SVC

System calls

Id	NATIVE_FIRM ARM11 kernel notes	Enabled for the TWL_FIRM ARM11 kernel	Description
0x1		No	Result ControlMemory(u32* outaddr, u32 addr0, u32 addr1, u32 size, u32 operation, u32 permissions) (outaddr is usually the same as the input addr0)
0x2		No	Result QueryMemory(MemoryInfo* info, PageInfo* out, u32 Addr)
0x3		No	void ExitProcess(void)
0x4		No	Result GetProcessAffinityMask(u8* affinitymask, Handle process, s32 processorcount)
0x5		No	Result SetProcessAffinityMask(Handle process, u8* affinitymask, s32 processorcount)
0x6		No	Result GetProcessIdealProcessor(s32 *idealprocessor, Handle process)
0x7		No	Result SetProcessIdealProcessor(Handle process, s32 idealprocessor)
0x8		Yes	Result CreateThread(Handle* thread, func entrypoint, u32 arg, u32 stacktop, s32 threadpriority, s32 processorid)
0x9		Yes	void ExitThread(void)
0xA		Yes	void SleepThread(s64 nanoseconds)
0xB		Yes	Result GetThreadPriority(s32* priority, Handle thread)
0xC		Yes	Result SetThreadPriority(Handle thread, s32 priority)
0xD		No	Result GetThreadAffinityMask(u8* affinitymask, Handle thread, s32 processorcount)
0xE		No	Result SetThreadAffinityMask(Handle thread, u8* affinitymask, s32 processorcount)
0xF		No	Result GetThreadIdealProcessor(s32* processorid, Handle thread)
0x10		No	Result SetThreadIdealProcessor(Handle thread, s32 processorid)
0x11		No	s32 GetCurrentProcessorNumber(void)
0x12		No	Result Run(Handle process, StartupInfo* info) (This starts the main() thread. Buf+0 is main-thread priority, Buf+4 is main-thread stack-size.)
0x13		Yes	Result CreateMutex(Handle* mutex, bool initialLocked)
0x14		Yes	Result ReleaseMutex(Handle mutex)
0x15		Yes	Result CreateSemaphore(Handle* semaphore, s32 initialCount, s32 maxCount)
0x16		Yes	Result ReleaseSemaphore(s32* count, Handle semaphore, s32 releaseCount)
0x17		Yes	Result CreateEvent(Handle* event, ResetType resettype)
0x18		Yes	Result SignalEvent(Handle event)
0x19		Yes	Result ClearEvent(Handle event)
0x1A		Yes	Result CreateTimer(Handle* timer, ResetType resettype)
0x1B		Yes	Result SetTimer(Handle timer, s64 initial, s64 interval)
0x1C		Yes	Result CancelTimer(Handle timer)
0x1D		Yes	Result ClearTimer(Handle timer)
0x1E		No	Result CreateMemoryBlock(Handle* memblock, u32 addr, u32 size, u32 mypermission, u32 otherpermission)
0x1F		No	Result MapMemoryBlock(Handle memblock, u32 addr, u32 mypermissions, u32 otherpermission)
0x20		No	Result UnmapMemoryBlock(Handle memblock, u32 addr)
0x21		Yes	Result CreateAddressArbiter(Handle* arbiter)
0x22		Yes	Result ArbitrateAddress(Handle arbiter, u32 addr, ArbitrationType type, s32 value)
0x23		Yes	Result CloseHandle(Handle handle)
0x24		Yes	Result WaitSynchronization1(Handle handle, s64 nanoseconds)
0x25		Yes	Result WaitSynchronizationN(s32* out, Handle* handles, s32 handlecount, bool waitAll, s64 nanoseconds)
0x26		No	Result SignalAndWait(s32* out, Handle signal, Handle* handles, s32 handleCount, bool waitAll, s64 nanoseconds)
0x27		Yes	Result DuplicateHandle(Handle* out, Handle original)
0x28		Yes	s64 GetSystemTick(void) (This returns the total CPU ticks elapsed since the CPU was powered-on)
0x29		No	Result GetHandleInfo(s64* out, Handle handle, HandleInfoType type)
0x2A		Yes	Result GetSystemInfo(s64* out, SystemInfoType type, s32 param)
0x2B		Yes	Result GetProcessInfo(s64* out, Handle process, ProcessInfoType type)
0x2C		Yes	Result GetThreadInfo(s64* out, Handle thread, ThreadInfoType type)
0x2D		No	Result ConnectToPort(Handle* out, const char* portName)
0x2E	Stubbed	No	Result SendSyncRequest1(Handle session)
0x2F	Stubbed	No	Result SendSyncRequest2(Handle session)
0x30	Stubbed	No	Result SendSyncRequest3(Handle session)
0x31	Stubbed	No	Result SendSyncRequest4(Handle session)
0x32		No	Result SendSyncRequest(Handle session)
0x33		No	Result OpenProcess(Handle* process, u32 processId)
0x34		No	Result OpenThread(Handle* thread, Handle process, u32 threadId)
0x35		Yes	Result GetProcessId(u32* processId, Handle process)
0x36		No	Result GetProcessIdOfThread(u32* processId, Handle thread)
0x37		Yes	Result GetThreadId(u32* threadId, Handle thread)
0x38		No	Result GetResourceLimit(Handle* resourceLimit, Handle process)
0x39		No	Result GetResourceLimitLimitValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
0x3A		No	Result GetResourceLimitCurrentValues(s64* values, Handle resourceLimit, LimitableResource* names, s32 nameCount)
0x3B		No	Result GetThreadContext(ThreadContext* context, Handle thread) (Stubbed)
0x3C		Yes	Break(BreakReason)
0x3D		Yes	OutputDebugString(void const, int) (Does nothing on non-debug units)
0x3E		No	ControlPerformanceCounter(unsigned long long, int, unsigned int, unsigned long long)
0x47		No	Result CreatePort(Handle* portServer, Handle* portClient, const char* name, s32 maxSessions)
0x48		No	Result CreateSessionToPort(Handle* session, Handle port)
0x49		No	Result CreateSession(Handle* sessionServer, Handle* sessionClient)
0x4A		No	Result AcceptSession(Handle* session, Handle port)
0x4B		No	Result ReplyAndReceive1(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
0x4C		No	Result ReplyAndReceive2(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
0x4D		No	Result ReplyAndReceive3(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
0x4E		No	Result ReplyAndReceive4(s32* index, Handle* handles, s32 handleCount, Handle replyTarget) (Stubbed)
0x4F		No	Result ReplyAndReceive(s32* index, Handle* handles, s32 handleCount, Handle replyTarget)
0x50		Yes	Result BindInterrupt(Interrupt name, Handle syncObject, s32 priority, bool isManualClear)
0x51		Yes	Result UnbindInterrupt(Interrupt name, Handle syncObject)
0x52		Yes	Result InvalidateProcessDataCache(Handle process, void* addr, u32 size)
0x53		Yes	Result StoreProcessDataCache(Handle process, void const* addr, u32 size)
0x54		Yes	Result FlushProcessDataCache(Handle process, void const* addr, u32 size)
0x55		Yes	Result StartInterProcessDma(Handle* dma, Handle dstProcess, void* dst, Handle srcProcess, const void* src, u32 size, const DmaConfig& config )
0x56		Yes	Result StopDma(Handle dma)
0x57		Yes	Result GetDmaState(DmaState* state, Handle dma)
0x58		Yes	RestartDma(nn::Handle, void *, void const*, unsigned int, signed char)
0x60		No	Result DebugActiveProcess(Handle* debug, u32 processID)
0x61		No	Result BreakDebugProcess(Handle debug)
0x62		No	Result TerminateDebugProcess(Handle debug)
0x63		No	Result GetProcessDebugEvent(DebugEventInfo* info, Handle debug)
0x64		No	Result ContinueDebugEvent(Handle debug, u32 flags)
0x65		No	Result GetProcessList(s32* processCount, u32* processIds, s32 processIdMaxCount)
0x66		No	Result GetThreadList(s32* threadCount, u32* threadIds, s32 threadIdMaxCount, Handle domain)
0x67		No	Result GetDebugThreadContext(ThreadContext* context, Handle debug, u32 threadId, u32 controlFlags)
0x68		No	Result SetDebugThreadContext(Handle debug, u32 threadId, ThreadContext* context, u32 controlFlags)
0x69		No	Result QueryDebugProcessMemory(MemoryInfo* blockInfo, PageInfo* pageInfo, Handle process, u32 addr)
0x6A		No	Result ReadProcessMemory(void* buffer, Handle debug, u32 addr, u32 size)
0x6B		No	Result WriteProcessMemory(Handle debug, void const* buffer, u32 addr, u32 size)
0x6C		No	Result SetHardwareBreakPoint(s32 registerId, u32 control, u32 value)
0x6D		No	GetDebugThreadParam(long long *, int *, nn::Handle, unsigned int, nn::dmnt::DebugThreadParam) (Disabled on regular kernel)
0x70		No	ControlProcessMemory(Handle KProcess, unsigned int Addr0, unsigned int Addr1, unsigned int Size, unsigned int Type, unsigned int Permissions)
0x71		No	MapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
0x72		No	UnmapProcessMemory(Handle KProcess, unsigned int StartAddr, unsigned int EndAddr)
0x73		No	?
0x74	Stubbed	No
0x75		No	?
0x76		No	TerminateProcess(Handle)
0x77		No	(Handle KProcess, Handle KResourceLimit)
0x78		No	CreateResourceLimit(Handle *KResourceLimit)
0x79		No	?
0x7A	Stubbed beginning with 2.0.0-2	Yes	? (unsigned int Addr, unsigned int Size)
0x7C		Yes	KernelSetState(unsigned int Type, unsigned int Param0, unsigned int Param1, unsigned int Param2) (The Type determines the usage of each param)
0x7D		No	QueryProcessMemory(MemInfo *Info, unsigned int *Out, Handle KProcess, unsigned int Addr)
0xFF		Yes	Debug related (The Syscall access control mask doesn't apply for this SVC)

CreateThread

R0=s32 threadpriority
R1=func entrypoint
R2=u32 arg
R3=u32 stacktop
R4=s32 processorid

Result result=R0
Handle* thread=R1

This processorid is a bitmask for which processors the thread can be run on. Bit value zero enables thread execution for this CPUID, bit value one disables thread execution for this CPUID. Bit0-bit1 are for CPUID0-CPUID1.

The stacktop must be aligned to 0x8-bytes, otherwise when not aligned to 0x8-bytes the ARM11 kernel clears the low 3-bits of the stacktop address.

Types and structures

enum MemoryState

Memory state flags	Bit
FREE	0
RESERVED	1
IO	2
STATIC	3
CODE	4
PRIVATE	5
SHARED	6
CONTINUOUS	7
ALIASED	8
ALIAS	9
ALIAS CODE	10
LOCKED	11

enum PageFlags

Page flags	Bit
LOCKED	0
CHANGED	1

enum MemoryOperation

Memory operation	Id
FREE	1
RESERVE	2
COMMIT	3
MAP	4
UNMAP	5
PROTECT	6
REGION APP	0x100
REGION SYSTEM	0x200
REGION BASE	0x300
LINEAR	0x1000

enum MemoryPermission

Memory permission	Id
NONE	0
READ	1
WRITE	2
READWRITE	3
DONTCARE	0x10000000

enum ResetType

Reset type	Id
ONESHOT	0
STICKY	1
PULSE	2

struct MemoryInfo

Type	Field
u32	Base address
u32	Size
u32	Permission
enum MemoryState	State

struct PageInfo

Type	Field
u32	Flags

struct StartupInfo

Type	Field
s32	Priority
u32	Stack size
s32	argc
s16*	argv
s16*	envp

Processes

Each process can only use SVCs which are enabled in the exheader for this process. The ARM11 kernel SVC handler checks whether the SVC is enabled in the syscall access control mask stored on the SVC-mode stack, when the SVC isn't enabled a kernelpanic() is triggered. Each process has a separate SVC-mode stack, this stack and the syscall access mask stored here is initialized when the process is started. Applications normally only have access to SVCs <=0x3D, however not all SVCs <=0x3D are accessible to the application. The majority of the SVCs accessible to applications are unused by the application.

Each process has a separate handle-table, the size of this table is stored in the exheader. The handles in a handle-table can't be used in the context of other processes, since those handles don't exist in other handle-tables.

0xFFFF8001 is a handle alias for the current KProcess, and 0xFFFF8000 is a handle alias for the current KThread.

Calling svcBreak on retail will only terminate the process which called this SVC.

Threads

For svcCreateThread the input address used for Entrypoint_Param and StackTop are normally the same, however these can be arbitrary. For the main thread the Entrypoint_Param is value 0.

Using CloseHandle() with a KThread handle will terminate the specified thread.

Memory Mapping

ControlMemory and MapMemoryBlock can be used to map memory pages, these two SVCs only support mapping execute-never R/W pages. The input permissions parameter for these SVCs must be <=3, where value zero is used when un-mapping memory. Bitmask 0xf00 for ControlMemory parameter MemoryType is the memory-type, when this is zero the memory-type is loaded from the kernel flags stored in the exheader ARM11 kernel descriptors, for the process using the SVC. ControlMemory parameter MemoryType with value 0x10003 is used for mapping the GSP heap. The low 8-bits are the type: 1 is for un-mapping memory, 3 for mapping memory. Type4 is used to mirror the RW memory at Addr1, to Addr0. Type4 will return an error if Addr1 is located in read-only memory. Addr1 is not used for type1 and type3.

The ARM11 kernel does not allow processes to create shared memory blocks via svcCreateMemoryBlock, when the process memorytype(from the kernel flags stored in the exheader kernel descriptor) is the application memorytype, and when addr=0. It's unknown how the kernel handles addr=0 when the memorytype is not the application memorytype. When addr is non-zero, it must be located in memory which is already mapped.

ControlProcessMemory maps memory in the specified process, this is the only SVC which allows mapping executable memory. Format of the permissions field for memory mapping SVCs: bit0=R, bit1=W, bit2=X. Type6 sets the Addr0 memory permissions to the input permissions, for already mapped memory. Type is the MemoryOperation enum, without the memory-type/memory-region. ControlProcessMemory only supports type4, type5, and type6. ControlProcessMemory does not support using the current KProcess handle alias.

MapProcessMemory maps RW memory starting at address 0x00100000 in the specified KProcess, at the specified StartAddr in the current process. MapProcessMemory then maps 0x08000000 in the specified process, to StartAddr+0x7f00000 in the current process. UnmapProcessMemory unmaps the memory which was mapped by MapProcessMemory.

Debugging

DebugActiveProcess is used to attach to a process for debugging. This SVC can only be used when the target process' ARM11 descriptors stored in the exheader have the kernel flag for "Enable debug" set. Otherwise when that flag is clear, the kernel flags for the process using this SVC must have the "Force debug" flag set.

KernelSetState

Type	Enabled for the NATIVE_FIRM ARM11 kernel	Enabled for the TWL_FIRM ARM11 kernel	Description
0	Yes	No	This initializes the programID for launching FIRM, then triggers launching FIRM. Param0 and Param2 are unused. Param1 is the programID-low, and the programID-high is 0x00040138.
1	Yes	Yes	Unknown, does nothing with the TWL_FIRM ARM11 kernel.
2	Yes	Yes	?
3	Yes	No	This used for initializing the 0x1000-byte buffer used by the launched FIRM. Param2 is unused. When Param0 is value 1, this buffer is copied to the beginning of FCRAM at 0xF0000000, and Param1 is unused. When Param0 is value 0, this kernel buffer is mapped to process address Param1.
4	No	Yes	This unmaps the following virtual memory by writing value physaddr(where physaddr base is 0x80000000) to the L1 MMU table entries: 0x00300000..0x04300000, 0x08000000..0x0FE00000, and 0x10000000..0xF8000000. Attempting to access these regions after using this svcKernelSetState type would result in a translation fault.
5	Yes	Yes	?
6	Yes	No	Debug related?
7	Yes	No	This triggers ARM11 kernel I2C code, Param0-Param3 are unused. This ARM11 kernel I2C code will never return. Device address 0x4a via the second I2C bus is used here. This triggers a hardware system reboot via poking an I2C MCU register: register address 0x20 is written to with value 4.
8	Yes	No	Alternate unused FIRM launch code-path, with different PXI FIFO word constants.

GetSystemInfo

Type0 value 26(Type1 is unused) writes the total number of processes which were directly launched by the kernel, to Output. For the NATIVE_FIRM/SAFE_MODE_FIRM ARM11 kernel, this is normally 5, for processes sm, fs, pm, loader, and pxi.

Kernel error-codes

Error-code value	Description
0xD8E007F7	This error indicates that the input handle used with the SVC does not exist in the process handle-table, or that the handle kernel object type does not match the type used by the SVC.
0xD92007EA	This error is returned when a process attempts to use svcCreateMemoryBlock when the process memorytype is the application memorytype, and when addr=0.
0xF8C007F4	Invalid type/param0-param3 input for svcKernelSetState.