Nintendo Switch Brew - User contributions [en]

Fuses

2019-12-04T23:30:38Z

Roblabla: 9.1.0 burned a fuse on retail

The Nintendo Switch makes use of Tegra's fuse driver for a number of operations. This driver is mapped to physical address 0x7000F800 with a total size of 0x400 bytes and exposes several registers for fuse programming.

Registers from 0x7000F800 to 0x7000F800 + 0xFF can be used to directly program the hardware fuse bitmap, while registers from 0x7000F800 + 0x100 (FUSE_CHIP_REG_START_OFFSET) to 0x7000F800 + 0x3FC (FUSE_CHIP_REG_END_OFFSET) represent cached values read from certain fuses.

== Registers ==
Below is a list of fuse driver registers used by the Switch's bootloaders.

=== Driver registers ===
{| class="wikitable" border="1"
! Name
! Address
|-
| [[#FUSE_FUSECTRL|FUSE_FUSECTRL]]
| 0x7000F800
|-
| [[#FUSE_FUSEADDR|FUSE_FUSEADDR]]
| 0x7000F804
|-
| [[#FUSE_FUSERDATA|FUSE_FUSERDATA]]
| 0x7000F808
|-
| [[#FUSE_FUSEWDATA|FUSE_FUSEWDATA]]
| 0x7000F80C
|-
| [[#FUSE_FUSETIME_RD1|FUSE_FUSETIME_RD1]]
| 0x7000F810
|-
| [[#FUSE_FUSETIME_RD2|FUSE_FUSETIME_RD2]]
| 0x7000F814
|-
| [[#FUSE_FUSETIME_PGM1|FUSE_FUSETIME_PGM1]]
| 0x7000F818
|-
| [[#FUSE_FUSETIME_PGM2|FUSE_FUSETIME_PGM2]]
| 0x7000F81C
|-
| [[#FUSE_PRIV2INTFC_START|FUSE_PRIV2INTFC_START]]
| 0x7000F820
|-
| [[#FUSE_FUSEBYPASS|FUSE_FUSEBYPASS]]
| 0x7000F824
|-
| [[#FUSE_PRIVATEKEYDISABLE|FUSE_PRIVATEKEYDISABLE]]
| 0x7000F828
|-
| [[#FUSE_DISABLEREGPROGRAM|FUSE_DISABLEREGPROGRAM]]
| 0x7000F82C
|-
| [[#FUSE_WRITE_ACCESS_SW|FUSE_WRITE_ACCESS_SW]]
| 0x7000F830
|-
| [[#FUSE_PWR_GOOD_SW|FUSE_PWR_GOOD_SW]]
| 0x7000F834
|-
| [[#FUSE_PRIV2RESHIFT|FUSE_PRIV2RESHIFT]]
| 0x7000F83C
|-
| [[#FUSE_FUSETIME_RD3|FUSE_FUSETIME_RD3]]
| 0x7000F84C
|-
| [[#FUSE_PRIVATE_KEY0_NONZERO|FUSE_PRIVATE_KEY0_NONZERO]]
| 0x7000F880
|-
| [[#FUSE_PRIVATE_KEY1_NONZERO|FUSE_PRIVATE_KEY1_NONZERO]]
| 0x7000F884
|-
| [[#FUSE_PRIVATE_KEY2_NONZERO|FUSE_PRIVATE_KEY2_NONZERO]]
| 0x7000F888
|-
| [[#FUSE_PRIVATE_KEY3_NONZERO|FUSE_PRIVATE_KEY3_NONZERO]]
| 0x7000F88C
|-
| [[#FUSE_PRIVATE_KEY4_NONZERO|FUSE_PRIVATE_KEY4_NONZERO]]
| 0x7000F890
|}

==== FUSE_FUSECTRL ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FUSE_FUSECTRL_CMD
0x00: IDLE
0x01: READ
0x02: WRITE
0x03: SENSE_CTRL
|-
| 16-20
| FUSE_FUSECTRL_STATE
0x00: STATE_RESET
0x01: STATE_POST_RESET
0x02: STATE_LOAD_ROW0
0x03: STATE_LOAD_ROW1
0x04: STATE_IDLE
0x05: STATE_READ_SETUP
0x06: STATE_READ_STROBE
0x07: STATE_SAMPLE_FUSES
0x08: STATE_READ_HOLD
0x09: STATE_FUSE_SRC_SETUP
0x0A: STATE_WRITE_SETUP
0x0B: STATE_WRITE_ADDR_SETUP
0x0C: STATE_WRITE_PROGRAM
0x0D: STATE_WRITE_ADDR_HOLD
0x0E: STATE_FUSE_SRC_HOLD
0x0F: STATE_LOAD_RIR
0x10: STATE_READ_BEFORE_WRITE_SETUP
0x11: STATE_READ_DEASSERT_PD
|-
| 21
| FUSE_FUSECTRL_MARGIN_READ
|-
| 22
| FUSE_FUSECTRL_RWL
|-
| 23
| FUSE_FUSECTRL_TRCS
|-
| 24
| FUSE_FUSECTRL_AT1
|-
| 25
| FUSE_FUSECTRL_AT0
|-
| 26
| FUSE_FUSECTRL_PD_CTRL
|-
| 30
| FUSE_FUSECTRL_FUSE_SENSE_DONE
|-
| 31
| FUSE_FUSECTRL_RECORD_SHIFT_DONE
|}

FUSE_FUSECTRL_CMD takes the fuse controller's operation mode. READ and WRITE interact directly with the hardware fuse bitmap while SENSE_CTRL flushes programmed values into the [[Fuses#Cache_registers|cache registers]].

FUSE_FUSECTRL_STATE returns the current state of the fuse controller.

FUSE_FUSECTRL_MARGIN_READ changes the fuse read trip point setting to margin read mode.

FUSE_FUSECTRL_RWL selects the fuse redundancy information row.

FUSE_FUSECTRL_PD_CTRL controls the fuse macro's power down mode.

FUSE_FUSECTRL_FUSE_SENSE_DONE is set if fuse sensing is completed.

FUSE_FUSECTRL_RECORD_SHIFT_DONE is set if ramrepair shift is completed.

==== FUSE_FUSEADDR ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| FUSE_FUSEADDR_VLDFLD
|}

Takes the address of the fuse to be read/written/sensed.

==== FUSE_FUSERDATA ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| FUSE_FUSERDATA_DATA
|}

Returns the value read from the fuse.

==== FUSE_FUSEWDATA ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| FUSE_FUSEWDATA_DATA
|}

Takes the value to be written to the fuse.

==== FUSE_FUSETIME_RD1 ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| FUSE_FUSETIME_RD1_TSUR_MAX
|-
| 8-15
| FUSE_FUSETIME_RD1_TSUR_FUSEOUT
|-
| 16-23
| FUSE_FUSETIME_RD1_THR_MAX
|}

FUSE_FUSETIME_RD1_TSUR_MAX takes the maximum time for [[#FUSE_FUSECTRL|STATE_READ_SETUP]].

FUSE_FUSETIME_RD1_TSUR_FUSEOUT takes the time to spend on [[#FUSE_FUSECTRL|STATE_SAMPLE_FUSES]].

FUSE_FUSETIME_RD1_THR_MAX takes the maximum time for [[#FUSE_FUSECTRL|STATE_READ_HOLD]].

==== FUSE_FUSETIME_RD2 ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| FUSE_FUSETIME_RD2_TWIDTH_RD
|}

Takes the read strobe pulse width used during [[#FUSE_FUSECTRL|STATE_READ_STROBE]].

==== FUSE_FUSETIME_PGM1 ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| FUSE_FUSETIME_PGM1_TSUP_MAX
|-
| 8-15
| FUSE_FUSETIME_PGM1_TSUP_ADDR
|-
| 16-23
| FUSE_FUSETIME_PGM1_THP_ADDR
|-
| 24-31
| FUSE_FUSETIME_PGM1_THP_PS
|}

FUSE_FUSETIME_PGM1_TSUP_MAX takes the maximum time for [[#FUSE_FUSECTRL|STATE_WRITE_SETUP]].

FUSE_FUSETIME_PGM1_TSUP_ADDR takes the time to spend on [[#FUSE_FUSECTRL|STATE_WRITE_ADDR_SETUP]].

FUSE_FUSETIME_PGM1_THP_ADDR takes the time to spend on [[#FUSE_FUSECTRL|STATE_WRITE_ADDR_HOLD]].

FUSE_FUSETIME_PGM1_THP_PS takes the time to spend on [[#FUSE_FUSECTRL|STATE_FUSE_SRC_HOLD]].

==== FUSE_FUSETIME_PGM2 ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| FUSE_FUSETIME_PGM2_TWIDTH_PGM
|-
| 16-23
| FUSE_FUSETIME_PGM2_TSUP_PS
|-
| 24-31
| FUSE_FUSETIME_PGM2_THP_CSPS
|}

FUSE_FUSETIME_PGM2_TWIDTH_PGM takes the program strobe pulse width used during [[#FUSE_FUSECTRL|STATE_WRITE_PROGRAM]].

FUSE_FUSETIME_PGM2_TSUP_PS takes the time to spend on [[#FUSE_FUSECTRL|STATE_FUSE_SRC_SETUP]].

FUSE_FUSETIME_PGM2_THP_CSPS takes the time to spend on [[#FUSE_FUSECTRL|STATE_READ_BEFORE_WRITE_SETUP]].

==== FUSE_PRIV2INTFC_START ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FUSE_PRIV2INTFC_START_DATA
|-
| 1
| FUSE_PRIV2INTFC_SKIP_RECORDS
|}

Controls the interface between the internal fuse chip (INTFC) and the fuse cache registers (PRIV).

==== FUSE_FUSEBYPASS ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FUSE_FUSEBYPASS_VAL
|}

If set, this register enables fuse bypass mode. This is only available in hardware where the [[#Bitmap|production_mode]] fuse remains unburnt.

==== FUSE_PRIVATEKEYDISABLE ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FUSE_PRIVATEKEYDISABLE_VAL
|-
| 4
| FUSE_PRIVATEKEYDISABLE_TZ_STICKY_BIT_VAL
|}

If set, this register hides the [[#Bitmap|private_key]] fuses until the next reset.

==== FUSE_DISABLEREGPROGRAM ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FUSE_DISABLEREGPROGRAM_VAL
|}

If set, this register disables fuse programming until the next reset.

==== FUSE_WRITE_ACCESS_SW ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FUSE_WRITE_ACCESS_SW_CTRL
|-
| 16
| FUSE_WRITE_ACCESS_SW_STATUS
|}

Controls and returns the status of software writes to the fuse cache registers.

==== FUSE_PWR_GOOD_SW ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FUSE_PWR_GOOD_SW_VAL
|}

This register is deprecated and has no effect.

==== FUSE_PRIV2RESHIFT ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FUSE_PRIV2RESHIFT_TRIGENABLE_VAL
|-
| 1
| FUSE_PRIV2RESHIFT_TRIG_1_FCPU0_VAL
|-
| 2
| FUSE_PRIV2RESHIFT_TRIG_1_FCPU1_VAL
|-
| 3
| FUSE_PRIV2RESHIFT_TRIG_1_FCPU2_VAL
|-
| 4
| FUSE_PRIV2RESHIFT_TRIG_1_FCPU3_VAL
|-
| 5
| FUSE_PRIV2RESHIFT_TRIG_1_FL2_TBANK0_VAL
|-
| 6
| FUSE_PRIV2RESHIFT_TRIG_1_FL2_TBANK1_VAL
|-
| 7
| FUSE_PRIV2RESHIFT_TRIG_1_FL2_TBANK2_VAL
|-
| 8
| FUSE_PRIV2RESHIFT_TRIG_1_FL2_TBANK3_VAL
|-
| 9
| FUSE_PRIV2RESHIFT_TRIG_1_SCPU_VAL
|-
| 10
| FUSE_PRIV2RESHIFT_TRIG_1_SL2_TBANK_VAL
|-
| 11
| FUSE_PRIV2RESHIFT_STATUS_1_FCPU0_VAL
|-
| 12
| FUSE_PRIV2RESHIFT_STATUS_1_FCPU1_VAL
|-
| 13
| FUSE_PRIV2RESHIFT_STATUS_1_FCPU2_VAL
|-
| 14
| FUSE_PRIV2RESHIFT_STATUS_1_FCPU3_VAL
|-
| 15
| FUSE_PRIV2RESHIFT_STATUS_1_FL2_TBANK0_VAL
|-
| 16
| FUSE_PRIV2RESHIFT_STATUS_1_FL2_TBANK1_VAL
|-
| 17
| FUSE_PRIV2RESHIFT_STATUS_1_FL2_TBANK2_VAL
|-
| 18
| FUSE_PRIV2RESHIFT_STATUS_1_FL2_TBANK3_VAL
|-
| 19
| FUSE_PRIV2RESHIFT_STATUS_1_SCPU_VAL
|-
| 20
| FUSE_PRIV2RESHIFT_STATUS_1_SL2_TBANK_VAL
|}

Controls and returns the status of the RESHIFT hardware block used in RAM repair.

==== FUSE_FUSETIME_RD3 ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| FUSE_FUSETIME_RD3_TSUR_PDCS
|}

Takes the time to spend on [[#FUSE_FUSECTRL|STATE_READ_DEASSERT_PD]].

==== FUSE_PRIVATE_KEY0_NONZERO ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FUSE_PRIVATE_KEY0_NONZERO_DATA
|}

Returns whether [[#Bitmap|private_key0]] is empty or not.

==== FUSE_PRIVATE_KEY1_NONZERO ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FUSE_PRIVATE_KEY1_NONZERO_DATA
|}

Returns whether [[#Bitmap|private_key1]] is empty or not.

==== FUSE_PRIVATE_KEY2_NONZERO ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FUSE_PRIVATE_KEY2_NONZERO_DATA
|}

Returns whether [[#Bitmap|private_key2]] is empty or not.

==== FUSE_PRIVATE_KEY3_NONZERO ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FUSE_PRIVATE_KEY3_NONZERO_DATA
|}

Returns whether [[#Bitmap|private_key3]] is empty or not.

==== FUSE_PRIVATE_KEY4_NONZERO ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FUSE_PRIVATE_KEY4_NONZERO_DATA
|}

Returns whether [[#Bitmap|private_key4]] is empty or not.

=== Cache registers ===
{| class="wikitable" border="1"
! Name
! Address
|-
| FUSE_PRODUCTION_MODE
| 0x7000F900
|-
| FUSE_JTAG_SECUREID_VALID
| 0x7000F904
|-
| FUSE_ODM_LOCK
| 0x7000F908
|-
| FUSE_OPT_OPENGL_EN
| 0x7000F90C
|-
| [[#FUSE_SKU_INFO|FUSE_SKU_INFO]]
| 0x7000F910
|-
| FUSE_CPU_SPEEDO_0_CALIB
| 0x7000F914
|-
| FUSE_CPU_IDDQ_CALIB
| 0x7000F918
|-
| FUSE_DAC_CRT_CALIB
| 0x7000F91C
|-
| FUSE_DAC_HDTV_CALIB
| 0x7000F920
|-
| FUSE_DAC_SDTV_CALIB
| 0x7000F924
|-
| [[#FUSE_OPT_FT_REV|FUSE_OPT_FT_REV]]
| 0x7000F928
|-
| FUSE_CPU_SPEEDO_1_CALIB
| 0x7000F92C
|-
| FUSE_CPU_SPEEDO_2_CALIB
| 0x7000F930
|-
| FUSE_SOC_SPEEDO_0_CALIB
| 0x7000F934
|-
| [[#FUSE_SOC_SPEEDO_1_CALIB|FUSE_SOC_SPEEDO_1_CALIB]]
| 0x7000F938
|-
| FUSE_SOC_SPEEDO_2_CALIB
| 0x7000F93C
|-
| FUSE_SOC_IDDQ_CALIB
| 0x7000F940
|-
| FUSE_RESERVED_PRODUCTION_WP
| 0x7000F944
|-
| [[#FUSE_FA|FUSE_FA]]
| 0x7000F948
|-
| FUSE_RESERVED_PRODUCTION
| 0x7000F94C
|-
| FUSE_HDMI_LANE0_CALIB
| 0x7000F950
|-
| FUSE_HDMI_LANE1_CALIB
| 0x7000F954
|-
| FUSE_HDMI_LANE2_CALIB
| 0x7000F958
|-
| FUSE_HDMI_LANE3_CALIB
| 0x7000F95C
|-
| FUSE_ENCRYPTION_RATE
| 0x7000F960
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY0]]
| 0x7000F964
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY1]]
| 0x7000F968
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY2]]
| 0x7000F96C
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY3]]
| 0x7000F970
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY4]]
| 0x7000F974
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY5]]
| 0x7000F978
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY6]]
| 0x7000F97C
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY7]]
| 0x7000F980
|-
| FUSE_TSENSOR1_CALIB
| 0x7000F984
|-
| FUSE_TSENSOR2_CALIB
| 0x7000F988
|-
| FUSE_VSENSOR_CALIB
| 0x7000F98C
|-
| [[#FUSE_OPT_CP_REV|FUSE_OPT_CP_REV]]
| 0x7000F990
|-
| FUSE_OPT_PFG
| 0x7000F994
|-
| FUSE_TSENSOR0_CALIB
| 0x7000F998
|-
| FUSE_FIRST_BOOTROM_PATCH_SIZE
| 0x7000F99C
|-
| FUSE_SECURITY_MODE
| 0x7000F9A0
|-
| [[#FUSE_PRIVATE_KEY|FUSE_PRIVATE_KEY0]]
| 0x7000F9A4
|-
| [[#FUSE_PRIVATE_KEY|FUSE_PRIVATE_KEY1]]
| 0x7000F9A8
|-
| [[#FUSE_PRIVATE_KEY|FUSE_PRIVATE_KEY2]]
| 0x7000F9AC
|-
| [[#FUSE_PRIVATE_KEY|FUSE_PRIVATE_KEY3]]
| 0x7000F9B0
|-
| [[#FUSE_PRIVATE_KEY|FUSE_PRIVATE_KEY4]]
| 0x7000F9B4
|-
| FUSE_ARM_JTAG_DIS
| 0x7000F9B8
|-
| FUSE_BOOT_DEVICE_INFO
| 0x7000F9BC
|-
| [[#FUSE_RESERVED_SW|FUSE_RESERVED_SW]]
| 0x7000F9C0
|-
| FUSE_OPT_VP9_DISABLE
| 0x7000F9C4
|-
| [[#FUSE_RESERVED_ODM0|FUSE_RESERVED_ODM0]]
| 0x7000F9C8
|-
| [[#FUSE_RESERVED_ODM1|FUSE_RESERVED_ODM1]]
| 0x7000F9CC
|-
| [[#FUSE_RESERVED_ODM2|FUSE_RESERVED_ODM2]]
| 0x7000F9D0
|-
| [[#FUSE_RESERVED_ODM3|FUSE_RESERVED_ODM3]]
| 0x7000F9D4
|-
| [[#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]]
| 0x7000F9D8
|-
| FUSE_RESERVED_ODM5
| 0x7000F9DC
|-
| [[#FUSE_RESERVED_ODM6|FUSE_RESERVED_ODM6]]
| 0x7000F9E0
|-
| [[#FUSE_RESERVED_ODM7|FUSE_RESERVED_ODM7]]
| 0x7000F9E4
|-
| FUSE_OBS_DIS
| 0x7000F9E8
|-
| FUSE_NOR_INFO
| 0x7000F9EC
|-
| FUSE_USB_CALIB
| 0x7000F9F0
|-
| FUSE_SKU_DIRECT_CONFIG
| 0x7000F9F4
|-
| FUSE_KFUSE_PRIVKEY_CTRL
| 0x7000F9F8
|-
| FUSE_PACKAGE_INFO
| 0x7000F9FC
|-
| FUSE_OPT_VENDOR_CODE
| 0x7000FA00
|-
| FUSE_OPT_FAB_CODE
| 0x7000FA04
|-
| FUSE_OPT_LOT_CODE_0
| 0x7000FA08
|-
| FUSE_OPT_LOT_CODE_1
| 0x7000FA0C
|-
| FUSE_OPT_WAFER_ID
| 0x7000FA10
|-
| FUSE_OPT_X_COORDINATE
| 0x7000FA14
|-
| FUSE_OPT_Y_COORDINATE
| 0x7000FA18
|-
| [[#FUSE_OPT_SEC_DEBUG_EN|FUSE_OPT_SEC_DEBUG_EN]]
| 0x7000FA1C
|-
| FUSE_OPT_OPS_RESERVED
| 0x7000FA20
|-
| FUSE_SATA_CALIB
| 0x7000FA24
|-
| FUSE_GPU_IDDQ_CALIB
| 0x7000FA28
|-
| FUSE_TSENSOR3_CALIB
| 0x7000FA2C
|-
| FUSE_SKU_BOND_OUT_L
| 0x7000FA30
|-
| FUSE_SKU_BOND_OUT_H
| 0x7000FA34
|-
| FUSE_SKU_BOND_OUT_U
| 0x7000FA38
|-
| FUSE_SKU_BOND_OUT_V
| 0x7000FA3C
|-
| FUSE_SKU_BOND_OUT_W
| 0x7000FA40
|-
| FUSE_OPT_SAMPLE_TYPE
| 0x7000FA44
|-
| FUSE_OPT_SUBREVISION
| 0x7000FA48
|-
| FUSE_OPT_SW_RESERVED_0
| 0x7000FA4C
|-
| FUSE_OPT_SW_RESERVED_1
| 0x7000FA50
|-
| FUSE_TSENSOR4_CALIB
| 0x7000FA54
|-
| FUSE_TSENSOR5_CALIB
| 0x7000FA58
|-
| FUSE_TSENSOR6_CALIB
| 0x7000FA5C
|-
| FUSE_TSENSOR7_CALIB
| 0x7000FA60
|-
| [[#FUSE_OPT_PRIV_SEC_EN|FUSE_OPT_PRIV_SEC_EN]]
| 0x7000FA64
|-
| [[#FUSE_PKC_DISABLE|FUSE_PKC_DISABLE]]
| 0x7000FA68
|-
| FUSE_FUSE2TSEC_DEBUG_DISABLE
| 0x7000FA7C
|-
| FUSE_TSENSOR_COMMON
| 0x7000FA80
|-
| FUSE_OPT_CP_BIN
| 0x7000FA84
|-
| FUSE_OPT_GPU_DISABLE
| 0x7000FA88
|-
| FUSE_OPT_FT_BIN
| 0x7000FA8C
|-
| FUSE_OPT_DONE_MAP
| 0x7000FA90
|-
| FUSE_APB2JTAG_DISABLE
| 0x7000FA98
|-
| FUSE_ODM_INFO
| 0x7000FA9C
|-
| FUSE_ARM_CRYPT_DE_FEATURE
| 0x7000FAA8
|-
| FUSE_WOA_SKU_FLAG
| 0x7000FAC0
|-
| FUSE_ECO_RESERVE_1
| 0x7000FAC4
|-
| FUSE_GCPLEX_CONFIG_FUSE
| 0x7000FAC8
|-
| FUSE_PRODUCTION_MONTH
| 0x7000FACC
|-
| FUSE_RAM_REPAIR_INDICATOR
| 0x7000FAD0
|-
| FUSE_TSENSOR9_CALIB
| 0x7000FAD4
|-
| FUSE_VMIN_CALIBRATION
| 0x7000FADC
|-
| FUSE_AGING_SENSOR_CALIBRATION
| 0x7000FAE0
|-
| FUSE_DEBUG_AUTHENTICATION
| 0x7000FAE4
|-
| FUSE_SECURE_PROVISION_INDEX
| 0x7000FAE8
|-
| FUSE_SECURE_PROVISION_INFO
| 0x7000FAEC
|-
| FUSE_OPT_GPU_DISABLE_CP1
| 0x7000FAF0
|-
| FUSE_SPARE_ENDIS
| 0x7000FAF4
|-
| [[#FUSE_ECO_RESERVE_0|FUSE_ECO_RESERVE_0]]
| 0x7000FAF8
|-
| FUSE_RESERVED_CALIB0
| 0x7000FB04
|-
| FUSE_RESERVED_CALIB1
| 0x7000FB08
|-
| FUSE_OPT_GPU_TPC0_DISABLE
| 0x7000FB0C
|-
| FUSE_OPT_GPU_TPC0_DISABLE_CP1
| 0x7000FB10
|-
| FUSE_OPT_CPU_DISABLE
| 0x7000FB14
|-
| FUSE_OPT_CPU_DISABLE_CP1
| 0x7000FB18
|-
| FUSE_TSENSOR10_CALIB
| 0x7000FB1C
|-
| FUSE_TSENSOR10_CALIB_AUX
| 0x7000FB20
|-
| FUSE_OPT_RAM_SVOP_DP
| 0x7000FB24
|-
| FUSE_OPT_RAM_SVOP_PDP
| 0x7000FB28
|-
| FUSE_OPT_RAM_SVOP_REG
| 0x7000FB2C
|-
| FUSE_OPT_RAM_SVOP_SP
| 0x7000FB30
|-
| FUSE_OPT_RAM_SVOP_SMPDP
| 0x7000FB34
|-
| FUSE_OPT_GPU_TPC0_DISABLE_CP2
| 0x7000FB38
|-
| FUSE_OPT_GPU_TPC1_DISABLE
| 0x7000FB3C
|-
| FUSE_OPT_GPU_TPC1_DISABLE_CP1
| 0x7000FB40
|-
| FUSE_OPT_GPU_TPC1_DISABLE_CP2
| 0x7000FB44
|-
| FUSE_OPT_CPU_DISABLE_CP2
| 0x7000FB48
|-
| FUSE_OPT_GPU_DISABLE_CP2
| 0x7000FB4C
|-
| FUSE_USB_CALIB_EXT
| 0x7000FB50
|-
| FUSE_RESERVED_FIELD
| 0x7000FB54
|-
| FUSE_OPT_ECC_EN
| 0x7000FB58
|-
| FUSE_SPARE_REALIGNMENT_REG
| 0x7000FB7C
|-
| FUSE_SPARE_BIT_0
| 0x7000FB80
|-
| FUSE_SPARE_BIT_1
| 0x7000FB84
|-
| [[#FUSE_SPARE_BIT_2|FUSE_SPARE_BIT_2]]
| 0x7000FB88
|-
| [[#FUSE_SPARE_BIT_3|FUSE_SPARE_BIT_3]]
| 0x7000FB8C
|-
| [[#FUSE_SPARE_BIT_4|FUSE_SPARE_BIT_4]]
| 0x7000FB90
|-
| [[#FUSE_SPARE_BIT_5|FUSE_SPARE_BIT_5]]
| 0x7000FB94
|-
| FUSE_SPARE_BIT_6
| 0x7000FB98
|-
| FUSE_SPARE_BIT_7
| 0x7000FB9C
|-
| FUSE_SPARE_BIT_8
| 0x7000FBA0
|-
| FUSE_SPARE_BIT_9
| 0x7000FBA4
|-
| FUSE_SPARE_BIT_10
| 0x7000FBA8
|-
| FUSE_SPARE_BIT_11
| 0x7000FBAC
|-
| FUSE_SPARE_BIT_12
| 0x7000FBB0
|-
| FUSE_SPARE_BIT_13
| 0x7000FBB4
|-
| FUSE_SPARE_BIT_14
| 0x7000FBB8
|-
| FUSE_SPARE_BIT_15
| 0x7000FBBC
|-
| FUSE_SPARE_BIT_16
| 0x7000FBC0
|-
| FUSE_SPARE_BIT_17
| 0x7000FBC4
|-
| FUSE_SPARE_BIT_18
| 0x7000FBC8
|-
| FUSE_SPARE_BIT_19
| 0x7000FBCC
|-
| FUSE_SPARE_BIT_20
| 0x7000FBD0
|-
| FUSE_SPARE_BIT_21
| 0x7000FBD4
|-
| FUSE_SPARE_BIT_22
| 0x7000FBD8
|-
| FUSE_SPARE_BIT_23
| 0x7000FBDC
|-
| FUSE_SPARE_BIT_24
| 0x7000FBE0
|-
| FUSE_SPARE_BIT_25
| 0x7000FBE4
|-
| FUSE_SPARE_BIT_26
| 0x7000FBE8
|-
| FUSE_SPARE_BIT_27
| 0x7000FBEC
|-
| FUSE_SPARE_BIT_28
| 0x7000FBF0
|-
| FUSE_SPARE_BIT_29
| 0x7000FBF4
|-
| FUSE_SPARE_BIT_30
| 0x7000FBF8
|-
| FUSE_SPARE_BIT_31
| 0x7000FBFC
|}

==== FUSE_SKU_INFO ====
Stores the SKU ID (must be 0x83).

==== FUSE_OPT_FT_REV ====
Stores the FT (Final Test) revision.

Original launch units have this value set to 0xA0 (revision 5.0). The first batch of patched units have this value set to 0xC0 (revision 6.0). The second batch of patched units have this value set to 0xE0 (revision 7.0)

==== FUSE_SOC_SPEEDO_1_CALIB ====
Stores the bootrom patch version.

==== FUSE_FA ====
Stores failure analysis mode.

==== FUSE_PUBLIC_KEY ====
Stores the SHA256 hash of the 2048-bit RSA key expected at BCT+0x210.

==== FUSE_OPT_CP_REV ====
Stores the CP (Chip Probing) revision.

Original launch units have this value set to 0xA0 (revision 5.0). Patched units have this value set to 0x103 (revision 8.3).

==== FUSE_PRIVATE_KEY ====
Stores the 160-bit private key (128 bit SBK + 32-bit device key).

Reads to these registers after the SBK is locked out produce all-FF output.

==== FUSE_RESERVED_SW ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| Boot device
|-
| 3
| Skip device selection straps (0 = don't skip; 1 = skip)
|-
| 4
| ENABLE_CHARGER_DETECT
|-
| 5
| ENABLE_WATCHDOG
|-
| 6
| Forced RCM two button mode (0 = Only VOLUME_UP; 1 = VOLUME_UP + HOME)
|-
| 7
| RCM USB controller mode (0 = USB 2.0; 1 = XUSB)
|}

Stores software reserved configuration values.

Original launch units have the RCM USB controller mode set to USB 2.0, while the first batch of patched units have the RCM USB controller mode set to XUSB.

==== FUSE_RESERVED_ODM0 ====
Stores an hardware ID.

==== FUSE_RESERVED_ODM1 ====
Stores an hardware ID.

==== FUSE_RESERVED_ODM2 ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| [5.0.0+] Used as key generation (patched units only)
|}

Stores an hardware ID in original launch units, but in patched units it stores a single value (key generation).

==== FUSE_RESERVED_ODM3 ====
Stores an hardware ID in original launch units, but is empty in patched units.

==== FUSE_RESERVED_ODM4 ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Unit type (0x00 = Retail, 0x03 = Debug)
|-
| 2
| Production flag (0x00 = Prototype, 0x01 = Production)
|-
| [1.0.0-3.0.2] 3-5
[4.0.0+] 3-7
| DRAM ID
|-
| 8
| Development flag (0x00 = Retail, 0x01 = Development)
|-
| 9
| Unit type flag (0x00 = Debug, 0x01 = Retail)
|-
| 10
| [3.0.0+] Kiosk flag (0x00 = Retail, 0x01 = Kiosk/Quest)
|-
| 11
| [5.0.0+] Patch flag (0x00 = Unpatched, 1 = Patched)
|-
| 16-19
| [4.0.0+] New hardware type (0x00 = Icosa, 0x01 = Iowa, 0x02 = Hoag)
|}

Stores some device configuration parameters.

==== FUSE_RESERVED_ODM5 ====
Empty and unused.

==== FUSE_RESERVED_ODM6 ====
Returns the value of the [[#reserved_odm6|reserved_odm6]] anti-downgrade fuse.

==== FUSE_RESERVED_ODM7 ====
Returns the value of the [[#reserved_odm7|reserved_odm7]] anti-downgrade fuse.

==== FUSE_OPT_SEC_DEBUG_EN ====
Controls the [[TSEC#TSEC_SCP_CTL_STAT|Falcon SCP]] debug mode.

==== FUSE_OPT_PRIV_SEC_EN ====
Controls the [[TSEC#FALCON_SCTL|Falcon Light Secure]] feature.

==== FUSE_PKC_DISABLE ====
Returns if public key crypto is used or not.

==== FUSE_ECO_RESERVE_0 ====
Returns the chip unique AID.

==== FUSE_SPARE_BIT_2 ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Speedo fusing revision
|}

==== FUSE_SPARE_BIT_3 ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Speedo fusing revision
|}

==== FUSE_SPARE_BIT_4 ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| Speedo fusing revision
|}

==== FUSE_SPARE_BIT_5 ====
Must be non-zero on retail units, otherwise the first bootloader panics.
On prototype units it can be zero, which tells the bootloader to choose from two pre-production master key seeds. If set to non-zero on a prototype unit, it tells the bootloader to choose from two master key seeds (with the second one being the same as the retail master key seed).

[4.0.0+] This value is no longer used during boot.

== Bitmap ==
The actual hardware fuses are stored in a bitmap and may be programmed through the fuse driver after enabling fuse programming.

Fuse numbers are relative to the start of the fuse bitmap where each element is a 4 byte word and has a redundant alias. A single fuse write operation must always write the same value to '''fuse_bitmap + ((fuse_number + 0) << 2)''' (PRIMARY_ALIAS) and '''fuse_bitmap + ((fuse_number + 1) << 2)''' (REDUNDANT_ALIAS). However, spare bits and all fuses afterwards in the fuse bitmap, no longer have a redundant alias.

Below is a list of common fuses used by Tegra devices (and applicable to the Switch).

{| class="wikitable" border="1"
! Name
! Number
! Redundant number
! Bits
|-
| enable_fuse_program
| 0
| 1
| 0
|-
| disable_fuse_program
| 0
| 1
| 1
|-
| bypass_fuses
| 0
| 1
| 2
|-
| jtag_direct_access_disable
| 0
| 1
| 3
|-
| production_mode
| 0
| 1
| 4
|-
| jtag_secureid_valid
| 0
| 1
| 5
|-
| odm_lock
| 0
| 1
| 6-9
|-
| fa_mode
| 0
| 1
| 10
|-
| security_mode
| 0
| 1
| 11
|-
| arm_debug_dis
| 0
| 1
| 12
|-
| obs_dis
| 0
| 1
| 13
|-
| public_key0
| 10
| 11
| 30-31
|-
| public_key0
| 12
| 13
| 0-29
|-
| public_key1
| 12
| 13
| 30-31
|-
| public_key1
| 14
| 15
| 0-29
|-
| public_key2
| 14
| 15
| 30-31
|-
| public_key2
| 16
| 17
| 0-29
|-
| public_key3
| 16
| 17
| 30-31
|-
| public_key3
| 18
| 19
| 0-29
|-
| public_key4
| 18
| 19
| 30-31
|-
| public_key4
| 20
| 21
| 0-29
|-
| public_key5
| 20
| 21
| 30-31
|-
| public_key5
| 22
| 23
| 0-29
|-
| public_key6
| 22
| 23
| 30-31
|-
| public_key6
| 24
| 25
| 0-29
|-
| public_key7
| 24
| 25
| 30-31
|-
| public_key7
| 26
| 27
| 0-29
|-
| private_key0
| 34
| 35
| 12-31
|-
| private_key0
| 36
| 37
| 0-11
|-
| private_key1
| 36
| 37
| 12-31
|-
| private_key1
| 38
| 39
| 0-11
|-
| private_key2
| 38
| 39
| 12-31
|-
| private_key2
| 40
| 41
| 0-11
|-
| private_key3
| 40
| 41
| 12-31
|-
| private_key3
| 42
| 43
| 0-11
|-
| private_key4
| 42
| 43
| 12-31
|-
| private_key4
| 44
| 45
| 0-11
|-
| boot_device_info
| 44
| 45
| 12-27
|-
| reserved_sw
| 44
| 45
| 28-31
|-
| reserved_sw
| 46
| 47
| 0-3
|-
| reserved_odm0
| 46
| 47
| 5-31
|-
| reserved_odm0
| 48
| 49
| 0-4
|-
| reserved_odm1
| 48
| 49
| 5-31
|-
| reserved_odm1
| 50
| 51
| 0-4
|-
| reserved_odm2
| 50
| 51
| 5-31
|-
| reserved_odm2
| 52
| 53
| 0-4
|-
| reserved_odm3
| 52
| 53
| 5-31
|-
| reserved_odm3
| 54
| 55
| 0-4
|-
| reserved_odm4
| 54
| 55
| 5-31
|-
| reserved_odm4
| 56
| 57
| 0-4
|-
| reserved_odm5
| 56
| 57
| 5-31
|-
| reserved_odm5
| 58
| 59
| 0-4
|-
| [[#reserved_odm6|reserved_odm6]]
| 58
| 59
| 5-31
|-
| [[#reserved_odm6|reserved_odm6]]
| 60
| 61
| 0-4
|-
| [[#reserved_odm7|reserved_odm7]]
| 60
| 61
| 5-31
|-
| [[#reserved_odm7|reserved_odm7]]
| 62
| 63
| 0-4
|-
| kfuse_privkey_ctrl
| 64
| 65
| 13-14
|-
| package_info
| 64
| 65
| 15-18
|-
| opt_vendor_code
| 64
| 65
| 19-22
|-
| opt_fab_code
| 64
| 65
| 23-28
|-
| opt_lot_code_0
| 64
| 65
| 29-31
|-
| opt_lot_code_0
| 66
| 67
| 0-28
|-
| opt_lot_code_1
| 66
| 67
| 29-31
|-
| opt_lot_code_1
| 68
| 69
| 0-24
|-
| opt_wafer_id
| 68
| 69
| 25-30
|-
| opt_x_coordinate
| 68
| 69
| 31
|-
| opt_x_coordinate
| 70
| 71
| 0-7
|-
| opt_y_coordinate
| 70
| 71
| 8-16
|-
| opt_sec_debug_en
| 70
| 71
| 17
|-
| opt_ops_reserved
| 70
| 71
| 18-23
|-
| sata_calib
| 70
| 71
| 24-25
|-
| opt_priv_sec_en
| 90
| 91
| 8
|-
| pkc_disable
| 90
| 91
| 9
|-
| fuse2tsec_debug_disable
| 90
| 91
| 10
|-
| secure_provision_index
| 90
| 91
| 24-27
|-
| secure_provision_info
| 90
| 91
| 28-29
|-
| spare_bit_0
| 100
| None
| 16
|-
| spare_bit_1
| 100
| None
| 17
|-
| spare_bit_2
| 100
| None
| 18
|-
| spare_bit_3
| 100
| None
| 19
|-
| spare_bit_4
| 100
| None
| 20
|-
| spare_bit_5
| 100
| None
| 21
|-
| spare_bit_6
| 100
| None
| 22
|-
| spare_bit_7
| 100
| None
| 23
|-
| spare_bit_8
| 100
| None
| 24
|-
| spare_bit_9
| 100
| None
| 25
|-
| spare_bit_10
| 100
| None
| 26
|-
| spare_bit_11
| 100
| None
| 27
|-
| spare_bit_12
| 100
| None
| 28
|-
| spare_bit_13
| 100
| None
| 29
|-
| spare_bit_14
| 100
| None
| 30
|-
| spare_bit_15
| 100
| None
| 31
|-
| spare_bit_16
| 101
| None
| 16
|-
| spare_bit_17
| 101
| None
| 17
|-
| spare_bit_18
| 101
| None
| 18
|-
| spare_bit_19
| 101
| None
| 19
|-
| spare_bit_20
| 101
| None
| 20
|-
| spare_bit_21
| 101
| None
| 21
|-
| spare_bit_22
| 101
| None
| 22
|-
| spare_bit_23
| 101
| None
| 23
|-
| spare_bit_24
| 101
| None
| 24
|-
| spare_bit_25
| 101
| None
| 25
|-
| spare_bit_26
| 101
| None
| 26
|-
| spare_bit_27
| 101
| None
| 27
|-
| spare_bit_28
| 101
| None
| 28
|-
| spare_bit_29
| 101
| None
| 29
|-
| spare_bit_30
| 101
| None
| 30
|-
| spare_bit_31
| 101
| None
| 31
|-
| aid
| 103
| None
| 2-31
|-
| aid
| 104
| None
| 0-1
|-
| ramrepair_record0
| 106
| None
| 0-31
|-
| ramrepair_record1
| 107
| None
| 0-31
|-
| ramrepair_record2
| 108
| None
| 0-31
|-
| ramrepair_record3
| 109
| None
| 0-31
|-
| ramrepair_record4
| 110
| None
| 0-31
|-
| ramrepair_record5
| 111
| None
| 0-31
|-
| ramrepair_record6
| 112
| None
| 0-31
|-
| ramrepair_record7
| 113
| None
| 0-31
|-
| [[#irom_patch|irom_patch]]
| 114
| None
| Variable
|}

=== reserved_odm6 ===
Used for [[#Anti-downgrade|anti-downgrade]] control.

=== reserved_odm7 ===
Used for [[#Anti-downgrade|anti-downgrade]] control.

=== irom_patch ===
Tegra210 based hardware such as the Switch provides support for bootrom patches. The patch data is burned to the hardware fuse bitmap using a specific format (see [https://gist.github.com/shuffle2/f8728159da100e9df2606d43925de0af shuffle2's ipatch decoder]). The bootrom reads these fuses in order to initialize the IPATCH hardware, which allows overriding data returned for code and data fetches done by BPMP.

The following represents the patch data dumped from a Switch console:
<syntaxhighlight>
RAM:00000000 ; =============== S U B R O U T I N E =======================================
RAM:00000000
RAM:00000000
RAM:00000000 irom_svc_dispatch
RAM:00000000 STMFD SP!, {R0-R2} ; ipatches (new):
RAM:00000000 ; 0 b57df00 16ae df00 : svc #0x00 (offset 0x48)
RAM:00000000 ; 1 1820df22 3040 df22 : svc #0x22 (offset 0x8c)
RAM:00000000 ; 2 3797df26 6f2e df26 : svc #0x26 (offset 0x94)
RAM:00000000 ; 3 3b4d2100 769a 2100 : movs r1, #0x00
RAM:00000000 ; 4 42bdf2c 856 df2c : svc #0x2c (offset 0xa0)
RAM:00000000 ; 5 37aadf42 6f54 df42 : svc #0x42 (offset 0xcc)
RAM:00000000 ; 6 972df4b 12e4 df4b : svc #0x4b (offset 0xde)
RAM:00000000 ; 7 2293df54 4526 df54 : svc #0x54 (offset 0xf0)
RAM:00000000 ; 8 21fadf5d 43f4 df5d : svc #0x5d (offset 0x102)
RAM:00000000 ; 9 bba2ac57 17744 ac57 : data
RAM:00000000 ; 10 bbac3d19 17758 3d19 : data
RAM:00000000 ; 11 1e952001 3d2a 2001 : movs r0, #0x01
RAM:00000000 ;
RAM:00000000 ; ipatches (old):
RAM:00000000 ; 0 b57df00 16ae df00 : svc #0x00 (offset 0x48)
RAM:00000000 ; 1 1820df22 3040 df22 : svc #0x22 (offset 0x8c)
RAM:00000000 ; 2 3797df26 6f2e df26 : svc #0x26 (offset 0x94)
RAM:00000000 ; 3 7d9e2000 fb3c 2000 : movs r0, #0x00
RAM:00000000 ; 4 42bdf2c 856 df2c : svc #0x2c (offset 0xa0)
RAM:00000000 ; 5 37aadf42 6f54 df42 : svc #0x42 (offset 0xcc)
RAM:00000000 ; 6 972df4b 12e4 df4b : svc #0x4b (offset 0xde)
RAM:00000000 ; 7 2293df54 4526 df54 : svc #0x54 (offset 0xf0)
RAM:00000000 ; 8 21fadf5d 43f4 df5d : svc #0x5d (offset 0x102)
RAM:00000000 ; 9 bba2ac57 17744 ac57 : data
RAM:00000000 ; 10 bbac3d19 17758 3d19 : data
RAM:00000000 ; 11 1e952001 3d2a 2001 : movs r0, #0x01
RAM:00000004 MOV R2, LR
RAM:00000008 SUB R2, R2, #2
RAM:0000000C LDR R2, [R2]
RAM:00000010 AND R2, R2, #0xFF
RAM:00000014 MOV R2, R2,LSL#1
RAM:00000018 LDR R0, =0x1007B0
RAM:0000001C LDR R1, =0x1007F8
RAM:00000020 SUB R1, R1, R0
RAM:00000024 LDR R0, =0x40004C30
RAM:00000028 ADD R0, R0, R1
RAM:0000002C ADD R2, R2, R0
RAM:00000030 ORR R2, R2, #1
RAM:00000034 LDMFD SP!, {R0,R1}
RAM:00000038 BX R2
RAM:00000038 ; End of function irom_svc_dispatch
RAM:00000038
RAM:00000038 ; ---------------------------------------------------------------------------
RAM:0000003C dword_3C DCD 0x1007B0 ; DATA XREF: irom_svc_dispatch+18↑r
RAM:00000040 dword_40 DCD 0x1007F8 ; DATA XREF: irom_svc_dispatch+1C↑r
RAM:00000044 dword_44 DCD 0x40004C30 ; DATA XREF: irom_svc_dispatch+24↑r
RAM:00000048 CODE16
RAM:00000048
RAM:00000048 ; =============== S U B R O U T I N E =======================================
RAM:00000048
RAM:00000048
RAM:00000048 sub_48
RAM:00000048 MOVS R2, #0 ; 0 b57df00 16ae df00 : svc #0x00 (offset 0x48)
RAM:0000004A MVNS R2, R2
RAM:0000004C LDR R1, =0x60006410
RAM:0000004E STR R2, [R1,#0x30]
RAM:00000050 STR R2, [R1,#0x38]
RAM:00000052 LDR R1, =0x600060F8
RAM:00000054 STR R2, [R1]
RAM:00000056 STR R2, [R1,#4]
RAM:00000058 LDR R1, =0x60006284
RAM:0000005A STR R2, [R1]
RAM:0000005C STR R2, [R1,#0x18]
RAM:0000005E ADDS R1, #0x80
RAM:00000060 ADDS R1, #0x1C
RAM:00000062 STR R2, [R1]
RAM:00000064 STR R2, [R1,#8]
RAM:00000066 STR R2, [R1,#0x10]
RAM:00000068 ADDS R1, #0x80
RAM:0000006A STR R2, [R1]
RAM:0000006C STR R2, [R1,#4]
RAM:0000006E LDR R1, =0x60006554
RAM:00000070 STR R2, [R1]
RAM:00000072 MOVS R2, #0xA0000000
RAM:00000076 LDR R1, =0x60006148
RAM:00000078 STR R2, [R1]
RAM:0000007A ADDS R1, #0x38 ; '8'
RAM:0000007C STR R2, [R1]
RAM:0000007E MOVS R2, #0xE0000000
RAM:00000082 LDR R1, =0x600066A0
RAM:00000084 STR R2, [R1]
RAM:00000086 MOVS R1, #0
RAM:00000088 MOVS R0, #0xE
RAM:0000008A B pop_r2_mov_pc_lr
RAM:0000008A ; End of function sub_48
RAM:0000008A
RAM:0000008C
RAM:0000008C ; =============== S U B R O U T I N E =======================================
RAM:0000008C
RAM:0000008C
RAM:0000008C sub_8C
RAM:0000008C LDR R0, [R1,#0x18] ; 1 1820df22 3040 df22 : svc #0x22 (offset 0x8c)
RAM:0000008E MOVS R2, #1
RAM:00000090 ORRS R0, R2
RAM:00000092 B pop_r2_mov_pc_lr
RAM:00000092 ; End of function sub_8C
RAM:00000092
RAM:00000094
RAM:00000094 ; =============== S U B R O U T I N E =======================================
RAM:00000094
RAM:00000094
RAM:00000094 sub_94
RAM:00000094 LDR R2, [R4,#0x50] ; 2 3797df26 6f2e df26 : svc #0x26 (offset 0x94)
RAM:00000096 ADDS R2, R2, #2
RAM:00000098 STR R2, [R4,#0x50]
RAM:0000009A SUBS R1, #0x80
RAM:0000009C STR R1, [R4,#0x34]
RAM:0000009E B pop_r2_mov_pc_lr
RAM:0000009E ; End of function sub_94
RAM:0000009E
RAM:000000A0
RAM:000000A0 ; =============== S U B R O U T I N E =======================================
RAM:000000A0
RAM:000000A0
RAM:000000A0 sub_A0
RAM:000000A0
RAM:000000A0 ; FUNCTION CHUNK AT RAM:00000148 SIZE 00000004 BYTES
RAM:000000A0
RAM:000000A0 MOVS R0, #0x70000000 ; 4 42bdf2c 856 df2c : svc #0x2c (offset 0xa0)
RAM:000000A4 LDR R6, =dword_7000EF14
RAM:000000A6 LDR R2, =dword_7000E5B4
RAM:000000A8 LDR R2, [R2]
RAM:000000AA CMP R2, #0
RAM:000000AC BEQ loc_B4
RAM:000000AE LDR R2, [R6]
RAM:000000B0 STR R2, [R0,#8]
RAM:000000B2 B loc_BC
RAM:000000B4 ; ---------------------------------------------------------------------------
RAM:000000B4
RAM:000000B4 loc_B4 ; CODE XREF: sub_A0+C↑j
RAM:000000B4 LDR R2, [R0,#8]
RAM:000000B6 LSRS R0, R0, #0x12
RAM:000000B8 ORRS R2, R0
RAM:000000BA STR R2, [R6]
RAM:000000BC
RAM:000000BC loc_BC ; CODE XREF: sub_A0+12↑j
RAM:000000BC LDR R6, =dword_7000E9C0
RAM:000000BE LDR R0, [R6]
RAM:000000C0 MOVS R2, #0x4000
RAM:000000C4 ORRS R2, R0
RAM:000000C6 STR R2, [R6]
RAM:000000C8 LDR R0, [R5,#0x10]
RAM:000000CA B pop_r2_mov_pc_lr
RAM:000000CA ; End of function sub_A0
RAM:000000CA
RAM:000000CC
RAM:000000CC ; =============== S U B R O U T I N E =======================================
RAM:000000CC
RAM:000000CC
RAM:000000CC sub_CC
RAM:000000CC MOVS R2, #0xF000000 ; 5 37aadf42 6f54 df42 : svc #0x42 (offset 0xcc)
RAM:000000D0 BICS R1, R2
RAM:000000D2 STR R1, [R4,#0x10]
RAM:000000D4 LDR R1, [R4,#0x50]
RAM:000000D6 MOVS R2, #7
RAM:000000D8 BICS R1, R2
RAM:000000DA STR R1, [R4,#0x50]
RAM:000000DC B pop_r2_mov_pc_lr
RAM:000000DC ; End of function sub_CC
RAM:000000DC
RAM:000000DE
RAM:000000DE ; =============== S U B R O U T I N E =======================================
RAM:000000DE
RAM:000000DE
RAM:000000DE sub_DE
RAM:000000DE LDR R2, =dword_7000FA9C ; 6 972df4b 12e4 df4b : svc #0x4b (offset 0xde)
RAM:000000E0 LDR R2, [R2]
RAM:000000E2 LSRS R2, R2, #8
RAM:000000E4 LSLS R2, R2, #1
RAM:000000E6 LDR R1, [R4]
RAM:000000E8 BICS R1, R2
RAM:000000EA STR R1, [R4]
RAM:000000EC CMP R0, #0
RAM:000000EE B pop_r2_mov_pc_lr
RAM:000000EE ; End of function sub_DE
RAM:000000EE
RAM:000000F0
RAM:000000F0 ; =============== S U B R O U T I N E =======================================
RAM:000000F0
RAM:000000F0
RAM:000000F0 sub_F0
RAM:000000F0
RAM:000000F0 arg_0= 0
RAM:000000F0
RAM:000000F0 LDR R0, =0x400049F0 ; 7 2293df54 4526 df54 : svc #0x54 (offset 0xf0)
RAM:000000F2 LDR R2, [R0]
RAM:000000F4 STR R2, [SP,#arg_0]
RAM:000000F6 LDR R0, =0x40010000
RAM:000000F8 LSRS R2, R2, #17
RAM:000000FA BEQ pop_r2_mov_pc_lr ; if ([0x400049F0] >> 17) == 0) {
RAM:000000FA ; r2 = [0x400049F0];
RAM:000000FA ; } else {
RAM:000000FC LDR R0, =APBDEV_PMC_CNTRL_0
RAM:000000FE STR R4, [R0] ; write APBDEV_PMC_CNTRL
RAM:00000100
RAM:00000100 loc_100 ; CODE XREF: sub_F0:loc_100↓j
RAM:00000100 B loc_100 ; hang
RAM:00000100 ; End of function sub_F0 ; }
RAM:00000100
RAM:00000102
RAM:00000102 ; =============== S U B R O U T I N E =======================================
RAM:00000102
RAM:00000102
RAM:00000102 sub_102
RAM:00000102
RAM:00000102 arg_0= 0
RAM:00000102
RAM:00000102 LDR R2, =0x40010220 ; 8 21fadf5d 43f4 df5d : svc #0x5d (offset 0x102)
RAM:00000104 STR R2, [SP,#arg_0] ; set r2 retval = [0x40010220]
RAM:00000106 LDR R2, [R2,#0x18]
RAM:00000108 ADDS R0, #0xFC
RAM:0000010A STR R2, [R0,#0x1C] ; [r0+0x118] = [0x40010220 + 0x18]
RAM:0000010C B pop_r2_mov_pc_lr
RAM:0000010C ; End of function sub_102
RAM:0000010C
RAM:0000010C ; ---------------------------------------------------------------------------
RAM:0000010E DCB 0
RAM:0000010F DCB 0
RAM:00000110 off_110 DCD 0x60006410 ; DATA XREF: sub_48+4↑r
RAM:00000114 off_114 DCD 0x600060F8 ; DATA XREF: sub_48+A↑r
RAM:00000118 off_118 DCD 0x60006284 ; DATA XREF: sub_48+10↑r
RAM:0000011C off_11C DCD 0x60006554 ; DATA XREF: sub_48+26↑r
RAM:00000120 off_120 DCD 0x60006148 ; DATA XREF: sub_48+2E↑r
RAM:00000124 off_124 DCD 0x600066A0 ; DATA XREF: sub_48+3A↑r
RAM:00000128 off_128 DCD dword_7000EF14 ; DATA XREF: sub_A0+4↑r
RAM:0000012C off_12C DCD dword_7000E5B4 ; DATA XREF: sub_A0+6↑r
RAM:00000130 off_130 DCD dword_7000E9C0 ; DATA XREF: sub_A0:loc_BC↑r
RAM:00000134 off_134 DCD dword_7000FA9C ; DATA XREF: sub_DE↑r
RAM:00000138 off_138 DCD 0x400049F0 ; DATA XREF: sub_F0↑r
RAM:0000013C dword_13C DCD 0x40010000 ; DATA XREF: sub_F0+6↑r
RAM:00000140 off_140 DCD APBDEV_PMC_CNTRL_0 ; DATA XREF: sub_F0+C↑r
RAM:00000144 off_144 DCD 0x40010220 ; DATA XREF: sub_102↑r
RAM:00000148 ; ---------------------------------------------------------------------------
RAM:00000148 ; START OF FUNCTION CHUNK FOR sub_A0
RAM:00000148
RAM:00000148 pop_r2_mov_pc_lr ; CODE XREF: sub_48+42↑j
RAM:00000148 ; sub_8C+6↑j ...
RAM:00000148 POP {R2}
RAM:0000014A MOV PC, LR
RAM:0000014A ; END OF FUNCTION CHUNK FOR sub_A0
</syntaxhighlight>

The last 4 patches are exclusive to the Switch, while the remaining ones are often included in most Tegra210 based devices.

==== IROM patch 0 ====
This patch configures clock enables and clock gate overrides for new hardware.

<syntaxhighlight lang="c">
u32 CLK_ENB_H_SET = 0x60006328;
u32 CLK_ENB_L_SET = 0x60006320;
u32 CLK_ENB_U_SET = 0x60006330;
u32 CLK_ENB_V_SET = 0x60006440;
u32 CLK_ENB_W_SET = 0x60006448;
u32 CLK_ENB_X_SET = 0x60006284;
u32 CLK_ENB_Y_SET = 0x6000629C;
u32 LVL2_CLK_GATE_OVRA = 0x600060F8;
u32 LVL2_CLK_GATE_OVRB = 0x600060FC;
u32 LVL2_CLK_GATE_OVRC = 0x600063A0;
u32 LVL2_CLK_GATE_OVRD = 0x600063A4;
u32 LVL2_CLK_GATE_OVRE = 0x60006554;
u32 CLK_SOURCE_VI = 0x60006148;
u32 CLK_SOURCE_HOST1X = 0x60006180;
u32 CLK_SOURCE_NVENC = 0x600066A0;

// Set all clock enables and overrides
*(u32 *)CLK_ENB_V_SET = 0xFFFFFFFF;
*(u32 *)CLK_ENB_W_SET = 0xFFFFFFFF;
*(u32 *)LVL2_CLK_GATE_OVRA = 0xFFFFFFFF;
*(u32 *)LVL2_CLK_GATE_OVRB = 0xFFFFFFFF;
*(u32 *)CLK_ENB_X_SET = 0xFFFFFFFF;
*(u32 *)CLK_ENB_Y_SET = 0xFFFFFFFF;
*(u32 *)CLK_ENB_L_SET = 0xFFFFFFFF;
*(u32 *)CLK_ENB_H_SET = 0xFFFFFFFF;
*(u32 *)CLK_ENB_U_SET = 0xFFFFFFFF;
*(u32 *)LVL2_CLK_GATE_OVRC = 0xFFFFFFFF;
*(u32 *)LVL2_CLK_GATE_OVRD = 0xFFFFFFFF;
*(u32 *)LVL2_CLK_GATE_OVRE = 0xFFFFFFFF;

// Set VI, HOST1X and NVENC clock sources to CLK_M
*(u32 *)CLK_SOURCE_VI = 0xA0000000;
*(u32 *)CLK_SOURCE_HOST1X = 0xA0000000;
*(u32 *)CLK_SOURCE_NVENC = 0xE0000000;

/*
Untranslated instructions:

MOVS R1, #0
MOVS R0, #0xE
*/

return;
</syntaxhighlight>

==== IROM patch 1 ====
This patch is a bugfix.

LP0 resume code expects APBDEV_PMC_SCRATCH190_0 to be set to 0x01, but the bootrom didn't set it.

<syntaxhighlight lang="c">
u32 APBDEV_PMC_SCRATCH190_0 = 0x7000EC18;
u32 pmc_scratch190_val = *(u32 *)APBDEV_PMC_SCRATCH190_0;

return (pmc_scratch190_val | 0x01);
</syntaxhighlight>

==== IROM patch 2 ====
This patch adjusts USB configurations.

<syntaxhighlight lang="c">
u32 USB1_UTMIP_SPARE_CFG0_0 = 0x7D000834;
u32 USB1_UTMIP_BIAS_CFG2_0 = 0x7D000850;

// Increase UTMIP_HSSQUELCH_LEVEL_NEW by 0x02
*(u32 *)USB1_UTMIP_BIAS_CFG2_0 += 0x02;

// Clear FUSE_HS_IREF_CAP_CFG
*(u32 *)USB1_UTMIP_SPARE_CFG0_0 = ((*(u32 *)USB1_UTMIP_SPARE_CFG0_0 & ~(0x118)) - 0x80);

return;
</syntaxhighlight>

==== IROM patch 3 ====
This patch ensures that waiting on PRC_PENDING from the XUSB_DEV register T_XUSB_DEV_XHCI_PORTSC never fails.

In the second batch of patched units ([[#FUSE_OPT_FT_REV|FUSE_OPT_FT_REV]] set to revision 7.0) this patch has been replaced with a fix for [[Switch_System_Flaws#Hardware|CVE-2018-6242]] (arbitrary copy when handling USB control requests in RCM). By setting R1 to 0 at address 0x0010769A in the bootrom, the upper 16 bits of the USB control request's wLength field are cleared out, effectively limiting the request's size to a maximum of 255 bytes.

==== IROM patch 4 ====
This patch allows backing up and restoring strapping options for warmboot.

<syntaxhighlight lang="c">
u32 APBDEV_PMC_SCRATCH0_0 = 0x7000E450;
u32 APBDEV_PMC_RST_STATUS_0 = 0x7000E5B4;
u32 APBDEV_PMC_SEC_DISABLE8_0 = 0x7000E9C0;
u32 APBDEV_PMC_SECURE_SCRATCH111_0 = 0x7000EF14;
u32 APB_MISC_PP_STRAPPING_OPT_A_0 = 0x70000008;

u32 reset_status = *(u32 *)APBDEV_PMC_RST_STATUS_0;

// Check for regular power on
if (reset_status == 0)
{
// Set all buttons in RCM_STRAPS and backup to PMC scratch
*(u32 *)APBDEV_PMC_SECURE_SCRATCH111_0 = (*(u32 *)APB_MISC_PP_STRAPPING_OPT_A_0 | 0x1C00);
}
else
{
// Restore strapping options from PMC scratch
*(u32 *)APB_MISC_PP_STRAPPING_OPT_A_0 = *(u32 *)APBDEV_PMC_SECURE_SCRATCH111_0;
}

// Disable write access to APBDEV_PMC_SECURE_SCRATCH111_0
*(u32 *)APBDEV_PMC_SEC_DISABLE8_0 |= 0x4000;

return *(u32 *)APBDEV_PMC_SCRATCH0_0;
</syntaxhighlight>

==== IROM patch 5 ====
This patch adjusts USB configurations.

<syntaxhighlight lang="c">
u32 USB1_UTMIP_HSRX_CFG0_0 = 0x7D000810;
u32 USB1_UTMIP_BIAS_CFG2_0 = 0x7D000850;

// Clear UTMIP_IDLE_WAIT, UTMIP_ELASTIC_LIMIT and UTMIP_PCOUNT_UPDN_DIV,
// and set UTMIP_IDLE_WAIT to 0x11 and UTMIP_ELASTIC_LIMIT to 0x10
*(u32 *)USB1_UTMIP_HSRX_CFG0_0 = ((*(u32 *)USB1_UTMIP_HSRX_CFG0_0 & ~(0xF8000) + 0x88000 & ~(0x7C00) + 0x4000) & ~(0xF000000));

// Clear UTMIP_HSSQUELCH_LEVEL_NEW
*(u32 *)USB1_UTMIP_BIAS_CFG2_0 &= ~(0x07);

return;
</syntaxhighlight>

==== IROM patch 6 ====
This patch is a factory backdoor.

It allows controlling the debug authentication configuration using a fuse.

<syntaxhighlight lang="c">
u32 FUSE_ODM_INFO = 0x7000FA9C;

u32 odm_info = *(u32 *)FUSE_ODM_INFO;
debug_auth_override_val = ((odm_info >> 0x08) << 0x01);

// Override debug authentication value stored in IRAM
*(u32 *)0x400028E4 &= ~(debug_auth_override_val);

/*
Untranslated instructions:

CMP R0, #0
*/

return;
</syntaxhighlight>

==== IROM patch 7 ====
This patch is a bugfix.

It prevents overflowing IRAM (0x40010000) when copying the warmboot binary from DRAM.

<syntaxhighlight lang="c">
u32 APBDEV_PMC_CNTRL_0 = 0x7000E400;

u32 warmboot_header_addr = 0x400049F0;
u32 warmboot_bin_size = *(u32 *)warmboot_bin_header_addr;

// Invalid warmboot binary size
if (warmboot_size >> 0x11)
{
// Assert MAIN_RST
// 0x40004BF0 comes from R4 and the bootrom doesn't bother to change it
*(u32 *)APBDEV_PMC_CNTRL_0 = 0x40004BF0;

// Deadlock
while(1);
}

/*
Untranslated instructions:

LDR R0, =0x40010000
LDR R2, [warmboot_bin_header_addr]
*/

return;
</syntaxhighlight>

==== IROM patch 8 ====
This patch is a bugfix.

It sets the correct warmboot binary entrypoint address for RSA signature verification, which would be done in DRAM instead of IRAM without this patch.

<syntaxhighlight lang="c">
u32 warmboot_addr_ptr = 0x40010238;
u32 warmboot_entry_addr_ptr = 0x40004C28;

*(u32 *)warmboot_entry_addr_ptr = *(u32 *)warmboot_addr_ptr;

/*
Untranslated instructions:

LDR R2, [warmboot_addr_ptr]
*/

return;
</syntaxhighlight>

==== IROM patches 9 and 10 ====
These patches modify the 256-bit Secure Provisioning AES key with index 0x3A.

==== IROM patch 11 ====
This patch forces the value of [[Security_Engine|SE_TZRAM_SECURITY]] to be 0x01 instead of restoring it from the saved SE context.

== Anti-downgrade ==
The first bootloader verifies [[#FUSE_RESERVED_ODM7|FUSE_RESERVED_ODM7]] to prevent downgrading.
How many fuses are expected to be burnt depends the device's unit type as below.

{| class="wikitable" border="1"
|-
! System version
! Expected number of burnt fuses (retail)
! Expected number of burnt fuses (non-retail)
|-
| 1.0.0
| 1
| 0
|-
| 2.0.0-2.3.0
| 2
| 0
|-
| 3.0.0
| 3
| 1
|-
| 3.0.1-3.0.2
| 4
| 1
|-
| 4.0.0-4.1.0
| 5
| 1
|-
| 5.0.0-5.1.0
| 6
| 1
|-
| 6.0.0-6.1.0
| 7
| 1
|-
| 6.2.0
| 8
| 1
|-
| 7.0.0-8.0.1
| 9
| 1
|-
| 8.1.0
| 10
| 1
|-
| 9.0.0-9.0.1
| 11
| 1
|-
| 9.1.0
| 12
| ?
|}

If too many fuses are burnt the bootloader will panic immediately.

If too few are burnt, the bootloader will enable fuse programming and write the expected value to fuses [[#reserved_odm6|reserved_odm6]] and [[#reserved_odm7|reserved_odm7]]. Afterwards, fuse programming is disabled and the panic value 0x21 is written to PMC_SCRATCH200 register (0x7000EC40). Finally, the watchdog timer is initialized and programmed to force a reset.

On a subsequent boot, after the anti-downgrade fuses are checked again, the PMC_RST_STATUS register (0x7000E5B4) is checked and if set to 0x01 (watchdog reset) the PMC_SCRATCH200 register (0x7000EC40) will be checked for the panic value 0x21.
PMC_RST_STATUS will only be set back to 0 (power on reset) if the fuse count matches the new expected value, otherwise the system will panic.

Kernel

2019-11-18T15:02:22Z

Roblabla: It's a kautoobjectptr oops

= KAutoObject =
Size: 0x10

[5.0.0] Size: 0x20

[6.0.0] Size: 0x30

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || * || Vtable
|-
| 8 || u32 || ReferenceCount
|}

[5.0.0]:
{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || * || Vtable
|-
| 8 || u32 || ReferenceCount
|-
| 0x10 || KLinkedListNode || Intrusive list, links to other instances of the same class (managed by a KObjectAllocator).
|}

[6.0.0]:
{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || * || Vtable
|-
| 8 || u32 || ReferenceCount
|-
| 0x10 || [[#KRedBlackTreeNode]] || Intrusive red-black tree node, replaces the Intrusive list node from previous versions.
|}

= KSynchronizationObject =
Size: 0x28

[5.0.0] Size: 0x38

[6.0.0] Size: 0x48

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KLinkedList]] || ThreadSyncList
|}

= KMutex =
Size: 0x8

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || u64 || OwnerTag
|}

= KRecursiveLock =
Size: 0x18

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KThread]] * || Owner
|-
| 8 || s32 || Count
|}

= KLockedList =
Size: 0x28

[5.0.0]? Size: 0x20

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || u64 || Count
|-
| 8 || [[#KLinkedListNode]] || List
|-
| 0x18 || [[#KMutex]] || Mutex
|-
| 0x20 || u64 || MaxCount
|}

[5.0.0]?:

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLinkedListNode]] || List
|-
| 0x10 || [[#KMutex]] || Mutex
|-
| 0x18 || u64 || MaxCount
|}

= KLinkedListNode =
Size: 0x10

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLinkedListNode]]* || Prev
|-
| 8 || [[#KLinkedListNode]]* || Next
|}

= KLinkedListEntry =
Size: 0x10 + <code>sizeof(T)</code>

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLinkedListNode]] || NodeFor__List
|-
| 0x10 || T || Data
|}

= KLinkedList =
Size: 0x18

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || u64 || Count
|-
| 8 || [[#KLinkedListNode]] || Bounds (first, last)
|}

= KRedBlackTreeNode =
Size: 0x20

Note: This is BSD sys/tree.h's RB_ENTRY(...).

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || KRedBlackTreeNode* || Left Child
|-
| 8 || KRedBlackTreeNode* || Right Child
|-
| 0x10 || KRedBlackTreeNode* || Parent
|-
| 0x18 || int || Color
|}

= KRedBlackTree =
Size: 0x8

Note: This is BSD sys/tree.h's RB_HEAD(..., KRedBlackTreeNode);

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || KRedBlackTreeNode* || Root
|-
|}

= KThread =
[1.0.0] Size: 0x620
[5.0.0]? Size: 0x6C0

Inherits from: [[#KSynchronizationObject]], [[#KSchedulerObject0]], [[#KSchedulerObject1]], [[#KSchedulerObject2]]

<div style="display: inline-block">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || KSchedulerObject0 || Inheritance
|-
| 0x48 || KSchedulerObject1 || Inheritance
|-
| 0x58 || KSchedulerObject2 || Inheritance
|-
| 0x70 || KThreadContext || Context
|-
| 0x2F0 || u64 || CoreMask
|-
| 0x2F8 || u64 || CoreMaskOverride
|-
| 0x300 || u64 || ThreadId
|-
| 0x308 || u64 || TotalTimeRunning
|-
| 0x310 || [[#KSynchronizationObject]]* || SignalledObjectPtr
|-
| 0x318 || u64 ||
|-
| 0x320 || u64 || CondVar_CondVarUserAddr
|-
| 0x328 || u64 || Entrypoint
|-
| 0x330 || u64 || CondVar_MutexUserAddr
|-
| 0x338 || [[#KProcess]]* || ProcessPtr
|-
| 0x340 || void* || KernelThreadStack
|-
| 0x348 || u64 ||
|-
| 0x350 || void* || TlsKernelPtr
|-
| 0x358 || void* || TlsPhysicalPtr
|-
| 0x360 || [[#KSynchronizationObject]]*[0x40] || SyncObjects
|-
| 0x560 || [[#KThread]]* || CondVar_NextThreadPtr
|-
| 0x568 || [[#KThread]]* || CondVar_PrevThreadPtr
|-
| 0x570 || [[#KSynchronizationObject]]* || SignalledObjectPtr?
|-
| 0x578 || KLinkedListNode ||
|-
| 0x588 || KLinkedListNode ||
|-
| 0x598 || KLinkedListNode || NodeFor__ThreadList
|-
| 0x5A8 || KLinkedListNode || NodeFor__ThreadsOnSameCore
|-
| 0x5B8 || [[#KThread]]* ||
|-
| 0x5C0 || [[#KThread]]* || CondVar_SelfPtr
|-
| 0x5C8 || u64 ||
|-
| 0x5D0 || u64 ||
|-
| 0x5D8 || u64 ||
|-
| 0x5E0 || u32 || CondVar_WaitThreadHandle
|-
| 0x5E4 || u32 || SchedulingFlags_Default
|-
| 0x5E8 || u32 || WaitSync_RetVal
|-
| 0x5EC || u32 ||
|-
| 0x5F0 || u32 || ActualPriority
|-
| 0x5F4 || u32 ||
|-
| 0x5F8 || u32 ||
|-
| 0x5FC || u32 ||
|-
| 0x600 || u32 || WantedPriority
|-
| 0x604 || u32 || CpuCore
|-
| 0x608 || u8 || State
|-
| 0x609 || u8 || ShallBeTerminated
|-
| 0x60A || u8 ||
|-
| 0x60B || u8 ||
|-
| 0x60C || u8 ||
|-
| 0x60D || u8 ||
|-
| 0x60E || u8 || HasExited
|-
| 0x60F || u8 || HasCpuCoreOverride
|-
| ... || ... || ...
|}

= KProcess =
[1.0.0] Size: 0x5B0

[2.0.0] Size: 0x2480

[3.0.0] Size: 0x2580

[5.0.0] Size: 0x4600

Inherits from: [[#KSynchronizationObject]]

<div style="display: inline-block">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || KProcessTerminationMessage || Sent to mailbox 0 when self-terminating.
|-
| 0x38 || [[#KMemoryManager]] || MemoryManager
|-
| 0xF0 || u64 || TotalMemUsage
|-
| 0xF8 || [[#KLinkedList]]<[[#KTlsPageManager]]*>> || TlsPagesList
|-
| 0x110 || s32 || DefaultCpuCore
|-
| 0x118 || [[#KDebug]]* || Debug
|-
| 0x120 || [[#KResourceLimit]]* || ResourceLimit
|-
| 0x128 || u32 || State
|-
| 0x130 || [[#KMutex]] || ProcessMutex
|-
| 0x138 || [[#KMutex]] || ThreadingMutex
|-
| 0x140 || [[#KLinkedListNode]]<[[#KThread]] *> || ThreadArbiterList
|-
| 0x150 || KLinkedListNode ||
|-
| 0x160 || u64[4] || RandomEntropy
|-
| 0x180 || u8 || HasStateChanged
|-
| 0x181 || u8 || HasInitialized
|-
| 0x182 || u8 || IsSystem
|-
| 0x183 || u8[12+1] || ProcessName
|-
| 0x190 || u16 || NumberOfCreatedThreads
|-
| 0x192 || u16 || ThreadingRelatedInitiallyZero
|-
| 0x194 || u32 || ProcessFlags
|-
| 0x198 || [[#KProcessCapabilities]] || Capabilities
|-
| 0x248 || u64 || TitleId
|-
| 0x250 || u64 || ProcessId
|-
| 0x258 || u64 || CreatedTickstamp
|-
| 0x260 || u64 || Entrypoint
|-
| 0x268 || u64 || CodeMemUsage
|-
| 0x270 || u64 || DynamicMemUsage
|-
| 0x278 || u64 || MaxTotalMemUsage
|-
| 0x280 || u32 || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x288 || [[#KProcessHandleTable]] || HandleTable
|-
| 0x528 || void* || UsermodeExceptionTlsArea
|-
| 0x530 || [[#KLinkedListNode]]<[[#KThread]] *> || ExceptionThreadList
|-
| 0x540 || [[#KThread]]* || ExceptionThread
|-
| 0x548 || [[#KLinkedListNode]]<[[#KThread]] *> || ThreadList
|-
| 0x558 || bool || HasStarted
|-
| 0x55C || u32 || UnusedZero
|-
| 0x560 || u64[2] || UnusedZeroes
|-
| 0x570 || u64 || TotalTimeRunning
|-
| 0x578 || u64[5] || UnusedZeroes
|-
| 0x5A0 || u64 || UnusedZero
|-
| 0x5A8 || u64 || UnusedZero
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || KProcessTerminationMessage || Sent to mailbox 0 when self-terminating.
|-
| 0x38 || [[#KMemoryManager]] || MemoryManager
|-
| 0x100 || u64 || TotalMemUsage
|-
| 0x108 || [[#KLinkedList]]<[[#KTlsPageManager]]*> || TlsPagesList
|-
| 0x120 || s32 || DefaultCpuCore
|-
| 0x128 || [[#KDebug]]* || Debug
|-
| 0x130 || [[#KResourceLimit]]* || ResourceLimit
|-
| 0x138 || u32 || State
|-
| 0x140 || [[#KMutex]] || ProcessMutex
|-
| 0x148 || [[#KMutex]] || ThreadingMutex
|-
| 0x150 || [[#KLinkedListNode]]<[[#KThread]] *> || ThreadArbiterList
|-
| 0x160 || KLinkedListNode ||
|-
| 0x170 || u64[4] || RandomEntropy
|-
| 0x190 || u8 || HasStateChanged
|-
| 0x191 || u8 || HasInitialized
|-
| 0x192 || u8 || IsSystem
|-
| 0x193 || u8[12+1] || ProcessName
|-
| 0x1A0 || u16 || NumberOfCreatedThreads
|-
| 0x1A2 || u16 || ThreadingRelatedInitiallyZero
|-
| 0x1A4 || u32 || ProcessFlags
|-
| 0x1A8 || [[#KProcessCapabilities]] || Capabilities
|-
| 0x258 || u64 || TitleId
|-
| 0x260 || u64 || ProcessId
|-
| 0x268 || u64 || CreatedTickstamp
|-
| 0x270 || u64 || Entrypoint
|-
| 0x278 || u64 || CodeMemUsage
|-
| 0x280 || u64 || DynamicMemUsage
|-
| 0x288 || u64 || MaxTotalMemUsage
|-
| 0x290 || u32 || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x298 || u64[5] || Unused [?]
|-
| 0x2C0 || [[#KProcessHandleTable]] || HandleTable
|-
| 0x2380 || void* || UsermodeExceptionTlsArea
|-
| 0x2388 || [[#KLinkedListNode]]<[[#KThread]] *> || ExceptionThreadList
|-
| 0x2398 || [[#KThread]]* || ExceptionThread
|-
| 0x23A0 || [[#KLinkedListNode]]<[[#KThread]] *> || ThreadList
|-
| 0x23B0 || [[#KLinkedListNode]]<[[#KSharedMemoryRef]] *> || MappedSharedMemoriesList
|-
| 0x23C0 || bool || HasStarted
|-
| 0x23C1 || bool || HasException
|-
| 0x23C4 || u32 || ExceptionEnum0
|-
| 0x23C8 || u64 || ExceptionEnum1
|-
| 0x23D0 || u64 || ExceptionThreadUnkInfo0
|-
| 0x23D8 || u64 || BreakArg0
|-
| 0x23E0 || u64 || BreakArg1
|-
| 0x23E8 || u64 || BreakArg2
|-
| 0x23F0 || u64 || ExceptionThreadUnkInfo1
|-
| 0x23F8 || u32 || UnusedZero
|-
| 0x2400 || u64[8] || UnusedZeroes
|-
| 0x2440 || u64 || UnusedZero
|-
| 0x2448 || u64 || UnusedZero
|-
| 0x2450 || u64[6] || Unused [?]
|}
</div>

== KTlsPageManager ==
Size: 0x20

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || void* || TlsPagePtr
|-
| 8 || [[#KProcess*]] || ProcessPtr
|-
| 0x10 || u32 || UsageCount
|-
| 0x14 || u8[8] || IsSlotFree
|}

== KProcessCapabilities ==
Size: 0xB0

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || u8[16] || SvcAccessMask
|-
| 0x10 || u8[128] || IrqAccessMask
|-
| 0x90 || u64 || AllowedCpuIdBitmask
|-
| 0x98 || u64 || AllowedThreadPrioBitmask
|-
| 0xA0 || u32 || DebuggingFlags
|-
| 0xA4 || u32 || HandleTableSize
|-
| 0xA8 || u32 || KernelReleaseVersion
|-
| 0xAC || u32 || ApplicationType
|}

== KProcessHandleTable ==
[1.0.0] Size: 0x2A0

[2.0.0] Size: 0x20C0

<div style="display: inline-block">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || [[#KHandleEntry]]* || TablePtr
|-
| 8 || [[#KHandleEntry]]* || NextFreeEntry
|-
| 0x10 || [[#KHandleEntry]][40] || InternalTable
|-
| 0x290 || u16 || Size
|-
| 0x292 || u16 || MaxUsageAtOnce
|-
| 0x294 || u16 || IdCounter
|-
| 0x296 || u16 || NumActiveSlots
|-
| 0x298 || [[#KSpinLock]] || Lock
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || [[#KHandleEntry]]* || TablePtr
|-
| 8 || [[#KHandleEntry]]* || NextFreeEntry
|-
| 0x10 || [[#KHandleEntry]][1024] || InternalTable
|-
| 0x2010 || u16 || Size
|-
| 0x2012 || u16 || MaxUsageAtOnce
|-
| 0x2014 || u16 || IdCounter
|-
| 0x2016 || u16 || NumActiveSlots
|-
| 0x2040 || [[#KSpinLock]] || Lock
|}
</div>

=== KHandleEntry ===
[1.0.0] Size: 0x10

[2.0.0] Size: 8

[5.0.0] Size: 0x10

<div style="display: inline-block">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || u16 || HandleId
|-
| 2 || u8 || ObjectType
|-
| 8 || [[#KAutoObject]]* || Object
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || u16 || HandleId
|-
| 2 || u8 || ObjectType
|-
| 4 || u32 || ObjectCompressedPtr
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 5.0.0 Offset || Type || Description
|-
| 0 || u16 || HandleId
|-
| 2 || u16 || ObjectType
|-
| 8 || [[#KAutoObject]]* || object
|}
</div>

=== KSpinLock ===
[1.0.0] Size: 0x1

[2.0.0] Size: 0x40

<div style="display: inline-block">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || u8 || IsBusy
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || u16 ||
|-
| 0x20 || u16 ||
|}
</div>

== KSharedMemoryRef ==
[2.0.0] Size: 0x40

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLinkedListNode]]<[[#KSharedMemoryRef]] *> || NodeFor__MappedSharedMemoriesList
|-
| 0x10 || [[#KSharedMemory*]] || SharedMem
|-
| 0x18 || u64 || InitiallyZero
|}

= KMemoryManager =
[1.0.0] Size: 0xB8

[2.0.0] Size: 0xC8

[5.0.0] Size: 0xF8?

<div style="display: inline-block">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset
! Type
! Description
|-
| 0 || * || Vtable
|-
| 8 || u64 || AddrSpaceMinAddr
|-
| 0x10 || u64 || AddrSpaceMaxAddr
|-
| 0x18 || u64 || HeapRegionBaseAddr
|-
| 0x20 || u64 || HeapRegionEndAddr
|-
| 0x28 || u64 || HeapCurAddr
|-
| 0x30 || u64 || MapRegionBaseAddr
|-
| 0x38 || u64 || MapRegionEndAddr
|-
| 0x40 || u64 || HeapMaxAllocation
|-
| 0x48 || [[#KMutex]] || Mutex
|-
| 0x50 || [[#KPageTable]] || PageTable
|-
| 0x60 || [[#KMemoryBlockManager]] || MemoryBlockManager
|-
| 0x78 || bool || IsKernel
|-
| 0x79 || bool || IsSystem
|-
| 0x7A || bool || IsAddrSpace36Bit
|-
| 0x7B || bool || HasAslr
|-
| 0x7C || u32 || Is_0x59_If_Cfg12_Bit0_ElseZero
|-
| 0x80 || u32 || Is_0x5A_If_Cfg12_Bit0_ElseZero
|-
| 0x84 || u32 || Is_0x58_If_Cfg12_Bit0_ElseZero
|-
| 0x88 || ||
|-
| 0x90 || ||
|-
| 0x98 || ||
|-
| 0xA0 || u64 || TranslationTableBaseRegister0
|-
| 0xA8 || u64 || TranslationControlRegister
|-
| 0xB0 || u8 || AsidTagValue
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset
! Type
! Description
|-
| 0 || * || Vtable
|-
| 8 || u64 || AddrSpaceMinAddr
|-
| 0x10 || u64 || AddrSpaceMaxAddr
|-
| 0x18 || u64 || HeapRegionBaseAddr
|-
| 0x20 || u64 || HeapRegionEndAddr
|-
| 0x28 || u64 || HeapCurAddr
|-
| 0x30 || u64 || MapRegionBaseAddr
|-
| 0x38 || u64 || MapRegionEndAddr
|-
| 0x40 || u64 || NewMapRegionBaseAddr
|-
| 0x48 || u64 || NewMapRegionEndAddr
|-
| 0x50 || u64 || TlsIoRegionBaseAddr
|-
| 0x58 || u64 || TlsIoRegionEndAddr
|-
| 0x60 || u64 || HeapMaxAllocation
|-
| 0x68 || [[#KMutex]] || Mutex
|-
| 0x70 || [[#KPageTable]] || PageTable
|-
| 0x80 || [[#KMemoryBlockManager]] || MemoryBlockManager
|-
| 0x98 || u32 || AddressSpaceWidth (32/36/39)
|-
| 0x9C || bool || IsKernel
|-
| 0x9D || bool || IsSystem
|-
| 0x9E || bool || HasAslr
|-
| 0xA0 || u32 || PoolPartition
|-
| 0xA4 || u32 || Is_0x5A_If_Cfg12_Bit0_ElseZero
|-
| 0xA8 || u32 || Is_0x59_If_Cfg12_Bit0_ElseZero
|-
| 0xAC || u32 || Is_0x58_If_Cfg12_Bit0_ElseZero
|-
| 0xB0 || u64 || TranslationTableBaseRegister0
|-
| 0xB8 || u64 || TranslationControlRegister
|-
| 0xC0 || u32 || AsidTagValue
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 5.0.0 Offset
! Type
! Description
|-
| 0 || * || Vtable
|-
| 8 || u64 || AddrSpaceMinAddr
|-
| 0x10 || u64 || AddrSpaceMaxAddr
|-
| 0x18 || u64 || HeapRegionBaseAddr
|-
| 0x20 || u64 || HeapRegionEndAddr
|-
| 0x28 || u64 || HeapCurAddr
|-
| 0x30 || u64 || MapRegionBaseAddr
|-
| 0x38 || u64 || MapRegionEndAddr
|-
| 0x40 || u64 || NewMapRegionBaseAddr
|-
| 0x48 || u64 || NewMapRegionEndAddr
|-
| 0x50 || u64 || TlsIoRegionBaseAddr
|-
| 0x58 || u64 || TlsIoRegionEndAddr
|-
| 0x60 || u64 || HeapMaxAllocation
|-
| 0x68 || ||
|-
| 0x70 || ||
|-
| 0x78 || [[#KMutex]] || Mutex
|-
| 0x80 || [[#KPageTable]] || PageTable
|-
| 0x90 || [[#KMemoryBlockManager]] || MemoryBlockManager
|-
| 0xA8 || u32 || ?
|-
| 0xAC || u32 || AddressSpaceWidth (32/36/39)
|-
| 0xB0 || [[#KLinkedList]]? ||
|-
| 0xC8 || ||
|-
| 0xD0 || ||
|-
| 0xD8 || ptr ||
|-
| 0xE0 || u64 || TranslationTableBaseRegister0 val
|-
| 0xE8 || u64 || TranslationControlRegister val
|-
| 0xF0 || u32 || AsidTagValue
|}
</div>

== KPageTable ==
Size: 0x10

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || void* || RawPageTablePtr
|-
| 8 || bool ||
|-
| 0xC || u32 || AddrSpaceSizeInGb
|}

== KMemoryBlockManager ==
Size: 0x18

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KMemoryBlock]]* || MemoryBlockList
|-
| 8 || u64 || MaxAddr
|-
| 0x10 || u64 || MinAddr
|}

== KMemoryBlock ==
Size: 0x40

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KLinkedListNode]]<[[#KMemoryBlock]] *> || NodeFor__MemoryBlockList
|-
| 0x10 || ||
|-
| 0x18 || ||
|-
| 0x20 || u64 || BaseAddress
|-
| 0x28 || u64 || NumOfPages
|-
| 0x30 || u32 || State
|-
| 0x34 || u16 || IpcRefCount [?]
|-
| 0x36 || u16 || DeviceMapRefCount
|-
| 0x38 || u8 || Permission
|-
| 0x39 || u8 || UnkAttribute
|-
| 0x3A || u8 || Attribute
|}

== KMemoryBlockInfo ==
Size: 0x20

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || u64 || BaseAddress
|-
| 8 || u64 || Size
|-
| 0x10 || u32 || State
|-
| 0x14 || u8 || Permission
|-
| 0x15 || u8 || Attribute
|-
| 0x16 || u8 || UnkAttribute
|-
| 0x18 || u16 || IpcRefCount [?]
|-
| 0x1A || u16 || DeviceMapRefCount
|}

= KTransferMemory =
Size: 0x48

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || KMemoryBlockList || Blocks
|-
| 0x28 || [[#KProcess]]* || OwnerProcess
|-
| 0x30 || u64 || BaseAddress
|-
| 0x38 || KMutex || Mutex
|-
| 0x40 || int || Permission
|-
| 0x44 || bool || HasInited
|-
| 0x45 || bool || IsMapped
|}

= KSharedMemory =
[1.0.0] Size: 0x40

[2.0.0] Size: 0x48

Inherits from: [[#KAutoObject]]

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || KMemoryBlockList || Blocks
|-
| 0x28 || [[#KProcess]]* || OwnerProcess
|-
| 0x30 || int || LocalPermission
|-
| 0x34 || int || RemotePermission
|-
| 0x38 || bool || HasInited
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || KMemoryBlockList || Blocks
|-
| 0x28 || [[#KResourceLimit]]* || OwnerResourceLimit
|-
| 0x30 || u64 || OwnerProcessPid
|-
| 0x38 || int || LocalPermission
|-
| 0x3C || int || RemotePermission
|-
| 0x40 || bool || HasInited
|}

</div>

= KJitMemory =
[4.0.0+] Size: 0x58

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x20 || KMemoryBlockList || Blocks
|-
| 0x38 || [[#KProcess]]* || SrcProcessPtr
|-
| 0x40 || u64 || SrcAddr
|-
| 0x48 || [[#KMutex]] || Mutex
|-
| 0x50 || u8 || HasInit
|-
| 0x51 || u8 || HasMappedSlave
|-
| 0x52 || u8 || HasMappedMaster
|}

= KPort =
[1.0.0] Size: 0xA8

[7.0.0] Size: 0x110

Inherits from: [[#KAutoObject]]

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KServerPort]] || ServerSide
|-
| 0x60 || [[#KClientPort]] || ClientSide
|-
| 0x98 || u64 ||
|-
| 0xA0 || bool || HasInited
|-
| 0xA1 || bool || IsLight
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 7.0.0 Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x30 || [[#KServerPort]] || ServerSide
|-
| 0xA0 || [[#KClientPort]] || ClientSide
|-
| 0xF8 || u64 ||
|-
| 0x100 || char* || NamePtr
|-
| 0x108 || bool || HasInited
|-
| 0x109 || bool || IsLight
|}
</div>

== KServerPort ==
Size: 0x50

Inherits from: [[#KSynchronizationObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || [[#KLinkedListNode]] || IncomingConnections
|-
| 0x38 || [[#KLinkedListNode]] || IncomingLightConnections
|-
| 0x48 || [[#KPort]]* || Parent
|}

== KClientPort ==
Size: 0x38

Inherits from: [[#KSynchronizationObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || u32 || NumSessions
|-
| 0x2C || u32 || MaxSessions
|-
| 0x30 || [[#KPort]]* || Parent
|}

= KSession =
Size: 0xB0

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KServerSession]] || ServerSide
|-
| 0x70 || [[#KClientSession]] || ClientSide
|-
| 0xA8 || bool || HasInited
|}

== KServerSession ==
Size: 0x60

Inherits from: [[#KSynchronizationObject]]

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || KLinkedListNode || NodeFor__IncomingConnections
|-
| 0x38 || [[#KSession*]] || Parent
|-
| 0x40 || KLinkedListNode<[[#KSessionRequest]]*> || RequestList
|-
| 0x50 || [[#KSessionRequest]]* || ActiveRequest
|-
| 0x58 || [[#KMutex]] || lock
|}

=== KSessionRequest ===
Size: 0x158

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || KLinkedListNode || NodeFor__RequestList
|-
| 0x20 || [[#KBufferDescriptor]][8] || BufferTable
|-
| 0x120 || [[#KBufferDescriptor]]* || ExternalBufferTable
|-
| 0x128 || u8 || NumSendBuffers
|-
| 0x129 || u8 || NumRecvBuffers
|-
| 0x12A || u8 || NumExchBuffers
|-
| 0x130 || [[#KThread]]* || SenderThread
|-
| 0x138 || u64 || InitiallyZero
|-
| 0x140 || [[#KWritableEvent]]* || ForAsyncEvent
|-
| 0x148 || u64 || CustomCmdbufAddr
|-
| 0x150 || u64 || CustomCmdbufSize
|}

=== KBufferDescriptor ===
Size: 0x20

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || u64 || UserVirtAddr
|-
| 8 || u64 || Size
|-
| 0x10 || u64 ||
|-
| 0x18 || u64 || BufferMemoryState
|-
|}

== KClientSession ==
Size: 0x38

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KSession]]* || Parent
|-
| 0x18 || bool || HasInited
|-
| 0x20 || [[#KClientPort]]* || ParentPort
|-
| 0x28 || ||
|-
| 0x30 || [[#KProcess]]* || CreatorProcess
|}

= KLightSession =
Size: 0xA8

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KLightSessionServer]] || ServerSide
|-
| 0x68 || [[#KLightSessionClient]] || ClientSide
|-
| 0xA0 || bool || HasInited
|}

== KLightServerSession ==
Size: 0x58

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || KLinkedListNode || NodeFor__IncomingLightConnections
|-
| 0x20 || [[#KLightSession]] || Parent
|-
| 0x28 || u64[6] ||
|}

== KLightClientSession ==
Size: 0x38

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KLightSession]]* || Parent
|-
| 0x18 || bool || HasInited
|-
| 0x20 || [[#KClientPort]]* || Port
|-
| 0x28 || ||
|-
| 0x30 || [[#KProcess]]* || CreatorProcess
|}

= KEvent =
Size: 0x70

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KReadableEvent]] || ReadableEvent
|-
| 0x48 || [[#KWritableEvent]] || WritableEvent
|-
| 0x60 || [[#KProcess]]* || Creator
|-
| 0x68 || bool || HasInited
|}

== KReadableEvent ==
Size: 0x38

Inherits from: [[#KSynchronizationEvent]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || bool ||
|-
| 0x30 || [[#KEvent]]* || Parent
|}

== KWritableEvent ==
Size: 0x18

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KEvent]]* || Parent
|}

== KInterruptEvent ==
[1.0.0] Size: 0x50

[2.0.0] Size: 0x48

Inherits from: [[#KReadableEvent]]

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || [[#KReadableEvent]] || Inheritance
|-
| 0x38 || [[#KInterruptReceiver]] || Receiver
|-
| 0x48 || u32 || IrqId (or -1)
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || [[#KReadableEvent]] || Inheritance
|-
| 0x38 || [[#KInterruptReceiver]]* || Receiver
|-
| 0x40 || u32 || IrqId (or -1)
|-
| 0x44 || bool || IsIrqRegistered
|}
</div>

=== KInterruptReceiver ===
[1.0.0] Size: 0x10
[2.0.0] Size: 0x20

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || * || Vtable
|-
| 8 || u64 ||
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || * || Vtable
|-
| 8 || u64 || InitiallyZero
|-
| 0x10 || [[#KInterruptEvent]]* || IrqEventPtr
|-
| 0x18 || s32 || IrqId
|}
</div>

= KDeviceAddressSpace =
Size: 0x70

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KMutex]] || Mutex
|-
| 0x18 || [[#KSmmuManager]] || Manager
|-
| 0x58 || u64 || BaseAddress
|-
| 0x60 || u64 || Size
|-
| 0x68 || bool || HasInited
|}

[1.0.0] It was called KAddressSpace.

== KSmmuManager ==
Size: 0x40

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || u8[4] || PageTableAsids
|-
| 8 || void*[4] || PageDirectories
|-
| 0x28 || u64 || AttachedDevicesMask
|-
| 0x30 || u32 || RegVal32Bit
|-
| 0x34 || u32 || RegVal32BitEmpty
|-
| 0x38 || u32 || RegVal36Bit
|-
| 0x3C || u32 || RegVal36BitEmpty
|}

= KResourceLimit =
Size: 0x68

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || u64[5] || CurrentValue
|-
| 0x38 || u64[5] || LimitValue
|-
| 0x60 || [[#KMutex]] || Mutex
|}

= KPoolManager =
[1.0.0] Size: 0x380

[2.0.0] Size: 0x450

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || [[#KPoolAllocator]][3] || Allocator
|-
| 0x348 || [[#KPoolRefManager]] || RefManager
|-
| 0x368 || u64 || AllocationCounter
|-
| 0x370 || u64 ||
|-
| 0x378 || [[#KMutex]] || Mutex
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || [[#KPoolAllocator]] || Allocator0
|-
| 0x220 || [[#KPartitionInfo]]* || PartitionInfo0
|-
| 0x228 || [[#KPoolAllocator]] || Allocator1
|-
| 0x448 || [[#KPartitionInfo]]* || PartitionInfo1
|}
</div>

== KPoolAllocator ==
[1.0.0] Size: 0x118

[2.0.0] Size: 0x220

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || void* || MemoryBase
|-
| 8 || u64 || MemorySize
|-
| 0x10 || s32 || NumPools
|-
| 0x18 || [[#KPool]][8] || Pools
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || void* || MemoryBase
|-
| 8 || u64 || MemorySize
|-
| 0x10 || [[#KPool]][8] || Pools
|-
| 0x210 || s32 || NumPools
|}
</div>

=== KPool ===
[1.0.0] Size: 0x20

[2.0.0] Size: 0x40

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || KPoolHeader* || FirstFreeChunk
|-
| 8 || u64 ||
|-
| 0x10 || u64 ||
|-
| 0x18 || void* || SingletonTableEntryPtr
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || KPoolHeader* || FirstFreeChunk
|-
| 8 || u64 ||
|-
| 0x10 || u64 ||
|-
| 0x18 || void* || SingletonTableEntryPtr
|-
| 0x20 || [[#KPool]]* || Parent
|-
| 0x30 || u64[2] || DmaProtectionKey
|}
</div>

== KPoolRefManager ==
[1.0.0] Size: 0x20

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KPoolManager]]* || Parent
|-
| 8 || void* || PoolBase
|-
| 0x10 || u64 || MaxPage
|-
| 0x18 || u16* || RefCountTable
|}

= KObjectAllocator =
Size: 0x50
[5.0.0]? Size: 0x48

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLockedList]] || LockedList
|-
| 0x28 || [[#KSlabHeap]] || SlabHeap
|}

= KSlabHeap =
Size: 0x28

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || void* || FreeListHead
|-
| 0x8 || u64 ||
|-
| 0x10 || void* || HeapPtr
|-
| 0x18 || u64 || TotalHeapSize
|-
| 0x20 || u64 || SingleObjectSize
|}

5.0.0 (?):
{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || void* || FreeListHead
|-
| 0x8 || u64 || SingleObjectSize
|-
| 0x10 || void* || HeapPtr
|-
| 0x18 || void* || Start (equal to HeapPtr on init)
|-
| 0x20 || void* || End
|}

= KPageTableAllocator =
Size: 0x30

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || u64 ||
|-
| 0x10 || u16* || RefCountTable
|-
| 0x10 || void* || BaseAddress
|-
| 0x18 || u64 || Size
|-
| 0x20 || u64 ||
|-
| 0x28 || u64 ||
|}

= KIrqManager =
[1.0.0] Size: 0x1608

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KIrqEntry]][32] || Core0Irq
|-
| 0x200 || [[#KIrqEntry]][32] || Core1Irq
|-
| 0x400 || [[#KIrqEntry]][32] || Core2Irq
|-
| 0x600 || [[#KIrqEntry]][32] || Core3Irq
|-
| 0x800 || [[#KIrqEntry]][224] || SharedIrqs
|-
| 0x1600 || [[#KMutex]] || Mutex
|}

== KIrqEntry ==
[1.0.0] Size: 0x10

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KInterruptReceiver]]* || Receiver
|-
| 8 || u8 || State0
|-
| 9 || u8 || State1
|}

= KDebug =
Size: 0x50

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || [[#KLinkedListNode]]<[[#KDebugEvent]]> || EventList
|-
| 0x38 || u32 || Flags
|-
| 0x40 || [[#KProcess]]* || ProcessPtr
|-
| 0x48 || [[#KMutex]] || Mutex
|}

== KDebugEvent ==
Size: 0x60

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLinkedListNode]]<[[#KDebugEvent]] *> || NodeFor__EventList
|-
| 0x10 || u32 || EventType
|-
| 0x14 || u32 || ThreadId
|-
| 0x18 || u32 || Flags
|-
| 0x1C || u16 ||
|-
| 0x1E || bool ||
|-
| 0x20 || ... || ...
|}

= KManagedPort =
Size: 0x28

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLinkedListNode]]<[[#KManagedPort]] *> || NodeFor__ManagedPortList
|-
| 0x10 || char[12] || PortName
|-
| 0x20 || [[#KClientPort]]* || ClientPort
|}

= Slab Information =

The Horizon/NX kernel keeps all objects in slab allocators, that can allocate a fixed amount of each. Attempting to allocate an object when the slab heap is full will result in an error 0xCE01 (Resource Exhaustion).

{| class="wikitable" border="1"
|-
! Object || Slab Count
|-
| KEvent || 600
|-
| KInterruptEvent || 100
|-
| KProcess || 80
|-
| KThread || 700
|-
| KPort || 200
|-
| KSharedMemory || 80
|-
| KTransferMemory || 200
|-
| KDeviceAddressSpace || 300
|-
| KDebug || 4
|-
| KSession || 800
|-
| KLightSession || 100
|-
| KLinkedListEntry<void*> || 17 231
|-
| KLinkedListNode || 4 000
|-
| KMemoryBlock (System) || 20 000
|-
| KMemoryBlock (Other) || 10 000
|-
| KTlsPageManager || 167
|-
| KManagedPort || 7
|-
| KDebugEvent || 704
|-
| KSessionRequest || 1 600
|-
| KResourceLimit || 5
|}

Kernel

2019-11-18T15:01:34Z

Roblabla: KHandleEntry changed to 0x10 bytes in 5.0.0

= KAutoObject =
Size: 0x10

[5.0.0] Size: 0x20

[6.0.0] Size: 0x30

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || * || Vtable
|-
| 8 || u32 || ReferenceCount
|}

[5.0.0]:
{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || * || Vtable
|-
| 8 || u32 || ReferenceCount
|-
| 0x10 || KLinkedListNode || Intrusive list, links to other instances of the same class (managed by a KObjectAllocator).
|}

[6.0.0]:
{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || * || Vtable
|-
| 8 || u32 || ReferenceCount
|-
| 0x10 || [[#KRedBlackTreeNode]] || Intrusive red-black tree node, replaces the Intrusive list node from previous versions.
|}

= KSynchronizationObject =
Size: 0x28

[5.0.0] Size: 0x38

[6.0.0] Size: 0x48

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KLinkedList]] || ThreadSyncList
|}

= KMutex =
Size: 0x8

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || u64 || OwnerTag
|}

= KRecursiveLock =
Size: 0x18

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KThread]] * || Owner
|-
| 8 || s32 || Count
|}

= KLockedList =
Size: 0x28

[5.0.0]? Size: 0x20

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || u64 || Count
|-
| 8 || [[#KLinkedListNode]] || List
|-
| 0x18 || [[#KMutex]] || Mutex
|-
| 0x20 || u64 || MaxCount
|}

[5.0.0]?:

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLinkedListNode]] || List
|-
| 0x10 || [[#KMutex]] || Mutex
|-
| 0x18 || u64 || MaxCount
|}

= KLinkedListNode =
Size: 0x10

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLinkedListNode]]* || Prev
|-
| 8 || [[#KLinkedListNode]]* || Next
|}

= KLinkedListEntry =
Size: 0x10 + <code>sizeof(T)</code>

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLinkedListNode]] || NodeFor__List
|-
| 0x10 || T || Data
|}

= KLinkedList =
Size: 0x18

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || u64 || Count
|-
| 8 || [[#KLinkedListNode]] || Bounds (first, last)
|}

= KRedBlackTreeNode =
Size: 0x20

Note: This is BSD sys/tree.h's RB_ENTRY(...).

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || KRedBlackTreeNode* || Left Child
|-
| 8 || KRedBlackTreeNode* || Right Child
|-
| 0x10 || KRedBlackTreeNode* || Parent
|-
| 0x18 || int || Color
|}

= KRedBlackTree =
Size: 0x8

Note: This is BSD sys/tree.h's RB_HEAD(..., KRedBlackTreeNode);

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || KRedBlackTreeNode* || Root
|-
|}

= KThread =
[1.0.0] Size: 0x620
[5.0.0]? Size: 0x6C0

Inherits from: [[#KSynchronizationObject]], [[#KSchedulerObject0]], [[#KSchedulerObject1]], [[#KSchedulerObject2]]

<div style="display: inline-block">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || KSchedulerObject0 || Inheritance
|-
| 0x48 || KSchedulerObject1 || Inheritance
|-
| 0x58 || KSchedulerObject2 || Inheritance
|-
| 0x70 || KThreadContext || Context
|-
| 0x2F0 || u64 || CoreMask
|-
| 0x2F8 || u64 || CoreMaskOverride
|-
| 0x300 || u64 || ThreadId
|-
| 0x308 || u64 || TotalTimeRunning
|-
| 0x310 || [[#KSynchronizationObject]]* || SignalledObjectPtr
|-
| 0x318 || u64 ||
|-
| 0x320 || u64 || CondVar_CondVarUserAddr
|-
| 0x328 || u64 || Entrypoint
|-
| 0x330 || u64 || CondVar_MutexUserAddr
|-
| 0x338 || [[#KProcess]]* || ProcessPtr
|-
| 0x340 || void* || KernelThreadStack
|-
| 0x348 || u64 ||
|-
| 0x350 || void* || TlsKernelPtr
|-
| 0x358 || void* || TlsPhysicalPtr
|-
| 0x360 || [[#KSynchronizationObject]]*[0x40] || SyncObjects
|-
| 0x560 || [[#KThread]]* || CondVar_NextThreadPtr
|-
| 0x568 || [[#KThread]]* || CondVar_PrevThreadPtr
|-
| 0x570 || [[#KSynchronizationObject]]* || SignalledObjectPtr?
|-
| 0x578 || KLinkedListNode ||
|-
| 0x588 || KLinkedListNode ||
|-
| 0x598 || KLinkedListNode || NodeFor__ThreadList
|-
| 0x5A8 || KLinkedListNode || NodeFor__ThreadsOnSameCore
|-
| 0x5B8 || [[#KThread]]* ||
|-
| 0x5C0 || [[#KThread]]* || CondVar_SelfPtr
|-
| 0x5C8 || u64 ||
|-
| 0x5D0 || u64 ||
|-
| 0x5D8 || u64 ||
|-
| 0x5E0 || u32 || CondVar_WaitThreadHandle
|-
| 0x5E4 || u32 || SchedulingFlags_Default
|-
| 0x5E8 || u32 || WaitSync_RetVal
|-
| 0x5EC || u32 ||
|-
| 0x5F0 || u32 || ActualPriority
|-
| 0x5F4 || u32 ||
|-
| 0x5F8 || u32 ||
|-
| 0x5FC || u32 ||
|-
| 0x600 || u32 || WantedPriority
|-
| 0x604 || u32 || CpuCore
|-
| 0x608 || u8 || State
|-
| 0x609 || u8 || ShallBeTerminated
|-
| 0x60A || u8 ||
|-
| 0x60B || u8 ||
|-
| 0x60C || u8 ||
|-
| 0x60D || u8 ||
|-
| 0x60E || u8 || HasExited
|-
| 0x60F || u8 || HasCpuCoreOverride
|-
| ... || ... || ...
|}

= KProcess =
[1.0.0] Size: 0x5B0

[2.0.0] Size: 0x2480

[3.0.0] Size: 0x2580

[5.0.0] Size: 0x4600

Inherits from: [[#KSynchronizationObject]]

<div style="display: inline-block">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || KProcessTerminationMessage || Sent to mailbox 0 when self-terminating.
|-
| 0x38 || [[#KMemoryManager]] || MemoryManager
|-
| 0xF0 || u64 || TotalMemUsage
|-
| 0xF8 || [[#KLinkedList]]<[[#KTlsPageManager]]*>> || TlsPagesList
|-
| 0x110 || s32 || DefaultCpuCore
|-
| 0x118 || [[#KDebug]]* || Debug
|-
| 0x120 || [[#KResourceLimit]]* || ResourceLimit
|-
| 0x128 || u32 || State
|-
| 0x130 || [[#KMutex]] || ProcessMutex
|-
| 0x138 || [[#KMutex]] || ThreadingMutex
|-
| 0x140 || [[#KLinkedListNode]]<[[#KThread]] *> || ThreadArbiterList
|-
| 0x150 || KLinkedListNode ||
|-
| 0x160 || u64[4] || RandomEntropy
|-
| 0x180 || u8 || HasStateChanged
|-
| 0x181 || u8 || HasInitialized
|-
| 0x182 || u8 || IsSystem
|-
| 0x183 || u8[12+1] || ProcessName
|-
| 0x190 || u16 || NumberOfCreatedThreads
|-
| 0x192 || u16 || ThreadingRelatedInitiallyZero
|-
| 0x194 || u32 || ProcessFlags
|-
| 0x198 || [[#KProcessCapabilities]] || Capabilities
|-
| 0x248 || u64 || TitleId
|-
| 0x250 || u64 || ProcessId
|-
| 0x258 || u64 || CreatedTickstamp
|-
| 0x260 || u64 || Entrypoint
|-
| 0x268 || u64 || CodeMemUsage
|-
| 0x270 || u64 || DynamicMemUsage
|-
| 0x278 || u64 || MaxTotalMemUsage
|-
| 0x280 || u32 || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x288 || [[#KProcessHandleTable]] || HandleTable
|-
| 0x528 || void* || UsermodeExceptionTlsArea
|-
| 0x530 || [[#KLinkedListNode]]<[[#KThread]] *> || ExceptionThreadList
|-
| 0x540 || [[#KThread]]* || ExceptionThread
|-
| 0x548 || [[#KLinkedListNode]]<[[#KThread]] *> || ThreadList
|-
| 0x558 || bool || HasStarted
|-
| 0x55C || u32 || UnusedZero
|-
| 0x560 || u64[2] || UnusedZeroes
|-
| 0x570 || u64 || TotalTimeRunning
|-
| 0x578 || u64[5] || UnusedZeroes
|-
| 0x5A0 || u64 || UnusedZero
|-
| 0x5A8 || u64 || UnusedZero
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || KProcessTerminationMessage || Sent to mailbox 0 when self-terminating.
|-
| 0x38 || [[#KMemoryManager]] || MemoryManager
|-
| 0x100 || u64 || TotalMemUsage
|-
| 0x108 || [[#KLinkedList]]<[[#KTlsPageManager]]*> || TlsPagesList
|-
| 0x120 || s32 || DefaultCpuCore
|-
| 0x128 || [[#KDebug]]* || Debug
|-
| 0x130 || [[#KResourceLimit]]* || ResourceLimit
|-
| 0x138 || u32 || State
|-
| 0x140 || [[#KMutex]] || ProcessMutex
|-
| 0x148 || [[#KMutex]] || ThreadingMutex
|-
| 0x150 || [[#KLinkedListNode]]<[[#KThread]] *> || ThreadArbiterList
|-
| 0x160 || KLinkedListNode ||
|-
| 0x170 || u64[4] || RandomEntropy
|-
| 0x190 || u8 || HasStateChanged
|-
| 0x191 || u8 || HasInitialized
|-
| 0x192 || u8 || IsSystem
|-
| 0x193 || u8[12+1] || ProcessName
|-
| 0x1A0 || u16 || NumberOfCreatedThreads
|-
| 0x1A2 || u16 || ThreadingRelatedInitiallyZero
|-
| 0x1A4 || u32 || ProcessFlags
|-
| 0x1A8 || [[#KProcessCapabilities]] || Capabilities
|-
| 0x258 || u64 || TitleId
|-
| 0x260 || u64 || ProcessId
|-
| 0x268 || u64 || CreatedTickstamp
|-
| 0x270 || u64 || Entrypoint
|-
| 0x278 || u64 || CodeMemUsage
|-
| 0x280 || u64 || DynamicMemUsage
|-
| 0x288 || u64 || MaxTotalMemUsage
|-
| 0x290 || u32 || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x298 || u64[5] || Unused [?]
|-
| 0x2C0 || [[#KProcessHandleTable]] || HandleTable
|-
| 0x2380 || void* || UsermodeExceptionTlsArea
|-
| 0x2388 || [[#KLinkedListNode]]<[[#KThread]] *> || ExceptionThreadList
|-
| 0x2398 || [[#KThread]]* || ExceptionThread
|-
| 0x23A0 || [[#KLinkedListNode]]<[[#KThread]] *> || ThreadList
|-
| 0x23B0 || [[#KLinkedListNode]]<[[#KSharedMemoryRef]] *> || MappedSharedMemoriesList
|-
| 0x23C0 || bool || HasStarted
|-
| 0x23C1 || bool || HasException
|-
| 0x23C4 || u32 || ExceptionEnum0
|-
| 0x23C8 || u64 || ExceptionEnum1
|-
| 0x23D0 || u64 || ExceptionThreadUnkInfo0
|-
| 0x23D8 || u64 || BreakArg0
|-
| 0x23E0 || u64 || BreakArg1
|-
| 0x23E8 || u64 || BreakArg2
|-
| 0x23F0 || u64 || ExceptionThreadUnkInfo1
|-
| 0x23F8 || u32 || UnusedZero
|-
| 0x2400 || u64[8] || UnusedZeroes
|-
| 0x2440 || u64 || UnusedZero
|-
| 0x2448 || u64 || UnusedZero
|-
| 0x2450 || u64[6] || Unused [?]
|}
</div>

== KTlsPageManager ==
Size: 0x20

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || void* || TlsPagePtr
|-
| 8 || [[#KProcess*]] || ProcessPtr
|-
| 0x10 || u32 || UsageCount
|-
| 0x14 || u8[8] || IsSlotFree
|}

== KProcessCapabilities ==
Size: 0xB0

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || u8[16] || SvcAccessMask
|-
| 0x10 || u8[128] || IrqAccessMask
|-
| 0x90 || u64 || AllowedCpuIdBitmask
|-
| 0x98 || u64 || AllowedThreadPrioBitmask
|-
| 0xA0 || u32 || DebuggingFlags
|-
| 0xA4 || u32 || HandleTableSize
|-
| 0xA8 || u32 || KernelReleaseVersion
|-
| 0xAC || u32 || ApplicationType
|}

== KProcessHandleTable ==
[1.0.0] Size: 0x2A0

[2.0.0] Size: 0x20C0

<div style="display: inline-block">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || [[#KHandleEntry]]* || TablePtr
|-
| 8 || [[#KHandleEntry]]* || NextFreeEntry
|-
| 0x10 || [[#KHandleEntry]][40] || InternalTable
|-
| 0x290 || u16 || Size
|-
| 0x292 || u16 || MaxUsageAtOnce
|-
| 0x294 || u16 || IdCounter
|-
| 0x296 || u16 || NumActiveSlots
|-
| 0x298 || [[#KSpinLock]] || Lock
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || [[#KHandleEntry]]* || TablePtr
|-
| 8 || [[#KHandleEntry]]* || NextFreeEntry
|-
| 0x10 || [[#KHandleEntry]][1024] || InternalTable
|-
| 0x2010 || u16 || Size
|-
| 0x2012 || u16 || MaxUsageAtOnce
|-
| 0x2014 || u16 || IdCounter
|-
| 0x2016 || u16 || NumActiveSlots
|-
| 0x2040 || [[#KSpinLock]] || Lock
|}
</div>

=== KHandleEntry ===
[1.0.0] Size: 0x10

[2.0.0] Size: 8

[5.0.0] Size: 0x10

<div style="display: inline-block">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || u16 || HandleId
|-
| 2 || u8 || ObjectType
|-
| 8 || [[#KAutoObject]]* || Object
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || u16 || HandleId
|-
| 2 || u8 || ObjectType
|-
| 4 || u32 || ObjectCompressedPtr
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 5.0.0 Offset || Type || Description
|-
| 0 || u16 || HandleId
|-
| 2 || u16 || ObjectType
|-
| 8 || [[#KAutoObject]] || object
|}
</div>

=== KSpinLock ===
[1.0.0] Size: 0x1

[2.0.0] Size: 0x40

<div style="display: inline-block">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || u8 || IsBusy
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || u16 ||
|-
| 0x20 || u16 ||
|}
</div>

== KSharedMemoryRef ==
[2.0.0] Size: 0x40

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLinkedListNode]]<[[#KSharedMemoryRef]] *> || NodeFor__MappedSharedMemoriesList
|-
| 0x10 || [[#KSharedMemory*]] || SharedMem
|-
| 0x18 || u64 || InitiallyZero
|}

= KMemoryManager =
[1.0.0] Size: 0xB8

[2.0.0] Size: 0xC8

[5.0.0] Size: 0xF8?

<div style="display: inline-block">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset
! Type
! Description
|-
| 0 || * || Vtable
|-
| 8 || u64 || AddrSpaceMinAddr
|-
| 0x10 || u64 || AddrSpaceMaxAddr
|-
| 0x18 || u64 || HeapRegionBaseAddr
|-
| 0x20 || u64 || HeapRegionEndAddr
|-
| 0x28 || u64 || HeapCurAddr
|-
| 0x30 || u64 || MapRegionBaseAddr
|-
| 0x38 || u64 || MapRegionEndAddr
|-
| 0x40 || u64 || HeapMaxAllocation
|-
| 0x48 || [[#KMutex]] || Mutex
|-
| 0x50 || [[#KPageTable]] || PageTable
|-
| 0x60 || [[#KMemoryBlockManager]] || MemoryBlockManager
|-
| 0x78 || bool || IsKernel
|-
| 0x79 || bool || IsSystem
|-
| 0x7A || bool || IsAddrSpace36Bit
|-
| 0x7B || bool || HasAslr
|-
| 0x7C || u32 || Is_0x59_If_Cfg12_Bit0_ElseZero
|-
| 0x80 || u32 || Is_0x5A_If_Cfg12_Bit0_ElseZero
|-
| 0x84 || u32 || Is_0x58_If_Cfg12_Bit0_ElseZero
|-
| 0x88 || ||
|-
| 0x90 || ||
|-
| 0x98 || ||
|-
| 0xA0 || u64 || TranslationTableBaseRegister0
|-
| 0xA8 || u64 || TranslationControlRegister
|-
| 0xB0 || u8 || AsidTagValue
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset
! Type
! Description
|-
| 0 || * || Vtable
|-
| 8 || u64 || AddrSpaceMinAddr
|-
| 0x10 || u64 || AddrSpaceMaxAddr
|-
| 0x18 || u64 || HeapRegionBaseAddr
|-
| 0x20 || u64 || HeapRegionEndAddr
|-
| 0x28 || u64 || HeapCurAddr
|-
| 0x30 || u64 || MapRegionBaseAddr
|-
| 0x38 || u64 || MapRegionEndAddr
|-
| 0x40 || u64 || NewMapRegionBaseAddr
|-
| 0x48 || u64 || NewMapRegionEndAddr
|-
| 0x50 || u64 || TlsIoRegionBaseAddr
|-
| 0x58 || u64 || TlsIoRegionEndAddr
|-
| 0x60 || u64 || HeapMaxAllocation
|-
| 0x68 || [[#KMutex]] || Mutex
|-
| 0x70 || [[#KPageTable]] || PageTable
|-
| 0x80 || [[#KMemoryBlockManager]] || MemoryBlockManager
|-
| 0x98 || u32 || AddressSpaceWidth (32/36/39)
|-
| 0x9C || bool || IsKernel
|-
| 0x9D || bool || IsSystem
|-
| 0x9E || bool || HasAslr
|-
| 0xA0 || u32 || PoolPartition
|-
| 0xA4 || u32 || Is_0x5A_If_Cfg12_Bit0_ElseZero
|-
| 0xA8 || u32 || Is_0x59_If_Cfg12_Bit0_ElseZero
|-
| 0xAC || u32 || Is_0x58_If_Cfg12_Bit0_ElseZero
|-
| 0xB0 || u64 || TranslationTableBaseRegister0
|-
| 0xB8 || u64 || TranslationControlRegister
|-
| 0xC0 || u32 || AsidTagValue
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 5.0.0 Offset
! Type
! Description
|-
| 0 || * || Vtable
|-
| 8 || u64 || AddrSpaceMinAddr
|-
| 0x10 || u64 || AddrSpaceMaxAddr
|-
| 0x18 || u64 || HeapRegionBaseAddr
|-
| 0x20 || u64 || HeapRegionEndAddr
|-
| 0x28 || u64 || HeapCurAddr
|-
| 0x30 || u64 || MapRegionBaseAddr
|-
| 0x38 || u64 || MapRegionEndAddr
|-
| 0x40 || u64 || NewMapRegionBaseAddr
|-
| 0x48 || u64 || NewMapRegionEndAddr
|-
| 0x50 || u64 || TlsIoRegionBaseAddr
|-
| 0x58 || u64 || TlsIoRegionEndAddr
|-
| 0x60 || u64 || HeapMaxAllocation
|-
| 0x68 || ||
|-
| 0x70 || ||
|-
| 0x78 || [[#KMutex]] || Mutex
|-
| 0x80 || [[#KPageTable]] || PageTable
|-
| 0x90 || [[#KMemoryBlockManager]] || MemoryBlockManager
|-
| 0xA8 || u32 || ?
|-
| 0xAC || u32 || AddressSpaceWidth (32/36/39)
|-
| 0xB0 || [[#KLinkedList]]? ||
|-
| 0xC8 || ||
|-
| 0xD0 || ||
|-
| 0xD8 || ptr ||
|-
| 0xE0 || u64 || TranslationTableBaseRegister0 val
|-
| 0xE8 || u64 || TranslationControlRegister val
|-
| 0xF0 || u32 || AsidTagValue
|}
</div>

== KPageTable ==
Size: 0x10

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || void* || RawPageTablePtr
|-
| 8 || bool ||
|-
| 0xC || u32 || AddrSpaceSizeInGb
|}

== KMemoryBlockManager ==
Size: 0x18

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KMemoryBlock]]* || MemoryBlockList
|-
| 8 || u64 || MaxAddr
|-
| 0x10 || u64 || MinAddr
|}

== KMemoryBlock ==
Size: 0x40

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KLinkedListNode]]<[[#KMemoryBlock]] *> || NodeFor__MemoryBlockList
|-
| 0x10 || ||
|-
| 0x18 || ||
|-
| 0x20 || u64 || BaseAddress
|-
| 0x28 || u64 || NumOfPages
|-
| 0x30 || u32 || State
|-
| 0x34 || u16 || IpcRefCount [?]
|-
| 0x36 || u16 || DeviceMapRefCount
|-
| 0x38 || u8 || Permission
|-
| 0x39 || u8 || UnkAttribute
|-
| 0x3A || u8 || Attribute
|}

== KMemoryBlockInfo ==
Size: 0x20

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || u64 || BaseAddress
|-
| 8 || u64 || Size
|-
| 0x10 || u32 || State
|-
| 0x14 || u8 || Permission
|-
| 0x15 || u8 || Attribute
|-
| 0x16 || u8 || UnkAttribute
|-
| 0x18 || u16 || IpcRefCount [?]
|-
| 0x1A || u16 || DeviceMapRefCount
|}

= KTransferMemory =
Size: 0x48

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || KMemoryBlockList || Blocks
|-
| 0x28 || [[#KProcess]]* || OwnerProcess
|-
| 0x30 || u64 || BaseAddress
|-
| 0x38 || KMutex || Mutex
|-
| 0x40 || int || Permission
|-
| 0x44 || bool || HasInited
|-
| 0x45 || bool || IsMapped
|}

= KSharedMemory =
[1.0.0] Size: 0x40

[2.0.0] Size: 0x48

Inherits from: [[#KAutoObject]]

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || KMemoryBlockList || Blocks
|-
| 0x28 || [[#KProcess]]* || OwnerProcess
|-
| 0x30 || int || LocalPermission
|-
| 0x34 || int || RemotePermission
|-
| 0x38 || bool || HasInited
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || KMemoryBlockList || Blocks
|-
| 0x28 || [[#KResourceLimit]]* || OwnerResourceLimit
|-
| 0x30 || u64 || OwnerProcessPid
|-
| 0x38 || int || LocalPermission
|-
| 0x3C || int || RemotePermission
|-
| 0x40 || bool || HasInited
|}

</div>

= KJitMemory =
[4.0.0+] Size: 0x58

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x20 || KMemoryBlockList || Blocks
|-
| 0x38 || [[#KProcess]]* || SrcProcessPtr
|-
| 0x40 || u64 || SrcAddr
|-
| 0x48 || [[#KMutex]] || Mutex
|-
| 0x50 || u8 || HasInit
|-
| 0x51 || u8 || HasMappedSlave
|-
| 0x52 || u8 || HasMappedMaster
|}

= KPort =
[1.0.0] Size: 0xA8

[7.0.0] Size: 0x110

Inherits from: [[#KAutoObject]]

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KServerPort]] || ServerSide
|-
| 0x60 || [[#KClientPort]] || ClientSide
|-
| 0x98 || u64 ||
|-
| 0xA0 || bool || HasInited
|-
| 0xA1 || bool || IsLight
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 7.0.0 Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x30 || [[#KServerPort]] || ServerSide
|-
| 0xA0 || [[#KClientPort]] || ClientSide
|-
| 0xF8 || u64 ||
|-
| 0x100 || char* || NamePtr
|-
| 0x108 || bool || HasInited
|-
| 0x109 || bool || IsLight
|}
</div>

== KServerPort ==
Size: 0x50

Inherits from: [[#KSynchronizationObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || [[#KLinkedListNode]] || IncomingConnections
|-
| 0x38 || [[#KLinkedListNode]] || IncomingLightConnections
|-
| 0x48 || [[#KPort]]* || Parent
|}

== KClientPort ==
Size: 0x38

Inherits from: [[#KSynchronizationObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || u32 || NumSessions
|-
| 0x2C || u32 || MaxSessions
|-
| 0x30 || [[#KPort]]* || Parent
|}

= KSession =
Size: 0xB0

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KServerSession]] || ServerSide
|-
| 0x70 || [[#KClientSession]] || ClientSide
|-
| 0xA8 || bool || HasInited
|}

== KServerSession ==
Size: 0x60

Inherits from: [[#KSynchronizationObject]]

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || KLinkedListNode || NodeFor__IncomingConnections
|-
| 0x38 || [[#KSession*]] || Parent
|-
| 0x40 || KLinkedListNode<[[#KSessionRequest]]*> || RequestList
|-
| 0x50 || [[#KSessionRequest]]* || ActiveRequest
|-
| 0x58 || [[#KMutex]] || lock
|}

=== KSessionRequest ===
Size: 0x158

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || KLinkedListNode || NodeFor__RequestList
|-
| 0x20 || [[#KBufferDescriptor]][8] || BufferTable
|-
| 0x120 || [[#KBufferDescriptor]]* || ExternalBufferTable
|-
| 0x128 || u8 || NumSendBuffers
|-
| 0x129 || u8 || NumRecvBuffers
|-
| 0x12A || u8 || NumExchBuffers
|-
| 0x130 || [[#KThread]]* || SenderThread
|-
| 0x138 || u64 || InitiallyZero
|-
| 0x140 || [[#KWritableEvent]]* || ForAsyncEvent
|-
| 0x148 || u64 || CustomCmdbufAddr
|-
| 0x150 || u64 || CustomCmdbufSize
|}

=== KBufferDescriptor ===
Size: 0x20

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || u64 || UserVirtAddr
|-
| 8 || u64 || Size
|-
| 0x10 || u64 ||
|-
| 0x18 || u64 || BufferMemoryState
|-
|}

== KClientSession ==
Size: 0x38

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KSession]]* || Parent
|-
| 0x18 || bool || HasInited
|-
| 0x20 || [[#KClientPort]]* || ParentPort
|-
| 0x28 || ||
|-
| 0x30 || [[#KProcess]]* || CreatorProcess
|}

= KLightSession =
Size: 0xA8

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KLightSessionServer]] || ServerSide
|-
| 0x68 || [[#KLightSessionClient]] || ClientSide
|-
| 0xA0 || bool || HasInited
|}

== KLightServerSession ==
Size: 0x58

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || KLinkedListNode || NodeFor__IncomingLightConnections
|-
| 0x20 || [[#KLightSession]] || Parent
|-
| 0x28 || u64[6] ||
|}

== KLightClientSession ==
Size: 0x38

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KLightSession]]* || Parent
|-
| 0x18 || bool || HasInited
|-
| 0x20 || [[#KClientPort]]* || Port
|-
| 0x28 || ||
|-
| 0x30 || [[#KProcess]]* || CreatorProcess
|}

= KEvent =
Size: 0x70

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KReadableEvent]] || ReadableEvent
|-
| 0x48 || [[#KWritableEvent]] || WritableEvent
|-
| 0x60 || [[#KProcess]]* || Creator
|-
| 0x68 || bool || HasInited
|}

== KReadableEvent ==
Size: 0x38

Inherits from: [[#KSynchronizationEvent]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || bool ||
|-
| 0x30 || [[#KEvent]]* || Parent
|}

== KWritableEvent ==
Size: 0x18

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KEvent]]* || Parent
|}

== KInterruptEvent ==
[1.0.0] Size: 0x50

[2.0.0] Size: 0x48

Inherits from: [[#KReadableEvent]]

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || [[#KReadableEvent]] || Inheritance
|-
| 0x38 || [[#KInterruptReceiver]] || Receiver
|-
| 0x48 || u32 || IrqId (or -1)
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || [[#KReadableEvent]] || Inheritance
|-
| 0x38 || [[#KInterruptReceiver]]* || Receiver
|-
| 0x40 || u32 || IrqId (or -1)
|-
| 0x44 || bool || IsIrqRegistered
|}
</div>

=== KInterruptReceiver ===
[1.0.0] Size: 0x10
[2.0.0] Size: 0x20

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || * || Vtable
|-
| 8 || u64 ||
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || * || Vtable
|-
| 8 || u64 || InitiallyZero
|-
| 0x10 || [[#KInterruptEvent]]* || IrqEventPtr
|-
| 0x18 || s32 || IrqId
|}
</div>

= KDeviceAddressSpace =
Size: 0x70

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || [[#KMutex]] || Mutex
|-
| 0x18 || [[#KSmmuManager]] || Manager
|-
| 0x58 || u64 || BaseAddress
|-
| 0x60 || u64 || Size
|-
| 0x68 || bool || HasInited
|}

[1.0.0] It was called KAddressSpace.

== KSmmuManager ==
Size: 0x40

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || u8[4] || PageTableAsids
|-
| 8 || void*[4] || PageDirectories
|-
| 0x28 || u64 || AttachedDevicesMask
|-
| 0x30 || u32 || RegVal32Bit
|-
| 0x34 || u32 || RegVal32BitEmpty
|-
| 0x38 || u32 || RegVal36Bit
|-
| 0x3C || u32 || RegVal36BitEmpty
|}

= KResourceLimit =
Size: 0x68

Inherits from: [[#KAutoObject]]

{| class="wikitable" border="1"
|-
! Offset
! Type
! Description
|-
| 0 || [[#KAutoObject]] || Inheritance
|-
| 0x10 || u64[5] || CurrentValue
|-
| 0x38 || u64[5] || LimitValue
|-
| 0x60 || [[#KMutex]] || Mutex
|}

= KPoolManager =
[1.0.0] Size: 0x380

[2.0.0] Size: 0x450

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || [[#KPoolAllocator]][3] || Allocator
|-
| 0x348 || [[#KPoolRefManager]] || RefManager
|-
| 0x368 || u64 || AllocationCounter
|-
| 0x370 || u64 ||
|-
| 0x378 || [[#KMutex]] || Mutex
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || [[#KPoolAllocator]] || Allocator0
|-
| 0x220 || [[#KPartitionInfo]]* || PartitionInfo0
|-
| 0x228 || [[#KPoolAllocator]] || Allocator1
|-
| 0x448 || [[#KPartitionInfo]]* || PartitionInfo1
|}
</div>

== KPoolAllocator ==
[1.0.0] Size: 0x118

[2.0.0] Size: 0x220

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || void* || MemoryBase
|-
| 8 || u64 || MemorySize
|-
| 0x10 || s32 || NumPools
|-
| 0x18 || [[#KPool]][8] || Pools
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || void* || MemoryBase
|-
| 8 || u64 || MemorySize
|-
| 0x10 || [[#KPool]][8] || Pools
|-
| 0x210 || s32 || NumPools
|}
</div>

=== KPool ===
[1.0.0] Size: 0x20

[2.0.0] Size: 0x40

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! 1.0.0 Offset || Type || Description
|-
| 0 || KPoolHeader* || FirstFreeChunk
|-
| 8 || u64 ||
|-
| 0x10 || u64 ||
|-
| 0x18 || void* || SingletonTableEntryPtr
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! 2.0.0 Offset || Type || Description
|-
| 0 || KPoolHeader* || FirstFreeChunk
|-
| 8 || u64 ||
|-
| 0x10 || u64 ||
|-
| 0x18 || void* || SingletonTableEntryPtr
|-
| 0x20 || [[#KPool]]* || Parent
|-
| 0x30 || u64[2] || DmaProtectionKey
|}
</div>

== KPoolRefManager ==
[1.0.0] Size: 0x20

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KPoolManager]]* || Parent
|-
| 8 || void* || PoolBase
|-
| 0x10 || u64 || MaxPage
|-
| 0x18 || u16* || RefCountTable
|}

= KObjectAllocator =
Size: 0x50
[5.0.0]? Size: 0x48

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLockedList]] || LockedList
|-
| 0x28 || [[#KSlabHeap]] || SlabHeap
|}

= KSlabHeap =
Size: 0x28

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || void* || FreeListHead
|-
| 0x8 || u64 ||
|-
| 0x10 || void* || HeapPtr
|-
| 0x18 || u64 || TotalHeapSize
|-
| 0x20 || u64 || SingleObjectSize
|}

5.0.0 (?):
{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || void* || FreeListHead
|-
| 0x8 || u64 || SingleObjectSize
|-
| 0x10 || void* || HeapPtr
|-
| 0x18 || void* || Start (equal to HeapPtr on init)
|-
| 0x20 || void* || End
|}

= KPageTableAllocator =
Size: 0x30

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || u64 ||
|-
| 0x10 || u16* || RefCountTable
|-
| 0x10 || void* || BaseAddress
|-
| 0x18 || u64 || Size
|-
| 0x20 || u64 ||
|-
| 0x28 || u64 ||
|}

= KIrqManager =
[1.0.0] Size: 0x1608

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KIrqEntry]][32] || Core0Irq
|-
| 0x200 || [[#KIrqEntry]][32] || Core1Irq
|-
| 0x400 || [[#KIrqEntry]][32] || Core2Irq
|-
| 0x600 || [[#KIrqEntry]][32] || Core3Irq
|-
| 0x800 || [[#KIrqEntry]][224] || SharedIrqs
|-
| 0x1600 || [[#KMutex]] || Mutex
|}

== KIrqEntry ==
[1.0.0] Size: 0x10

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KInterruptReceiver]]* || Receiver
|-
| 8 || u8 || State0
|-
| 9 || u8 || State1
|}

= KDebug =
Size: 0x50

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KSynchronizationObject]] || Inheritance
|-
| 0x28 || [[#KLinkedListNode]]<[[#KDebugEvent]]> || EventList
|-
| 0x38 || u32 || Flags
|-
| 0x40 || [[#KProcess]]* || ProcessPtr
|-
| 0x48 || [[#KMutex]] || Mutex
|}

== KDebugEvent ==
Size: 0x60

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLinkedListNode]]<[[#KDebugEvent]] *> || NodeFor__EventList
|-
| 0x10 || u32 || EventType
|-
| 0x14 || u32 || ThreadId
|-
| 0x18 || u32 || Flags
|-
| 0x1C || u16 ||
|-
| 0x1E || bool ||
|-
| 0x20 || ... || ...
|}

= KManagedPort =
Size: 0x28

{| class="wikitable" border="1"
|-
! Offset || Type || Description
|-
| 0 || [[#KLinkedListNode]]<[[#KManagedPort]] *> || NodeFor__ManagedPortList
|-
| 0x10 || char[12] || PortName
|-
| 0x20 || [[#KClientPort]]* || ClientPort
|}

= Slab Information =

The Horizon/NX kernel keeps all objects in slab allocators, that can allocate a fixed amount of each. Attempting to allocate an object when the slab heap is full will result in an error 0xCE01 (Resource Exhaustion).

{| class="wikitable" border="1"
|-
! Object || Slab Count
|-
| KEvent || 600
|-
| KInterruptEvent || 100
|-
| KProcess || 80
|-
| KThread || 700
|-
| KPort || 200
|-
| KSharedMemory || 80
|-
| KTransferMemory || 200
|-
| KDeviceAddressSpace || 300
|-
| KDebug || 4
|-
| KSession || 800
|-
| KLightSession || 100
|-
| KLinkedListEntry<void*> || 17 231
|-
| KLinkedListNode || 4 000
|-
| KMemoryBlock (System) || 20 000
|-
| KMemoryBlock (Other) || 10 000
|-
| KTlsPageManager || 167
|-
| KManagedPort || 7
|-
| KDebugEvent || 704
|-
| KSessionRequest || 1 600
|-
| KResourceLimit || 5
|}

SVC

2019-10-30T15:33:46Z

Roblabla: svcContinueDebugEvent: 1.0.0-2.3.0 32-bit register info.

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || [[#svcSignalEvent]] || W0=wevent_handle || W0=result
|-
| 0x12 || [[#svcClearEvent]] || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || [[#svcResetSignal]] || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=baseaddr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
R0=debug_handle, R1=[[#ContinueDebugFlagsOld]], R2=thread_id_lower32, R3=thread_id_upper32

[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || [[#svcGetProcessList]] || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value
R0=reslimit_handle, R1=[[#LimitableResource]], R2=value_lower32, R3=value_upper32
|| W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args
R0=smc_sub_id, R1, R2, R3=smc_args
|| X0,X1,X2,X3,X4,X5,X6,X7=result
R0,R1,R2,R3=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to OutAddr.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

=== Result codes ===

'''0x0:''' Success. The memory region was reprotected.

'''0xCC01:''' Unaligned address specified.

'''0xCA01:''' Unaligned or zero size specified.

'''0xD401:''' The provided memory region does not fall within the userland address space.

'''0xD801:''' Invalid permission specified. Valid permissions are ---, r-- and rw-.

'''0xD401:''' The provided memory region was in an invalid state. The region must have the PermissionChangeAllowed bit set in its [[#MemoryState]], and must not have the IsBorrowed or IsUncached [[#MemoryAttribute]].

'''0xCE01:''' Kernel resource exhausted.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcSignalEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Puts the given event in the signaled state.

Will wake up any thread currently waiting on this event. Can potentially trigger a reschedule.

Any calls to [[#svcWaitSynchronization]] on this handle will return immediately, until the event's signaled state is reset.

=== Result codes ===

'''0x0:''' Success. Event is now in signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a WritableEvent.

== svcClearEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent or ReadableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Takes the given event out of the signaled state.

=== Result codes ===

'''0x0:''' Success, the event is now in the not-signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a ReadableEvent nor a WritableEvent.

'''0xFA01:''' The handle was not in a signaled state.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcResetSignal ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<ReadableEvent> or Handle<Process> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Resets the signal on the given handle, ensuring future calls to [[#svcWaitSynchronization]] on this handle will sleep until the handle is signaled again. If the handle is a ReadableEvent, this is equivalent to calling svcClearEvent() on the handle.

If the handle is a Process, it will clear the signaled state (which is set when the process changes [[#ProcessState]]. Once the process enters the Exited state, calling svcResetSignal on the process will no longer have an effect (the process is permanently signaled), and the syscall will return 0xFA01.

=== Result codes ===

'''0x0:''' Success. The signal was reset.

'''0xE401:''' The handle is invalid or of the wrong type.

'''0xFA01:''' The handle was not signaled, or the process is in exited state, causing it to be permanently signaled.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Process || 23 || 0 || [9.0.0+]
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || BaseAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

'''Description:''' Query the physical address of a virtual address. Will always fetch the lowest page-aligned mapping that contains the provided physical address.

The returned BaseAddr is the virtual address of that page-aligned mapping, while PhysAddr is the physical address of that page. Size is the amount of continuous physical memory in that mapping.

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! [1.0.0-2.3.0] Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Debug> || DebugHandle
|-
| (In) W1 || R1 || [[#ContinueDebugFlagsOld]] || DebugFlags
|-
| (In) X2 || R2, R3 || u64 || ThreadId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! [3.0.0+] Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Debug> || DebugHandle
|-
| (In) W1 || R1 || [[#ContinueDebugFlags]] || DebugFlags
|-
| (In) X2 || R2 || u64* || ThreadIdList
|-
| (In) X3 || R3 || size_t || NumTids (max 64 - 0 means "all threads")
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetProcessList ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || u64* || PidBuffer
|-
| (In) X2 || R2 || size_t || PidBufferSize
|-
| (Out) X0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || size_t || NumProcesses
|}
</div>

'''Description:''' Fills the provided array with the pids of currently living processes. A process "lives" so long as it is currently running or a handle to it still exists.

It returns the total number of processes currently alive. If this number is bigger than the size of PidBuffer, the user won't have all the pids.

=== Result codes ===

'''0x0:''' Success.

'''0xd401:''' The provided buffer is outside the process address space.

'''0xe601:''' copyToUser failed. The provided buffer is not user-accessible.

'''0xee01:''' The provided buffer size is too big. Max value is 0xFFFFFFF.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || R1-R3 || u64 || SMC sub-arguments
|-
| (Out) X0 || R0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || R1-R3 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description || Meaning
|-
| 7-0 || Type ||
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]] ||
|-
| 9 || ForceReadWritableByDebugSyscalls || Allows using [[#svcWriteDebugProcessMemory]] on segments mapped read-only.
|-
| 10 || IpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=0.
|-
| 11 || NonDeviceIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=1.
|-
| 12 || NonSecureIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=3.
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]] ||
|-
| 15 || [[#svcMapMemory|MapAllowed]] ||
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]] ||
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]] ||
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]] ||
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]]) ||
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]] ||
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]] ||
|-
| 22 || IsPoolAllocated/IsReferenceCounted || The physical memory blocks backing this region are refcounted.
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]] ||
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]] ||
|-
| 25 || [4.0.0+] [[#svcCreateCodeMemory|CodeMemoryAllowed]] ||
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-10-30T15:22:06Z

Roblabla: Add detailed information about svcGetProcessList.

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || [[#svcSignalEvent]] || W0=wevent_handle || W0=result
|-
| 0x12 || [[#svcClearEvent]] || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || [[#svcResetSignal]] || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=baseaddr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || [[#svcGetProcessList]] || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value
R0=reslimit_handle, R1=[[#LimitableResource]], R2=value_lower32, R3=value_upper32
|| W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args
R0=smc_sub_id, R1, R2, R3=smc_args
|| X0,X1,X2,X3,X4,X5,X6,X7=result
R0,R1,R2,R3=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to OutAddr.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

=== Result codes ===

'''0x0:''' Success. The memory region was reprotected.

'''0xCC01:''' Unaligned address specified.

'''0xCA01:''' Unaligned or zero size specified.

'''0xD401:''' The provided memory region does not fall within the userland address space.

'''0xD801:''' Invalid permission specified. Valid permissions are ---, r-- and rw-.

'''0xD401:''' The provided memory region was in an invalid state. The region must have the PermissionChangeAllowed bit set in its [[#MemoryState]], and must not have the IsBorrowed or IsUncached [[#MemoryAttribute]].

'''0xCE01:''' Kernel resource exhausted.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcSignalEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Puts the given event in the signaled state.

Will wake up any thread currently waiting on this event. Can potentially trigger a reschedule.

Any calls to [[#svcWaitSynchronization]] on this handle will return immediately, until the event's signaled state is reset.

=== Result codes ===

'''0x0:''' Success. Event is now in signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a WritableEvent.

== svcClearEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent or ReadableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Takes the given event out of the signaled state.

=== Result codes ===

'''0x0:''' Success, the event is now in the not-signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a ReadableEvent nor a WritableEvent.

'''0xFA01:''' The handle was not in a signaled state.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcResetSignal ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<ReadableEvent> or Handle<Process> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Resets the signal on the given handle, ensuring future calls to [[#svcWaitSynchronization]] on this handle will sleep until the handle is signaled again. If the handle is a ReadableEvent, this is equivalent to calling svcClearEvent() on the handle.

If the handle is a Process, it will clear the signaled state (which is set when the process changes [[#ProcessState]]. Once the process enters the Exited state, calling svcResetSignal on the process will no longer have an effect (the process is permanently signaled), and the syscall will return 0xFA01.

=== Result codes ===

'''0x0:''' Success. The signal was reset.

'''0xE401:''' The handle is invalid or of the wrong type.

'''0xFA01:''' The handle was not signaled, or the process is in exited state, causing it to be permanently signaled.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Process || 23 || 0 || [9.0.0+]
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || BaseAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

'''Description:''' Query the physical address of a virtual address. Will always fetch the lowest page-aligned mapping that contains the provided physical address.

The returned BaseAddr is the virtual address of that page-aligned mapping, while PhysAddr is the physical address of that page. Size is the amount of continuous physical memory in that mapping.

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetProcessList ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || u64* || PidBuffer
|-
| (In) X2 || R2 || size_t || PidBufferSize
|-
| (Out) X0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || size_t || NumProcesses
|}
</div>

'''Description:''' Fills the provided array with the pids of currently living processes. A process "lives" so long as it is currently running or a handle to it still exists.

It returns the total number of processes currently alive. If this number is bigger than the size of PidBuffer, the user won't have all the pids.

=== Result codes ===

'''0x0:''' Success.

'''0xd401:''' The provided buffer is outside the process address space.

'''0xe601:''' copyToUser failed. The provided buffer is not user-accessible.

'''0xee01:''' The provided buffer size is too big. Max value is 0xFFFFFFF.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || R1-R3 || u64 || SMC sub-arguments
|-
| (Out) X0 || R0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || R1-R3 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description || Meaning
|-
| 7-0 || Type ||
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]] ||
|-
| 9 || ForceReadWritableByDebugSyscalls || Allows using [[#svcWriteDebugProcessMemory]] on segments mapped read-only.
|-
| 10 || IpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=0.
|-
| 11 || NonDeviceIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=1.
|-
| 12 || NonSecureIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=3.
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]] ||
|-
| 15 || [[#svcMapMemory|MapAllowed]] ||
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]] ||
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]] ||
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]] ||
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]]) ||
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]] ||
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]] ||
|-
| 22 || IsPoolAllocated/IsReferenceCounted || The physical memory blocks backing this region are refcounted.
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]] ||
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]] ||
|-
| 25 || [4.0.0+] [[#svcCreateCodeMemory|CodeMemoryAllowed]] ||
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

Main Page/Navigation

2019-10-12T08:55:46Z

Roblabla: Add link to test pads

{{Main page box|Navigation|:Navigation}}
<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="33%" | '''General'''
! width="33%" | '''Homebrew'''
! width="33%" | '''Switch Hardware'''
|- valign="top" style="background: #F5FAFF;"
|
*[[Product Information]]
|
*[[Setting up Development Environment]]
*[[Homebrew Exploits]]
*[[Homebrew Applications]]
*[[Switch System Flaws]]
*[[Switch Userland Flaws]]
|
*[[Hardware|Overview]]
*[[Joy-Con]]
*[[Cartridge]]
*[[Dock]]
*[[Testpads|Mainboard Testpads]]
|}
</div>

<div style="margin: -.3em -1em -1em -1em; margin-top: +1em">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- align="center" bgcolor="#e7eef6"
! width="33%" | '''Switch Operating System'''
! width="33%" | '''Switch Software Stack'''
! width="33%" | '''Switch Content'''
|- valign="top" style="background: #F5FAFF;"
|
*[[SVC|System calls]]
*[[Services API]]
*[[IPC Marshalling]]
*[[Memory layout]]
*[[Error codes]]
|
*[[Title list]]
*[[Nintendo Software]]
*[[Recovery Mode]]
*[[System Versions]]
|
*[[Online Multiplayer]]
*[[SD Filesystem]]
*[[Flash Filesystem]]
*[[Domains]]
|}
</div>
{{box-footer-empty}}

Fuses

2019-10-07T17:44:44Z

Roblabla:

The Nintendo Switch makes use of Tegra's fuse driver for a number of operations. This driver is mapped to physical address 0x7000F800 with a total size of 0x400 bytes and exposes several registers for fuse programming.

Registers from 0x7000F800 to 0x7000F800 + 0xFF can be used to directly program the hardware fuse bitmap, while registers from 0x7000F800 + 0x100 (FUSE_CHIP_REG_START_OFFSET) to 0x7000F800 + 0x3FC (FUSE_CHIP_REG_END_OFFSET) represent cached values read from certain fuses.

== Registers ==
Below is a list of fuse driver registers used by the Switch's bootloaders.

=== Driver registers ===
{| class="wikitable" border="1"
! Name
! Address
|-
| [[#FUSE_FUSECTRL|FUSE_FUSECTRL]]
| 0x7000F800
|-
| [[#FUSE_FUSEADDR|FUSE_FUSEADDR]]
| 0x7000F804
|-
| [[#FUSE_FUSERDATA|FUSE_FUSERDATA]]
| 0x7000F808
|-
| [[#FUSE_FUSEWDATA|FUSE_FUSEWDATA]]
| 0x7000F80C
|-
| FUSE_FUSETIME_RD1
| 0x7000F810
|-
| FUSE_FUSETIME_RD2
| 0x7000F814
|-
| FUSE_FUSETIME_PGM1
| 0x7000F818
|-
| [[#FUSE_FUSETIME_PGM2|FUSE_FUSETIME_PGM2]]
| 0x7000F81C
|-
| [[#FUSE_PRIV2INTFC_START|FUSE_PRIV2INTFC_START]]
| 0x7000F820
|-
| FUSE_FUSEBYPASS
| 0x7000F824
|-
| FUSE_PRIVATEKEYDISABLE
| 0x7000F828
|-
| [[#FUSE_DISABLEREGPROGRAM|FUSE_DISABLEREGPROGRAM]]
| 0x7000F82C
|-
| [[#FUSE_WRITE_ACCESS_SW|FUSE_WRITE_ACCESS_SW]]
| 0x7000F830
|-
| FUSE_PWR_GOOD_SW
| 0x7000F834
|-
| FUSE_PRIV2RESHIFT
| 0x7000F83C
|-
| FUSE_FUSETIME_RD3
| 0x7000F84C
|-
| FUSE_PRIVATE_KEY0_NONZERO
| 0x7000F880
|-
| FUSE_PRIVATE_KEY1_NONZERO
| 0x7000F884
|-
| FUSE_PRIVATE_KEY2_NONZERO
| 0x7000F888
|-
| FUSE_PRIVATE_KEY3_NONZERO
| 0x7000F88C
|-
| FUSE_PRIVATE_KEY4_NONZERO
| 0x7000F890
|}

==== FUSE_FUSECTRL ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| FUSE_FUSECTRL_CMD
0x00: IDLE
0x01: READ
0x02: WRITE
0x03: SENSE_CTRL
|-
| 16-20
| FUSE_FUSECTRL_STATE
0x00: STATE_RESET
0x01: STATE_POST_RESET
0x02: STATE_LOAD_ROW0
0x03: STATE_LOAD_ROW1
0x04: STATE_IDLE
0x05: STATE_READ_SETUP
0x06: STATE_READ_STROBE
0x07: STATE_SAMPLE_FUSES
0x08: STATE_READ_HOLD
0x09: STATE_FUSE_SRC_SETUP
0x0A: STATE_WRITE_SETUP
0x0B: STATE_WRITE_ADDR_SETUP
0x0C: STATE_WRITE_PROGRAM
0x0D: STATE_WRITE_ADDR_HOLD
0x0E: STATE_FUSE_SRC_HOLD
0x0F: STATE_READ_BEFORE_WRITE_SETUP
|-
| 21
| FUSE_FUSECTRL_MARGIN_READ
|-
| 22
| FUSE_FUSECTRL_RWL
|-
| 23
| FUSE_FUSECTRL_TRCS
|-
| 24
| FUSE_FUSECTRL_AT1
|-
| 25
| FUSE_FUSECTRL_AT0
|-
| 26
| FUSE_FUSECTRL_PD_CTRL
|-
| 30
| FUSE_FUSECTRL_FUSE_SENSE_DONE
|-
| 31
| FUSE_FUSECTRL_RECORD_SHIFT_DONE
|}

Before fuse reading/writing the power down mode must be disabled.
SENSE_CTRL mode flushes programmed values into the [[Fuses#Cache_registers|cache registers]].

==== FUSE_FUSEADDR ====
This register takes the address of the fuse to be read/written/sensed.

==== FUSE_FUSERDATA ====
This register receives the value read from the fuse.

==== FUSE_FUSEWDATA ====
This register takes the value to be written to the fuse.

==== FUSE_FUSETIME_PGM2 ====
This register takes the fuse programming pulse (0xC0 == 19200 kHz).

==== FUSE_PRIV2INTFC_START ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| FUSE_PRIV2INTFC_START_DATA
|-
| 1
| FUSE_PRIV2INTFC_START_SKIP_RECORDS
|}

==== FUSE_DISABLEREGPROGRAM ====
If set to 0x01, this register disables fuse programming.

==== FUSE_WRITE_ACCESS_SW ====
If set to 0x01, this register disables software writes to the fuse driver registers.

=== Cache registers ===
{| class="wikitable" border="1"
! Name
! Address
|-
| FUSE_PRODUCTION_MODE
| 0x7000F900
|-
| FUSE_JTAG_SECUREID_VALID
| 0x7000F904
|-
| FUSE_ODM_LOCK
| 0x7000F908
|-
| FUSE_OPT_OPENGL_EN
| 0x7000F90C
|-
| [[#FUSE_SKU_INFO|FUSE_SKU_INFO]]
| 0x7000F910
|-
| FUSE_CPU_SPEEDO_0_CALIB
| 0x7000F914
|-
| FUSE_CPU_IDDQ_CALIB
| 0x7000F918
|-
| FUSE_DAC_CRT_CALIB
| 0x7000F91C
|-
| FUSE_DAC_HDTV_CALIB
| 0x7000F920
|-
| FUSE_DAC_SDTV_CALIB
| 0x7000F924
|-
| [[#FUSE_OPT_FT_REV|FUSE_OPT_FT_REV]]
| 0x7000F928
|-
| FUSE_CPU_SPEEDO_1_CALIB
| 0x7000F92C
|-
| FUSE_CPU_SPEEDO_2_CALIB
| 0x7000F930
|-
| FUSE_SOC_SPEEDO_0_CALIB
| 0x7000F934
|-
| [[#FUSE_SOC_SPEEDO_1_CALIB|FUSE_SOC_SPEEDO_1_CALIB]]
| 0x7000F938
|-
| FUSE_SOC_SPEEDO_2_CALIB
| 0x7000F93C
|-
| FUSE_SOC_IDDQ_CALIB
| 0x7000F940
|-
| FUSE_RESERVED_PRODUCTION_WP
| 0x7000F944
|-
| [[#FUSE_FA|FUSE_FA]]
| 0x7000F948
|-
| FUSE_RESERVED_PRODUCTION
| 0x7000F94C
|-
| FUSE_HDMI_LANE0_CALIB
| 0x7000F950
|-
| FUSE_HDMI_LANE1_CALIB
| 0x7000F954
|-
| FUSE_HDMI_LANE2_CALIB
| 0x7000F958
|-
| FUSE_HDMI_LANE3_CALIB
| 0x7000F95C
|-
| FUSE_ENCRYPTION_RATE
| 0x7000F960
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY0]]
| 0x7000F964
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY1]]
| 0x7000F968
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY2]]
| 0x7000F96C
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY3]]
| 0x7000F970
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY4]]
| 0x7000F974
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY5]]
| 0x7000F978
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY6]]
| 0x7000F97C
|-
| [[#FUSE_PUBLIC_KEY|FUSE_PUBLIC_KEY7]]
| 0x7000F980
|-
| FUSE_TSENSOR1_CALIB
| 0x7000F984
|-
| FUSE_TSENSOR2_CALIB
| 0x7000F988
|-
| FUSE_VSENSOR_CALIB
| 0x7000F98C
|-
| [[#FUSE_OPT_CP_REV|FUSE_OPT_CP_REV]]
| 0x7000F990
|-
| FUSE_OPT_PFG
| 0x7000F994
|-
| FUSE_TSENSOR0_CALIB
| 0x7000F998
|-
| FUSE_FIRST_BOOTROM_PATCH_SIZE
| 0x7000F99C
|-
| FUSE_SECURITY_MODE
| 0x7000F9A0
|-
| [[#FUSE_PRIVATE_KEY|FUSE_PRIVATE_KEY0]]
| 0x7000F9A4
|-
| [[#FUSE_PRIVATE_KEY|FUSE_PRIVATE_KEY1]]
| 0x7000F9A8
|-
| [[#FUSE_PRIVATE_KEY|FUSE_PRIVATE_KEY2]]
| 0x7000F9AC
|-
| [[#FUSE_PRIVATE_KEY|FUSE_PRIVATE_KEY3]]
| 0x7000F9B0
|-
| [[#FUSE_PRIVATE_KEY|FUSE_PRIVATE_KEY4]]
| 0x7000F9B4
|-
| FUSE_ARM_JTAG_DIS
| 0x7000F9B8
|-
| FUSE_BOOT_DEVICE_INFO
| 0x7000F9BC
|-
| [[#FUSE_RESERVED_SW|FUSE_RESERVED_SW]]
| 0x7000F9C0
|-
| FUSE_OPT_VP9_DISABLE
| 0x7000F9C4
|-
| [[#FUSE_RESERVED_ODM0|FUSE_RESERVED_ODM0]]
| 0x7000F9C8
|-
| [[#FUSE_RESERVED_ODM1|FUSE_RESERVED_ODM1]]
| 0x7000F9CC
|-
| [[#FUSE_RESERVED_ODM2|FUSE_RESERVED_ODM2]]
| 0x7000F9D0
|-
| [[#FUSE_RESERVED_ODM3|FUSE_RESERVED_ODM3]]
| 0x7000F9D4
|-
| [[#FUSE_RESERVED_ODM4|FUSE_RESERVED_ODM4]]
| 0x7000F9D8
|-
| FUSE_RESERVED_ODM5
| 0x7000F9DC
|-
| [[#FUSE_RESERVED_ODM6|FUSE_RESERVED_ODM6]]
| 0x7000F9E0
|-
| [[#FUSE_RESERVED_ODM7|FUSE_RESERVED_ODM7]]
| 0x7000F9E4
|-
| FUSE_OBS_DIS
| 0x7000F9E8
|-
| FUSE_NOR_INFO
| 0x7000F9EC
|-
| FUSE_USB_CALIB
| 0x7000F9F0
|-
| FUSE_SKU_DIRECT_CONFIG
| 0x7000F9F4
|-
| FUSE_KFUSE_PRIVKEY_CTRL
| 0x7000F9F8
|-
| FUSE_PACKAGE_INFO
| 0x7000F9FC
|-
| FUSE_OPT_VENDOR_CODE
| 0x7000FA00
|-
| FUSE_OPT_FAB_CODE
| 0x7000FA04
|-
| FUSE_OPT_LOT_CODE_0
| 0x7000FA08
|-
| FUSE_OPT_LOT_CODE_1
| 0x7000FA0C
|-
| FUSE_OPT_WAFER_ID
| 0x7000FA10
|-
| FUSE_OPT_X_COORDINATE
| 0x7000FA14
|-
| FUSE_OPT_Y_COORDINATE
| 0x7000FA18
|-
| FUSE_OPT_SEC_DEBUG_EN
| 0x7000FA1C
|-
| FUSE_OPT_OPS_RESERVED
| 0x7000FA20
|-
| FUSE_SATA_CALIB
| 0x7000FA24
|-
| FUSE_GPU_IDDQ_CALIB
| 0x7000FA28
|-
| FUSE_TSENSOR3_CALIB
| 0x7000FA2C
|-
| FUSE_SKU_BOND_OUT_L
| 0x7000FA30
|-
| FUSE_SKU_BOND_OUT_H
| 0x7000FA34
|-
| FUSE_SKU_BOND_OUT_U
| 0x7000FA38
|-
| FUSE_SKU_BOND_OUT_V
| 0x7000FA3C
|-
| FUSE_SKU_BOND_OUT_W
| 0x7000FA40
|-
| FUSE_OPT_SAMPLE_TYPE
| 0x7000FA44
|-
| FUSE_OPT_SUBREVISION
| 0x7000FA48
|-
| FUSE_OPT_SW_RESERVED_0
| 0x7000FA4C
|-
| FUSE_OPT_SW_RESERVED_1
| 0x7000FA50
|-
| FUSE_TSENSOR4_CALIB
| 0x7000FA54
|-
| FUSE_TSENSOR5_CALIB
| 0x7000FA58
|-
| FUSE_TSENSOR6_CALIB
| 0x7000FA5C
|-
| FUSE_TSENSOR7_CALIB
| 0x7000FA60
|-
| FUSE_OPT_PRIV_SEC_EN
| 0x7000FA64
|-
| [[#FUSE_PKC_DISABLE|FUSE_PKC_DISABLE]]
| 0x7000FA68
|-
| FUSE_FUSE2TSEC_DEBUG_DISABLE
| 0x7000FA7C
|-
| FUSE_TSENSOR_COMMON
| 0x7000FA80
|-
| FUSE_OPT_CP_BIN
| 0x7000FA84
|-
| FUSE_OPT_GPU_DISABLE
| 0x7000FA88
|-
| FUSE_OPT_FT_BIN
| 0x7000FA8C
|-
| FUSE_OPT_DONE_MAP
| 0x7000FA90
|-
| FUSE_APB2JTAG_DISABLE
| 0x7000FA98
|-
| FUSE_ODM_INFO
| 0x7000FA9C
|-
| FUSE_ARM_CRYPT_DE_FEATURE
| 0x7000FAA8
|-
| FUSE_WOA_SKU_FLAG
| 0x7000FAC0
|-
| FUSE_ECO_RESERVE_1
| 0x7000FAC4
|-
| FUSE_GCPLEX_CONFIG_FUSE
| 0x7000FAC8
|-
| FUSE_PRODUCTION_MONTH
| 0x7000FACC
|-
| FUSE_RAM_REPAIR_INDICATOR
| 0x7000FAD0
|-
| FUSE_TSENSOR9_CALIB
| 0x7000FAD4
|-
| FUSE_VMIN_CALIBRATION
| 0x7000FADC
|-
| FUSE_AGING_SENSOR_CALIBRATION
| 0x7000FAE0
|-
| FUSE_DEBUG_AUTHENTICATION
| 0x7000FAE4
|-
| FUSE_SECURE_PROVISION_INDEX
| 0x7000FAE8
|-
| FUSE_SECURE_PROVISION_INFO
| 0x7000FAEC
|-
| FUSE_OPT_GPU_DISABLE_CP1
| 0x7000FAF0
|-
| FUSE_SPARE_ENDIS
| 0x7000FAF4
|-
| FUSE_ECO_RESERVE_0
| 0x7000FAF8
|-
| FUSE_SPARE_REALIGNMENT_REG_OLD
| 0x7000FAFC
|-
| FUSE_RESERVED_CALIB0
| 0x7000FB04
|-
| FUSE_RESERVED_CALIB1
| 0x7000FB08
|-
| FUSE_OPT_GPU_TPC0_DISABLE
| 0x7000FB0C
|-
| FUSE_OPT_GPU_TPC0_DISABLE_CP1
| 0x7000FB10
|-
| FUSE_OPT_CPU_DISABLE
| 0x7000FB14
|-
| FUSE_OPT_CPU_DISABLE_CP1
| 0x7000FB18
|-
| FUSE_TSENSOR10_CALIB
| 0x7000FB1C
|-
| FUSE_TSENSOR10_CALIB_AUX
| 0x7000FB20
|-
| FUSE_OPT_RAM_SVOP_DP
| 0x7000FB24
|-
| FUSE_OPT_RAM_SVOP_PDP
| 0x7000FB28
|-
| FUSE_OPT_RAM_SVOP_REG
| 0x7000FB2C
|-
| FUSE_OPT_RAM_SVOP_SP
| 0x7000FB30
|-
| FUSE_OPT_RAM_SVOP_SMPDP
| 0x7000FB34
|-
| FUSE_OPT_GPU_TPC0_DISABLE_CP2
| 0x7000FB38
|-
| FUSE_OPT_GPU_TPC1_DISABLE
| 0x7000FB3C
|-
| FUSE_OPT_GPU_TPC1_DISABLE_CP1
| 0x7000FB40
|-
| FUSE_OPT_GPU_TPC1_DISABLE_CP2
| 0x7000FB44
|-
| FUSE_OPT_CPU_DISABLE_CP2
| 0x7000FB48
|-
| FUSE_OPT_GPU_DISABLE_CP2
| 0x7000FB4C
|-
| FUSE_USB_CALIB_EXT
| 0x7000FB50
|-
| FUSE_RESERVED_FIELD
| 0x7000FB54
|-
| FUSE_OPT_ECC_EN
| 0x7000FB58
|-
| FUSE_SPARE_REALIGNMENT_REG
| 0x7000FB7C
|-
| FUSE_SPARE_BIT_0
| 0x7000FB80
|-
| FUSE_SPARE_BIT_1
| 0x7000FB84
|-
| [[#FUSE_SPARE_BIT_2|FUSE_SPARE_BIT_2]]
| 0x7000FB88
|-
| [[#FUSE_SPARE_BIT_3|FUSE_SPARE_BIT_3]]
| 0x7000FB8C
|-
| [[#FUSE_SPARE_BIT_4|FUSE_SPARE_BIT_4]]
| 0x7000FB90
|-
| [[#FUSE_SPARE_BIT_5|FUSE_SPARE_BIT_5]]
| 0x7000FB94
|-
| FUSE_SPARE_BIT_6
| 0x7000FB98
|-
| FUSE_SPARE_BIT_7
| 0x7000FB9C
|-
| FUSE_SPARE_BIT_8
| 0x7000FBA0
|-
| FUSE_SPARE_BIT_9
| 0x7000FBA4
|-
| FUSE_SPARE_BIT_10
| 0x7000FBA8
|-
| FUSE_SPARE_BIT_11
| 0x7000FBAC
|-
| FUSE_SPARE_BIT_12
| 0x7000FBB0
|-
| FUSE_SPARE_BIT_13
| 0x7000FBB4
|-
| FUSE_SPARE_BIT_14
| 0x7000FBB8
|-
| FUSE_SPARE_BIT_15
| 0x7000FBBC
|-
| FUSE_SPARE_BIT_16
| 0x7000FBC0
|-
| FUSE_SPARE_BIT_17
| 0x7000FBC4
|-
| FUSE_SPARE_BIT_18
| 0x7000FBC8
|-
| FUSE_SPARE_BIT_19
| 0x7000FBCC
|-
| FUSE_SPARE_BIT_20
| 0x7000FBD0
|-
| FUSE_SPARE_BIT_21
| 0x7000FBD4
|-
| FUSE_SPARE_BIT_22
| 0x7000FBD8
|-
| FUSE_SPARE_BIT_23
| 0x7000FBDC
|-
| FUSE_SPARE_BIT_24
| 0x7000FBE0
|-
| FUSE_SPARE_BIT_25
| 0x7000FBE4
|-
| FUSE_SPARE_BIT_26
| 0x7000FBE8
|-
| FUSE_SPARE_BIT_27
| 0x7000FBEC
|-
| FUSE_SPARE_BIT_28
| 0x7000FBF0
|-
| FUSE_SPARE_BIT_29
| 0x7000FBF4
|-
| FUSE_SPARE_BIT_30
| 0x7000FBF8
|-
| FUSE_SPARE_BIT_31
| 0x7000FBFC
|}

==== FUSE_SKU_INFO ====
Stores the SKU ID (must be 0x83).

==== FUSE_OPT_FT_REV ====
Stores the FT (Final Test) revision.

Original launch units have this value set to 0xA0 (revision 5.0). The first batch of patched units have this value set to 0xC0 (revision 6.0). The second batch of patched units have this value set to 0xE0 (revision 7.0)

==== FUSE_FA ====
Stores failure analysis mode.

==== FUSE_SOC_SPEEDO_1_CALIB ====
Stores the bootrom patch version.

==== FUSE_RESERVED_ODM0 ====
This stores an hardware ID.

==== FUSE_RESERVED_ODM1 ====
This stores an hardware ID.

==== FUSE_RESERVED_ODM2 ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| [5.0.0+] Used as key generation (patched units only)
|}

This stores an hardware ID in original launch units, but in patched units it stores a single value (key generation).

==== FUSE_RESERVED_ODM3 ====
This stores an hardware ID in original launch units, but in patched units it's empty.

==== FUSE_RESERVED_ODM4 ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| Unit type (0x00 = Retail, 0x03 = Debug)
|-
| 2
| Production flag (0x00 = Prototype, 0x01 = Production)
|-
| [1.0.0-3.0.2] 3-5
[4.0.0+] 3-7
| DRAM ID
|-
| 8
| Development flag (0x00 = Retail, 0x01 = Development)
|-
| 9
| Unit type flag (0x00 = Debug, 0x01 = Retail)
|-
| 10
| [3.0.0+] Kiosk flag (0x00 = Retail, 0x01 = Kiosk/Quest)
|-
| 11
| [5.0.0+] Patch flag (0x00 = Unpatched, 1 = Patched)
|-
| 16-19
| [4.0.0+] New hardware type (0x00 = Icosa, 0x01 = Iowa, 0x02 = Hoag)
|}

This stores some device configuration parameters.

==== FUSE_RESERVED_ODM6 ====
This register returns the value programmed into fuse [[#reserved_odm6|reserved_odm6]].

==== FUSE_RESERVED_ODM7 ====
This register returns the value programmed into fuse [[#reserved_odm7|reserved_odm7]].

==== FUSE_PUBLIC_KEY ====
This stores the SHA256 hash of the 2048-bit RSA key expected at BCT+0x210.

==== FUSE_OPT_CP_REV ====
Stores the CP (Chip Probing) revision.

Original launch units have this value set to 0xA0 (revision 5.0). Patched units have this value set to 0x103 (revision 8.3).

==== FUSE_PRIVATE_KEY ====
This stores the 160-bit private key (128 bit SBK + 32-bit device key).
Reads to these registers after the SBK is locked out produce all-FF output.

==== FUSE_RESERVED_SW ====
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| Boot device
|-
| 3
| Skip device selection straps (0 = don't skip; 1 = skip)
|-
| 4
| ENABLE_CHARGER_DETECT
|-
| 5
| ENABLE_WATCHDOG
|-
| 6
| Forced RCM two button mode (0 = Only VOLUME_UP; 1 = VOLUME_UP + HOME)
|-
| 7
| RCM USB controller mode (0 = USB 2.0; 1 = XUSB)
|}

This caches the value of the reserved_sw fuse from the hardware bitmap.

Original launch units have the RCM USB controller mode set to USB 2.0, while the first batch of patched units have the RCM USB controller mode set to XUSB.

==== FUSE_PKC_DISABLE ====
This caches the value of the pkc_disable fuse from the hardware bitmap.

==== FUSE_SPARE_BIT_2 ====
Stores part of the speedo fusing revision.

==== FUSE_SPARE_BIT_3 ====
Stores part of the speedo fusing revision.

==== FUSE_SPARE_BIT_4 ====
Stores part of the speedo fusing revision.

==== FUSE_SPARE_BIT_5 ====
Must be non-zero on retail units, otherwise the first bootloader panics.
On prototype units it can be zero, which tells the bootloader to choose from two pre-production master key seeds. If set to non-zero on a prototype unit, it tells the bootloader to choose from two master key seeds (with the second one being the same as the retail master key seed).

[4.0.0+] This value is no longer used during boot.

== Bitmap ==
The actual hardware fuses are stored in a bitmap and may be programmed through the fuse driver after enabling fuse programming.

Fuse numbers are relative to the start of the fuse bitmap where each element is a 4 byte word and has a redundant alias. A single fuse write operation must always write the same value to '''fuse_bitmap + ((fuse_number + 0) << 2)''' (PRIMARY_ALIAS) and '''fuse_bitmap + ((fuse_number + 1) << 2)''' (REDUNDANT_ALIAS). However, after offset 0x180 in the fuse bitmap, fuses no longer have a redundant alias.

Below is a list of common fuses used by Tegra devices (and applicable to the Switch).

{| class="wikitable" border="1"
! Name
! Number
! Redundant number
! Bits
|-
| enable_fuse_program
| 0
| 1
| 0
|-
| disable_fuse_program
| 0
| 1
| 1
|-
| bypass_fuses
| 0
| 1
| 2
|-
| jtag_direct_access_disable
| 0
| 1
| 3
|-
| production_mode
| 0
| 1
| 4
|-
| jtag_secureid_valid
| 0
| 1
| 5
|-
| odm_lock
| 0
| 1
| 6-9
|-
| fa_mode
| 0
| 1
| 10
|-
| security_mode
| 0
| 1
| 11
|-
| arm_debug_dis
| 0
| 1
| 12
|-
| obs_dis
| 0
| 1
| 13
|-
| public_key0
| 10
| 11
| 30-31
|-
| public_key0
| 12
| 13
| 0-29
|-
| public_key1
| 12
| 13
| 30-31
|-
| public_key1
| 14
| 15
| 0-29
|-
| public_key2
| 14
| 15
| 30-31
|-
| public_key2
| 16
| 17
| 0-29
|-
| public_key3
| 16
| 17
| 30-31
|-
| public_key3
| 18
| 19
| 0-29
|-
| public_key4
| 18
| 19
| 30-31
|-
| public_key4
| 20
| 21
| 0-29
|-
| public_key5
| 20
| 21
| 30-31
|-
| public_key5
| 22
| 23
| 0-29
|-
| public_key6
| 22
| 23
| 30-31
|-
| public_key6
| 24
| 25
| 0-29
|-
| public_key7
| 24
| 25
| 30-31
|-
| public_key7
| 26
| 27
| 0-29
|-
| private_key0
| 34
| 35
| 12-31
|-
| private_key0
| 36
| 37
| 0-11
|-
| private_key1
| 36
| 37
| 12-31
|-
| private_key1
| 38
| 39
| 0-11
|-
| private_key2
| 38
| 39
| 12-31
|-
| private_key2
| 40
| 41
| 0-11
|-
| private_key3
| 40
| 41
| 12-31
|-
| private_key3
| 42
| 43
| 0-11
|-
| private_key4
| 42
| 43
| 12-31
|-
| private_key4
| 44
| 45
| 0-11
|-
| boot_device_info
| 44
| 45
| 12-27
|-
| reserved_sw
| 44
| 45
| 28-31
|-
| reserved_sw
| 46
| 47
| 0-3
|-
| reserved_odm0
| 46
| 47
| 5-31
|-
| reserved_odm0
| 48
| 49
| 0-4
|-
| reserved_odm1
| 48
| 49
| 5-31
|-
| reserved_odm1
| 50
| 51
| 0-4
|-
| reserved_odm2
| 50
| 51
| 5-31
|-
| reserved_odm2
| 52
| 53
| 0-4
|-
| reserved_odm3
| 52
| 53
| 5-31
|-
| reserved_odm3
| 54
| 55
| 0-4
|-
| reserved_odm4
| 54
| 55
| 5-31
|-
| reserved_odm4
| 56
| 57
| 0-4
|-
| reserved_odm5
| 56
| 57
| 5-31
|-
| reserved_odm5
| 58
| 59
| 0-4
|-
| [[#reserved_odm6|reserved_odm6]]
| 58
| 59
| 5-31
|-
| [[#reserved_odm6|reserved_odm6]]
| 60
| 61
| 0-4
|-
| [[#reserved_odm7|reserved_odm7]]
| 60
| 61
| 5-31
|-
| [[#reserved_odm7|reserved_odm7]]
| 62
| 63
| 0-4
|-
| kfuse_privkey_ctrl
| 64
| 65
| 13-14
|-
| package_info
| 64
| 65
| 15-18
|-
| opt_vendor_code
| 64
| 65
| 19-22
|-
| opt_fab_code
| 64
| 65
| 23-28
|-
| opt_lot_code_0
| 64
| 65
| 29-31
|-
| opt_lot_code_0
| 66
| 67
| 0-28
|-
| opt_lot_code_1
| 66
| 67
| 29-31
|-
| opt_lot_code_1
| 68
| 69
| 0-24
|-
| opt_wafer_id
| 68
| 69
| 25-30
|-
| opt_x_coordinate
| 68
| 69
| 31
|-
| opt_x_coordinate
| 70
| 71
| 0-7
|-
| opt_y_coordinate
| 70
| 71
| 8-16
|-
| opt_sec_debug_en
| 70
| 71
| 17
|-
| opt_ops_reserved
| 70
| 71
| 18-23
|-
| sata_calib
| 70
| 71
| 24-25
|-
| opt_priv_sec_en
| 90
| 91
| 8
|-
| pkc_disable
| 90
| 91
| 9
|-
| fuse2tsec_debug_disable
| 90
| 91
| 10
|-
| secure_provision_index
| 90
| 91
| 24-27
|-
| secure_provision_info
| 90
| 91
| 28-29
|-
| aid
| 103
| None
| 0-31
|-
| [[#irom_patch|irom_patch]]
| 114
| None
| Variable
|}

=== reserved_odm6 ===
Used for anti-downgrade control.

=== reserved_odm7 ===
Used for anti-downgrade control.

=== irom_patch ===
Tegra210 based hardware such as the Switch provides support for bootrom patches. The patch data is burned to the hardware fuse bitmap using a specific format (see [https://gist.github.com/shuffle2/f8728159da100e9df2606d43925de0af shuffle2's ipatch decoder]). The bootrom reads these fuses in order to initialize the IPATCH hardware, which allows overriding data returned for code and data fetches done by BPMP.

The following represents the patch data dumped from a Switch console:
<syntaxhighlight>
RAM:00000000 ; =============== S U B R O U T I N E =======================================
RAM:00000000
RAM:00000000
RAM:00000000 irom_svc_dispatch
RAM:00000000 STMFD SP!, {R0-R2} ; ipatches (new):
RAM:00000000 ; 0 b57df00 16ae df00 : svc #0x00 (offset 0x48)
RAM:00000000 ; 1 1820df22 3040 df22 : svc #0x22 (offset 0x8c)
RAM:00000000 ; 2 3797df26 6f2e df26 : svc #0x26 (offset 0x94)
RAM:00000000 ; 3 3b4d2100 769a 2100 : movs r1, #0x00
RAM:00000000 ; 4 42bdf2c 856 df2c : svc #0x2c (offset 0xa0)
RAM:00000000 ; 5 37aadf42 6f54 df42 : svc #0x42 (offset 0xcc)
RAM:00000000 ; 6 972df4b 12e4 df4b : svc #0x4b (offset 0xde)
RAM:00000000 ; 7 2293df54 4526 df54 : svc #0x54 (offset 0xf0)
RAM:00000000 ; 8 21fadf5d 43f4 df5d : svc #0x5d (offset 0x102)
RAM:00000000 ; 9 bba2ac57 17744 ac57 : data
RAM:00000000 ; 10 bbac3d19 17758 3d19 : data
RAM:00000000 ; 11 1e952001 3d2a 2001 : movs r0, #0x01
RAM:00000000 ;
RAM:00000000 ; ipatches (old):
RAM:00000000 ; 0 b57df00 16ae df00 : svc #0x00 (offset 0x48)
RAM:00000000 ; 1 1820df22 3040 df22 : svc #0x22 (offset 0x8c)
RAM:00000000 ; 2 3797df26 6f2e df26 : svc #0x26 (offset 0x94)
RAM:00000000 ; 3 7d9e2000 fb3c 2000 : movs r0, #0x00
RAM:00000000 ; 4 42bdf2c 856 df2c : svc #0x2c (offset 0xa0)
RAM:00000000 ; 5 37aadf42 6f54 df42 : svc #0x42 (offset 0xcc)
RAM:00000000 ; 6 972df4b 12e4 df4b : svc #0x4b (offset 0xde)
RAM:00000000 ; 7 2293df54 4526 df54 : svc #0x54 (offset 0xf0)
RAM:00000000 ; 8 21fadf5d 43f4 df5d : svc #0x5d (offset 0x102)
RAM:00000000 ; 9 bba2ac57 17744 ac57 : data
RAM:00000000 ; 10 bbac3d19 17758 3d19 : data
RAM:00000000 ; 11 1e952001 3d2a 2001 : movs r0, #0x01
RAM:00000004 MOV R2, LR
RAM:00000008 SUB R2, R2, #2
RAM:0000000C LDR R2, [R2]
RAM:00000010 AND R2, R2, #0xFF
RAM:00000014 MOV R2, R2,LSL#1
RAM:00000018 LDR R0, =0x1007B0
RAM:0000001C LDR R1, =0x1007F8
RAM:00000020 SUB R1, R1, R0
RAM:00000024 LDR R0, =0x40004C30
RAM:00000028 ADD R0, R0, R1
RAM:0000002C ADD R2, R2, R0
RAM:00000030 ORR R2, R2, #1
RAM:00000034 LDMFD SP!, {R0,R1}
RAM:00000038 BX R2
RAM:00000038 ; End of function irom_svc_dispatch
RAM:00000038
RAM:00000038 ; ---------------------------------------------------------------------------
RAM:0000003C dword_3C DCD 0x1007B0 ; DATA XREF: irom_svc_dispatch+18↑r
RAM:00000040 dword_40 DCD 0x1007F8 ; DATA XREF: irom_svc_dispatch+1C↑r
RAM:00000044 dword_44 DCD 0x40004C30 ; DATA XREF: irom_svc_dispatch+24↑r
RAM:00000048 CODE16
RAM:00000048
RAM:00000048 ; =============== S U B R O U T I N E =======================================
RAM:00000048
RAM:00000048
RAM:00000048 sub_48
RAM:00000048 MOVS R2, #0 ; 0 b57df00 16ae df00 : svc #0x00 (offset 0x48)
RAM:0000004A MVNS R2, R2
RAM:0000004C LDR R1, =0x60006410
RAM:0000004E STR R2, [R1,#0x30]
RAM:00000050 STR R2, [R1,#0x38]
RAM:00000052 LDR R1, =0x600060F8
RAM:00000054 STR R2, [R1]
RAM:00000056 STR R2, [R1,#4]
RAM:00000058 LDR R1, =0x60006284
RAM:0000005A STR R2, [R1]
RAM:0000005C STR R2, [R1,#0x18]
RAM:0000005E ADDS R1, #0x80
RAM:00000060 ADDS R1, #0x1C
RAM:00000062 STR R2, [R1]
RAM:00000064 STR R2, [R1,#8]
RAM:00000066 STR R2, [R1,#0x10]
RAM:00000068 ADDS R1, #0x80
RAM:0000006A STR R2, [R1]
RAM:0000006C STR R2, [R1,#4]
RAM:0000006E LDR R1, =0x60006554
RAM:00000070 STR R2, [R1]
RAM:00000072 MOVS R2, #0xA0000000
RAM:00000076 LDR R1, =0x60006148
RAM:00000078 STR R2, [R1]
RAM:0000007A ADDS R1, #0x38 ; '8'
RAM:0000007C STR R2, [R1]
RAM:0000007E MOVS R2, #0xE0000000
RAM:00000082 LDR R1, =0x600066A0
RAM:00000084 STR R2, [R1]
RAM:00000086 MOVS R1, #0
RAM:00000088 MOVS R0, #0xE
RAM:0000008A B pop_r2_mov_pc_lr
RAM:0000008A ; End of function sub_48
RAM:0000008A
RAM:0000008C
RAM:0000008C ; =============== S U B R O U T I N E =======================================
RAM:0000008C
RAM:0000008C
RAM:0000008C sub_8C
RAM:0000008C LDR R0, [R1,#0x18] ; 1 1820df22 3040 df22 : svc #0x22 (offset 0x8c)
RAM:0000008E MOVS R2, #1
RAM:00000090 ORRS R0, R2
RAM:00000092 B pop_r2_mov_pc_lr
RAM:00000092 ; End of function sub_8C
RAM:00000092
RAM:00000094
RAM:00000094 ; =============== S U B R O U T I N E =======================================
RAM:00000094
RAM:00000094
RAM:00000094 sub_94
RAM:00000094 LDR R2, [R4,#0x50] ; 2 3797df26 6f2e df26 : svc #0x26 (offset 0x94)
RAM:00000096 ADDS R2, R2, #2
RAM:00000098 STR R2, [R4,#0x50]
RAM:0000009A SUBS R1, #0x80
RAM:0000009C STR R1, [R4,#0x34]
RAM:0000009E B pop_r2_mov_pc_lr
RAM:0000009E ; End of function sub_94
RAM:0000009E
RAM:000000A0
RAM:000000A0 ; =============== S U B R O U T I N E =======================================
RAM:000000A0
RAM:000000A0
RAM:000000A0 sub_A0
RAM:000000A0
RAM:000000A0 ; FUNCTION CHUNK AT RAM:00000148 SIZE 00000004 BYTES
RAM:000000A0
RAM:000000A0 MOVS R0, #0x70000000 ; 4 42bdf2c 856 df2c : svc #0x2c (offset 0xa0)
RAM:000000A4 LDR R6, =dword_7000EF14
RAM:000000A6 LDR R2, =dword_7000E5B4
RAM:000000A8 LDR R2, [R2]
RAM:000000AA CMP R2, #0
RAM:000000AC BEQ loc_B4
RAM:000000AE LDR R2, [R6]
RAM:000000B0 STR R2, [R0,#8]
RAM:000000B2 B loc_BC
RAM:000000B4 ; ---------------------------------------------------------------------------
RAM:000000B4
RAM:000000B4 loc_B4 ; CODE XREF: sub_A0+C↑j
RAM:000000B4 LDR R2, [R0,#8]
RAM:000000B6 LSRS R0, R0, #0x12
RAM:000000B8 ORRS R2, R0
RAM:000000BA STR R2, [R6]
RAM:000000BC
RAM:000000BC loc_BC ; CODE XREF: sub_A0+12↑j
RAM:000000BC LDR R6, =dword_7000E9C0
RAM:000000BE LDR R0, [R6]
RAM:000000C0 MOVS R2, #0x4000
RAM:000000C4 ORRS R2, R0
RAM:000000C6 STR R2, [R6]
RAM:000000C8 LDR R0, [R5,#0x10]
RAM:000000CA B pop_r2_mov_pc_lr
RAM:000000CA ; End of function sub_A0
RAM:000000CA
RAM:000000CC
RAM:000000CC ; =============== S U B R O U T I N E =======================================
RAM:000000CC
RAM:000000CC
RAM:000000CC sub_CC
RAM:000000CC MOVS R2, #0xF000000 ; 5 37aadf42 6f54 df42 : svc #0x42 (offset 0xcc)
RAM:000000D0 BICS R1, R2
RAM:000000D2 STR R1, [R4,#0x10]
RAM:000000D4 LDR R1, [R4,#0x50]
RAM:000000D6 MOVS R2, #7
RAM:000000D8 BICS R1, R2
RAM:000000DA STR R1, [R4,#0x50]
RAM:000000DC B pop_r2_mov_pc_lr
RAM:000000DC ; End of function sub_CC
RAM:000000DC
RAM:000000DE
RAM:000000DE ; =============== S U B R O U T I N E =======================================
RAM:000000DE
RAM:000000DE
RAM:000000DE sub_DE
RAM:000000DE LDR R2, =dword_7000FA9C ; 6 972df4b 12e4 df4b : svc #0x4b (offset 0xde)
RAM:000000E0 LDR R2, [R2]
RAM:000000E2 LSRS R2, R2, #8
RAM:000000E4 LSLS R2, R2, #1
RAM:000000E6 LDR R1, [R4]
RAM:000000E8 BICS R1, R2
RAM:000000EA STR R1, [R4]
RAM:000000EC CMP R0, #0
RAM:000000EE B pop_r2_mov_pc_lr
RAM:000000EE ; End of function sub_DE
RAM:000000EE
RAM:000000F0
RAM:000000F0 ; =============== S U B R O U T I N E =======================================
RAM:000000F0
RAM:000000F0
RAM:000000F0 sub_F0
RAM:000000F0
RAM:000000F0 arg_0= 0
RAM:000000F0
RAM:000000F0 LDR R0, =0x400049F0 ; 7 2293df54 4526 df54 : svc #0x54 (offset 0xf0)
RAM:000000F2 LDR R2, [R0]
RAM:000000F4 STR R2, [SP,#arg_0]
RAM:000000F6 LDR R0, =0x40010000
RAM:000000F8 LSRS R2, R2, #17
RAM:000000FA BEQ pop_r2_mov_pc_lr ; if ([0x400049F0] >> 17) == 0) {
RAM:000000FA ; r2 = [0x400049F0];
RAM:000000FA ; } else {
RAM:000000FC LDR R0, =APBDEV_PMC_CNTRL_0
RAM:000000FE STR R4, [R0] ; write APBDEV_PMC_CNTRL
RAM:00000100
RAM:00000100 loc_100 ; CODE XREF: sub_F0:loc_100↓j
RAM:00000100 B loc_100 ; hang
RAM:00000100 ; End of function sub_F0 ; }
RAM:00000100
RAM:00000102
RAM:00000102 ; =============== S U B R O U T I N E =======================================
RAM:00000102
RAM:00000102
RAM:00000102 sub_102
RAM:00000102
RAM:00000102 arg_0= 0
RAM:00000102
RAM:00000102 LDR R2, =0x40010220 ; 8 21fadf5d 43f4 df5d : svc #0x5d (offset 0x102)
RAM:00000104 STR R2, [SP,#arg_0] ; set r2 retval = [0x40010220]
RAM:00000106 LDR R2, [R2,#0x18]
RAM:00000108 ADDS R0, #0xFC
RAM:0000010A STR R2, [R0,#0x1C] ; [r0+0x118] = [0x40010220 + 0x18]
RAM:0000010C B pop_r2_mov_pc_lr
RAM:0000010C ; End of function sub_102
RAM:0000010C
RAM:0000010C ; ---------------------------------------------------------------------------
RAM:0000010E DCB 0
RAM:0000010F DCB 0
RAM:00000110 off_110 DCD 0x60006410 ; DATA XREF: sub_48+4↑r
RAM:00000114 off_114 DCD 0x600060F8 ; DATA XREF: sub_48+A↑r
RAM:00000118 off_118 DCD 0x60006284 ; DATA XREF: sub_48+10↑r
RAM:0000011C off_11C DCD 0x60006554 ; DATA XREF: sub_48+26↑r
RAM:00000120 off_120 DCD 0x60006148 ; DATA XREF: sub_48+2E↑r
RAM:00000124 off_124 DCD 0x600066A0 ; DATA XREF: sub_48+3A↑r
RAM:00000128 off_128 DCD dword_7000EF14 ; DATA XREF: sub_A0+4↑r
RAM:0000012C off_12C DCD dword_7000E5B4 ; DATA XREF: sub_A0+6↑r
RAM:00000130 off_130 DCD dword_7000E9C0 ; DATA XREF: sub_A0:loc_BC↑r
RAM:00000134 off_134 DCD dword_7000FA9C ; DATA XREF: sub_DE↑r
RAM:00000138 off_138 DCD 0x400049F0 ; DATA XREF: sub_F0↑r
RAM:0000013C dword_13C DCD 0x40010000 ; DATA XREF: sub_F0+6↑r
RAM:00000140 off_140 DCD APBDEV_PMC_CNTRL_0 ; DATA XREF: sub_F0+C↑r
RAM:00000144 off_144 DCD 0x40010220 ; DATA XREF: sub_102↑r
RAM:00000148 ; ---------------------------------------------------------------------------
RAM:00000148 ; START OF FUNCTION CHUNK FOR sub_A0
RAM:00000148
RAM:00000148 pop_r2_mov_pc_lr ; CODE XREF: sub_48+42↑j
RAM:00000148 ; sub_8C+6↑j ...
RAM:00000148 POP {R2}
RAM:0000014A MOV PC, LR
RAM:0000014A ; END OF FUNCTION CHUNK FOR sub_A0
</syntaxhighlight>

The last 4 patches are exclusive to the Switch, while the remaining ones are often included in most Tegra210 based devices.

==== IROM patch 0 ====
This patch configures clock enables and clock gate overrides for new hardware.

<syntaxhighlight lang="c">
u32 CLK_ENB_H_SET = 0x60006328;
u32 CLK_ENB_L_SET = 0x60006320;
u32 CLK_ENB_U_SET = 0x60006330;
u32 CLK_ENB_V_SET = 0x60006440;
u32 CLK_ENB_W_SET = 0x60006448;
u32 CLK_ENB_X_SET = 0x60006284;
u32 CLK_ENB_Y_SET = 0x6000629C;
u32 LVL2_CLK_GATE_OVRA = 0x600060F8;
u32 LVL2_CLK_GATE_OVRB = 0x600060FC;
u32 LVL2_CLK_GATE_OVRC = 0x600063A0;
u32 LVL2_CLK_GATE_OVRD = 0x600063A4;
u32 LVL2_CLK_GATE_OVRE = 0x60006554;
u32 CLK_SOURCE_VI = 0x60006148;
u32 CLK_SOURCE_HOST1X = 0x60006180;
u32 CLK_SOURCE_NVENC = 0x600066A0;

// Set all clock enables and overrides
*(u32 *)CLK_ENB_V_SET = 0xFFFFFFFF;
*(u32 *)CLK_ENB_W_SET = 0xFFFFFFFF;
*(u32 *)LVL2_CLK_GATE_OVRA = 0xFFFFFFFF;
*(u32 *)LVL2_CLK_GATE_OVRB = 0xFFFFFFFF;
*(u32 *)CLK_ENB_X_SET = 0xFFFFFFFF;
*(u32 *)CLK_ENB_Y_SET = 0xFFFFFFFF;
*(u32 *)CLK_ENB_L_SET = 0xFFFFFFFF;
*(u32 *)CLK_ENB_H_SET = 0xFFFFFFFF;
*(u32 *)CLK_ENB_U_SET = 0xFFFFFFFF;
*(u32 *)LVL2_CLK_GATE_OVRC = 0xFFFFFFFF;
*(u32 *)LVL2_CLK_GATE_OVRD = 0xFFFFFFFF;
*(u32 *)LVL2_CLK_GATE_OVRE = 0xFFFFFFFF;

// Set VI, HOST1X and NVENC clock sources to CLK_M
*(u32 *)CLK_SOURCE_VI = 0xA0000000;
*(u32 *)CLK_SOURCE_HOST1X = 0xA0000000;
*(u32 *)CLK_SOURCE_NVENC = 0xE0000000;

/*
Untranslated instructions:

MOVS R1, #0
MOVS R0, #0xE
*/

return;
</syntaxhighlight>

==== IROM patch 1 ====
This patch is a bugfix.

LP0 resume code expects APBDEV_PMC_SCRATCH190_0 to be set to 0x01, but the bootrom didn't set it.

<syntaxhighlight lang="c">
u32 APBDEV_PMC_SCRATCH190_0 = 0x7000EC18;
u32 pmc_scratch190_val = *(u32 *)APBDEV_PMC_SCRATCH190_0;

return (pmc_scratch190_val | 0x01);
</syntaxhighlight>

==== IROM patch 2 ====
This patch adjusts USB configurations.

<syntaxhighlight lang="c">
u32 USB1_UTMIP_SPARE_CFG0_0 = 0x7D000834;
u32 USB1_UTMIP_BIAS_CFG2_0 = 0x7D000850;

// Increase UTMIP_HSSQUELCH_LEVEL_NEW by 0x02
*(u32 *)USB1_UTMIP_BIAS_CFG2_0 += 0x02;

// Clear FUSE_HS_IREF_CAP_CFG
*(u32 *)USB1_UTMIP_SPARE_CFG0_0 = ((*(u32 *)USB1_UTMIP_SPARE_CFG0_0 & ~(0x118)) - 0x80);

return;
</syntaxhighlight>

==== IROM patch 3 ====
This patch ensures that waiting on PRC_PENDING from the XUSB_DEV register T_XUSB_DEV_XHCI_PORTSC never fails.

In the second batch of patched units ([[#FUSE_OPT_FT_REV|FUSE_OPT_FT_REV]] set to revision 7.0) this patch has been replaced with a fix for [[Switch_System_Flaws#Hardware|CVE-2018-6242]] (arbitrary copy when handling USB control requests in RCM). By setting R1 to 0 at address 0x0010769A in the bootrom, the upper 16 bits of the USB control request's wLength field are cleared out, effectively limiting the request's size to a maximum of 255 bytes.

==== IROM patch 4 ====
This patch allows backing up and restoring strapping options for warmboot.

<syntaxhighlight lang="c">
u32 APBDEV_PMC_SCRATCH0_0 = 0x7000E450;
u32 APBDEV_PMC_RST_STATUS_0 = 0x7000E5B4;
u32 APBDEV_PMC_SEC_DISABLE8_0 = 0x7000E9C0;
u32 APBDEV_PMC_SECURE_SCRATCH111_0 = 0x7000EF14;
u32 APB_MISC_PP_STRAPPING_OPT_A_0 = 0x70000008;

u32 reset_status = *(u32 *)APBDEV_PMC_RST_STATUS_0;

// Check for regular power on
if (reset_status == 0)
{
// Set all buttons in RCM_STRAPS and backup to PMC scratch
*(u32 *)APBDEV_PMC_SECURE_SCRATCH111_0 = (*(u32 *)APB_MISC_PP_STRAPPING_OPT_A_0 | 0x1C00);
}
else
{
// Restore strapping options from PMC scratch
*(u32 *)APB_MISC_PP_STRAPPING_OPT_A_0 = *(u32 *)APBDEV_PMC_SECURE_SCRATCH111_0;
}

// Disable write access to APBDEV_PMC_SECURE_SCRATCH111_0
*(u32 *)APBDEV_PMC_SEC_DISABLE8_0 |= 0x4000;

return *(u32 *)APBDEV_PMC_SCRATCH0_0;
</syntaxhighlight>

==== IROM patch 5 ====
This patch adjusts USB configurations.

<syntaxhighlight lang="c">
u32 USB1_UTMIP_HSRX_CFG0_0 = 0x7D000810;
u32 USB1_UTMIP_BIAS_CFG2_0 = 0x7D000850;

// Clear UTMIP_IDLE_WAIT, UTMIP_ELASTIC_LIMIT and UTMIP_PCOUNT_UPDN_DIV,
// and set UTMIP_IDLE_WAIT to 0x11 and UTMIP_ELASTIC_LIMIT to 0x10
*(u32 *)USB1_UTMIP_HSRX_CFG0_0 = ((*(u32 *)USB1_UTMIP_HSRX_CFG0_0 & ~(0xF8000) + 0x88000 & ~(0x7C00) + 0x4000) & ~(0xF000000));

// Clear UTMIP_HSSQUELCH_LEVEL_NEW
*(u32 *)USB1_UTMIP_BIAS_CFG2_0 &= ~(0x07);

return;
</syntaxhighlight>

==== IROM patch 6 ====
This patch is a factory backdoor.

It allows controlling the debug authentication configuration using a fuse.

<syntaxhighlight lang="c">
u32 FUSE_ODM_INFO = 0x7000FA9C;

u32 odm_info = *(u32 *)FUSE_ODM_INFO;
debug_auth_override_val = ((odm_info >> 0x08) << 0x01);

// Override debug authentication value stored in IRAM
*(u32 *)0x400028E4 &= ~(debug_auth_override_val);

/*
Untranslated instructions:

CMP R0, #0
*/

return;
</syntaxhighlight>

==== IROM patch 7 ====
This patch is a bugfix.

It prevents overflowing IRAM (0x40010000) when copying the warmboot binary from DRAM.

<syntaxhighlight lang="c">
u32 APBDEV_PMC_CNTRL_0 = 0x7000E400;

u32 warmboot_header_addr = 0x400049F0;
u32 warmboot_bin_size = *(u32 *)warmboot_bin_header_addr;

// Invalid warmboot binary size
if (warmboot_size >> 0x11)
{
// Assert MAIN_RST
// 0x40004BF0 comes from R4 and the bootrom doesn't bother to change it
*(u32 *)APBDEV_PMC_CNTRL_0 = 0x40004BF0;

// Deadlock
while(1);
}

/*
Untranslated instructions:

LDR R0, =0x40010000
LDR R2, [warmboot_bin_header_addr]
*/

return;
</syntaxhighlight>

==== IROM patch 8 ====
This patch is a bugfix.

It sets the correct warmboot binary entrypoint address for RSA signature verification, which would be done in DRAM instead of IRAM without this patch.

<syntaxhighlight lang="c">
u32 warmboot_addr_ptr = 0x40010238;
u32 warmboot_entry_addr_ptr = 0x40004C28;

*(u32 *)warmboot_entry_addr_ptr = *(u32 *)warmboot_addr_ptr;

/*
Untranslated instructions:

LDR R2, [warmboot_addr_ptr]
*/

return;
</syntaxhighlight>

==== IROM patches 9 and 10 ====
These patches modify the 256-bit Secure Provisioning AES key with index 0x3A.

==== IROM patch 11 ====
This patch forces the value of [[Security_Engine|SE_TZRAM_SECURITY]] to be 0x01 instead of restoring it from the saved SE context.

== Anti-downgrade ==
The first bootloader verifies [[#FUSE_RESERVED_ODM7|FUSE_RESERVED_ODM7]] to prevent downgrading.
How many fuses are expected to be burnt depends the device's unit type as below.

{| class="wikitable" border="1"
|-
! System version
! Expected number of burnt fuses (retail)
! Expected number of burnt fuses (non-retail)
|-
| 1.0.0
| 1
| 0
|-
| 2.0.0-2.3.0
| 2
| 0
|-
| 3.0.0
| 3
| 1
|-
| 3.0.1-3.0.2
| 4
| 1
|-
| 4.0.0-4.1.0
| 5
| 1
|-
| 5.0.0-5.1.0
| 6
| 1
|-
| 6.0.0-6.1.0
| 7
| 1
|-
| 6.2.0
| 8
| 1
|-
| 7.0.0-8.0.1
| 9
| 1
|-
| 8.1.0
| 10
| 1
|-
| 9.0.0-9.0.1
| 11
| 1
|}

If too many fuses are burnt the bootloader will panic immediately.

If too few are burnt, the bootloader will enable fuse programming and write the expected value to fuses [[#reserved_odm6|reserved_odm6]] and [[#reserved_odm7|reserved_odm7]]. Afterwards, fuse programming is disabled and the panic value 0x21 is written to PMC_SCRATCH200 register (0x7000EC40). Finally, the watchdog timer is initialized and programmed to force a reset.

On a subsequent boot, after the anti-downgrade fuses are checked again, the PMC_RST_STATUS register (0x7000E5B4) is checked and if set to 0x01 (watchdog reset) the PMC_SCRATCH200 register (0x7000EC40) will be checked for the panic value 0x21.
PMC_RST_STATUS will only be set back to 0 (power on reset) if the fuse count matches the new expected value, otherwise the system will panic.

SVC

2019-10-02T08:03:58Z

Roblabla: We were lied to. Based on 5.0.0 info.

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || [[#svcSignalEvent]] || W0=wevent_handle || W0=result
|-
| 0x12 || [[#svcClearEvent]] || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || [[#svcResetSignal]] || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=baseaddr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value
R0=reslimit_handle, R1=[[#LimitableResource]], R2=value_lower32, R3=value_upper32
|| W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args
R0=smc_sub_id, R1, R2, R3=smc_args
|| X0,X1,X2,X3,X4,X5,X6,X7=result
R0,R1,R2,R3=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to OutAddr.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

=== Result codes ===

'''0x0:''' Success. The memory region was reprotected.

'''0xCC01:''' Unaligned address specified.

'''0xCA01:''' Unaligned or zero size specified.

'''0xD401:''' The provided memory region does not fall within the userland address space.

'''0xD801:''' Invalid permission specified. Valid permissions are ---, r-- and rw-.

'''0xD401:''' The provided memory region was in an invalid state. The region must have the PermissionChangeAllowed bit set in its [[#MemoryState]], and must not have the IsBorrowed or IsUncached [[#MemoryAttribute]].

'''0xCE01:''' Kernel resource exhausted.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcSignalEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Puts the given event in the signaled state.

Will wake up any thread currently waiting on this event. Can potentially trigger a reschedule.

Any calls to [[#svcWaitSynchronization]] on this handle will return immediately, until the event's signaled state is reset.

=== Result codes ===

'''0x0:''' Success. Event is now in signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a WritableEvent.

== svcClearEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent or ReadableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Takes the given event out of the signaled state.

=== Result codes ===

'''0x0:''' Success, the event is now in the not-signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a ReadableEvent nor a WritableEvent.

'''0xFA01:''' The handle was not in a signaled state.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcResetSignal ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<ReadableEvent> or Handle<Process> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Resets the signal on the given handle, ensuring future calls to [[#svcWaitSynchronization]] on this handle will sleep until the handle is signaled again. If the handle is a ReadableEvent, this is equivalent to calling svcClearEvent() on the handle.

If the handle is a Process, it will clear the signaled state (which is set when the process changes [[#ProcessState]]. Once the process enters the Exited state, calling svcResetSignal on the process will no longer have an effect (the process is permanently signaled), and the syscall will return 0xFA01.

=== Result codes ===

'''0x0:''' Success. The signal was reset.

'''0xE401:''' The handle is invalid or of the wrong type.

'''0xFA01:''' The handle was not signaled, or the process is in exited state, causing it to be permanently signaled.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Process || 23 || 0 || [9.0.0+]
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || BaseAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

'''Description:''' Query the physical address of a virtual address. Will always fetch the lowest page-aligned mapping that contains the provided physical address.

The returned BaseAddr is the virtual address of that page-aligned mapping, while PhysAddr is the physical address of that page. Size is the amount of continuous physical memory in that mapping.

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || R1-R3 || u64 || SMC sub-arguments
|-
| (Out) X0 || R0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || R1-R3 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description || Meaning
|-
| 7-0 || Type ||
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]] ||
|-
| 9 || ForceReadWritableByDebugSyscalls || Allows using [[#svcWriteDebugProcessMemory]] on segments mapped read-only.
|-
| 10 || IpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=0.
|-
| 11 || NonDeviceIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=1.
|-
| 12 || NonSecureIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=3.
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]] ||
|-
| 15 || [[#svcMapMemory|MapAllowed]] ||
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]] ||
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]] ||
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]] ||
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]]) ||
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]] ||
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]] ||
|-
| 22 || IsPoolAllocated/IsReferenceCounted || The physical memory blocks backing this region are refcounted.
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]] ||
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]] ||
|-
| 25 || [4.0.0+] [[#svcCreateCodeMemory|CodeMemoryAllowed]] ||
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

Error codes

2019-09-20T08:02:35Z

Roblabla: 0xFA01 is InvalidState.

= Structure =
These have been redesigned from the 3DS so that they fit within a Aarch64 MOV instruction immediate most of the time (without requiring the additional MOVK).

{| class=wikitable
! Bits || Field
|-
| 8-0 || Module
|-
| 21-9 || Description
|}

When a fatal-error is received the error code is outputted using the following formatter:
%04d-%04d

.. where the first code is <code>2000 + Module</code>, and the other being <code>Description</code>. Bits >=22 from the error-code are unused when displaying fatal-errors, since the Description ends with bit21.

= Modules =
{| class=wikitable
! Value || Name
|-
| 1 || Kernel
|-
| 2 || FS
|-
| 3 || OS (Memory, Thread, Mutex, NVIDIA)
|-
| 4 || HTCS
|-
| 5 || NCM
|-
| 6 || DD
|-
| 7 || Debug Monitor
|-
| 8 || LR
|-
| 9 || Loader
|-
| 10 || CMIF (IPC command interface)
|-
| 11 || HIPC (IPC)
|-
| 15 || PM
|-
| 16 || NS
|-
| 17 || Sockets
|-
| 18 || HTC
|-
| 19 || TSC
|-
| 20 || NCM (content)
|-
| 21 || SM
|-
| 22 || RO (userland)
|-
| 24 || SDMMC
|-
| 25 || OVLN
|-
| 26 || SPL
|-
| 30 || Bus
|-
| 100 || ETHC
|-
| 101 || I2C
|-
| 102 || GPIO
|-
| 103 || UART
|-
| 105 || Settings
|-
| 107 || WLAN
|-
| 108 || HID (xcd)
|-
| 110 || NIFM
|-
| 111 || Hwopus
|-
| 112 || HID (sasbus)
|-
| 113 || Bluetooth
|-
| 114 || VI
|-
| 115 || NFP
|-
| 116 || Time
|-
| 117 || FGM
|-
| 118 || OE
|-
| 120 || PCIe
|-
| 121 || Friends
|-
| 122 || BCAT
|-
| 123 || SSL
|-
| 124 || Account
|-
| 125 || News
|-
| 126 || Mii
|-
| 127 || NFC
|-
| 128 || AM
|-
| 129 || Play Report
|-
| 130 || HID (ahid)
|-
| 132 || Home Menu (Qlaunch)
|-
| 133 || PCV
|-
| 134 || OMM
|-
| 135 || BPC
|-
| 136 || PSM
|-
| 137 || NIM
|-
| 138 || PSC
|-
| 139 || TC
|-
| 140 || USB
|-
| 141 || NSD
|-
| 142 || PCTL
|-
| 143 || BTM
|-
| 144 || LA (Library Applet)
|-
| 145 || ETicket
|-
| 146 || NGC (Bad Words)
|-
| 147 || Error Report
|-
| 148 || APM
|-
| 149 || CEC
|-
| 150 || Profiler
|-
| 151 || Error Upload
|-
| 153 || Audio
|-
| 154 || NPNS
|-
| 155 || NPNS (XMPP Stream)
|-
| 157 || ARP
|-
| 158 || Updater
|-
| 159 || SWKBD
|-
| 161 || NFC (Mifare)
|-
| 162 || Userland (assert)
|-
| 163 || Fatal
|-
| 164 || NIM (shop)
|-
| 165 || SPSM
|-
| 167 || BGTC
|-
| 168 || Userland (crash)
|-
| 169 || Sasbus (Periodic Receive Mode)
|-
| 178 || PDM
|-
| 179 || OLSC
|-
| 180 || SREPO
|-
| 181 || Dauth
|-
| 187 || Sasbus
|-
| 191 || RTC
|-
| 192 || Regulator
|-
| 193 || Led
|-
| 197 || Clkrst
|-
| 202 || HID
|-
| 203 || LDN
|-
| 205 || HID (irsensor)
|-
| 206 || Capture
|-
| 208 || Manu
|-
| 209 || ATK
|-
| 210 || Web
|-
| 211 || Unknown
|-
| 212 || GRC
|-
| 216 || Migration
|-
| 217 || Migration (Idc Server)
|-
| 229 || Glue (notification)
|-
| 230 || PSC (ins)
|-
| 231 || LDN (lp2p)
|-
| 345 || libnx
|-
| 346 || [[Homebrew ABI]]
|-
| 347 || Homebrew Loader
|-
| 348 || libnx Nvidia errors
|-
|}

= Error codes =
{| class=wikitable
! Value || Module || Description || Notes
|-
| 0x0E01 || 1 || 7 || Session count exceeded
|-
| 0x1C01 || 1 || 14 || Invalid kernel capability descriptor
|-
| 0x4201 || 1 || 33 || Not Implemented
|-
| 0x7601 || 1 || 59 || Thread terminated/termination requested
|-
| 0x8C01 || 1 || 70 || No more debug events
|-
| 0xCA01 || 1 || 101 || Invalid size
|-
| 0xCC01 || 1 || 102 || Invalid address
|-
| 0xCE01 || 1 || 103 || Resource exhaustion
|-
| 0xD001 || 1 || 104 || Memory exhaustion
|-
| 0xD201 || 1 || 105 || Handle-table exhaustion
|-
| 0xD401 || 1 || 106 || Invalid memory state / invalid memory permissions.
|-
| 0xD801 || 1 || 108 || Invalid memory permissions.
|-
| 0xDC01 || 1 || 110 || Invalid memory range
|-
| 0xE001 || 1 || 112 || Invalid thread priority.
|-
| 0xE201 || 1 || 113 || Invalid processor id.
|-
| 0xE401 || 1 || 114 || Invalid handle.
|-
| 0xE601 || 1 || 115 || Invalid pointer/Syscall copy from user failed.
|-
| 0xE801 || 1 || 116 || Invalid combination
|-
| 0xEA01 || 1 || 117 || Time out. Also when you give 0 handles to svcWaitSynchronizationN.
|-
| 0xEC01 || 1 || 118 || Operation canceled
|-
| 0xEE01 || 1 || 119 || Out of range
|-
| 0xF001 || 1 || 120 || Invalid enum
|-
| 0xF201 || 1 || 121 || No such entry
|-
| 0xF401 || 1 || 122 || Irq/DeviceAddressSpace/{...} already registered
|-
| 0xF601 || 1 || 123 || Port remote dead
|-
| 0xF801 || 1 || 124 || [Usermode] Unhandled interrupt/exception
|-
| 0xFA01 || 1 || 125 || Invalid state
|-
| 0xFC01 || 1 || 126 || Reserved value
|-
| 0xFE01 || 1 || 127 || Invalid hardware breakpoint
|-
| 0x10001 || 1 || 128 || [Usermode] Fatal exception
|-
| 0x10201 || 1 || 129 || Last thread didn't belong to your process
|-
| 0x10601 || 1 || 131 || Port closed
|-
| 0x10801 || 1 || 132 || Resource limit exceeded
|-
| 0x20801 || 1 || 260 || Command buffer too small
|-
| 0x40A01 || 1 || 517 || Invalid process ID.
|-
| 0x40C01 || 1 || 518 || Invalid thread ID.
|-
| 0x40E01 || 1 || 519 || Invalid thread ID (used in svcGetDebugThreadParam).
|-
| 0x41001 || 1 || 520 || Process not being debugged
|-
| 0x202 || 2 || 1 || Path does not exist.
|-
| 0x402 || 2 || 2 || Path already exists.
|-
| 0xE02 || 2 || 7 || Resource already in use (file already opened, savedata filesystem already mounted).
|-
| 0x4602 || 2 || 35 || Not enough free space for BIS Calibration partition.
|-
| 0x4802 || 2 || 36 || Not enough free space for BIS Safe partition.
|-
| 0x4A02 || 2 || 37 || Not enough free space for BIS User partition.
|-
| 0x4C02 || 2 || 38 || Not enough free space for BIS System partition.
|-
| 0x4E02 || 2 || 39 || Not enough free space on SD card.
|-
| 0x6402 || 2 || 50 || NCA is older than version 3, or NCA SDK version is older than 0.11.0.0
|-
| 0x7802 || 2 || 60 || Specified mount name already exists.
|-
| 0x7D202 || 2 || 1001 || Process does not have RomFs
|-
| 0x7D402 || 2 || 1002 || Title-id not found / savedata not found.
|-
| 0xFA202 || 2 || 2001 || SD card not inserted
|-
| 0x13B002 || 2 || 2520 || Gamecard not inserted
|-
| 0x13DA02 || 2 || 2541 || Version check failed when mounting gamecard sysupdate partition?
|-
| 0x171402 || 2 || 2954 || Invalid gamecard handle.
|-
| 0x177202 || 2 || 3001 || Unimplemented behavior
|-
| 0x177602 || 2 || 3003 || File/Directory already exists.
|-
| 0x190202 || 2 || 3201 || Memory allocation failure related to FAT filesystem code
|-
| 0x190602 || 2 || 3203 || Memory allocation failure related to FAT filesystem code
|-
| 0x190802 || 2 || 3204 || Memory allocation failure related to FAT filesystem code
|-
| 0x190A02 || 2 || 3205 || Memory allocation failure related to FAT filesystem code
|-
| 0x190C02 || 2 || 3206 || Memory allocation failure related to FAT filesystem code
|-
| 0x191002 || 2 || 3208 || Memory allocation failure related to FAT filesystem code
|-
| 0x195802 || 2 || 3244 || Allocation failure related to SD cards
|-
| 0x196002 || 2 || 3248 || Out of memory
|-
| 0x196202 || 2 || 3249 || Out of memory
|-
| 0x1A3E02 || 2 || 3359 || Out of memory
|-
| 0x1A4002 || 2 || 3360 || Out of memory
|-
| 0x1A4A02 || 2 || 3365 || Out of memory
|-
| 0x21BC02 || 2 || 4318 || Invalid save data filesystem magic (valid magic is SAVE in ASCII)
|-
| 0x234202 || 2 || 4513 || Error reading ACID section in NPDM
|-
| 0x234402 || 2 || 4514 || Invalid NPDM ACID section size
|-
| 0x234602 || 2 || 4515 || Last byte of the ACID modulus is zero
|-
| 0x234802 || 2 || 4516 || Invalid ACID fixed key signature
|-
| 0x234A02 || 2 || 4517 || Invalid NCA magic
|-
| 0x234C02 || 2 || 4518 || Invalid NCA header fixed key signature
|-
| 0x234E02 || 2 || 4519 || Invalid NCA header ACID signature
|-
| 0x235002 || 2 || 4520 || Invalid NCA header section hash
|-
| 0x235202 || 2 || 4521 || Invalid NCA Key index
|-
| 0x235602 || 2 || 4523 || Invalid encryption type
|-
| 0x235802 || 2 || 4524 || Redirection BKTR table size is negative
|-
| 0x235A02 || 2 || 4525 || Encryption BKTR table size is negative
|-
| 0x235C02 || 2 || 4526 || Redirection BKTR table end offset is past the Encryption BKTR table start offset
|-
| 0x235E02 || 2 || 4527 || NCA-path used with the wrong titleID.
|-
| 0x236002 || 2 || 4528 || NCA header value is out of range
|-
| 0x236202 || 2 || 4529 || NCA FS header value is out of range
|-
| 0x236802 || 2 || 4532 || PartitionFS hash block size is not a power of 2
|-
| 0x236A02 || 2 || 4533 || PartitionFS hash "always_2" field is not 2
|-
| 0x236C02 || 2 || 4534 || PartitionFS hash table is too small for main data
|-
| 0x236E02 || 2 || 4535 || Invalid PartitionFS block hash
|-
| 0x244402 || 2 || 4642 || Invalid Partition file hashed region bounds
|-
| 0x244602 || 2 || 4643 || Invalid Partition FS hash
|-
| 0x244802 || 2 || 4644 || Invalid PFS0 magic
|-
| 0x244A02 || 2 || 4645 || Invalid HFS0 magic
|-
| 0x244C02 || 2 || 4646 || Invalid name offset for Partition FS file entry
|-
| 0x244E02 || 2 || 4647 || Calculated Partition FS header size changed between 2 consecutive reads
|-
| 0x249802 || 2 || 4684 || Invalid FAT file number.
|-
| 0x249C02 || 2 || 4686 || Invalid FAT format for BIS User partition.
|-
| 0x249E02 || 2 || 4687 || Invalid FAT format for BIS System partition.
|-
| 0x24A002 || 2 || 4688 || Invalid FAT format for BIS Safe partition.
|-
| 0x24A202 || 2 || 4689 || Invalid FAT format for BIS Calibration partition.
|-
| 0x250E02 || 2 || 4743 || [[NAX0|Corrupted]] NAX0 header.
|-
| 0x251002 || 2 || 4744 || Invalid [[NAX0]] magicnum.
|-
| 0x280202 || 2 || 5121 || Invalid FAT size
|-
| 0x280402 || 2 || 5122 || Invalid FAT BPB (BIOS Parameter Block)
|-
| 0x280602 || 2 || 5123 || Invalid FAT parameter
|-
| 0x280802 || 2 || 5124 || Invalid FAT sector
|-
| 0x280A02 || 2 || 5125 || Invalid FAT sector
|-
| 0x280C02 || 2 || 5126 || Invalid FAT sector
|-
| 0x280E02 || 2 || 5127 || Invalid FAT sector
|-
| 0x296A02 || 2 || 5301 || Mountpoint not found
|-
| 0x2EE202 || 2 || 6001 || Invalid input
|-
| 0x2EE602 || 2 || 6003 || Path too long
|-
| 0x2EE802 || 2 || 6004 || Invalid character.
|-
| 0x2EEA02 || 2 || 6005 || Invalid directory path.
|-
| 0x2EEC02 || 2 || 6006 || Unable to retrieve directory from path
|-
| 0x2F5A02 || 2 || 6061 || Offset outside storage
|-
| 0x313802 || 2 || 6300 || Operation not supported
|-
| 0x313C02 || 2 || 6302 || Attempted to resize a nn::fs::SubStorage or BufferedStorage that is marked as non-resizable
|-
| 0x313E02 || 2 || 6303 || Attempted to resize a nn::fs::SubStorage or BufferedStorage when the SubStorage ends before the base storage
|-
| 0x314002 || 2 || 6304 || Attempted to call nn::fs::MemoryStorage::SetSize
|-
| 0x314202 || 2 || 6305 || Invalid Operation ID in nn::fs::MemoryStorage::OperateRange
|-
| 0x314402 || 2 || 6306 || Invalid Operation ID in nn::fs::FileStorage::OperateRange
|-
| 0x314C02 || 2 || 6310 || Attempted to call nn::fssystem::AesCtrCounterExtendedStorage::Write
|-
| 0x314E02 || 2 || 6311 || Attempted to call nn::fssystem::AesCtrCounterExtendedStorage::SetSize
|-
| 0x315002 || 2 || 6312 || Invalid Operation ID in nn::fssystem::AesCtrCounterExtendedStorage::OperateRange
|-
| 0x315802 || 2 || 6316 || Attempted to call nn::fssystem::save::HierarchicalIntegrityVerificationStorage::SetSize
|-
| 0x315A02 || 2 || 6317 || Attempted to call nn::fssystem::save::HierarchicalIntegrityVerificationStorage::OperateRange
|-
| 0x315C02 || 2 || 6318 || Attempted to call nn::fssystem::save::IntegrityVerificationStorage::SetSize
|-
| 0x315E02 || 2 || 6319 || Attempted to invalidate the cache of a RomFs IVFC storage in nn::fssystem::save::IntegrityVerificationStorage::OperateRange
|-
| 0x316002 || 2 || 6320 || Invalid Operation ID in nn::fssystem::save::IntegrityVerificationStorage::OperateRange
|-
| 0x316202 || 2 || 6321 || Attempted to call nn::fssystem::save::BlockCacheBufferedStorage::SetSize
|-
| 0x316402 || 2 || 6322 || Attempted to invalidate the cache of something other than a savedata IVFC storage in nn::fssystem::save::BlockCacheBufferedStorage::OperateRange
|-
| 0x316602 || 2 || 6323 || Invalid Operation ID in nn::fssystem::save::BlockCacheBufferedStorage::OperateRange
|-
| 0x316802 || 2 || 6324 || Attempted to call nn::fssystem::IndirectStorage::Write
|-
| 0x316A02 || 2 || 6325 || Attempted to call nn::fssystem::IndirectStorage::SetSize
|-
| 0x316C02 || 2 || 6326 || Invalid Operation ID in nn::fssystem::IndirectStorage::OperateRange
|-
| 0x317202 || 2 || 6329 || Attempted to call nn::fssystem::HierarchicalSha256Storage::SetSize
|-
| 0x317402 || 2 || 6330 || Attempted to call nn::fssystem::ReadOnlyBlockCacheStorage::Write
|-
| 0x317602 || 2 || 6331 || Attempted to call nn::fssystem::ReadOnlyBlockCacheStorage::SetSize
|-
| 0x317802 || 2 || 6332 || Attempted to call nn::fssystem::IntegrityRomFsStorage::SetSize
|-
| 0x317A02 || 2 || 6333 || Attempted to call nn::fssystem::save::DuplexStorage::SetSize
|-
| 0x317C02 || 2 || 6334 || Invalid Operation ID in nn::fssystem::save::DuplexStorage::OperateRange
|-
| 0x317E02 || 2 || 6335 || Attempted to call nn::fssystem::save::HierarchicalDuplexStorage::SetSize
|-
| 0x318002 || 2 || 6336 || Attempted to call nn::fssystem::save::RemapStorage::GetSize
|-
| 0x318202 || 2 || 6337 || Attempted to call nn::fssystem::save::RemapStorage::SetSize
|-
| 0x318402 || 2 || 6338 || Invalid Operation ID in nn::fssystem::save::RemapStorage::OperateRange
|-
| 0x318602 || 2 || 6339 || Attempted to call nn::fssystem::save::IntegritySaveDataStorage::SetSize
|-
| 0x318802 || 2 || 6340 || Invalid Operation ID in nn::fssystem::save::IntegritySaveDataStorage::OperateRange
|-
| 0x318A02 || 2 || 6341 || Attempted to call nn::fssystem::save::JournalIntegritySaveDataStorage::SetSize
|-
| 0x318C02 || 2 || 6342 || Invalid Operation ID in nn::fssystem::save::JournalIntegritySaveDataStorage::OperateRange
|-
| 0x318E02 || 2 || 6343 || Attempted to call nn::fssystem::save::JournalStorage::GetSize
|-
| 0x319002 || 2 || 6344 || Attempted to call nn::fssystem::save::JournalStorage::SetSize
|-
| 0x319202 || 2 || 6345 || Invalid Operation ID in nn::fssystem::save::JournalStorage::OperateRange
|-
| 0x319602 || 2 || 6347 || Attempted to call nn::fssystem::dbm::AllocationTableStorage::SetSize
|-
| 0x31A602 || 2 || 6355 || Invalid Operation ID in nn::fat::FatFile::DoOperateRange
|-
| 0x31A802 || 2 || 6356 || Invalid Operation ID in nn::fssystem::StorageFile::DoOperateRange
|-
| 0x31AE02 || 2 || 6359 || Invalid Query ID in nn::fssystem::ConcatenationFileSystem::DoQueryEntry
|-
| 0x31B002 || 2 || 6360 || Invalid Operation ID in nn::fssystem::ConcatenationFile::DoOperateRange
|-
| 0x31B402 || 2 || 6362 || Invalid Operation ID in nn::fs::detail::FileServiceObjectAdapter::DoOperateRange
|-
| 0x31B602 || 2 || 6363 || Invalid Operation ID in nn::fssystem::AesXtsFile::DoOperateRange
|-
| 0x31B802 || 2 || 6364 || Attempted to modify a nn::fs::RomFsFileSystem
|-
| 0x31BA02 || 2 || 6365 || Attempted to call nn::fs::RomFsFileSystem::DoCommitProvisionally
|-
| 0x31BC02 || 2 || 6366 || Attempted to query the space in a nn::fs::RomFsFileSystem
|-
| 0x31BE02 || 2 || 6367 || Attempted to modify a nn::fssystem::RomFsFile
|-
| 0x31C002 || 2 || 6368 || Invalid Operation ID in nn::fssystem::RomFsFile::DoOperateRange
|-
| 0x31C202 || 2 || 6369 || Attempted to modify a nn::fs::ReadOnlyFileSystemTemplate
|-
| 0x31C402 || 2 || 6370 || Attempted to call nn::fs::ReadOnlyFileSystemTemplate::DoCommitProvisionally
|-
| 0x31C602 || 2 || 6371 || Attempted to query the space in a nn::fs::ReadOnlyFileSystemTemplate
|-
| 0x31C802 || 2 || 6372 || Attempted to modify a nn::fs::ReadOnlyFileSystemFile
|-
| 0x31CA02 || 2 || 6373 || Invalid Operation ID in nn::fs::ReadOnlyFileSystemFile::DoOperateRange
|-
| 0x31CC02 || 2 || 6374 || Attempted to modify a nn::fssystem::PartitionFileSystemCore
|-
| 0x31CE02 || 2 || 6375 || Attempted to call nn::fssystem::PartitionFileSystemCore::DoCommitProvisionally
|-
| 0x31D002 || 2 || 6376 || Attempted to call nn::fssystem::PartitionFileSystemCore::PartitionFile::DoSetSize
|-
| 0x31D202 || 2 || 6377 || Invalid Operation ID in nn::fssystem::PartitionFileSystemCore::PartitionFile::DoOperateRange
|-
| 0x31DC02 || 2 || 6382 || Attempted to call nn::fssystem::ApplicationTemporaryFileSystem::DoCommitProvisionally
|-
| 0x31DE02 || 2 || 6383 || Attempted to call nn::fssystem::SaveDataFileSystem::DoCommitProvisionally
|-
| 0x31E002 || 2 || 6384 || Attempted to call nn::fssystem::DirectorySaveDataFileSystem::DoCommitProvisionally
|-
| 0x320002 || 2 || 6400 || Permission denied
|-
| 0x326602 || 2 || 6451 || Missing titlekey(?) required to mount content
|-
| 0x326E02 || 2 || 6455 || File not closed
|-
| 0x327002 || 2 || 6456 || Directory not closed
|-
| 0x327202 || 2 || 6457 || Writable file not closed when committing
|-
| 0x327402 || 2 || 6458 || FS allocators already registered
|-
| 0x327602 || 2 || 6459 || FS allocators already used
|-
| 0x327A02 || 2 || 6461 || FS allocator alignment violation
|-
| 0x339402 || 2 || 6602 || File not found.
|-
| 0x339602 || 2 || 6603 || Directory not found.
|-
| 0x35F202 || 2 || 6905 || Mount name not found in table.
|-
| 0x3DBC02 || 2 || 7902 || RomFs table: Entry not found in dictionary
|-
| 0x3DBE02 || 2 || 7903 || RomFs table: File not found
|-
| 0x3DC002 || 2 || 7904 || RomFs table: Directory not found
|-
| 0x3DC402 || 2 || 7906 || RomFs table: Entry already exists when trying to add a new entry
|-
| 0x3DC602 || 2 || 7907 || RomFs table: Insufficient space to add new entry
|-
| 0x3DC802 || 2 || 7908 || RomFs table: Unable to add new directory
|-
| 0x3DCA02 || 2 || 7909 || RomFs table: Unable to add new file
|-
| 0x3DCC02 || 2 || 7910 || RomFs directory has no more child directories/files when iterating
|-
| 0x3DD402 || 2 || 7914 || RomFs table: Path is file, not directory
|-
| 0x803 || 3 || 4 || OS busy
|-
| 0xE03 || 3 || 7 || Invalid parameter
|-
| 0x1003 || 3 || 8 || Out of memory
|-
| 0x1203 || 3 || 9 || Out of resources
|-
| 0x3EA03 || 3 || 501 || Invalid handle
|-
| 0x3EE03 || 3 || 503 || Invalid memory mirror
|-
| 0x7FE03 || 3 || 1023 || TLS slot is not allocated
|-
| 0xA05 || 5 || 5 || [[Content_Manager_services|NcaID]] not found. Returned when attempting to mount titles which exist that aren't *8XX titles, the same way *8XX titles are mounted.
|-
| 0xE05 || 5 || 7 || TitleId not found
|-
| 0x1805 || 5 || 12 || Invalid StorageId
|-
| 0xDC05 || 5 || 110 || Gamecard not inserted
|-
| 0x17C05 || 5 || 190 || Gamecard not initialized
|-
| 0x1F405 || 5 || 250 || Sdcard not inserted
|-
| 0x20805 || 5 || 260 || Storage not mounted
|-
| 0x806 || 6 || 4 || Converted from error 0xD401
|-
| 0x1006 || 6 || 8 || Converted from error 0xE401
|-
| 0x408 || 8 || 2 || Program location entry not found
|-
| 0x608 || 8 || 3 || Invalid context for control location
|-
| 0x808 || 8 || 4 || Storage not found
|-
| 0xA08 || 8 || 5 || Access denied
|-
| 0xC08 || 8 || 6 || Offline manual HTML location entry not found
|-
| 0xE08 || 8 || 7 || Title is not registered
|-
| 0x1008 || 8 || 8 || Control location entry for host not found
|-
| 0x1208 || 8 || 9 || Legal info HTML location entry not found
|-
| 0x1408 || 8 || 10 || Program location for debug entry not found
|-
| 0x209 || 9 || 1 || Args too long.
|-
| 0x409 || 9 || 2 || Maximum processes loaded.
|-
| 0x609 || 9 || 3 || NPDM too big.
|-
| 0x809 || 9 || 4 || Invalid NPDM.
|-
| 0xA09 || 9 || 5 || Invalid NSO.
|-
| 0xC09 || 9 || 6 || Invalid Path.
|-
| 0xE09 || 9 || 7 || Already registered.
|-
| 0x1009 || 9 || 8 || Title not found.
|-
| 0x1209 || 9 || 9 || Title-id in ACI0 doesn't match range in ACID.
|-
| 0x1409 || 9 || 10 || Invalid version in NPDM.
|-
| 0x6609 || 9 || 51 || Insufficient address space.
|-
| 0x6809 || 9 || 52 || Insufficient NRO.
|-
| 0x6A09 || 9 || 53 || Invalid NRR
|-
| 0x6C09 || 9 || 54 || Invalid signature
|-
| 0x6E09 || 9 || 55 || Insufficient NRO registrations.
|-
| 0x7009 || 9 || 56 || Insufficient NRR registrations.
|-
| 0x7209 || 9 || 57 || NRO Already loaded.
|-
| 0xA209 || 9 || 81 || Unaligned NRR address
|-
| 0xA409 || 9 || 82 || Bad NRR size
|-
| 0xA809 || 9 || 84 || NRR Not Loaded.
|-
| 0xAA09 || 9 || 85 || Bad NRR address
|-
| 0xAE09 || 9 || 87 || Bad initialization
|-
| 0xC809 || 9 || 100 || Unknown ACI0 descriptor
|-
| 0xCE09 || 9 || 103 || ACID/ACI0 don't match for descriptor "KernelFlags"
|-
| 0xD009 || 9 || 104 || ACID/ACI0 don't match for descriptor "SyscallMask"
|-
| 0xD409 || 9 || 106 || ACID/ACI0 don't match for descriptor "MapIoOrNormalRange"
|-
| 0xD609 || 9 || 107 || ACID/ACI0 don't match for descriptor "MapNormalPage"
|-
| 0xDE09 || 9 || 111 || ACID/ACI0 don't match for descriptor "InterruptPair"
|-
| 0xE209 || 9 || 113 || ACID/ACI0 don't match for descriptor "ApplicationType"
|-
| 0xE409 || 9 || 114 || ACID/ACI0 don't match for descriptor "KernelReleaseVersion"
|-
| 0xE609 || 9 || 115 || ACID/ACI0 don't match for descriptor "HandleTableSize"
|-
| 0xE809 || 9 || 116 || ACID/ACI0 don't match for descriptor "DebugFlags"
|-
| 0x1940A || 10 || 202 || Invalid CMIF header size.
|-
| 0x1A60A || 10 || 211 || Invalid CMIF input header.
|-
| 0x1A80A || 10 || 212 || Invalid CMIF output header.
|-
| 0x1BA0A || 10 || 221 || Invalid method dispatch ID.
|-
| 0x1D60A || 10 || 235 || Invalid in object count.
|-
| 0x1D80A || 10 || 236 || Invalid out object count.
|-
| 0x25A0A || 10 || 301 || Out of domain entries.
|-
| 0x20B || 11 || 1 || Unsupported operation
|-
| 0xCC0B || 11 || 102 || Out of server session memory
|-
| 0x11A0B || 11 || 141 || Went past maximum during marshalling.
|-
| 0x1900B || 11 || 200 || Session doesn't support domains.
|-
| 0x25A0B || 11 || 301 || Remote process is dead.
|-
| 0x3260B || 11 || 403 || Unknown request type
|-
| 0x3D60B || 11 || 491 || IPC Query 1 failed.
|-
| 0x20F || 15 || 1 || Pid not found
|-
| 0x60F || 15 || 3 || Process has no pending events
|-
| 0xA0F || 15 || 5 || Application already running
|-
| 0x410 || 16 || 2 || Title-id not found
|-
| 0xF010 || 16 || 120 || Gamecard sysupdate not required
|-
| 0x1F610 || 16 || 251 || Unexpected StorageId
|-
| 0x215 || 21 || 1 || Out of processes
|-
| 0x415 || 21 || 2 || Not initialized.
|-
| 0x615 || 21 || 3 || Max sessions
|-
| 0x815 || 21 || 4 || Service already registered
|-
| 0xA15 || 21 || 5 || Out of services
|-
| 0xC15 || 21 || 6 || Invalid name (all zeroes)
|-
| 0xE15 || 21 || 7 || Service not registered
|-
| 0x1015 || 21 || 8 || Permission denied
|-
| 0x1215 || 21 || 9 || Service Access Control too big.
|-
| 0x416 || 22 || 2 || Address space is full
|-
| 0x616 || 22 || 3 || NRO already loaded
|-
| 0x816 || 22 || 4 || Invalid NRO header values
|-
| 0xC16 || 22 || 6 || Bad NRR magic
|-
| 0x1016 || 22 || 8 || Reached max NRR count
|-
| 0x1216 || 22 || 9 || Unable to verify NRO hash or NRR signature
|-
| 0x80216 || 22 || 1025 || Address not page-aligned
|-
| 0x80416 || 22 || 1026 || Incorrect NRO size
|-
| 0x80816 || 22 || 1028 || NRO not loaded
|-
| 0x80A16 || 22 || 1029 || NRR not loaded
|-
| 0x80C16 || 22 || 1030 || Already initialized
|-
| 0x80E16 || 22 || 1031 || Not initialized
|-
| 0x21A || 26 || 1 || SMC is not implemented
|-
| 0x41A || 26 || 2 || SMC argument is invalid
|-
| 0x61A || 26 || 3 || SMC is currently in progress/secmon is busy
|-
| 0x81A || 26 || 4 || Secmon not currently performing async operation
|-
| 0xA1A || 26 || 5 || Invalid SMC async callback key
|-
| 0xC1A || 26 || 6 || SMC is blacklisted during current boot
|-
| 0xC81A || 26 || 100 || Invalid (buffer) size
|-
| 0xCA1A || 26 || 101 || Unknown SMC error
|-
| 0xCA1A || 26 || 101 || Decryption failure
|-
| 0xD01A || 26 || 104 || No AES keyslots available
|-
| 0xD21A || 26 || 105 || Invalid AES keyslot
|-
| 0xD41A || 26 || 106 || BootReason already set
|-
| 0xD61A || 26 || 107 || BootReason not set
|-
| 0xD81A || 26 || 108 || Invalid argument
|-
| 0x19269 || 105 || 201 || Null settings name
|-
| 0x19469 || 105 || 202 || Null settings key
|-
| 0x19669 || 105 || 203 || Null settings value
|-
| 0x19A69 || 105 || 205 || Null settings value buffer
|-
| 0x1A069 || 105 || 208 || Null setting value size buffer
|-
| 0x1A269 || 105 || 209 || Null debug mode flag buffer
|-
| 0x1BA69 || 105 || 221 || Setting group name has zero length
|-
| 0x1BC69 || 105 || 222 || Empty settings item key
|-
| 0x1E269 || 105 || 241 || Setting group name is too long (64 character limit?)
|-
| 0x1E469 || 105 || 242 || Setting name is too long (64 character limit?)
|-
| 0x20A69 || 105 || 261 || Setting group name ends with '.' or contains invalid characters (allowed: [a-z0-9_\-.])
|-
| 0x20C69 || 105 || 262 || Setting name ends with '.' or contains invalid characters (allowed: [a-z0-9_\-.])
|-
| 0x4DA69 || 105 || 621 || Null language code buffer
|-
| 0x4EE69 || 105 || 631 || Null network settings buffer
|-
| 0x4F069 || 105 || 632 || Null network settings output count buffer
|-
| 0x50269 || 105 || 641 || Null backlight settings buffer
|-
| 0x51669 || 105 || 651 || Null Bluetooth device setting buffer
|-
| 0x51869 || 105 || 652 || Null Bluetooth device setting output count buffer
|-
| 0x51A69 || 105 || 653 || Null Bluetooth enable flag buffer
|-
| 0x51C69 || 105 || 654 || Null Bluetooth AFH enable flag buffer
|-
| 0x51E69 || 105 || 655 || Null Bluetooth boost enable flag buffer
|-
| 0x52069 || 105 || 656 || Null BLE pairing settings buffer
|-
| 0x52269 || 105 || 657 || Null BLE pairing settings entry count buffer
|-
| 0x52A69 || 105 || 661 || Null external steady clock source ID buffer
|-
| 0x52C69 || 105 || 662 || Null user system clock context buffer
|-
| 0x52E69 || 105 || 663 || Null network system clock context buffer
|-
| 0x53069 || 105 || 664 || Null user system clock automatic correction enabled flag buffer
|-
| 0x53269 || 105 || 665 || Null shutdown RTC value buffer
|-
| 0x53469 || 105 || 666 || Null external steady clock internal offset buffer
|-
| 0x53E69 || 105 || 671 || Null account settings buffer
|-
| 0x55269 || 105 || 681 || Null audio volume buffer
|-
| 0x55669 || 105 || 683 || Null ForceMuteOnHeadphoneRemoved buffer
|-
| 0x55869 || 105 || 684 || Null headphone volume warning count buffer
|-
| 0x55E69 || 105 || 687 || Invalid audio output mode
|-
| 0x56069 || 105 || 688 || Null headphone volume update flag buffer
|-
| 0x56669 || 105 || 691 || Null console information upload flag buffer
|-
| 0x57A69 || 105 || 701 || Null automatic application download flag buffer
|-
| 0x57C69 || 105 || 702 || Null notification settings buffer
|-
| 0x57E69 || 105 || 703 || Null account notification settings entry count buffer
|-
| 0x58069 || 105 || 704 || Null account notification settings buffer
|-
| 0x58E69 || 105 || 711 || Null vibration master volume buffer
|-
| 0x59069 || 105 || 712 || Null NX controller settings buffer
|-
| 0x59269 || 105 || 713 || Null NX controller settings entry count buffer
|-
| 0x59469 || 105 || 714 || Null USB full key enable flag buffer
|-
| 0x5A269 || 105 || 721 || Null TV settings buffer
|-
| 0x5A469 || 105 || 722 || Null EDID buffer
|-
| 0x5B669 || 105 || 731 || Null data deletion settings buffer
|-
| 0x5CA69 || 105 || 741 || Null initial system applet program ID buffer
|-
| 0x5CC69 || 105 || 742 || Null overlay disp program ID buffer
|-
| 0x5CE69 || 105 || 743 || Null IsInRepairProcess buffer
|-
| 0x5D069 || 105 || 744 || Null RequiresRunRepairTimeReviser buffer
|-
| 0x5DE69 || 105 || 751 || Null device timezone location name buffer
|-
| 0x5F269 || 105 || 761 || Null primary album storage buffer
|-
| 0x60669 || 105 || 771 || Null USB 3.0 enable flag buffer
|-
| 0x60869 || 105 || 772 || Null USB Type-C power source circuit version buffer
|-
| 0x61A69 || 105 || 781 || Null battery lot buffer
|-
| 0x62E69 || 105 || 791 || Null serial number buffer
|-
| 0x64269 || 105 || 801 || Null lock screen flag buffer
|-
| 0x64669 || 105 || 803 || Null color set ID buffer
|-
| 0x64869 || 105 || 804 || Null quest flag buffer
|-
| 0x64A69 || 105 || 805 || Null wireless certification file size buffer
|-
| 0x64C69 || 105 || 806 || Null wireless certification file buffer
|-
| 0x64E69 || 105 || 807 || Null initial launch settings buffer
|-
| 0x65069 || 105 || 808 || Null device nickname buffer
|-
| 0x65269 || 105 || 809 || Null battery percentage flag buffer
|-
| 0x65469 || 105 || 810 || Null applet launch flags buffer
|-
| 0x7E869 || 105 || 1012 || Null wireless LAN enable flag buffer
|-
| 0x7FA69 || 105 || 1021 || Null product model buffer
|-
| 0x80E69 || 105 || 1031 || Null NFC enable flag buffer
|-
| 0x82269 || 105 || 1041 || Null ECI device certificate buffer
|-
| 0x82469 || 105 || 1042 || Null E-Ticket device certificate buffer
|-
| 0x83669 || 105 || 1051 || Null sleep settings buffer
|-
| 0x84A69 || 105 || 1061 || Null EULA version buffer
|-
| 0x84C69 || 105 || 1062 || Null EULA version entry count buffer
|-
| 0x85E69 || 105 || 1071 || Null LDN channel buffer
|-
| 0x87269 || 105 || 1081 || Null SSL key buffer
|-
| 0x87469 || 105 || 1082 || Null SSL certificate buffer
|-
| 0x88669 || 105 || 1091 || Null telemetry flags buffer
|-
| 0x89A69 || 105 || 1101 || Null Gamecard key buffer
|-
| 0x89C69 || 105 || 1102 || Null Gamecard certificate buffer
|-
| 0x8AE69 || 105 || 1111 || Null PTM battery lot buffer
|-
| 0x8B069 || 105 || 1112 || Null PTM fuel gauge parameter buffer
|-
| 0x8C269 || 105 || 1121 || Null ECI device key buffer
|-
| 0x8C469 || 105 || 1122 || Null E-Ticket device key buffer
|-
| 0x8D669 || 105 || 1131 || Null speaker parameter buffer
|-
| 0x8EA69 || 105 || 1141 || Null firmware version buffer
|-
| 0x8EC69 || 105 || 1142 || Null firmware version digest buffer
|-
| 0x8EE69 || 105 || 1143 || Null rebootless system update version buffer
|-
| 0x8FE69 || 105 || 1151 || Null Mii author ID buffer
|-
| 0x91269 || 105 || 1161 || Null fatal flags buffer
|-
| 0x92669 || 105 || 1171 || Null auto update enable flag buffer
|-
| 0x93A69 || 105 || 1181 || Null external RTC reset flag buffer
|-
| 0x94E69 || 105 || 1191 || Null push notification activity mode buffer
|-
| 0x96269 || 105 || 1201 || Null service discovery control setting buffer
|-
| 0x97669 || 105 || 1211 || Null error report share permission buffer
|-
| 0x98A69 || 105 || 1221 || Null LCD vendor ID buffer
|-
| 0x99E69 || 105 || 1231 || Null console SixAxis sensor acceleration bias buffer
|-
| 0x9A069 || 105 || 1232 || Null console SixAxis sensor angular velocity bias buffer
|-
| 0x9A269 || 105 || 1233 || Null console SixAxis sensor acceleration gain buffer
|-
| 0x9A469 || 105 || 1234 || Null console SixAxis sensor angular velocity gain buffer
|-
| 0x9A669 || 105 || 1235 || Null console SixAxis sensor angular velocity time bias buffer
|-
| 0x9A869 || 105 || 1236 || Null console SixAxis sensor angular acceleration buffer
|-
| 0x9B269 || 105 || 1241 || Null keyboard layout buffer
|-
| 0x9BA69 || 105 || 1245 || Invalid keyboard layout
|-
| 0x9C669 || 105 || 1251 || Null web inspector flag buffer
|-
| 0x9C869 || 105 || 1252 || Null allowed SSL hosts buffer
|-
| 0x9CA69 || 105 || 1253 || Null allowed SSL hosts entry count buffer
|-
| 0x9CC69 || 105 || 1254 || Null host FS mount point buffer
|-
| 0x9EE69 || 105 || 1271 || Null Amiibo key buffer
|-
| 0x9F069 || 105 || 1272 || Null Amiibo ECQV certificate buffer
|-
| 0x9F269 || 105 || 1273 || Null Amiibo ECDSA certificate buffer
|-
| 0x9F469 || 105 || 1274 || Null Amiibo ECQV BLS key buffer
|-
| 0x9F669 || 105 || 1275 || Null Amiibo ECQV BLS certificate buffer
|-
| 0x9F869 || 105 || 1276 || Null Amiibo ECQV BLS root certificate buffer
|-
| 0x272 || 114 || 1 || Generic error
|-
| 0xC72 || 114 || 6 || Unsupported operation
|-
| 0x74 || 116 || 0 || Time service not initialized
|-
| 0x274 || 116 || 1 || Permission denied
|-
| 0xCC74 || 116 || 102 || Time not set / Clock Source Id mismatch
|-
| 0x19074 || 116 || 200 || Invalid time comparison
|-
| 0x19274 || 116 || 201 || Signed overflow/underflow
|-
| 0x64274 || 116 || 801 || Memory allocation failure
|-
| 0x70A74 || 116 || 901 || Null pointer
|-
| 0x70C74 || 116 || 902 || Value out of valid range
|-
| 0x70E74 || 116 || 903 || TimeZoneRule conversion failed
|-
| 0x7BA74 || 116 || 989 || TimeZone location name not found
|-
| 0x7BC74 || 116 || 990 || Unimplemented functionality
|-
| 0x27A || 122 || 1 || Invalid argument
|-
| 0x47A || 122 || 2 || Object not found
|-
| 0x67A || 122 || 3 || Object locked/in used
|-
| 0x87A || 122 || 4 || Target already mounted
|-
| 0xA7A || 122 || 5 || Target not mounted
|-
| 0xC7A || 122 || 6 || Object already opened
|-
| 0xE7A || 122 || 7 || Object not opened
|-
| 0xA07A || 122 || 80 || Passphrase not found
|-
| 0xA27A || 122 || 81 || Data verification failed
|-
| 0xB47A || 122 || 90 || Invalid API call
|-
| 0xC47A || 122 || 98 || Invalid operation
|-
| 0x287C || 124 || 20 || Argument is NULL
|-
| 0x2C7C || 124 || 22 || Argument is invalid
|-
| 0x3C7C || 124 || 30 || Bad input buffer size
|-
| 0x407C || 124 || 32 || Invalid input buffer
|-
| 0x27E || 126 || 1 || Invalid argument
|-
| 0x87E || 126 || 4 || Entry not found
|-
| 0xCE7E || 126 || 67 || Invalid database signature value (should be "NFDB")
|-
| 0xD27E || 126 || 69 || Invalid database entry count
|-
| 0x1987E || 126 || 204 || Development/debug-only behavior
|-
| 0x480 || 128 || 2 || IStorage not available.
|-
| 0x4680 || 128 || 35 || Error while launching applet.
|-
| 0x4A80 || 128 || 37 || Title-ID not found. Caused by code 0x410 when applet launch fails
|-
| 0x3E880 || 128 || 500 || Invalid input
|-
| 0x3EC80 || 128 || 502 || IStorage has already been opened by another accessor
|-
| 0x3EE80 || 128 || 503 || IStorage Read/Write out-of-bounds
|-
| 0x3FE80 || 128 || 511 || IStorage opened as wrong type (data opened as transfermem, transfermem opened as data)
|-
| 0x40080 || 128 || 512 || Unbalanced fatal section leave (returned when executing LeaveFatalSection without a preceding EnterFatalSection call)
|-
| 0x4B080 || 128 || 600 || Failed to allocate memory for IStorage
|-
| 0x59080 || 128 || 712 || Thread stack pool exhausted (out of memory)
|-
| 0x79C80 || 128 || 974 || DebugMode not enabled
|-
| 0x7A880 || 128 || 980 || <code>am.debug!dev_function</code> setting needs to be set / DebugMode not enabled
|-
| 0x7CC80 || 128 || 998 || Not Implemented
|-
| 0xA83 || 131 || 5 || Unrecognized applet ID
|-
| 0x485 || 133 || 2 || Invalid DVFS table ID
|-
| 0x885 || 133 || 4 || Invalid parameter
|-
| 0x3CF089 || 137 || 7800 || Unknown/invalid libcurl error.
|-
| 0x3E8289-0x3F4089 || 137 || 8001-8096 || libcurl error 1-96. Some of the libcurl errors in the error-table map to the above unknown-libcurl-error however.
|-
| 0x68A || 138 || 3 || Not initialized.
|-
| 0x668C || 140 || 51 || USB data-transfer in progress
|-
| 0xD48C || 140 || 106 || Invalid descriptor
|-
| 0x1928C || 140 || 201 || USB device not bound / interface already enabled
|-
| 0x290 || 144 || 1 || Exited Abnormally ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Abormal)
|-
| 0x690 || 144 || 3 || Canceled ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Canceled)
|-
| 0x890 || 144 || 4 || Rejected
|-
| 0xA90 || 144 || 5 || Exited Unexpectedly ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Unexpected)
|-
| 0x299 || 153 || 1 || Invalid audio device
|-
| 0x499 || 153 || 2 || Operation couldn't complete successfully
|-
| 0x699 || 153 || 3 || Invalid sample rate
|-
| 0x899 || 153 || 4 || Buffer size too small
|-
| 0x1099 || 153 || 8 || Too many buffers are still unreleased
|-
| 0x1499 || 153 || 10 || Invalid channel count
|-
| 0x40299 || 153 || 513 || Invalid/Unsupported operation
|-
| 0xC0099 || 153 || 1536 || Invalid handle
|-
| 0xC0899 || 153 || 1540 || Audio output was already started
|-
| 0x3C9D || 157 || 30 || Address is NULL
|-
| 0x3E9D || 157 || 31 || PID is NULL
|-
| 0x549D || 157 || 42 || Already bound
|-
| 0xCC9D || 157 || 102 || Invalid PID
|-
| 0xAA3 || 163 || 5 || System is booting up repair process without VOL+ held down.
|-
| 0xCA3 || 163 || 6 || System is booting up repair process that requires RepairTimeReviser but does not have special cartridge inserted.
|-
| 0xC8B2 || 178 || 100 || Invalid user ID
|-
| 0xCAB2 || 178 || 101 || User does not exist
|-
| 0x12CB2 || 178 || 150 || Service unavailable
|-
| 0x190B2 || 178 || 200 || File storage failure
|-
| 0x58ACA || 202 || 709 || Npad ID is out of range.
|-
| 0xF0CD || 205 || 120 || IR image data not available/ready.
|-
| 0x1A8CD || 205 || 212 || IR camera handle pointer is null.
|-
| 0x198CD || 205 || 204 || IR camera invalid handle value.
|-
| 0x35B || 347 || 1 || Failed to init SM.
|-
| 0x55B || 347 || 2 || Failed to init FS.
|-
| 0x75B || 347 || 3 || Failed to open NRO file. May also happen when SD card isn't inserted / SD mounting failed earlier.
|-
| 0x95B || 347 || 4 || Failed to read NRO header.
|-
| 0xB5B || 347 || 5 || Invalid NRO magic.
|-
| 0xD5B || 347 || 6 || Invalid NRO segments.
|-
| 0xF5B || 347 || 7 || Failed to read NRO.
|-
| 0x135B || 347 || 9 || Failed to allocate heap.
|-
| 0x255B || 347 || 18 || Failed to map code-binary memory.
|-
| 0x275B || 347 || 19 || Failed to map code memory (.text).
|-
| 0x295B || 347 || 20 || Failed to map code memory (.rodata).
|-
| 0x2B5B || 347 || 21 || Failed to map code memory (.data+.bss).
|-
| 0x315B || 347 || 24 || Failed to unmap code memory (.text).
|-
| 0x335B || 347 || 25 || Failed to unmap code memory (.rodata).
|-
| 0x355B || 347 || 26 || Failed to unmap code memory (.data+.bss).
|}

== FS Error Codes ==
The following are the error codes recognized by nn::fs::detail::LogErrorMessage found in some [[Factory Setup|factory]] titles:

{| class=wikitable
! Value || Description || Message
|-
| 0x7802 || 60 || nn::fs::ResultMountNameAlreadyExists: Error: Specified mount name already exists.
|-
| 0xD401 || 106 || nn::svc::ResultInvalidCurrentMemory: Error: Passed buffer is not usable for fs library. See a manual of fs library for more information.
|-
| 0x7D202 || 1001 || nn::fs::ResultPartitionNotFound: Error: Specified partition is not found.
|-
| 0x7D402 || 1002 || nn::fs::ResultTargetNotFound: Error: Specified target is not found.
|-
| 0xFA002 - 0x138602 || 2000 - 2499 || nn::fs::ResultSdCardAccessFailed: Error: Failed to access SD card.
|-
| 0x136802 - 0x176E02 || 2500 - 2999 || nn::fs::ResultGameCardAccessFailed: Error: Failed to access game card.
|-
| 0x177202 || 3001 || nn::fs::ResultNotImplemented: Error: Specified operation is not implemented.
|-
| 0x177A02 || 3005 || nn::fs::ResultOutOfRange: Error: Specified value is out of range.
|-
| 0x190002 - 0x1B5602 || 3200 - 3499 || nn::fs::ResultAllocationMemoryFailed: Error: Failed to allocate memory.
|-
| 0x1B5802 - 0x1F3E02 || 3500 - 3999 || nn::fs::ResultMmcAccessFailed: Error: Failed to access MMC.
|-
| 0x1F4202 - 0x219602 || 4001 - 4299 || nn::fs::ResultRomCorrupted: Error: ROM is corrupted.
|-
| 0x219A02 - 0x232602 || 4301 - 4499 || nn::fs::ResultSaveDataCorrupted: Error: Save data is corrupted.
|-
| 0x232A02 - 0x23EE02 || 4501 - 4599 || nn::fs::ResultNcaCorrupted: Error: NCA is corrupted.
|-
| 0x23F202 - 0x243E02 || 4601 - 4639 || nn::fs::ResultIntegrityVerificationStorageCorrupted: Error: Integrity verification failed.
|-
| 0x244202 - 0x246602 || 4641 - 4659 || nn::fs::ResultPartitionFileSystemCorrupted: Error: Partition FS is corrupted.
|-
| 0x246A02 - 0x248E02 || 4661 - 4679 || nn::fs::ResultBuiltInStorageCorrupted: Error: Built-in-storage is corrupted.
|-
| 0x249202 - 0x24B602 || 4681 - 4699 || nn::fs::ResultFatFileSystemCorrupted: Error: FAT FS is corrupted.
|-
| 0x24BA02 - 0x24DE02 || 4701 - 4719 || nn::fs::ResultHostFileSystemCorrupted: Error: HOST FS is corrupted.
|-
| 0x1F4002 - 0x270E02 || 4000, 4300, 4500, 4600, 4640, 4660, 4680, 4700, 4720-4999 || nn::fs::ResultDataCorrupted: Error: Data is corrupted.
|-
| 0x271002 - 0x2EDE02 || 5000-5999 || nn::fs::ResultUnexpected: Error: Unexpected failure occurred.
|-
| 0x2EE002 - 0x32C602 || 6000-6499 || nn::fs::ResultPreconditionViolation: Error: Precondition violation.
|-
| 0x2EE202 - 0x306E02 || 6001-6199 || nn::fs::ResultInvalidArgument: Error: Invalid argument was specified.
|-
| 0x2EE402 - 0x2F1A02 || 6002-6029 || nn::fs::ResultInvalidPath: Error: Invalid path was specified.
|-
| 0x2EE602 || 6003 || nn::fs::ResultTooLongPath: Error: Too long path was specified.
|-
| 0x2EE802 || 6004 || nn::fs::ResultInvalidCharacter: Error: Invalid path character was specified.
|-
| 0x2EEA02 || 6005 || nn::fs::ResultInvalidPathFormat: Error: Invalid path format was specified.
|-
| 0x2F5A02 || 6061 || nn::fs::ResultInvalidOffset: Error: Invalid offset was specified.
|-
| 0x2F5C02 || 6062 || nn::fs::ResultInvalidSize: Error: Invalid size was specified.
|-
| 0x2F5E02 || 6063 || nn::fs::ResultNullptrArgument: Error: Null pointer argument was specified.
|-
| 0x2F6202 || 6065 || nn::fs::ResultInvalidMountName: Error: Invalid mount name was specified.
|-
| 0x2F6402 || 6066 || nn::fs::ResultExtensionSizeTooLarge: Error: Extension size exceeds max value set in nmeta file.
|-
| 0x2F6602 || 6067 || nn::fs::ResultExtensionSizeInvalid: Error: Extension size is not a multiple of nn::fs::SaveDataExtensionUnitSize.
|-
| 0x307202 || 6201 || nn::fs::ResultFileExtensionWithoutOpenModeAllowAppend: Error: OpenMode_AllowAppend is required for implicit extension of file size by WriteFile().
|-
| 0x307002 - 0x313602 || 6200, 6202 - 6299 || nn::fs::ResultInvalidOperationForOpenMode: Error: Invalid operation for the open mode.
|-
| 0x313802 - 0x31FE02 || 6300-6399 || nn::fs::ResultUnsupportedOperation: Error: Unsupported operation.
|-
| 0x320002 - 0x326202 || 6400-6449 || nn::fs::ResultPermissionDenied: Error: Permission denied.
|-
| 0x327202 || 6457 || nn::fs::ResultWriteModeFileNotClosed: Error: Close files opened in write mode before committing.
|-
| 0x328202 || 6465 || nn::fs::ResultUserNotExist: Error: Specified user doesn't exist.
|-
| 0x346402 || 6706 || nn::fs::ResultMappingTableFull: Error: Enough journal space is not left.
|-
| 0x346A02 || 6709 || nn::fs::ResultOpenCountLimit: Error: The open count of files and directories reached the limitation.
|-
| 0x353602 || 6811 || nn::fs::ResultMapFull: Error: Save data extension count reached the limitation.
|-
| 0x35F202 || 6905 || nn::fs::ResultNotMounted: Error: Specified mount name is not found.
|}

= Fatal Errors =
{| class=wikitable
! Error || Description
|-
| 2162-0002
| Can be triggered by running [[SVC|svcBreak]]. The svcBreak params have no effect on the value of the thrown error-code.
|-
| 2168-0000
| Userland ARM undefined instruction exception
|-
| 2168-0001
| Userland ARM prefetch-abort due to PC set to non-executable region
|-
| 2168-0002
| Userland ARM data abort. Also caused by abnormal process termination via [[SVC|svcExitProcess]]. Note: directly jumping to nnMain()-retaddr from non-main-thread has the same result.
|-
| 2168-0003
| Userland PC address not aligned to 4 bytes
|-
| 2168-0008
| Can occur when attempting to call an svc outside the whitelist
|}

= Support Errors =
This section is for Support Errors displayed by the error-applet, separate from the normal Result errors.

== Support Modules ==
{| class=wikitable
! Value || Name
|-
| 800 || [[Internet_Browser|General web-applet]]
|-
| 809 || [[Internet_Browser|WifiWebAuthApplet]]
|-
| 810 || [[Internet_Browser|Whitelisted-applet]]
|-
| 811 || [[Internet_Browser|ShopN]]
|}

8XX is for/includes system applets.

== Errors ==
{| class=wikitable
! Error || Module || Description || Notes
|-
|
| {web-applets listed above}
| 2750
| MP4 parsing failed.
|}

Normal error-codes displayed by the system also use the same format as fatal-errors.

SVC

2019-09-20T07:58:22Z

Roblabla: Link resetsignal to doc.

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || [[#svcSignalEvent]] || W0=wevent_handle || W0=result
|-
| 0x12 || [[#svcClearEvent]] || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || [[#svcResetSignal]] || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value
R0=reslimit_handle, R1=[[#LimitableResource]], R2=value_lower32, R3=value_upper32
|| W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args
R0=smc_sub_id, R1, R2, R3=smc_args
|| X0,X1,X2,X3,X4,X5,X6,X7=result
R0,R1,R2,R3=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to OutAddr.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

=== Result codes ===

'''0x0:''' Success. The memory region was reprotected.

'''0xCC01:''' Unaligned address specified.

'''0xCA01:''' Unaligned or zero size specified.

'''0xD401:''' The provided memory region does not fall within the userland address space.

'''0xD801:''' Invalid permission specified. Valid permissions are ---, r-- and rw-.

'''0xD401:''' The provided memory region was in an invalid state. The region must have the PermissionChangeAllowed bit set in its [[#MemoryState]], and must not have the IsBorrowed or IsUncached [[#MemoryAttribute]].

'''0xCE01:''' Kernel resource exhausted.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcSignalEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Puts the given event in the signaled state.

Will wake up any thread currently waiting on this event. Can potentially trigger a reschedule.

Any calls to [[#svcWaitSynchronization]] on this handle will return immediately, until the event's signaled state is reset.

=== Result codes ===

'''0x0:''' Success. Event is now in signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a WritableEvent.

== svcClearEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent or ReadableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Takes the given event out of the signaled state.

=== Result codes ===

'''0x0:''' Success, the event is now in the not-signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a ReadableEvent nor a WritableEvent.

'''0xFA01:''' The handle was not in a signaled state.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcResetSignal ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<ReadableEvent> or Handle<Process> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Resets the signal on the given handle, ensuring future calls to [[#svcWaitSynchronization]] on this handle will sleep until the handle is signaled again. If the handle is a ReadableEvent, this is equivalent to calling svcClearEvent() on the handle.

If the handle is a Process, it will clear the signaled state (which is set when the process changes [[#ProcessState]]. Once the process enters the Exited state, calling svcResetSignal on the process will no longer have an effect (the process is permanently signaled), and the syscall will return 0xFA01.

=== Result codes ===

'''0x0:''' Success. The signal was reset.

'''0xE401:''' The handle is invalid or of the wrong type.

'''0xFA01:''' The handle was not signaled, or the process is in exited state, causing it to be permanently signaled.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Process || 23 || 0 || [9.0.0+]
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || R1-R3 || u64 || SMC sub-arguments
|-
| (Out) X0 || R0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || R1-R3 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description || Meaning
|-
| 7-0 || Type ||
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]] ||
|-
| 9 || ForceReadWritableByDebugSyscalls || Allows using [[#svcWriteDebugProcessMemory]] on segments mapped read-only.
|-
| 10 || IpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=0.
|-
| 11 || NonDeviceIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=1.
|-
| 12 || NonSecureIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=3.
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]] ||
|-
| 15 || [[#svcMapMemory|MapAllowed]] ||
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]] ||
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]] ||
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]] ||
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]]) ||
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]] ||
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]] ||
|-
| 22 || IsPoolAllocated/IsReferenceCounted || The physical memory blocks backing this region are refcounted.
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]] ||
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]] ||
|-
| 25 || [4.0.0+] [[#svcCreateCodeMemory|CodeMemoryAllowed]] ||
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-09-20T07:57:57Z

Roblabla: Add documentation for svcResetSignal

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || [[#svcSignalEvent]] || W0=wevent_handle || W0=result
|-
| 0x12 || [[#svcClearEvent]] || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value
R0=reslimit_handle, R1=[[#LimitableResource]], R2=value_lower32, R3=value_upper32
|| W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args
R0=smc_sub_id, R1, R2, R3=smc_args
|| X0,X1,X2,X3,X4,X5,X6,X7=result
R0,R1,R2,R3=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to OutAddr.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

=== Result codes ===

'''0x0:''' Success. The memory region was reprotected.

'''0xCC01:''' Unaligned address specified.

'''0xCA01:''' Unaligned or zero size specified.

'''0xD401:''' The provided memory region does not fall within the userland address space.

'''0xD801:''' Invalid permission specified. Valid permissions are ---, r-- and rw-.

'''0xD401:''' The provided memory region was in an invalid state. The region must have the PermissionChangeAllowed bit set in its [[#MemoryState]], and must not have the IsBorrowed or IsUncached [[#MemoryAttribute]].

'''0xCE01:''' Kernel resource exhausted.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcSignalEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Puts the given event in the signaled state.

Will wake up any thread currently waiting on this event. Can potentially trigger a reschedule.

Any calls to [[#svcWaitSynchronization]] on this handle will return immediately, until the event's signaled state is reset.

=== Result codes ===

'''0x0:''' Success. Event is now in signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a WritableEvent.

== svcClearEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent or ReadableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Takes the given event out of the signaled state.

=== Result codes ===

'''0x0:''' Success, the event is now in the not-signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a ReadableEvent nor a WritableEvent.

'''0xFA01:''' The handle was not in a signaled state.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcResetSignal ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<ReadableEvent> or Handle<Process> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Resets the signal on the given handle, ensuring future calls to [[#svcWaitSynchronization]] on this handle will sleep until the handle is signaled again. If the handle is a ReadableEvent, this is equivalent to calling svcClearEvent() on the handle.

If the handle is a Process, it will clear the signaled state (which is set when the process changes [[#ProcessState]]. Once the process enters the Exited state, calling svcResetSignal on the process will no longer have an effect (the process is permanently signaled), and the syscall will return 0xFA01.

=== Result codes ===

'''0x0:''' Success. The signal was reset.

'''0xE401:''' The handle is invalid or of the wrong type.

'''0xFA01:''' The handle was not signaled, or the process is in exited state, causing it to be permanently signaled.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Process || 23 || 0 || [9.0.0+]
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || R1-R3 || u64 || SMC sub-arguments
|-
| (Out) X0 || R0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || R1-R3 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description || Meaning
|-
| 7-0 || Type ||
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]] ||
|-
| 9 || ForceReadWritableByDebugSyscalls || Allows using [[#svcWriteDebugProcessMemory]] on segments mapped read-only.
|-
| 10 || IpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=0.
|-
| 11 || NonDeviceIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=1.
|-
| 12 || NonSecureIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=3.
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]] ||
|-
| 15 || [[#svcMapMemory|MapAllowed]] ||
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]] ||
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]] ||
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]] ||
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]]) ||
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]] ||
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]] ||
|-
| 22 || IsPoolAllocated/IsReferenceCounted || The physical memory blocks backing this region are refcounted.
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]] ||
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]] ||
|-
| 25 || [4.0.0+] [[#svcCreateCodeMemory|CodeMemoryAllowed]] ||
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

Error codes

2019-09-11T07:15:55Z

Roblabla: Add some missing errors from loader.

= Structure =
These have been redesigned from the 3DS so that they fit within a Aarch64 MOV instruction immediate most of the time (without requiring the additional MOVK).

{| class=wikitable
! Bits || Field
|-
| 8-0 || Module
|-
| 21-9 || Description
|}

When a fatal-error is received the error code is outputted using the following formatter:
%04d-%04d

.. where the first code is <code>2000 + Module</code>, and the other being <code>Description</code>. Bits >=22 from the error-code are unused when displaying fatal-errors, since the Description ends with bit21.

= Modules =
{| class=wikitable
! Value || Name
|-
| 1 || Kernel
|-
| 2 || FS
|-
| 3 || OS (Memory, Thread, Mutex, NVIDIA)
|-
| 4 || HTCS
|-
| 5 || NCM
|-
| 6 || DD
|-
| 7 || Debug Monitor
|-
| 8 || LR
|-
| 9 || Loader
|-
| 10 || CMIF (IPC command interface)
|-
| 11 || HIPC (IPC)
|-
| 15 || PM
|-
| 16 || NS
|-
| 17 || Sockets
|-
| 18 || HTC
|-
| 19 || TSC
|-
| 20 || NCM (content)
|-
| 21 || SM
|-
| 22 || RO (userland)
|-
| 24 || SDMMC
|-
| 25 || OVLN
|-
| 26 || SPL
|-
| 30 || Bus
|-
| 100 || ETHC
|-
| 101 || I2C
|-
| 102 || GPIO
|-
| 103 || UART
|-
| 105 || Settings
|-
| 107 || WLAN
|-
| 108 || HID (xcd)
|-
| 110 || NIFM
|-
| 111 || Hwopus
|-
| 112 || HID (sasbus)
|-
| 113 || Bluetooth
|-
| 114 || VI
|-
| 115 || NFP
|-
| 116 || Time
|-
| 117 || FGM
|-
| 118 || OE
|-
| 120 || PCIe
|-
| 121 || Friends
|-
| 122 || BCAT
|-
| 123 || SSL
|-
| 124 || Account
|-
| 125 || News
|-
| 126 || Mii
|-
| 127 || NFC
|-
| 128 || AM
|-
| 129 || Play Report
|-
| 130 || HID (ahid)
|-
| 132 || Home Menu (Qlaunch)
|-
| 133 || PCV
|-
| 134 || OMM
|-
| 135 || BPC
|-
| 136 || PSM
|-
| 137 || NIM
|-
| 138 || PSC
|-
| 139 || TC
|-
| 140 || USB
|-
| 141 || NSD
|-
| 142 || PCTL
|-
| 143 || BTM
|-
| 144 || LA (Library Applet)
|-
| 145 || ETicket
|-
| 146 || NGC (Bad Words)
|-
| 147 || Error Report
|-
| 148 || APM
|-
| 149 || CEC
|-
| 150 || Profiler
|-
| 151 || Error Upload
|-
| 153 || Audio
|-
| 154 || NPNS
|-
| 155 || NPNS (XMPP Stream)
|-
| 157 || ARP
|-
| 158 || Updater
|-
| 159 || SWKBD
|-
| 161 || NFC (Mifare)
|-
| 162 || Userland (assert)
|-
| 163 || Fatal
|-
| 164 || NIM (shop)
|-
| 165 || SPSM
|-
| 167 || BGTC
|-
| 168 || Userland (crash)
|-
| 169 || Sasbus (Periodic Receive Mode)
|-
| 178 || PDM
|-
| 179 || OLSC
|-
| 180 || SREPO
|-
| 181 || Dauth
|-
| 187 || Sasbus
|-
| 191 || RTC
|-
| 192 || Regulator
|-
| 193 || Led
|-
| 197 || Clkrst
|-
| 202 || HID
|-
| 203 || LDN
|-
| 205 || HID (irsensor)
|-
| 206 || Capture
|-
| 208 || Manu
|-
| 209 || ATK
|-
| 210 || Web
|-
| 211 || Unknown
|-
| 212 || GRC
|-
| 216 || Migration
|-
| 217 || Migration (Idc Server)
|-
| 229 || Glue (notification)
|-
| 230 || PSC (ins)
|-
| 345 || libnx
|-
| 346 || [[Homebrew ABI]]
|-
| 347 || Homebrew Loader
|-
| 348 || libnx Nvidia errors
|-
|}

= Error codes =
{| class=wikitable
! Value || Module || Description || Notes
|-
| 0x0E01 || 1 || 7 || Session count exceeded
|-
| 0x1C01 || 1 || 14 || Invalid kernel capability descriptor
|-
| 0x4201 || 1 || 33 || Not Implemented
|-
| 0x7601 || 1 || 59 || Thread terminated/termination requested
|-
| 0x8C01 || 1 || 70 || No more debug events
|-
| 0xCA01 || 1 || 101 || Invalid size
|-
| 0xCC01 || 1 || 102 || Invalid address
|-
| 0xCE01 || 1 || 103 || Resource exhaustion
|-
| 0xD001 || 1 || 104 || Memory exhaustion
|-
| 0xD201 || 1 || 105 || Handle-table exhaustion
|-
| 0xD401 || 1 || 106 || Invalid memory state / invalid memory permissions.
|-
| 0xD801 || 1 || 108 || Invalid memory permissions.
|-
| 0xDC01 || 1 || 110 || Invalid memory range
|-
| 0xE001 || 1 || 112 || Invalid thread priority.
|-
| 0xE201 || 1 || 113 || Invalid processor id.
|-
| 0xE401 || 1 || 114 || Invalid handle.
|-
| 0xE601 || 1 || 115 || Invalid pointer/Syscall copy from user failed.
|-
| 0xE801 || 1 || 116 || Invalid combination
|-
| 0xEA01 || 1 || 117 || Time out. Also when you give 0 handles to svcWaitSynchronizationN.
|-
| 0xEC01 || 1 || 118 || Operation canceled
|-
| 0xEE01 || 1 || 119 || Out of range
|-
| 0xF001 || 1 || 120 || Invalid enum
|-
| 0xF201 || 1 || 121 || No such entry
|-
| 0xF401 || 1 || 122 || Irq/DeviceAddressSpace/{...} already registered
|-
| 0xF601 || 1 || 123 || Port remote dead
|-
| 0xF801 || 1 || 124 || [Usermode] Unhandled interrupt/exception
|-
| 0xFA01 || 1 || 125 || Process already started/Wrong memory permission?
|-
| 0xFC01 || 1 || 126 || Reserved value
|-
| 0xFE01 || 1 || 127 || Invalid hardware breakpoint
|-
| 0x10001 || 1 || 128 || [Usermode] Fatal exception
|-
| 0x10201 || 1 || 129 || Last thread didn't belong to your process
|-
| 0x10601 || 1 || 131 || Port closed
|-
| 0x10801 || 1 || 132 || Resource limit exceeded
|-
| 0x20801 || 1 || 260 || Command buffer too small
|-
| 0x40A01 || 1 || 517 || Invalid process ID.
|-
| 0x40C01 || 1 || 518 || Invalid thread ID.
|-
| 0x40E01 || 1 || 519 || Invalid thread ID (used in svcGetDebugThreadParam).
|-
| 0x41001 || 1 || 520 || Process not being debugged
|-
| 0x202 || 2 || 1 || Path does not exist.
|-
| 0x402 || 2 || 2 || Path already exists.
|-
| 0xE02 || 2 || 7 || Resource already in use (file already opened, savedata filesystem already mounted).
|-
| 0x4602 || 2 || 35 || Not enough free space for BIS Calibration partition.
|-
| 0x4802 || 2 || 36 || Not enough free space for BIS Safe partition.
|-
| 0x4A02 || 2 || 37 || Not enough free space for BIS User partition.
|-
| 0x4C02 || 2 || 38 || Not enough free space for BIS System partition.
|-
| 0x4E02 || 2 || 39 || Not enough free space on SD card.
|-
| 0x6402 || 2 || 50 || NCA is older than version 3, or NCA SDK version is older than 0.11.0.0
|-
| 0x7802 || 2 || 60 || Specified mount name already exists.
|-
| 0x7D202 || 2 || 1001 || Process does not have RomFs
|-
| 0x7D402 || 2 || 1002 || Title-id not found / savedata not found.
|-
| 0xFA202 || 2 || 2001 || SD card not inserted
|-
| 0x13B002 || 2 || 2520 || Gamecard not inserted
|-
| 0x13DA02 || 2 || 2541 || Version check failed when mounting gamecard sysupdate partition?
|-
| 0x171402 || 2 || 2954 || Invalid gamecard handle.
|-
| 0x177202 || 2 || 3001 || Unimplemented behavior
|-
| 0x177602 || 2 || 3003 || File/Directory already exists.
|-
| 0x190202 || 2 || 3201 || Memory allocation failure related to FAT filesystem code
|-
| 0x190602 || 2 || 3203 || Memory allocation failure related to FAT filesystem code
|-
| 0x190802 || 2 || 3204 || Memory allocation failure related to FAT filesystem code
|-
| 0x190A02 || 2 || 3205 || Memory allocation failure related to FAT filesystem code
|-
| 0x190C02 || 2 || 3206 || Memory allocation failure related to FAT filesystem code
|-
| 0x191002 || 2 || 3208 || Memory allocation failure related to FAT filesystem code
|-
| 0x195802 || 2 || 3244 || Allocation failure related to SD cards
|-
| 0x196002 || 2 || 3248 || Out of memory
|-
| 0x196202 || 2 || 3249 || Out of memory
|-
| 0x1A3E02 || 2 || 3359 || Out of memory
|-
| 0x1A4002 || 2 || 3360 || Out of memory
|-
| 0x1A4A02 || 2 || 3365 || Out of memory
|-
| 0x21BC02 || 2 || 4318 || Invalid save data filesystem magic (valid magic is SAVE in ASCII)
|-
| 0x234202 || 2 || 4513 || Error reading ACID section in NPDM
|-
| 0x234402 || 2 || 4514 || Invalid NPDM ACID section size
|-
| 0x234602 || 2 || 4515 || Last byte of the ACID modulus is zero
|-
| 0x234802 || 2 || 4516 || Invalid ACID fixed key signature
|-
| 0x234A02 || 2 || 4517 || Invalid NCA magic
|-
| 0x234C02 || 2 || 4518 || Invalid NCA header fixed key signature
|-
| 0x234E02 || 2 || 4519 || Invalid NCA header ACID signature
|-
| 0x235002 || 2 || 4520 || Invalid NCA header section hash
|-
| 0x235202 || 2 || 4521 || Invalid NCA Key index
|-
| 0x235602 || 2 || 4523 || Invalid encryption type
|-
| 0x235802 || 2 || 4524 || Redirection BKTR table size is negative
|-
| 0x235A02 || 2 || 4525 || Encryption BKTR table size is negative
|-
| 0x235C02 || 2 || 4526 || Redirection BKTR table end offset is past the Encryption BKTR table start offset
|-
| 0x235E02 || 2 || 4527 || NCA-path used with the wrong titleID.
|-
| 0x236002 || 2 || 4528 || NCA header value is out of range
|-
| 0x236202 || 2 || 4529 || NCA FS header value is out of range
|-
| 0x236802 || 2 || 4532 || PartitionFS hash block size is not a power of 2
|-
| 0x236A02 || 2 || 4533 || PartitionFS hash "always_2" field is not 2
|-
| 0x236C02 || 2 || 4534 || PartitionFS hash table is too small for main data
|-
| 0x236E02 || 2 || 4535 || Invalid PartitionFS block hash
|-
| 0x244402 || 2 || 4642 || Invalid Partition file hashed region bounds
|-
| 0x244602 || 2 || 4643 || Invalid Partition FS hash
|-
| 0x244802 || 2 || 4644 || Invalid PFS0 magic
|-
| 0x244A02 || 2 || 4645 || Invalid HFS0 magic
|-
| 0x244C02 || 2 || 4646 || Invalid name offset for Partition FS file entry
|-
| 0x244E02 || 2 || 4647 || Calculated Partition FS header size changed between 2 consecutive reads
|-
| 0x249802 || 2 || 4684 || Invalid FAT file number.
|-
| 0x249C02 || 2 || 4686 || Invalid FAT format for BIS User partition.
|-
| 0x249E02 || 2 || 4687 || Invalid FAT format for BIS System partition.
|-
| 0x24A002 || 2 || 4688 || Invalid FAT format for BIS Safe partition.
|-
| 0x24A202 || 2 || 4689 || Invalid FAT format for BIS Calibration partition.
|-
| 0x250E02 || 2 || 4743 || [[NAX0|Corrupted]] NAX0 header.
|-
| 0x251002 || 2 || 4744 || Invalid [[NAX0]] magicnum.
|-
| 0x280202 || 2 || 5121 || Invalid FAT size
|-
| 0x280402 || 2 || 5122 || Invalid FAT BPB (BIOS Parameter Block)
|-
| 0x280602 || 2 || 5123 || Invalid FAT parameter
|-
| 0x280802 || 2 || 5124 || Invalid FAT sector
|-
| 0x280A02 || 2 || 5125 || Invalid FAT sector
|-
| 0x280C02 || 2 || 5126 || Invalid FAT sector
|-
| 0x280E02 || 2 || 5127 || Invalid FAT sector
|-
| 0x296A02 || 2 || 5301 || Mountpoint not found
|-
| 0x2EE202 || 2 || 6001 || Invalid input
|-
| 0x2EE602 || 2 || 6003 || Path too long
|-
| 0x2EE802 || 2 || 6004 || Invalid character.
|-
| 0x2EEA02 || 2 || 6005 || Invalid directory path.
|-
| 0x2EEC02 || 2 || 6006 || Unable to retrieve directory from path
|-
| 0x2F5A02 || 2 || 6061 || Offset outside storage
|-
| 0x313802 || 2 || 6300 || Operation not supported
|-
| 0x313C02 || 2 || 6302 || Attempted to resize a nn::fs::SubStorage or BufferedStorage that is marked as non-resizable
|-
| 0x313E02 || 2 || 6303 || Attempted to resize a nn::fs::SubStorage or BufferedStorage when the SubStorage ends before the base storage
|-
| 0x314002 || 2 || 6304 || Attempted to call nn::fs::MemoryStorage::SetSize
|-
| 0x314202 || 2 || 6305 || Invalid Operation ID in nn::fs::MemoryStorage::OperateRange
|-
| 0x314402 || 2 || 6306 || Invalid Operation ID in nn::fs::FileStorage::OperateRange
|-
| 0x314C02 || 2 || 6310 || Attempted to call nn::fssystem::AesCtrCounterExtendedStorage::Write
|-
| 0x314E02 || 2 || 6311 || Attempted to call nn::fssystem::AesCtrCounterExtendedStorage::SetSize
|-
| 0x315002 || 2 || 6312 || Invalid Operation ID in nn::fssystem::AesCtrCounterExtendedStorage::OperateRange
|-
| 0x315802 || 2 || 6316 || Attempted to call nn::fssystem::save::HierarchicalIntegrityVerificationStorage::SetSize
|-
| 0x315A02 || 2 || 6317 || Attempted to call nn::fssystem::save::HierarchicalIntegrityVerificationStorage::OperateRange
|-
| 0x315C02 || 2 || 6318 || Attempted to call nn::fssystem::save::IntegrityVerificationStorage::SetSize
|-
| 0x315E02 || 2 || 6319 || Attempted to invalidate the cache of a RomFs IVFC storage in nn::fssystem::save::IntegrityVerificationStorage::OperateRange
|-
| 0x316002 || 2 || 6320 || Invalid Operation ID in nn::fssystem::save::IntegrityVerificationStorage::OperateRange
|-
| 0x316202 || 2 || 6321 || Attempted to call nn::fssystem::save::BlockCacheBufferedStorage::SetSize
|-
| 0x316402 || 2 || 6322 || Attempted to invalidate the cache of something other than a savedata IVFC storage in nn::fssystem::save::BlockCacheBufferedStorage::OperateRange
|-
| 0x316602 || 2 || 6323 || Invalid Operation ID in nn::fssystem::save::BlockCacheBufferedStorage::OperateRange
|-
| 0x316802 || 2 || 6324 || Attempted to call nn::fssystem::IndirectStorage::Write
|-
| 0x316A02 || 2 || 6325 || Attempted to call nn::fssystem::IndirectStorage::SetSize
|-
| 0x316C02 || 2 || 6326 || Invalid Operation ID in nn::fssystem::IndirectStorage::OperateRange
|-
| 0x317202 || 2 || 6329 || Attempted to call nn::fssystem::HierarchicalSha256Storage::SetSize
|-
| 0x317402 || 2 || 6330 || Attempted to call nn::fssystem::ReadOnlyBlockCacheStorage::Write
|-
| 0x317602 || 2 || 6331 || Attempted to call nn::fssystem::ReadOnlyBlockCacheStorage::SetSize
|-
| 0x317802 || 2 || 6332 || Attempted to call nn::fssystem::IntegrityRomFsStorage::SetSize
|-
| 0x317A02 || 2 || 6333 || Attempted to call nn::fssystem::save::DuplexStorage::SetSize
|-
| 0x317C02 || 2 || 6334 || Invalid Operation ID in nn::fssystem::save::DuplexStorage::OperateRange
|-
| 0x317E02 || 2 || 6335 || Attempted to call nn::fssystem::save::HierarchicalDuplexStorage::SetSize
|-
| 0x318002 || 2 || 6336 || Attempted to call nn::fssystem::save::RemapStorage::GetSize
|-
| 0x318202 || 2 || 6337 || Attempted to call nn::fssystem::save::RemapStorage::SetSize
|-
| 0x318402 || 2 || 6338 || Invalid Operation ID in nn::fssystem::save::RemapStorage::OperateRange
|-
| 0x318602 || 2 || 6339 || Attempted to call nn::fssystem::save::IntegritySaveDataStorage::SetSize
|-
| 0x318802 || 2 || 6340 || Invalid Operation ID in nn::fssystem::save::IntegritySaveDataStorage::OperateRange
|-
| 0x318A02 || 2 || 6341 || Attempted to call nn::fssystem::save::JournalIntegritySaveDataStorage::SetSize
|-
| 0x318C02 || 2 || 6342 || Invalid Operation ID in nn::fssystem::save::JournalIntegritySaveDataStorage::OperateRange
|-
| 0x318E02 || 2 || 6343 || Attempted to call nn::fssystem::save::JournalStorage::GetSize
|-
| 0x319002 || 2 || 6344 || Attempted to call nn::fssystem::save::JournalStorage::SetSize
|-
| 0x319202 || 2 || 6345 || Invalid Operation ID in nn::fssystem::save::JournalStorage::OperateRange
|-
| 0x319602 || 2 || 6347 || Attempted to call nn::fssystem::dbm::AllocationTableStorage::SetSize
|-
| 0x31A602 || 2 || 6355 || Invalid Operation ID in nn::fat::FatFile::DoOperateRange
|-
| 0x31A802 || 2 || 6356 || Invalid Operation ID in nn::fssystem::StorageFile::DoOperateRange
|-
| 0x31AE02 || 2 || 6359 || Invalid Query ID in nn::fssystem::ConcatenationFileSystem::DoQueryEntry
|-
| 0x31B002 || 2 || 6360 || Invalid Operation ID in nn::fssystem::ConcatenationFile::DoOperateRange
|-
| 0x31B402 || 2 || 6362 || Invalid Operation ID in nn::fs::detail::FileServiceObjectAdapter::DoOperateRange
|-
| 0x31B602 || 2 || 6363 || Invalid Operation ID in nn::fssystem::AesXtsFile::DoOperateRange
|-
| 0x31B802 || 2 || 6364 || Attempted to modify a nn::fs::RomFsFileSystem
|-
| 0x31BA02 || 2 || 6365 || Attempted to call nn::fs::RomFsFileSystem::DoCommitProvisionally
|-
| 0x31BC02 || 2 || 6366 || Attempted to query the space in a nn::fs::RomFsFileSystem
|-
| 0x31BE02 || 2 || 6367 || Attempted to modify a nn::fssystem::RomFsFile
|-
| 0x31C002 || 2 || 6368 || Invalid Operation ID in nn::fssystem::RomFsFile::DoOperateRange
|-
| 0x31C202 || 2 || 6369 || Attempted to modify a nn::fs::ReadOnlyFileSystemTemplate
|-
| 0x31C402 || 2 || 6370 || Attempted to call nn::fs::ReadOnlyFileSystemTemplate::DoCommitProvisionally
|-
| 0x31C602 || 2 || 6371 || Attempted to query the space in a nn::fs::ReadOnlyFileSystemTemplate
|-
| 0x31C802 || 2 || 6372 || Attempted to modify a nn::fs::ReadOnlyFileSystemFile
|-
| 0x31CA02 || 2 || 6373 || Invalid Operation ID in nn::fs::ReadOnlyFileSystemFile::DoOperateRange
|-
| 0x31CC02 || 2 || 6374 || Attempted to modify a nn::fssystem::PartitionFileSystemCore
|-
| 0x31CE02 || 2 || 6375 || Attempted to call nn::fssystem::PartitionFileSystemCore::DoCommitProvisionally
|-
| 0x31D002 || 2 || 6376 || Attempted to call nn::fssystem::PartitionFileSystemCore::PartitionFile::DoSetSize
|-
| 0x31D202 || 2 || 6377 || Invalid Operation ID in nn::fssystem::PartitionFileSystemCore::PartitionFile::DoOperateRange
|-
| 0x31DC02 || 2 || 6382 || Attempted to call nn::fssystem::ApplicationTemporaryFileSystem::DoCommitProvisionally
|-
| 0x31DE02 || 2 || 6383 || Attempted to call nn::fssystem::SaveDataFileSystem::DoCommitProvisionally
|-
| 0x31E002 || 2 || 6384 || Attempted to call nn::fssystem::DirectorySaveDataFileSystem::DoCommitProvisionally
|-
| 0x320002 || 2 || 6400 || Permission denied
|-
| 0x326602 || 2 || 6451 || Missing titlekey(?) required to mount content
|-
| 0x326E02 || 2 || 6455 || File not closed
|-
| 0x327002 || 2 || 6456 || Directory not closed
|-
| 0x327202 || 2 || 6457 || Writable file not closed when committing
|-
| 0x327402 || 2 || 6458 || FS allocators already registered
|-
| 0x327602 || 2 || 6459 || FS allocators already used
|-
| 0x327A02 || 2 || 6461 || FS allocator alignment violation
|-
| 0x339402 || 2 || 6602 || File not found.
|-
| 0x339602 || 2 || 6603 || Directory not found.
|-
| 0x35F202 || 2 || 6905 || Mount name not found in table.
|-
| 0x3DBC02 || 2 || 7902 || RomFs table: Entry not found in dictionary
|-
| 0x3DBE02 || 2 || 7903 || RomFs table: File not found
|-
| 0x3DC002 || 2 || 7904 || RomFs table: Directory not found
|-
| 0x3DC402 || 2 || 7906 || RomFs table: Entry already exists when trying to add a new entry
|-
| 0x3DC602 || 2 || 7907 || RomFs table: Insufficient space to add new entry
|-
| 0x3DC802 || 2 || 7908 || RomFs table: Unable to add new directory
|-
| 0x3DCA02 || 2 || 7909 || RomFs table: Unable to add new file
|-
| 0x3DCC02 || 2 || 7910 || RomFs directory has no more child directories/files when iterating
|-
| 0x3DD402 || 2 || 7914 || RomFs table: Path is file, not directory
|-
| 0x803 || 3 || 4 || OS busy
|-
| 0xE03 || 3 || 7 || Invalid parameter
|-
| 0x1003 || 3 || 8 || Out of memory
|-
| 0x1203 || 3 || 9 || Out of resources
|-
| 0x3EA03 || 3 || 501 || Invalid handle
|-
| 0x3EE03 || 3 || 503 || Invalid memory mirror
|-
| 0x7FE03 || 3 || 1023 || TLS slot is not allocated
|-
| 0xA05 || 5 || 5 || [[Content_Manager_services|NcaID]] not found. Returned when attempting to mount titles which exist that aren't *8XX titles, the same way *8XX titles are mounted.
|-
| 0xE05 || 5 || 7 || TitleId not found
|-
| 0x1805 || 5 || 12 || Invalid StorageId
|-
| 0xDC05 || 5 || 110 || Gamecard not inserted
|-
| 0x17C05 || 5 || 190 || Gamecard not initialized
|-
| 0x1F405 || 5 || 250 || Sdcard not inserted
|-
| 0x20805 || 5 || 260 || Storage not mounted
|-
| 0x806 || 6 || 4 || Converted from error 0xD401
|-
| 0x1006 || 6 || 8 || Converted from error 0xE401
|-
| 0x408 || 8 || 2 || Program location entry not found
|-
| 0x608 || 8 || 3 || Invalid context for control location
|-
| 0x808 || 8 || 4 || Storage not found
|-
| 0xA08 || 8 || 5 || Access denied
|-
| 0xC08 || 8 || 6 || Offline manual HTML location entry not found
|-
| 0xE08 || 8 || 7 || Title is not registered
|-
| 0x1008 || 8 || 8 || Control location entry for host not found
|-
| 0x1208 || 8 || 9 || Legal info HTML location entry not found
|-
| 0x1408 || 8 || 10 || Program location for debug entry not found
|-
| 0x209 || 9 || 1 || Args too long.
|-
| 0x409 || 9 || 2 || Maximum processes loaded.
|-
| 0x609 || 9 || 3 || NPDM too big.
|-
| 0x809 || 9 || 4 || Invalid NPDM.
|-
| 0xA09 || 9 || 5 || Invalid NSO.
|-
| 0xC09 || 9 || 6 || Invalid Path.
|-
| 0xE09 || 9 || 7 || Already registered.
|-
| 0x1009 || 9 || 8 || Title not found.
|-
| 0x1209 || 9 || 9 || Title-id in ACI0 doesn't match range in ACID.
|-
| 0x1409 || 9 || 10 || Invalid version in NPDM.
|-
| 0x6609 || 9 || 51 || Insufficient address space.
|-
| 0x6809 || 9 || 52 || Insufficient NRO.
|-
| 0x6A09 || 9 || 53 || Invalid NRR
|-
| 0x6C09 || 9 || 54 || Invalid signature
|-
| 0x6E09 || 9 || 55 || Insufficient NRO registrations.
|-
| 0x7009 || 9 || 56 || Insufficient NRR registrations.
|-
| 0x7209 || 9 || 57 || NRO Already loaded.
|-
| 0xA209 || 9 || 81 || Unaligned NRR address
|-
| 0xA409 || 9 || 82 || Bad NRR size
|-
| 0xA809 || 9 || 84 || NRR Not Loaded.
|-
| 0xAA09 || 9 || 85 || Bad NRR address
|-
| 0xAE09 || 9 || 87 || Bad initialization
|-
| 0xC809 || 9 || 100 || Unknown ACI0 descriptor
|-
| 0xCE09 || 9 || 103 || ACID/ACI0 don't match for descriptor "KernelFlags"
|-
| 0xD009 || 9 || 104 || ACID/ACI0 don't match for descriptor "SyscallMask"
|-
| 0xD409 || 9 || 106 || ACID/ACI0 don't match for descriptor "MapIoOrNormalRange"
|-
| 0xD609 || 9 || 107 || ACID/ACI0 don't match for descriptor "MapNormalPage"
|-
| 0xDE09 || 9 || 111 || ACID/ACI0 don't match for descriptor "InterruptPair"
|-
| 0xE209 || 9 || 113 || ACID/ACI0 don't match for descriptor "ApplicationType"
|-
| 0xE409 || 9 || 114 || ACID/ACI0 don't match for descriptor "KernelReleaseVersion"
|-
| 0xE609 || 9 || 115 || ACID/ACI0 don't match for descriptor "HandleTableSize"
|-
| 0xE809 || 9 || 116 || ACID/ACI0 don't match for descriptor "DebugFlags"
|-
| 0x1940A || 10 || 202 || Invalid CMIF header size.
|-
| 0x1A60A || 10 || 211 || Invalid CMIF input header.
|-
| 0x1A80A || 10 || 212 || Invalid CMIF output header.
|-
| 0x1BA0A || 10 || 221 || Invalid method dispatch ID.
|-
| 0x1D60A || 10 || 235 || Invalid in object count.
|-
| 0x1D80A || 10 || 236 || Invalid out object count.
|-
| 0x25A0A || 10 || 301 || Out of domain entries.
|-
| 0x20B || 11 || 1 || Unsupported operation
|-
| 0xCC0B || 11 || 102 || Out of server session memory
|-
| 0x11A0B || 11 || 141 || Went past maximum during marshalling.
|-
| 0x1900B || 11 || 200 || Session doesn't support domains.
|-
| 0x25A0B || 11 || 301 || Remote process is dead.
|-
| 0x3260B || 11 || 403 || Unknown request type
|-
| 0x3D60B || 11 || 491 || IPC Query 1 failed.
|-
| 0x20F || 15 || 1 || Pid not found
|-
| 0x60F || 15 || 3 || Process has no pending events
|-
| 0xA0F || 15 || 5 || Application already running
|-
| 0x410 || 16 || 2 || Title-id not found
|-
| 0xF010 || 16 || 120 || Gamecard sysupdate not required
|-
| 0x1F610 || 16 || 251 || Unexpected StorageId
|-
| 0x215 || 21 || 1 || Out of processes
|-
| 0x415 || 21 || 2 || Not initialized.
|-
| 0x615 || 21 || 3 || Max sessions
|-
| 0x815 || 21 || 4 || Service already registered
|-
| 0xA15 || 21 || 5 || Out of services
|-
| 0xC15 || 21 || 6 || Invalid name (all zeroes)
|-
| 0xE15 || 21 || 7 || Service not registered
|-
| 0x1015 || 21 || 8 || Permission denied
|-
| 0x1215 || 21 || 9 || Service Access Control too big.
|-
| 0x416 || 22 || 2 || Address space is full
|-
| 0x616 || 22 || 3 || NRO already loaded
|-
| 0x816 || 22 || 4 || Invalid NRO header values
|-
| 0xC16 || 22 || 6 || Bad NRR magic
|-
| 0x1016 || 22 || 8 || Reached max NRR count
|-
| 0x1216 || 22 || 9 || Unable to verify NRO hash or NRR signature
|-
| 0x80216 || 22 || 1025 || Address not page-aligned
|-
| 0x80416 || 22 || 1026 || Incorrect NRO size
|-
| 0x80816 || 22 || 1028 || NRO not loaded
|-
| 0x80A16 || 22 || 1029 || NRR not loaded
|-
| 0x80C16 || 22 || 1030 || Already initialized
|-
| 0x80E16 || 22 || 1031 || Not initialized
|-
| 0x21A || 26 || 1 || SMC is not implemented
|-
| 0x41A || 26 || 2 || SMC argument is invalid
|-
| 0x61A || 26 || 3 || SMC is currently in progress/secmon is busy
|-
| 0x81A || 26 || 4 || Secmon not currently performing async operation
|-
| 0xA1A || 26 || 5 || Invalid SMC async callback key
|-
| 0xC1A || 26 || 6 || SMC is blacklisted during current boot
|-
| 0xC81A || 26 || 100 || Invalid (buffer) size
|-
| 0xCA1A || 26 || 101 || Unknown SMC error
|-
| 0xCA1A || 26 || 101 || Decryption failure
|-
| 0xD01A || 26 || 104 || No AES keyslots available
|-
| 0xD21A || 26 || 105 || Invalid AES keyslot
|-
| 0xD41A || 26 || 106 || BootReason already set
|-
| 0xD61A || 26 || 107 || BootReason not set
|-
| 0xD81A || 26 || 108 || Invalid argument
|-
| 0x19269 || 105 || 201 || Null settings name
|-
| 0x19469 || 105 || 202 || Null settings key
|-
| 0x19669 || 105 || 203 || Null settings value
|-
| 0x19A69 || 105 || 205 || Null settings value buffer
|-
| 0x1A069 || 105 || 208 || Null setting value size buffer
|-
| 0x1A269 || 105 || 209 || Null debug mode flag buffer
|-
| 0x1BA69 || 105 || 221 || Setting group name has zero length
|-
| 0x1BC69 || 105 || 222 || Empty settings item key
|-
| 0x1E269 || 105 || 241 || Setting group name is too long (64 character limit?)
|-
| 0x1E469 || 105 || 242 || Setting name is too long (64 character limit?)
|-
| 0x20A69 || 105 || 261 || Setting group name ends with '.' or contains invalid characters (allowed: [a-z0-9_\-.])
|-
| 0x20C69 || 105 || 262 || Setting name ends with '.' or contains invalid characters (allowed: [a-z0-9_\-.])
|-
| 0x4DA69 || 105 || 621 || Null language code buffer
|-
| 0x4EE69 || 105 || 631 || Null network settings buffer
|-
| 0x4F069 || 105 || 632 || Null network settings output count buffer
|-
| 0x50269 || 105 || 641 || Null backlight settings buffer
|-
| 0x51669 || 105 || 651 || Null Bluetooth device setting buffer
|-
| 0x51869 || 105 || 652 || Null Bluetooth device setting output count buffer
|-
| 0x51A69 || 105 || 653 || Null Bluetooth enable flag buffer
|-
| 0x51C69 || 105 || 654 || Null Bluetooth AFH enable flag buffer
|-
| 0x51E69 || 105 || 655 || Null Bluetooth boost enable flag buffer
|-
| 0x52069 || 105 || 656 || Null BLE pairing settings buffer
|-
| 0x52269 || 105 || 657 || Null BLE pairing settings entry count buffer
|-
| 0x52A69 || 105 || 661 || Null external steady clock source ID buffer
|-
| 0x52C69 || 105 || 662 || Null user system clock context buffer
|-
| 0x52E69 || 105 || 663 || Null network system clock context buffer
|-
| 0x53069 || 105 || 664 || Null user system clock automatic correction enabled flag buffer
|-
| 0x53269 || 105 || 665 || Null shutdown RTC value buffer
|-
| 0x53469 || 105 || 666 || Null external steady clock internal offset buffer
|-
| 0x53E69 || 105 || 671 || Null account settings buffer
|-
| 0x55269 || 105 || 681 || Null audio volume buffer
|-
| 0x55669 || 105 || 683 || Null ForceMuteOnHeadphoneRemoved buffer
|-
| 0x55869 || 105 || 684 || Null headphone volume warning count buffer
|-
| 0x55E69 || 105 || 687 || Invalid audio output mode
|-
| 0x56069 || 105 || 688 || Null headphone volume update flag buffer
|-
| 0x56669 || 105 || 691 || Null console information upload flag buffer
|-
| 0x57A69 || 105 || 701 || Null automatic application download flag buffer
|-
| 0x57C69 || 105 || 702 || Null notification settings buffer
|-
| 0x57E69 || 105 || 703 || Null account notification settings entry count buffer
|-
| 0x58069 || 105 || 704 || Null account notification settings buffer
|-
| 0x58E69 || 105 || 711 || Null vibration master volume buffer
|-
| 0x59069 || 105 || 712 || Null NX controller settings buffer
|-
| 0x59269 || 105 || 713 || Null NX controller settings entry count buffer
|-
| 0x59469 || 105 || 714 || Null USB full key enable flag buffer
|-
| 0x5A269 || 105 || 721 || Null TV settings buffer
|-
| 0x5A469 || 105 || 722 || Null EDID buffer
|-
| 0x5B669 || 105 || 731 || Null data deletion settings buffer
|-
| 0x5CA69 || 105 || 741 || Null initial system applet program ID buffer
|-
| 0x5CC69 || 105 || 742 || Null overlay disp program ID buffer
|-
| 0x5CE69 || 105 || 743 || Null IsInRepairProcess buffer
|-
| 0x5D069 || 105 || 744 || Null RequiresRunRepairTimeReviser buffer
|-
| 0x5DE69 || 105 || 751 || Null device timezone location name buffer
|-
| 0x5F269 || 105 || 761 || Null primary album storage buffer
|-
| 0x60669 || 105 || 771 || Null USB 3.0 enable flag buffer
|-
| 0x60869 || 105 || 772 || Null USB Type-C power source circuit version buffer
|-
| 0x61A69 || 105 || 781 || Null battery lot buffer
|-
| 0x62E69 || 105 || 791 || Null serial number buffer
|-
| 0x64269 || 105 || 801 || Null lock screen flag buffer
|-
| 0x64669 || 105 || 803 || Null color set ID buffer
|-
| 0x64869 || 105 || 804 || Null quest flag buffer
|-
| 0x64A69 || 105 || 805 || Null wireless certification file size buffer
|-
| 0x64C69 || 105 || 806 || Null wireless certification file buffer
|-
| 0x64E69 || 105 || 807 || Null initial launch settings buffer
|-
| 0x65069 || 105 || 808 || Null device nickname buffer
|-
| 0x65269 || 105 || 809 || Null battery percentage flag buffer
|-
| 0x65469 || 105 || 810 || Null applet launch flags buffer
|-
| 0x7E869 || 105 || 1012 || Null wireless LAN enable flag buffer
|-
| 0x7FA69 || 105 || 1021 || Null product model buffer
|-
| 0x80E69 || 105 || 1031 || Null NFC enable flag buffer
|-
| 0x82269 || 105 || 1041 || Null ECI device certificate buffer
|-
| 0x82469 || 105 || 1042 || Null E-Ticket device certificate buffer
|-
| 0x83669 || 105 || 1051 || Null sleep settings buffer
|-
| 0x84A69 || 105 || 1061 || Null EULA version buffer
|-
| 0x84C69 || 105 || 1062 || Null EULA version entry count buffer
|-
| 0x85E69 || 105 || 1071 || Null LDN channel buffer
|-
| 0x87269 || 105 || 1081 || Null SSL key buffer
|-
| 0x87469 || 105 || 1082 || Null SSL certificate buffer
|-
| 0x88669 || 105 || 1091 || Null telemetry flags buffer
|-
| 0x89A69 || 105 || 1101 || Null Gamecard key buffer
|-
| 0x89C69 || 105 || 1102 || Null Gamecard certificate buffer
|-
| 0x8AE69 || 105 || 1111 || Null PTM battery lot buffer
|-
| 0x8B069 || 105 || 1112 || Null PTM fuel gauge parameter buffer
|-
| 0x8C269 || 105 || 1121 || Null ECI device key buffer
|-
| 0x8C469 || 105 || 1122 || Null E-Ticket device key buffer
|-
| 0x8D669 || 105 || 1131 || Null speaker parameter buffer
|-
| 0x8EA69 || 105 || 1141 || Null firmware version buffer
|-
| 0x8EC69 || 105 || 1142 || Null firmware version digest buffer
|-
| 0x8EE69 || 105 || 1143 || Null rebootless system update version buffer
|-
| 0x8FE69 || 105 || 1151 || Null Mii author ID buffer
|-
| 0x91269 || 105 || 1161 || Null fatal flags buffer
|-
| 0x92669 || 105 || 1171 || Null auto update enable flag buffer
|-
| 0x93A69 || 105 || 1181 || Null external RTC reset flag buffer
|-
| 0x94E69 || 105 || 1191 || Null push notification activity mode buffer
|-
| 0x96269 || 105 || 1201 || Null service discovery control setting buffer
|-
| 0x97669 || 105 || 1211 || Null error report share permission buffer
|-
| 0x98A69 || 105 || 1221 || Null LCD vendor ID buffer
|-
| 0x99E69 || 105 || 1231 || Null console SixAxis sensor acceleration bias buffer
|-
| 0x9A069 || 105 || 1232 || Null console SixAxis sensor angular velocity bias buffer
|-
| 0x9A269 || 105 || 1233 || Null console SixAxis sensor acceleration gain buffer
|-
| 0x9A469 || 105 || 1234 || Null console SixAxis sensor angular velocity gain buffer
|-
| 0x9A669 || 105 || 1235 || Null console SixAxis sensor angular velocity time bias buffer
|-
| 0x9A869 || 105 || 1236 || Null console SixAxis sensor angular acceleration buffer
|-
| 0x9B269 || 105 || 1241 || Null keyboard layout buffer
|-
| 0x9BA69 || 105 || 1245 || Invalid keyboard layout
|-
| 0x9C669 || 105 || 1251 || Null web inspector flag buffer
|-
| 0x9C869 || 105 || 1252 || Null allowed SSL hosts buffer
|-
| 0x9CA69 || 105 || 1253 || Null allowed SSL hosts entry count buffer
|-
| 0x9CC69 || 105 || 1254 || Null host FS mount point buffer
|-
| 0x9EE69 || 105 || 1271 || Null Amiibo key buffer
|-
| 0x9F069 || 105 || 1272 || Null Amiibo ECQV certificate buffer
|-
| 0x9F269 || 105 || 1273 || Null Amiibo ECDSA certificate buffer
|-
| 0x9F469 || 105 || 1274 || Null Amiibo ECQV BLS key buffer
|-
| 0x9F669 || 105 || 1275 || Null Amiibo ECQV BLS certificate buffer
|-
| 0x9F869 || 105 || 1276 || Null Amiibo ECQV BLS root certificate buffer
|-
| 0x272 || 114 || 1 || Generic error
|-
| 0xC72 || 114 || 6 || Unsupported operation
|-
| 0x74 || 116 || 0 || Time service not initialized
|-
| 0x274 || 116 || 1 || Permission denied
|-
| 0xCC74 || 116 || 102 || Time not set / Clock Source Id mismatch
|-
| 0x19074 || 116 || 200 || Invalid time comparison
|-
| 0x19274 || 116 || 201 || Signed overflow/underflow
|-
| 0x64274 || 116 || 801 || Memory allocation failure
|-
| 0x70A74 || 116 || 901 || Null pointer
|-
| 0x70C74 || 116 || 902 || Value out of valid range
|-
| 0x70E74 || 116 || 903 || TimeZoneRule conversion failed
|-
| 0x7BA74 || 116 || 989 || TimeZone location name not found
|-
| 0x7BC74 || 116 || 990 || Unimplemented functionality
|-
| 0x27A || 122 || 1 || Invalid argument
|-
| 0x47A || 122 || 2 || Object not found
|-
| 0x67A || 122 || 3 || Object locked/in used
|-
| 0x87A || 122 || 4 || Target already mounted
|-
| 0xA7A || 122 || 5 || Target not mounted
|-
| 0xC7A || 122 || 6 || Object already opened
|-
| 0xE7A || 122 || 7 || Object not opened
|-
| 0xA07A || 122 || 80 || Passphrase not found
|-
| 0xA27A || 122 || 81 || Data verification failed
|-
| 0xB47A || 122 || 90 || Invalid API call
|-
| 0xC47A || 122 || 98 || Invalid operation
|-
| 0x287C || 124 || 20 || Argument is NULL
|-
| 0x2C7C || 124 || 22 || Argument is invalid
|-
| 0x3C7C || 124 || 30 || Bad input buffer size
|-
| 0x407C || 124 || 32 || Invalid input buffer
|-
| 0x27E || 126 || 1 || Invalid argument
|-
| 0x87E || 126 || 4 || Entry not found
|-
| 0xCE7E || 126 || 67 || Invalid database signature value (should be "NFDB")
|-
| 0xD27E || 126 || 69 || Invalid database entry count
|-
| 0x1987E || 126 || 204 || Development/debug-only behavior
|-
| 0x480 || 128 || 2 || IStorage not available.
|-
| 0x4680 || 128 || 35 || Error while launching applet.
|-
| 0x4A80 || 128 || 37 || Title-ID not found. Caused by code 0x410 when applet launch fails
|-
| 0x3E880 || 128 || 500 || Invalid input
|-
| 0x3EC80 || 128 || 502 || IStorage has already been opened by another accessor
|-
| 0x3EE80 || 128 || 503 || IStorage Read/Write out-of-bounds
|-
| 0x3FE80 || 128 || 511 || IStorage opened as wrong type (data opened as transfermem, transfermem opened as data)
|-
| 0x40080 || 128 || 512 || Unbalanced fatal section leave (returned when executing LeaveFatalSection without a preceding EnterFatalSection call)
|-
| 0x4B080 || 128 || 600 || Failed to allocate memory for IStorage
|-
| 0x59080 || 128 || 712 || Thread stack pool exhausted (out of memory)
|-
| 0x7A880 || 128 || 980 || <code>am.debug!dev_function</code> setting needs to be set
|-
| 0xA83 || 131 || 5 || Unrecognized applet ID
|-
| 0x485 || 133 || 2 || Invalid DVFS table ID
|-
| 0x885 || 133 || 4 || Invalid parameter
|-
| 0x3CF089 || 137 || 7800 || Unknown/invalid libcurl error.
|-
| 0x3E8289-0x3F4089 || 137 || 8001-8096 || libcurl error 1-96. Some of the libcurl errors in the error-table map to the above unknown-libcurl-error however.
|-
| 0x68A || 138 || 3 || Not initialized.
|-
| 0x668C || 140 || 51 || USB data-transfer in progress
|-
| 0xD48C || 140 || 106 || Invalid descriptor
|-
| 0x1928C || 140 || 201 || USB device not bound / interface already enabled
|-
| 0x290 || 144 || 1 || Exited Abnormally ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Abormal)
|-
| 0x690 || 144 || 3 || Canceled ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Canceled)
|-
| 0x890 || 144 || 4 || Rejected
|-
| 0xA90 || 144 || 5 || Exited Unexpectedly ([[Applet_Manager_services#LibraryAppletExitReason|ExitReason]] == Unexpected)
|-
| 0x299 || 153 || 1 || Invalid audio device
|-
| 0x499 || 153 || 2 || Operation couldn't complete successfully
|-
| 0x699 || 153 || 3 || Invalid sample rate
|-
| 0x899 || 153 || 4 || Buffer size too small
|-
| 0x1099 || 153 || 8 || Too many buffers are still unreleased
|-
| 0x1499 || 153 || 10 || Invalid channel count
|-
| 0x40299 || 153 || 513 || Invalid/Unsupported operation
|-
| 0xC0099 || 153 || 1536 || Invalid handle
|-
| 0xC0899 || 153 || 1540 || Audio output was already started
|-
| 0x3C9D || 157 || 30 || Address is NULL
|-
| 0x3E9D || 157 || 31 || PID is NULL
|-
| 0x549D || 157 || 42 || Already bound
|-
| 0xCC9D || 157 || 102 || Invalid PID
|-
| 0xAA3 || 163 || 5 || System is booting up repair process without VOL+ held down.
|-
| 0xCA3 || 163 || 6 || System is booting up repair process that requires RepairTimeReviser but does not have special cartridge inserted.
|-
| 0xC8B2 || 178 || 100 || Invalid user ID
|-
| 0xCAB2 || 178 || 101 || User does not exist
|-
| 0x12CB2 || 178 || 150 || Service unavailable
|-
| 0x190B2 || 178 || 200 || File storage failure
|-
| 0x58ACA || 202 || 709 || Npad ID is out of range.
|-
| 0xF0CD || 205 || 120 || IR image data not available/ready.
|-
| 0x1A8CD || 205 || 212 || IR camera handle pointer is null.
|-
| 0x198CD || 205 || 204 || IR camera invalid handle value.
|-
| 0x35B || 347 || 1 || Failed to init SM.
|-
| 0x55B || 347 || 2 || Failed to init FS.
|-
| 0x75B || 347 || 3 || Failed to open NRO file. May also happen when SD card isn't inserted / SD mounting failed earlier.
|-
| 0x95B || 347 || 4 || Failed to read NRO header.
|-
| 0xB5B || 347 || 5 || Invalid NRO magic.
|-
| 0xD5B || 347 || 6 || Invalid NRO segments.
|-
| 0xF5B || 347 || 7 || Failed to read NRO.
|-
| 0x135B || 347 || 9 || Failed to allocate heap.
|-
| 0x255B || 347 || 18 || Failed to map code-binary memory.
|-
| 0x275B || 347 || 19 || Failed to map code memory (.text).
|-
| 0x295B || 347 || 20 || Failed to map code memory (.rodata).
|-
| 0x2B5B || 347 || 21 || Failed to map code memory (.data+.bss).
|-
| 0x315B || 347 || 24 || Failed to unmap code memory (.text).
|-
| 0x335B || 347 || 25 || Failed to unmap code memory (.rodata).
|-
| 0x355B || 347 || 26 || Failed to unmap code memory (.data+.bss).
|}

== FS Error Codes ==
The following are the error codes recognized by nn::fs::detail::LogErrorMessage found in some [[Factory Setup|factory]] titles:

{| class=wikitable
! Value || Description || Message
|-
| 0x7802 || 60 || nn::fs::ResultMountNameAlreadyExists: Error: Specified mount name already exists.
|-
| 0xD401 || 106 || nn::svc::ResultInvalidCurrentMemory: Error: Passed buffer is not usable for fs library. See a manual of fs library for more information.
|-
| 0x7D202 || 1001 || nn::fs::ResultPartitionNotFound: Error: Specified partition is not found.
|-
| 0x7D402 || 1002 || nn::fs::ResultTargetNotFound: Error: Specified target is not found.
|-
| 0xFA002 - 0x138602 || 2000 - 2499 || nn::fs::ResultSdCardAccessFailed: Error: Failed to access SD card.
|-
| 0x136802 - 0x176E02 || 2500 - 2999 || nn::fs::ResultGameCardAccessFailed: Error: Failed to access game card.
|-
| 0x177202 || 3001 || nn::fs::ResultNotImplemented: Error: Specified operation is not implemented.
|-
| 0x177A02 || 3005 || nn::fs::ResultOutOfRange: Error: Specified value is out of range.
|-
| 0x190002 - 0x1B5602 || 3200 - 3499 || nn::fs::ResultAllocationMemoryFailed: Error: Failed to allocate memory.
|-
| 0x1B5802 - 0x1F3E02 || 3500 - 3999 || nn::fs::ResultMmcAccessFailed: Error: Failed to access MMC.
|-
| 0x1F4202 - 0x219602 || 4001 - 4299 || nn::fs::ResultRomCorrupted: Error: ROM is corrupted.
|-
| 0x219A02 - 0x232602 || 4301 - 4499 || nn::fs::ResultSaveDataCorrupted: Error: Save data is corrupted.
|-
| 0x232A02 - 0x23EE02 || 4501 - 4599 || nn::fs::ResultNcaCorrupted: Error: NCA is corrupted.
|-
| 0x23F202 - 0x243E02 || 4601 - 4639 || nn::fs::ResultIntegrityVerificationStorageCorrupted: Error: Integrity verification failed.
|-
| 0x244202 - 0x246602 || 4641 - 4659 || nn::fs::ResultPartitionFileSystemCorrupted: Error: Partition FS is corrupted.
|-
| 0x246A02 - 0x248E02 || 4661 - 4679 || nn::fs::ResultBuiltInStorageCorrupted: Error: Built-in-storage is corrupted.
|-
| 0x249202 - 0x24B602 || 4681 - 4699 || nn::fs::ResultFatFileSystemCorrupted: Error: FAT FS is corrupted.
|-
| 0x24BA02 - 0x24DE02 || 4701 - 4719 || nn::fs::ResultHostFileSystemCorrupted: Error: HOST FS is corrupted.
|-
| 0x1F4002 - 0x270E02 || 4000, 4300, 4500, 4600, 4640, 4660, 4680, 4700, 4720-4999 || nn::fs::ResultDataCorrupted: Error: Data is corrupted.
|-
| 0x271002 - 0x2EDE02 || 5000-5999 || nn::fs::ResultUnexpected: Error: Unexpected failure occurred.
|-
| 0x2EE002 - 0x32C602 || 6000-6499 || nn::fs::ResultPreconditionViolation: Error: Precondition violation.
|-
| 0x2EE202 - 0x306E02 || 6001-6199 || nn::fs::ResultInvalidArgument: Error: Invalid argument was specified.
|-
| 0x2EE402 - 0x2F1A02 || 6002-6029 || nn::fs::ResultInvalidPath: Error: Invalid path was specified.
|-
| 0x2EE602 || 6003 || nn::fs::ResultTooLongPath: Error: Too long path was specified.
|-
| 0x2EE802 || 6004 || nn::fs::ResultInvalidCharacter: Error: Invalid path character was specified.
|-
| 0x2EEA02 || 6005 || nn::fs::ResultInvalidPathFormat: Error: Invalid path format was specified.
|-
| 0x2F5A02 || 6061 || nn::fs::ResultInvalidOffset: Error: Invalid offset was specified.
|-
| 0x2F5C02 || 6062 || nn::fs::ResultInvalidSize: Error: Invalid size was specified.
|-
| 0x2F5E02 || 6063 || nn::fs::ResultNullptrArgument: Error: Null pointer argument was specified.
|-
| 0x2F6202 || 6065 || nn::fs::ResultInvalidMountName: Error: Invalid mount name was specified.
|-
| 0x2F6402 || 6066 || nn::fs::ResultExtensionSizeTooLarge: Error: Extension size exceeds max value set in nmeta file.
|-
| 0x2F6602 || 6067 || nn::fs::ResultExtensionSizeInvalid: Error: Extension size is not a multiple of nn::fs::SaveDataExtensionUnitSize.
|-
| 0x307202 || 6201 || nn::fs::ResultFileExtensionWithoutOpenModeAllowAppend: Error: OpenMode_AllowAppend is required for implicit extension of file size by WriteFile().
|-
| 0x307002 - 0x313602 || 6200, 6202 - 6299 || nn::fs::ResultInvalidOperationForOpenMode: Error: Invalid operation for the open mode.
|-
| 0x313802 - 0x31FE02 || 6300-6399 || nn::fs::ResultUnsupportedOperation: Error: Unsupported operation.
|-
| 0x320002 - 0x326202 || 6400-6449 || nn::fs::ResultPermissionDenied: Error: Permission denied.
|-
| 0x327202 || 6457 || nn::fs::ResultWriteModeFileNotClosed: Error: Close files opened in write mode before committing.
|-
| 0x328202 || 6465 || nn::fs::ResultUserNotExist: Error: Specified user doesn't exist.
|-
| 0x346402 || 6706 || nn::fs::ResultMappingTableFull: Error: Enough journal space is not left.
|-
| 0x346A02 || 6709 || nn::fs::ResultOpenCountLimit: Error: The open count of files and directories reached the limitation.
|-
| 0x353602 || 6811 || nn::fs::ResultMapFull: Error: Save data extension count reached the limitation.
|-
| 0x35F202 || 6905 || nn::fs::ResultNotMounted: Error: Specified mount name is not found.
|}

= Fatal Errors =
{| class=wikitable
! Error || Description
|-
| 2162-0002
| Can be triggered by running [[SVC|svcBreak]]. The svcBreak params have no effect on the value of the thrown error-code.
|-
| 2168-0000
| Userland ARM undefined instruction exception
|-
| 2168-0001
| Userland ARM prefetch-abort due to PC set to non-executable region
|-
| 2168-0002
| Userland ARM data abort. Also caused by abnormal process termination via [[SVC|svcExitProcess]]. Note: directly jumping to nnMain()-retaddr from non-main-thread has the same result.
|-
| 2168-0003
| Userland PC address not aligned to 4 bytes
|-
| 2168-0008
| Can occur when attempting to call an svc outside the whitelist
|}

= Support Errors =
This section is for Support Errors displayed by the error-applet, separate from the normal Result errors.

== Support Modules ==
{| class=wikitable
! Value || Name
|-
| 800 || [[Internet_Browser|General web-applet]]
|-
| 809 || [[Internet_Browser|WifiWebAuthApplet]]
|-
| 810 || [[Internet_Browser|Whitelisted-applet]]
|-
| 811 || [[Internet_Browser|ShopN]]
|}

8XX is for/includes system applets.

== Errors ==
{| class=wikitable
! Error || Module || Description || Notes
|-
|
| {web-applets listed above}
| 2750
| MP4 parsing failed.
|}

Normal error-codes displayed by the system also use the same format as fatal-errors.

SVC

2019-08-28T07:31:02Z

Roblabla: Add some meanings to the MemoryState.

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || [[#svcSignalEvent]] || W0=wevent_handle || W0=result
|-
| 0x12 || [[#svcClearEvent]] || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value
R0=reslimit_handle, R1=[[#LimitableResource]], R2=value_lower32, R3=value_upper32
|| W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args
R0=smc_sub_id, R1, R2, R3=smc_args
|| X0,X1,X2,X3,X4,X5,X6,X7=result
R0,R1,R2,R3=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to OutAddr.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

=== Result codes ===

'''0x0:''' Success. The memory region was reprotected.

'''0xCC01:''' Unaligned address specified.

'''0xCA01:''' Unaligned or zero size specified.

'''0xD401:''' The provided memory region does not fall within the userland address space.

'''0xD801:''' Invalid permission specified. Valid permissions are ---, r-- and rw-.

'''0xD401:''' The provided memory region was in an invalid state. The region must have the PermissionChangeAllowed bit set in its [[#MemoryState]], and must not have the IsBorrowed or IsUncached [[#MemoryAttribute]].

'''0xCE01:''' Kernel resource exhausted.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcSignalEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Puts the given event in the signaled state.

Will wake up any thread currently waiting on this event. Can potentially trigger a reschedule.

Any calls to [[#svcWaitSynchronization]] on this handle will return immediately, until the event's signaled state is reset.

=== Result codes ===

'''0x0:''' Success. Event is now in signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a WritableEvent.

== svcClearEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent or ReadableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Takes the given event out of the signaled state.

=== Result codes ===

'''0x0:''' Success, the event is now in the not-signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a ReadableEvent nor a WritableEvent.

'''0xFA01:''' The handle was not in a signaled state.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || R1-R3 || u64 || SMC sub-arguments
|-
| (Out) X0 || R0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || R1-R3 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description || Meaning
|-
| 7-0 || Type ||
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]] ||
|-
| 9 || ForceReadWritableByDebugSyscalls || Allows using [[#svcWriteDebugProcessMemory]] on segments mapped read-only.
|-
| 10 || IpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=0.
|-
| 11 || NonDeviceIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=1.
|-
| 12 || NonSecureIpcSendAllowed || Allows sending this region as an IPC A/B/W buffer with flags=3.
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]] ||
|-
| 15 || [[#svcMapMemory|MapAllowed]] ||
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]] ||
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]] ||
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]] ||
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]]) ||
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]] ||
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]] ||
|-
| 22 || IsPoolAllocated/IsReferenceCounted || The physical memory blocks backing this region are refcounted.
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]] ||
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]] ||
|-
| 25 || [4.0.0+] [[#svcCreateCodeMemory|CodeMemoryAllowed]] ||
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-08-26T08:13:36Z

Roblabla: Linkify

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || [[#svcSignalEvent]] || W0=wevent_handle || W0=result
|-
| 0x12 || [[#svcClearEvent]] || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value
R0=reslimit_handle, R1=[[#LimitableResource]], R2=value_lower32, R3=value_upper32
|| W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args
R0=smc_sub_id, R1, R2, R3=smc_args
|| X0,X1,X2,X3,X4,X5,X6,X7=result
R0,R1,R2,R3=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to OutAddr.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

=== Result codes ===

'''0x0:''' Success. The memory region was reprotected.

'''0xCC01:''' Unaligned address specified.

'''0xCA01:''' Unaligned or zero size specified.

'''0xD401:''' The provided memory region does not fall within the userland address space.

'''0xD801:''' Invalid permission specified. Valid permissions are ---, r-- and rw-.

'''0xD401:''' The provided memory region was in an invalid state. The region must have the PermissionChangeAllowed bit set in its [[#MemoryState]], and must not have the IsBorrowed or IsUncached [[#MemoryAttribute]].

'''0xCE01:''' Kernel resource exhausted.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcSignalEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Puts the given event in the signaled state.

Will wake up any thread currently waiting on this event. Can potentially trigger a reschedule.

Any calls to [[#svcWaitSynchronization]] on this handle will return immediately, until the event's signaled state is reset.

=== Result codes ===

'''0x0:''' Success. Event is now in signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a WritableEvent.

== svcClearEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent or ReadableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Takes the given event out of the signaled state.

=== Result codes ===

'''0x0:''' Success, the event is now in the not-signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a ReadableEvent nor a WritableEvent.

'''0xFA01:''' The handle was not in a signaled state.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || R1-R3 || u64 || SMC sub-arguments
|-
| (Out) X0 || R0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || R1-R3 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed
|-
| 11 || NonDeviceIpcSendAllowed
|-
| 12 || NonSecureIpcSendAllowed
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-08-26T08:10:08Z

Roblabla: Add result code information for svcSetMemoryPermission.

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || [[#svcSignalEvent]] || W0=wevent_handle || W0=result
|-
| 0x12 || [[#svcClearEvent]] || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value
R0=reslimit_handle, R1=[[#LimitableResource]], R2=value_lower32, R3=value_upper32
|| W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args
R0=smc_sub_id, R1, R2, R3=smc_args
|| X0,X1,X2,X3,X4,X5,X6,X7=result
R0,R1,R2,R3=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to OutAddr.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

=== Result codes ===

'''0x0:''' Success. The memory region was reprotected.

'''0xCC01:''' Unaligned address specified.

'''0xCA01:''' Unaligned or zero size specified.

'''0xD401:''' The provided memory region does not fall within the userland address space.

'''0xD801:''' Invalid permission specified. Valid permissions are ---, r-- and rw-.

'''0xD401:''' The provided memory region was in an invalid state. The region must have the PermissionChangeAllowed state, and must not be Borrowed or Uncached.

'''0xCE01:''' Kernel resource exhausted.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcSignalEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Puts the given event in the signaled state.

Will wake up any thread currently waiting on this event. Can potentially trigger a reschedule.

Any calls to [[#svcWaitSynchronization]] on this handle will return immediately, until the event's signaled state is reset.

=== Result codes ===

'''0x0:''' Success. Event is now in signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a WritableEvent.

== svcClearEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent or ReadableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Takes the given event out of the signaled state.

=== Result codes ===

'''0x0:''' Success, the event is now in the not-signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a ReadableEvent nor a WritableEvent.

'''0xFA01:''' The handle was not in a signaled state.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || R1-R3 || u64 || SMC sub-arguments
|-
| (Out) X0 || R0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || R1-R3 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed
|-
| 11 || NonDeviceIpcSendAllowed
|-
| 12 || NonSecureIpcSendAllowed
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-08-26T07:25:37Z

Roblabla: Add documentation for Signal/Clear Event.

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || [[#svcSignalEvent]] || W0=wevent_handle || W0=result
|-
| 0x12 || [[#svcClearEvent]] || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value
R0=reslimit_handle, R1=[[#LimitableResource]], R2=value_lower32, R3=value_upper32
|| W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args
R0=smc_sub_id, R1, R2, R3=smc_args
|| X0,X1,X2,X3,X4,X5,X6,X7=result
R0,R1,R2,R3=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to OutAddr.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcSignalEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Puts the given event in the signaled state.

Will wake up any thread currently waiting on this event. Can potentially trigger a reschedule.

Any calls to [[#svcWaitSynchronization]] on this handle will return immediately, until the event's signaled state is reset.

=== Result codes ===

'''0x0:''' Success. Event is now in signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a WritableEvent.

== svcClearEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<WritableEvent or ReadableEvent> || Event
|-
| (Out) X0 || [[#Result]] || Result
|}
</div>

'''Description:''' Takes the given event out of the signaled state.

=== Result codes ===

'''0x0:''' Success, the event is now in the not-signaled state.

'''0xE401:''' Invalid handle. The handle either does not exist, or is not a ReadableEvent nor a WritableEvent.

'''0xFA01:''' The handle was not in a signaled state.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || R1-R3 || u64 || SMC sub-arguments
|-
| (Out) X0 || R0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || R1-R3 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed
|-
| 11 || NonDeviceIpcSendAllowed
|-
| 12 || NonSecureIpcSendAllowed
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-08-25T15:32:32Z

Roblabla: Add result code documentation for svcSetHeapSize.

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value
R0=reslimit_handle, R1=[[#LimitableResource]], R2=value_lower32, R3=value_upper32
|| W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args
R0=smc_sub_id, R1, R2, R3=smc_args
|| X0,X1,X2,X3,X4,X5,X6,X7=result
R0,R1,R2,R3=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd, and always in the Heap memory region) is written to OutAddr.

Uses current process pool partition. The memory allocated counts towards the caller's process Memory ResourceLimit.

[2.0.0+] Size must be less than or equal to 4GB.

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Invalid size passed. It's either bigger than 4GB, or misaligned.

'''0xD001:''' Size is bigger than the Heap Region size.

'''0xCE01:''' KMemoryBlockAllocator slab allocator exhausted.

'''0xD401:''' The memory region is in an invalid state. Likely because a mapping was made in the heap region.

'''0x10801:''' Memory resource limit reached.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || R1-R3 || u64 || SMC sub-arguments
|-
| (Out) X0 || R0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || R1-R3 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed
|-
| 11 || NonDeviceIpcSendAllowed
|-
| 12 || NonSecureIpcSendAllowed
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-08-25T15:07:14Z

Roblabla: Oops. I suck at this.

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value
R0=reslimit_handle, R1=[[#LimitableResource]], R2=value_lower32, R3=value_upper32
|| W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args
R0=smc_sub_id, R1, R2, R3=smc_args
|| X0,X1,X2,X3,X4,X5,X6,X7=result
R0,R1,R2,R3=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || R1-R3 || u64 || SMC sub-arguments
|-
| (Out) X0 || R0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || R1-R3 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed
|-
| 11 || NonDeviceIpcSendAllowed
|-
| 12 || NonSecureIpcSendAllowed
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-08-25T15:06:46Z

Roblabla: Finish all the 32-bit ABI. That was fun.

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value
R0=reslimit_handle, R1=[[#LimitableResource], R2=value_lower32, R3=value_upper32
|| W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args
R0=smc_sub_id, R1, R2, R3=smc_args
|| X0,X1,X2,X3,X4,X5,X6,X7=result
R0,R1,R2,R3=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || R1-R3 || u64 || SMC sub-arguments
|-
| (Out) X0 || R0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || R1-R3 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed
|-
| 11 || NonDeviceIpcSendAllowed
|-
| 12 || NonSecureIpcSendAllowed
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-08-25T15:04:00Z

Roblabla: Add 32-bit ABI for svcStartProcess and svcGetProcessInfo. Also fix GetProcessInfo, it was missing so much shit.

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz
R0=process_handle, R1=main_thread_prio, R2=default_cpuid, R3=main_thread_stacksz_lower32, R4=main_thread_stacksz_upper32
|| W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]]
R1=process_handle, R2=[[#ProcessInfoType]]
|| W0=result, X1=[[#ProcessState]]
R0=result, R1=[[#ProcessState]]_lower32, R2=[[#ProcessState]]_upper32
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R1 || Handle<Process> || ProcessHandle
|-
| (In) W1 || R2 || [[#ProcessInfoType]] || InfoType
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1, R2 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || u64 || SMC sub-arguments
|-
| (Out) X0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed
|-
| 11 || NonDeviceIpcSendAllowed
|-
| 12 || NonSecureIpcSendAllowed
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-08-25T14:58:56Z

Roblabla: Add ABI for svc*ProcessCodeMemory. Nintendo, you're drunk, go home.

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size
R0=process_handle, R1=srcaddr_lower32, R2=dstaddr_lower32, R3=dstaddr_upper32, R4=srcaddr_lower32, R5=size_lower32, R6=size_upper32
|| W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]] || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || DstAddr
|-
| (In) X2 || R1, R4 || u64 || SrcAddr
|-
| (In) X3 || R5, R6 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || u64 || SMC sub-arguments
|-
| (Out) X0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed
|-
| 11 || NonDeviceIpcSendAllowed
|-
| 12 || NonSecureIpcSendAllowed
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-08-25T14:54:57Z

Roblabla: Add 32-bit ABI for svc*ProcessMemory

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32, R5=perm
|| W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size
R0=dstaddr, R1=process_handle, R2=srcaddr_lower32, R3=srcaddr_upper32, R4=size
|| W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr
R0=meminfo_ptr, R1=addr_lower32, R2=process_handle, R3=addr_upper32
|| W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]] || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || R2, R3 || u64 || Addr
|-
| (In) X2 || R1, R4 || u64 || Size
|-
| (In) W3 || R5 || void* || Perm
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || u64 || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || void* || DstAddr
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || u64 || SrcAddr
|-
| (In) X3 || R4 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || R2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || R1, R3 || u64 || Addr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || u64 || SMC sub-arguments
|-
| (Out) X0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed
|-
| 11 || NonDeviceIpcSendAllowed
|-
| 12 || NonSecureIpcSendAllowed
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-08-25T14:48:48Z

Roblabla: Add 32-bit ABI to CreatePort

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr
R0=name_ptr, R2=max_sessions, R3=is_light
|| W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]] || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || u64 || SMC sub-arguments
|-
| (Out) X0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed
|-
| 11 || NonDeviceIpcSendAllowed
|-
| 12 || NonSecureIpcSendAllowed
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-08-25T14:46:48Z

Roblabla: Add svcGetSystemInfo 32-bit ABI

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id
R1=info_sub_id_lower32, R2=info_id, R3=handle, R4=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr || W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]] || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || u64 || SMC sub-arguments
|-
| (Out) X0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed
|-
| 11 || NonDeviceIpcSendAllowed
|-
| 12 || NonSecureIpcSendAllowed
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-08-25T14:44:59Z

Roblabla: Add svcGetDebugThreadParam 32-bit regs

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]]
R0=thread_id_lower32, R1=thread_id_upper32, R2=debug_handle, R3=[[#DebugThreadParam]]
|| W0=result, X1=out0, W2=out1
R0=result, R1=out0_lower32, R2=out0_upper32, R3=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr || W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]] || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || u64 || SMC sub-arguments
|-
| (Out) X0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed
|-
| 11 || NonDeviceIpcSendAllowed
|-
| 12 || NonSecureIpcSendAllowed
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?

SVC

2019-08-25T14:41:38Z

Roblabla: add svcSetHardwareBreakPoint 32-bit regs

__NOTOC__

= System calls =
{| class=wikitable
! Id || Name || In || Out
|-
| 0x1 || [[#svcSetHeapSize]] || W1=size || W0=result, X1=outaddr
|-
| 0x2 || [[#svcSetMemoryPermission]] || X0=addr, X1=size, W2=prot || W0=result
|-
| 0x3 || [[#svcSetMemoryAttribute]] || X0=addr, X1=size, W2=state0, W3=state1 || W0=result
|-
| 0x4 || [[#svcMapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x5 || [[#svcUnmapMemory]] || X0=dstaddr, X1=srcaddr, X2=size || W0=result
|-
| 0x6 || [[#svcQueryMemory]] || X0=MemoryInfo*, X2=addr || W0=result, W1=PageInfo
|-
| 0x7 || [[#svcExitProcess]] || None ||
|-
| 0x8 || [[#svcCreateThread]] || X1=entry, X2=thread_context, X3=stacktop, W4=prio, W5=processor_id
R0=prio, R1=entry, R2=thread_context, R3=stacktop, R4=processor_id
|| W0=result, W1=handle
|-
| 0x9 || [[#svcStartThread]] || W0=thread_handle || W0=result
|-
| 0xA || [[#svcExitThread]] || None ||
|-
| 0xB || [[#svcSleepThread]] || X0=nano
R0=nano_lower32, R1=lower_upper32
||
|-
| 0xC || [[#svcGetThreadPriority]] || W1=thread_handle || W0=result, W1=prio
|-
| 0xD || [[#svcSetThreadPriority]] || W0=thread_handle, W1=prio || W0=result
|-
| 0xE || [[#svcGetThreadCoreMask]] || W2=thread_handle || W0=result, W1=out0, X2=out1
R0=result, R1=out0, R2=out1_lower32, R3=out1_upper32
|-
| 0xF || [[#svcSetThreadCoreMask]] || W0=thread_handle, W1=in, X2=in2
R0=thread_handle, R1=in, R2=in2_lower32, R3=in2_upper32
|| W0=result
|-
| 0x10 || [[#svcGetCurrentProcessorNumber]] || None || W0/X0=cpuid
|-
| 0x11 || svcSignalEvent || W0=wevent_handle || W0=result
|-
| 0x12 || svcClearEvent || W0=wevent_or_revent_handle || W0=result
|-
| 0x13 || [[#svcMapSharedMemory]] || W0=shmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x14 || svcUnmapSharedMemory || W0=shmem_handle, X1=addr, X2=size || W0=result
|-
| 0x15 || [[#svcCreateTransferMemory]] || X1=addr, X2=size, W3=perm || W0=result, W1=tmem_handle
|-
| 0x16 || svcCloseHandle || W0=handle || W0=result
|-
| 0x17 || svcResetSignal || W0=revent_or_process_handle || W0=result
|-
| 0x18 || [[#svcWaitSynchronization]] || X1=handles_ptr, W2=num_handles, X3=timeout
R0=timeout_lower32, R1=handles_ptr, R2=num_handles, R3=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x19 || [[#svcCancelSynchronization]] || W0=thread_handle || W0=result
|-
| 0x1A || svcArbitrateLock || W0=cur_thread_handle, X1=ptr, W2=req_thread_handle ||
|-
| 0x1B || svcArbitrateUnlock || X0=ptr ||
|-
| 0x1C || svcWaitProcessWideKeyAtomic || X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout
R0=ptr0, R1=ptr, R2=thread_handle, R3=timeout_lower32, R4=timeout_upper32
|| W0=result
|-
| 0x1D || svcSignalProcessWideKey || X0=ptr, W1=value || W0=result
|-
| 0x1E || [[#svcGetSystemTick]] || None || X0={value of cntpct_el0}
R0=cntpct_el0_lower32, R1=cntpct_el0_upper32
|-
| 0x1F || svcConnectToNamedPort || X1=port_name_str || W0=result, W1=handle
|-
| 0x20 || svcSendSyncRequestLight || W0=light_session_handle, X1=? || W0=result
|-
| 0x21 || svcSendSyncRequest || X0=normal_session_handle || W0=result
|-
| 0x22 || [[#svcSendSyncRequestWithUserBuffer]] || X0=cmdbufptr, X1=size, X2=handle || W0=result
|-
| 0x23 || svcSendAsyncRequestWithUserBuffer || X1=cmdbufptr, X2=size, X3=handle || W0=result, W1=revent_handle
|-
| 0x24 || svcGetProcessId || W1=thread_or_process_or_debug_handle || W0=result, X1=pid
R0=result, R1=pid_lower32, R2=pid_upper32
|-
| 0x25 || svcGetThreadId || W1=thread_handle || W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x26 || [[#svcBreak]] || X0=break_reason,X1,X2=info || W0=result = 0
|-
| 0x27 || svcOutputDebugString || X0=str, X1=size || W0=result
|-
| 0x28 || svcReturnFromException || X0=result ||
|-
| 0x29 || [[#svcGetInfo]] || W1=info_id, X2=handle, X3=info_sub_id
R0=info_sub_id_lower32, R1=info_id, R2=handle, R3=info_sub_id_upper32
|| W0=result, X1=out
R0=result, R1=out_lower32, R2=out_upper32
|-
| 0x2A || svcFlushEntireDataCache || None || None
|-
| 0x2B || svcFlushDataCache || X0=addr, X1=size || W0=result
|-
| 0x2C || [3.0.0+] [[#svcMapPhysicalMemory]] || X0=addr, X1=size || W0=result
|-
| 0x2D || [3.0.0+] svcUnmapPhysicalMemory || X0=addr, X1=size || W0=result
|-
| 0x2E || [5.0.0+] svcGetFutureThreadInfo || X3=timeout
R0=timeout_lower32, R1=timeout_upper32
|| W0=result, bunch of crap
|-
| 0x2F || svcGetLastThreadInfo || None || W0=result, W1,W2,W3,W4=unk, W5=truncated_u64, W6=bool
|-
| 0x30 || svcGetResourceLimitLimitValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x31 || svcGetResourceLimitCurrentValue || W1=reslimit_handle, W2=[[#LimitableResource]] || W0=result, X1=value
R0=result, R1=value_lower32, R2=value_upper32
|-
| 0x32 || svcSetThreadActivity || W0=thread_handle, W1=bool || W0=result
|-
| 0x33 || svcGetThreadContext3 || X0=[[#ThreadContext]]*, W1=thread_handle || W0=result
|-
| 0x34 || [4.0.0+] svcWaitForAddress || X0=ptr, W1=[[#ArbitrationType]], X2=value, X3=timeout
R0=ptr, R1=[[#ArbitrationType]], R2=value, R3=timeout_lower32, R4=timeout_upper32
||
|-
| 0x35 || [4.0.0+] svcSignalToAddress || X0=ptr, W1=[[#SignalType]], X2=value, W3=num_to_signal ||
|-
| 0x36 || [8.0.0+] svcSynchronizePreemptionState || None || W0=result
|- style="border-top: double"
| 0x3C || [[#svcDumpInfo]] || ||
|-
| 0x3D || [4.0.0+] svcDumpInfoNew || ||
|- style="border-top: double"
| 0x40 || svcCreateSession || W2=is_light, X3=name_ptr || W0=result, W1=server_handle, W2=client_handle
|-
| 0x41 || [[#svcAcceptSession]] || W1=port_handle || W0=result, W1=session_handle
|-
| 0x42 || svcReplyAndReceiveLight || W0=light_session_handle || W0=result, W1,W2,W3,W4,W5,W6,W7=out
|-
| 0x43 || [[#svcReplyAndReceive]] || X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout
R0=timeout_lower32, R1=ptr_handles, R2=num_handles, R3=replytarget_handle(0=none), R4=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x44 || svcReplyAndReceiveWithUserBuffer|| X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout
R0=num_handles, R1=buf, R2=sz, R3=ptr_handles, R4=replytarget_handle(0=none), R5=timeout_lower32, R6=timeout_upper32
|| W0=result, W1=handle_idx
|-
| 0x45 || svcCreateEvent || None || W0=result, W1=wevent_handle, W2=revent_handle
|- style="border-top: double"
| 0x48 || [5.0.0+] [[#svcMapPhysicalMemoryUnsafe]] || X0=addr, X1=size || W0=result
|-
| 0x49 || [5.0.0+] svcUnmapPhysicalMemoryUnsafe || X0=addr, X1=size || W0=result
|-
| 0x4A || [5.0.0+] svcSetUnsafeLimit || X0=size || W0=result
|-
| 0x4B || [4.0.0+] [[#svcCreateCodeMemory]] || X1=addr, X2=size || W0=result, W1=code_memory_handle
|-
| 0x4C || [4.0.0+] [[#svcControlCodeMemory]] || W0=code_memory_handle, W1=[[#CodeMemoryOperation]], X2=dstaddr, X3=size, W4=perm
R0=code_memory_handle, R1=[[#CodeMemoryOperation]], R2=dstaddr_lower32, R3=dstaddr_upper32, R4=size_lower32, R5=size_upper32, R6=perm
|| W0=result
|-
| 0x4D || svcSleepSystem || None || None
|-
| 0x4E || [[#svcReadWriteRegister]] || X1=reg_addr, W2=rw_mask, W3=in_val
R0=rw_mask, R1=in_val, R2=reg_addr_lower32, R3=reg_addr_upper32
|| W0=result, W1=out_val
|-
| 0x4F || svcSetProcessActivity || W0=process_handle, W1=bool || W0=result
|-
| 0x50 || [[#svcCreateSharedMemory]] || W1=size, W2=myperm, W3=otherperm || W0=result, W1=shmem_handle
|-
| 0x51 || [[#svcMapTransferMemory]] || X0=tmem_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x52 || [[#svcUnmapTransferMemory]] || W0=tmemhandle, X1=addr, X2=size || W0=result
|-
| 0x53 || [[#svcCreateInterruptEvent]] || X1=irq_num, W2=flag || W0=result, W1=handle
|-
| 0x54 || [[#svcQueryPhysicalAddress]] || X1=addr || W0=result, X1=physaddr, X2=kerneladdr, X3=size
|-
| 0x55 || [[#svcQueryIoMapping]] || X1=physaddr, X2=size
R0=size, R2=physaddr_lower32, R3=physaddr_upper32
|| W0=result, X1=virtaddr
|-
| 0x56 || [[#svcCreateDeviceAddressSpace]] || X1=dev_as_start_addr, X2=dev_as_end_addr
R0=dev_as_end_addr_lower32, R1=dev_as_end_addr_upper32, R2=dev_as_start_addr_lower32, R3=dev_as_start_addr_upper32
|| W0=result, W1=dev_as_handle
|-
| 0x57 || [[#svcAttachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x58 || [[#svcDetachDeviceAddressSpace]] || W0=device, X1=dev_as_handle || W0=result
|-
| 0x59 || [[#svcMapDeviceAddressSpaceByForce]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5A || [[#svcMapDeviceAddressSpaceAligned]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=rev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result
|-
| 0x5B || svcMapDeviceAddressSpace || W1=dev_as_handle, W2=proc_handle, X3=dev_map_addr, X4=dev_as_size, X5=dev_as_addr, W6=perm
R0=dev_map_addr_lower32, R1=dev_as_handle, R2=proc_handle, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32, R7=perm
|| W0=result, X1=mapped_size
R0=result, R1=mapped_size
|-
| 0x5C || [[#svcUnmapDeviceAddressSpace]] || W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr
R0=dev_as_handle, R1=proc_handle, R2=dev_map_addr_lower32, R3=dev_map_addr_upper32, R4=dev_as_size, R5=dev_as_addr_lower32, R6=dev_as_addr_upper32
|| W0=result
|-
| 0x5D || svcInvalidateProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5E || svcStoreProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x5F || svcFlushProcessDataCache || W0=process_handle, X1=addr, X2=size
R0=process_handle, R1=size_lower32, R2=addr_lower32, R3=addr_upper32, R4=size_upper32
|| W0=size
|-
| 0x60 || svcDebugActiveProcess || X1=pid
R2=pid_lower32, R3=pid_upper32
|| W0=result, W1=debug_handle
|-
| 0x61 || svcBreakDebugProcess || W0=debug_handle || W0=result
|-
| 0x62 || svcTerminateDebugProcess || W0=debug_handle || W0=result
|-
| 0x63 || svcGetDebugEvent || X0=[[#DebugEventInfo]]*, W1=debug_handle || W0=result
|-
| 0x64 || [[#svcContinueDebugEvent]] || [1.0.0-2.3.0] W0=debug_handle, W1=[[#ContinueDebugFlagsOld]], X2=thread_id
[3.0.0+] W0=debug_handle, W1=[[#ContinueDebugFlags]], X2=thread_id_list(u64 *), W3=num_tids (max 64, 0 means "all threads")
|| W0=result
|-
| 0x65 || svcGetProcessList || X1=pids_out_ptr, W2=max_out || W0=result, W1=num_out
|-
| 0x66 || svcGetThreadList || X1=tids_out_ptr, W2=max_out, W3=debug_handle_or_zero || W0=result, X1=num_out
|-
| 0x67 || svcGetDebugThreadContext || X0=ThreadContext*, X1=debug_handle, X2=thread_id, W3=[[#ThreadContextFlags]]
R0=ThreadContext*, R1=debug_handle, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x68 || svcSetDebugThreadContext || W0=debug_handle, X1=thread_id, X2=ThreadContext*, W3=[[#ThreadContextFlags]]
R0=debug_handle, R1=ThreadContext*, R2=thread_id_lower32, R3=thread_id_upper32, R4=[[#ThreadContextFlags]]
|| W0=result
|-
| 0x69 || svcQueryDebugProcessMemory || X0=[[#MemoryInfo]]*, X2=debug_handle, X3=addr || W0=result, W1=PageInfo
|-
| 0x6A || svcReadDebugProcessMemory || X0=buffer*, X1=debug_handle, X2=src_addr, X3=size || W0=result
|-
| 0x6B || svcWriteDebugProcessMemory || X0=debug_handle, X1=buffer*, X2=dst_addr, X3=size || W0=result
|-
| 0x6C || [[#svcSetHardwareBreakPoint]] || W0=HardwareBreakpointId, X1=watchpoint_flags/breakpoint_flags, X2=watchpoint_value/debug_handle
R0=HardwareBreakpointId, R1=value_lower32, R2=flags_lower32, R3=flags_upper32, R4=value_upper32
|| W0=result
|-
| 0x6D || svcGetDebugThreadParam || X2=debug_handle, X3=thread_id, W4=[[#DebugThreadParam]] || W0=result, X1=out0, W2=out1
|- style="border-top: double"
| 0x6F || [5.0.0+] [[#svcGetSystemInfo]] || X1=info_id, X2=handle, X3=info_sub_id || W0=result, X1=out
|-
| 0x70 || svcCreatePort || W2=max_sessions, W3=is_light, X4=name_ptr || W0=result, W1=serverport_handle, W2=clientport_handle
|-
| 0x71 || svcManageNamedPort || X1=name_ptr, W2=max_sessions || W0=result, W1=serverport_handle
|-
| 0x72 || svcConnectToPort || W1=clientport_handle || W0=result, W1=session_handle
|-
| 0x73 || [[#svcSetProcessMemoryPermission]] || W0=process_handle, X1=addr, X2=size, W3=perm || W0=result
|-
| 0x74 || [[#svcMapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x75 || [[#svcUnmapProcessMemory]] || X0=dstaddr, W1=process_handle, X2=srcaddr, X3=size || W0=result
|-
| 0x76 || [[#svcQueryProcessMemory]] || X0=meminfo_ptr, W2=process_handle, X3=addr || W0=result, W1=pageinfo
|-
| 0x77 || [[#svcMapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x78 || [[#svcUnmapProcessCodeMemory]] || W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size || W0=result
|-
| 0x79 || [[#svcCreateProcess]] || X1=procinfo_ptr, X2=caps_ptr, W3=cap_num || W0=result, W1=process_handle
|-
| 0x7A || svcStartProcess || W0=process_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz || W0=result
|-
| 0x7B || svcTerminateProcess || W0=process_handle || W0=result
|-
| 0x7C || [[#svcGetProcessInfo]] || W0=process_handle, W1=[[#ProcessInfoType]] || W0=result, X1=[[#ProcessState]]
|-
| 0x7D || svcCreateResourceLimit || None || W0=result, W1=reslimit_handle
|-
| 0x7E || svcSetResourceLimitLimitValue || W0=reslimit_handle, W1=[[#LimitableResource]], X2=value || W0=result
|-
| 0x7F || [[#svcCallSecureMonitor]] || X0=smc_sub_id, X1,X2,X3,X4,X5,X6,X7=smc_args || X0,X1,X2,X3,X4,X5,X6,X7=result
|}

== svcSetHeapSize ==
<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || OutAddr
|}
</div>

'''Description:''' Set the process heap to a given Size. It can both extend and shrink the heap.

Size must be a multiple of 0x200000 (2MB).

On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.

Uses current process pool partition.

[2.0.0+] Size must be less than or equal to 4GB.

== svcSetMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || Prot
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change permission of page-aligned memory region.

Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).

This can be used to move back and forth between ---, r-- and rw-.

== svcSetMemoryAttribute ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || Addr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || u32 || State0
|-
| (In) W3 || u32 || State1
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Change attribute of page-aligned memory region.

This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.

What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.

{| class=wikitable
! State0 || State1 || Action
|-
| 0 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 0 || Clear bit3 in [[#MemoryAttribute]].
|-
| 8 || 8 || Set bit3 in [[#MemoryAttribute]].
|}

== svcMapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps a memory range into a different range.

Mainly used for adding guard pages around stack.

Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source [[#MemoryAttribute]].

[1.0.0] This could be used to map into either the Alias Region or the Stack region.

[2.0.0+] This can only be used to map into the Stack region.

Code can get the range of the Alias region from [[#svcGetInfo]] id0=2,3, and on 2.0.0+ the range of the Stack region via [[#svcGetInfo]] id0=14, 15 (on 1.0.0, the Stack region had hardcoded limits).

When mapped into the Alias region, the mapped memory will have state 0x482907.

When mapped into the Stack region, the mapped memory will have state 0x5C3C0B.

== svcUnmapMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) X1 || void* || SrcAddr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps a region that was previously mapped with [[#svcMapMemory]].

It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".

The srcaddr/dstaddr must match what was given when the pages were originally mapped.

== svcQueryMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfo
|-
| (In) X2 || void* || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

'''Description:''' Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.

Outputs a [[#MemoryInfo]] struct.

== svcExitProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current process.

== svcCreateThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || void(*)(void*) || Entry
|-
| (In) X2 || R2 || void* || ThreadContext
|-
| (In) X3 || R3 || void* || StackTop
|-
| (In) W4 || R0 || u32 || Priority
|-
| (In) W5 || R4 || u32 || ProcessorId
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<Thread> || Handle
|}
</div>

'''Description:''' Create a thread in the current process.

Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.

== svcStartThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) None || ||
|}
</div>

'''Description:''' Starts the thread for the provided handle.

== svcExitThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

'''Description:''' Exits the current thread.

== svcSleepThread ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X0 || R0, R1 || s64 || Nanoseconds
|-
|}
</div>

'''Description:''' Sleep for a specified amount of time, or yield thread.

Setting nanoseconds to 0, -1, or -2 indicates a yielding type.

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Value || Type
|-
| 0 || Yielding without core migration
|-
| -1 || Yielding with core migration
|-
| -2 || Yielding to any other thread
|-
|}
</div>

== svcGetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1|| Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || u64 || Priority
|}
</div>

'''Description:''' Get priority of provided thread handle.

== svcSetThreadPriority ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0|| Handle<Thread> || Handle
|-
| (In) W1|| u32 || Priority
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set priority of provided thread handle.

Priority is a number 0-0x3F. Lower value means higher priority.

== svcGetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W2 || R2 || Handle<Thread> || Handle
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u32 || Out0
|-
| (Out) X2 || R2, R3 || u64 || Out1
|}
</div>

'''Description:''' Get affinity mask of provided thread handle.

== svcSetThreadCoreMask ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<Thread> || Handle
|-
| (In) W1 || R1 || u32 || In0
|-
| (In) X2 || R2, R3 || u64 || In1
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Set affinity mask of provided thread handle.

== svcGetCurrentProcessorNumber ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) W0/X0 || u64 || CpuId
|}
</div>

'''Description:''' Get which cpu is executing the current thread.

Cpu-id is an integer in the range 0-3.

== svcMapSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<SharedMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.

Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.

== svcCreateTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<TransferMemory> || Handle
|}
</div>

This one reprotects the src block with perms you give it. It also sets bit0 into [[#MemoryAttribute]].

Executable bit perm not allowed.

Closing all handles automatically causes the bit0 in [[#MemoryAttribute]] to clear, and the permission to reset.

== svcWaitSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R1 || Handle* || HandlesPtr
|-
| (In) W2 || R2 || u64 || HandlesNum
|-
| (In) X3 || R0, R3 || u64 || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || HandleIndex
|}
</div>
Works with num_handles <= 0x40.

When zero handles are passed, this will wait forever until either timeout or cancellation occurs.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

=== Object types ===

'''KDebug:''' signals when there is a new [[#DebugEventInfo|DebugEvent]] (retrievable via [[#svcGetDebugEvent]]).

'''KClientPort:''' signals when the number of sessions is less than the maximum allowed.

'''KProcess:''' signals when the process undergoes a state change (retrievable via [[#svcGetProcessInfo]]).

'''KReadableEvent:''' signals when the event's corresponding KWritableEvent has been signaled via svcSignalEvent.

'''KServerPort:''' signals when there is an incoming connection waiting to be [[#svcAcceptSession|accepted]].

'''KServerSession:''' signals when there is an incoming message waiting to be [[#svcReplyAndReceive|received]] or the pipe is closed.

'''KThread:''' signals when the thread has exited.

=== Result codes ===

'''0x0:''' Success. One of the objects was signaled before the timeout expired, or one of the objects is a Session with a closed remote. Handle index is updated to indicate which object signaled.

'''0x7601:''' Thread termination requested. Handle index is not updated.

'''0xe401:''' Invalid handle. Returned when one of the handles passed is invalid. Handle index is not updated.

'''0xe601:''' Invalid address. Returned when the handles pointer is not a readable address. Handle index is not updated.

'''0xea01:''' Timeout. Returned when no objects have been signaled within the timeout. Handle index is not updated.

'''0xec01:''' Interrupted. Returned when another thread uses [[#svcCancelSynchronization]] to cancel this thread. Handle index is not updated.

'''0xee01:''' Too many handles. Returned when the number of handles passed is > 0x40.

== svcCancelSynchronization ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Thread> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

If the referenced thread is currently in a synchronization call ([[#svcWaitSynchronization]], [[#svcReplyAndReceive]] or [[#svcReplyAndReceiveLight]]), that call will be interrupted and return 0xec01.
If that thread is not currently executing such a synchronization call, the next call to a synchronization call will return 0xec01.

This doesn't take force-pause (activity/debug pause) into account.

=== Result codes ===

'''0x0:''' Success. The thread was either interrupted or has had its flag set.

'''0xe401:''' Invalid handle. The handle given was either invalid or not a thread handle.

== svcGetSystemTick ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (Out) X0 || R0, R1 || u64 || Ticks
|}
</div>

Returns the value of cntpct_el0.

The frequency is 19200000 Hz (constant from official sw).

Official sw reads cntpct_el0 directly from usermode without using this SVC. [[ExeFS|sdk-nso]] has this SVC, but it's not known to be called anywhere.

== svcSendSyncRequestWithUserBuffer ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || CmdPtr
|-
| (In) X1 || u64 || Size
|-
| (In) W2 || Handle<Session> || Handle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size and CmdPtr must be 0x1000-aligned.

=== Result codes ===

'''0x0:''' Success.

'''0xcc01:''' CmdPtr is not 0x1000-aligned.

'''0xca01:''' Size is not 0x1000-aligned.

'''0xce01:''' KSessionRequest allocation failed (unlikely) or pointer buffer size exceeded.

'''0xe401:''' Handles does not exist, or handle is not an instance of KClientSession.

== svcBreak ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || Break Reason
|-
| (In) X1 || u64 ||
|-
| (In) X2 || u64 || Info
|-
| (Out) W0 || Result || 0 (Success)
|}
</div>

If the process is attached, report the Break event. Then, if svcContinueDebugEvent didn't apply IgnoreException on the thread: if TPIDR_EL0 is 0, adjust ELR_EL1 to retry to svc instruction (and set TPIDR_EL0 to 1).

Otherwise, if bit31 in reason isn't set, perform crash reporting (see Exception Handling section below), if it doesn't terminate the process adjust ELR_EL1 as well.

Otherwise just return 0.

== svcGetInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u32 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>
<div style="display: inline-block; vertical-align:top;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) R0 || u32 || InfoSubIdLower32
|-
| (In) R1 || u32 || InfoId
|-
| (In) R2 || Handle || Handle
|-
| (In) R3 || u32 || InfoSubIdUpper32
|-
| (Out) R0 || [[#Result]] || Ret
|-
| (Out) R1 || u32 || OutLower32
|-
| (Out) R2 || u32 || OutUpper32
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Process || 0 || 0 || AllowedCpuIdBitmask
|-
| Process || 1 || 0 || AllowedThreadPrioBitmask
|-
| Process || 2 || 0 || AliasRegionBaseAddr
|-
| Process || 3 || 0 || AliasRegionSize
|-
| Process || 4 || 0 || HeapRegionBaseAddr
|-
| Process || 5 || 0 || HeapRegionSize
|-
| Process || 6 || 0 || TotalMemoryAvailable. Total memory available(free+used).
|-
| Process || 7 || 0 || TotalMemoryUsage. Total used size of codebin memory + main-thread stack + allocated heap.
|-
| Zero || 8 || 0 || IsCurrentProcessBeingDebugged
|-
| Zero || 9 || 0 || Returns ResourceLimit handle for current process. Used by [[Process_Manager_services|PM]].
|-
| Zero || 10 || -1, {current coreid} || IdleTickCount
|-
| Zero || 11 || 0-3 || RandomEntropy from current process. TRNG. Used to seed usermode PRNGs.
|-
| Process || 12 || 0 || [2.0.0+] AddressSpaceBaseAddr
|-
| Process || 13 || 0 || [2.0.0+] AddressSpaceSize
|-
| Process || 14 || 0 || [2.0.0+] StackRegionBaseAddr
|-
| Process || 15 || 0 || [2.0.0+] StackRegionSize
|-
| Process || 16 || 0 || [3.0.0+] PersonalMmHeapSize
|-
| Process || 17 || 0 || [3.0.0+] PersonalMmHeapUsage
|-
| Process || 18 || 0 || [3.0.0+] TitleId
|-
| Zero || 19 || 0 || [4.0.0-4.1.0] PrivilegedProcessId_LowerBound
|-
| Zero || 19 || 1 || [4.0.0-4.1.0] PrivilegedProcessId_UpperBound
|-
| Process || 20 || 0 || [5.0.0+] UserExceptionContextAddr
|-
| Process || 21 || 0 || [6.0.0+] TotalMemoryAvailableWithoutMmHeap
|-
| Process || 22 || 0 || [6.0.0+] TotalMemoryUsedWithoutMmHeap
|-
| Thread || 0xF0000002 || 0-3, -1 || Thread Ticks. When 0-3 are passed, gets specific core CPU ticks spent on thread. When -1 is passed, gets total CPU ticks spent on thread.
|}

== svcMapPhysicalMemory ==
This is like svcSetHeapSize except you can allocate heap at any address you'd like.

Uses current process pool partition.

== svcDumpInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) None || ||
|-
| (Out) None || ||
|}
</div>

Does nothing, just returns with registers set to all-zero.

== svcAcceptSession ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || Handle<Port> || Port
|-
| (Out) W0 || [[#Result]] || Result
|-
| (Out) W1 || Handle<ServerSession> || Session
|}
</div>

=== Result codes ===

'''0xf201:''' No session waiting to be accepted

== svcReplyAndReceive ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W1 || R1 || *Handle<Port or ServerSession> || Handles
|-
| (In) W2 || R2 || u32 || NumHandles
|-
| (In) W3 || R3 || Handle<ServerSession> || ReplyTarget
|-
| (In) X4 || R0, R4 || u64 (nanoseconds) || Timeout
|-
| (Out) W0 || R0 || [[#Result]] || Result
|-
| (Out) W1 || R1 || u32 || HandleIndex
|}
</div>

If ReplyTarget is not zero, a reply from the TLS will be sent to that session.
Then it will wait until either of the passed sessions has an incoming message, is closed, a passed port has an incoming connection, or the timeout expires.
If there is an incoming message, it is copied to the TLS.

If ReplyTarget is zero, the TLS should contain a blank message. If this message has a C descriptor, the buffer it points to will be used as the pointer buffer. See [[IPC_Marshalling#IPC_buffers]]. Note that a pointer buffer cannot be specified if ReplyTarget is not zero.

After being validated, passed handles will be enumerated in order; even if a session has been closed, if one that appears earlier in the list has an incoming message, it will take priority and a result code of 0x0 will be returned.

=== Result codes ===

'''0x0:''' Success. Either a session has an incoming message or a port has an incoming connection. HandleIndex is set appropriately.

'''0xea01:''' Timeout. No handles were signalled before the timeout expired. HandleIndex is not updated.

'''0xf601:''' Port remote dead. One of the sessions has been closed. HandleIndex is set appropriately.

== svcMapPhysicalMemoryUnsafe ==
Same as [[#svcMapPhysicalMemory]] except it always uses pool partition 0.

== svcCreateCodeMemory ==
Takes an address range with backing memory to create the code memory object.

The memory is initially memset to 0xFF after being locked.

== svcControlCodeMemory ==
Maps the backing memory for a Code memory object into the current process.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapOwner]], memory permission must be RW-.

For [[#CodeMemoryOperation|CodeMemoryOperation_MapSlave]], memory permission must be R-- or R-X.

Operations [[#CodeMemoryOperation|CodeMemoryOperation_UnmapOwner/CodeMemoryOperation_UnmapSlave]] unmap memory that was previously mapped this way.

This allows one "secure JIT" process to map the code memory as RW-, and the other "slave" process to map it R-X.

[5.0.0+] Error 0xE401 is now returned when the process owner of the Code memory object is the same as the current process.

== svcReadWriteRegister ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || RegAddr
|-
| (In) W2 || R0 || u64 || RwMask
|-
| (In) W3 || R1 || u64 || InValue
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || u64 || OutValue
|}
</div>

Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.

rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.

You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.

The whitelist is same for writing as for reading.

The whitelist is:

0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac

[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.

[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using [[SMC]] Id1 0xC3000008(ReadWriteRegister).

[4.0.0+] Access to the Memory Controller (0x70019000) also uses smcReadWriteRegister.

Here is the whitelist imposed by that SMC, relative to the start of the PMC registers:

0x000, 0x00c, 0x010, 0x014, 0x01c, 0x020, 0x02c, 0x030, 0x034, 0x038, 0x03c, 0x040, 0x044, 0x048, 0x0dc, 0x0e0, 0x0e4, 0x160, 0x164, 0x168, 0x170, 0x1a8, 0x1b8, 0x1bc, 0x1c0, 0x1c4, 0x1c8, 0x2b4, 0x2d4, 0x440, 0x4d8

Here is the whitelist imposed by smcReadWriteRegister (checked in addition to the whitelist in svcReadWriteRegister), relative to the start of the MC registers:

0x000, 0x004, 0x008, 0x00C, 0x010, 0x01C, 0x020, 0x030, 0x034, 0x050, 0x054, 0x090, 0x094, 0x098, 0x09C, 0x0A0, 0x0A4, 0x0A8, 0x0AC, 0x0B0, 0x0B4, 0x0B8, 0x0BC, 0x0C0, 0x0C4, 0x0C8, 0x0D0, 0x0D4, 0x0D8, 0x0DC, 0x0E0, 0x100, 0x108, 0x10C, 0x118, 0x11C, 0x124, 0x128, 0x12C, 0x130, 0x134, 0x138, 0x13C, 0x158, 0x15C, 0x164, 0x168, 0x16C, 0x170, 0x174, 0x178, 0x17C, 0x200, 0x204, 0x238, 0x240, 0x244, 0x250, 0x254, 0x258, 0x264, 0x268, 0x26C, 0x270, 0x274, 0x280, 0x284, 0x288, 0x28C, 0x294, 0x2E4, 0x2E8, 0x2EC, 0x2F4, 0x2F8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37C, 0x380, 0x390, 0x394, 0x398, 0x3AC, 0x3B8, 0x3BC, 0x3C0, 0x3C4, 0x3D8, 0x3E8, 0x41C, 0x420, 0x424, 0x428, 0x42C, 0x430, 0x44C, 0x47C, 0x480, 0x484, 0x4C4, 0x4C8, 0x4CC, 0x50C, 0x554, 0x558, 0x55C, 0x584, 0x588, 0x58C, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69C, 0x6A0, 0x6A4, 0x6C0, 0x6C4, 0x6F0, 0x6F4, 0x960, 0x970, 0x974, 0x9B8, 0xA20, 0xA24, 0xA88, 0xA94, 0xA98, 0xA9C, 0xAA0, 0xAA4, 0xAA8, 0xAAC, 0xAB0, 0xAB4, 0xAB8, 0xABC, 0xAC0, 0xAC4, 0xAC8, 0xACC, 0xAD0, 0xAD4, 0xAD8, 0xADC, 0xAE0, 0xB88, 0xB8C, 0xBC4, 0xBC8, 0xBCC, 0xBD0, 0xBD4, 0xBD8, 0xBDC, 0xBE0, 0xBE4, 0xBE8, 0xBEC, 0xC00, 0xC5C, 0xCAC

== svcCreateSharedMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W1 || u64 || Size
|-
| (In) W2 || [[#Permission]] || LocalPerm
|-
| (In) W3 || [[#Permission]] || RemotePerm
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<SharedMemory> || MemHandle
|}
</div>

Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.

Allocates memory from the current process' pool partition.

== svcMapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || [[#Permission]] || Permissions
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

The newly mapped pages will have [[#MemoryState]] type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

== svcUnmapTransferMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || Handle<TransferMemory> || MemHandle
|-
| (In) X1 || void* || Addr
|-
| (In) X2 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Size must match size given in map syscall, otherwise there's an invalid-size error.

== svcCreateInterruptEvent ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || IrqNum
|-
| (In) W2 || bool || Flags
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<ReadableEvent> || ReadableEventHandle
|}
</div>

Create an event handle for the given IRQ number. Waiting on this handle will wait until the IRQ is triggered. The flags argument configures the triggering. If it is false, the IRQ is active HIGH level sensitive, if it is true it is rising-edge sensitive.

=== Result codes ===

'''0x0:''' Success.

'''0xF001:''' Flags was > 1

'''0xF201:''' IRQ above 0x3FF or outside the [[NPDM#Kernel_Access_Control|IRQ access mask]] was given.

'''0xCE01:''' A SlabHeap was exhausted (too many interrupts created).

'''0xF401:''' IRQ already has an event registered.

'''0xD201:''' The handle table is full. Try closing some handles.

== svcQueryPhysicalAddress ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || Addr
|-
| (Out) W0 || [[#Result]]|| Ret
|-
| (Out) X1 || u64 || PhysAddr
|-
| (Out) X2 || u64 || KernelAddr
|-
| (Out) X3 || u64 || Size
|}
</div>

== svcQueryIoMapping ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || PhysAddr
|-
| (In) X2 || R0 || u64 || Size
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) X1 || R1 || void* || VirtAddr
|}
</div>

'''Description:''' Returns a virtual address mapped to a given IO range.

== svcCreateDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) X1 || R2, R3 || u64 || StartAddr
|-
| (In) X2 || R0, R1 || u64 || EndAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|-
| (Out) W1 || R1 || Handle<DeviceAddressSpace> || AddressSpaceHandle
|}
</div>

'''Description:''' Creates a virtual address space for binding device address spaces and returns a handle.

dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.

== svcAttachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Attaches a device address space to a [[#DeviceName|device]].

== svcDetachDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || [[#DeviceName]] || DeviceId
|-
| (In) X1 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Detaches a device address space from a [[#DeviceName|device]].

== svcMapDeviceAddressSpaceByForce ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to [[#svcCreateDeviceAddressSpace]]).

The userspace destination address must have the [[SVC#MemoryState|MapDeviceAllowed]] bit set. Bit [[SVC#MemoryAttribute|IsDeviceMapped]] will be set after mapping.

== svcMapDeviceAddressSpaceAligned ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (In) W5 || R7 || [[#Permission]] || Permissions
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Maps an attached device address space to an userspace address.

Same as [[#svcMapDeviceAddressSpaceByForce]], but the userspace destination address must have the [[SVC#MemoryState|MapDeviceAlignedAllowed]] bit set instead.

== svcUnmapDeviceAddressSpace ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || Handle<DeviceAddressSpace> || DeviceAsHandle
|-
| (In) W1 || R1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || R2, R3 || void* || SrcAddr
|-
| (In) X3 || R4 || u64 || DeviceAsSize
|-
| (In) X4 || R5, R6 || u64 || DeviceAsAddr
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

'''Description:''' Unmaps an attached device address space from an userspace address.

== svcContinueDebugEvent ==

=== Result codes ===

'''0x0:''' Success. The process has been resumed.

'''0xe401:''' Invalid debug handle.

'''0xf401:''' Process has debug events queued or is already running.

== svcGetSystemInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || u64 || InfoId
|-
| (In) W2 || Handle || Handle
|-
| (In) X3 || u64 || InfoSubId
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) X1 || u64 || Out
|}
</div>

{| class=wikitable
! Handle type || Id0 || Id1 || Description
|-
| Zero || 0 || 0 || TotalMemorySize_Application
|-
| Zero || 0 || 1 || TotalMemorySize_Applet
|-
| Zero || 0 || 2 || TotalMemorySize_System
|-
| Zero || 0 || 3 || TotalMemorySize_SystemUnsafe
|-
| Zero || 1 || 0 || CurrentMemorySize_Application
|-
| Zero || 1 || 1 || CurrentMemorySize_Applet
|-
| Zero || 1 || 2 || CurrentMemorySize_System
|-
| Zero || 1 || 3 || CurrentMemorySize_SystemUnsafe
|-
| Zero || 2 || 0 || PrivilegedProcessId_LowerBound
|-
| Zero || 2 || 1 || PrivilegedProcessId_UpperBound
|-
|}

== svcSetProcessMemoryPermission ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || Addr
|-
| (In) X2 || u64 || Size
|-
| (In) W3 || void* || Perm
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

This sets the memory permissions for the specified memory with the supplied process handle.

This throws an error(0xD801) when the input perm is >0x5, hence -WX and RWX are not allowed.

== svcMapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || void* || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Maps the src address from the supplied process handle into the current process.

This allows mapping code and rodata with RW- permission.

== svcUnmapProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || void* || DstAddr
|-
| (In) W1 || Handle<Process> || ProcessHandle
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessMemory]].

== svcQueryProcessMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || [[#MemoryInfo]]* || MemInfoPtr
|-
| (In) W2 || Handle<Process> || ProcessHandle
|-
| (In) X3 || u64 || Addr
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || PageInfo || PageInfo
|}
</div>

Equivalent to [[#svcQueryMemory]] except takes a process handle.

== svcMapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Takes a process handle, and maps normal heap in that process as executable code in that process. Used when loading NROs. This does not support using the current-process handle alias.

== svcUnmapProcessCodeMemory ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (In) X1 || u64 || DstAddr
|-
| (In) X2 || u64 || SrcAddr
|-
| (In) X3 || u64 || Size
|-
| (Out) W0 || [[#Result]] || Ret
|}
</div>

Unmaps what was mapped by [[#svcMapProcessCodeMemory]].

== svcCreateProcess ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X1 || [[#CreateProcessInfo]]* || InfoPtr
|-
| (In) X2 || u32* || CapabilitiesPtr
|-
| (In) X3 || u64 || CapabilitiesNum
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || Handle<Process> || ProcessHandle
|}
</div>

Takes a [[#CreateProcessInfo]] as input.
CapabilitiesPtr points to an array of [[NPDM#Kernel_Access_Control|kernel capabilities]].
CapabilitiesNum is a number of capabilities in the CapabilitiesPtr array (number of element, not number of bytes).

=== Result codes ===

'''0x0:''' Success.

'''0xCA01:''' Attempted to map more code pages than available in address space.

'''0xCC01:''' Provided CodeAddr is invalid (make sure it's in range?)

'''0xE401:''' The resource handle passed is invalid.

'''0xE601:''' Attempt to copy procinfo from user-supplied pointer failed. Attempt to copy capabilities_num from user-supplied pointer failed.

'''0xE801:''' Attempted to create a 32-bit process with a 36-bit address space.

'''0xF001:''' Unused bits are set in mmuflags. Unknown address space type used.

== svcGetProcessInfo ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) W0 || Handle<Process> || ProcessHandle
|-
| (Out) W0 || [[#Result]] || Ret
|-
| (Out) W1 || [[#ProcessState]] || State
|}
</div>

Returns an enum with value 0-7.

== svcCallSecureMonitor ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument || Type || Name
|-
| (In) X0 || u64 || [[SMC#ID_0|Function ID]]
|-
| (In) X1-X7 || u64 || SMC sub-arguments
|-
| (Out) X0 || [[SMC#Errors|SMC Result]] || Result of SMC
|-
| (Out) X1-X7 || u64 || SMC sub-output
|}
</div>

Takes in a SMC function ID in X0, and arguments for that SMC function in X1-X7.

Passing an invalid SMC function ID or calling from a core other than core 3 will result in a secure monitor panic.

The kernel parses bits 9-15 in the passed SMC function ID (per the ARM SMC calling convention), and when set uses as an indicator to translate a pointer in the associated register (X1-X7) to a physical address. The kernel will translate any address mapped as R-W, other addresses (R--, R-X, or invalid pointers) will be translated as 0/NULL.

Output is returned raw from the Secure Monitor; X0 will be the untranslated SMC result and X1-X7 will contain other SMC output (or be unchanged, depending on the SMC).

== Debugging ==
[2.0.0+] Exactly 6 debug SVCs require that [[SPL_services#GetConfig|IsDebugMode]] is non-zero. Error 0x4201 is returned otherwise.
* svcBreakDebugProcess
* svcContinueDebugEvent
* svcWriteDebugProcessMemory
* svcSetDebugThreadContext
* svcTerminateDebugProcess
* svcSetHardwareBreakPoint

svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.

== svcSetHardwareBreakPoint ==

<div style="display: inline-block;">
{| class="wikitable" border="1"
|-
! Argument64 || Argument32 || Type || Name
|-
| (In) W0 || R0 || u32 || hardware_breakpoint_id
|-
| (In) X1 || R2, R3 || u64 || flags
|-
| (In) X2 || R1, R4 || u64 || value
|-
| (Out) W0 || R0 || [[#Result]] || Ret
|}
</div>

Sets one of the AArch64 hardware breakpoints. The nintendo switch has 6 hardware breakpoints, and 4 hardware watchpoints. The syscall has two behaviors depending on the value of hardware_breakpoint_id:

If hardware_breakpoint_id < 0x10, then it sets one of the AArch64 hardware breakpoints. Flags will go to DBGBCRn_EL1, and value to DBGBVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0x7F01E1. Furthermore, the kernel will or it with 0x4004, in order to set various security flags to guarantee the watchpoints only triggers for code in EL0. If the user asks for a Breakpoint Type of ContextIDR match, the kernel shall use the given debug_handle to set DBGBVRn_EL1 to the ContextID of the debugged process.

If hardware_breakpoint_id is between 0x10 and 0x20 (exclusive), then it sets one of the AArch64 hardware watchpoints. Flags will go to DBGWCRn_EL1, and the value to DBGWVRn_EL1. The only flags the user is allowed to set are those in the bitmask 0xFF0F1FF9. Furthermore, the kernel will or it with 0x104004. This will set various security flags, and set the watchpoint type to be a Linked Watchpoint. This means that you need to link it to a Linked ContextIDR breakpoint. Check the ARM documentation for more information.

Note that hardware_breakpoint_id 0 to 4 match only to Virtual Address, while hardware_breakpoint_id 5 and 6 match against either Virtual Address, ContextID, or VMID. As such, if you are configuring a breakpoint to link for a watchpoint, make sure you use hardware_breakpoint_id 5 or 6.

For more documentation for hardware breakpoints, check out the AArch64 documentation for the [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0488h/way1382455558968.html DBGBCRn_EL1 register] and the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0488h/way1382455560629.html DBGWCRn_EL1 register]

= Enum/Structures =
== ThreadContextFlags ==
Bitfield of one of more of these:

{| class=wikitable
! Bit || Bitmask || Name || Description
|-
| 0 || 1 || General-purpose registers || If in 64-bit mode, GPRs 0–28 will be read/written. If in 32-bit mode, GPRs 0–12 will be read/written.
|-
| 1 || 2 || Control registers || Reads/writes the FP, LR, PC, SP, PSTATE, and TPIDR registers.
|-
| 2 || 4 || Floating-point registers || Reads/writes the floating-point vector registers.
|-
| 3 || 8 || Floating-point control registers || Reads/writes the FPCR and FPSR registers.
|}

== DeviceName ==
{| class=wikitable
! Value || Name
|-
| 0 || DeviceName_AFI
|-
| 1 || DeviceName_AVPC
|-
| 2 || DeviceName_DC
|-
| 3 || DeviceName_DCB
|-
| 4 || DeviceName_HC
|-
| 5 || DeviceName_HDA
|-
| 6 || DeviceName_ISP2
|-
| 7 || DeviceName_MSENCNVENC
|-
| 8 || DeviceName_NV
|-
| 9 || DeviceName_NV2
|-
| 10 || DeviceName_PPCS
|-
| 11 || DeviceName_SATA
|-
| 12 || DeviceName_VI
|-
| 13 || DeviceName_VIC
|-
| 14 || DeviceName_XUSB_HOST
|-
| 15 || DeviceName_XUSB_DEV
|-
| 16 || DeviceName_TSEC
|-
| 17 || DeviceName_PPCS1
|-
| 18 || DeviceName_DC1
|-
| 19 || DeviceName_SDMMC1A
|-
| 20 || DeviceName_SDMMC2A
|-
| 21 || DeviceName_SDMMC3A
|-
| 22 || DeviceName_SDMMC4A
|-
| 23 || DeviceName_ISP2B
|-
| 24 || DeviceName_GPU
|-
| 25 || DeviceName_GPUB
|-
| 26 || DeviceName_PPCS2
|-
| 27 || DeviceName_NVDEC
|-
| 28 || DeviceName_APE
|-
| 29 || DeviceName_SE
|-
| 30 || DeviceName_NVJPG
|-
| 31 || DeviceName_HC1
|-
| 32 || DeviceName_SE1
|-
| 33 || DeviceName_AXIAP
|-
| 34 || DeviceName_ETR
|-
| 35 || DeviceName_TSECB
|-
| 36 || DeviceName_TSEC1
|-
| 37 || DeviceName_TSECB1
|-
| 38 || DeviceName_NVDEC1
|}

== CodeMemoryOperation ==
{| class=wikitable
! Value || Name
|-
| 0 || CodeMemoryOperation_MapOwner
|-
| 1 || CodeMemoryOperation_MapSlave
|-
| 2 || CodeMemoryOperation_UnmapOwner
|-
| 3 || CodeMemoryOperation_UnmapSlave
|}

== LimitableResource ==
{| class=wikitable
! Value || Name || Note
|-
| 0 || LimitableResource_Memory || Bytes of memory a process may allocate.
|-
| 1 || LimitableResource_Threads || Amount of threads a process can create.
|-
| 2 || LimitableResource_Events || Amount of events a process can create through svcCreateEvent or svcSendAsyncRequestWithUserBuffer.
|-
| 3 || LimitableResource_TransferMemories || Amount of TransferMemory a process can create through svcCreateTransferMemory.
|-
| 4 || LimitableResource_Sessions || Amount of session a process can create through svcCreateSession, svcConnectToPort or svcConnectToNamedPort.
|}

== ProcessInfoType ==

{| class=wikitable
! Value || Name
|-
| 0 || [[#ProcessState|ProcessInfoType_ProcessState]]
|-
|}

== ProcessState ==
{| class=wikitable
! Value || Name || Notes
|-
| 0 || ProcessState_Created ||
|-
| 1 || ProcessState_CreatedAttached ||
|-
| 2 || ProcessState_Started ||
|-
| 3 || ProcessState_Crashed || Processes will not enter this state unless they were created with [[#CreateProcessInfo|EnableDebug]].
|-
| 4 || ProcessState_StartedAttached ||
|-
| 5 || ProcessState_Exiting ||
|-
| 6 || ProcessState_Exited ||
|-
| 7 || ProcessState_DebugSuspended ||
|}

== DebugThreadParam ==
{| class=wikitable
! Value || Name
|-
| 0 || DebugThreadParam_DynamicPriority
|-
| 1 || DebugThreadParam_SchedulingStatus
|-
| 2 || DebugThreadParam_PreferredCpuCore
|-
| 3 || DebugThreadParam_CurrentCpuCore
|-
| 4 || DebugThreadParam_AffinityMask
|}

Dynamic priority: output in out2

Scheduling status: out1 contains bit0: is debug-suspended, bit1: is user-suspended (svcSetThreadActivity 1 or svcSetProcessActivity 1).
Out2 contains {suspended, idle, running, terminating} => {5, 0, 1, 4}

DebugThreadParam_PreferredCpuCore: output in out2

DebugThreadParam_CurrentCpuCore: output in out2

DebugThreadParam_AffinityMask: output in out1

== CreateProcessInfo ==
{| class=wikitable
! Offset || Length || Bits || Description
|-
| 0 || 12 || || ProcessName (doesn't have to be null-terminated)
|-
| 0x0C || 4 || || ProcessCategory (0: regular title, 1: kernel built-in)
|-
| 0x10 || 8 || || TitleId
|-
| 0x18 || 8 || || CodeAddr
|-
| 0x20 || 4 || || CodeNumPages
|-
| 0x24 || 4 || || Flags
|-
| || || Bit0 || IsAarch64
|-
| || || Bit3-1 || [[#AddressSpaceType]]
|-
| || || Bit4 || [2.0.0+] EnableDebug
|-
| || || Bit5 || EnableAslr
|-
| || || Bit6 || IsApplication
|-
| || || Bit7 || [4.0.0] UseSecureMemory
|-
| || || Bit10-7 || [5.0.0+] PoolPartition (0=Application, 1=Applet, 2=Sysmodule, 3=Nvservices)
|-
| || || Bit11 || [7.0.0+] OptimizeMemoryAllocation (Only allowed in combination with IsApplication).
|-
| 0x28 || 4 || || ResourceLimitHandle or zero
|-
| 0x2C || 4 || || [3.0.0+] SystemResourceNumPages
|}

On [1.0.0] there's only one pool.

On [2.0.0-4.0.0] PoolPartition is 1 for built-ins and 0 for rest.

On [5.0.0] PoolPartition is specified in CreateProcessArgs. There are now 4 pool partitions.

On [5.0.0] (maybe lower?) a zero ResourceLimitHandle defaults to sysmodule limits and 0x12300000 bytes of memory.

The PersonalMmHeap are allocated as follows:
* For the application, normal insecure pool is used. Carveout 5 is used to provide protection.
* For the applet, a pre-allocated secure pool segment of size 0x400000 is used.
* For sysmodules, secure pool is allocated.

=== AddressSpaceType ===
{| class=wikitable
! Type || Name || Width || Description
|-
| 0 || Normal_32Bit || 32 ||
|-
| 1 || Normal_36Bit || 36 ||
|-
| 2 || WithoutMap_32Bit || 32 || Appears to be missing map region [?]
|-
| 3 || [2.0.0+] Normal_39Bit || 39 ||
|}

== MemoryInfo ==
{| class=wikitable
! Offset || Length || Description
|-
| 0 || 8 || BaseAddress
|-
| 8 || 8 || Size
|-
| 0x10 || 4 || MemoryType: lower 8 bits of [[#MemoryState]]
|-
| 0x14 || 4 || [[#MemoryAttribute]]
|-
| 0x18 || 4 || Permission (bit0: R, bit1: W, bit2: X)
|-
| 0x1C || 4 || IpcRefCount
|-
| 0x20 || 4 || DeviceRefCount
|-
| 0x24 || 4 || Padding: always zero
|}

== MemoryAttribute ==
{| class=wikitable
! Bits || Name || Description
|-
| 0 || IsBorrowed || Used by MapMemory, as an async IPC user buffer,
|-
| 1 || IsIpcLocked || True when IpcRefCount > 0
|-
| 2 || IsDeviceShared || True when DeviceRefCount > 0
|-
| 3 || IsUncached ||
|}

== MemoryState ==
{| class=wikitable
! Bits || Description
|-
| 7-0 || Type
|-
| 8 || [[#svcSetMemoryPermission|PermissionChangeAllowed]]
|-
| 9 || ForceReadWritableByDebugSyscalls
|-
| 10 || IpcSendAllowed
|-
| 11 || NonDeviceIpcSendAllowed
|-
| 12 || NonSecureIpcSendAllowed
|-
| 14 || [[#svcSetProcessMemoryPermission|ProcessPermissionChangeAllowed]]
|-
| 15 || [[#svcMapMemory|MapAllowed]]
|-
| 16 || [[#svcUnmapProcessCodeMemory|UnmapProcessCodeMemoryAllowed]]
|-
| 17 || [[#svcCreateTransferMemory|TransferMemoryAllowed]]
|-
| 18 || [[#svcQueryPhysicalAddress|QueryPhysicalAddressAllowed]]
|-
| 19 || MapDeviceAllowed ([[#svcMapDeviceAddressSpace]] and [[#svcMapDeviceAddressSpaceByForce]])
|-
| 20 || [[#svcMapDeviceAddressSpaceAligned|MapDeviceAlignedAllowed]]
|-
| 21 || [[#svcSendSyncRequestWithUserBuffer|IpcBufferAllowed]]
|-
| 22 || IsPoolAllocated/IsReferenceCounted
|-
| 23 || [[#svcMapProcessMemory|MapProcessAllowed]]
|-
| 24 || [[#svcSetMemoryAttribute|AttributeChangeAllowed]]
|-
| 25 || [4.0.0+] CodeMemoryAllowed
|}

{| class=wikitable
! Value || Type || Meaning
|-
| 0x00000000 || MemoryType_Unmapped ||
|-
| 0x00002001 || MemoryType_Io || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00042002 || MemoryType_Normal || Mapped by kernel capability parsing in [[#svcCreateProcess]].
|-
| 0x00DC7E03 || MemoryType_CodeStatic || Mapped during [[#svcCreateProcess]].
|-
| [1.0.0+]

0x01FEBD04

[4.0.0+]

0x03FEBD04
|| MemoryType_CodeMutable || Transition from 0xDC7E03 performed by [[#svcSetProcessMemoryPermission]].
|-
| [1.0.0+]
0x017EBD05

[4.0.0+]

0x037EBD05
|| MemoryType_Heap || Mapped using [[#svcSetHeapSize]].
|-
| 0x00402006 || MemoryType_SharedMemory || Mapped using [[#svcMapSharedMemory]].
|-
| 0x00482907 || [1.0.0] MemoryType_Alias || Mapped using [[#svcMapMemory]].
|-
| 0x00DD7E08 || MemoryType_ModuleCodeStatic || Mapped using [[#svcMapProcessCodeMemory]].
|-
| [1.0.0+]

0x01FFBD09

[4.0.0+]

0x03FFBD09
|| MemoryType_ModuleCodeMutable || Transition from 0xDD7E08 performed by [[#svcSetProcessMemoryPermission]].
|-
| 0x005C3C0A || [[IPC_Marshalling|MemoryType_Ipc]] || IPC buffers with descriptor flags=0.
|-
| 0x005C3C0B || MemoryType_Stack || Mapped using [[#svcMapMemory]].
|-
| 0x0040200C || [[Thread Local Storage|MemoryType_ThreadLocal]] || Mapped during [[#svcCreateThread]].
|-
| 0x015C3C0D || MemoryType_TransferMemoryIsolated || Mapped using [[#svcMapTransferMemory]] when the owning process has perm=0.
|-
| 0x005C380E || MemoryType_TransferMemory || Mapped using [[#svcMapTransferMemory]] when the owning process has perm!=0.
|-
| 0x0040380F || MemoryType_ProcessMemory || Mapped using [[#svcMapProcessMemory]].
|-
| 0x00000010 || MemoryType_Reserved ||
|-
| 0x005C3811 || [[IPC_Marshalling|MemoryType_NonSecureIpc]] || IPC buffers with descriptor flags=1.
|-
| 0x004C2812 || [[IPC_Marshalling|MemoryType_NonDeviceIpc]] || IPC buffers with descriptor flags=3.
|-
| 0x00002013 || MemoryType_KernelStack || Mapped in kernel during [[#svcCreateThread]].
|-
| 0x00402214 || [4.0.0+] MemoryType_CodeReadOnly || Mapped in kernel during [[#svcControlCodeMemory]].
|-
| 0x00402015 || [4.0.0+] MemoryType_CodeWritable || Mapped in kernel during [[#svcControlCodeMemory]].
|}

== ArbitrationType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || WaitIfLessThan
|-
| 0x1 || DecrementAndWaitIfLessThan
|-
| 0x2 || WaitIfEqual
|-
|}

== SignalType ==

{| class=wikitable
! Value || Type
|-
| 0x0 || Signal
|-
| 0x1 || SignalAndIncrementIfEqual
|-
| 0x2 || SignalAndModifyBasedOnWaitingThreadCountIfEqual
|-
|}

== ContinueDebugFlagsOld ==
[1.0.0-2.3.0]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: ResumeAllThreads or debug-suspended-thread-id needed)
|-
| 1 || 2 || SwallowException
|-
| 2 || 4 || ResumeAllThreads
|}

== ContinueDebugFlags ==
[3.0.0+]

{| class=wikitable
! Bit || Bitmask || Description
|-
| 0 || 1 || IgnoreException (note: doesn't need to be set in the same call than Resume)
|-
| 1 || 2 || DontCatchExceptions
|-
| 2 || 4 || Resume
|-
| 3 || 8 || IgnoreOtherThreadsExceptions
|}

IgnoreExceptionsOfOthers is like IgnoreException but acts on all threads that aren't in the input list. The affected threads are resumed.

Only one of of Resume and IgnoreOtherThreadsExceptions can be set at a time.

If the input number of threads is 0, this means "all threads".

== DebugEventInfo ==

The below table is for the Aarch64 version of the system call. For A32, all u64 fields but title/process/thread id are actually u32, making the structure 0x28-byte-big (0x40 for a64).

Size: 0x40

{| class=wikitable
! Offset || Length || Description
|-
| 0 || u32 || EventType
|-
| 4 || u32 || Flags (bit0: NeedsContinue)
|-
| 8 || u64 || ThreadId
|-
| 0x10 || || PerTypeSpecifics
|}

AttachProcess specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || TitleId
|-
| 0x18 || u64 || ProcessId
|-
| 0x20 || char[12] || ProcessName
|-
| 0x2C || u32 || MmuFlags
|-
| 0x30 || u64 || [5.0.0+] UserExceptionContextAddr
|}

AttachThread specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u64 || ThreadId
|-
| 0x18 || u64 || TlsPtr
|-
| 0x20 || u64 || Entrypoint
|}

Exit specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32|| Type (0=PausedThread, 1=RunningThread, 2=ExitedProcess, 3=TerminatedProcess)
|}

Exception specific:
{| class=wikitable
! Offset || Length || Description
|-
| 0x10 || u32 || ExceptionType
|-
| 0x18 || u64 || FaultRegister
|-
| 0x20 || || PerExceptionSpecifics
|}

=== DebugEventType ===
{| class=wikitable
! Value || Name
|-
| 0 || DebugEvent_AttachProcess
|-
| 1 || DebugEvent_AttachThread
|-
| 2 || DebugEvent_ExitProcess
|-
| 3 || DebugEvent_ExitThread
|-
| 4 || DebugEvent_Exception
|}

=== DebugExceptionType ===
{| class=wikitable
! Value || Name
|-
| 0 || Exception_Trap (*)
|-
| 1 || Exception_InstructionAbort
|-
| 2 || Exception_DataAbortMisc (**)
|-
| 3 || Exception_PcSpAlignmentFault
|-
| 4 || Exception_DebuggerAttached
|-
| 5 || Exception_BreakPoint
|-
| 6 || Exception_UserBreak
|-
| 7 || Exception_DebuggerBreak
|-
| 8 || Exception_BadSvcId
|-
| 9 || Exception_SError [not in 1.0.0]
|}

<nowiki>*</nowiki> Undefined instructions, software breakpoints, some other traps.

<nowiki>**</nowiki> Data aborts, FP traps, and everything else that doesn't belong to any of the above.

Trap specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Opcode
|}

BreakPoint specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || IsWatchpoint
|}

UserBreak specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || Info0
|-
| 0x28 || u64 || Info1
|-
| 0x30 || u64 || Info2
|}

BadSvcId specifics:
{| class=wikitable
! Offset || Length || Description
|-
| 0x20 || u32 || SvcId
|}

= Exception handling =
First of all, a function that might be called by synchronous exception handler and that is called by the SError handler fetches the exception info, adjusts PC, panics on exceptions taken from EL1, then dispatches the exception.

The dispatcher has two mutually exclusive exception reporting methods:
* by storing information at the start of the process's TLS memregion (TPIDRRO_EL0) and jumping back to the crt0
* by using KDebug

KDebug dispatching is used when at least one of the following conditions are met:
* SMC ConfigItem KernelMemConfig bit 1 is NOT set (it isn't on retail), unless: this is a software or hardware breakpoint, or a watchpoint, or [4.0.0+?] the process is attached and this is a Google PNaCl trap instruction (see LLVM source)
* FAR doesn't point to a valid address in mapped-readable CodeStatic memory (i.e. this is the case for NRO and JIT memory) or this is one of the following exceptions (it particular, that doesn't include FP exceptions occurring in CodeStatic memory):
** Uncategorized
** IllegalState
** SupervisorCallA32
** SupervisorCallA64
** PCAlignment
** SPAlignment
** SError
** BreakpointLowerEl
** SoftwareStepLowerEl (note: no way set single-step flag; not parsed)
** WatchpointLowerEl
** SoftwareBreakpointA32 (note: not parsed)
** SoftwareBreakpointA64 (note: not parsed)

In all other cases the userland-handled exception path is taken.

KDebug path:

If the process is attached, the exception is reported to the KDebug. If the thread was continued using flag IgnoreExceptions, it returns from the exception as if nothing happened.

If the latter is not the case, or if the process isn't attached, proceed to [2.0.0+] crash reporting (or in [1.0.0] just terminate the process):
if EnableDebug is set, and depending on the process state (more than one crash per process isn't permitted) it may signal itself with ProcessState_Crashed so that PM asks NS to start creport so that creport attaches to it and reports the crashes. Otherwise, just terminate.

Userland reporting path and svcReturnFromException:

TLS region start (A64):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x148 || Exception stack
|-
| 0x148 || 0x78 || ExceptionFrameA64
|}

ExceptionFrameA64:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x48 (8*9) || GPRs 0..8.
|-
| 0x48 || 0x8 || lr
|-
| 0x50 || 0x8 || sp
|-
| 0x58 || 0x8 || pc (elr_el1)
|-
| 0x60 || 0x4 || pstate & 0xFF0FFE20
|-
| 0x64 || 0x4 || afsr0
|-
| 0x68 || 0x4 || afsr1
|-
| 0x6C || 0x4 || esr
|-
| 0x70 || 0x8 || far
|}

TLS region start (A32):

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x178 || Exception stack
|-
| 0x148 || 0x44 || ExceptionFrameA32
|}

ExceptionFrameA32:

{| class=wikitable
! Offset || Length || Description
|-
| 0x0 || 0x20 (8*4) || GPRs 0..7.
|-
| 0x20 || 0x4 || sp
|-
| 0x24 || 0x4 || lr
|-
| 0x28 || 0x4 || pc (elr_el1)
|-
| 0x2C || 0x4 || tpidr_el0 = 1
|-
| 0x30 || 0x4 || cpsr & 0xFF0FFE20
|-
| 0x34 || 0x4 || afsr0
|-
| 0x38 || 0x4 || afsr1
|-
| 0x3C || 0x4 || esr
|-
| 0x40 || 0x4 || far
|}

In that case, after storing the regs in the TLS, the exception handler returns to the application's crt0 (entrypoint), with X0=<error description code> (see below) and X1=SP=frame=<stack top> (see above)

{| class=wikitable
! Desc. code || Meaning
|-
| 0x100 || Instruction abort
|-
| 0x102 || Misaligned PC
|-
| 0x103 || Misaligned SP
|-
| 0x106 || SError [not in 1.0.0?]
|-
| 0x301 || Bad SVC
|-
| 0x104 || Uncategorized, CP15RTTrap, CP15RRTTrap, CP14RTTrap, CP14RRTTrap, IllegalState, SystemRegisterTrap
|-
| 0x101 || None of the above, EC <= 0x34 and not a breakpoint
|-
|}

(During normal app boot the process is invoked with X0=0 and X1=main_thread_handle. The crt0 of retail apps determines whether to boot normally or handle an exception if X0 is set to 0 or not)

The application is supposed to promptly update the contents of elr_el1 to a user handler (and any other regs it sees fit) and call svcReturnFromException (error code) to call that handler. The latter is then expected to promptly abort the program.

svcReturnFromException updates the contents of the kernel stack frame with what the user provided in the TLS structure, sets TPIDR_EL0 to 1, then:
* if the provided error code is 0, gracefully pivots and returns from exception
* if it is not, replays the exception and pass it to the KDebug (see above). One can pass 0x10001 to prevent process termination. If the process is attached, this also prevents crash-collection/termination (different from the exception handler behavior)

If an exception occurs from the above user handler, the entire exception handling process will repeat with the new exception.

Note that if a thread that wasn't faulting calls svcReturnFromException, it signals an "invalid syscall" exception

Note that [[SMC|IsDebugMode]] is not used during exception-handling, except for enabling printing a message to UART-A. This UART code causes a system-hang on retail (likely due to a loop that doesn't exit). This printing doesn't seem to run when the process is attached for debugging?