspan="2"| Padding to align to u64
|-
| 3
|-
| 4... || || [[#Data payload|Data payload]]
|}

=== Data payload ===

This is an array of u32's, but individual parameters are generally stored as u64's.

{| class="wikitable" border="1"
! Word || Description
|-
| 0 || Magic ("SFCI" for requests, "SFCO" for responses) as u64.
|-
| 2 || Command id as u64 for requests, [[Error_codes|error code]] as u64 for responses.
|-
| 4... || Input parameters or return values
|}

Many messages which require the PID also require a placeholder u64 value passed in the input parameters. In these cases the OverwriteClientProcessId method is called to replace the value before it is used.

== Official marshalling code ==
The official marshalling function takes an array of (buf_ptr, size) pairs and a type-field for each such pair.

Bitmask 0x10 seems to indicate null-terminated strings, but that flag is ignored by the marshalling code.

{| class="wikitable" border="1"
! Type Mask || Description || Direction
|-
| 4 + 1 || Creates a A descriptor with flags=0. || In
|-
| 0x40 + 4 + 1 || Creates a A descriptor with flags=1. || In
|-
| 0x80 + 4 + 1 || Creates a A descriptor with flags=3. || In
|-
| 4 + 2 || Creates a B descriptor with flags=0. || Out
|-
| 0x40 + 4 + 2 || Creates a B descriptor with flags=1. || Out
|-
| 0x80 + 4 + 2 || Creates a B descriptor with flags=3. || Out
|-
| 8 + 1 || Creates an X descriptor || In
|-
| 8 + 2 || Creates a C descriptor, and writes the u16 size to an offset into raw data. || Out
|-
| 0x10 + 8 + 2 || Creates a C descriptor || Out
|-
| 0x20 + 1 || Creates both an A and X descriptor || In
|-
| 0x20 + 2 || Creates both an B and C descriptor || Out
|}

For types 0x21, 0x22 if size doesn't fit in u16, it's added to a list. Some magic shit happens to that list.

== Official IPC Cmd Structure ==
Official struct that is stored for each IPC command. It contains precalculated offsets for different portions of the command structure.

All offsets are given is in number of u32 words.

struct IpcCmdStruct {
u8 unk0;
u8 has_handle_descriptor;
u8 pad0[2];
u32 cmd0;
u32 cmd1;
u32 offset_handle_descriptor;
u32 pad1;
u32 offset_handles;
u32 pad2;
u32 offset_x_descriptors;
u32 offset_a_descriptors;
u32 offset_b_descriptors;
u32 offset_w_descriptors; /* this is a guess */
u32 offset_raw_data;
u32 offset_c_descriptors;
u32 unk2;
u32 unk3;
}

== Control ==
When type == 5 you are talking to the IPC manager.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments
|-
| 0 || ConvertSessionToDomain || None
|-
| 1 || ConvertDomainToSession || u32 domain
|-
| 2 || DuplicateSession || None
|-
| 3 || QueryPointerBufferSize || None
|-
| 4 || DuplicateSessionEx || u32 unknown
|}

NS services

2017-09-20T02:16:48Z

Hthh:

= ns:am =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListApplicationRecord]]
|-
| 1 ||
|-
| 2 || GetApplicationRecordUpdateSystemEvent
|-
| 3 || SubmitArpData
|-
| 4 ||
|-
| 5 ||
|-
| 6 ||
|-
| 7 ||
|-
| 8 || IsApplicationEntityMovable
|-
| 9 ||
|-
| 11 ||
|-
| 13 ||
|-
| 16 ||
|-
| 17 ||
|-
| 19 ||
|-
| 21 || [[#GetTitlePatchContentNcaPath]]
|-
| 22 ||
|-
| 23 ||
|-
| 25 ||
|-
| 27 ||
|-
| 30 || GetIAsyncValue
|-
| 31 || GetIAsyncResult
|-
| 33 ||
|-
| 35 ||
|-
| 36 ||
|-
| 37 ||
|-
| 38 ||
|-
| 39 ||
|-
| 40 ||
|-
| 41 ||
|-
| 42 ||
|-
| 43 ||
|-
| 44 || GetSdCardMountStatusChangedEvent
|-
| 45 || GetGameCardAttachmentEvent
|-
| 46 || GetGameCardAttachmentInfo
|-
| 47 || [[#GetFreeSpace]]
|-
| 48 || [[#GetTotalSpace]]
|-
| 49 || GetSdCardRemovedEvent
|-
| 52 || GetGameCardUpdateDetectionEvent
|-
| 53 ||
|-
| 54 ||
|-
| 55 || GetApplicationDesiredLanguage
|-
| 56 ||
|-
| 57 ||
|-
| 58 ||
|-
| 59 || ConvertApplicationLanguageToLanguageCode
|-
| 60 || [[#GetLanguageIdFromString]]
|-
| 61 ||
|-
| 62 || GetIGameCardStopper
|-
| 63 || IsSystemProgramInstalled
|-
| 64 ||
|-
| 65 || GetIRequestServerStopper
|-
| 100 || ResetToFactorySettings
|-
| 101 || ResetToFactorySettingsWithoutUserSaveData
|-
| 102 || DeleteUserContent2
|-
| 200 ||
|-
| 201 ||
|-
| 210 ||
|-
| 220 ||
|-
| 300 || GetApplicationShellEvent
|-
| 301 || PopApplicationShellEventInfo
|-
| 302 ||
|-
| 303 ||
|-
| 304 ||
|-
| 305 ||
|-
| 306 ||
|-
| 307 ||
|-
| 401 ||
|-
| 402 ||
|-
| 403 ||
|-
| 404 ||
|-
| 405 ||
|-
| 502 ||
|-
| 503 ||
|-
| 504 ||
|-
| 600 ||
|-
| 601 || [[#GetTitleInfo1]]
|-
| 602 ||
|-
| 603 ||
|-
| 604 ||
|-
| 605 || Used same way as [[#GetTitleInfo1]].
|-
| 700 ||
|-
| 701 ||
|-
| 702 ||
|-
| 703 ||
|-
| 704 ||
|-
| 705 ||
|-
| 800 ||
|-
| 801 ||
|-
| 900 ||
|-
| 901 ||
|-
| 902 ||
|-
| 903 ||
|-
| 904 ||
|-
| 905 ||
|-
| 906 ||
|-
| 907 ||
|-
| 908 ||
|-
| 1000 ||
|-
| 1001 ||
|-
| 1200 ||
|-
| 1300 ||
|-
| 1301 ||
|-
| 1302 ||
|-
| 1400 ||
|-
| 1500 ||
|-
| 1501 ||
|-
| 1502 ||
|-
| 1503 ||
|-
| 1600 ||
|-
| 1700 ||
|-
| 1800 ||
|-
| 1801 ||
|-
| 1802 ||
|}

== GetTitlePatchContentNcaPath ==
Takes a 0x16-type output buffer, an u8 [[NCA|type]], and an u64 titleID.

The input titleID is used with the application-title table like various other cmds, anything not in that table can't be used with this.

Returns a string path for the specified type of patch content with this titleID, otherwise returns regular-application paths when update-title not installed. Returns an error when the specified type of content doesn't exist for this title. Starts with "@{SdCardContent,UserContent}://" and ends in ".nca".

For gamecard content, the output path is: "@GcSXXXXXXXX:/<NcaId>.nca". NCA-type0 with gamecard returns 0 with an empty output string.

The output string is then used by the user-process with [[Filesystem_services|FS]] to mount the content.

== GetFreeSpace ==
Takes an input media-id that must be 5.

Returns the u64 from [[Content_Manager_services#IContentStorage]] cmd22.

== GetTotalSpace ==
Takes an input media-id that must be 5.

Returns the u64 from [[Content_Manager_services#IContentStorage]] cmd23.

== GetLanguageIdFromString ==
Takes an input u8 pointer for the resulting Id to be written to and a string represented as a u64 (i.e 0x53552D6E65 for 'en-US').

Returns 0 if an ID was successfully found, otherwise returns 0x25810.

== ListApplicationRecord ==
Takes a type-6 output buffer and an u64.

Returns an array of title-info entries using the specified offset and size. No input titleID is passed to this.

== GetTitleInfo1 ==
Returns 0x10-byte entries using the specified titleID starting at the specified u32 entryindex. Can only return game titles. The second entry if any is the update-title usually. When the input entryindex is >= totalentries, this will return 0 with out_entrycount=0.

Entry structure:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| u8 "type". [[Content_Manager_services|Title type]] (String is from web-applet)
|-
| 0x1
| 0x1
| u8 "installedStorage" / [[Filesystem_services|StorageId]] (String is from web-applet)
|-
| 0x2
| 0x1
| Unknown. Non-zero with output from cmd 605, differs for app/update titles.
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| u32 Title-version
|-
| 0x8
| 0x8
| u64 titleID
|}

= ns:su =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 || GetISystemUpdateControl
|-
| 2 ||
|-
| 3 ||
|-
| 4 ||
|-
| 5 ||
|-
| 6 ||
|-
| 9 || GetNsSuWaitEvent
|-
| 10 ||
|-
|}

= ns:dev =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#LaunchTitle]]
|-
| 1 || [[#TerminateTitleByPid]]
|-
| 2 || [[#TerminateTitleByTitleId]]
|-
| 3 || [[#GetNsDevWaitEvent]]
|-
| 4 || [[#GetNsDevEventType]]
|-
| 5 || [[#TerminateCrashingTitle]]
|-
| 6 || [[#InstallTitle]]
|-
| 7 || SetEventState6
|-
| 8 || SetEventState
|-
|}

== LaunchTitle ==
Wrapper for "pm:shell" [[Process_Manager_services#LaunchProcess|LaunchProcess]].

== TerminateTitleByPid ==
Wrapper for "pm:shell" [[Process_Manager_services#TerminateTitleByPid|TerminateTitleByPid]].

== TerminateTitleByTitleId ==
Wrapper for "pm:shell" [[Process_Manager_services#TerminateTitleByTitleId|TerminateTitleByTitleId]].

== GetNsDevWaitEvent ==
Wrapper for "pm:shell" [[Process_Manager_services#GetProcessEventWaiter|GetProcessEventWaiter]].

== GetNsDevEventType ==
Wrapper for "pm:shell" [[Process_Manager_services#GetProcessEventType|GetProcessEventType]].

== TerminateCrashingTitle ==
Calls "pm:shell" [[Process_Manager_services#GetCrashingProcessPid|GetCrashingProcessPid]] and sends PID to [[Process_Manager_services#TerminateTitleByPid|TerminateTitleByPid]].

== InstallTitle ==
Calls [[NCM_services#IPathResolverForStorage|IPathResolverForStorage]] Set...NcaPath functions.

[[Category:Services]]

NS services

2017-09-19T06:02:46Z

Hthh:

= ns:am =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#ListApplicationRecord]]
|-
| 1 ||
|-
| 2 || GetApplicationRecordUpdateSystemEvent
|-
| 3 || SubmitArpData
|-
| 4 ||
|-
| 5 ||
|-
| 6 ||
|-
| 7 ||
|-
| 8 || IsApplicationEntityMovable
|-
| 9 ||
|-
| 11 ||
|-
| 13 ||
|-
| 16 ||
|-
| 17 ||
|-
| 19 ||
|-
| 21 || [[#GetTitlePatchContentNcaPath]]
|-
| 22 ||
|-
| 23 ||
|-
| 25 ||
|-
| 27 ||
|-
| 30 || GetIAsyncValue
|-
| 31 || GetIAsyncResult
|-
| 33 ||
|-
| 35 ||
|-
| 36 ||
|-
| 37 ||
|-
| 38 ||
|-
| 39 ||
|-
| 40 ||
|-
| 41 ||
|-
| 42 ||
|-
| 43 ||
|-
| 44 || GetSdCardMountStatusChangedEvent
|-
| 45 ||
|-
| 46 ||
|-
| 47 || [[#GetFreeSpace]]
|-
| 48 || [[#GetTotalSpace]]
|-
| 49 ||
|-
| 52 || GetGameCardUpdateDetectionEvent
|-
| 53 ||
|-
| 54 ||
|-
| 55 || GetApplicationDesiredLanguage
|-
| 56 ||
|-
| 57 ||
|-
| 58 ||
|-
| 59 ||
|-
| 60 || [[#GetLanguageIdFromString]]
|-
| 61 ||
|-
| 62 || GetIGameCardStopper
|-
| 63 || IsSystemProgramInstalled
|-
| 64 ||
|-
| 65 || GetIRequestServerStopper
|-
| 100 || ResetToFactorySettings
|-
| 101 || DeleteUserContent1
|-
| 102 || DeleteUserContent2
|-
| 200 ||
|-
| 201 ||
|-
| 210 ||
|-
| 220 ||
|-
| 300 ||
|-
| 301 ||
|-
| 302 ||
|-
| 303 ||
|-
| 304 ||
|-
| 305 ||
|-
| 306 ||
|-
| 307 ||
|-
| 401 ||
|-
| 402 ||
|-
| 403 ||
|-
| 404 ||
|-
| 405 ||
|-
| 502 ||
|-
| 503 ||
|-
| 504 ||
|-
| 600 ||
|-
| 601 || [[#GetTitleInfo1]]
|-
| 602 ||
|-
| 603 ||
|-
| 604 ||
|-
| 605 || Used same way as [[#GetTitleInfo1]].
|-
| 700 ||
|-
| 701 ||
|-
| 702 ||
|-
| 703 ||
|-
| 704 ||
|-
| 705 ||
|-
| 800 ||
|-
| 801 ||
|-
| 900 ||
|-
| 901 ||
|-
| 902 ||
|-
| 903 ||
|-
| 904 ||
|-
| 905 ||
|-
| 906 ||
|-
| 907 ||
|-
| 908 ||
|-
| 1000 ||
|-
| 1001 ||
|-
| 1200 ||
|-
| 1300 ||
|-
| 1301 ||
|-
| 1302 ||
|-
| 1400 ||
|-
| 1500 ||
|-
| 1501 ||
|-
| 1502 ||
|-
| 1503 ||
|-
| 1600 ||
|-
| 1700 ||
|-
| 1800 ||
|-
| 1801 ||
|-
| 1802 ||
|}

== GetTitlePatchContentNcaPath ==
Takes a 0x16-type output buffer, an u8 [[NCA|type]], and an u64 titleID.

The input titleID is used with the application-title table like various other cmds, anything not in that table can't be used with this.

Returns a string path for the specified type of patch content with this titleID, otherwise returns regular-application paths when update-title not installed. Returns an error when the specified type of content doesn't exist for this title. Starts with "@{SdCardContent,UserContent}://" and ends in ".nca".

For gamecard content, the output path is: "@GcSXXXXXXXX:/<NcaId>.nca". NCA-type0 with gamecard returns 0 with an empty output string.

The output string is then used by the user-process with [[Filesystem_services|FS]] to mount the content.

== GetFreeSpace ==
Takes an input media-id that must be 5.

Returns the u64 from [[Content_Manager_services#IContentStorage]] cmd22.

== GetTotalSpace ==
Takes an input media-id that must be 5.

Returns the u64 from [[Content_Manager_services#IContentStorage]] cmd23.

== GetLanguageIdFromString ==
Takes an input u8 pointer for the resulting Id to be written to and a string represented as a u64 (i.e 0x53552D6E65 for 'en-US').

Returns 0 if an ID was successfully found, otherwise returns 0x25810.

== ListApplicationRecord ==
Takes a type-6 output buffer and an u64.

Returns an array of title-info entries using the specified offset and size. No input titleID is passed to this.

== GetTitleInfo1 ==
Returns 0x10-byte entries using the specified titleID starting at the specified u32 entryindex. Can only return game titles. The second entry if any is the update-title usually. When the input entryindex is >= totalentries, this will return 0 with out_entrycount=0.

Entry structure:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| u8 "type". [[Content_Manager_services|Title type]] (String is from web-applet)
|-
| 0x1
| 0x1
| u8 "installedStorage" / [[Filesystem_services|StorageId]] (String is from web-applet)
|-
| 0x2
| 0x1
| Unknown. Non-zero with output from cmd 605, differs for app/update titles.
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x4
| u32 Title-version
|-
| 0x8
| 0x8
| u64 titleID
|}

= ns:su =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 || GetISystemUpdateControl
|-
| 2 ||
|-
| 3 ||
|-
| 4 ||
|-
| 5 ||
|-
| 6 ||
|-
| 9 || GetNsSuWaitEvent
|-
| 10 ||
|-
|}

= ns:dev =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#LaunchTitle]]
|-
| 1 || [[#TerminateTitleByPid]]
|-
| 2 || [[#TerminateTitleByTitleId]]
|-
| 3 || [[#GetNsDevWaitEvent]]
|-
| 4 || [[#GetNsDevEventType]]
|-
| 5 || [[#TerminateCrashingTitle]]
|-
| 6 || [[#InstallTitle]]
|-
| 7 || SetEventState6
|-
| 8 || SetEventState
|-
|}

== LaunchTitle ==
Wrapper for "pm:shell" [[Process_Manager_services#LaunchProcess|LaunchProcess]].

== TerminateTitleByPid ==
Wrapper for "pm:shell" [[Process_Manager_services#TerminateTitleByPid|TerminateTitleByPid]].

== TerminateTitleByTitleId ==
Wrapper for "pm:shell" [[Process_Manager_services#TerminateTitleByTitleId|TerminateTitleByTitleId]].

== GetNsDevWaitEvent ==
Wrapper for "pm:shell" [[Process_Manager_services#GetProcessEventWaiter|GetProcessEventWaiter]].

== GetNsDevEventType ==
Wrapper for "pm:shell" [[Process_Manager_services#GetProcessEventType|GetProcessEventType]].

== TerminateCrashingTitle ==
Calls "pm:shell" [[Process_Manager_services#GetCrashingProcessPid|GetCrashingProcessPid]] and sends PID to [[Process_Manager_services#TerminateTitleByPid|TerminateTitleByPid]].

== InstallTitle ==
Calls [[NCM_services#IPathResolverForStorage|IPathResolverForStorage]] Set...NcaPath functions.

[[Category:Services]]

Bluetooth Driver services

2017-09-19T00:47:42Z

Hthh:

= btdrv =
The bluetooth driver implements the bluetooth protocol over h4/uart.

It interfaces with the [[Bus_services#uart|uart]] service to actually talk with the bluetooth hardware.

The code seems to be derived from a broadcom stack. A good starting point for similar source code can be found in the MICO project: https://github.com/yinhongxing/mico/tree/ea67ff3659f12d730d4dc3b8d547b093bd2ee2ee/MICO/bluetooth_bte Note that the library files contain many (symbolized) functions which match btdrv.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 ||
|-
| 1 || Init
|-
| 2 || Enable
|-
| 3 || Disable
|-
| 4 || CleanupAndShutdown
|-
| 5 || GetAdapterProperties
|-
| 6 || GetAdapterProperty
|-
| 7 || SetAdapterProperty
|-
| 8 || StartDiscovery
|-
| 9 || CancelDiscovery
|-
| 10 || CreateBond
|-
| 11 || RemoveBond
|-
| 12 || CancelBond
|-
| 13 || PinReply
|-
| 14 || SspReply
|-
| 15 ||
|-
| 16 || InitInterfaces
|-
| 17 || HidHostInterface_Connect
|-
| 18 || HidHostInterface_Disconnect
|-
| 19 || HidHostInterface_SendData
|-
| 20 || HidHostInterface_SendData2
|-
| 21 || HidHostInterface_SetReport
|-
| 22 || HidHostInterface_GetReport
|-
| 23 || HidHostInterface_WakeController
|-
| 24 || HidHostInterface_AddPairedDevice
|-
| 25 || HidHostInterface_GetPairedDevice
|-
| 26 || HidHostInterface_CleanupAndShutdown
|-
| 27 ||
|-
| 28 || ExtInterface_SetTSI
|-
| 29 || ExtInterface_SetBurstMode
|-
| 30 || ExtInterface_SetZeroRetran
|-
| 31 || ExtInterface_SetMcMode
|-
| 32 || ExtInterface_StartLlrMode
|-
| 33 || ExtInterface_ExitLlrMode
|-
| 34 || ExtInterface_SetRadio
|-
| 35 || ExtInterface_SetVisibility
|-
| 36 ||
|-
| 37 ||
|-
| 38 || HidHostInterface_GetLatestPlr
|-
| 39 || ExtInterface_GetPendingConnections
|-
| 40 || HidHostInterface_GetChannelMap
|-
| 41 || SetIsBluetoothBoostEnabled
|-
| 42 || GetIsBluetoothBoostEnabled
|-
| 43 || SetIsBluetoothAfhEnabled
|-
| 44 || GetIsBluetoothAfhEnabled
|}

Services API

2017-09-01T09:20:29Z

Hthh:

Services are system processes running in the background which wait for incoming requests. When a process wants to communicate with a service, it first needs to get a handle to the named service, and then it can communicate with the service via inter-process communication (each service has a name up to 8 characters).

Handles for services are retrieved from the service manager port, "sm:". Manager service "sm:m" also exists. Services are an abstraction of ports, they operate the same way except regular ports can have their handles retrieved directly from a SVC.

= sm: =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize]]
|-
| 1 || [[#GetService]]
|-
| 2 || [[#RegisterService]]
|-
| 3 || [[#UnregisterService]]
|}

== Initialize ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x8000000A
|-
| 2 || 0x00000001
|- style="border-top: double"
| 0-1 || Pid
|- style="border-top: double"
| 0 || "SFCI"
|-
| 1 || 0x00000000
|-
| 2 || Always 0.
|}

== GetService ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x0000000A
|- style="border-top: double"
| 0 || "SFCI"
|-
| 1 || 0x00000001
|-
| 2 || Service name, zero padded and casted to u64.
|}

== RegisterService ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x0000000C
|- style="border-top: double"
| 0 || "SFCI"
|-
| 1 || 0x00000002
|-
| 2 || Service name, zero padded and casted to u64.
|-
| 3 || Max sessions? 32-bit integer.
|-
| 4 || Unknown bool
|}

== UnregisterService ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x0000000A
|- style="border-top: double"
| 0 || "SFCI"
|-
| 1 || 0x00000003
|-
| 2 || Service name, zero padded and casted to u64.
|}

= sm:m =

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Notes
|-
| 0 || RegisterProcess || u32 PID + 2 A Descriptors (unknown, probably service access lists of some kind) ||
|-
| 1 || UnregisterProcess || u32 PID ||
|}

= Service List =
{| class="wikitable" border="1"
|-
! Service names
! scope="col" width="200" | Description
! scope="col" width="200" | Notes
|-
| acc:u0, acc:u1, acc:aa, acc:su
| [[Account services]]
| u0: System, u1: User, su: Admin, aa: Baas
|-
| ahid:cd, ahid:hdr, hid, hid:dbg, hid:sys, irs, irs:sys, xcd:sys
| [[HID services]]
|
|-
| appletAE, appletOE, idle:sys, omm, spsm
| [[AM services]]
|
|-
| [ [[1.0.0]] +] aoc:u, mii:u, mii:e, ns:am, ns:su, ns:dev, pl:u, ovln:rcv, ovln:snd, pdm:ntfy, pdm:qry

[ [[3.0.0]] +] aoc:u, ns:am2, ns:dev, ns:ec, ns:rid, ns:rt, ns:su, ns:vm, ns:web, ovln:rcv, ovln:snd
| [[NS Services]]
| am: Application Manager, su: System Update
|-
| apm, apm:p, apm:sys, fgm, fgm:0, fgm:9, (fgm:dbg?)
| [[APM services]]
| fgm: Fuel guage?
|-
| arp:r, arp:w, bgtc:t, bgtc:sc
| [[Glue services]]
| r: Reader, w: Writer
|-
| audin:a, audin:d, audin:u, audout:a, audout:d, audout:u, audren:a, audren:d, audren:u, audrec:a, audrec:d, audrec:u, audctl, codecctl, hwopus
| Audio services
|
|-
| <nowiki>bcat:a, bcat:u, bcat:m, bcat:s, news:a, news:c, news:m, news:p, news:v, prepo:u, prepo:s, prepo:m, prepo:a</nowiki>
| [[BCAT services]]
|
|-
| bpc, bpc:r, pcv, pcv:arb, pcv:imm, time:u, time:a, time:s
| [[PCV services]]
|
|-
| bsd:u, bsd:s, bsdcfg, ethc:c, ethc:i, nsd:u, nsd:a, sfdnsres
| [[Sockets services]], [[NSD services]]
|
|-
| btdrv
| [[Bluetooth Driver services]]
|
|-
| btm, btm:dbg, btm:sys
| Battery services
|
|-
| caps:a, caps:c
| [[Capture services]]
| a: AlbumAccessor, c: AlbumControl
|-
| caps:sc, caps:ss, mm:u, vi:m, vi:s, vi:u, cec-mgr
| [[Display services]]
|
|-
| dispdrv
| Nvnflinger services
|
|-
| erpt:c, erpt:r
| [[Error Report services]]
|
|-
| es
| ETicket services
|
|-
| fan, psm, tc, ts
| [[PTM services]]
|
|-
| fatal:u, fatal:p
| Fatal Error services
| u: User, p: Privileged
|-
| friend:u, friend:v, friend:m, friend:s, friend:a
| Friend services
|
|-
| fsp-srv, fsp-ldr, fsp-pr
| [[Filesystem services]]
| srv: Main, ldr: Loader, pr: Program Registry
|-
| gpio, i2c, i2c:pcv, pinmux, pwm, uart
| [[Bus services]]
|
|-
| htc, htcs, htc:tenv
| [[TMA services]]
|
|-
| lbl
| [[Backlight services]]
|
|-
| ldn:m, ldn:s, ldn:u
| [[LDN services]]
|
|-
| [ [[1.0.0]]+ ] ldr:pm, ldr:ro, ldr:shel, ldr:dmnt

[ [[3.0.0]]+ ] ldr:pm, ldr:shel, ldr:dmnt
| [[Loader services]]
|
|-
| lm
| [[Log services]]
|
|-
| manu
| [[Manu Services]]
| "Manufacturing", present in factory firmware but not installed on retail systems.
|-
| lr, ncm, ncm:v
| [[NCM services]]
|
|-
| nfc:am, nfc:mf:u, nfc:user, nfc:sys
| NFC services
|
|-
| nifm:u, nifm:a, nifm:s
| [[Network Interface services]]
|
|-
| nim, nim:shp, ntc
| [[NIM services]]
| shp: eShop
|-
| npns:u, npns:s
| NPNS services
|
|-
| nvdrv:a, nvdrv:s, nvdrv:t, nvdrv, nvdrvdbg, nvgem:c, nvgem:cd, nvmemp
| [[NV services]]
|
|-
| pcie
| [[PCIe services]]
|
|-
| pctl, pctl:a, pctl:s, pctl:r
| [[Parental Control services]]
|
|-
| pm:bm, pm:info, pm:shell
| [[Process Manager services]]
|
|-
| psc:c, psc:m
| PSC services
|
|-
| [ [[3.0.0]]+ ] ldr:ro, ro:dmnt
| [[Loader services|RO services]]
|
|-
| set, set:fd, set:cal, set:sys
| [[Settings services]]
| cal: calibration, sys: System Settings
|-
| [ [[3.0.0]]+ ] mii:u, mii:e, pdm:ntfy, pdm:qry, pl:u
| [[Shared Database services]]
|
|-
| ssl
| [[SSL services]]
|
|-
| csrng, spl:
| [[SPL services]]
|
|-
| usb:ds, usb:hs, usb:pd, usb:pd:c, usb:pm
| [[USB services]]
|
|-
| wlan:inf, wlan:lcl, wlan:lg, wlan:lga, wlan:sg, wlan:soc
| WLAN services
|
|}

[[Category:Services]]

Services API

2017-09-01T09:20:10Z

Hthh:

Services are system processes running in the background which wait for incoming requests. When a process wants to communicate with a service, it first needs to get a handle to the named service, and then it can communicate with the service via inter-process communication (each service has a name up to 8 characters).

Handles for services are retrieved from the service manager port, "sm:". Manager service "sm:m" also exists. Services are an abstraction of ports, they operate the same way except regular ports can have their handles retrieved directly from a SVC.

= sm: =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Initialize]]
|-
| 1 || [[#GetService]]
|-
| 2 || [[#RegisterService]]
|-
| 3 || [[#UnregisterService]]
|}

== Initialize ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x8000000A
|-
| 2 || 0x00000001
|- style="border-top: double"
| 0-1 || Pid
|- style="border-top: double"
| 0 || "SFCI"
|-
| 1 || 0x00000000
|-
| 2 || Always 0.
|}

== GetService ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x0000000A
|- style="border-top: double"
| 0 || "SFCI"
|-
| 1 || 0x00000001
|-
| 2 || Service name, zero padded and casted to u64.
|}

== RegisterService ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x0000000C
|- style="border-top: double"
| 0 || "SFCI"
|-
| 1 || 0x00000002
|-
| 2 || Service name, zero padded and casted to u64.
|-
| 3 || Max sessions? 32-bit integer.
|-
| 4 || Unknown bool
|}

== UnregisterService ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x0000000A
|- style="border-top: double"
| 0 || "SFCI"
|-
| 1 || 0x00000003
|-
| 2 || Service name, zero padded and casted to u64.
|}

= sm:m =

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Notes
|-
| 0 || RegisterProcess || u32 PID + 2 A Descriptors (unknown, probably service access lists of some kind) ||
|-
| 1 || UnregisterProcess || u32 PID ||
|}

= Service List =
{| class="wikitable" border="1"
|-
! Service names
! scope="col" width="200" | Description
! scope="col" width="200" | Notes
|-
| acc:u0, acc:u1, acc:aa, acc:su
| [[Account services]]
| u0: System, u1: User, su: Admin, aa: Baas
|-
| ahid:cd, ahid:hdr, hid, hid:dbg, hid:sys, irs, irs:sys, xcd:sys
| [[HID services]]
|
|-
| appletAE, appletOE, idle:sys, omm, spsm
| [[AM services]]
|
|-
| [ [[1.0.0]] +] aoc:u, mii:u, mii:e, ns:am, ns:su, ns:dev, pl:u, ovln:rcv, ovln:snd, pdm:ntfy, pdm:qry

[ [[3.0.0]] +] aoc:u, ns:am2, ns:dev, ns:ec, ns:rid, ns:rt, ns:su, ns:vm, ns:web, ovln:rcv, ovln:snd
| [[NS Services]]
| am: Application Manager, su: System Update
|-
| apm, apm:p, apm:sys, fgm, fgm:0, fgm:9, (fgm:dbg?)
| [[APM services]]
| fgm: Fuel guage?
|-
| arp:r, arp:w, bgtc:t, bgtc:sc
| [[Glue services]]
| r: Reader, w: Writer
|-
| audin:a, audin:d, audin:u, audout:a, audout:d, audout:u, audren:a, audren:d, audren:u, audrec:a, audrec:d, audrec:u, audctl, codecctl, hwopus
| Audio services
|
|-
| <nowiki>bcat:a, bcat:u, bcat:m, bcat:s, news:a, news:c, news:m, news:p, news:v, prepo:u, prepo:s, prepo:m, prepo:a</nowiki>
| [[BCAT services]]
|
|-
| bpc, bpc:r, pcv, pcv:arb, pcv:imm, time:u, time:a, time:s
| [[PCV services]]
|
|-
| bsd:u, bsd:s, bsdcfg, ethc:c, ethc:i, nsd:u, nsd:a, sfdnsres
| [[Sockets services]], [[NSD services]]
|
|-
| btdrv
| [[Bluetooth Driver services]]
|
|-
| btm, btm:dbg, btm:sys
| Battery services
|
|-
| caps:a, caps:c
| [[Capture services]]
| a: AlbumAccessor, c: AlbumControl
|-
| caps:sc, caps:ss, mm:u, vi:m, vi:s, vi:u, cec-mgr
| [[Display services]]
|
|-
| dispdrv
| Nvnflinger services
|
|-
| erpt:c, erpt:r
| [[Error Report services]]
|
|-
| es
| ETicket services
|
|-
| fan, psm, tc, ts
| [[PTM services]]
|
|-
| fatal:u, fatal:p
| Fatal Error services
| u: User, p: Privileged
|-
| friend:u, friend:v, friend:m, friend:s, friend:a
| Friend services
|
|-
| fsp-srv, fsp-ldr, fsp-pr
| [[Filesystem services]]
| srv: Main, ldr: Loader, pr: Program Registry
|-
| gpio, i2c, i2c:pcv, pinmux, pwm, uart
| [[Bus services]]
|
|-
| htc, htcs, htc:tenv
| [[TMA services]]
|
|-
| lbl
| [[Backlight services]]
|
|-
| ldn:m, ldn:s, ldn:u
| [[LDN services]]
|
|-
| [ [[1.0.0]]+ ] ldr:pm, ldr:ro, ldr:shel, ldr:dmnt

[ [[3.0.0]]+ ] ldr:pm, ldr:shel, ldr:dmnt
| [[Loader services]]
|
|-
| lm
| [[Log services]]
|
|-
| manu
| [[Manu Services]]
| "Manufacturing", present in factory firmware but not installed on retail systems.
|-
| lr, ncm, ncm:v
| [[NCM services]]
|
|-
| nfc:am, nfc:mf:u, nfc:user, nfc:sys
| NFC services
|
|-
| nifm:u, nifm:a, nifm:s
| [[Network Interface services]]
|
|-
| nim, nim:shp, ntc
| [[NIM services]]
| shp: eShop
|-
| npns:u, npns:s
| NPNS services
|
|-
| nvdrv:a, nvdrv:s, nvdrv:t, nvdrv, nvdrvdbg, nvgem:c, nvgem:cd, nvmemp
| [[NV services]]
|
|-
| pcie
| [[PCIe services]]
|
|-
| pctl, pctl:a, pctl:s, pctl:r
| [[Parental Control services]]
|
|-
| pm:bm, pm:info, pm:shell
| [[Process Manager services]]
|
|-
| psc:c, psc:m
| PSC services
|
|-
| [ [[3.0.0]]+ ] ldr:ro, ro:dmnt
| [[Loader services|RO services]]
|
|-
| set, set:fd, set:cal, set:sys
| [[Settings services]]
| cal: calibration, sys: System Settings
|-
| [ [[3.0.0]]+ ] mii:u, mii:e, pdm:ntfy, pdm:qry, pl:u
| [[Shared Database Services]]
|
|-
| ssl
| [[SSL services]]
|
|-
| csrng, spl:
| [[SPL services]]
|
|-
| usb:ds, usb:hs, usb:pd, usb:pd:c, usb:pm
| [[USB services]]
|
|-
| wlan:inf, wlan:lcl, wlan:lg, wlan:lga, wlan:sg, wlan:soc
| WLAN services
|
|}

[[Category:Services]]

Shared Database services

2017-09-01T09:19:32Z

Hthh: Created page with " = pl:u (Shared Font Manager) = {| class="wikitable" border="1" |- ! Cmd || Name |- | 0 || RequestLoad |- | 1 || GetLoadState |- | 2 || GetSize |- | 3 || GetSharedMemoryAddres..."

= pl:u (Shared Font Manager) =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || RequestLoad
|-
| 1 || GetLoadState
|-
| 2 || GetSize
|-
| 3 || GetSharedMemoryAddressOffset
|-
| 4 || GetSharedMemoryNativeHandle
|-
| 5 || GetSharedFontInOrderOfPriority
|}

Filesystem services

2017-08-31T02:47:45Z

Hthh:

= fsp-ldr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Notes
|-
| 0 || MountCode || u64 TID + X descriptor [[#ContentPath]] || Returns an [[#IFileSystem]].
|-
| 1 || IsCodeMounted || u64 PID || Returns a bool (1 if code is mounted).
|}

= fsp-pr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Notes
|-
| 0 || SetFsPermissions || u8 storageID, u32 PID, u64 TID, ACI0_buf_size, ACID_buf_size + two A descriptors (the 0x1C FS-access control from ACI0 + the 0x2C FS-access control from ACID). || Actual FS permissions are set to (ACI0_perms & ACID_perms). Will panic(svcBreak) when buffer sizes from ipc-rawdata are invalid.
|-
| 1 || ClearFsPermissions || u32 PID to clear ||
|-
| 256 || SetEnabledProgramVerification || bool enabled ||
|}

== SetEnabledProgramVerification ==
Seems to sets a global flag to inputval & 1.

When the flag is zero, it will set ret=0 instead of ret={error} when verifying a RSA signature fails. This RSA signature seems to be the signature in the [[NPDM]] ACID. It then skips verifying what seems to be the second signature in the [[NCA_Format|NCA header]]. Note that if verifying the NPDM(?) signature is successful, and verifying that second signature fails, it will throw an error and abort.

= fsp-srv =
{| class="wikitable" border="1"
|-
! Cmd || Name || Required permissions-type and func
|-
| 1 || [[#Initialize]] ||
|-
| 2 || OpenDataFileSystemByCurrentProcess ||
|-
| 7 || [[#MountContent7]] ||
|-
| 8 || [[#MountContent]] || Depends on input.
|-
| 9 || OpenDataFileSystemByApplicationId [3.0.0+] ||
|-
| 11 || [[#MountBis]] ||
|-
| 12 || [[#OpenBisPartition]] ||
|-
| 13 || InvalidateBisCache ||
|-
| 17 || OpenHostFileSystemImpl ||
|-
| 18 || MountSdCard ||
|-
| 19 || FormatSdCard ||
|-
| 21 || [[#DeleteSaveData]] ||
|-
| 22 || [[#CreateSaveData]] ||
|-
| 23 || [[#CreateSystemSaveData]] ||
|-
| 24 || RegisterSaveDataAtomicDeletion ||
|-
| 25 || DeleteSaveDataWithSpaceId ||
|-
| 26 || FormatSdCardDryRun ||
|-
| 27 || IsExFatSupported ||
|-
| 30 || [[#OpenGameCardPartition]] ||
|-
| 31 || [[#MountGameCardPartition]] ||
|-
| 32 || ExtendSaveData [3.0.0+] ||
|-
| 51 || [[#MountSaveData]] ||
|-
| 52 || [[#MountSystemSaveData]] ||
|-
| 53 || MountSaveDataReadOnly ||
|-
| 57 || ReadSaveDataFileSystemExtraDataWithSpaceId [3.0.0+] ||
|-
| 58 || ReadSaveDataFileSystemExtraData ||
|-
| 59 || WriteSaveDataFileSystemExtraData ||
|-
| 60 || OpenSaveDataInfoReader ||
|-
| 61 || OpenSaveDataIterator ||
|-
| 80 || OpenSaveDataThumbnailFile ||
|-
| 100 || MountImageDirectory ||
|-
| 110 || [[#MountContentStorage]] ||
|-
| 200 || OpenDataStorageByCurrentProcess ||
|-
| 201 || OpenDataStorageByApplicationId [3.0.0+] ||
|-
| 202 || [[#OpenDataStorageByDataId]] ||
|-
| 203 || Returns an [[#IStorage]]. ||
|-
| 400 || [[#OpenDeviceOperator]] ||
|-
| 500 || [[#OpenSdCardDetectionEventNotifier]] ||
|-
| 501 || [[#OpenGameCardDetectionEventNotifier]] ||
|-
| 600 || SetCurrentPosixTime || 0x18, 1
|-
| 601 || QuerySaveDataTotalSize ||
|-
| 602 || [[#VerifySaveData]] ||
|-
| 603 || CorruptSaveDataForDebug ||
|-
| 604 || CreatePaddingFile ||
|-
| 605 || DeleteAllPaddingFiles ||
|-
| 606 || GetRightsId ||
|-
| 607 || RegisterExternalKey || 0x18, 1
|-
| 608 || UnregisterExternalKey ||
|-
| 609 || GetRightsIdByPath ||
|-
| 610 || GetRightsIdByPath2 (returns extra byte) [3.0.0+] ||
|-
| 620 || [[#SetSdCardEncryptionSeed]] || 0x19, 1
|-
| 800 || GetAndClearFileSystemProxyErrorInfo ||
|-
| 1000 || SetBisRootForHost ||
|-
| 1001 || SetSaveDataSize ||
|-
| 1002 || SetSaveDataRootPath ||
|-
| 1003 || DisableAutoSaveDataCreation ||
|-
| 1004 || [[#SetGlobalAccessLogMode]] || 0x10, 1
|-
| 1005 || [[#GetGlobalAccessLogMode]] || None
|-
| 1006 || [[#OutputAccessLogToSdCard]] || None
|}

== Permissions ==
Each time permissions are checked, the [[#fsp-pr|process-obj]] is loaded using the session PID, then a func is called with the permissions-type. The func retval is checked, then the permissions [[Error_codes|error]] is thrown if needed.

Internally in that process-obj load func, it will load the obj as normal when the PID is >6, otherwise it will use a fixed obj. If not done already, that fixed obj will be initialized using fixed input data, via the same code used internally by [[#fsp-pr]].

In general this func uses the input permissions-type to determine what mask value to use. That value is masked with the [[NPDM|permissions]] from the above process-obj. When the result is 0, 0 is returned, otherwise non-zero is returned. The default non-zero retval is basically 0x3.

Panic is triggered when the input type is >{max value} / invalid.

Func0:
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Non-zero retval || Notes
|-
| 0xA 0xD 0x16 0x1F 0x20 0x21 0x22 || 0x8000000000000080 || Default ||
|-
| 0x15 0x17 0x18 0x19 0x1A 0x1B 0x1C || 0x8000000000010080 || Default ||
|-
| 0x0 0x1 0x2 0x3 0x4 0x5 || 0x8000000000000801 || 0x1 ||
|-
| 0x9 0x1D 0x1E || 0x8000000000000084 || Default ||
|-
| 0xB 0xC || 0x8000000000008080 || Default ||
|-
| 0xE 0x23 || 0xC000000000200000 || Default ||
|-
| 0x12 0x13 || 0x8000000000000020 || Default ||
|-
| 0x6 || || || In this case it appears the func returns retval & 0xff, where retval = {bit0=0, bit1..bit63=obj_permissions starting at bit0}?
|-
| 0x7 || 0x8000000000000800 || Default ||
|-
| 0x8 || 0x8000000000001000 || Default ||
|-
| 0xF || 0x8000000000000010 || Default ||
|-
| 0x10 || 0x8000000000040020 || Default ||
|-
| 0x11 || 0x8000000000000028 || Default ||
|-
| 0x14 || 0x8000000000010082 || Default ||
|-
| 0x24 || 0x8000000000000100 || Default ||
|-
| 0x25 || 0x8000000000100008 || 0x1 ||
|-
| 0x26 || 0xC000000000400000 || Default ||
|}

Func1(non-zero retval is always 0x1):
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Notes
|-
| 0x0 0x1 || 0x8000000000000080 ||
|-
| 0x2 0x3 || 0x8000000000000010 ||
|-
| 0x4 0x5 || 0x8000000000000200 ||
|-
| 0x7 0xB || 0x8000000000000060 ||
|-
| 0xC 0x1A || 0x8000000000004020 ||
|-
| 0x10 0x11 || 0x8000000000080000 ||
|-
| 0x6 || 0x8000000000002020 ||
|-
| 0x8 || 0x8000000000000028 ||
|-
| 0x9 || 0x8000000000000020 ||
|-
| 0xA || 0x8000000000004028 ||
|-
| 0xD || 0x8000000000020000 ||
|-
| 0xE || 0x8000000000000400 ||
|-
| 0xF || 0x8000000000004060 ||
|-
| 0x13 || 0xC000000000800000 ||
|-
| 0x14 || 0xC000000001000000 ||
|-
| 0x15 || 0xC000000002000000 ||
|-
| 0x16 || 0x8000000004000000 ||
|-
| 0x17 || 0x8000000008000000 ||
|-
| 0x18 || 0x8000000010000000 ||
|-
| 0x19 || 0x8000000000000800 ||
|-
| 0x12 || || Invalid
|}

== Initialize ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x8000000E
|-
| 2 || 0x00000001
|- style="border-top: double"
| 0-1 || Pid
|- style="border-top: double"
| 0 || Always. 0x18000001
|-
| 1 || Always. 0
|-
| 2 || "SCFI"
|-
| 3 || 0x00000001
|-
| 4 || Always 0.
|}

== MountContent7 ==
Takes an input u32 ([[NCA]]-type) and an u64 title-id. Web-applet loads the u32 from u32_table[inparam]. Only type4 is usable with this?

Returns an [[#IFileSystem]].

Note: web-applet strings refer to both this cmd and the below "MountContent" as "MountContent".

== MountContent ==
Takes a type-0x19 input buffer, an in32, and an input title-id.

The in32 must be 5 if the NCA type is 0 (control).

The in32 must be 2..7.

The input buffer is the output string path from nsam [[NS_Services#GetContentNcaPath|GetContentNcaPath]].

Returns an [[#IFileSystem]].

May return errors when attempting to access NCA-paths for an update-title with a gamecard, when the gamecard isn't inserted. May return error 0x7D402 in some cases with update-titles. Non-val2 in32 values with NCA-type1 are unusable, even for normal titles.

The official "MountApplicationPackage" func uses this with in64=0 and in32=7.

After the in32-specific permissions are checked, it then gets the func retval for permissions-type 0x25 and func0.

When in32=5, it uses in64=0xffffffffffffffff internally, otherwise it checks if in64 is set to 0xffffffffffffffff then throws an error if so.

{| class="wikitable" border="1"
|-
! in32 || Required permissions-type and func
|-
| 2 || 0x0, 0
|-
| 3 || 0x2, 0
|-
| 4 || 0x3, 0
|-
| 5 || 0x1, 0
|-
| 6 || 0x4, 0
|-
| 7 || 0x5, 0
|}

== MountBis ==
Takes a type-0x19 input buffer string and a u32 Bis partitionID(see below). Official user-process code sets instr[0] = 0 normally.

Returns an [[#IFileSystem]].

Only partitionIDs for FAT partitions are usable with this, otherwise error 0x2EE202 is returned. Seems to be about the same as [[#OpenBisPartition]] except this mounts the partition filesystem instead of allowing direct access to the partition sectors.

== OpenBisPartition ==
Takes a u32 partition ID, returns 0x2EE202 for partitions which do not exist, 0x320002 for partitions which cannot be opened and a valid [[#IStorage]] handle otherwise.

== DeleteSaveData ==
Takes an input u64.

== CreateSaveData ==
Takes a 0x40-byte Save-struct entry, a 0x40-byte SaveCreate-struct entry, and a 0x10-byte input struct.

Only the first 0x5-bytes in the 0x10-byte struct are initialized: all-zero when automatically creating savedata during savecommon mount by official user-processes. In the dedicated save-creation code in official user-processes: +0 u32 = 0x40060, +4 u8 = 1.

Creates regular savedata.

== CreateSystemSaveData ==
Takes a 0x40-byte Save-struct entry and a 0x40-byte SaveCreate-struct entry.

Creates savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== OpenGameCardPartition ==

Takes an input u32 (partition ID), and returns an [[#IStorage]] for the [[Gamecard_Format|partition]].

== MountGameCardPartition ==
Takes two input u32s, with the second u32 located at +4 in rawdata after the first u32.

Returns an [[#IFileSystem]].

Mounts a gamecard [[Gamecard_Partition|partition]].

== MountSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Official user-process code is only known to use value 1 for the u8.

Returns an [[#IFileSystem]].

Permissions aren't checked until the specified save is successfully found.

Only one process can mount a given savedata at any given time (this includes systemsavedata).

== MountSystemSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Web-applet only uses value0 for the input u8.

Returns an [[#IFileSystem]].

Mounts savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== MountContentStorage ==
Takes a [[#ContentStorageId]]. Invalid values return 0x2EE202.

Returns an [[#IFileSystem]] with NCA files. The read data from these files is identical to the data read by [[Content_Manager_services#ReadEntryRaw]].

== OpenDataStorageByDataId ==
Takes a [[#StorageId]] and a TitleID.

Returns a [[IPC_Marshalling#Domain_message|domain object ID]] implementing the [[#IStorage]] interface for data archives.

== OpenDeviceOperator ==
This command returns a session to a port implementing the [[#IDeviceOperator]] interface.

== OpenSdCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== OpenGameCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== VerifySaveData ==
Takes an unknown input u64 and a type-0x6 output buffer.

The input u64 high-byte must be non-zero, otherwise an [[Error_codes|error]] is returned(0xE02).

== SetSdCardEncryptionSeed ==
Takes 0x10-bytes of input.

Appears to be used to load the seed into FS-module state, since FS-module itself doesn't seem to have file-reading code to handle this itself.

[[NS_Services|NS]]-module uses this with data read from a file.

== SetGlobalAccessLogMode ==
Takes an input u32.

== GetGlobalAccessLogMode ==
Returns an output u32.

GlobalAccessLogMode is normally 0.

== OutputAccessLogToSdCard ==
Takes a type-0x5 input buffer.

The input buffer is the string to output to the log. User-processes normally include a newline at the end.

User-processes only use this when the value previously loaded from [[#GetGlobalAccessLogMode]] has bit1 set.

When bit1 in GlobalAccessLogMode is clear, FS-module will just return 0 for OutputAccessLogToSdCard. However even with that set the log doesn't show up SD, unknown why.

The input buffer is written to the "$FsAccessLog:/FsAccessLog.txt" file, where "$FsAccessLog" is the SD-card mount-name. It's written to the current end of the file(appended).

= IStorage =
This is the interface for a raw device, usually a block device.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments
|-
| 0 || Read || Takes a type-0x46 buffer, an offset and length
|-
| 1 || Write || Takes a type-0x45 buffer, an offset and length
|-
| 2 || Flush || None
|-
| 3 || SetSize || Takes a size
|-
| 4 || GetSize || None
|}

= IFileSystem =
There are two main implementations of this interface:

* '''RomFS''': Filesystem implementation statically linked in the binary. Uses an [[#IStorage]] interface as underlying raw device.
* '''IPC proxy''': Used for all non-RomFS filesystems. In this case, actual filesystem implementation is in the FS process.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateFile
|-
| 1 || DeleteFile
|-
| 2 || CreateDirectory
|-
| 3 || DeleteDirectory
|-
| 4 || DeleteDirectoryRecursively
|-
| 5 || RenameFile
|-
| 6 || RenameDirectory
|-
| 7 || GetEntryType
|-
| 8 || OpenFile
|-
| 9 || OpenDirectory
|-
| 10 || Commit
|-
| 11 || GetFreeSpaceSize
|-
| 12 || GetTotalSpaceSize
|-
| 13 || CleanDirectoryRecursively [3.0.0+]
|-
| 14 || GetFileTimeStampRaw [3.0.0+]
|}

== Commit ==
Like [https://3dbrew.org/wiki/FS:ControlArchive 3DS], this has to be used after writing to savedata for the changes to take affect.

= IDirectory =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Read
|-
| 1 || GetEntryCount
|}

= IFile =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Read
|-
| 1 || Write
|-
| 2 || Flush
|-
| 3 || SetSize
|-
| 4 || GetSize
|}

= ISaveDataInfoReader =

= IDeviceOperator =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsSdCardInserted
|-
| 1 || GetSdCardSpeedMode
|-
| 2 || GetSdCardCid
|-
| 3 || GetSdCardUserAreaSize
|-
| 4 || GetSdCardProtectedAreaSize
|-
| 5 || GetAndClearSdCardErrorInfo
|-
| 6 ||
|-
| 100 || GetMmcCid
|-
| 101 || GetMmcSpeedMode
|-
| 110 || EraseMmc
|-
| 111 || GetMmcPartitionSize
|-
| 112 || GetMmcPatrolCount
|-
| 113 || GetAndClearMmcErrorInfo
|-
| 114 || GetMmcExtendedCsd
|-
| 200 || IsGameCardInserted
|-
| 201 || EraseGameCard
|-
| 202 || GetGameCardHandle
|-
| 203 || [[#GetGameCardUpdatePartitionInfo]]
|-
| 204 || FinalizeGameCardDriver
|-
| 205 || GetGameCardAttribute
|-
| 206 || GetGameCardDeviceCertificate
|-
| 207 || GetGameCardAsicInfo
|-
| 208 || GetGameCardIdSet
|-
| 209 || WriteToGameCard
|-
| 210 || SetVerifyWriteEnalbleFlag
|-
| 211 || GetGameCardImageHash
|-
| 212 || GetGameCardErrorInfo
|-
| 213 ||
|-
| 214 || GetGameCardCid
|-
| 215 ||
|-
| 216 ||
|-
| 217 || [2.1.0+] Returns 0x40-bytes of output data.
|-
| 300 || SetSpeedEmulationMode
|-
| 301 || GetSpeedEmulationMode
|}

== GetGameCardUpdatePartitionInfo ==

Returns a titleID and the title-version for it.

* Output u32 with ARMS-gamecard: title-version v131162. This is the title-version for [[2.1.0]], which is the sysupdate included with this gamecard. Launch-day gamecards return title-version v450.
* Output u64 with ARMS-gamecard: titleID 0100000000000816.

[[NS_Services|NS]] appears to only use this with [[Content_Manager_services#GetTitleIdInfo]] and [[Content_Manager_services#GetUpdateTitleList]] with storageid=nandsys, for checking whether a sysupdate is required.

= IEventNotifier =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || BindEvent
|}

= StorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || None
|-
| 1 || Host
|-
| 2 || GameCard
|-
| 3 || NandSystem
|-
| 4 || NandUser
|-
| 5 || SdCard
|}

= ContentStorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || NandSystem
|-
| 1 || NandUser
|-
| 2 || SdCard
|}

= ContentPath =
These are the 0x300 paths to NCA files for the various filesystems FS can access, beginning with @. They're passed via X descriptors, and returned via various [[Location Resolver services|ncm/lr]] commands.

{| class="wikitable" border="1"
|-
! Path || Notes
|-
| @GcApp || Gamecard App partition (Partition 2)
|-
| @GcS00000001 || Gamecard Contents.
|-
| @SdCardContent || Installed SD card contents
|-
| @Sdcard || Raw SD card partition
|-
| @SystemContent || NandSystem partition.
|-
| @upp || Gamecard update partition (Partition 0)
|-
| @UserContent || NandUser partition.
|}

=BisPartitionID=
* 0: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 0.
* 10: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 1.
* Rest: see [[Flash_Filesystem|here]].

=Save Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| 0 for SystemSaveData. SaveData: 0 can be used for accessing the savedata associated with the current FS session titleID, otherwise when set this is the titleID associated with the savedata to access.
|-
| 0x8
| 0x10
| userID for user-specific savedata(saveuser) when set, otherwise when zero this indicates the common savedata(savecommon). This is loaded from [[Account_services]].
|-
| 0x18
| 0x8
| u64 [[Flash_Filesystem|saveID]]. 0 for SaveData.
|-
| 0x20
| 0x8
| ContentStorageId? 0 for SystemSaveData. 1 for SaveData. 2 for DeviceSaveData(with official user-processes all other fields are 0 for DeviceSaveData).
|-
| 0x28
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x30
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x38
| 0x8
| 0 for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=SaveCreate Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[Savegames|IVFC]] level4 size?
|-
| 0x8
| 0x8
| Same as offset 0x0 normally? Hard-coded to 0x80000 for BcatSaveData.
|-
| 0x10
| 0x8
| 0x4000 for SystemSaveData/SaveData/DeviceSaveData/BcatSaveData. [[Savegames|IVFC]] level4 block-size in bytes?
|-
| 0x18
| 0x8
| Official user-processes only uses 0 here for SystemSaveData/SaveData. For the dedicated save-creation code with SaveData/DeviceSaveData, this value comes from an input param with official user-processes. For BcatSaveData, this is the hard-coded [[Title_list|titleID]] of the bcat-sysmodule.
|-
| 0x20
| 0x4
| Written using an input param for official user-processes. Hard-coded 0 for BcatSaveData.
|-
| 0x24
| 0x1
| Official user-processes only uses 0 here for SystemSaveData, 1 for SaveData/DeviceSaveData/BcatSaveData.
|-
| 0x25
| 0x1
| 0 for SystemSaveData/SaveData.
|-
| 0x26
| 0x1A
| Not initialized for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=DeviceSaveData=
This is accessed using the same commands for SaveData with the same input u8, the only difference compared to SaveData is the Save-struct.

=BcatSaveData=
This is accessed using the same commands for SaveData with the same input u8. The Save-struct is the same as DeviceSaveData, except that the titleID field is set to <input titleID>. See above regarding SaveCreate-struct.

The 0x10-byte struct passed to [[#CreateSaveData]] has the first 0x5-bytes set to all-zero.

[[Category:Services]]

Filesystem services

2017-08-30T01:36:02Z

Hthh:

= fsp-ldr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Notes
|-
| 0 || MountCode || u64 TID + X descriptor [[#ContentPath]] || Returns an [[#IFileSystem]].
|-
| 1 || IsCodeMounted || u64 PID || Returns a bool (1 if code is mounted).
|}

= fsp-pr =
{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Notes
|-
| 0 || SetFsPermissions || u8 storageID, u32 PID, u64 TID, ACI0_buf_size, ACID_buf_size + two A descriptors (the 0x1C FS-access control from ACI0 + the 0x2C FS-access control from ACID). || Actual FS permissions are set to (ACI0_perms & ACID_perms). Will panic(svcBreak) when buffer sizes from ipc-rawdata are invalid.
|-
| 1 || ClearFsPermissions || u32 PID to clear ||
|-
| 256 || SetEnabledProgramVerification || bool enabled ||
|}

== SetEnabledProgramVerification ==
Seems to sets a global flag to inputval & 1.

When the flag is zero, it will set ret=0 instead of ret={error} when verifying a RSA signature fails. This RSA signature seems to be the signature in the [[NPDM]] ACID. It then skips verifying what seems to be the second signature in the [[NCA_Format|NCA header]]. Note that if verifying the NPDM(?) signature is successful, and verifying that second signature fails, it will throw an error and abort.

= fsp-srv =
{| class="wikitable" border="1"
|-
! Cmd || Name || Required permissions-type and func
|-
| 1 || [[#Initialize]] ||
|-
| 2 || OpenDataFileSystemByCurrentProcess ||
|-
| 7 || [[#MountContent7]] ||
|-
| 8 || [[#MountContent]] || Depends on input.
|-
| 9 || OpenDataFileSystemByApplicationId [3.0.0+] ||
|-
| 11 || [[#MountBis]] ||
|-
| 12 || [[#OpenBisPartition]] ||
|-
| 13 || InvalidateBisCache ||
|-
| 17 || OpenHostFileSystemImpl ||
|-
| 18 || MountSdCard ||
|-
| 19 || FormatSdCard ||
|-
| 21 || [[#DeleteSaveData]] ||
|-
| 22 || [[#CreateSaveData]] ||
|-
| 23 || [[#CreateSystemSaveData]] ||
|-
| 24 || RegisterSaveDataAtomicDeletion ||
|-
| 25 || DeleteSaveDataWithSpaceId ||
|-
| 26 || FormatSdCardDryRun ||
|-
| 27 || IsExFatSupported ||
|-
| 30 || [[#OpenGameCardPartition]] ||
|-
| 31 || [[#MountGameCardPartition]] ||
|-
| 32 || ExtendSaveData [3.0.0+] ||
|-
| 51 || [[#MountSaveData]] ||
|-
| 52 || [[#MountSystemSaveData]] ||
|-
| 53 || MountSaveDataReadOnly ||
|-
| 57 || ReadSaveDataFileSystemExtraDataWithSpaceId [3.0.0+] ||
|-
| 58 || ReadSaveDataFileSystemExtraData ||
|-
| 59 || WriteSaveDataFileSystemExtraData ||
|-
| 60 || OpenSaveDataInfoReader ||
|-
| 61 || OpenSaveDataIterator ||
|-
| 80 || OpenSaveDataThumbnailFile ||
|-
| 100 || MountImageDirectory ||
|-
| 110 || [[#MountContentStorage]] ||
|-
| 200 || OpenDataStorageByCurrentProcess ||
|-
| 201 || OpenDataStorageByApplicationId [3.0.0+] ||
|-
| 202 || [[#OpenDataStorageByDataId]] ||
|-
| 203 || Returns an [[#IStorage]]. ||
|-
| 400 || [[#OpenDeviceOperator]] ||
|-
| 500 || [[#OpenSdCardDetectionEventNotifier]] ||
|-
| 501 || [[#OpenGameCardDetectionEventNotifier]] ||
|-
| 600 || SetCurrentPosixTime || 0x18, 1
|-
| 601 || QuerySaveDataTotalSize ||
|-
| 602 || [[#VerifySaveData]] ||
|-
| 603 || CorruptSaveDataForDebug ||
|-
| 604 || CreatePaddingFile ||
|-
| 605 || DeleteAllPaddingFiles ||
|-
| 606 || GetRightsId ||
|-
| 607 || RegisterExternalKey || 0x18, 1
|-
| 608 || UnregisterExternalKey ||
|-
| 609 || GetRightsIdByPath ||
|-
| 610 || GetRightsIdByPath2 (returns extra byte) [3.0.0+] ||
|-
| 620 || [[#SetSdCardEncryptionSeed]] || 0x19, 1
|-
| 800 || GetAndClearFileSystemProxyErrorInfo ||
|-
| 1000 || SetBisRootForHost ||
|-
| 1001 || SetSaveDataSize ||
|-
| 1002 || SetSaveDataRootPath ||
|-
| 1003 || DisableAutoSaveDataCreation ||
|-
| 1004 || [[#SetGlobalAccessLogMode]] || 0x10, 1
|-
| 1005 || [[#GetGlobalAccessLogMode]] || None
|-
| 1006 || [[#OutputAccessLogToSdCard]] || None
|}

== Permissions ==
Each time permissions are checked, the [[#fsp-pr|process-obj]] is loaded using the session PID, then a func is called with the permissions-type. The func retval is checked, then the permissions [[Error_codes|error]] is thrown if needed.

Internally in that process-obj load func, it will load the obj as normal when the PID is >6, otherwise it will use a fixed obj. If not done already, that fixed obj will be initialized using fixed input data, via the same code used internally by [[#fsp-pr]].

In general this func uses the input permissions-type to determine what mask value to use. That value is masked with the [[NPDM|permissions]] from the above process-obj. When the result is 0, 0 is returned, otherwise non-zero is returned. The default non-zero retval is basically 0x3.

Panic is triggered when the input type is >{max value} / invalid.

Func0:
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Non-zero retval || Notes
|-
| 0xA 0xD 0x16 0x1F 0x20 0x21 0x22 || 0x8000000000000080 || Default ||
|-
| 0x15 0x17 0x18 0x19 0x1A 0x1B 0x1C || 0x8000000000010080 || Default ||
|-
| 0x0 0x1 0x2 0x3 0x4 0x5 || 0x8000000000000801 || 0x1 ||
|-
| 0x9 0x1D 0x1E || 0x8000000000000084 || Default ||
|-
| 0xB 0xC || 0x8000000000008080 || Default ||
|-
| 0xE 0x23 || 0xC000000000200000 || Default ||
|-
| 0x12 0x13 || 0x8000000000000020 || Default ||
|-
| 0x6 || || || In this case it appears the func returns retval & 0xff, where retval = {bit0=0, bit1..bit63=obj_permissions starting at bit0}?
|-
| 0x7 || 0x8000000000000800 || Default ||
|-
| 0x8 || 0x8000000000001000 || Default ||
|-
| 0xF || 0x8000000000000010 || Default ||
|-
| 0x10 || 0x8000000000040020 || Default ||
|-
| 0x11 || 0x8000000000000028 || Default ||
|-
| 0x14 || 0x8000000000010082 || Default ||
|-
| 0x24 || 0x8000000000000100 || Default ||
|-
| 0x25 || 0x8000000000100008 || 0x1 ||
|-
| 0x26 || 0xC000000000400000 || Default ||
|}

Func1(non-zero retval is always 0x1):
{| class="wikitable" border="1"
|-
! Type(s) || Mask || Notes
|-
| 0x0 0x1 || 0x8000000000000080 ||
|-
| 0x2 0x3 || 0x8000000000000010 ||
|-
| 0x4 0x5 || 0x8000000000000200 ||
|-
| 0x7 0xB || 0x8000000000000060 ||
|-
| 0xC 0x1A || 0x8000000000004020 ||
|-
| 0x10 0x11 || 0x8000000000080000 ||
|-
| 0x6 || 0x8000000000002020 ||
|-
| 0x8 || 0x8000000000000028 ||
|-
| 0x9 || 0x8000000000000020 ||
|-
| 0xA || 0x8000000000004028 ||
|-
| 0xD || 0x8000000000020000 ||
|-
| 0xE || 0x8000000000000400 ||
|-
| 0xF || 0x8000000000004060 ||
|-
| 0x13 || 0xC000000000800000 ||
|-
| 0x14 || 0xC000000001000000 ||
|-
| 0x15 || 0xC000000002000000 ||
|-
| 0x16 || 0x8000000004000000 ||
|-
| 0x17 || 0x8000000008000000 ||
|-
| 0x18 || 0x8000000010000000 ||
|-
| 0x19 || 0x8000000000000800 ||
|-
| 0x12 || || Invalid
|}

== Initialize ==
{| class="wikitable" border="1"
|-
! Word || Value
|-
| 0 || 0x00000004
|-
| 1 || 0x8000000E
|-
| 2 || 0x00000001
|- style="border-top: double"
| 0-1 || Pid
|- style="border-top: double"
| 0 || Always. 0x18000001
|-
| 1 || Always. 0
|-
| 2 || "SCFI"
|-
| 3 || 0x00000001
|-
| 4 || Always 0.
|}

== MountContent7 ==
Takes an input u32 ([[NCA]]-type) and an u64 title-id. Web-applet loads the u32 from u32_table[inparam]. Only type4 is usable with this?

Returns an [[#IFileSystem]].

Note: web-applet strings refer to both this cmd and the below "MountContent" as "MountContent".

== MountContent ==
Takes a type-0x19 input buffer, an in32, and an input title-id.

The in32 must be 5 if the NCA type is 0 (control).

The in32 must be 2..7.

The input buffer is the output string path from nsam [[NS_Services#GetContentNcaPath|GetContentNcaPath]].

Returns an [[#IFileSystem]].

May return errors when attempting to access NCA-paths for an update-title with a gamecard, when the gamecard isn't inserted. May return error 0x7D402 in some cases with update-titles. Non-val2 in32 values with NCA-type1 are unusable, even for normal titles.

The official "MountApplicationPackage" func uses this with in64=0 and in32=7.

After the in32-specific permissions are checked, it then gets the func retval for permissions-type 0x25 and func0.

When in32=5, it uses in64=0xffffffffffffffff internally, otherwise it checks if in64 is set to 0xffffffffffffffff then throws an error if so.

{| class="wikitable" border="1"
|-
! in32 || Required permissions-type and func
|-
| 2 || 0x0, 0
|-
| 3 || 0x2, 0
|-
| 4 || 0x3, 0
|-
| 5 || 0x1, 0
|-
| 6 || 0x4, 0
|-
| 7 || 0x5, 0
|}

== MountBis ==
Takes a type-0x19 input buffer string and a u32 Bis partitionID(see below). Official user-process code sets instr[0] = 0 normally.

Returns an [[#IFileSystem]].

Only partitionIDs for FAT partitions are usable with this, otherwise error 0x2EE202 is returned. Seems to be about the same as [[#OpenBisPartition]] except this mounts the partition filesystem instead of allowing direct access to the partition sectors.

== OpenBisPartition ==
Takes a u32 partition ID, returns 0x2EE202 for partitions which do not exist, 0x320002 for partitions which cannot be opened and a valid [[#IStorage]] handle otherwise.

== DeleteSaveData ==
Takes an input u64.

== CreateSaveData ==
Takes a 0x40-byte Save-struct entry, a 0x40-byte SaveCreate-struct entry, and a 0x10-byte input struct.

Only the first 0x5-bytes in the 0x10-byte struct are initialized: all-zero when automatically creating savedata during savecommon mount by official user-processes. In the dedicated save-creation code in official user-processes: +0 u32 = 0x40060, +4 u8 = 1.

Creates regular savedata.

== CreateSystemSaveData ==
Takes a 0x40-byte Save-struct entry and a 0x40-byte SaveCreate-struct entry.

Creates savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== OpenGameCardPartition ==

Takes an input u32 (partition ID), and returns an [[#IStorage]] for the [[Gamecard_Format|partition]].

== MountGameCardPartition ==
Takes two input u32s, with the second u32 located at +4 in rawdata after the first u32.

Returns an [[#IFileSystem]].

Mounts a gamecard [[Gamecard_Partition|partition]].

== MountSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Official user-process code is only known to use value 1 for the u8.

Returns an [[#IFileSystem]].

Permissions aren't checked until the specified save is successfully found.

Only one process can mount a given savedata at any given time (this includes systemsavedata).

== MountSystemSaveData ==
Takes an input u8 and a 0x40-byte Save-struct entry. Web-applet only uses value0 for the input u8.

Returns an [[#IFileSystem]].

Mounts savedata in the SYSTEM [[Flash_Filesystem|NAND]] partition.

== MountContentStorage ==
Takes a [[#ContentStorageId]]. Invalid values return 0x2EE202.

Returns an [[#IFileSystem]] with NCA files. The read data from these files is identical to the data read by [[Content_Manager_services#ReadEntryRaw]].

== OpenDataStorageByDataId ==
Takes a [[#StorageId]] and a TitleID.

Returns a [[IPC_Marshalling#Domain_message|domain object ID]] implementing the [[#IStorage]] interface for data archives.

== OpenDeviceOperator ==
This command returns a session to a port implementing the [[#IDeviceOperator]] interface.

== OpenSdCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== OpenGameCardDetectionEventNotifier ==
This command returns a session to a port implementing the [[#IEventNotifier]] interface.

== VerifySaveData ==
Takes an unknown input u64 and a type-0x6 output buffer.

The input u64 high-byte must be non-zero, otherwise an [[Error_codes|error]] is returned(0xE02).

== SetSdCardEncryptionSeed ==
Takes 0x10-bytes of input.

Appears to be used to load the seed into FS-module state, since FS-module itself doesn't seem to have file-reading code to handle this itself.

[[NS_Services|NS]]-module uses this with data read from a file.

== SetGlobalAccessLogMode ==
Takes an input u32.

== GetGlobalAccessLogMode ==
Returns an output u32.

GlobalAccessLogMode is normally 0.

== OutputAccessLogToSdCard ==
Takes a type-0x5 input buffer.

The input buffer is the string to output to the log. User-processes normally include a newline at the end.

User-processes only use this when the value previously loaded from [[#GetGlobalAccessLogMode]] has bit1 set.

When bit1 in GlobalAccessLogMode is clear, FS-module will just return 0 for OutputAccessLogToSdCard. However even with that set the log doesn't show up SD, unknown why.

The input buffer is written to the "$FsAccessLog:/FsAccessLog.txt" file, where "$FsAccessLog" is the SD-card mount-name. It's written to the current end of the file(appended).

= IStorage =
This is the interface for a raw device, usually a block device.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments
|-
| 0 || Read || Takes a type-0x46 buffer, an offset and length
|-
| 1 || Write || Takes a type-0x45 buffer, an offset and length
|-
| 2 || Flush || None
|-
| 3 || SetSize || Takes a size
|-
| 4 || GetSize || None
|}

= IFileSystem =
There are two main implementations of this interface:

* '''RomFS''': Filesystem implementation statically linked in the binary. Uses an [[#IStorage]] interface as underlying raw device.
* '''IPC proxy''': Used for all non-RomFS filesystems. In this case, actual filesystem implementation is in the FS process.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || CreateFile
|-
| 1 || DeleteFile
|-
| 2 || CreateDirectory
|-
| 3 || DeleteDirectory
|-
| 4 || DeleteDirectoryRecursively
|-
| 5 || RenameFile
|-
| 6 || RenameDirectory
|-
| 7 || GetEntryType
|-
| 8 || OpenFile
|-
| 9 || OpenDirectory
|-
| 10 || Commit
|-
| 11 || GetFreeSpaceSize
|-
| 12 || GetTotalSpaceSize
|}

== Commit ==
Like [https://3dbrew.org/wiki/FS:ControlArchive 3DS], this has to be used after writing to savedata for the changes to take affect.

= IDirectory =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Read
|-
| 1 || GetEntryCount
|}

= IFile =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Read
|-
| 1 || Write
|-
| 2 || Flush
|-
| 3 || SetSize
|-
| 4 || GetSize
|}

= ISaveDataInfoReader =

= IDeviceOperator =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || IsSdCardInserted
|-
| 1 || GetSdCardSpeedMode
|-
| 2 || GetSdCardCid
|-
| 3 || GetSdCardUserAreaSize
|-
| 4 || GetSdCardProtectedAreaSize
|-
| 5 || GetAndClearSdCardErrorInfo
|-
| 6 ||
|-
| 100 || GetMmcCid
|-
| 101 || GetMmcSpeedMode
|-
| 110 || EraseMmc
|-
| 111 || GetMmcPartitionSize
|-
| 112 || GetMmcPatrolCount
|-
| 113 || GetAndClearMmcErrorInfo
|-
| 114 || GetMmcExtendedCsd
|-
| 200 || IsGameCardInserted
|-
| 201 || EraseGameCard
|-
| 202 || GetGameCardHandle
|-
| 203 || [[#GetGameCardUpdatePartitionInfo]]
|-
| 204 || FinalizeGameCardDriver
|-
| 205 || GetGameCardAttribute
|-
| 206 || GetGameCardDeviceCertificate
|-
| 207 || GetGameCardAsicInfo
|-
| 208 || GetGameCardIdSet
|-
| 209 || WriteToGameCard
|-
| 210 || SetVerifyWriteEnalbleFlag
|-
| 211 || GetGameCardImageHash
|-
| 212 || GetGameCardErrorInfo
|-
| 213 ||
|-
| 214 || GetGameCardCid
|-
| 215 ||
|-
| 216 ||
|-
| 217 || [2.1.0+] Returns 0x40-bytes of output data.
|-
| 300 || SetSpeedEmulationMode
|-
| 301 || GetSpeedEmulationMode
|}

== GetGameCardUpdatePartitionInfo ==

Returns a titleID and the title-version for it.

* Output u32 with ARMS-gamecard: title-version v131162. This is the title-version for [[2.1.0]], which is the sysupdate included with this gamecard. Launch-day gamecards return title-version v450.
* Output u64 with ARMS-gamecard: titleID 0100000000000816.

[[NS_Services|NS]] appears to only use this with [[Content_Manager_services#GetTitleIdInfo]] and [[Content_Manager_services#GetUpdateTitleList]] with storageid=nandsys, for checking whether a sysupdate is required.

= IEventNotifier =
{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || BindEvent
|}

= StorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || None
|-
| 1 || Host
|-
| 2 || GameCard
|-
| 3 || NandSystem
|-
| 4 || NandUser
|-
| 5 || SdCard
|}

= ContentStorageId =
{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || NandSystem
|-
| 1 || NandUser
|-
| 2 || SdCard
|}

= ContentPath =
These are the 0x300 paths to NCA files for the various filesystems FS can access, beginning with @. They're passed via X descriptors, and returned via various [[Location Resolver services|ncm/lr]] commands.

{| class="wikitable" border="1"
|-
! Path || Notes
|-
| @GcApp || Gamecard App partition (Partition 2)
|-
| @GcS00000001 || Gamecard Contents.
|-
| @SdCardContent || Installed SD card contents
|-
| @Sdcard || Raw SD card partition
|-
| @SystemContent || NandSystem partition.
|-
| @upp || Gamecard update partition (Partition 0)
|-
| @UserContent || NandUser partition.
|}

=BisPartitionID=
* 0: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 0.
* 10: Raw NAND sectors access for MMC [[Flash_Filesystem|boot]] partition 1.
* Rest: see [[Flash_Filesystem|here]].

=Save Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| 0 for SystemSaveData. SaveData: 0 can be used for accessing the savedata associated with the current FS session titleID, otherwise when set this is the titleID associated with the savedata to access.
|-
| 0x8
| 0x10
| userID for user-specific savedata(saveuser) when set, otherwise when zero this indicates the common savedata(savecommon). This is loaded from [[Account_services]].
|-
| 0x18
| 0x8
| u64 [[Flash_Filesystem|saveID]]. 0 for SaveData.
|-
| 0x20
| 0x8
| ContentStorageId? 0 for SystemSaveData. 1 for SaveData. 2 for DeviceSaveData(with official user-processes all other fields are 0 for DeviceSaveData).
|-
| 0x28
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x30
| 0x8
| 0 for SystemSaveData/SaveData.
|-
| 0x38
| 0x8
| 0 for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=SaveCreate Struct=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| [[Savegames|IVFC]] level4 size?
|-
| 0x8
| 0x8
| Same as offset 0x0 normally? Hard-coded to 0x80000 for BcatSaveData.
|-
| 0x10
| 0x8
| 0x4000 for SystemSaveData/SaveData/DeviceSaveData/BcatSaveData. [[Savegames|IVFC]] level4 block-size in bytes?
|-
| 0x18
| 0x8
| Official user-processes only uses 0 here for SystemSaveData/SaveData. For the dedicated save-creation code with SaveData/DeviceSaveData, this value comes from an input param with official user-processes. For BcatSaveData, this is the hard-coded [[Title_list|titleID]] of the bcat-sysmodule.
|-
| 0x20
| 0x4
| Written using an input param for official user-processes. Hard-coded 0 for BcatSaveData.
|-
| 0x24
| 0x1
| Official user-processes only uses 0 here for SystemSaveData, 1 for SaveData/DeviceSaveData/BcatSaveData.
|-
| 0x25
| 0x1
| 0 for SystemSaveData/SaveData.
|-
| 0x26
| 0x1A
| Not initialized for SystemSaveData/SaveData.
|}

Total size is 0x40-bytes.

=DeviceSaveData=
This is accessed using the same commands for SaveData with the same input u8, the only difference compared to SaveData is the Save-struct.

=BcatSaveData=
This is accessed using the same commands for SaveData with the same input u8. The Save-struct is the same as DeviceSaveData, except that the titleID field is set to <input titleID>. See above regarding SaveCreate-struct.

The 0x10-byte struct passed to [[#CreateSaveData]] has the first 0x5-bytes set to all-zero.

[[Category:Services]]

Switch System Flaws

2017-07-20T13:30:57Z

Hthh:

HIPC

2017-07-06T08:31:17Z

Hthh: Fix a few things

== IPC Command Structure ==
This is an array of u32's.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 15-0 || Type. 4=Request, 5=Control
|-
| 0 || 19-16 || Number of buf X descriptors (each: 2 words).
|-
| 0 || 23-20 || Number of buf A descriptors (each: 3 words).
|-
| 0 || 27-24 || Number of buf B descriptors (each: 3 words).
|-
| 0 || 31-28 || Number of buf W desciptors (each: 3 words), never observed.
|-
| 1 || 9-0 || Raw data size (in u32's).
|-
| 1 || 13-10 || Flags for buf C descriptor.
|-
| 1 || 31 || Enable handle descriptor.
|-
| ... || || Handle descriptor, if enabled.
|-
| ... || || Buf X descriptors, each one 2 words.
|-
| ... || || Buf A descriptors, each one 3 words.
|-
| ... || || Buf B descriptors, each one 3 words.
|-
| ... || || Type W descriptors, each one 3 words.
|-
| ... || || Raw data (including any padding).
|-
| ... || || Buf C descriptors, each one 2 words.
|}

=== Handle descriptor ===
There can only be one of this descriptor type. It is enabled by bit31 of the second word.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 0 || Send current PID.
|-
| 0 || 4-1 || Number of handles to copy
|-
| 0 || 8-5 || Number of handles to move
|-
| ... || || 8-byte PID if enabled
|-
| ... || || Handles to copy
|-
| ... || || Handles to move
|}

=== Buffer descriptor X "Pointer" ===
This one is packed even worse than A, they inserted the bit38-36 of the address ''on top'' of the counter field.

Officially, the counter is known as "receive index". This one writes to the buffer described in the ReceiveList.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 5-0 || Bits 5-0 of counter.
|-
| 0 || 8-6 || Bit 38-36 of address.
|-
| 0 || 11-9 || Bits 11-9 of counter.
|-
| 0 || 15-12 || Bit 35-32 of address.
|-
| 0 || 31-16 || Size
|-
| 1 || || Lower 32-bits of address.
|}

=== Buffer descriptor A/B/W "Send"/"Receive"/"Exchange" ===
This packing is so unnecessarily complex.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of size.
|-
| 1 || || Lower 32-bits of address.
|-
| 2 || 1-0 || Flags. Always set to 1 or 3.
|-
| 2 || 4-2 || Bit 38-36 of address.
|-
| 2 || 27-24 || Bit 35-32 of size.
|-
| 2 || 31-28 || Bit 35-32 of address.
|}

=== Buffer descriptor C "ReceiveList" ===
There's a 4-bit flag in the main header controlling the behavior of C descriptors.

If it has value 0, the C descriptor functionality is disabled. If it has value 1, there is no C descriptor. If it has value 2, there is a single C descriptor.

Otherwise it has (flag-2) C descriptors.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of address.
|-
| 1 || 15-0 || Rest of address.
|-
| 1 || 31-16 || Size
|}

== Raw data portion ==
This is an array of u32's, but individual parameters are generally stored as u64's.

{| class="wikitable" border="1"
! Word || Description
|-
| ... || Padding to align to 16
|-
| ... || Domain header padded to 16 if required
|-
| +0 || Magic ("SFCI" for requests, "SFCO" for responses) as u64
|-
| +2 || Cmd id as u64
|-
| ... || Input parameters
|-
| ... || Any u16 buffer sizes packed and aligned to 2 bytes
|}

== Official marshalling code ==
The official marshalling function takes an array of (buf_ptr, size) pairs and a type-field for each such pair.

Bitmask 0x10 seems to indicate null-terminated strings, but that flag is ignored by the marshalling code.

{| class="wikitable" border="1"
! Type Mask || Description || Direction
|-
| 4 + 1 || Creates a A descriptor with flags=0. || In
|-
| 0x40 + 4 + 1 || Creates a A descriptor with flags=1. || In
|-
| 0x80 + 4 + 1 || Creates a A descriptor with flags=3. || In
|-
| 4 + 2 || Creates a B descriptor with flags=0. || Out
|-
| 0x40 + 4 + 2 || Creates a B descriptor with flags=1. || Out
|-
| 0x80 + 4 + 2 || Creates a B descriptor with flags=3. || Out
|-
| 8 + 1 || Creates an X descriptor || In
|-
| 8 + 2 || Creates a C descriptor, and writes the u16 size to an offset into raw data. || Out
|-
| 0x10 + 8 + 2 || Creates a C descriptor || Out
|-
| 0x20 + 1 || Creates both an A and X descriptor || In
|-
| 0x20 + 2 || Creates both an B and C descriptor || Out
|}

For types 0x21, 0x22 if size doesn't fit in u16, it's added to a list. Some magic shit happens to that list.

== Official IPC Cmd Structure ==
Official struct that is stored for each IPC command. It contains precalculated offsets for different portions of the command structure.

All offsets are given is in number of u32 words.

struct IpcCmdStruct {
u8 unk0;
u8 has_handle_descriptor;
u8 pad0[2];
u32 cmd0;
u32 cmd1;
u32 offset_handle_descriptor;
u32 pad1;
u32 offset_handles;
u32 pad2;
u32 offset_x_descriptors;
u32 offset_a_descriptors;
u32 offset_b_descriptors;
u32 offset_w_descriptors; /* this is a guess */
u32 offset_raw_data;
u32 offset_c_descriptors;
u32 unk2;
u32 unk3;
}

== Control ==
When type == 5 you are talking to the IPC manager.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || ConvertSessionToDomain
|-
| 2 || DuplicateSession
|-
| 3 || QueryPointerBufferSize
|-
| 4 || DuplicateSessionEx
|}

SVC

2017-06-28T06:41:17Z

Hthh:

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || svcUnmapMemory || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || svcQueryMemory || X0=meminfo_ptr, X2=addr || W0=result, W1=pageinfo
|-
| 0x7 || svcExitProcess || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=arg, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || svcStartThread || W0=thread_handle ||
|-
| 0xA || svcExitThread || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano ||
|-
| 0xC || svcGetThreadPriority || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || svcSetThreadPriority || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || svcGetThreadCoreMask || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || svcSetThreadCoreMask || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || svcGetCurrentProcessorNumber || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=handle || ?
|-
| 0x12 || svcClearEvent || W0=handle || ?
|-
| 0x13 || svcMapSharedMemory || W0=memblk_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=memblk_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || svcCancelSynchronization || W0=handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || svcGetSystemTick || ||
|-
| 0x1F || svcConnectToPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || ||
|-
| 0x21 || svcSendSyncRequest || X0=handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || ||
|-
| 0x24 || svcGetProcessId || ||
|-
| 0x25 || svcGetThreadId || W0=thread_handle || W0=result, X1=out
|-
| 0x26 || svcBreak || X0,X1,X2=info || ?
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size ||
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x2A || svcFlushEntireDataCache || ||
|-
| 0x2B || svcFlushDataCache || ||
|-
| 0x2C || svcFlushEntireInsnCache? || ||
|-
| 0x2D || svcFlushInsnCache? || ||
|-
| .... || ? || ? || ?
|-
| 0x2F || svcGetLastThreadInfo || ||
|-
| 0x30 || svcGetResourceLimitLimitValue || ||
|-
| 0x31 || svcGetResourceLimitCurrentValue || ||
|-
| 0x32 || svcSetThreadActivity || ||
|-
| 0x33 || svcGetThreadContext3 || ||
|-
| .... || ? || ? || ?
|-
| 0x3C || svcDumpInfo || ||
|-
| .... || ? || ? || ?
|-
| 0x40 || svcCreateSession || W2=?, X3=? || W0=result, W1=client_handle, W2=server_handle
|-
| 0x41 || svcAcceptSession || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || ||
|-
| 0x43 || svcReplyAndReceive || X1=ptr_handles, W2=num_handles, X3=?, X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=?, X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=client_handle ?, W2=server_handle ?
|-
| .... || ? || ? || ?
|-
| 0x4D || svcSleepSystem || ||
|-
| 0x4E || svcReadWriteRegister || ||
|-
| 0x4F || svcSetProcessActivity || ||
|-
| 0x50 || svcCreateSharedMemory || W1=size?, W2=perm0, W3=perm1 || W0=result, W1=handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=mirror_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=mirror_handle, X1=addr, X2=size || W0=result
|-
| 0x53 || svcCreateInterruptEvent || ||
|-
| 0x54 || svcQueryPhysicalAddress || ||
|-
| 0x55 || svcQueryIoMapping || ||
|-
| 0x56 || svcCreateDeviceAddressSpace || ||
|-
| 0x57 || svcAttachDeviceAddressSpace || ||
|-
| 0x58 || svcDetachDeviceAddressSpace || ||
|-
| 0x59 || svcMapDeviceAddressSpaceByForce || ||
|-
| 0x5A || svcMapDeviceAddressSpaceAligned || ||
|-
| 0x5B || svcMapDeviceAddressSpace || ||
|-
| 0x5C || svcUnmapDeviceAddressSpace || ||
|-
| 0x5D || svcInvalidateProcessDataCache || ||
|-
| 0x5E || svcStoreProcessDataCache || ||
|-
| 0x5F || svcFlushProcessDataCache || ||
|-
| 0x60 || svcDebugActiveProcess || ||
|-
| 0x61 || svcBreakDebugProcess || ||
|-
| 0x62 || svcTerminateDebugProcess || ||
|-
| 0x63 || svcGetDebugEvent || ||
|-
| 0x64 || svcContinueDebugEvent || ||
|-
| 0x65 || svcGetProcessList || ||
|-
| 0x66 || svcGetThreadList || ||
|-
| 0x67 || svcGetDebugThreadContext || ||
|-
| 0x68 || svcSetDebugThreadContext || ||
|-
| 0x69 || svcQueryDebugProcessMemory || ||
|-
| 0x6A || svcReadDebugProcessMemory || ||
|-
| 0x6B || svcWriteDebugProcessMemory || ||
|-
| 0x6C || svcSetHardwareBreakPoint || ||
|-
| 0x6D || svcGetDebugThreadParam || ||
|-
| .... || ? || ? || ?
|-
| 0x70 || svcCreatePort || ||
|-
| 0x71 || svcManageNamedPort || ||
|-
| 0x72 || svcConnectToPort || ||
|-
| 0x73 || svcSetProcessMemoryPermission || ||
|-
| 0x74 || svcMapProcessMemory || X0=srcaddr, W1=process_handle, X2=dstaddr, X3=size || W0=result
|-
| 0x75 || svcUnmapProcessMemory || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || svcQueryProcessMemory || ||
|-
| 0x77 || svcMapProcessCodeMemory || W0=process_handle, X21dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || svcUnmapProcessCodeMemory || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || svcCreateProcess || ||
|-
| 0x7A || svcStartProcess || ||
|-
| 0x7B || svcTerminateProcess || ||
|-
| 0x7C || svcGetProcessInfo || ||
|-
| 0x7D || svcCreateResourceLimit || ||
|-
| 0x7E || svcSetResourceLimitLimitValue || ||
|-
| 0x7F || svcCallSecureMonitor || ||
|}

== svcSetHeapSize ==
Size must be a multiple of 0x2000000. The heap base-address is written to out.

== svcSetMemoryPermission ==
Bit2 of permission (exec) is not allowed.

Setting write-only is not allowed either (bit1).

== svcSetMemoryAttribute ==
{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit35 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit35 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit35 in [[#MemoryAttribute]].
|}

This might used for switching between cached and non-cached mappings.

== svcMapMemory ==
Memory is only allowed to be mapped into a special region.

Code can get the range of this region from [[#svcGetInfo]].

The source region gets reprotected to ---, and sets bit32 is set in [[#MemoryAttribute]].

== svcCreateThread ==
Processor_id must be 0,1,2,3 or -2.

== svcSleepThread ==
Setting nano=0 means "yield thread".

== svcCreateTransferMemory ==
This one reprotects the src block with perms you give it. It also sets bit32 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit32 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==
Works with num_handles <= 0x40, error on num_handles == 0.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

== svcSendSyncRequestWithUserBuffer ==
Size must be 0x1000-aligned.

== svcBreak ==
When used on retail where inx0 bit31 is clear, the system will throw a [[Error_codes|fatal-error]]. Otherwise when bit31 is set, it will return 0.

== svcGetInfo ==
{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || Core available mask. Always 0xF meaning all 4 cores available.
|-
| Process || 1 || 0 || Always 0xfffffffff0000000.
|-
| Process || 2 || 0 || Randomized unknown base-address.
|-
| Process || 3 || 0 || Always 0x1000000000.
|-
| Process || 4 || 0 || Heap base. Randomized.
|-
| Process || 5 || 0 || Heap region size. Always 0x180000000.
|-
| Process || 6 || 0 || Total memory usage?
|-
| Process || 7 || 0 || Process heap size.
|-
| Zero || 8 || 0 || Always 0. Used during exception handling.
|-
| Zero || 9 || 0 || This creates and returns an unknown handle.
|-
| Zero || 10 || -1, {current coreid} || Unknown. Output data changes each time this SVC is used. Global and core-specific tick-count?
|-
| Zero || 11 || 0-3 || Returns random from TRNG. Used to seed usermode PRNGs. Unknown what exactly causes this output to change, however it does change when exiting+launching a process.
|-
| Process || 12 || 0 || Address space start. Always 0x8000000.
|-
| Process || 13 || 0 || Address space size. Always 0x7ff8000000.
|-
| Process || 14 || 0 || Map region base. Randomized.
|-
| Process || 15 || 0 || Map region size.
|-
| Process || 18 || 0 || Title-id, introduced with [[3.0.0]]
|}

== svcMapTransferMemory ==
The newly mapped pages will have [[#MemoryAttribute]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==
Size must match size given in map syscall, otherwise there's an invalid-size error.

== MemoryAttribute ==
{| class=wikitable
! Lower 8 bits || Type || Meaning
|-
| 0x3 || Code static || .text and .rodata
|-
| 0x4 || Code || .data
|-
| 0x5 || Heap ||
|-
| 0x6 || Shared memory block ||
|-
| 0x8 || Module code static || .text and .rodata
|-
| 0x9 || Module code || .data
|-
| 0xB || Mapped memory ||
|-
| 0xC || Thread local storage ||
|-
| 0xE || Transfer memory ||
|-
| 0x10 || Reserved ||
|}

Bit32: is_mirrored
Bit34: is_nv_locked
Bit35: is_uncached?

=Exception Handling=
There appears to be userland code for handling exceptions, however this doesn't seem to be executed on retail.

On usermode exception, it jumps to main code binary entrypoint (main_binary_address+0) with X0=exception_info_ptr and X1=exception_info2_ptr.
On boot, X0 is set to 0 triggering normal crt0 setup.

SVC

2017-06-24T09:29:29Z

Hthh: SVC 0x40 is svcCreateSession, SVC 0x45 is used to create "event" handles

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcProtectMemory]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryState]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMirrorStack]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || svcUnmirrorStack || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || svcQueryMemory || X0=meminfo_ptr, X2=addr || W0=result, W1=pageinfo
|-
| 0x7 || svcExitProcess || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=arg, X3=stacktop, W4=prio, W5=processor_id || W0=result, W1=handle
|-
| 0x9 || svcStartThread || W0=thread_handle ||
|-
| 0xA || svcExitThread || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano ||
|-
| 0xC || svcGetThreadPriority || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || svcSetThreadPriority || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || svcGetThreadAffinityMask || W2=thread_handle || W0=result, W1=out, X2=out
|-
| 0xF || svcSetThreadAffinityMask || W0=thread_handle, W1=in, X2=in2 || W0=result
|-
| 0x10 || svcGetCurrentProcessorNumber || None || W0/X0=cpuid
|-
| 0x11 || svcGetMemoryBlockSomethingA? || W0=handle || ?
|-
| 0x12 || svcGetMemoryBlockSomethingB? || W0=handle || ?
|-
| 0x13 || svcMapMemoryBlock || W0=memblk_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapMemoryBlock || W0=memblk_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateMemoryMirror]] || X1=addr, X2=size, W3=perm || W0=result, W1=handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcClearEvent || W0=handle || W0=result
|-
| 0x18 || [[#svcWaitEvents]] || X1=handles_ptr, W2=num_handles. X3=timeout || W0=result, W1=handle_idx
|-
| 0x19 || svcSignalEvent || W0=handle || W0=result
|-
| 0x1A || svcLockMutex || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcUnlockMutex || X0=ptr ||
|-
| 0x1C || svcCondWait || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout || W0=result
|-
| 0x1D || svcCondBroadcast || X0=ptr, W1=value || W0=result
|-
| .... || ? || ? || ?
|-
| 0x1F || svcConnectToPort || X1=port_name_str || W0=result, W1=handle
|-
| .... || ? || ? || ?
|-
| 0x21 || svcSendSyncRequest || X0=handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestByBuf]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| .... || ? || ? || ?
|-
| 0x25 || svcGetThreadId || W0=thread_handle || W0=result, X1=out
|-
| 0x26 || svcBreak || X0,X1,X2=info || ?
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size ||
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| .... || ? || ? || ?
|-
| 0x40 || svcCreateSession || W2=?, X3=? || W0=result, W1=client_handle, W2=server_handle
|-
| 0x41 || svcAcceptSession || W1=port_handle || W0=result, W1=session_handle
|-
| .... || ? || ? || ?
|-
| 0x43 || svcReplyAndReceive || X1=ptr_handles, W2=num_handles, X3=?, X4=timeout || W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveByBuf || X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=?, X6=timeout || W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent ? || None || W0=result, W1=client_handle ?, W2=server_handle ?
|-
| .... || ? || ? || ?
|-
| 0x50 || svcCreateMemoryBlock || W1=size?, W2=perm0, W3=perm1 || W0=result, W1=handle
|-
| 0x51 || [[#svcMapMemoryMirror]] || X0=mirror_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapMemoryMirror]] || W0=mirror_handle, X1=addr, X2=size || W0=result
|}

== svcSetHeapSize ==
Size must be a multiple of 0x2000000. The heap base-address is written to out.

== svcProtectMemory ==
Bit2 of permission (exec) is not allowed.

Setting write-only is not allowed either (bit1).

== svcSetMemoryState ==
{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit35 in [[#MemoryState]].
|-
| 8 || 0 || Clear bit35 in [[#MemoryState]].
|-
| 8 || 8 || Set bit35 in [[#MemoryState]].
|}

This might used for switching between cached and non-cached mappings.

== svcMirrorStack ==
Memory is only allowed to be mapped into a special region.

Code can get the range of this region from [[#svcGetInfo]].

The source region gets reprotected to ---, and sets bit32 is set in [[#MemoryState]].

== svcCreateThread ==
Processor_id must be 0,1,2,3 or -2.

== svcSleepThread ==
Setting nano=0 means "yield thread".

== svcCreateMemoryMirror ==
This one reprotects the src block with perms you give it. It also sets bit32 into [[#MemoryState]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit32 in [[#MemoryState]] to clear, and the permission to reset.

== svcWaitEvents ==
Works with num_handles <= 0x40, error on num_handles == 0.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

== svcSendSyncRequestByBuf ==
Size must be 0x1000-aligned.

== svcBreak ==
When used on retail where inx0 bit31 is clear, the system will throw a [[Error_codes|fatal-error]]. Otherwise when bit31 is set, it will return 0.

== svcGetInfo ==
{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || Core available mask. Always 0xF meaning all 4 cores available.
|-
| Process || 1 || 0 || Always 0xfffffffff0000000.
|-
| Process || 2 || 0 || Randomized unknown base-address.
|-
| Process || 3 || 0 || Always 0x1000000000.
|-
| Process || 4 || 0 || Randomized heap base-address.
|-
| Process || 5 || 0 || Always 0x180000000.
|-
| Process || 6 || 0 || Total memory usage?
|-
| Process || 7 || 0 || Process heap size.
|-
| Zero || 8 || 0 || Always 0. Used during exception handling.
|-
| Zero || 9 || 0 || This creates and returns an unknown handle.
|-
| Zero || 10 || -1, {current coreid} || Unknown. Output data changes each time this SVC is used. Global and core-specific tick-count?
|-
| Zero || 11 || 0-3 || Returns random from TRNG. Used to seed usermode PRNGs. Unknown what exactly causes this output to change, however it does change when exiting+launching a process.
|-
| Process || 12 || 0 || Always 0x8000000.
|-
| Process || 13 || 0 || Always 0x7ff8000000.
|-
| Process || 14 || 0 || Start of stack mirror region.
|-
| Process || 15 || 0 || Size of stack mirror region.
|}

== svcMapMemoryMirror ==
The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapMemoryMirror ==
Size must match size given in map syscall, otherwise there's an invalid-size error.

== MemoryState ==
{| class=wikitable
! Lower 8 bits || Type || Meaning
|-
| 0x3 || Code static || .text and .rodata
|-
| 0x4 || Code || .data
|-
| 0x5 || Heap ||
|-
| 0x6 || Shared memory block ||
|-
| 0x8 || Module code static || .text and .rodata
|-
| 0x9 || Module code || .data
|-
| 0xB || Stack mirror ||
|-
| 0xC || Thread local storage ||
|-
| 0xE || Memory mirror ||
|-
| 0x10 || Reserved ||
|}

Bit32: is_mirrored
Bit34: is_nv_locked
Bit35: is_uncached?

=Exception Handling=
There appears to be userland code for handling exceptions, however this doesn't seem to be executed on retail.

On usermode exception, it jumps to main code binary entrypoint (main_binary_address+0) with X0=exception_info_ptr and X1=exception_info2_ptr.
On boot, X0 is set to 0 triggering normal crt0 setup.