The IPC commands are written to the [[Thread Local Storage]] at offset 0x80. Every IPC command sent to services starts with a u32 header code:
+
The IPC commands are written to the Thread Local Storage, at offset 0x80. Every IPC command sent to services starts with a u32 header code, and parameters, if any, are written after this header. If the kernel was able to dispatch the request, the server replies with an error code at TLS+0x84, and after this code there is the response data, if any.
+
+
The command header is a 32-bit integer that can be decompossed in the following parts: