3dbrew - User contributions [en]

Nintendo OpenGL

2014-12-21T04:11:01Z

Neimod:

This page's goal is to describe parts of Nintendo's OpenGL implementation for the 3DS as we reverse engineer it to better understand how to use the PICA200.
Some of the information on this page is specific to Steeldiver : Sub Wars. The reason for this is that it's a fairly graphics-heavy game that's available on the eShop for '''free''', so it seems like a good target for a community REing effort.

== Rendering pipeline ==


== Description ==

The PICA200 is an opengl ES 1.1 compliant GPU manufactured by DMP. It comes loaded with a number of extensions that make it similar to an openGL ES 2.0 compliant GPU (ability to run programmable vertex/geometry shaders, for instance). Because of this, Nintendo wrapped GPU access into an openGL ES 2.0 implementation with some limitations. As the fragment stage of the pipeline is non-programmable, Nintendo instead gives developers the ability to configure a number of fragment-related values through glGetUniformLocation and glUniformXX. See below for the full list.

== Shader program structure ==

When uniform values are set (in shm_uniformfv/shm_uniformiv), they are attached to the current shader program and stored into the corresponding shader program structure. They are later written to the GPU command buffer in __shv_validateShaderValidator or equivalent.

Shader program struct :
{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x000
| 0x04
| Value 0x0 ?
|-
| 0x004
| 0x04
| Program ID
|-
| 0x008
| 0x04
| Value -1 ?
|-
| 0x01C
| 0x04
| Pointer to program-specific uniform table
|-
| 0x020
| 0x04
| Total number of uniforms for program
|-
| 0x028
| 0x04
| Number of program-specific uniforms
|-
| 0x414
| 0x04
| Pointer to vertex shader struct
|-
| 0x64C
| 0x04
| Value for GPU register 0x0104
|-
| 0x7C0
| 0x04
| Bitfield containing dmp_FragmentLightSource[n].shadowed values
|-
| 0x7D8
| 0x04
| Bitfield containing dmp_FragmentLightSource[n].geomFactor0 / dmp_FragmentLightSource[n].geomFactor1 / dmp_FragmentLightSource[n].twoSideDiffuse values
|-
| 0xA20
| 0x70*8
| Table of structs for 8 dmp_FragmentLightSource
|}

dmp_FragmentLightSource struct:
{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x00
| 0x01
| dmp_FragmentLightSource[k].enabled
|-
| 0x04
| 0x10
| dmp_FragmentLightSource[k].ambient (float[4])
|-
| 0x14
| 0x10
| dmp_FragmentLightSource[k].diffuse (float[4])
|-
| 0x24
| 0x10
| dmp_FragmentLightSource[k].specular0 (float[4])
|-
| 0x34
| 0x10
| dmp_FragmentLightSource[k].specular1 (float[4])
|-
| 0x44
| 0x10
| dmp_FragmentLightSource[k].position (float[4])
|-
| 0x54
| 0x10
| dmp_FragmentLightSource[k].spotDirection (float[3])
|-
| 0x60
| 0x04
| dmp_FragmentLightSource[k].samplerSP (u32)
|-
| 0x64
| 0x04
| dmp_FragmentLightSource[k].distanceAttenuationBias (float)
|-
| 0x68
| 0x04
| dmp_FragmentLightSource[k].distanceAttenuationScale (float)
|}

vertex/geometry shader struct:
{| class="wikitable" border="1"
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Pointer to shader code data
|-
| 0x4
| 0x4
| Size of shader code (in words)
|-
| 0x8
| 0x4
| Pointer to shader opdesc data
|-
| 0xC
| 0x4
| Size of shader opdescs (in words)
|}

== Proposed REing methodology ==

1. Choose a "uniform" you want to RE below

2. Take note of its ID and type !

3. Depending on whether its a float or not, go through the gigantic switches in shm_uniformfv or shm_uniformiv (non-float) based on the ID of your uniform (in the case of '''steeldiver: sub wars''' you can now just go directly to the handler as it's listed in the table below)

4. Once you find the piece of code specific to your uniform, take note of how the values passed to shm_uniformfv/shm_uniformiv are written to the shader object

5. Go through __shv_validateShaderValidator looking for where those fields written to in shm_uniformfv/shm_uniformiv are used and written to the GPU command buffer either directly or through __cb_writeRegs, __cb_multiWriteReg or __cb_fillRegs.

6. Document findings on 3Dbrew ! (that's the most important step)

== Fragment "uniform" list ==

{| class="wikitable" border="1"
! Uniform ID
! Type
! Name
! Handler address (Steeldiver : Sub Wars)
! Shader Program struct offset
! GPU Register
|-
| 0x0
| GL_BOOL
| dmp_Texture[0].perspectiveShadow
| 0x0012A504
| ?
| ?
|-
| 0x1
| GL_FLOAT
| dmp_Texture[0].shadowZBias
| 0x00155584
| 0xE44
| ?
|-
| 0x2
| GL_FLOAT
| dmp_Texture[0].shadowZScale
| 0x001556A0
| 0xE48
| ?
|-
| 0x3
| GL_INT
| dmp_Texture[0].samplerType
| 0x0012A5D0
| ?
| ?
|-
| 0x4
| GL_INT
| dmp_Texture[1].samplerType
| 0x0012A6F8
| ?
| ?
|-
| 0x5
| GL_INT
| dmp_Texture[2].samplerType
| 0x0012A774
| ?
| ?
|-
| 0x6
| GL_INT
| dmp_Texture[3].samplerType
| 0x0012A7F0
| ?
| ?
|-
| 0x7
| GL_INT
| dmp_Texture[2].texcoord
| 0x0012A8B4
| ?
| ?
|-
| 0x8
| GL_INT
| dmp_Texture[3].texcoord
| 0x0012A97C
| ?
| ?
|-
| 0x9
| GL_INT
| dmp_Texture[3].ptRgbMap
| 0x0012AA54
| ?
| ?
|-
| 0xA
| GL_INT
| dmp_Texture[3].ptAlphaMap
| 0x0012AB94
| ?
| ?
|-
| 0xB
| GL_BOOL
| dmp_Texture[3].ptAlphaSeparate
| 0x0012ACD4
| ?
| ?
|-
| 0xC
| GL_INT
| dmp_Texture[3].ptClampU
| 0x0012ADB8
| ?
| ?
|-
| 0xD
| GL_INT
| dmp_Texture[3].ptClampV
| 0x0012AEC0
| ?
| ?
|-
| 0xE
| GL_INT
| dmp_Texture[3].ptShiftU
| 0x0012AFD0
| ?
| ?
|-
| 0xF
| GL_INT
| dmp_Texture[3].ptShiftV
| 0x0012B0A0
| ?
| ?
|-
| 0x10
| GL_INT
| dmp_Texture[3].ptMinFilter
| 0x0012B168
| ?
| ?
|-
| 0x11
| GL_INT
| dmp_Texture[3].ptTexWidth
| 0x0012B270
| ?
| ?
|-
| 0x12
| GL_INT
| dmp_Texture[3].ptTexOffset
| 0x0012B334
| ?
| ?
|-
| 0x13
| GL_FLOAT
| dmp_Texture[3].ptTexBias
| 0x001556B4
| 0xE10
| ?
|-
| 0x14
| GL_BOOL
| dmp_Texture[3].ptNoiseEnable
| 0x0012B3E0
| ?
| ?
|-
| 0x15
| GL_FLOAT_VEC3
| dmp_Texture[3].ptNoiseU
| 0x00155878
| 0xE14
| ?
|-
| 0x16
| GL_FLOAT_VEC3
| dmp_Texture[3].ptNoiseV
| 0x00155A7C
| 0xE20
| ?
|-
| 0x17
| GL_SAMPLER_1D
| dmp_Texture[3].ptSamplerRgbMap
| 0x0012B4B0
| 0xDF0
| ?
|-
| 0x18
| GL_SAMPLER_1D
| dmp_Texture[3].ptSamplerAlphaMap
| 0x0012B4F4
| 0xDF4
| ?
|-
| 0x19
| GL_SAMPLER_1D
| dmp_Texture[3].ptSamplerNoiseMap
| 0x0012B540
| 0xDF8
| ?
|-
| 0x1A
| GL_SAMPLER_1D
| dmp_Texture[3].ptSamplerR
| 0x0012B58C
| 0xDFC
| ?
|-
| 0x1B
| GL_SAMPLER_1D
| dmp_Texture[3].ptSamplerG
| 0x0012B5D8
| 0xE00
| ?
|-
| 0x1C
| GL_SAMPLER_1D
| dmp_Texture[3].ptSamplerB
| 0x0012B624
| 0xE04
| ?
|-
| 0x1D
| GL_SAMPLER_1D
| dmp_Texture[3].ptSamplerA
| 0x0012B670
| 0xE08
| ?
|-
| 0x1E
| GL_INT
| dmp_FragOperation.mode
| 0x0012B6BC
| 0xE38
| ?
|-
| 0x1F
| GL_FLOAT
| dmp_FragOperation.penumbraScale
| 0x00155C98
| 0xE40
| ?
|-
| 0x20
| GL_FLOAT
| dmp_FragOperation.penumbraBias
| 0x00155D8C
| 0xE3C
| ?
|-
| 0x21
| GL_FLOAT
| dmp_FragOperation.wScale
| 0x00155E9C
| 0xE4C
| ?
|-
| 0x22
| GL_BOOL
| dmp_FragOperation.enableClippingPlane
| 0x0012EAEC
| 0x568
| ?
|-
| 0x23
| GL_FLOAT_VEC4
| dmp_FragOperation.clippingPlane
| 0x00159474
| 0xE50
| ?
|-
| 0x24
| GL_BOOL
| dmp_FragOperation.enableAlphaTest
| 0x0012EBAC
| 0x64C
| ?
|-
| 0x25
| GL_INT
| dmp_FragOperation.alphaTestFunc
| 0x0012EC64
| 0x64C
| ?
|-
| 0x26
| GL_FLOAT
| dmp_FragOperation.alphaRefValue
| 0x0015971C
| 0x64C ?
| ?
|-
| 0x27
| GL_FLOAT_VEC3
| dmp_Gas.lightXY
| 0x001560EC
| 0xE84
| ?
|-
| 0x28
| GL_FLOAT_VEC4
| dmp_Gas.lightZ
| 0x00156268
| 0xE90
| ?
|-
| 0x29
| GL_FLOAT
| dmp_Gas.deltaZ
| 0x001564D4
| 0xEA0
| ?
|-
| 0x2A
| GL_FLOAT
| dmp_Gas.accMax
| 0x001565C0
| 0xEA4
| ?
|-
| 0x2B
| GL_BOOL
| dmp_Gas.autoAcc
| 0x0012B790
| 0xE74
| ?
|-
| 0x2C
| GL_FLOAT
| dmp_Gas.attenuation
| 0x00156684
| 0xEA8
| ?
|-
| 0x2D
| GL_INT
| dmp_Gas.colorLutInput
| 0x0012B7A4
| 0x640
| ?
|-
| 0x2E
| GL_INT
| dmp_Gas.shadingDensitySrc
| 0x0012B854
| 0x624
| ?
|-
| 0x2F
| GL_SAMPLER_1D
| dmp_Gas.samplerTR
| 0x0012B910
| 0xE78
| ?
|-
| 0x30
| GL_SAMPLER_1D
| dmp_Gas.samplerTG
| 0x0012B95C
| 0xE7C
| ?
|-
| 0x31
| GL_SAMPLER_1D
| dmp_Gas.samplerTB
| 0x0012B9A8
| 0xE80
| ?
|-
| 0x32
| GL_BOOL
| dmp_FragmentLighting.enabled
| 0x0012B9F4
| 0x590
| 0x00A8 ?
|-
| 0x33
| GL_FLOAT_VEC4
| dmp_FragmentLighting.ambient
| 0x00156744
| 0xA10
| ?
|-
| 0x34
| GL_FLOAT_VEC4
| dmp_FragmentMaterial.emission
| 0x00156E1C
| 0xDE0
| ?
|-
| 0x35
| GL_FLOAT_VEC4
| dmp_FragmentMaterial.ambient
| 0x0015696C
| 0xDA0
| ?
|-
| 0x36
| GL_FLOAT_VEC4
| dmp_FragmentMaterial.diffuse
| 0x00157048
| 0xDB0
| ?
|-
| 0x37
| GL_FLOAT_VEC4
| dmp_FragmentMaterial.specular0
| 0x001572E0
| 0xDC0
| ?
|-
| 0x38
| GL_FLOAT_VEC4
| dmp_FragmentMaterial.specular1
| 0x0015756C
| 0xDD0
| ?
|-
| 0x39
| GL_BOOL
| dmp_FragmentLightSource[0].enabled
| 0x0012BD24
| 0xA20+0*0x70+0x00
| 0x01C5
|-
| 0x3A
| GL_BOOL
| dmp_FragmentLightSource[1].enabled
| 0x0012BD24
| 0xA20+1*0x70+0x00
| 0x01C5
|-
| 0x3B
| GL_BOOL
| dmp_FragmentLightSource[2].enabled
| 0x0012BD24
| 0xA20+2*0x70+0x00
| 0x01C5
|-
| 0x3C
| GL_BOOL
| dmp_FragmentLightSource[3].enabled
| 0x0012BD24
| 0xA20+3*0x70+0x00
| 0x01C5
|-
| 0x3D
| GL_BOOL
| dmp_FragmentLightSource[4].enabled
| 0x0012BD24
| 0xA20+4*0x70+0x00
| 0x01C5
|-
| 0x3E
| GL_BOOL
| dmp_FragmentLightSource[5].enabled
| 0x0012BD24
| 0xA20+5*0x70+0x00
| 0x01C5
|-
| 0x3F
| GL_BOOL
| dmp_FragmentLightSource[6].enabled
| 0x0012BD24
| 0xA20+6*0x70+0x00
| 0x01C5
|-
| 0x40
| GL_BOOL
| dmp_FragmentLightSource[7].enabled
| 0x0012BD24
| 0xA20+7*0x70+0x00
| 0x01C5
|-
| 0x41
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[0].ambient
| 0x001579CC
| 0xA20+0*0x70+0x04
| 0x01C8 ?
|-
| 0x42
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[1].ambient
| 0x001579CC
| 0xA20+1*0x70+0x04
| 0x01C8 ?
|-
| 0x43
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[2].ambient
| 0x001579CC
| 0xA20+2*0x70+0x04
| 0x01C8 ?
|-
| 0x44
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[3].ambient
| 0x001579CC
| 0xA20+3*0x70+0x04
| 0x01C8 ?
|-
| 0x45
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[4].ambient
| 0x001579CC
| 0xA20+4*0x70+0x04
| 0x01C8 ?
|-
| 0x46
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[5].ambient
| 0x001579CC
| 0xA20+5*0x70+0x04
| 0x01C8 ?
|-
| 0x47
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[6].ambient
| 0x001579CC
| 0xA20+6*0x70+0x04
| 0x01C8 ?
|-
| 0x48
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[7].ambient
| 0x001579CC
| 0xA20+7*0x70+0x04
| 0x01C8 ?
|-
| 0x49
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[0].diffuse
| 0x00157C10
| 0xA20+0*0x70+0x14
| 0x01C8 ?
|-
| 0x4A
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[1].diffuse
| 0x00157C10
| 0xA20+1*0x70+0x14
| 0x01C8 ?
|-
| 0x4B
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[2].diffuse
| 0x00157C10
| 0xA20+2*0x70+0x14
| 0x01C8 ?
|-
| 0x4C
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[3].diffuse
| 0x00157C10
| 0xA20+3*0x70+0x14
| 0x01C8 ?
|-
| 0x4D
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[4].diffuse
| 0x00157C10
| 0xA20+4*0x70+0x14
| 0x01C8 ?
|-
| 0x4E
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[5].diffuse
| 0x00157C10
| 0xA20+5*0x70+0x14
| 0x01C8 ?
|-
| 0x4F
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[6].diffuse
| 0x00157C10
| 0xA20+6*0x70+0x14
| 0x01C8 ?
|-
| 0x50
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[7].diffuse
| 0x00157C10
| 0xA20+7*0x70+0x14
| 0x01C8 ?
|-
| 0x51
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[0].specular0
| 0x00157E5C
| 0xA20+0*0x70+0x24
| 0x01C8 ?
|-
| 0x52
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[1].specular0
| 0x00157E5C
| 0xA20+1*0x70+0x24
| 0x01C8 ?
|-
| 0x53
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[2].specular0
| 0x00157E5C
| 0xA20+2*0x70+0x24
| 0x01C8 ?
|-
| 0x54
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[3].specular0
| 0x00157E5C
| 0xA20+3*0x70+0x24
| 0x01C8 ?
|-
| 0x55
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[4].specular0
| 0x00157E5C
| 0xA20+4*0x70+0x24
| 0x01C8 ?
|-
| 0x56
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[5].specular0
| 0x00157E5C
| 0xA20+5*0x70+0x24
| 0x01C8 ?
|-
| 0x57
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[6].specular0
| 0x00157E5C
| 0xA20+6*0x70+0x24
| 0x01C8 ?
|-
| 0x58
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[7].specular0
| 0x00157E5C
| 0xA20+7*0x70+0x24
| 0x01C8 ?
|-
| 0x59
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[0].specular1
| 0x001580B4
| 0xA20+0*0x70+0x34
| 0x01C8 ?
|-
| 0x5A
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[1].specular1
| 0x001580B4
| 0xA20+1*0x70+0x34
| 0x01C8 ?
|-
| 0x5B
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[2].specular1
| 0x001580B4
| 0xA20+2*0x70+0x34
| 0x01C8 ?
|-
| 0x5C
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[3].specular1
| 0x001580B4
| 0xA20+3*0x70+0x34
| 0x01C8 ?
|-
| 0x5D
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[4].specular1
| 0x001580B4
| 0xA20+4*0x70+0x34
| 0x01C8 ?
|-
| 0x5E
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[5].specular1
| 0x001580B4
| 0xA20+5*0x70+0x34
| 0x01C8 ?
|-
| 0x5F
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[6].specular1
| 0x001580B4
| 0xA20+6*0x70+0x34
| 0x01C8 ?
|-
| 0x60
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[7].specular1
| 0x001580B4
| 0xA20+7*0x70+0x34
| 0x01C8 ?
|-
| 0x61
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[0].position
| 0x001584B0
| 0xA20+0*0x70+0x44
| 0x01C8 ?
|-
| 0x62
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[1].position
| 0x001584B0
| 0xA20+1*0x70+0x44
| 0x01C8 ?
|-
| 0x63
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[2].position
| 0x001584B0
| 0xA20+2*0x70+0x44
| 0x01C8 ?
|-
| 0x64
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[3].position
| 0x001584B0
| 0xA20+3*0x70+0x44
| 0x01C8 ?
|-
| 0x65
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[4].position
| 0x001584B0
| 0xA20+4*0x70+0x44
| 0x01C8 ?
|-
| 0x66
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[5].position
| 0x001584B0
| 0xA20+5*0x70+0x44
| 0x01C8 ?
|-
| 0x67
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[6].position
| 0x001584B0
| 0xA20+6*0x70+0x44
| 0x01C8 ?
|-
| 0x68
| GL_FLOAT_VEC4
| dmp_FragmentLightSource[7].position
| 0x001584B0
| 0xA20+7*0x70+0x44
| 0x01C8 ?
|-
| 0x69
| GL_FLOAT_VEC3
| dmp_FragmentLightSource[0].spotDirection
| 0x001587E4
| 0xA20+0*0x70+0x54
| 0x01C8 ?
|-
| 0x6A
| GL_FLOAT_VEC3
| dmp_FragmentLightSource[1].spotDirection
| 0x001587E4
| 0xA20+1*0x70+0x54
| 0x01C8 ?
|-
| 0x6B
| GL_FLOAT_VEC3
| dmp_FragmentLightSource[2].spotDirection
| 0x001587E4
| 0xA20+2*0x70+0x54
| 0x01C8 ?
|-
| 0x6C
| GL_FLOAT_VEC3
| dmp_FragmentLightSource[3].spotDirection
| 0x001587E4
| 0xA20+3*0x70+0x54
| 0x01C8 ?
|-
| 0x6D
| GL_FLOAT_VEC3
| dmp_FragmentLightSource[4].spotDirection
| 0x001587E4
| 0xA20+4*0x70+0x54
| 0x01C8 ?
|-
| 0x6E
| GL_FLOAT_VEC3
| dmp_FragmentLightSource[5].spotDirection
| 0x001587E4
| 0xA20+5*0x70+0x54
| 0x01C8 ?
|-
| 0x6F
| GL_FLOAT_VEC3
| dmp_FragmentLightSource[6].spotDirection
| 0x001587E4
| 0xA20+6*0x70+0x54
| 0x01C8 ?
|-
| 0x70
| GL_FLOAT_VEC3
| dmp_FragmentLightSource[7].spotDirection
| 0x001587E4
| 0xA20+7*0x70+0x54
| 0x01C8 ?
|-
| 0x71
| GL_BOOL
| dmp_FragmentLightSource[0].shadowed
| 0x0012C20C
| 0x7C0
| 0x01C8 ?
|-
| 0x72
| GL_BOOL
| dmp_FragmentLightSource[1].shadowed
| 0x0012C20C
| 0x7C0
| 0x01C8 ?
|-
| 0x73
| GL_BOOL
| dmp_FragmentLightSource[2].shadowed
| 0x0012C20C
| 0x7C0
| 0x01C8 ?
|-
| 0x74
| GL_BOOL
| dmp_FragmentLightSource[3].shadowed
| 0x0012C20C
| 0x7C0
| 0x01C8 ?
|-
| 0x75
| GL_BOOL
| dmp_FragmentLightSource[4].shadowed
| 0x0012C20C
| 0x7C0
| 0x01C8 ?
|-
| 0x76
| GL_BOOL
| dmp_FragmentLightSource[5].shadowed
| 0x0012C20C
| 0x7C0
| 0x01C8 ?
|-
| 0x77
| GL_BOOL
| dmp_FragmentLightSource[6].shadowed
| 0x0012C20C
| 0x7C0
| 0x01C8 ?
|-
| 0x78
| GL_BOOL
| dmp_FragmentLightSource[7].shadowed
| 0x0012C20C
| 0x7C0
| 0x01C8 ?
|-
| 0x79
| GL_BOOL
| dmp_FragmentLightSource[0].geomFactor0
| 0x0012C018
| 0x7D8
| 0x01C8 ?
|-
| 0x7A
| GL_BOOL
| dmp_FragmentLightSource[1].geomFactor0
| 0x0012C018
| 0x7D8
| 0x01C8 ?
|-
| 0x7B
| GL_BOOL
| dmp_FragmentLightSource[2].geomFactor0
| 0x0012C018
| 0x7D8
| 0x01C8 ?
|-
| 0x7C
| GL_BOOL
| dmp_FragmentLightSource[3].geomFactor0
| 0x0012C018
| 0x7D8
| 0x01C8 ?
|-
| 0x7D
| GL_BOOL
| dmp_FragmentLightSource[4].geomFactor0
| 0x0012C018
| 0x7D8
| 0x01C8 ?
|-
| 0x7E
| GL_BOOL
| dmp_FragmentLightSource[5].geomFactor0
| 0x0012C018
| 0x7D8
| 0x01C8 ?
|-
| 0x7F
| GL_BOOL
| dmp_FragmentLightSource[6].geomFactor0
| 0x0012C018
| 0x7D8
| 0x01C8 ?
|-
| 0x80
| GL_BOOL
| dmp_FragmentLightSource[7].geomFactor0
| 0x0012C018
| 0x7D8
| 0x01C8 ?
|-
| 0x81
| GL_BOOL
| dmp_FragmentLightSource[0].geomFactor1
| 0x0012C114
| 0x7D8
| 0x01C8 ?
|-
| 0x82
| GL_BOOL
| dmp_FragmentLightSource[1].geomFactor1
| 0x0012C114
| 0x7D8
| 0x01C8 ?
|-
| 0x83
| GL_BOOL
| dmp_FragmentLightSource[2].geomFactor1
| 0x0012C114
| 0x7D8
| 0x01C8 ?
|-
| 0x84
| GL_BOOL
| dmp_FragmentLightSource[3].geomFactor1
| 0x0012C114
| 0x7D8
| 0x01C8 ?
|-
| 0x85
| GL_BOOL
| dmp_FragmentLightSource[4].geomFactor1
| 0x0012C114
| 0x7D8
| 0x01C8 ?
|-
| 0x86
| GL_BOOL
| dmp_FragmentLightSource[5].geomFactor1
| 0x0012C114
| 0x7D8
| 0x01C8 ?
|-
| 0x87
| GL_BOOL
| dmp_FragmentLightSource[6].geomFactor1
| 0x0012C114
| 0x7D8
| 0x01C8 ?
|-
| 0x88
| GL_BOOL
| dmp_FragmentLightSource[7].geomFactor1
| 0x0012C114
| 0x7D8
| 0x01C8 ?
|-
| 0x89
| GL_BOOL
| dmp_FragmentLightSource[0].twoSideDiffuse
| 0x0012BF10
| 0x7D8
| 0x01C8 ?
|-
| 0x8A
| GL_BOOL
| dmp_FragmentLightSource[1].twoSideDiffuse
| 0x0012BF10
| 0x7D8
| 0x01C8 ?
|-
| 0x8B
| GL_BOOL
| dmp_FragmentLightSource[2].twoSideDiffuse
| 0x0012BF10
| 0x7D8
| 0x01C8 ?
|-
| 0x8C
| GL_BOOL
| dmp_FragmentLightSource[3].twoSideDiffuse
| 0x0012BF10
| 0x7D8
| 0x01C8 ?
|-
| 0x8D
| GL_BOOL
| dmp_FragmentLightSource[4].twoSideDiffuse
| 0x0012BF10
| 0x7D8
| 0x01C8 ?
|-
| 0x8E
| GL_BOOL
| dmp_FragmentLightSource[5].twoSideDiffuse
| 0x0012BF10
| 0x7D8
| 0x01C8 ?
|-
| 0x8F
| GL_BOOL
| dmp_FragmentLightSource[6].twoSideDiffuse
| 0x0012BF10
| 0x7D8
| 0x01C8 ?
|-
| 0x90
| GL_BOOL
| dmp_FragmentLightSource[7].twoSideDiffuse
| 0x0012BF10
| 0x7D8
| 0x01C8 ?
|-
| 0x91
| GL_SAMPLER_1D
| dmp_FragmentLightSource[0].samplerSP
| 0x0012C31C
| 0xA20+0*0x70+0x60
| 0x01C8 ?
|-
| 0x92
| GL_SAMPLER_1D
| dmp_FragmentLightSource[1].samplerSP
| 0x0012C31C
| 0xA20+1*0x70+0x60
| 0x01C8 ?
|-
| 0x93
| GL_SAMPLER_1D
| dmp_FragmentLightSource[2].samplerSP
| 0x0012C31C
| 0xA20+2*0x70+0x60
| 0x01C8 ?
|-
| 0x94
| GL_SAMPLER_1D
| dmp_FragmentLightSource[3].samplerSP
| 0x0012C31C
| 0xA20+3*0x70+0x60
| 0x01C8 ?
|-
| 0x95
| GL_SAMPLER_1D
| dmp_FragmentLightSource[4].samplerSP
| 0x0012C31C
| 0xA20+4*0x70+0x60
| 0x01C8 ?
|-
| 0x96
| GL_SAMPLER_1D
| dmp_FragmentLightSource[5].samplerSP
| 0x0012C31C
| 0xA20+5*0x70+0x60
| 0x01C8 ?
|-
| 0x97
| GL_SAMPLER_1D
| dmp_FragmentLightSource[6].samplerSP
| 0x0012C31C
| 0xA20+6*0x70+0x60
| 0x01C8 ?
|-
| 0x98
| GL_SAMPLER_1D
| dmp_FragmentLightSource[7].samplerSP
| 0x0012C31C
| 0xA20+7*0x70+0x60
| 0x01C8 ?
|-
| 0x99
| GL_BOOL
| dmp_FragmentLightSource[0].spotEnabled
| 0x0012C380
| ?
| 0x01C8 ?
|-
| 0x9A
| GL_BOOL
| dmp_FragmentLightSource[1].spotEnabled
| 0x0012C380
| ?
| 0x01C8 ?
|-
| 0x9B
| GL_BOOL
| dmp_FragmentLightSource[2].spotEnabled
| 0x0012C380
| ?
| 0x01C8 ?
|-
| 0x9C
| GL_BOOL
| dmp_FragmentLightSource[3].spotEnabled
| 0x0012C380
| ?
| 0x01C8 ?
|-
| 0x9D
| GL_BOOL
| dmp_FragmentLightSource[4].spotEnabled
| 0x0012C380
| ?
| 0x01C8 ?
|-
| 0x9E
| GL_BOOL
| dmp_FragmentLightSource[5].spotEnabled
| 0x0012C380
| ?
| 0x01C8 ?
|-
| 0x9F
| GL_BOOL
| dmp_FragmentLightSource[6].spotEnabled
| 0x0012C380
| ?
| 0x01C8 ?
|-
| 0xA0
| GL_BOOL
| dmp_FragmentLightSource[7].spotEnabled
| 0x0012C380
| ?
| 0x01C8 ?
|-
| 0xA1
| GL_FLOAT
| dmp_FragmentLightSource[0].distanceAttenuationBias
| 0x00158AE8
| 0xA20+0*0x70+0x64
| 0x01C8 ?
|-
| 0xA2
| GL_FLOAT
| dmp_FragmentLightSource[1].distanceAttenuationBias
| 0x00158AE8
| 0xA20+1*0x70+0x64
| 0x01C8 ?
|-
| 0xA3
| GL_FLOAT
| dmp_FragmentLightSource[2].distanceAttenuationBias
| 0x00158AE8
| 0xA20+2*0x70+0x64
| 0x01C8 ?
|-
| 0xA4
| GL_FLOAT
| dmp_FragmentLightSource[3].distanceAttenuationBias
| 0x00158AE8
| 0xA20+3*0x70+0x64
| 0x01C8 ?
|-
| 0xA5
| GL_FLOAT
| dmp_FragmentLightSource[4].distanceAttenuationBias
| 0x00158AE8
| 0xA20+4*0x70+0x64
| 0x01C8 ?
|-
| 0xA6
| GL_FLOAT
| dmp_FragmentLightSource[5].distanceAttenuationBias
| 0x00158AE8
| 0xA20+5*0x70+0x64
| 0x01C8 ?
|-
| 0xA7
| GL_FLOAT
| dmp_FragmentLightSource[6].distanceAttenuationBias
| 0x00158AE8
| 0xA20+6*0x70+0x64
| 0x01C8 ?
|-
| 0xA8
| GL_FLOAT
| dmp_FragmentLightSource[7].distanceAttenuationBias
| 0x00158AE8
| 0xA20+7*0x70+0x64
| 0x01C8 ?
|-
| 0xA9
| GL_FLOAT
| dmp_FragmentLightSource[0].distanceAttenuationScale
| 0x00158C44
| 0xA20+0*0x70+0x68
| 0x01C8 ?
|-
| 0xAA
| GL_FLOAT
| dmp_FragmentLightSource[1].distanceAttenuationScale
| 0x00158C44
| 0xA20+1*0x70+0x68
| 0x01C8 ?
|-
| 0xAB
| GL_FLOAT
| dmp_FragmentLightSource[2].distanceAttenuationScale
| 0x00158C44
| 0xA20+2*0x70+0x68
| 0x01C8 ?
|-
| 0xAC
| GL_FLOAT
| dmp_FragmentLightSource[3].distanceAttenuationScale
| 0x00158C44
| 0xA20+3*0x70+0x68
| 0x01C8 ?
|-
| 0xAD
| GL_FLOAT
| dmp_FragmentLightSource[4].distanceAttenuationScale
| 0x00158C44
| 0xA20+4*0x70+0x68
| 0x01C8 ?
|-
| 0xAE
| GL_FLOAT
| dmp_FragmentLightSource[5].distanceAttenuationScale
| 0x00158C44
| 0xA20+5*0x70+0x68
| 0x01C8 ?
|-
| 0xAF
| GL_FLOAT
| dmp_FragmentLightSource[6].distanceAttenuationScale
| 0x00158C44
| 0xA20+6*0x70+0x68
| 0x01C8 ?
|-
| 0xB0
| GL_FLOAT
| dmp_FragmentLightSource[7].distanceAttenuationScale
| 0x00158C44
| 0xA20+7*0x70+0x68
| 0x01C8 ?
|-
| 0xB1
| GL_BOOL
| dmp_FragmentLightSource[0].distanceAttenuationEnabled
| 0x0012C4A0
| ?
| 0x01C8 ?
|-
| 0xB2
| GL_BOOL
| dmp_FragmentLightSource[1].distanceAttenuationEnabled
| 0x0012C4A0
| ?
| 0x01C8 ?
|-
| 0xB3
| GL_BOOL
| dmp_FragmentLightSource[2].distanceAttenuationEnabled
| 0x0012C4A0
| ?
| 0x01C8 ?
|-
| 0xB4
| GL_BOOL
| dmp_FragmentLightSource[3].distanceAttenuationEnabled
| 0x0012C4A0
| ?
| 0x01C8 ?
|-
| 0xB5
| GL_BOOL
| dmp_FragmentLightSource[4].distanceAttenuationEnabled
| 0x0012C4A0
| ?
| 0x01C8 ?
|-
| 0xB6
| GL_BOOL
| dmp_FragmentLightSource[5].distanceAttenuationEnabled
| 0x0012C4A0
| ?
| 0x01C8 ?
|-
| 0xB7
| GL_BOOL
| dmp_FragmentLightSource[6].distanceAttenuationEnabled
| 0x0012C4A0
| ?
| 0x01C8 ?
|-
| 0xB8
| GL_BOOL
| dmp_FragmentLightSource[7].distanceAttenuationEnabled
| 0x0012C4A0
| ?
| 0x01C8 ?
|-
| 0xB9
| GL_SAMPLER_1D
| dmp_FragmentLightSource[0].samplerDA
| 0x0012C578
| 0xA20+0*0x70+0x6C
| 0x01C8 ?
|-
| 0xBA
| GL_SAMPLER_1D
| dmp_FragmentLightSource[1].samplerDA
| 0x0012C578
| 0xA20+1*0x70+0x6C
| 0x01C8 ?
|-
| 0xBB
| GL_SAMPLER_1D
| dmp_FragmentLightSource[2].samplerDA
| 0x0012C578
| 0xA20+2*0x70+0x6C
| 0x01C8 ?
|-
| 0xBC
| GL_SAMPLER_1D
| dmp_FragmentLightSource[3].samplerDA
| 0x0012C578
| 0xA20+3*0x70+0x6C
| 0x01C8 ?
|-
| 0xBD
| GL_SAMPLER_1D
| dmp_FragmentLightSource[4].samplerDA
| 0x0012C578
| 0xA20+4*0x70+0x6C
| 0x01C8 ?
|-
| 0xBE
| GL_SAMPLER_1D
| dmp_FragmentLightSource[5].samplerDA
| 0x0012C578
| 0xA20+5*0x70+0x6C
| 0x01C8 ?
|-
| 0xBF
| GL_SAMPLER_1D
| dmp_FragmentLightSource[6].samplerDA
| 0x0012C578
| 0xA20+6*0x70+0x6C
| 0x01C8 ?
|-
| 0xC0
| GL_SAMPLER_1D
| dmp_FragmentLightSource[7].samplerDA
| 0x0012C578
| 0xA20+7*0x70+0x6C
| 0x01C8 ?
|-
| 0xC1
| GL_BOOL
| dmp_LightEnv.absLutInputD0
| 0x0012C5D8
| ?
| ?
|-
| 0xC2
| GL_BOOL
| dmp_LightEnv.absLutInputD1
| 0x0012C5D8
| ?
| ?
|-
| 0xC3
| GL_BOOL
| dmp_LightEnv.absLutInputSP
| 0x0012C5D8
| ?
| ?
|-
| 0xC4
| GL_BOOL
| dmp_LightEnv.absLutInputFR
| 0x0012C5D8
| ?
| ?
|-
| 0xC5
| GL_BOOL
| dmp_LightEnv.absLutInputRB
| 0x0012C5D8
| ?
| ?
|-
| 0xC6
| GL_BOOL
| dmp_LightEnv.absLutInputRG
| 0x0012C5D8
| ?
| ?
|-
| 0xC7
| GL_BOOL
| dmp_LightEnv.absLutInputRR
| 0x0012C5D8
| ?
| ?
|-
| 0xC8
| GL_INT
| dmp_LightEnv.lutInputD0
| 0x0012C6E8
| ?
| ?
|-
| 0xC9
| GL_INT
| dmp_LightEnv.lutInputD1
| 0x0012C6E8
| ?
| ?
|-
| 0xCA
| GL_INT
| dmp_LightEnv.lutInputSP
| 0x0012C6E8
| ?
| ?
|-
| 0xCB
| GL_INT
| dmp_LightEnv.lutInputFR
| 0x0012C6E8
| ?
| ?
|-
| 0xCC
| GL_INT
| dmp_LightEnv.lutInputRB
| 0x0012C6E8
| ?
| ?
|-
| 0xCD
| GL_INT
| dmp_LightEnv.lutInputRG
| 0x0012C6E8
| ?
| ?
|-
| 0xCE
| GL_INT
| dmp_LightEnv.lutInputRR
| 0x0012C6E8
| ?
| ?
|-
| 0xCF
| GL_FLOAT
| dmp_LightEnv.lutScaleD0
| 0x00155404
| ?
| ?
|-
| 0xD0
| GL_FLOAT
| dmp_LightEnv.lutScaleD1
| 0x00155404
| ?
| ?
|-
| 0xD1
| GL_FLOAT
| dmp_LightEnv.lutScaleSP
| 0x00155404
| ?
| ?
|-
| 0xD2
| GL_FLOAT
| dmp_LightEnv.lutScaleFR
| 0x00155404
| ?
| ?
|-
| 0xD3
| GL_FLOAT
| dmp_LightEnv.lutScaleRB
| 0x00155404
| ?
| ?
|-
| 0xD4
| GL_FLOAT
| dmp_LightEnv.lutScaleRG
| 0x00155404
| ?
| ?
|-
| 0xD5
| GL_FLOAT
| dmp_LightEnv.lutScaleRR
| 0x00155404
| ?
| ?
|-
| 0xD6
| GL_SAMPLER_1D
| dmp_FragmentMaterial.samplerD0
| 0x0012C7D0
| ?
| ?
|-
| 0xD7
| GL_SAMPLER_1D
| dmp_FragmentMaterial.samplerD1
| 0x0012C7D0
| ?
| ?
|-
| 0xD8
| GL_SAMPLER_1D
| dmp_FragmentMaterial.samplerFR
| 0x0012C7D0
| ?
| ?
|-
| 0xD9
| GL_SAMPLER_1D
| dmp_FragmentMaterial.samplerRB
| 0x0012C7D0
| ?
| ?
|-
| 0xDA
| GL_SAMPLER_1D
| dmp_FragmentMaterial.samplerRG
| 0x0012C7D0
| ?
| ?
|-
| 0xDB
| GL_SAMPLER_1D
| dmp_FragmentMaterial.samplerRR
| 0x0012C7D0
| ?
| ?
|-
| 0xDC
| GL_INT
| dmp_LightEnv.shadowSelector
| 0x0012CE44
| ?
| ?
|-
| 0xDD
| GL_INT
| dmp_LightEnv.bumpSelector
| 0x0012CD88
| ?
| ?
|-
| 0xDE
| GL_INT
| dmp_LightEnv.bumpMode
| 0x0012D4B4
| ?
| ?
|-
| 0xDF
| GL_BOOL
| dmp_LightEnv.bumpRenorm
| 0x0012D8A0
| ?
| ?
|-
| 0xE0
| GL_INT
| dmp_LightEnv.config
| 0x0012D5E4
| ?
| ?
|-
| 0xE1
| GL_BOOL
| dmp_LightEnv.invertShadow
| 0x0012CF04
| ?
| ?
|-
| 0xE2
| GL_BOOL
| dmp_LightEnv.shadowPrimary
| 0x0012CFD4
| ?
| ?
|-
| 0xE3
| GL_BOOL
| dmp_LightEnv.shadowSecondary
| 0x0012D1B8
| ?
| ?
|-
| 0xE4
| GL_BOOL
| dmp_LightEnv.shadowAlpha
| 0x0012D350
| ?
| ?
|-
| 0xE5
| GL_INT
| dmp_LightEnv.fresnelSelector
| 0x0012D720
| ?
| ?
|-
| 0xE6
| GL_BOOL
| dmp_LightEnv.clampHighlights
| 0x0012D9B0
| ?
| ?
|-
| 0xE7
| GL_BOOL
| dmp_LightEnv.lutEnabledD0
| 0x0012DA80
| ?
| ?
|-
| 0xE8
| GL_BOOL
| dmp_LightEnv.lutEnabledD1
| 0x0012DB58
| ?
| ?
|-
| 0xE9
| GL_BOOL
| dmp_LightEnv.lutEnabledRefl
| 0x0012C83C
| ?
| ?
|-
| 0xEA
| GL_INT
| dmp_TexEnv[0].combineRgb
| 0x0012DC2C
| ?
| 0xC2
|-
| 0xEB
| GL_INT
| dmp_TexEnv[1].combineRgb
| 0x0012DC2C
| ?
| 0xCA
|-
| 0xEC
| GL_INT
| dmp_TexEnv[2].combineRgb
| 0x0012DC2C
| ?
| 0xD2
|-
| 0xED
| GL_INT
| dmp_TexEnv[3].combineRgb
| 0x0012DC2C
| ?
| 0xDA
|-
| 0xEE
| GL_INT
| dmp_TexEnv[4].combineRgb
| 0x0012DC2C
| ?
| 0xF2
|-
| 0xEF
| GL_INT
| dmp_TexEnv[5].combineRgb
| 0x0012DC2C
| ?
| 0xFA
|-
| 0xF0
| GL_INT
| dmp_TexEnv[0].combineAlpha
| 0x0012DD9C
| ?
| 0xC2
|-
| 0xF1
| GL_INT
| dmp_TexEnv[1].combineAlpha
| 0x0012DD9C
| ?
| 0xCA
|-
| 0xF2
| GL_INT
| dmp_TexEnv[2].combineAlpha
| 0x0012DD9C
| ?
| 0xD2
|-
| 0xF3
| GL_INT
| dmp_TexEnv[3].combineAlpha
| 0x0012DD9C
| ?
| 0xDA
|-
| 0xF4
| GL_INT
| dmp_TexEnv[4].combineAlpha
| 0x0012DD9C
| ?
| 0xF2
|-
| 0xF5
| GL_INT
| dmp_TexEnv[5].combineAlpha
| 0x0012DD9C
| ?
| 0xFA
|-
| 0xF6
| GL_INT_VEC3
| dmp_TexEnv[0].srcRgb
| 0x0012DF08
| ?
| 0xC0
|-
| 0xF7
| GL_INT_VEC3
| dmp_TexEnv[1].srcRgb
| 0x0012DF08
| ?
| 0xC8
|-
| 0xF8
| GL_INT_VEC3
| dmp_TexEnv[2].srcRgb
| 0x0012DF08
| ?
| 0xD0
|-
| 0xF9
| GL_INT_VEC3
| dmp_TexEnv[3].srcRgb
| 0x0012DF08
| ?
| 0xD8
|-
| 0xFA
| GL_INT_VEC3
| dmp_TexEnv[4].srcRgb
| 0x0012DF08
| ?
| 0xF0
|-
| 0xFB
| GL_INT_VEC3
| dmp_TexEnv[5].srcRgb
| 0x0012DF08
| ?
| 0xF8
|-
| 0xFC
| GL_INT_VEC3
| dmp_TexEnv[0].srcAlpha
| 0x0012E0FC
| ?
| 0xC0
|-
| 0xFD
| GL_INT_VEC3
| dmp_TexEnv[1].srcAlpha
| 0x0012E0FC
| ?
| 0xC8
|-
| 0xFE
| GL_INT_VEC3
| dmp_TexEnv[2].srcAlpha
| 0x0012E0FC
| ?
| 0xD0
|-
| 0xFF
| GL_INT_VEC3
| dmp_TexEnv[3].srcAlpha
| 0x0012E0FC
| ?
| 0xD8
|-
| 0x100
| GL_INT_VEC3
| dmp_TexEnv[4].srcAlpha
| 0x0012E0FC
| ?
| 0xF0
|-
| 0x101
| GL_INT_VEC3
| dmp_TexEnv[5].srcAlpha
| 0x0012E0FC
| ?
| 0xF8
|-
| 0x102
| GL_INT_VEC3
| dmp_TexEnv[0].operandRgb
| 0x0012E2F0
| ?
| 0xC1
|-
| 0x103
| GL_INT_VEC3
| dmp_TexEnv[1].operandRgb
| 0x0012E2F0
| ?
| 0xC9
|-
| 0x104
| GL_INT_VEC3
| dmp_TexEnv[2].operandRgb
| 0x0012E2F0
| ?
| 0xD1
|-
| 0x105
| GL_INT_VEC3
| dmp_TexEnv[3].operandRgb
| 0x0012E2F0
| ?
| 0xD9
|-
| 0x106
| GL_INT_VEC3
| dmp_TexEnv[4].operandRgb
| 0x0012E2F0
| ?
| 0xF1
|-
| 0x107
| GL_INT_VEC3
| dmp_TexEnv[5].operandRgb
| 0x0012E2F0
| ?
| 0xF9
|-
| 0x108
| GL_INT_VEC3
| dmp_TexEnv[0].operandAlpha
| 0x0012E51C
| ?
| 0xC1
|-
| 0x109
| GL_INT_VEC3
| dmp_TexEnv[1].operandAlpha
| 0x0012E51C
| ?
| 0xC9
|-
| 0x10A
| GL_INT_VEC3
| dmp_TexEnv[2].operandAlpha
| 0x0012E51C
| ?
| 0xD1
|-
| 0x10B
| GL_INT_VEC3
| dmp_TexEnv[3].operandAlpha
| 0x0012E51C
| ?
| 0xD9
|-
| 0x10C
| GL_INT_VEC3
| dmp_TexEnv[4].operandAlpha
| 0x0012E51C
| ?
| 0xF1
|-
| 0x10D
| GL_INT_VEC3
| dmp_TexEnv[5].operandAlpha
| 0x0012E51C
| ?
| 0xF9
|-
| 0x10E
| GL_FLOAT
| dmp_TexEnv[0].scaleRgb
| 0x00155464
| ?
| ?
|-
| 0x10F
| GL_FLOAT
| dmp_TexEnv[1].scaleRgb
| 0x00155464
| ?
| ?
|-
| 0x110
| GL_FLOAT
| dmp_TexEnv[2].scaleRgb
| 0x00155464
| ?
| ?
|-
| 0x111
| GL_FLOAT
| dmp_TexEnv[3].scaleRgb
| 0x00155464
| ?
| ?
|-
| 0x112
| GL_FLOAT
| dmp_TexEnv[4].scaleRgb
| 0x00155464
| ?
| ?
|-
| 0x113
| GL_FLOAT
| dmp_TexEnv[5].scaleRgb
| 0x00155464
| ?
| ?
|-
| 0x114
| GL_FLOAT
| dmp_TexEnv[0].scaleAlpha
| 0x00158EDC
| ?
| ?
|-
| 0x115
| GL_FLOAT
| dmp_TexEnv[1].scaleAlpha
| 0x00158EDC
| ?
| ?
|-
| 0x116
| GL_FLOAT
| dmp_TexEnv[2].scaleAlpha
| 0x00158EDC
| ?
| ?
|-
| 0x117
| GL_FLOAT
| dmp_TexEnv[3].scaleAlpha
| 0x00158EDC
| ?
| ?
|-
| 0x118
| GL_FLOAT
| dmp_TexEnv[4].scaleAlpha
| 0x00158EDC
| ?
| ?
|-
| 0x119
| GL_FLOAT
| dmp_TexEnv[5].scaleAlpha
| 0x00158EDC
| ?
| ?
|-
| 0x11A
| GL_FLOAT_VEC4
| dmp_TexEnv[0].constRgba
| 0x00158FF4
| ?
| 0xC3
|-
| 0x11B
| GL_FLOAT_VEC4
| dmp_TexEnv[1].constRgba
| 0x00158FF4
| ?
| 0xCB
|-
| 0x11C
| GL_FLOAT_VEC4
| dmp_TexEnv[2].constRgba
| 0x00158FF4
| ?
| 0xD3
|-
| 0x11D
| GL_FLOAT_VEC4
| dmp_TexEnv[3].constRgba
| 0x00158FF4
| ?
| 0xDB
|-
| 0x11E
| GL_FLOAT_VEC4
| dmp_TexEnv[4].constRgba
| 0x00158FF4
| ?
| 0xF3
|-
| 0x11F
| GL_FLOAT_VEC4
| dmp_TexEnv[5].constRgba
| 0x00158FF4
| ?
| 0xFB
|-
| 0x120
| GL_FLOAT_VEC4
| dmp_TexEnv[0].bufferColor
| 0x001591C0
| ?
| ?
|-
| 0x121
| GL_INT_VEC2
| dmp_TexEnv[1].bufferInput
| 0x0012E6D0
| ?
| ?
|-
| 0x122
| GL_INT_VEC2
| dmp_TexEnv[2].bufferInput
| 0x0012E6D0
| ?
| ?
|-
| 0x123
| GL_INT_VEC2
| dmp_TexEnv[3].bufferInput
| 0x0012E6D0
| ?
| ?
|-
| 0x124
| GL_INT_VEC2
| dmp_TexEnv[4].bufferInput
| 0x0012E6D0
| ?
| ?
|-
| 0x125
| GL_INT
| dmp_Fog.mode
| 0x0012E7F8
| ?
| ?
|-
| 0x126
| GL_FLOAT_VEC3
| dmp_Fog.color
| 0x00159338
| ?
| ?
|-
| 0x127
| GL_BOOL
| dmp_Fog.zFlip
| 0x0012E9DC
| ?
| ?
|-
| 0x128
| GL_SAMPLER_1D
| dmp_Fog.sampler
| 0x0012EAA4
| ?
| ?
|}

On steeldiver's uniform handlers : R1 is a pointer to the current shader program object, R12 is a pointer to the data the uniform is being set to.

3DS System Flaws

2014-11-03T14:11:53Z

Neimod:

Exploits are used to execute unofficial code (homebrew) on the Nintendo 3DS. This page is a list of known 3DS-mode exploits.

==List of 3DS exploits==

==Current Efforts==
There are people working on finding exploits and documenting the 3DS. Here's a list of some current efforts being made to make homebrew on the 3DS possible:

* Smealum has a working exploit up to newest system version and has shown what seems to be viable proof that this is real. He says that he will be releasing the exploit when he believes all of the bundled software (HBC and others) are relatively bug free. In other words NO ETA.

==Stale / Rejected Efforts==
* Neimod has been working on a RAM dumping setup for a little while now. He's desoldered the 3DS's RAM chip and hooked it and the RAM pinouts on the 3DS's PCB up to a custom RAM dumping setup. Recent photos show that the setup is working quite well, with the 3DS successfully booting up. Pictures of neimod's work can be found on [http://www.flickr.com/photos/neimod/ his Flickr stream].

Neimod's flickr stream is now private and his work is considered awesome

* A loser has released CFW and CIA installers along with some other interesting stuff (and illegal stuff) most of which were created by others and stolen

== Fixed vulnerabilities ==
* The following was fixed with [[7.0.0-13]], see here for [[7.0.0-13|details]]. Too long or corrupted strings (01Ah 2 Nickname length in characters 050h 2 Message length in characters) in the NVRAM DS user settings cause (System Settings->Other Settings->Profile->Nintendo DS Profile) to crash in 3DS-mode due to a stack-smash. The DSi is not vulnerable to this, DSi launcher(menu) and DSi System Settings will reset the NVRAM user-settings if the length field values are too long(same result as when the CRCs are invalid).

==Failed attempts==
Here are listed all attempts at exploiting 3DS software that have failed so far.

* Pushmo (3DSWare), QR codes: level name is properly limited to 16 characters, game doesn't crash with a longer name. The only possible crashes are triggered by out-of-bounds values, these crashes are caused by the application attempting to load a ptr from a buffer located at NULL.
* Pyramids (3DSWare), QR codes: no strings. Only crashes are from out-of-bounds values (like background ID) and are not exploitable.
* 3DS browser, 2^32 characters long string: this is similar to the vuln fixed [http://git.chromium.org/gitweb/?p=external/Webkit.git;a=commitdiff;h=ec471f16fbd1f879cb631f9b022fd16acd75f4d4 here], concat-large-strings-crash2.html triggers a crash which is about the same as the one triggered by a 2^32 string. Most of the time this vuln will cause a memory page permissions fault, since the webkit code attempts to copy the string text data to the output buffer located in read-only [[CRO0|CRO]] heap memory. The only difference between a crash triggered by a 2^32 string and the concat-large-strings-crash2.html crash is that the former copies the string data using the original string length(like 1 text character for "x", 4 for "xxxx") while the latter attempts to copy >12MB. In some ''very'' rare cases a thread separate from the string data-copy thread will crash, this might be exploitable however this is useless since it rarely crashes this way.

==Tips and info==
The 3DS uses the XN feature of the ARM processor, and only apps that have the necessary permissions in their headers can set memory to be executable. This means that although a usable buffer overflow exploit would still be useful, it would not go the entire way towards allowing code to be run in an easy/practical fashion (ie an actual homebrew launcher) - for that, an exploit in the system is required. A buffer overflow exploit does, however, provide enough wriggle room through the use of return-oriented programming to potentially trigger a system exploit.

SD card [[extdata]] and SD savegames can be attacked, for consoles where the console-unique [[Nand/private/movable.sed|movable.sed]] was dumped.

Note that the publicly-available <v5.0 total-control exploits are [[FIRM|Process9]] exploits, not "kernel exploits".

==System flaws==
=== ARM11 kernel ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in system version
|-
| [[SVC]] table too small
| The table of function pointers for SVC's only contains entries up to 0x7D, but the biggest allowed SVC for the table is 0x7F. Thus, executing svc7E or svc7F would make the SVC-handler read after the buffer, and interpret some ARM instructions as function pointers.

However this would require patching the kernel .text or modifying SVC-access-control. Even if you could get these to execute, they would still jump to memory that isn't mapped as executable.
| None
|-
| [[SVC|svcBackdoor (0x7B)]]
| This backdoor allows executing SVC-mode code at the user-specified code-address. This is used by Process9, using this on the ARM11(with NATIVE_FIRM) requires patching the kernel .text or modifying SVC-access-control.
| None
|-
| [[Memory_layout#ARM11_Detailed_virtual_memory_map|0xEFF00000]] / 0xDFF00000 ARM11 kernel virtual-memory
| The ARM11 kernel-mode 0xEFF00000/0xDFF00000 virtual-memory(size 0x100000) is mapped to phys-mem 0x1FF00000(entire DSP-mem + entire AXIWRAM), with permissions RW-. This is used during ARM11 kernel startup, this never seems to be used after that however.
| None
|-
| [[SVC|svcStartInterProcessDma]]
| For svcStartInterProcessDma, the kernel code had the following flaws:

* Originally the ARM11-kernel read the input DmaConfig structure directly in kernel-mode(ldr(b/h) instructions), without checking whether the DmaConfig address is readable under userland. This was fixed by copying that structure to the SVC-mode stack, using the ldrbt instruction.

* Integer overflows for srcaddr+size and dstaddr+size are now checked(with [[6.0.0-11]]), which were not checked before.

* The kernel now also checks whether the srcaddr/dstaddr(+size) is within userland memory(0x20000000), the kernel now(with [[6.0.0-11]]) returns an error when the address is beyond userland memory. Using an address >=0x20000000 would result in the kernel reading from the process L1 MMU table, beyond the memory allocated for that MMU table(for vaddr->physaddr conversion).
| [[6.0.0-11]]
|-
| [[SVC|svcControlMemory]] Parameter checks
| For svcControlMemory the parameter check had these two flaws:

* The allowed range for addr0, addr1, size parameters depends on which MemoryOperation is being specified. The limitation for GSP heap was only checked if op=(u32)0x10003. By setting a random bit in op that has no meaning (like bit17?), op would instead be (u32)0x30003, and the range-check would be less strict and not accurate. However, the kernel doesn't actually use the input address for LINEAR memory-mapping at all besides the range-checks, so this isn't actually useful. This was fixed in the kernel by just checking for the LINEAR bit, instead of comparing the entire MemoryOperation value with 0x10003.

* Integer overflows on (addr0+size) are now checked that previously weren't(this also applies to most other address checks elsewhere in the kernel).

| [[5.0.0-11]]
|-
| [[RPC_Command_Structure|Command]] request/response buffer overflow
| Originally the kernel did not check the word-values from the command-header. Starting with [[5.0.0-11]], the kernel will trigger a kernelpanic() when the total word-size of the entire command(including the cmd-header) is larger than 0x40-words(0x100-bytes). This allows overwriting threadlocalstorage+0x180 in the destination thread, however since the data written there would be translate parameters(such as header-words + buffer addresses), exploiting this would likely be very difficult if possible at all.

If the two words at threadlocalstorage+0x180 could be overwritten with controlled data this way, one could then use a command with a buffer-header of <nowiki>((size<<14) | 2)</nowiki> to write arbitrary memory to any RW userland memory in the destination process.
| [[5.0.0-11]]
|-
| [[SVC|SVC stack allocation overflows]]
|
* Syscalls that allocate a variable-length array on stack, only checked bit31 before multiplying by 4/16 (when calculating how much memory to allocate). If a large integer was passed as input to one of these syscalls, an integer overflow would occur, and too little memory would have been allocated on stack resulting in a buffer overrun.
* The alignment (size+7)&~7 calucation before allocation was not checked for integer overflow.

This might allow for ARM11 kernel code-execution.

(Applies to svcSetResourceLimitValues, svcGetThreadList, svcGetProcessList, svcReplyAndReceive, svcWaitSynchronizationN.)
| [[5.0.0-11]]
|-
| [[SVC|svcControlMemory]] MemoryOperation MAP memory-permissions
| svcControlMemory with MemoryOperation=MAP allows mapping the already-mapped process virtual-mem at addr1, to addr0. The lowest address permitted for addr1 is 0x00100000. Originally the ARM11 kernel didn't check memory permissions for addr1. Therefore .text as addr1 could be mapped elsewhere as RW- memory, which allowed ARM11 userland code-execution.
| [[4.1.0-8]]
|-
| [[RPC_Command_Structure|Command]] input/output buffer permissions
| Originally the ARM11 kernel didn't check memory permissions for the input/output buffers for commands. Starting with [[4.0.0-7]] the ARM11 kernel will trigger a kernelpanic() if the input/output buffers don't have the required memory permissions. For example, this allowed a FSUSER file-read to .text, which therefore allowed ARM11-userland code execution.
| [[4.0.0-7]]
|-
| [[SVC|svcReadProcessMemory/svcWriteProcessMemory memory]] permissions
| Originally the kernel only checked the first page(0x1000-bytes) of the src/dst buffers, for svcReadProcessMemory and svcWriteProcessMemory. There is no known retail processes which have access to these SVCs.
| [[4.0.0-7]]
|}

=== FIRM ARM11 modules ===
{| class="wikitable" border="1"
|-
! Summary
! Description
! Fixed in system version
|-
| [[Services|"srv:pm"]] process registration
| Originally any process had access to the port "srv:pm". The PID's used for the (un)registration commands are not checked either. This allowed any process to re-register itself with "srv:pm", and therefore allowed the process to give itself access to any service, bypassing the exheader service-access-control list.

This was fixed in [[7.0.0-13]]: starting with [[7.0.0-13]] "srv:pm" is now a service instead of a globally accessible port. Only processes with PID's less than 6 (in other words: fs, ldr, sm, pm, pxi modules) have access to it. With [[7.0.0-13]] there can only be one session for "srv:pm" open at a time(this is used by pm module), svcBreak will be executed if more sessions are opened by the processes which can access this.

This flaw was needed for exploiting the <=v4.x Process9 PXI vulnerabilities from ARM11 userland ROP, since most applications don't have access to those service(s).
| [[7.0.0-13]]
|}

AES Registers

2014-10-28T17:57:12Z

Neimod:

== Registers ==
{| class="wikitable" border="1"
! NAME
! PHYSICAL ADDRESS
! WIDTH
! RW
|-
| REG_AESCNT
| 0x10009000
| 4
| RW
|-
| REG_AESBLKCNT
| 0x10009004
| 4
| W?
|-
| REG_AESWRFIFO
| 0x10009008
| 4
| W
|-
| REG_AESRDFIFO
| 0x1000900C
| 4
| R
|-
| REG_AESKEYSEL
| 0x10009010
| 1
| RW
|-
| REG_AESKEYCNT
| 0x10009011
| 1
| RW
|-
| REG_AESCTR
| 0x10009020
| 16
| W
|-
| REG_AESMAC
| 0x10009030
| 16
| W
|-
| REG_AESKEY0
| 0x10009040
| 48
| W
|-
| REG_AESKEY1
| 0x10009070
| 48
| W
|-
| REG_AESKEY2
| 0x100090A0
| 48
| W
|-
| REG_AESKEY3
| 0x100090D0
| 48
| W
|-
| REG_AESKEYFIFO
| 0x10009100
| 4
| W
|-
| REG_AESKEYXFIFO
| 0x10009104
| 4
| W
|-
| REG_AESKEYYFIFO
| 0x10009108
| 4
| W
|}

== REG_AESCNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 4-0
| Write fifo count (0..16)
|-
| 9-5
| Read fifo count (0..16)
|-
| 10
| Flush write fifo (1=Clear write fifo)
|-
| 11
| Flush read fifo (1=Clear read fifo)
|-
| 18-16
| MAC size (encoding = (maclen-2)/2)
|-
| 19
| ? (something MAC related)
|-
| 20
| MAC input control (0 = read MAC from FIFO, 1 = read from MAC register)
|-
| 21
| MAC status (0 = invalid, 1 = verified)
|-
| 22
| Output endianness (1=Big endian, 0=Little endian)
|-
| 23
| Input endianness (1=Big endian, 0=Little endian)
|-
| 24
| Output word order (1=Normal order, 0=Reversed order)
|-
| 25
| Input word order (1=Normal order, 0=Reversed order)
|-
|-
| 26
| Update keyslot (set to 1 when the keyslot is changed)
|-
| 29-27
| Mode (0=CCM decrypt, 1=CCM encrypt, 2=CTR, 3=CTR, 4=CBC decrypt, 5=CBC encrypt, 6=ECB decrypt, 7=ECB encrypt)
|-
| 30
| Interrupt enable (1=Enable, 0=Disable)
|-
| 31
| Start (1=Enable/Busy, 0=Idle)
|}

== REG_AESBLKCNT ==

{| class="wikitable" border="1"
! Bit
! Description
|-
| 16-31
| (Data length)>>4
|}

== REG_AESKEYCNT ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 5-0
| Keyslot
|-
| 6
| Hardware key-generator type: 0 = 3DS, 1 = DSi.
|-
| 7
| This normally has value 1 written here when updating keys, however that's not actually needed(keydata gets updated regardless of whether this bit is set).
|}

Bit6 is only used when keyslots >=4 are used, value1 has the same affect as doing key-init with the TWL keyslots. Bit6 is checked when a keyY was written, for when the final-normalkey needs updated via the key-generator.

== REG_AESCTR ==
This register specifies the counter (CTR mode), nonce (CCM mode) or the initialization vector (CBC mode) depending on the mode of operation.
For CBC and CTR mode this register takes up the full 16 bytes, but for CCM mode the nonce is only the first 12 bytes.

== REG_AESMAC ==
This register specifies the message authentication code (MAC) for use in CCM mode.

== Endianness and word order ==
When writing to the REG_AESCTR or REG_AESMAC register, the hardware will process the written data according to the current input endianness specified in AESCNT. However, the current specified input word order will not be honored for this register, and always defaults to reversed word order. Therefore, for normal word order, the reversal must be carried out manually if required.

== Keyslots ==
{| class="wikitable" border="1"
! Keyslot
! Description
|-
| 0x00-0x03
| These are the TWL keyslots, the key-data for these can be set via the REG_AESKEY0-REG_AESKEY3 registers. These keyslots are initialized by NATIVE_FIRM. The console-unique portion of two of these keyslots are only [[CONFIG|initialized]] by NATIVE_FIRM during initial hard-boot.
|-
| 0x0D
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]], this uses the hardware key-scrambler.
|-
| 0x11
| This is used for general normal-key crypto, where the normal-key is set by FIRM. This keyslot is also used by the New3DS [[FIRM]] arm9 binary loader.
|-
| 0x14
| Starting with [[5.0.0-11]], NATIVE_FIRM Process9 now sets the keyY for this to the same one it uses for initializing 3 of the keyslots' keyYs from [[PSPXI:EncryptDecryptAes|here]].
|-
| 0x20..0x23
| All of these keyslots(initialized by bootrom) are set to the same key-data. These seem to be set to a regular normal-key?
|-
| 0x25
| The keyX and keyY initialized by bootrom for this keyslot are console-unique. This keyslot is used for the [[7.0.0-13|v7.0]] [[NCCH]] encryption, the keyX is initialized during NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]]. The keyY/CTR used for this keyslot is the same as keyslot 0x2C.
|-
| 0x2C
| Used to decrypt [[NCCH|NCCH]], the keyY is set by Process9(see [[NCCH|here]] regarding the keyY). Keyslots 0x2C..0x2F all use the same keyX, set by bootrom.
|-
| 0x2D
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]], this uses the hardware key-scrambler.
|-
| 0x2E
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. This keyY is set by NATIVE_FIRM.
|-
| 0x2F
| Initially this keyslot has the same keyY as keyslot 0x2D, initialized by bootrom. This keyY is initialized during NATIVE_FIRM [[Savegames#6.0.0-11_Savegame_keyY|boot]]. This is the keyslot used for calculating v6.0 gamecard savegames' keyYs.
|-
| 0x31
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]], this uses the hardware key-scrambler. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
|-
| 0x32
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. This keyslot keyX is the same keyX used for keyslot 0x31.
|-
| 0x34-0x37
| All four of these keyslots use the same keyX. Keyslots 0x35/0x36 use the same keyY, see [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]] for keyslot 0x36.
|-
| 0x38
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]], this uses the hardware key-scrambler.
|-
| 0x39
| See [[PSPXI:EncryptDecryptAes|EncryptDecryptAes]]. This keyslot keyX is the same keyX used for keyslot 0x38. NATIVE_FIRM sets this keyY to the same one used for keyslot 0x2E.
|-
| 0x3D
| This keyslot uses keyY. Used to decrypt title keys in [[Ticket]]. Used by Gateway.
|-
| 0x3E
| This keyslot uses an unique keyX/keyY.
|-
| 0x3F
| This keyslot uses an unique keyX/keyY.
|}

=== Hardware key generator ===
Unless noted otherwise, all keyslots on retail units use the hardware key-scrambler, where the final normal-key is generated in hardware using the input keyX and keyY. This normal-key is then written to the hardware keyslot by the AES engine, all of the AES engine key registers are write-only. The internal normal-key keyslot is only updated when the keyY is written to, the keyslot's normal-key is not immediately updated when writing to the keyX.

=== keyX ===
The ARM9 bootrom initializes the keyX for each 3DS keyslot, the ARM9 bootrom also initializes the keyY for the keyslots where NATIVE_FIRM doesn't set the keyY. In certain cases Process9 may also set the keyX.

=== Updating keydata ===
After writing to a keyslot when the keyslot is already selected, the keyslot must be re-selected for the updated keyslot key-data to be used.

Writing to the key FIFOs with byte writes results in the AES engine converting the byte to a word for setting the key word, with this: word = (byteval) | (byteval<<8) | (byteval<<16) | (byteval<<24). The result is the same regardless of which FIFO register byte was written to.

=== FIRM-launch key clearing ===
Starting with [[9.0.0-20]] the Process9 FIRM-launch code now "clears" the following AES keyslots, with certain keydata by writing the normal-key: 0x15 and 0x18-0x20. These are the keyslots used by the New3DS [[FIRM]] arm9bin loader(minus keyslot 0x11), so the New3DS Process9 presumably does this too.

AES Registers

2014-10-28T17:55:39Z

Neimod: moved AES Registers to AES Registers2

#REDIRECT [[AES Registers2]]

Main Page/Header

2014-01-12T20:44:46Z

Neimod:

<div style="background-color:#e7eef6; border: 1px solid #ccc; color:#000; margin-top: 15px; margin-bottom: 10px; padding: 8px; text-align:center;">
<div style="font-size: 162%; border: none; margin: 0; padding:.1em;">Welcome to [[3DBrew:About|3DBrew]],</div>
<div style="font-size: 95%">a wiki dedicated to homebrew on the Nintendo 3DS.</div>
<div style="font-size:85%;">We have [[Special:Statistics|{{NUMBEROFARTICLES}}]] articles. Join our development conversations on the EFnet IRC channel ''#3dsdev''. </div>
<div style="font-size:200%;"><br>[[Fundraiser|Chip Decapping Fundraiser]] currently suspended!</div>
</div>

Fundraiser

2014-01-12T20:43:28Z

Neimod:

There has been alot of tinkering with the 3DS since launch, and although there have been leaps and bounds due to the combined efforts of many contributors, much of what we're doing would be expedited by extracting the boot code and other proprietary information (secrets) from the custom Nintendo SoC (System-On-a-Chip) of a retail 3DS.

= UPDATE 12/01/2013 =
We are unable to contact user [[User:Jl12|Jl12]] for months now, if you can contact this user please let us know. His email address gspeer012 (at) gmail (dot) com. For now the fundraiser is suspended.

Main Page/OtherSites

2013-12-30T07:05:26Z

Neimod:

{{Main page box|Other Nintendo Homebrew Sites|:OtherSites}}
<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- valign="top" align="left" style="background: #F5FAFF;"
| DSiBrew [http://dsibrew.org] WiiBrew [http://wiibrew.org] WiiUBrew [http://wiiubrew.org]
|}
</div>
{{box-footer-empty}}

IO Registers

2013-07-08T00:40:09Z

Neimod:

= Overview =

{| class="wikitable" border="1"
! Category
! Address start
! Virtual address
! Kernel address
|-
| [[CONFIG]]
| 0x10000000
|
|
|-
| [[IRQ]]
| 0x10001000
|
|
|-
| [[NDMA]]
| 0x10002000
|
|
|-
| [[TIMER]]
| 0x10003000
|
|
|-
| [[CTRCARD]]
| 0x10004000 / 0x10005000
|
|
|-
| [[SDMC]] / [[NAND]]
| 0x10006000 / 0x10007000
|
|
|-
| [[PXI]]
| 0x10008000
|
|
|-
| [[AES]]
| 0x10009000
|
|
|-
| [[SHA]]
| 0x1000A000
|
|
|-
| [[RSA]]
| 0x1000B000
|
|
|-
| [[XDMA]]
| 0x1000C000
|
|
|-
| [[SPICARD]]
| 0x1000D800
|
|
|-
| [[CONFIG]]
| 0x10010000
|
|
|-
| [[PDN]]
| 0x10141000
| 0x1EC41000
|
|-
| [[CODEC]]
| 0x10141000
| 0x1EC41000
|
|-
| [[SPI]]
| 0x10142000
| 0x1EC42000
|
|-
| [[I2C]]
| 0x10144000
| 0x1EC44000
|
|-
| [[HID]]
| 0x10146000
| 0x1EC46000
|
|-
| [[PAD]]
| 0x10146000
| 0x1EC46000
|
|-
| [[PTM]]
| 0x10146000
| 0x1EC46000
|
|-
| [[I2C]]
| 0x10148000
| 0x1EC48000
|
|-
| [[SPI]]
| 0x10160000
| 0x1EC60000
|
|-
| [[I2C]]
| 0x10161000
| 0x1EC61000
|
|-
| [[MIC]]
| 0x10162000
| 0x1EC62000
|
|-
| [[NTRCARD]]
| 0x10164000
|
|
|-
|}

=Summary=

* [[PXI]]
* [[I2C]]
* [[LCD]]
* [[GPU]]

HID Registers

2013-07-08T00:31:19Z

Neimod:

== Registers ==
{| class="wikitable" border="1"
! NAME
! PHYSICAL ADDRESS
! PROCESS ADDRESS
! WIDTH
|-
| REG_HID???
| 0x10146000
| 0x1EC46000
|
|}

HID Registers

2013-07-08T00:31:07Z

Neimod: Created page with "== Registers == {| class="wikitable" border="1" ! NAME ! PHYSICAL ADDRESS ! PROCESS ADDRESS ! WIDTH |- | REG_HID??? | 0x10146000 | 0x1EC46000 |}"

== Registers ==
{| class="wikitable" border="1"
! NAME
! PHYSICAL ADDRESS
! PROCESS ADDRESS
! WIDTH
|-
| REG_HID???
| 0x10146000
| 0x1EC46000
|}

I2C Registers

2013-07-08T00:28:56Z

Neimod:

== Registers ==
{| class="wikitable" border="1"
! NAME
! PHYSICAL ADDRESS
! PROCESS ADDRESS
! WIDTH
|-
| REG_I2C1DATA
| 0x10161000
| 0x1EC61000
| 1
|-
| REG_I2C1CNT
| 0x10161001
| 0x1EC61001
| 1
|-
| REG_I2C1CNTEX
| 0x10161002
| 0x1EC61002
| 2
|-
| REG_I2C1SCL
| 0x10161004
| 0x1EC61004
| 2
|-
| REG_I2C2DATA
| 0x10144000
| 0x1EC44000
| 1
|-
| REG_I2C2CNT
| 0x10144001
| 0x1EC44001
| 1
|-
| REG_I2C2CNTEX
| 0x10144002
| 0x1EC44002
| 2
|-
| REG_I2C2SCL
| 0x10144004
| 0x1EC44004
| 2
|-
| REG_I2C3DATA
| 0x10148000
| 0x1EC48000
| 1
|-
| REG_I2C3CNT
| 0x10148001
| 0x1EC48001
| 1
|-
| REG_I2C3CNTEX
| 0x10148002
| 0x1EC48002
| 2
|-
| REG_I2C3SCL
| 0x10148004
| 0x1EC48004
| 2
|}

== I2C Devices ==
{| class="wikitable" border="1"
! Device id
! Device bus id
! Device address
! Device description
|-
| 0
| 1
| 0x4a
| Power management?(same device addr as the DSi power-management)
|-
| 1
| 1
| 0x7a
| Camera0?(same dev-addr as DSi cam0)
|-
| 2
| 1
| 0x78
| Camera1?(same dev-addr as DSi cam1)
|-
| 3
| 2
| 0x4a
| MCU
|-
| 4
| 2
| 0x78
| ?
|-
| 5
| 2
| 0x2c
| ?
|-
| 6
| 2
| 0x2e
| ?
|-
| 7
| 2
| 0x40
| ?
|-
| 8
| 2
| 0x44
| ?
|-
| 9
| 3
| 0xa6
| ?
|-
| 10
| 3
| 0xd0
| ?
|-
| 11
| 3
| 0xd2
| ?
|-
| 12
| 3
| 0xa4
| ?
|-
| 13
| 3
| 0x9a
| ?
|-
| 14
| 3
| 0xa0
| eeprom?
|}

== Device 3 ==
{| class="wikitable" border="1"
! REGISTER
! WIDTH
! DESCRIPTION
|-
| 0x03
| 8
| ?
|-
| 0x04
| 8
| ?
|-
| 0x18
| 8
| ?
|-
| 0x20
| 8
| Writing u8 value 4 here triggers a hardware system reboot.
|-
| 0x22
| 8
| ?
|-
| 0x23
| 8
| ?
|-
| 0x24
| 8
| ?
|-
| 0x28
| 8
| ?
|-
| 0x29
| 8
| ?
|-
| 0x2A
| 8
| ?
|-
| 0x2B
| 8
| ?
|-
| 0x2C
| 8
| ?
|-
| 0x30
| 8
| ?
|-
| 0x31
| 8
| ?
|-
| 0x32
| 8
| ?
|-
| 0x33
| 8
| ?
|-
| 0x34
| 8
| ?
|-
| 0x35
| 8
| ?
|-
| 0x36
| 8
| ?
|-
| 0x37
| 8
| ?
|-
| 0x38
| 8
| ?
|-
| 0x39
| 8
| ?
|-
| 0x3A
| 8
| ?
|-
| 0x3B
| 8
| ?
|-
| 0x3C
| 8
| ?
|-
| 0x41
| 8
| ?
|-
| 0x43
| 8
| ?
|-
| 0x4E
| 8
| ?
|-
| 0x50
| 8
| ?
|-
| 0x51
| 8
| ?
|-
| 0x58
| 8
| ?
|-
| 0x60
| 8
| ?
|}

= I2CCNT =
{| class="wikitable" border="1"
|+ REG_I2CxCNT
! BIT
! DESCRIPTION
|-
| 0
| HOLD (0=Last byte of transaction, 1=More bytes coming)
|-
| 2
| Error flag/ack?
|-
| 4
| Read mode related?
|-
| 5
| Read mode?
|-
| 6
| IRQ enable?
|-
| 7
| Enable?
|}

File talk:CTR NAND pinout XL.jpg

2013-07-07T16:06:57Z

Neimod: Created page with "Image thanks to profi200 and friend"

Image thanks to profi200 and friend

Hardware

2013-07-07T16:04:48Z

Neimod:

{{stub}}

This page lists and describes the hardware found inside the Nintendo 3DS. Many of these parts are custom made and are expanded upon here or in other pages.

== Specifications ==

{| class="wikitable"
! Type !! Name !! Datasheet !! Source
|-
| SoC || Nintendo 1048 0H (Custom): CPU, GPU, VRAM & DSP all on one chip. || N/A || N/A
|-
| ARM11 Processor Core || ARM11 MPCore 2x 268MHz(~268123480 Hz) & 2x VFP Co-Processor || [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0360f/index.html] || [11]
|-
| GPU || [http://en.wikipedia.org/wiki/PICA200 DMP PICA] 268MHz || N/A || [11]
|-
| DSP || 134Mhz. 24ch 32728Hz sampling rates. || N/A || [11]
|-
| VRAM || 6 MB within SoC. Independent of system memory (FCRAM). || N/A || [11]
|-
| FCRAM || 2x64MB Fujitsu MB82M8080-07L ||[http://crediar.no-ip.com/sg_/download.php?id=d67d1c][http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511463.pdf][http://edevice.fujitsu.com/jp/datasheet/j-ds/j511463.pdf]|| [5]
|-
| Storage || Toshiba THGBM2G3P1FBAI8 1GB NAND Flash || N/A || N/A
|-
| Power Management || Texas Instruments PAIC3010B 0AA37DW || N/A || FCC filing
|-
| Gyroscope || Invensense ITG-3270 MEMS Gyroscope || [http://dl-web.dropbox.com/u/20520664/references/PS-ITG-3200-00-01.4.pdf] || N/A
|-
| Accelerometer || ST Micro 2048 33DH X1MAQ Accelerometer Model LIS331DH || [http://dl.dropbox.com/u/20520664/references/CD00213470.pdf] || N/A
|-
| Wifi || 802.11b/g Atheros AR6014 || [http://www.db.pokestation.net/3DS/Wi-Fi%20module%20pinouts.pdf] || N/A
|-
| Infrared IC || NXP infrared IC, "S750 0803 TSD031C" || N/A || [10]
|-
| Auxiliary Microcontroller || Renesas Electronics UC CTR, custom Nintendo microcontroller || N/A || N/A
|}

* [11] Official Documentation

* [5],[10] According to iFixit.com ([http://www.ifixit.com/Teardown/Nintendo-3DS-Teardown/5029/1#s22696 source]):

* Datasheet for memory is for a chip in the same series, it has less memory than the one inside the 3DS (128mbits vs 512mbits).

* There is a trove of data on the FCC website at [https://fjallfoss.fcc.gov/oetcf/eas/reports/ViewExhibitReport.cfm?mode=Exhibits&RequestTimeout=500&calledFromFrame=N&application_id=462292&fcc_id=%27EW4DWMW028%27].

== FCRAM ==

There is one FCRAM (Fast Cycle RAM) IC in the 3DS, produced by Fujitsu and branded as MB82M8080-07L. The Fujitsu MB82M8080-07L chip internally contains 2 dies, where each die is branded MB81EDS516545 and MB82DBS08645.

The MB81EDS516545 die is a CMOS Fast Cycle Random Access Memory (FCRAM) with Low Power Double Data Rate (LPDDR) SDRAM Interface containing 512MBit storage accessible in a 64-bit format. The MB81EDS516545 is suited for consumer applications requiring high data bandwidth with low power consumption.

== SoC ==

The 3DS has much of it's internals housed in a SoC (System on Chip) just like it's predecessors. This is done to reduce build costs, cut down on power consumption, as well as make the PCB layout less complex and make the system harder to tamper with. The SoC, branded as the Nintendo 1048 0H, contains the CPU, GPU, DSP and VRAM.

According to official documents, the CPU used is a dual-core ARM11 CPU, clocked at 268MHz. One core is dedicated to system software, while the other is used for application programming, each known as the syscore and appcore, respectively.

== GPU ==

As mentioned, DMP's (Digital Media Proffesionals) PICA 200, 268Mhz. This GPU supports OpenGL ES 1.1.

[[File:Pica200BlockDiagram.png]]

Block diagram of an ULTRAY2000 based architecture PICA200

== Images ==

=== Front ===

[[Image:CTR_Front.jpg|600px]]

[http://guide-images.ifixit.net/igi/ishJaSCOwLkvbLYK High Resolution]

=== Back ===

[[Image:CTR_Back.jpg]]

[http://guide-images.ifixit.net/igi/n1CKAdbPrHyNPNuW High Resolution]

=== NAND pinout ===

NAND dumping has been successful, but the image is encrypted.

==== Normal model ====

[[Image:CTR_NAND_pinout.png]]

==== XL model ====

[[Image:CTR_NAND_pinout_XL.jpg|500px]]

=== WiFi dongle pinout ===
[[Image:CTR_WiFiDongle_pinout.png|600px]]

SDIO interface is colored red:
* CLK
* CMD
* D0, D1, D2, D3

This is the interface for the 'NEW' WiFi module (based on Atheros AR6002) first included in DSi.

The proprietary and by now ancient DS-mode WiFi is colored yellow, pins are unknown.

I2C eeprom is colored blue:
* SCL
* SDA

SPI Flash is colored purple:
* CLK
* CS#
* SI
* SO
* WP#
* NC

=== Auxiliary Microntroller ===
[[Image:CTR_UC.png|600px]]

Monitors HOME button, WiFi switch, 3D slider, volume control slider.
Controls LEDs, various power supplies.

Devices attached to I2C bus:
* UC (master?)
* Accelerometer (slave address 0x18)
* SoC (master? slave?)

File:CTR NAND pinout XL.jpg

2013-07-07T16:02:29Z

Neimod:

Fundraiser

2013-07-06T08:42:13Z

Neimod:

There has been alot of tinkering with the 3DS since launch, and although there have been leaps and bounds due to the combined efforts of many contributors, much of what we're doing would be expedited by extracting the boot code and other proprietary information (secrets) from the custom Nintendo SoC (System-On-a-Chip) of a retail 3DS.

= UPDATE 06/07/2013 =
The fundraiser will remain open until it raises approximately 2,300 in order to pay for the decapping and the applicable taxes. Thus the fundraiser is still running.

= What is chip decapping? =
For those that are unfamiliar: the CPU, GPU & DSP all exist on one proprietary SOC design used on the 3DS. Secure information is stored there partly, most likely burned onto the SoC during manufacturing and not readable by any other normal means or from outside of the SoC, in such a way that the secure information there, always stays there. In good design it will never reach the main memory of the 3DS and so sensitive data (like encryption keys or algorithms) stay secure.

Extracting data from a proprietary chip to reverse-engineer it is typically done by decapping it, which is risky business and involves removing the epoxy, delayering the chip and taking high-resolution pictures of every layer to reconstruct logic from the images. Special equipment is used ( SEM / scanning electron microscope ) and it is rarely done outside of a professional context because it is very costly to an average enthusiast ("hacker") and access to equipment and the expertise is hard to realize.

Chip decapping has been used by the "emulation" community to reverse-engineer and recover data from special proprietary chips, such as those in SNES cartridges. It has also been used to to reverse-engineer other hardware to create emulators for other platforms besides the SNES.

= Is this legal? =
Decapping a chip and reverse engineering it is in fact legal in the US, and most likely in other countries too. Check out the [http://en.wikipedia.org/wiki/Semiconductor_Chip_Protection_Act_of_1984 Semiconductor Chip Protection Act of 1984], which states reverse engineering a chip is not prohibited.

However, we do not endorse piracy, and any information revealed by the chip decapping will be used to advance progress for homebrew applications and games on 3DS, not piracy.

= How much? =
We have gotten a price quote from a professional lab on the deal (removal, decap, delayer, SEM imaging) and it came out to $400 per layer of the chip, which they estimate will come to "about $2000 total". Plus the cost of the 3DS we will be donating for the hardware sample(s).

The numbers of layers is approximate because they likely don't know how many layers are in the SoC until they actually decap it. In the worst case we estimate between 8 or 10 layers. For now we're trying to reach their initial quote of $2000 USD and send in the 3DS to get it started. Later on we can still decide to have the remaining layers imaged.

= Why should I help? =
Kicking it around with other contributors on this site, we all agreed it would be interesting or valuable to us but $2000+ is simply a lot to ask of anyone to drop suddenly on a hobby project. Also $2000+ while a lot for an individual is a very achievable goal for a fund raising.

We created this page here to raise awareness of the fundraiser for this purpose. Now is the chance for you, the viewers of this site, to contribute.
You will have the noble honor of helping the 3DS community progress forward.
We're also considering giving contributors a copy of the images produced as thanks.

To reiterate, what we're trying to do is: send in initially 1 3DS to a professional lab to get delayered and imaged (covering the costs of doing so). The resulting SEM images will be reconstructed and used towards discovering more of the hardware secrets inside the 3DS.

= How likely is this going to help progress? =
It is not possible to give a clear answer on this until the 3DS SoC chip has been decapped. But consider the success story about the SNES decapping [http://byuu.org/articles/emulation/decap here]. There is no 100% guarantee that we will have the same success story, since the technology is different and there might be more technological limitations. But we won't know until we try. We have a team of proven experts, anxious to have a very thorough look inside the SoC of the 3DS.

The most likely focus points will be:
* the boot ROM, possibly containing flaws which allow us to take control of the system
* secret keys, hidden in hardware, used in cryptographic operations
* secret algorithms, implemented in hardware to obscure information
* and possibly much more

= How can I help? =
If you'd like to donate and help contribute to this cause you can do so by donating [http://n-dev.net/donate.php here].

= Contact information =
User [[User:Jl12|Jl12]] is in charge of collecting the donations, and will deliver the final samples to [http://www.eaglabs.com/about-eag.html the professional lab] for the chip decapping at the end of the fundraiser. Any more questions can be directed to him at his email address gspeer012 (at) gmail (dot) com

Virtual address mapping FW26

2013-05-03T18:02:46Z

Neimod: Created page with " VA E8000000..E8600000 -> PA 18000000..18600000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA] VA EFF00000..F0000000 -> PA 1FF00000..20000000 [SYS:RW USR..."

VA E8000000..E8600000 -> PA 18000000..18600000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA EFF00000..F0000000 -> PA 1FF00000..20000000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA F0000000..F8000000 -> PA 20000000..28000000 [SYS:RW USR:-- XN TYP:NORMAL PRIVAT OUTER NOCACHE, INNER CACHED WB WA]
VA FF401000..FF402000 -> PA 27FCD000..27FCE000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF403000..FF404000 -> PA 27FC8000..27FC9000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF405000..FF406000 -> PA 27FC1000..27FC2000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF407000..FF408000 -> PA 27FB9000..27FBA000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF409000..FF40A000 -> PA 27F9C000..27F9D000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF40B000..FF40C000 -> PA 27EB8000..27EB9000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF40D000..FF40E000 -> PA 27EB7000..27EB8000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF40F000..FF410000 -> PA 27EB6000..27EB7000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF411000..FF412000 -> PA 27EB5000..27EB6000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF413000..FF414000 -> PA 27EB0000..27EB1000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF415000..FF416000 -> PA 27EAF000..27EB0000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF417000..FF418000 -> PA 27EAE000..27EAF000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF419000..FF41A000 -> PA 27EAD000..27EAE000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF41B000..FF41C000 -> PA 27EAC000..27EAD000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF41D000..FF41E000 -> PA 27E98000..27E99000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF41F000..FF420000 -> PA 27E7A000..27E7B000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF421000..FF422000 -> PA 27E77000..27E78000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF423000..FF424000 -> PA 27E65000..27E66000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF425000..FF426000 -> PA 27E50000..27E51000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF427000..FF428000 -> PA 27E4D000..27E4E000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF429000..FF42A000 -> PA 27E4C000..27E4D000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF42B000..FF42C000 -> PA 27E46000..27E47000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF42D000..FF42E000 -> PA 27E44000..27E45000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF42F000..FF430000 -> PA 27E43000..27E44000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF431000..FF432000 -> PA 27E3B000..27E3C000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF433000..FF434000 -> PA 27E28000..27E29000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF435000..FF436000 -> PA 27E26000..27E27000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF437000..FF438000 -> PA 27E25000..27E26000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF439000..FF43A000 -> PA 27E23000..27E24000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF43B000..FF43C000 -> PA 27E22000..27E23000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF43D000..FF43E000 -> PA 27E21000..27E22000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF43F000..FF440000 -> PA 27E20000..27E21000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF441000..FF442000 -> PA 27E1F000..27E20000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF443000..FF444000 -> PA 27E1C000..27E1D000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF445000..FF446000 -> PA 27E1B000..27E1C000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF447000..FF448000 -> PA 27E1A000..27E1B000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF449000..FF44A000 -> PA 27E19000..27E1A000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF44B000..FF44C000 -> PA 27E0A000..27E0B000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF44D000..FF44E000 -> PA 27DF5000..27DF6000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF44F000..FF450000 -> PA 27DF2000..27DF3000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF451000..FF452000 -> PA 27DF1000..27DF2000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF453000..FF454000 -> PA 27DF0000..27DF1000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF455000..FF456000 -> PA 27DEF000..27DF0000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF457000..FF458000 -> PA 27DDF000..27DE0000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF459000..FF45A000 -> PA 27DDD000..27DDE000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF45B000..FF45C000 -> PA 27DDC000..27DDD000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF45D000..FF45E000 -> PA 27DDB000..27DDC000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF45F000..FF460000 -> PA 27DC7000..27DC8000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF461000..FF462000 -> PA 27DC1000..27DC2000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF463000..FF464000 -> PA 27DA2000..27DA3000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF465000..FF466000 -> PA 2779F000..277A0000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF467000..FF468000 -> PA 2779E000..2779F000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF469000..FF46A000 -> PA 2779D000..2779E000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF46B000..FF46C000 -> PA 2779C000..2779D000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF46D000..FF46E000 -> PA 2779B000..2779C000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF46F000..FF470000 -> PA 2779A000..2779B000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF471000..FF472000 -> PA 27799000..2779A000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF473000..FF474000 -> PA 27798000..27799000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF475000..FF476000 -> PA 27797000..27798000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF477000..FF478000 -> PA 27796000..27797000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF479000..FF47A000 -> PA 27795000..27796000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF47B000..FF47C000 -> PA 27794000..27795000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF47D000..FF47E000 -> PA 27793000..27794000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF47F000..FF480000 -> PA 27792000..27793000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF481000..FF482000 -> PA 27786000..27787000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF483000..FF484000 -> PA 27774000..27775000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF485000..FF486000 -> PA 27773000..27774000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF487000..FF488000 -> PA 27756000..27757000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF489000..FF48A000 -> PA 2774C000..2774D000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF48B000..FF48C000 -> PA 2774B000..2774C000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF48D000..FF48E000 -> PA 2774A000..2774B000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF48F000..FF490000 -> PA 27748000..27749000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF491000..FF492000 -> PA 27747000..27748000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF493000..FF494000 -> PA 27740000..27741000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF495000..FF496000 -> PA 2773D000..2773E000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF497000..FF498000 -> PA 2773C000..2773D000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF499000..FF49A000 -> PA 2772C000..2772D000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF49B000..FF49C000 -> PA 27729000..2772A000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF49D000..FF49E000 -> PA 27728000..27729000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF49F000..FF4A0000 -> PA 276C5000..276C6000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4A1000..FF4A2000 -> PA 276AE000..276AF000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4A3000..FF4A4000 -> PA 2768B000..2768C000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4A5000..FF4A6000 -> PA 27689000..2768A000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4A7000..FF4A8000 -> PA 27688000..27689000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4A9000..FF4AA000 -> PA 27687000..27688000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4AB000..FF4AC000 -> PA 27686000..27687000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4AD000..FF4AE000 -> PA 27685000..27686000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4AF000..FF4B0000 -> PA 27684000..27685000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4B1000..FF4B2000 -> PA 27645000..27646000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4B3000..FF4B4000 -> PA 27602000..27603000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4B5000..FF4B6000 -> PA 27601000..27602000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4B7000..FF4B8000 -> PA 27600000..27601000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4B9000..FF4BA000 -> PA 275FF000..27600000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4BB000..FF4BC000 -> PA 2757D000..2757E000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4BD000..FF4BE000 -> PA 2757A000..2757B000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4BF000..FF4C0000 -> PA 274A6000..274A7000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4C1000..FF4C2000 -> PA 274A5000..274A6000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4C3000..FF4C4000 -> PA 274A4000..274A5000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4C5000..FF4C6000 -> PA 274A3000..274A4000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4C7000..FF4C8000 -> PA 274A2000..274A3000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4C9000..FF4CA000 -> PA 274A1000..274A2000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4CB000..FF4CC000 -> PA 274A0000..274A1000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4CD000..FF4CE000 -> PA 2749F000..274A0000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4CF000..FF4D0000 -> PA 2749E000..2749F000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4D1000..FF4D2000 -> PA 2749D000..2749E000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4D3000..FF4D4000 -> PA 2749C000..2749D000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4D5000..FF4D6000 -> PA 2749B000..2749C000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4D7000..FF4D8000 -> PA 2749A000..2749B000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4D9000..FF4DA000 -> PA 27499000..2749A000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4DB000..FF4DC000 -> PA 27498000..27499000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4DD000..FF4DE000 -> PA 27496000..27497000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4DF000..FF4E0000 -> PA 27495000..27496000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4E1000..FF4E2000 -> PA 27493000..27494000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4E3000..FF4E4000 -> PA 27353000..27354000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4E5000..FF4E6000 -> PA 27351000..27352000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4E7000..FF4E8000 -> PA 27350000..27351000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4E9000..FF4EA000 -> PA 27310000..27311000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4EB000..FF4EC000 -> PA 2730A000..2730B000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4ED000..FF4EE000 -> PA 272F7000..272F8000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4EF000..FF4F0000 -> PA 272F6000..272F7000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4F1000..FF4F2000 -> PA 2720D000..2720E000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4F3000..FF4F4000 -> PA 271E4000..271E5000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4F5000..FF4F6000 -> PA 26FB2000..26FB3000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4F7000..FF4F8000 -> PA 271E2000..271E3000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4F9000..FF4FA000 -> PA 26FAF000..26FB0000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4FB000..FF4FC000 -> PA 26FA4000..26FA5000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4FD000..FF4FE000 -> PA 26FA3000..26FA4000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF4FF000..FF500000 -> PA 26FA2000..26FA3000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF501000..FF502000 -> PA 26FA1000..26FA2000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF503000..FF504000 -> PA 26FA0000..26FA1000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF505000..FF506000 -> PA 26F9F000..26FA0000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF507000..FF508000 -> PA 26F7D000..26F7E000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF509000..FF50A000 -> PA 26F7C000..26F7D000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF50B000..FF50C000 -> PA 26F7B000..26F7C000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF50D000..FF50E000 -> PA 26F7A000..26F7B000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF50F000..FF510000 -> PA 26F30000..26F31000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF511000..FF512000 -> PA 26F2F000..26F30000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF513000..FF514000 -> PA 26F2D000..26F2E000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF515000..FF516000 -> PA 26F2E000..26F2F000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF517000..FF518000 -> PA 26F2C000..26F2D000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF519000..FF51A000 -> PA 26F2B000..26F2C000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF51B000..FF51C000 -> PA 26F2A000..26F2B000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF51D000..FF51E000 -> PA 26F29000..26F2A000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF51F000..FF520000 -> PA 26F28000..26F29000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF521000..FF522000 -> PA 26F27000..26F28000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF523000..FF524000 -> PA 26F26000..26F27000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF525000..FF526000 -> PA 26F04000..26F05000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF527000..FF528000 -> PA 26F25000..26F26000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF529000..FF52A000 -> PA 26EFB000..26EFC000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF52B000..FF52C000 -> PA 26F23000..26F24000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF52D000..FF52E000 -> PA 26EFC000..26EFD000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF52F000..FF530000 -> PA 26EFA000..26EFB000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF531000..FF532000 -> PA 26EF8000..26EF9000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF533000..FF534000 -> PA 26EF5000..26EF6000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF535000..FF536000 -> PA 26EF6000..26EF7000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF537000..FF538000 -> PA 26EF3000..26EF4000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF539000..FF53A000 -> PA 26EF2000..26EF3000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF53B000..FF53C000 -> PA 26EF9000..26EFA000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FF53D000..FF53E000 -> PA 26EF7000..26EF8000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFF00000..FFF3F000 -> PA 1FFA0000..1FFDF000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFF50000..FFF70000 -> PA 1FF80000..1FFA0000 [SYS:RO USR:-- X TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFF70000..FFF7B000 -> PA 1FFDF000..1FFEA000 [SYS:RO USR:-- X TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFF7B000..FFF7C000 -> PA 1FFEA000..1FFEB000 [SYS:RO USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFF7C000..FFF81000 -> PA 1FFEB000..1FFF0000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFFCC000..FFFCD000 -> PA 10144000..10145000 [SYS:RW USR:-- XN TYP:DEVICE SHARED ]
VA FFFCE000..FFFCF000 -> PA 10400000..10401000 [SYS:RW USR:-- XN TYP:DEVICE SHARED ]
VA FFFD0000..FFFD1000 -> PA 10141000..10142000 [SYS:RW USR:-- XN TYP:DEVICE SHARED ]
VA FFFD2000..FFFD3000 -> PA 10163000..10164000 [SYS:RW USR:-- XN TYP:DEVICE SHARED ]
VA FFFD4000..FFFD5000 -> PA 10146000..10147000 [SYS:RW USR:-- XN TYP:DEVICE SHARED ]
VA FFFD6000..FFFD7000 -> PA 10202000..10203000 [SYS:RW USR:-- XN TYP:DEVICE SHARED ]
VA FFFD8000..FFFD9000 -> PA 10140000..10141000 [SYS:RW USR:-- XN TYP:DEVICE SHARED ]
VA FFFDA000..FFFDB000 -> PA 10200000..10201000 [SYS:RW USR:-- XN TYP:DEVICE SHARED ]
VA FFFDC000..FFFE0000 -> PA 1FFF8000..1FFFC000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFFE1000..FFFE2000 -> PA 1FFF0000..1FFF1000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFFE3000..FFFE4000 -> PA 1FFF2000..1FFF3000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFFE5000..FFFE9000 -> PA 1FFFC000..20000000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFFEA000..FFFEB000 -> PA 1FFF1000..1FFF2000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFFEC000..FFFED000 -> PA 1FFF3000..1FFF4000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFFEE000..FFFF0000 -> PA 17E00000..17E02000 [SYS:RW USR:-- XN TYP:DEVICE SHARED ]
VA FFFF0000..FFFF1000 -> PA 1FFF4000..1FFF5000 [SYS:RO USR:-- X TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFFF2000..FFFF6000 -> PA 1FFF8000..1FFFC000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFFF7000..FFFF8000 -> PA 1FFF0000..1FFF1000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFFF9000..FFFFA000 -> PA 1FFF2000..1FFF3000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]
VA FFFFB000..FFFFE000 -> PA 1FFF5000..1FFF8000 [SYS:RW USR:-- XN TYP:NORMAL SHARED OUTER NOCACHE, INNER CACHED WB WA]

GPU/Commands

2013-04-18T23:51:09Z

Neimod:

This page describes the structure of the buffer for [[GSP_Shared_Memory|GX command]] 1 with the registers at [[GPU|0x1EF018E0]]. This buffer is used for GPU commands including OpenGL commands, each 8-byte entry in the buffer is a command. Cmd+0 is the command parameter, and cmd+4 is the command header.

Invalid GPU command parameters including NaN floats can cause the GPU to hang, this then causes the GSP module to hang as well.

=== Command Header ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 19-0
| Command ID
|-
| 30-20
| Total words following the command, if any.
|-
| 31
| ?
|}
The first word in the parameter data structure is the command parameter value, the rest of the data structure is from the data following the command. The word after the last data structure word is padding when needed for 8-byte alignment, for the following command.

=== Commands ===
{| class="wikitable" border="1"
! CommandID
! Parameter
! Description
|-
| 0x000F0010
| Value is 0x12345678
| This command is always the last command in the buffer.
|-
| 0x000F0110
| Value 0x1
| This command is immediately before CmdID 0x000F0010, this is also used elsewhere for beginning rendering of mesh(es) as well.
|-
| 0x000F0111
| Value 0x1
| This command is immediately before CmdID 0x000F0110, however CmdID 0x000F0110 doesn't always follow this command.
|-
| 0x000F0040
| u32, valid values are 0x1 and 0x2, values 0x0 and 0x3 have the same effect as value 0x2. Only bits 1-0 are used.
| Value 2 = GL_FRONT/GL_CW or GL_BACK/GL_CCW. Value 1 = GL_FRONT/GL_CCW or GL_BACK/GL_CW.
|-
| 0x000F0041
| float24
| VIEWPORT_WIDTH. See command set 0x000F0041.
|-
| 0x000F0042
| float32
| VIEWPORT_WIDTH_INV. See command set 0x000F0041.
|-
| 0x000F0043
| float24
| VIEWPORT_HEIGHT. See command set 0x000F0041.
|-
| 0x000F0044
| float32
| VIEWPORT_HEIGHT_INV. See command set 0x000F0041.
|-
| 0x801F004D
|
| See command set 0x801F004D.
|-
| 0x000F0068
| u32
| VIEWPORT Y/X. See command set 0x000F0041.
|-
| 0x000F006D
|
| See command set 0x801F004D.
|-
| 0x000F006E
| u32
| See command set 0x000F0111.
|-
| 0x00010080
| u32
| See command set 0x00030080.
|-
| 0x00030080
| u32
| See command set 0x00030080.
|-
| 0x00040080
| u32
| See command set 0x00030080.
|-
| 0x809F0081
|
| This is used to set the current texture info used for rendering, see command set [[GPU_Textures|0x809F0081]].
|-
| 0x000F008E
| u32 color type
| This command sets the texture color type, see command set [[GPU_Textures|0x809F0081]].
|-
| 0x805F0091
|
| This sets current texture info, see command [[GPU_Textures|0x805F0091]].
|-
| 0x805F0099
|
| This sets current texture info, see command [[GPU_Textures|0x805F0099]].
|-
| 0x800F00C3
| val<<24
| Val is usually 0xFF or 0x00, however 0x00-0xFF is valid as well. This is alpha-blending related?
|-
| 0x800F00CB
| val<<24
| Val is usually 0xFF or 0x00, however 0x00-0xFF is valid as well. This is alpha-blending related?
|-
| 0x80XF00C0
|
| See command set 0x80XF00C0.
|-
| 0x800F00C4
|
| See command set 0x80XF00C0.
|-
| 0x80XF00C8
|
| See command set 0x80XF00C0.
|-
| 0x800F00CC
|
| See command set 0x80XF00C0.
|-
| 0x80XF00D0
|
| See command set 0x80XF00C0.
|-
| 0x800F00D4
|
| See command set 0x80XF00C0.
|-
| 0x80XF00D8
|
| See command set 0x80XF00C0.
|-
| 0x800F00DC
|
| See command set 0x80XF00C0.
|-
| 0x80XF00F0
|
| See command set 0x80XF00C0.
|-
| 0x800F00F4
|
| See command set 0x80XF00C0.
|-
| 0x80XF00F8
|
| See command set 0x80XF00C0.
|-
| 0x800F00FC
|
| See command set 0x80XF00C0.
|-
| 0x000100E0
| Normally value zero.
| Unknown, fragment related?
|-
| 0x000500E0
|
| See command set 0x000500E0.
|-
| 0x000F00E1
|
| See command set 0x000500E0.
|-
| 0x000F00E6
| Value zero
| See command set 0x000F00E6.
|-
| 0x000F00E8
|
| See command set 0x000F00E6.
|-
| 0x00020100
| u32, value is 0x00E40100
| See command set 0x00020100.
|-
| 0x000D0100
| <nowiki>0x00E40000 | val</nowiki>.
| Val0 = unknown, val1 = unknown, val3 = unknown. The default val used here is 0.
|-
| 0x000F0101
| u32
| See command set 0x00020100.
|-
| 0x000F0103
|
| See command set 0x00020100.
|-
| 0x000F0104
| u32
| glAlphaFunc()
|-
| 0x00010107
|
| See command set CmdID 0x00010107.
|-
| 0x00020107
|
| See command set CmdID 0x00010107.
|-
| 0x00030107
|
| See command set CmdID 0x00030107.
|-
| 0x000F0116
| u32
| DEPTHBUFFER FORMAT. See command set 0x000F0111.
|-
| 0x000F0117
| u32
| COLORBUFFER FORMAT/PIXEL. See command set 0x000F0111.
|-
| 0x000F011C
| Physical address>>3
| DEPTHBUFFER ADDRESS. See command set 0x000F0111.
|-
| 0x000F011D
| Physical address>>3
| COLORBUFFER ADDRESS. See command set 0x000F0111.
|-
| 0x000F011E
| u32
| COLORBUFFER HEIGHT/WIDTH. See command set 0x000F0111.
|-
| 0x803F0112
|
| ?
|-
| 0x826F0200
|
| See command set [[GPU_GL_Arrays|0x826F0200]].
|-
| 0x00080126
|
| See command set CmdID 0x00030107.
|-
| 0x000F0227
| u32
| This specifies the address of an array containing vertex array indices, and the data-type of the indices, used for rendering primitives. See command set [[GPU_GL_Arrays|glDrawElements()]].
|-
| 0x000F0228
| u32 total elements in the array to use for rendering.
| See command set [[GPU_GL_Arrays|glDrawElements()]].
|-
| 0x803F0232
|
| See command set [[GPU_GL_Arrays|0x826F0200]].
|-
| 0x0002025E
| u32, val<<8.
| This sets the GL rendering mode, see command set [[GPU_GL_Arrays|0x826F0200]].
|-
| 0x000F02B0
| u32, value is <nowiki>0x7FFF0000 | val</nowiki>.
| Texture related?
|-
| 0x801F02BB
|
| See command set [[GPU_GL_Arrays|0x826F0200]].
|-
| 0x000F02C0
| <nowiki>0x80000000 | Type</nowiki>
| This is used immediately before CmdID 0xXXXF02C1. This type field controls the command parameter buffer type.
|-
| 0xXXXF02C1
| First word in the first entry
| A list of entries follow this command.
|}

==== Command Sets ====

===== glDrawElements() =====
See [[GPU_GL_Arrays|GPU GL Arrays]].

===== glClear() / glClearColor() =====
The GPU does not have dedicated commands for clearing the color buffer, therefore applications implement color buffer clearing by rendering a quad. Applications normally store this vertex and color [[GPU_GL_Arrays|array]] in the GSP application heap.

===== CmdID 0x809F0081 =====
This sets current texture info, see [[GPU Textures|GPU textures]].

===== CmdID 0x00030080 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x00030080
| <nowiki>0x11000 | val</nowiki>, where only bits 2-1 are used in val.
| ?
|-
| 0
| 0x00040080
| Same value as CmdID 0x00030080.
| ?
|-
| 0
| 0x00010080
| Same value as CmdID 0x00030080.
| ?
|}

===== CmdID 0x80XF00C0 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| <nowiki>0x802F0000 | SlotCmdID</nowiki>
|
|
|-
| 1
| <nowiki>0x800F0000 | SlotCmdID + 4</nowiki>
|
|
|}

This is used for glTexEnv(), for the slot indicated by the CmdID. There's a total of 6 slots, where each slot corresponds to the following u16 CmdIDs: 0xC0, 0xC8, 0xD0, 0xD8, 0xF0, 0xF8.

===== CmdID 0x000500E0 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x000500E0
| <nowiki>5 | val<<16</nowiki>, where val is 0 or 1.
| Val0 = enable, val1 = disable.
|-
| 1
| 0x000F00E1
|
| This specifies a color.
|}

This is usually used immediately after command set glDrawElements(). This is used to specify a color used for blending?

===== CmdID 0x000F00E6 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x000F00E6
| Value 0
| ?
|-
| 1
| 0x000F00E8
|
|
|}

This is usually the last command set used for rendering a mesh, when command set 0x000500E0 was used. This command set is used immediately after command set 0x000500E0.

===== CmdID 0x00020100 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x00020100
| Value 0x00E40100
| ?
|-
| 1
| 0x000F0101
| 0x01010000 when disabled?
| ?
|-
| 2
| 0x000F0103
| This is set to zero when the Cmd 0x000F0101 parameter is value 0x01010000.
| ?
|}

This is fragment related?

===== CmdID 0x801F004D =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x801F004D
|
| glDepthRange()
|-
| 1
| 0x000F006D
| 0 = unknown, 1 = unknown.
| Value zero causes the mesh to not be rendered.
|}

===== CmdID 0x000F0041 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x000F0041
| float
| This corresponds to the framebuffer width.
|-
| 1
| 0x000F0043
| float
| This parameter value is calculated the same way as the CmdID 0x000F0041 parameter, except the framebuffer height is used instead.
|-
| 2
| 0x000F0042
| float
| This corresponds to the framebuffer width.
|-
| 3
| 0x000F0044
| float
| This parameter value value is calculated the same way as the CmdID 0x000F0042 parameter, except the framebuffer height is used instead.
|-
| 4
| 0x000F0068
| u32
| This sets the X/Y coordinates used for glViewport().
|}

This command set initializes the projection matrix. This command set is used twice when beginning rendering for each screen. The framebuffer width used here for the main screen is 240, however this is 480 with stereoscopy enabled for the second time this command set is used.

===== CmdID 0x000F0111 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x000F0111
| Value 1
|
|-
| 1
| 0x000F0110
| Value 1
|
|-
| 2
| 0x000F0117
| Bits15-0 = unk, 31-16 = unk.
| Unknown, normally the input parameter is value 0x2.
|-
| 3
| 0x000F011D
| Physical address>>3
| This initializes the framebuffer address used for rendering, this framebuffer is used for the input framebuffer with [[GSP_Shared_Memory|GX command]] 3 and 4. This command is used immediately after CmdID 0x000F0117.
|-
| 4
| 0x000F0116
|
| ?
|-
| 5
| 0x000F011C
| Physical address>>3
| Unknown, normally this address is located in VRAM.
|-
| 6
| 0x000F011E
| u32
| This sets the width and height for the framebuffer used for rendering. Therefore this is glViewport(), x/y are specified by CmdID 0x000F0068.
|-
| 7
| 0x000F006E
| Same input parameter value as CmdID 0x000F011E.
|
|}

This command set is normally used after the two 0x000F0041 command sets.

===== CmdID 0x00030107 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x00030107
|
|
|-
| 1
| 0x00080126
| type<<24
|
|}

This command set is used for disabling the alpha-blending info set by command set 0x00010107? The GL AlphaFunction used here is normally GL_ALWAYS.

===== CmdID 0x00010107 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x00010107
| Same format as CmdID 0x00030107.
|
|-
| 1
| 0x00080126
| type<<24
|
|-
| 0
| 0x00020107
| Same value as CmdID 0x00010107.
|
|}

=== Parameter format for CmdIDs 0x00030107, 0x00020107, and 0x00010107 ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| 0 = disable GL_ALPHA_TEST, 1 = enable GL_ALPHA_TEST
|-
| 3-1
| Unused?
|-
| 7-4
| Alpha function
|-
| 11-8
| Color to blend with?
|-
| 12
| ?
|-
| 31-13
| Unused
|}

==== Alpha function values ====
{| class="wikitable" border="1"
! Value
! GL AlphaFunction
|-
| 0
| GL_NEVER
|-
| 1
| GL_ALWAYS
|-
| 2
| GL_EQUAL
|-
| 3
| GL_NOTEQUAL
|-
| 4
| GL_LESS
|-
| 5
| GL_LEQUAL
|-
| 6
| GL_GREATER
|-
| 7
| GL_GEQUAL
|}

=== Alpha types for CmdID 0x00080126 ===
{| class="wikitable" border="1"
! Type
! GL AlphaFunction
|-
| 0
| GL_NEVER
|-
| 1
| GL_ALWAYS
|-
| 2
| GL_GREATER/GL_GEQUAL
|-
| 3
| The remaining GL alpha functions.
|}

=== Parameter value format for CmdID 0x000F0104 ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| 0 = disable GL_ALPHA_TEST, 1 = enable GL_ALPHA_TEST
|-
| 3-1
| Unused?
|-
| 7-4
| Alpha function
|-
| 15-8
| u8 ref, range is 0-255
|-
| 31-16
| Unused?
|}

This is glAlphaFunc().

=== Parameter value format for CmdID 0x000F011E ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 11-0
| Framebuffer/viewport width
|-
| 23-12
| Framebuffer/viewport height - 1
|-
| 24
| Must be set
|-
| 31-25
| Unused?
|}

This specifies the width/height for glViewport(). Normally the framebuffer width and height is set to the same [[GPU|dimensions]] used with GX [[GSP_Shared_Memory|command]] 3 and 4.

=== Parameter value format for CmdID 0x000F0068 ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 15-0
| X
|-
| 31-16
| Y
|}

This specifies the X/Y coordinates for glViewport().

=== Parameter structure for CmdID 0x804F00C0 ===
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| Value 0xFFF0FFF / 0x0
|-
| 1
| Value 0x0
|-
| 2
| Value 0x0
|-
| 3
| Value 0xFFFFFFFF
|-
| 4
| Value 0x0
|}

This individual command is used instead of the 0x80XF00C0 command set when none of the associated rendering parameters for this slot are set.

=== Parameter structure for CmdID 0x802F00C0 ===
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| Param0
|-
| 1
| Param1
|-
| 2
| Param2
|}

See command set 0x80XF00C0.

==== Param0 format for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Bit
! Description
|-
| 3-0
| See below values.(Field0 index0)
|-
| 7-4
| See below values.(Field0 index1)
|-
| 11-8
| See below values.(Field0 index2)
|-
| 15-12
| Unused
|-
| 19-16
| See below values.(Field1 index0)
|-
| 23-20
| See below values.(Field1 index1)
|-
| 27-24
| See below values.(Field1 index2)
|-
| 31-28
| Unused
|}

==== Param0 values for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Value
! GL type
|-
| 0x0
| GL_PRIMARY_COLOR
|-
| 0x1
| ?
|-
| 0x2
| ?
|-
| 0x3
| GL_TEXTURE0
|-
| 0x4
| GL_TEXTURE1
|-
| 0x5
| GL_TEXTURE2
|-
| 0x6
| GL_TEXTURE3
|-
| 0xC-0x7
| GL_PRIMARY_COLOR
|-
| 0xD
| ?
|-
| 0xE
| GL_CONSTANT
|-
| 0xF
| GL_PREVIOUS
|}

==== Param1 format for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Bit
! Description
|-
| 3-0
| See below values for field0.(Index0)
|-
| 7-4
| See below values for field0.(Index1)
|-
| 11-8
| See below values for field0.(Index2)
|-
| 15-12
| See below values for field1.(Index0)
|-
| 19-16
| See below values for field1.(Index1)
|-
| 23-20
| See below values for field1.(Index2)
|-
| 31-24
| Unused
|}

This specifies the pname for glTexEnv().

==== Param1 field0 values for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Value
! GL type
|-
| 0x0
| GL_SRC_COLOR
|-
| 0x1
| GL_ONE_MINUS_SRC_COLOR
|-
| 0x2
| GL_SRC_ALPHA
|-
| 0x3
| GL_ONE_MINUS_SRC_ALPHA
|-
| 0x4
| GL_SRC0_RGB
|-
| 0x5
| ?
|-
| 0x6
| GL_SRC_COLOR
|-
| 0x7
| GL_SRC_COLOR
|-
| 0x8
| GL_SRC1_RGB
|-
| 0x9
| ?
|-
| 0xA
| GL_SRC_COLOR
|-
| 0xB
| GL_SRC_COLOR
|-
| 0xC
| GL_SRC2_RGB
|-
| 0xD
| ?
|}

==== Param1 field1 values for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Value
! GL type
|-
| 0x0
| GL_SRC_ALPHA
|-
| 0x1
| GL_ONE_MINUS_SRC_ALPHA
|-
| 0x2
| GL_SRC0_RGB
|-
| 0x3
| ?
|-
| 0x4
| GL_SRC1_RGB
|-
| 0x5
| ?
|-
| 0x6
| GL_SRC2_RGB
|-
| 0x7
| ?
|}

==== Param2 format for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Bit
! Description
|-
| 15-0
| See below field0 values.
|-
| 31-16
| See below field1 values.
|}

This is used to specify the param for glTexEnv(..., ..., param).

==== Param2 field0 values for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Value
! GL type
|-
| 0x0
| GL_REPLACE
|-
| 0x1
| GL_MODULATE
|-
| 0x2
| GL_ADD
|-
| 0x3
| GL_ADD_SIGNED
|-
| 0x4
| GL_INTERPOLATE
|-
| 0x5
| GL_SUBTRACT
|-
| 0x6
| GL_DOT3_RGB
|-
| 0x7
| GL_DOT3_RGBA
|-
| 0x8
| ?
|-
| 0x9
| ?
|}

==== Param2 field1 values for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Value
! GL type
|-
| 0x0
| GL_REPLACE
|-
| 0x1
| GL_MODULATE
|-
| 0x2
| GL_ADD
|-
| 0x3
| GL_ADD_SIGNED
|-
| 0x4
| GL_INTERPOLATE
|-
| 0x5
| GL_SUBTRACT
|-
| 0x6
| GL_REPLACE
|-
| 0x7
| GL_DOT3_RGB
|-
| 0x8
| ?
|-
| 0x9
| ?
|}

=== Parameter value format for CmdID 0x800F00C4 ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 15-0
| Valid values: 0=unknown, 1=unknown, 2=unknown.
|-
| 31-16
| Same format as bits15-0.
|}

See command set 0x80XF00C0.

=== Parameter value format for CmdID 0x000F00E1 ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 7-0
| Red component
|-
| 15-8
| Green component
|-
| 23-16
| Blue component
|-
| 31-24
| Unused
|}

=== Parameter value format for CmdID 0x000F0101 ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 7-0
| ?
|-
| 15-8
| ?
|-
| 19-16
| ?
|-
| 23-20
| ?
|-
| 27-24
| ?
|-
| 31-28
| ?
|}

=== Parameter structure for CmdID 0x801F004D ===
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| float far
|-
| 1
| float near
|}

This is glDepthRange().

=== Parameter structure for CmdID 0x000F00E8 ===
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0x7D-0x00
| Usually value 0x00FFE000.
|-
| 0x7E
| Usually value 0x00FFFEE6?
|-
| 0x7F
| Usually value 0x00DCD919?
|}

=== Parameter structure for CmdID 0x803F0112 ===
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| 0x0 = unknown, 0xF = unknown. Only bits 3-0 are used.(Values 0x1-0xF all have the same effect)
|-
| 1
| 0x0 = unknown, 0xF = unknown. Only bits 3-0 are used.
|-
| 2
| 0x0 = unknown, 0x2 = unknown. Only bits 1-0 are used.(Values 0x1-0x3 all have the same effect)
|-
| 3
| 0x0 = unknown, 0x2 = unknown. Only bits 1-0 are used.(Values 0x1-0x3 all have the same effect)
|}

=== Entries for CmdID 0xXXXF02C1 ===
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| float, the GPU handles this as the 4th word.
|-
| 1
| float, the GPU handles this as the 3rd word.
|-
| 2
| float, the GPU handles this as the 2nd word.
|-
| 3
| float, the GPU handles this as the 1st word.
|}

The below entry structure info is in the raw order used for the command, not the order used by the GPU.

==== Color Entry ====
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| float Red component
|-
| 1
| float Blue component
|-
| 2
| float Green component
|-
| 3
| float Alpha
|}

==== Lighting Color Entry ====
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| float Alpha
|-
| 1
| float Blue component
|-
| 2
| float Green component
|-
| 3
| float Red component
|}

=== Types for CmdID 0x000F02C0 ===
{| class="wikitable" border="1"
! Value
! Entries per chunk
! Description
|-
| 0x00
| 4
| This specifies 16-floats for a 4x4 matrix, used for glLoadMatrix() for the projection matrix.
|-
| 0x04
| 4
| This specifies a 4x4 matrix, used for glLoadMatrix() for the model-view matrix. This is usually an identity matrix.
|-
| 0x08
| 2
| Sets the color.
|-
| 0x0A
| 4
| Specifies a 4x4 matrix, used for glLoadMatrix() for the texture matrix.(Index0)
|-
| 0x0E
| 3
| Specifies a 4x3 texture matrix.(Index1)
|-
| 0x11
| 3
| Specifies a 4x3 texture matrix.(Index2)
|-
| 0x14
| <=30
| Used to specify a 4xN matrix, where N is the total CmdID 0xXXXF02C1 entries. This is glMultMatrix() for the model-view matrix, except the input matrix is 4xN instead of 4x4.
|-
| 0x4C
| 4
| This specifies a 4x4 float matrix.
|-
| 0x50, 0x53, and 0x56
| 1
| This specifies the GL_LIGHT0-2 color for GL_AMBIENT?
|-
| 0x51, 0x54, and 0x57
| 1
| This specifies the GL_LIGHT0-2 color for GL_DIFFUSE?
|-
| 0x52, 0x55, and 0x58
| 1
| This specifies the GL_LIGHT0-2 color for GL_SPECULAR?
|-
| 0x59
| 1
| Unknown, the entry data is floats converted from s32s. Usually each entry word is zeros.
|-
| 0x5A
| 2
| Color related?
|-
| 0x5C
| 1
| ?
|}

The matrices for types 0x00 and 0x04 use row-major order, instead of column-major order.

GPU/Commands

2013-04-18T23:43:12Z

Neimod:

This page describes the structure of the buffer for [[GSP_Shared_Memory|GX command]] 1 with the registers at [[GPU|0x1EF018E0]]. This buffer is used for GPU commands including OpenGL commands, each 8-byte entry in the buffer is a command. Cmd+0 is the command parameter, and cmd+4 is the command header.

Invalid GPU command parameters including NaN floats can cause the GPU to hang, this then causes the GSP module to hang as well.

=== Command Header ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 19-0
| Command ID
|-
| 30-20
| Total words following the command, if any.
|-
| 31
| ?
|}
The first word in the parameter data structure is the command parameter value, the rest of the data structure is from the data following the command. The word after the last data structure word is padding when needed for 8-byte alignment, for the following command.

=== Commands ===
{| class="wikitable" border="1"
! CommandID
! Parameter
! Description
|-
| 0x000F0010
| Value is 0x12345678
| This command is always the last command in the buffer.
|-
| 0x000F0110
| Value 0x1
| This command is immediately before CmdID 0x000F0010, this is also used elsewhere for beginning rendering of mesh(es) as well.
|-
| 0x000F0111
| Value 0x1
| This command is immediately before CmdID 0x000F0110, however CmdID 0x000F0110 doesn't always follow this command.
|-
| 0x000F0040
| u32, valid values are 0x1 and 0x2, values 0x0 and 0x3 have the same effect as value 0x2. Only bits 1-0 are used.
| Value 2 = GL_FRONT/GL_CW or GL_BACK/GL_CCW. Value 1 = GL_FRONT/GL_CCW or GL_BACK/GL_CW.
|-
| 0x000F0041
| float24
| VIEWPORT_WIDTH. See command set 0x000F0041.
|-
| 0x000F0042
| float32
| VIEWPORT_WIDTH_INV. See command set 0x000F0041.
|-
| 0x000F0043
| float24
| VIEWPORT_HEIGHT. See command set 0x000F0041.
|-
| 0x000F0044
| float32
| VIEWPORT_HEIGHT_INV. See command set 0x000F0041.
|-
| 0x801F004D
|
| See command set 0x801F004D.
|-
| 0x000F0068
| u32
| VIEWPORT X/Y. See command set 0x000F0041.
|-
| 0x000F006D
|
| See command set 0x801F004D.
|-
| 0x000F006E
| u32
| See command set 0x000F0111.
|-
| 0x00010080
| u32
| See command set 0x00030080.
|-
| 0x00030080
| u32
| See command set 0x00030080.
|-
| 0x00040080
| u32
| See command set 0x00030080.
|-
| 0x809F0081
|
| This is used to set the current texture info used for rendering, see command set [[GPU_Textures|0x809F0081]].
|-
| 0x000F008E
| u32 color type
| This command sets the texture color type, see command set [[GPU_Textures|0x809F0081]].
|-
| 0x805F0091
|
| This sets current texture info, see command [[GPU_Textures|0x805F0091]].
|-
| 0x805F0099
|
| This sets current texture info, see command [[GPU_Textures|0x805F0099]].
|-
| 0x800F00C3
| val<<24
| Val is usually 0xFF or 0x00, however 0x00-0xFF is valid as well. This is alpha-blending related?
|-
| 0x800F00CB
| val<<24
| Val is usually 0xFF or 0x00, however 0x00-0xFF is valid as well. This is alpha-blending related?
|-
| 0x80XF00C0
|
| See command set 0x80XF00C0.
|-
| 0x800F00C4
|
| See command set 0x80XF00C0.
|-
| 0x80XF00C8
|
| See command set 0x80XF00C0.
|-
| 0x800F00CC
|
| See command set 0x80XF00C0.
|-
| 0x80XF00D0
|
| See command set 0x80XF00C0.
|-
| 0x800F00D4
|
| See command set 0x80XF00C0.
|-
| 0x80XF00D8
|
| See command set 0x80XF00C0.
|-
| 0x800F00DC
|
| See command set 0x80XF00C0.
|-
| 0x80XF00F0
|
| See command set 0x80XF00C0.
|-
| 0x800F00F4
|
| See command set 0x80XF00C0.
|-
| 0x80XF00F8
|
| See command set 0x80XF00C0.
|-
| 0x800F00FC
|
| See command set 0x80XF00C0.
|-
| 0x000100E0
| Normally value zero.
| Unknown, fragment related?
|-
| 0x000500E0
|
| See command set 0x000500E0.
|-
| 0x000F00E1
|
| See command set 0x000500E0.
|-
| 0x000F00E6
| Value zero
| See command set 0x000F00E6.
|-
| 0x000F00E8
|
| See command set 0x000F00E6.
|-
| 0x00020100
| u32, value is 0x00E40100
| See command set 0x00020100.
|-
| 0x000D0100
| <nowiki>0x00E40000 | val</nowiki>.
| Val0 = unknown, val1 = unknown, val3 = unknown. The default val used here is 0.
|-
| 0x000F0101
| u32
| See command set 0x00020100.
|-
| 0x000F0103
|
| See command set 0x00020100.
|-
| 0x000F0104
| u32
| glAlphaFunc()
|-
| 0x00010107
|
| See command set CmdID 0x00010107.
|-
| 0x00020107
|
| See command set CmdID 0x00010107.
|-
| 0x00030107
|
| See command set CmdID 0x00030107.
|-
| 0x000F0116
| u32
| See command set 0x000F0111.
|-
| 0x000F0117
| u32
| See command set 0x000F0111.
|-
| 0x000F011C
| Physical address>>3
| See command set 0x000F0111.
|-
| 0x000F011D
| Physical address>>3
| See command set 0x000F0111.
|-
| 0x000F011E
| u32
| See command set 0x000F0111.
|-
| 0x803F0112
|
| ?
|-
| 0x826F0200
|
| See command set [[GPU_GL_Arrays|0x826F0200]].
|-
| 0x00080126
|
| See command set CmdID 0x00030107.
|-
| 0x000F0227
| u32
| This specifies the address of an array containing vertex array indices, and the data-type of the indices, used for rendering primitives. See command set [[GPU_GL_Arrays|glDrawElements()]].
|-
| 0x000F0228
| u32 total elements in the array to use for rendering.
| See command set [[GPU_GL_Arrays|glDrawElements()]].
|-
| 0x803F0232
|
| See command set [[GPU_GL_Arrays|0x826F0200]].
|-
| 0x0002025E
| u32, val<<8.
| This sets the GL rendering mode, see command set [[GPU_GL_Arrays|0x826F0200]].
|-
| 0x000F02B0
| u32, value is <nowiki>0x7FFF0000 | val</nowiki>.
| Texture related?
|-
| 0x801F02BB
|
| See command set [[GPU_GL_Arrays|0x826F0200]].
|-
| 0x000F02C0
| <nowiki>0x80000000 | Type</nowiki>
| This is used immediately before CmdID 0xXXXF02C1. This type field controls the command parameter buffer type.
|-
| 0xXXXF02C1
| First word in the first entry
| A list of entries follow this command.
|}

==== Command Sets ====

===== glDrawElements() =====
See [[GPU_GL_Arrays|GPU GL Arrays]].

===== glClear() / glClearColor() =====
The GPU does not have dedicated commands for clearing the color buffer, therefore applications implement color buffer clearing by rendering a quad. Applications normally store this vertex and color [[GPU_GL_Arrays|array]] in the GSP application heap.

===== CmdID 0x809F0081 =====
This sets current texture info, see [[GPU Textures|GPU textures]].

===== CmdID 0x00030080 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x00030080
| <nowiki>0x11000 | val</nowiki>, where only bits 2-1 are used in val.
| ?
|-
| 0
| 0x00040080
| Same value as CmdID 0x00030080.
| ?
|-
| 0
| 0x00010080
| Same value as CmdID 0x00030080.
| ?
|}

===== CmdID 0x80XF00C0 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| <nowiki>0x802F0000 | SlotCmdID</nowiki>
|
|
|-
| 1
| <nowiki>0x800F0000 | SlotCmdID + 4</nowiki>
|
|
|}

This is used for glTexEnv(), for the slot indicated by the CmdID. There's a total of 6 slots, where each slot corresponds to the following u16 CmdIDs: 0xC0, 0xC8, 0xD0, 0xD8, 0xF0, 0xF8.

===== CmdID 0x000500E0 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x000500E0
| <nowiki>5 | val<<16</nowiki>, where val is 0 or 1.
| Val0 = enable, val1 = disable.
|-
| 1
| 0x000F00E1
|
| This specifies a color.
|}

This is usually used immediately after command set glDrawElements(). This is used to specify a color used for blending?

===== CmdID 0x000F00E6 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x000F00E6
| Value 0
| ?
|-
| 1
| 0x000F00E8
|
|
|}

This is usually the last command set used for rendering a mesh, when command set 0x000500E0 was used. This command set is used immediately after command set 0x000500E0.

===== CmdID 0x00020100 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x00020100
| Value 0x00E40100
| ?
|-
| 1
| 0x000F0101
| 0x01010000 when disabled?
| ?
|-
| 2
| 0x000F0103
| This is set to zero when the Cmd 0x000F0101 parameter is value 0x01010000.
| ?
|}

This is fragment related?

===== CmdID 0x801F004D =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x801F004D
|
| glDepthRange()
|-
| 1
| 0x000F006D
| 0 = unknown, 1 = unknown.
| Value zero causes the mesh to not be rendered.
|}

===== CmdID 0x000F0041 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x000F0041
| float
| This corresponds to the framebuffer width.
|-
| 1
| 0x000F0043
| float
| This parameter value is calculated the same way as the CmdID 0x000F0041 parameter, except the framebuffer height is used instead.
|-
| 2
| 0x000F0042
| float
| This corresponds to the framebuffer width.
|-
| 3
| 0x000F0044
| float
| This parameter value value is calculated the same way as the CmdID 0x000F0042 parameter, except the framebuffer height is used instead.
|-
| 4
| 0x000F0068
| u32
| This sets the X/Y coordinates used for glViewport().
|}

This command set initializes the projection matrix. This command set is used twice when beginning rendering for each screen. The framebuffer width used here for the main screen is 240, however this is 480 with stereoscopy enabled for the second time this command set is used.

===== CmdID 0x000F0111 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x000F0111
| Value 1
|
|-
| 1
| 0x000F0110
| Value 1
|
|-
| 2
| 0x000F0117
| Bits15-0 = unk, 31-16 = unk.
| Unknown, normally the input parameter is value 0x2.
|-
| 3
| 0x000F011D
| Physical address>>3
| This initializes the framebuffer address used for rendering, this framebuffer is used for the input framebuffer with [[GSP_Shared_Memory|GX command]] 3 and 4. This command is used immediately after CmdID 0x000F0117.
|-
| 4
| 0x000F0116
|
| ?
|-
| 5
| 0x000F011C
| Physical address>>3
| Unknown, normally this address is located in VRAM.
|-
| 6
| 0x000F011E
| u32
| This sets the width and height for the framebuffer used for rendering. Therefore this is glViewport(), x/y are specified by CmdID 0x000F0068.
|-
| 7
| 0x000F006E
| Same input parameter value as CmdID 0x000F011E.
|
|}

This command set is normally used after the two 0x000F0041 command sets.

===== CmdID 0x00030107 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x00030107
|
|
|-
| 1
| 0x00080126
| type<<24
|
|}

This command set is used for disabling the alpha-blending info set by command set 0x00010107? The GL AlphaFunction used here is normally GL_ALWAYS.

===== CmdID 0x00010107 =====
{| class="wikitable" border="1"
! Command Index
! CommandID
! Parameter
! Description
|-
| 0
| 0x00010107
| Same format as CmdID 0x00030107.
|
|-
| 1
| 0x00080126
| type<<24
|
|-
| 0
| 0x00020107
| Same value as CmdID 0x00010107.
|
|}

=== Parameter format for CmdIDs 0x00030107, 0x00020107, and 0x00010107 ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| 0 = disable GL_ALPHA_TEST, 1 = enable GL_ALPHA_TEST
|-
| 3-1
| Unused?
|-
| 7-4
| Alpha function
|-
| 11-8
| Color to blend with?
|-
| 12
| ?
|-
| 31-13
| Unused
|}

==== Alpha function values ====
{| class="wikitable" border="1"
! Value
! GL AlphaFunction
|-
| 0
| GL_NEVER
|-
| 1
| GL_ALWAYS
|-
| 2
| GL_EQUAL
|-
| 3
| GL_NOTEQUAL
|-
| 4
| GL_LESS
|-
| 5
| GL_LEQUAL
|-
| 6
| GL_GREATER
|-
| 7
| GL_GEQUAL
|}

=== Alpha types for CmdID 0x00080126 ===
{| class="wikitable" border="1"
! Type
! GL AlphaFunction
|-
| 0
| GL_NEVER
|-
| 1
| GL_ALWAYS
|-
| 2
| GL_GREATER/GL_GEQUAL
|-
| 3
| The remaining GL alpha functions.
|}

=== Parameter value format for CmdID 0x000F0104 ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| 0 = disable GL_ALPHA_TEST, 1 = enable GL_ALPHA_TEST
|-
| 3-1
| Unused?
|-
| 7-4
| Alpha function
|-
| 15-8
| u8 ref, range is 0-255
|-
| 31-16
| Unused?
|}

This is glAlphaFunc().

=== Parameter value format for CmdID 0x000F011E ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 11-0
| Framebuffer/viewport width
|-
| 23-12
| Framebuffer/viewport height - 1
|-
| 24
| Must be set
|-
| 31-25
| Unused?
|}

This specifies the width/height for glViewport(). Normally the framebuffer width and height is set to the same [[GPU|dimensions]] used with GX [[GSP_Shared_Memory|command]] 3 and 4.

=== Parameter value format for CmdID 0x000F0068 ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 15-0
| X
|-
| 31-16
| Y
|}

This specifies the X/Y coordinates for glViewport().

=== Parameter structure for CmdID 0x804F00C0 ===
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| Value 0xFFF0FFF / 0x0
|-
| 1
| Value 0x0
|-
| 2
| Value 0x0
|-
| 3
| Value 0xFFFFFFFF
|-
| 4
| Value 0x0
|}

This individual command is used instead of the 0x80XF00C0 command set when none of the associated rendering parameters for this slot are set.

=== Parameter structure for CmdID 0x802F00C0 ===
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| Param0
|-
| 1
| Param1
|-
| 2
| Param2
|}

See command set 0x80XF00C0.

==== Param0 format for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Bit
! Description
|-
| 3-0
| See below values.(Field0 index0)
|-
| 7-4
| See below values.(Field0 index1)
|-
| 11-8
| See below values.(Field0 index2)
|-
| 15-12
| Unused
|-
| 19-16
| See below values.(Field1 index0)
|-
| 23-20
| See below values.(Field1 index1)
|-
| 27-24
| See below values.(Field1 index2)
|-
| 31-28
| Unused
|}

==== Param0 values for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Value
! GL type
|-
| 0x0
| GL_PRIMARY_COLOR
|-
| 0x1
| ?
|-
| 0x2
| ?
|-
| 0x3
| GL_TEXTURE0
|-
| 0x4
| GL_TEXTURE1
|-
| 0x5
| GL_TEXTURE2
|-
| 0x6
| GL_TEXTURE3
|-
| 0xC-0x7
| GL_PRIMARY_COLOR
|-
| 0xD
| ?
|-
| 0xE
| GL_CONSTANT
|-
| 0xF
| GL_PREVIOUS
|}

==== Param1 format for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Bit
! Description
|-
| 3-0
| See below values for field0.(Index0)
|-
| 7-4
| See below values for field0.(Index1)
|-
| 11-8
| See below values for field0.(Index2)
|-
| 15-12
| See below values for field1.(Index0)
|-
| 19-16
| See below values for field1.(Index1)
|-
| 23-20
| See below values for field1.(Index2)
|-
| 31-24
| Unused
|}

This specifies the pname for glTexEnv().

==== Param1 field0 values for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Value
! GL type
|-
| 0x0
| GL_SRC_COLOR
|-
| 0x1
| GL_ONE_MINUS_SRC_COLOR
|-
| 0x2
| GL_SRC_ALPHA
|-
| 0x3
| GL_ONE_MINUS_SRC_ALPHA
|-
| 0x4
| GL_SRC0_RGB
|-
| 0x5
| ?
|-
| 0x6
| GL_SRC_COLOR
|-
| 0x7
| GL_SRC_COLOR
|-
| 0x8
| GL_SRC1_RGB
|-
| 0x9
| ?
|-
| 0xA
| GL_SRC_COLOR
|-
| 0xB
| GL_SRC_COLOR
|-
| 0xC
| GL_SRC2_RGB
|-
| 0xD
| ?
|}

==== Param1 field1 values for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Value
! GL type
|-
| 0x0
| GL_SRC_ALPHA
|-
| 0x1
| GL_ONE_MINUS_SRC_ALPHA
|-
| 0x2
| GL_SRC0_RGB
|-
| 0x3
| ?
|-
| 0x4
| GL_SRC1_RGB
|-
| 0x5
| ?
|-
| 0x6
| GL_SRC2_RGB
|-
| 0x7
| ?
|}

==== Param2 format for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Bit
! Description
|-
| 15-0
| See below field0 values.
|-
| 31-16
| See below field1 values.
|}

This is used to specify the param for glTexEnv(..., ..., param).

==== Param2 field0 values for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Value
! GL type
|-
| 0x0
| GL_REPLACE
|-
| 0x1
| GL_MODULATE
|-
| 0x2
| GL_ADD
|-
| 0x3
| GL_ADD_SIGNED
|-
| 0x4
| GL_INTERPOLATE
|-
| 0x5
| GL_SUBTRACT
|-
| 0x6
| GL_DOT3_RGB
|-
| 0x7
| GL_DOT3_RGBA
|-
| 0x8
| ?
|-
| 0x9
| ?
|}

==== Param2 field1 values for CmdID 0x802F00C0 ====
{| class="wikitable" border="1"
! Value
! GL type
|-
| 0x0
| GL_REPLACE
|-
| 0x1
| GL_MODULATE
|-
| 0x2
| GL_ADD
|-
| 0x3
| GL_ADD_SIGNED
|-
| 0x4
| GL_INTERPOLATE
|-
| 0x5
| GL_SUBTRACT
|-
| 0x6
| GL_REPLACE
|-
| 0x7
| GL_DOT3_RGB
|-
| 0x8
| ?
|-
| 0x9
| ?
|}

=== Parameter value format for CmdID 0x800F00C4 ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 15-0
| Valid values: 0=unknown, 1=unknown, 2=unknown.
|-
| 31-16
| Same format as bits15-0.
|}

See command set 0x80XF00C0.

=== Parameter value format for CmdID 0x000F00E1 ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 7-0
| Red component
|-
| 15-8
| Green component
|-
| 23-16
| Blue component
|-
| 31-24
| Unused
|}

=== Parameter value format for CmdID 0x000F0101 ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 7-0
| ?
|-
| 15-8
| ?
|-
| 19-16
| ?
|-
| 23-20
| ?
|-
| 27-24
| ?
|-
| 31-28
| ?
|}

=== Parameter structure for CmdID 0x801F004D ===
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| float far
|-
| 1
| float near
|}

This is glDepthRange().

=== Parameter structure for CmdID 0x000F00E8 ===
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0x7D-0x00
| Usually value 0x00FFE000.
|-
| 0x7E
| Usually value 0x00FFFEE6?
|-
| 0x7F
| Usually value 0x00DCD919?
|}

=== Parameter structure for CmdID 0x803F0112 ===
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| 0x0 = unknown, 0xF = unknown. Only bits 3-0 are used.(Values 0x1-0xF all have the same effect)
|-
| 1
| 0x0 = unknown, 0xF = unknown. Only bits 3-0 are used.
|-
| 2
| 0x0 = unknown, 0x2 = unknown. Only bits 1-0 are used.(Values 0x1-0x3 all have the same effect)
|-
| 3
| 0x0 = unknown, 0x2 = unknown. Only bits 1-0 are used.(Values 0x1-0x3 all have the same effect)
|}

=== Entries for CmdID 0xXXXF02C1 ===
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| float, the GPU handles this as the 4th word.
|-
| 1
| float, the GPU handles this as the 3rd word.
|-
| 2
| float, the GPU handles this as the 2nd word.
|-
| 3
| float, the GPU handles this as the 1st word.
|}

The below entry structure info is in the raw order used for the command, not the order used by the GPU.

==== Color Entry ====
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| float Red component
|-
| 1
| float Blue component
|-
| 2
| float Green component
|-
| 3
| float Alpha
|}

==== Lighting Color Entry ====
{| class="wikitable" border="1"
! Index Word
! Description
|-
| 0
| float Alpha
|-
| 1
| float Blue component
|-
| 2
| float Green component
|-
| 3
| float Red component
|}

=== Types for CmdID 0x000F02C0 ===
{| class="wikitable" border="1"
! Value
! Entries per chunk
! Description
|-
| 0x00
| 4
| This specifies 16-floats for a 4x4 matrix, used for glLoadMatrix() for the projection matrix.
|-
| 0x04
| 4
| This specifies a 4x4 matrix, used for glLoadMatrix() for the model-view matrix. This is usually an identity matrix.
|-
| 0x08
| 2
| Sets the color.
|-
| 0x0A
| 4
| Specifies a 4x4 matrix, used for glLoadMatrix() for the texture matrix.(Index0)
|-
| 0x0E
| 3
| Specifies a 4x3 texture matrix.(Index1)
|-
| 0x11
| 3
| Specifies a 4x3 texture matrix.(Index2)
|-
| 0x14
| <=30
| Used to specify a 4xN matrix, where N is the total CmdID 0xXXXF02C1 entries. This is glMultMatrix() for the model-view matrix, except the input matrix is 4xN instead of 4x4.
|-
| 0x4C
| 4
| This specifies a 4x4 float matrix.
|-
| 0x50, 0x53, and 0x56
| 1
| This specifies the GL_LIGHT0-2 color for GL_AMBIENT?
|-
| 0x51, 0x54, and 0x57
| 1
| This specifies the GL_LIGHT0-2 color for GL_DIFFUSE?
|-
| 0x52, 0x55, and 0x58
| 1
| This specifies the GL_LIGHT0-2 color for GL_SPECULAR?
|-
| 0x59
| 1
| Unknown, the entry data is floats converted from s32s. Usually each entry word is zeros.
|-
| 0x5A
| 2
| Color related?
|-
| 0x5C
| 1
| ?
|}

The matrices for types 0x00 and 0x04 use row-major order, instead of column-major order.

GSP Shared Memory

2013-04-15T23:59:50Z

Neimod:

This page describes the structure of the GSP [[GSPGPU:RegisterInterruptRelayQueue|shared]] memory. GX commands and framebuffer info is stored here, and other unknown data.

=Framebuffer info=
The framebuffer info structure for the main LCD is located at sharedmemvadr + 0x200 + threadindex*0x80. The framebuffer info structure for the sub LCD is located at sharedmemvadr + 0x240 + threadindex*0x80.

==Framebuffer info header==
{| class="wikitable" border="1"
|-
! Index Byte
! Description
|-
| 0
| Framebuffer info [[GSPGPU:SetBufferSwap|entry]] index
|-
| 1
| Flag
|-
| 3-2
| Padding
|}

When a process sets this framebuffer info, it sets index to <nowiki>(index+1) & 1</nowiki>. Then it writes the framebuffer info entry, and sets flag to value 1. The GSP module loads this framebuffer info entry data into GSP state once the [[GPU]] finishes processing GX commands 3 or 4. Once the GSP module finishes loading this framebuffer info, it sets flag to value 0, then it will not load the framebuffer info again until flag is value 1. After loading this entry data into GSP state, the GSP module then writes this framebuffer state to the [[LCD]] registers. GSP module automatically updates the LCD framebuffer registers each time GX commands 3 or 4 finish, even when this shared memory data was not updated by the application.(GSP module toggles the active framebuffer register when automatically updating LCD registers, when shared memory data is not used)

The two 0x1C-byte framebuffer info entries are located at framebufferinfo+4.

=3D Slider=
See [[Configuration Memory]].

=Command Buffer Header=
{| class="wikitable" border="1"
|-
! Index Byte
! Description
|-
| 0
| Current command index. This index is updated by GSP module after loading the command data, right before the command is processed. When this index is updated by GSP module, the total commands field is decreased by one as well.
|-
| 1
| Total commands to process, must not be value 0 when GSP module handles commands. This must be <=15 when writing a command to shared memory. This is incremented by the application when writing a command to shared memory, after increasing this value [[GSPGPU:TriggerCmdReqQueue|TriggerCmdReqQueue]] is only used if this field is value 1.
|-
| 2
| Must not be value 1. When the error-code u32 is set, this u8 is set to value 0x80.
|-
| 3
| Bit0 must not be set
|-
| 4
| u32 Error code for the last GX command which failed
|}

The command buffer is located at sharedmem + 0x800 + [[GSPGPU:RegisterInterruptRelayQueue|threadindex]]*0x200. After writing the command data to shared memory, [[GSPGPU:TriggerCmdReqQueue|TriggerCmdReqQueue]] must be used to trigger GSP processing for the command when the total commands field is value 1.

=Command Header=
{| class="wikitable" border="1"
|-
! Index Byte
! Description
|-
| 0
| Command ID
|-
| 2-1
| ?
|-
| 3
| When non-zero GSP module may check flags for the specified cmdID, command handling is aborted when the flags are set. The corresponding flag for each CmdID is set once the command is handled by GSP module, this flag is likely cleared once the GPU finishes processing the command.
|}

The command is located at cmdbuf + 0x20 + cmdindex*0x20, the size of each command is 0x20-bytes. The command parameters are located at command+4. Addresses specified in parameters are application vaddrs, these are usually located in either the process GSP [[Memory_layout|heap]] or VRAM. For applications these addresses are normally located in the GSP heap, while for other processes these addresses are located in VRAM. Addresses/sizes specified in parameters except for cmd0 and cmd5 must be 8-byte [[GPU|aligned]].

=Commands=

==GX RequestDma==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x00
|-
| 1
| Source address
|-
| 2
| Destination address
|-
| 3
| Size
|-
| 7-4
| Unused
|}

This command is normally used to DMA data from the application GSP [[Memory_layout|heap]] to VRAM.

==GX SetCommandList Last==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x01
|-
| 1
| Buffer address
|-
| 2
| Buffer size
|-
| 3
| Flag, bit0 is written to GSP module state
|-
| 6-4
| Unused
|-
| 7
| When non-zero, call svcFlushProcessDataCache() with the specified buffer
|}

This command converts the specified address to a physical address, then writes the physical address and size to the [[GPU]] registers at 0x1EF018E0. This buffer contains [[GPU_Commands|GPU commands]].

==GX SetMemoryFill==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x02
|-
| 1
| Buf0 address
|-
| 2
| Buf0 size
|-
| 3
| Buf0 data
|-
| 4
| Buf1 address
|-
| 5
| Buf1 size
|-
| 6
| Buf1 data
|-
| 7
| The low u16 is width0, while the high u16 is width1
|}

This commands converts the specified addresses to physical addresses, then writes these addresses and the specified parameters to the [[GPU]] registers at 0x1EF00010 and 0x1EF00020. The associated buffer address must not be <= to the main buffer address, thus the associated buffer address must not be zero as well. When the bufX address is zero, processing for the bufX parameters is skipped.

==GX SetDisplayTransfer==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x03
|-
| 1
| Input framebuffer address
|-
| 2
| Output framebuffer address
|-
| 3
| Input framebuffer [[GPU|dimensions]]
|-
| 4
| Output framebuffer dimensions
|-
| 5
| [[GPU|Flags]], for applications this is 0x1001000 for the main screen, and 0x1000 for the sub screen.
|-
| 7-6
| Unused
|}

This command converts the specified addresses to physical addresses, then writes these physical addresses and parameters to the [[GPU]] registers at 0x1EF00C00. This command writes the rendered framebuffer data from the input framebuffer address to the specified output framebuffer. The input framebuffer is normally located in VRAM.

==GX SetTextureCopy==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x04
|-
| 1
| Buf0 address
|-
| 2
| Buf1 address
|-
| 3
| ?
|-
| 4
| ?
|-
| 5
| ?
|-
| 6
| ?
|-
| 7
| Unused
|}

This command is similar to cmd3, this command also writes to the [[GPU]] registers at 0x1EF00C00.

==GX SetCommandList First ==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x05
|-
| 1
| Buf0 address
|-
| 2
| Buf0 size
|-
| 3
| Buf1 address
|-
| 4
| Buf1 size
|-
| 5
| Buf2 address
|-
| 6
| Buf2 size
|-
| 7
| Unused
|}

The application buffer addresses specified in the parameters are used with [[SVC|svcFlushProcessDataCache]]. The input buf0 size must not be zero. When buf1 size is zero, svcFlushProcessDataCache() for buf1 and buf2 are skipped. When buf2 size is zero, svcFlushProcessDataCache() for buf2 is skipped.

GSP Shared Memory

2013-04-15T23:51:04Z

Neimod:

This page describes the structure of the GSP [[GSPGPU:RegisterInterruptRelayQueue|shared]] memory. GX commands and framebuffer info is stored here, and other unknown data.

=Framebuffer info=
The framebuffer info structure for the main LCD is located at sharedmemvadr + 0x200 + threadindex*0x80. The framebuffer info structure for the sub LCD is located at sharedmemvadr + 0x240 + threadindex*0x80.

==Framebuffer info header==
{| class="wikitable" border="1"
|-
! Index Byte
! Description
|-
| 0
| Framebuffer info [[GSPGPU:SetBufferSwap|entry]] index
|-
| 1
| Flag
|-
| 3-2
| Padding
|}

When a process sets this framebuffer info, it sets index to <nowiki>(index+1) & 1</nowiki>. Then it writes the framebuffer info entry, and sets flag to value 1. The GSP module loads this framebuffer info entry data into GSP state once the [[GPU]] finishes processing GX commands 3 or 4. Once the GSP module finishes loading this framebuffer info, it sets flag to value 0, then it will not load the framebuffer info again until flag is value 1. After loading this entry data into GSP state, the GSP module then writes this framebuffer state to the [[LCD]] registers. GSP module automatically updates the LCD framebuffer registers each time GX commands 3 or 4 finish, even when this shared memory data was not updated by the application.(GSP module toggles the active framebuffer register when automatically updating LCD registers, when shared memory data is not used)

The two 0x1C-byte framebuffer info entries are located at framebufferinfo+4.

=3D Slider=
See [[Configuration Memory]].

=Command Buffer Header=
{| class="wikitable" border="1"
|-
! Index Byte
! Description
|-
| 0
| Current command index. This index is updated by GSP module after loading the command data, right before the command is processed. When this index is updated by GSP module, the total commands field is decreased by one as well.
|-
| 1
| Total commands to process, must not be value 0 when GSP module handles commands. This must be <=15 when writing a command to shared memory. This is incremented by the application when writing a command to shared memory, after increasing this value [[GSPGPU:TriggerCmdReqQueue|TriggerCmdReqQueue]] is only used if this field is value 1.
|-
| 2
| Must not be value 1. When the error-code u32 is set, this u8 is set to value 0x80.
|-
| 3
| Bit0 must not be set
|-
| 4
| u32 Error code for the last GX command which failed
|}

The command buffer is located at sharedmem + 0x800 + [[GSPGPU:RegisterInterruptRelayQueue|threadindex]]*0x200. After writing the command data to shared memory, [[GSPGPU:TriggerCmdReqQueue|TriggerCmdReqQueue]] must be used to trigger GSP processing for the command when the total commands field is value 1.

=Command Header=
{| class="wikitable" border="1"
|-
! Index Byte
! Description
|-
| 0
| Command ID
|-
| 2-1
| ?
|-
| 3
| When non-zero GSP module may check flags for the specified cmdID, command handling is aborted when the flags are set. The corresponding flag for each CmdID is set once the command is handled by GSP module, this flag is likely cleared once the GPU finishes processing the command.
|}

The command is located at cmdbuf + 0x20 + cmdindex*0x20, the size of each command is 0x20-bytes. The command parameters are located at command+4. Addresses specified in parameters are application vaddrs, these are usually located in either the process GSP [[Memory_layout|heap]] or VRAM. For applications these addresses are normally located in the GSP heap, while for other processes these addresses are located in VRAM. Addresses/sizes specified in parameters except for cmd0 and cmd5 must be 8-byte [[GPU|aligned]].

=Commands=

==GX RequestDma==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x00
|-
| 1
| Source address
|-
| 2
| Destination address
|-
| 3
| Size
|-
| 7-4
| Unused
|}

This command is normally used to DMA data from the application GSP [[Memory_layout|heap]] to VRAM.

==GX SetCommandList==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x01
|-
| 1
| Buffer address
|-
| 2
| Buffer size
|-
| 3
| Flag, bit0 is written to GSP module state
|-
| 6-4
| Unused
|-
| 7
| When non-zero, call svcFlushProcessDataCache() with the specified buffer
|}

This command converts the specified address to a physical address, then writes the physical address and size to the [[GPU]] registers at 0x1EF018E0. This buffer contains [[GPU_Commands|GPU commands]].

==GX SetMemoryFill==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x02
|-
| 1
| Buf0 address
|-
| 2
| Buf0 size
|-
| 3
| Buf0 data
|-
| 4
| Buf1 address
|-
| 5
| Buf1 size
|-
| 6
| Buf1 data
|-
| 7
| The low u16 is width0, while the high u16 is width1
|}

This commands converts the specified addresses to physical addresses, then writes these addresses and the specified parameters to the [[GPU]] registers at 0x1EF00010 and 0x1EF00020. The associated buffer address must not be <= to the main buffer address, thus the associated buffer address must not be zero as well. When the bufX address is zero, processing for the bufX parameters is skipped.

==GX SetDisplayTransfer==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x03
|-
| 1
| Input framebuffer address
|-
| 2
| Output framebuffer address
|-
| 3
| Input framebuffer [[GPU|dimensions]]
|-
| 4
| Output framebuffer dimensions
|-
| 5
| [[GPU|Flags]], for applications this is 0x1001000 for the main screen, and 0x1000 for the sub screen.
|-
| 7-6
| Unused
|}

This command converts the specified addresses to physical addresses, then writes these physical addresses and parameters to the [[GPU]] registers at 0x1EF00C00. This command writes the rendered framebuffer data from the input framebuffer address to the specified output framebuffer. The input framebuffer is normally located in VRAM.

==GX SetTextureCopy==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x04
|-
| 1
| Buf0 address
|-
| 2
| Buf1 address
|-
| 3
| ?
|-
| 4
| ?
|-
| 5
| ?
|-
| 6
| ?
|-
| 7
| Unused
|}

This command is similar to cmd3, this command also writes to the [[GPU]] registers at 0x1EF00C00.

==GX SetCommandList==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x05
|-
| 1
| Buf0 address
|-
| 2
| Buf0 size
|-
| 3
| Buf1 address
|-
| 4
| Buf1 size
|-
| 5
| Buf2 address
|-
| 6
| Buf2 size
|-
| 7
| Unused
|}

The application buffer addresses specified in the parameters are used with [[SVC|svcFlushProcessDataCache]]. The input buf0 size must not be zero. When buf1 size is zero, svcFlushProcessDataCache() for buf1 and buf2 are skipped. When buf2 size is zero, svcFlushProcessDataCache() for buf2 is skipped.

GSP Shared Memory

2013-04-15T23:45:35Z

Neimod:

This page describes the structure of the GSP [[GSPGPU:RegisterInterruptRelayQueue|shared]] memory. GX commands and framebuffer info is stored here, and other unknown data.

=Framebuffer info=
The framebuffer info structure for the main LCD is located at sharedmemvadr + 0x200 + threadindex*0x80. The framebuffer info structure for the sub LCD is located at sharedmemvadr + 0x240 + threadindex*0x80.

==Framebuffer info header==
{| class="wikitable" border="1"
|-
! Index Byte
! Description
|-
| 0
| Framebuffer info [[GSPGPU:SetBufferSwap|entry]] index
|-
| 1
| Flag
|-
| 3-2
| Padding
|}

When a process sets this framebuffer info, it sets index to <nowiki>(index+1) & 1</nowiki>. Then it writes the framebuffer info entry, and sets flag to value 1. The GSP module loads this framebuffer info entry data into GSP state once the [[GPU]] finishes processing GX commands 3 or 4. Once the GSP module finishes loading this framebuffer info, it sets flag to value 0, then it will not load the framebuffer info again until flag is value 1. After loading this entry data into GSP state, the GSP module then writes this framebuffer state to the [[LCD]] registers. GSP module automatically updates the LCD framebuffer registers each time GX commands 3 or 4 finish, even when this shared memory data was not updated by the application.(GSP module toggles the active framebuffer register when automatically updating LCD registers, when shared memory data is not used)

The two 0x1C-byte framebuffer info entries are located at framebufferinfo+4.

=3D Slider=
See [[Configuration Memory]].

=Command Buffer Header=
{| class="wikitable" border="1"
|-
! Index Byte
! Description
|-
| 0
| Current command index. This index is updated by GSP module after loading the command data, right before the command is processed. When this index is updated by GSP module, the total commands field is decreased by one as well.
|-
| 1
| Total commands to process, must not be value 0 when GSP module handles commands. This must be <=15 when writing a command to shared memory. This is incremented by the application when writing a command to shared memory, after increasing this value [[GSPGPU:TriggerCmdReqQueue|TriggerCmdReqQueue]] is only used if this field is value 1.
|-
| 2
| Must not be value 1. When the error-code u32 is set, this u8 is set to value 0x80.
|-
| 3
| Bit0 must not be set
|-
| 4
| u32 Error code for the last GX command which failed
|}

The command buffer is located at sharedmem + 0x800 + [[GSPGPU:RegisterInterruptRelayQueue|threadindex]]*0x200. After writing the command data to shared memory, [[GSPGPU:TriggerCmdReqQueue|TriggerCmdReqQueue]] must be used to trigger GSP processing for the command when the total commands field is value 1.

=Command Header=
{| class="wikitable" border="1"
|-
! Index Byte
! Description
|-
| 0
| Command ID
|-
| 2-1
| ?
|-
| 3
| When non-zero GSP module may check flags for the specified cmdID, command handling is aborted when the flags are set. The corresponding flag for each CmdID is set once the command is handled by GSP module, this flag is likely cleared once the GPU finishes processing the command.
|}

The command is located at cmdbuf + 0x20 + cmdindex*0x20, the size of each command is 0x20-bytes. The command parameters are located at command+4. Addresses specified in parameters are application vaddrs, these are usually located in either the process GSP [[Memory_layout|heap]] or VRAM. For applications these addresses are normally located in the GSP heap, while for other processes these addresses are located in VRAM. Addresses/sizes specified in parameters except for cmd0 and cmd5 must be 8-byte [[GPU|aligned]].

=Commands=

==GX Command 0==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x00
|-
| 1
| Source address
|-
| 2
| Destination address
|-
| 3
| Size
|-
| 7-4
| Unused
|}

This command is normally used to DMA data from the application GSP [[Memory_layout|heap]] to VRAM.

==GX SetCommandList==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x01
|-
| 1
| Buffer address
|-
| 2
| Buffer size
|-
| 3
| Flag, bit0 is written to GSP module state
|-
| 6-4
| Unused
|-
| 7
| When non-zero, call svcFlushProcessDataCache() with the specified buffer
|}

This command converts the specified address to a physical address, then writes the physical address and size to the [[GPU]] registers at 0x1EF018E0. This buffer contains [[GPU_Commands|GPU commands]].

==GX SetMemoryFill==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x02
|-
| 1
| Buf0 address
|-
| 2
| Buf0 size
|-
| 3
| Buf0 data
|-
| 4
| Buf1 address
|-
| 5
| Buf1 size
|-
| 6
| Buf1 data
|-
| 7
| The low u16 is width0, while the high u16 is width1
|}

This commands converts the specified addresses to physical addresses, then writes these addresses and the specified parameters to the [[GPU]] registers at 0x1EF00010 and 0x1EF00020. The associated buffer address must not be <= to the main buffer address, thus the associated buffer address must not be zero as well. When the bufX address is zero, processing for the bufX parameters is skipped.

==GX SetDisplayTransfer==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x03
|-
| 1
| Input framebuffer address
|-
| 2
| Output framebuffer address
|-
| 3
| Input framebuffer [[GPU|dimensions]]
|-
| 4
| Output framebuffer dimensions
|-
| 5
| [[GPU|Flags]], for applications this is 0x1001000 for the main screen, and 0x1000 for the sub screen.
|-
| 7-6
| Unused
|}

This command converts the specified addresses to physical addresses, then writes these physical addresses and parameters to the [[GPU]] registers at 0x1EF00C00. This command writes the rendered framebuffer data from the input framebuffer address to the specified output framebuffer. The input framebuffer is normally located in VRAM.

==GX SetTextureCopy==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x04
|-
| 1
| Buf0 address
|-
| 2
| Buf1 address
|-
| 3
| ?
|-
| 4
| ?
|-
| 5
| ?
|-
| 6
| ?
|-
| 7
| Unused
|}

This command is similar to cmd3, this command also writes to the [[GPU]] registers at 0x1EF00C00.

==GX SetCommandList==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x05
|-
| 1
| Buf0 address
|-
| 2
| Buf0 size
|-
| 3
| Buf1 address
|-
| 4
| Buf1 size
|-
| 5
| Buf2 address
|-
| 6
| Buf2 size
|-
| 7
| Unused
|}

The application buffer addresses specified in the parameters are used with [[SVC|svcFlushProcessDataCache]]. The input buf0 size must not be zero. When buf1 size is zero, svcFlushProcessDataCache() for buf1 and buf2 are skipped. When buf2 size is zero, svcFlushProcessDataCache() for buf2 is skipped.

GSP Shared Memory

2013-04-15T23:36:07Z

Neimod:

This page describes the structure of the GSP [[GSPGPU:RegisterInterruptRelayQueue|shared]] memory. GX commands and framebuffer info is stored here, and other unknown data.

=Framebuffer info=
The framebuffer info structure for the main LCD is located at sharedmemvadr + 0x200 + threadindex*0x80. The framebuffer info structure for the sub LCD is located at sharedmemvadr + 0x240 + threadindex*0x80.

==Framebuffer info header==
{| class="wikitable" border="1"
|-
! Index Byte
! Description
|-
| 0
| Framebuffer info [[GSPGPU:SetBufferSwap|entry]] index
|-
| 1
| Flag
|-
| 3-2
| Padding
|}

When a process sets this framebuffer info, it sets index to <nowiki>(index+1) & 1</nowiki>. Then it writes the framebuffer info entry, and sets flag to value 1. The GSP module loads this framebuffer info entry data into GSP state once the [[GPU]] finishes processing GX commands 3 or 4. Once the GSP module finishes loading this framebuffer info, it sets flag to value 0, then it will not load the framebuffer info again until flag is value 1. After loading this entry data into GSP state, the GSP module then writes this framebuffer state to the [[LCD]] registers. GSP module automatically updates the LCD framebuffer registers each time GX commands 3 or 4 finish, even when this shared memory data was not updated by the application.(GSP module toggles the active framebuffer register when automatically updating LCD registers, when shared memory data is not used)

The two 0x1C-byte framebuffer info entries are located at framebufferinfo+4.

=3D Slider=
See [[Configuration Memory]].

=Command Buffer Header=
{| class="wikitable" border="1"
|-
! Index Byte
! Description
|-
| 0
| Current command index. This index is updated by GSP module after loading the command data, right before the command is processed. When this index is updated by GSP module, the total commands field is decreased by one as well.
|-
| 1
| Total commands to process, must not be value 0 when GSP module handles commands. This must be <=15 when writing a command to shared memory. This is incremented by the application when writing a command to shared memory, after increasing this value [[GSPGPU:TriggerCmdReqQueue|TriggerCmdReqQueue]] is only used if this field is value 1.
|-
| 2
| Must not be value 1. When the error-code u32 is set, this u8 is set to value 0x80.
|-
| 3
| Bit0 must not be set
|-
| 4
| u32 Error code for the last GX command which failed
|}

The command buffer is located at sharedmem + 0x800 + [[GSPGPU:RegisterInterruptRelayQueue|threadindex]]*0x200. After writing the command data to shared memory, [[GSPGPU:TriggerCmdReqQueue|TriggerCmdReqQueue]] must be used to trigger GSP processing for the command when the total commands field is value 1.

=Command Header=
{| class="wikitable" border="1"
|-
! Index Byte
! Description
|-
| 0
| Command ID
|-
| 2-1
| ?
|-
| 3
| When non-zero GSP module may check flags for the specified cmdID, command handling is aborted when the flags are set. The corresponding flag for each CmdID is set once the command is handled by GSP module, this flag is likely cleared once the GPU finishes processing the command.
|}

The command is located at cmdbuf + 0x20 + cmdindex*0x20, the size of each command is 0x20-bytes. The command parameters are located at command+4. Addresses specified in parameters are application vaddrs, these are usually located in either the process GSP [[Memory_layout|heap]] or VRAM. For applications these addresses are normally located in the GSP heap, while for other processes these addresses are located in VRAM. Addresses/sizes specified in parameters except for cmd0 and cmd5 must be 8-byte [[GPU|aligned]].

=Commands=

==GX Command 0==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x00
|-
| 1
| Source address
|-
| 2
| Destination address
|-
| 3
| Size
|-
| 7-4
| Unused
|}

This command is normally used to DMA data from the application GSP [[Memory_layout|heap]] to VRAM.

==GX Command 1==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x01
|-
| 1
| Buffer address
|-
| 2
| Buffer size
|-
| 3
| Flag, bit0 is written to GSP module state
|-
| 6-4
| Unused
|-
| 7
| When non-zero, call svcFlushProcessDataCache() with the specified buffer
|}

This command converts the specified address to a physical address, then writes the physical address and size to the [[GPU]] registers at 0x1EF018E0. This buffer contains [[GPU_Commands|GPU commands]].

==GX SetMemoryFill==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x02
|-
| 1
| Buf0 address
|-
| 2
| Buf0 size
|-
| 3
| Buf0 data
|-
| 4
| Buf1 address
|-
| 5
| Buf1 size
|-
| 6
| Buf1 data
|-
| 7
| The low u16 is width0, while the high u16 is width1
|}

This commands converts the specified addresses to physical addresses, then writes these addresses and the specified parameters to the [[GPU]] registers at 0x1EF00010 and 0x1EF00020. The associated buffer address must not be <= to the main buffer address, thus the associated buffer address must not be zero as well. When the bufX address is zero, processing for the bufX parameters is skipped.

==GX Command 3==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x03
|-
| 1
| Input framebuffer address
|-
| 2
| Output framebuffer address
|-
| 3
| Input framebuffer [[GPU|dimensions]]
|-
| 4
| Output framebuffer dimensions
|-
| 5
| [[GPU|Flags]], for applications this is 0x1001000 for the main screen, and 0x1000 for the sub screen.
|-
| 7-6
| Unused
|}

This command converts the specified addresses to physical addresses, then writes these physical addresses and parameters to the [[GPU]] registers at 0x1EF00C00. This command writes the rendered framebuffer data from the input framebuffer address to the specified output framebuffer. The input framebuffer is normally located in VRAM.

==GX Command 4==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x04
|-
| 1
| Buf0 address
|-
| 2
| Buf1 address
|-
| 3
| ?
|-
| 4
| ?
|-
| 5
| ?
|-
| 6
| ?
|-
| 7
| Unused
|}

This command is similar to cmd3, this command also writes to the [[GPU]] registers at 0x1EF00C00.

==GX Command 5==
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| u8 CommandID is 0x05
|-
| 1
| Buf0 address
|-
| 2
| Buf0 size
|-
| 3
| Buf1 address
|-
| 4
| Buf1 size
|-
| 5
| Buf2 address
|-
| 6
| Buf2 size
|-
| 7
| Unused
|}

The application buffer addresses specified in the parameters are used with [[SVC|svcFlushProcessDataCache]]. The input buf0 size must not be zero. When buf1 size is zero, svcFlushProcessDataCache() for buf1 and buf2 are skipped. When buf2 size is zero, svcFlushProcessDataCache() for buf2 is skipped.

Main Page/Current events

2013-03-29T21:25:44Z

Neimod:

{{Main page box|Latest safe firmware|:FirmwareNews}}
<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- valign="top" align="left" style="background: #F5FAFF;"
| {{:FirmwareNews}}
|}
</div>
{{box-footer-empty}}

{{Main page box|Latest news|:News}}
<div style="margin: -.3em -1em -1em -1em;">
{| width="100%" bgcolor="#fff" border="0" cellpadding="2px" cellspacing="2px" style="margin:auto;"
|- valign="top" align="left" style="background: #F5FAFF;"
| {{:News}}
|- class="plainlinks" style="background: #e7eef6; text-align: center;"
| [[Image:view_more.png|link=:News/Archive]] [[:News/Archive|Archive]]
|}
</div>
{{box-footer-empty}}

FirmwareNews

2013-03-29T21:25:21Z

Neimod: Created page with "Latest '''safe''' firmware is 4.5.0-10, '''updating to 5.0.0-11 is not recommended'''!"

Latest '''safe''' firmware is [[4.5.0-10]], '''updating to [[5.0.0-11]] is not recommended'''!

News

2013-03-29T21:23:59Z

Neimod:

<noinclude>
==Adding an item==
* Log in to the wiki. Editing is disabled if you don't have an account.
* Add the news event to the top of the list, using this format for the date: <tt><nowiki>'''</nowiki>{{#time: d F y}}<nowiki>''' </nowiki></tt>. Please include the application's creator, version number, and a link to a page on 3DBrew about the application. No external links please.
* '''Move the last entry to the [[:News/Archive|news archive]]. There should be no more than 4 entrees in the list.'''

==Archives==
For older news, see the [[:News/Archive|news archive]].

=== News ===
</noinclude>

*'''25 March 13''' Nintendo released system update [[5.0.0-11]].
*'''14 January 13''' [[3DSExplorer|3DSExplorer v1.5.1]] updated by [[User:Elisherer|Elisherer]]
*'''4 December 12''' Nintendo released system update [[4.5.0-10]].
*'''1 December 12''' [[3DSExplorer|3DSExplorer v1.4]] updated by [[User:Elisherer|Elisherer]]

News

2013-03-29T21:19:39Z

Neimod:

<noinclude>
==Adding an item==
* Log in to the wiki. Editing is disabled if you don't have an account.
* Add the news event to the top of the list, using this format for the date: <tt><nowiki>'''</nowiki>{{#time: d F y}}<nowiki>''' </nowiki></tt>. Please include the application's creator, version number, and a link to a page on 3DBrew about the application. No external links please.
* '''Move the last entry to the [[:News/Archive|news archive]]. There should be no more than 4 entrees in the list.'''

==Archives==
For older news, see the [[:News/Archive|news archive]].

=== Firmware safety ===
Latest '''safe''' firmware is [[4.5.0-10]], '''updating to [[5.0.0-11]] is not recommended'''!

=== News ===
</noinclude>

*'''25 March 13''' Nintendo released system update [[5.0.0-11]].
*'''14 January 13''' [[3DSExplorer|3DSExplorer v1.5.1]] updated by [[User:Elisherer|Elisherer]]
*'''4 December 12''' Nintendo released system update [[4.5.0-10]].
*'''1 December 12''' [[3DSExplorer|3DSExplorer v1.4]] updated by [[User:Elisherer|Elisherer]]

AMPXI:GetTitleInfo

2013-03-26T21:59:49Z

Neimod:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00030084]
|-
| 1
| [[#Mediatypes|Mediatype]]
|-
| 2
| Title count
|-
| 3
| (titlecount*8)<<8 <nowiki>|</nowiki> 4
|-
| 4
| Pointer to buffer that contains title list, for which info needs to be retrieved
|-
| 5
| (titlecount*24)<<8 <nowiki>|</nowiki> 0x14
|-
| 6
| Pointer to buffer that will receive the title info
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00030040]
|-
| 1
| Result code
|}

= Title info =
Each entry in the buffer is 24 bytes, some contents are currently unknown.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0
| 8
| Title id
|-
| 8
| 8
| Unknown
|-
| 16
| 2
| Version
|-
| 18
| 2
| Unknown
|-
| 20
| 4
| Title type
|}

{{:Mediatypes}}

AMPXI:GetTitleList

2013-03-26T21:59:11Z

Neimod:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00020082]
|-
| 1
| Title count
|-
| 2
| [[#Mediatypes|Mediatype]]
|-
| 3
| (titlecount*8)<<8 <nowiki>|</nowiki> 4
|-
| 4
| Pointer to buffer that will receive list with titleid's
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00020080]
|-
| 1
| Result code
|-
| 2
| Number of entries returned
|}

{{:Mediatypes}}

Memory layout

2013-02-24T19:16:25Z

Neimod:

=ARM11 Physical memory regions =
{| class="wikitable" border="1"
|-
! Address
! Size
! Description
|-
| 0x0
| 0x10000
| Bootrom (super secret code/data @ 0x8000)
|-
| 0x10000
| 0x10000
| Bootrom mirror
|-
| 0x10000000
| ?
| [[IO]] memory
|-
| 0x17E00000
| 0x2000
| MPCore private memory region
|-
| 0x18000000
| 0x600000
| VRAM
|-
| 0x1FF00000
| 0x80000
| DSP memory
|-
| 0x1FF80000
| 0x80000
| AXI WRAM
|-
| 0x20000000
| 0x8000000
| FCRAM
|}

=Memory map by firmware=
* [[Virtual address mapping FW0B]]
* [[Virtual address mapping FW1F]]

=ARM11 Detailed physical memory map=
18000000 - 18600000: VRAM

1FF80000 - 1FFAB000: Kernel code
1FFAB000 - 1FFF0000: SlabHeap [temporarily contains boot processes]
1FFF0000 - 1FFF1000: ?
1FFF1000 - 1FFF2000: ?
1FFF2000 - 1FFF3000: ?
1FFF3000 - 1FFF4000: ?
1FFF4000 - 1FFF5000: Exception vectors
1FFF5000 - 1FFF5800: Unused?
1FFF5800 - 1FFF5C00: 256-entry L2 MMU table for VA FF4xx000
1FFF5C00 - 1FFF6000: 256-entry L2 MMU table for VA FF5xx000
1FFF6000 - 1FFF6400: 256-entry L2 MMU table for VA FF6xx000
1FFF6400 - 1FFF6800: 256-entry L2 MMU table for VA FF7xx000
1FFF6800 - 1FFF6C00: 256-entry L2 MMU table for VA FF8xx000
1FFF6C00 - 1FFF7000: 256-entry L2 MMU table for VA FF9xx000
1FFF7000 - 1FFF7400: 256-entry L2 MMU table for VA FFAxx000
1FFF7400 - 1FFF7800: 256-entry L2 MMU table for VA FFBxx000
1FFF7800 - 1FFF7C00: MMU table but unused?
1FFF7C00 - 1FFF8000: 256-entry L2 MMU table for VA FFFxx000
1FFF8000 - 1FFFC000: 4096-entry L1 MMU table for VA xxx00000 (CPU 0 or 1)
1FFFC000 - 20000000: 4096-entry L1 MMU table for VA xxx00000 (CPU 1 or 0)
20000000 - 28000000: Main memory

=ARM11 Detailed virtual memory map=
E8000000 - E8600000: mapped VRAM (18000000 - 18600000)

EFF00000 - F0000000: mapped Internal memory (1FF00000 - 20000000)
F0000000 - F8000000: mapped Main memory

FF401000 - FF402000: mapped ? (27FC7000 - 27FC8000)

FF403000 - FF404000: mapped ? (27FC2000 - 27FC3000)

FF405000 - FF406000: mapped ? (27FBB000 - 27FBC000)

FF407000 - FF408000: mapped ? (27FB3000 - 27FB4000)

FF409000 - FF40A000: mapped ? (27F8E000 - 27F8F000)

FFF00000 - FFF45000: mapped SlabHeap

FFF60000 - FFF8B000: mapped Kernel code

FFFCC000 - FFFCD000: mapped IO [[I2C|I2C]] second bus (10144000 - 10145000)

FFFCE000 - FFFCF000: mapped IO PDC (10400000 - 10401000)

FFFD0000 - FFFD1000: mapped IO PDN (10141000 - 10142000)

FFFD2000 - FFFD3000: mapped IO PXI (10163000 - 10164000)

FFFD4000 - FFFD5000: mapped IO PAD (10146000 - 10147000)

FFFD6000 - FFFD7000: mapped IO LCD (10202000 - 10203000)

FFFD8000 - FFFD9000: mapped IO ? (10140000 - 10141000)

FFFDA000 - FFFDB000: mapped IO XDMA (10200000 - 10201000)

FFFDC000 - FFFE0000: mapped ? (1FFF8000 - 1FFFC000)

FFFE1000 - FFFE2000: mapped ? (1FFF0000 - 1FFF1000)

FFFE3000 - FFFE4000: mapped ? (1FFF2000 - 1FFF3000)

FFFE5000 - FFFE9000: mapped L1 MMU table for VA xxx00000

FFFEA000 - FFFEB000: mapped ? (1FFF1000 - 1FFF2000)

FFFEC000 - FFFED000: mapped ? (1FFF3000 - 1FFF4000)

FFFEE000 - FFFF0000: mapped IO IRQ (17E00000 - 17E02000)

FFFF0000 - FFFF1000: mapped Exception vectors

FFFF2000 - FFFF6000: mapped L1 MMU table for VA xxx00000

FFFF7000 - FFFF8000: mapped ? (1FFF1000 - 1FFF2000)

FFFF9000 - FFFFA000: mapped ? (1FFF3000 - 1FFF4000)

FFFFB000 - FFFFE000: mapped L2 MMU tables (1FFF5000 - 1FFF8000)

=ARM11 User-land memory regions=
{| class="wikitable" border="1"
|-
! Virtual Address Base
! Physical Address Base
! Region Max Size
! Description
|-
| 0x00100000 / 0x14000000
|
| 0x03F00000
| The [[ExeFS]]:/.code is loaded here, executables must be loaded to the 0x00100000 region when the exheader "special memory" flag is clear. The 0x03F00000-byte size restriction only applies when this flag is clear. Executables are usually loaded to 0x14000000 when the exheader "special memory" flag is set, however this address can be arbitrary.
|-
| 0x08000000
| For applications: FCRAM + GSP heap size
| 0x08000000
| Heap mapped by [[SVC|ControlMemory]]
|-
| 0x10000000-StackSize
| .bss physical address - total stack pages
| StackSize from process exheader
| Stack for the main-thread, initialized by the ARM11 kernel. The StackSize from the exheader is usually 0x4000, therefore the stack-bottom is usually 0x0FFFC000. The stack for the other threads is normally located in the process .data section however this can be arbitrary.
|-
| 0x10000000
|
| 0x04000000
| [[SVC|Shared]] memory
|-
| 0x14000000
| FCRAM+0
| 0x08000000
| Can be mapped by [[SVC|ControlMemory]], this is used for the application's GSP heap.
|-
| 0x1EC00000
| 0x10100000
| 0x01000000
| [[IO]] registers, the mapped IO pages which each process can access is specified in the [[NCCH#CXI|CXI]] exheader.(Applications normally don't have access to registers in this range)
|-
| 0x1F000000
| 0x18000000
| 0x00600000
| VRAM, access to this is specified by the exheader.
|-
| 0x1FF00000
| 0x1FF00000
| 0x00080000
| DSP memory, access to this is specified by the exheader.
|-
| 0x1FF80000
|
| 0x1000
| [[Configuration Memory]], all processes have access to this however write-permission to this page is specified by the exheader "Shared page writing" kernel flag.
|-
| 0x1FF81000
|
| 0x1000
| Shared page, access to this is the same as 0x1FF80000.
|}

All executable pages are read-only, and data pages have the execute-never permission set. Normally .text from the loaded ExeFS:/.code is the only mapped executable memory. Executable [[RO Services|CROs]] can be loaded into memory, once loaded the CRO .text section memory page permissions are changed via [[SVC|ControlProcessMemory]] from RW- to R-X. The address and size of each ExeFS:/.code section is stored in the exheader, the permissions for each section is: .text R-X, .rodata R--, .data RW-, and .bss RW-. The loaded .code is mapped to the addresses specified in the exheader by the ARM11 kernel. The stack permissions is initialized by the ARM11 kernel: RW-. The heap permissions is normally RW-.

All userland memory is mapped with RW permissions for privileged-mode. However, normally the ARM11 kernel only uses userland read/write instructions(or checks that the memory can be written from userland first) for accessing memory specified by [[SVC|SVCs]].

The virtual memory located below 0x20000000 is process-unique, processes can't directly access memory for other processes. The virtual memory starting at 0x20000000 is only accessible in privileged-mode. When service [[Services API|commands]] are used, the kernel maps memory in the destination process for input/output buffers, where the addresses in the command received by the process is replaced by this mapped memory. When this is an input buffer, the buffer data is copied to the mapped memory. When this is an output buffer, the data stored in the mapped memory is copied to the destination buffer specified in the command.

The physical address which memory for the application memory-type is mapped to begins at FCRAM+0, the total memory allocated for this memory-type is stored in [[Configuration_Memory]]. Applications' exefs:/.code under the application memory-type is mapped at FCRAM + APPMEMALLOC - exefs:/.code size aligned to the page size. The application .bss is mapped at CODEADDR - .bss size aligned down to the page size. Once the application exefs:/.code, .bss, and stack are mapped, APPMEMALLOC is set to APPMEMALLOC - (stacksize + bss_size + codesize), where stacksize, bss_size, and code_size are aligned to the page size.

== System memory details ==
0xFFFF9004 Pointer to the current KProcess instance

== Handles ==
The handle 0xFFFF8001 is a reference to the current KProcess.

== VRAM Map While Running Webbrowser ==
*0x1e6000-0x22C500 -- top screen framebuffer 0(240x400x3)
*0x22C800-0x272D00 -- top screen framebuffer 1(240x400x3)
*0x273000-0x2B9500 -- top screen framebuffer 2(240x400x3)
*0x2B9800-0x2FFD00 -- top screen framebuffer 3(240x400x3)
*0x48F000-0x4C7400 -- bottom screen framebuffer 0(240x320x3)
*0x4C7800-0x4FF800 -- bottom screen framebuffer 1(240x320x3)

Memory layout

2013-02-23T20:43:47Z

Neimod:

=ARM11 Physical memory regions =
{| class="wikitable" border="1"
|-
! Address
! Size
! Description
|-
| 0x0
| 0x10000
| Bootrom (super secret code/data @ 0x8000)
|-
| 0x10000
| 0x10000
| Bootrom mirror
|-
| 0x10000000
| ?
| [[IO]] memory
|-
| 0x18000000
| 0x600000
| VRAM
|-
| 0x1FF00000
| 0x80000
| DSP memory
|-
| 0x1FF80000
| 0x80000
| AXI WRAM
|-
| 0x20000000
| 0x8000000
| FCRAM
|}

=Memory map by firmware=
* [[Virtual address mapping FW0B]]
* [[Virtual address mapping FW1F]]

=ARM11 Detailed physical memory map=
18000000 - 18600000: VRAM

1FF80000 - 1FFAB000: Kernel code
1FFAB000 - 1FFF0000: SlabHeap [temporarily contains boot processes]
1FFF0000 - 1FFF1000: ?
1FFF1000 - 1FFF2000: ?
1FFF2000 - 1FFF3000: ?
1FFF3000 - 1FFF4000: ?
1FFF4000 - 1FFF5000: Exception vectors
1FFF5000 - 1FFF5800: Unused?
1FFF5800 - 1FFF5C00: 256-entry L2 MMU table for VA FF4xx000
1FFF5C00 - 1FFF6000: 256-entry L2 MMU table for VA FF5xx000
1FFF6000 - 1FFF6400: 256-entry L2 MMU table for VA FF6xx000
1FFF6400 - 1FFF6800: 256-entry L2 MMU table for VA FF7xx000
1FFF6800 - 1FFF6C00: 256-entry L2 MMU table for VA FF8xx000
1FFF6C00 - 1FFF7000: 256-entry L2 MMU table for VA FF9xx000
1FFF7000 - 1FFF7400: 256-entry L2 MMU table for VA FFAxx000
1FFF7400 - 1FFF7800: 256-entry L2 MMU table for VA FFBxx000
1FFF7800 - 1FFF7C00: MMU table but unused?
1FFF7C00 - 1FFF8000: 256-entry L2 MMU table for VA FFFxx000
1FFF8000 - 1FFFC000: 4096-entry L1 MMU table for VA xxx00000 (CPU 0 or 1)
1FFFC000 - 20000000: 4096-entry L1 MMU table for VA xxx00000 (CPU 1 or 0)
20000000 - 28000000: Main memory

=ARM11 Detailed virtual memory map=
E8000000 - E8600000: mapped VRAM (18000000 - 18600000)

EFF00000 - F0000000: mapped Internal memory (1FF00000 - 20000000)
F0000000 - F8000000: mapped Main memory

FF401000 - FF402000: mapped ? (27FC7000 - 27FC8000)

FF403000 - FF404000: mapped ? (27FC2000 - 27FC3000)

FF405000 - FF406000: mapped ? (27FBB000 - 27FBC000)

FF407000 - FF408000: mapped ? (27FB3000 - 27FB4000)

FF409000 - FF40A000: mapped ? (27F8E000 - 27F8F000)

FFF00000 - FFF45000: mapped SlabHeap

FFF60000 - FFF8B000: mapped Kernel code

FFFCC000 - FFFCD000: mapped IO [[I2C|I2C]] second bus (10144000 - 10145000)

FFFCE000 - FFFCF000: mapped IO PDC (10400000 - 10401000)

FFFD0000 - FFFD1000: mapped IO PDN (10141000 - 10142000)

FFFD2000 - FFFD3000: mapped IO PXI (10163000 - 10164000)

FFFD4000 - FFFD5000: mapped IO PAD (10146000 - 10147000)

FFFD6000 - FFFD7000: mapped IO LCD (10202000 - 10203000)

FFFD8000 - FFFD9000: mapped IO ? (10140000 - 10141000)

FFFDA000 - FFFDB000: mapped IO XDMA (10200000 - 10201000)

FFFDC000 - FFFE0000: mapped ? (1FFF8000 - 1FFFC000)

FFFE1000 - FFFE2000: mapped ? (1FFF0000 - 1FFF1000)

FFFE3000 - FFFE4000: mapped ? (1FFF2000 - 1FFF3000)

FFFE5000 - FFFE9000: mapped L1 MMU table for VA xxx00000

FFFEA000 - FFFEB000: mapped ? (1FFF1000 - 1FFF2000)

FFFEC000 - FFFED000: mapped ? (1FFF3000 - 1FFF4000)

FFFEE000 - FFFF0000: mapped IO IRQ (17E00000 - 17E02000)

FFFF0000 - FFFF1000: mapped Exception vectors

FFFF2000 - FFFF6000: mapped L1 MMU table for VA xxx00000

FFFF7000 - FFFF8000: mapped ? (1FFF1000 - 1FFF2000)

FFFF9000 - FFFFA000: mapped ? (1FFF3000 - 1FFF4000)

FFFFB000 - FFFFE000: mapped L2 MMU tables (1FFF5000 - 1FFF8000)

=ARM11 User-land memory regions=
{| class="wikitable" border="1"
|-
! Virtual Address Base
! Physical Address Base
! Region Max Size
! Description
|-
| 0x00100000 / 0x14000000
|
| 0x03F00000
| The [[ExeFS]]:/.code is loaded here, executables must be loaded to the 0x00100000 region when the exheader "special memory" flag is clear. The 0x03F00000-byte size restriction only applies when this flag is clear. Executables are usually loaded to 0x14000000 when the exheader "special memory" flag is set, however this address can be arbitrary.
|-
| 0x08000000
| For applications: FCRAM + GSP heap size
| 0x08000000
| Heap mapped by [[SVC|ControlMemory]]
|-
| 0x10000000-StackSize
| .bss physical address - total stack pages
| StackSize from process exheader
| Stack for the main-thread, initialized by the ARM11 kernel. The StackSize from the exheader is usually 0x4000, therefore the stack-bottom is usually 0x0FFFC000. The stack for the other threads is normally located in the process .data section however this can be arbitrary.
|-
| 0x10000000
|
| 0x04000000
| [[SVC|Shared]] memory
|-
| 0x14000000
| FCRAM+0
| 0x08000000
| Can be mapped by [[SVC|ControlMemory]], this is used for the application's GSP heap.
|-
| 0x1EC00000
| 0x10100000
| 0x01000000
| [[IO]] registers, the mapped IO pages which each process can access is specified in the [[NCCH#CXI|CXI]] exheader.(Applications normally don't have access to registers in this range)
|-
| 0x1F000000
| 0x18000000
| 0x00600000
| VRAM, access to this is specified by the exheader.
|-
| 0x1FF00000
| 0x1FF00000
| 0x00080000
| DSP memory, access to this is specified by the exheader.
|-
| 0x1FF80000
|
| 0x1000
| [[Configuration Memory]], all processes have access to this however write-permission to this page is specified by the exheader "Shared page writing" kernel flag.
|-
| 0x1FF81000
|
| 0x1000
| Shared page, access to this is the same as 0x1FF80000.
|}

All executable pages are read-only, and data pages have the execute-never permission set. Normally .text from the loaded ExeFS:/.code is the only mapped executable memory. Executable [[RO Services|CROs]] can be loaded into memory, once loaded the CRO .text section memory page permissions are changed via [[SVC|ControlProcessMemory]] from RW- to R-X. The address and size of each ExeFS:/.code section is stored in the exheader, the permissions for each section is: .text R-X, .rodata R--, .data RW-, and .bss RW-. The loaded .code is mapped to the addresses specified in the exheader by the ARM11 kernel. The stack permissions is initialized by the ARM11 kernel: RW-. The heap permissions is normally RW-.

All userland memory is mapped with RW permissions for privileged-mode. However, normally the ARM11 kernel only uses userland read/write instructions(or checks that the memory can be written from userland first) for accessing memory specified by [[SVC|SVCs]].

The virtual memory located below 0x20000000 is process-unique, processes can't directly access memory for other processes. The virtual memory starting at 0x20000000 is only accessible in privileged-mode. When service [[Services API|commands]] are used, the kernel maps memory in the destination process for input/output buffers, where the addresses in the command received by the process is replaced by this mapped memory. When this is an input buffer, the buffer data is copied to the mapped memory. When this is an output buffer, the data stored in the mapped memory is copied to the destination buffer specified in the command.

The physical address which memory for the application memory-type is mapped to begins at FCRAM+0, the total memory allocated for this memory-type is stored in [[Configuration_Memory]]. Applications' exefs:/.code under the application memory-type is mapped at FCRAM + APPMEMALLOC - exefs:/.code size aligned to the page size. The application .bss is mapped at CODEADDR - .bss size aligned down to the page size. Once the application exefs:/.code, .bss, and stack are mapped, APPMEMALLOC is set to APPMEMALLOC - (stacksize + bss_size + codesize), where stacksize, bss_size, and code_size are aligned to the page size.

== System memory details ==
0xFFFF9004 Pointer to the current KProcess instance

== Handles ==
The handle 0xFFFF8001 is a reference to the current KProcess.

== VRAM Map While Running Webbrowser ==
*0x1e6000-0x22C500 -- top screen framebuffer 0(240x400x3)
*0x22C800-0x272D00 -- top screen framebuffer 1(240x400x3)
*0x273000-0x2B9500 -- top screen framebuffer 2(240x400x3)
*0x2B9800-0x2FFD00 -- top screen framebuffer 3(240x400x3)
*0x48F000-0x4C7400 -- bottom screen framebuffer 0(240x320x3)
*0x4C7800-0x4FF800 -- bottom screen framebuffer 1(240x320x3)

SVC

2013-02-22T22:26:48Z

Neimod:

= System calls =
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| Result ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| Result QueryMemory(MemoryInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| void ExitProcess(void)
|-
| 0x4
| Result GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
|-
| 0x5
| Result SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| Result GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
|-
| 0x7
| Result SetProcessIdealProcessor(Handle process, s32 idealprocessor)
|-
| 0x8
| Result [[#CreateThread|CreateThread]](Handle* thread, func entrypoint, u32 arg, u32 stacktop, s32 threadpriority, s32 processorid)
|-
| 0x9
| void ExitThread(void)
|-
| 0xA
| void SleepThread(s64 nanoseconds)
|-
| 0xB
| Result GetThreadPriority(s32* priority, Handle thread)
|-
| 0xC
| Result SetThreadPriority(Handle thread, s32 priority)
|-
| 0xD
| Result GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount)
|-
| 0xE
| Result SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| Result GetThreadIdealProcessor(s32* processorid, Handle thread)
|-
| 0x10
| Result SetThreadIdealProcessor(Handle thread, s32 processorid)
|-
| 0x11
| s32 GetCurrentProcessorNumber(void)
|-
| 0x12
| Result Run(Handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| Result CreateMutex(Handle* mutex, bool initialLocked)
|-
| 0x14
| Result ReleaseMutex(Handle mutex)
|-
| 0x15
| Result CreateSemaphore(Handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| Result ReleaseSemaphore(s32* count, Handle semaphore, s32 releaseCount)
|-
| 0x17
| Result CreateEvent(Handle* event, ResetType resettype)
|-
| 0x18
| Result SignalEvent(Handle event)
|-
| 0x19
| Result ClearEvent(Handle event)
|-
| 0x1A
| Result CreateTimer(Handle* timer, ResetType resettype)
|-
| 0x1B
| Result SetTimer(Handle timer, s64 initial, s64 interval)
|-
| 0x1C
| Result CancelTimer(Handle timer)
|-
| 0x1D
| Result ClearTimer(Handle timer)
|-
| 0x1E
| Result CreateMemoryBlock(Handle* memblock, u32 memory, u32 size, u32 mypermission, u32 otherpermission)
|-
| 0x1F
| Result MapMemoryBlock(Handle memblock, u32 addr, u32 mypermissions, u32 otherpermission)
|-
| 0x20
| Result UnmapMemoryBlock(Handle memblock, u32 addr)
|-
| 0x21
| Result CreateAddressArbiter(Handle* arbiter)
|-
| 0x22
| Result ArbitrateAddress(Handle arbiter, u32 addr, ArbitrationType type, s32 value)
|-
| 0x23
| Result CloseHandle(Handle handle)
|-
| 0x24
| Result WaitSynchronization1(Handle handle, s64 nanoseconds)
|-
| 0x25
| Result WaitSynchronizationN(s32* out, Handle* handles, s32 handlecount, bool waitAll, s64 nanoseconds)
|-
| 0x26
| Result SignalAndWait(s32* out, Handle signal, Handle* handles, s32 handleCount, bool waitAll, s64 nanoseconds)
|-
| 0x27
| Result DuplicateHandle(Handle* out, Handle original)
|-
| 0x28
| s64 GetSystemTick(void)
|-
| 0x29
| Result GetHandleInfo(s64* out, Handle handle, HandleInfoType type)
|-
| 0x2A
| Result GetSystemInfo(s64* out, SystemInfoType type, s32 param)
|-
| 0x2B
| Result GetProcessInfo(s64* out, Handle process, ProcessInfoType type)
|-
| 0x2C
| Result GetThreadInfo(s64* out, Handle thread, ThreadInfoType type)
|-
| 0x2D
| Result ConnectToPort(Handle* out, const char* portName)
|-
| 0x2E
| Result SendSyncRequest1(Handle session) (Stubbed)
|-
| 0x2F
| Result SendSyncRequest2(Handle session) (Stubbed)
|-
| 0x30
| Result SendSyncRequest3(Handle session) (Stubbed)
|-
| 0x31
| Result SendSyncRequest4(Handle session) (Stubbed)
|-
| 0x32
| Result SendSyncRequest(Handle session)
|-
| 0x33
| Result OpenProcess(Handle* process, u32 processId)
|-
| 0x34
| Result OpenThread(Handle* thread, Handle process, u32 threadId)
|-
| 0x35
| Result GetProcessId(u32* processId, Handle process)
|-
| 0x36
| Result GetProcessIdOfThread(u32* processId, Handle thread)
|-
| 0x37
| Result GetThreadId(u32* threadId, Handle thread)
|-
| 0x38
| Result GetResourceLimit(Handle* resourceLimit, Handle process)
|-
| 0x39
| Result GetResourceLimitLimitValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
|-
| 0x3A
| Result GetResourceLimitCurrentValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
|-
| 0x3B
| Result GetThreadContext(ThreadContext* context, Handle thread) (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| Result CreatePort(Handle* portServer, Handle* portClient, const char* name, s32 maxSessions)
|-
| 0x48
| Result CreateSessionToPort(Handle* session, Handle port)
|-
| 0x49
| Result CreateSession(Handle* sessionServer, Handle* sessionClient)
|-
| 0x4A
| Result AcceptSession(Handle* session, Handle port)
|-
| 0x4B
| Result ReplyAndReceive1(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4C
| Result ReplyAndReceive2(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4D
| Result ReplyAndReceive3(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4E
| Result ReplyAndReceive4(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4F
| Result ReplyAndReceive(s32* index, Handle* handles, s32 handleCount, Handle replyTarget)
|-
| 0x50
| Result BindInterrupt(Interrupt name, Handle syncObject, s32 priority, bool isManualClear)
|-
| 0x51
| Result UnbindInterrupt(Interrupt name, Handle syncObject)
|-
| 0x52
| Result InvalidateProcessDataCache(Handle process, void* addr, u32 size)
|-
| 0x53
| Result StoreProcessDataCache(Handle process, void const* addr, u32 size)
|-
| 0x54
| Result FlushProcessDataCache(Handle process, void const* addr, u32 size)
|-
| 0x55
| Result StartInterProcessDma(Handle* dma, Handle dstProcess, void* dst, Handle srcProcess, const void* src, u32 size, const DmaConfig& config )
|-
| 0x56
| Result StopDma(Handle dma)
|-
| 0x57
| Result GetDmaState(DmaState* state, Handle dma)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| Result DebugActiveProcess(Handle* debug, u32 processID)
|-
| 0x61
| Result BreakDebugProcess(Handle debug)
|-
| 0x62
| Result TerminateDebugProcess(Handle debug)
|-
| 0x63
| Result GetProcessDebugEvent(DebugEventInfo* info, Handle debug)
|-
| 0x64
| Result ContinueDebugEvent(Handle debug, u32 flags)
|-
| 0x65
| Result GetProcessList(s32* processCount, u32* processIds, s32 processIdMaxCount)
|-
| 0x66
| Result GetThreadList(s32* threadCount, u32* threadIds, s32 threadIdMaxCount, Handle domain)
|-
| 0x67
| Result GetDebugThreadContext(ThreadContext* context, Handle debug, u32 threadId, u32 controlFlags)
|-
| 0x68
| Result SetDebugThreadContext(Handle debug, u32 threadId, ThreadContext* context, u32 controlFlags)
|-
| 0x69
| Result QueryDebugProcessMemory(MemoryInfo* blockInfo, PageInfo* pageInfo, Handle process, u32 addr)
|-
| 0x6A
| Result ReadProcessMemory(void* buffer, Handle debug, u32 addr, u32 size)
|-
| 0x6B
| Result WriteProcessMemory(Handle debug, void const* buffer, u32 addr, u32 size)
|-
| 0x6C
| Result SetHardwareBreakPoint(s32 registerId, u32 control, u32 value)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

== CreateThread ==
R0=s32 threadpriority
R1=func entrypoint
R2=u32 arg
R3=u32 stacktop
R4=s32 processorid

Result result=R0
Handle* thread=R1

= Types and structures =

== enum MemoryState ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

== enum PageFlags ==
{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

== enum MemoryOperation ==

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x1000
|}

== enum MemoryPermission ==

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| READ
| 1
|-
| WRITE
| 2
|-
| READWRITE
| 3
|-
| DONTCARE
| 0x10000000
|}

== enum ResetType ==

{| class="wikitable" border="1"
! Reset type
! Id
|-
| ONESHOT
| 0
|-
| STICKY
| 1
|-
| PULSE
| 2
|}

== struct MemoryInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Base address
|-
| u32
| Size
|-
| u32
| Permission
|-
| enum MemoryState
| State
|}

== struct PageInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Flags
|}

== struct StartupInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| s32
| Priority
|-
| u32
| Stack size
|-
| s32
| argc
|-
| s16*
| argv
|-
| s16*
| envp
|}

= Processes =
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

= Threads =
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

= Memory Mapping =
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

= Debugging =
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

= KernelSetState =
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

= GetSystemInfo =
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-22T22:19:39Z

Neimod:

= System calls =
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| Result ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| Result QueryMemory(MemoryInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| void ExitProcess(void)
|-
| 0x4
| Result GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
|-
| 0x5
| Result SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| Result GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
|-
| 0x7
| Result SetProcessIdealProcessor(Handle process, s32 idealprocessor)
|-
| 0x8
| Result CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stacktop, s32 threadpriority, s32 processorid)
|-
| 0x9
| void ExitThread(void)
|-
| 0xA
| void SleepThread(s64 nanoseconds)
|-
| 0xB
| Result GetThreadPriority(s32* priority, Handle thread)
|-
| 0xC
| Result SetThreadPriority(Handle thread, s32 priority)
|-
| 0xD
| Result GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount)
|-
| 0xE
| Result SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| Result GetThreadIdealProcessor(s32* processorid, Handle thread)
|-
| 0x10
| Result SetThreadIdealProcessor(Handle thread, s32 processorid)
|-
| 0x11
| s32 GetCurrentProcessorNumber(void)
|-
| 0x12
| Result Run(Handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| Result CreateMutex(Handle* mutex, bool initialLocked)
|-
| 0x14
| Result ReleaseMutex(Handle mutex)
|-
| 0x15
| Result CreateSemaphore(Handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| Result ReleaseSemaphore(s32* count, Handle semaphore, s32 releaseCount)
|-
| 0x17
| Result CreateEvent(Handle* event, ResetType resettype)
|-
| 0x18
| Result SignalEvent(Handle event)
|-
| 0x19
| Result ClearEvent(Handle event)
|-
| 0x1A
| Result CreateTimer(Handle* timer, ResetType resettype)
|-
| 0x1B
| Result SetTimer(Handle timer, s64 initial, s64 interval)
|-
| 0x1C
| Result CancelTimer(Handle timer)
|-
| 0x1D
| Result ClearTimer(Handle timer)
|-
| 0x1E
| Result CreateMemoryBlock(Handle* memblock, u32 memory, u32 size, u32 mypermission, u32 otherpermission)
|-
| 0x1F
| Result MapMemoryBlock(Handle memblock, u32 addr, u32 mypermissions, u32 otherpermission)
|-
| 0x20
| Result UnmapMemoryBlock(Handle memblock, u32 addr)
|-
| 0x21
| Result CreateAddressArbiter(Handle* arbiter)
|-
| 0x22
| Result ArbitrateAddress(Handle arbiter, u32 addr, ArbitrationType type, s32 value)
|-
| 0x23
| Result CloseHandle(Handle handle)
|-
| 0x24
| Result WaitSynchronization1(Handle handle, s64 nanoseconds)
|-
| 0x25
| Result WaitSynchronizationN(s32* out, Handle* handles, s32 handlecount, bool waitAll, s64 nanoseconds)
|-
| 0x26
| Result SignalAndWait(s32* out, Handle signal, Handle* handles, s32 handleCount, bool waitAll, s64 nanoseconds)
|-
| 0x27
| Result DuplicateHandle(Handle* out, Handle original)
|-
| 0x28
| s64 GetSystemTick(void)
|-
| 0x29
| Result GetHandleInfo(s64* out, Handle handle, HandleInfoType type)
|-
| 0x2A
| Result GetSystemInfo(s64* out, SystemInfoType type, s32 param)
|-
| 0x2B
| Result GetProcessInfo(s64* out, Handle process, ProcessInfoType type)
|-
| 0x2C
| Result GetThreadInfo(s64* out, Handle thread, ThreadInfoType type)
|-
| 0x2D
| Result ConnectToPort(Handle* out, const char* portName)
|-
| 0x2E
| Result SendSyncRequest1(Handle session) (Stubbed)
|-
| 0x2F
| Result SendSyncRequest2(Handle session) (Stubbed)
|-
| 0x30
| Result SendSyncRequest3(Handle session) (Stubbed)
|-
| 0x31
| Result SendSyncRequest4(Handle session) (Stubbed)
|-
| 0x32
| Result SendSyncRequest(Handle session)
|-
| 0x33
| Result OpenProcess(Handle* process, u32 processId)
|-
| 0x34
| Result OpenThread(Handle* thread, Handle process, u32 threadId)
|-
| 0x35
| Result GetProcessId(u32* processId, Handle process)
|-
| 0x36
| Result GetProcessIdOfThread(u32* processId, Handle thread)
|-
| 0x37
| Result GetThreadId(u32* threadId, Handle thread)
|-
| 0x38
| Result GetResourceLimit(Handle* resourceLimit, Handle process)
|-
| 0x39
| Result GetResourceLimitLimitValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
|-
| 0x3A
| Result GetResourceLimitCurrentValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
|-
| 0x3B
| Result GetThreadContext(ThreadContext* context, Handle thread) (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| Result CreatePort(Handle* portServer, Handle* portClient, const char* name, s32 maxSessions)
|-
| 0x48
| Result CreateSessionToPort(Handle* session, Handle port)
|-
| 0x49
| Result CreateSession(Handle* sessionServer, Handle* sessionClient)
|-
| 0x4A
| Result AcceptSession(Handle* session, Handle port)
|-
| 0x4B
| Result ReplyAndReceive1(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4C
| Result ReplyAndReceive2(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4D
| Result ReplyAndReceive3(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4E
| Result ReplyAndReceive4(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4F
| Result ReplyAndReceive(s32* index, Handle* handles, s32 handleCount, Handle replyTarget)
|-
| 0x50
| Result BindInterrupt(Interrupt name, Handle syncObject, s32 priority, bool isManualClear)
|-
| 0x51
| Result UnbindInterrupt(Interrupt name, Handle syncObject)
|-
| 0x52
| Result InvalidateProcessDataCache(Handle process, void* addr, u32 size)
|-
| 0x53
| Result StoreProcessDataCache(Handle process, void const* addr, u32 size)
|-
| 0x54
| Result FlushProcessDataCache(Handle process, void const* addr, u32 size)
|-
| 0x55
| Result StartInterProcessDma(Handle* dma, Handle dstProcess, void* dst, Handle srcProcess, const void* src, u32 size, const DmaConfig& config )
|-
| 0x56
| Result StopDma(Handle dma)
|-
| 0x57
| Result GetDmaState(DmaState* state, Handle dma)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| Result DebugActiveProcess(Handle* debug, u32 processID)
|-
| 0x61
| Result BreakDebugProcess(Handle debug)
|-
| 0x62
| Result TerminateDebugProcess(Handle debug)
|-
| 0x63
| Result GetProcessDebugEvent(DebugEventInfo* info, Handle debug)
|-
| 0x64
| Result ContinueDebugEvent(Handle debug, u32 flags)
|-
| 0x65
| Result GetProcessList(s32* processCount, u32* processIds, s32 processIdMaxCount)
|-
| 0x66
| Result GetThreadList(s32* threadCount, u32* threadIds, s32 threadIdMaxCount, Handle domain)
|-
| 0x67
| Result GetDebugThreadContext(ThreadContext* context, Handle debug, u32 threadId, u32 controlFlags)
|-
| 0x68
| Result SetDebugThreadContext(Handle debug, u32 threadId, ThreadContext* context, u32 controlFlags)
|-
| 0x69
| Result QueryDebugProcessMemory(MemoryInfo* blockInfo, PageInfo* pageInfo, Handle process, u32 addr)
|-
| 0x6A
| Result ReadProcessMemory(void* buffer, Handle debug, u32 addr, u32 size)
|-
| 0x6B
| Result WriteProcessMemory(Handle debug, void const* buffer, u32 addr, u32 size)
|-
| 0x6C
| Result SetHardwareBreakPoint(s32 registerId, u32 control, u32 value)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

== CreateThread ==
R0=threadpriority
R1=entrypoint
R2=arg
R3=stacktop
R4=processorid

result=R0
thread=R1

= Types and structures =

== enum MemoryState ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

== enum PageFlags ==
{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

== enum MemoryOperation ==

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x1000
|}

== enum MemoryPermission ==

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| READ
| 1
|-
| WRITE
| 2
|-
| READWRITE
| 3
|-
| DONTCARE
| 0x10000000
|}

== enum ResetType ==

{| class="wikitable" border="1"
! Reset type
! Id
|-
| ONESHOT
| 0
|-
| STICKY
| 1
|-
| PULSE
| 2
|}

== struct MemoryInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Base address
|-
| u32
| Size
|-
| u32
| Permission
|-
| enum MemoryState
| State
|}

== struct PageInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Flags
|}

== struct StartupInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| s32
| Priority
|-
| u32
| Stack size
|-
| s32
| argc
|-
| s16*
| argv
|-
| s16*
| envp
|}

= Processes =
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

= Threads =
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

= Memory Mapping =
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

= Debugging =
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

= KernelSetState =
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

= GetSystemInfo =
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-22T02:32:50Z

Neimod:

= System calls =
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| Result ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| Result QueryMemory(MemoryInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| void ExitProcess(void)
|-
| 0x4
| Result GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
|-
| 0x5
| Result SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| Result GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
|-
| 0x7
| Result SetProcessIdealProcessor(Handle process, s32 idealprocessor)
|-
| 0x8
| Result CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stacktop, s32 threadpriority, s32 processorid)
|-
| 0x9
| void ExitThread(void)
|-
| 0xA
| void SleepThread(s64 nanoseconds)
|-
| 0xB
| Result GetThreadPriority(s32* priority, Handle thread)
|-
| 0xC
| Result SetThreadPriority(Handle thread, s32 priority)
|-
| 0xD
| Result GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount)
|-
| 0xE
| Result SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| Result GetThreadIdealProcessor(s32* processorid, Handle thread)
|-
| 0x10
| Result SetThreadIdealProcessor(Handle thread, s32 processorid)
|-
| 0x11
| s32 GetCurrentProcessorNumber(void)
|-
| 0x12
| Result Run(Handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| Result CreateMutex(Handle* mutex, bool initialLocked)
|-
| 0x14
| Result ReleaseMutex(Handle mutex)
|-
| 0x15
| Result CreateSemaphore(Handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| Result ReleaseSemaphore(s32* count, Handle semaphore, s32 releaseCount)
|-
| 0x17
| Result CreateEvent(Handle* event, ResetType resettype)
|-
| 0x18
| Result SignalEvent(Handle event)
|-
| 0x19
| Result ClearEvent(Handle event)
|-
| 0x1A
| Result CreateTimer(Handle* timer, ResetType resettype)
|-
| 0x1B
| Result SetTimer(Handle timer, s64 initial, s64 interval)
|-
| 0x1C
| Result CancelTimer(Handle timer)
|-
| 0x1D
| Result ClearTimer(Handle timer)
|-
| 0x1E
| Result CreateMemoryBlock(Handle* memblock, u32 memory, u32 size, u32 mypermission, u32 otherpermission)
|-
| 0x1F
| Result MapMemoryBlock(Handle memblock, u32 addr, u32 mypermissions, u32 otherpermission)
|-
| 0x20
| Result UnmapMemoryBlock(Handle memblock, u32 addr)
|-
| 0x21
| Result CreateAddressArbiter(Handle* arbiter)
|-
| 0x22
| Result ArbitrateAddress(Handle arbiter, u32 addr, ArbitrationType type, s32 value)
|-
| 0x23
| Result CloseHandle(Handle handle)
|-
| 0x24
| Result WaitSynchronization1(Handle handle, s64 nanoseconds)
|-
| 0x25
| Result WaitSynchronizationN(s32* out, Handle* handles, s32 handlecount, bool waitAll, s64 nanoseconds)
|-
| 0x26
| Result SignalAndWait(s32* out, Handle signal, Handle* handles, s32 handleCount, bool waitAll, s64 nanoseconds)
|-
| 0x27
| Result DuplicateHandle(Handle* out, Handle original)
|-
| 0x28
| s64 GetSystemTick(void)
|-
| 0x29
| Result GetHandleInfo(s64* out, Handle handle, HandleInfoType type)
|-
| 0x2A
| Result GetSystemInfo(s64* out, SystemInfoType type, s32 param)
|-
| 0x2B
| Result GetProcessInfo(s64* out, Handle process, ProcessInfoType type)
|-
| 0x2C
| Result GetThreadInfo(s64* out, Handle thread, ThreadInfoType type)
|-
| 0x2D
| Result ConnectToPort(Handle* out, const char* portName)
|-
| 0x2E
| Result SendSyncRequest1(Handle session) (Stubbed)
|-
| 0x2F
| Result SendSyncRequest2(Handle session) (Stubbed)
|-
| 0x30
| Result SendSyncRequest3(Handle session) (Stubbed)
|-
| 0x31
| Result SendSyncRequest4(Handle session) (Stubbed)
|-
| 0x32
| Result SendSyncRequest(Handle session)
|-
| 0x33
| Result OpenProcess(Handle* process, u32 processId)
|-
| 0x34
| Result OpenThread(Handle* thread, Handle process, u32 threadId)
|-
| 0x35
| Result GetProcessId(u32* processId, Handle process)
|-
| 0x36
| Result GetProcessIdOfThread(u32* processId, Handle thread)
|-
| 0x37
| Result GetThreadId(u32* threadId, Handle thread)
|-
| 0x38
| Result GetResourceLimit(Handle* resourceLimit, Handle process)
|-
| 0x39
| Result GetResourceLimitLimitValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
|-
| 0x3A
| Result GetResourceLimitCurrentValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
|-
| 0x3B
| Result GetThreadContext(ThreadContext* context, Handle thread) (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| Result CreatePort(Handle* portServer, Handle* portClient, const char* name, s32 maxSessions)
|-
| 0x48
| Result CreateSessionToPort(Handle* session, Handle port)
|-
| 0x49
| Result CreateSession(Handle* sessionServer, Handle* sessionClient)
|-
| 0x4A
| Result AcceptSession(Handle* session, Handle port)
|-
| 0x4B
| Result ReplyAndReceive1(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4C
| Result ReplyAndReceive2(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4D
| Result ReplyAndReceive3(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4E
| Result ReplyAndReceive4(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4F
| Result ReplyAndReceive(s32* index, Handle* handles, s32 handleCount, Handle replyTarget)
|-
| 0x50
| Result BindInterrupt(Interrupt name, Handle syncObject, s32 priority, bool isManualClear)
|-
| 0x51
| Result UnbindInterrupt(Interrupt name, Handle syncObject)
|-
| 0x52
| Result InvalidateProcessDataCache(Handle process, void* addr, u32 size)
|-
| 0x53
| Result StoreProcessDataCache(Handle process, void const* addr, u32 size)
|-
| 0x54
| Result FlushProcessDataCache(Handle process, void const* addr, u32 size)
|-
| 0x55
| Result StartInterProcessDma(Handle* dma, Handle dstProcess, void* dst, Handle srcProcess, const void* src, u32 size, const DmaConfig& config )
|-
| 0x56
| Result StopDma(Handle dma)
|-
| 0x57
| Result GetDmaState(DmaState* state, Handle dma)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| Result DebugActiveProcess(Handle* debug, u32 processID)
|-
| 0x61
| Result BreakDebugProcess(Handle debug)
|-
| 0x62
| Result TerminateDebugProcess(Handle debug)
|-
| 0x63
| Result GetProcessDebugEvent(DebugEventInfo* info, Handle debug)
|-
| 0x64
| Result ContinueDebugEvent(Handle debug, u32 flags)
|-
| 0x65
| Result GetProcessList(s32* processCount, u32* processIds, s32 processIdMaxCount)
|-
| 0x66
| Result GetThreadList(s32* threadCount, u32* threadIds, s32 threadIdMaxCount, Handle domain)
|-
| 0x67
| Result GetDebugThreadContext(ThreadContext* context, Handle debug, u32 threadId, u32 controlFlags)
|-
| 0x68
| Result SetDebugThreadContext(Handle debug, u32 threadId, ThreadContext* context, u32 controlFlags)
|-
| 0x69
| Result QueryDebugProcessMemory(MemoryInfo* blockInfo, PageInfo* pageInfo, Handle process, u32 addr)
|-
| 0x6A
| Result ReadProcessMemory(void* buffer, Handle debug, u32 addr, u32 size)
|-
| 0x6B
| Result WriteProcessMemory(Handle debug, void const* buffer, u32 addr, u32 size)
|-
| 0x6C
| Result SetHardwareBreakPoint(s32 registerId, u32 control, u32 value)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

= Types and structures =

== enum MemoryState ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

== enum PageFlags ==
{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

== enum MemoryOperation ==

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x1000
|}

== enum MemoryPermission ==

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| READ
| 1
|-
| WRITE
| 2
|-
| READWRITE
| 3
|-
| DONTCARE
| 0x10000000
|}

== enum ResetType ==

{| class="wikitable" border="1"
! Reset type
! Id
|-
| ONESHOT
| 0
|-
| STICKY
| 1
|-
| PULSE
| 2
|}

== struct MemoryInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Base address
|-
| u32
| Size
|-
| u32
| Permission
|-
| enum MemoryState
| State
|}

== struct PageInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Flags
|}

== struct StartupInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| s32
| Priority
|-
| u32
| Stack size
|-
| s32
| argc
|-
| s16*
| argv
|-
| s16*
| envp
|}

= Processes =
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

= Threads =
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

= Memory Mapping =
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

= Debugging =
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

= KernelSetState =
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

= GetSystemInfo =
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-22T02:26:30Z

Neimod:

= System calls =
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| Result ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| Result QueryMemory(MemoryInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| void ExitProcess(void)
|-
| 0x4
| Result GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
|-
| 0x5
| Result SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| Result GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
|-
| 0x7
| Result SetProcessIdealProcessor(Handle process, s32 idealprocessor)
|-
| 0x8
| Result CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stacktop, s32 threadpriority, s32 processorid)
|-
| 0x9
| void ExitThread(void)
|-
| 0xA
| void SleepThread(s64 nanoseconds)
|-
| 0xB
| Result GetThreadPriority(s32* priority, Handle thread)
|-
| 0xC
| Result SetThreadPriority(Handle thread, s32 priority)
|-
| 0xD
| Result GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount)
|-
| 0xE
| Result SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| Result GetThreadIdealProcessor(s32* processorid, Handle thread)
|-
| 0x10
| Result SetThreadIdealProcessor(Handle thread, s32 processorid)
|-
| 0x11
| s32 GetCurrentProcessorNumber(void)
|-
| 0x12
| Result Run(Handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| Result CreateMutex(Handle* mutex, bool initialLocked)
|-
| 0x14
| Result ReleaseMutex(Handle mutex)
|-
| 0x15
| Result CreateSemaphore(Handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| Result ReleaseSemaphore(s32* count, Handle semaphore, s32 releaseCount)
|-
| 0x17
| Result CreateEvent(Handle* event, ResetType resettype)
|-
| 0x18
| Result SignalEvent(Handle event)
|-
| 0x19
| Result ClearEvent(Handle event)
|-
| 0x1A
| Result CreateTimer(Handle* timer, ResetType resettype)
|-
| 0x1B
| Result SetTimer(Handle timer, s64 initial, s64 interval)
|-
| 0x1C
| Result CancelTimer(Handle timer)
|-
| 0x1D
| Result ClearTimer(Handle timer)
|-
| 0x1E
| Result CreateMemoryBlock(Handle* memblock, u32 memory, u32 size, u32 mypermission, u32 otherpermission)
|-
| 0x1F
| Result MapMemoryBlock(Handle memblock, u32 addr, u32 mypermissions, u32 otherpermission)
|-
| 0x20
| Result UnmapMemoryBlock(Handle memblock, u32 addr)
|-
| 0x21
| Result CreateAddressArbiter(Handle* arbiter)
|-
| 0x22
| Result ArbitrateAddress(Handle arbiter, u32 addr, ArbitrationType type, s32 value)
|-
| 0x23
| Result CloseHandle(Handle handle)
|-
| 0x24
| Result WaitSynchronization1(Handle handle, s64 nanoseconds)
|-
| 0x25
| Result WaitSynchronizationN(s32* out, Handle* handles, s32 handlecount, bool waitAll, s64 nanoseconds)
|-
| 0x26
| Result SignalAndWait(s32* out, Handle signal, Handle* handles, s32 handleCount, bool waitAll, s64 nanoseconds)
|-
| 0x27
| Result DuplicateHandle(Handle* out, Handle original)
|-
| 0x28
| s64 GetSystemTick(void)
|-
| 0x29
| Result GetHandleInfo(s64* out, Handle handle, HandleInfoType type)
|-
| 0x2A
| Result GetSystemInfo(s64* out, SystemInfoType type, s32 param)
|-
| 0x2B
| Result GetProcessInfo(s64* out, Handle process, ProcessInfoType type)
|-
| 0x2C
| Result GetThreadInfo(s64* out, Handle thread, ThreadInfoType type)
|-
| 0x2D
| Result ConnectToPort(Handle* out, const char* portName)
|-
| 0x2E
| Result SendSyncRequest1(Handle session) (Stubbed)
|-
| 0x2F
| Result SendSyncRequest2(Handle session) (Stubbed)
|-
| 0x30
| Result SendSyncRequest3(Handle session) (Stubbed)
|-
| 0x31
| Result SendSyncRequest4(Handle session) (Stubbed)
|-
| 0x32
| Result SendSyncRequest(Handle session)
|-
| 0x33
| Result OpenProcess(Handle* process, u32 processId)
|-
| 0x34
| Result OpenThread(Handle* thread, Handle process, u32 threadId)
|-
| 0x35
| Result GetProcessId(u32* processId, Handle process)
|-
| 0x36
| Result GetProcessIdOfThread(u32* processId, Handle thread)
|-
| 0x37
| Result GetThreadId(u32* threadId, Handle thread)
|-
| 0x38
| Result GetResourceLimit(Handle* resourceLimit, Handle process)
|-
| 0x39
| Result GetResourceLimitLimitValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
|-
| 0x3A
| Result GetResourceLimitCurrentValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
|-
| 0x3B
| Result GetThreadContext(ThreadContext* context, Handle thread) (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| Result CreatePort(Handle* portServer, Handle* portClient, const char* name, s32 maxSessions)
|-
| 0x48
| Result CreateSessionToPort(Handle* session, Handle port)
|-
| 0x49
| Result CreateSession(Handle* sessionServer, Handle* sessionClient)
|-
| 0x4A
| Result AcceptSession(Handle* session, Handle port)
|-
| 0x4B
| Result ReplyAndReceive1(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4C
| Result ReplyAndReceive2(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4D
| Result ReplyAndReceive3(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4E
| Result ReplyAndReceive4(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4F
| Result ReplyAndReceive(s32* index, Handle* handles, s32 handleCount, Handle replyTarget)
|-
| 0x50
| Result BindInterrupt(Interrupt name, Handle syncObject, s32 priority, bool isManualClear)
|-
| 0x51
| Result UnbindInterrupt(Interrupt name, Handle syncObject)
|-
| 0x52
| Result InvalidateProcessDataCache(Handle process, void* addr, u32 size)
|-
| 0x53
| Result StoreProcessDataCache(Handle process, void const* addr, u32 size)
|-
| 0x54
| Result FlushProcessDataCache(Handle process, void const* addr, u32 size)
|-
| 0x55
| Result StartInterProcessDma(Handle* dma, Handle dstProcess, void* dst, Handle srcProcess, const void* src, u32 size, const DmaConfig& config )
|-
| 0x56
| Result StopDma(Handle dma)
|-
| 0x57
| Result GetDmaState(DmaState* state, Handle dma)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

= Types and structures =

== enum MemoryState ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

== enum PageFlags ==
{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

== enum MemoryOperation ==

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x1000
|}

== enum MemoryPermission ==

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| READ
| 1
|-
| WRITE
| 2
|-
| READWRITE
| 3
|-
| DONTCARE
| 0x10000000
|}

== enum ResetType ==

{| class="wikitable" border="1"
! Reset type
! Id
|-
| ONESHOT
| 0
|-
| STICKY
| 1
|-
| PULSE
| 2
|}

== struct MemoryInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Base address
|-
| u32
| Size
|-
| u32
| Permission
|-
| enum MemoryState
| State
|}

== struct PageInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Flags
|}

== struct StartupInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| s32
| Priority
|-
| u32
| Stack size
|-
| s32
| argc
|-
| s16*
| argv
|-
| s16*
| envp
|}

= Processes =
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

= Threads =
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

= Memory Mapping =
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

= Debugging =
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

= KernelSetState =
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

= GetSystemInfo =
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-22T02:20:38Z

Neimod:

= System calls =
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| Result ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| Result QueryMemory(MemoryInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| void ExitProcess(void)
|-
| 0x4
| Result GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
|-
| 0x5
| Result SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| Result GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
|-
| 0x7
| Result SetProcessIdealProcessor(Handle process, s32 idealprocessor)
|-
| 0x8
| Result CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stacktop, s32 threadpriority, s32 processorid)
|-
| 0x9
| void ExitThread(void)
|-
| 0xA
| void SleepThread(s64 nanoseconds)
|-
| 0xB
| Result GetThreadPriority(s32* priority, Handle thread)
|-
| 0xC
| Result SetThreadPriority(Handle thread, s32 priority)
|-
| 0xD
| Result GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount)
|-
| 0xE
| Result SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| Result GetThreadIdealProcessor(s32* processorid, Handle thread)
|-
| 0x10
| Result SetThreadIdealProcessor(Handle thread, s32 processorid)
|-
| 0x11
| s32 GetCurrentProcessorNumber(void)
|-
| 0x12
| Result Run(Handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| Result CreateMutex(Handle* mutex, bool initialLocked)
|-
| 0x14
| Result ReleaseMutex(Handle mutex)
|-
| 0x15
| Result CreateSemaphore(Handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| Result ReleaseSemaphore(s32* count, Handle semaphore, s32 releaseCount)
|-
| 0x17
| Result CreateEvent(Handle* event, ResetType resettype)
|-
| 0x18
| Result SignalEvent(Handle event)
|-
| 0x19
| Result ClearEvent(Handle event)
|-
| 0x1A
| Result CreateTimer(Handle* timer, ResetType resettype)
|-
| 0x1B
| Result SetTimer(Handle timer, s64 initial, s64 interval)
|-
| 0x1C
| Result CancelTimer(Handle timer)
|-
| 0x1D
| Result ClearTimer(Handle timer)
|-
| 0x1E
| Result CreateMemoryBlock(Handle* memblock, u32 memory, u32 size, u32 mypermission, u32 otherpermission)
|-
| 0x1F
| Result MapMemoryBlock(Handle memblock, u32 addr, u32 mypermissions, u32 otherpermission)
|-
| 0x20
| Result UnmapMemoryBlock(Handle memblock, u32 addr)
|-
| 0x21
| Result CreateAddressArbiter(Handle* arbiter)
|-
| 0x22
| Result ArbitrateAddress(Handle arbiter, u32 addr, ArbitrationType type, s32 value)
|-
| 0x23
| Result CloseHandle(Handle handle)
|-
| 0x24
| Result WaitSynchronization1(Handle handle, s64 nanoseconds)
|-
| 0x25
| Result WaitSynchronizationN(s32* out, Handle* handles, s32 handlecount, bool waitAll, s64 nanoseconds)
|-
| 0x26
| Result SignalAndWait(s32* out, Handle signal, Handle* handles, s32 handleCount, bool waitAll, s64 nanoseconds)
|-
| 0x27
| Result DuplicateHandle(Handle* out, Handle original)
|-
| 0x28
| s64 GetSystemTick(void)
|-
| 0x29
| Result GetHandleInfo(s64* out, Handle handle, HandleInfoType type)
|-
| 0x2A
| Result GetSystemInfo(s64* out, SystemInfoType type, s32 param)
|-
| 0x2B
| Result GetProcessInfo(s64* out, Handle process, ProcessInfoType type)
|-
| 0x2C
| Result GetThreadInfo(s64* out, Handle thread, ThreadInfoType type)
|-
| 0x2D
| Result ConnectToPort(Handle* out, const char* portName)
|-
| 0x2E
| Result SendSyncRequest1(Handle session) (Stubbed)
|-
| 0x2F
| Result SendSyncRequest2(Handle session) (Stubbed)
|-
| 0x30
| Result SendSyncRequest3(Handle session) (Stubbed)
|-
| 0x31
| Result SendSyncRequest4(Handle session) (Stubbed)
|-
| 0x32
| Result SendSyncRequest(Handle session)
|-
| 0x33
| Result OpenProcess(Handle* process, u32 processId)
|-
| 0x34
| Result OpenThread(Handle* thread, Handle process, u32 threadId)
|-
| 0x35
| Result GetProcessId(u32* processId, Handle process)
|-
| 0x36
| Result GetProcessIdOfThread(u32* processId, Handle thread)
|-
| 0x37
| Result GetThreadId(u32* threadId, Handle thread)
|-
| 0x38
| Result GetResourceLimit(Handle* resourceLimit, Handle process)
|-
| 0x39
| Result GetResourceLimitLimitValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
|-
| 0x3A
| Result GetResourceLimitCurrentValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
|-
| 0x3B
| Result GetThreadContext(ThreadContext* context, Handle thread) (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| Result CreatePort(Handle* portServer, Handle* portClient, const char* name, s32 maxSessions)
|-
| 0x48
| Result CreateSessionToPort(Handle* session, Handle port)
|-
| 0x49
| Result CreateSession(Handle* sessionServer, Handle* sessionClient)
|-
| 0x4A
| Result AcceptSession(Handle* session, Handle port)
|-
| 0x4B
| Result ReplyAndReceive1(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4C
| Result ReplyAndReceive2(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4D
| Result ReplyAndReceive3(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4E
| Result ReplyAndReceive4(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
|-
| 0x4F
| Result ReplyAndReceive(s32* index, Handle* handles, s32 handleCount, Handle replyTarget)
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

= Types and structures =

== enum MemoryState ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

== enum PageFlags ==
{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

== enum MemoryOperation ==

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x1000
|}

== enum MemoryPermission ==

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| READ
| 1
|-
| WRITE
| 2
|-
| READWRITE
| 3
|-
| DONTCARE
| 0x10000000
|}

== enum ResetType ==

{| class="wikitable" border="1"
! Reset type
! Id
|-
| ONESHOT
| 0
|-
| STICKY
| 1
|-
| PULSE
| 2
|}

== struct MemoryInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Base address
|-
| u32
| Size
|-
| u32
| Permission
|-
| enum MemoryState
| State
|}

== struct PageInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Flags
|}

== struct StartupInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| s32
| Priority
|-
| u32
| Stack size
|-
| s32
| argc
|-
| s16*
| argv
|-
| s16*
| envp
|}

= Processes =
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

= Threads =
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

= Memory Mapping =
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

= Debugging =
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

= KernelSetState =
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

= GetSystemInfo =
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-22T02:12:59Z

Neimod:

= System calls =
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| Result ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| Result QueryMemory(MemoryInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| void ExitProcess(void)
|-
| 0x4
| Result GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
|-
| 0x5
| Result SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| Result GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
|-
| 0x7
| Result SetProcessIdealProcessor(Handle process, s32 idealprocessor)
|-
| 0x8
| Result CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stacktop, s32 threadpriority, s32 processorid)
|-
| 0x9
| void ExitThread(void)
|-
| 0xA
| void SleepThread(s64 nanoseconds)
|-
| 0xB
| Result GetThreadPriority(s32* priority, Handle thread)
|-
| 0xC
| Result SetThreadPriority(Handle thread, s32 priority)
|-
| 0xD
| Result GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount)
|-
| 0xE
| Result SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| Result GetThreadIdealProcessor(s32* processorid, Handle thread)
|-
| 0x10
| Result SetThreadIdealProcessor(Handle thread, s32 processorid)
|-
| 0x11
| s32 GetCurrentProcessorNumber(void)
|-
| 0x12
| Result Run(Handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| Result CreateMutex(Handle* mutex, bool initialLocked)
|-
| 0x14
| Result ReleaseMutex(Handle mutex)
|-
| 0x15
| Result CreateSemaphore(Handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| Result ReleaseSemaphore(s32* count, Handle semaphore, s32 releaseCount)
|-
| 0x17
| Result CreateEvent(Handle* event, ResetType resettype)
|-
| 0x18
| Result SignalEvent(Handle event)
|-
| 0x19
| Result ClearEvent(Handle event)
|-
| 0x1A
| Result CreateTimer(Handle* timer, ResetType resettype)
|-
| 0x1B
| Result SetTimer(Handle timer, s64 initial, s64 interval)
|-
| 0x1C
| Result CancelTimer(Handle timer)
|-
| 0x1D
| Result ClearTimer(Handle timer)
|-
| 0x1E
| Result CreateMemoryBlock(Handle* memblock, u32 memory, u32 size, u32 mypermission, u32 otherpermission)
|-
| 0x1F
| Result MapMemoryBlock(Handle memblock, u32 addr, u32 mypermissions, u32 otherpermission)
|-
| 0x20
| Result UnmapMemoryBlock(Handle memblock, u32 addr)
|-
| 0x21
| Result CreateAddressArbiter(Handle* arbiter)
|-
| 0x22
| Result ArbitrateAddress(Handle arbiter, u32 addr, ArbitrationType type, s32 value)
|-
| 0x23
| Result CloseHandle(Handle handle)
|-
| 0x24
| Result WaitSynchronization1(Handle handle, s64 nanoseconds)
|-
| 0x25
| Result WaitSynchronizationN(s32* out, Handle* handles, s32 handlecount, bool waitAll, s64 nanoseconds)
|-
| 0x26
| Result SignalAndWait(s32* out, Handle signal, Handle* handles, s32 handleCount, bool waitAll, s64 nanoseconds)
|-
| 0x27
| Result DuplicateHandle(Handle* out, Handle original)
|-
| 0x28
| s64 GetSystemTick(void)
|-
| 0x29
| Result GetHandleInfo(s64* out, Handle handle, HandleInfoType type)
|-
| 0x2A
| Result GetSystemInfo(s64* out, SystemInfoType type, s32 param)
|-
| 0x2B
| Result GetProcessInfo(s64* out, Handle process, ProcessInfoType type)
|-
| 0x2C
| Result GetThreadInfo(s64* out, Handle thread, ThreadInfoType type)
|-
| 0x2D
| Result ConnectToPort(Handle* out, const char* portName)
|-
| 0x2E
| SendSyncRequest1 (Stubbed)
|-
| 0x2F
| SendSyncRequest2 (Stubbed)
|-
| 0x30
| SendSyncRequest3 (Stubbed)
|-
| 0x31
| SendSyncRequest4 (Stubbed)
|-
| 0x32
| SendSyncRequest(Handle)
|-
| 0x33
| OpenProcess(Handle *KProcess, unsigned int ProcessId)
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId(unsigned int *ProcessId, Handle KProcess)
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit(Handle*, Handle KProcess)
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1 (Stubbed)
|-
| 0x4C
| ReplyAndReceive2 (Stubbed)
|-
| 0x4D
| ReplyAndReceive3 (Stubbed)
|-
| 0x4E
| ReplyAndReceive4 (Stubbed)
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

= Types and structures =

== enum MemoryState ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

== enum PageFlags ==
{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

== enum MemoryOperation ==

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x1000
|}

== enum MemoryPermission ==

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| READ
| 1
|-
| WRITE
| 2
|-
| READWRITE
| 3
|-
| DONTCARE
| 0x10000000
|}

== enum ResetType ==

{| class="wikitable" border="1"
! Reset type
! Id
|-
| ONESHOT
| 0
|-
| STICKY
| 1
|-
| PULSE
| 2
|}

== struct MemoryInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Base address
|-
| u32
| Size
|-
| u32
| Permission
|-
| enum MemoryState
| State
|}

== struct PageInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Flags
|}

== struct StartupInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| s32
| Priority
|-
| u32
| Stack size
|-
| s32
| argc
|-
| s16*
| argv
|-
| s16*
| envp
|}

= Processes =
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

= Threads =
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

= Memory Mapping =
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

= Debugging =
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

= KernelSetState =
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

= GetSystemInfo =
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-21T01:08:18Z

Neimod:

= System calls =
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| QueryMemory(MemoryInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| ExitProcess(void)
|-
| 0x4
| GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
|-
| 0x5
| SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
|-
| 0x7
| SetProcessIdealProcessor(Handle process, s32 idealprocessor)
|-
| 0x8
| CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stacktop, s32 threadpriority, s32 processorid)
|-
| 0x9
| ExitThread(void)
|-
| 0xA
| SleepThread(s64 nanoseconds)
|-
| 0xB
| GetThreadPriority(s32* priority, Handle thread)
|-
| 0xC
| SetThreadPriority(Handle thread, s32 priority)
|-
| 0xD
| GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount)
|-
| 0xE
| SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| GetThreadIdealProcessor(s32* processorid, Handle thread)
|-
| 0x10
| SetThreadIdealProcessor(Handle thread, s32 processorid)
|-
| 0x11
| GetCurrentProcessorNumber(void)
|-
| 0x12
| Run(Handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| CreateMutex(Handle* mutex, bool initialLocked)
|-
| 0x14
| ReleaseMutex(Handle mutex)
|-
| 0x15
| CreateSemaphore(Handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| ReleaseSemaphore(s32* count, Handle semaphore, s32 releaseCount)
|-
| 0x17
| CreateEvent(Handle* event, ResetType resettype)
|-
| 0x18
| SignalEvent(Handle event)
|-
| 0x19
| ClearEvent(Handle event)
|-
| 0x1A
| CreateTimer(Handle* timer, ResetType resettype)
|-
| 0x1B
| SetTimer(Handle timer, s64 initial, s64 interval)
|-
| 0x1C
| CancelTimer(Handle timer)
|-
| 0x1D
| ClearTimer(Handle timer)
|-
| 0x1E
| CreateMemoryBlock(Handle* memblock, u32 memory, u32 size, u32 mypermission, u32 otherpermission)
|-
| 0x1F
| MapMemoryBlock(Handle memblock, u32 addr, u32 mypermissions, u32 otherpermission)
|-
| 0x20
| UnmapMemoryBlock(Handle memblock, u32 addr)
|-
| 0x21
| CreateAddressArbiter(Handle* arbiter)
|-
| 0x22
| ArbitrateAddress(Handle arbiter, u32 addr, ArbitrationType type, s32 value)
|-
| 0x23
| CloseHandle(Handle handle)
|-
| 0x24
| WaitSynchronization1(Handle handle, s64 nanoseconds)
|-
| 0x25
| WaitSynchronizationN(s32* out, Handle* handles, s32 handlecount, bool waitAll, s64 nanoseconds)
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo(unsigned long long *Output, unsigned int Type0, unsigned int Type1)
|-
| 0x2B
| GetProcessInfo(unsigned long long *Output, Handle KProcess, unsigned int Type)
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort(Handle*, char *PortName)
|-
| 0x2E
| SendSyncRequest1 (Stubbed)
|-
| 0x2F
| SendSyncRequest2 (Stubbed)
|-
| 0x30
| SendSyncRequest3 (Stubbed)
|-
| 0x31
| SendSyncRequest4 (Stubbed)
|-
| 0x32
| SendSyncRequest(Handle)
|-
| 0x33
| OpenProcess(Handle *KProcess, unsigned int ProcessId)
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId(unsigned int *ProcessId, Handle KProcess)
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit(Handle*, Handle KProcess)
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1 (Stubbed)
|-
| 0x4C
| ReplyAndReceive2 (Stubbed)
|-
| 0x4D
| ReplyAndReceive3 (Stubbed)
|-
| 0x4E
| ReplyAndReceive4 (Stubbed)
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

= Types and structures =

== enum MemoryState ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

== enum PageFlags ==
{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

== enum MemoryOperation ==

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x1000
|}

== enum MemoryPermission ==

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| READ
| 1
|-
| WRITE
| 2
|-
| READWRITE
| 3
|-
| DONTCARE
| 0x10000000
|}

== enum ResetType ==

{| class="wikitable" border="1"
! Reset type
! Id
|-
| ONESHOT
| 0
|-
| STICKY
| 1
|-
| PULSE
| 2
|}

== struct MemoryInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Base address
|-
| u32
| Size
|-
| u32
| Permission
|-
| enum MemoryState
| State
|}

== struct PageInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Flags
|}

== struct StartupInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| s32
| Priority
|-
| u32
| Stack size
|-
| s32
| argc
|-
| s16*
| argv
|-
| s16*
| envp
|}

= Processes =
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

= Threads =
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

= Memory Mapping =
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

= Debugging =
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

= KernelSetState =
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

= GetSystemInfo =
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-21T00:51:40Z

Neimod:

= System calls =
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| QueryMemory(MemoryInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| ExitProcess(void)
|-
| 0x4
| GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
|-
| 0x5
| SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
|-
| 0x7
| SetProcessIdealProcessor(Handle process, s32 idealprocessor)
|-
| 0x8
| CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stackbottom, s32 threadpriority, s32 processorid)
|-
| 0x9
| ExitThread(void)
|-
| 0xA
| SleepThread(s64 nanoseconds)
|-
| 0xB
| GetThreadPriority(s32* priority, Handle thread)
|-
| 0xC
| SetThreadPriority(Handle thread, s32 priority)
|-
| 0xD
| GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount)
|-
| 0xE
| SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| GetThreadIdealProcessor(s32* processorid, Handle thread)
|-
| 0x10
| SetThreadIdealProcessor(Handle thread, s32 processorid)
|-
| 0x11
| GetCurrentProcessorNumber(void)
|-
| 0x12
| Run(Handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| CreateMutex(Handle* mutex, bool initialLocked)
|-
| 0x14
| ReleaseMutex(Handle mutex)
|-
| 0x15
| CreateSemaphore(Handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| ReleaseSemaphore(s32* count, Handle semaphore, s32 releaseCount)
|-
| 0x17
| CreateEvent(Handle* event, ResetType resettype)
|-
| 0x18
| SignalEvent(Handle event)
|-
| 0x19
| ClearEvent(Handle event)
|-
| 0x1A
| CreateTimer(Handle* timer, ResetType resettype)
|-
| 0x1B
| SetTimer(Handle timer, s64 initial, s64 interval)
|-
| 0x1C
| CancelTimer(Handle timer)
|-
| 0x1D
| ClearTimer(Handle timer)
|-
| 0x1E
| CreateMemoryBlock(Handle* memblock, u32 memory, u32 size, u32 mypermission, u32 otherpermission)
|-
| 0x1F
| MapMemoryBlock(Handle memblock, u32 addr, u32 mypermissions, u32 otherpermission)
|-
| 0x20
| UnmapMemoryBlock(Handle memblock, u32 addr)
|-
| 0x21
| CreateAddressArbiter(Handle* arbiter)
|-
| 0x22
| ArbitrateAddress(Handle arbiter, u32 addr, ArbitrationType type, s32 value)
|-
| 0x23
| CloseHandle(Handle handle)
|-
| 0x24
| WaitSynchronization1(Handle handle, s64 nanoseconds)
|-
| 0x25
| WaitSynchronizationN(s32* out, Handle* handles, s32 handlecount, bool waitAll, s64 nanoseconds)
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo(unsigned long long *Output, unsigned int Type0, unsigned int Type1)
|-
| 0x2B
| GetProcessInfo(unsigned long long *Output, Handle KProcess, unsigned int Type)
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort(Handle*, char *PortName)
|-
| 0x2E
| SendSyncRequest1 (Stubbed)
|-
| 0x2F
| SendSyncRequest2 (Stubbed)
|-
| 0x30
| SendSyncRequest3 (Stubbed)
|-
| 0x31
| SendSyncRequest4 (Stubbed)
|-
| 0x32
| SendSyncRequest(Handle)
|-
| 0x33
| OpenProcess(Handle *KProcess, unsigned int ProcessId)
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId(unsigned int *ProcessId, Handle KProcess)
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit(Handle*, Handle KProcess)
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1 (Stubbed)
|-
| 0x4C
| ReplyAndReceive2 (Stubbed)
|-
| 0x4D
| ReplyAndReceive3 (Stubbed)
|-
| 0x4E
| ReplyAndReceive4 (Stubbed)
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

= Types and structures =

== enum MemoryState ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

== enum PageFlags ==
{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

== enum MemoryOperation ==

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x1000
|}

== enum MemoryPermission ==

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| READ
| 1
|-
| WRITE
| 2
|-
| READWRITE
| 3
|-
| DONTCARE
| 0x10000000
|}

== enum ResetType ==

{| class="wikitable" border="1"
! Reset type
! Id
|-
| ONESHOT
| 0
|-
| STICKY
| 1
|-
| PULSE
| 2
|}

== struct MemoryInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Base address
|-
| u32
| Size
|-
| u32
| Permission
|-
| enum MemoryState
| State
|}

== struct PageInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Flags
|}

== struct StartupInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| s32
| Priority
|-
| u32
| Stack size
|-
| s32
| argc
|-
| s16*
| argv
|-
| s16*
| envp
|}

= Processes =
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

= Threads =
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

= Memory Mapping =
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

= Debugging =
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

= KernelSetState =
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

= GetSystemInfo =
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-21T00:48:32Z

Neimod:

= System calls =
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| QueryMemory(MemoryInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| ExitProcess(void)
|-
| 0x4
| GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
|-
| 0x5
| SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
|-
| 0x7
| SetProcessIdealProcessor(Handle process, s32 idealprocessor)
|-
| 0x8
| CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stackbottom, s32 threadpriority, s32 processorid)
|-
| 0x9
| ExitThread(void)
|-
| 0xA
| SleepThread(s64 nanoseconds)
|-
| 0xB
| GetThreadPriority(s32* priority, Handle thread)
|-
| 0xC
| SetThreadPriority(Handle thread, s32 priority)
|-
| 0xD
| GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount)
|-
| 0xE
| SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| GetThreadIdealProcessor(s32* processorid, Handle thread)
|-
| 0x10
| SetThreadIdealProcessor(Handle thread, s32 processorid)
|-
| 0x11
| GetCurrentProcessorNumber(void)
|-
| 0x12
| Run(Handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| CreateMutex(Handle* mutex, bool initialLocked)
|-
| 0x14
| ReleaseMutex(Handle mutex)
|-
| 0x15
| CreateSemaphore(Handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| ReleaseSemaphore(s32* count, Handle semaphore, s32 releaseCount)
|-
| 0x17
| CreateEvent(Handle* event, ResetType resettype)
|-
| 0x18
| SignalEvent(Handle event)
|-
| 0x19
| ClearEvent(Handle event)
|-
| 0x1A
| CreateTimer(Handle* timer, ResetType resettype)
|-
| 0x1B
| SetTimer(Handle timer, s64 initial, s64 interval)
|-
| 0x1C
| CancelTimer(Handle timer)
|-
| 0x1D
| ClearTimer(Handle timer)
|-
| 0x1E
| CreateMemoryBlock(Handle* memblock, u32 memory, u32 size, u32 mypermission, u32 otherpermission)
|-
| 0x1F
| MapMemoryBlock(Handle memblock, u32 addr, u32 mypermissions, u32 otherpermission)
|-
| 0x20
| UnmapMemoryBlock(Handle memblock, u32 addr)
|-
| 0x21
| CreateAddressArbiter(Handle* arbiter)
|-
| 0x22
| ArbitrateAddress(Handle arbiter, u32 addr, ArbitrationType type, s32 value)
|-
| 0x23
| CloseHandle(Handle handle)
|-
| 0x24
| WaitSynchronization1
|-
| 0x25
| WaitSynchronization2
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo(unsigned long long *Output, unsigned int Type0, unsigned int Type1)
|-
| 0x2B
| GetProcessInfo(unsigned long long *Output, Handle KProcess, unsigned int Type)
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort(Handle*, char *PortName)
|-
| 0x2E
| SendSyncRequest1 (Stubbed)
|-
| 0x2F
| SendSyncRequest2 (Stubbed)
|-
| 0x30
| SendSyncRequest3 (Stubbed)
|-
| 0x31
| SendSyncRequest4 (Stubbed)
|-
| 0x32
| SendSyncRequest(Handle)
|-
| 0x33
| OpenProcess(Handle *KProcess, unsigned int ProcessId)
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId(unsigned int *ProcessId, Handle KProcess)
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit(Handle*, Handle KProcess)
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1 (Stubbed)
|-
| 0x4C
| ReplyAndReceive2 (Stubbed)
|-
| 0x4D
| ReplyAndReceive3 (Stubbed)
|-
| 0x4E
| ReplyAndReceive4 (Stubbed)
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

= Types and structures =

== enum MemoryState ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

== enum PageFlags ==
{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

== enum MemoryOperation ==

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x1000
|}

== enum MemoryPermission ==

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| READ
| 1
|-
| WRITE
| 2
|-
| READWRITE
| 3
|-
| DONTCARE
| 0x10000000
|}

== enum ResetType ==

{| class="wikitable" border="1"
! Reset type
! Id
|-
| ONESHOT
| 0
|-
| STICKY
| 1
|-
| PULSE
| 2
|}

== struct MemoryInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Base address
|-
| u32
| Size
|-
| u32
| Permission
|-
| enum MemoryState
| State
|}

== struct PageInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Flags
|}

== struct StartupInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| s32
| Priority
|-
| u32
| Stack size
|-
| s32
| argc
|-
| s16*
| argv
|-
| s16*
| envp
|}

= Processes =
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

= Threads =
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

= Memory Mapping =
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

= Debugging =
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

= KernelSetState =
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

= GetSystemInfo =
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-21T00:46:24Z

Neimod:

= Service calls =
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| QueryMemory(MemoryInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| ExitProcess(void)
|-
| 0x4
| GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
|-
| 0x5
| SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
|-
| 0x7
| SetProcessIdealProcessor(Handle process, s32 idealprocessor)
|-
| 0x8
| CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stackbottom, s32 threadpriority, s32 processorid)
|-
| 0x9
| ExitThread(void)
|-
| 0xA
| SleepThread(s64 nanoseconds)
|-
| 0xB
| GetThreadPriority(s32* priority, Handle thread)
|-
| 0xC
| SetThreadPriority(Handle thread, s32 priority)
|-
| 0xD
| GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount)
|-
| 0xE
| SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| GetThreadIdealProcessor(s32* processorid, Handle thread)
|-
| 0x10
| SetThreadIdealProcessor(Handle thread, s32 processorid)
|-
| 0x11
| GetCurrentProcessorNumber(void)
|-
| 0x12
| Run(Handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| CreateMutex(Handle* mutex, bool initialLocked)
|-
| 0x14
| ReleaseMutex(Handle mutex)
|-
| 0x15
| CreateSemaphore(Handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| ReleaseSemaphore(s32* count, Handle semaphore, s32 releaseCount)
|-
| 0x17
| CreateEvent(Handle* event, ResetType resettype)
|-
| 0x18
| SignalEvent(Handle event)
|-
| 0x19
| ClearEvent(Handle event)
|-
| 0x1A
| CreateTimer(Handle* timer, ResetType resettype)
|-
| 0x1B
| SetTimer(Handle timer, s64 initial, s64 interval)
|-
| 0x1C
| CancelTimer(Handle timer)
|-
| 0x1D
| ClearTimer(Handle timer)
|-
| 0x1E
| CreateMemoryBlock(Handle* memblock, u32 memory, u32 size, u32 mypermission, u32 otherpermission)
|-
| 0x1F
| MapMemoryBlock(Handle memblock, u32 addr, u32 mypermissions, u32 otherpermission)
|-
| 0x20
| UnmapMemoryBlock(Handle memblock, u32 addr)
|-
| 0x21
| CreateAddressArbiter(Handle* arbiter)
|-
| 0x22
| ArbitrateAddress(Handle arbiter, u32 addr, ArbitrationType type, s32 value)
|-
| 0x23
| CloseHandle(Handle handle)
|-
| 0x24
| WaitSynchronization1
|-
| 0x25
| WaitSynchronization2
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo(unsigned long long *Output, unsigned int Type0, unsigned int Type1)
|-
| 0x2B
| GetProcessInfo(unsigned long long *Output, Handle KProcess, unsigned int Type)
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort(Handle*, char *PortName)
|-
| 0x2E
| SendSyncRequest1 (Stubbed)
|-
| 0x2F
| SendSyncRequest2 (Stubbed)
|-
| 0x30
| SendSyncRequest3 (Stubbed)
|-
| 0x31
| SendSyncRequest4 (Stubbed)
|-
| 0x32
| SendSyncRequest(Handle)
|-
| 0x33
| OpenProcess(Handle *KProcess, unsigned int ProcessId)
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId(unsigned int *ProcessId, Handle KProcess)
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit(Handle*, Handle KProcess)
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1 (Stubbed)
|-
| 0x4C
| ReplyAndReceive2 (Stubbed)
|-
| 0x4D
| ReplyAndReceive3 (Stubbed)
|-
| 0x4E
| ReplyAndReceive4 (Stubbed)
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

= Types and structures =

== enum MemoryState ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

== enum PageFlags ==
{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

== enum MemoryOperation ==

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x1000
|}

== enum MemoryPermission ==

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| READ
| 1
|-
| WRITE
| 2
|-
| READWRITE
| 3
|-
| DONTCARE
| 0x10000000
|}

== enum ResetType ==

{| class="wikitable" border="1"
! Reset type
! Id
|-
| ONESHOT
| 0
|-
| STICKY
| 1
|-
| PULSE
| 2
|}

== struct MemoryInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Base address
|-
| u32
| Size
|-
| u32
| Permission
|-
| enum MemoryState
| State
|}

== struct PageInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Flags
|}

== struct StartupInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| s32
| Priority
|-
| u32
| Stack size
|-
| s32
| argc
|-
| s16*
| argv
|-
| s16*
| envp
|}

= Processes =
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

= Threads =
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

= Memory Mapping =
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

= Debugging =
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

= KernelSetState =
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

= GetSystemInfo =
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-21T00:43:15Z

Neimod:

= Service calls =
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| QueryMemory(MemoryInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| ExitProcess(void)
|-
| 0x4
| GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
|-
| 0x5
| SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
|-
| 0x7
| SetProcessIdealProcessor(Handle process, s32 idealprocessor)
|-
| 0x8
| CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stackbottom, s32 threadpriority, s32 processorid)
|-
| 0x9
| ExitThread(void)
|-
| 0xA
| SleepThread(s64 nanoseconds)
|-
| 0xB
| GetThreadPriority(s32* priority, Handle thread)
|-
| 0xC
| SetThreadPriority(Handle thread, s32 priority)
|-
| 0xD
| GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount)
|-
| 0xE
| SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| GetThreadIdealProcessor(s32* processorid, Handle thread)
|-
| 0x10
| SetThreadIdealProcessor(Handle thread, s32 processorid)
|-
| 0x11
| GetCurrentProcessorNumber(void)
|-
| 0x12
| Run(Handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| CreateMutex(Handle* mutex, bool initialLocked)
|-
| 0x14
| ReleaseMutex(Handle mutex)
|-
| 0x15
| CreateSemaphore(Handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| ReleaseSemaphore(s32* count, Handle semaphore, s32 releaseCount)
|-
| 0x17
| CreateEvent(Handle* event, ResetType resettype)
|-
| 0x18
| SignalEvent(Handle event)
|-
| 0x19
| ClearEvent(Handle event)
|-
| 0x1A
| CreateTimer(Handle* timer,
|-
| 0x1B
| SetTimer
|-
| 0x1C
| CancelTimer
|-
| 0x1D
| ClearTimer
|-
| 0x1E
| CreateMemoryBlock
|-
| 0x1F
| MapMemoryBlock(Handle, unsigned int Addr, unsigned int Permissions, unsigned int Unk)
|-
| 0x20
| UnmapMemoryBlock
|-
| 0x21
| CreateAddressArbiter
|-
| 0x22
| ArbitrateAddress
|-
| 0x23
| CloseHandle(Handle)
|-
| 0x24
| WaitSynchronization1
|-
| 0x25
| WaitSynchronization2
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo(unsigned long long *Output, unsigned int Type0, unsigned int Type1)
|-
| 0x2B
| GetProcessInfo(unsigned long long *Output, Handle KProcess, unsigned int Type)
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort(Handle*, char *PortName)
|-
| 0x2E
| SendSyncRequest1 (Stubbed)
|-
| 0x2F
| SendSyncRequest2 (Stubbed)
|-
| 0x30
| SendSyncRequest3 (Stubbed)
|-
| 0x31
| SendSyncRequest4 (Stubbed)
|-
| 0x32
| SendSyncRequest(Handle)
|-
| 0x33
| OpenProcess(Handle *KProcess, unsigned int ProcessId)
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId(unsigned int *ProcessId, Handle KProcess)
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit(Handle*, Handle KProcess)
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1 (Stubbed)
|-
| 0x4C
| ReplyAndReceive2 (Stubbed)
|-
| 0x4D
| ReplyAndReceive3 (Stubbed)
|-
| 0x4E
| ReplyAndReceive4 (Stubbed)
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

= Types and structures =

== enum MemoryState ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

== enum PageFlags ==
{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

== enum MemoryOperation ==

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x1000
|}

== enum MemoryPermission ==

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| READ
| 1
|-
| WRITE
| 2
|-
| READWRITE
| 3
|-
| DONTCARE
| 0x10000000
|}

== enum ResetType ==

{| class="wikitable" border="1"
! Reset type
! Id
|-
| ONESHOT
| 0
|-
| STICKY
| 1
|-
| PULSE
| 2
|}

== struct MemoryInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Base address
|-
| u32
| Size
|-
| u32
| Permission
|-
| enum MemoryState
| State
|}

== struct PageInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Flags
|}

== struct StartupInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| s32
| Priority
|-
| u32
| Stack size
|-
| s32
| argc
|-
| s16*
| argv
|-
| s16*
| envp
|}

= Processes =
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

= Threads =
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

= Memory Mapping =
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

= Debugging =
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

= KernelSetState =
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

= GetSystemInfo =
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-21T00:41:37Z

Neimod:

= Service calls =
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| QueryMemory(MemoryInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| ExitProcess(void)
|-
| 0x4
| GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
|-
| 0x5
| SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
|-
| 0x7
| SetProcessIdealProcessor(Handle process, s32 idealprocessor)
|-
| 0x8
| CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stackbottom, s32 threadpriority, s32 processorid)
|-
| 0x9
| ExitThread(void)
|-
| 0xA
| SleepThread(s64 nanoseconds)
|-
| 0xB
| GetThreadPriority(s32* priority, Handle thread)
|-
| 0xC
| SetThreadPriority(Handle thread, s32 priority)
|-
| 0xD
| GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount)
|-
| 0xE
| SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| GetThreadIdealProcessor(s32* processorid, Handle thread)
|-
| 0x10
| SetThreadIdealProcessor(Handle thread, s32 processorid)
|-
| 0x11
| GetCurrentProcessorNumber(void)
|-
| 0x12
| Run(Handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| CreateMutex(Handle* mutex, bool initialLocked)
|-
| 0x14
| ReleaseMutex(Handle mutex)
|-
| 0x15
| CreateSemaphore(Handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| ReleaseSemaphore(s32* count, Handle semaphore, s32 releaseCount)
|-
| 0x17
| CreateEvent(Handle* event, ResetType resettype)
|-
| 0x18
| SignalEvent(Handle event)
|-
| 0x19
| ClearEvent(Handle event)
|-
| 0x1A
| CreateTimer(Handle* timer,
|-
| 0x1B
| SetTimer
|-
| 0x1C
| CancelTimer
|-
| 0x1D
| ClearTimer
|-
| 0x1E
| CreateMemoryBlock
|-
| 0x1F
| MapMemoryBlock(Handle, unsigned int Addr, unsigned int Permissions, unsigned int Unk)
|-
| 0x20
| UnmapMemoryBlock
|-
| 0x21
| CreateAddressArbiter
|-
| 0x22
| ArbitrateAddress
|-
| 0x23
| CloseHandle(Handle)
|-
| 0x24
| WaitSynchronization1
|-
| 0x25
| WaitSynchronization2
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo(unsigned long long *Output, unsigned int Type0, unsigned int Type1)
|-
| 0x2B
| GetProcessInfo(unsigned long long *Output, Handle KProcess, unsigned int Type)
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort(Handle*, char *PortName)
|-
| 0x2E
| SendSyncRequest1 (Stubbed)
|-
| 0x2F
| SendSyncRequest2 (Stubbed)
|-
| 0x30
| SendSyncRequest3 (Stubbed)
|-
| 0x31
| SendSyncRequest4 (Stubbed)
|-
| 0x32
| SendSyncRequest(Handle)
|-
| 0x33
| OpenProcess(Handle *KProcess, unsigned int ProcessId)
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId(unsigned int *ProcessId, Handle KProcess)
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit(Handle*, Handle KProcess)
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1 (Stubbed)
|-
| 0x4C
| ReplyAndReceive2 (Stubbed)
|-
| 0x4D
| ReplyAndReceive3 (Stubbed)
|-
| 0x4E
| ReplyAndReceive4 (Stubbed)
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

= Types and structures =

== enum MemoryState ==
{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

== enum PageFlags ==
{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

== enum MemoryOperation ==

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x1000
|}

== enum MemoryPermission ==

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| READ
| 1
|-
| WRITE
| 2
|-
| READWRITE
| 3
|-
| DONTCARE
| 0x10000000
|}

== struct MemoryInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Base address
|-
| u32
| Size
|-
| u32
| Permission
|-
| enum MemoryState
| State
|}

== struct PageInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| u32
| Flags
|}

== struct StartupInfo ==
{| class="wikitable" border="1"
! Type
! Field
|-
| s32
| Priority
|-
| u32
| Stack size
|-
| s32
| argc
|-
| s16*
| argv
|-
| s16*
| envp
|}

= Processes =
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

= Threads =
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

= Memory Mapping =
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

= Debugging =
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

= KernelSetState =
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

= GetSystemInfo =
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-21T00:31:54Z

Neimod:

=== SVC List ===
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| QueryMemory(MemInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| ExitProcess(void)
|-
| 0x4
| GetProcessAffinityMask(u8* affinitymask, handle process, s32 processorcount)
|-
| 0x5
| SetProcessAffinityMask(handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| GetProcessIdealProcessor(s32 *idealprocessor, handle process)
|-
| 0x7
| SetProcessIdealProcessor(handle process, s32 idealprocessor)
|-
| 0x8
| CreateThread(handle* thread, func entrypoint, u32 arg, u32 stackbottom, s32 threadpriority, s32 processorid)
|-
| 0x9
| ExitThread(void)
|-
| 0xA
| SleepThread(s64 nanoseconds)
|-
| 0xB
| GetThreadPriority(s32* priority, handle thread)
|-
| 0xC
| SetThreadPriority(handle thread, s32 priority)
|-
| 0xD
| GetThreadAffinityMask(u8* affinitymask, handle thread, s32 processorcount)
|-
| 0xE
| SetThreadAffinityMask(handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| GetThreadIdealProcessor(s32* processorid, handle thread)
|-
| 0x10
| SetThreadIdealProcessor(handle thread, s32 processorid)
|-
| 0x11
| GetCurrentProcessorNumber(void)
|-
| 0x12
| Run(handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| CreateMutex(handle* mutex, bool initialLocked)
|-
| 0x14
| ReleaseMutex(handle mutex)
|-
| 0x15
| CreateSemaphore(handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| ReleaseSemaphore(s32* count, handle semaphore, s32 releaseCount)
|-
| 0x17
| CreateEvent(handle* event, unsigned char resettype)
|-
| 0x18
| SignalEvent(handle event)
|-
| 0x19
| ClearEvent(handle event)
|-
| 0x1A
| CreateTimer(handle* timer,
|-
| 0x1B
| SetTimer
|-
| 0x1C
| CancelTimer
|-
| 0x1D
| ClearTimer
|-
| 0x1E
| CreateMemoryBlock
|-
| 0x1F
| MapMemoryBlock(Handle, unsigned int Addr, unsigned int Permissions, unsigned int Unk)
|-
| 0x20
| UnmapMemoryBlock
|-
| 0x21
| CreateAddressArbiter
|-
| 0x22
| ArbitrateAddress
|-
| 0x23
| CloseHandle(Handle)
|-
| 0x24
| WaitSynchronization1
|-
| 0x25
| WaitSynchronization2
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo(unsigned long long *Output, unsigned int Type0, unsigned int Type1)
|-
| 0x2B
| GetProcessInfo(unsigned long long *Output, Handle KProcess, unsigned int Type)
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort(Handle*, char *PortName)
|-
| 0x2E
| SendSyncRequest1 (Stubbed)
|-
| 0x2F
| SendSyncRequest2 (Stubbed)
|-
| 0x30
| SendSyncRequest3 (Stubbed)
|-
| 0x31
| SendSyncRequest4 (Stubbed)
|-
| 0x32
| SendSyncRequest(Handle)
|-
| 0x33
| OpenProcess(Handle *KProcess, unsigned int ProcessId)
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId(unsigned int *ProcessId, Handle KProcess)
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit(Handle*, Handle KProcess)
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1 (Stubbed)
|-
| 0x4C
| ReplyAndReceive2 (Stubbed)
|-
| 0x4D
| ReplyAndReceive3 (Stubbed)
|-
| 0x4E
| ReplyAndReceive4 (Stubbed)
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

=== Types and structures ===

{| class="wikitable" border="1"
! Memory state flags
! Bit
|-
| FREE
| 0
|-
| RESERVED
| 1
|-
| IO
| 2
|-
| STATIC
| 3
|-
| CODE
| 4
|-
| PRIVATE
| 5
|-
| SHARED
| 6
|-
| CONTINUOUS
| 7
|-
| ALIASED
| 8
|-
| ALIAS
| 9
|-
| ALIAS CODE
| 10
|-
| LOCKED
| 11
|}

{| class="wikitable" border="1"
! Page flags
! Bit
|-
| LOCKED
| 0
|-
| CHANGED
| 1
|}

{| class="wikitable" border="1"
! Memory operation
! Id
|-
| FREE
| 1
|-
| RESERVE
| 2
|-
| COMMIT
| 3
|-
| MAP
| 4
|-
| UNMAP
| 5
|-
| PROTECT
| 6
|-
| REGION APP
| 0x100
|-
| REGION SYSTEM
| 0x200
|-
| REGION BASE
| 0x300
|-
| LINEAR
| 0x1000
|}

{| class="wikitable" border="1"
! Memory permission
! Id
|-
| NONE
| 0
|-
| READ
| 1
|-
| WRITE
| 2
|-
| READWRITE
| 3
|-
| DONTCARE
| 0x10000000
|}

=== Processes ===
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

=== Threads ===
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

=== Memory Mapping ===
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

=== Debugging ===
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

=== KernelSetState ===
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

=== GetSystemInfo ===
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-21T00:20:08Z

Neimod:

=== SVC List ===
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| QueryMemory(MemInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| ExitProcess(void)
|-
| 0x4
| GetProcessAffinityMask(u8* affinitymask, handle process, s32 processorcount)
|-
| 0x5
| SetProcessAffinityMask(handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| GetProcessIdealProcessor(s32 *idealprocessor, handle process)
|-
| 0x7
| SetProcessIdealProcessor(handle process, s32 idealprocessor)
|-
| 0x8
| CreateThread(handle* thread, func entrypoint, u32 arg, u32 stackbottom, s32 threadpriority, s32 processorid)
|-
| 0x9
| ExitThread(void)
|-
| 0xA
| SleepThread(s64 nanoseconds)
|-
| 0xB
| GetThreadPriority(s32* priority, handle thread)
|-
| 0xC
| SetThreadPriority(handle thread, s32 priority)
|-
| 0xD
| GetThreadAffinityMask(u8* affinitymask, handle thread, s32 processorcount)
|-
| 0xE
| SetThreadAffinityMask(handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| GetThreadIdealProcessor(s32* processorid, handle thread)
|-
| 0x10
| SetThreadIdealProcessor(handle thread, s32 processorid)
|-
| 0x11
| GetCurrentProcessorNumber(void)
|-
| 0x12
| Run(handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| CreateMutex(handle* mutex, bool initialLocked)
|-
| 0x14
| ReleaseMutex(handle mutex)
|-
| 0x15
| CreateSemaphore(handle* semaphore, s32 initialCount, s32 maxCount)
|-
| 0x16
| ReleaseSemaphore(s32* count, handle semaphore, s32 releaseCount)
|-
| 0x17
| CreateEvent(handle* event, unsigned char resettype)
|-
| 0x18
| SignalEvent(handle event)
|-
| 0x19
| ClearEvent(handle event)
|-
| 0x1A
| CreateTimer(handle* timer,
|-
| 0x1B
| SetTimer
|-
| 0x1C
| CancelTimer
|-
| 0x1D
| ClearTimer
|-
| 0x1E
| CreateMemoryBlock
|-
| 0x1F
| MapMemoryBlock(Handle, unsigned int Addr, unsigned int Permissions, unsigned int Unk)
|-
| 0x20
| UnmapMemoryBlock
|-
| 0x21
| CreateAddressArbiter
|-
| 0x22
| ArbitrateAddress
|-
| 0x23
| CloseHandle(Handle)
|-
| 0x24
| WaitSynchronization1
|-
| 0x25
| WaitSynchronization2
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo(unsigned long long *Output, unsigned int Type0, unsigned int Type1)
|-
| 0x2B
| GetProcessInfo(unsigned long long *Output, Handle KProcess, unsigned int Type)
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort(Handle*, char *PortName)
|-
| 0x2E
| SendSyncRequest1 (Stubbed)
|-
| 0x2F
| SendSyncRequest2 (Stubbed)
|-
| 0x30
| SendSyncRequest3 (Stubbed)
|-
| 0x31
| SendSyncRequest4 (Stubbed)
|-
| 0x32
| SendSyncRequest(Handle)
|-
| 0x33
| OpenProcess(Handle *KProcess, unsigned int ProcessId)
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId(unsigned int *ProcessId, Handle KProcess)
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit(Handle*, Handle KProcess)
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1 (Stubbed)
|-
| 0x4C
| ReplyAndReceive2 (Stubbed)
|-
| 0x4D
| ReplyAndReceive3 (Stubbed)
|-
| 0x4E
| ReplyAndReceive4 (Stubbed)
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

=== Processes ===
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

=== Threads ===
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

=== Memory Mapping ===
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

=== Debugging ===
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

=== KernelSetState ===
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

=== GetSystemInfo ===
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-21T00:14:07Z

Neimod:

=== SVC List ===
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| QueryMemory(MemInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| ExitProcess(void)
|-
| 0x4
| GetProcessAffinityMask(u8* affinitymask, handle process, s32 processorcount)
|-
| 0x5
| SetProcessAffinityMask(handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| GetProcessIdealProcessor(s32 *idealprocessor, handle process)
|-
| 0x7
| SetProcessIdealProcessor(handle process, s32 idealprocessor)
|-
| 0x8
| CreateThread(handle* thread, func entrypoint, u32 arg, u32 stackbottom, s32 threadpriority, s32 processorid)
|-
| 0x9
| ExitThread(void)
|-
| 0xA
| SleepThread(s64 nanoseconds)
|-
| 0xB
| GetThreadPriority(s32* priority, handle thread)
|-
| 0xC
| SetThreadPriority(handle thread, s32 priority)
|-
| 0xD
| GetThreadAffinityMask(u8* affinitymask, handle thread, s32 processorcount)
|-
| 0xE
| SetThreadAffinityMask(handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| GetThreadIdealProcessor
|-
| 0x10
| SetThreadIdealProcessor
|-
| 0x11
| GetCurrentProcessorNumber
|-
| 0x12
| Run(Handle KProcess, unsigned int *buf) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| CreateMutex
|-
| 0x14
| ReleaseMutex(Handle KMutex)
|-
| 0x15
| CreateSemaphore
|-
| 0x16
| ReleaseSemaphore
|-
| 0x17
| CreateEvent(Handle *KEvent, unsigned char Unk)
|-
| 0x18
| SignalEvent(Handle KEvent)
|-
| 0x19
| ClearEvent
|-
| 0x1A
| CreateTimer
|-
| 0x1B
| SetTimer
|-
| 0x1C
| CancelTimer
|-
| 0x1D
| ClearTimer
|-
| 0x1E
| CreateMemoryBlock
|-
| 0x1F
| MapMemoryBlock(Handle, unsigned int Addr, unsigned int Permissions, unsigned int Unk)
|-
| 0x20
| UnmapMemoryBlock
|-
| 0x21
| CreateAddressArbiter
|-
| 0x22
| ArbitrateAddress
|-
| 0x23
| CloseHandle(Handle)
|-
| 0x24
| WaitSynchronization1
|-
| 0x25
| WaitSynchronization2
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo(unsigned long long *Output, unsigned int Type0, unsigned int Type1)
|-
| 0x2B
| GetProcessInfo(unsigned long long *Output, Handle KProcess, unsigned int Type)
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort(Handle*, char *PortName)
|-
| 0x2E
| SendSyncRequest1 (Stubbed)
|-
| 0x2F
| SendSyncRequest2 (Stubbed)
|-
| 0x30
| SendSyncRequest3 (Stubbed)
|-
| 0x31
| SendSyncRequest4 (Stubbed)
|-
| 0x32
| SendSyncRequest(Handle)
|-
| 0x33
| OpenProcess(Handle *KProcess, unsigned int ProcessId)
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId(unsigned int *ProcessId, Handle KProcess)
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit(Handle*, Handle KProcess)
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1 (Stubbed)
|-
| 0x4C
| ReplyAndReceive2 (Stubbed)
|-
| 0x4D
| ReplyAndReceive3 (Stubbed)
|-
| 0x4E
| ReplyAndReceive4 (Stubbed)
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

=== Processes ===
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

=== Threads ===
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

=== Memory Mapping ===
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

=== Debugging ===
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

=== KernelSetState ===
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

=== GetSystemInfo ===
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-21T00:12:31Z

Neimod:

=== SVC List ===
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
|-
| 0x2
| QueryMemory(MemInfo* info, PageInfo* out, u32 Addr)
|-
| 0x3
| ExitProcess(void)
|-
| 0x4
| GetProcessAffinityMask(u8* affinitymask, handle process, s32 processorcount)
|-
| 0x5
| SetProcessAffinityMask(handle process, u8* affinitymask, s32 processorcount)
|-
| 0x6
| GetProcessIdealProcessor(s32 *idealprocessor, handle process)
|-
| 0x7
| SetProcessIdealProcessor(handle process, s32 idealprocessor)
|-
| 0x8
| CreateThread(handle* thread, Entrypoint, void* arg, , ThreadPriority, ResLimit)
|-
| 0x9
| ExitThread(void)
|-
| 0xA
| SleepThread(s64 nanoseconds)
|-
| 0xB
| GetThreadPriority(s32* priority, handle thread)
|-
| 0xC
| SetThreadPriority(handle thread, s32 priority)
|-
| 0xD
| GetThreadAffinityMask(u8* affinitymask, handle thread, s32 processorcount)
|-
| 0xE
| SetThreadAffinityMask(handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| GetThreadIdealProcessor
|-
| 0x10
| SetThreadIdealProcessor
|-
| 0x11
| GetCurrentProcessorNumber
|-
| 0x12
| Run(Handle KProcess, unsigned int *buf) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| CreateMutex
|-
| 0x14
| ReleaseMutex(Handle KMutex)
|-
| 0x15
| CreateSemaphore
|-
| 0x16
| ReleaseSemaphore
|-
| 0x17
| CreateEvent(Handle *KEvent, unsigned char Unk)
|-
| 0x18
| SignalEvent(Handle KEvent)
|-
| 0x19
| ClearEvent
|-
| 0x1A
| CreateTimer
|-
| 0x1B
| SetTimer
|-
| 0x1C
| CancelTimer
|-
| 0x1D
| ClearTimer
|-
| 0x1E
| CreateMemoryBlock
|-
| 0x1F
| MapMemoryBlock(Handle, unsigned int Addr, unsigned int Permissions, unsigned int Unk)
|-
| 0x20
| UnmapMemoryBlock
|-
| 0x21
| CreateAddressArbiter
|-
| 0x22
| ArbitrateAddress
|-
| 0x23
| CloseHandle(Handle)
|-
| 0x24
| WaitSynchronization1
|-
| 0x25
| WaitSynchronization2
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo(unsigned long long *Output, unsigned int Type0, unsigned int Type1)
|-
| 0x2B
| GetProcessInfo(unsigned long long *Output, Handle KProcess, unsigned int Type)
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort(Handle*, char *PortName)
|-
| 0x2E
| SendSyncRequest1 (Stubbed)
|-
| 0x2F
| SendSyncRequest2 (Stubbed)
|-
| 0x30
| SendSyncRequest3 (Stubbed)
|-
| 0x31
| SendSyncRequest4 (Stubbed)
|-
| 0x32
| SendSyncRequest(Handle)
|-
| 0x33
| OpenProcess(Handle *KProcess, unsigned int ProcessId)
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId(unsigned int *ProcessId, Handle KProcess)
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit(Handle*, Handle KProcess)
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1 (Stubbed)
|-
| 0x4C
| ReplyAndReceive2 (Stubbed)
|-
| 0x4D
| ReplyAndReceive3 (Stubbed)
|-
| 0x4E
| ReplyAndReceive4 (Stubbed)
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

=== Processes ===
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

=== Threads ===
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

=== Memory Mapping ===
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

=== Debugging ===
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

=== KernelSetState ===
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

=== GetSystemInfo ===
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-20T20:51:01Z

Neimod:

=== SVC List ===
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory(unsigned int *OutAddr, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int MemoryType, unsigned int Permissions) (OutAddr is usually the same as the input Addr0)
|-
| 0x2
| QueryMemory(MemInfo *Info, unsigned int *Out, unsigned int Addr)
|-
| 0x3
| ExitProcess()
|-
| 0x4
| GetProcessAffinityMask
|-
| 0x5
| SetProcessAffinityMask
|-
| 0x6
| GetProcessIdealProcessor(unsigned int *IdealProcessor, Handle KProcess)
|-
| 0x7
| SetProcessIdealProcessor(Handle KProcess, unsigned int IdealProcessor)
|-
| 0x8
| CreateThread(Handle*, Entrypoint, Entrypoint_Param, StackTop, ThreadPriority, ResLimit)
|-
| 0x9
| ExitThread(void)
|-
| 0xA
| SleepThread(s64 nanoseconds)
|-
| 0xB
| GetThreadPriority(s32* priority, handle thread)
|-
| 0xC
| SetThreadPriority(handle thread, s32 priority)
|-
| 0xD
| GetThreadAffinityMask(u8* affinitymask, handle thread, s32 processorcount)
|-
| 0xE
| SetThreadAffinityMask(handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xF
| GetThreadIdealProcessor
|-
| 0x10
| SetThreadIdealProcessor
|-
| 0x11
| GetCurrentProcessorNumber
|-
| 0x12
| Run(Handle KProcess, unsigned int *buf) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| CreateMutex
|-
| 0x14
| ReleaseMutex(Handle KMutex)
|-
| 0x15
| CreateSemaphore
|-
| 0x16
| ReleaseSemaphore
|-
| 0x17
| CreateEvent(Handle *KEvent, unsigned char Unk)
|-
| 0x18
| SignalEvent(Handle KEvent)
|-
| 0x19
| ClearEvent
|-
| 0x1A
| CreateTimer
|-
| 0x1B
| SetTimer
|-
| 0x1C
| CancelTimer
|-
| 0x1D
| ClearTimer
|-
| 0x1E
| CreateMemoryBlock
|-
| 0x1F
| MapMemoryBlock(Handle, unsigned int Addr, unsigned int Permissions, unsigned int Unk)
|-
| 0x20
| UnmapMemoryBlock
|-
| 0x21
| CreateAddressArbiter
|-
| 0x22
| ArbitrateAddress
|-
| 0x23
| CloseHandle(Handle)
|-
| 0x24
| WaitSynchronization1
|-
| 0x25
| WaitSynchronization2
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo(unsigned long long *Output, unsigned int Type0, unsigned int Type1)
|-
| 0x2B
| GetProcessInfo(unsigned long long *Output, Handle KProcess, unsigned int Type)
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort(Handle*, char *PortName)
|-
| 0x2E
| SendSyncRequest1 (Stubbed)
|-
| 0x2F
| SendSyncRequest2 (Stubbed)
|-
| 0x30
| SendSyncRequest3 (Stubbed)
|-
| 0x31
| SendSyncRequest4 (Stubbed)
|-
| 0x32
| SendSyncRequest(Handle)
|-
| 0x33
| OpenProcess(Handle *KProcess, unsigned int ProcessId)
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId(unsigned int *ProcessId, Handle KProcess)
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit(Handle*, Handle KProcess)
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1 (Stubbed)
|-
| 0x4C
| ReplyAndReceive2 (Stubbed)
|-
| 0x4D
| ReplyAndReceive3 (Stubbed)
|-
| 0x4E
| ReplyAndReceive4 (Stubbed)
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

=== Processes ===
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

=== Threads ===
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

=== Memory Mapping ===
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

=== Debugging ===
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

=== KernelSetState ===
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

=== GetSystemInfo ===
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

SVC

2013-02-20T20:50:09Z

Neimod:

=== SVC List ===
{| class="wikitable" border="1"
|-
! Id
! Description
|-
| 0x1
| ControlMemory(unsigned int *OutAddr, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int MemoryType, unsigned int Permissions) (OutAddr is usually the same as the input Addr0)
|-
| 0x2
| QueryMemory(MemInfo *Info, unsigned int *Out, unsigned int Addr)
|-
| 0x3
| ExitProcess()
|-
| 0x4
| GetProcessAffinityMask
|-
| 0x5
| SetProcessAffinityMask
|-
| 0x6
| GetProcessIdealProcessor(unsigned int *IdealProcessor, Handle KProcess)
|-
| 0x7
| SetProcessIdealProcessor(Handle KProcess, unsigned int IdealProcessor)
|-
| 0x8
| CreateThread(Handle*, Entrypoint, Entrypoint_Param, StackTop, ThreadPriority, ResLimit)
|-
| 0x9
| ExitThread(void)
|-
| 0xA
| SleepThread(s64 nanoseconds)
|-
| 0xB
| GetThreadPriority(s32* priority, handle thread)
|-
| 0xC
| SetThreadPriority(handle thread, s32 priority)
|-
| 0xD
| GetThreadAffinityMask(handle thread, u8* affinitymask, s32 processorcount)
|-
| 0xE
| SetThreadAffinityMask(u8* affinitymask, handle thread, s32 processorcount)
|-
| 0xF
| GetThreadIdealProcessor
|-
| 0x10
| SetThreadIdealProcessor
|-
| 0x11
| GetCurrentProcessorNumber
|-
| 0x12
| Run(Handle KProcess, unsigned int *buf) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
|-
| 0x13
| CreateMutex
|-
| 0x14
| ReleaseMutex(Handle KMutex)
|-
| 0x15
| CreateSemaphore
|-
| 0x16
| ReleaseSemaphore
|-
| 0x17
| CreateEvent(Handle *KEvent, unsigned char Unk)
|-
| 0x18
| SignalEvent(Handle KEvent)
|-
| 0x19
| ClearEvent
|-
| 0x1A
| CreateTimer
|-
| 0x1B
| SetTimer
|-
| 0x1C
| CancelTimer
|-
| 0x1D
| ClearTimer
|-
| 0x1E
| CreateMemoryBlock
|-
| 0x1F
| MapMemoryBlock(Handle, unsigned int Addr, unsigned int Permissions, unsigned int Unk)
|-
| 0x20
| UnmapMemoryBlock
|-
| 0x21
| CreateAddressArbiter
|-
| 0x22
| ArbitrateAddress
|-
| 0x23
| CloseHandle(Handle)
|-
| 0x24
| WaitSynchronization1
|-
| 0x25
| WaitSynchronization2
|-
| 0x26
| SignalAndWait
|-
| 0x27
| DuplicateHandle
|-
| 0x28
| GetSystemTick
|-
| 0x29
| GetHandleInfo
|-
| 0x2A
| GetSystemInfo(unsigned long long *Output, unsigned int Type0, unsigned int Type1)
|-
| 0x2B
| GetProcessInfo(unsigned long long *Output, Handle KProcess, unsigned int Type)
|-
| 0x2C
| GetThreadInfo
|-
| 0x2D
| ConnectToPort(Handle*, char *PortName)
|-
| 0x2E
| SendSyncRequest1 (Stubbed)
|-
| 0x2F
| SendSyncRequest2 (Stubbed)
|-
| 0x30
| SendSyncRequest3 (Stubbed)
|-
| 0x31
| SendSyncRequest4 (Stubbed)
|-
| 0x32
| SendSyncRequest(Handle)
|-
| 0x33
| OpenProcess(Handle *KProcess, unsigned int ProcessId)
|-
| 0x34
| OpenThread
|-
| 0x35
| GetProcessId(unsigned int *ProcessId, Handle KProcess)
|-
| 0x36
| GetProcessIdOfThread
|-
| 0x37
| GetThreadId
|-
| 0x38
| GetResourceLimit(Handle*, Handle KProcess)
|-
| 0x39
| GetResourceLimitLimitValues
|-
| 0x3A
| GetResourceLimitCurrentValues
|-
| 0x3B
| GetThreadContext (Stubbed)
|-
| 0x3C
| Break(BreakReason)
|-
| 0x3D
| OutputDebugString(void const, int) (Does nothing on non-debug units)
|-
| 0x3E
| ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
|-
| 0x47
| CreatePort
|-
| 0x48
| CreateSessionToPort
|-
| 0x49
| CreateSession
|-
| 0x4A
| AcceptSession
|-
| 0x4B
| ReplyAndReceive1 (Stubbed)
|-
| 0x4C
| ReplyAndReceive2 (Stubbed)
|-
| 0x4D
| ReplyAndReceive3 (Stubbed)
|-
| 0x4E
| ReplyAndReceive4 (Stubbed)
|-
| 0x4F
| ReplyAndReceive
|-
| 0x50
| BindInterrupt(Interrupt, Handle, int, bool)
|-
| 0x51
| UnbindInterrupt(Interrupt, Handle)
|-
| 0x52
| InvalidateProcessDataCache(Handle, void*, unsigned int)
|-
| 0x53
| StoreProcessDataCache(Handle process, void const* addr, unsigned int size)
|-
| 0x54
| FlushProcessDataCache(Handle, void const*, unsigned int)
|-
| 0x55
| StartInterProcessDma(Handle* out, Handle dstProcess, void* dst, Handle srcProcess, const void* src, size_t size, const DmaConfig& config )
|-
| 0x56
| StopDma(Handle)
|-
| 0x57
| GetDmaState(DmaState*, Handle)
|-
| 0x58
| RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
|-
| 0x60
| DebugActiveProcess(Handle *KDebug, unsigned int ProcessID)
|-
| 0x61
| BreakDebugProcess(Handle)
|-
| 0x62
| TerminateDebugProcess(Handle)
|-
| 0x63
| GetProcessDebugEvent(DebugEventInfo*, Handle)
|-
| 0x64
| ContinueDebugEvent(Handle, unsigned int)
|-
| 0x65
| GetProcessList(int *TotalPIDs, unsigned int *PIDs, int MaxPIDs)
|-
| 0x66
| GetThreadList(int*, unsigned int*, int, Handle)
|-
| 0x67
| GetDebugThreadContext(ThreadContext*, Handle, unsigned int, unsigned int)
|-
| 0x68
| SetDebugThreadContext(Handle, unsigned int, ThreadContext const&, unsigned int)
|-
| 0x69
| QueryDebugProcessMemory(MemoryInfo*, PageInfo*, Handle, unsigned int)
|-
| 0x6A
| ReadProcessMemory(void* Buffer, Handle KDebug, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6B
| WriteProcessMemory(Handle KDebug, void const* Buffer, unsigned int ProcAddr, unsigned int Size)
|-
| 0x6C
| SetHardwareBreakPoint(int, unsigned int, unsigned int)
|-
| 0x6D
| GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
|-
| 0x70
| ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
|-
| 0x71
| MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x72
| UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
|-
| 0x73
| ?
|-
| 0x74
| Stubbed on regular kernel
|-
| 0x75
| ?
|-
| 0x76
| TerminateProcess(Handle)
|-
| 0x77
| (Handle KProcess, Handle KResourceLimit)
|-
| 0x78
| CreateResourceLimit(Handle *KResourceLimit)
|-
| 0x79
| ?
|-
| 0x7A
| DisableExecuteNever(unsigned int Addr, unsigned int Size) (Stubbed for regular kernel beginning with [[2.0.0-2]])
|-
| 0x7C
| KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
|-
| 0x7D
| QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
|-
| 0xFF
| Debug related (The Syscall access control mask doesn't apply for this SVC)
|}

=== Processes ===
Each process can only use SVCs which are enabled in the [[NCCH#CXI|exheader]] for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

=== Threads ===
For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

=== Memory Mapping ===
ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP [[Memory_layout|heap]]. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

=== Debugging ===
DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

=== KernelSetState ===
Type0 initializes the programID for launching [[FIRM]], then triggers launching [[FIRM]]. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.

Type3 is used for initializing the 0x1000-byte buffer used by the launched [[FIRM]]. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.

=== GetSystemInfo ===
Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

NS and APT Services

2013-02-16T23:28:09Z

Neimod:

[[Category:Services]]
The NS system module is the first module launched from a NAND title after the core processes sm, fs, [[Process Manager Ports|pm]], loader, and pxi are loaded. This module is launched by the pm process, with the titleID loaded from [[Configuration Memory|NSTID]]. NS first launches [[ErrDisp]], then the menu. On retail the menu TID is loaded from [[Shared_Registers|MENUTID]], while on dev/debug the menu TID is loaded from [[Config Info Blocks|config]]. The TID of the launched menu is then written to [[Configuration Memory|ACTIVEMENUTID]]. NS uses [[PMApp:LaunchTitle|pm:app]] to launch titles.

Like home menu NS is constantly running while the system is in 3DS-mode.

= Alternate menu =
When launching the regular menu fails, NS will then attempt to launch the alternate menu. This title could be used as a recovery process, however it normally doesn't exist on retail.

= NS Service "ns:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000200C0
| [[NSS:LaunchTitle|LaunchTitle]]
|}

= NS Service "APT:U" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x000B0040
| [[APTU:GetSignalType|GetSignalType]]
|}

=APT Service=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| GetLockHandle
|-
| 0x00020080
| Initialize
|-
| 0x00030040
| Enable
|-
| 0x00040040
| Finalize
|-
| 0x00050040
| GetAppletManInfo
|-
| 0x00060040
| GetAppletInfo
|-
| 0x00070000
| GetLastSignaledAppletId
|-
| 0x00080000
| CountRegisteredApplet
|-
| 0x00090040
| IsRegistered
|-
| 0x000A0040
| GetAttribute
|-
| 0x000B0040
| InquireNotification
|-
| 0x000C0104
| SendParameter
|-
| 0x000D0080
| ReceiveParameter
|-
| 0x000E0080
| GlanceParameter
|-
| 0x000F0100
| CancelParameter
|-
| 0x001000c2
| DebugFunc
|-
| 0x001100C0
| MapProgramIdForDebug
|-
| 0x00120040
| SetHomeMenuAppletIdForDebug
|-
| 0x00130000
| GetPreparationState
|-
| 0x00140040
| SetPreparationState
|-
| 0x00150140
| PrepareToStartApplication
|-
| 0x00160040
| PreloadLibraryApplet
|-
| 0x00170040
| FinishPreloadingLibraryApplet
|-
| 0x00180040
| PrepareToStartLibraryApplet
|-
| 0x00190040
| PrepareToStartSystemApplet
|-
| 0x001A0000
| PrepareToStartNewestHomeMenu
|-
| 0x001B00C4
| StartApplication
|-
| 0x001C0000
| WakeupApplication
|-
| 0x001D0000
| CancelApplication
|-
| 0x001E0084
| StartLibraryApplet
|-
| 0x001F0084
| StartSystemApplet
|-
| 0x00200044
| StartNewestHomeMenu
|-
| 0x00210000
| OrderToCloseApplication
|-
| 0x00220040
| PrepareToCloseApplication
|-
| 0x00230040
| PrepareToJumpToApplication
|-
| 0x00240044
| JumpToApplication
|-
| 0x002500C0
| PrepareToCloseLibraryApplet
|-
| 0x00260000
| PrepareToCloseSystemApplet
|-
| 0x00270044
| CloseApplication
|-
| 0x00280044
| CloseLibraryApplet
|-
| 0x00290044
| CloseSystemApplet
|-
| 0x002A0000
| OrderToCloseSystemApplet
|-
| 0x002B0000
| PrepareToJumpToHomeMenu
|-
| 0x002C0044
| JumpToHomeMenu
|-
| 0x002D0000
| PrepareToLeaveHomeMenu
|-
| 0x002E0044
| LeaveHomeMenu
|-
| 0x002F0040
| PrepareToLeaveResidentApplet
|-
| 0x00300044
| LeaveResidentApplet
|-
| 0x00310100
| PrepareToDoApplicationJump
|-
| 0x00320084
| DoApplicationJump
|-
| 0x00330000
| GetProgramIdOnApplicationJump
|-
| 0x00340084
| SendDeliverArg
|-
| 0x00350080
| ReceiveDeliverArg
|-
| 0x00360040
| LoadSysMenuArg
|-
| 0x00370042
| StoreSysMenuArg
|-
| 0x00380040
| PreloadResidentApplet
|-
| 0x00390040
| PrepareToStartResidentApplet
|-
| 0x003A0044
| StartResidentApplet
|-
| 0x003B0040
| CancelLibraryApplet
|-
| 0x003C0042
| SendDspSleep
|-
| 0x003D0042
| SendDspWakeUp
|-
| 0x003E0080
| ReplySleepQuery
|-
| 0x003F0040
| ReplySleepNotificationComplete
|-
| 0x00400042
| SendCaptureBufferInfo
|-
| 0x00410040
| ReceiveCaptureBufferInfo
|-
| 0x00420080
| SleepSystem
|-
| 0x00430040
| NotifyToWait
|-
| 0x00440000
| GetSharedFont
|-
| 0x00450040
| GetWirelessRebootInfo
|-
| 0x00460104
| Wrap
|-
| 0x00470104
| Unwrap
|-
| 0x00480100
| GetProgramInfo
|-
| 0x00490180
| Reboot
|-
| 0x004A0040
| GetCaptureInfo
|-
| 0x004B00C2
| AppletUtility
|-
| 0x004C0000
| SetFatalErrDispMode
|-
| 0x004D0080
| GetAppletProgramInfo
|-
| 0x004E0000
| HardwareResetAsync
|}

These applet services can handle launching "applets", APT:U handles signaling for home/power button as well.

= NS Service "APT:S" =

PTM

2013-02-16T20:57:02Z

Neimod:

=User PTM Service "ptm:u"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010002
| RegisterAlarmClient
|-
| 0x00020080
| SetRtcAlarm
|-
| 0x00030000
| GetRtcAlarm
|-
| 0x00040000
| CancelRtcAlarm
|-
| 0x00050000
| GetAdapterState
|-
| 0x00060000
| GetShellState
|-
| 0x00070000
| GetBatteryLevel
|-
| 0x00080000
| GetBatteryChargeState
|-
| 0x00090000
| GetPedometerState
|-
| 0x000A0042
| GetStepHistoryEntry
|-
| 0x000B00C2
| GetStepHistory
|-
| 0x000C0000
| GetTotalStepCount
|-
| 0x000D0040
| SetPedometerRecordingMode
|-
| 0x000E0000
| GetPedometerRecordingMode
|-
| 0x000F0084
| GetStepHistoryAll
|}

=PlayHistory PTM Service "ptm:play" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010002
| RegisterAlarmClient
|-
| 0x00020080
| SetRtcAlarm
|-
| 0x00030000
| GetRtcAlarm
|-
| 0x00040000
| CancelRtcAlarm
|-
| 0x00050000
| GetAdapterState
|-
| 0x00060000
| GetShellState
|-
| 0x00070000
| GetBatteryLevel
|-
| 0x00080000
| GetBatteryChargeState
|-
| 0x00090000
| GetPedometerState
|-
| 0x000A0042
| GetStepHistoryEntry
|-
| 0x000B00C2
| GetStepHistory
|-
| 0x000C0000
| GetTotalStepCount
|-
| 0x000D0040
| SetPedometerRecordingMode
|-
| 0x000E0000
| GetPedometerRecordingMode
|-
| 0x000F0084
| GetStepHistoryAll
|-
| 0x08070082
| GetPlayHistory
|-
| 0x08080000
| GetPlayHistoryStart
|-
| 0x08090000
| GetPlayHistoryLength
|-
| 0x080B0080
| CalcPlayHistoryStart
|}

=SysMenu PTM Service "ptm:sysm"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010002
| RegisterAlarmClient
|-
| 0x00020080
| SetRtcAlarm
|-
| 0x00030000
| GetRtcAlarm
|-
| 0x00040000
| CancelRtcAlarm
|-
| 0x00050000
| GetAdapterState
|-
| 0x00060000
| GetShellState
|-
| 0x00070000
| GetBatteryLevel
|-
| 0x00080000
| GetBatteryChargeState
|-
| 0x00090000
| GetPedometerState
|-
| 0x000A0042
| GetStepHistoryEntry
|-
| 0x000B00C2
| GetStepHistory
|-
| 0x000C0000
| GetTotalStepCount
|-
| 0x000D0040
| SetPedometerRecordingMode
|-
| 0x000E0000
| GetPedometerRecordingMode
|-
| 0x000F0084
| GetStepHistoryAll
|-
| 0x040100C0
| SetRtcAlarmEx
|-
| 0x04020042
| ReplySleepQuery
|-
| 0x04030042
| NotifySleepPreparationComplete
|-
| 0x04040102
| SetWakeupTrigger
|-
| 0x04050000
| GetAwakeReason
|-
| 0x04060000
| RequestSleep
|-
| 0x040700C0
| ShutdownAsync
|-
| 0x04080000
| Awake
|-
| 0x04090080
| RebootAsync
|-
| 0x08010640
| SetInfoLEDPattern
|-
| 0x08020040
| SetInfoLEDPatternHeader
|-
| 0x08030000
| GetInfoLEDStatus
|-
| 0x08040040
| SetBatteryEmptyLEDPattern
|-
| 0x08050000
| ClearStepHistory
|-
| 0x080600C2
| SetStepHistory
|-
| 0x08070082
| GetPlayHistory
|-
| 0x08080000
| GetPlayHistoryStart
|-
| 0x08090000
| GetPlayHistoryLength
|-
| 0x080A0000
| ClearPlayHistory
|-
| 0x080B0080
| CalcPlayHistoryStart
|-
| 0x080C0080
| SetUserTime
|-
| 0x080D0000
| InvalidateSystemTime
|-
| 0x080E0140
| NotifyPlayEvent
|-
| 0x080F0000
| IsLegacyPowerOff
|-
| 0x08100000
| ClearLegacyPowerOff
|-
| 0x08110000
| GetShellStatus
|-
| 0x08120000
| IsShutdownByBatteryEmpty
|-
| 0x08130000
| FormatSavedata
|-
| 0x08140000
| GetLegacyJumpProhibitedFlag
|}

=GetSystemTime PTM Service "ptm:gets"=

=SystemControl PTM Service "ptm:s"=