Nintendo Switch Brew - User contributions [en]

SVC

2021-02-20T05:38:55Z

PixelyIon: Add Argument32 value for Result in WaitForAddress and SignalToAddress

__NOTOC__

= System calls =
{| class=wikitable
! ID || Return Type || Name || Arguments
|-
| 0x01 || Result || [[#SetHeapSize|SetHeapSize]] || uintptr_t *out_address, size_t size
|-
| 0x02 || Result || [[#SetMemoryPermission|SetMemoryPermission]] || uintptr_t address, size_t size, MemoryPermission perm
|-
| 0x03 || Result || [[#SetMemoryAttribute|SetMemoryAttribute]] || uintptr_t address, size_t size, uint32_t mask, uint32_t attr
|-
| 0x04 || Result || [[#MapMemory|MapMemory]] || uintptr_t dst_address, uintptr_t src_address, size_t size
|-
| 0x05 || Result || [[#UnmapMemory|UnmapMemory]] || uintptr_t dst_address, uintptr_t src_address, size_t size
|-
| 0x06 || Result || [[#QueryMemory|QueryMemory]] || arch::MemoryInfo *out_memory_info, PageInfo *out_page_info, uintptr_t address
|-
| 0x07 || void || [[#ExitProcess|ExitProcess]] ||
|-
| 0x08 || Result || [[#CreateThread|CreateThread]] || Handle *out_handle, ThreadFunc func, uintptr_t arg, uintptr_t stack_bottom, int32_t priority, int32_t core_id
|-
| 0x09 || Result || [[#StartThread|StartThread]] || Handle thread_handle
|-
| 0x0A || void || [[#ExitThread|ExitThread]] ||
|-
| 0x0B || void || [[#SleepThread|SleepThread]] || int64_t ns
|-
| 0x0C || Result || [[#GetThreadPriority|GetThreadPriority]] || int32_t *out_priority, Handle thread_handle
|-
| 0x0D || Result || [[#SetThreadPriority|SetThreadPriority]] || Handle thread_handle, int32_t priority
|-
| 0x0E || Result || [[#GetThreadCoreMask|GetThreadCoreMask]] || int32_t *out_core_id, uint64_t *out_affinity_mask, Handle thread_handle
|-
| 0x0F || Result || [[#SetThreadCoreMask|SetThreadCoreMask]] || Handle thread_handle, int32_t core_id, uint64_t affinity_mask
|-
| 0x10 || int32_t || [[#GetCurrentProcessorNumber|GetCurrentProcessorNumber]] ||
|-
| 0x11 || Result || [[#SignalEvent|SignalEvent]] || Handle event_handle
|-
| 0x12 || Result || [[#ClearEvent|ClearEvent]] || Handle event_handle
|-
| 0x13 || Result || [[#MapSharedMemory|MapSharedMemory]] || Handle shmem_handle, uintptr_t address, size_t size, MemoryPermission map_perm
|-
| 0x14 || Result || [[#UnmapSharedMemory|UnmapSharedMemory]] || Handle shmem_handle, uintptr_t address, size_t size
|-
| 0x15 || Result || [[#CreateTransferMemory|CreateTransferMemory]] || Handle *out_handle, uintptr_t address, size_t size, MemoryPermission map_perm
|-
| 0x16 || Result || [[#CloseHandle|CloseHandle]] || Handle handle
|-
| 0x17 || Result || [[#ResetSignal|ResetSignal]] || Handle handle
|-
| 0x18 || Result || [[#WaitSynchronization|WaitSynchronization]] || int32_t *out_index, const Handle *handles, int32_t numHandles, int64_t timeout_ns
|-
| 0x19 || Result || [[#CancelSynchronization|CancelSynchronization]] || Handle handle
|-
| 0x1A || Result || [[#ArbitrateLock|ArbitrateLock]] || Handle thread_handle, uintptr_t address, uint32_t tag
|-
| 0x1B || Result || [[#ArbitrateUnlock|ArbitrateUnlock]] || uintptr_t address
|-
| 0x1C || Result || [[#WaitProcessWideKeyAtomic|WaitProcessWideKeyAtomic]] || uintptr_t address, uintptr_t cv_key, uint32_t tag, int64_t timeout_ns
|-
| 0x1D || void || [[#SignalProcessWideKey|SignalProcessWideKey]] || uintptr_t cv_key, int32_t count
|-
| 0x1E || int64_t || [[#GetSystemTick|GetSystemTick]] ||
|-
| 0x1F || Result || [[#ConnectToNamedPort|ConnectToNamedPort]] || Handle *out_handle, const char *name
|-
| 0x20 || Result || [[#SendSyncRequestLight|SendSyncRequestLight]] || Handle session_handle
|-
| 0x21 || Result || [[#SendSyncRequest|SendSyncRequest]] || Handle session_handle
|-
| 0x22 || Result || [[#SendSyncRequestWithUserBuffer|SendSyncRequestWithUserBuffer]] || uintptr_t message_buffer, size_t message_buffer_size, Handle session_handle
|-
| 0x23 || Result || [[#SendAsyncRequestWithUserBuffer|SendAsyncRequestWithUserBuffer]] || Handle *out_event_handle, uintptr_t message_buffer, size_t message_buffer_size, Handle session_handle
|-
| 0x24 || Result || [[#GetProcessId|GetProcessId]] || uint64_t *out_process_id, Handle process_handle
|-
| 0x25 || Result || [[#GetThreadId|GetThreadId]] || uint64_t *out_thread_id, Handle thread_handle
|-
| 0x26 || void || [[#Break|Break]] || BreakReason break_reason, uintptr_t arg, size_t size
|-
| 0x27 || Result || [[#OutputDebugString|OutputDebugString]] || const char *debug_str, size_t len
|-
| 0x28 || void || [[#ReturnFromException|ReturnFromException]] || Result result
|-
| 0x29 || Result || [[#GetInfo|GetInfo]] || uint64_t *out, InfoType info_type, Handle handle, uint64_t info_subtype
|-
| 0x2A || void || [[#FlushEntireDataCache|FlushEntireDataCache]] ||
|-
| 0x2B || Result || [[#FlushDataCache|FlushDataCache]] || uintptr_t address, size_t size
|-
| [3.0.0+] 0x2C || Result || [[#MapPhysicalMemory|MapPhysicalMemory]] || uintptr_t address, size_t size
|-
| [3.0.0+] 0x2D || Result || [[#UnmapPhysicalMemory|UnmapPhysicalMemory]] || uintptr_t address, size_t size
|-
| [5.0.0-5.1.0] 0x2E || Result || GetFutureThreadInfo || arch::LastThreadContext *out_context, uintptr_t *out_tls_address, uint32_t *out_flags, int64_t ns
|-
| [6.0.0+] 0x2E || Result || [[#GetDebugFutureThreadInfo|GetDebugFutureThreadInfo]] || arch::LastThreadContext *out_context, uint64_t *thread_id, Handle debug_handle, int64_t ns
|-
| 0x2F || Result || [[#GetLastThreadInfo|GetLastThreadInfo]] || arch::LastThreadContext *out_context, uintptr_t *out_tls_address, uint32_t *out_flags
|-
| 0x30 || Result || [[#GetResourceLimitLimitValue|GetResourceLimitLimitValue]] || int64_t *out_limit_value, Handle resource_limit_handle, LimitableResource which
|-
| 0x31 || Result || [[#GetResourceLimitCurrentValue|GetResourceLimitCurrentValue]] || int64_t *out_current_value, Handle resource_limit_handle, LimitableResource which
|-
| 0x32 || Result || [[#SetThreadActivity|SetThreadActivity]] || Handle thread_handle, ThreadActivity thread_activity
|-
| 0x33 || Result || [[#GetThreadContext3|GetThreadContext3]] || ThreadContext *out_context, Handle thread_handle
|-
| [4.0.0+] 0x34 || Result || [[#WaitForAddress|WaitForAddress]] || uintptr_t address, ArbitrationType arb_type, int32_t value, int64_t timeout_ns
|-
| [4.0.0+] 0x35 || Result || [[#SignalToAddress|SignalToAddress]] || uintptr_t address, SignalType signal_type, int32_t value, int32_t count
|-
| [8.0.0+] 0x36 || void || [[#SynchronizePreemptionState|SynchronizePreemptionState]] ||
|-
| [11.0.0+] 0x37 || Result || [[#GetResourceLimitPeakValue|GetResourceLimitPeakValue]] || int64_t *out_peak_value, Handle resource_limit_handle, LimitableResource which
|- style="border-top: double"
| [1.0.0-3.0.2] 0x3C || void || [[#DumpInfo|DumpInfo]] || DumpInfoType dump_info_type, uint64_t arg
|-
| [4.0.0+] 0x3C || void || [[#KernelDebug|KernelDebug]] || KernelDebugType kern_debug_type, uint64_t arg0, uint64_t arg1, uint64_t arg2
|-
| [4.0.0+] 0x3D || void || [[#ChangeKernelTraceState|ChangeKernelTraceState]] || KernelTraceState kern_trace_state
|- style="border-top: double"
| 0x40 || Result || [[#CreateSession|CreateSession]] || Handle *out_server_session_handle, Handle *out_client_session_handle, bool is_light, uintptr_t name
|-
| 0x41 || Result || [[#AcceptSession|AcceptSession]] || Handle *out_handle, Handle port
|-
| 0x42 || Result || [[#ReplyAndReceiveLight|ReplyAndReceiveLight]] || Handle handle
|-
| 0x43 || Result || [[#ReplyAndReceive|ReplyAndReceive]] || int32_t *out_index, const Handle *handles, int32_t num_handles, Handle reply_target, int64_t timeout_ns
|-
| 0x44 || Result || [[#ReplyAndReceiveWithUserBuffer|ReplyAndReceiveWithUserBuffer]] || int32_t *out_index, uintptr_t message_buffer, size_t message_buffer_size, const Handle *handles, int32_t num_handles, Handle reply_target, int64_t timeout_ns
|-
| 0x45 || Result || [[#CreateEvent|CreateEvent]] || Handle *out_write_handle, Handle *out_read_handle
|- style="border-top: double"
| [5.0.0+] 0x48 || Result || [[#MapPhysicalMemoryUnsafe|MapPhysicalMemoryUnsafe]] || uintptr_t address, size_t size
|-
| [5.0.0+] 0x49 || Result || [[#UnmapPhysicalMemoryUnsafe|UnmapPhysicalMemoryUnsafe]] || uintptr_t address, size_t size
|-
| [5.0.0+] 0x4A || Result || [[#SetUnsafeLimit|SetUnsafeLimit]] || size_t limit
|-
| [4.0.0+] 0x4B || Result || [[#CreateCodeMemory|CreateCodeMemory]] || Handle *out_handle, uintptr_t address, size_t size
|-
| [4.0.0+] 0x4C || Result || [[#ControlCodeMemory|ControlCodeMemory]] || Handle code_memory_handle, CodeMemoryOperation operation, uint64_t address, uint64_t size, MemoryPermission perm
|-
| 0x4D || void || [[#SleepSystem|SleepSystem]] ||
|-
| 0x4E || Result || [[#ReadWriteRegister|ReadWriteRegister]] || uint32_t *out_value, PhysicalAddress address, uint32_t mask, uint32_t value
|-
| 0x4F || Result || [[#SetProcessActivity|SetProcessActivity]] || Handle process_handle, ProcessActivity process_activity
|-
| 0x50 || Result || [[#CreateSharedMemory|CreateSharedMemory]] || Handle *out_handle, size_t size, MemoryPermission owner_perm, MemoryPermission remote_perm
|-
| 0x51 || Result || [[#MapTransferMemory|MapTransferMemory]] || Handle trmem_handle, uintptr_t address, size_t size, MemoryPermission owner_perm
|-
| 0x52 || Result || [[#UnmapTransferMemory|UnmapTransferMemory]] || Handle trmem_handle, uintptr_t address, size_t size
|-
| 0x53 || Result || [[#CreateInterruptEvent|CreateInterruptEvent]] || Handle *out_read_handle, int32_t interrupt_id, InterruptType interrupt_type
|-
| 0x54 || Result || [[#QueryPhysicalAddress|QueryPhysicalAddress]] || arch::PhysicalMemoryInfo *out_info, uintptr_t address
|-
| 0x55 || Result || [[#QueryIoMapping|QueryIoMapping]] || uintptr_t *out_address, [10.0.0+] size_t *out_size, PhysicalAddress physical_address, size_t size
|-
| 0x56 || Result || [[#CreateDeviceAddressSpace|CreateDeviceAddressSpace]] || Handle *out_handle, uint64_t das_address, uint64_t das_size
|-
| 0x57 || Result || [[#AttachDeviceAddressSpace|AttachDeviceAddressSpace]] || DeviceName device_name, Handle das_handle
|-
| 0x58 || Result || [[#DetachDeviceAddressSpace|DetachDeviceAddressSpace]] || DeviceName device_name, Handle das_handle
|-
| 0x59 || Result || [[#MapDeviceAddressSpaceByForce|MapDeviceAddressSpaceByForce]] || Handle das_handle, Handle process_handle, uint64_t process_address, size_t size, uint64_t device_address, MemoryPermission device_perm
|-
| 0x5A || Result || [[#MapDeviceAddressSpaceAligned|MapDeviceAddressSpaceAligned]] || Handle das_handle, Handle process_handle, uint64_t process_address, size_t size, uint64_t device_address, MemoryPermission device_perm
|-
| 0x5B || Result || [[#MapDeviceAddressSpace|MapDeviceAddressSpace]] || size_t *out_mapped_size, Handle das_handle, Handle process_handle, uint64_t process_address, size_t size, uint64_t device_address, MemoryPermission device_perm
|-
| 0x5C || Result || [[#UnmapDeviceAddressSpace|UnmapDeviceAddressSpace]] || Handle das_handle, Handle process_handle, uint64_t process_address, size_t size, uint64_t device_address
|-
| 0x5D || Result || [[#InvalidateProcessDataCache|InvalidateProcessDataCache]] || Handle process_handle, uint64_t address, uint64_t size
|-
| 0x5E || Result || [[#StoreProcessDataCache|StoreProcessDataCache]] || Handle process_handle, uint64_t address, uint64_t size
|-
| 0x5F || Result || [[#FlushProcessDataCache|FlushProcessDataCache]] || Handle process_handle, uint64_t address, uint64_t size
|-
| 0x60 || Result || [[#DebugActiveProcess|DebugActiveProcess]] || Handle *out_handle, uint64_t process_id
|-
| 0x61 || Result || [[#BreakDebugProcess|BreakDebugProcess]] || Handle debug_handle
|-
| 0x62 || Result || [[#TerminateDebugProcess|TerminateDebugProcess]] || Handle debug_handle
|-
| 0x63 || Result || [[#GetDebugEvent|GetDebugEvent]] || arch::DebugEventInfo *out_info, Handle debug_handle
|-
| 0x64 || Result || [[#ContinueDebugEvent|ContinueDebugEvent]] || Handle debug_handle, uint32_t flags, const uint64_t *thread_ids, int32_t num_thread_ids
|-
| 0x65 || Result || [[#GetProcessList|GetProcessList]] || int32_t *out_num_processes, uint64_t *out_process_ids, int32_t max_out_count
|-
| 0x66 || Result || [[#GetThreadList|GetThreadList]] || int32_t *out_num_threads, uint64_t *out_thread_ids, int32_t max_out_count, Handle debug_handle
|-
| 0x67 || Result || [[#GetDebugThreadContext|GetDebugThreadContext]] || ThreadContext *out_context, Handle debug_handle, uint64_t thread_id, uint32_t context_flags
|-
| 0x68 || Result || [[#SetDebugThreadContext|SetDebugThreadContext]] || Handle debug_handle, uint64_t thread_id, const ThreadContext *context, uint32_t context_flags
|-
| 0x69 || Result || [[#QueryDebugProcessMemory|QueryDebugProcessMemory]] || arch::MemoryInfo *out_memory_info, PageInfo *out_page_info, Handle process_handle, uintptr_t address
|-
| 0x6A || Result || [[#ReadDebugProcessMemory|ReadDebugProcessMemory]] || uintptr_t buffer, Handle debug_handle, uintptr_t address, size_t size
|-
| 0x6B || Result || [[#WriteDebugProcessMemory|WriteDebugProcessMemory]] || Handle debug_handle, uintptr_t buffer, uintptr_t address, size_t size
|-
| 0x6C || Result || [[#SetHardwareBreakPoint|SetHardwareBreakPoint]] || HardwareBreakPointRegisterName name, uint64_t flags, uint64_t value
|-
| 0x6D || Result || [[#GetDebugThreadParam|GetDebugThreadParam]] || uint64_t *out_64, uint32_t *out_32, Handle debug_handle, uint64_t thread_id, DebugThreadParam param
|- style="border-top: double"
| [5.0.0+] 0x6F || Result || [[#GetSystemInfo|GetSystemInfo]] || uint64_t *out, SystemInfoType info_type, Handle handle, uint64_t info_subtype
|-
| 0x70 || Result || [[#CreatePort|CreatePort]] || Handle *out_server_handle, Handle *out_client_handle, int32_t max_sessions, bool is_light, uintptr_t name
|-
| 0x71 || Result || [[#ManageNamedPort|ManageNamedPort]] || Handle *out_server_handle, const char *name, int32_t max_sessions
|-
| 0x72 || Result || [[#ConnectToPort|ConnectToPort]] || Handle *out_handle, Handle port
|-
| 0x73 || Result || [[#SetProcessMemoryPermission|SetProcessMemoryPermission]] || Handle process_handle, uint64_t address, uint64_t size, MemoryPermission perm
|-
| 0x74 || Result || [[#MapProcessMemory|MapProcessMemory]] || uintptr_t dst_address, Handle process_handle, uint64_t src_address, size_t size
|-
| 0x75 || Result || [[#UnmapProcessMemory|UnmapProcessMemory]] || uintptr_t dst_address, Handle process_handle, uint64_t src_address, size_t size
|-
| 0x76 || Result || [[#QueryProcessMemory|QueryProcessMemory]] || arch::MemoryInfo *out_memory_info, PageInfo *out_page_info, Handle process_handle, uint64_t address
|-
| 0x77 || Result || [[#MapProcessCodeMemory|MapProcessCodeMemory]] || Handle process_handle, uint64_t dst_address, uint64_t src_address, uint64_t size
|-
| 0x78 || Result || [[#UnmapProcessCodeMemory|UnmapProcessCodeMemory]] || Handle process_handle, uint64_t dst_address, uint64_t src_address, uint64_t size
|-
| 0x79 || Result || [[#CreateProcess|CreateProcess]] || Handle *out_handle, const arch::CreateProcessParameter *parameters, const uint32_t *caps, int32_t num_caps
|-
| 0x7A || Result || [[#StartProcess|StartProcess]] || Handle process_handle, int32_t priority, int32_t core_id, uint64_t main_thread_stack_size
|-
| 0x7B || Result || [[#TerminateProcess|TerminateProcess]] || Handle process_handle
|-
| 0x7C || Result || [[#GetProcessInfo|GetProcessInfo]] || int64_t *out_info, Handle process_handle, ProcessInfoType info_type
|-
| 0x7D || Result || [[#CreateResourceLimit|CreateResourceLimit]] || Handle *out_handle
|-
| 0x7E || Result || [[#SetResourceLimitLimitValue|SetResourceLimitLimitValue]] || Handle resource_limit_handle, LimitableResource which, int64_t limit_value
|-
| 0x7F || void || [[#CallSecureMonitor|CallSecureMonitor]] || SecureMonitorArguments *args
|-
|}

== SetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || uint32_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) X1 || void* || HeapAddress
|}
</div>

Sets the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to HeapAddress.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===
'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== SetMemoryPermission ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (In) W2 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Changes permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

=== Result codes ===
'''0x0:''' Success. The memory region was reprotected.

'''0xCC01:''' Unaligned address specified.

'''0xCA01:''' Unaligned or zero size specified.

'''0xD401:''' The provided memory region does not fall within the userland address space.

'''0xD801:''' Invalid permission specified. Valid permissions are ---, r-- and rw-.

'''0xD401:''' The provided memory region was in an invalid state. The region must have the [[#MemoryState|FlagCanReprotect]] state, and must not have the [[#MemoryAttribute|Locked]] or [[#MemoryAttribute|Uncached]] attributes.

'''0xCE01:''' Kernel resource exhausted.

== SetMemoryAttribute ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (In) W2 || uint32_t || Mask
|-
| (In) W3 || uint32_t || Value
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Changes attribute of page-aligned memory region. The only allowed combination of Value and Mask is 0x8, which means only bit3 in [[#MemoryAttribute]] can be set or cleared.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

== MapMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddress
|-
| (In) X1 || void* || SrcAddress
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#GetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#GetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== UnmapMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddress
|-
| (In) X1 || void* || SrcAddress
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Unmaps a region that was previously mapped with [[#MapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== QueryMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemoryInfo
|-
| (In) X2 || void* || Address
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || [[#PageInfo]] || PageInfo
|}
</div>

Queries information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== ExitProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Exits the current process.

== CreateThread ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || int32_t || Priority
|-
| (In) W5 || R4 || int32_t || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || Handle<Thread> || ThreadHandle
|}
</div>

Creates a thread in the current process.

ProcessorId must be 0,1,2,3 or -2, where -2 uses the default CpuId for process.

== StartThread ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || ThreadHandle
|-
| (Out) None || ||
|}
</div>

Starts the thread for the provided handle.

== ExitThread ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Exits the current thread.

== SleepThread ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || uint64_t || Nanoseconds
|}
</div>

Sleeps for a specified amount of time, or yields the thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|}
</div>

== GetThreadPriority ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || ThreadHandle
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || int32_t || Priority
|}
</div>

Gets the priority of provided thread handle.

== SetThreadPriority ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || ThreadHandle
|-
| (In) W1|| int32_t || Priority
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Sets the priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== GetThreadCoreMask ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || ThreadHandle
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || int32_t || CoreMask0
|-
| (Out) X2 || R2, R3 || uint64_t || CoreMask1
|}
</div>

Gets the affinity mask of provided thread handle.

== SetThreadCoreMask ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || ThreadHandle
|-
| (In) W1 || R1 || int32_t || CoreMask0
|-
| (In) X2 || R2, R3 || uint64_t || CoreMask1
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Sets the affinity mask of provided thread handle.

== GetCurrentProcessorNumber ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0 || uint32_t || CpuId
|}
</div>

Gets which cpu is executing the current thread.

CpuId is an integer in the range 0-3.

== SignalEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> || EventHandle
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

Puts the given event in the signaled state.

Will wake up any thread currently waiting on this event. Can potentially trigger a reschedule.

Any calls to [[#WaitSynchronization]] on this handle will return immediately, until the event's signaled state is reset.

=== Result codes ===
'''0x0:''' Success. Event is now in signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a WritableEvent.

== ClearEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> or Handle<ReadableEvent> || EventHandle
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

Takes the given event out of the signaled state.

=== Result codes ===
'''0x0:''' Success, the event is now in the not-signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a ReadableEvent nor a WritableEvent.

'''0xFA01:''' The handle was not in a signaled state.

== MapSharedMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || SharedMemoryHandle
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (In) W3 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== UnmapSharedMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || SharedMemoryHandle
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== CreateTransferMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (In) W3 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<TransferMemory> || TransferMemoryHandle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== CloseHandle ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle || Handle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ResetSignal ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<ReadableEvent> or Handle<Process> || Handle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Resets the signal on the given handle, ensuring future calls to [[#WaitSynchronization]] on this handle will sleep until the handle is signaled again. If the handle is a ReadableEvent, this is equivalent to calling ClearEvent() on the handle.

If the handle is a Process, it will clear the signaled state (which is set when the process changes [[#ProcessState]]. Once the process enters the Exited state, calling ResetSignal on the process will no longer have an effect (the process is permanently signaled), and the syscall will return 0xFA01.

=== Result codes ===
'''0x0:''' Success. The signal was reset.

'''0xE401:''' The handle is invalid or of the wrong type.

'''0xFA01:''' The handle was not signaled, or the process is in exited state, causing it to be permanently signaled.

== WaitSynchronization ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || int32_t || HandlesNum
|-
| (In) X3 || R0, R3 || int64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint64_t || HandleIndex
|}
</div>

Works with HandlesNum <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===
'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#GetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#GetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via [[#SignalEvent]].

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#AcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#ReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===
'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#CancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== CancelSynchronization ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || ThreadHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

If the referenced thread is currently in a synchronization call ([[#WaitSynchronization]], [[#ReplyAndReceive]] or [[#ReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===
'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== ArbitrateLock ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || ThreadHandle
|-
| (In) X1 || void* || Address
|-
| (In) W2 || uint32_t || Tag
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ArbitrateUnlock ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== WaitProcessWideKeyAtomic ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || KeyAddress
|-
| (In) X1 || R1 || void* || TagAddress
|-
| (In) W2 || R2 || uint32_t || Tag
|-
| (In) X3 || R3, R4 || int64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== SignalProcessWideKey ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) W1 || int32_t || Value
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetSystemTick ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || uint64_t || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== ConnectToNamedPort ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || char* || PortName
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<Session> || SessionHandle
|}
</div>

== SendSyncRequestLight ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Session> || SessionHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SendSyncRequest ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Session> || SessionHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SendSyncRequestWithUserBuffer ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (In) W2 || Handle<Session> || SessionHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Size and Address must be 0x1000-aligned.

=== Result codes ===
'''0x0:''' Success.

'''0xcc01:''' Address is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== SendAsyncRequestWithUserBuffer ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (In) W3 || Handle<Session> || SessionHandle
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ReadableEvent> || EventHandle
|}
</div>

Size and Address must be 0x1000-aligned.

== GetProcessId ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || ProcessId
|}
</div>

== GetThreadId ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<Thread> || ThreadHandle
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || ThreadId
|}
</div>

== Break ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#BreakReason]] || BreakReason
|-
| (In) X1 || uint64_t ||
|-
| (In) X2 || uint64_t || Info
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

If the process is attached, report the Break event. Then, if [[#ContinueDebugEvent]] didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== OutputDebugString ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || char* || String
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ReturnFromException ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#Result]] || Result
|}
</div>

== GetInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || [[#InfoType]] || InfoType
|-
| (In) W2 || R2 || Handle || Handle
|-
| (In) X3 || R0, R3 || uint64_t || InfoSubType
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || Info
|}
</div>

== FlushEntireDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

== FlushDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== MapPhysicalMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Acts like [[#SetHeapSize]] except you can allocate heap at any address you'd like.

Uses current process pool partition.

=== Result codes ===
'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either zero or not 4k-aligned

'''0xCC01:''' Invalid address. (not 4k-aligned)

'''0xDC01:''' Invalid memory range. It's either causes overflow, or does not fall into "reserved" address range (aka Alias). See AliasRegionAddress at [[#InfoType]]

'''0xFA01:''' Invalid state. (not enough SystemResource (see [[NPDM#SystemResourceSize]]))

== UnmapPhysicalMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetDebugFutureThreadInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X3 || R0, R1 || uint64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || uint64_t || LastThreadContextParam0
|-
| (Out) X2 || uint64_t || LastThreadContextParam1
|-
| (Out) X3 || uint64_t || LastThreadContextParam2
|-
| (Out) X4 || uint64_t || LastThreadContextParam3
|-
| (Out) X5 || uint64_t ||
|-
| (Out) W6 || uint32_t ||
|}
</div>

== GetLastThreadInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) X1 || uint64_t || LastThreadContextParam0
|-
| (Out) X2 || uint64_t || LastThreadContextParam1
|-
| (Out) X3 || uint64_t || LastThreadContextParam2
|-
| (Out) X4 || uint64_t || LastThreadContextParam3
|-
| (Out) X5 || uint64_t ||
|-
| (Out) W6 || uint32_t ||
|}
</div>

== GetResourceLimitLimitValue ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<ResourceLimit> || ResourceLimitHandle
|-
| (In) W2 || R2 || [[#LimitableResource]] || LimitableResource
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || int64_t || LimitValue
|}
</div>

== GetResourceLimitCurrentValue ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<ResourceLimit> || ResourceLimitHandle
|-
| (In) W2 || R2 || [[#LimitableResource]] || LimitableResource
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || int64_t || CurrentValue
|}
</div>

== SetThreadActivity ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || ThreadHandle
|-
| (In) W1 || [[#ThreadActivity]] || ThreadActivity
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetThreadContext3 ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#ThreadContext]]* || ThreadContext
|-
| (In) W1 || Handle<Thread> || ThreadHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== WaitForAddress ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || Address
|-
| (In) W1 || R1 || [[#ArbitrationType]] || ArbitrationType
|-
| (In) W2 || R2 || uint32_t || Value
|-
| (In) X3 || R3, R4 || uint64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== SignalToAddress ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || Address
|-
| (In) W1 || R1 || [[#SignalType]] || SignalType
|-
| (In) W2 || R2 || uint32_t || Value
|-
| (In) W3 || R3 || uint32_t || NumToSignal
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== SynchronizePreemptionState ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

== GetResourceLimitPeakValue ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<ResourceLimit> || ResourceLimitHandle
|-
| (In) W2 || R2 || [[#LimitableResource]] || LimitableResource
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || int64_t || PeakValue
|}
</div>

== DumpInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#DumpInfoType]] || DumpInfoType
|-
| (In) X1 || uint64_t || DumpInfoSubType
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Stubbed in retail kernel.

[4.0.0+] This function was removed and replaced by [[#KernelDebug]].

== KernelDebug ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#KernelDebugType]] || KernelDebugType
|-
| (In) X1 || uint64_t ||
|-
| (In) X2 || uint64_t ||
|-
| (In) X3 || uint64_t ||
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Stubbed in retail kernel.

== ChangeKernelTraceState ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#KernelTraceState]] || KernelTraceState
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Stubbed in retail kernel.

== CreateSession ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || bool || IsLight
|-
| (In) X3 || uint64_t || Name
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || ServerSessionHandle
|-
| (Out) W2 || Handle<ClientSession> || ClientSessionHandle
|}
</div>

== AcceptSession ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || PortHandle
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || ServerSessionHandle
|}
</div>

=== Result codes ===
'''0xf201:''' No session waiting to be accepted

== ReplyAndReceiveLight ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Port> or Handle<ServerSession> || Handle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ReplyAndReceive ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<Port>* or Handle<ServerSession>* || Handles
|-
| (In) W2 || R2 || uint32_t || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTargetSessionHandle
|-
| (In) X4 || R0, R4 || uint64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || HandleIndex
|}
</div>

If ReplyTargetSessionHandle is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTargetSessionHandle is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTargetSessionHandle is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===
'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== ReplyAndReceiveWithUserBuffer ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void* || Address
|-
| (In) X2 || R2 || uint64_t || Size
|-
| (In) X3 || R3 || Handle<Port>* or Handle<ServerSession>* || Handles
|-
| (In) W4 || R0 || uint32_t || NumHandles
|-
| (In) W5 || R4 || Handle<ServerSession> || ReplyTargetSessionHandle
|-
| (In) X6 || R5, R6 || uint64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || HandleIndex
|}
</div>

== CreateEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<WritableEvent> || WritableEventHandle
|-
| (Out) W2 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

== MapPhysicalMemoryUnsafe ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Same as [[#MapPhysicalMemory]] except it always uses pool partition 0.

== UnmapPhysicalMemoryUnsafe ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SetUnsafeLimit ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || uint64_t || Limit
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== CreateCodeMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<CodeMemory> || CodeMemoryHandle
|}
</div>

Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== ControlCodeMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<CodeMemory> || CodeMemoryHandle
|-
| (In) W1 || R1 || [[#CodeMemoryOperation]] || CodeMemoryOperation
|-
| (In) X2 || R2, R3 || void* || Address
|-
| (In) X3 || R4, R5 || uint64_t || Size
|-
| (In) W4 || R6 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maps the backing memory for a CodeMemory object into the current process.

For [[#CodeMemoryOperation|MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|UnmapOwner/UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== SleepSystem ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

== ReadWriteRegister ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || uint64_t || RegisterAddress
|-
| (In) W2 || R0 || uint32_t || RwMask
|-
| (In) W3 || R1 || uint32_t || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC#ReadWriteRegister|ReadWriteRegister]].

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by the SMC [[SMC#ReadWriteRegister|ReadWriteRegister]] (checked in addition to the whitelist in the ReadWriteRegister SVC), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== SetProcessActivity ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) W1 || [[#ProcessActivity]] || ProcessActivity
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== CreateSharedMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || uint64_t || Size
|-
| (In) W2 || [[#MemoryPermission]] || LocalMemoryPermission
|-
| (In) W3 || [[#MemoryPermission]] || RemoteMemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<SharedMemory> || SharedMemoryHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== MapTransferMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || TransferMemoryHandle
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (In) W3 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

You must pass same size and permissions as given in [[#CreateTransferMemory]], otherwise error.

== UnmapTransferMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || TransferMemoryHandle
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== CreateInterruptEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#Interrupt]] || Interrupt
|-
| (In) W2 || [[#InterruptType]] || InterruptType
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Creates an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The InterruptType argument configures the triggering. If it is 0, the IRQ is active HIGH level sensitive, if it is 1 it is rising-edge sensitive.

=== Result codes ===
'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== QueryPhysicalAddress ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || VirtualAddress
|-
| (Out) W0 || [[#Result]]|| Result
|-
| (Out) X1 || uint64_t || PhysicalMemoryInfoAddress
|-
| (Out) X2 || uint64_t || PhysicalMemoryInfoBaseAddress
|-
| (Out) X3 || uint64_t || PhysicalMemoryInfoSize
|}
</div>

Queries the physical address of a virtual address. Will always fetch the lowest page-aligned mapping that contains the provided physical address.

The returned PhysicalMemoryInfoBaseAddress is the virtual address of that page-aligned mapping, while PhysicalMemoryInfoAddress is the physical address of that page. PhysicalMemoryInfoSize is the amount of continuous physical memory in that mapping.

== QueryIoMapping ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || uint64_t || IoAddress
|-
| (In) X2 || R0 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1 || void* || VirtualAddress
|}
</div>

Returns a virtual address mapped to a given IO range.

== CreateDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || uint64_t || DeviceAddressSpaceStartAddress
|-
| (In) X2 || R0, R1 || uint64_t || DeviceAddressSpaceEndAddress
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|}
</div>

Creates a virtual address space for binding device address spaces and returns a handle.

StartAddr is normally set to 0 and EndAddr is normally set to 0xFFFFFFFF.

== AttachDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceName
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Attaches a device address space to a [[#DeviceName|device]].

== DetachDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceName
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Detaches a device address space from a [[#DeviceName|device]].

== MapDeviceAddressSpaceByForce ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || Address
|-
| (In) X3 || R4 || uint64_t || DeviceAddressSpaceSize
|-
| (In) X4 || R5, R6 || uint64_t || DeviceAddressSpaceAddress
|-
| (In) W5 || R7 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maps an attached device address space to an userspace address.

Address is the userspace destination address, while DeviceAddressSpaceAddress is the source address between DeviceAddressSpaceStartAddress and DeviceAddressSpaceEndAddress (passed to [[#CreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|FlagCanDeviceMap]] bit set. Bit [[SVC#MemoryAttribute|DeviceShared]] will be set after mapping.

== MapDeviceAddressSpaceAligned ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || Address
|-
| (In) X3 || R4 || uint64_t || DeviceAddressSpaceSize
|-
| (In) X4 || R5, R6 || uint64_t || DeviceAddressSpaceAddress
|-
| (In) W5 || R7 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maps an attached device address space to an userspace address.

Same as [[#MapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|FlagCanAlignedDeviceMap]] bit set instead.

== MapDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R0, R3 || void* || Address
|-
| (In) X4 || R4 || uint64_t || DeviceAddressSpaceSize
|-
| (In) X5 || R5, R6 || uint64_t || DeviceAddressSpaceAddress
|-
| (In) W6 || R7 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1 || uint64_t || Size
|}
</div>

== UnmapDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || Address
|-
| (In) X3 || R4 || uint64_t || DeviceAddressSpaceSize
|-
| (In) X4 || R5, R6 || uint64_t || DeviceAddressSpaceAddress
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Unmaps an attached device address space from an userspace address.

== InvalidateProcessDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || Address
|-
| (In) X2 || R1, R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== StoreProcessDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || Address
|-
| (In) X2 || R1, R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== FlushProcessDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || Address
|-
| (In) X2 || R1, R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== DebugActiveProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || uint64_t || ProcessId
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || Handle<Debug> || DebugHandle
|}
</div>

== BreakDebugProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Debug> || DebugHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== TerminateDebugProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Debug> || DebugHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetDebugEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#DebugEventInfo]]* || DebugEventInfo
|-
| (In) W1 || Handle<Debug> || DebugHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ContinueDebugEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Debug> || DebugHandle
|-
| (In) W1 || R1 || uint32_t || [[#ContinueDebugFlags]] ([1.0.0-2.3.0] [[#ContinueDebugFlagsOld]])
|-
| (In) X2 || R2 ([1.0.0-2.3.0] R2, R3) || uint64_t* ([1.0.0-2.3.0] uint64_t)|| ThreadIdList ([1.0.0-2.3.0] ThreadId)
|-
| (In) X3 || R3 || uint64_t || [3.0.0+] NumThreadIds
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maximum NumThreadIds is 64. 0 means "all threads".

=== Result codes ===
'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== GetProcessList ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || uint64_t* || ProcessIdBuffer
|-
| (In) W2 || R2 || uint32_t || ProcessIdBufferSize
|-
| (Out) X0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || NumProcesses
|}
</div>

Fills the provided array with the pids of currently living processes. A process "lives" so long as it is currently running or a handle to it still exists.

It returns the total number of processes currently alive. If this number is bigger than the size of ProcessIdBuffer, the user won't have all the pids.

=== Result codes ===
'''0x0:''' Success.

'''0xd401:''' The provided buffer is outside the process address space.

'''0xe601:''' copyToUser failed. The provided buffer is not user-accessible.

'''0xee01:''' The provided buffer size is too big. Max value is 0xFFFFFFF.

== GetThreadList ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || uint64_t* || ThreadIdBuffer
|-
| (In) W2 || R2 || uint32_t || ThreadIdBufferSize
|-
| (In) W3 || R3 || Handle<Debug> || DebugHandle
|-
| (Out) X0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || NumThreads
|}
</div>

== GetDebugThreadContext ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#ThreadContext]]* || ThreadContext
|-
| (In) X1 || R1 || Handle<Debug> || DebugHandle
|-
| (In) X2 || R2, R3 || uint64_t || ThreadId
|-
| (In) W3 || R4 || uint32_t || [[#ThreadContextFlags]]
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== SetDebugThreadContext ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Debug> || DebugHandle
|-
| (In) X1 || R2, R3 || uint64_t || ThreadId
|-
| (In) X2 || R1 || [[#ThreadContext]]* || ThreadContext
|-
| (In) W3 || R4 || uint32_t || [[#ThreadContextFlags]]
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== QueryDebugProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemoryInfo
|-
| (In) W2 || Handle<Debug> || DebugHandle
|-
| (In) X3 || void* || Address
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || [[#PageInfo]] || PageInfo
|}
</div>

== ReadDebugProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || MemoryBufferAddress
|-
| (In) W1 || Handle<Debug> || DebugHandle
|-
| (In) X2 || void* || SrcAddress
|-
| (In) X3 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== WriteDebugProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Debug> || DebugHandle
|-
| (In) X1 || void* || MemoryBufferAddress
|-
| (In) X2 || void* || DstAddress
|-
| (In) X3 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SetHardwareBreakPoint ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || [[#HardwareBreakPointRegisterName]] || Name
|-
| (In) X1 || R2, R3 || uint64_t || Flags
|-
| (In) X2 || R1, R4 || uint64_t || Value
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of HardwareBreakPointRegisterName:

If HardwareBreakPointRegisterName < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given DebugHandle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If HardwareBreakPointRegisterName is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that HardwareBreakPointRegisterName 0 to 4 match only to Virtual Address, while HardwareBreakPointRegisterName 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

== GetDebugThreadParam ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X2 || R2 || Handle<Debug> || DebugHandle
|-
| (In) X3 || R0, R1 || uint64_t || ThreadId
|-
| (In) W4 || R3 || [[#DebugThreadParam]] || DebugThreadParam
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || Out0
|-
| (Out) W2 || R3 || uint32_t || Out1
|}
</div>

== GetSystemInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#SystemInfoType]] || SystemInfoType
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || uint64_t || SystemInfoSubType
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) X1 || uint64_t || SystemInfo
|}
</div>

== CreatePort ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || int32_t || MaxSessions
|-
| (In) W3 || R3 || bool || IsLight
|-
| (In) X4 || R0 || uint64_t || Name
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || Handle<Port> || ServerPortHandle
|-
| (Out) W2 || R2 || Handle<Port> || ClientPortHandle
|}
</div>

== ManageNamedPort ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || char* || Name
|-
| (In) W2 || int32_t || MaxSessions
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<Port> || ServerPortHandle
|}
</div>

== ConnectToPort ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || ClientPortHandle
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<Session> || SessionHandle
|}
</div>

== SetProcessMemoryPermission ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || Addr
|-
| (In) X2 || R1, R4 || uint64_t || Size
|-
| (In) W3 || R5 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== MapProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddress
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddress
|-
| (In) X3 || R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== UnmapProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddress
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddress
|-
| (In) X3 || R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Unmaps what was mapped by [[#MapProcessMemory]].

== QueryProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemoryInfo
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || void* || Address
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || [[#PageInfo]] || PageInfo
|}
</div>

Equivalent to [[#QueryMemory]] except takes a process handle.

== MapProcessCodeMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || DstAddress
|-
| (In) X2 || R1, R4 || void* || SrcAddress
|-
| (In) X3 || R5, R6 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== UnmapProcessCodeMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || DstAddress
|-
| (In) X2 || R1, R4 || void* || SrcAddress
|-
| (In) X3 || R5, R6 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Unmaps what was mapped by [[#MapProcessCodeMemory]].

== CreateProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessParameter]]* || CreateProcessParameter
|-
| (In) X2 || uint32_t* || Capabilities
|-
| (In) X3 || int32_t || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessParameter]] as input.
Capabilities points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the Capabilities array (number of element, not number of bytes).

=== Result codes ===
'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== StartProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R1 || int32_t || MainThreadPriority
|-
| (In) W2 || R2 || int32_t || DefaultCpuId
|-
| (In) X3 || R3, R4 || uint64_t || MainThreadStackSize
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== TerminateProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetProcessInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || ProcessInfoType
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || [[#ProcessState]]
|}
</div>

Returns an enum with value 0-7.

== CreateResourceLimit ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ResourceLimit> || ResourceLimitHandle
|}
</div>

== SetResourceLimitLimitValue ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<ResourceLimit> || ResourceLimitHandle
|-
| (In) W1 || R1 || [[#LimitableResource]] || LimitableResource
|-
| (In) X2 || R2, R3 || int64_t || LimitValue
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== CallSecureMonitor ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || uint64_t || [[SMC#Secure_Monitor_calls|FunctionId]]
|-
| (In) X1-X7 || R1-R7 || uint64_t || SMC arguments
|-
| (Out) X0 || R0 || [[SMC#Result|Result]] || SMC result
|-
| (Out) X1-X7 || R1-R7 || uint64_t || SMC output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* BreakDebugProcess
* ContinueDebugEvent
* WriteDebugProcessMemory
* SetDebugThreadContext
* TerminateDebugProcess
* SetHardwareBreakPoint

DebugActiveProcess stops execution of the target process, the normal method for resuming it requires ContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

= Enum/Structures =
== InfoType ==
{| class=wikitable
! Handle type || InfoType || InfoSubType || Description
|-
| Process || 0 || 0 || CoreMask
|-
| Process || 1 || 0 || PriorityMask
|-
| Process || 2 || 0 || AliasRegionAddress
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionAddress
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemorySize. Total memory available(free+used).
|-
| Process || 7 || 0 || UsedMemorySize. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || DebuggerAttached
|-
| Zero || 9 || 0 || ResourceLimit
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AslrRegionAddress
|-
| Process || 13 || 0 || [2.0.0+] AslrRegionSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionAddress
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] SystemResourceSizeTotal
|-
| Process || 17 || 0 || [3.0.0+] SystemResourceSizeUsed
|-
| Process || 18 || 0 || [3.0.0+] ProgramId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] InitialProcessIdRange_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] InitialProcessIdRange_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddress
|-
| Process || 21 || 0 || [6.0.0+] TotalNonSystemMemorySize
|-
| Process || 22 || 0 || [6.0.0+] UsedNonSystemMemorySize
|-
| Process || 23 || 0 || [9.0.0+] IsApplication
|-
| Process || 24 || 0 || [11.0.0+] FreeThreadCount
|-
| Thread || 0xF0000002 || 0-3, -1 || ThreadTickCount. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== SystemInfoType ==
{| class=wikitable
! Handle type || SystemInfoType || SystemInfoSubType || Description
|-
| Zero || 0 || 0 || TotalPhysicalMemorySize_Application
|-
| Zero || 0 || 1 || TotalPhysicalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalPhysicalMemorySize_System
|-
| Zero || 0 || 3 || TotalPhysicalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || UsedPhysicalMemorySize_Application
|-
| Zero || 1 || 1 || UsedPhysicalMemorySize_Applet
|-
| Zero || 1 || 2 || UsedPhysicalMemorySize_System
|-
| Zero || 1 || 3 || UsedPhysicalMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || InitialProcessIdRange_LowerBound
|-
| Zero || 2 || 1 || InitialProcessIdRange_UpperBound
|}

== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || AFI
|-
| 1 || AVPC
|-
| 2 || DC
|-
| 3 || DCB
|-
| 4 || HC
|-
| 5 || HDA
|-
| 6 || ISP2
|-
| 7 || MSENCNVENC
|-
| 8 || NV
|-
| 9 || NV2
|-
| 10 || PPCS
|-
| 11 || SATA
|-
| 12 || VI
|-
| 13 || VIC
|-
| 14 || XUSB_HOST
|-
| 15 || XUSB_DEV
|-
| 16 || TSEC
|-
| 17 || PPCS1
|-
| 18 || DC1
|-
| 19 || SDMMC1A
|-
| 20 || SDMMC2A
|-
| 21 || SDMMC3A
|-
| 22 || SDMMC4A
|-
| 23 || ISP2B
|-
| 24 || GPU
|-
| 25 || GPUB
|-
| 26 || PPCS2
|-
| 27 || NVDEC
|-
| 28 || APE
|-
| 29 || SE
|-
| 30 || NVJPG
|-
| 31 || HC1
|-
| 32 || SE1
|-
| 33 || AXIAP
|-
| 34 || ETR
|-
| 35 || TSECB
|-
| 36 || TSEC1
|-
| 37 || TSECB1
|-
| 38 || NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || MapOwner
|-
| 1 || MapSlave
|-
| 2 || UnmapOwner
|-
| 3 || UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Description
|-
| 0 || PhysicalMemoryMax || Bytes of memory a process may allocate.
|-
| 1 || ThreadCountMax || Amount of threads a process can create.
|-
| 2 || EventCountMax || Amount of events a process can create through [[#CreateEvent]] or [[#SendAsyncRequestWithUserBuffer]].
|-
| 3 || TransferMemoryCountMax || Amount of TransferMemory a process can create through [[#CreateTransferMemory]].
|-
| 4 || SessionCountMax || Amount of session a process can create through [[#CreateSession]], [[#ConnectToPort]] or [[#ConnectToNamedPort]].
|}

= ThreadActivity =
{| class=wikitable
! Value || Name
|-
| 0 || None
|-
| 1 || Runnable
|}

== ProcessActivity ==
{| class=wikitable
! Value || Name
|-
| 0 || None
|-
| 1 || Runnable
|}

== ProcessInfoType ==
{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessState]]
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || Created ||
|-
| 1 || CreatedAttached ||
|-
| 2 || Started ||
|-
| 3 || Crashed || Processes will not enter this state unless they were created with [[#CreateProcessParameter|EnableDebug]].
|-
| 4 || StartedAttached ||
|-
| 5 || Exiting ||
|-
| 6 || Exited ||
|-
| 7 || DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DynamicPriority
|-
| 1 || SchedulingStatus
|-
| 2 || PreferredCpuCore
|-
| 3 || CurrentCpuCore
|-
| 4 || AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended ([[#SetThreadActivity]] 1 or [[#SetProcessActivity]] 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

PreferredCpuCore: output in out2

CurrentCpuCore: output in out2

AffinityMask: output in out1

== CreateProcessParameter ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || Is64BitInstruction
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] MemoryRegion (0 = Application, 1 = Applet, 2 = SecureSystem, 3 = NonSecureSystem)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (only allowed in combination with IsApplication)
|-
| 0x28 || 4 || || ResourceLimitHandle (can be zero)
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one MemoryRegion.

On [2.0.0-4.0.0] MemoryRegion is 1 for built-ins and 0 for rest.

On [5.0.0] MemoryRegion is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || AddressSpace32Bit || 32 ||
|-
| 1 || AddressSpace64BitOld || 36 ||
|-
| 2 || AddressSpace32BitNoReserved || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] AddressSpace64Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || [[#MemoryType]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || [[#MemoryPermission]]
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryPermission ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || Read || Can be set by [[#SetMemoryPermission]].
|-
| 1 || Write || Can be set by [[#SetMemoryPermission]].
|-
| 2 || Execute || Can be set by [[#SetProcessMemoryPermission]] and [[#ControlCodeMemory]].
|-
| 28 || DontCare ||
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || Locked || Used by MapMemory, as an async IPC user buffer.
|-
| 1 || IpcLocked || True when IpcRefCount > 0.
|-
| 2 || DeviceShared || True when DeviceRefCount > 0.
|-
| 3 || Uncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description || Meaning
|-
| 7-0 || [[#MemoryType]] ||
|-
| 8 || [[#SetMemoryPermission|FlagCanReprotect]] ||
|-
| 9 || FlagCanDebug || Allows using [[#WriteDebugProcessMemory]] on segments mapped read-only.
|-
| 10 || FlagCanUseIpc || Allows sending this region as an IPC A/B/W buffer with flags=0.
|-
| 11 || FlagCanUseNonDeviceIpc || Allows sending this region as an IPC A/B/W buffer with flags=1.
|-
| 12 || FlagCanUseNonSecureIpc || Allows sending this region as an IPC A/B/W buffer with flags=3.
|-
| 13 || FlagMapped ||
|-
| 14 || [[#SetProcessMemoryPermission|FlagCode]] ||
|-
| 15 || [[#MapMemory|FlagCanAlias]] ||
|-
| 16 || [[#MapProcessCodeMemory|FlagCanCodeAlias]] ||
|-
| 17 || [[#CreateTransferMemory|FlagCanTransfer]] ||
|-
| 18 || [[#QueryPhysicalAddress|FlagCanQueryPhysical]] ||
|-
| 19 || [[#MapDeviceAddressSpace|FlagCanDeviceMap]] ||
|-
| 20 || [[#MapDeviceAddressSpaceAligned|FlagCanAlignedDeviceMap]] ||
|-
| 21 || [[#SendSyncRequestWithUserBuffer|FlagCanIpcUserBuffer]] ||
|-
| 22 || FlagReferenceCounted || The physical memory blocks backing this region are refcounted.
|-
| 23 || [[#MapProcessMemory|FlagCanMapProcess]] ||
|-
| 24 || [[#SetMemoryAttribute|FlagCanChangeAttribute]] ||
|-
| 25 || [4.0.0+] [[#CreateCodeMemory|FlagCanCodeMemory]] ||
|}

=== MemoryType ===
{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || Free ||
|-
| 0x00002001 || Io || Mapped by kernel capability parsing in [[#CreateProcess]].
|-
| 0x00042002 || Static || Mapped by kernel capability parsing in [[#CreateProcess]].
|-
| 0x00DC7E03 || Code || Mapped during [[#CreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| CodeData || Transition from 0xDC7E03 performed by [[#SetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| Normal || Mapped using [[#SetHeapSize]].
|-
| 0x00402006 || Shared || Mapped using [[#MapSharedMemory]].
|-
| 0x00482907 || [1.0.0] Alias || Mapped using [[#MapMemory]].
|-
| 0x00DD7E08 || AliasCode || Mapped using [[#MapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| AliasCodeData || Transition from 0xDD7E08 performed by [[#SetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || Stack || Mapped using [[#MapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|ThreadLocal]] || Mapped during [[#CreateThread]].
|-
| 0x015C3C0D || Transfered || Mapped using [[#MapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || SharedTransfered || Mapped using [[#MapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || SharedCode || Mapped using [[#MapProcessMemory]].
|-
| 0x00000010 || Inaccessible ||
|-
| 0x005C3811 || [[IPC_Marshalling|NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || Kernel || Mapped in kernel during [[#CreateThread]].
|-
| 0x00402214 || [4.0.0+] GeneratedCode || Mapped in kernel during [[#ControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] CodeOut || Mapped in kernel during [[#ControlCodeMemory]].
|}

== ArbitrationType ==
{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|}

== SignalType ==
{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==
The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || AttachProcess
|-
| 1 || AttachThread
|-
| 2 || ExitProcess
|-
| 3 || ExitThread
|-
| 4 || Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Trap (*)
|-
| 1 || InstructionAbort
|-
| 2 || DataAbortMisc (**)
|-
| 3 || PcSpAlignmentFault
|-
| 4 || DebuggerAttached
|-
| 5 || BreakPoint
|-
| 6 || UserBreak
|-
| 7 || DebuggerBreak
|-
| 8 || BadSvcId
|-
| 9 || [2.0.0+] SError
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and [[#ReturnFromException]]:

TLS region start (A64):
{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:
{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):
{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:
{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || [2.0.0+] SError
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call [[#ReturnFromException]] (error code) to call that handler. The latter is then expected to promptly abort the program.

[[#ReturnFromException]] updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls [[#ReturnFromException]], it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2021-02-20T05:36:22Z

PixelyIon: WaitForAddress and SignalToAddress have a Result returned in W0

__NOTOC__

= System calls =
{| class=wikitable
! ID || Return Type || Name || Arguments
|-
| 0x01 || Result || [[#SetHeapSize|SetHeapSize]] || uintptr_t *out_address, size_t size
|-
| 0x02 || Result || [[#SetMemoryPermission|SetMemoryPermission]] || uintptr_t address, size_t size, MemoryPermission perm
|-
| 0x03 || Result || [[#SetMemoryAttribute|SetMemoryAttribute]] || uintptr_t address, size_t size, uint32_t mask, uint32_t attr
|-
| 0x04 || Result || [[#MapMemory|MapMemory]] || uintptr_t dst_address, uintptr_t src_address, size_t size
|-
| 0x05 || Result || [[#UnmapMemory|UnmapMemory]] || uintptr_t dst_address, uintptr_t src_address, size_t size
|-
| 0x06 || Result || [[#QueryMemory|QueryMemory]] || arch::MemoryInfo *out_memory_info, PageInfo *out_page_info, uintptr_t address
|-
| 0x07 || void || [[#ExitProcess|ExitProcess]] ||
|-
| 0x08 || Result || [[#CreateThread|CreateThread]] || Handle *out_handle, ThreadFunc func, uintptr_t arg, uintptr_t stack_bottom, int32_t priority, int32_t core_id
|-
| 0x09 || Result || [[#StartThread|StartThread]] || Handle thread_handle
|-
| 0x0A || void || [[#ExitThread|ExitThread]] ||
|-
| 0x0B || void || [[#SleepThread|SleepThread]] || int64_t ns
|-
| 0x0C || Result || [[#GetThreadPriority|GetThreadPriority]] || int32_t *out_priority, Handle thread_handle
|-
| 0x0D || Result || [[#SetThreadPriority|SetThreadPriority]] || Handle thread_handle, int32_t priority
|-
| 0x0E || Result || [[#GetThreadCoreMask|GetThreadCoreMask]] || int32_t *out_core_id, uint64_t *out_affinity_mask, Handle thread_handle
|-
| 0x0F || Result || [[#SetThreadCoreMask|SetThreadCoreMask]] || Handle thread_handle, int32_t core_id, uint64_t affinity_mask
|-
| 0x10 || int32_t || [[#GetCurrentProcessorNumber|GetCurrentProcessorNumber]] ||
|-
| 0x11 || Result || [[#SignalEvent|SignalEvent]] || Handle event_handle
|-
| 0x12 || Result || [[#ClearEvent|ClearEvent]] || Handle event_handle
|-
| 0x13 || Result || [[#MapSharedMemory|MapSharedMemory]] || Handle shmem_handle, uintptr_t address, size_t size, MemoryPermission map_perm
|-
| 0x14 || Result || [[#UnmapSharedMemory|UnmapSharedMemory]] || Handle shmem_handle, uintptr_t address, size_t size
|-
| 0x15 || Result || [[#CreateTransferMemory|CreateTransferMemory]] || Handle *out_handle, uintptr_t address, size_t size, MemoryPermission map_perm
|-
| 0x16 || Result || [[#CloseHandle|CloseHandle]] || Handle handle
|-
| 0x17 || Result || [[#ResetSignal|ResetSignal]] || Handle handle
|-
| 0x18 || Result || [[#WaitSynchronization|WaitSynchronization]] || int32_t *out_index, const Handle *handles, int32_t numHandles, int64_t timeout_ns
|-
| 0x19 || Result || [[#CancelSynchronization|CancelSynchronization]] || Handle handle
|-
| 0x1A || Result || [[#ArbitrateLock|ArbitrateLock]] || Handle thread_handle, uintptr_t address, uint32_t tag
|-
| 0x1B || Result || [[#ArbitrateUnlock|ArbitrateUnlock]] || uintptr_t address
|-
| 0x1C || Result || [[#WaitProcessWideKeyAtomic|WaitProcessWideKeyAtomic]] || uintptr_t address, uintptr_t cv_key, uint32_t tag, int64_t timeout_ns
|-
| 0x1D || void || [[#SignalProcessWideKey|SignalProcessWideKey]] || uintptr_t cv_key, int32_t count
|-
| 0x1E || int64_t || [[#GetSystemTick|GetSystemTick]] ||
|-
| 0x1F || Result || [[#ConnectToNamedPort|ConnectToNamedPort]] || Handle *out_handle, const char *name
|-
| 0x20 || Result || [[#SendSyncRequestLight|SendSyncRequestLight]] || Handle session_handle
|-
| 0x21 || Result || [[#SendSyncRequest|SendSyncRequest]] || Handle session_handle
|-
| 0x22 || Result || [[#SendSyncRequestWithUserBuffer|SendSyncRequestWithUserBuffer]] || uintptr_t message_buffer, size_t message_buffer_size, Handle session_handle
|-
| 0x23 || Result || [[#SendAsyncRequestWithUserBuffer|SendAsyncRequestWithUserBuffer]] || Handle *out_event_handle, uintptr_t message_buffer, size_t message_buffer_size, Handle session_handle
|-
| 0x24 || Result || [[#GetProcessId|GetProcessId]] || uint64_t *out_process_id, Handle process_handle
|-
| 0x25 || Result || [[#GetThreadId|GetThreadId]] || uint64_t *out_thread_id, Handle thread_handle
|-
| 0x26 || void || [[#Break|Break]] || BreakReason break_reason, uintptr_t arg, size_t size
|-
| 0x27 || Result || [[#OutputDebugString|OutputDebugString]] || const char *debug_str, size_t len
|-
| 0x28 || void || [[#ReturnFromException|ReturnFromException]] || Result result
|-
| 0x29 || Result || [[#GetInfo|GetInfo]] || uint64_t *out, InfoType info_type, Handle handle, uint64_t info_subtype
|-
| 0x2A || void || [[#FlushEntireDataCache|FlushEntireDataCache]] ||
|-
| 0x2B || Result || [[#FlushDataCache|FlushDataCache]] || uintptr_t address, size_t size
|-
| [3.0.0+] 0x2C || Result || [[#MapPhysicalMemory|MapPhysicalMemory]] || uintptr_t address, size_t size
|-
| [3.0.0+] 0x2D || Result || [[#UnmapPhysicalMemory|UnmapPhysicalMemory]] || uintptr_t address, size_t size
|-
| [5.0.0-5.1.0] 0x2E || Result || GetFutureThreadInfo || arch::LastThreadContext *out_context, uintptr_t *out_tls_address, uint32_t *out_flags, int64_t ns
|-
| [6.0.0+] 0x2E || Result || [[#GetDebugFutureThreadInfo|GetDebugFutureThreadInfo]] || arch::LastThreadContext *out_context, uint64_t *thread_id, Handle debug_handle, int64_t ns
|-
| 0x2F || Result || [[#GetLastThreadInfo|GetLastThreadInfo]] || arch::LastThreadContext *out_context, uintptr_t *out_tls_address, uint32_t *out_flags
|-
| 0x30 || Result || [[#GetResourceLimitLimitValue|GetResourceLimitLimitValue]] || int64_t *out_limit_value, Handle resource_limit_handle, LimitableResource which
|-
| 0x31 || Result || [[#GetResourceLimitCurrentValue|GetResourceLimitCurrentValue]] || int64_t *out_current_value, Handle resource_limit_handle, LimitableResource which
|-
| 0x32 || Result || [[#SetThreadActivity|SetThreadActivity]] || Handle thread_handle, ThreadActivity thread_activity
|-
| 0x33 || Result || [[#GetThreadContext3|GetThreadContext3]] || ThreadContext *out_context, Handle thread_handle
|-
| [4.0.0+] 0x34 || Result || [[#WaitForAddress|WaitForAddress]] || uintptr_t address, ArbitrationType arb_type, int32_t value, int64_t timeout_ns
|-
| [4.0.0+] 0x35 || Result || [[#SignalToAddress|SignalToAddress]] || uintptr_t address, SignalType signal_type, int32_t value, int32_t count
|-
| [8.0.0+] 0x36 || void || [[#SynchronizePreemptionState|SynchronizePreemptionState]] ||
|-
| [11.0.0+] 0x37 || Result || [[#GetResourceLimitPeakValue|GetResourceLimitPeakValue]] || int64_t *out_peak_value, Handle resource_limit_handle, LimitableResource which
|- style="border-top: double"
| [1.0.0-3.0.2] 0x3C || void || [[#DumpInfo|DumpInfo]] || DumpInfoType dump_info_type, uint64_t arg
|-
| [4.0.0+] 0x3C || void || [[#KernelDebug|KernelDebug]] || KernelDebugType kern_debug_type, uint64_t arg0, uint64_t arg1, uint64_t arg2
|-
| [4.0.0+] 0x3D || void || [[#ChangeKernelTraceState|ChangeKernelTraceState]] || KernelTraceState kern_trace_state
|- style="border-top: double"
| 0x40 || Result || [[#CreateSession|CreateSession]] || Handle *out_server_session_handle, Handle *out_client_session_handle, bool is_light, uintptr_t name
|-
| 0x41 || Result || [[#AcceptSession|AcceptSession]] || Handle *out_handle, Handle port
|-
| 0x42 || Result || [[#ReplyAndReceiveLight|ReplyAndReceiveLight]] || Handle handle
|-
| 0x43 || Result || [[#ReplyAndReceive|ReplyAndReceive]] || int32_t *out_index, const Handle *handles, int32_t num_handles, Handle reply_target, int64_t timeout_ns
|-
| 0x44 || Result || [[#ReplyAndReceiveWithUserBuffer|ReplyAndReceiveWithUserBuffer]] || int32_t *out_index, uintptr_t message_buffer, size_t message_buffer_size, const Handle *handles, int32_t num_handles, Handle reply_target, int64_t timeout_ns
|-
| 0x45 || Result || [[#CreateEvent|CreateEvent]] || Handle *out_write_handle, Handle *out_read_handle
|- style="border-top: double"
| [5.0.0+] 0x48 || Result || [[#MapPhysicalMemoryUnsafe|MapPhysicalMemoryUnsafe]] || uintptr_t address, size_t size
|-
| [5.0.0+] 0x49 || Result || [[#UnmapPhysicalMemoryUnsafe|UnmapPhysicalMemoryUnsafe]] || uintptr_t address, size_t size
|-
| [5.0.0+] 0x4A || Result || [[#SetUnsafeLimit|SetUnsafeLimit]] || size_t limit
|-
| [4.0.0+] 0x4B || Result || [[#CreateCodeMemory|CreateCodeMemory]] || Handle *out_handle, uintptr_t address, size_t size
|-
| [4.0.0+] 0x4C || Result || [[#ControlCodeMemory|ControlCodeMemory]] || Handle code_memory_handle, CodeMemoryOperation operation, uint64_t address, uint64_t size, MemoryPermission perm
|-
| 0x4D || void || [[#SleepSystem|SleepSystem]] ||
|-
| 0x4E || Result || [[#ReadWriteRegister|ReadWriteRegister]] || uint32_t *out_value, PhysicalAddress address, uint32_t mask, uint32_t value
|-
| 0x4F || Result || [[#SetProcessActivity|SetProcessActivity]] || Handle process_handle, ProcessActivity process_activity
|-
| 0x50 || Result || [[#CreateSharedMemory|CreateSharedMemory]] || Handle *out_handle, size_t size, MemoryPermission owner_perm, MemoryPermission remote_perm
|-
| 0x51 || Result || [[#MapTransferMemory|MapTransferMemory]] || Handle trmem_handle, uintptr_t address, size_t size, MemoryPermission owner_perm
|-
| 0x52 || Result || [[#UnmapTransferMemory|UnmapTransferMemory]] || Handle trmem_handle, uintptr_t address, size_t size
|-
| 0x53 || Result || [[#CreateInterruptEvent|CreateInterruptEvent]] || Handle *out_read_handle, int32_t interrupt_id, InterruptType interrupt_type
|-
| 0x54 || Result || [[#QueryPhysicalAddress|QueryPhysicalAddress]] || arch::PhysicalMemoryInfo *out_info, uintptr_t address
|-
| 0x55 || Result || [[#QueryIoMapping|QueryIoMapping]] || uintptr_t *out_address, [10.0.0+] size_t *out_size, PhysicalAddress physical_address, size_t size
|-
| 0x56 || Result || [[#CreateDeviceAddressSpace|CreateDeviceAddressSpace]] || Handle *out_handle, uint64_t das_address, uint64_t das_size
|-
| 0x57 || Result || [[#AttachDeviceAddressSpace|AttachDeviceAddressSpace]] || DeviceName device_name, Handle das_handle
|-
| 0x58 || Result || [[#DetachDeviceAddressSpace|DetachDeviceAddressSpace]] || DeviceName device_name, Handle das_handle
|-
| 0x59 || Result || [[#MapDeviceAddressSpaceByForce|MapDeviceAddressSpaceByForce]] || Handle das_handle, Handle process_handle, uint64_t process_address, size_t size, uint64_t device_address, MemoryPermission device_perm
|-
| 0x5A || Result || [[#MapDeviceAddressSpaceAligned|MapDeviceAddressSpaceAligned]] || Handle das_handle, Handle process_handle, uint64_t process_address, size_t size, uint64_t device_address, MemoryPermission device_perm
|-
| 0x5B || Result || [[#MapDeviceAddressSpace|MapDeviceAddressSpace]] || size_t *out_mapped_size, Handle das_handle, Handle process_handle, uint64_t process_address, size_t size, uint64_t device_address, MemoryPermission device_perm
|-
| 0x5C || Result || [[#UnmapDeviceAddressSpace|UnmapDeviceAddressSpace]] || Handle das_handle, Handle process_handle, uint64_t process_address, size_t size, uint64_t device_address
|-
| 0x5D || Result || [[#InvalidateProcessDataCache|InvalidateProcessDataCache]] || Handle process_handle, uint64_t address, uint64_t size
|-
| 0x5E || Result || [[#StoreProcessDataCache|StoreProcessDataCache]] || Handle process_handle, uint64_t address, uint64_t size
|-
| 0x5F || Result || [[#FlushProcessDataCache|FlushProcessDataCache]] || Handle process_handle, uint64_t address, uint64_t size
|-
| 0x60 || Result || [[#DebugActiveProcess|DebugActiveProcess]] || Handle *out_handle, uint64_t process_id
|-
| 0x61 || Result || [[#BreakDebugProcess|BreakDebugProcess]] || Handle debug_handle
|-
| 0x62 || Result || [[#TerminateDebugProcess|TerminateDebugProcess]] || Handle debug_handle
|-
| 0x63 || Result || [[#GetDebugEvent|GetDebugEvent]] || arch::DebugEventInfo *out_info, Handle debug_handle
|-
| 0x64 || Result || [[#ContinueDebugEvent|ContinueDebugEvent]] || Handle debug_handle, uint32_t flags, const uint64_t *thread_ids, int32_t num_thread_ids
|-
| 0x65 || Result || [[#GetProcessList|GetProcessList]] || int32_t *out_num_processes, uint64_t *out_process_ids, int32_t max_out_count
|-
| 0x66 || Result || [[#GetThreadList|GetThreadList]] || int32_t *out_num_threads, uint64_t *out_thread_ids, int32_t max_out_count, Handle debug_handle
|-
| 0x67 || Result || [[#GetDebugThreadContext|GetDebugThreadContext]] || ThreadContext *out_context, Handle debug_handle, uint64_t thread_id, uint32_t context_flags
|-
| 0x68 || Result || [[#SetDebugThreadContext|SetDebugThreadContext]] || Handle debug_handle, uint64_t thread_id, const ThreadContext *context, uint32_t context_flags
|-
| 0x69 || Result || [[#QueryDebugProcessMemory|QueryDebugProcessMemory]] || arch::MemoryInfo *out_memory_info, PageInfo *out_page_info, Handle process_handle, uintptr_t address
|-
| 0x6A || Result || [[#ReadDebugProcessMemory|ReadDebugProcessMemory]] || uintptr_t buffer, Handle debug_handle, uintptr_t address, size_t size
|-
| 0x6B || Result || [[#WriteDebugProcessMemory|WriteDebugProcessMemory]] || Handle debug_handle, uintptr_t buffer, uintptr_t address, size_t size
|-
| 0x6C || Result || [[#SetHardwareBreakPoint|SetHardwareBreakPoint]] || HardwareBreakPointRegisterName name, uint64_t flags, uint64_t value
|-
| 0x6D || Result || [[#GetDebugThreadParam|GetDebugThreadParam]] || uint64_t *out_64, uint32_t *out_32, Handle debug_handle, uint64_t thread_id, DebugThreadParam param
|- style="border-top: double"
| [5.0.0+] 0x6F || Result || [[#GetSystemInfo|GetSystemInfo]] || uint64_t *out, SystemInfoType info_type, Handle handle, uint64_t info_subtype
|-
| 0x70 || Result || [[#CreatePort|CreatePort]] || Handle *out_server_handle, Handle *out_client_handle, int32_t max_sessions, bool is_light, uintptr_t name
|-
| 0x71 || Result || [[#ManageNamedPort|ManageNamedPort]] || Handle *out_server_handle, const char *name, int32_t max_sessions
|-
| 0x72 || Result || [[#ConnectToPort|ConnectToPort]] || Handle *out_handle, Handle port
|-
| 0x73 || Result || [[#SetProcessMemoryPermission|SetProcessMemoryPermission]] || Handle process_handle, uint64_t address, uint64_t size, MemoryPermission perm
|-
| 0x74 || Result || [[#MapProcessMemory|MapProcessMemory]] || uintptr_t dst_address, Handle process_handle, uint64_t src_address, size_t size
|-
| 0x75 || Result || [[#UnmapProcessMemory|UnmapProcessMemory]] || uintptr_t dst_address, Handle process_handle, uint64_t src_address, size_t size
|-
| 0x76 || Result || [[#QueryProcessMemory|QueryProcessMemory]] || arch::MemoryInfo *out_memory_info, PageInfo *out_page_info, Handle process_handle, uint64_t address
|-
| 0x77 || Result || [[#MapProcessCodeMemory|MapProcessCodeMemory]] || Handle process_handle, uint64_t dst_address, uint64_t src_address, uint64_t size
|-
| 0x78 || Result || [[#UnmapProcessCodeMemory|UnmapProcessCodeMemory]] || Handle process_handle, uint64_t dst_address, uint64_t src_address, uint64_t size
|-
| 0x79 || Result || [[#CreateProcess|CreateProcess]] || Handle *out_handle, const arch::CreateProcessParameter *parameters, const uint32_t *caps, int32_t num_caps
|-
| 0x7A || Result || [[#StartProcess|StartProcess]] || Handle process_handle, int32_t priority, int32_t core_id, uint64_t main_thread_stack_size
|-
| 0x7B || Result || [[#TerminateProcess|TerminateProcess]] || Handle process_handle
|-
| 0x7C || Result || [[#GetProcessInfo|GetProcessInfo]] || int64_t *out_info, Handle process_handle, ProcessInfoType info_type
|-
| 0x7D || Result || [[#CreateResourceLimit|CreateResourceLimit]] || Handle *out_handle
|-
| 0x7E || Result || [[#SetResourceLimitLimitValue|SetResourceLimitLimitValue]] || Handle resource_limit_handle, LimitableResource which, int64_t limit_value
|-
| 0x7F || void || [[#CallSecureMonitor|CallSecureMonitor]] || SecureMonitorArguments *args
|-
|}

== SetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || uint32_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) X1 || void* || HeapAddress
|}
</div>

Sets the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to HeapAddress.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===
'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== SetMemoryPermission ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (In) W2 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Changes permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

=== Result codes ===
'''0x0:''' Success. The memory region was reprotected.

'''0xCC01:''' Unaligned address specified.

'''0xCA01:''' Unaligned or zero size specified.

'''0xD401:''' The provided memory region does not fall within the userland address space.

'''0xD801:''' Invalid permission specified. Valid permissions are ---, r-- and rw-.

'''0xD401:''' The provided memory region was in an invalid state. The region must have the [[#MemoryState|FlagCanReprotect]] state, and must not have the [[#MemoryAttribute|Locked]] or [[#MemoryAttribute|Uncached]] attributes.

'''0xCE01:''' Kernel resource exhausted.

== SetMemoryAttribute ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (In) W2 || uint32_t || Mask
|-
| (In) W3 || uint32_t || Value
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Changes attribute of page-aligned memory region. The only allowed combination of Value and Mask is 0x8, which means only bit3 in [[#MemoryAttribute]] can be set or cleared.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

== MapMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddress
|-
| (In) X1 || void* || SrcAddress
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#GetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#GetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== UnmapMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddress
|-
| (In) X1 || void* || SrcAddress
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Unmaps a region that was previously mapped with [[#MapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== QueryMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemoryInfo
|-
| (In) X2 || void* || Address
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || [[#PageInfo]] || PageInfo
|}
</div>

Queries information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== ExitProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Exits the current process.

== CreateThread ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || int32_t || Priority
|-
| (In) W5 || R4 || int32_t || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || Handle<Thread> || ThreadHandle
|}
</div>

Creates a thread in the current process.

ProcessorId must be 0,1,2,3 or -2, where -2 uses the default CpuId for process.

== StartThread ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || ThreadHandle
|-
| (Out) None || ||
|}
</div>

Starts the thread for the provided handle.

== ExitThread ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Exits the current thread.

== SleepThread ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || uint64_t || Nanoseconds
|}
</div>

Sleeps for a specified amount of time, or yields the thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|}
</div>

== GetThreadPriority ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || ThreadHandle
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || int32_t || Priority
|}
</div>

Gets the priority of provided thread handle.

== SetThreadPriority ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || ThreadHandle
|-
| (In) W1|| int32_t || Priority
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Sets the priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== GetThreadCoreMask ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || ThreadHandle
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || int32_t || CoreMask0
|-
| (Out) X2 || R2, R3 || uint64_t || CoreMask1
|}
</div>

Gets the affinity mask of provided thread handle.

== SetThreadCoreMask ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || ThreadHandle
|-
| (In) W1 || R1 || int32_t || CoreMask0
|-
| (In) X2 || R2, R3 || uint64_t || CoreMask1
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Sets the affinity mask of provided thread handle.

== GetCurrentProcessorNumber ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0 || uint32_t || CpuId
|}
</div>

Gets which cpu is executing the current thread.

CpuId is an integer in the range 0-3.

== SignalEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> || EventHandle
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

Puts the given event in the signaled state.

Will wake up any thread currently waiting on this event. Can potentially trigger a reschedule.

Any calls to [[#WaitSynchronization]] on this handle will return immediately, until the event's signaled state is reset.

=== Result codes ===
'''0x0:''' Success. Event is now in signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a WritableEvent.

== ClearEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> or Handle<ReadableEvent> || EventHandle
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

Takes the given event out of the signaled state.

=== Result codes ===
'''0x0:''' Success, the event is now in the not-signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a ReadableEvent nor a WritableEvent.

'''0xFA01:''' The handle was not in a signaled state.

== MapSharedMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || SharedMemoryHandle
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (In) W3 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== UnmapSharedMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || SharedMemoryHandle
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== CreateTransferMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (In) W3 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<TransferMemory> || TransferMemoryHandle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== CloseHandle ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle || Handle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ResetSignal ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<ReadableEvent> or Handle<Process> || Handle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Resets the signal on the given handle, ensuring future calls to [[#WaitSynchronization]] on this handle will sleep until the handle is signaled again. If the handle is a ReadableEvent, this is equivalent to calling ClearEvent() on the handle.

If the handle is a Process, it will clear the signaled state (which is set when the process changes [[#ProcessState]]. Once the process enters the Exited state, calling ResetSignal on the process will no longer have an effect (the process is permanently signaled), and the syscall will return 0xFA01.

=== Result codes ===
'''0x0:''' Success. The signal was reset.

'''0xE401:''' The handle is invalid or of the wrong type.

'''0xFA01:''' The handle was not signaled, or the process is in exited state, causing it to be permanently signaled.

== WaitSynchronization ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || int32_t || HandlesNum
|-
| (In) X3 || R0, R3 || int64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint64_t || HandleIndex
|}
</div>

Works with HandlesNum <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===
'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#GetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#GetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via [[#SignalEvent]].

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#AcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#ReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===
'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#CancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== CancelSynchronization ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || ThreadHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

If the referenced thread is currently in a synchronization call ([[#WaitSynchronization]], [[#ReplyAndReceive]] or [[#ReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===
'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== ArbitrateLock ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || ThreadHandle
|-
| (In) X1 || void* || Address
|-
| (In) W2 || uint32_t || Tag
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ArbitrateUnlock ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== WaitProcessWideKeyAtomic ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || KeyAddress
|-
| (In) X1 || R1 || void* || TagAddress
|-
| (In) W2 || R2 || uint32_t || Tag
|-
| (In) X3 || R3, R4 || int64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== SignalProcessWideKey ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) W1 || int32_t || Value
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetSystemTick ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || uint64_t || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== ConnectToNamedPort ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || char* || PortName
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<Session> || SessionHandle
|}
</div>

== SendSyncRequestLight ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Session> || SessionHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SendSyncRequest ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Session> || SessionHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SendSyncRequestWithUserBuffer ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (In) W2 || Handle<Session> || SessionHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Size and Address must be 0x1000-aligned.

=== Result codes ===
'''0x0:''' Success.

'''0xcc01:''' Address is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== SendAsyncRequestWithUserBuffer ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (In) W3 || Handle<Session> || SessionHandle
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ReadableEvent> || EventHandle
|}
</div>

Size and Address must be 0x1000-aligned.

== GetProcessId ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || ProcessId
|}
</div>

== GetThreadId ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<Thread> || ThreadHandle
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || ThreadId
|}
</div>

== Break ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#BreakReason]] || BreakReason
|-
| (In) X1 || uint64_t ||
|-
| (In) X2 || uint64_t || Info
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

If the process is attached, report the Break event. Then, if [[#ContinueDebugEvent]] didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== OutputDebugString ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || char* || String
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ReturnFromException ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#Result]] || Result
|}
</div>

== GetInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || [[#InfoType]] || InfoType
|-
| (In) W2 || R2 || Handle || Handle
|-
| (In) X3 || R0, R3 || uint64_t || InfoSubType
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || Info
|}
</div>

== FlushEntireDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

== FlushDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== MapPhysicalMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Acts like [[#SetHeapSize]] except you can allocate heap at any address you'd like.

Uses current process pool partition.

=== Result codes ===
'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either zero or not 4k-aligned

'''0xCC01:''' Invalid address. (not 4k-aligned)

'''0xDC01:''' Invalid memory range. It's either causes overflow, or does not fall into "reserved" address range (aka Alias). See AliasRegionAddress at [[#InfoType]]

'''0xFA01:''' Invalid state. (not enough SystemResource (see [[NPDM#SystemResourceSize]]))

== UnmapPhysicalMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetDebugFutureThreadInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X3 || R0, R1 || uint64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || uint64_t || LastThreadContextParam0
|-
| (Out) X2 || uint64_t || LastThreadContextParam1
|-
| (Out) X3 || uint64_t || LastThreadContextParam2
|-
| (Out) X4 || uint64_t || LastThreadContextParam3
|-
| (Out) X5 || uint64_t ||
|-
| (Out) W6 || uint32_t ||
|}
</div>

== GetLastThreadInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) X1 || uint64_t || LastThreadContextParam0
|-
| (Out) X2 || uint64_t || LastThreadContextParam1
|-
| (Out) X3 || uint64_t || LastThreadContextParam2
|-
| (Out) X4 || uint64_t || LastThreadContextParam3
|-
| (Out) X5 || uint64_t ||
|-
| (Out) W6 || uint32_t ||
|}
</div>

== GetResourceLimitLimitValue ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<ResourceLimit> || ResourceLimitHandle
|-
| (In) W2 || R2 || [[#LimitableResource]] || LimitableResource
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || int64_t || LimitValue
|}
</div>

== GetResourceLimitCurrentValue ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<ResourceLimit> || ResourceLimitHandle
|-
| (In) W2 || R2 || [[#LimitableResource]] || LimitableResource
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || int64_t || CurrentValue
|}
</div>

== SetThreadActivity ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || ThreadHandle
|-
| (In) W1 || [[#ThreadActivity]] || ThreadActivity
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetThreadContext3 ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#ThreadContext]]* || ThreadContext
|-
| (In) W1 || Handle<Thread> || ThreadHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== WaitForAddress ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || Address
|-
| (In) W1 || R1 || [[#ArbitrationType]] || ArbitrationType
|-
| (In) W2 || R2 || uint32_t || Value
|-
| (In) X3 || R3, R4 || uint64_t || Timeout
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SignalToAddress ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || Address
|-
| (In) W1 || R1 || [[#SignalType]] || SignalType
|-
| (In) W2 || R2 || uint32_t || Value
|-
| (In) W3 || R3 || uint32_t || NumToSignal
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SynchronizePreemptionState ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

== GetResourceLimitPeakValue ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<ResourceLimit> || ResourceLimitHandle
|-
| (In) W2 || R2 || [[#LimitableResource]] || LimitableResource
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || int64_t || PeakValue
|}
</div>

== DumpInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#DumpInfoType]] || DumpInfoType
|-
| (In) X1 || uint64_t || DumpInfoSubType
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Stubbed in retail kernel.

[4.0.0+] This function was removed and replaced by [[#KernelDebug]].

== KernelDebug ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#KernelDebugType]] || KernelDebugType
|-
| (In) X1 || uint64_t ||
|-
| (In) X2 || uint64_t ||
|-
| (In) X3 || uint64_t ||
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Stubbed in retail kernel.

== ChangeKernelTraceState ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#KernelTraceState]] || KernelTraceState
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Stubbed in retail kernel.

== CreateSession ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || bool || IsLight
|-
| (In) X3 || uint64_t || Name
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || ServerSessionHandle
|-
| (Out) W2 || Handle<ClientSession> || ClientSessionHandle
|}
</div>

== AcceptSession ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || PortHandle
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || ServerSessionHandle
|}
</div>

=== Result codes ===
'''0xf201:''' No session waiting to be accepted

== ReplyAndReceiveLight ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Port> or Handle<ServerSession> || Handle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ReplyAndReceive ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<Port>* or Handle<ServerSession>* || Handles
|-
| (In) W2 || R2 || uint32_t || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTargetSessionHandle
|-
| (In) X4 || R0, R4 || uint64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || HandleIndex
|}
</div>

If ReplyTargetSessionHandle is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTargetSessionHandle is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTargetSessionHandle is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===
'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== ReplyAndReceiveWithUserBuffer ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void* || Address
|-
| (In) X2 || R2 || uint64_t || Size
|-
| (In) X3 || R3 || Handle<Port>* or Handle<ServerSession>* || Handles
|-
| (In) W4 || R0 || uint32_t || NumHandles
|-
| (In) W5 || R4 || Handle<ServerSession> || ReplyTargetSessionHandle
|-
| (In) X6 || R5, R6 || uint64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || HandleIndex
|}
</div>

== CreateEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<WritableEvent> || WritableEventHandle
|-
| (Out) W2 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

== MapPhysicalMemoryUnsafe ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Same as [[#MapPhysicalMemory]] except it always uses pool partition 0.

== UnmapPhysicalMemoryUnsafe ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SetUnsafeLimit ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || uint64_t || Limit
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== CreateCodeMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<CodeMemory> || CodeMemoryHandle
|}
</div>

Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== ControlCodeMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<CodeMemory> || CodeMemoryHandle
|-
| (In) W1 || R1 || [[#CodeMemoryOperation]] || CodeMemoryOperation
|-
| (In) X2 || R2, R3 || void* || Address
|-
| (In) X3 || R4, R5 || uint64_t || Size
|-
| (In) W4 || R6 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maps the backing memory for a CodeMemory object into the current process.

For [[#CodeMemoryOperation|MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|UnmapOwner/UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== SleepSystem ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

== ReadWriteRegister ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || uint64_t || RegisterAddress
|-
| (In) W2 || R0 || uint32_t || RwMask
|-
| (In) W3 || R1 || uint32_t || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC#ReadWriteRegister|ReadWriteRegister]].

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by the SMC [[SMC#ReadWriteRegister|ReadWriteRegister]] (checked in addition to the whitelist in the ReadWriteRegister SVC), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== SetProcessActivity ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) W1 || [[#ProcessActivity]] || ProcessActivity
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== CreateSharedMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || uint64_t || Size
|-
| (In) W2 || [[#MemoryPermission]] || LocalMemoryPermission
|-
| (In) W3 || [[#MemoryPermission]] || RemoteMemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<SharedMemory> || SharedMemoryHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== MapTransferMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || TransferMemoryHandle
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (In) W3 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

You must pass same size and permissions as given in [[#CreateTransferMemory]], otherwise error.

== UnmapTransferMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || TransferMemoryHandle
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== CreateInterruptEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#Interrupt]] || Interrupt
|-
| (In) W2 || [[#InterruptType]] || InterruptType
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Creates an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The InterruptType argument configures the triggering. If it is 0, the IRQ is active HIGH level sensitive, if it is 1 it is rising-edge sensitive.

=== Result codes ===
'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== QueryPhysicalAddress ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || VirtualAddress
|-
| (Out) W0 || [[#Result]]|| Result
|-
| (Out) X1 || uint64_t || PhysicalMemoryInfoAddress
|-
| (Out) X2 || uint64_t || PhysicalMemoryInfoBaseAddress
|-
| (Out) X3 || uint64_t || PhysicalMemoryInfoSize
|}
</div>

Queries the physical address of a virtual address. Will always fetch the lowest page-aligned mapping that contains the provided physical address.

The returned PhysicalMemoryInfoBaseAddress is the virtual address of that page-aligned mapping, while PhysicalMemoryInfoAddress is the physical address of that page. PhysicalMemoryInfoSize is the amount of continuous physical memory in that mapping.

== QueryIoMapping ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || uint64_t || IoAddress
|-
| (In) X2 || R0 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1 || void* || VirtualAddress
|}
</div>

Returns a virtual address mapped to a given IO range.

== CreateDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || uint64_t || DeviceAddressSpaceStartAddress
|-
| (In) X2 || R0, R1 || uint64_t || DeviceAddressSpaceEndAddress
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|}
</div>

Creates a virtual address space for binding device address spaces and returns a handle.

StartAddr is normally set to 0 and EndAddr is normally set to 0xFFFFFFFF.

== AttachDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceName
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Attaches a device address space to a [[#DeviceName|device]].

== DetachDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceName
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Detaches a device address space from a [[#DeviceName|device]].

== MapDeviceAddressSpaceByForce ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || Address
|-
| (In) X3 || R4 || uint64_t || DeviceAddressSpaceSize
|-
| (In) X4 || R5, R6 || uint64_t || DeviceAddressSpaceAddress
|-
| (In) W5 || R7 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maps an attached device address space to an userspace address.

Address is the userspace destination address, while DeviceAddressSpaceAddress is the source address between DeviceAddressSpaceStartAddress and DeviceAddressSpaceEndAddress (passed to [[#CreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|FlagCanDeviceMap]] bit set. Bit [[SVC#MemoryAttribute|DeviceShared]] will be set after mapping.

== MapDeviceAddressSpaceAligned ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || Address
|-
| (In) X3 || R4 || uint64_t || DeviceAddressSpaceSize
|-
| (In) X4 || R5, R6 || uint64_t || DeviceAddressSpaceAddress
|-
| (In) W5 || R7 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maps an attached device address space to an userspace address.

Same as [[#MapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|FlagCanAlignedDeviceMap]] bit set instead.

== MapDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R0, R3 || void* || Address
|-
| (In) X4 || R4 || uint64_t || DeviceAddressSpaceSize
|-
| (In) X5 || R5, R6 || uint64_t || DeviceAddressSpaceAddress
|-
| (In) W6 || R7 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1 || uint64_t || Size
|}
</div>

== UnmapDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || Address
|-
| (In) X3 || R4 || uint64_t || DeviceAddressSpaceSize
|-
| (In) X4 || R5, R6 || uint64_t || DeviceAddressSpaceAddress
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Unmaps an attached device address space from an userspace address.

== InvalidateProcessDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || Address
|-
| (In) X2 || R1, R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== StoreProcessDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || Address
|-
| (In) X2 || R1, R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== FlushProcessDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || Address
|-
| (In) X2 || R1, R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== DebugActiveProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || uint64_t || ProcessId
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || Handle<Debug> || DebugHandle
|}
</div>

== BreakDebugProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Debug> || DebugHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== TerminateDebugProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Debug> || DebugHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetDebugEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#DebugEventInfo]]* || DebugEventInfo
|-
| (In) W1 || Handle<Debug> || DebugHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ContinueDebugEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Debug> || DebugHandle
|-
| (In) W1 || R1 || uint32_t || [[#ContinueDebugFlags]] ([1.0.0-2.3.0] [[#ContinueDebugFlagsOld]])
|-
| (In) X2 || R2 ([1.0.0-2.3.0] R2, R3) || uint64_t* ([1.0.0-2.3.0] uint64_t)|| ThreadIdList ([1.0.0-2.3.0] ThreadId)
|-
| (In) X3 || R3 || uint64_t || [3.0.0+] NumThreadIds
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maximum NumThreadIds is 64. 0 means "all threads".

=== Result codes ===
'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== GetProcessList ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || uint64_t* || ProcessIdBuffer
|-
| (In) W2 || R2 || uint32_t || ProcessIdBufferSize
|-
| (Out) X0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || NumProcesses
|}
</div>

Fills the provided array with the pids of currently living processes. A process "lives" so long as it is currently running or a handle to it still exists.

It returns the total number of processes currently alive. If this number is bigger than the size of ProcessIdBuffer, the user won't have all the pids.

=== Result codes ===
'''0x0:''' Success.

'''0xd401:''' The provided buffer is outside the process address space.

'''0xe601:''' copyToUser failed. The provided buffer is not user-accessible.

'''0xee01:''' The provided buffer size is too big. Max value is 0xFFFFFFF.

== GetThreadList ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || uint64_t* || ThreadIdBuffer
|-
| (In) W2 || R2 || uint32_t || ThreadIdBufferSize
|-
| (In) W3 || R3 || Handle<Debug> || DebugHandle
|-
| (Out) X0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || NumThreads
|}
</div>

== GetDebugThreadContext ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#ThreadContext]]* || ThreadContext
|-
| (In) X1 || R1 || Handle<Debug> || DebugHandle
|-
| (In) X2 || R2, R3 || uint64_t || ThreadId
|-
| (In) W3 || R4 || uint32_t || [[#ThreadContextFlags]]
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== SetDebugThreadContext ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Debug> || DebugHandle
|-
| (In) X1 || R2, R3 || uint64_t || ThreadId
|-
| (In) X2 || R1 || [[#ThreadContext]]* || ThreadContext
|-
| (In) W3 || R4 || uint32_t || [[#ThreadContextFlags]]
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== QueryDebugProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemoryInfo
|-
| (In) W2 || Handle<Debug> || DebugHandle
|-
| (In) X3 || void* || Address
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || [[#PageInfo]] || PageInfo
|}
</div>

== ReadDebugProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || MemoryBufferAddress
|-
| (In) W1 || Handle<Debug> || DebugHandle
|-
| (In) X2 || void* || SrcAddress
|-
| (In) X3 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== WriteDebugProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Debug> || DebugHandle
|-
| (In) X1 || void* || MemoryBufferAddress
|-
| (In) X2 || void* || DstAddress
|-
| (In) X3 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SetHardwareBreakPoint ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || [[#HardwareBreakPointRegisterName]] || Name
|-
| (In) X1 || R2, R3 || uint64_t || Flags
|-
| (In) X2 || R1, R4 || uint64_t || Value
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of HardwareBreakPointRegisterName:

If HardwareBreakPointRegisterName < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given DebugHandle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If HardwareBreakPointRegisterName is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that HardwareBreakPointRegisterName 0 to 4 match only to Virtual Address, while HardwareBreakPointRegisterName 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

== GetDebugThreadParam ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X2 || R2 || Handle<Debug> || DebugHandle
|-
| (In) X3 || R0, R1 || uint64_t || ThreadId
|-
| (In) W4 || R3 || [[#DebugThreadParam]] || DebugThreadParam
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || Out0
|-
| (Out) W2 || R3 || uint32_t || Out1
|}
</div>

== GetSystemInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#SystemInfoType]] || SystemInfoType
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || uint64_t || SystemInfoSubType
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) X1 || uint64_t || SystemInfo
|}
</div>

== CreatePort ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || int32_t || MaxSessions
|-
| (In) W3 || R3 || bool || IsLight
|-
| (In) X4 || R0 || uint64_t || Name
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || Handle<Port> || ServerPortHandle
|-
| (Out) W2 || R2 || Handle<Port> || ClientPortHandle
|}
</div>

== ManageNamedPort ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || char* || Name
|-
| (In) W2 || int32_t || MaxSessions
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<Port> || ServerPortHandle
|}
</div>

== ConnectToPort ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || ClientPortHandle
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<Session> || SessionHandle
|}
</div>

== SetProcessMemoryPermission ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || Addr
|-
| (In) X2 || R1, R4 || uint64_t || Size
|-
| (In) W3 || R5 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== MapProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddress
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddress
|-
| (In) X3 || R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== UnmapProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddress
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddress
|-
| (In) X3 || R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Unmaps what was mapped by [[#MapProcessMemory]].

== QueryProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemoryInfo
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || void* || Address
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || [[#PageInfo]] || PageInfo
|}
</div>

Equivalent to [[#QueryMemory]] except takes a process handle.

== MapProcessCodeMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || DstAddress
|-
| (In) X2 || R1, R4 || void* || SrcAddress
|-
| (In) X3 || R5, R6 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== UnmapProcessCodeMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || DstAddress
|-
| (In) X2 || R1, R4 || void* || SrcAddress
|-
| (In) X3 || R5, R6 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Unmaps what was mapped by [[#MapProcessCodeMemory]].

== CreateProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessParameter]]* || CreateProcessParameter
|-
| (In) X2 || uint32_t* || Capabilities
|-
| (In) X3 || int32_t || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessParameter]] as input.
Capabilities points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the Capabilities array (number of element, not number of bytes).

=== Result codes ===
'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== StartProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R1 || int32_t || MainThreadPriority
|-
| (In) W2 || R2 || int32_t || DefaultCpuId
|-
| (In) X3 || R3, R4 || uint64_t || MainThreadStackSize
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== TerminateProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetProcessInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || ProcessInfoType
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || [[#ProcessState]]
|}
</div>

Returns an enum with value 0-7.

== CreateResourceLimit ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ResourceLimit> || ResourceLimitHandle
|}
</div>

== SetResourceLimitLimitValue ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<ResourceLimit> || ResourceLimitHandle
|-
| (In) W1 || R1 || [[#LimitableResource]] || LimitableResource
|-
| (In) X2 || R2, R3 || int64_t || LimitValue
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== CallSecureMonitor ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || uint64_t || [[SMC#Secure_Monitor_calls|FunctionId]]
|-
| (In) X1-X7 || R1-R7 || uint64_t || SMC arguments
|-
| (Out) X0 || R0 || [[SMC#Result|Result]] || SMC result
|-
| (Out) X1-X7 || R1-R7 || uint64_t || SMC output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* BreakDebugProcess
* ContinueDebugEvent
* WriteDebugProcessMemory
* SetDebugThreadContext
* TerminateDebugProcess
* SetHardwareBreakPoint

DebugActiveProcess stops execution of the target process, the normal method for resuming it requires ContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

= Enum/Structures =
== InfoType ==
{| class=wikitable
! Handle type || InfoType || InfoSubType || Description
|-
| Process || 0 || 0 || CoreMask
|-
| Process || 1 || 0 || PriorityMask
|-
| Process || 2 || 0 || AliasRegionAddress
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionAddress
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemorySize. Total memory available(free+used).
|-
| Process || 7 || 0 || UsedMemorySize. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || DebuggerAttached
|-
| Zero || 9 || 0 || ResourceLimit
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AslrRegionAddress
|-
| Process || 13 || 0 || [2.0.0+] AslrRegionSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionAddress
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] SystemResourceSizeTotal
|-
| Process || 17 || 0 || [3.0.0+] SystemResourceSizeUsed
|-
| Process || 18 || 0 || [3.0.0+] ProgramId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] InitialProcessIdRange_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] InitialProcessIdRange_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddress
|-
| Process || 21 || 0 || [6.0.0+] TotalNonSystemMemorySize
|-
| Process || 22 || 0 || [6.0.0+] UsedNonSystemMemorySize
|-
| Process || 23 || 0 || [9.0.0+] IsApplication
|-
| Process || 24 || 0 || [11.0.0+] FreeThreadCount
|-
| Thread || 0xF0000002 || 0-3, -1 || ThreadTickCount. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== SystemInfoType ==
{| class=wikitable
! Handle type || SystemInfoType || SystemInfoSubType || Description
|-
| Zero || 0 || 0 || TotalPhysicalMemorySize_Application
|-
| Zero || 0 || 1 || TotalPhysicalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalPhysicalMemorySize_System
|-
| Zero || 0 || 3 || TotalPhysicalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || UsedPhysicalMemorySize_Application
|-
| Zero || 1 || 1 || UsedPhysicalMemorySize_Applet
|-
| Zero || 1 || 2 || UsedPhysicalMemorySize_System
|-
| Zero || 1 || 3 || UsedPhysicalMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || InitialProcessIdRange_LowerBound
|-
| Zero || 2 || 1 || InitialProcessIdRange_UpperBound
|}

== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || AFI
|-
| 1 || AVPC
|-
| 2 || DC
|-
| 3 || DCB
|-
| 4 || HC
|-
| 5 || HDA
|-
| 6 || ISP2
|-
| 7 || MSENCNVENC
|-
| 8 || NV
|-
| 9 || NV2
|-
| 10 || PPCS
|-
| 11 || SATA
|-
| 12 || VI
|-
| 13 || VIC
|-
| 14 || XUSB_HOST
|-
| 15 || XUSB_DEV
|-
| 16 || TSEC
|-
| 17 || PPCS1
|-
| 18 || DC1
|-
| 19 || SDMMC1A
|-
| 20 || SDMMC2A
|-
| 21 || SDMMC3A
|-
| 22 || SDMMC4A
|-
| 23 || ISP2B
|-
| 24 || GPU
|-
| 25 || GPUB
|-
| 26 || PPCS2
|-
| 27 || NVDEC
|-
| 28 || APE
|-
| 29 || SE
|-
| 30 || NVJPG
|-
| 31 || HC1
|-
| 32 || SE1
|-
| 33 || AXIAP
|-
| 34 || ETR
|-
| 35 || TSECB
|-
| 36 || TSEC1
|-
| 37 || TSECB1
|-
| 38 || NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || MapOwner
|-
| 1 || MapSlave
|-
| 2 || UnmapOwner
|-
| 3 || UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Description
|-
| 0 || PhysicalMemoryMax || Bytes of memory a process may allocate.
|-
| 1 || ThreadCountMax || Amount of threads a process can create.
|-
| 2 || EventCountMax || Amount of events a process can create through [[#CreateEvent]] or [[#SendAsyncRequestWithUserBuffer]].
|-
| 3 || TransferMemoryCountMax || Amount of TransferMemory a process can create through [[#CreateTransferMemory]].
|-
| 4 || SessionCountMax || Amount of session a process can create through [[#CreateSession]], [[#ConnectToPort]] or [[#ConnectToNamedPort]].
|}

= ThreadActivity =
{| class=wikitable
! Value || Name
|-
| 0 || None
|-
| 1 || Runnable
|}

== ProcessActivity ==
{| class=wikitable
! Value || Name
|-
| 0 || None
|-
| 1 || Runnable
|}

== ProcessInfoType ==
{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessState]]
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || Created ||
|-
| 1 || CreatedAttached ||
|-
| 2 || Started ||
|-
| 3 || Crashed || Processes will not enter this state unless they were created with [[#CreateProcessParameter|EnableDebug]].
|-
| 4 || StartedAttached ||
|-
| 5 || Exiting ||
|-
| 6 || Exited ||
|-
| 7 || DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DynamicPriority
|-
| 1 || SchedulingStatus
|-
| 2 || PreferredCpuCore
|-
| 3 || CurrentCpuCore
|-
| 4 || AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended ([[#SetThreadActivity]] 1 or [[#SetProcessActivity]] 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

PreferredCpuCore: output in out2

CurrentCpuCore: output in out2

AffinityMask: output in out1

== CreateProcessParameter ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || Is64BitInstruction
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] MemoryRegion (0 = Application, 1 = Applet, 2 = SecureSystem, 3 = NonSecureSystem)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (only allowed in combination with IsApplication)
|-
| 0x28 || 4 || || ResourceLimitHandle (can be zero)
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one MemoryRegion.

On [2.0.0-4.0.0] MemoryRegion is 1 for built-ins and 0 for rest.

On [5.0.0] MemoryRegion is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || AddressSpace32Bit || 32 ||
|-
| 1 || AddressSpace64BitOld || 36 ||
|-
| 2 || AddressSpace32BitNoReserved || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] AddressSpace64Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || [[#MemoryType]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || [[#MemoryPermission]]
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryPermission ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || Read || Can be set by [[#SetMemoryPermission]].
|-
| 1 || Write || Can be set by [[#SetMemoryPermission]].
|-
| 2 || Execute || Can be set by [[#SetProcessMemoryPermission]] and [[#ControlCodeMemory]].
|-
| 28 || DontCare ||
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || Locked || Used by MapMemory, as an async IPC user buffer.
|-
| 1 || IpcLocked || True when IpcRefCount > 0.
|-
| 2 || DeviceShared || True when DeviceRefCount > 0.
|-
| 3 || Uncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description || Meaning
|-
| 7-0 || [[#MemoryType]] ||
|-
| 8 || [[#SetMemoryPermission|FlagCanReprotect]] ||
|-
| 9 || FlagCanDebug || Allows using [[#WriteDebugProcessMemory]] on segments mapped read-only.
|-
| 10 || FlagCanUseIpc || Allows sending this region as an IPC A/B/W buffer with flags=0.
|-
| 11 || FlagCanUseNonDeviceIpc || Allows sending this region as an IPC A/B/W buffer with flags=1.
|-
| 12 || FlagCanUseNonSecureIpc || Allows sending this region as an IPC A/B/W buffer with flags=3.
|-
| 13 || FlagMapped ||
|-
| 14 || [[#SetProcessMemoryPermission|FlagCode]] ||
|-
| 15 || [[#MapMemory|FlagCanAlias]] ||
|-
| 16 || [[#MapProcessCodeMemory|FlagCanCodeAlias]] ||
|-
| 17 || [[#CreateTransferMemory|FlagCanTransfer]] ||
|-
| 18 || [[#QueryPhysicalAddress|FlagCanQueryPhysical]] ||
|-
| 19 || [[#MapDeviceAddressSpace|FlagCanDeviceMap]] ||
|-
| 20 || [[#MapDeviceAddressSpaceAligned|FlagCanAlignedDeviceMap]] ||
|-
| 21 || [[#SendSyncRequestWithUserBuffer|FlagCanIpcUserBuffer]] ||
|-
| 22 || FlagReferenceCounted || The physical memory blocks backing this region are refcounted.
|-
| 23 || [[#MapProcessMemory|FlagCanMapProcess]] ||
|-
| 24 || [[#SetMemoryAttribute|FlagCanChangeAttribute]] ||
|-
| 25 || [4.0.0+] [[#CreateCodeMemory|FlagCanCodeMemory]] ||
|}

=== MemoryType ===
{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || Free ||
|-
| 0x00002001 || Io || Mapped by kernel capability parsing in [[#CreateProcess]].
|-
| 0x00042002 || Static || Mapped by kernel capability parsing in [[#CreateProcess]].
|-
| 0x00DC7E03 || Code || Mapped during [[#CreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| CodeData || Transition from 0xDC7E03 performed by [[#SetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| Normal || Mapped using [[#SetHeapSize]].
|-
| 0x00402006 || Shared || Mapped using [[#MapSharedMemory]].
|-
| 0x00482907 || [1.0.0] Alias || Mapped using [[#MapMemory]].
|-
| 0x00DD7E08 || AliasCode || Mapped using [[#MapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| AliasCodeData || Transition from 0xDD7E08 performed by [[#SetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || Stack || Mapped using [[#MapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|ThreadLocal]] || Mapped during [[#CreateThread]].
|-
| 0x015C3C0D || Transfered || Mapped using [[#MapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || SharedTransfered || Mapped using [[#MapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || SharedCode || Mapped using [[#MapProcessMemory]].
|-
| 0x00000010 || Inaccessible ||
|-
| 0x005C3811 || [[IPC_Marshalling|NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || Kernel || Mapped in kernel during [[#CreateThread]].
|-
| 0x00402214 || [4.0.0+] GeneratedCode || Mapped in kernel during [[#ControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] CodeOut || Mapped in kernel during [[#ControlCodeMemory]].
|}

== ArbitrationType ==
{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|}

== SignalType ==
{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==
The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || AttachProcess
|-
| 1 || AttachThread
|-
| 2 || ExitProcess
|-
| 3 || ExitThread
|-
| 4 || Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Trap (*)
|-
| 1 || InstructionAbort
|-
| 2 || DataAbortMisc (**)
|-
| 3 || PcSpAlignmentFault
|-
| 4 || DebuggerAttached
|-
| 5 || BreakPoint
|-
| 6 || UserBreak
|-
| 7 || DebuggerBreak
|-
| 8 || BadSvcId
|-
| 9 || [2.0.0+] SError
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and [[#ReturnFromException]]:

TLS region start (A64):
{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:
{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):
{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:
{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || [2.0.0+] SError
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call [[#ReturnFromException]] (error code) to call that handler. The latter is then expected to promptly abort the program.

[[#ReturnFromException]] updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls [[#ReturnFromException]], it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

NPDM

2020-11-20T07:57:34Z

PixelyIon: Correct `ThreadInfo` priority field order

This is the Switch equivalent of 3DS [https://www.3dbrew.org/wiki/NCCH/Extended_Header exheader]. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x80
| [[#META|META]]
|-
| 0x80
| <Varies>
| [[#ACID|ACID]]
|-
| <See META>
| <See META>
| [[#ACI0|ACI0]]
|}

= META =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magicnum "META"
|-
| 0x4
| 0x4
| [9.0.0+] AcidSignatureKeyGeneration (0 or 1)
|-
| 0x8
| 0x4
| Reserved
|-
| 0xC
| 0x1
| [[#Flags|Flags]]
|-
| 0xD
| 0x1
| Reserved
|-
| 0xE
| 0x1
| [[#MainThreadPriority|MainThreadPriority]]
|-
| 0xF
| 0x1
| MainThreadCoreNumber
|-
| 0x10
| 0x4
| Reserved
|-
| 0x14
| 0x4
| [3.0.0+] [[#SystemResourceSize|SystemResourceSize]]
|-
| 0x18
| 0x4
| [[#Version|Version]]
|-
| 0x1C
| 0x4
| [[#MainThreadStackSize|MainThreadStackSize]]
|-
| 0x20
| 0x10
| Name (usually/always "Application")
|-
| 0x30
| 0x10
| ProductCode (usually/always all zeroes)
|-
| 0x40
| 0x30
| Reserved
|-
| 0x70
| 0x4
| [[#ACI0|AciOffset]]
|-
| 0x74
| 0x4
| [[#ACI0|AciSize]]
|-
| 0x78
| 0x4
| [[#ACID|AcidOffset]]
|-
| 0x7C
| 0x4
| [[#ACID|AcidSize]]
|}

== Flags ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0
| Is64BitInstruction
|-
| 1-3
| ProcessAddressSpace (0x00 = AddressSpace32Bit, 0x01 = AddressSpace64BitOld, 0x02 = AddressSpace32BitNoReserved, 0x03 = AddressSpace64Bit)
|-
| 4
| OptimizeMemoryAllocation
|}

== MainThreadPriority ==
Ranges from 0 to 0x3F.

== SystemResourceSize ==
This is the size of PersonalMmHeap. Maximum size as of 5.0.0 is 0x1FE00000.

== Version ==
0 for all titles.

[8.1.0+] Now set to 1 for certain titles.

[9.0.0+] Now set to a proper version field for all titles.

== MainThreadStackSize ==
Must be aligned to 0x1000.

In non-nspwn scenarios, values of 0 can also rarely break in Horizon. This might be something auto-adapting or a security feature of some sort?

= ACID =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x100
| RSA-2048 signature over the data starting at 0x100 with the size field from 0x204
|-
| 0x100
| 0x100
| RSA-2048 public key for the second [[NCA_Format|NCA]] signature
|-
| 0x200
| 0x4
| Magicnum "ACID"
|-
| 0x204
| 0x4
| Size
|-
| 0x208
| 0x4
| Reserved
|-
| 0x20C
| 0x4
| [[#Flags_2|Flags]]
|-
| 0x210
| 0x8
| ProgramIdMin
|-
| 0x218
| 0x8
| ProgramIdMax
|-
| 0x220
| 0x4
| [[#FsAccessControl|FsAccessControlOffset]]
|-
| 0x224
| 0x4
| [[#FsAccessControl|FsAccessControlSize]]
|-
| 0x228
| 0x4
| [[#SrvAccessControl|SrvAccessControlOffset]]
|-
| 0x22C
| 0x4
| [[#SrvAccessControl|SrvAccessControlSize]]
|-
| 0x230
| 0x4
| [[#KernelCapability|KernelCapabilityOffset]]
|-
| 0x234
| 0x4
| [[#KernelCapability|KernelCapabilitySize]]
|-
| 0x238
| 0x8
| Reserved
|}

== Flags ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0
| ProductionFlag
|-
| 1
| UnqualifiedApproval
|-
| 2-3
| [5.0.0+ ] MemoryRegion (0 = Application, 1 = Applet, 2 = SecureSystem, 3 = NonSecureSystem)
|}

MemoryRegion is set to Application for "starter" and NonSecureSystem for "nvservices".

= ACI0 =
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Magicnum "ACI0"
|-
| 0x4
| 0xC
| Reserved
|-
| 0x10
| 0x8
| ProgramId
|-
| 0x18
| 0x8
| Reserved
|-
| 0x20
| 0x4
| [[#FsAccessControl|FsAccessControlOffset]]
|-
| 0x24
| 0x4
| [[#FsAccessControl|FsAccessControlSize]]
|-
| 0x28
| 0x4
| [[#SrvAccessControl|SrvAccessControlOffset]]
|-
| 0x2C
| 0x4
| [[#SrvAccessControl|SrvAccessControlSize]]
|-
| 0x30
| 0x4
| [[#KernelCapability|KernelCapabilityOffset]]
|-
| 0x34
| 0x4
| [[#KernelCapability|KernelCapabilitySize]]
|-
| 0x38
| 0x8
| Reserved
|}

= FsAccessControl =
For [[#ACID|ACID]] this is a simple descriptor as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version (always 1, must be non-zero)
|-
| 0x1
| 0x1
| [5.0.0+] ContentOwnerIdCount
|-
| 0x2
| 0x1
| [5.0.0+] SaveDataOwnerIdCount
|-
| 0x3
| 0x1
| Padding
|-
| 0x4
| 0x8
| [[#FsAccessFlag|FsAccessFlag]]
|-
| 0xC
| 0x8
| ContentOwnerIdMin
|-
| 0x14
| 0x8
| ContentOwnerIdMax
|-
| 0x1C
| 0x8
| SaveDataOwnerIdMin
|-
| 0x24
| 0x8
| SaveDataOwnerIdMax
|-
| 0x2C
| 0x8 * ContentOwnerIdCount
| [5.0.0+] ContentOwnerIds
|-
| Variable
| 0x8 * SaveDataOwnerIdCount
| [5.0.0+] SaveDataOwnerIds
|}

For [[#ACI0|ACI0]] this embeds data as follows:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Version (always 1, must be non-zero)
|-
| 0x1
| 0x3
| Padding
|-
| 0x4
| 0x8
| [[#FsAccessFlag|FsAccessFlag]]
|-
| 0xC
| 0x4
| ContentOwnerInfoOffset
|-
| 0x10
| 0x4
| ContentOwnerInfoSize
|-
| 0x14
| 0x4
| SaveDataOwnerInfoOffset
|-
| 0x18
| 0x4
| SaveDataOwnerInfoSize
|-
| 0x1C
| 0x4
| (Optional) ContentOwnerIdCount
|-
| 0x1C
| 0x8 * ContentOwnerIdCount
| ContentOwnerIds
|-
| Variable
| 0x4
| SaveDataOwnerIdCount
|-
| Variable
| 0x1 * SaveDataOwnerIdCount
| Accessibilities (1=Read, 2=Write, 3=ReadWrite)
|-
| Variable (padded to nearest 4 bytes)
| 0x8 * SaveDataOwnerIdCount
| SaveDataOwnerIds
|}

== FsAccessFlag ==
{| class="wikitable" border="1"
|-
! Bits
! Name
! Description
|-
| 0
| ApplicationInfo
| MountContent* is accessible when set.
|-
| 1
| BootModeControl
|
|-
| 2
| Calibration
|
|-
| 3
| SystemSaveData
|
|-
| 4
| GameCard
|
|-
| 5
| SaveDataBackUp
|
|-
| 6
| SaveDataManagement
|
|-
| 7
| BisAllRaw
|
|-
| 8
| GameCardRaw
|
|-
| 9
| GameCardPrivate
|
|-
| 10
| SetTime
|
|-
| 11
| ContentManager
|
|-
| 12
| ImageManager
|
|-
| 13
| CreateSaveData
|
|-
| 14
| SystemSaveDataManagement
|
|-
| 15
| BisFileSystem
|
|-
| 16
| SystemUpdate
|
|-
| 17
| SaveDataMeta
|
|-
| 18
| DeviceSaveData
|
|-
| 19
| SettingsControl
|
|-
| 20
| SystemData
|
|-
| 21
| SdCard
|
|-
| 22
| Host
|
|-
| 23
| FillBis
|
|-
| 24
| CorruptSaveData
|
|-
| 25
| SaveDataForDebug
|
|-
| 26
| FormatSdCard
|
|-
| 27
| GetRightsId
|
|-
| 28
| RegisterExternalKey
|
|-
| 29
| RegisterUpdatePartition
|
|-
| 30
| SaveDataTransfer
|
|-
| 31
| DeviceDetection
|
|-
| 32
| AccessFailureResolution
|
|-
| 33
| SaveDataTransferVersion2
|
|-
| 34
| RegisterProgramIndexMapInfo
|
|-
| 35
| CreateOwnSaveData
|
|-
| 36
| MoveCacheStorage
|
|-
| 37-61
| Reserved
|
|-
| 62
| Debug
| See [[SPL_services#GetConfig|here]].
|-
| 63
| FullPermission
| Enables access to everything: all [[Filesystem_services#Permissions|permission types]] which check a bitmask have this bit set.
|}

Controls the [[Filesystem_services#Permissions|filesystem permissions]].

Web-applets permissions:
* "LibAppletWeb" and "LibAppletOff" have same access control: bit0 and bit3 set, and bit62 set.
* Rest of the web-applets: Same as above except bit0 isn't set.

= Service Access Control =
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-2
| Size (length of the service-name without null-terminator minus 1)
|-
| 7
| IsServer (service is allowed to be registered)
|-
| Variable
| Name
|}

This is a list of [[Services_API|service]]-name strings which the title has access to.

The service name string starts after the first byte and supports the wildcard <code>*</code> character.

= KernelCapability =
{| class="wikitable" border="1"
|-
! Pattern of lower bits
! Lowest clear bitmask/bit
! Description
|-
| <code>0bxxxxxxxxxxxx0111</code>
| Bit3
| [[#ThreadInfo]]
|-
| <code>0bxxxxxxxxxxx01111</code>
| Bit4
| [[#EnableSystemCalls]]
|-
| <code>0bxxxxxxxxx0111111</code>
| Bit6
| [[#MemoryMap]]
|-
| <code>0bxxxxxxxx01111111</code>
| Bit7
| [[#IoMemoryMap]]
|-
| <code>0bxxxxx01111111111</code>
| Bit10
| [8.0.0+] [[#MemoryRegionMap]]
|-
| <code>0bxxxx011111111111</code>
| Bit11
| [[#EnableInterrupts]]
|-
| <code>0bxx01111111111111</code>
| Bit13
| [[#MiscParams]]
|-
| <code>0bx011111111111111</code>
| Bit14
| [[#KernelVersion]]
|-
| <code>0b0111111111111111</code>
| Bit15
| [[#HandleTableSize]]
|-
| <code>0b1111111111111111</code>
| Bit16
| [[#MiscFlags]]
|-
| All ones
|
| Invalid
|}

These descriptors are identified by pattern 01..11 in low bits.

== ThreadInfo ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 4-9
| HighestPriority
|-
| 10-15
| LowestPriority
|-
| 16-23
| MinCoreNumber
|-
| 24-31
| MaxCoreNumber
|}

== EnableSystemCalls ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 5-28
| SystemCallId
|-
| 29-31
| Index
|}

== MemoryMap ==
MemoryMap entries are stored in pairs. The first pair will contain BeginAddress and PermissionType, while the second pair will contain Size and MappingType.
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 7-30
| BeginAddress
|-
| 31
| PermissionType (0=RW, 1=RO)
|}

{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 7-26
| Size
|-
| 27-30
| Reserved
|-
| 31
| MappingType (0=Io, 1=Static)
|}

=== Restrictions ===
The physaddr range 0x80060000-0x2000000000 is not allowed to be mapped as IO.
The physaddr range 0x80000000-0x2000000000 is not allowed to be mapped as Normal.

[2.0.0-4.1.0] The range for IO was changed into 0x80060000-0x81D3FFFF.

[2.0.0-4.1.0] A blacklist was added for IO and Normal mappings:
* 0x50040000-0x50060000 (ARM, Interrupt Controller)
* 0x6000F000 (Exception Vectors)
* 0x6001DC00-0x6001E000 (IPATCH)
* 0x7000E000 (RTC/PMC)
* 0x70019000 (MC)
* 0x7001C000 (MC0)
* 0x7001D000 (MC1)

[5.0.0+] For IO, this blacklist was abandoned and instead two range checks were added. For Normal mappings it is still applied

== IoMemoryMap ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 8-31
| BeginAddress
|}

== MemoryRegionMap ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 11-16
| RegionType0 (0 = NoMapping, 1 = KernelTraceBuffer, 2 = OnMemoryBootImage, 3 = DTB)
|-
| 17
| RegionIsReadOnly0
|-
| 18-23
| RegionType1 (0 = NoMapping, 1 = KernelTraceBuffer, 2 = OnMemoryBootImage, 3 = DTB)
|-
| 24
| RegionIsReadOnly1
|-
| 25-30
| RegionType2 (0 = NoMapping, 1 = KernelTraceBuffer, 2 = OnMemoryBootImage, 3 = DTB)
|-
| 31
| RegionIsReadOnly2
|}

MemoryRegionMap is supported by the kernel but not by [[Loader_services|Loader]]. Thus, only initial processes may possess this capability.

== EnableInterrupts ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 12-21
| InterruptNumber0
|-
| 22-31
| InterruptNumber1
|}

0x3FF means empty.

== MiscParams ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 14-16
| ProgramType (0 = System, 1 = Application, 2 = Applet)
|}

ProgramType is parsed by [[Process Manager services]]. Defaults to 0 if descriptor doesn't exist. Can only run 1 application at a time.

== KernelVersion ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 15-18
| MinorVersion
|-
| 19-31
| MajorVersion
|}

This encodes the intended kernel version for the program.

The kernel requires that the intended version is >= the minimum supported version (3.0 for all released kernels), and <= the current version.

Kernel version is derived from/equivalent to SDK version:
* Kernel Major = SDK Major + 4
* Kernel Minor = SDK Minor

=== Versions ===
{| class="wikitable" border="1"
|-
! Firmware || Kernel Version || Corresponding SDK Version
|-
| 1.0.0 || 5.0 || 1.0.0.0
|-
| 2.0.0 || 6.1 || 2.1.0.0
|-
| 3.0.0 || 7.4 || 3.4.0.0
|-
| 3.0.2 || 7.4 || 3.4.0.0
|-
| 5.0.0 || 9.3 || 5.3.0.0
|}

== HandleTableSize ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 16-25
| HandleTableSize
|}

== MiscFlags ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 17
| EnableDebug
|-
| 18
| ForceDebug
|}

SVC

2020-01-19T06:02:22Z

PixelyIon: "Id" -> "ID"

__NOTOC__

= System calls =
{| class=wikitable
! ID || Return Type || Name || Arguments
|-
| 0x01 || Result || [[#SetHeapSize|SetHeapSize]] || uintptr_t *out_address, size_t size
|-
| 0x02 || Result || [[#SetMemoryPermission|SetMemoryPermission]] || uintptr_t address, size_t size, MemoryPermission perm
|-
| 0x03 || Result || [[#SetMemoryAttribute|SetMemoryAttribute]] || uintptr_t address, size_t size, uint32_t mask, uint32_t attr
|-
| 0x04 || Result || [[#MapMemory|MapMemory]] || uintptr_t dst_address, uintptr_t src_address, size_t size
|-
| 0x05 || Result || [[#UnmapMemory|UnmapMemory]] || uintptr_t dst_address, uintptr_t src_address, size_t size
|-
| 0x06 || Result || [[#QueryMemory|QueryMemory]] || arch::MemoryInfo *out_memory_info, PageInfo *out_page_info, uintptr_t address
|-
| 0x07 || void || [[#ExitProcess|ExitProcess]] ||
|-
| 0x08 || Result || [[#CreateThread|CreateThread]] || Handle *out_handle, ThreadFunc func, uintptr_t arg, uintptr_t stack_bottom, int32_t priority, int32_t core_id
|-
| 0x09 || Result || [[#StartThread|StartThread]] || Handle thread_handle
|-
| 0x0A || void || [[#ExitThread|ExitThread]] ||
|-
| 0x0B || void || [[#SleepThread|SleepThread]] || int64_t ns
|-
| 0x0C || Result || [[#GetThreadPriority|GetThreadPriority]] || int32_t *out_priority, Handle thread_handle
|-
| 0x0D || Result || [[#SetThreadPriority|SetThreadPriority]] || Handle thread_handle, int32_t priority
|-
| 0x0E || Result || [[#GetThreadCoreMask|GetThreadCoreMask]] || int32_t *out_core_id, uint64_t *out_affinity_mask, Handle thread_handle
|-
| 0x0F || Result || [[#SetThreadCoreMask|SetThreadCoreMask]] || Handle thread_handle, int32_t core_id, uint64_t affinity_mask
|-
| 0x10 || int32_t || [[#GetCurrentProcessorNumber|GetCurrentProcessorNumber]] ||
|-
| 0x11 || Result || [[#SignalEvent|SignalEvent]] || Handle event_handle
|-
| 0x12 || Result || [[#ClearEvent|ClearEvent]] || Handle event_handle
|-
| 0x13 || Result || [[#MapSharedMemory|MapSharedMemory]] || Handle shmem_handle, uintptr_t address, size_t size, MemoryPermission map_perm
|-
| 0x14 || Result || [[#UnmapSharedMemory|UnmapSharedMemory]] || Handle shmem_handle, uintptr_t address, size_t size
|-
| 0x15 || Result || [[#CreateTransferMemory|CreateTransferMemory]] || Handle *out_handle, uintptr_t address, size_t size, MemoryPermission map_perm
|-
| 0x16 || Result || [[#CloseHandle|CloseHandle]] || Handle handle
|-
| 0x17 || Result || [[#ResetSignal|ResetSignal]] || Handle handle
|-
| 0x18 || Result || [[#WaitSynchronization|WaitSynchronization]] || int32_t *out_index, const Handle *handles, int32_t numHandles, int64_t timeout_ns
|-
| 0x19 || Result || [[#CancelSynchronization|CancelSynchronization]] || Handle handle
|-
| 0x1A || Result || [[#ArbitrateLock|ArbitrateLock]] || Handle thread_handle, uintptr_t address, uint32_t tag
|-
| 0x1B || Result || [[#ArbitrateUnlock|ArbitrateUnlock]] || uintptr_t address
|-
| 0x1C || Result || [[#WaitProcessWideKeyAtomic|WaitProcessWideKeyAtomic]] || uintptr_t address, uintptr_t cv_key, uint32_t tag, int64_t timeout_ns
|-
| 0x1D || void || [[#SignalProcessWideKey|SignalProcessWideKey]] || uintptr_t cv_key, int32_t count
|-
| 0x1E || int64_t || [[#GetSystemTick|GetSystemTick]] ||
|-
| 0x1F || Result || [[#ConnectToNamedPort|ConnectToNamedPort]] || Handle *out_handle, const char *name
|-
| 0x20 || Result || [[#SendSyncRequestLight|SendSyncRequestLight]] || Handle session_handle
|-
| 0x21 || Result || [[#SendSyncRequest|SendSyncRequest]] || Handle session_handle
|-
| 0x22 || Result || [[#SendSyncRequestWithUserBuffer|SendSyncRequestWithUserBuffer]] || uintptr_t message_buffer, size_t message_buffer_size, Handle session_handle
|-
| 0x23 || Result || [[#SendAsyncRequestWithUserBuffer|SendAsyncRequestWithUserBuffer]] || Handle *out_event_handle, uintptr_t message_buffer, size_t message_buffer_size, Handle session_handle
|-
| 0x24 || Result || [[#GetProcessId|GetProcessId]] || uint64_t *out_process_id, Handle process_handle
|-
| 0x25 || Result || [[#GetThreadId|GetThreadId]] || uint64_t *out_thread_id, Handle thread_handle
|-
| 0x26 || void || [[#Break|Break]] || BreakReason break_reason, uintptr_t arg, size_t size
|-
| 0x27 || Result || [[#OutputDebugString|OutputDebugString]] || const char *debug_str, size_t len
|-
| 0x28 || void || [[#ReturnFromException|ReturnFromException]] || Result result
|-
| 0x29 || Result || [[#GetInfo|GetInfo]] || uint64_t *out, InfoType info_type, Handle handle, uint64_t info_subtype
|-
| 0x2A || void || [[#FlushEntireDataCache|FlushEntireDataCache]] ||
|-
| 0x2B || Result || [[#FlushDataCache|FlushDataCache]] || uintptr_t address, size_t size
|-
| [3.0.0+] 0x2C || Result || [[#MapPhysicalMemory|MapPhysicalMemory]] || uintptr_t address, size_t size
|-
| [3.0.0+] 0x2D || Result || [[#UnmapPhysicalMemory|UnmapPhysicalMemory]] || uintptr_t address, size_t size
|-
| [5.0.0+] 0x2E || Result || [[#GetDebugFutureThreadInfo|GetDebugFutureThreadInfo]] || arch::LastThreadContext *out_context, uint64_t *thread_id, Handle debug_handle, int64_t ns
|-
| 0x2F || Result || [[#GetLastThreadInfo|GetLastThreadInfo]] || arch::LastThreadContext *out_context, uintptr_t *out_tls_address, uint32_t *out_flags
|-
| 0x30 || Result || [[#GetResourceLimitLimitValue|GetResourceLimitLimitValue]] || int64_t *out_limit_value, Handle resource_limit_handle, LimitableResource which
|-
| 0x31 || Result || [[#GetResourceLimitCurrentValue|GetResourceLimitCurrentValue]] || int64_t *out_current_value, Handle resource_limit_handle, LimitableResource which
|-
| 0x32 || Result || [[#SetThreadActivity|SetThreadActivity]] || Handle thread_handle, ThreadActivity thread_activity
|-
| 0x33 || Result || [[#GetThreadContext3|GetThreadContext3]] || ThreadContext *out_context, Handle thread_handle
|-
| [4.0.0+] 0x34 || Result || [[#WaitForAddress|WaitForAddress]] || uintptr_t address, ArbitrationType arb_type, int32_t value, int64_t timeout_ns
|-
| [4.0.0+] 0x35 || Result || [[#SignalToAddress|SignalToAddress]] || uintptr_t address, SignalType signal_type, int32_t value, int32_t count
|-
| [8.0.0+] 0x36 || void || [[#SynchronizePreemptionState|SynchronizePreemptionState]] ||
|- style="border-top: double"
| [1.0.0-3.0.2] 0x3C || void || [[#DumpInfo|DumpInfo]] || DumpInfoType dump_info_type, uint64_t arg
|-
| [4.0.0+] 0x3C || void || [[#KernelDebug|KernelDebug]] || KernelDebugType kern_debug_type, uint64_t arg0, uint64_t arg1, uint64_t arg2
|-
| [4.0.0+] 0x3D || void || [[#ChangeKernelTraceState|ChangeKernelTraceState]] || KernelTraceState kern_trace_state
|- style="border-top: double"
| 0x40 || Result || [[#CreateSession|CreateSession]] || Handle *out_server_session_handle, Handle *out_client_session_handle, bool is_light, uintptr_t name
|-
| 0x41 || Result || [[#AcceptSession|AcceptSession]] || Handle *out_handle, Handle port
|-
| 0x42 || Result || [[#ReplyAndReceiveLight|ReplyAndReceiveLight]] || Handle handle
|-
| 0x43 || Result || [[#ReplyAndReceive|ReplyAndReceive]] || int32_t *out_index, const Handle *handles, int32_t num_handles, Handle reply_target, int64_t timeout_ns
|-
| 0x44 || Result || [[#ReplyAndReceiveWithUserBuffer|ReplyAndReceiveWithUserBuffer]] || int32_t *out_index, uintptr_t message_buffer, size_t message_buffer_size, const Handle *handles, int32_t num_handles, Handle reply_target, int64_t timeout_ns
|-
| 0x45 || Result || [[#CreateEvent|CreateEvent]] || Handle *out_write_handle, Handle *out_read_handle
|- style="border-top: double"
| [5.0.0+] 0x48 || Result || [[#MapPhysicalMemoryUnsafe|MapPhysicalMemoryUnsafe]] || uintptr_t address, size_t size
|-
| [5.0.0+] 0x49 || Result || [[#UnmapPhysicalMemoryUnsafe|UnmapPhysicalMemoryUnsafe]] || uintptr_t address, size_t size
|-
| [5.0.0+] 0x4A || Result || [[#SetUnsafeLimit|SetUnsafeLimit]] || size_t limit
|-
| [4.0.0+] 0x4B || Result || [[#CreateCodeMemory|CreateCodeMemory]] || Handle *out_handle, uintptr_t address, size_t size
|-
| [4.0.0+] 0x4C || Result || [[#ControlCodeMemory|ControlCodeMemory]] || Handle code_memory_handle, CodeMemoryOperation operation, uint64_t address, uint64_t size, MemoryPermission perm
|-
| 0x4D || void || [[#SleepSystem|SleepSystem]] ||
|-
| 0x4E || Result || [[#ReadWriteRegister|ReadWriteRegister]] || uint32_t *out_value, PhysicalAddress address, uint32_t mask, uint32_t value
|-
| 0x4F || Result || [[#SetProcessActivity|SetProcessActivity]] || Handle process_handle, ProcessActivity process_activity
|-
| 0x50 || Result || [[#CreateSharedMemory|CreateSharedMemory]] || Handle *out_handle, size_t size, MemoryPermission owner_perm, MemoryPermission remote_perm
|-
| 0x51 || Result || [[#MapTransferMemory|MapTransferMemory]] || Handle trmem_handle, uintptr_t address, size_t size, MemoryPermission owner_perm
|-
| 0x52 || Result || [[#UnmapTransferMemory|UnmapTransferMemory]] || Handle trmem_handle, uintptr_t address, size_t size
|-
| 0x53 || Result || [[#CreateInterruptEvent|CreateInterruptEvent]] || Handle *out_read_handle, int32_t interrupt_id, InterruptType interrupt_type
|-
| 0x54 || Result || [[#QueryPhysicalAddress|QueryPhysicalAddress]] || arch::PhysicalMemoryInfo *out_info, uintptr_t address
|-
| 0x55 || Result || [[#QueryIoMapping|QueryIoMapping]] || uintptr_t *out_address, PhysicalAddress physical_address, size_t size
|-
| 0x56 || Result || [[#CreateDeviceAddressSpace|CreateDeviceAddressSpace]] || Handle *out_handle, uint64_t das_address, uint64_t das_size
|-
| 0x57 || Result || [[#AttachDeviceAddressSpace|AttachDeviceAddressSpace]] || DeviceName device_name, Handle das_handle
|-
| 0x58 || Result || [[#DetachDeviceAddressSpace|DetachDeviceAddressSpace]] || DeviceName device_name, Handle das_handle
|-
| 0x59 || Result || [[#MapDeviceAddressSpaceByForce|MapDeviceAddressSpaceByForce]] || Handle das_handle, Handle process_handle, uint64_t process_address, size_t size, uint64_t device_address, MemoryPermission device_perm
|-
| 0x5A || Result || [[#MapDeviceAddressSpaceAligned|MapDeviceAddressSpaceAligned]] || Handle das_handle, Handle process_handle, uint64_t process_address, size_t size, uint64_t device_address, MemoryPermission device_perm
|-
| 0x5B || Result || [[#MapDeviceAddressSpace|MapDeviceAddressSpace]] || size_t *out_mapped_size, Handle das_handle, Handle process_handle, uint64_t process_address, size_t size, uint64_t device_address, MemoryPermission device_perm
|-
| 0x5C || Result || [[#UnmapDeviceAddressSpace|UnmapDeviceAddressSpace]] || Handle das_handle, Handle process_handle, uint64_t process_address, size_t size, uint64_t device_address
|-
| 0x5D || Result || [[#InvalidateProcessDataCache|InvalidateProcessDataCache]] || Handle process_handle, uint64_t address, uint64_t size
|-
| 0x5E || Result || [[#StoreProcessDataCache|StoreProcessDataCache]] || Handle process_handle, uint64_t address, uint64_t size
|-
| 0x5F || Result || [[#FlushProcessDataCache|FlushProcessDataCache]] || Handle process_handle, uint64_t address, uint64_t size
|-
| 0x60 || Result || [[#DebugActiveProcess|DebugActiveProcess]] || Handle *out_handle, uint64_t process_id
|-
| 0x61 || Result || [[#BreakDebugProcess|BreakDebugProcess]] || Handle debug_handle
|-
| 0x62 || Result || [[#TerminateDebugProcess|TerminateDebugProcess]] || Handle debug_handle
|-
| 0x63 || Result || [[#GetDebugEvent|GetDebugEvent]] || arch::DebugEventInfo *out_info, Handle debug_handle
|-
| 0x64 || Result || [[#ContinueDebugEvent|ContinueDebugEvent]] || Handle debug_handle, uint32_t flags, const uint64_t *thread_ids, int32_t num_thread_ids
|-
| 0x65 || Result || [[#GetProcessList|GetProcessList]] || int32_t *out_num_processes, uint64_t *out_process_ids, int32_t max_out_count
|-
| 0x66 || Result || [[#GetThreadList|GetThreadList]] || int32_t *out_num_threads, uint64_t *out_thread_ids, int32_t max_out_count, Handle debug_handle
|-
| 0x67 || Result || [[#GetDebugThreadContext|GetDebugThreadContext]] || ThreadContext *out_context, Handle debug_handle, uint64_t thread_id, uint32_t context_flags
|-
| 0x68 || Result || [[#SetDebugThreadContext|SetDebugThreadContext]] || Handle debug_handle, uint64_t thread_id, const ThreadContext *context, uint32_t context_flags
|-
| 0x69 || Result || [[#QueryDebugProcessMemory|QueryDebugProcessMemory]] || arch::MemoryInfo *out_memory_info, PageInfo *out_page_info, Handle process_handle, uintptr_t address
|-
| 0x6A || Result || [[#ReadDebugProcessMemory|ReadDebugProcessMemory]] || uintptr_t buffer, Handle debug_handle, uintptr_t address, size_t size
|-
| 0x6B || Result || [[#WriteDebugProcessMemory|WriteDebugProcessMemory]] || Handle debug_handle, uintptr_t buffer, uintptr_t address, size_t size
|-
| 0x6C || Result || [[#SetHardwareBreakPoint|SetHardwareBreakPoint]] || HardwareBreakPointRegisterName name, uint64_t flags, uint64_t value
|-
| 0x6D || Result || [[#GetDebugThreadParam|GetDebugThreadParam]] || uint64_t *out_64, uint32_t *out_32, Handle debug_handle, uint64_t thread_id, DebugThreadParam param
|- style="border-top: double"
| [5.0.0+] 0x6F || Result || [[#GetSystemInfo|GetSystemInfo]] || uint64_t *out, SystemInfoType info_type, Handle handle, uint64_t info_subtype
|-
| 0x70 || Result || [[#CreatePort|CreatePort]] || Handle *out_server_handle, Handle *out_client_handle, int32_t max_sessions, bool is_light, uintptr_t name
|-
| 0x71 || Result || [[#ManageNamedPort|ManageNamedPort]] || Handle *out_server_handle, const char *name, int32_t max_sessions
|-
| 0x72 || Result || [[#ConnectToPort|ConnectToPort]] || Handle *out_handle, Handle port
|-
| 0x73 || Result || [[#SetProcessMemoryPermission|SetProcessMemoryPermission]] || Handle process_handle, uint64_t address, uint64_t size, MemoryPermission perm
|-
| 0x74 || Result || [[#MapProcessMemory|MapProcessMemory]] || uintptr_t dst_address, Handle process_handle, uint64_t src_address, size_t size
|-
| 0x75 || Result || [[#UnmapProcessMemory|UnmapProcessMemory]] || uintptr_t dst_address, Handle process_handle, uint64_t src_address, size_t size
|-
| 0x76 || Result || [[#QueryProcessMemory|QueryProcessMemory]] || arch::MemoryInfo *out_memory_info, PageInfo *out_page_info, Handle process_handle, uint64_t address
|-
| 0x77 || Result || [[#MapProcessCodeMemory|MapProcessCodeMemory]] || Handle process_handle, uint64_t dst_address, uint64_t src_address, uint64_t size
|-
| 0x78 || Result || [[#UnmapProcessCodeMemory|UnmapProcessCodeMemory]] || Handle process_handle, uint64_t dst_address, uint64_t src_address, uint64_t size
|-
| 0x79 || Result || [[#CreateProcess|CreateProcess]] || Handle *out_handle, const arch::CreateProcessParameter *parameters, const uint32_t *caps, int32_t num_caps
|-
| 0x7A || Result || [[#StartProcess|StartProcess]] || Handle process_handle, int32_t priority, int32_t core_id, uint64_t main_thread_stack_size
|-
| 0x7B || Result || [[#TerminateProcess|TerminateProcess]] || Handle process_handle
|-
| 0x7C || Result || [[#GetProcessInfo|GetProcessInfo]] || int64_t *out_info, Handle process_handle, ProcessInfoType info_type
|-
| 0x7D || Result || [[#CreateResourceLimit|CreateResourceLimit]] || Handle *out_handle
|-
| 0x7E || Result || [[#SetResourceLimitLimitValue|SetResourceLimitLimitValue]] || Handle resource_limit_handle, LimitableResource which, int64_t limit_value
|-
| 0x7F || void || [[#CallSecureMonitor|CallSecureMonitor]] || SecureMonitorArguments *args
|-
|}

== SetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || uint32_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) X1 || void* || HeapAddress
|}
</div>

Sets the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to HeapAddress.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===
'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== SetMemoryPermission ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (In) W2 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Changes permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

=== Result codes ===
'''0x0:''' Success. The memory region was reprotected.

'''0xCC01:''' Unaligned address specified.

'''0xCA01:''' Unaligned or zero size specified.

'''0xD401:''' The provided memory region does not fall within the userland address space.

'''0xD801:''' Invalid permission specified. Valid permissions are ---, r-- and rw-.

'''0xD401:''' The provided memory region was in an invalid state. The region must have the PermissionChangeAllowed bit set in its [[#MemoryState]], and must not have the IsBorrowed or IsUncached [[#MemoryAttribute]].

'''0xCE01:''' Kernel resource exhausted.

== SetMemoryAttribute ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (In) W2 || uint32_t || Mask
|-
| (In) W3 || uint32_t || Value
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Changes attribute of page-aligned memory region. The only allowed combination of Value and Mask is 0x8, which means only bit3 in [[#MemoryAttribute]] can be set or cleared.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

== MapMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddress
|-
| (In) X1 || void* || SrcAddress
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#GetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#GetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== UnmapMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddress
|-
| (In) X1 || void* || SrcAddress
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Unmaps a region that was previously mapped with [[#MapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== QueryMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemoryInfo
|-
| (In) X2 || void* || Address
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || [[#PageInfo]] || PageInfo
|}
</div>

Queries information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== ExitProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Exits the current process.

== CreateThread ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || int32_t || Priority
|-
| (In) W5 || R4 || int32_t || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || Handle<Thread> || ThreadHandle
|}
</div>

Creates a thread in the current process.

ProcessorId must be 0,1,2,3 or -2, where -2 uses the default CpuId for process.

== StartThread ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || ThreadHandle
|-
| (Out) None || ||
|}
</div>

Starts the thread for the provided handle.

== ExitThread ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Exits the current thread.

== SleepThread ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || uint64_t || Nanoseconds
|}
</div>

Sleeps for a specified amount of time, or yields the thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|}
</div>

== GetThreadPriority ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || ThreadHandle
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || int32_t || Priority
|}
</div>

Gets the priority of provided thread handle.

== SetThreadPriority ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || ThreadHandle
|-
| (In) W1|| int32_t || Priority
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Sets the priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== GetThreadCoreMask ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || ThreadHandle
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || int32_t || CoreMask0
|-
| (Out) X2 || R2, R3 || uint64_t || CoreMask1
|}
</div>

Gets the affinity mask of provided thread handle.

== SetThreadCoreMask ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || ThreadHandle
|-
| (In) W1 || R1 || int32_t || CoreMask0
|-
| (In) X2 || R2, R3 || uint64_t || CoreMask1
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Sets the affinity mask of provided thread handle.

== GetCurrentProcessorNumber ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0 || uint32_t || CpuId
|}
</div>

Gets which cpu is executing the current thread.

CpuId is an integer in the range 0-3.

== SignalEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> || EventHandle
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

Puts the given event in the signaled state.

Will wake up any thread currently waiting on this event. Can potentially trigger a reschedule.

Any calls to [[#WaitSynchronization]] on this handle will return immediately, until the event's signaled state is reset.

=== Result codes ===
'''0x0:''' Success. Event is now in signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a WritableEvent.

== ClearEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> or Handle<ReadableEvent> || EventHandle
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

Takes the given event out of the signaled state.

=== Result codes ===
'''0x0:''' Success, the event is now in the not-signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a ReadableEvent nor a WritableEvent.

'''0xFA01:''' The handle was not in a signaled state.

== MapSharedMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || SharedMemoryHandle
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (In) W3 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== UnmapSharedMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || SharedMemoryHandle
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== CreateTransferMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (In) W3 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<TransferMemory> || TransferMemoryHandle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== CloseHandle ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle || Handle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ResetSignal ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<ReadableEvent> or Handle<Process> || Handle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Resets the signal on the given handle, ensuring future calls to [[#WaitSynchronization]] on this handle will sleep until the handle is signaled again. If the handle is a ReadableEvent, this is equivalent to calling ClearEvent() on the handle.

If the handle is a Process, it will clear the signaled state (which is set when the process changes [[#ProcessState]]. Once the process enters the Exited state, calling ResetSignal on the process will no longer have an effect (the process is permanently signaled), and the syscall will return 0xFA01.

=== Result codes ===
'''0x0:''' Success. The signal was reset.

'''0xE401:''' The handle is invalid or of the wrong type.

'''0xFA01:''' The handle was not signaled, or the process is in exited state, causing it to be permanently signaled.

== WaitSynchronization ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || int32_t || HandlesNum
|-
| (In) X3 || R0, R3 || int64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint64_t || HandleIndex
|}
</div>

Works with HandlesNum <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===
'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#GetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#GetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via [[#SignalEvent]].

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#AcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#ReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===
'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#CancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== CancelSynchronization ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || ThreadHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

If the referenced thread is currently in a synchronization call ([[#WaitSynchronization]], [[#ReplyAndReceive]] or [[#ReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===
'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== ArbitrateLock ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || ThreadHandle
|-
| (In) X1 || void* || Address
|-
| (In) W2 || uint32_t || Tag
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ArbitrateUnlock ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== WaitProcessWideKeyAtomic ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || KeyAddress
|-
| (In) X1 || R1 || void* || TagAddress
|-
| (In) W2 || R2 || uint32_t || Tag
|-
| (In) X3 || R3, R4 || int64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== SignalProcessWideKey ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) W1 || int32_t || Value
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetSystemTick ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || uint64_t || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== ConnectToNamedPort ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || char* || PortName
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<Session> || SessionHandle
|}
</div>

== SendSyncRequestLight ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Session> || SessionHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SendSyncRequest ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Session> || SessionHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SendSyncRequestWithUserBuffer ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (In) W2 || Handle<Session> || SessionHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Size and Address must be 0x1000-aligned.

=== Result codes ===
'''0x0:''' Success.

'''0xcc01:''' Address is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== SendAsyncRequestWithUserBuffer ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (In) W3 || Handle<Session> || SessionHandle
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ReadableEvent> || EventHandle
|}
</div>

Size and Address must be 0x1000-aligned.

== GetProcessId ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || ProcessId
|}
</div>

== GetThreadId ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<Thread> || ThreadHandle
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || ThreadId
|}
</div>

== Break ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#BreakReason]] || BreakReason
|-
| (In) X1 || uint64_t ||
|-
| (In) X2 || uint64_t || Info
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

If the process is attached, report the Break event. Then, if [[#ContinueDebugEvent]] didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== OutputDebugString ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || char* || String
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ReturnFromException ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#Result]] || Result
|}
</div>

== GetInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || [[#InfoType]] || InfoType
|-
| (In) W2 || R2 || Handle || Handle
|-
| (In) X3 || R0, R3 || uint64_t || InfoSubType
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || Info
|}
</div>

== FlushEntireDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

== FlushDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== MapPhysicalMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Acts like [[#SetHeapSize]] except you can allocate heap at any address you'd like.

Uses current process pool partition.

== UnmapPhysicalMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetDebugFutureThreadInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X3 || R0, R1 || uint64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || uint64_t || LastThreadContextParam0
|-
| (Out) X2 || uint64_t || LastThreadContextParam1
|-
| (Out) X3 || uint64_t || LastThreadContextParam2
|-
| (Out) X4 || uint64_t || LastThreadContextParam3
|-
| (Out) X5 || uint64_t ||
|-
| (Out) W6 || uint32_t ||
|}
</div>

== GetLastThreadInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) X1 || uint64_t || LastThreadContextParam0
|-
| (Out) X2 || uint64_t || LastThreadContextParam1
|-
| (Out) X3 || uint64_t || LastThreadContextParam2
|-
| (Out) X4 || uint64_t || LastThreadContextParam3
|-
| (Out) X5 || uint64_t ||
|-
| (Out) W6 || uint32_t ||
|}
</div>

== GetResourceLimitLimitValue ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<ResourceLimit> || ResourceLimitHandle
|-
| (In) W2 || R2 || [[#LimitableResource]] || LimitableResource
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || int64_t || LimitValue
|}
</div>

== GetResourceLimitCurrentValue ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<ResourceLimit> || ResourceLimitHandle
|-
| (In) W2 || R2 || [[#LimitableResource]] || LimitableResource
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || int64_t || CurrentValue
|}
</div>

== SetThreadActivity ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || ThreadHandle
|-
| (In) W1 || [[#ThreadActivity]] || ThreadActivity
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetThreadContext3 ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#ThreadContext]]* || ThreadContext
|-
| (In) W1 || Handle<Thread> || ThreadHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== WaitForAddress ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || Address
|-
| (In) W1 || R1 || [[#ArbitrationType]] || ArbitrationType
|-
| (In) W2 || R2 || uint32_t || Value
|-
| (In) X3 || R3, R4 || uint64_t || Timeout
|-
| (Out) None || || ||
|}
</div>

== SignalToAddress ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || Address
|-
| (In) W1 || R1 || [[#SignalType]] || SignalType
|-
| (In) W2 || R2 || uint32_t || Value
|-
| (In) W3 || R3 || uint32_t || NumToSignal
|-
| (Out) None || || ||
|}
</div>

== SynchronizePreemptionState ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

== DumpInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#DumpInfoType]] || DumpInfoType
|-
| (In) X1 || uint64_t || DumpInfoSubType
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Stubbed in retail kernel.

[4.0.0+] This function was removed and replaced by [[#KernelDebug]].

== KernelDebug ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#KernelDebugType]] || KernelDebugType
|-
| (In) X1 || uint64_t ||
|-
| (In) X2 || uint64_t ||
|-
| (In) X3 || uint64_t ||
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Stubbed in retail kernel.

== ChangeKernelTraceState ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#KernelTraceState]] || KernelTraceState
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Stubbed in retail kernel.

== CreateSession ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W2 || bool || IsLight
|-
| (In) X3 || uint64_t || Name
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || ServerSessionHandle
|-
| (Out) W2 || Handle<ClientSession> || ClientSessionHandle
|}
</div>

== AcceptSession ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || PortHandle
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || ServerSessionHandle
|}
</div>

=== Result codes ===
'''0xf201:''' No session waiting to be accepted

== ReplyAndReceiveLight ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Port> or Handle<ServerSession> || Handle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ReplyAndReceive ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<Port>* or Handle<ServerSession>* || Handles
|-
| (In) W2 || R2 || uint32_t || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTargetSessionHandle
|-
| (In) X4 || R0, R4 || uint64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || HandleIndex
|}
</div>

If ReplyTargetSessionHandle is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTargetSessionHandle is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTargetSessionHandle is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===
'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== ReplyAndReceiveWithUserBuffer ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void* || Address
|-
| (In) X2 || R2 || uint64_t || Size
|-
| (In) X3 || R3 || Handle<Port>* or Handle<ServerSession>* || Handles
|-
| (In) W4 || R0 || uint32_t || NumHandles
|-
| (In) W5 || R4 || Handle<ServerSession> || ReplyTargetSessionHandle
|-
| (In) X6 || R5, R6 || uint64_t || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || HandleIndex
|}
</div>

== CreateEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<WritableEvent> || WritableEventHandle
|-
| (Out) W2 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

== MapPhysicalMemoryUnsafe ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Same as [[#MapPhysicalMemory]] except it always uses pool partition 0.

== UnmapPhysicalMemoryUnsafe ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Address
|-
| (In) X1 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SetUnsafeLimit ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || uint64_t || Limit
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== CreateCodeMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<CodeMemory> || CodeMemoryHandle
|}
</div>

Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== ControlCodeMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<CodeMemory> || CodeMemoryHandle
|-
| (In) W1 || R1 || [[#CodeMemoryOperation]] || CodeMemoryOperation
|-
| (In) X2 || R2, R3 || void* || Address
|-
| (In) X3 || R4, R5 || uint64_t || Size
|-
| (In) W4 || R6 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maps the backing memory for a CodeMemory object into the current process.

For [[#CodeMemoryOperation|MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|UnmapOwner/UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== SleepSystem ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

== ReadWriteRegister ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || uint64_t || RegisterAddress
|-
| (In) W2 || R0 || uint32_t || RwMask
|-
| (In) W3 || R1 || uint32_t || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC#ReadWriteRegister|ReadWriteRegister]].

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by the SMC [[SMC#ReadWriteRegister|ReadWriteRegister]] (checked in addition to the whitelist in the ReadWriteRegister SVC), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== SetProcessActivity ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) W1 || [[#ProcessActivity]] || ProcessActivity
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== CreateSharedMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || uint64_t || Size
|-
| (In) W2 || [[#MemoryPermission]] || LocalMemoryPermission
|-
| (In) W3 || [[#MemoryPermission]] || RemoteMemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<SharedMemory> || SharedMemoryHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== MapTransferMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || TransferMemoryHandle
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (In) W3 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in [[#CreateTransferMemory]], otherwise error.

== UnmapTransferMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || TransferMemoryHandle
|-
| (In) X1 || void* || Address
|-
| (In) X2 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== CreateInterruptEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#Interrupt]] || Interrupt
|-
| (In) W2 || [[#InterruptType]] || InterruptType
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Creates an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The InterruptType argument configures the triggering. If it is 0, the IRQ is active HIGH level sensitive, if it is 1 it is rising-edge sensitive.

=== Result codes ===
'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== QueryPhysicalAddress ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || VirtualAddress
|-
| (Out) W0 || [[#Result]]|| Result
|-
| (Out) X1 || uint64_t || PhysicalMemoryInfoAddress
|-
| (Out) X2 || uint64_t || PhysicalMemoryInfoBaseAddress
|-
| (Out) X3 || uint64_t || PhysicalMemoryInfoSize
|}
</div>

Queries the physical address of a virtual address. Will always fetch the lowest page-aligned mapping that contains the provided physical address.

The returned PhysicalMemoryInfoBaseAddress is the virtual address of that page-aligned mapping, while PhysicalMemoryInfoAddress is the physical address of that page. PhysicalMemoryInfoSize is the amount of continuous physical memory in that mapping.

== QueryIoMapping ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || uint64_t || IoAddress
|-
| (In) X2 || R0 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1 || void* || VirtualAddress
|}
</div>

Returns a virtual address mapped to a given IO range.

== CreateDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || uint64_t || DeviceAddressSpaceStartAddress
|-
| (In) X2 || R0, R1 || uint64_t || DeviceAddressSpaceEndAddress
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|}
</div>

Creates a virtual address space for binding device address spaces and returns a handle.

StartAddr is normally set to 0 and EndAddr is normally set to 0xFFFFFFFF.

== AttachDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceName
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Attaches a device address space to a [[#DeviceName|device]].

== DetachDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceName
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

Detaches a device address space from a [[#DeviceName|device]].

== MapDeviceAddressSpaceByForce ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || Address
|-
| (In) X3 || R4 || uint64_t || DeviceAddressSpaceSize
|-
| (In) X4 || R5, R6 || uint64_t || DeviceAddressSpaceAddress
|-
| (In) W5 || R7 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maps an attached device address space to an userspace address.

Address is the userspace destination address, while DeviceAddressSpaceAddress is the source address between DeviceAddressSpaceStartAddress and DeviceAddressSpaceEndAddress (passed to [[#CreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== MapDeviceAddressSpaceAligned ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || Address
|-
| (In) X3 || R4 || uint64_t || DeviceAddressSpaceSize
|-
| (In) X4 || R5, R6 || uint64_t || DeviceAddressSpaceAddress
|-
| (In) W5 || R7 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maps an attached device address space to an userspace address.

Same as [[#MapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== MapDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R0, R3 || void* || Address
|-
| (In) X4 || R4 || uint64_t || DeviceAddressSpaceSize
|-
| (In) X5 || R5, R6 || uint64_t || DeviceAddressSpaceAddress
|-
| (In) W6 || R7 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1 || uint64_t || Size
|}
</div>

== UnmapDeviceAddressSpace ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAddressSpaceHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || Address
|-
| (In) X3 || R4 || uint64_t || DeviceAddressSpaceSize
|-
| (In) X4 || R5, R6 || uint64_t || DeviceAddressSpaceAddress
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Unmaps an attached device address space from an userspace address.

== InvalidateProcessDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || Address
|-
| (In) X2 || R1, R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== StoreProcessDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || Address
|-
| (In) X2 || R1, R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== FlushProcessDataCache ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || Address
|-
| (In) X2 || R1, R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== DebugActiveProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || uint64_t || ProcessId
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || Handle<Debug> || DebugHandle
|}
</div>

== BreakDebugProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Debug> || DebugHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== TerminateDebugProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Debug> || DebugHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetDebugEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#DebugEventInfo]]* || DebugEventInfo
|-
| (In) W1 || Handle<Debug> || DebugHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== ContinueDebugEvent ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Debug> || DebugHandle
|-
| (In) W1 || R1 || uint32_t || [[#ContinueDebugFlags]] ([1.0.0-2.3.0] [[#ContinueDebugFlagsOld]])
|-
| (In) X2 || R2 ([1.0.0-2.3.0] R2, R3) || uint64_t* ([1.0.0-2.3.0] uint64_t)|| ThreadIdList ([1.0.0-2.3.0] ThreadId)
|-
| (In) X3 || R3 || uint64_t || [3.0.0+] NumThreadIds
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maximum NumThreadIds is 64. 0 means "all threads".

=== Result codes ===
'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== GetProcessList ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || uint64_t* || ProcessIdBuffer
|-
| (In) W2 || R2 || uint32_t || ProcessIdBufferSize
|-
| (Out) X0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || NumProcesses
|}
</div>

Fills the provided array with the pids of currently living processes. A process "lives" so long as it is currently running or a handle to it still exists.

It returns the total number of processes currently alive. If this number is bigger than the size of ProcessIdBuffer, the user won't have all the pids.

=== Result codes ===
'''0x0:''' Success.

'''0xd401:''' The provided buffer is outside the process address space.

'''0xe601:''' copyToUser failed. The provided buffer is not user-accessible.

'''0xee01:''' The provided buffer size is too big. Max value is 0xFFFFFFF.

== GetThreadList ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || uint64_t* || ThreadIdBuffer
|-
| (In) W2 || R2 || uint32_t || ThreadIdBufferSize
|-
| (In) W3 || R3 || Handle<Debug> || DebugHandle
|-
| (Out) X0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || uint32_t || NumThreads
|}
</div>

== GetDebugThreadContext ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#ThreadContext]]* || ThreadContext
|-
| (In) X1 || R1 || Handle<Debug> || DebugHandle
|-
| (In) X2 || R2, R3 || uint64_t || ThreadId
|-
| (In) W3 || R4 || uint32_t || [[#ThreadContextFlags]]
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== SetDebugThreadContext ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Debug> || DebugHandle
|-
| (In) X1 || R2, R3 || uint64_t || ThreadId
|-
| (In) X2 || R1 || [[#ThreadContext]]* || ThreadContext
|-
| (In) W3 || R4 || uint32_t || [[#ThreadContextFlags]]
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== QueryDebugProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemoryInfo
|-
| (In) W2 || Handle<Debug> || DebugHandle
|-
| (In) X3 || void* || Address
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || [[#PageInfo]] || PageInfo
|}
</div>

== ReadDebugProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || MemoryBufferAddress
|-
| (In) W1 || Handle<Debug> || DebugHandle
|-
| (In) X2 || void* || SrcAddress
|-
| (In) X3 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== WriteDebugProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Debug> || DebugHandle
|-
| (In) X1 || void* || MemoryBufferAddress
|-
| (In) X2 || void* || DstAddress
|-
| (In) X3 || uint64_t || Size
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== SetHardwareBreakPoint ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || [[#HardwareBreakPointRegisterName]] || Name
|-
| (In) X1 || R2, R3 || uint64_t || Flags
|-
| (In) X2 || R1, R4 || uint64_t || Value
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of HardwareBreakPointRegisterName:

If HardwareBreakPointRegisterName < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given DebugHandle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If HardwareBreakPointRegisterName is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that HardwareBreakPointRegisterName 0 to 4 match only to Virtual Address, while HardwareBreakPointRegisterName 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

== GetDebugThreadParam ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X2 || R2 || Handle<Debug> || DebugHandle
|-
| (In) X3 || R0, R1 || uint64_t || ThreadId
|-
| (In) W4 || R3 || [[#DebugThreadParam]] || DebugThreadParam
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || Out0
|-
| (Out) W2 || R3 || uint32_t || Out1
|}
</div>

== GetSystemInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#SystemInfoType]] || SystemInfoType
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || uint64_t || SystemInfoSubType
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) X1 || uint64_t || SystemInfo
|}
</div>

== CreatePort ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || int32_t || MaxSessions
|-
| (In) W3 || R3 || bool || IsLight
|-
| (In) X4 || R0 || uint64_t || Name
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || Handle<Port> || ServerPortHandle
|-
| (Out) W2 || R2 || Handle<Port> || ClientPortHandle
|}
</div>

== ManageNamedPort ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || char* || Name
|-
| (In) W2 || int32_t || MaxSessions
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<Port> || ServerPortHandle
|}
</div>

== ConnectToPort ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || ClientPortHandle
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<Session> || SessionHandle
|}
</div>

== SetProcessMemoryPermission ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || Addr
|-
| (In) X2 || R1, R4 || uint64_t || Size
|-
| (In) W3 || R5 || [[#MemoryPermission]] || MemoryPermission
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== MapProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddress
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddress
|-
| (In) X3 || R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== UnmapProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddress
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddress
|-
| (In) X3 || R4 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Unmaps what was mapped by [[#MapProcessMemory]].

== QueryProcessMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemoryInfo
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || void* || Address
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || [[#PageInfo]] || PageInfo
|}
</div>

Equivalent to [[#QueryMemory]] except takes a process handle.

== MapProcessCodeMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || DstAddress
|-
| (In) X2 || R1, R4 || void* || SrcAddress
|-
| (In) X3 || R5, R6 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== UnmapProcessCodeMemory ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || void* || DstAddress
|-
| (In) X2 || R1, R4 || void* || SrcAddress
|-
| (In) X3 || R5, R6 || uint64_t || Size
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

Unmaps what was mapped by [[#MapProcessCodeMemory]].

== CreateProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessParameter]]* || CreateProcessParameter
|-
| (In) X2 || uint32_t* || Capabilities
|-
| (In) X3 || int32_t || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessParameter]] as input.
Capabilities points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the Capabilities array (number of element, not number of bytes).

=== Result codes ===
'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== StartProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R1 || int32_t || MainThreadPriority
|-
| (In) W2 || R2 || int32_t || DefaultCpuId
|-
| (In) X3 || R3, R4 || uint64_t || MainThreadStackSize
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== TerminateProcess ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Result
|}
</div>

== GetProcessInfo ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || ProcessInfoType
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) X1 || R1, R2 || uint64_t || [[#ProcessState]]
|}
</div>

Returns an enum with value 0-7.

== CreateResourceLimit ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ResourceLimit> || ResourceLimitHandle
|}
</div>

== SetResourceLimitLimitValue ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<ResourceLimit> || ResourceLimitHandle
|-
| (In) W1 || R1 || [[#LimitableResource]] || LimitableResource
|-
| (In) X2 || R2, R3 || int64_t || LimitValue
|-
| (Out) W0 || R0 || [[#Result]] || Result
|}
</div>

== CallSecureMonitor ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || uint64_t || [[SMC#Secure_Monitor_calls|FunctionId]]
|-
| (In) X1-X7 || R1-R7 || uint64_t || SMC arguments
|-
| (Out) X0 || R0 || [[SMC#Result|Result]] || SMC result
|-
| (Out) X1-X7 || R1-R7 || uint64_t || SMC output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* BreakDebugProcess
* ContinueDebugEvent
* WriteDebugProcessMemory
* SetDebugThreadContext
* TerminateDebugProcess
* SetHardwareBreakPoint

DebugActiveProcess stops execution of the target process, the normal method for resuming it requires ContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

= Enum/Structures =
== InfoType ==
{| class=wikitable
! Handle type || InfoType || InfoSubType || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] ProgramId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Process || 23 || 0 || [9.0.0+] IsApplication
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== SystemInfoType ==
{| class=wikitable
! Handle type || SystemInfoType || SystemInfoSubType|| Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|}

== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || AFI
|-
| 1 || AVPC
|-
| 2 || DC
|-
| 3 || DCB
|-
| 4 || HC
|-
| 5 || HDA
|-
| 6 || ISP2
|-
| 7 || MSENCNVENC
|-
| 8 || NV
|-
| 9 || NV2
|-
| 10 || PPCS
|-
| 11 || SATA
|-
| 12 || VI
|-
| 13 || VIC
|-
| 14 || XUSB_HOST
|-
| 15 || XUSB_DEV
|-
| 16 || TSEC
|-
| 17 || PPCS1
|-
| 18 || DC1
|-
| 19 || SDMMC1A
|-
| 20 || SDMMC2A
|-
| 21 || SDMMC3A
|-
| 22 || SDMMC4A
|-
| 23 || ISP2B
|-
| 24 || GPU
|-
| 25 || GPUB
|-
| 26 || PPCS2
|-
| 27 || NVDEC
|-
| 28 || APE
|-
| 29 || SE
|-
| 30 || NVJPG
|-
| 31 || HC1
|-
| 32 || SE1
|-
| 33 || AXIAP
|-
| 34 || ETR
|-
| 35 || TSECB
|-
| 36 || TSEC1
|-
| 37 || TSECB1
|-
| 38 || NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || MapOwner
|-
| 1 || MapSlave
|-
| 2 || UnmapOwner
|-
| 3 || UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Description
|-
| 0 || PhysicalMemoryMax || Bytes of memory a process may allocate.
|-
| 1 || ThreadCountMax || Amount of threads a process can create.
|-
| 2 || EventCountMax || Amount of events a process can create through [[#CreateEvent]] or [[#SendAsyncRequestWithUserBuffer]].
|-
| 3 || TransferMemoryCountMax || Amount of TransferMemory a process can create through [[#CreateTransferMemory]].
|-
| 4 || SessionCountMax || Amount of session a process can create through [[#CreateSession]], [[#ConnectToPort]] or [[#ConnectToNamedPort]].
|}

= ThreadActivity =
{| class=wikitable
! Value || Name
|-
| 0 || None
|-
| 1 || Runnable
|}

== ProcessActivity ==
{| class=wikitable
! Value || Name
|-
| 0 || None
|-
| 1 || Runnable
|}

== ProcessInfoType ==
{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessState]]
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || Created ||
|-
| 1 || CreatedAttached ||
|-
| 2 || Started ||
|-
| 3 || Crashed || Processes will not enter this state unless they were created with [[#CreateProcessParameter|EnableDebug]].
|-
| 4 || StartedAttached ||
|-
| 5 || Exiting ||
|-
| 6 || Exited ||
|-
| 7 || DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DynamicPriority
|-
| 1 || SchedulingStatus
|-
| 2 || PreferredCpuCore
|-
| 3 || CurrentCpuCore
|-
| 4 || AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended ([[#SetThreadActivity]] 1 or [[#SetProcessActivity]] 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

PreferredCpuCore: output in out2

CurrentCpuCore: output in out2

AffinityMask: output in out1

== CreateProcessParameter ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || Is64BitInstruction
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] MemoryRegion (0 = Application, 1 = Applet, 2 = SecureSystem, 3 = NonSecureSystem)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (only allowed in combination with IsApplication)
|-
| 0x28 || 4 || || ResourceLimitHandle (can be zero)
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one MemoryRegion.

On [2.0.0-4.0.0] MemoryRegion is 1 for built-ins and 0 for rest.

On [5.0.0] MemoryRegion is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || AddressSpace32Bit || 32 ||
|-
| 1 || AddressSpace64BitOld || 36 ||
|-
| 2 || AddressSpace32BitNoReserved || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] AddressSpace64Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || [[#MemoryType]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || [[#MemoryPermission]]
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryPermission ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || Read || Can be set by [[#SetMemoryPermission]].
|-
| 1 || Write || Can be set by [[#SetMemoryPermission]].
|-
| 2 || Execute || Can be set by [[#SetProcessMemoryPermission]] and [[#ControlCodeMemory]].
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || Locked || Used by MapMemory, as an async IPC user buffer.
|-
| 1 || IpcLocked || True when IpcRefCount > 0.
|-
| 2 || DeviceShared || True when DeviceRefCount > 0.
|-
| 3 || Uncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description || Meaning
|-
| 7-0 || [[#MemoryType]] ||
|-
| 8 || [[#SetMemoryPermission|PermissionChangeAllowed]] ||
|-
| 9 || ForceReadWritableByDebugSyscalls || Allows using [[#WriteDebugProcessMemory]] on segments mapped read-only.
|-
| 10 || IpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=0.
|-
| 11 || NonDeviceIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=1.
|-
| 12 || NonSecureIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=3.
|-
| 14 || [[#SetProcessMemoryPermission|ProcessPermissionChangeAllowed]] ||
|-
| 15 || [[#MapMemory|MapAllowed]] ||
|-
| 16 || [[#UnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]] ||
|-
| 17 || [[#CreateTransferMemory|TransferMemoryAllowed]] ||
|-
| 18 || [[#QueryPhysicalAddress|QueryPhysicalAddressAllowed]] ||
|-
| 19 || MapDeviceAllowed ([[#MapDeviceAddressSpace]] and [[#MapDeviceAddressSpaceByForce]]) ||
|-
| 20 || [[#MapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]] ||
|-
| 21 || [[#SendSyncRequestWithUserBuffer|IpcBufferAllowed]] ||
|-
| 22 || IsPoolAllocated/IsReferenceCounted || The physical memory blocks backing this region are refcounted.
|-
| 23 || [[#MapProcessMemory|MapProcessAllowed]] ||
|-
| 24 || [[#SetMemoryAttribute|AttributeChangeAllowed]] ||
|-
| 25 || [4.0.0+] [[#CreateCodeMemory|CodeMemoryAllowed]] ||
|}

=== MemoryType ===
{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || Free ||
|-
| 0x00002001 || Io || Mapped by kernel capability parsing in [[#CreateProcess]].
|-
| 0x00042002 || Static || Mapped by kernel capability parsing in [[#CreateProcess]].
|-
| 0x00DC7E03 || Code || Mapped during [[#CreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| CodeData || Transition from 0xDC7E03 performed by [[#SetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| Normal || Mapped using [[#SetHeapSize]].
|-
| 0x00402006 || Shared || Mapped using [[#MapSharedMemory]].
|-
| 0x00482907 || [1.0.0] Alias || Mapped using [[#MapMemory]].
|-
| 0x00DD7E08 || AliasCode || Mapped using [[#MapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| AliasCodeData || Transition from 0xDD7E08 performed by [[#SetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || Stack || Mapped using [[#MapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|ThreadLocal]] || Mapped during [[#CreateThread]].
|-
| 0x015C3C0D || Transfered || Mapped using [[#MapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || ShTransfered || Mapped using [[#MapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || SharedCode || Mapped using [[#MapProcessMemory]].
|-
| 0x00000010 || Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || KernelStack || Mapped in kernel during [[#CreateThread]].
|-
| 0x00402214 || [4.0.0+] CodeReadOnly || Mapped in kernel during [[#ControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] CodeWritable || Mapped in kernel during [[#ControlCodeMemory]].
|}

== ArbitrationType ==
{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|}

== SignalType ==
{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]
{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==
The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || AttachProcess
|-
| 1 || AttachThread
|-
| 2 || ExitProcess
|-
| 3 || ExitThread
|-
| 4 || Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Trap (*)
|-
| 1 || InstructionAbort
|-
| 2 || DataAbortMisc (**)
|-
| 3 || PcSpAlignmentFault
|-
| 4 || DebuggerAttached
|-
| 5 || BreakPoint
|-
| 6 || UserBreak
|-
| 7 || DebuggerBreak
|-
| 8 || BadSvcId
|-
| 9 || [2.0.0+] SError
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and [[#ReturnFromException]]:

TLS region start (A64):
{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:
{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):
{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:
{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || [2.0.0+] SError
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call [[#ReturnFromException]] (error code) to call that handler. The latter is then expected to promptly abort the program.

[[#ReturnFromException]] updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls [[#ReturnFromException]], it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

NV services

2019-11-07T01:43:53Z

PixelyIon: Correct the NVMAP_IOC_FREE struct by changing it's 'refcount' field to 'address'

The Switch uses a customized NVIDIA driver.

= nvdrv, nvdrv:a, nvdrv:s, nvdrv:t =
This is "nns::nvdrv::INvDrvServices".

Main NVIDIA driver service.

Each service is used by:
* "nvdrv": regular applications
* "nvdrv:a": applets
* "nvdrv:s": sysmodules
* "nvdrv:t": factory titles

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#Open]]
|-
| 1 || [[#Ioctl]]
|-
| 2 || [[#Close]]
|-
| 3 || [[#Initialize]]
|-
| 4 || [[#QueryEvent]]
|-
| 5 || [[#MapSharedMem]]
|-
| 6 || [[#GetStatus]]
|-
| 7 || [[#SetAruid]]
|-
| 8 || [[#SetAruidByPID]]
|-
| 9 || [[#DumpGraphicsMemoryInfo]]
|-
| 10 || [3.0.0+] [[#InitializeDevtools]]
|-
| 11 || [3.0.0+] [[#Ioctl2]]
|-
| 12 || [3.0.0+] [[#Ioctl3]]
|-
| 13 || [3.0.0+] [[#FinishInitialize]]
|}

== Open ==
Takes a type-0x5 input buffer for the device-path. Returns the output 32bit '''fd''' and the u32 '''error_code'''.

== Ioctl ==
Takes a 32bit '''fd''', an u32 '''ioctl_cmd''', a type-0x21 input buffer, and a type-0x22 output buffer. Returns an output u32 ('''error_code''').

The addr/size for send/recv buffers are only set when the associated direction bit is set in the ioctl cmd (addr/size = 0 otherwise).

== Close ==
Takes a 32bit '''fd'''. Returns an output u32 ('''error_code''').

== Initialize ==
Takes two copy-handles ('''current_process''' and '''transfer_memory''') and an input u32 ('''transfer_memory_size'''). Returns an output u32 ('''error_code''').

Webkit applet creates the transfer-memory with perm = 0 and size 0x300000.

== QueryEvent ==
Takes two input u32s ('''fd''' and '''event_id'''), with the second word immediately after the first one. Returns an output u32 ('''error_code''') and a copy-handle ('''event_handle''').

QueryEvent is only supported on (and implemented differently on):
* /dev/nvhost-gpu
** 1: SmException_BptIntReport
** 2: SmException_BptPauseReport
** 3: ErrorNotifierEvent
* /dev/nvhost-ctrl: Used to get events for SyncPts.
** If bit31-28 is 1, then lower 16-bits contain event_slot, bit27-16 contain syncpt_number.
** If bit31-28 is 0, then lower 4-bits contain event_slot, bit31-4 contains syncpt_number.
* /dev/nvhost-ctrl-gpu
** 1: Returns error_event_handle.
** 2: Returns unknown event.
* /dev/nvhost-dbg-gpu
** Ignores event_id.

== MapSharedMem ==
Takes a copy-handle ('''transfer_memory''') and two input u32s ('''fd''' and '''nvmap_handle'''). Returns an output u32 ('''error_code''').

== GetStatus ==
Takes no input. Returns 0x10-bytes and an output u32 ('''error_code''').

== SetAruid ==
Takes an input u64 which must [[IPC_Marshalling|match]] the user-process PID ([[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]). Returns an output u32 ('''error_code''').

== SetAruidByPID ==
Takes a PID-descriptor and an u64 which must [[IPC_Marshalling|match]] the user-process PID ([[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]]). Returns an output u32 ('''error_code''').

== DumpGraphicsMemoryInfo ==
No input or output. Does nothing.

== InitializeDevtools ==
Takes a copy-handle and an input u32. Returns an output u32 ('''error_code''').

== Ioctl2 ==
Takes a type-0x21 buffer, a type-0x22 buffer, a type-0x21 buffer, and two input u32s. Returns an output u32 ('''error_code''').

== Ioctl3 ==
Takes a type-0x21 buffer, a type-0x22 buffer, another type-0x22 buffer, and two input u32s. Returns an output u32 (error_code).
Cmdhdr_word1 is 0x100B instead of 0xC0B.

== FinishInitialize ==
Takes an input u64. No output.

This sets a boolean value based on the input u64 and the value of the "nv!nv_graphics_firmware_memory_margin" system configuration, but only for "nvdrv" (the other services default to false).

Official user-processes starting with 3.0.0 now use this at the end of nvdrv service init with value 0x1.

= Ioctls =
The ioctl number is generated with the following primitive (see Linux kernel):

#define _IOC(inout, group, num, len) \
(inout | ((len & IOCPARM_MASK) << 16) | ((group) << 8) | (num))

The following table contains known ioctls.

== /dev/nvhost-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0xC0080014 || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ]]
|-
| 0x40040015 || In || 4 || [[#NVHOST_IOCTL_CTRL_SYNCPT_INCR]]
|-
| 0xC00C0016 || Inout || 12 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAIT]]
|-
| 0x40080017 || In || 8 || [[#NVHOST_IOCTL_CTRL_MODULE_MUTEX]]
|-
| 0xC0180018 || Inout || 24 || [[#NVHOST_IOCTL_CTRL_MODULE_REGRDWR]]
|-
| 0xC0100019 || Inout || 16 || [[#NVHOST_IOCTL_CTRL_SYNCPT_WAITEX]]
|-
| 0xC008001A || Inout || 8 || [[#NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX]]
|-
| 0xC183001B || Inout || 387 || [[#NVHOST_IOCTL_CTRL_GET_CONFIG]]
|-
| 0xC004001C || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_SIGNAL]]
|-
| 0xC010001D || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT]]
|-
| 0xC010001E || Inout || 16 || [[#NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC]]
|-
| 0xC004001F || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_REGISTER]]
|-
| 0xC0040020 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_EVENT_UNREGISTER]]
|-
| 0x40080021 || In || 8 || [[#NVHOST_IOCTL_CTRL_EVENT_KILL]]
|-
| 0xC0040022 || Inout || 4 || [[#NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL]]
|}

=== NVHOST_IOCTL_CTRL_SYNCPT_READ ===
Identical to Linux driver.

struct {
__in u32 id;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_INCR ===
Identical to Linux driver.

struct {
__in u32 id;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAIT ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
};

=== NVHOST_IOCTL_CTRL_MODULE_MUTEX ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 lock; // (0==unlock; 1==lock)
};

=== NVHOST_IOCTL_CTRL_MODULE_REGRDWR ===
Identical to Linux driver. Uses 32-bit version and doesn't work.

struct {
__in u32 id;
__in u32 num_offsets;
__in u32 block_size;
__in u32 offsets;
__in u32 values;
__in u32 write;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_WAITEX ===
Identical to Linux driver.

struct {
__in u32 id;
__in u32 thresh;
__in s32 timeout;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_SYNCPT_READ_MAX ===
Identical to Linux driver.

struct {
__in u32 id;
__out u32 value;
};

=== NVHOST_IOCTL_CTRL_GET_CONFIG ===
Returns configured settings. Not available in production mode.

struct {
__in char domain_str[0x41]; // "nv"
__in char param_str[0x41];
__out char config_str[0x101];
};

=== NVHOST_IOCTL_CTRL_EVENT_SIGNAL ===
Signals an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT ===
Waits on an event. If waiting fails, returns error code 0x05 (Timeout) and sets '''value''' to (('''syncpt_id''' << 0x10) | 0x10000000).

Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.

struct {
__in u32 syncpt_id;
__in u32 threshold;
__in s32 timeout;
__inout u32 value; // in=user_event_id (ignored); out=syncpt_value or user_event_id
};

=== NVHOST_IOCTL_CTRL_EVENT_WAIT_ASYNC ===
Waits on an event (async version). If waiting fails, returns error code 0x0B (BadValue).

Depending on '''threshold''', an '''user_event_id''' may be returned for using with other event ioctls.

struct {
__in u32 syncpt_id;
__in u32 threshold;
__in u32 timeout;
__inout u32 value; // in=user_event_id (ignored); out=syncpt_value or user_event_id
};

=== NVHOST_IOCTL_CTRL_EVENT_REGISTER ===
Registers an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_UNREGISTER ===
Unregisters an user event. Exclusive to the Switch.

struct {
__in u32 user_event_id; // ranges from 0x00 to 0x3F
};

=== NVHOST_IOCTL_CTRL_EVENT_KILL ===
Kills user events. Exclusive to the Switch.

struct {
__in u64 user_events; // 64-bit bitfield where each bit represents one event
};

=== NVHOST_IOCTL_CTRL_GET_MAX_EVENT_FIFO_CHANNEL ===
If event FIFO is enabled, returns the maximum channel number. Exclusive to the Switch.

struct {
__out u32 max_channel; // 0x00 (FIFO disabled) or 0x60 (FIFO enabled)
};

== /dev/nvmap ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0xC0080101 || Inout || 8 || [[#NVMAP_IOC_CREATE]]
|-
| 0x00000102 || - || 0 || [[#NVMAP_IOC_CLAIM]]
|-
| 0xC0080103 || Inout || 8 || [[#NVMAP_IOC_FROM_ID]]
|-
| 0xC0200104 || Inout || 32 || [[#NVMAP_IOC_ALLOC]]
|-
| 0xC0180105 || Inout || 24 || [[#NVMAP_IOC_FREE]]
|-
| 0xC0280106 || Inout || 40 || [[#NVMAP_IOC_MMAP]]
|-
| 0xC0280107 || Inout || 40 || [[#NVMAP_IOC_WRITE]]
|-
| 0xC0280108 || Inout || 40 || [[#NVMAP_IOC_READ]]
|-
| 0xC00C0109 || Inout || 12 || [[#NVMAP_IOC_PARAM]]
|-
| 0xC010010A || Inout || 16 || [[#NVMAP_IOC_PIN_MULT]]
|-
| 0xC010010B || Inout || 16 || [[#NVMAP_IOC_UNPIN_MULT]]
|-
| 0xC008010C || Inout || 8 || [[#NVMAP_IOC_CACHE]]
|-
| 0xC004010D || Inout || 4 || [[#NVMAP_IOC_GET_IVC_ID]]
|-
| 0xC008010E || Inout || 8 || [[#NVMAP_IOC_GET_ID]]
|-
| 0xC004010F || Inout || 4 || [[#NVMAP_IOC_FROM_IVC_ID]]
|-
| 0x40040110 || In || 4 || [[#NVMAP_IOC_SET_ALLOCATION_TAG_LABEL]]
|-
| 0x00000111 || - || 0 || [[#NVMAP_IOC_RESERVE]]
|-
| 0x40100112 || In || 16 || [[#NVMAP_IOC_EXPORT_FOR_ARUID]]
|-
| 0x40100113 || In || 16 || [[#NVMAP_IOC_IS_OWNED_BY_ARUID]]
|-
| 0x40100114 || In || 16 || [[#NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID]]
|}

=== NVMAP_IOC_CREATE ===
Creates an nvmap object. Identical to Linux driver.

struct {
__in u32 size;
__out u32 handle;
};

=== NVMAP_IOC_CLAIM ===
Returns [[#Errors|NotSupported]].

=== NVMAP_IOC_FROM_ID ===
Get handle to an existing nvmap object. Identical to Linux driver.

struct {
__in u32 id;
__out u32 handle;
};

=== NVMAP_IOC_ALLOC ===
Allocate memory for the nvmap object. Nintendo extended this one with 16 bytes, and changed it from in to inout.

struct {
__in u32 handle;
__in u32 heapmask;
__in u32 flags; // (0=read-only, 1=read-write)
__in u32 align;
__in u8 kind;
u8 pad[7];
__inout u64 addr;
};

=== NVMAP_IOC_FREE ===
This one is completely custom. Partly because the Linux driver passed the handle as the ioctl "arg-ptr", and HIPC can't handle that voodoo.

struct {
__in u32 handle;
u32 pad;
__out u64 address;
__out u32 size;
__out u32 flags; // 1=NOT_FREED_YET
};

=== NVMAP_IOC_MMAP ===
Returns [[#Errors|NotSupported]].

=== NVMAP_IOC_WRITE ===
Returns [[#Errors|NotSupported]].

=== NVMAP_IOC_READ ===
Returns [[#Errors|NotSupported]].

=== NVMAP_IOC_PARAM ===
Returns info about a nvmap object. Identical to Linux driver, but extended with further params.

struct {
__in u32 handle;
__in u32 param; // 1=SIZE, 2=ALIGNMENT, 3=BASE (returns error), 4=HEAP (always 0x40000000), 5=KIND, 6=COMPR (unused)
__out u32 result;
};

=== NVMAP_IOC_PIN_MULT ===
Returns [[#Errors|NotSupported]].

=== NVMAP_IOC_UNPIN_MULT ===
Returns [[#Errors|NotSupported]].

=== NVMAP_IOC_CACHE ===
Returns [[#Errors|NotSupported]].

=== NVMAP_IOC_GET_IVC_ID ===
Returns [[#Errors|NotSupported]].

=== NVMAP_IOC_GET_ID ===
Returns an id for a nvmap object. Identical to Linux driver.

struct {
__out u32 id; //~0 indicates error
__in u32 handle;
};

=== NVMAP_IOC_FROM_IVC_ID ===
Returns [[#Errors|NotSupported]].

=== NVMAP_IOC_SET_ALLOCATION_TAG_LABEL ===
Returns [[#Errors|NotSupported]].

=== NVMAP_IOC_RESERVE ===
Returns [[#Errors|NotSupported]].

=== NVMAP_IOC_EXPORT_FOR_ARUID ===
Binds a nvmap object to an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].

struct {
__in u64 aruid;
__in u32 handle;
u8 pad[4];
};

=== NVMAP_IOC_IS_OWNED_BY_ARUID ===
Checks if a nvmap object is bound to an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].

struct {
__in u64 aruid;
__in u32 handle;
u8 pad[4];
};

=== NVMAP_IOC_REMOVE_EXPORT_FOR_ARUID ===
Unbinds a nvmap object from an [[Applet_Manager_services#AppletResourceUserId|AppletResourceUserId]].

struct {
__in u64 aruid;
__in u32 handle;
u8 pad[4];
};

== /dev/nvdisp-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0x80040212 || Out || 4 || NVDISP_CTRL_GET_NUM_OUTPUTS
|-
| 0xC0140213 || Inout || 20 || NVDISP_CTRL_GET_OUTPUT_PROPERTIES
|-
| 0xC1100214 || Inout || 272 || NVDISP_CTRL_GET_OUTPUT_EDID
|-
| 0xC0080216</br>([1.0.0-3.0.0] 0xC0040216) || Inout || 8</br>([1.0.0-3.0.0] 4) || NVDISP_CTRL_GET_EXT_HPD_IN_OUT_EVENTS</br>([1.0.0-3.0.0] NVDISP_CTRL_GET_EXT_HPD_IN_EVENT)
|-
| ([1.0.0-3.0.0] 0xC0040217) || ([1.0.0-3.0.0] Inout) || ([1.0.0-3.0.0] 4) || ([1.0.0-3.0.0] NVDISP_CTRL_GET_EXT_HPD_OUT_EVENT)
|-
| 0xC0100218 || Inout || 16 || NVDISP_CTRL_GET_VBLANK_HEAD0_EVENT
|-
| 0xC0100219 || Inout || 16 || NVDISP_CTRL_GET_VBLANK_HEAD1_EVENT
|-
| 0xC0040220 || Inout || 4 || NVDISP_CTRL_GET_HPD_IRQ
|}

== /dev/nvdisp-disp0, /dev/nvdisp-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0x40040201 || In || 4 || NVDISP_GET_WINDOW
|-
| 0x40040202 || In || 4 || NVDISP_PUT_WINDOW
|-
| 0xC4C80203 || In || 1224 || NVDISP_FLIP
|-
| 0x80380204 || Out || 56 || NVDISP_GET_MODE
|-
| 0x40380205 || Out || 56 || NVDISP_SET_MODE
|-
| 0x430C0206 || In || 780 || NVDISP_SET_LUT
|-
| 0x40010207 || In || 1 || NVDISP_ENABLE_DISABLE_CRC
|-
| 0x80040208 || Out || 4 || NVDISP_GET_CRC
|-
| 0x80040209 || Out || 4 || NVDISP_GET_HEAD_STATUS
|-
| 0xC038020A || Inout || 56 || NVDISP_VALIDATE_MODE
|-
| 0x4018020B || In || 24 || NVDISP_SET_CSC
|-
| 0xC004020C || Inout || 4 || NVDISP_GET_VBLANK_SYNCPT
|-
| 0x8040020D || Out || 64 || NVDISP_GET_UNDERFLOWS
|-
| 0xC99A020E || Inout || 2458 || NVDISP_SET_CMU
|-
| 0xC004020F || Inout || 4 || NVDISP_DPMS
|-
| 0x80600210 || Out || 96 || NVDISP_GET_AVI_INFOFRAME
|-
| 0x40600211 || In || 96 || NVDISP_SET_AVI_INFOFRAME
|-
| 0xEBFC0215 || Inout || 11260 || NVDISP_GET_MODE_DB
|-
| 0xC003021A || Inout || 3 || NVDISP_PANEL_GET_VENDOR_ID
|-
| 0x803C021B || Out || 60 || NVDISP_GET_MODE2
|-
| 0x403C021C || In || 60 || NVDISP_SET_MODE2
|-
| 0xC03C021D || Inout || 60 || NVDISP_VALIDATE_MODE2
|-
| 0xEF20021E || Inout || 12064 || NVDISP_GET_MODE_DB2
|-
| 0xC004021F || Inout || 4 || NVDISP_GET_WINMASK
|}

== /dev/nvcec-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0x40010301 || In || 1 || NVCEC_CTRL_ENABLE
|-
| 0x804C0302 || Out || 76 || NVCEC_CTRL_GET_PADDR
|-
| 0x40040303 || In || 4 || NVCEC_CTRL_SET_LADDR
|-
| 0xC04C0304 || Inout || 76 || NVCEC_CTRL_WRITE
|-
| 0xC04C0305 || Inout || 76 || NVCEC_CTRL_READ
|-
| 0x804C0306 || Out || 76 || NVCEC_CTRL_GET_CONNECTION_STATUS
|-
| 0x804C0307 || Out || 76 || NVCEC_CTRL_GET_WRITE_STATUS
|}

== /dev/nvhdcp_up-ctrl ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0xC4880401 || Inout || 1160 || NVHDCP_READ_M
|-
| 0xC4880402 || Inout || 1160 || NVHDCP_READ_S
|-
| 0x40010403 || In || 1 || NVHDCP_ON_OFF
|-
| 0xC0080404 || Inout || 8 || NVHDCP_READ_EVENT
|-
| 0xC0010405 || Inout || 1 || NVHDCP_EVENTS_ON_OFF
|}

== /dev/nvdcutil-disp0, /dev/nvdcutil-disp1 ==
{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0x40010501 || In || 1 || NVDCUTIL_SW_HOTPLUG_IN_OUT
|-
| 0x40010502 || In || 1 || NVDCUTIL_VIRTUAL_EDID_ON_OFF
|-
| 0x42040503 || In || 1056 || NVDCUTIL_VIRTUAL_EDID_SET_DATA
|-
| 0x803C0504 || Out || 60 || NVDCUTIL_GET_MODE
|-
| 0x40010505 || In || 1 || NVDCUTIL_TELEMETRY_TEST_ON_OFF
|-
| 0x400C0506 || In || 12 || NVDCUTIL_DSI_PACKET_SHORT_WRITE
|-
| 0x40F80507 || In || 248 || NVDCUTIL_DSI_PACKET_LONG_WRITE
|-
| 0xC0F40508 || Inout || 244 || NVDCUTIL_DSI_PACKET_READ
|}

== /dev/nvsched-ctrl ==
This is a customized scheduler device.

The way this device is exposed and configured is exclusive to the Switch, since other sources don't have an actual interface for the scheduler.

{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0x00000601 || - || 0 || [[#NVSCHED_CTRL_ENABLE]]
|-
| 0x00000602 || - || 0 || [[#NVSCHED_CTRL_DISABLE]]
|-
| 0x40180603 || In || 24 || [[#NVSCHED_CTRL_ADD_APPLICATION]]
|-
| 0x40180604 || In || 24 || [[#NVSCHED_CTRL_UPDATE_APPLICATION]]
|-
| 0x40080605 || In || 8 || [[#NVSCHED_CTRL_REMOVE_APPLICATION]]
|-
| 0x80080606 || Out || 8 || [[#NVSCHED_CTRL_GET_ID]]
|-
| 0x80080607 || Out || 8 || [[#NVSCHED_CTRL_ADD_RUNLIST]]
|-
| 0x40180608 || In || 24 || [[#NVSCHED_CTRL_UPDATE_RUNLIST]]
|-
| 0x40100609 || In || 16 || [[#NVSCHED_CTRL_LINK_RUNLIST]]
|-
| 0x4010060A || In || 16 || [[#NVSCHED_CTRL_UNLINK_RUNLIST]]
|-
| 0x4008060B || In || 8 || [[#NVSCHED_CTRL_REMOVE_RUNLIST]]
|-
| 0x8001060C || Out || 1 || [[#NVSCHED_CTRL_HAS_OVERRUN_EVENT]]
|-
| 0x8020060D</br>([1.0.0-3.0.0] 0x8010060D) || Out || 32</br>([1.0.0-3.0.0] 16) || [[#NVSCHED_CTRL_GET_NEXT_OVERRUN_EVENT]]
|-
| 0x400C060E || In || 12 || [[#NVSCHED_CTRL_PUT_CONDUCTOR_FLIP_FENCE]]
|-
| 0x4008060F || In || 8 || [[#NVSCHED_CTRL_DETACH_APPLICATION]]
|-
| 0x40100610 || In || 16 || NVSCHED_CTRL_LINK_RUNLIST_EX
|-
| 0x40100611 || In || 16 || NVSCHED_CTRL_UNLINK_RUNLIST_EX
|-
| 0x40010612 || In || 1 || NVSCHED_CTRL_OVERRUN_EVENTS_ON_OFF
|}

=== NVSCHED_CTRL_ENABLE ===
Enables the scheduler.

=== NVSCHED_CTRL_DISABLE ===
Disables the scheduler.

=== NVSCHED_CTRL_ADD_APPLICATION ===
Adds a new application to the scheduler.

struct {
__in u64 application_id;
__in u64 priority;
__in u64 timeslice;
};

=== NVSCHED_CTRL_UPDATE_APPLICATION ===
Updates the application parameters in the scheduler.

struct {
__in u64 application_id;
__in u64 priority;
__in u64 timeslice;
};

=== NVSCHED_CTRL_REMOVE_APPLICATION ===
Removes the application from the scheduler.

struct {
__in u64 application_id;
};

=== NVSCHED_CTRL_GET_ID ===
Returns the ID of the last scheduled object.

struct {
__out u64 id;
};

=== NVSCHED_CTRL_ADD_RUNLIST ===
Creates a new runlist and returns it's ID.

struct {
__out u64 runlist_id;
};

=== NVSCHED_CTRL_UPDATE_RUNLIST ===
Updates the runlist parameters in the scheduler.

struct {
__in u64 runlist_id;
__in u64 priority;
__in u64 timeslice;
};

=== NVSCHED_CTRL_LINK_RUNLIST ===
Links a runlist to a given application in the scheduler.

struct {
__in u64 runlist_id;
__in u64 application_id;
};

=== NVSCHED_CTRL_UNLINK_RUNLIST ===
Unlinks a runlist from a given application in the scheduler.

struct {
__in u64 runlist_id;
__in u64 application_id;
};

=== NVSCHED_CTRL_REMOVE_RUNLIST ===
Removes the runlist from the scheduler.

struct {
__in u64 runlist_id;
};

=== NVSCHED_CTRL_HAS_OVERRUN_EVENT ===
Returns a boolean to tell if the scheduler has an overrun event or not.

struct {
__out u8 has_overrun;
};

=== NVSCHED_CTRL_GET_NEXT_OVERRUN_EVENT ===
Returns the overrun event's data from the scheduler.

struct {
__out u64 runlist_id;
__out u64 debt;
__out u64 unk0; // 3.0.0+ only
__out u64 unk1; // 3.0.0+ only
};

=== NVSCHED_CTRL_PUT_CONDUCTOR_FLIP_FENCE ===
Installs a fence swap event?

struct {
__in u32 fence_id;
__in u32 fence_value;
__in u32 swap_interval;
};

=== NVSCHED_CTRL_DETACH_APPLICATION ===
Places the given application in detached state.

struct {
__in u64 application_id;
};

== /dev/nverpt-ctrl ==
Added in firmware version 3.0.0.

{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0xC1280701 || Inout || 296 || [[#NVERPT_TELEMETRY_SUBMIT_DATA]]
|-
| 0xCF580702 || Inout || 3928 || [[#NVERPT_TELEMETRY_SUBMIT_DISPLAY_DATA]]
|}

=== NVERPT_TELEMETRY_SUBMIT_DATA ===
Sends test data for creating a new [[Error_Report_services|Error Report]].

struct {
__in u64 TestU64;
__in u32 TestU32;
__in u8 padding0[4];
__in s64 TestI64;
__in s32 TestI32;
__in u8 TestString[32];
__in u8 TestU8Array[8];
__in u32 TestU8Array_size;
__in u32 TestU32Array[8];
__in u32 TestU32Array_size;
__in u64 TestU64Array[8];
__in u32 TestU64Array_size;
__in s32 TestI32Array[8];
__in u32 TestI32Array_size;
__in s64 TestI64Array[8];
__in u32 TestI64Array_size;
__in u16 TestU16;
__in u8 TestU8;
__in s16 TestI16;
__in s8 TestI8;
__in u8 padding1[5];
};

=== NVERPT_TELEMETRY_SUBMIT_DISPLAY_DATA ===
Sends display data for creating a new [[Error_Report_services|Error Report]].

struct {
__in u32 CodecType;
__in u32 DecodeBuffers;
__in u32 FrameWidth;
__in u32 FrameHeight;
__in u8 ColorPrimaries;
__in u8 TransferCharacteristics;
__in u8 MatrixCoefficients;
__in u8 padding;
__in u32 DisplayWidth;
__in u32 DisplayHeight;
__in u32 DARWidth;
__in u32 DARHeight;
__in u32 ColorFormat;
__in u32 ColorSpace[8];
__in u32 ColorSpace_size;
__in u32 SurfaceLayout[8];
__in u32 SurfaceLayout_size;
__in u8 ErrorString[64]; // must be "Error detected = 0x1000000"
__in u32 VideoDecState;
__in u8 VideoLog[3712];
__in u32 VideoLog_size;
};

== /dev/nvhost-as-gpu ==
Each fd opened to this device creates an address space. An address space is then later bound with a channel.

Once a nvgpu channel has been bound to an address space it cannot be unbound. There is no support for allowing an nvgpu channel to change from one address space to another (or from one to none).

{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0x40044101 || In || 4 || [[#NVGPU_AS_IOCTL_BIND_CHANNEL]]
|-
| 0xC0184102 || Inout || 24 || [[#NVGPU_AS_IOCTL_ALLOC_SPACE]]
|-
| 0xC0104103 || Inout || 16 || [[#NVGPU_AS_IOCTL_FREE_SPACE]]
|-
| 0xC0184104 || Inout || 24 || [[#NVGPU_AS_IOCTL_MAP_BUFFER]]
|-
| 0xC0084105 || Inout || 8 || [[#NVGPU_AS_IOCTL_UNMAP_BUFFER]]
|-
| 0xC0284106 || Inout || 40 || [[#NVGPU_AS_IOCTL_MODIFY]]
|-
| 0x40104107 || In || 16 || [[#NVGPU_AS_IOCTL_INITIALIZE]]
|-
| 0xC0404108 || Inout || 64 || [[#NVGPU_AS_IOCTL_GET_VA_REGIONS]]
|-
| 0x40284109 || In || 40 || [[#NVGPU_AS_IOCTL_INITIALIZE_EX]]
|-
| 0xC038410A || Inout || 56 || [[#NVGPU_AS_IOCTL_MAP_BUFFER_EX]]
|-
| 0xC0??4114 || Inout || Variable || [[#NVGPU_AS_IOCTL_REMAP]]
|}

=== NVGPU_AS_IOCTL_BIND_CHANNEL ===
Identical to Linux driver.

struct {
__in u32 fd;
};

=== NVGPU_AS_IOCTL_ALLOC_SPACE ===
Reserves pages in the device address space.

struct {
__in u32 pages;
__in u32 page_size;
__in u32 flags;
u32 pad;
union {
__out u64 offset;
__in u64 align;
};
};

=== NVGPU_AS_IOCTL_FREE_SPACE ===
Frees pages from the device address space.

struct {
__in u64 offset;
__in u32 pages;
__in u32 page_size;
};

=== NVGPU_AS_IOCTL_MAP_BUFFER ===
Maps a memory region in the device address space. Identical to Linux driver pretty much.

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
u32 pad;
__in u32 nvmap_handle;
__inout u32 page_size; // 0 means don't care
union {
__out u64 offset;
__in u64 align;
};
};

=== NVGPU_AS_IOCTL_MODIFY ===
Modifies a memory region in the device address space.

Unaligned size will cause a [[#Panic]].

On success, the mapped memory region is locked by having [[SVC#MemoryState]] bit34 set.

struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__in u32 kind; // -1 is default
__in u32 nvmap_handle;
__inout u32 page_size; // 0 means don't care
__in u64 buffer_offset;
__in u64 mapping_size;
__inout u64 offset;
};

=== NVGPU_AS_IOCTL_UNMAP_BUFFER ===
Unmaps a memory region from the device address space.

struct {
__in u64 offset;
};

=== NVGPU_AS_IOCTL_INITIALIZE ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable).

struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u32 flags; // ignored; passes 0
__in u32 reserved; // ignored; passes 0
};

=== NVGPU_AS_IOCTL_GET_VA_REGIONS ===
Nintendo's custom implementation to get rid of pointer in struct.

struct va_region {
u64 offset;
u32 page_size;
u32 pad;
u64 pages;
};

struct {
u64 not_used; // (contained output user ptr on linux, ignored)
__inout u32 bufsize; // forced to 2*sizeof(struct va_region)
u32 pad;
__out struct va_region regions[2];
};

=== NVGPU_AS_IOCTL_INITIALIZE_EX ===
Nintendo's custom implementation of NVGPU_GPU_IOCTL_ALLOC_AS (unavailable) with extra params.

struct {
__in u32 big_page_size; // depends on GPU's available_big_page_sizes; 0=default
__in s32 as_fd; // ignored; passes 0
__in u32 flags; // passes 0
__in u32 reserved; // ignored; passes 0
__in u64 unk0;
__in u64 unk1;
__in u64 unk2;
};

=== NVGPU_AS_IOCTL_MAP_BUFFER_EX ===
Maps a memory region in the device address space with extra params.

struct {
__in u32 flags; // bit0: fixed_offset, bit2: cacheable
__in u32 kind; // -1 is default
__in u32 nvmap_handle;
__inout u32 page_size; // 0 means don't care
__in u64 buffer_offset;
__in u64 mapping_size;
__inout u64 offset;
__in u64 unk0;
__in u32 unk1;
u32 pad;
};

=== NVGPU_AS_IOCTL_REMAP ===
Nintendo's custom implementation of address space remapping.

struct remap_entry {
__in u16 flags; // 0 or 4
__in u16 kind;
__in u32 nvmap_handle;
__in u32 reserved;
__in u32 offset; // (alloc_space_offset >> 0x10)
__in u32 pages; // alloc_space_pages
};

struct {
__in struct remap_entry entries[];
};

== /dev/nvhost-dbg-gpu ==
Returns [[#Errors|NotSupported]] on Open unless nn::settings::detail::GetDebugModeFlag is set.

{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0x40084401 || In || 8 || NVGPU_DBG_GPU_IOCTL_BIND_CHANNEL
|-
| 0xC0??4402 || Inout || Variable || NVGPU_DBG_GPU_IOCTL_REG_OPS
|-
| 0x40084403 || In || 8 || NVGPU_DBG_GPU_IOCTL_EVENTS_CTRL
|-
| 0x40044404 || In || 4 || NVGPU_DBG_GPU_IOCTL_POWERGATE
|-
| 0x40044405 || In || 4 || NVGPU_DBG_GPU_IOCTL_SMPC_CTXSW_MODE
|-
| 0x40044406 || In || 4 || NVGPU_DBG_GPU_IOCTL_SUSPEND_RESUME_ALL_SMS
|-
| 0xC0184407 || Inout || 24 || NVGPU_DBG_GPU_IOCTL_PERFBUF_MAP
|-
| 0x40084408 || In || 8 || NVGPU_DBG_GPU_IOCTL_PERFBUF_UNMAP
|-
| 0x40084409 || In || 8 || NVGPU_DBG_GPU_IOCTL_PC_SAMPLING
|-
| 0x4008440A || In || 8 || NVGPU_DBG_GPU_IOCTL_TIMEOUT
|-
| 0x8008440B || Out || 8 || NVGPU_DBG_GPU_IOCTL_GET_TIMEOUT
|-
| 0x8004440C || Out || 4 || NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT_SIZE
|-
| 0x0000440D || None || 0 || [[#NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT]]
|-
| 0xC018440F || Inout || 24 || NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_NUM_PDES
|-
| 0xC0104410 || Inout || 16 || [[#NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PDES]]
|-
| 0xC0184411 || Inout || 24 || NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_NUM_PTES
|-
| 0xC0104412 || Inout || 16 || [[#NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PTES]]
|-
| 0xC0684413 || Inout || 104 || NVGPU_DBG_GPU_IOCTL_GET_COMPTAG_INFO
|-
| 0xC0184414 || Inout || 24 || [[#NVGPU_DBG_GPU_IOCTL_READ_COMPTAGS]]
|-
| 0xC0184415 || Inout || 24 || [[#NVGPU_DBG_GPU_IOCTL_WRITE_COMPTAGS]]
|-
| 0xC0104416 || Inout || 16 || NVGPU_DBG_GPU_IOCTL_RESERVE_COMPTAGS
|-
| 0xC0104417 || Inout || 16 || NVGPU_DBG_GPU_IOCTL_FREE_RESERVED_COMPTAGS
|-
| 0xC0104418 || Inout || 16 || NVGPU_DBG_GPU_IOCTL_RESERVE_PA
|-
| 0xC0104419 || Inout || 16 || NVGPU_DBG_GPU_IOCTL_FREE_RESERVED_PA
|-
| 0xC018441A || Inout || 24 || NVGPU_DBG_GPU_IOCTL_LAZY_ALLOC_RESERVED_PA
|}

=== NVGPU_DBG_GPU_IOCTL_GET_GR_CONTEXT ===
Uses [[#Ioctl3|Ioctl3]].

=== NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PDES ===
Uses [[#Ioctl3|Ioctl3]].

=== NVGPU_DBG_GPU_IOCTL_GET_GPU_VA_RANGE_PTES ===
Uses [[#Ioctl3|Ioctl3]].

=== NVGPU_DBG_GPU_IOCTL_READ_COMPTAGS ===
Uses [[#Ioctl3|Ioctl3]].

=== NVGPU_DBG_GPU_IOCTL_WRITE_COMPTAGS ===
Uses [[#Ioctl2|Ioctl2]].

== /dev/nvhost-prof-gpu ==
Returns [[#Errors|NotSupported]] on Open unless nn::settings::detail::GetDebugModeFlag is set.

This device is identical to [[#/dev/nvhost-dbg-gpu|/dev/nvhost-dbg-gpu]].

== /dev/nvhost-ctrl-gpu ==
This device is for global (context independent) operations on the gpu.

{| class="wikitable" border="1"
! Value || Direction || Size || Description
|-
| 0x80044701 || Out || 4 || [[#NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE]]
|-
| 0x80284702 || Out || 40 || [[#NVGPU_GPU_IOCTL_ZCULL_GET_INFO]]
|-
| 0x402C4703 || In || 44 || [[#NVGPU_GPU_IOCTL_ZBC_SET_TABLE]]
|-
| 0xC0344704 || Inout || 52 || [[#NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE]]
|-
| 0xC0B04705 || Inout || 176 || [[#NVGPU_GPU_IOCTL_GET_CHARACTERISTICS]]
|-
| 0xC0184706 || Inout || 24 || [[#NVGPU_GPU_IOCTL_GET_TPC_MASKS]]
|-
| 0x40084707 || In || 8 || [[#NVGPU_GPU_IOCTL_FLUSH_L2]]
|-
| 0x4008470D || In || 8 || [[#NVGPU_GPU_IOCTL_INVAL_ICACHE]]
|-
| 0x4008470E || In || 8 || [[#NVGPU_GPU_IOCTL_SET_MMU_DEBUG_MODE]]
|-
| 0x4010470F || In || 16 || [[#NVGPU_GPU_IOCTL_SET_SM_DEBUG_MODE]]
|-
| 0xC0304710</br>([1.0.0-6.1.0] 0xC0084710) || Inout || 48</br>([1.0.0-6.1.0] 8) || [[#NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE]]
|-
| 0x80084711 || Out || 8 || [[#NVGPU_GPU_IOCTL_GET_TPC_EXCEPTION_EN_STATUS]]
|-
| 0x80084712 || Out || 8 || [[#NVGPU_GPU_IOCTL_NUM_VSMS]]
|-
| 0xC0044713 || Inout || 4 || [[#NVGPU_GPU_IOCTL_VSMS_MAPPING]]
|-
| 0x80084714 || Out || 8 || [[#NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK]]
|-
| 0x80044715 || Out || 4 || [[#NVGPU_GPU_IOCTL_PMU_GET_GPU_LOAD]]
|-
| 0x40084716 || In || 8 || [[#NVGPU_GPU_IOCTL_SET_CG_CONTROLS]]
|-
| 0xC0084717 || Inout || 8 || [[#NVGPU_GPU_IOCTL_GET_CG_CONTROLS]]
|-
| 0x40084718 || In || 8 || [[#NVGPU_GPU_IOCTL_SET_PG_CONTROLS]]
|-
| 0xC0084719 || Inout || 8 || [[#NVGPU_GPU_IOCTL_GET_PG_CONTROLS]]
|-
| 0x8018471A || Out || 24 || [[#NVGPU_GPU_IOCTL_PMU_GET_ELPG_RESIDENCY_GATING]]
|-
| 0xC008471B || Inout || 8 || [[#NVGPU_GPU_IOCTL_GET_ERROR_CHANNEL_USER_DATA]]
|-
| 0xC010471C || Inout || 16 || [[#NVGPU_GPU_IOCTL_GET_GPU_TIME]]
|-
| 0xC108471D || Inout || 264 || [[#NVGPU_GPU_IOCTL_GET_CPU_TIME_CORRELATION_INFO]]
|}

=== NVGPU_GPU_IOCTL_ZCULL_GET_CTX_SIZE ===
Returns the GPU's ZCULL context size. Identical to Linux driver.

struct {
__out u32 size;
};

=== NVGPU_GPU_IOCTL_ZCULL_GET_INFO ===
Returns GPU's ZCULL information. Identical to Linux driver.

struct {
__out u32 width_align_pixels;
__out u32 height_align_pixels;
__out u32 pixel_squares_by_aliquots;
__out u32 aliquot_total;
__out u32 region_byte_multiplier;
__out u32 region_header_size;
__out u32 subregion_header_size;
__out u32 subregion_width_align_pixels;
__out u32 subregion_height_align_pixels;
__out u32 subregion_count;
};

=== NVGPU_GPU_IOCTL_ZBC_SET_TABLE ===
Sets the active ZBC table. Identical to Linux driver.

struct {
__in u32 color_ds[4];
__in u32 color_l2[4];
__in u32 depth;
__in u32 format;
__in u32 type; // 1=color, 2=depth
};

=== NVGPU_GPU_IOCTL_ZBC_QUERY_TABLE ===
Queries the active ZBC table. Identical to Linux driver.

struct {
__out u32 color_ds[4];
__out u32 color_l2[4];
__out u32 depth;
__out u32 ref_cnt;
__out u32 format;
__out u32 type;
__inout u32 index_size;
};

=== NVGPU_GPU_IOCTL_GET_CHARACTERISTICS ===
Returns the GPU characteristics. Modified to return inline data instead of using a pointer.

[3.0.0+] Uses either [[#Ioctl|Ioctl]] or [[#Ioctl3|Ioctl3]].

struct gpu_characteristics {
u32 arch; // 0x120 (NVGPU_GPU_ARCH_GM200)
u32 impl; // 0xB (NVGPU_GPU_IMPL_GM20B) or 0xE (NVGPU_GPU_IMPL_GM20B_B)
u32 rev; // 0xA1 (Revision A1)
u32 num_gpc; // 0x1
u64 l2_cache_size; // 0x40000
u64 on_board_video_memory_size; // 0x0 (not used)
u32 num_tpc_per_gpc; // 0x2
u32 bus_type; // 0x20 (NVGPU_GPU_BUS_TYPE_AXI)
u32 big_page_size; // 0x20000
u32 compression_page_size; // 0x20000
u32 pde_coverage_bit_count; // 0x1B
u32 available_big_page_sizes; // 0x30000
u32 gpc_mask; // 0x1
u32 sm_arch_sm_version; // 0x503 (Maxwell Generation 5.0.3)
u32 sm_arch_spa_version; // 0x503 (Maxwell Generation 5.0.3)
u32 sm_arch_warp_count; // 0x80
u32 gpu_va_bit_count; // 0x28
u32 reserved; // NULL
u64 flags; // 0x55 (HAS_SYNCPOINTS | SUPPORT_SPARSE_ALLOCS | SUPPORT_CYCLE_STATS | SUPPORT_CYCLE_STATS_SNAPSHOT)
u32 twod_class; // 0x902D (FERMI_TWOD_A)
u32 threed_class; // 0xB197 (MAXWELL_B)
u32 compute_class; // 0xB1C0 (MAXWELL_COMPUTE_B)
u32 gpfifo_class; // 0xB06F (MAXWELL_CHANNEL_GPFIFO_A)
u32 inline_to_memory_class; // 0xA140 (KEPLER_INLINE_TO_MEMORY_B)
u32 dma_copy_class; // 0xB0B5 (MAXWELL_DMA_COPY_A)
u32 max_fbps_count; // 0x1
u32 fbp_en_mask; // 0x0 (disabled)
u32 max_ltc_per_fbp; // 0x2
u32 max_lts_per_ltc; // 0x1
u32 max_tex_per_tpc; // 0x0 (not supported)
u32 max_gpc_count; // 0x1
u32 rop_l2_en_mask_0; // 0x21D70 (fuse_status_opt_rop_l2_fbp_r)
u32 rop_l2_en_mask_1; // 0x0
u64 chipname; // 0x6230326D67 ("gm20b")
u64 gr_compbit_store_base_hw; // 0x0 (not supported)
};

struct {
__inout u64 gpu_characteristics_buf_size; // must not be NULL, but gets overwritten with 0xA0=max_size
__in u64 gpu_characteristics_buf_addr; // ignored, but must not be NULL
__out struct gpu_characteristics gc;
};

=== NVGPU_GPU_IOCTL_GET_TPC_MASKS ===
Returns the TPC mask value for each GPC. Modified to return inline data instead of using a pointer.

[3.0.0+] Uses either [[#Ioctl|Ioctl]] or [[#Ioctl3|Ioctl3]].

struct {
__in u32 mask_buf_size; // ignored, but must not be NULL
__in u32 reserved[3];
__out u64 mask_buf; // receives one 32-bit TPC mask per GPC (GPC 0 and GPC 1)
};

=== NVGPU_GPU_IOCTL_FLUSH_L2 ===
Flushes the GPU L2 cache.

struct {
__in u32 flush; // l2_flush | l2_invalidate << 1 | fb_flush << 2
__in u32 reserved;
};

=== NVGPU_GPU_IOCTL_INVAL_ICACHE ===
Invalidates the GPU instruction cache. Identical to Linux driver.

struct {
__in s32 channel_fd;
__in u32 reserved;
};

=== NVGPU_GPU_IOCTL_SET_MMU_DEBUG_MODE ===
Sets the GPU MMU debug mode. Identical to Linux driver.

struct {
__in u32 state;
__in u32 reserved;
};

=== NVGPU_GPU_IOCTL_SET_SM_DEBUG_MODE ===
Sets the GPU SM debug mode. Identical to Linux driver.

struct {
__in s32 channel_fd;
__in u32 enable;
__in u64 sms;
};

=== NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE ===
Waits until all valid warps on the GPU SM are paused and returns their current state.

struct {
__in u64 pwarpstate;
};

[6.1.0+] This command was modified to return inline data instead of using a pointer.

struct {
__out u64 sm0_valid_warps;
__out u64 sm0_trapped_warps;
__out u64 sm0_paused_warps;
__out u64 sm1_valid_warps;
__out u64 sm1_trapped_warps;
__out u64 sm1_paused_warps;
};

=== NVGPU_GPU_IOCTL_GET_TPC_EXCEPTION_EN_STATUS ===
Returns a mask value describing all active TPC exceptions. Identical to Linux driver.

struct {
__out u64 tpc_exception_en_sm_mask;
};

=== NVGPU_GPU_IOCTL_NUM_VSMS ===
Returns the number of GPU SM units present. Identical to Linux driver.

struct {
__out u32 num_vsms;
__out u32 reserved;
};

=== NVGPU_GPU_IOCTL_VSMS_MAPPING ===
Returns mapping information on each GPU SM unit. Modified to return inline data instead of using a pointer.

struct {
__out u8 sm0_gpc_index;
__out u8 sm0_tpc_index;
__out u8 sm1_gpc_index;
__out u8 sm1_tpc_index;
};

=== NVGPU_GPU_IOCTL_ZBC_GET_ACTIVE_SLOT_MASK ===
Returns the mask value for a ZBC slot.

struct {
__out u32 slot; // always 0x07
__out u32 mask;
};

=== NVGPU_GPU_IOCTL_PMU_GET_GPU_LOAD ===
Returns the GPU load value from the PMU.

struct {
__out u32 pmu_gpu_load;
};

=== NVGPU_GPU_IOCTL_SET_CG_CONTROLS ===
Sets the clock gate control value.

struct {
__in u32 cg_mask;
__in u32 cg_value;
};

=== NVGPU_GPU_IOCTL_GET_CG_CONTROLS ===
Returns the clock gate control value.

struct {
__in u32 cg_mask;
__out u32 cg_value;
};

=== NVGPU_GPU_IOCTL_SET_PG_CONTROLS ===
Sets the power gate control value.

struct {
__in u32 pg_mask;
__in u32 pg_value;
};

=== NVGPU_GPU_IOCTL_GET_PG_CONTROLS ===
Returns the power gate control value.

struct {
__in u32 pg_mask;
__out u32 pg_value;
};

=== NVGPU_GPU_IOCTL_PMU_GET_ELPG_RESIDENCY_GATING ===
Returns the GPU PMU ELPG residency gating values.

struct {
__out u64 pg_ingating_time_us;
__out u64 pg_ungating_time_us;
__out u64 pg_gating_cnt;
};

=== NVGPU_GPU_IOCTL_GET_ERROR_CHANNEL_USER_DATA ===
Returns user specific data from the error channel, if one exists.

struct {
__out u64 data;
};

=== NVGPU_GPU_IOCTL_GET_GPU_TIME ===
Returns the timestamp from the GPU's nanosecond timer (PTIMER). Identical to Linux driver.

struct {
__out u64 gpu_timestamp; // raw GPU counter (PTIMER) value
__out u64 reserved;
};

=== NVGPU_GPU_IOCTL_GET_CPU_TIME_CORRELATION_INFO ===
Returns CPU/GPU timestamp pairs for correlation analysis. Identical to Linux driver.

struct time_correlation_sample {
u64 cpu_timestamp; // from CPU's CNTPCT_EL0 register
u64 gpu_timestamp; // from GPU's PTIMER registers
};

struct {
__out struct time_correlation_sample samples[16]; // timestamp pairs
__in u32 count; // number of pairs to read
__in u32 source_id; // cpu clock source id (must be 1)
};

== Channels ==
Channels are a concept for NVIDIA hardware blocks that share a common interface.

{| class="wikitable" border="1"
! Path || Name
|-
| /dev/nvhost-gpu || GPU
|-
| /dev/nvhost-msenc || Video Encoder
|-
| /dev/nvhost-nvdec || Video Decoder
|-
| /dev/nvhost-nvjpg || JPEG Decoder
|-
| /dev/nvhost-vic || Video Image Compositor
|-
| /dev/nvhost-display || Display
|}

== Channel Ioctls ==
{| class="wikitable" border="1"
! Value || Size || Description
|-
| 0xC0??0001 || Variable || NVHOST_IOCTL_CHANNEL_SUBMIT
|-
| 0xC0080002 || 8 || [[#NVHOST_IOCTL_CHANNEL_GET_SYNCPOINT]]
|-
| 0xC0080003 || 8 || [[#NVHOST_IOCTL_CHANNEL_GET_WAITBASE]]
|-
| 0xC0080004 || 8 || [[#NVHOST_IOCTL_CHANNEL_GET_MODMUTEX]]
|-
| 0x40040007 || 4 || [[#NVHOST_IOCTL_CHANNEL_SET_SUBMIT_TIMEOUT]]
|-
| 0x40080008 || 8 || [[#NVHOST_IOCTL_CHANNEL_SET_CLK_RATE]]
|-
| 0xC0??0009 || Variable || [[#NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER]]
|-
| 0xC0??000A || Variable || [[#NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER]]
|-
| 0x00000013 || 0 || [[#NVHOST_IOCTL_CHANNEL_SET_TIMEOUT_EX]]
|-
| 0xC0080023</br>([1.0.0-7.0.1] 0xC0080014) || 8 || [[#NVHOST_IOCTL_CHANNEL_GET_CLK_RATE]]
|-
| 0xC0??0024 || Variable || NVHOST_IOCTL_CHANNEL_SUBMIT_EX
|-
| 0xC0??0025 || Variable || [[#NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER_EX]]
|-
| 0xC0??0026 || Variable || [[#NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER_EX]]
|- style="border-top: double"
| 0x40044801 || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD]]
|-
| 0x40044803 || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_TIMEOUT]]
|-
| 0x40084805 || 8 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO]]
|-
| 0x40184806 || 24 || [[#NVGPU_IOCTL_CHANNEL_WAIT]]
|-
| 0xC0044807 || 4 || [[#NVGPU_IOCTL_CHANNEL_CYCLE_STATS]]
|-
| 0xC0??4808 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]]
|-
| 0xC0104809 || 16 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX]]
|-
| 0x4008480A || 8 || [[#NVHOST_IOCTL_CHANNEL_FREE_OBJ_CTX]]
|-
| 0xC010480B || 16 || [[#NVGPU_IOCTL_CHANNEL_ZCULL_BIND]]
|-
| 0xC018480C || 24 || [[#NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER]]
|-
| 0x4004480D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_PRIORITY]]
|-
| 0x0000480E || 0 || [[#NVGPU_IOCTL_CHANNEL_ENABLE]]
|-
| 0x0000480F || 0 || [[#NVGPU_IOCTL_CHANNEL_DISABLE]]
|-
| 0x00004810 || 0 || [[#NVGPU_IOCTL_CHANNEL_PREEMPT]]
|-
| 0x00004811 || 0 || [[#NVGPU_IOCTL_CHANNEL_FORCE_RESET]]
|-
| 0x40084812 || 8 || [[#NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL]]
|-
| 0xC0104813 || 16 || [[#NVGPU_IOCTL_CHANNEL_CYCLE_STATS_SNAPSHOT]]
|-
| 0x80804816 || 128 || [[#NVGPU_IOCTL_CHANNEL_GET_ERROR_INFO]]
|-
| 0xC0104817 || 16 || [[#NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION]]
|-
| 0x40204818 || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]]
|-
| 0xC0??4819 || Variable || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]]
|-
| 0xC020481A || 32 || [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2]]
|-
| 0xC018481B || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX]]
|-
| 0xC018481C || 24 || [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY_EX]]
|-
| 0xC004481D || 4 || [[#NVGPU_IOCTL_CHANNEL_SET_TIMESLICE]]
|- style="border-top: double"
| 0x40084714 || 8 || [[#NVGPU_IOCTL_CHANNEL_SET_USER_DATA]]
|-
| 0x80084715 || 8 || [[#NVGPU_IOCTL_CHANNEL_GET_USER_DATA]]
|}

=== NVHOST_IOCTL_CHANNEL_GET_SYNCPOINT ===
Returns the current syncpoint value for a given module. Identical to Linux driver.

struct {
__in u32 module_id;
__out u32 syncpt_value;
};

=== NVHOST_IOCTL_CHANNEL_GET_WAITBASE ===
Returns the current waitbase value for a given module. Always returns 0.

struct {
__in u32 module_id;
__out u32 waitbase_value;
};

=== NVHOST_IOCTL_CHANNEL_GET_MODMUTEX ===
Stubbed. Does a debug print and returns 0.

=== NVHOST_IOCTL_CHANNEL_SET_SUBMIT_TIMEOUT ===
Sets the submit timeout value for the channel. Identical to Linux driver.

struct {
__in u32 timeout;
};

=== NVHOST_IOCTL_CHANNEL_SET_CLK_RATE ===
Sets the clock rate value for a given module. Identical to Linux driver.

struct {
__in u32 clk_rate;
__in u32 module_id;
};

=== NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER ===
Uses '''nvmap_pin''' internally to pin a given number of nvmap handles to an appropriate device physical address.

struct handle {
u32 handle_id_in; // nvmap handle to map
u32 phys_addr_out; // returned device physical address mapped to the handle
};

struct {
__in u32 num_handles; // number of nvmap handles to map
__in u32 reserved; // ignored
__in u8 is_compr; // memory to map is compressed
__in u8 padding[3]; // ignored
__inout struct handle handles[]; // depends on num_handles
};

=== NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER ===
Uses '''nvmap_unpin''' internally to unpin a given number of nvmap handles from their device physical address.

struct handle {
u32 handle_id_in; // nvmap handle to unmap
u32 reserved; // ignored
};

struct {
__in u32 num_handles; // number of nvmap handles to unmap
__in u32 reserved; // ignored
__in u8 is_compr; // memory to unmap is compressed
__in u8 padding[3]; // ignored
__inout struct handle handles[]; // depends on num_handles
};

=== NVHOST_IOCTL_CHANNEL_SET_TIMEOUT_EX ===
Sets the global timeout value for the channel. Identical to Linux driver.

struct {
__in u32 timeout;
__in u32 flags;
};

=== NVHOST_IOCTL_CHANNEL_GET_CLK_RATE ===
Returns the clock rate value for a given module. Identical to Linux driver.

struct {
__out u32 clk_rate;
__in u32 module_id;
};

=== NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER_EX ===
Same as [[#NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER|NVHOST_IOCTL_CHANNEL_MAP_CMD_BUFFER]], but calls '''nvmap_unpin''' internally in case of error.

=== NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER_EX ===
Same as [[#NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER|NVHOST_IOCTL_CHANNEL_UNMAP_CMD_BUFFER]].

=== NVGPU_IOCTL_CHANNEL_SET_NVMAP_FD ===
Binds a nvmap object to this channel. Identical to Linux driver.

struct {
__in u32 nvmap_fd;
};

=== NVGPU_IOCTL_CHANNEL_SET_TIMEOUT ===
Sets the timeout value for the GPU channel. Identical to Linux driver.

struct {
__in u32 timeout;
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO ===
Allocates gpfifo entries. Identical to Linux driver.

struct {
__in u32 num_entries;
__in u32 flags;
};

=== NVGPU_IOCTL_CHANNEL_WAIT ===
Waits on channel. Identical to Linux driver.

struct {
__in u32 type; // wait type (0=notifier, 1=semaphore)
__in u32 timeout; // wait timeout value
__in u32 dmabuf_fd; // nvmap handle
__in u32 offset; // nvmap memory offset
__in u32 payload; // payload data (semaphore only)
__in u32 padding; // ignored
};

=== NVGPU_IOCTL_CHANNEL_CYCLE_STATS ===
Maps memory for the cycle stats buffer. Identical to Linux driver.

struct {
__in u32 dmabuf_fd; // nvmap handle
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO ===
Submits a gpfifo object. Modified to take inline entry objects instead of a pointer.

struct fence {
u32 syncpt_id;
u32 syncpt_value;
};

struct gpfifo_entry {
u64 entry; // gpu_iova | (unk_2bits << 40) | (size << 42) | (unk_flag << 63)
};

struct {
__in u64 gpfifo; // (ignored) pointer to gpfifo fence structs
__in u32 num_entries; // number of fence objects being submitted
__in u32 flags;
__inout struct fence fence_out; // returned new fence object for others to wait on
__in struct gpfifo_entry entries[]; // depends on num_entries
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_OBJ_CTX ===
Allocates a graphics context object. Modified to ignore object's ID.

You can only have one object context allocated at a time. You must have bound an address space before using this.

struct {
__in u32 class_num; // 0x902D=2d, 0xB197=3d, 0xB1C0=compute, 0xA140=kepler, 0xB0B5=DMA, 0xB06F=channel_gpfifo
__in u32 flags; // bit0: LOCKBOOST_ZERO
__out u64 obj_id; // (ignored) used for FREE_OBJ_CTX ioctl, which is not supported
};

=== NVHOST_IOCTL_CHANNEL_FREE_OBJ_CTX ===
Frees a graphics context object. Not supported.

struct {
__in u64 obj_id; // ignored
};

=== NVGPU_IOCTL_CHANNEL_ZCULL_BIND ===
Binds a ZCULL context to the channel. Identical to Linux driver.

struct {
__in u64 gpu_va;
__in u32 mode; // 0=global, 1=no_ctxsw, 2=separate_buffer, 3=part_of_regular_buf
__in u32 reserved;
};

=== NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER ===
Initializes the error notifier for this channel. Unlike for the Linux kernel, the Switch driver cannot write to an arbitrary userspace buffer. Thus new ioctls have been introduced to fetch the error information rather than using a shared memory buffer.

struct {
__in u64 offset; // ignored
__in u64 size; // ignored
__in u32 mem; // must be non-zero to initialize, zero to de-initialize
__in u32 reserved; // ignored
};

=== NVGPU_IOCTL_CHANNEL_SET_PRIORITY ===
Changes channel's priority. Identical to Linux driver.

struct {
__in u32 priority; // 0x32 is low, 0x64 is medium and 0x96 is high
};

=== NVGPU_IOCTL_CHANNEL_ENABLE ===
Enables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_DISABLE ===
Disables the current channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_PREEMPT ===
Clears the FIFO pipe for this channel. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_FORCE_RESET ===
Forces the channel to reset. Identical to Linux driver.

=== NVGPU_IOCTL_CHANNEL_EVENT_ID_CONTROL ===
Controls event notifications.

struct {
__in u32 cmd; // 0=disable, 1=enable, 2=clear
__in u32 id; // same id's as for [[#QueryEvent]]
};

=== NVGPU_IOCTL_CHANNEL_CYCLE_STATS_SNAPSHOT ===
Controls the cycle stats snapshot buffer. Identical to Linux driver.

struct {
__in u32 cmd; // command to handle (0=flush, 1=attach, 2=detach)
__in u32 dmabuf_fd; // nvmap handle
__inout u32 extra; // extra payload data/result
__in u32 padding; // ignored
};

=== NVGPU_IOCTL_CHANNEL_GET_ERROR_INFO ===
Returns information on the current error notification caught by the error notifier. Exclusive to the Switch.

struct {
__out u32 error_info[32]; // first word is an error code (0=no_error, 1=gr_error, 2=gr_error, 3=invalid, 4=invalid)
};

=== NVGPU_IOCTL_CHANNEL_GET_ERROR_NOTIFICATION ===
Returns the current error notification caught by the error notifier. Exclusive to the Switch.

struct {
__out u64 timestamp; // fetched straight from armGetSystemTick
__out u32 info32; // error code
__out u16 info16; // additional error info
__out u16 status; // always 0xFFFF
};

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX ===
Allocates gpfifo entries with additional parameters. Exclusive to the Switch.

struct fence {
u32 syncpt_id;
u32 syncpt_value;
};

struct {
__in u32 num_entries;
__in u32 num_jobs;
__in u32 flags;
__out struct fence fence_out; // returned new fence object for others to wait on
__in u32 reserved[3]; // ignored
};

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY ===
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]].

=== NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX2 ===
Same as [[#NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX|NVGPU_IOCTL_CHANNEL_ALLOC_GPFIFO_EX]].

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_EX ===
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO]], but uses [[#Ioctl2|Ioctl2]].

=== NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY_EX ===
Same as [[#NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY|NVGPU_IOCTL_CHANNEL_SUBMIT_GPFIFO_RETRY]], but uses [[#Ioctl2|Ioctl2]].

=== NVGPU_IOCTL_CHANNEL_SET_TIMESLICE ===
Changes channel's timeslice. Identical to Linux driver.

struct {
__in u32 timeslice;
};

=== NVGPU_IOCTL_CHANNEL_SET_USER_DATA ===
Sets user specific data.

struct {
__in u64 data;
};

=== NVGPU_IOCTL_CHANNEL_GET_USER_DATA ===
Returns user specific data.

struct {
__out u64 data;
};

= nvmemp =
NVIDIA memory profiler (this service is not available on retail units).
/dev/nvhost-ctrl sends the ioctl NVHOST_IOCTL_CTRL_GET_CONFIG to check the config "nv!NV_MEMORY_PROFILER". If config_str returns "1", the application attempts to use nvmemp.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Open
|-
| 1 || GetAruid
|}

= nvdrvdbg =
This is "nns::nvdrv::INvDrvDebugFSServices".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || [[#OpenDebugFS]]
|-
| 1 || [[#CloseDebugFS]]
|-
| 2 || [[#GetDebugFSKeys]]
|-
| 3 || GetDebugFSValue
|-
| 4 || SetDebugFSValue
|}

== OpenDebugFS ==
Takes a process handle. Returns a u32 '''fd'''.

== CloseDebugFS ==
Takes a u32 '''fd''' and closes it.

== GetDebugFSKeys ==
Takes a u32 '''fd''' and reads debug contents into a type-6 buffer.

= nvgem:c =
This is "nv::gemcontrol::INvGemControl".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Initialize
|-
| 1 || GetGemEvent
|-
| 2 ||
|-
| 3 || RegisterUnregisterAppIdLocked
|-
| 4 ||
|-
| [1.0.0-4.1.0] 5 || GetAruid
|-
| 6 || HandleDeferredErrors
|-
| 7 || [3.0.0+]
|}

= nvgem:cd =
This is "nv::gemcoredump::INvGemCoreDump".

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Initialize
|-
| 1 || GetAruid
|-
| [1.0.0-8.1.0] 2 || ReadNextCdBlock
|-
| 3 || [8.0.0+]
|-
| 4 || [8.0.0+]
|}

= Errors =
Most nvidia driver commands return an error code apart from the normal return code.

{| class="wikitable" border="1"
|-
! Cmd || Name
|-
| 0 || Success
|-
| 1 || NotImplemented
|-
| 2 || NotSupported
|-
| 3 || NotInitialized
|-
| 4 || BadParameter
|-
| 5 || Timeout
|-
| 6 || InsufficientMemory
|-
| 7 || ReadOnlyAttribute
|-
| 8 || InvalidState
|-
| 9 || InvalidAddress
|-
| 0xA || InvalidSize
|-
| 0xB || BadValue
|-
| 0xD || AlreadyAllocated
|-
| 0xE || Busy
|-
| 0xF || ResourceError
|-
| 0x10 || CountMismatch
|-
| 0x1000 || SharedMemoryTooSmall
|-
| 0x30003 || FileOperationFailed
|-
| 0x30004 || DirOperationFailed
|-
| 0x3000F || IoctlFailed
|-
| 0x30010 || AccessDenied
|-
| 0x30013 || FileNotFound
|-
| 0xA000E || ModuleNotPresent
|}

= Panic =
In some cases, a panic may occur. NV forces a crash by doing:
(void *)0 = 0xCAFE;
End result is that the system hangs with a white-screen.

== Gpfifo Panic ==
When the gpfifo data in the gpu_va buffers specified by the submitted gpfifo entries is invalid(?), eventually the user-process will be force-terminated after using the submit-gpfifo ioctl. It's unknown how exactly this is done.

[[Category:Services]]

HIPC

2019-09-23T09:45:18Z

PixelyIon: Fix bracket location

== IPC Command Structure ==
This is an array of u32's, usually located in [[Thread Local Storage]].

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 15-0 || [[#Type|Type]].
|-
| 0 || 19-16 || Number of buf X descriptors (each: 2 words).
|-
| 0 || 23-20 || Number of buf A descriptors (each: 3 words).
|-
| 0 || 27-24 || Number of buf B descriptors (each: 3 words).
|-
| 0 || 31-28 || Number of buf W desciptors (each: 3 words), not observed
|-
| 1 || 9-0 || Size of [[#Raw data section|raw data]] in u32s.
|-
| 1 || 13-10 || Flags for buf C descriptor.
|-
| 1 || 30-20 || Empty.
|-
| 1 || 31 || Enable handle descriptor.
|-
| ... || || [[#Handle descriptor|Handle descriptor]], if enabled.
|-
| ... || || [[#Buffer descriptor X "Pointer"|Buf X descriptors]], each one 2 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf A descriptors]], each one 3 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf B descriptors]], each one 3 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf W descriptors]], each one 3 words.
|-
| ... || || [[#Raw_data_section|Raw data section]] (including padding before and after aligned data section).
|-
| ... || || [[#Buffer descriptor C "ReceiveList"|Buf C descriptors]], each one 2 words.
|}

First two header u32's and handle descriptor (if enabled) are copied as-is from one process to the other.

=== Type ===
IPC commands can have different types which influence how the IPC server processes requests in "nn::sf::hipc::server::HipcServerSessionManagerBase::ProcessRequest".

{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || Invalid
|-
| 1 || [[#LegacyRequest, LegacyControl|LegacyRequest]]
|-
| 2 || [[#Close|Close]]
|-
| 3 || [[#LegacyRequest, LegacyControl|LegacyControl]]
|-
| 4 || [[#Request, Control|Request]]
|-
| 5 || [[#Request, Control|Control]]
|-
| 6 || [5.0.0+] [[#RequestWithContext, ControlWithContext|RequestWithContext]]
|-
| 7 || [5.0.0+] [[#RequestWithContext, ControlWithContext|ControlWithContext]]
|}

==== Close ====
When processing a request of this type, the IPC server calls:
* "nn::sf::hipc::server::HipcServerSessionManager::DestroyServerSession"
* "nn::sf::hipc::CloseServerSessionHandle"

This ensures that the server session is destroyed internally and properly closed.

==== LegacyRequest, LegacyControl ====
These types are handled by calling:
* "nn::sf::hipc::detail::HipcMessageBufferAccessor::ParseHeader"
* "nn::sf::hipc::server::HipcServerSessionManager::ProcessMessage"
* "nn::sf::hipc::Reply"
* "nn::sf::hipc::server::HipcServerSessionManager::RegisterServerSessionToWaitBase"

It is speculated that these are part of an older message processing system where headers were further partitioned.

==== Request, Control ====
These types are handled by calling:
* "nn::sf::hipc::server::HipcServerSessionManager::ProcessMessage2"
* "nn::sf::hipc::server::HipcServerSessionManager::RegisterServerSessionToWaitBase"

This represents a more modern message handling system where contents follow the general marshalling structure.

==== RequestWithContext, ControlWithContext ====
These are identical to normal Request and Control types, but with the additional requirement of suppling a token in their [[#Data payload|data payload]].

This token is used by "nn::sf::cmif::SetInlineContext" which has the sole purpose of saving it into the TLS in order for it to be distributed to any IPC commands that are made while processing the current command. It's unknown if this token serves any purpose or if it's just a debug-tool to figure out what IPC command caused a particular chain of commands.

=== Handle descriptor ===
There can only be one of this descriptor type. It is enabled by bit31 of the second word.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 0 || Send current PID.
|-
| 0 || 4-1 || Number of handles to copy
|-
| 0 || 8-5 || Number of handles to move
|-
| ... || || 8-byte PID if enabled
|-
| ... || || Handles to copy
|-
| ... || || Handles to move
|}

Sysmodules load the last u64 of rawdata when handling the PID. This is not written by kernel. For sysmodule handling:
* In some cases: these commands require a placeholder u64 value passed in the input parameters, as mentioned above. In these cases the OverwriteClientProcessId method is called to replace the value before it is used.
* In other cases: The rawdata_u64 is compared with the PID from the descriptor. On mismatch and when rawdata_u64!=0, error 0x60A is returned. The PID value passed to the cmdhandler vtable funcptr is the rawdata_u64.

Handle 0 is allowed, and just means no handle was sent.

=== Buffer descriptor X "Pointer" ===
This one is packed even worse than A, they inserted the bit38-36 of the address ''on top'' of the counter field.

Officially, the counter is known as "receive index". This one writes to the buffer described in the ReceiveList.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 5-0 || Bits 5-0 of counter.
|-
| 0 || 8-6 || Bit 38-36 of address.
|-
| 0 || 11-9 || Bits 11-9 of counter.
|-
| 0 || 15-12 || Bit 35-32 of address.
|-
| 0 || 31-16 || Size
|-
| 1 || || Lower 32-bits of address.
|}

=== Buffer descriptor A/B/W "Send"/"Receive"/"Exchange" ===
This packing is so unnecessarily complex.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of size.
|-
| 1 || || Lower 32-bits of address.
|-
| 2 || 1-0 || Flags. Always set to 0, 1 or 3.
|-
| 2 || 4-2 || Bit 38-36 of address.
|-
| 2 || 27-24 || Bit 35-32 of size.
|-
| 2 || 31-28 || Bit 35-32 of address.
|}

A reply must not use A/B/W, svcReplyAndReceive will return 0xE801.

[[SVC|MemoryAttribute]] IsBorrowed and IsUncached are never allowed for the source address.

"Send" means buffer is sent from source process into service process.

"Receive" means that data is copied from service process into user process.

"Exchange" means both "Send" and "Receive".

==== Flags ====
Determines what [[SVC|MemoryState]] to use with the mapped memory in the sysmodule.

Used to enforce whether or not device mapping is allowed for src and dst buffers respectively.

* Ipc (flag=0): Device mapping *not* allowed for src or dst.
* NonSecureIpc (flag=1): Device mapping allowed for src and dst.
* NonDeviceIpc (flag=3): Device mapping allowed for src but not for dst.

=== Buffer descriptor C "ReceiveList" ===
There's a 4-bit flag in the main header controlling the behavior of C descriptors.

If it has value 0, the C descriptor functionality is disabled.

If it has value 1, there is an "inlined" C buffer after the raw data. Received data is copied to ROUND_UP(cmdbuf+raw_size+index, 16)

If it has value 2, there is a single C descriptor.

Otherwise it has (flag-2) C descriptors. In this case, index picks which C descriptor to copy received data to [instead of picking the offset into the buffer].

Data sent with this method must have MemoryState 0x4000000 mask set.

After reply, X descriptors are written to the sender containing the address, size and index that were copied to.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of address.
|-
| 1 || 15-0 || Rest of address.
|-
| 1 || 31-16 || Size
|}

=== IPC buffers ===
Buffer descriptor A/B/... map memory into the sysmodule process. For the mapped memory in the sysmodule the permissions are: desc-A = R--, desc-B = RW-. The buffer is automatically unmapped while the kernel handles the cmdreply, the sysmodule doesn't need to specify anything in the cmdreply to trigger this.

This memory is mapped in the sysmodule to the same vaddr from the original user-process cmd-request, except with with bits >=(~28(?)) changed to a different ASLR'd region.

No user-process->sysmodule memcpy is done for outbufs, only sysmodule->user-process.

Buffer descriptors C/X are somewhat different. Rather than mapping new memory into the server process, C/X descriptors copy data between existing buffers in different processes. Each X descriptor in a message has its data copied into a C descriptor on the other side. Each C descriptor in a message is used to reserve space for the other side's X descriptors to copy into.

When the kernel processes X descriptors, it must determine where to copy the data to. If the destination used C descriptors with flags >= 3, each X descriptor from the source is matched to a C descriptor in the destination by the X descriptor's index field. If the destination used a "single" C descriptor, the data from all the X descriptors is copied into the same buffer specified by the destination's C descriptor (causing error 0xce01 if there is not enough space) and the X descriptor index is ignored. The kernel then modifies the addresses in the X descriptors to indicate where the data was copied to in the destination.

Before receiving a request, if the IPC server is expecting X descriptors, it prepares a message with a "single" C descriptor (flags=2) in its message buffer before calling svcReplyAndReceive so that X descriptors from the client have a place to copy their data to. The usage of the flag-2 C descriptor allows the server to receive an arbitrary number of X descriptors, since they're all packed into the same buffer. If the server had used flag-3+ C descriptors, it would be limited in how many X descriptors it could receive since the X descriptors would have to be matched to distinct C descriptors. The buffer that the server's C descriptor points to is called the '''pointer buffer'''.

When the client sends X descriptors, data is copied into the server's pointer buffer. When the client sends C descriptors, no data is copied automatically. The server needs to use X descriptors to copy the data back to the client's C descriptors (using the index field to match X descriptors in the response back to the correct C descriptors).

== Raw data section ==
[[File:Ipc msg buffer type a example.png|thumb|An example of an IPC message with a type 0xA buffer in it. Red is headers/descriptors, yellow is padding, and blue is data/buffer lengths. Note that the size of the u16 array for type A lengths is padded to fill up a whole word.]]

{| class="wikitable" border="1"
! Word || Description
|-
| ... || Padding to align to 16 bytes.
|-
| ... || If sent to an object domain, a [[#Domain_message|domain message]], otherwise a [[#Data payload|data payload]]
|-
| ... || Padding
|-
| ... || Buffer type 0xA lengths (u16 array)
|}

The total amount of padding within the raw data section is always 0x10 bytes. This means that if no padding is required before the message, there will be 0x10 bytes of padding after the message (before the buffer type 0xA lengths).

=== Domains ===
Because the switch has relatively low limits on the total number of sessions available to the system (Kernel slabheap limits, sysmodule handle table size limits), HIPC supports a "Domains" feature that allows multiplexing multiple service sessions through a single handle. Domains store (effectively) a mapping from u32 object id to a SharedPointer<IServiceObject> -- When messages are sent to a domain, an extra header is sent in the raw data section (before anything else) with information about what object in the domain is being acted on; responses similarly contain an additional header. Official session code implements this by just using the dispatch table for the object in the map with the appropriate ID, instead of the dispatch table the session was initialized with.

Format for the extra request header for domain message:
{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 7-0 || Command. 1=send message, 2=close virtual handle
|-
| 0 || 8-15 || Input object count
|-
| 0 || 31-16 || Length of [[IPC_Marshalling#Data_payload|data payload]] in bytes.
|-
| 1 || || Object ID (from cmd 0 in [[IPC_Marshalling#Control|Control]]).
|-
| 2 || || Padding
|-
| 3 || || [1.0.0-4.1.0] Padding [5.0.0+] Token (for NewRequest only)
|-
| 4... || || [[#Data payload|Data payload]]
|-
| ... || || Input object IDs (u32s, not aligned)
|}

Format for the extra response header for domain message:
{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 31-0 || Output object count
|-
| 1-3 || || Padding
|-
|}

=== Data payload ===
This is an array of u32's, but individual parameters are generally stored as u64's.

{| class="wikitable" border="1"
! Word || Description
|-
| 0 || Magic ("SFCI" for requests, "SFCO" for responses) as u32.
|-
| 1 || Version as u32. 1 for NewRequest, 0 for Request.
|-
| 2 || Command id as u64 for requests, [[Error_codes|error code]] as u64 for responses.
|-
| 3 || [1.0.0-4.1.0] Padding [5.0.0+] Token (for NewRequest only, non-domain messages).
|-
| 4... || Input parameters or return values
|}

[5.0.0+] Version was incremented from 0 to 1, and a token value was introduced into raw_data+12 (regardless of domain or not, in either case it overlaps with padding).

The input rawdata struct is generated by stable-sorting function parameters by alignment, from low to high. It is likely this is a mistake, as it generates structs with suboptimal possible padding -- Nintendo probably meant to sort from high to low (which would give minimized padding), but couldn't/can't change this without breaking backwards compatibility.

== Official marshalling code ==
The official marshalling function is called "nn::sf::hipc::client::Hipc2ClientCoreProcessorImpl::WriteBufferDataImpl" and takes:
* A pointer to a "nn::sf::hipc::detail::HipcMessageWriter" context;
* The number of (buf_ptr, size) pairs;
* An array of (buf_ptr, size) pairs (called "nn::sf::detail::PointerAndSize");
* A pointer to a type bitfield for each such pair;
* The offset of the main IPC command structure;
* The size of the IPC command's [[IPC_Marshalling#Raw_data_section|raw data]].

The type of an IPC command is described by a bitfield as below:
{| class="wikitable" border="1"
! Bits || Name || Description
|-
| 0 || In || Direction is input.
|-
| 1 || Out || Direction is output.
|-
| 2 || HipcMapAlias || Use buffer descriptors A ("Send"), B ("Receive") or W ("Exchange").
|-
| 3 || HipcPointer || Use buffer descriptors X ("Pointer") or C ("ReceiveList").
|-
| 4 || FixedSize || Skip saving the pointer buffer size in raw data.
|-
| 5 || HipcAutoSelect || Select which buffer descriptor to use automatically.
|-
| 6 || HipcMapTransferAllowsNonSecure || Use [[#Flags|NonSecureIpc flag]].
|-
| 7 || HipcMapTransferAllowsNonDevice || Use [[#Flags|NonDeviceIpc flag]].
|}

X and C (Pointer and ReceiveList) descriptors are backed by the "pointer buffer", a buffer in the service process. Its size is a u16, which is retrieved using the "QueryPointerBufferSize" control message. If the client code determines all buffers with flag 8 do not fit in the pointer buffer, it returns error 0x11A0B.

For buffers with flag 0x20 it creates two descriptors (A+X or B+C), but one descriptor is NULL (zero size and pointer), while the other holds the expected values. X/C descriptors are used as the non-NULL descriptor where possible, but if they don't fit in the pointer buffer, A/B descriptors are used instead. The code defers processing of type 0x20 buffers with sizes that fit in a u16 (and may therefore fit in the pointer buffer), which ensures all type 8 buffers get pointer-buffer space before any type 0x20. The order in which the deferred type 0x20 buffers are processed is determined by a convoluted loop.

== Official IPC Cmd Structure ==
Official struct that is stored for each IPC command. It contains precalculated offsets for different portions of the command structure.

All offsets are given is in number of u32 words.

struct IpcCmdStruct {
u8 unk0;
u8 has_handle_descriptor;
u8 pad0[2];
u32 cmd0;
u32 cmd1;
u32 offset_handle_descriptor;
u32 pad1;
u32 offset_handles;
u32 pad2;
u32 offset_x_descriptors;
u32 offset_a_descriptors;
u32 offset_b_descriptors;
u32 offset_w_descriptors; /* this is a guess */
u32 offset_raw_data;
u32 offset_c_descriptors;
u32 unk2;
u32 unk3;
}

== Control ==
When type is [[IPC_Marshalling#Request.2C_Control|Control]], you are talking to the IPC manager. These are processed by the sysmodule.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Output
|-
| 0 || ConvertCurrentObjectToDomain || None || u32 CmifDomainObjectId
|-
| 1 || CopyFromCurrentDomain || u32 CmifDomainObjectId || u32 NativeHandle
|-
| 2 || CloneCurrentObject || None || u32 NativeHandle
|-
| 3 || QueryPointerBufferSize || None || u16 size
|-
| 4 || CloneCurrentObjectEx || u32 unknown || u32 NativeHandle
|}

HIPC

2019-09-20T10:46:49Z

PixelyIon: Corrects order of buffers to match that of their descriptions

== IPC Command Structure ==
This is an array of u32's, usually located in [[Thread Local Storage]].

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 15-0 || [[#Type|Type]].
|-
| 0 || 19-16 || Number of buf X descriptors (each: 2 words).
|-
| 0 || 23-20 || Number of buf A descriptors (each: 3 words).
|-
| 0 || 27-24 || Number of buf B descriptors (each: 3 words).
|-
| 0 || 31-28 || Number of buf W desciptors (each: 3 words), not observed
|-
| 1 || 9-0 || Size of [[#Raw data section|raw data]] in u32s.
|-
| 1 || 13-10 || Flags for buf C descriptor.
|-
| 1 || 30-20 || Empty.
|-
| 1 || 31 || Enable handle descriptor.
|-
| ... || || [[#Handle descriptor|Handle descriptor]], if enabled.
|-
| ... || || [[#Buffer descriptor X "Pointer"|Buf X descriptors]], each one 2 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf A descriptors]], each one 3 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf B descriptors]], each one 3 words.
|-
| ... || || [[#Buffer descriptor A/B/W "Send"/"Receive"/"Exchange"|Buf W descriptors]], each one 3 words.
|-
| ... || || [[#Raw_data_section|Raw data section]] (including padding before and after aligned data section).
|-
| ... || || [[#Buffer descriptor C "ReceiveList"|Buf C descriptors]], each one 2 words.
|}

First two header u32's and handle descriptor (if enabled) are copied as-is from one process to the other.

=== Type ===
IPC commands can have different types which influence how the IPC server processes requests in "nn::sf::hipc::server::HipcServerSessionManagerBase::ProcessRequest".

{| class="wikitable" border="1"
|-
! Value || Name
|-
| 0 || Invalid
|-
| 1 || [[#LegacyRequest, LegacyControl|LegacyRequest]]
|-
| 2 || [[#Close|Close]]
|-
| 3 || [[#LegacyRequest, LegacyControl|LegacyControl]]
|-
| 4 || [[#Request, Control|Request]]
|-
| 5 || [[#Request, Control|Control]]
|-
| 6 || [5.0.0+] [[#RequestWithContext, ControlWithContext|RequestWithContext]]
|-
| 7 || [5.0.0+] [[#RequestWithContext, ControlWithContext|ControlWithContext]]
|}

==== Close ====
When processing a request of this type, the IPC server calls:
* "nn::sf::hipc::server::HipcServerSessionManager::DestroyServerSession"
* "nn::sf::hipc::CloseServerSessionHandle"

This ensures that the server session is destroyed internally and properly closed.

==== LegacyRequest, LegacyControl ====
These types are handled by calling:
* "nn::sf::hipc::detail::HipcMessageBufferAccessor::ParseHeader"
* "nn::sf::hipc::server::HipcServerSessionManager::ProcessMessage"
* "nn::sf::hipc::Reply"
* "nn::sf::hipc::server::HipcServerSessionManager::RegisterServerSessionToWaitBase"

It is speculated that these are part of an older message processing system where headers were further partitioned.

==== Request, Control ====
These types are handled by calling:
* "nn::sf::hipc::server::HipcServerSessionManager::ProcessMessage2"
* "nn::sf::hipc::server::HipcServerSessionManager::RegisterServerSessionToWaitBase"

This represents a more modern message handling system where contents follow the general marshalling structure.

==== RequestWithContext, ControlWithContext ====
These are identical to normal Request and Control types, but with the additional requirement of suppling a token in their [[#Data payload|data payload]].

This token is used by "nn::sf::cmif::SetInlineContext" which has the sole purpose of saving it into the TLS in order for it to be distributed to any IPC commands that are made while processing the current command. It's unknown if this token serves any purpose or if it's just a debug-tool to figure out what IPC command caused a particular chain of commands.

=== Handle descriptor ===
There can only be one of this descriptor type. It is enabled by bit31 of the second word.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 0 || Send current PID.
|-
| 0 || 4-1 || Number of handles to copy
|-
| 0 || 8-5 || Number of handles to move
|-
| ... || || 8-byte PID if enabled
|-
| ... || || Handles to copy
|-
| ... || || Handles to move
|}

Sysmodules load the last u64 of rawdata when handling the PID. This is not written by kernel. For sysmodule handling:
* In some cases: these commands require a placeholder u64 value passed in the input parameters, as mentioned above. In these cases the OverwriteClientProcessId method is called to replace the value before it is used.
* In other cases: The rawdata_u64 is compared with the PID from the descriptor. On mismatch and when rawdata_u64!=0, error 0x60A is returned. The PID value passed to the cmdhandler vtable funcptr is the rawdata_u64.

Handle 0 is allowed, and just means no handle was sent.

=== Buffer descriptor X "Pointer" ===
This one is packed even worse than A, they inserted the bit38-36 of the address ''on top'' of the counter field.

Officially, the counter is known as "receive index". This one writes to the buffer described in the ReceiveList.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 5-0 || Bits 5-0 of counter.
|-
| 0 || 8-6 || Bit 38-36 of address.
|-
| 0 || 11-9 || Bits 11-9 of counter.
|-
| 0 || 15-12 || Bit 35-32 of address.
|-
| 0 || 31-16 || Size
|-
| 1 || || Lower 32-bits of address.
|}

=== Buffer descriptor A/B/W "Send"/"Receive"/"Exchange" ===
This packing is so unnecessarily complex.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of size.
|-
| 1 || || Lower 32-bits of address.
|-
| 2 || 1-0 || Flags. Always set to 0, 1 or 3.
|-
| 2 || 4-2 || Bit 38-36 of address.
|-
| 2 || 27-24 || Bit 35-32 of size.
|-
| 2 || 31-28 || Bit 35-32 of address.
|}

A reply must not use A/B/W, svcReplyAndReceive will return 0xE801.

[[SVC|MemoryAttribute]] IsBorrowed and IsUncached are never allowed for the source address.

"Send" means buffer is sent from source process into service process.

"Receive" means that data is copied from service process into user process.

"Exchange" means both "Send" and "Receive".

==== Flags ====
Determines what [[SVC|MemoryState]] to use with the mapped memory in the sysmodule.

Used to enforce whether or not device mapping is allowed for src and dst buffers respectively.

* Ipc (flag=0): Device mapping *not* allowed for src or dst.
* NonSecureIpc (flag=1): Device mapping allowed for src and dst.
* NonDeviceIpc (flag=3): Device mapping allowed for src but not for dst.

=== Buffer descriptor C "ReceiveList" ===
There's a 4-bit flag in the main header controlling the behavior of C descriptors.

If it has value 0, the C descriptor functionality is disabled.

If it has value 1, there is an "inlined" C buffer after the raw data. Received data is copied to ROUND_UP(cmdbuf+raw_size+index, 16)

If it has value 2, there is a single C descriptor.

Otherwise it has (flag-2) C descriptors. In this case, index picks which C descriptor to copy received data to [instead of picking the offset into the buffer].

Data sent with this method must have MemoryState 0x4000000 mask set.

After reply, X descriptors are written to the sender containing the address, size and index that were copied to.

{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || || Lower 32-bits of address.
|-
| 1 || 15-0 || Rest of address.
|-
| 1 || 31-16 || Size
|}

=== IPC buffers ===
Buffer descriptor A/B/... map memory into the sysmodule process. For the mapped memory in the sysmodule the permissions are: desc-A = R--, desc-B = RW-. The buffer is automatically unmapped while the kernel handles the cmdreply, the sysmodule doesn't need to specify anything in the cmdreply to trigger this.

This memory is mapped in the sysmodule to the same vaddr from the original user-process cmd-request, except with with bits >=(~28(?)) changed to a different ASLR'd region.

No user-process->sysmodule memcpy is done for outbufs, only sysmodule->user-process.

Buffer descriptors C/X are somewhat different. Rather than mapping new memory into the server process, C/X descriptors copy data between existing buffers in different processes. Each X descriptor in a message has its data copied into a C descriptor on the other side. Each C descriptor in a message is used to reserve space for the other side's X descriptors to copy into.

When the kernel processes X descriptors, it must determine where to copy the data to. If the destination used C descriptors with flags >= 3, each X descriptor from the source is matched to a C descriptor in the destination by the X descriptor's index field. If the destination used a "single" C descriptor, the data from all the X descriptors is copied into the same buffer specified by the destination's C descriptor (causing error 0xce01 if there is not enough space) and the X descriptor index is ignored. The kernel then modifies the addresses in the X descriptors to indicate where the data was copied to in the destination.

Before receiving a request, if the IPC server is expecting X descriptors, it prepares a message with a "single" C descriptor (flags=2) in its message buffer before calling svcReplyAndReceive so that X descriptors from the client have a place to copy their data to. The usage of the flag-2 C descriptor allows the server to receive an arbitrary number of X descriptors, since they're all packed into the same buffer. If the server had used flag-3+ C descriptors, it would be limited in how many X descriptors it could receive since the X descriptors would have to be matched to distinct C descriptors. The buffer that the server's C descriptor points to is called the '''pointer buffer'''.

When the client sends X descriptors, data is copied into the server's pointer buffer. When the client sends C descriptors, no data is copied automatically. The server needs to use X descriptors to copy the data back to the client's C descriptors (using the index field to match X descriptors in the response back to the correct C descriptors).

== Raw data section ==
[[File:Ipc msg buffer type a example.png|thumb|An example of an IPC message with a type 0xA buffer in it. Red is headers/descriptors, yellow is padding, and blue is data/buffer lengths. Note that the size of the u16 array for type A lengths is padded to fill up a whole word.]]

{| class="wikitable" border="1"
! Word || Description
|-
| ... || Padding to align to 16 bytes.
|-
| ... || If sent to an object domain, a [[#Domain_message|domain message]], otherwise a [[#Data payload|data payload]]
|-
| ... || Padding
|-
| ... || Buffer type 0xA lengths (u16 array)
|}

The total amount of padding within the raw data section is always 0x10 bytes. This means that if no padding is required before the message, there will be 0x10 bytes of padding after the message (before the buffer type 0xA lengths).

=== Domains ===
Because the switch has relatively low limits on the total number of sessions available to the system (Kernel slabheap limits, sysmodule handle table size limits), HIPC supports a "Domains" feature that allows multiplexing multiple service sessions through a single handle. Domains store (effectively) a mapping from u32 object id to a SharedPointer<IServiceObject> -- When messages are sent to a domain, an extra header is sent in the raw data section (before anything else) with information about what object in the domain is being acted on; responses similarly contain an additional header. Official session code implements this by just using the dispatch table for the object in the map with the appropriate ID, instead of the dispatch table the session was initialized with.

Format for the extra request header for domain message:
{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 7-0 || Command. 1=send message, 2=close virtual handle
|-
| 0 || 8-15 || Input object count
|-
| 0 || 31-16 || Length of [[IPC_Marshalling#Data_payload|data payload]] in bytes.
|-
| 1 || || Object ID (from cmd 0 in [[IPC_Marshalling#Control|Control]]).
|-
| 2 || || Padding
|-
| 3 || || [1.0.0-4.1.0] Padding [5.0.0+] Token for (NewRequest only)
|-
| 4... || || [[#Data payload|Data payload]]
|-
| ... || || Input object IDs (u32s, not aligned)
|}

Format for the extra response header for domain message:
{| class="wikitable" border="1"
! Word || Bits || Description
|-
| 0 || 31-0 || Output object count
|-
| 1-3 || || Padding
|-
|}

=== Data payload ===
This is an array of u32's, but individual parameters are generally stored as u64's.

{| class="wikitable" border="1"
! Word || Description
|-
| 0 || Magic ("SFCI" for requests, "SFCO" for responses) as u32.
|-
| 1 || Version as u32. 1 for NewRequest, 0 for Request.
|-
| 2 || Command id as u64 for requests, [[Error_codes|error code]] as u64 for responses.
|-
| 3 || [1.0.0-4.1.0] Padding [5.0.0+] Token (for NewRequest only, non-domain messages).
|-
| 4... || Input parameters or return values
|}

[5.0.0+] Version was incremented from 0 to 1, and a token value was introduced into raw_data+12 (regardless of domain or not, in either case it overlaps with padding).

The input rawdata struct is generated by stable-sorting function parameters by alignment, from low to high. It is likely this is a mistake, as it generates structs with suboptimal possible padding -- Nintendo probably meant to sort from high to low (which would give minimized padding), but couldn't/can't change this without breaking backwards compatibility.

== Official marshalling code ==
The official marshalling function is called "nn::sf::hipc::client::Hipc2ClientCoreProcessorImpl::WriteBufferDataImpl" and takes:
* A pointer to a "nn::sf::hipc::detail::HipcMessageWriter" context;
* The number of (buf_ptr, size) pairs;
* An array of (buf_ptr, size) pairs (called "nn::sf::detail::PointerAndSize");
* A pointer to a type bitfield for each such pair;
* The offset of the main IPC command structure;
* The size of the IPC command's [[IPC_Marshalling#Raw_data_section|raw data]].

The type of an IPC command is described by a bitfield as below:
{| class="wikitable" border="1"
! Bits || Name || Description
|-
| 0 || In || Direction is input.
|-
| 1 || Out || Direction is output.
|-
| 2 || HipcMapAlias || Use buffer descriptors A ("Send"), B ("Receive") or W ("Exchange").
|-
| 3 || HipcPointer || Use buffer descriptors X ("Pointer") or C ("ReceiveList").
|-
| 4 || FixedSize || Skip saving the pointer buffer size in raw data.
|-
| 5 || HipcAutoSelect || Select which buffer descriptor to use automatically.
|-
| 6 || HipcMapTransferAllowsNonSecure || Use [[#Flags|NonSecureIpc flag]].
|-
| 7 || HipcMapTransferAllowsNonDevice || Use [[#Flags|NonDeviceIpc flag]].
|}

X and C (Pointer and ReceiveList) descriptors are backed by the "pointer buffer", a buffer in the service process. Its size is a u16, which is retrieved using the "QueryPointerBufferSize" control message. If the client code determines all buffers with flag 8 do not fit in the pointer buffer, it returns error 0x11A0B.

For buffers with flag 0x20 it creates two descriptors (A+X or B+C), but one descriptor is NULL (zero size and pointer), while the other holds the expected values. X/C descriptors are used as the non-NULL descriptor where possible, but if they don't fit in the pointer buffer, A/B descriptors are used instead. The code defers processing of type 0x20 buffers with sizes that fit in a u16 (and may therefore fit in the pointer buffer), which ensures all type 8 buffers get pointer-buffer space before any type 0x20. The order in which the deferred type 0x20 buffers are processed is determined by a convoluted loop.

== Official IPC Cmd Structure ==
Official struct that is stored for each IPC command. It contains precalculated offsets for different portions of the command structure.

All offsets are given is in number of u32 words.

struct IpcCmdStruct {
u8 unk0;
u8 has_handle_descriptor;
u8 pad0[2];
u32 cmd0;
u32 cmd1;
u32 offset_handle_descriptor;
u32 pad1;
u32 offset_handles;
u32 pad2;
u32 offset_x_descriptors;
u32 offset_a_descriptors;
u32 offset_b_descriptors;
u32 offset_w_descriptors; /* this is a guess */
u32 offset_raw_data;
u32 offset_c_descriptors;
u32 unk2;
u32 unk3;
}

== Control ==
When type is [[IPC_Marshalling#Request.2C_Control|Control]], you are talking to the IPC manager. These are processed by the sysmodule.

{| class="wikitable" border="1"
|-
! Cmd || Name || Arguments || Output
|-
| 0 || ConvertCurrentObjectToDomain || None || u32 CmifDomainObjectId
|-
| 1 || CopyFromCurrentDomain || u32 CmifDomainObjectId || u32 NativeHandle
|-
| 2 || CloneCurrentObject || None || u32 NativeHandle
|-
| 3 || QueryPointerBufferSize || None || u16 size
|-
| 4 || CloneCurrentObjectEx || u32 unknown || u32 NativeHandle
|}