3dbrew - User contributions [en]

GPU/Shader Instruction Set

2023-08-24T15:54:39Z

Steveice10: More thorough behavior testing

[[Category:GPU]]

== Overview ==
A compiled shader binary is comprised of two parts : the main instruction sequence and the operand descriptor table. These are both sent to the GPU around the same time but using separate [[GPU/Internal_Registers|GPU Commands]]. Instructions (such as format 1 instruction) may reference operand descriptors. When such is the case, the operand descriptor ID is the offset, in words, of the descriptor within the table.
Both instructions and descriptors are coded in little endian.
Basic implementations of the following specification can be found at [https://github.com/smealum/aemstro] and [https://github.com/neobrain/nihstro].
The instruction set seems to have been heavily inspired by Microsoft's vs_3_0 [http://msdn.microsoft.com/en-us/library/windows/desktop/bb172938%28v=vs.85%29.aspx] and the Direct3D shader code [https://msdn.microsoft.com/en-us/library/windows/hardware/ff552891%28v=vs.85%29.aspx].
Please note that this page is being written as the instruction set is reverse engineered; as such it may very well contain mistakes.

Debug information found in the code.bin of "Ironfall: Invasion" suggests that there may not be more than 512 instructions and 128 operand descriptors in a shader.

== Nomenclature ==

* opcode names with I appended to them are the same as their non-I version, except they use the inverted instruction format, giving 7 bits to SRC2 (and access to constant registers) and 5 bits to SRC1

* opcode names with U appended to them are the same as their non-U version, except they are executed conditionally based on the value of a constant boolean register.

* opcode names with C appended to them are the same as their non-C version, except they are executed conditionally based on a logical expression specified in the instruction.

== Instruction formats ==

Format 1 : (used for register operations)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x7
| Operand descriptor ID (DESC)
|-
| 0x7
| 0x5
| Source 2 register (SRC2)
|-
| 0xC
| 0x7
| Source 1 register (SRC1)
|-
| 0x13
| 0x2
| Address register index for SRC1 (IDX_1)
|-
| 0x15
| 0x5
| Destination register (DST)
|-
| 0x1A
| 0x6
| Opcode
|}

Format 1i : (used for register operations)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x7
| Operand descriptor ID (DESC)
|-
| 0x7
| 0x7
| Source 2 register (SRC2)
|-
| 0xE
| 0x5
| Source 1 register (SRC1)
|-
| 0x13
| 0x2
| Address register index for SRC2 (IDX_2)
|-
| 0x15
| 0x5
| Destination register (DST)
|-
| 0x1A
| 0x6
| Opcode
|}

Format 1u : (used for unary register operations)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x7
| Operand descriptor ID (DESC)
|-
| 0xC
| 0x7
| Source 1 register (SRC1)
|-
| 0x13
| 0x2
| Address register index for SRC1 (IDX_1)
|-
| 0x15
| 0x5
| Destination register (DST)
|-
| 0x1A
| 0x6
| Opcode
|}

Format 1c : (used for comparison operations)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x7
| Operand descriptor ID (DESC)
|-
| 0x7
| 0x5
| Source 2 register (SRC2)
|-
| 0xC
| 0x7
| Source 1 register (SRC1)
|-
| 0x13
| 0x2
| Address register index for SRC1 (IDX_1)
|-
| 0x15
| 0x3
| Comparison operator for Y (CMPY)
|-
| 0x18
| 0x3
| Comparison operator for X (CMPX)
|-
| 0x1B
| 0x5
| Opcode
|}

Format 2 : (used for flow control instructions)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x8
| Number of instructions (NUM)
|-
| 0xA
| 0xC
| Destination offset (in words) (DST)
|-
| 0x16
| 0x2
| Condition boolean operator (CONDOP)
|-
| 0x18
| 0x1
| Y reference bit (REFY)
|-
| 0x19
| 0x1
| X reference bit (REFX)
|-
| 0x1A
| 0x6
| Opcode
|}

Format 3 : (used for constant-based conditional flow control instructions)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x8
| Number of instructions ? (NUM)
|-
| 0xA
| 0xC
| Destination offset (in words) (DST)
|-
| 0x16
| 0x4
| Constant ID (BOOL/INT)
|-
| 0x1A
| 0x6
| Opcode
|}

Format 4 : (used for SETEMIT)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x16
| 0x1
| Winding flag (FLAG_WINDING)
|-
| 0x17
| 0x1
| Primitive emit flag (FLAG_PRIMEMIT)
|-
| 0x18
| 0x2
| Vertex ID (VTXID)
|-
| 0x1A
| 0x6
| Opcode
|}

Format 5 : (used for MAD)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x5
| Operand descriptor ID (DESC)
|-
| 0x5
| 0x5
| Source 3 register (SRC3)
|-
| 0xA
| 0x7
| Source 2 register (SRC2)
|-
| 0x11
| 0x5
| Source 1 register (SRC1)
|-
| 0x16
| 0x2
| Address register index for SRC2 (IDX_2)
|-
| 0x18
| 0x5
| Destination register (DST)
|-
| 0x1D
| 0x3
| Opcode
|}

Format 5i : (used for MADI)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x5
| Operand descriptor ID (DESC)
|-
| 0x5
| 0x7
| Source 3 register (SRC3)
|-
| 0xC
| 0x5
| Source 2 register (SRC2)
|-
| 0x11
| 0x5
| Source 1 register (SRC1)
|-
| 0x16
| 0x2
| Address register index for SRC3 (IDX_3)
|-
| 0x18
| 0x5
| Destination register (DST)
|-
| 0x1D
| 0x3
| Opcode
|}

== Instructions ==
Unless noted otherwise, SRC1 and SRC2 refer to their respectively indexed float[4] registers (after swizzling). Similarly, DST refers to its indexed register modulo destination component masking, i.e. an expression like DST=SRC1 might actually just set DST.y to SRC1.y.

{| class="wikitable" border="1"
|-
! Opcode
! Format
! Name
! Description
|-
| 0x00
| 1
| ADD
| Adds two vectors component by component; DST[i] = SRC1[i]+SRC2[i] for all i
|-
| 0x01
| 1
| DP3
| Computes dot product on 3-component vectors; DST = SRC1.SRC2
|-
| 0x02
| 1
| DP4
| Computes dot product on 4-component vectors; DST = SRC1.SRC2
|-
| 0x03
| 1
| DPH
| Computes dot product on a 3-component vector with 1.0 appended to it and a 4-component vector; DST = SRC1.SRC2 (with SRC1 homogenous)
|-
| 0x04
| 1
| DST
| Equivalent to Microsoft's [https://msdn.microsoft.com/en-us/library/windows/desktop/bb219790.aspx dst] instruction: DST = {1, SRC1[1]*SRC2[1], SRC1[2], SRC2[3]}
|-
| 0x05
| 1u
| EX2
| Computes SRC1's first component exponent with base 2; DST[i] = EXP2(SRC1[0]) for all i
|-
| 0x06
| 1u
| LG2
| Computes SRC1's first component logarithm with base 2; DST[i] = LOG2(SRC1[0]) for all i
|-
| 0x07
| 1u
| LITP
| Appears to be related to Microsoft's [https://msdn.microsoft.com/en-us/library/windows/desktop/bb174703.aspx lit] instruction; DST = clamp(SRC1, min={0, -127.9961, 0, 0}, max={inf, 127.9961, 0, inf}); n.b.: 127.9961 = 0x7FFF / 0x100
|-
| 0x08
| 1
| MUL
| Multiplies two vectors component by component; DST[i] = SRC1[i].SRC2[i] for all i
|-
| 0x09
| 1
| SGE
| Sets output if SRC1 is greater than or equal to SRC2; DST[i] = (SRC1[i] >= SRC2[i]) ? 1.0 : 0.0 for all i
|-
| 0x0A
| 1
| SLT
| Sets output if SRC1 is strictly less than SRC2; DST[i] = (SRC1[i] < SRC2[i]) ? 1.0 : 0.0 for all i
|-
| 0x0B
| 1u
| FLR
| Computes SRC1's floor component by component; DST[i] = FLOOR(SRC1[i]) for all i
|-
| 0x0C
| 1
| MAX
| Takes the max of two vectors, component by component; DST[i] = MAX(SRC1[i], SRC2[i]) for all i
|-
| 0x0D
| 1
| MIN
| Takes the min of two vectors, component by component; DST[i] = MIN(SRC1[i], SRC2[i]) for all i
|-
| 0x0E
| 1u
| RCP
| Computes the reciprocal of the vector's first component; DST[i] = 1/SRC1[0] for all i
|-
| 0x0F
| 1u
| RSQ
| Computes the reciprocal of the square root of the vector's first component; DST[i] = 1/sqrt(SRC1[0]) for all i
|-
| 0x10
| ?
| ???
| ?
|-
| 0x11
| ?
| ???
| ?
|-
| 0x12
| 1u
| MOVA
| Move to address register; Casts the float value given by SRC1 to an integer (truncating the fractional part) and assigns the result to (a0.x, a0.y, _, _), respecting the destination component mask.
|-
| 0x13
| 1u
| MOV
| Moves value from one register to another; DST = SRC1.
|-
| 0x14
| ?
| ???
| ?
|-
| 0x15
| ?
| ???
| ?
|-
| 0x16
| ?
| ???
| ?
|-
| 0x17
| ?
| ???
| ?
|-
| 0x18
| 1i
| DPHI
| Computes dot product on a 3-component vector with 1.0 appended to it and a 4-component vector; DST = SRC1.SRC2 (with SRC1 homogenous)
|-
| 0x19
| 1i
| DSTI
| DST with sources swapped.
|-
| 0x1A
| 1i
| SGEI
| Sets output if SRC1 is greater than or equal to SRC2; DST[i] = (SRC1[i] >= SRC2[i]) ? 1.0 : 0.0 for all i
|-
| 0x1B
| 1i
| SLTI
| Sets output if SRC1 is strictly less than SRC2; DST[i] = (SRC1[i] < SRC2[i]) ? 1.0 : 0.0 for all i
|-
| 0x1C
| ?
| ???
| ?
|-
| 0x1D
| ?
| ???
| ?
|-
| 0x1E
| ?
| ???
| ?
|-
| 0x1F
| ?
| ???
| ?
|-
| 0x20
| 0
| BREAK
| Breaks out of LOOP block; do not use while in nested IF/CALL block inside LOOP block.
|-
| 0x21
| 0
| NOP
| Does literally nothing.
|-
| 0x22
| 0
| END
| Signals the shader unit that processing for this vertex/primitive is done.
|-
| 0x23
| 2
| BREAKC
| If condition (see [[#Conditions|below]] for details) is true, then breaks out of LOOP block.
|-
| 0x24
| 2
| CALL
| Jumps to DST and executes instructions until it reaches DST+NUM instructions
|-
| 0x25
| 2
| CALLC
| If condition (see [[#Conditions|below]] for details) is true, then jumps to DST and executes instructions until it reaches DST+NUM instructions, else does nothing.
|-
| 0x26
| 3
| CALLU
| Jumps to DST and executes instructions until it reaches DST+NUM instructions if BOOL is true
|-
| 0x27
| 3
| IFU
| If condition BOOL is true, then executes instructions until DST, then jumps to DST+NUM; else, jumps to DST.
|-
| 0x28
| 2
| IFC
| If condition (see [[#Conditions|below]] for details) is true, then executes instructions until DST, then jumps to DST+NUM; else, jumps to DST
|-
| 0x29
| 3
| LOOP
| Loops over the code between itself and DST (inclusive), performing INT.x+1 iterations in total. First, aL is initialized to INT.y. After each iteration, aL is incremented by INT.z.
|-
| 0x2A
| 0 (no param)
| EMIT
| (geometry shader only) Emits a vertex (and primitive if FLAG_PRIMEMIT was set in the corresponding SETEMIT). SETEMIT must be called before this.
|-
| 0x2B
| 4
| SETEMIT
| (geometry shader only) Sets VTXID, FLAG_WINDING and FLAG_PRIMEMIT for the next EMIT instruction. VTXID is the ID of the vertex about to be emitted within the primitive, while FLAG_PRIMEMIT is zero if we are just emitting a single vertex and non-zero if are emitting a vertex and primitive simultaneously. FLAG_WINDING controls the output primitive's winding. Note that the output vertex buffer (which holds 4 vertices) is '''not''' cleared when the primitive is emitted, meaning that vertices from the previous primitive can be reused for the current one. (this is still a working hypothesis and unconfirmed)
|-
| 0x2C
| 2
| JMPC
| If condition (see [[#Conditions|below]] for details) is true, then jumps to DST, else does nothing.
|-
| 0x2D
| 3
| JMPU
| If condition BOOL is true, then jumps to DST, else does nothing. Having bit 0 of NUM = 1 will invert the test, jumping if BOOL is false instead.
|-
| 0x2E-0x2F
| 1c
| CMP
| Sets booleans cmp.x and cmp.y based on the operand's x and y components and the CMPX and CMPY comparison operators respectively. See [[#Comparison_operator|below]] for details about operators. It's unknown whether CMP respects the destination component mask or not.
|-
| 0x30-0x37
| 5i
| MADI
| Multiplies two vectors and adds a third one component by component; DST[i] = SRC3[i] + SRC2[i].SRC1[i] for all i; this is not an FMA, the intermediate result is rounded
|-
| 0x38-0x3F
| 5
| MAD
| Multiplies two vectors and adds a third one component by component; DST[i] = SRC3[i] + SRC2[i].SRC1[i] for all i; this is not an FMA, the intermediate result is rounded
|}

== Operand descriptors ==
Sizes below are in bits, not bytes.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Destination component mask. Bit 3 = x, 2 = y, 1 = z, 0 = w.
|-
| 0x4
| 0x1
| Source 1 negation bit
|-
| 0x5
| 0x8
| Source 1 component selector
|-
| 0xD
| 0x1
| Source 2 negation bit
|-
| 0xE
| 0x8
| Source 2 component selector
|-
| 0x16
| 0x1
| Source 3 negation bit
|-
| 0x17
| 0x8
| Source 3 component selector
|}

Component selector :
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Component 3 value
|-
| 0x2
| 0x2
| Component 2 value
|-
| 0x4
| 0x2
| Component 1 value
|-
| 0x6
| 0x2
| Component 0 value
|}

{| class="wikitable" border="1"
|-
! Value
! Component
|-
| 0x0
| x
|-
| 0x1
| y
|-
| 0x2
| z
|-
| 0x3
| w
|}

The component selector enables swizzling. For example, component selector 0x1B is equivalent to .xyzw, while 0x55 is equivalent to .yyyy.

Depending on the current shader opcode, source components are disabled implicitly by setting the destination component mask. For example, ADD o0.xy, r0.xyzw, r1.xyzw will not make use of r0's or r1's z/w components, while DP4 o0.xy, r0.xyzw, r1.xyzw will use all input components regardless of the used destination component mask.

== Relative addressing ==

{| class="wikitable" border="1"
|-
! IDX raw value
! Register name
|-
| 0x0
| None
|-
| 0x1
| a0.x
|-
| 0x2
| a0.y
|-
| 0x3
| aL
|}

There are 3 address registers: a0.x, a0.y and aL (loop counter). For format 1 instructions, when IDX != 0, the value of the corresponding address register is added to SRC1's value. For example, if IDX = 2, a0.y = 3 and SRC1 = c8, then instead SRC1+a0.y = c11 will be used for the instruction. It is only possible to use address registers on constant registers, attempting to use them on input attribute or temporary registers results in the address register being ignored (i.e. read as zero).

a0.x and a0.y are set manually through the MOVA instruction by rounding a float value to integer precision. Hence, they may take negative values. The way out-of-bounds values behave when reading uniforms is as follows:
* If the offset is out of byte bounds (less than -128 or greater than 127), the offset is not applied (treated as 0).
* The offset is added to the constant register index and masked by 0x7F.
* If the resulting index is greater than 95, the result is (1, 1, 1, 1).
* Otherwise, the result is the value at the indexed constant register.

aL can only be set indirectly by the LOOP instruction. It is still accessible and valid after exiting a LOOP block, though.

== Comparison operator ==

{| class="wikitable" border="1"
|-
! CMPX/CMPY raw value
! Operator name
! Expression
|-
| 0x0
| EQ
| src1 == src2
|-
| 0x1
| NE
| src1 != src2
|-
| 0x2
| LT
| src1 < src2
|-
| 0x3
| LE
| src1 <= src2
|-
| 0x4
| GT
| src1 > src2
|-
| 0x5
| GE
| src1 >= src2
|-
| 0x6
| ??
| true ?
|-
| 0x7
| ??
| true ?
|}

6 and 7 seem to always return true.

== Conditions ==

A number of format 2 instructions are executed conditionally. These conditions are based on two boolean registers which can be set with CMP : cmp.x and cmp.y.

Conditional instructions include 3 parameters : CONDOP, REFX and REFY. REFX and REFY are reference values which are tested for equality against cmp.x and cmp.y, respectively. CONDOP describes how the final truth value is constructed from the results of the two tests. There are four conditional expression formats :

{| class="wikitable" border="1"
|-
! CONDOP raw value
! Expression
! Description
|-
| 0x0
| <nowiki>cmp.x == REFX || cmp.y == REFY</nowiki>
| OR
|-
| 0x1
| <nowiki>cmp.x == REFX && cmp.y == REFY</nowiki>
| AND
|-
| 0x2
| cmp.x == REFX
| X
|-
| 0x3
| cmp.y == REFY
| Y
|}

== Registers ==

{| class="wikitable" border="1"
|-
! Name
! Format
! Type
! Access
! Written by
! Description
|-
| v0-v15
| vector
| float
| Read only
| Application/Vertex-stream
| Input registers.
|-
| o0-o15
| vector
| float
| Write only
| Vertex shader
| Output registers.
|-
| r0-r15
| vector
| float
| Read/Write
| Vertex shader
| Temporary registers.
|-
| c0-c95
| vector
| float
| Read only
| Application/Vertex-stream
| Floating-point Constant registers.
|-
| i0-i3
| vector
| integer
| Read only
| Application
| Integer Constant registers. (special purpose)
|-
| b0-b15
| scalar
| boolean
| Read only
| Application
| Boolean Constant registers. (special purpose)
|-
| a0.x & a0.y
| scalar
| integer
| Use/Write
| Vertex shader
| Address registers.
|-
| aL
| scalar
| integer
| Use
| Vertex shader
| Loop count register.
|}

Input attribute registers store the per-vertex data given by the CPU and hence are read-only.

Output registers hold the data to be passed to the later GPU stages and are write-only. Each of the output register is assigned a semantic by setting the corresponding [[GPU_Internal_Registers]]. Output registers o7-o15 are only available in vertex shaders.
Keep in mind that writing to the same output register/component more than once appears appears to cause problems (e.g. GPU hangs).

Temporary registers can be used for intermediate calculations and can be both read and written.

Constant registers hold data uploaded by the application which remain constant throughout all processed vertices. There are 96 float[4] constant registers (c0-c95), eight boolean constant registers (b0-b7), and four int[4] constant registers (i0-i3).
Many shader instructions which take float arguments can only provide the full 7 bits for one SRC operand. All other source operands can only be used to refer to input attributes or temporary registers and cannot be passed Floating-point Constant registers.

Address registers and the Loop count register can be used to to provide relative addressing for the designated SRC operand. For more information, see the section on [[#Relative_addressing|relative addressing]].

DST mapping :

{| class="wikitable" border="1"
|-
! DST raw value
! Register name
! Description
|-
| 0x0-0xF
| o0-o15
| Output registers.
|-
| 0x10-0x1F
| r0-r15
| Temporary registers.
|}

SRC mapping :

{| class="wikitable" border="1"
|-
! SRC raw value
! Register name
! Description
|-
| 0x0-0xF
| v0-v15
| Input attribute registers.
|-
| 0x10-0x1F
| r0-r15
| Temporary registers.
|-
| 0x20-0x7F
| c0-c95
| Constant registers.
|}

== Floating-Point Behavior ==

The PICA200 is not IEEE-compliant. It has positive and negative infinities and NaN, but does not seem to have negative 0. Input and output subnormals are flushed to +0. The internal floating point format seems to be the same as used in shader binaries: 1 sign bit, 7 exponent bits, 16 (explicit) mantissa bits. Several instructions also have behavior that differs from the IEEE functions. Here are the results from some tests done on hardware (s = largest subnormal, n = smallest positive normal):

{| class="wikitable" border="1"
|-
! Computation
! Result
! Notes
|-
| inf * 0
| 0
| Including inside MUL, MAD, DP4, etc.
|-
| NaN * 0
| NaN
|
|-
| +inf - +inf
| NaN
| Indicates +inf is real inf, not FLT_MAX
|-
| rsq(rcp(-inf))
| +inf
| Indicates that there isn't -0.0.

|- style="border-top: double"
| rcp(-0)
| +inf
| no -0 so differs from IEEE where rcp(-0) = -inf
|-
| rcp(0)
| +inf
|
|-
| rcp(+inf)
| 0
|
|-
| rcp(NaN)
| NaN
|

|- style="border-top: double"
| rsq(-0)
| +inf
| no -0 so differs from IEEE where rsq(-0) = -inf
|-
| rsq(-2)
| NaN
|
|-
| rsq(+inf)
| 0
|
|-
| rsq(-inf)
| NaN
|
|-
| rsq(NaN)
| NaN
|

|- style="border-top: double"
| max(0, +inf)
| +inf
|
|-
| max(0, -inf)
| -inf
|
|-
| max(0, NaN)
| NaN
| max violates IEEE but match GLSL spec
|-
| max(NaN, 0)
| 0
|
|-
| max(-inf, +inf)
| +inf
|

|- style="border-top: double"
| min(0, +inf)
| 0
|
|-
| min(0, -inf)
| -inf
|
|-
| min(0, NaN)
| NaN
| min violates IEEE but match GLSL spec
|-
| min(NaN, 0)
| 0
|
|-
| min(-inf, +inf)
| -inf
|

|- style="border-top: double"
| cmp(s, 0)
| false
| cmp does not flush input subnormals
|-
| max(s, 0)
| s
| max does not flush input or output subnormals
|-
| mul(s, 2)
| 0
| input subnormals are flushed in arithmetic instructions
|-
| mul(n, 0.5)
| 0
| output subnormals are flushed in arithmetic instructions
|}

1.0 can be multiplied 63 times by 0.5 until the result compares equal zero. This is consistent with a 7-bit exponent and output subnormal flushing.

== Control Flow ==

Control flow is implemented using four independent stacks:

* 4-deep CALL stack
* 8-deep IF stack
* 4-deep LOOP stack

All stacks are initially empty. After every instruction but before JMP takes effect, the PC is incremented and a copy is sent to each stack. Each stack is checked against its copy of the PC. If an entry is popped from the stack, the copied PC is updated and used for the next check of this stack, although the IF/LOOP stacks can each only pop one entry per instruction, whereas the CALL stack is checked again until it doesn't match or the stack is empty. The updated PC copy with the highest priority wins: LOOP (highest), IF, CALL, JMP, original PC (lowest).

Special cases:
* JMP overwrites the PC *after* the stacks checks (and only if no stack was popped).
* Executing a BREAK on an empty LOOP stack hangs the GPU.
* A stack overflow discards the oldest element, so you could think of it as a queue or a ring buffer.
* If the CALL stack is popped four times in a row, the fourth update to its copy of the PC is missed (the third PC update will be propagated). Probably a hardware bug.

GPU/Shader Instruction Set

2023-08-24T08:53:23Z

Steveice10: /* Relative addressing */

[[Category:GPU]]

== Overview ==
A compiled shader binary is comprised of two parts : the main instruction sequence and the operand descriptor table. These are both sent to the GPU around the same time but using separate [[GPU/Internal_Registers|GPU Commands]]. Instructions (such as format 1 instruction) may reference operand descriptors. When such is the case, the operand descriptor ID is the offset, in words, of the descriptor within the table.
Both instructions and descriptors are coded in little endian.
Basic implementations of the following specification can be found at [https://github.com/smealum/aemstro] and [https://github.com/neobrain/nihstro].
The instruction set seems to have been heavily inspired by Microsoft's vs_3_0 [http://msdn.microsoft.com/en-us/library/windows/desktop/bb172938%28v=vs.85%29.aspx] and the Direct3D shader code [https://msdn.microsoft.com/en-us/library/windows/hardware/ff552891%28v=vs.85%29.aspx].
Please note that this page is being written as the instruction set is reverse engineered; as such it may very well contain mistakes.

Debug information found in the code.bin of "Ironfall: Invasion" suggests that there may not be more than 512 instructions and 128 operand descriptors in a shader.

== Nomenclature ==

* opcode names with I appended to them are the same as their non-I version, except they use the inverted instruction format, giving 7 bits to SRC2 (and access to constant registers) and 5 bits to SRC1

* opcode names with U appended to them are the same as their non-U version, except they are executed conditionally based on the value of a constant boolean register.

* opcode names with C appended to them are the same as their non-C version, except they are executed conditionally based on a logical expression specified in the instruction.

== Instruction formats ==

Format 1 : (used for register operations)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x7
| Operand descriptor ID (DESC)
|-
| 0x7
| 0x5
| Source 2 register (SRC2)
|-
| 0xC
| 0x7
| Source 1 register (SRC1)
|-
| 0x13
| 0x2
| Address register index for SRC1 (IDX_1)
|-
| 0x15
| 0x5
| Destination register (DST)
|-
| 0x1A
| 0x6
| Opcode
|}

Format 1i : (used for register operations)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x7
| Operand descriptor ID (DESC)
|-
| 0x7
| 0x7
| Source 2 register (SRC2)
|-
| 0xE
| 0x5
| Source 1 register (SRC1)
|-
| 0x13
| 0x2
| Address register index for SRC2 (IDX_2)
|-
| 0x15
| 0x5
| Destination register (DST)
|-
| 0x1A
| 0x6
| Opcode
|}

Format 1u : (used for unary register operations)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x7
| Operand descriptor ID (DESC)
|-
| 0xC
| 0x7
| Source 1 register (SRC1)
|-
| 0x13
| 0x2
| Address register index for SRC1 (IDX_1)
|-
| 0x15
| 0x5
| Destination register (DST)
|-
| 0x1A
| 0x6
| Opcode
|}

Format 1c : (used for comparison operations)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x7
| Operand descriptor ID (DESC)
|-
| 0x7
| 0x5
| Source 2 register (SRC2)
|-
| 0xC
| 0x7
| Source 1 register (SRC1)
|-
| 0x13
| 0x2
| Address register index for SRC1 (IDX_1)
|-
| 0x15
| 0x3
| Comparison operator for Y (CMPY)
|-
| 0x18
| 0x3
| Comparison operator for X (CMPX)
|-
| 0x1B
| 0x5
| Opcode
|}

Format 2 : (used for flow control instructions)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x8
| Number of instructions (NUM)
|-
| 0xA
| 0xC
| Destination offset (in words) (DST)
|-
| 0x16
| 0x2
| Condition boolean operator (CONDOP)
|-
| 0x18
| 0x1
| Y reference bit (REFY)
|-
| 0x19
| 0x1
| X reference bit (REFX)
|-
| 0x1A
| 0x6
| Opcode
|}

Format 3 : (used for constant-based conditional flow control instructions)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x8
| Number of instructions ? (NUM)
|-
| 0xA
| 0xC
| Destination offset (in words) (DST)
|-
| 0x16
| 0x4
| Constant ID (BOOL/INT)
|-
| 0x1A
| 0x6
| Opcode
|}

Format 4 : (used for SETEMIT)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x16
| 0x1
| Winding flag (FLAG_WINDING)
|-
| 0x17
| 0x1
| Primitive emit flag (FLAG_PRIMEMIT)
|-
| 0x18
| 0x2
| Vertex ID (VTXID)
|-
| 0x1A
| 0x6
| Opcode
|}

Format 5 : (used for MAD)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x5
| Operand descriptor ID (DESC)
|-
| 0x5
| 0x5
| Source 3 register (SRC3)
|-
| 0xA
| 0x7
| Source 2 register (SRC2)
|-
| 0x11
| 0x5
| Source 1 register (SRC1)
|-
| 0x16
| 0x2
| Address register index for SRC2 (IDX_2)
|-
| 0x18
| 0x5
| Destination register (DST)
|-
| 0x1D
| 0x3
| Opcode
|}

Format 5i : (used for MADI)
{| class="wikitable" border="1"
|-
! Offset
! Size (bits)
! Description
|-
| 0x0
| 0x5
| Operand descriptor ID (DESC)
|-
| 0x5
| 0x7
| Source 3 register (SRC3)
|-
| 0xC
| 0x5
| Source 2 register (SRC2)
|-
| 0x11
| 0x5
| Source 1 register (SRC1)
|-
| 0x16
| 0x2
| Address register index for SRC3 (IDX_3)
|-
| 0x18
| 0x5
| Destination register (DST)
|-
| 0x1D
| 0x3
| Opcode
|}

== Instructions ==
Unless noted otherwise, SRC1 and SRC2 refer to their respectively indexed float[4] registers (after swizzling). Similarly, DST refers to its indexed register modulo destination component masking, i.e. an expression like DST=SRC1 might actually just set DST.y to SRC1.y.

{| class="wikitable" border="1"
|-
! Opcode
! Format
! Name
! Description
|-
| 0x00
| 1
| ADD
| Adds two vectors component by component; DST[i] = SRC1[i]+SRC2[i] for all i
|-
| 0x01
| 1
| DP3
| Computes dot product on 3-component vectors; DST = SRC1.SRC2
|-
| 0x02
| 1
| DP4
| Computes dot product on 4-component vectors; DST = SRC1.SRC2
|-
| 0x03
| 1
| DPH
| Computes dot product on a 3-component vector with 1.0 appended to it and a 4-component vector; DST = SRC1.SRC2 (with SRC1 homogenous)
|-
| 0x04
| 1
| DST
| Equivalent to Microsoft's [https://msdn.microsoft.com/en-us/library/windows/desktop/bb219790.aspx dst] instruction: DST = {1, SRC1[1]*SRC2[1], SRC1[2], SRC2[3]}
|-
| 0x05
| 1u
| EX2
| Computes SRC1's first component exponent with base 2; DST[i] = EXP2(SRC1[0]) for all i
|-
| 0x06
| 1u
| LG2
| Computes SRC1's first component logarithm with base 2; DST[i] = LOG2(SRC1[0]) for all i
|-
| 0x07
| 1u
| LITP
| Appears to be related to Microsoft's [https://msdn.microsoft.com/en-us/library/windows/desktop/bb174703.aspx lit] instruction; DST = clamp(SRC1, min={0, -127.9961, 0, 0}, max={inf, 127.9961, 0, inf}); n.b.: 127.9961 = 0x7FFF / 0x100
|-
| 0x08
| 1
| MUL
| Multiplies two vectors component by component; DST[i] = SRC1[i].SRC2[i] for all i
|-
| 0x09
| 1
| SGE
| Sets output if SRC1 is greater than or equal to SRC2; DST[i] = (SRC1[i] >= SRC2[i]) ? 1.0 : 0.0 for all i
|-
| 0x0A
| 1
| SLT
| Sets output if SRC1 is strictly less than SRC2; DST[i] = (SRC1[i] < SRC2[i]) ? 1.0 : 0.0 for all i
|-
| 0x0B
| 1u
| FLR
| Computes SRC1's floor component by component; DST[i] = FLOOR(SRC1[i]) for all i
|-
| 0x0C
| 1
| MAX
| Takes the max of two vectors, component by component; DST[i] = MAX(SRC1[i], SRC2[i]) for all i
|-
| 0x0D
| 1
| MIN
| Takes the min of two vectors, component by component; DST[i] = MIN(SRC1[i], SRC2[i]) for all i
|-
| 0x0E
| 1u
| RCP
| Computes the reciprocal of the vector's first component; DST[i] = 1/SRC1[0] for all i
|-
| 0x0F
| 1u
| RSQ
| Computes the reciprocal of the square root of the vector's first component; DST[i] = 1/sqrt(SRC1[0]) for all i
|-
| 0x10
| ?
| ???
| ?
|-
| 0x11
| ?
| ???
| ?
|-
| 0x12
| 1u
| MOVA
| Move to address register; Casts the float value given by SRC1 to an integer (truncating the fractional part) and assigns the result to (a0.x, a0.y, _, _), respecting the destination component mask.
|-
| 0x13
| 1u
| MOV
| Moves value from one register to another; DST = SRC1.
|-
| 0x14
| ?
| ???
| ?
|-
| 0x15
| ?
| ???
| ?
|-
| 0x16
| ?
| ???
| ?
|-
| 0x17
| ?
| ???
| ?
|-
| 0x18
| 1i
| DPHI
| Computes dot product on a 3-component vector with 1.0 appended to it and a 4-component vector; DST = SRC1.SRC2 (with SRC1 homogenous)
|-
| 0x19
| 1i
| DSTI
| DST with sources swapped.
|-
| 0x1A
| 1i
| SGEI
| Sets output if SRC1 is greater than or equal to SRC2; DST[i] = (SRC1[i] >= SRC2[i]) ? 1.0 : 0.0 for all i
|-
| 0x1B
| 1i
| SLTI
| Sets output if SRC1 is strictly less than SRC2; DST[i] = (SRC1[i] < SRC2[i]) ? 1.0 : 0.0 for all i
|-
| 0x1C
| ?
| ???
| ?
|-
| 0x1D
| ?
| ???
| ?
|-
| 0x1E
| ?
| ???
| ?
|-
| 0x1F
| ?
| ???
| ?
|-
| 0x20
| 0
| BREAK
| Breaks out of LOOP block; do not use while in nested IF/CALL block inside LOOP block.
|-
| 0x21
| 0
| NOP
| Does literally nothing.
|-
| 0x22
| 0
| END
| Signals the shader unit that processing for this vertex/primitive is done.
|-
| 0x23
| 2
| BREAKC
| If condition (see [[#Conditions|below]] for details) is true, then breaks out of LOOP block.
|-
| 0x24
| 2
| CALL
| Jumps to DST and executes instructions until it reaches DST+NUM instructions
|-
| 0x25
| 2
| CALLC
| If condition (see [[#Conditions|below]] for details) is true, then jumps to DST and executes instructions until it reaches DST+NUM instructions, else does nothing.
|-
| 0x26
| 3
| CALLU
| Jumps to DST and executes instructions until it reaches DST+NUM instructions if BOOL is true
|-
| 0x27
| 3
| IFU
| If condition BOOL is true, then executes instructions until DST, then jumps to DST+NUM; else, jumps to DST.
|-
| 0x28
| 2
| IFC
| If condition (see [[#Conditions|below]] for details) is true, then executes instructions until DST, then jumps to DST+NUM; else, jumps to DST
|-
| 0x29
| 3
| LOOP
| Loops over the code between itself and DST (inclusive), performing INT.x+1 iterations in total. First, aL is initialized to INT.y. After each iteration, aL is incremented by INT.z.
|-
| 0x2A
| 0 (no param)
| EMIT
| (geometry shader only) Emits a vertex (and primitive if FLAG_PRIMEMIT was set in the corresponding SETEMIT). SETEMIT must be called before this.
|-
| 0x2B
| 4
| SETEMIT
| (geometry shader only) Sets VTXID, FLAG_WINDING and FLAG_PRIMEMIT for the next EMIT instruction. VTXID is the ID of the vertex about to be emitted within the primitive, while FLAG_PRIMEMIT is zero if we are just emitting a single vertex and non-zero if are emitting a vertex and primitive simultaneously. FLAG_WINDING controls the output primitive's winding. Note that the output vertex buffer (which holds 4 vertices) is '''not''' cleared when the primitive is emitted, meaning that vertices from the previous primitive can be reused for the current one. (this is still a working hypothesis and unconfirmed)
|-
| 0x2C
| 2
| JMPC
| If condition (see [[#Conditions|below]] for details) is true, then jumps to DST, else does nothing.
|-
| 0x2D
| 3
| JMPU
| If condition BOOL is true, then jumps to DST, else does nothing. Having bit 0 of NUM = 1 will invert the test, jumping if BOOL is false instead.
|-
| 0x2E-0x2F
| 1c
| CMP
| Sets booleans cmp.x and cmp.y based on the operand's x and y components and the CMPX and CMPY comparison operators respectively. See [[#Comparison_operator|below]] for details about operators. It's unknown whether CMP respects the destination component mask or not.
|-
| 0x30-0x37
| 5i
| MADI
| Multiplies two vectors and adds a third one component by component; DST[i] = SRC3[i] + SRC2[i].SRC1[i] for all i; this is not an FMA, the intermediate result is rounded
|-
| 0x38-0x3F
| 5
| MAD
| Multiplies two vectors and adds a third one component by component; DST[i] = SRC3[i] + SRC2[i].SRC1[i] for all i; this is not an FMA, the intermediate result is rounded
|}

== Operand descriptors ==
Sizes below are in bits, not bytes.

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Destination component mask. Bit 3 = x, 2 = y, 1 = z, 0 = w.
|-
| 0x4
| 0x1
| Source 1 negation bit
|-
| 0x5
| 0x8
| Source 1 component selector
|-
| 0xD
| 0x1
| Source 2 negation bit
|-
| 0xE
| 0x8
| Source 2 component selector
|-
| 0x16
| 0x1
| Source 3 negation bit
|-
| 0x17
| 0x8
| Source 3 component selector
|}

Component selector :
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Component 3 value
|-
| 0x2
| 0x2
| Component 2 value
|-
| 0x4
| 0x2
| Component 1 value
|-
| 0x6
| 0x2
| Component 0 value
|}

{| class="wikitable" border="1"
|-
! Value
! Component
|-
| 0x0
| x
|-
| 0x1
| y
|-
| 0x2
| z
|-
| 0x3
| w
|}

The component selector enables swizzling. For example, component selector 0x1B is equivalent to .xyzw, while 0x55 is equivalent to .yyyy.

Depending on the current shader opcode, source components are disabled implicitly by setting the destination component mask. For example, ADD o0.xy, r0.xyzw, r1.xyzw will not make use of r0's or r1's z/w components, while DP4 o0.xy, r0.xyzw, r1.xyzw will use all input components regardless of the used destination component mask.

== Relative addressing ==

{| class="wikitable" border="1"
|-
! IDX raw value
! Register name
|-
| 0x0
| None
|-
| 0x1
| a0.x
|-
| 0x2
| a0.y
|-
| 0x3
| aL
|}

There are 3 address registers: a0.x, a0.y and aL (loop counter). For format 1 instructions, when IDX != 0, the value of the corresponding address register is added to SRC1's value. For example, if IDX = 2, a0.y = 3 and SRC1 = c8, then instead SRC1+a0.y = c11 will be used for the instruction. It is only possible to use address registers on constant registers, attempting to use them on input attribute or temporary registers results in the address register being ignored (i.e. read as zero).

a0.x and a0.y are set manually through the MOVA instruction by rounding a float value to integer precision. Hence, they may take negative values. The way out-of-bounds values behave when reading uniforms is as follows:
* If the value is out of byte bounds (less than -128 or greater than 127), the result is the vector (0, 0, 0, 0).
* If the value without its sign bit (value & 0x7F) is greater than 95, the result is the vector (1, 1, 1, 1).
* Otherwise, the index of the resulting uniform value is the value without its sign bit (value & 0x7F).

aL can only be set indirectly by the LOOP instruction. It is still accessible and valid after exiting a LOOP block, though.

== Comparison operator ==

{| class="wikitable" border="1"
|-
! CMPX/CMPY raw value
! Operator name
! Expression
|-
| 0x0
| EQ
| src1 == src2
|-
| 0x1
| NE
| src1 != src2
|-
| 0x2
| LT
| src1 < src2
|-
| 0x3
| LE
| src1 <= src2
|-
| 0x4
| GT
| src1 > src2
|-
| 0x5
| GE
| src1 >= src2
|-
| 0x6
| ??
| true ?
|-
| 0x7
| ??
| true ?
|}

6 and 7 seem to always return true.

== Conditions ==

A number of format 2 instructions are executed conditionally. These conditions are based on two boolean registers which can be set with CMP : cmp.x and cmp.y.

Conditional instructions include 3 parameters : CONDOP, REFX and REFY. REFX and REFY are reference values which are tested for equality against cmp.x and cmp.y, respectively. CONDOP describes how the final truth value is constructed from the results of the two tests. There are four conditional expression formats :

{| class="wikitable" border="1"
|-
! CONDOP raw value
! Expression
! Description
|-
| 0x0
| <nowiki>cmp.x == REFX || cmp.y == REFY</nowiki>
| OR
|-
| 0x1
| <nowiki>cmp.x == REFX && cmp.y == REFY</nowiki>
| AND
|-
| 0x2
| cmp.x == REFX
| X
|-
| 0x3
| cmp.y == REFY
| Y
|}

== Registers ==

{| class="wikitable" border="1"
|-
! Name
! Format
! Type
! Access
! Written by
! Description
|-
| v0-v15
| vector
| float
| Read only
| Application/Vertex-stream
| Input registers.
|-
| o0-o15
| vector
| float
| Write only
| Vertex shader
| Output registers.
|-
| r0-r15
| vector
| float
| Read/Write
| Vertex shader
| Temporary registers.
|-
| c0-c95
| vector
| float
| Read only
| Application/Vertex-stream
| Floating-point Constant registers.
|-
| i0-i3
| vector
| integer
| Read only
| Application
| Integer Constant registers. (special purpose)
|-
| b0-b15
| scalar
| boolean
| Read only
| Application
| Boolean Constant registers. (special purpose)
|-
| a0.x & a0.y
| scalar
| integer
| Use/Write
| Vertex shader
| Address registers.
|-
| aL
| scalar
| integer
| Use
| Vertex shader
| Loop count register.
|}

Input attribute registers store the per-vertex data given by the CPU and hence are read-only.

Output registers hold the data to be passed to the later GPU stages and are write-only. Each of the output register is assigned a semantic by setting the corresponding [[GPU_Internal_Registers]]. Output registers o7-o15 are only available in vertex shaders.
Keep in mind that writing to the same output register/component more than once appears appears to cause problems (e.g. GPU hangs).

Temporary registers can be used for intermediate calculations and can be both read and written.

Constant registers hold data uploaded by the application which remain constant throughout all processed vertices. There are 96 float[4] constant registers (c0-c95), eight boolean constant registers (b0-b7), and four int[4] constant registers (i0-i3).
Many shader instructions which take float arguments can only provide the full 7 bits for one SRC operand. All other source operands can only be used to refer to input attributes or temporary registers and cannot be passed Floating-point Constant registers.

Address registers and the Loop count register can be used to to provide relative addressing for the designated SRC operand. For more information, see the section on [[#Relative_addressing|relative addressing]].

DST mapping :

{| class="wikitable" border="1"
|-
! DST raw value
! Register name
! Description
|-
| 0x0-0xF
| o0-o15
| Output registers.
|-
| 0x10-0x1F
| r0-r15
| Temporary registers.
|}

SRC mapping :

{| class="wikitable" border="1"
|-
! SRC raw value
! Register name
! Description
|-
| 0x0-0xF
| v0-v15
| Input attribute registers.
|-
| 0x10-0x1F
| r0-r15
| Temporary registers.
|-
| 0x20-0x7F
| c0-c95
| Constant registers.
|}

== Floating-Point Behavior ==

The PICA200 is not IEEE-compliant. It has positive and negative infinities and NaN, but does not seem to have negative 0. Input and output subnormals are flushed to +0. The internal floating point format seems to be the same as used in shader binaries: 1 sign bit, 7 exponent bits, 16 (explicit) mantissa bits. Several instructions also have behavior that differs from the IEEE functions. Here are the results from some tests done on hardware (s = largest subnormal, n = smallest positive normal):

{| class="wikitable" border="1"
|-
! Computation
! Result
! Notes
|-
| inf * 0
| 0
| Including inside MUL, MAD, DP4, etc.
|-
| NaN * 0
| NaN
|
|-
| +inf - +inf
| NaN
| Indicates +inf is real inf, not FLT_MAX
|-
| rsq(rcp(-inf))
| +inf
| Indicates that there isn't -0.0.

|- style="border-top: double"
| rcp(-0)
| +inf
| no -0 so differs from IEEE where rcp(-0) = -inf
|-
| rcp(0)
| +inf
|
|-
| rcp(+inf)
| 0
|
|-
| rcp(NaN)
| NaN
|

|- style="border-top: double"
| rsq(-0)
| +inf
| no -0 so differs from IEEE where rsq(-0) = -inf
|-
| rsq(-2)
| NaN
|
|-
| rsq(+inf)
| 0
|
|-
| rsq(-inf)
| NaN
|
|-
| rsq(NaN)
| NaN
|

|- style="border-top: double"
| max(0, +inf)
| +inf
|
|-
| max(0, -inf)
| -inf
|
|-
| max(0, NaN)
| NaN
| max violates IEEE but match GLSL spec
|-
| max(NaN, 0)
| 0
|
|-
| max(-inf, +inf)
| +inf
|

|- style="border-top: double"
| min(0, +inf)
| 0
|
|-
| min(0, -inf)
| -inf
|
|-
| min(0, NaN)
| NaN
| min violates IEEE but match GLSL spec
|-
| min(NaN, 0)
| 0
|
|-
| min(-inf, +inf)
| -inf
|

|- style="border-top: double"
| cmp(s, 0)
| false
| cmp does not flush input subnormals
|-
| max(s, 0)
| s
| max does not flush input or output subnormals
|-
| mul(s, 2)
| 0
| input subnormals are flushed in arithmetic instructions
|-
| mul(n, 0.5)
| 0
| output subnormals are flushed in arithmetic instructions
|}

1.0 can be multiplied 63 times by 0.5 until the result compares equal zero. This is consistent with a 7-bit exponent and output subnormal flushing.

== Control Flow ==

Control flow is implemented using four independent stacks:

* 4-deep CALL stack
* 8-deep IF stack
* 4-deep LOOP stack

All stacks are initially empty. After every instruction but before JMP takes effect, the PC is incremented and a copy is sent to each stack. Each stack is checked against its copy of the PC. If an entry is popped from the stack, the copied PC is updated and used for the next check of this stack, although the IF/LOOP stacks can each only pop one entry per instruction, whereas the CALL stack is checked again until it doesn't match or the stack is empty. The updated PC copy with the highest priority wins: LOOP (highest), IF, CALL, JMP, original PC (lowest).

Special cases:
* JMP overwrites the PC *after* the stacks checks (and only if no stack was popped).
* Executing a BREAK on an empty LOOP stack hangs the GPU.
* A stack overflow discards the oldest element, so you could think of it as a queue or a ring buffer.
* If the CALL stack is popped four times in a row, the fourth update to its copy of the PC is missed (the third PC update will be propagated). Probably a hardware bug.

GPU/Internal Registers

2023-08-19T02:50:26Z

Steveice10: /* GPUREG_LIGHTING_CONFIG1 */

[[Category:GPU]]

== Overview ==

GPU internal registers are written to through GPU commands. They are used to control the GPU's behavior, that is to say tell it to draw stuff and how we want it drawn.

Each command is at least 8 bytes wide. The first word is the command parameter and the second word constitutes the command header. Optionally, more parameter words may follow (potentially including a padding word to align commands to multiples of 8 bytes).

In the simplest case, a command is exactly 8 bytes wide. You can think of such a command as writing the parameter word to an internal register (the index of which is given in the command header). The more general case where more than one parameter word is given is equivalent to multiple simple commands (one for each parameter word). If consecutive writing mode is enabled in the command header, the current command index will be incremented after each parameter write. Otherwise, the parameters will be consecutively written to the same register.

For example, the sequence "0xAAAAAAAA 0x802F011C 0xBBBBBBBB 0xCCCCCCCC" is equivalent to a call to commands 0xF011C with parameter 0xAAAAAAAA, 0xF011D with parameter 0xBBBBBBBB and 0xF011E with parameter 0xCCCCCCCC. If consecutive writing mode were disabled, the command would be equivalent to three consecutive calls to 0xF011C (once with parameter 0xAAAAAAAA, once with 0xBBBBBBBB, and finally with 0xCCCCCCCC).

Invalid GPU command parameters including NaN floats can cause the GPU to hang, which then causes the GSP module to hang as well.

The size of GPU command buffers must be 0x10-byte aligned; the lower 3 bits of the size are cleared. A common pitfall is having the finalization command (write to register 0x0010) not executed because it was the last 8 bytes of a non-0x10 byte aligned command buffer, and having the GPU hang as a result.

=== Command Header ===
{| class="wikitable" border="1"
! Bit
! Description
|-
| 0-15
| Command ID
|-
| 16-19
| Parameter mask
|-
| 20-27
| Number of extra parameters (may be zero)
|-
| 28-30
| Unused
|-
| 31
| Consecutive writing mode
|}

=== Parameter masking ===

Using a value other than 0xF, parts of a word in internal GPU memory can be updated without touching the other bits of it. For example, setting bit 16 to zero indicates that the least significant byte of the parameter will not be overwritten, setting bit 17 to zero indicates that the parameter's second LSB will not be overwritten, etc. This means that for instance commands 0x00010107 and 0x00020107 refer to the same thing but write different parts of the parameter.

=== Types ===

There are three main types of registers :
* configuration registers, which directly map to various rendering properties (for example: [[#GPUREG_FACECULLING_CONFIG|GPUREG_FACECULLING_CONFIG]])
* data transfer registers, which can be seen as FIFOs that let us send sequential chunks of data to the GPU, such as shader code or 1D samplers (for example: [[#GPUREG_SH_CODETRANSFER_DATA|GPUREG_GSH_CODETRANSFER_DATA]])
* action triggering registers, which tell the GPU to do something, like draw a primitive (for example: [[#GPUREG_DRAWARRAYS|GPUREG_DRAWARRAYS]])

=== Aliases ===

It is possible for multiple register (sequential) IDs to correspond to the same register. This is done to leverage the consecutive writing mode for GPU commands, which makes it possible for a single command to write data to multiple sequential register IDs. For example, register IDs 02C1 through 02C8 all correspond to [[#GPUREG_VSH_FLOATUNIFORM_DATAi|GPUREG_VSH_FLOATUNIFORM_DATA''i'']] so that a consecutively writing command based at 02C0 will write its first parameter to [[#GPUREG_VSH_FLOATUNIFORM_INDEX|GPUREG_VSH_FLOATUNIFORM_INDEX]] and ever subsequent ones to [[#GPUREG_VSH_FLOATUNIFORM_DATAi|GPUREG_VSH_FLOATUNIFORM_DATA''i'']]

=== Data Types ===

{| class="wikitable" border="1"
! Name
! Description
|-
| signed
| Signed integer
|-
| unsigned
| Unsigned integer
|-
| floatX.Y.Z
| Floating-point number with X sign bits, Y exponent bits, and Z mantissa bits
|-
| fixedX.Y.Z
| Fixed-point number with X sign bits, Y integer bits, and Z fractional bits
|}

== Register list ==

=== Miscellaneous registers (0x000-0x03F) ===

{| class="wikitable" border="1"
! Register ID
! Register name
! Notes
! Official Name
|-
| 0000
| [[#GPUREG_0000|GPUREG_0000]]
|
|
|-
| 0001
| [[#GPUREG_0001|GPUREG_0001]]
|
|
|-
| 0002
| [[#GPUREG_0002|GPUREG_0002]]
|
|
|-
| 0003
| [[#GPUREG_0003|GPUREG_0003]]
|
|
|-
| 0004
| [[#GPUREG_0004|GPUREG_0004]]
|
|
|-
| 0005
| [[#GPUREG_0005|GPUREG_0005]]
|
|
|-
| 0006
| [[#GPUREG_0006|GPUREG_0006]]
|
|
|-
| 0007
| [[#GPUREG_0007|GPUREG_0007]]
|
|
|-
| 0008
| [[#GPUREG_0008|GPUREG_0008]]
|
|
|-
| 0009
| [[#GPUREG_0009|GPUREG_0009]]
|
|
|-
| 000A
| [[#GPUREG_000A|GPUREG_000A]]
|
|
|-
| 000B
| [[#GPUREG_000B|GPUREG_000B]]
|
|
|-
| 000C
| [[#GPUREG_000C|GPUREG_000C]]
|
|
|-
| 000D
| [[#GPUREG_000D|GPUREG_000D]]
|
|
|-
| 000E
| [[#GPUREG_000E|GPUREG_000E]]
|
|
|-
| 000F
| [[#GPUREG_000F|GPUREG_000F]]
|
|
|-
| 0010
| [[#GPUREG_FINALIZE|GPUREG_FINALIZE]]
|
|PICA_REG_INTERRUPT
|-
| 0011
| [[#GPUREG_0011|GPUREG_0011]]
|
|
|-
| 0012
| [[#GPUREG_0012|GPUREG_0012]]
|
|
|-
| 0013
| [[#GPUREG_0013|GPUREG_0013]]
|
|
|-
| 0014
| [[#GPUREG_0014|GPUREG_0014]]
|
|
|-
| 0015
| [[#GPUREG_0015|GPUREG_0015]]
|
|
|-
| 0016
| [[#GPUREG_0016|GPUREG_0016]]
|
|
|-
| 0017
| [[#GPUREG_0017|GPUREG_0017]]
|
|
|-
| 0018
| [[#GPUREG_0018|GPUREG_0018]]
|
|
|-
| 0019
| [[#GPUREG_0019|GPUREG_0019]]
|
|
|-
| 001A
| [[#GPUREG_001A|GPUREG_001A]]
|
|
|-
| 001B
| [[#GPUREG_001B|GPUREG_001B]]
|
|
|-
| 001C
| [[#GPUREG_001C|GPUREG_001C]]
|
|
|-
| 001D
| [[#GPUREG_001D|GPUREG_001D]]
|
|
|-
| 001E
| [[#GPUREG_001E|GPUREG_001E]]
|
|
|-
| 001F
| [[#GPUREG_001F|GPUREG_001F]]
|
|
|-
| 0020
| [[#GPUREG_0020|GPUREG_0020]]
|
|
|-
| 0021
| [[#GPUREG_0021|GPUREG_0021]]
|
|
|-
| 0022
| [[#GPUREG_0022|GPUREG_0022]]
|
|
|-
| 0023
| [[#GPUREG_0023|GPUREG_0023]]
|
|
|-
| 0024
| [[#GPUREG_0024|GPUREG_0024]]
|
|
|-
| 0025
| [[#GPUREG_0025|GPUREG_0025]]
|
|
|-
| 0026
| [[#GPUREG_0026|GPUREG_0026]]
|
|
|-
| 0027
| [[#GPUREG_0027|GPUREG_0027]]
|
|
|-
| 0028
| [[#GPUREG_0028|GPUREG_0028]]
|
|
|-
| 0029
| [[#GPUREG_0029|GPUREG_0029]]
|
|
|-
| 002A
| [[#GPUREG_002A|GPUREG_002A]]
|
|
|-
| 002B
| [[#GPUREG_002B|GPUREG_002B]]
|
|
|-
| 002C
| [[#GPUREG_002C|GPUREG_002C]]
|
|
|-
| 002D
| [[#GPUREG_002D|GPUREG_002D]]
|
|
|-
| 002E
| [[#GPUREG_002E|GPUREG_002E]]
|
|
|-
| 002F
| [[#GPUREG_002F|GPUREG_002F]]
|
|
|-
| 0030
| [[#GPUREG_0030|GPUREG_0030]]
|
|
|-
| 0031
| [[#GPUREG_0031|GPUREG_0031]]
|
|
|-
| 0032
| [[#GPUREG_0032|GPUREG_0032]]
|
|
|-
| 0033
| [[#GPUREG_0033|GPUREG_0033]]
|
|
|-
| 0034
| [[#GPUREG_0034|GPUREG_0034]]
|
|
|-
| 0035
| [[#GPUREG_0035|GPUREG_0035]]
|
|
|-
| 0036
| [[#GPUREG_0036|GPUREG_0036]]
|
|
|-
| 0037
| [[#GPUREG_0037|GPUREG_0037]]
|
|
|-
| 0038
| [[#GPUREG_0038|GPUREG_0038]]
|
|
|-
| 0039
| [[#GPUREG_0039|GPUREG_0039]]
|
|
|-
| 003A
| [[#GPUREG_003A|GPUREG_003A]]
|
|
|-
| 003B
| [[#GPUREG_003B|GPUREG_003B]]
|
|
|-
| 003C
| [[#GPUREG_003C|GPUREG_003C]]
|
|
|-
| 003D
| [[#GPUREG_003D|GPUREG_003D]]
|
|
|-
| 003E
| [[#GPUREG_003E|GPUREG_003E]]
|
|
|-
| 003F
| [[#GPUREG_003F|GPUREG_003F]]
|
|
|}

=== Rasterizer registers (0x040-0x07F) ===

{| class="wikitable" border="1"
! Register ID
! Register name
! Notes
! Official Name
|-
| 0040
| [[#GPUREG_FACECULLING_CONFIG|GPUREG_FACECULLING_CONFIG]]
|
|PICA_REG_CULL_FACE
|-
| 0041
| [[#GPUREG_VIEWPORT_WIDTH|GPUREG_VIEWPORT_WIDTH]]
|
|PICA_REG_VIEWPORT_WIDTH1
|-
| 0042
| [[#GPUREG_VIEWPORT_INVW|GPUREG_VIEWPORT_INVW]]
|
|PICA_REG_VIEWPORT_WIDTH2
|-
| 0043
| [[#GPUREG_VIEWPORT_HEIGHT|GPUREG_VIEWPORT_HEIGHT]]
|
|PICA_REG_VIEWPORT_HEIGHT1
|-
| 0044
| [[#GPUREG_VIEWPORT_INVH|GPUREG_VIEWPORT_INVH]]
|
|PICA_REG_VIEWPORT_HEIGHT2
|-
| 0045
| [[#GPUREG_0045|GPUREG_0045]]
|
|
|-
| 0046
| [[#GPUREG_0046|GPUREG_0046]]
|
|
|-
| 0047
| [[#GPUREG_FRAGOP_CLIP|GPUREG_FRAGOP_CLIP]]
|?
|PICA_REG_FRAGOP_CLIP
|-
| 0048
| [[#GPUREG_FRAGOP_CLIP_DATAi|GPUREG_FRAGOP_CLIP_DATA0]]
|?
|PICA_REG_FRAGOP_CLIP_DATA1
|-
| 0049
| [[#GPUREG_FRAGOP_CLIP_DATAi|GPUREG_FRAGOP_CLIP_DATA1]]
|?
|PICA_REG_FRAGOP_CLIP_DATA2
|-
| 004A
| [[#GPUREG_FRAGOP_CLIP_DATAi|GPUREG_FRAGOP_CLIP_DATA2]]
|?
|PICA_REG_FRAGOP_CLIP_DATA3
|-
| 004B
| [[#GPUREG_FRAGOP_CLIP_DATAi|GPUREG_FRAGOP_CLIP_DATA3]]
|?
|PICA_REG_FRAGOP_CLIP_DATA4
|-
| 004C
| [[#GPUREG_004C|GPUREG_004C]]
|
|
|-
| 004D
| [[#GPUREG_DEPTHMAP_SCALE|GPUREG_DEPTHMAP_SCALE]]
| As f24
|PICA_REG_FRAGOP_WSCALE_DATA1
|-
| 004E
| [[#GPUREG_DEPTHMAP_OFFSET|GPUREG_DEPTHMAP_OFFSET]]
| As f24
|PICA_REG_FRAGOP_WSCALE_DATA2
|-
| 004F
| [[#GPUREG_SH_OUTMAP_TOTAL|GPUREG_SH_OUTMAP_TOTAL]]
|
|PICA_REG_GS_OUT_REG_NUM0 / PICA_REG_VS_OUT_REG_NUM0
|-
| 0050
| [[#GPUREG_SH_OUTMAP_Oi|GPUREG_SH_OUTMAP_O0]]
|
|PICA_REG_GS_OUT_ATTR0 / PICA_REG_VS_OUT_ATTR0
|-
| 0051
| [[#GPUREG_SH_OUTMAP_Oi|GPUREG_SH_OUTMAP_O1]]
|
|PICA_REG_GS_OUT_ATTR1 / PICA_REG_VS_OUT_ATTR1
|-
| 0052
| [[#GPUREG_SH_OUTMAP_Oi|GPUREG_SH_OUTMAP_O2]]
|
|PICA_REG_GS_OUT_ATTR2 / PICA_REG_VS_OUT_ATTR2
|-
| 0053
| [[#GPUREG_SH_OUTMAP_Oi|GPUREG_SH_OUTMAP_O3]]
|
|PICA_REG_GS_OUT_ATTR3 / PICA_REG_VS_OUT_ATTR3
|-
| 0054
| [[#GPUREG_SH_OUTMAP_Oi|GPUREG_SH_OUTMAP_O4]]
|
|PICA_REG_GS_OUT_ATTR4 / PICA_REG_VS_OUT_ATTR4
|-
| 0055
| [[#GPUREG_SH_OUTMAP_Oi|GPUREG_SH_OUTMAP_O5]]
|
|PICA_REG_GS_OUT_ATTR5 / PICA_REG_VS_OUT_ATTR5
|-
| 0056
| [[#GPUREG_SH_OUTMAP_Oi|GPUREG_SH_OUTMAP_O6]]
|
|PICA_REG_GS_OUT_ATTR6 / PICA_REG_VS_OUT_ATTR6
|-
| 0057
| [[#GPUREG_0057|GPUREG_0057]]
|
|
|-
| 0058
| [[#GPUREG_0058|GPUREG_0058]]
|
|
|-
| 0059
| [[#GPUREG_0059|GPUREG_0059]]
|
|
|-
| 005A
| [[#GPUREG_005A|GPUREG_005A]]
|
|
|-
| 005B
| [[#GPUREG_005B|GPUREG_005B]]
|
|
|-
| 005C
| [[#GPUREG_005C|GPUREG_005C]]
|
|
|-
| 005D
| [[#GPUREG_005D|GPUREG_005D]]
|
|
|-
| 005E
| [[#GPUREG_005E|GPUREG_005E]]
|
|
|-
| 005F
| [[#GPUREG_005F|GPUREG_005F]]
|
|
|-
| 0060
| [[#GPUREG_0060|GPUREG_0060]]
|
|
|-
| 0061
| [[#GPUREG_EARLYDEPTH_FUNC|GPUREG_EARLYDEPTH_FUNC]]
|?
|PICA_REG_EARLY_DEPTH_FUNC
|-
| 0062
| [[#GPUREG_EARLYDEPTH_TEST1|GPUREG_EARLYDEPTH_TEST1]]
|?
|PICA_REG_EARLY_DEPTH_TEST1
|-
| 0063
| [[#GPUREG_EARLYDEPTH_CLEAR|GPUREG_EARLYDEPTH_CLEAR]]
|
|PICA_REG_EARLY_DEPTH_CLEAR
|-
| 0064
| [[#GPUREG_SH_OUTATTR_MODE|GPUREG_SH_OUTATTR_MODE]]
|?
|PICA_REG_GS_OUT_ATTR_MODE / PICA_REG_VS_OUT_ATTR_MODE
|-
| 0065
| [[#GPUREG_SCISSORTEST_MODE|GPUREG_SCISSORTEST_MODE]]
|
|PICA_REG_SCISSOR
|-
| 0066
| [[#GPUREG_SCISSORTEST_POS|GPUREG_SCISSORTEST_POS]]
|
|PICA_REG_SCISSOR_XY
|-
| 0067
| [[#GPUREG_SCISSORTEST_DIM|GPUREG_SCISSORTEST_DIM]]
|
|PICA_REG_SCISSOR_SIZE
|-
| 0068
| [[#GPUREG_VIEWPORT_XY|GPUREG_VIEWPORT_XY]]
|
|PICA_REG_VIEWPORT_XY
|-
| 0069
| [[#GPUREG_0069|GPUREG_0069]]
|
|
|-
| 006A
| [[#GPUREG_EARLYDEPTH_DATA|GPUREG_EARLYDEPTH_DATA]]
|
|PICA_REG_EARLY_DEPTH_DATA
|-
| 006B
| [[#GPUREG_006B|GPUREG_006B]]
|
|
|-
| 006C
| [[#GPUREG_006C|GPUREG_006C]]
|
|
|-
| 006D
| [[#GPUREG_DEPTHMAP_ENABLE|GPUREG_DEPTHMAP_ENABLE]]
|?
|PICA_REG_FRAGOP_WSCALE
|-
| 006E
| [[#GPUREG_RENDERBUF_DIM|GPUREG_RENDERBUF_DIM]]
|?
|PICA_REG_RENDER_BUF_RESOLUTION1
|-
| 006F
| [[#GPUREG_SH_OUTATTR_CLOCK|GPUREG_SH_OUTATTR_CLOCK]]
|?
|PICA_REG_GS_OUT_ATTR_CLK / PICA_REG_VS_OUT_ATTR_CLK
|-
| 0070
| [[#GPUREG_0070|GPUREG_0070]]
|
|
|-
| 0071
| [[#GPUREG_0071|GPUREG_0071]]
|
|
|-
| 0072
| [[#GPUREG_0072|GPUREG_0072]]
|
|
|-
| 0073
| [[#GPUREG_0073|GPUREG_0073]]
|
|
|-
| 0074
| [[#GPUREG_0074|GPUREG_0074]]
|
|
|-
| 0075
| [[#GPUREG_0075|GPUREG_0075]]
|
|
|-
| 0076
| [[#GPUREG_0076|GPUREG_0076]]
|
|
|-
| 0077
| [[#GPUREG_0077|GPUREG_0077]]
|
|
|-
| 0078
| [[#GPUREG_0078|GPUREG_0078]]
|
|
|-
| 0079
| [[#GPUREG_0079|GPUREG_0079]]
|
|
|-
| 007A
| [[#GPUREG_007A|GPUREG_007A]]
|
|
|-
| 007B
| [[#GPUREG_007B|GPUREG_007B]]
|
|
|-
| 007C
| [[#GPUREG_007C|GPUREG_007C]]
|
|
|-
| 007D
| [[#GPUREG_007D|GPUREG_007D]]
|
|
|-
| 007E
| [[#GPUREG_007E|GPUREG_007E]]
|
|
|-
| 007F
| [[#GPUREG_007F|GPUREG_007F]]
|
|
|}

=== Texturing registers (0x080-0x0FF) ===

{| class="wikitable" border="1"
! Register ID
! Register name
! Notes
! Official Name
|-
| 0080
| [[#GPUREG_TEXUNIT_CONFIG|GPUREG_TEXUNIT_CONFIG]]
|
|PICA_REG_TEXTURE_FUNC
|-
| 0081
| [[#GPUREG_TEXUNITi_BORDER_COLOR|GPUREG_TEXUNIT0_BORDER_COLOR]]
|
|PICA_REG_TEXTURE0_BORDER_COLOR
|-
| 0082
| [[#GPUREG_TEXUNITi_DIM|GPUREG_TEXUNIT0_DIM]]
|
|PICA_REG_TEXTURE0_SIZE
|-
| 0083
| [[#GPUREG_TEXUNITi_PARAM|GPUREG_TEXUNIT0_PARAM]]
|
|PICA_REG_TEXTURE0_WRAP_FILTER
|-
| 0084
| [[#GPUREG_TEXUNITi_LOD|GPUREG_TEXUNIT0_LOD]]
|?
|PICA_REG_TEXTURE0_LOD
|-
| 0085
| [[#GPUREG_TEXUNITi_ADDRi|GPUREG_TEXUNIT0_ADDR1]]
|
|PICA_REG_TEXTURE0_ADDR1
|-
| 0086
| [[#GPUREG_TEXUNITi_ADDRi|GPUREG_TEXUNIT0_ADDR2]]
|
|PICA_REG_TEXTURE0_ADDR2
|-
| 0087
| [[#GPUREG_TEXUNITi_ADDRi|GPUREG_TEXUNIT0_ADDR3]]
|
|PICA_REG_TEXTURE0_ADDR3
|-
| 0088
| [[#GPUREG_TEXUNITi_ADDRi|GPUREG_TEXUNIT0_ADDR4]]
|
|PICA_REG_TEXTURE0_ADDR4
|-
| 0089
| [[#GPUREG_TEXUNITi_ADDRi|GPUREG_TEXUNIT0_ADDR5]]
|
|PICA_REG_TEXTURE0_ADDR5
|-
| 008A
| [[#GPUREG_TEXUNITi_ADDRi|GPUREG_TEXUNIT0_ADDR6]]
|
|PICA_REG_TEXTURE0_ADDR6
|-
| 008B
| [[#GPUREG_TEXUNITi_SHADOW|GPUREG_TEXUNIT0_SHADOW]]
|?
|PICA_REG_TEXTURE0_SHADOW
|-
| 008C
| [[#GPUREG_008C|GPUREG_008C]]
|
|
|-
| 008D
| [[#GPUREG_008D|GPUREG_008D]]
|
|
|-
| 008E
| [[#GPUREG_TEXUNITi_TYPE|GPUREG_TEXUNIT0_TYPE]]
|?
|PICA_REG_TEXTURE0_FORMAT
|-
| 008F
| [[#GPUREG_LIGHTING_ENABLE0|GPUREG_LIGHTING_ENABLE0]]
|?
|PICA_REG_FRAG_LIGHT_EN0
|-
| 0090
| [[#GPUREG_0090|GPUREG_0090]]
|
|
|-
| 0091
| [[#GPUREG_TEXUNITi_BORDER_COLOR|GPUREG_TEXUNIT1_BORDER_COLOR]]
|
|PICA_REG_TEXTURE1_BORDER_COLOR
|-
| 0092
| [[#GPUREG_TEXUNITi_DIM|GPUREG_TEXUNIT1_DIM]]
|
|PICA_REG_TEXTURE1_SIZE
|-
| 0093
| [[#GPUREG_TEXUNITi_PARAM|GPUREG_TEXUNIT1_PARAM]]
|
|PICA_REG_TEXTURE1_WRAP_FILTER
|-
| 0094
| [[#GPUREG_TEXUNITi_LOD|GPUREG_TEXUNIT1_LOD]]
|?
|PICA_REG_TEXTURE1_LOD
|-
| 0095
| [[#GPUREG_TEXUNITi_ADDRi|GPUREG_TEXUNIT1_ADDR]]
|
|PICA_REG_TEXTURE1_ADDR
|-
| 0096
| [[#GPUREG_TEXUNITi_TYPE|GPUREG_TEXUNIT1_TYPE]]
|
|PICA_REG_TEXTURE1_FORMAT
|-
| 0097
| [[#GPUREG_0097|GPUREG_0097]]
|
|
|-
| 0098
| [[#GPUREG_0098|GPUREG_0098]]
|
|
|-
| 0099
| [[#GPUREG_TEXUNITi_BORDER_COLOR|GPUREG_TEXUNIT2_BORDER_COLOR]]
|
|PICA_REG_TEXTURE2_BORDER_COLOR
|-
| 009A
| [[#GPUREG_TEXUNITi_DIM|GPUREG_TEXUNIT2_DIM]]
|
|PICA_REG_TEXTURE2_SIZE
|-
| 009B
| [[#GPUREG_TEXUNITi_PARAM|GPUREG_TEXUNIT2_PARAM]]
|
|PICA_REG_TEXTURE2_WRAP_FILTER
|-
| 009C
| [[#GPUREG_TEXUNITi_LOD|GPUREG_TEXUNIT2_LOD]]
|?
|PICA_REG_TEXTURE2_LOD
|-
| 009D
| [[#GPUREG_TEXUNITi_ADDRi|GPUREG_TEXUNIT2_ADDR]]
|
|PICA_REG_TEXTURE2_ADDR
|-
| 009E
| [[#GPUREG_TEXUNITi_TYPE|GPUREG_TEXUNIT2_TYPE]]
|
|PICA_REG_TEXTURE2_FORMAT
|-
| 009F
| [[#GPUREG_009F|GPUREG_009F]]
|
|
|-
| 00A0
| [[#GPUREG_00A0|GPUREG_00A0]]
|
|
|-
| 00A1
| [[#GPUREG_00A1|GPUREG_00A1]]
|
|
|-
| 00A2
| [[#GPUREG_00A2|GPUREG_00A2]]
|
|
|-
| 00A3
| [[#GPUREG_00A3|GPUREG_00A3]]
|
|
|-
| 00A4
| [[#GPUREG_00A4|GPUREG_00A4]]
|
|
|-
| 00A5
| [[#GPUREG_00A5|GPUREG_00A5]]
|
|
|-
| 00A6
| [[#GPUREG_00A6|GPUREG_00A6]]
|
|
|-
| 00A7
| [[#GPUREG_00A7|GPUREG_00A7]]
|
|
|-
| 00A8
| [[#GPUREG_TEXUNIT3_PROCTEX0|GPUREG_TEXUNIT3_PROCTEX0]]
|?
|PICA_REG_TEXTURE3_PROCTEX0
|-
| 00A9
| [[#GPUREG_TEXUNIT3_PROCTEX1|GPUREG_TEXUNIT3_PROCTEX1]]
|?
|PICA_REG_TEXTURE3_PROCTEX1
|-
| 00AA
| [[#GPUREG_TEXUNIT3_PROCTEX2|GPUREG_TEXUNIT3_PROCTEX2]]
|?
|PICA_REG_TEXTURE3_PROCTEX2
|-
| 00AB
| [[#GPUREG_TEXUNIT3_PROCTEX3|GPUREG_TEXUNIT3_PROCTEX3]]
|?
|PICA_REG_TEXTURE3_PROCTEX3
|-
| 00AC
| [[#GPUREG_TEXUNIT3_PROCTEX4|GPUREG_TEXUNIT3_PROCTEX4]]
|?
|PICA_REG_TEXTURE3_PROCTEX4
|-
| 00AD
| [[#GPUREG_TEXUNIT3_PROCTEX5|GPUREG_TEXUNIT3_PROCTEX5]]
|?
|PICA_REG_TEXTURE3_PROCTEX5
|-
| 00AE
| [[#GPUREG_00AE|GPUREG_00AE]]
|
|
|-
| 00AF
| [[#GPUREG_PROCTEX_LUT|GPUREG_PROCTEX_LUT]]
|?
|PICA_REG_PROCTEX_LUT
|-
| 00B0
| [[#GPUREG_PROCTEX_LUT_DATAi|GPUREG_PROCTEX_LUT_DATA0]]
| ?
|PICA_REG_PROCTEX_LUT_DATA0
|-
| 00B1
| [[#GPUREG_PROCTEX_LUT_DATAi|GPUREG_PROCTEX_LUT_DATA1]]
| ?
|PICA_REG_PROCTEX_LUT_DATA1
|-
| 00B2
| [[#GPUREG_PROCTEX_LUT_DATAi|GPUREG_PROCTEX_LUT_DATA2]]
| ?
|PICA_REG_PROCTEX_LUT_DATA2
|-
| 00B3
| [[#GPUREG_PROCTEX_LUT_DATAi|GPUREG_PROCTEX_LUT_DATA3]]
| ?
|PICA_REG_PROCTEX_LUT_DATA3
|-
| 00B4
| [[#GPUREG_PROCTEX_LUT_DATAi|GPUREG_PROCTEX_LUT_DATA4]]
| ?
|PICA_REG_PROCTEX_LUT_DATA4
|-
| 00B5
| [[#GPUREG_PROCTEX_LUT_DATAi|GPUREG_PROCTEX_LUT_DATA5]]
| ?
|PICA_REG_PROCTEX_LUT_DATA5
|-
| 00B6
| [[#GPUREG_PROCTEX_LUT_DATAi|GPUREG_PROCTEX_LUT_DATA6]]
| ?
|PICA_REG_PROCTEX_LUT_DATA6
|-
| 00B7
| [[#GPUREG_PROCTEX_LUT_DATAi|GPUREG_PROCTEX_LUT_DATA7]]
| ?
|PICA_REG_PROCTEX_LUT_DATA7
|-
| 00B8
| [[#GPUREG_00B8|GPUREG_00B8]]
|
|
|-
| 00B9
| [[#GPUREG_00B9|GPUREG_00B9]]
|
|
|-
| 00BA
| [[#GPUREG_00BA|GPUREG_00BA]]
|
|
|-
| 00BB
| [[#GPUREG_00BB|GPUREG_00BB]]
|
|
|-
| 00BC
| [[#GPUREG_00BC|GPUREG_00BC]]
|
|
|-
| 00BD
| [[#GPUREG_00BD|GPUREG_00BD]]
|
|
|-
| 00BE
| [[#GPUREG_00BE|GPUREG_00BE]]
|
|
|-
| 00BF
| [[#GPUREG_00BF|GPUREG_00BF]]
|
|
|-
| 00C0
| [[#GPUREG_TEXENVi_SOURCE|GPUREG_TEXENV0_SOURCE]]
|
|PICA_REG_TEX_ENV_0
|-
| 00C1
| [[#GPUREG_TEXENVi_OPERAND|GPUREG_TEXENV0_OPERAND]]
|
|PICA_REG_TEX_ENV_0_OPERAND
|-
| 00C2
| [[#GPUREG_TEXENVi_COMBINER|GPUREG_TEXENV0_COMBINER]]
|
|PICA_REG_TEX_ENV_0_COMBINE
|-
| 00C3
| [[#GPUREG_TEXENVi_COLOR|GPUREG_TEXENV0_COLOR]]
|
|PICA_REG_TEX_ENV_0_COLOR
|-
| 00C4
| [[#GPUREG_TEXENVi_SCALE|GPUREG_TEXENV0_SCALE]]
|
|PICA_REG_TEX_ENV_0_SCALE
|-
| 00C5
| [[#GPUREG_00C5|GPUREG_00C5]]
|
|
|-
| 00C6
| [[#GPUREG_00C6|GPUREG_00C6]]
|
|
|-
| 00C7
| [[#GPUREG_00C7|GPUREG_00C7]]
|
|
|-
| 00C8
| [[#GPUREG_TEXENVi_SOURCE|GPUREG_TEXENV1_SOURCE]]
|
|PICA_REG_TEX_ENV_1
|-
| 00C9
| [[#GPUREG_TEXENVi_OPERAND|GPUREG_TEXENV1_OPERAND]]
|
|PICA_REG_TEX_ENV_1_OPERAND
|-
| 00CA
| [[#GPUREG_TEXENVi_COMBINER|GPUREG_TEXENV1_COMBINER]]
|
|PICA_REG_TEX_ENV_1_COMBINE
|-
| 00CB
| [[#GPUREG_TEXENVi_COLOR|GPUREG_TEXENV1_COLOR]]
|
|PICA_REG_TEX_ENV_1_COLOR
|-
| 00CC
| [[#GPUREG_TEXENVi_SCALE|GPUREG_TEXENV1_SCALE]]
|
|PICA_REG_TEX_ENV_1_SCALE
|-
| 00CD
| [[#GPUREG_00CD|GPUREG_00CD]]
|
|
|-
| 00CE
| [[#GPUREG_00CE|GPUREG_00CE]]
|
|
|-
| 00CF
| [[#GPUREG_00CF|GPUREG_00CF]]
|
|
|-
| 00D0
| [[#GPUREG_TEXENVi_SOURCE|GPUREG_TEXENV2_SOURCE]]
|
|PICA_REG_TEX_ENV_2
|-
| 00D1
| [[#GPUREG_TEXENVi_OPERAND|GPUREG_TEXENV2_OPERAND]]
|
|PICA_REG_TEX_ENV_2_OPERAND
|-
| 00D2
| [[#GPUREG_TEXENVi_COMBINER|GPUREG_TEXENV2_COMBINER]]
|
|PICA_REG_TEX_ENV_2_COMBINE
|-
| 00D3
| [[#GPUREG_TEXENVi_COLOR|GPUREG_TEXENV2_COLOR]]
|
|PICA_REG_TEX_ENV_2_COLOR
|-
| 00D4
| [[#GPUREG_TEXENVi_SCALE|GPUREG_TEXENV2_SCALE]]
|
|PICA_REG_TEX_ENV_2_SCALE
|-
| 00D5
| [[#GPUREG_00D5|GPUREG_00D5]]
|
|
|-
| 00D6
| [[#GPUREG_00D6|GPUREG_00D6]]
|
|
|-
| 00D7
| [[#GPUREG_00D7|GPUREG_00D7]]
|
|
|-
| 00D8
| [[#GPUREG_TEXENVi_SOURCE|GPUREG_TEXENV3_SOURCE]]
|
|PICA_REG_TEX_ENV_3
|-
| 00D9
| [[#GPUREG_TEXENVi_OPERAND|GPUREG_TEXENV3_OPERAND]]
|
|PICA_REG_TEX_ENV_3_OPERAND
|-
| 00DA
| [[#GPUREG_TEXENVi_COMBINER|GPUREG_TEXENV3_COMBINER]]
|
|PICA_REG_TEX_ENV_3_COMBINE
|-
| 00DB
| [[#GPUREG_TEXENVi_COLOR|GPUREG_TEXENV3_COLOR]]
|
|PICA_REG_TEX_ENV_3_COLOR
|-
| 00DC
| [[#GPUREG_TEXENVi_SCALE|GPUREG_TEXENV3_SCALE]]
|
|PICA_REG_TEX_ENV_3_SCALE
|-
| 00DD
| [[#GPUREG_00DD|GPUREG_00DD]]
|
|
|-
| 00DE
| [[#GPUREG_00DE|GPUREG_00DE]]
|
|
|-
| 00DF
| [[#GPUREG_00DF|GPUREG_00DF]]
|
|
|-
| 00E0
| [[#GPUREG_TEXENV_UPDATE_BUFFER|GPUREG_TEXENV_UPDATE_BUFFER]]
|?
|PICA_REG_GAS_FOG_MODE / PICA_REG_TEX_ENV_BUF_INPUT
|-
| 00E1
| [[#GPUREG_FOG_COLOR|GPUREG_FOG_COLOR]]
|?
|PICA_REG_FOG_COLOR
|-
| 00E2
| [[#GPUREG_00E2|GPUREG_00E2]]
|
|
|-
| 00E3
| [[#GPUREG_00E3|GPUREG_00E3]]
|
|
|-
| 00E4
| [[#GPUREG_GAS_ATTENUATION|GPUREG_GAS_ATTENUATION]]
|?
|PICA_REG_GAS_ATTENUATION
|-
| 00E5
| [[#GPUREG_GAS_ACCMAX|GPUREG_GAS_ACCMAX]]
|?
|PICA_REG_GAS_ACCMAX
|-
| 00E6
| [[#GPUREG_FOG_LUT_INDEX|GPUREG_FOG_LUT_INDEX]]
|?
|PICA_REG_FOG_LUT_INDEX
|-
| 00E7
| [[#GPUREG_00E7|GPUREG_00E7]]
|
|
|-
| 00E8
| [[#GPUREG_FOG_LUT_DATAi|GPUREG_FOG_LUT_DATA0]]
|?
|PICA_REG_FOG_LUT_DATA0
|-
| 00E9
| [[#GPUREG_FOG_LUT_DATAi|GPUREG_FOG_LUT_DATA1]]
|?
|PICA_REG_FOG_LUT_DATA1
|-
| 00EA
| [[#GPUREG_FOG_LUT_DATAi|GPUREG_FOG_LUT_DATA2]]
|?
|PICA_REG_FOG_LUT_DATA2
|-
| 00EB
| [[#GPUREG_FOG_LUT_DATAi|GPUREG_FOG_LUT_DATA3]]
|?
|PICA_REG_FOG_LUT_DATA3
|-
| 00EC
| [[#GPUREG_FOG_LUT_DATAi|GPUREG_FOG_LUT_DATA4]]
|?
|PICA_REG_FOG_LUT_DATA4
|-
| 00ED
| [[#GPUREG_FOG_LUT_DATAi|GPUREG_FOG_LUT_DATA5]]
|?
|PICA_REG_FOG_LUT_DATA5
|-
| 00EE
| [[#GPUREG_FOG_LUT_DATAi|GPUREG_FOG_LUT_DATA6]]
|?
|PICA_REG_FOG_LUT_DATA6
|-
| 00EF
| [[#GPUREG_FOG_LUT_DATAi|GPUREG_FOG_LUT_DATA7]]
|?
|PICA_REG_FOG_LUT_DATA7
|-
| 00F0
| [[#GPUREG_TEXENVi_SOURCE|GPUREG_TEXENV4_SOURCE]]
|
|PICA_REG_TEX_ENV_4
|-
| 00F1
| [[#GPUREG_TEXENVi_OPERAND|GPUREG_TEXENV4_OPERAND]]
|
|PICA_REG_TEX_ENV_4_OPERAND
|-
| 00F2
| [[#GPUREG_TEXENVi_COMBINER|GPUREG_TEXENV4_COMBINER]]
|
|PICA_REG_TEX_ENV_4_COMBINE
|-
| 00F3
| [[#GPUREG_TEXENVi_COLOR|GPUREG_TEXENV4_COLOR]]
|
|PICA_REG_TEX_ENV_4_COLOR
|-
| 00F4
| [[#GPUREG_TEXENVi_SCALE|GPUREG_TEXENV4_SCALE]]
|
|PICA_REG_TEX_ENV_4_SCALE
|-
| 00F5
| [[#GPUREG_00F5|GPUREG_00F5]]
|
|
|-
| 00F6
| [[#GPUREG_00F6|GPUREG_00F6]]
|
|
|-
| 00F7
| [[#GPUREG_00F7|GPUREG_00F7]]
|
|
|-
| 00F8
| [[#GPUREG_TEXENVi_SOURCE|GPUREG_TEXENV5_SOURCE]]
|
|PICA_REG_TEX_ENV_5
|-
| 00F9
| [[#GPUREG_TEXENVi_OPERAND|GPUREG_TEXENV5_OPERAND]]
|
|PICA_REG_TEX_ENV_5_OPERAND
|-
| 00FA
| [[#GPUREG_TEXENVi_COMBINER|GPUREG_TEXENV5_COMBINER]]
|
|PICA_REG_TEX_ENV_5_COMBINE
|-
| 00FB
| [[#GPUREG_TEXENVi_COLOR|GPUREG_TEXENV5_COLOR]]
|
|PICA_REG_TEX_ENV_5_COLOR
|-
| 00FC
| [[#GPUREG_TEXENVi_SCALE|GPUREG_TEXENV5_SCALE]]
|
|PICA_REG_TEX_ENV_5_SCALE
|-
| 00FD
| [[#GPUREG_TEXENV_BUFFER_COLOR|GPUREG_TEXENV_BUFFER_COLOR]]
|?
|PICA_REG_TEX_ENV_BUF_COLOR
|-
| 00FE
| [[#GPUREG_00FE|GPUREG_00FE]]
|
|
|-
| 00FF
| [[#GPUREG_00FF|GPUREG_00FF]]
|
|
|}

=== Framebuffer registers (0x100-0x13F) ===

{| class="wikitable" border="1"
! Register ID
! Register name
! Notes
! Official Name
|-
| 0100
| [[#GPUREG_COLOR_OPERATION|GPUREG_COLOR_OPERATION]]
|
|PICA_REG_COLOR_OPERATION
|-
| 0101
| [[#GPUREG_BLEND_FUNC|GPUREG_BLEND_FUNC]]
|
|PICA_REG_BLEND_FUNC
|-
| 0102
| [[#GPUREG_LOGIC_OP|GPUREG_LOGIC_OP]]
|
|PICA_REG_LOGIC_OP
|-
| 0103
| [[#GPUREG_BLEND_COLOR|GPUREG_BLEND_COLOR]]
|
|PICA_REG_BLEND_COLOR
|-
| 0104
| [[#GPUREG_FRAGOP_ALPHA_TEST|GPUREG_FRAGOP_ALPHA_TEST]]
|
|PICA_REG_FRAGOP_ALPHA_TEST
|-
| 0105
| [[#GPUREG_STENCIL_TEST|GPUREG_STENCIL_TEST]]
|
|PICA_REG_STENCIL_TEST
|-
| 0106
| [[#GPUREG_STENCIL_OP|GPUREG_STENCIL_OP]]
|
|PICA_REG_STENCIL_OP
|-
| 0107
| [[#GPUREG_DEPTH_COLOR_MASK|GPUREG_DEPTH_COLOR_MASK]]
|
|PICA_REG_DEPTH_COLOR_MASK
|-
| 0108
| [[#GPUREG_0108|GPUREG_0108]]
|
|
|-
| 0109
| [[#GPUREG_0109|GPUREG_0109]]
|
|
|-
| 010A
| [[#GPUREG_010A|GPUREG_010A]]
|
|
|-
| 010B
| [[#GPUREG_010B|GPUREG_010B]]
|
|
|-
| 010C
| [[#GPUREG_010C|GPUREG_010C]]
|
|
|-
| 010D
| [[#GPUREG_010D|GPUREG_010D]]
|
|
|-
| 010E
| [[#GPUREG_010E|GPUREG_010E]]
|
|
|-
| 010F
| [[#GPUREG_010F|GPUREG_010F]]
|
|
|-
| 0110
| [[#GPUREG_FRAMEBUFFER_INVALIDATE|GPUREG_FRAMEBUFFER_INVALIDATE]]
|
|PICA_REG_COLOR_BUFFER_CLEAR0
|-
| 0111
| [[#GPUREG_FRAMEBUFFER_FLUSH|GPUREG_FRAMEBUFFER_FLUSH]]
|
|PICA_REG_COLOR_BUFFER_CLEAR1
|-
| 0112
| [[#GPUREG_COLORBUFFER_READ|GPUREG_COLORBUFFER_READ]]
|
|PICA_REG_COLOR_BUFFER_READ
|-
| 0113
| [[#GPUREG_COLORBUFFER_WRITE|GPUREG_COLORBUFFER_WRITE]]
|
|PICA_REG_COLOR_BUFFER_WRITE
|-
| 0114
| [[#GPUREG_DEPTHBUFFER_READ|GPUREG_DEPTHBUFFER_READ]]
|
|PICA_REG_DEPTH_STENCIL_READ
|-
| 0115
| [[#GPUREG_DEPTHBUFFER_WRITE|GPUREG_DEPTHBUFFER_WRITE]]
|
|PICA_REG_DEPTH_STENCIL_WRITE
|-
| 0116
| [[#GPUREG_DEPTHBUFFER_FORMAT|GPUREG_DEPTHBUFFER_FORMAT]]
|
|PICA_REG_RENDER_BUF_DEPTH_MODE
|-
| 0117
| [[#GPUREG_COLORBUFFER_FORMAT|GPUREG_COLORBUFFER_FORMAT]]
|
|PICA_REG_RENDER_BUF_COLOR_MODE
|-
| 0118
| [[#GPUREG_EARLYDEPTH_TEST2|GPUREG_EARLYDEPTH_TEST2]]
|?
|PICA_REG_EARLY_DEPTH_TEST2
|-
| 0119
| [[#GPUREG_0119|GPUREG_0119]]
|
|
|-
| 011A
| [[#GPUREG_011A|GPUREG_011A]]
|
|
|-
| 011B
| [[#GPUREG_FRAMEBUFFER_BLOCK32|GPUREG_FRAMEBUFFER_BLOCK32]]
|
|PICA_REG_RENDER_BLOCK_FORMAT
|-
| 011C
| [[#GPUREG_DEPTHBUFFER_LOC|GPUREG_DEPTHBUFFER_LOC]]
|
|PICA_REG_RENDER_BUF_DEPTH_ADDR
|-
| 011D
| [[#GPUREG_COLORBUFFER_LOC|GPUREG_COLORBUFFER_LOC]]
|
|PICA_REG_RENDER_BUF_COLOR_ADDR
|-
| 011E
| [[#GPUREG_FRAMEBUFFER_DIM|GPUREG_FRAMEBUFFER_DIM]]
|
|PICA_REG_RENDER_BUF_RESOLUTION0
|-
| 011F
| [[#GPUREG_011F|GPUREG_011F]]
|
|
|-
| 0120
| [[#GPUREG_GAS_LIGHT_XY|GPUREG_GAS_LIGHT_XY]]
|?
|PICA_REG_GAS_LIGHT_XY
|-
| 0121
| [[#GPUREG_GAS_LIGHT_Z|GPUREG_GAS_LIGHT_Z]]
|?
|PICA_REG_GAS_LIGHT_Z
|-
| 0122
| [[#GPUREG_GAS_LIGHT_Z_COLOR|GPUREG_GAS_LIGHT_Z_COLOR]]
|?
|PICA_REG_GAS_LIGHT_Z_COLOR
|-
| 0123
| [[#GPUREG_GAS_LUT_INDEX|GPUREG_GAS_LUT_INDEX]]
|?
|PICA_REG_GAS_LUT_INDEX
|-
| 0124
| [[#GPUREG_GAS_LUT_DATA|GPUREG_GAS_LUT_DATA]]
|?
|PICA_REG_GAS_LUT_DATA
|-
| 0125
| [[#GPUREG_0125|GPUREG_0125]]
|
|
|-
| 0126
| [[#GPUREG_GAS_DELTAZ_DEPTH|GPUREG_GAS_DELTAZ_DEPTH]]
|?
|PICA_REG_GAS_DELTAZ_DEPTH
|-
| 0127
| [[#GPUREG_0127|GPUREG_0127]]
|
|
|-
| 0128
| [[#GPUREG_0128|GPUREG_0128]]
|
|
|-
| 0129
| [[#GPUREG_0129|GPUREG_0129]]
|
|
|-
| 012A
| [[#GPUREG_012A|GPUREG_012A]]
|
|
|-
| 012B
| [[#GPUREG_012B|GPUREG_012B]]
|
|
|-
| 012C
| [[#GPUREG_012C|GPUREG_012C]]
|
|
|-
| 012D
| [[#GPUREG_012D|GPUREG_012D]]
|
|
|-
| 012E
| [[#GPUREG_012E|GPUREG_012E]]
|
|
|-
| 012F
| [[#GPUREG_012F|GPUREG_012F]]
|
|
|-
| 0130
| [[#GPUREG_FRAGOP_SHADOW|GPUREG_FRAGOP_SHADOW]]
|?
|PICA_REG_FRAGOP_SHADOW
|-
| 0131
| [[#GPUREG_0131|GPUREG_0131]]
|
|
|-
| 0132
| [[#GPUREG_0132|GPUREG_0132]]
|
|
|-
| 0133
| [[#GPUREG_0133|GPUREG_0133]]
|
|
|-
| 0134
| [[#GPUREG_0134|GPUREG_0134]]
|
|
|-
| 0135
| [[#GPUREG_0135|GPUREG_0135]]
|
|
|-
| 0136
| [[#GPUREG_0136|GPUREG_0136]]
|
|
|-
| 0137
| [[#GPUREG_0137|GPUREG_0137]]
|
|
|-
| 0138
| [[#GPUREG_0138|GPUREG_0138]]
|
|
|-
| 0139
| [[#GPUREG_0139|GPUREG_0139]]
|
|
|-
| 013A
| [[#GPUREG_013A|GPUREG_013A]]
|
|
|-
| 013B
| [[#GPUREG_013B|GPUREG_013B]]
|
|
|-
| 013C
| [[#GPUREG_013C|GPUREG_013C]]
|
|
|-
| 013D
| [[#GPUREG_013D|GPUREG_013D]]
|
|
|-
| 013E
| [[#GPUREG_013E|GPUREG_013E]]
|
|
|-
| 013F
| [[#GPUREG_013F|GPUREG_013F]]
|
|
|}

=== Fragment lighting registers (0x140-0x1FF) ===

{| class="wikitable" border="1"
! Register ID
! Register name
! Notes
! Official Name
|-
| 0140
| [[#GPUREG_LIGHTi_SPECULAR0|GPUREG_LIGHT0_SPECULAR0]]
|?
|PICA_REG_FRAG_LIGHT0_SPECULAR0 / PICA_REG_FRAG_LIGHT_START
|-
| 0141
| [[#GPUREG_LIGHTi_SPECULAR1|GPUREG_LIGHT0_SPECULAR1]]
|?
|PICA_REG_FRAG_LIGHT0_SPECULAR1
|-
| 0142
| [[#GPUREG_LIGHTi_DIFFUSE|GPUREG_LIGHT0_DIFFUSE]]
|?
|PICA_REG_FRAG_LIGHT0_DIFFUSE
|-
| 0143
| [[#GPUREG_LIGHTi_AMBIENT|GPUREG_LIGHT0_AMBIENT]]
|?
|PICA_REG_FRAG_LIGHT0_AMBIENT
|-
| 0144
| [[#GPUREG_LIGHTi_XY|GPUREG_LIGHT0_XY]]
|?
|PICA_REG_FRAG_LIGHT0_POSITION_XY
|-
| 0145
| [[#GPUREG_LIGHTi_Z|GPUREG_LIGHT0_Z]]
|?
|PICA_REG_FRAG_LIGHT0_POSITION_Z
|-
| 0146
| [[#GPUREG_LIGHTi_SPOTDIR_XY|GPUREG_LIGHT0_SPOTDIR_XY]]
|?
|PICA_REG_FRAG_LIGHT0_SPOT_XY
|-
| 0147
| [[#GPUREG_LIGHTi_SPOTDIR_Z|GPUREG_LIGHT0_SPOTDIR_Z]]
|?
|PICA_REG_FRAG_LIGHT0_SPOT_Z
|-
| 0148
| [[#GPUREG_0148|GPUREG_0148]]
|
|
|-
| 0149
| [[#GPUREG_LIGHTi_CONFIG|GPUREG_LIGHT0_CONFIG]]
|
|PICA_REG_FRAG_LIGHT0_TYPE
|-
| 014A
| [[#GPUREG_LIGHTi_ATTENUATION_BIAS|GPUREG_LIGHT0_ATTENUATION_BIAS]]
|?
|PICA_REG_FRAG_LIGHT0_DIST_ATTN_BIAS
|-
| 014B
| [[#GPUREG_LIGHTi_ATTENUATION_SCALE|GPUREG_LIGHT0_ATTENUATION_SCALE]]
|?
|PICA_REG_FRAG_LIGHT0_DIST_ATTN_SCALE
|-
| 014C
| [[#GPUREG_014C|GPUREG_014C]]
|
|
|-
| 014D
| [[#GPUREG_014D|GPUREG_014D]]
|
|
|-
| 014E
| [[#GPUREG_014E|GPUREG_014E]]
|
|
|-
| 014F
| [[#GPUREG_014F|GPUREG_014F]]
|
|
|-
| 0150
| [[#GPUREG_LIGHTi_SPECULAR0|GPUREG_LIGHT1_SPECULAR0]]
|?
|PICA_REG_FRAG_LIGHT1_SPECULAR0
|-
| 0151
| [[#GPUREG_LIGHTi_SPECULAR1|GPUREG_LIGHT1_SPECULAR1]]
|?
|PICA_REG_FRAG_LIGHT1_SPECULAR1
|-
| 0152
| [[#GPUREG_LIGHTi_DIFFUSE|GPUREG_LIGHT1_DIFFUSE]]
|?
|PICA_REG_FRAG_LIGHT1_DIFFUSE
|-
| 0153
| [[#GPUREG_LIGHTi_AMBIENT|GPUREG_LIGHT1_AMBIENT]]
|?
|PICA_REG_FRAG_LIGHT1_AMBIENT
|-
| 0154
| [[#GPUREG_LIGHTi_XY|GPUREG_LIGHT1_XY]]
|?
|PICA_REG_FRAG_LIGHT1_POSITION_XY
|-
| 0155
| [[#GPUREG_LIGHTi_Z|GPUREG_LIGHT1_Z]]
|?
|PICA_REG_FRAG_LIGHT1_POSITION_Z
|-
| 0156
| [[#GPUREG_LIGHTi_SPOTDIR_XY|GPUREG_LIGHT1_SPOTDIR_XY]]
|?
|PICA_REG_FRAG_LIGHT1_SPOT_XY
|-
| 0157
| [[#GPUREG_LIGHTi_SPOTDIR_Z|GPUREG_LIGHT1_SPOTDIR_Z]]
|?
|PICA_REG_FRAG_LIGHT1_SPOT_Z
|-
| 0158
| [[#GPUREG_0158|GPUREG_0158]]
|
|
|-
| 0159
| [[#GPUREG_LIGHTi_CONFIG|GPUREG_LIGHT1_CONFIG]]
|?
|PICA_REG_FRAG_LIGHT1_TYPE
|-
| 015A
| [[#GPUREG_LIGHTi_ATTENUATION_BIAS|GPUREG_LIGHT1_ATTENUATION_BIAS]]
|?
|PICA_REG_FRAG_LIGHT1_DIST_ATTN_BIAS
|-
| 015B
| [[#GPUREG_LIGHTi_ATTENUATION_SCALE|GPUREG_LIGHT1_ATTENUATION_SCALE]]
|?
|PICA_REG_FRAG_LIGHT1_DIST_ATTN_SCALE
|-
| 015C
| [[#GPUREG_015C|GPUREG_015C]]
|
|
|-
| 015D
| [[#GPUREG_015D|GPUREG_015D]]
|
|
|-
| 015E
| [[#GPUREG_015E|GPUREG_015E]]
|
|
|-
| 015F
| [[#GPUREG_015F|GPUREG_015F]]
|
|
|-
| 0160
| [[#GPUREG_LIGHTi_SPECULAR0|GPUREG_LIGHT2_SPECULAR0]]
|?
|PICA_REG_FRAG_LIGHT2_SPECULAR0
|-
| 0161
| [[#GPUREG_LIGHTi_SPECULAR1|GPUREG_LIGHT2_SPECULAR1]]
|?
|PICA_REG_FRAG_LIGHT2_SPECULAR1
|-
| 0162
| [[#GPUREG_LIGHTi_DIFFUSE|GPUREG_LIGHT2_DIFFUSE]]
|?
|PICA_REG_FRAG_LIGHT2_DIFFUSE
|-
| 0163
| [[#GPUREG_LIGHTi_AMBIENT|GPUREG_LIGHT2_AMBIENT]]
|?
|PICA_REG_FRAG_LIGHT2_AMBIENT
|-
| 0164
| [[#GPUREG_LIGHTi_XY|GPUREG_LIGHT2_XY]]
|?
|PICA_REG_FRAG_LIGHT2_POSITION_XY
|-
| 0165
| [[#GPUREG_LIGHTi_Z|GPUREG_LIGHT2_Z]]
|?
|PICA_REG_FRAG_LIGHT2_POSITION_Z
|-
| 0166
| [[#GPUREG_LIGHTi_SPOTDIR_XY|GPUREG_LIGHT2_SPOTDIR_XY]]
|?
|PICA_REG_FRAG_LIGHT2_SPOT_XY
|-
| 0167
| [[#GPUREG_LIGHTi_SPOTDIR_Z|GPUREG_LIGHT2_SPOTDIR_Z]]
|?
|PICA_REG_FRAG_LIGHT2_SPOT_Z
|-
| 0168
| [[#GPUREG_0168|GPUREG_0168]]
|
|
|-
| 0169
| [[#GPUREG_LIGHTi_CONFIG|GPUREG_LIGHT2_CONFIG]]
|?
|PICA_REG_FRAG_LIGHT2_TYPE
|-
| 016A
| [[#GPUREG_LIGHTi_ATTENUATION_BIAS|GPUREG_LIGHT2_ATTENUATION_BIAS]]
|?
|PICA_REG_FRAG_LIGHT2_DIST_ATTN_BIAS
|-
| 016B
| [[#GPUREG_LIGHTi_ATTENUATION_SCALE|GPUREG_LIGHT2_ATTENUATION_SCALE]]
|?
|PICA_REG_FRAG_LIGHT2_DIST_ATTN_SCALE
|-
| 016C
| [[#GPUREG_016C|GPUREG_016C]]
|
|
|-
| 016D
| [[#GPUREG_016D|GPUREG_016D]]
|
|
|-
| 016E
| [[#GPUREG_016E|GPUREG_016E]]
|
|
|-
| 016F
| [[#GPUREG_016F|GPUREG_016F]]
|
|
|-
| 0170
| [[#GPUREG_LIGHTi_SPECULAR0|GPUREG_LIGHT3_SPECULAR0]]
|?
|PICA_REG_FRAG_LIGHT3_SPECULAR0
|-
| 0171
| [[#GPUREG_LIGHTi_SPECULAR1|GPUREG_LIGHT3_SPECULAR1]]
|?
|PICA_REG_FRAG_LIGHT3_SPECULAR1
|-
| 0172
| [[#GPUREG_LIGHTi_DIFFUSE|GPUREG_LIGHT3_DIFFUSE]]
|?
|PICA_REG_FRAG_LIGHT3_DIFFUSE
|-
| 0173
| [[#GPUREG_LIGHTi_AMBIENT|GPUREG_LIGHT3_AMBIENT]]
|?
|PICA_REG_FRAG_LIGHT3_AMBIENT
|-
| 0174
| [[#GPUREG_LIGHTi_XY|GPUREG_LIGHT3_XY]]
|?
|PICA_REG_FRAG_LIGHT3_POSITION_XY
|-
| 0175
| [[#GPUREG_LIGHTi_Z|GPUREG_LIGHT3_Z]]
|?
|PICA_REG_FRAG_LIGHT3_POSITION_Z
|-
| 0176
| [[#GPUREG_LIGHTi_SPOTDIR_XY|GPUREG_LIGHT3_SPOTDIR_XY]]
|?
|PICA_REG_FRAG_LIGHT3_SPOT_XY
|-
| 0177
| [[#GPUREG_LIGHTi_SPOTDIR_Z|GPUREG_LIGHT3_SPOTDIR_Z]]
|?
|PICA_REG_FRAG_LIGHT3_SPOT_Z
|-
| 0178
| [[#GPUREG_0178|GPUREG_0178]]
|
|
|-
| 0179
| [[#GPUREG_LIGHTi_CONFIG|GPUREG_LIGHT3_CONFIG]]
|?
|PICA_REG_FRAG_LIGHT3_TYPE
|-
| 017A
| [[#GPUREG_LIGHTi_ATTENUATION_BIAS|GPUREG_LIGHT3_ATTENUATION_BIAS]]
|?
|PICA_REG_FRAG_LIGHT3_DIST_ATTN_BIAS
|-
| 017B
| [[#GPUREG_LIGHTi_ATTENUATION_SCALE|GPUREG_LIGHT3_ATTENUATION_SCALE]]
|?
|PICA_REG_FRAG_LIGHT3_DIST_ATTN_SCALE
|-
| 017C
| [[#GPUREG_017C|GPUREG_017C]]
|
|
|-
| 017D
| [[#GPUREG_017D|GPUREG_017D]]
|
|
|-
| 017E
| [[#GPUREG_017E|GPUREG_017E]]
|
|
|-
| 017F
| [[#GPUREG_017F|GPUREG_017F]]
|
|
|-
| 0180
| [[#GPUREG_LIGHTi_SPECULAR0|GPUREG_LIGHT4_SPECULAR0]]
|?
|PICA_REG_FRAG_LIGHT4_SPECULAR0
|-
| 0181
| [[#GPUREG_LIGHTi_SPECULAR1|GPUREG_LIGHT4_SPECULAR1]]
|?
|PICA_REG_FRAG_LIGHT4_SPECULAR1
|-
| 0182
| [[#GPUREG_LIGHTi_DIFFUSE|GPUREG_LIGHT4_DIFFUSE]]
|?
|PICA_REG_FRAG_LIGHT4_DIFFUSE
|-
| 0183
| [[#GPUREG_LIGHTi_AMBIENT|GPUREG_LIGHT4_AMBIENT]]
|?
|PICA_REG_FRAG_LIGHT4_AMBIENT
|-
| 0184
| [[#GPUREG_LIGHTi_XY|GPUREG_LIGHT4_XY]]
|?
|PICA_REG_FRAG_LIGHT4_POSITION_XY
|-
| 0185
| [[#GPUREG_LIGHTi_Z|GPUREG_LIGHT4_Z]]
|?
|PICA_REG_FRAG_LIGHT4_POSITION_Z
|-
| 0186
| [[#GPUREG_LIGHTi_SPOTDIR_XY|GPUREG_LIGHT4_SPOTDIR_XY]]
|?
|PICA_REG_FRAG_LIGHT4_SPOT_XY
|-
| 0187
| [[#GPUREG_LIGHTi_SPOTDIR_Z|GPUREG_LIGHT4_SPOTDIR_Z]]
|?
|PICA_REG_FRAG_LIGHT4_SPOT_Z
|-
| 0188
| [[#GPUREG_0188|GPUREG_0188]]
|
|
|-
| 0189
| [[#GPUREG_LIGHTi_CONFIG|GPUREG_LIGHT4_CONFIG]]
|?
|PICA_REG_FRAG_LIGHT4_TYPE
|-
| 018A
| [[#GPUREG_LIGHTi_ATTENUATION_BIAS|GPUREG_LIGHT4_ATTENUATION_BIAS]]
|?
|PICA_REG_FRAG_LIGHT4_DIST_ATTN_BIAS
|-
| 018B
| [[#GPUREG_LIGHTi_ATTENUATION_SCALE|GPUREG_LIGHT4_ATTENUATION_SCALE]]
|?
|PICA_REG_FRAG_LIGHT4_DIST_ATTN_SCALE
|-
| 018C
| [[#GPUREG_018C|GPUREG_018C]]
|
|
|-
| 018D
| [[#GPUREG_018D|GPUREG_018D]]
|
|
|-
| 018E
| [[#GPUREG_018E|GPUREG_018E]]
|
|
|-
| 018F
| [[#GPUREG_018F|GPUREG_018F]]
|
|
|-
| 0190
| [[#GPUREG_LIGHTi_SPECULAR0|GPUREG_LIGHT5_SPECULAR0]]
|?
|PICA_REG_FRAG_LIGHT5_SPECULAR0
|-
| 0191
| [[#GPUREG_LIGHTi_SPECULAR1|GPUREG_LIGHT5_SPECULAR1]]
|?
|PICA_REG_FRAG_LIGHT5_SPECULAR1
|-
| 0192
| [[#GPUREG_LIGHTi_DIFFUSE|GPUREG_LIGHT5_DIFFUSE]]
|?
|PICA_REG_FRAG_LIGHT5_DIFFUSE
|-
| 0193
| [[#GPUREG_LIGHTi_AMBIENT|GPUREG_LIGHT5_AMBIENT]]
|?
|PICA_REG_FRAG_LIGHT5_AMBIENT
|-
| 0194
| [[#GPUREG_LIGHTi_XY|GPUREG_LIGHT5_XY]]
|?
|PICA_REG_FRAG_LIGHT5_POSITION_XY
|-
| 0195
| [[#GPUREG_LIGHTi_Z|GPUREG_LIGHT5_Z]]
|?
|PICA_REG_FRAG_LIGHT5_POSITION_Z
|-
| 0196
| [[#GPUREG_LIGHTi_SPOTDIR_XY|GPUREG_LIGHT5_SPOTDIR_XY]]
|?
|PICA_REG_FRAG_LIGHT5_SPOT_XY
|-
| 0197
| [[#GPUREG_LIGHTi_SPOTDIR_Z|GPUREG_LIGHT5_SPOTDIR_Z]]
|?
|PICA_REG_FRAG_LIGHT5_SPOT_Z
|-
| 0198
| [[#GPUREG_0198|GPUREG_0198]]
|
|
|-
| 0199
| [[#GPUREG_LIGHTi_CONFIG|GPUREG_LIGHT5_CONFIG]]
|?
|PICA_REG_FRAG_LIGHT5_TYPE
|-
| 019A
| [[#GPUREG_LIGHTi_ATTENUATION_BIAS|GPUREG_LIGHT5_ATTENUATION_BIAS]]
|
|PICA_REG_FRAG_LIGHT5_DIST_ATTN_BIAS
|-
| 019B
| [[#GPUREG_LIGHTi_ATTENUATION_SCALE|GPUREG_LIGHT5_ATTENUATION_SCALE]]
|
|PICA_REG_FRAG_LIGHT5_DIST_ATTN_SCALE
|-
| 019C
| [[#GPUREG_019C|GPUREG_019C]]
|
|
|-
| 019D
| [[#GPUREG_019D|GPUREG_019D]]
|
|
|-
| 019E
| [[#GPUREG_019E|GPUREG_019E]]
|
|
|-
| 019F
| [[#GPUREG_019F|GPUREG_019F]]
|
|
|-
| 01A0
| [[#GPUREG_LIGHTi_SPECULAR0|GPUREG_LIGHT6_SPECULAR0]]
|?
|PICA_REG_FRAG_LIGHT6_SPECULAR0
|-
| 01A1
| [[#GPUREG_LIGHTi_SPECULAR1|GPUREG_LIGHT6_SPECULAR1]]
|?
|PICA_REG_FRAG_LIGHT6_SPECULAR1
|-
| 01A2
| [[#GPUREG_LIGHTi_DIFFUSE|GPUREG_LIGHT6_DIFFUSE]]
|
|PICA_REG_FRAG_LIGHT6_DIFFUSE
|-
| 01A3
| [[#GPUREG_LIGHTi_AMBIENT|GPUREG_LIGHT6_AMBIENT]]
|
|PICA_REG_FRAG_LIGHT6_AMBIENT
|-
| 01A4
| [[#GPUREG_LIGHTi_XY|GPUREG_LIGHT6_XY]]
|
|PICA_REG_FRAG_LIGHT6_POSITION_XY
|-
| 01A5
| [[#GPUREG_LIGHTi_Z|GPUREG_LIGHT6_Z]]
|
|PICA_REG_FRAG_LIGHT6_POSITION_Z
|-
| 01A6
| [[#GPUREG_LIGHTi_SPOTDIR_XY|GPUREG_LIGHT6_SPOTDIR_XY]]
|?
|PICA_REG_FRAG_LIGHT6_SPOT_XY
|-
| 01A7
| [[#GPUREG_LIGHTi_SPOTDIR_Z|GPUREG_LIGHT6_SPOTDIR_Z]]
|?
|PICA_REG_FRAG_LIGHT6_SPOT_Z
|-
| 01A8
| [[#GPUREG_01A8|GPUREG_01A8]]
|
|
|-
| 01A9
| [[#GPUREG_LIGHTi_CONFIG|GPUREG_LIGHT6_CONFIG]]
|?
|PICA_REG_FRAG_LIGHT6_TYPE
|-
| 01AA
| [[#GPUREG_LIGHTi_ATTENUATION_BIAS|GPUREG_LIGHT6_ATTENUATION_BIAS]]
|
|PICA_REG_FRAG_LIGHT6_DIST_ATTN_BIAS
|-
| 01AB
| [[#GPUREG_LIGHTi_ATTENUATION_SCALE|GPUREG_LIGHT6_ATTENUATION_SCALE]]
|
|PICA_REG_FRAG_LIGHT6_DIST_ATTN_SCALE
|-
| 01AC
| [[#GPUREG_01AC|GPUREG_01AC]]
|
|
|-
| 01AD
| [[#GPUREG_01AD|GPUREG_01AD]]
|
|
|-
| 01AE
| [[#GPUREG_01AE|GPUREG_01AE]]
|
|
|-
| 01AF
| [[#GPUREG_01AF|GPUREG_01AF]]
|
|
|-
| 01B0
| [[#GPUREG_LIGHTi_SPECULAR0|GPUREG_LIGHT7_SPECULAR0]]
|?
|PICA_REG_FRAG_LIGHT7_SPECULAR0
|-
| 01B1
| [[#GPUREG_LIGHTi_SPECULAR1|GPUREG_LIGHT7_SPECULAR1]]
|?
|PICA_REG_FRAG_LIGHT7_SPECULAR1
|-
| 01B2
| [[#GPUREG_LIGHTi_DIFFUSE|GPUREG_LIGHT7_DIFFUSE]]
|?
|PICA_REG_FRAG_LIGHT7_DIFFUSE
|-
| 01B3
| [[#GPUREG_LIGHTi_AMBIENT|GPUREG_LIGHT7_AMBIENT]]
|?
|PICA_REG_FRAG_LIGHT7_AMBIENT
|-
| 01B4
| [[#GPUREG_LIGHTi_XY|GPUREG_LIGHT7_XY]]
|?
|PICA_REG_FRAG_LIGHT7_POSITION_XY
|-
| 01B5
| [[#GPUREG_LIGHTi_Z|GPUREG_LIGHT7_Z]]
|?
|PICA_REG_FRAG_LIGHT7_POSITION_Z
|-
| 01B6
| [[#GPUREG_LIGHTi_SPOTDIR_XY|GPUREG_LIGHT7_SPOTDIR_XY]]
|?
|PICA_REG_FRAG_LIGHT7_SPOT_XY
|-
| 01B7
| [[#GPUREG_LIGHTi_SPOTDIR_Z|GPUREG_LIGHT7_SPOTDIR_Z]]
|?
|PICA_REG_FRAG_LIGHT7_SPOT_Z
|-
| 01B8
| [[#GPUREG_01B8|GPUREG_01B8]]
|
|
|-
| 01B9
| [[#GPUREG_LIGHTi_CONFIG|GPUREG_LIGHT7_CONFIG]]
|?
|PICA_REG_FRAG_LIGHT7_TYPE
|-
| 01BA
| [[#GPUREG_LIGHTi_ATTENUATION_BIAS|GPUREG_LIGHT7_ATTENUATION_BIAS]]
|
|PICA_REG_FRAG_LIGHT7_DIST_ATTN_BIAS
|-
| 01BB
| [[#GPUREG_LIGHTi_ATTENUATION_SCALE|GPUREG_LIGHT7_ATTENUATION_SCALE]]
|
|PICA_REG_FRAG_LIGHT7_DIST_ATTN_SCALE
|-
| 01BC
| [[#GPUREG_01BC|GPUREG_01BC]]
|
|
|-
| 01BD
| [[#GPUREG_01BD|GPUREG_01BD]]
|
|
|-
| 01BE
| [[#GPUREG_01BE|GPUREG_01BE]]
|
|
|-
| 01BF
| [[#GPUREG_01BF|GPUREG_01BF]]
|
|
|-
| 01C0
| [[#GPUREG_LIGHTING_AMBIENT|GPUREG_LIGHTING_AMBIENT]]
|?
|PICA_REG_FRAG_LIGHT_AMBIENT
|-
| 01C1
| [[#GPUREG_01C1|GPUREG_01C1]]
|
|
|-
| 01C2
| [[#GPUREG_LIGHTING_NUM_LIGHTS|GPUREG_LIGHTING_NUM_LIGHTS]]
|?
|PICA_REG_FRAG_LIGHT_SRC_NUM
|-
| 01C3
| [[#GPUREG_LIGHTING_CONFIG0|GPUREG_LIGHTING_CONFIG0]]
|?
|PICA_REG_FRAG_LIGHT_FUNC_MODE0
|-
| 01C4
| [[#GPUREG_LIGHTING_CONFIG1|GPUREG_LIGHTING_CONFIG1]]
|?
|PICA_REG_FRAG_LIGHT_FUNC_MODE1
|-
| 01C5
| [[#GPUREG_LIGHTING_LUT_INDEX|GPUREG_LIGHTING_LUT_INDEX]]
|?
|PICA_REG_FRAG_LIGHT_LUT
|-
| 01C6
| [[#GPUREG_LIGHTING_ENABLE1|GPUREG_LIGHTING_ENABLE1]]
|?
|PICA_REG_FRAG_LIGHT_EN1
|-
| 01C7
| [[#GPUREG_01C7|GPUREG_01C7]]
|
|
|-
| 01C8
| [[#GPUREG_LIGHTING_LUT_DATAi|GPUREG_LIGHTING_LUT_DATA0]]
|?
|PICA_REG_FRAG_LIGHT_LUT_DATA0
|-
| 01C9
| [[#GPUREG_LIGHTING_LUT_DATAi|GPUREG_LIGHTING_LUT_DATA1]]
|?
|PICA_REG_FRAG_LIGHT_LUT_DATA1
|-
| 01CA
| [[#GPUREG_LIGHTING_LUT_DATAi|GPUREG_LIGHTING_LUT_DATA2]]
|?
|PICA_REG_FRAG_LIGHT_LUT_DATA2
|-
| 01CB
| [[#GPUREG_LIGHTING_LUT_DATAi|GPUREG_LIGHTING_LUT_DATA3]]
|?
|PICA_REG_FRAG_LIGHT_LUT_DATA3
|-
| 01CC
| [[#GPUREG_LIGHTING_LUT_DATAi|GPUREG_LIGHTING_LUT_DATA4]]
|?
|PICA_REG_FRAG_LIGHT_LUT_DATA4
|-
| 01CD
| [[#GPUREG_LIGHTING_LUT_DATAi|GPUREG_LIGHTING_LUT_DATA5]]
|?
|PICA_REG_FRAG_LIGHT_LUT_DATA5
|-
| 01CE
| [[#GPUREG_LIGHTING_LUT_DATAi|GPUREG_LIGHTING_LUT_DATA6]]
|?
|PICA_REG_FRAG_LIGHT_LUT_DATA6
|-
| 01CF
| [[#GPUREG_LIGHTING_LUT_DATAi|GPUREG_LIGHTING_LUT_DATA7]]
|?
|PICA_REG_FRAG_LIGHT_LUT_DATA7
|-
| 01D0
| [[#GPUREG_LIGHTING_LUTINPUT_ABS|GPUREG_LIGHTING_LUTINPUT_ABS]]
|?
|PICA_REG_FRAG_LIGHT_ABSLUTINPUT
|-
| 01D1
| [[#GPUREG_LIGHTING_LUTINPUT_SELECT|GPUREG_LIGHTING_LUTINPUT_SELECT]]
|?
|PICA_REG_FRAG_LIGHT_LUTINPUT
|-
| 01D2
| [[#GPUREG_LIGHTING_LUTINPUT_SCALE|GPUREG_LIGHTING_LUTINPUT_SCALE]]
|?
|PICA_REG_FRAG_LIGHT_LUTSCALE
|-
| 01D3
| [[#GPUREG_01D3|GPUREG_01D3]]
|
|
|-
| 01D4
| [[#GPUREG_01D4|GPUREG_01D4]]
|
|
|-
| 01D5
| [[#GPUREG_01D5|GPUREG_01D5]]
|
|
|-
| 01D6
| [[#GPUREG_01D6|GPUREG_01D6]]
|
|
|-
| 01D7
| [[#GPUREG_01D7|GPUREG_01D7]]
|
|
|-
| 01D8
| [[#GPUREG_01D8|GPUREG_01D8]]
|
|
|-
| 01D9
| [[#GPUREG_LIGHTING_LIGHT_PERMUTATION|GPUREG_LIGHTING_LIGHT_PERMUTATION]]
|?
|PICA_REG_FRAG_LIGHT_SRC_EN_ID
|-
| 01DA
| [[#GPUREG_01DA|GPUREG_01DA]]
|
|
|-
| 01DB
| [[#GPUREG_01DB|GPUREG_01DB]]
|
|
|-
| 01DC
| [[#GPUREG_01DC|GPUREG_01DC]]
|
|
|-
| 01DD
| [[#GPUREG_01DD|GPUREG_01DD]]
|
|
|-
| 01DE
| [[#GPUREG_01DE|GPUREG_01DE]]
|
|
|-
| 01DF
| [[#GPUREG_01DF|GPUREG_01DF]]
|
|
|-
| 01E0
| [[#GPUREG_01E0|GPUREG_01E0]]
|
|
|-
| 01E1
| [[#GPUREG_01E1|GPUREG_01E1]]
|
|
|-
| 01E2
| [[#GPUREG_01E2|GPUREG_01E2]]
|
|
|-
| 01E3
| [[#GPUREG_01E3|GPUREG_01E3]]
|
|
|-
| 01E4
| [[#GPUREG_01E4|GPUREG_01E4]]
|
|
|-
| 01E5
| [[#GPUREG_01E5|GPUREG_01E5]]
|
|
|-
| 01E6
| [[#GPUREG_01E6|GPUREG_01E6]]
|
|
|-
| 01E7
| [[#GPUREG_01E7|GPUREG_01E7]]
|
|
|-
| 01E8
| [[#GPUREG_01E8|GPUREG_01E8]]
|
|
|-
| 01E9
| [[#GPUREG_01E9|GPUREG_01E9]]
|
|
|-
| 01EA
| [[#GPUREG_01EA|GPUREG_01EA]]
|
|
|-
| 01EB
| [[#GPUREG_01EB|GPUREG_01EB]]
|
|
|-
| 01EC
| [[#GPUREG_01EC|GPUREG_01EC]]
|
|
|-
| 01ED
| [[#GPUREG_01ED|GPUREG_01ED]]
|
|
|-
| 01EE
| [[#GPUREG_01EE|GPUREG_01EE]]
|
|
|-
| 01EF
| [[#GPUREG_01EF|GPUREG_01EF]]
|
|
|-
| 01F0
| [[#GPUREG_01F0|GPUREG_01F0]]
|
|
|-
| 01F1
| [[#GPUREG_01F1|GPUREG_01F1]]
|
|
|-
| 01F2
| [[#GPUREG_01F2|GPUREG_01F2]]
|
|
|-
| 01F3
| [[#GPUREG_01F3|GPUREG_01F3]]
|
|
|-
| 01F4
| [[#GPUREG_01F4|GPUREG_01F4]]
|
|
|-
| 01F5
| [[#GPUREG_01F5|GPUREG_01F5]]
|
|
|-
| 01F6
| [[#GPUREG_01F6|GPUREG_01F6]]
|
|
|-
| 01F7
| [[#GPUREG_01F7|GPUREG_01F7]]
|
|
|-
| 01F8
| [[#GPUREG_01F8|GPUREG_01F8]]
|
|
|-
| 01F9
| [[#GPUREG_01F9|GPUREG_01F9]]
|
|
|-
| 01FA
| [[#GPUREG_01FA|GPUREG_01FA]]
|
|
|-
| 01FB
| [[#GPUREG_01FB|GPUREG_01FB]]
|
|
|-
| 01FC
| [[#GPUREG_01FC|GPUREG_01FC]]
|
|
|-
| 01FD
| [[#GPUREG_01FD|GPUREG_01FD]]
|
|
|-
| 01FE
| [[#GPUREG_01FE|GPUREG_01FE]]
|
|
|-
| 01FF
| [[#GPUREG_01FF|GPUREG_01FF]]
|
|
|}

=== Geometry pipeline registers (0x200-0x27F) ===

{| class="wikitable" border="1"
! Register ID
! Register name
! Notes
! Official Name
|-
| 0200
| [[#GPUREG_ATTRIBBUFFERS_LOC|GPUREG_ATTRIBBUFFERS_LOC]]
|
|PICA_REG_VTX_ATTR_ARRAYS_BASE_ADDR
|-
| 0201
| [[#GPUREG_ATTRIBBUFFERS_FORMAT_LOW|GPUREG_ATTRIBBUFFERS_FORMAT_LOW]]
|
|PICA_REG_VTX_ATTR_ARRAYS0
|-
| 0202
| [[#GPUREG_ATTRIBBUFFERS_FORMAT_HIGH|GPUREG_ATTRIBBUFFERS_FORMAT_HIGH]]
|
|PICA_REG_VTX_ATTR_ARRAYS1
|-
| 0203
| [[#GPUREG_ATTRIBBUFFERi_OFFSET|GPUREG_ATTRIBBUFFER0_OFFSET]]
|
|PICA_REG_LOAD_ARRAY0_ATTR_OFFSET
|-
| 0204
| [[#GPUREG_ATTRIBBUFFERi_CONFIG1|GPUREG_ATTRIBBUFFER0_CONFIG1]]
|
|PICA_REG_LOAD_ARRAY0_ELEMENT0
|-
| 0205
| [[#GPUREG_ATTRIBBUFFERi_CONFIG2|GPUREG_ATTRIBBUFFER0_CONFIG2]]
|
|PICA_REG_LOAD_ARRAY0_ELEMENT1
|-
| 0206
| [[#GPUREG_ATTRIBBUFFERi_OFFSET|GPUREG_ATTRIBBUFFER1_OFFSET]]
|
|
|-
| 0207
| [[#GPUREG_ATTRIBBUFFERi_CONFIG1|GPUREG_ATTRIBBUFFER1_CONFIG1]]
|
|
|-
| 0208
| [[#GPUREG_ATTRIBBUFFERi_CONFIG2|GPUREG_ATTRIBBUFFER1_CONFIG2]]
|
|
|-
| 0209
| [[#GPUREG_ATTRIBBUFFERi_OFFSET|GPUREG_ATTRIBBUFFER2_OFFSET]]
|
|
|-
| 020A
| [[#GPUREG_ATTRIBBUFFERi_CONFIG1|GPUREG_ATTRIBBUFFER2_CONFIG1]]
|
|
|-
| 020B
| [[#GPUREG_ATTRIBBUFFERi_CONFIG2|GPUREG_ATTRIBBUFFER2_CONFIG2]]
|
|
|-
| 020C
| [[#GPUREG_ATTRIBBUFFERi_OFFSET|GPUREG_ATTRIBBUFFER3_OFFSET]]
|
|
|-
| 020D
| [[#GPUREG_ATTRIBBUFFERi_CONFIG1|GPUREG_ATTRIBBUFFER3_CONFIG1]]
|
|
|-
| 020E
| [[#GPUREG_ATTRIBBUFFERi_CONFIG2|GPUREG_ATTRIBBUFFER3_CONFIG2]]
|
|
|-
| 020F
| [[#GPUREG_ATTRIBBUFFERi_OFFSET|GPUREG_ATTRIBBUFFER4_OFFSET]]
|
|
|-
| 0210
| [[#GPUREG_ATTRIBBUFFERi_CONFIG1|GPUREG_ATTRIBBUFFER4_CONFIG1]]
|
|
|-
| 0211
| [[#GPUREG_ATTRIBBUFFERi_CONFIG2|GPUREG_ATTRIBBUFFER4_CONFIG2]]
|
|
|-
| 0212
| [[#GPUREG_ATTRIBBUFFERi_OFFSET|GPUREG_ATTRIBBUFFER5_OFFSET]]
|
|
|-
| 0213
| [[#GPUREG_ATTRIBBUFFERi_CONFIG1|GPUREG_ATTRIBBUFFER5_CONFIG1]]
|
|
|-
| 0214
| [[#GPUREG_ATTRIBBUFFERi_CONFIG2|GPUREG_ATTRIBBUFFER5_CONFIG2]]
|
|
|-
| 0215
| [[#GPUREG_ATTRIBBUFFERi_OFFSET|GPUREG_ATTRIBBUFFER6_OFFSET]]
|
|
|-
| 0216
| [[#GPUREG_ATTRIBBUFFERi_CONFIG1|GPUREG_ATTRIBBUFFER6_CONFIG1]]
|
|
|-
| 0217
| [[#GPUREG_ATTRIBBUFFERi_CONFIG2|GPUREG_ATTRIBBUFFER6_CONFIG2]]
|
|
|-
| 0218
| [[#GPUREG_ATTRIBBUFFERi_OFFSET|GPUREG_ATTRIBBUFFER7_OFFSET]]
|
|
|-
| 0219
| [[#GPUREG_ATTRIBBUFFERi_CONFIG1|GPUREG_ATTRIBBUFFER7_CONFIG1]]
|
|
|-
| 021A
| [[#GPUREG_ATTRIBBUFFERi_CONFIG2|GPUREG_ATTRIBBUFFER7_CONFIG2]]
|
|
|-
| 021B
| [[#GPUREG_ATTRIBBUFFERi_OFFSET|GPUREG_ATTRIBBUFFER8_OFFSET]]
|
|
|-
| 021C
| [[#GPUREG_ATTRIBBUFFERi_CONFIG1|GPUREG_ATTRIBBUFFER8_CONFIG1]]
|
|
|-
| 021D
| [[#GPUREG_ATTRIBBUFFERi_CONFIG2|GPUREG_ATTRIBBUFFER8_CONFIG2]]
|
|
|-
| 021E
| [[#GPUREG_ATTRIBBUFFERi_OFFSET|GPUREG_ATTRIBBUFFER9_OFFSET]]
|
|
|-
| 021F
| [[#GPUREG_ATTRIBBUFFERi_CONFIG1|GPUREG_ATTRIBBUFFER9_CONFIG1]]
|
|
|-
| 0220
| [[#GPUREG_ATTRIBBUFFERi_CONFIG2|GPUREG_ATTRIBBUFFER9_CONFIG2]]
|
|
|-
| 0221
| [[#GPUREG_ATTRIBBUFFERi_OFFSET|GPUREG_ATTRIBBUFFER10_OFFSET]]
|
|
|-
| 0222
| [[#GPUREG_ATTRIBBUFFERi_CONFIG1|GPUREG_ATTRIBBUFFER10_CONFIG1]]
|
|
|-
| 0223
| [[#GPUREG_ATTRIBBUFFERi_CONFIG2|GPUREG_ATTRIBBUFFER10_CONFIG2]]
|
|
|-
| 0224
| [[#GPUREG_ATTRIBBUFFERi_OFFSET|GPUREG_ATTRIBBUFFER11_OFFSET]]
|
|
|-
| 0225
| [[#GPUREG_ATTRIBBUFFERi_CONFIG1|GPUREG_ATTRIBBUFFER11_CONFIG1]]
|
|
|-
| 0226
| [[#GPUREG_ATTRIBBUFFERi_CONFIG2|GPUREG_ATTRIBBUFFER11_CONFIG2]]
|
|
|-
| 0227
| [[#GPUREG_INDEXBUFFER_CONFIG|GPUREG_INDEXBUFFER_CONFIG]]
|
|PICA_REG_INDEX_ARRAY_ADDR_OFFSET
|-
| 0228
| [[#GPUREG_NUMVERTICES|GPUREG_NUMVERTICES]]
|
|PICA_REG_DRAW_VERTEX_NUM
|-
| 0229
| [[#GPUREG_GEOSTAGE_CONFIG|GPUREG_GEOSTAGE_CONFIG]]
| ?
|PICA_REG_DRAW_MODE0
|-
| 022A
| [[#GPUREG_VERTEX_OFFSET|GPUREG_VERTEX_OFFSET]]
|
|PICA_REG_DRAW_VERTEX_OFFSET
|-
| 022B
| [[#GPUREG_022B|GPUREG_022B]]
|
|
|-
| 022C
| [[#GPUREG_022C|GPUREG_022C]]
|
|
|-
| 022D
| [[#GPUREG_POST_VERTEX_CACHE_NUM|GPUREG_POST_VERTEX_CACHE_NUM]]
|
|PICA_REG_POST_VERTEX_CACHE_NUM
|-
| 022E
| [[#GPUREG_DRAWARRAYS|GPUREG_DRAWARRAYS]]
|
|PICA_REG_START_DRAW_ARRAY
|-
| 022F
| [[#GPUREG_DRAWELEMENTS|GPUREG_DRAWELEMENTS]]
|
|PICA_REG_START_DRAW_ELEMENT
|-
| 0230
| [[#GPUREG_0230|GPUREG_0230]]
|
|
|-
| 0231
| [[#GPUREG_VTX_FUNC|GPUREG_VTX_FUNC]]
|?
|PICA_REG_VTX_FUNC
|-
| 0232
| [[#GPUREG_FIXEDATTRIB_INDEX|GPUREG_FIXEDATTRIB_INDEX]]
|?
|PICA_REG_VS_FIXED_ATTR
|-
| 0233
| [[#GPUREG_FIXEDATTRIB_DATAi|GPUREG_FIXEDATTRIB_DATA0]]
|?
|PICA_REG_VS_FIXED_ATTR_DATA0
|-
| 0234
| [[#GPUREG_FIXEDATTRIB_DATAi|GPUREG_FIXEDATTRIB_DATA1]]
|?
|PICA_REG_VS_FIXED_ATTR_DATA1
|-
| 0235
| [[#GPUREG_FIXEDATTRIB_DATAi|GPUREG_FIXEDATTRIB_DATA2]]
|?
|PICA_REG_VS_FIXED_ATTR_DATA2
|-
| 0236
| [[#GPUREG_0236|GPUREG_0236]]
|
|
|-
| 0237
| [[#GPUREG_0237|GPUREG_0237]]
|
|
|-
| 0238
| [[#GPUREG_CMDBUF_SIZE0|GPUREG_CMDBUF_SIZE0]]
|
|PICA_REG_COMMAND_BUF_SIZE_CH0
|-
| 0239
| [[#GPUREG_CMDBUF_SIZE1|GPUREG_CMDBUF_SIZE1]]
|
|PICA_REG_COMMAND_BUF_SIZE_CH1
|-
| 023A
| [[#GPUREG_CMDBUF_ADDR0|GPUREG_CMDBUF_ADDR0]]
|
|PICA_REG_COMMAND_BUF_ADDR_CH0
|-
| 023B
| [[#GPUREG_CMDBUF_ADDR1|GPUREG_CMDBUF_ADDR1]]
|
|PICA_REG_COMMAND_BUF_ADDR_CH1
|-
| 023C
| [[#GPUREG_CMDBUF_JUMP0|GPUREG_CMDBUF_JUMP0]]
|
|PICA_REG_COMMAND_BUF_KICK_CH0
|-
| 023D
| [[#GPUREG_CMDBUF_JUMP1|GPUREG_CMDBUF_JUMP1]]
|
|PICA_REG_COMMAND_BUF_KICK_CH1
|-
| 023E
| [[#GPUREG_023E|GPUREG_023E]]
|
|
|-
| 023F
| [[#GPUREG_023F|GPUREG_023F]]
|
|
|-
| 0240
| [[#GPUREG_0240|GPUREG_0240]]
|
|
|-
| 0241
| [[#GPUREG_0241|GPUREG_0241]]
|
|
|-
| 0242
| [[#GPUREG_VSH_NUM_ATTR|GPUREG_VSH_NUM_ATTR]]
|?
|PICA_REG_VS_ATTR_NUM1
|-
| 0243
| [[#GPUREG_0243|GPUREG_0243]]
|
|
|-
| 0244
| [[#GPUREG_VSH_COM_MODE|GPUREG_VSH_COM_MODE]]
|?
|PICA_REG_VS_COM_MODE
|-
| 0245
| [[#GPUREG_START_DRAW_FUNC0|GPUREG_START_DRAW_FUNC0]]
|?
|PICA_REG_START_DRAW_FUNC0
|-
| 0246
| [[#GPUREG_0246|GPUREG_0246]]
|
|
|-
| 0247
| [[#GPUREG_0247|GPUREG_0247]]
|
|
|-
| 0248
| [[#GPUREG_0248|GPUREG_0248]]
|
|
|-
| 0249
| [[#GPUREG_0249|GPUREG_0249]]
|
|
|-
| 024A
| [[#GPUREG_VSH_OUTMAP_TOTAL1|GPUREG_VSH_OUTMAP_TOTAL1]]
|?
|PICA_REG_VS_OUT_REG_NUM1
|-
| 024B
| [[#GPUREG_024B|GPUREG_024B]]
|
|
|-
| 024C
| [[#GPUREG_024C|GPUREG_024C]]
|
|
|-
| 024D
| [[#GPUREG_024D|GPUREG_024D]]
|
|
|-
| 024E
| [[#GPUREG_024E|GPUREG_024E]]
|
|
|-
| 024F
| [[#GPUREG_024F|GPUREG_024F]]
|
|
|-
| 0250
| [[#GPUREG_0250|GPUREG_0250]]
|
|
|-
| 0251
| [[#GPUREG_VSH_OUTMAP_TOTAL2|GPUREG_VSH_OUTMAP_TOTAL2]]
|?
|PICA_REG_VS_OUT_REG_NUM2
|-
| 0252
| [[#GPUREG_GSH_MISC0|GPUREG_GSH_MISC0]]
|?
|PICA_REG_GS_MISC_REG0
|-
| 0253
| [[#GPUREG_GEOSTAGE_CONFIG2|GPUREG_GEOSTAGE_CONFIG2]]
|?
|PICA_REG_DRAW_MODE1
|-
| 0254
| [[#GPUREG_GSH_MISC1|GPUREG_GSH_MISC1]]
|?
|PICA_REG_GS_MISC_REG1
|-
| 0255
| [[#GPUREG_0255|GPUREG_0255]]
|
|
|-
| 0256
| [[#GPUREG_0256|GPUREG_0256]]
|
|
|-
| 0257
| [[#GPUREG_0257|GPUREG_0257]]
|
|
|-
| 0258
| [[#GPUREG_0258|GPUREG_0258]]
|
|
|-
| 0259
| [[#GPUREG_0259|GPUREG_0259]]
|
|
|-
| 025A
| [[#GPUREG_025A|GPUREG_025A]]
|
|
|-
| 025B
| [[#GPUREG_025B|GPUREG_025B]]
|
|
|-
| 025C
| [[#GPUREG_025C|GPUREG_025C]]
|
|
|-
| 025D
| [[#GPUREG_025D|GPUREG_025D]]
|
|
|-
| 025E
| [[#GPUREG_PRIMITIVE_CONFIG|GPUREG_PRIMITIVE_CONFIG]]
| ?
|PICA_REG_GS_OUT_REG_NUM3 / PICA_REG_DRAW_MODE2 / PICA_REG_VS_OUT_REG_NUM3
|-
| 025F
| [[#GPUREG_RESTART_PRIMITIVE|GPUREG_RESTART_PRIMITIVE]]
|?
|PICA_REG_START_DRAW_FUNC1
|-
| 0260
| [[#GPUREG_0260|GPUREG_0260]]
|
|
|-
| 0261
| [[#GPUREG_0261|GPUREG_0261]]
|
|
|-
| 0262
| [[#GPUREG_0262|GPUREG_0262]]
|
|
|-
| 0263
| [[#GPUREG_0263|GPUREG_0263]]
|
|
|-
| 0264
| [[#GPUREG_0264|GPUREG_0264]]
|
|
|-
| 0265
| [[#GPUREG_0265|GPUREG_0265]]
|
|
|-
| 0266
| [[#GPUREG_0266|GPUREG_0266]]
|
|
|-
| 0267
| [[#GPUREG_0267|GPUREG_0267]]
|
|
|-
| 0268
| [[#GPUREG_0268|GPUREG_0268]]
|
|
|-
| 0269
| [[#GPUREG_0269|GPUREG_0269]]
|
|
|-
| 026A
| [[#GPUREG_026A|GPUREG_026A]]
|
|
|-
| 026B
| [[#GPUREG_026B|GPUREG_026B]]
|
|
|-
| 026C
| [[#GPUREG_026C|GPUREG_026C]]
|
|
|-
| 026D
| [[#GPUREG_026D|GPUREG_026D]]
|
|
|-
| 026E
| [[#GPUREG_026E|GPUREG_026E]]
|
|
|-
| 026F
| [[#GPUREG_026F|GPUREG_026F]]
|
|
|-
| 0270
| [[#GPUREG_0270|GPUREG_0270]]
|
|
|-
| 0271
| [[#GPUREG_0271|GPUREG_0271]]
|
|
|-
| 0272
| [[#GPUREG_0272|GPUREG_0272]]
|
|
|-
| 0273
| [[#GPUREG_0273|GPUREG_0273]]
|
|
|-
| 0274
| [[#GPUREG_0274|GPUREG_0274]]
|
|
|-
| 0275
| [[#GPUREG_0275|GPUREG_0275]]
|
|
|-
| 0276
| [[#GPUREG_0276|GPUREG_0276]]
|
|
|-
| 0277
| [[#GPUREG_0277|GPUREG_0277]]
|
|
|-
| 0278
| [[#GPUREG_0278|GPUREG_0278]]
|
|
|-
| 0279
| [[#GPUREG_0279|GPUREG_0279]]
|
|
|-
| 027A
| [[#GPUREG_027A|GPUREG_027A]]
|
|
|-
| 027B
| [[#GPUREG_027B|GPUREG_027B]]
|
|
|-
| 027C
| [[#GPUREG_027C|GPUREG_027C]]
|
|
|-
| 027D
| [[#GPUREG_027D|GPUREG_027D]]
|
|
|-
| 027E
| [[#GPUREG_027E|GPUREG_027E]]
|
|
|-
| 027F
| [[#GPUREG_027F|GPUREG_027F]]
|
|
|}

=== Shader registers (0x280-0x2DF) ===

{| class="wikitable" border="1"
! Register ID
! Register name
! Notes
! Official Name
|-
! colspan=4 | Geometry shader
|-
| 0280
| [[#GPUREG_SH_BOOLUNIFORM|GPUREG_GSH_BOOLUNIFORM]]
|
|PICA_REG_GS_BOOL
|-
| 0281
| [[#GPUREG_SH_INTUNIFORM_Ii|GPUREG_GSH_INTUNIFORM_I0]]
|
|PICA_REG_GS_INT0
|-
| 0282
| [[#GPUREG_SH_INTUNIFORM_Ii|GPUREG_GSH_INTUNIFORM_I1]]
|
|PICA_REG_GS_INT1
|-
| 0283
| [[#GPUREG_SH_INTUNIFORM_Ii|GPUREG_GSH_INTUNIFORM_I2]]
|
|PICA_REG_GS_INT2
|-
| 0284
| [[#GPUREG_SH_INTUNIFORM_Ii|GPUREG_GSH_INTUNIFORM_I3]]
|
|PICA_REG_GS_INT3
|-
| 0285
| [[#GPUREG_0285|GPUREG_0285]]
|
|
|-
| 0286
| [[#GPUREG_0286|GPUREG_0286]]
|
|
|-
| 0287
| [[#GPUREG_0287|GPUREG_0287]]
|
|
|-
| 0288
| [[#GPUREG_0288|GPUREG_0288]]
|
|
|-
| 0289
| [[#GPUREG_SH_INPUTBUFFER_CONFIG|GPUREG_GSH_INPUTBUFFER_CONFIG]]
|
|PICA_REG_GS_ATTR_NUM
|-
| 028A
| [[#GPUREG_SH_ENTRYPOINT|GPUREG_GSH_ENTRYPOINT]]
|
|PICA_REG_GS_START_ADDR
|-
| 028B
| [[#GPUREG_SH_ATTRIBUTES_PERMUTATION_LOW|GPUREG_GSH_ATTRIBUTES_PERMUTATION_LOW]]
|
|PICA_REG_GS_ATTR_IN_REG_MAP0
|-
| 028C
| [[#GPUREG_SH_ATTRIBUTES_PERMUTATION_HIGH|GPUREG_GSH_ATTRIBUTES_PERMUTATION_HIGH]]
|
|PICA_REG_GS_ATTR_IN_REG_MAP1
|-
| 028D
| [[#GPUREG_SH_OUTMAP_MASK|GPUREG_GSH_OUTMAP_MASK]]
|
|PICA_REG_GS_OUT_REG_MASK
|-
| 028E
| [[#GPUREG_028E|GPUREG_028E]]
|
|
|-
| 028F
| [[#GPUREG_SH_CODETRANSFER_END|GPUREG_GSH_CODETRANSFER_END]]
|
|PICA_REG_GS_PROG_RENEWAL_END
|-
| 0290
| [[#GPUREG_SH_FLOATUNIFORM_INDEX|GPUREG_GSH_FLOATUNIFORM_INDEX]]
|
|PICA_REG_GS_FLOAT_ADDR
|-
| 0291
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_GSH_FLOATUNIFORM_DATA0]]
|
|PICA_REG_GS_FLOAT_DATA0
|-
| 0292
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_GSH_FLOATUNIFORM_DATA1]]
|
|PICA_REG_GS_FLOAT_DATA1
|-
| 0293
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_GSH_FLOATUNIFORM_DATA2]]
|
|PICA_REG_GS_FLOAT_DATA2
|-
| 0294
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_GSH_FLOATUNIFORM_DATA3]]
|
|PICA_REG_GS_FLOAT_DATA3
|-
| 0295
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_GSH_FLOATUNIFORM_DATA4]]
|
|PICA_REG_GS_FLOAT_DATA4
|-
| 0296
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_GSH_FLOATUNIFORM_DATA5]]
|
|PICA_REG_GS_FLOAT_DATA5
|-
| 0297
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_GSH_FLOATUNIFORM_DATA6]]
|
|PICA_REG_GS_FLOAT_DATA6
|-
| 0298
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_GSH_FLOATUNIFORM_DATA7]]
|
|PICA_REG_GS_FLOAT_DATA7
|-
| 0299
| [[#GPUREG_0299|GPUREG_0299]]
|
|
|-
| 029A
| [[#GPUREG_029A|GPUREG_029A]]
|
|
|-
| 029B
| [[#GPUREG_SH_CODETRANSFER_INDEX|GPUREG_GSH_CODETRANSFER_INDEX]]
| ?
|PICA_REG_GS_PROG_ADDR
|-
| 029C
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_GSH_CODETRANSFER_DATA0]]
|
|PICA_REG_GS_PROG_DATA0
|-
| 029D
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_GSH_CODETRANSFER_DATA1]]
|
|PICA_REG_GS_PROG_DATA1
|-
| 029E
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_GSH_CODETRANSFER_DATA2]]
|
|PICA_REG_GS_PROG_DATA2
|-
| 029F
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_GSH_CODETRANSFER_DATA3]]
|
|PICA_REG_GS_PROG_DATA3
|-
| 02A0
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_GSH_CODETRANSFER_DATA4]]
|
|PICA_REG_GS_PROG_DATA4
|-
| 02A1
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_GSH_CODETRANSFER_DATA5]]
|
|PICA_REG_GS_PROG_DATA5
|-
| 02A2
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_GSH_CODETRANSFER_DATA6]]
|
|PICA_REG_GS_PROG_DATA6
|-
| 02A3
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_GSH_CODETRANSFER_DATA7]]
|
|PICA_REG_GS_PROG_DATA7
|-
| 02A4
| [[#GPUREG_02A4|GPUREG_02A4]]
|
|
|-
| 02A5
| [[#GPUREG_SH_OPDESCS_INDEX|GPUREG_GSH_OPDESCS_INDEX]]
|
|PICA_REG_GS_PROG_SWIZZLE_ADDR
|-
| 02A6
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_GSH_OPDESCS_DATA0]]
|
|PICA_REG_GS_PROG_SWIZZLE_DATA0
|-
| 02A7
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_GSH_OPDESCS_DATA1]]
|
|PICA_REG_GS_PROG_SWIZZLE_DATA1
|-
| 02A8
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_GSH_OPDESCS_DATA2]]
|
|PICA_REG_GS_PROG_SWIZZLE_DATA2
|-
| 02A9
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_GSH_OPDESCS_DATA3]]
|
|PICA_REG_GS_PROG_SWIZZLE_DATA3
|-
| 02AA
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_GSH_OPDESCS_DATA4]]
|
|PICA_REG_GS_PROG_SWIZZLE_DATA4
|-
| 02AB
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_GSH_OPDESCS_DATA5]]
|
|PICA_REG_GS_PROG_SWIZZLE_DATA5
|-
| 02AC
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_GSH_OPDESCS_DATA6]]
|
|PICA_REG_GS_PROG_SWIZZLE_DATA6
|-
| 02AD
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_GSH_OPDESCS_DATA7]]
|
|PICA_REG_GS_PROG_SWIZZLE_DATA7
|-
| 02AE
| [[#GPUREG_02AE|GPUREG_02AE]]
|
|
|-
| 02AF
| [[#GPUREG_02AF|GPUREG_02AF]]
|
|
|-
! colspan=4 | Vertex shader
|-
| 02B0
| [[#GPUREG_SH_BOOLUNIFORM|GPUREG_VSH_BOOLUNIFORM]]
|
|PICA_REG_VS_BOOL
|-
| 02B1
| [[#GPUREG_SH_INTUNIFORM_Ii|GPUREG_VSH_INTUNIFORM_I0]]
|
|PICA_REG_VS_INT0
|-
| 02B2
| [[#GPUREG_SH_INTUNIFORM_Ii|GPUREG_VSH_INTUNIFORM_I1]]
|
|PICA_REG_VS_INT1
|-
| 02B3
| [[#GPUREG_SH_INTUNIFORM_Ii|GPUREG_VSH_INTUNIFORM_I2]]
|
|PICA_REG_VS_INT2
|-
| 02B4
| [[#GPUREG_SH_INTUNIFORM_Ii|GPUREG_VSH_INTUNIFORM_I3]]
|
|PICA_REG_VS_INT3
|-
| 02B5
| [[#GPUREG_02B5|GPUREG_02B5]]
|
|
|-
| 02B6
| [[#GPUREG_02B6|GPUREG_02B6]]
|
|
|-
| 02B7
| [[#GPUREG_02B7|GPUREG_02B7]]
|
|
|-
| 02B8
| [[#GPUREG_02B8|GPUREG_02B8]]
|
|
|-
| 02B9
| [[#GPUREG_SH_INPUTBUFFER_CONFIG|GPUREG_VSH_INPUTBUFFER_CONFIG]]
|
|PICA_REG_VS_ATTR_NUM0
|-
| 02BA
| [[#GPUREG_SH_ENTRYPOINT|GPUREG_VSH_ENTRYPOINT]]
|
|PICA_REG_VS_START_ADDR
|-
| 02BB
| [[#GPUREG_SH_ATTRIBUTES_PERMUTATION_LOW|GPUREG_VSH_ATTRIBUTES_PERMUTATION_LOW]]
|
|PICA_REG_VS_ATTR_IN_REG_MAP0
|-
| 02BC
| [[#GPUREG_SH_ATTRIBUTES_PERMUTATION_HIGH|GPUREG_VSH_ATTRIBUTES_PERMUTATION_HIGH]]
|
|PICA_REG_VS_ATTR_IN_REG_MAP1
|-
| 02BD
| [[#GPUREG_SH_OUTMAP_MASK|GPUREG_VSH_OUTMAP_MASK]]
|
|PICA_REG_VS_OUT_REG_MASK
|-
| 02BE
| [[#GPUREG_02BE|GPUREG_02BE]]
|
|
|-
| 02BF
| [[#GPUREG_SH_CODETRANSFER_END|GPUREG_VSH_CODETRANSFER_END]]
|
|PICA_REG_VS_PROG_RENEWAL_END
|-
| 02C0
| [[#GPUREG_SH_FLOATUNIFORM_INDEX|GPUREG_VSH_FLOATUNIFORM_INDEX]]
|
|PICA_REG_VS_FLOAT_ADDR
|-
| 02C1
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_VSH_FLOATUNIFORM_DATA0]]
|
|PICA_REG_VS_FLOAT_DATA0
|-
| 02C2
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_VSH_FLOATUNIFORM_DATA1]]
|
|PICA_REG_VS_FLOAT_DATA1
|-
| 02C3
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_VSH_FLOATUNIFORM_DATA2]]
|
|PICA_REG_VS_FLOAT_DATA2
|-
| 02C4
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_VSH_FLOATUNIFORM_DATA3]]
|
|PICA_REG_VS_FLOAT_DATA3
|-
| 02C5
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_VSH_FLOATUNIFORM_DATA4]]
|
|PICA_REG_VS_FLOAT_DATA4
|-
| 02C6
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_VSH_FLOATUNIFORM_DATA5]]
|
|PICA_REG_VS_FLOAT_DATA5
|-
| 02C7
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_VSH_FLOATUNIFORM_DATA6]]
|
|PICA_REG_VS_FLOAT_DATA6
|-
| 02C8
| [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_VSH_FLOATUNIFORM_DATA7]]
|
|PICA_REG_VS_FLOAT_DATA7
|-
| 02C9
| [[#GPUREG_02C9|GPUREG_02C9]]
|
|
|-
| 02CA
| [[#GPUREG_02CA|GPUREG_02CA]]
|
|
|-
| 02CB
| [[#GPUREG_SH_CODETRANSFER_INDEX|GPUREG_VSH_CODETRANSFER_INDEX]]
| ?
|PICA_REG_VS_PROG_ADDR
|-
| 02CC
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_VSH_CODETRANSFER_DATA0]]
|
|PICA_REG_VS_PROG_DATA0
|-
| 02CD
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_VSH_CODETRANSFER_DATA1]]
|
|PICA_REG_VS_PROG_DATA1
|-
| 02CE
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_VSH_CODETRANSFER_DATA2]]
|
|PICA_REG_VS_PROG_DATA2
|-
| 02CF
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_VSH_CODETRANSFER_DATA3]]
|
|PICA_REG_VS_PROG_DATA3
|-
| 02D0
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_VSH_CODETRANSFER_DATA4]]
|
|PICA_REG_VS_PROG_DATA4
|-
| 02D1
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_VSH_CODETRANSFER_DATA5]]
|
|PICA_REG_VS_PROG_DATA5
|-
| 02D2
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_VSH_CODETRANSFER_DATA6]]
|
|PICA_REG_VS_PROG_DATA6
|-
| 02D3
| [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_VSH_CODETRANSFER_DATA7]]
|
|PICA_REG_VS_PROG_DATA7
|-
| 02D4
| [[#GPUREG_02D4|GPUREG_02D4]]
|
|
|-
| 02D5
| [[#GPUREG_SH_OPDESCS_INDEX|GPUREG_VSH_OPDESCS_INDEX]]
| ?
|PICA_REG_VS_PROG_SWIZZLE_ADDR
|-
| 02D6
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_VSH_OPDESCS_DATA0]]
|
|PICA_REG_VS_PROG_SWIZZLE_DATA0
|-
| 02D7
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_VSH_OPDESCS_DATA1]]
|
|PICA_REG_VS_PROG_SWIZZLE_DATA1
|-
| 02D8
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_VSH_OPDESCS_DATA2]]
|
|PICA_REG_VS_PROG_SWIZZLE_DATA2
|-
| 02D9
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_VSH_OPDESCS_DATA3]]
|
|PICA_REG_VS_PROG_SWIZZLE_DATA3
|-
| 02DA
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_VSH_OPDESCS_DATA4]]
|
|PICA_REG_VS_PROG_SWIZZLE_DATA4
|-
| 02DB
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_VSH_OPDESCS_DATA5]]
|
|PICA_REG_VS_PROG_SWIZZLE_DATA5
|-
| 02DC
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_VSH_OPDESCS_DATA6]]
|
|PICA_REG_VS_PROG_SWIZZLE_DATA6
|-
| 02DD
| [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_VSH_OPDESCS_DATA7]]
|
|PICA_REG_VS_PROG_SWIZZLE_DATA7
|-
| 02DE
| [[#GPUREG_02DE|GPUREG_02DE]]
|
|
|-
| 02DF
| [[#GPUREG_02DF|GPUREG_02DF]]
|
|
|}

=== Unknown registers (0x2E0-0x2FF) ===

{| class="wikitable" border="1"
! Register ID
! Register name
! Notes
! Official Name
|-
| 02E0
| [[#GPUREG_02E0|GPUREG_02E0]]
|
|
|-
| 02E1
| [[#GPUREG_02E1|GPUREG_02E1]]
|
|
|-
| 02E2
| [[#GPUREG_02E2|GPUREG_02E2]]
|
|
|-
| 02E3
| [[#GPUREG_02E3|GPUREG_02E3]]
|
|
|-
| 02E4
| [[#GPUREG_02E4|GPUREG_02E4]]
|
|
|-
| 02E5
| [[#GPUREG_02E5|GPUREG_02E5]]
|
|
|-
| 02E6
| [[#GPUREG_02E6|GPUREG_02E6]]
|
|
|-
| 02E7
| [[#GPUREG_02E7|GPUREG_02E7]]
|
|
|-
| 02E8
| [[#GPUREG_02E8|GPUREG_02E8]]
|
|
|-
| 02E9
| [[#GPUREG_02E9|GPUREG_02E9]]
|
|
|-
| 02EA
| [[#GPUREG_02EA|GPUREG_02EA]]
|
|
|-
| 02EB
| [[#GPUREG_02EB|GPUREG_02EB]]
|
|
|-
| 02EC
| [[#GPUREG_02EC|GPUREG_02EC]]
|
|
|-
| 02ED
| [[#GPUREG_02ED|GPUREG_02ED]]
|
|
|-
| 02EE
| [[#GPUREG_02EE|GPUREG_02EE]]
|
|
|-
| 02EF
| [[#GPUREG_02EF|GPUREG_02EF]]
|
|
|-
| 02F0
| [[#GPUREG_02F0|GPUREG_02F0]]
|
|
|-
| 02F1
| [[#GPUREG_02F1|GPUREG_02F1]]
|
|
|-
| 02F2
| [[#GPUREG_02F2|GPUREG_02F2]]
|
|
|-
| 02F3
| [[#GPUREG_02F3|GPUREG_02F3]]
|
|
|-
| 02F4
| [[#GPUREG_02F4|GPUREG_02F4]]
|
|
|-
| 02F5
| [[#GPUREG_02F5|GPUREG_02F5]]
|
|
|-
| 02F6
| [[#GPUREG_02F6|GPUREG_02F6]]
|
|
|-
| 02F7
| [[#GPUREG_02F7|GPUREG_02F7]]
|
|
|-
| 02F8
| [[#GPUREG_02F8|GPUREG_02F8]]
|
|
|-
| 02F9
| [[#GPUREG_02F9|GPUREG_02F9]]
|
|
|-
| 02FA
| [[#GPUREG_02FA|GPUREG_02FA]]
|
|
|-
| 02FB
| [[#GPUREG_02FB|GPUREG_02FB]]
|
|
|-
| 02FC
| [[#GPUREG_02FC|GPUREG_02FC]]
|
|
|-
| 02FD
| [[#GPUREG_02FD|GPUREG_02FD]]
|
|
|-
| 02FE
| [[#GPUREG_02FE|GPUREG_02FE]]
|
|
|-
| 02FF
| [[#GPUREG_02FF|GPUREG_02FF]]
|
|
|}

== Miscellaneous registers ==

=== GPUREG_FINALIZE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| unsigned, Trigger P3D Interrupt (0 = idle, non-zero = trigger)
|}

Writing to this register seems to signal the GPU to stop processing GPU commands from the current buffer; any command following a write to this register will be ignored. The value written to this register does not appear to matter, although 0x12345678 is the value typically written by commercial software.
Failure to write to this register in any command buffer will result in the GPU hanging.

== Rasterizer registers ==

=== GPUREG_FACECULLING_CONFIG ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| unsigned, Culling mode
|}

This register is used to configure the face culling mode.

Culling mode values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| None
|-
| 1
| Front Face (Counter Clockwise)
|-
| 2
| Back Face (Counter Clockwise)
|}

=== GPUREG_VIEWPORT_WIDTH ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| float1.7.16, width / 2
|}

This register is used to configure the viewport width, along with GPUREG_VIEWPORT_INVW.

=== GPUREG_VIEWPORT_INVW ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 1-31
| float1.7.23, 2 / width
|}

This register is used to configure the viewport width, along with GPUREG_VIEWPORT_WIDTH.

=== GPUREG_VIEWPORT_HEIGHT ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| float1.7.16, height / 2
|}

This register is used to configure the viewport height, along with GPUREG_VIEWPORT_INVH.

=== GPUREG_VIEWPORT_INVH ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 1-31
| float1.7.23, 2 / height
|}

This register is used to configure the viewport height, along with GPUREG_VIEWPORT_HEIGHT.

=== GPUREG_FRAGOP_CLIP ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Enabled (0 = disabled, 1 = enabled)
|}

This register is used to enable clipping planes.

=== GPUREG_FRAGOP_CLIP_DATA''i'' ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| float1.7.16, Clipping plane coefficient ''i''
|}

This register is used to configure clipping plane coefficients.

=== GPUREG_DEPTHMAP_SCALE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| float1.7.16, Near - Far
|}

This register is used to configure the depth range scale.

=== GPUREG_DEPTHMAP_OFFSET ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| float1.7.16, Near + Polygon Offset
|}

This register is used to configure the depth range bias.

=== GPUREG_SH_OUTMAP_TOTAL ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| unsigned, Number of following attributes
|}

This register is used to configure the total shader output map attributes.

=== GPUREG_SH_OUTMAP_O''i'' ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| unsigned, Semantic for the x component of the register.
|-
| 8-12
| unsigned, Semantic for the y component of the register.
|-
| 16-20
| unsigned, Semantic for the z component of the register.
|-
| 24-28
| unsigned, Semantic for the w component of the register.
|}

These registers map components of the corresponding vertex shader output register to specific fixed-function semantics.

Semantic values:

{| class="wikitable" border="1"
! Value
! Semantic
! Description
|-
| 0x00
| position.x
| rowspan="4" | Vertex Position
|-
| 0x01
| position.y
|-
| 0x02
| position.z
|-
| 0x03
| position.w
|-
| 0x04
| normquat.x
| rowspan="4" | Quaternion specifying the normal/tangent frame (for fragment lighting)
|-
| 0x05
| normquat.y
|-
| 0x06
| normquat.z
|-
| 0x07
| normquat.w
|-
| 0x08
| color.r
| rowspan="4" | Vertex color
|-
| 0x09
| color.g
|-
| 0x0A
| color.b
|-
| 0x0B
| color.a
|-
| 0x0C
| texcoord0.u
| rowspan="2" | Texture coordinates for texture 0
|-
| 0x0D
| texcoord0.v
|-
| 0x0E
| texcoord1.u
| rowspan="2" | Texture coordinates for texture 1
|-
| 0x0F
| texcoord1.v
|-
| 0x10
| texcoord0.w
|

|-
| 0x12
| view.x
| rowspan="3" | View vector (for fragment lighting)
|-
| 0x13
| view.y
|-
| 0x14
| view.z

|-
| 0x16
| texcoord2.u
| rowspan="2" | Texture coordinates for texture 2
|-
| 0x17
| texcoord2.v

|-
| 0x1F
| Unused component
| Should be set for unused components of the output register
|}

=== GPUREG_EARLYDEPTH_FUNC ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| unsigned, Early depth function
|}

This register configures the early depth test function.

Early depth function values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| >=
|-
| 1
| >
|-
| 2
| <=
|-
| 3
| <
|}

=== GPUREG_EARLYDEPTH_TEST1 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Enabled (0 = disabled, 1 = enabled)
|}

This register sets whether the early depth test is enabled.

=== GPUREG_EARLYDEPTH_CLEAR ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Trigger (0 = idle, 1 = clear)
|}

This register triggers clearing the early depth data.

=== GPUREG_SH_OUTATTR_MODE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Use texture coordinates (0 = don't use, 1 = use)
|}

This register is used to configure the shader output attribute mode.

=== GPUREG_SCISSORTEST_MODE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| unsigned, Enabled (0 = disabled, 3 = enabled)
|}

This register is used to enable scissor testing.

=== GPUREG_SCISSORTEST_POS ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| unsigned, X1
|-
| 16-25
| unsigned, Y1
|}

This register is used to configure the scissor test start position.

=== GPUREG_SCISSORTEST_DIM ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| unsigned, X2
|-
| 16-25
| unsigned, Y2
|}

This register is used to configure the scissor test end position.

=== GPUREG_VIEWPORT_XY ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-9
| signed, X
|-
| 16-25
| signed, Y
|}

This register is used to configure the viewport position.

=== GPUREG_EARLYDEPTH_DATA ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| unsigned, Clear value
|}

This register is used to configure the early depth clear value.

=== GPUREG_DEPTHMAP_ENABLE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Enabled (0 = disabled, 1 = enabled)
|}

This register is used to enable depth range.

=== GPUREG_RENDERBUF_DIM ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-10
| unsigned, Width
|-
| 12-21
| unsigned, Height - 1
|-
| 24
| 0x1
|}

This register is used to configure the output framebuffer dimensions.

=== GPUREG_SH_OUTATTR_CLOCK ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, 'position.z' present (0 = absent, 1 = present)
|-
| 1
| unsigned, 'color' component present (0 = absent, 1 = present)
|-
| 8
| unsigned, 'texcoord0' component present (0 = absent, 1 = present)
|-
| 9
| unsigned, 'texcoord1' component present (0 = absent, 1 = present)
|-
| 10
| unsigned, 'texcoord2' component present (0 = absent, 1 = present)
|-
| 16
| unsigned, 'texcoord0.w' present (0 = absent, 1 = present)
|-
| 24
| unsigned, 'normquat' or 'view' component present (0 = absent, 1 = present)
|}

This register controls the clock supply to parts relating to certain attributes.

== Texturing registers ==

=== GPUREG_TEXUNIT_CONFIG ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Texture 0 enabled (0 = disabled, 1 = enabled)
|-
| 1
| unsigned, Texture 1 enabled (0 = disabled, 1 = enabled)
|-
| 2
| unsigned, Texture 2 enabled (0 = disabled, 1 = enabled)
|-
| 3
| 0x0
|-
| 8-9
| unsigned, Texture 3 coordinates
|-
| 10
| unsigned, Texture 3 enabled (0 = disabled, 1 = enabled)
|-
| 12
| 0x1
|-
| 13
| unsigned, Texture 2 coordinates
|-
| 16
| unsigned, Clear texture cache (0 = don't clear, 1 = clear)
|-
| 17-31
| 0x0
|}

This register is used to enable texture units.

Texture 3 coordinates values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Texture 0
|-
| 1
| Texture 1
|-
| 2
| Texture 2
|}

Texture 2 coordinates values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Texture 2
|-
| 1
| Texture 1
|}

=== GPUREG_TEXUNIT''i''_BORDER_COLOR ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Red
|-
| 8-15
| unsigned, Green
|-
| 16-23
| unsigned, Blue
|-
| 24-31
| unsigned, Alpha
|}

This register is used to set a texture unit's border color.

=== GPUREG_TEXUNIT''i''_DIM ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-10
| unsigned, Height
|-
| 16-26
| unsigned, Width
|}

This register is used to set a texture unit's dimensions.

=== GPUREG_TEXUNIT''i''_PARAM ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| unsigned, Magnification filter
|-
| 2
| unsigned, Minification filter
|-
| 4-5
| unsigned, ETC1 (0 = not ETC1, 2 = ETC1) note: still 0 for ETC1A4
|-
| 8-10
| unsigned, Wrap T
|-
| 12-14
| unsigned, Wrap S
|-
| 16-17
| 0x0
|-
| 20
| unsigned, Shadow (Texture 0 only, 0 = not shadow, 1 = shadow)
|-
| 24
| unsigned, Mipmap filter
|-
| 28-30
| unsigned, Type (Texture 0 only)
|}

This register is used to set a texture unit's extra parameters.

Filter values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Nearest
|-
| 1
| Linear
|}

Wrap values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Clamp to edge
|-
| 1
| Clamp to border
|-
| 2
| Repeat
|-
| 3
| Mirrored repeat
|}

Type values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| 2D
|-
| 1
| Cube map
|-
| 2
| Shadow 2D
|-
| 3
| Projection
|-
| 4
| Shadow cube
|-
| 5
| Disabled
|}

=== GPUREG_TEXUNIT''i''_LOD ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-12
| fixed1.4.8, Bias
|-
| 16-19
| unsigned, Max Level
|-
| 24-27
| unsigned, Min Level
|}

This register is used to configure a texture unit's level of detail.

=== GPUREG_TEXUNIT''i''_ADDR''i'' ===

First ADDR register:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| unsigned, Texture physical address >> 3
|}

Subsequent ADDR registers:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-21
| unsigned, Texture physical address >> 3 (upper 6 bits reused from first ADDR register)
|}

This register is used to set a texture unit's physical address(es) in memory. Individual texels in a texture are laid out in memory as a [http://en.wikipedia.org/wiki/Z-order_curve Z-order curve]. Mipmap data is stored directly following the main texture data.

If the texture is a cube:

{| class="wikitable" border="1"
! Register
! Description
|-
| ADDR1
| Positive X
|-
| ADDR2
| Negative X
|-
| ADDR3
| Positive Y
|-
| ADDR4
| Negative Y
|-
| ADDR5
| Positive Z
|-
| ADDR6
| Negative Z
|}

Otherwise, ADDR(1) points to a 2D texture, and the rest are empty.

=== GPUREG_TEXUNIT''i''_SHADOW ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Perspective (0 = perspective, 1 = not perspective)
|-
| 1-23
| fixed0.0.24, Z bias (upper 23 bits)
|}

This register is used to set a texture unit's shadow texture properties.

=== GPUREG_TEXUNIT''i''_TYPE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Format
|}

This register is used to set a texture unit's data format.

Format values:

{| class="wikitable" border="1"
! Value
! Description
! GL Format
! GL Data Type
|-
| 0x0
| RGBA8888
| GL_RGBA
| GL_UNSIGNED_BYTE
|-
| 0x1
| RGB888
| GL_RGB
| GL_UNSIGNED_BYTE
|-
| 0x2
| RGBA5551
| GL_RGBA
| GL_UNSIGNED_SHORT_5_5_5_1
|-
| 0x3
| RGB565
| GL_RGB
| GL_UNSIGNED_SHORT_5_6_5
|-
| 0x4
| RGBA4444
| GL_RGBA
| GL_UNSIGNED_SHORT_4_4_4_4
|-
| 0x5
| IA8
| GL_LUMINANCE_ALPHA
| GL_UNSIGNED_BYTE
|-
| 0x6
| HILO8
|
|
|-
| 0x7
| I8
| GL_LUMINANCE
| GL_UNSIGNED_BYTE
|-
| 0x8
| A8
| GL_ALPHA
| GL_UNSIGNED_BYTE
|-
| 0x9
| IA44
| GL_LUMINANCE_ALPHA
| GL_UNSIGNED_BYTE_4_4_EXT
|-
| 0xA
| I4
|
|
|-
| 0xB
| A4
| GL_ALPHA
| GL_UNSIGNED_NIBBLE_EXT
|-
| 0xC
| ETC1
| GL_ETC1_RGB8_OES
|
|-
| 0xD
| ETC1A4
|
|
|}

=== GPUREG_LIGHTING_ENABLE0 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Enabled (0 = disabled, 1 = enabled)
|}

This register is used to enable lighting.

=== GPUREG_TEXUNIT3_PROCTEX0 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| unsigned, U-direction clamp
|-
| 3-5
| unsigned, V-direction clamp
|-
| 6-9
| unsigned, RGB mapping function
|-
| 10-13
| unsigned, Alpha mapping function
|-
| 14
| unsigned, Handle alpha separately (0 = don't separate, 1 = separate)
|-
| 15
| unsigned, Noise enabled (0 = disabled, 1 = enabled)
|-
| 16-17
| unsigned, U-direction shift
|-
| 18-19
| unsigned, V-direction shift
|-
| 20-27
| float1.5.10, Texture bias (lower 8 bits)
|}

This register is used to configure the procedural texture unit.

Clamp values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Clamp to zero
|-
| 1
| Clamp to edge
|-
| 2
| Symmetrical repeat
|-
| 3
| Mirrored repeat
|-
| 4
| Pulse
|}

Mapping function values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| U
|-
| 1
| U²
|-
| 2
| V
|-
| 3
| V²
|-
| 4
| (U + V) / 2
|-
| 5
| (U² + V²) / 2
|-
| 6
| sqrt(U² + V²)
|-
| 7
| Minimum
|-
| 8
| Maximum
|-
| 9
| Rmax
|}

Shift values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| None
|-
| 1
| Odd
|-
| 2
| Even
|}

=== GPUREG_TEXUNIT3_PROCTEX1 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| fixed1.3.12, U-direction noise amplitude
|-
| 16-31
| float1.5.10, U-direction noise phase
|}

This register is used to configure the procedural texture unit's U-direction noise amplitude/phase.

=== GPUREG_TEXUNIT3_PROCTEX2 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| fixed1.3.12, V-direction noise amplitude
|-
| 16-31
| float1.5.10, V-direction noise phase
|}

This register is used to configure the procedural texture unit's V-direction noise amplitude/phase.

=== GPUREG_TEXUNIT3_PROCTEX3 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| float1.5.10, U-direction noise frequency
|-
| 16-31
| float1.5.10, V-direction noise frequency
|}

This register is used to configure the procedural texture unit's U-direction and V-direction noise frequency.

=== GPUREG_TEXUNIT3_PROCTEX4 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| unsigned, Minification filter
|-
| 3-6
| Min LOD (usually 0)
|-
| 7-10
| Max LOD (usually 6)
|-
| 11-18
| unsigned, Texture width
|-
| 19-26
| float1.5.10, Texture bias (upper 8 bits)
|}

This register is used to configure the procedural texture unit.

Minification filter values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Nearest
|-
| 1
| Linear
|-
| 2
| Nearest, Mipmap Nearest
|-
| 3
| Linear, Mipmap Nearest
|-
| 4
| Nearest, Mipmap Linear
|-
| 5
| Linear, Mipmap Linear
|}

=== GPUREG_TEXUNIT3_PROCTEX5 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Texture offset (Mipmap level 0 / base level)
|-
| 8-15
| unsigned, mipmap level 1 offset (usually 0x80)
|-
| 16-23
| unsigned, mipmap level 2 offset (usually 0xC0)
|-
| 24-31
| unsigned, mipmap level 3 offset (usually 0xE0)
|}

This register is used to set the procedural texture unit's offset. Mipmap level 4-7 seems to be hardcoded at offset 0xF0, 0xF8, 0xFC and 0xFE .

=== GPUREG_PROCTEX_LUT ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Index
|-
| 8-11
| unsigned, Reference table
|}

This register is used to set which look-up table to write to, with GPUREG_PROCTEX_LUT_DATA''i'', at what index.

Reference table values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Noise table
|-
| 2
| RGB mapping function table
|-
| 3
| Alpha mapping function table
|-
| 4
| Color table
|-
| 5
| Color difference table
|}

=== GPUREG_PROCTEX_LUT_DATA''i'' ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| LUT data
|}

These registers behave as a FIFO queue. Each write to these registers writes the provided value to the table selected with GPUREG_PROCTEX_LUT, starting at the selected index.

==== Noise Table ====

128 elements:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| fixed0.0.12, Value
|-
| 12-23
| fixed0.0.12 with two's complement ( [0.5,1.0) mapped to [-1.0,0) ), Difference from next element
|}

==== RGB Mapping Function Table ====

128 elements:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| fixed0.0.12, Value
|-
| 12-23
| fixed0.0.12 with two's complement, Difference from next element
|}

==== Alpha Mapping Function Table ====

128 elements:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| fixed0.0.12, Value
|-
| 12-23
| fixed0.0.12 with two's complement, Difference from next element
|}

==== Color Table ====

256 elements:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Red
|-
| 8-15
| unsigned, Green
|-
| 16-23
| unsigned, Blue
|-
| 24-31
| unsigned, Alpha
|}

==== Color Difference Table ====

256 elements:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| signed, Half of red difference between current and next color table elements
|-
| 8-15
| signed, Half of green difference between current and next color table elements
|-
| 16-23
| signed, Half of blue difference between current and next color table elements
|-
| 24-31
| signed, Half of alpha difference between current and next color table elements
|}

=== GPUREG_TEXENV''i''_SOURCE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, RGB source 0
|-
| 4-7
| unsigned, RGB source 1
|-
| 8-11
| unsigned, RGB source 2
|-
| 16-19
| unsigned, Alpha source 0
|-
| 20-23
| unsigned, Alpha source 1
|-
| 24-27
| unsigned, Alpha source 2
|}

This register configures a texture combiner's sources.

Source values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Primary color
|-
| 1
| Fragment primary color
|-
| 2
| Fragment secondary color
|-
| 3
| Texture 0
|-
| 4
| Texture 1
|-
| 5
| Texture 2
|-
| 6
| Texture 3
|-
| 13
| Previous buffer
|-
| 14
| Constant (from GPUREG_TEXENV''i''_COLOR)
|-
| 15
| Previous
|}

=== GPUREG_TEXENV''i''_OPERAND ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, RGB operand 0
|-
| 4-7
| unsigned, RGB operand 1
|-
| 8-11
| unsigned, RGB operand 2
|-
| 12-14
| unsigned, Alpha operand 0
|-
| 16-18
| unsigned, Alpha operand 1
|-
| 20-22
| unsigned, Alpha operand 2
|}

This register configures a texture combiner's operands.

RGB operand values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Source color
|-
| 1
| One minus source color
|-
| 2
| Source alpha
|-
| 3
| One minus source alpha
|-
| 4
| Source red
|-
| 5
| One minus source red
|-
| 8
| Source green
|-
| 9
| One minus source green
|-
| 12
| Source blue
|-
| 13
| One minus source blue
|}

Alpha operand values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Source alpha
|-
| 1
| One minus source alpha
|-
| 2
| Source red
|-
| 3
| One minus source red
|-
| 4
| Source green
|-
| 5
| One minus source green
|-
| 6
| Source blue
|-
| 7
| One minus source blue
|}

=== GPUREG_TEXENV''i''_COMBINER ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, RGB combine
|-
| 16-19
| unsigned, Alpha combine
|}

This register configures a texture combiner's combine mode.

Combine values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Replace
|-
| 1
| Modulate
|-
| 2
| Add
|-
| 3
| Add signed
|-
| 4
| Interpolate
|-
| 5
| Subtract
|-
| 6
| Dot3 RGB
|-
| 7
| Dot3 RGBA
|-
| 8
| Multiply then add
|-
| 9
| Add then multiply
|}

=== GPUREG_TEXENV''i''_COLOR ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Red
|-
| 8-15
| unsigned, Green
|-
| 16-23
| unsigned, Blue
|-
| 24-31
| unsigned, Alpha
|}

This register configures a texture combiner's constant color.

=== GPUREG_TEXENV''i''_SCALE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| unsigned, RGB scale
|-
| 16-17
| unsigned, Alpha scale
|}

This register configures a texture combiner's scale value.

Scale values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| 1x
|-
| 1
| 2x
|-
| 2
| 4x
|}

=== GPUREG_TEXENV_UPDATE_BUFFER ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| unsigned, Fog mode
|-
| 3
| unsigned, Shading density source
|-
| 8
| unsigned, TexEnv 1 RGB buffer input
|-
| 9
| unsigned, TexEnv 2 RGB buffer input
|-
| 10
| unsigned, TexEnv 3 RGB buffer input
|-
| 11
| unsigned, TexEnv 4 RGB buffer input
|-
| 12
| unsigned, TexEnv 1 alpha buffer input
|-
| 13
| unsigned, TexEnv 2 alpha buffer input
|-
| 14
| unsigned, TexEnv 3 alpha buffer input
|-
| 15
| unsigned, TexEnv 4 alpha buffer input
|-
| 16
| unsigned, Z flip (0 = don't flip, 1 = flip)
|-
| 24-25
| 0x0
|}

This register is shared between the gas/fog mode configuration and texture combiner buffer inputs. Texture combiner buffer inputs are typically written with a mask of 0x2, and the gas/fog mode configuration is typically written with a mask of 0x5.

Fog mode values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Disabled
|-
| 5
| Fog
|-
| 7
| Gas
|}

Shading density source values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Plain density
|-
| 1
| Depth density
|}

Buffer input values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Previous buffer
|-
| 1
| Previous
|}

=== GPUREG_FOG_COLOR ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Red
|-
| 8-15
| unsigned, Green
|-
| 16-23
| unsigned, Blue
|}

This register is used to configure the color of fog.

=== GPUREG_GAS_ATTENUATION ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| float1.5.10, Gas density attenuation
|}

This register is used to configure the gas density attenuation.

=== GPUREG_GAS_ACCMAX ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| float1.5.10, Gas maximum density accumulation
|}

This register is used to configure the gas maximum density accumulation.

=== GPUREG_FOG_LUT_INDEX ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| unsigned, Index
|}

This register is used to set what index to write to with GPUREG_FOG_LUT_DATA''i''.

=== GPUREG_FOG_LUT_DATA''i'' ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| LUT data
|}

These registers behave as a FIFO queue. Each write to these registers writes the provided value to the fog look-up table, starting at the index selected with GPUREG_FOG_LUT_INDEX.

==== Fog Look-Up Table ====

128 elements:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-12
| fixed1.1.11, Difference from next element
|-
| 13-23
| fixed0.0.11, Value
|}

=== GPUREG_TEXENV_BUFFER_COLOR ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Red
|-
| 8-15
| unsigned, Green
|-
| 16-23
| unsigned, Blue
|-
| 24-31
| unsigned, Alpha
|}

This register is used to configure the texture combiner buffer color.

== Framebuffer registers ==

=== GPUREG_COLOR_OPERATION ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| unsigned, Fragment operation mode
|-
| 8
| unsigned, Blend mode
|-
| 16-25
| 0x0E4
|}

This register is used to configure the fragment operation mode and whether to use logic ops or blending.

Fragment operation mode values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Default
|-
| 1
| Gas
|-
| 3
| Shadow
|}

Blend mode values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Logic op
|-
| 1
| Blend
|}

=== GPUREG_BLEND_FUNC ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| unsigned, RGB equation
|-
| 8-10
| unsigned, Alpha equation
|-
| 16-19
| unsigned, RGB source function
|-
| 20-23
| unsigned, RGB destination function
|-
| 24-27
| unsigned, Alpha source function
|-
| 28-31
| unsigned, Alpha destination function
|}

This register is used to configure the blending function.

'''Equation values:'''

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Add
|-
| 1
| Subtract
|-
| 2
| Reverse subtract
|-
| 3
| Minimum
|-
| 4
| Maximum
|}

Blend equations 5, 6, 7 appear to behave the same as blend equation 0 (Add)

'''Function values:'''

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Zero
|-
| 1
| One
|-
| 2
| Source color
|-
| 3
| One minus source color
|-
| 4
| Destination color
|-
| 5
| One minus destination color
|-
| 6
| Source alpha
|-
| 7
| One minus source alpha
|-
| 8
| Destination alpha
|-
| 9
| One minus destination alpha
|-
| 10
| Constant color
|-
| 11
| One minus constant color
|-
| 12
| Constant alpha
|-
| 13
| One minus constant alpha
|-
| 14
| Source alpha saturate
|}

=== GPUREG_LOGIC_OP ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Logic op
|}

This register is used to configure the logic op.

Logic op values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Clear
|-
| 1
| AND
|-
| 2
| Reverse AND
|-
| 3
| Copy
|-
| 4
| Set
|-
| 5
| Inverted copy
|-
| 6
| Noop
|-
| 7
| Invert
|-
| 8
| NAND
|-
| 9
| OR
|-
| 10
| NOR
|-
| 11
| XOR
|-
| 12
| Equivalent
|-
| 13
| Inverted AND
|-
| 14
| Reverse OR
|-
| 15
| Inverted OR
|}

=== GPUREG_BLEND_COLOR ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Red
|-
| 8-15
| unsigned, Green
|-
| 16-23
| unsigned, Blue
|-
| 24-31
| unsigned, Alpha
|}

This register is used to configure the blending color.

=== GPUREG_FRAGOP_ALPHA_TEST ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Enabled (0 = disabled, 1 = enabled)
|-
| 4-6
| unsigned, Function
|-
| 8-15
| unsigned, Reference value
|}

This register is used to configure alpha testing.

Function values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Never
|-
| 1
| Always
|-
| 2
| Equal
|-
| 3
| Not equal
|-
| 4
| Less than
|-
| 5
| Less than or equal
|-
| 6
| Greater than
|-
| 7
| Greater than or equal
|}

=== GPUREG_STENCIL_TEST ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Enabled (0 = disabled, 1 = enabled)
|-
| 4-6
| unsigned, Function
|-
| 8-15
| unsigned, Buffer mask
|-
| 16-23
| signed, Reference value
|-
| 24-31
| unsigned, Mask
|}

This register is used to configure stencil testing.

Function values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Never
|-
| 1
| Always
|-
| 2
| Equal
|-
| 3
| Not equal
|-
| 4
| Less than
|-
| 5
| Less than or equal
|-
| 6
| Greater than
|-
| 7
| Greater than or equal
|}

=== GPUREG_STENCIL_OP ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| unsigned, Fail operation
|-
| 4-6
| unsigned, Z-fail operation
|-
| 8-10
| unsigned, Z-pass operation
|}

This register is used to configure stencil result operations.

Operation values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Keep
|-
| 1
| Zero
|-
| 2
| Replace
|-
| 3
| Increment
|-
| 4
| Decrement
|-
| 5
| Invert
|-
| 6
| Increment and wrap
|-
| 7
| Decrement and wrap
|}

=== GPUREG_DEPTH_COLOR_MASK ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Depth test enabled (0 = disabled, 1 = enabled)
|-
| 4-6
| unsigned, Depth function
|-
| 8
| unsigned, Red write enabled (0 = disabled, 1 = enabled)
|-
| 9
| unsigned, Green write enabled (0 = disabled, 1 = enabled)
|-
| 10
| unsigned, Blue write enabled (0 = disabled, 1 = enabled)
|-
| 11
| unsigned, Alpha write enabled (0 = disabled, 1 = enabled)
|-
| 12
| unsigned, Depth write enabled (0 = disabled, 1 = enabled)
|}

This register is used to depth testing and framebuffer write masking.

Note that setting the "Depth test enabled" bit to 0 will ''not'' also disable depth writes. It will instead behave as if the depth function were set to "Always". To completely disable depth-related operations both the depth test and depth write bits must be disabled.

Depth function values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Never
|-
| 1
| Always
|-
| 2
| Equal
|-
| 3
| Not equal
|-
| 4
| Less than
|-
| 5
| Less than or equal
|-
| 6
| Greater than
|-
| 7
| Greater than or equal
|}

=== GPUREG_FRAMEBUFFER_INVALIDATE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Trigger (0 = idle, 1 = invalidate)
|-
| 1-31
| 0x0
|}

Writing 1 to this register invalidates the framebuffer cache. This should be done when changing the framebuffer or when it is cleared before rendering. Note that it does '''not''' flush the cache, so it should always be preceded by a write to GPUREG_FRAMEBUFFER_FLUSH.

=== GPUREG_FRAMEBUFFER_FLUSH ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Trigger (0 = idle, 1 = flush)
|-
| 1-31
| 0x0
|}

Writing 1 to this register flushes the framebuffer cache to memory. This should be done after rendering before changing the framebuffer or using rendering results.

=== GPUREG_COLORBUFFER_READ ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Allow read (0 = disable, 0xF = enable)
|}

This register configures read access from the color buffer.

=== GPUREG_COLORBUFFER_WRITE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Allow write (0 = disable, 0xF = enable)
|}

This register configures write access to the color buffer.

=== GPUREG_DEPTHBUFFER_READ ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Allow stencil read (0 = disable, 1 = enable)
|-
| 1
| unsigned, Allow depth read (0 = disable, 1 = enable)
|}

This register configures read access from the depth and stencil buffers.

=== GPUREG_DEPTHBUFFER_WRITE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Allow stencil write (0 = disable, 1 = enable)
|-
| 1
| unsigned, Allow depth write (0 = disable, 1 = enable)
|}

This register configures write access to the depth and stencil buffers.

=== GPUREG_DEPTHBUFFER_FORMAT ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| unsigned, Format
|}

This register configures the depth buffer data format.

Format values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| 16-bit depth
|-
| 2
| 24-bit depth
|-
| 3
| 24-bit depth + 8-bit stencil
|}

=== GPUREG_COLORBUFFER_FORMAT ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| unsigned, Pixel size
|-
| 16-18
| unsigned, Format
|}

This register configures the color buffer data format. Color components are laid out in reverse byte order in memory, with the most significant bits used first.

Pixel size values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| 16-bit color
|-
| 2
| 32-bit color
|}

Format values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| RGBA8/Gas
|-
| 2
| RGB5A1
|-
| 3
| RGB565
|-
| 4
| RGBA4
|}

=== GPUREG_EARLYDEPTH_TEST2 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Enabled (0 = disabled, 1 = enabled)
|}

This register enables the early depth test.

=== GPUREG_FRAMEBUFFER_BLOCK32 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Render block mode
|}

This register configures the framebuffer block mode. To untile the color buffer when using the 32x32 block format, use bit 16 of the [[GPU/External_Registers#Transfer_Engine|display transfer flags]]. It is unknown if there are any advantages to using the 32x32 format.

Render block mode values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| 8x8 blocks
|-
| 1
| 32x32 blocks
|}

=== GPUREG_DEPTHBUFFER_LOC ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| unsigned, Depth buffer physical address >> 3
|}

This register configures the depth buffer physical address.

=== GPUREG_COLORBUFFER_LOC ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| unsigned, Color buffer physical address >> 3
|}

This register configures the color buffer physical address.

=== GPUREG_FRAMEBUFFER_DIM ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-10
| unsigned, Width
|-
| 12-21
| unsigned, Height - 1
|-
| 24
| 0x1
|}

This register configures the framebuffer dimensions.

=== GPUREG_GAS_LIGHT_XY ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Planar shading minimum intensity
|-
| 8-15
| unsigned, Planar shading maximum intensity
|-
| 16-23
| unsigned, Planar shading density attenuation
|}

This register configures gas light planar shading.

=== GPUREG_GAS_LIGHT_Z ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, View shading minimum intensity
|-
| 8-15
| unsigned, View shading maximum intensity
|-
| 16-23
| unsigned, View shading density attenuation
|}

This register configures gas light view shading.

=== GPUREG_GAS_LIGHT_Z_COLOR ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, View shading effect in line-of-sight direction
|-
| 8
| Gas color LUT input
|}

This register configures gas light shading in the line-of-sight direction, and the input to the gas color LUT.

Color LUT input values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Gas density
|-
| 1
| Light factor
|}

=== GPUREG_GAS_LUT_INDEX ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| unsigned, Index
|}

This register is used to set what index to write to with GPUREG_GAS_LUT_DATA''i''.

=== GPUREG_GAS_LUT_DATA ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| LUT data
|}

These registers behave as a FIFO queue. Each write to these registers writes the provided value to the gas look-up table, starting at the index selected with GPUREG_GAS_LUT_INDEX.

==== Gas Look-Up Table ====

16 elements:

First 8 elements:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| signed, Red
|-
| 8-15
| signed, Green
|-
| 16-23
| signed, Blue
|}

Last 8 elements:
{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Red
|-
| 8-15
| unsigned, Green
|-
| 16-23
| unsigned, Blue
|}

=== GPUREG_GAS_DELTAZ_DEPTH ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| fixed0.16.8, Depth direction attenuation proportion
|-
| 24-25
| unsigned, Depth function
|}

This register is used to configure the gas depth direction attenuation proportion, as well as the gas depth function.

Gas depth function values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Never
|-
| 1
| Always
|-
| 2
| Greater than/Greater than or equal
|-
| 3
| Less than/Less than or equal/Equal/Not equal
|}

=== GPUREG_FRAGOP_SHADOW ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| float1.5.10, Sum of penumbra scale and penumbra bias
|-
| 16-31
| float1.5.10, Penumbra scale with reversed sign
|}

This register is used to configure shadow properties.

== Fragment lighting registers ==

=== GPUREG_LIGHT''i''_SPECULAR0 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Blue
|-
| 10-17
| unsigned, Green
|-
| 20-27
| unsigned, Red
|}

These registers contain the specular0 color of the corresponding light. Usually set to material_specular0*lightX_specular0.

=== GPUREG_LIGHT''i''_SPECULAR1 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Blue
|-
| 10-17
| unsigned, Green
|-
| 20-27
| unsigned, Red
|}

These registers contain the specular1 color of the corresponding light. Usually set to material_specular1*lightX_specular1.

=== GPUREG_LIGHT''i''_DIFFUSE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Blue
|-
| 10-17
| unsigned, Green
|-
| 20-27
| unsigned, Red
|}

These registers contain the diffuse color of the corresponding light. Usually set to material_diffuse*lightX_diffuse.

=== GPUREG_LIGHT''i''_AMBIENT ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Blue
|-
| 10-17
| unsigned, Green
|-
| 20-27
| unsigned, Red
|}

These registers contain the ambient color of the corresponding light. Usually set to material_ambient*lightX_ambient.

=== GPUREG_LIGHT''i''_XY ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| float1.5.10, X coordinate
|-
| 16-31
| float1.5.10, Y coordinate
|}

These registers (along with GPUREG_LIGHT''i''_Z) represent the light position (for a positional light) or the light direction vector (for a directional light) of the corresponding light.

=== GPUREG_LIGHT''i''_Z ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| float1.5.10, Z coordinate
|}

These registers (along with GPUREG_LIGHT''i''_XY) represent the light position (for a positional light) or the light direction vector (for a directional light) of the corresponding light.

=== GPUREG_LIGHT''i''_SPOTDIR_XY ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-12
| fixed1.1.11, X coordinate (negated)
|-
| 16-28
| fixed1.1.11, Y coordinate (negated)
|}

These registers (along with GPUREG_LIGHT''i''_SPOTDIR_Z) represent the spot direction (unitary) vector of the corresponding light.

=== GPUREG_LIGHT''i''_SPOTDIR_Z ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-12
| fixed1.1.11, Z coordinate (negated)
|}

These registers (along with GPUREG_LIGHT''i''_SPOTDIR_XY) represent the spot direction (unitary) vector of the corresponding light.

=== GPUREG_LIGHT''i''_CONFIG ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Light type (0 = positional light, 1 = directional light)
|-
| 1
| unsigned, Two side diffuse (0 = one side, 1 = both sides)
|-
| 2
| unsigned, Use geometric factor 0 (0 = don't use, 1 = use)
|-
| 3
| unsigned, Use geometric factor 1 (0 = don't use, 1 = use)
|}

This register configures a light's properties.

=== GPUREG_LIGHT''i''_ATTENUATION_BIAS ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-19
| float1.7.12, Distance attenuation bias
|}

These registers contain the distance attenuation bias value of the corresponding light. The attenuation factor is DA(clip(bias + scale*distance, 0.0, 1.0)).

=== GPUREG_LIGHT''i''_ATTENUATION_SCALE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-19
| float1.7.12, Distance attenuation scale
|}

These registers contain the distance attenuation scale value of the corresponding light. The attenuation factor is DA(clip(bias + scale*distance, 0.0, 1.0)).

=== GPUREG_LIGHTING_AMBIENT ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Blue
|-
| 10-17
| unsigned, Green
|-
| 20-27
| unsigned, Red
|}

This register contains the initial value of the fragment primary color before the partial colors that correspond to each enabled light are added. Usually set to material_emission + material_ambient*scene_ambient.

=== GPUREG_LIGHTING_NUM_LIGHTS ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| unsigned, Number of active lights - 1
|}

This register configures the number of active lights.

=== GPUREG_LIGHTING_CONFIG0 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Shadow factor enabled (0 = disabled, 1 = enabled) (usually accompanied by bit 16, 17, or 18)
|-
| 2-3
| unsigned, Fresnel selector
|-
| 4-7
| unsigned, Light environment configuration
|-
| 8-11
| 0x4
|-
| 16
| unsigned, Apply shadow attenuation to primary color (0 = don't apply, 1 = apply)
|-
| 17
| unsigned, Apply shadow attenuation to secondary color (0 = don't apply, 1 = apply)
|-
| 18
| unsigned, Invert shadow attenuation (0 = don't invert, 1 = invert)
|-
| 19
| unsigned, Apply shadow attenuation to alpha component (0 = don't apply, 1 = apply)
|-
| 22-23
| unsigned, Bump map texture unit
|-
| 24-25
| unsigned, Shadow map texture unit
|-
| 27
| unsigned, Clamp highlights (0 = disabled, 1 = enabled)
|-
| 28-29
| unsigned, Bump mode
|-
| 30
| unsigned, Recalculate bump vectors (0 = enabled, 1 = disabled) (usually set to 1 when bump mode is not 0)
|-
| 31
| 0x1
|}

This register configures the light environment.

Fresnel selector values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| None
|-
| 1
| Primary alpha
|-
| 2
| Secondary alpha
|-
| 3
| Primary and secondary alpha
|}

The light environment configuration controls which LUTs are available for use. If a LUT is not available in the selected configuration, its value will always read a constant 1.0 regardless of the enable state in GPUREG_LIGHTING_CONFIG1. If RR is enabled but not RG or RB, the output of RR is used for the three components; Red, Green and Blue.

Light environment configuration values:

{| class="wikitable" border="1"
! Value
! Description
! Available LUTs
|-
| 0
| Configuration 0
| D0, RR, SP, DA
|-
| 1
| Configuration 1
| FR, RR, SP, DA
|-
| 2
| Configuration 2
| D0, D1, RR, DA
|-
| 3
| Configuration 3
| D0, D1, FR, DA
|-
| 4
| Configuration 4
| All except for FR
|-
| 5
| Configuration 5
| All except for D1
|-
| 6
| Configuration 6
| All except for RB and RG
|-
| 8
| Configuration 7
| All
|}

Bump mode values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Not used
|-
| 1
| Use as bump map
|-
| 2
| Use as tangent map
|}

=== GPUREG_LIGHTING_CONFIG1 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Fragment light source 0 shadows disabled (0 = enabled, 1 = disabled)
|-
| 1
| unsigned, Fragment light source 1 shadows disabled (0 = enabled, 1 = disabled)
|-
| 2
| unsigned, Fragment light source 2 shadows disabled (0 = enabled, 1 = disabled)
|-
| 3
| unsigned, Fragment light source 3 shadows disabled (0 = enabled, 1 = disabled)
|-
| 4
| unsigned, Fragment light source 4 shadows disabled (0 = enabled, 1 = disabled)
|-
| 5
| unsigned, Fragment light source 5 shadows disabled (0 = enabled, 1 = disabled)
|-
| 6
| unsigned, Fragment light source 6 shadows disabled (0 = enabled, 1 = disabled)
|-
| 7
| unsigned, Fragment light source 7 shadows disabled (0 = enabled, 1 = disabled)
|-
| 8
| unsigned, Fragment light source 0 spot light disabled (0 = enabled, 1 = disabled)
|-
| 9
| unsigned, Fragment light source 1 spot light disabled (0 = enabled, 1 = disabled)
|-
| 10
| unsigned, Fragment light source 2 spot light disabled (0 = enabled, 1 = disabled)
|-
| 11
| unsigned, Fragment light source 3 spot light disabled (0 = enabled, 1 = disabled)
|-
| 12
| unsigned, Fragment light source 4 spot light disabled (0 = enabled, 1 = disabled)
|-
| 13
| unsigned, Fragment light source 5 spot light disabled (0 = enabled, 1 = disabled)
|-
| 14
| unsigned, Fragment light source 6 spot light disabled (0 = enabled, 1 = disabled)
|-
| 15
| unsigned, Fragment light source 7 spot light disabled (0 = enabled, 1 = disabled)
|-
| 16
| unsigned, Term 0 distribution component D0 LUT disabled (0 = enabled, 1 = disabled)
|-
| 17
| unsigned, Term 1 distribution component D1 LUT disabled (0 = enabled, 1 = disabled)
|-
| 18
| 0x1
|-
| 19
| unsigned, Fresnel FR LUT disabled (0 = enabled, 1 = disabled)
|-
| 20
| unsigned, Term 1 reflection component RB LUT disabled (0 = enabled, 1 = disabled)
|-
| 21
| unsigned, Term 1 reflection component RG LUT disabled (0 = enabled, 1 = disabled)
|-
| 22
| unsigned, Term 1 reflection component RR LUT disabled (0 = enabled, 1 = disabled)
|-
| 24
| unsigned, Fragment light source 0 distance attenuation disabled (0 = enabled, 1 = disabled)
|-
| 25
| unsigned, Fragment light source 1 distance attenuation disabled (0 = enabled, 1 = disabled)
|-
| 26
| unsigned, Fragment light source 2 distance attenuation disabled (0 = enabled, 1 = disabled)
|-
| 27
| unsigned, Fragment light source 3 distance attenuation disabled (0 = enabled, 1 = disabled)
|-
| 28
| unsigned, Fragment light source 4 distance attenuation disabled (0 = enabled, 1 = disabled)
|-
| 29
| unsigned, Fragment light source 5 distance attenuation disabled (0 = enabled, 1 = disabled)
|-
| 30
| unsigned, Fragment light source 6 distance attenuation disabled (0 = enabled, 1 = disabled)
|-
| 31
| unsigned, Fragment light source 7 distance attenuation disabled (0 = enabled, 1 = disabled)
|}

This register is used to disable various aspects of the light environment.

=== GPUREG_LIGHTING_LUT_INDEX ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Starting index
|-
| 8-12
| unsigned, Look-up table
|}

This register controls which LUT and what offset into it the GPUREG_LIGHTING_LUT_DATA''i'' register writes to.

Lookup table values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| D0
|-
| 1
| D1
|-
| 3
| FR
|-
| 4
| RB
|-
| 5
| RG
|-
| 6
| RR
|-
| 8-15
| SP0-7
|-
| 16-23
| DA0-7
|}

=== GPUREG_LIGHTING_ENABLE1 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Disabled (0 = enabled, 1 = disabled)
|}

This register is set to 1 when fragment lighting is disabled, and to 0 when it is enabled.

=== GPUREG_LIGHTING_LUT_DATA''i'' ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-23
| LUT data
|}

Lighting LUT data is written here.

A LUT contains data for the input domain [-1.0, 1.0], which is indexed using a signed 8-bit number [-128, 127]. Therefore a LUT contains 256 entries. The index of a value is (int)(x/127.0f) & 0xFF.

DA: The input domain is [0.0, 1.0], and the index is an unsigned 8-bit number [0, 255] instead.

Format of an entry:

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| fixed0.0.12, Entry value
|-
| 12-23
| fixed1.0.11, Absolute value of the difference between the next entry and this entry, used to implement linear interpolation
|}

=== GPUREG_LIGHTING_LUTINPUT_ABS ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 1
| unsigned, abs() flag for the input of D0 (0 = enabled, 1 = disabled)
|-
| 5
| unsigned, abs() flag for the input of D1 (0 = enabled, 1 = disabled)
|-
| 9
| unsigned, abs() flag for the input of SP (0 = enabled, 1 = disabled)
|-
| 13
| unsigned, abs() flag for the input of FR (0 = enabled, 1 = disabled)
|-
| 17
| unsigned, abs() flag for the input of RB (0 = enabled, 1 = disabled)
|-
| 21
| unsigned, abs() flag for the input of RG (0 = enabled, 1 = disabled)
|-
| 25
| unsigned, abs() flag for the input of RR (0 = enabled, 1 = disabled)
|}

This register controls whether the absolute value of the input is taken before using a LUT.

=== GPUREG_LIGHTING_LUTINPUT_SELECT ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| unsigned, Input selector for D0
|-
| 4-6
| unsigned, Input selector for D1
|-
| 8-10
| unsigned, Input selector for SP
|-
| 12-14
| unsigned, Input selector for FR
|-
| 16-18
| unsigned, Input selector for RB
|-
| 20-22
| unsigned, Input selector for RG
|-
| 24-26
| unsigned, Input selector for RR
|}

This register selects the input from LUTs.

Input selector values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| N·H
|-
| 1
| V·H
|-
| 2
| N·V
|-
| 3
| L·N
|-
| 4
| -L·P (aka Spotlight aka SP)
|-
| 5
| cos φ (aka CP)
|}

=== GPUREG_LIGHTING_LUTINPUT_SCALE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| unsigned, Scaler selector for D0
|-
| 4-6
| unsigned, Scaler selector for D1
|-
| 8-10
| unsigned, Scaler selector for SP
|-
| 12-14
| unsigned, Scaler selector for FR
|-
| 16-18
| unsigned, Scaler selector for RB
|-
| 20-22
| unsigned, Scaler selector for RG
|-
| 24-26
| unsigned, Scaler selector for RR
|}

This register controls the scaling that is applied to the output of a LUT.

Scaler selector values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| 1x
|-
| 1
| 2x
|-
| 2
| 4x
|-
| 3
| 8x
|-
| 6
| 0.25x
|-
| 7
| 0.5x
|}

=== GPUREG_LIGHTING_LIGHT_PERMUTATION ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-2
| unsigned, ID of the 1st enabled light
|-
| 4-6
| unsigned, ID of the 2nd enabled light
|-
| 8-10
| unsigned, ID of the 3rd enabled light
|-
| 12-14
| unsigned, ID of the 4th enabled light
|-
| 16-18
| unsigned, ID of the 5th enabled light
|-
| 20-22
| unsigned, ID of the 6th enabled light
|-
| 24-26
| unsigned, ID of the 7th enabled light
|-
| 28-30
| unsigned, ID of the 8th enabled light
|}

This register sets the IDs of enabled light sources.

== Geometry pipeline registers ==

=== GPUREG_ATTRIBBUFFERS_LOC ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 1-28
| unsigned, Vertex arrays base address
|}

This register sets the base address of all vertex arrays.

=== GPUREG_ATTRIBBUFFERS_FORMAT_LOW ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| unsigned, Vertex attribute 0 type
|-
| 2-3
| unsigned, Vertex attribute 0 size
|-
| 4-5
| unsigned, Vertex attribute 1 type
|-
| 6-7
| unsigned, Vertex attribute 1 size
|-
| 8-9
| unsigned, Vertex attribute 2 type
|-
| 10-11
| unsigned, Vertex attribute 2 size
|-
| 12-13
| unsigned, Vertex attribute 3 type
|-
| 14-15
| unsigned, Vertex attribute 3 size
|-
| 16-17
| unsigned, Vertex attribute 4 type
|-
| 18-19
| unsigned, Vertex attribute 4 size
|-
| 20-21
| unsigned, Vertex attribute 5 type
|-
| 22-23
| unsigned, Vertex attribute 5 size
|-
| 24-25
| unsigned, Vertex attribute 6 type
|-
| 26-27
| unsigned, Vertex attribute 6 size
|-
| 28-29
| unsigned, Vertex attribute 7 type
|-
| 30-31
| unsigned, Vertex attribute 7 size
|}

This register configures the types and sizes of the first 8 vertex attributes.

Vertex attribute type values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Byte
|-
| 1
| Unsigned byte
|-
| 2
| Short
|-
| 3
| Float
|}

Vertex attribute size values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| 8 bits
|-
| 1
| 16 bits
|-
| 2
| 24 bits
|-
| 3
| 32 bits
|}

=== GPUREG_ATTRIBBUFFERS_FORMAT_HIGH ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| unsigned, Vertex attribute 8 type
|-
| 2-3
| unsigned, Vertex attribute 8 size
|-
| 4-5
| unsigned, Vertex attribute 9 type
|-
| 6-7
| unsigned, Vertex attribute 9 size
|-
| 8-9
| unsigned, Vertex attribute 10 type
|-
| 10-11
| unsigned, Vertex attribute 10 size
|-
| 12-13
| unsigned, Vertex attribute 11 type
|-
| 14-15
| unsigned, Vertex attribute 11 size
|-
| 16-27
| unsigned, Fixed vertex attribute mask
|-
| 28-31
| unsigned, Total vertex attribute count - 1
|}

This register configures the types and sizes of the last 4 vertex attributes, along with the attribute mask and the total attribute count.

See GPUREG_ATTRIBBUFFERS_FORMAT_LOW for vertex attribute type and size values.

=== GPUREG_ATTRIBBUFFER''i''_OFFSET ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| unsigned, Offset from base vertex arrays address
|}

This register configures the offset of a vertex array from the base vertex arrays address.

=== GPUREG_ATTRIBBUFFER''i''_CONFIG1 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Component 1
|-
| 4-7
| unsigned, Component 2
|-
| 8-11
| unsigned, Component 3
|-
| 12-15
| unsigned, Component 4
|-
| 16-19
| unsigned, Component 5
|-
| 20-23
| unsigned, Component 6
|-
| 24-27
| unsigned, Component 7
|-
| 28-31
| unsigned, Component 8
|}

This register configures the first 8 component types of a vertex array.

Component values:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Vertex attribute 0
|-
| 1
| Vertex attribute 1
|-
| 2
| Vertex attribute 2
|-
| 3
| Vertex attribute 3
|-
| 4
| Vertex attribute 4
|-
| 5
| Vertex attribute 5
|-
| 6
| Vertex attribute 6
|-
| 7
| Vertex attribute 7
|-
| 8
| Vertex attribute 8
|-
| 9
| Vertex attribute 9
|-
| 10
| Vertex attribute 10
|-
| 11
| Vertex attribute 11
|-
| 12
| 4-byte padding
|-
| 13
| 8-byte padding
|-
| 14
| 12-byte padding
|-
| 15
| 16-byte padding
|}

=== GPUREG_ATTRIBBUFFER''i''_CONFIG2 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Component 9
|-
| 4-7
| unsigned, Component 10
|-
| 8-11
| unsigned, Component 11
|-
| 12-15
| unsigned, Component 12
|-
| 16-23
| unsigned, Bytes per vertex
|-
| 28-31
| unsigned, Total number of components
|}

This register configures the last 4 component types of a vertex array, along with the bytes per vertex and the total number of components.

See GPUREG_ATTRIBBUFFER''i''_CONFIG1 for component values.

=== GPUREG_INDEXBUFFER_CONFIG ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-27
| unsigned, Offset from base vertex arrays address
|-
| 31
| Index type (0 = unsigned byte, 1 = unsigned short or drawing arrays)
|}

This register configures the index array used when drawing elements.

=== GPUREG_NUMVERTICES ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| unsigned, Number of vertices to render
|}

This register sets the number of vertices to render.

=== GPUREG_GEOSTAGE_CONFIG ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-1
| unsigned, Geometry shader in use (0 = not in use, 2 = in use)
|-
| 8
| unsigned, Drawing triangle elements (0 = not, 1 = drawing triangle elements)
|-
| 9
| 0x0
|-
| 31
| unsigned, Use reserved geometry shader subdivision (0 = don't use, 1 = use)
|}

This register configures the geometry stage of the GPU pipeline.

When using vertex buffers and drawing elements in triangles mode, bit 8 is set to 1, else it is set to 0.

=== GPUREG_VERTEX_OFFSET ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| unsigned, Starting vertex offset
|}

This register sets the offset of the first vertex in an array to render.

=== GPUREG_POST_VERTEX_CACHE_NUM ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Number of entries in the post-vertex cache (usually 0x4 or 0x84)
|}

This register configures the post-vertex cache.

=== GPUREG_DRAWARRAYS ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| unsigned, Trigger (0 = idle, non-zero = draw arrays)
|}

This register triggers drawing vertex arrays.

=== GPUREG_DRAWELEMENTS ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| unsigned, Trigger (0 = idle, non-zero = draw elements)
|}

This register triggers drawing vertex array elements.

=== GPUREG_VTX_FUNC ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| unsigned, Trigger (0 = idle, non-zero = clear post-vertex cache)
|}

This register triggers clearing the post-vertex cache.

=== GPUREG_FIXEDATTRIB_INDEX ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Fixed attribute index (0-11, 0xF = immediate-mode submission)
|}

This register selects the index of the fixed attribute to be input with GPUREG_FIXEDATTRIB_DATA''i''. See [[GPU/Fixed Vertex Attributes]] and [[GPU/Immediate-Mode Vertex Submission]] for usage info.

=== GPUREG_FIXEDATTRIB_DATA''i'' ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| colspan="2" | '''DATA0:'''
|-
| 0-7
| float1.7.16, Vertex attribute element 3 (Z) (bits 16-23)
|-
| 8-31
| float1.7.16, Vertex attribute element 4 (W)
|-
| colspan="2" | '''DATA1:'''
|-
| 0-15
| float1.7.16, Vertex attribute element 2 (Y) (bits 8-23)
|-
| 16-31
| float1.7.16, Vertex attribute element 3 (Z) (bits 0-15)
|-
| colspan="2" | '''DATA2:'''
|-
| 0-23
| float1.7.16, Vertex attribute element 1 (X)
|-
| 24-31
| float1.7.16, Vertex attribute element 2 (Y) (bits 0-7)
|}

Accepts four 24-bit floating-point values that make up a vertex attribute. Stored in the fixed attribute currently specified with GPUREG_FIXEDATTRIB_INDEX. If immediate-mode vertex submission is enabled (by writing 0xF to the index register) then vertex data is input here directly.

=== GPUREG_CMDBUF_SIZE0 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-20
| unsigned, Size of command buffer 0 >> 3
|}

This register sets the size of the first command buffer.

=== GPUREG_CMDBUF_SIZE1 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-20
| unsigned, Size of command buffer 1 >> 3
|}

This register sets the size of the second command buffer.

=== GPUREG_CMDBUF_ADDR0 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-28
| unsigned, Physical address of command buffer 0 >> 3
|}

This register sets the physical address of the first command buffer.

=== GPUREG_CMDBUF_ADDR1 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-28
| unsigned, Physical address of command buffer 1 >> 3
|}

This register sets the physical address of the second command buffer.

=== GPUREG_CMDBUF_JUMP0 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| unsigned, Trigger (0 = idle, non-zero = execute command buffer 0)
|}

This register triggers a jump to the first command buffer.

=== GPUREG_CMDBUF_JUMP1 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| unsigned, Trigger (0 = idle, non-zero = execute command buffer 1)
|}

This register triggers a jump to the second command buffer.

=== GPUREG_VSH_NUM_ATTR ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Number of vertex shader input attributes - 1
|}

This register sets the number of vertex shader input attributes.

=== GPUREG_VSH_COM_MODE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Geometry shader configuration enabled (0 = disabled, 1 = enabled)
|}

This register sets whether to use the geometry shader configuration or reuse the vertex shader configuration for the geometry shader shading unit.

=== GPUREG_START_DRAW_FUNC0 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Mode (0 = drawing, 1 = configuration)
|-
| 1-7
| 0x0
|}

This register is related to drawing. When the mode value is set to 1, rendering is not performed properly. When set to 0, changes to the vertex shader configuration registers are not applied correctly. Because of this, it is usually initialized to 1, set to 0 immediately before triggering a draw, and set back to 1 immediately after triggering a draw.

=== GPUREG_VSH_OUTMAP_TOTAL1 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Number of vertex shader output map registers - 1
|}

This register sets the number of vertex shader output map registers.

=== GPUREG_VSH_OUTMAP_TOTAL2 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Number of vertex shader output map registers - 1
|}

This register sets the number of vertex shader output map registers.

=== GPUREG_GSH_MISC0 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| unsigned, Misc data (0x00000001 = Reserved geometry shader subdivision in use, 0x01004302 = Particle system in use, 0 otherwise)
|}

This register configures miscellaneous geometry shader properties.

=== GPUREG_GEOSTAGE_CONFIG2 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Function indicator (with vertex buffers: 0 = draw elements, 1 = draw arrays, without: 0 = not inputting, 1 = inputting vertex attribute data)
|-
| 8
| unsigned, Drawing triangle elements (0 = not, 1 = drawing triangle elements)
|}

This register configures the geometry stage of the GPU pipeline.

When using vertex buffers, bit 0 is set to 1 before drawing arrays, and cleared to 0 immediately after. When using immediate mode to directly input vertex attribute data, bit 0 is set to 1 before inputting vertex attribute data, and cleared to 0 immediately after. While bit 0 is set to 1, some register writes outside of the 0x200-0x254 and 0x280-0x2DF ranges may be processed incorrectly.

When using vertex buffers and drawing elements in triangles mode, bit 8 is set to 1, else it is set to 0.

=== GPUREG_GSH_MISC1 ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-4
| unsigned, Reserved geometry shader subdivision type (2 = Loop, 3 = Catmull-Clark)
|}

This register configures the type of reserved geometry shader subdivision in use. The value is ignored when a subdivision is not in use.

=== GPUREG_PRIMITIVE_CONFIG ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Number of vertex shader output map registers - 1
|-
| 8-9
| unsigned, Primitive mode
|}

This register configures primitive drawing.

Primitive mode value:

{| class="wikitable" border="1"
! Value
! Description
|-
| 0
| Triangles
|-
| 1
| Triangle strip
|-
| 2
| Triangle fan
|-
| 3
| Geometry primitive
|}

=== GPUREG_RESTART_PRIMITIVE ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Trigger (0 = idle, 1 = reset primitive)
|-
| 1-31
| 0x0
|}

This register triggers resetting primitive drawing.

== Shader registers ==

=== GPUREG_''SH''_BOOLUNIFORM ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Boolean register b0 value (0 = false, 1 = true)
|-
| 1
| unsigned, Boolean register b1 value (0 = false, 1 = true)
|-
| 2
| unsigned, Boolean register b2 value (0 = false, 1 = true)
|-
| 3
| unsigned, Boolean register b3 value (0 = false, 1 = true)
|-
| 4
| unsigned, Boolean register b4 value (0 = false, 1 = true)
|-
| 5
| unsigned, Boolean register b5 value (0 = false, 1 = true)
|-
| 6
| unsigned, Boolean register b6 value (0 = false, 1 = true)
|-
| 7
| unsigned, Boolean register b7 value (0 = false, 1 = true)
|-
| 8
| unsigned, Boolean register b8 value (0 = false, 1 = true)
|-
| 9
| unsigned, Boolean register b9 value (0 = false, 1 = true)
|-
| 10
| unsigned, Boolean register b10 value (0 = false, 1 = true)
|-
| 11
| unsigned, Boolean register b11 value (0 = false, 1 = true)
|-
| 12
| unsigned, Boolean register b12 value (0 = false, 1 = true)
|-
| 13
| unsigned, Boolean register b13 value (0 = false, 1 = true)
|-
| 14
| unsigned, Boolean register b14 value (0 = false, 1 = true)
|-
| 15
| unsigned, Boolean register b15 value (0 = false, 1 = true)
|-
| 16-31
| 0x7FFF
|}

This register is used to set a shader unit's boolean registers.

=== GPUREG_''SH''_INTUNIFORM_I''i'' ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Integer register i''i'' X value
|-
| 8-15
| unsigned, Integer register i''i'' Y value
|-
| 16-23
| unsigned, Integer register i''i'' Z value
|-
| 24-31
| unsigned, Integer register i''i'' W value
|}

These registers are used to set a shader unit's integer registers.

=== GPUREG_''SH''_INPUTBUFFER_CONFIG ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Input vertex attributes - 1
|-
| 8-15
| unsigned, Use reserved geometry shader subdivision (0 = don't use, 1 = use) (always 0 for vertex shaders)
|-
| 16-23
| 0x0
|-
| 24-31
| unsigned, Use geometry shader (0x8 = use, 0xA0 = don't use) (always 0xA0 for vertex shaders)
|}

This register is used to configure a shader unit's input buffer.

=== GPUREG_''SH''_ENTRYPOINT ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-15
| unsigned, Code entry point offset, in 32-bit words
|-
| 16-31
| 0x7FFF
|}

This register sets a shader unit's code entry point.

For geometry shaders, this sets the entry point for the single shader unit which can be dedicated to running geometry shaders, regardless of the current geometry stage mode. This is means that while this register is normally used to set the geometry shader entry point, it can also be used to set this single shader unit to run from a different entry point than the other three, even when running a vertex shader.

For vertex shaders, this sets the entry point for the shader units set to vertex shader mode. Depending on the current geometry stage mode this can include either all 4 shader units or just 3 of them.

=== GPUREG_''SH''_ATTRIBUTES_PERMUTATION_LOW ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Vertex attribute 0 input register index
|-
| 4-7
| unsigned, Vertex attribute 1 input register index
|-
| 8-11
| unsigned, Vertex attribute 2 input register index
|-
| 12-15
| unsigned, Vertex attribute 3 input register index
|-
| 16-19
| unsigned, Vertex attribute 4 input register index
|-
| 20-23
| unsigned, Vertex attribute 5 input register index
|-
| 24-27
| unsigned, Vertex attribute 6 input register index
|-
| 28-31
| unsigned, Vertex attribute 7 input register index
|}

This register sets the shader unit input register index which will correspond to each attribute contained by the input buffer (which in the case of geometry shaders is the vertex shader output buffer) for the first 8 attributes. For example, having bits 0-3 set to 5 means that, in the shader program, v5 will contain the input buffer's 1st attribute.

=== GPUREG_''SH''_ATTRIBUTES_PERMUTATION_HIGH ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-3
| unsigned, Vertex attribute 8 input register index
|-
| 4-7
| unsigned, Vertex attribute 9 input register index
|-
| 8-11
| unsigned, Vertex attribute 10 input register index
|-
| 12-15
| unsigned, Vertex attribute 11 input register index
|-
| 16-19
| unsigned, Vertex attribute 12 input register index
|-
| 20-23
| unsigned, Vertex attribute 13 input register index
|-
| 24-27
| unsigned, Vertex attribute 14 input register index
|-
| 28-31
| unsigned, Vertex attribute 15 input register index
|}

This register sets the shader unit input register index which will correspond to each attribute contained by the input buffer (which in the case of geometry shaders is the vertex shader output buffer) for attributes 8 through 15. For example, having bits 0-3 set to 5 means that, in the shader program, v5 will contain the input buffer's 9th attribute.

=== GPUREG_''SH''_OUTMAP_MASK ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0
| unsigned, Output register o0 enabled (0 = disabled, 1 = enabled)
|-
| 1
| unsigned, Output register o1 enabled (0 = disabled, 1 = enabled)
|-
| 2
| unsigned, Output register o2 enabled (0 = disabled, 1 = enabled)
|-
| 3
| unsigned, Output register o3 enabled (0 = disabled, 1 = enabled)
|-
| 4
| unsigned, Output register o4 enabled (0 = disabled, 1 = enabled)
|-
| 5
| unsigned, Output register o5 enabled (0 = disabled, 1 = enabled)
|-
| 6
| unsigned, Output register o6 enabled (0 = disabled, 1 = enabled)
|-
| 7
| unsigned, Output register o7 enabled (0 = disabled, 1 = enabled) (vertex shader only)
|-
| 8
| unsigned, Output register o8 enabled (0 = disabled, 1 = enabled) (vertex shader only)
|-
| 9
| unsigned, Output register o9 enabled (0 = disabled, 1 = enabled) (vertex shader only)
|-
| 10
| unsigned, Output register o10 enabled (0 = disabled, 1 = enabled) (vertex shader only)
|-
| 11
| unsigned, Output register o11 enabled (0 = disabled, 1 = enabled) (vertex shader only)
|-
| 12
| unsigned, Output register o12 enabled (0 = disabled, 1 = enabled) (vertex shader only)
|-
| 13
| unsigned, Output register o13 enabled (0 = disabled, 1 = enabled) (vertex shader only)
|-
| 14
| unsigned, Output register o14 enabled (0 = disabled, 1 = enabled) (vertex shader only)
|-
| 15
| unsigned, Output register o15 enabled (0 = disabled, 1 = enabled) (vertex shader only)
|-
| 16-31
| 0x0
|}

This register toggles a shader unit's output registers.

=== GPUREG_''SH''_CODETRANSFER_END ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| unsigned, Signal transfer end (0 = idle, non-zero = signal)
|}

This register's value should be set to 1 in order to finalize the transfer of shader code.

=== GPUREG_''SH''_FLOATUNIFORM_INDEX ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-7
| unsigned, Target floating-point register index (range 0-95, where 0 = c0 and 95 = c95)
|-
| 31
| unsigned, Transfer mode (0 = float1.7.16, 1 = float1.8.23)
|}

This register sets the shader unit's target floating-point register and transfer mode for the data transfer system. As such it is typically used right before [[#GPUREG_SH_FLOATUNIFORM_DATAi|GPUREG_''SH''_FLOATUNIFORM_DATA''i'']], though writing to one register does not make writing to the other mandatory.

=== GPUREG_''SH''_FLOATUNIFORM_DATA''i'' ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| Floating-point register component data
|}

This register is used to set the components of a shader unit's floating-point registers, each having 4 components. The data format which should be written to it depends on the transfer mode set with [[#GPUREG_SH_FLOATUNIFORM_INDEX|GPUREG_''SH''_FLOATUNIFORM_INDEX]]. This register functions as a FIFO queue: after each time a 4-component uniform register is successfully set, the target register index is incremented, meaning that groups of uniforms with contiguous register IDs can be set with only one initial write to [[#GPUREG_SH_FLOATUNIFORM_INDEX|GPUREG_''SH''_FLOATUNIFORM_INDEX]].

* In the case of float24 transfer mode, data should be sent by writing three words which are the concatenation of the float24 value of the uniform register's 4 components, in the reverse order. Assuming each letter corresponds to 4 bits, the format becomes:
** first word : ZZWWWWWW
** second word : YYYYZZZZ
** third word : XXXXXXYY
* In the case of float32 transfer mode, data should be sent by writing four words which are each the float32 value of the uniform register's 4 components, in the reverse order.

=== GPUREG_''SH''_CODETRANSFER_INDEX ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| unsigned, Target shader code offset
|}

This register is used to set the offset at which upcoming shader code data transferred through [[#GPUREG_SH_CODETRANSFER_DATAi|GPUREG_''SH''_CODETRANSFER_DATA''i'']] should be written.

=== GPUREG_''SH''_CODETRANSFER_DATA''i'' ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| unsigned, Shader instruction data
|}

This register is used to transfer shader code data. This register behaves as a FIFO queue: each write to this register writes the provided value to the GPU shader code memory bank at the offset initially set by [[#GPUREG_SH_CODETRANSFER_INDEX|GPUREG_''SH''_CODETRANSFER_INDEX]]. The offset in question is incremented after each write to this register.

=== GPUREG_''SH''_OPDESCS_INDEX ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-11
| unsigned, Target shader operand descriptor offset
|}

This register is used to set the offset at which upcoming shader operand descriptor data transferred through [[#GPUREG_SH_OPDESCS_DATAi|GPUREG_''SH''_OPDESCS_DATA''i'']] should be written.

=== GPUREG_''SH''_OPDESCS_DATA''i'' ===

{| class="wikitable" border="1"
! Bits
! Description
|-
| 0-31
| unsigned, Shader operand descriptor data
|}

This register is used to transfer shader operand descriptor data. This register behaves as a FIFO queue: each write to this register writes the provided value to the GPU shader operand descriptor memory bank at the offset initially set by [[#GPUREG_SH_OPDESCS_INDEX|GPUREG_''SH''_OPDESCS_INDEX]]. The offset in question is incremented after each write to this register.

APT:SendDspSleep

2023-07-24T02:47:07Z

Steveice10: /* Request */

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x003C0042]
|-
| 1
| Source [[NS_and_APT_Services#AppIDs|AppID]]
|-
| 2
| 0x0
|-
| 3
| Handle
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

APT:SendDspWakeUp

2023-07-24T02:47:04Z

Steveice10: /* Request */

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x003D0042]
|-
| 1
| Source [[NS_and_APT_Services#AppIDs|AppID]]
|-
| 2
| 0x0
|-
| 3
| Handle
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

APT:GetProgramInfo

2023-07-24T02:28:59Z

Steveice10: /* Response */

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00480100]
|-
| 1-4
| [[Filesystem_services#ProgramInfo|Program Info]]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| u8, [[NCCH/Extended_Header#Flag0|System Mode]]
|-
| 3
| FIRM Program ID Low
|}

=Description=
This obtains info mainly used for [[APT:Reboot|launching]] [[FIRM]]. For TWL titles, the output Program ID Low is 0x102 for TWL_FIRM, however for CTR titles this is [[PMApp:GetTitleExheaderFlags|loaded]] from the first 4-bytes of the exheader_arm11systemlocalcaps.flags("Core Version"). For non-TWL titles when a certain NS state flag is set, the output flag is the value from config-mem [[Configuration_Memory|APPMEMTYPE]].

APT:WakeupApplication2

2023-07-23T22:47:18Z

Steveice10:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00570044]
|-
| 1
| Parameter Size (max is 0x1000)
|-
| 2
| 0x0
|-
| 3
| Handle Parameter
|-
| 4
| (Parameter Size << 14) <nowiki>|</nowiki> 2
|-
| 5
| void*, Parameter
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=

This is the same as [[APT:WakeupApplication]], except parameters can be passed to the application in the wake up message.

NS and APT Services

2023-07-23T20:37:55Z

Steveice10: /* "APT:A" Service */

[[Category:Services]]
The NS ('''N'''intendo User Interface '''S'''hell) system module is the first module launched from a CTR-NAND title after the [[FIRM]] processes are loaded (also see [[Bootloader]]). This module is launched by the pm process, with the titleID loaded from NS state(hard-coded TID initialized during applet TID-array initialization). NS first launches [[ErrDisp]], then the menu. On retail the menu TID is loaded from NS state, while on dev/debug the menu TID is loaded from [[Config_Savegame|config]]. On dev-units if the menu TID block doesn't exist in [[Config_Savegame|config]], NS will attempt to launch the alternate menu instead. The TID of the launched menu is then written to [[Configuration Memory|ACTIVEMENUTID]]. NS uses [[PMApp:LaunchTitle|pm:app]] to launch titles.

NS will not trigger the [[ErrDisp|fatal-error]] screen when launching the regular/alternate menu fails.

Like home menu NS is constantly running while the system is in 3DS-mode. When attempting to return to home-menu when the home-menu process isn't running(like when the process terminated/crashed), NS will trigger a [[ErrDisp|fatal]] error.

= Alternate menu =
When launching the regular menu fails, NS will then attempt to launch the alternate menu. This title could be used as a recovery process, however it's normally not used after the factory.

At the factory for all 3DS systems, [[3DS Development Unit GUI#Test Menu|Test Menu]] is installed with this TID. On retail this title is eventually deleted during [[Factory Setup]].

= Auto-boot =
After [[PMApp:GetFIRMLaunchParams|loading]] [[FIRM]] params and prior to launching [[ErrDisp]]/Home Menu, NS handles auto-booting titles. The same code called by [[APT:Reboot]] is used for launching FIRM here. When the [[Configuration_Memory|UPDATEFLAG]] is set, NS will launch SAFE_MODE_FIRM with the application titleID set to the [[System_Settings#System_Updater|System Updater]] titleID for this region. When the UPDATEFLAG is not set, NS can auto-boot the following titles as well if [[Configuration_Memory|0x1FF80016]] bit0 is set.

When bit1 and bit2 are value zero in [[Configuration_Memory|0x1FF80016]], NS will [[NSS:LaunchFIRM|launch]] the title specified by the [[FIRM]] parameters if the title-info is set. This FIRM launch is done after launching [[ErrDisp]] and Home Menu. Otherwise when [[Configuration_Memory|0x1FF80016]] is value 2 and the output u8 from [[PTM|PTMSYSM]] command 0x08140000 is value 0, NS will boot the title specified from the TWL TLNC block from FIRMparams+0x300. This is the same TLNC block which DSi titles wrote to RAM+0x300 for launching other titles via the launcher title. When handling the TLNC block, NS will boot the 3DS System Settings title when the TLNC titleID is the DSi System Settings titleID(the region field in the TLNC TID is not checked/used). When the TLNC titleID is not System Settings, NS will convert the input DSi titleID-high to the 3DS TWL titleID-high(tidhigh = (TLNCtidhigh & 0x7FFF) | 0x48000), then launch TWL_FIRM to run the title. NS does not support launching from gamecard via TLNC.

= NS Workaround =
A "ns_workaround" was [[5.1.0-11|added]] in NS to workaround the flaw added with [[5.0.0-11]]. When NS is loading before launching any ARM11 processes and certain [[Configuration Memory]] fields are set, NS will launch [[Application_Manager_Services|AM]] then use command [[AM:InstallNATIVEFIRM]]. NS will then execute the code called by [[APT:StartNewestHomeMenu]], the code related to APT:PrepareToStartNewestHomeMenu is not executed here.

NS will only execute this code-path when [[Configuration Memory|0x1FF80016]] is value zero, when KERNEL_VERSIONMAJOR is value 2, and when KERNEL_VERSIONMINOR is less than 35. Therefore, this code-path is only executed when the running NATIVE_FIRM version is prior to [[5.0.0-11]].

= NS Service "ns:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchFIRM|LaunchFIRM]]
|-
| 0x000200C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchTitle|LaunchTitle]]
|-
| 0x00030000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateApplication|TerminateApplication]]
|-
| 0x00040040
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateProcess|TerminateProcess]]
|-
| 0x000500C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchApplicationFIRM|LaunchApplicationFIRM]]
|-
| 0x00060042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetWirelessRebootInfo|SetWirelessRebootInfo]]
|-
| 0x00070042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateInitialize|CardUpdateInitialize]]
|-
| 0x00080000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateShutdown|CardUpdateShutdown]]
|-
| 0x00090000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000A0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000B0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000C0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000D0140
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetTWLBannerHMAC|SetTWLBannerHMAC]]
|-
| 0x000E0000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:ShutdownAsync|ShutdownAsync]]
|-
| 0x000F0000
| [[1.0.0-0]] - [[2.0.0-2]]
| This calls [[APT:AppletUtility]] with fixed input params.
|-
| 0x00100180
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:RebootSystem|RebootSystem]]
|-
| 0x00110100
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateTitle|TerminateTitle]]
|-
| 0x001200C0
| ?
| [[NSS:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00130000
| ?
| ?
|-
| 0x00140042
| ?
| ?
|-
| 0x00150140
| ?
| [[NSS:LaunchApplication|LaunchApplication]]
|-
| 0x00160000
| [[8.0.0-18]]
| [[NSS:RebootSystemClean|RebootSystemClean]]
|}

The maximum sessions that can be used with this service is two, therefore only two processes can use this service at the same time.

=NS Power Service "ns:p"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| [[NSP:RebootSystem|RebootSystem]]
|-
| 0x00020000
| [[NSS:ShutdownAsync|ShutdownAsync]]
|}

This was added with [[3.0.0-5]]. The PTM sysmodule connects to this service, and syncs whenever [[PTM|ptm:s GetShellState()]] changes.

=NS Service "ns:c"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010100
| [[NSC:LockSpecialContent|LockSpecialContent]]
|-
| 0x00020100
| [[NSC:UnlockSpecialContent|UnlockSpecialContent]]
|}

This was added with [[5.0.0-11]]. It is used by the Instruction Manual applet, and is likely related to triggering SD/Game Card removal errors when ejecting the media the manual is stored on.

=APT Services=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Accessible with APT:U
! Accessible with APT:A
! Description
|-
| 0x00010040
|
| Yes
| Yes
| [[APT:GetLockHandle|GetLockHandle]]
|-
| 0x00020080
|
| See [[APT:Initialize|here]].
| See [[APT:Initialize|here]].
| [[APT:Initialize|Initialize]]
|-
| 0x00030040
|
| Yes
| Yes
| [[APT:Enable|Enable]]
|-
| 0x00040040
|
| Yes
| Yes
| [[APT:Finalize|Finalize]]
|-
| 0x00050040
|
| Yes
| Yes
| [[APT:GetAppletManInfo|GetAppletManInfo]]
|-
| 0x00060040
|
| Yes (AppID != 0x300)
| Yes
| [[APT:GetAppletInfo|GetAppletInfo]]
|-
| 0x00070000
|
| Yes
| Yes
| [[APT:GetLastSignaledAppletId|GetLastSignaledAppletId]]
|-
| 0x00080000
|
| Yes
| Yes
| [[APT:CountRegisteredApplet|CountRegisteredApplet]]
|-
| 0x00090040
|
| Yes
| Yes
| [[APT:IsRegistered|IsRegistered]]
|-
| 0x000A0040
|
| Yes
| Yes
| [[APT:GetAttribute|GetAttribute]]
|-
| 0x000B0040
|
| Yes
| Yes
| [[APT:InquireNotification|InquireNotification]]
|-
| 0x000C0104
|
| Yes
| Yes
| [[APT:SendParameter|SendParameter]]
|-
| 0x000D0080
|
| Yes
| Yes
| [[APT:ReceiveParameter|ReceiveParameter]]
|-
| 0x000E0080
|
| Yes
| Yes
| [[APT:GlanceParameter|GlanceParameter]]
|-
| 0x000F0100
|
| Yes
| Yes
| [[APT:CancelParameter|CancelParameter]]
|-
| 0x001000C2
|
| Yes
| Yes
| [[APT:DebugFunc|DebugFunc]]
|-
| 0x001100C0
|
| Yes
| Yes
| [[APT:MapProgramIdForDebug|MapProgramIdForDebug]]
|-
| 0x00120040
|
| Yes
| Yes
| [[APT:SetHomeMenuAppletIdForDebug|SetHomeMenuAppletIdForDebug]]
|-
| 0x00130000
|
| Yes
| Yes
| [[APT:GetPreparationState|GetPreparationState]]
|-
| 0x00140040
|
| Yes
| Yes
| [[APT:SetPreparationState|SetPreparationState]]
|-
| 0x00150140
|
| No
| No
| [[APT:PrepareToStartApplication|PrepareToStartApplication]]
|-
| 0x00160040
|
| Yes
| Yes
| [[APT:PreloadLibraryApplet|PreloadLibraryApplet]]
|-
| 0x00170040
|
| Yes
| Yes
| [[APT:FinishPreloadingLibraryApplet|FinishPreloadingLibraryApplet]]
|-
| 0x00180040
|
| Yes
| Yes
| [[APT:PrepareToStartLibraryApplet|PrepareToStartLibraryApplet]]
|-
| 0x00190040
|
| Yes
| Yes
| [[APT:PrepareToStartSystemApplet|PrepareToStartSystemApplet]]
|-
| 0x001A0000
|
| Yes
| Yes
| [[APT:PrepareToStartNewestHomeMenu|PrepareToStartNewestHomeMenu]]
|-
| 0x001B00C4
|
| Yes
| Yes
| [[APT:StartApplication|StartApplication]]
|-
| 0x001C0000
|
| Yes
| Yes
| [[APT:WakeupApplication|WakeupApplication]]
|-
| 0x001D0000
|
| Yes
| Yes
| [[APT:CancelApplication|CancelApplication]]
|-
| 0x001E0084
|
| Yes
| Yes
| [[APT:StartLibraryApplet|StartLibraryApplet]]
|-
| 0x001F0084
|
| Yes
| Yes
| [[APT:StartSystemApplet|StartSystemApplet]]
|-
| 0x00200044
|
| Yes
| Yes
| [[APT:StartNewestHomeMenu|StartNewestHomeMenu]]
|-
| 0x00210000
|
| No
| No
| [[APT:OrderToCloseApplication|OrderToCloseApplication]]
|-
| 0x00220040
|
| Yes
| Yes
| [[APT:PrepareToCloseApplication|PrepareToCloseApplication]]
|-
| 0x00230040
|
| Yes
| Yes
| [[APT:PrepareToJumpToApplication|PrepareToJumpToApplication]]
|-
| 0x00240044
|
| Yes
| Yes
| [[APT:JumpToApplication|JumpToApplication]]
|-
| 0x002500C0
|
| Yes
| Yes
| [[APT:PrepareToCloseLibraryApplet|PrepareToCloseLibraryApplet]]
|-
| 0x00260000
|
| Yes
| Yes
| [[APT:PrepareToCloseSystemApplet|PrepareToCloseSystemApplet]]
|-
| 0x00270044
|
| Yes
| Yes
| [[APT:CloseApplication|CloseApplication]]
|-
| 0x00280044
|
| Yes
| Yes
| [[APT:CloseLibraryApplet|CloseLibraryApplet]]
|-
| 0x00290044
|
| Yes
| Yes
| [[APT:CloseSystemApplet|CloseSystemApplet]]
|-
| 0x002A0000
|
| Yes
| Yes
| [[APT:OrderToCloseSystemApplet|OrderToCloseSystemApplet]]
|-
| 0x002B0000
|
| Yes
| Yes
| [[APT:PrepareToJumpToHomeMenu|PrepareToJumpToHomeMenu]]
|-
| 0x002C0044
|
| Yes
| Yes
| [[APT:JumpToHomeMenu|JumpToHomeMenu]]
|-
| 0x002D0000
|
| Yes
| Yes
| [[APT:PrepareToLeaveHomeMenu|PrepareToLeaveHomeMenu]]
|-
| 0x002E0044
|
| Yes
| Yes
| [[APT:LeaveHomeMenu|LeaveHomeMenu]]
|-
| 0x002F0040
|
| Yes
| Yes
| [[APT:PrepareToLeaveResidentApplet|PrepareToLeaveResidentApplet]]
|-
| 0x00300044
|
| Yes
| Yes
| [[APT:LeaveResidentApplet|LeaveResidentApplet]]
|-
| 0x00310100
|
| Yes
| Yes
| [[APT:PrepareToDoApplicationJump|PrepareToDoApplicationJump]]
|-
| 0x00320084
|
| Yes
| Yes
| [[APT:DoApplicationJump|DoApplicationJump]]
|-
| 0x00330000
|
| Yes
| Yes
| [[APT:GetProgramIdOnApplicationJump|GetProgramIdOnApplicationJump]]
|-
| 0x00340084
|
| Yes
| Yes
| [[APT:SendDeliverArg|SendDeliverArg]]
|-
| 0x00350080
|
| Yes
| Yes
| [[APT:ReceiveDeliverArg|ReceiveDeliverArg]]
|-
| 0x00360040
|
| Yes
| Yes
| [[APT:LoadSysMenuArg|LoadSysMenuArg]]
|-
| 0x00370042
|
| Yes
| Yes
| [[APT:StoreSysMenuArg|StoreSysMenuArg]]
|-
| 0x00380040
|
| Yes
| Yes
| [[APT:PreloadResidentApplet|PreloadResidentApplet]]
|-
| 0x00390040
|
| Yes
| Yes
| [[APT:PrepareToStartResidentApplet|PrepareToStartResidentApplet]]
|-
| 0x003A0044
|
| Yes
| Yes
| [[APT:StartResidentApplet|StartResidentApplet]]
|-
| 0x003B0040
|
| Yes
| Yes
| [[APT:CancelLibraryApplet|CancelLibraryApplet]]
|-
| 0x003C0042
|
| Yes
| Yes
| [[APT:SendDspSleep|SendDspSleep]]
|-
| 0x003D0042
|
| Yes
| Yes
| [[APT:SendDspWakeUp|SendDspWakeUp]]
|-
| 0x003E0080
|
| Yes
| Yes
| [[APT:ReplySleepQuery|ReplySleepQuery]]
|-
| 0x003F0040
|
| Yes
| Yes
| [[APT:ReplySleepNotificationComplete|ReplySleepNotificationComplete]]
|-
| 0x00400042
|
| Yes
| Yes
| [[APT:SendCaptureBufferInfo|SendCaptureBufferInfo]]
|-
| 0x00410040
|
| Yes
| Yes
| [[APT:ReceiveCaptureBufferInfo|ReceiveCaptureBufferInfo]]
|-
| 0x00420080
|
| Yes
| Yes
| [[APT:SleepSystem|SleepSystem]]
|-
| 0x00430040
|
| Yes
| Yes
| [[APT:NotifyToWait|NotifyToWait]]
|-
| 0x00440000
|
| Yes
| Yes
| [[APT:GetSharedFont|GetSharedFont]]
|-
| 0x00450040
|
| Yes
| Yes
| [[APT:GetWirelessRebootInfo|GetWirelessRebootInfo]]
|-
| 0x00460104
|
| Yes
| Yes
| [[APT:Wrap|Wrap]]
|-
| 0x00470104
|
| Yes
| Yes
| [[APT:Unwrap|Unwrap]]
|-
| 0x00480100
|
| No
| No
| [[APT:GetProgramInfo|GetProgramInfo]]
|-
| 0x00490180
|
| No
| No
| [[APT:Reboot|Reboot]]
|-
| 0x004A0040
|
| Yes
| Yes
| [[APT:GetCaptureInfo|GetCaptureInfo]]
|-
| 0x004B00C2
|
| Yes
| Yes
| [[APT:AppletUtility|AppletUtility]]
|-
| 0x004C0000
|
| Yes
| Yes
| [[APT:SetFatalErrDispMode|SetFatalErrDispMode]]
|-
| 0x004D0080
|
| Yes
| Yes
| [[APT:GetAppletProgramInfo|GetAppletProgramInfo]]
|-
| 0x004E0000
|
| Yes
| Yes
| [[APT:HardwareResetAsync|HardwareResetAsync]]
|-
| 0x004F0080
| [[2.2.0-X]]
| Yes
| Yes
| [[APT:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00500040
| [[2.2.0-X]]
| Yes
| Yes
| [[APT:GetApplicationCpuTimeLimit|GetApplicationCpuTimeLimit]]
|-
| 0x00510080
| [[3.0.0-5]]
| Yes
| Yes
| [[APT:GetStartupArgument|GetStartupArgument]]
|-
| 0x00520104
| [[4.0.0-7]]
| Yes
| Yes
| [[APT:Wrap1|Wrap1]]
|-
| 0x00530104
| [[4.0.0-7]]
| Yes
| Yes
| [[APT:Unwrap1|Unwrap1]]
|-
| 0x00540040
| [[5.0.0-11]]
| Yes
| Yes
| Takes an unknown parameter, outputs a result code and media type.
|-
| 0x00550040
| [[7.0.0-13]]
| Yes
| Yes
| [[APT:SetScreenCapturePostPermission|SetScreenCapturePostPermission]]
|-
| 0x00560000
| [[7.0.0-13]]
| Yes
| Yes
| [[APT:GetScreenCapturePostPermission|GetScreenCapturePostPermission]]
|-
| 0x00570044
| [[7.0.0-13]]
| Yes
| Yes
| [[APT:WakeupApplication2|WakeupApplication2]]
|-
| 0x00580002
| [[7.0.0-13]]
| Yes
| Yes
| [[APT:GetProgramID|GetProgramID]]
|-
| 0x01010000
| [[8.0.0-18]]
| Yes
| Yes
| [[APT:GetTargetPlatform|GetTargetPlatform]]
|-
| 0x01020000
| [[8.0.0-18]]
| Yes
| Yes
| [[APT:CheckNew3DS|CheckNew3DS]]
|-
| 0x01030000
| [[8.0.0-18]]
| Yes
| Yes
| [[APT:GetApplicationRunningMode|GetApplicationRunningMode]]
|-
| 0x01040000
| [[8.0.0-18]]
| Yes
| Yes
| [[APT:IsStandardMemoryLayout|IsStandardMemoryLayout]]
|-
| 0x01050100
| [[10.4.0-29]]
| Yes
| Yes
| [[APT:IsTitleAllowed|IsTitleAllowed]]
|}

These "APT:U" and "APT:S" NS services can handle launching titles/"applets", these services handle signaling for home/power button as well. Only one session for either APT service can be open at a time, normally processes close the service handle immediately once finished using the service. The commands for APT:U and APT:S are exactly the same, however certain commands are only accessible with APT:S(NS module will call [[SVC|svcBreak]] when the command isn't accessible).

Applets returning to home-menu first use commands APT:PrepareToJumpToHomeMenu and APT:JumpToHomeMenu, followed by these commands to launch home-menu: [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]]. [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]] are also used for launching the [[Internet Browser]], the camera applet, etc.

Processes launch applications via home-menu, not directly with [[APT:PrepareToStartApplication]] and [[APT:StartApplication]]. Regular applications can't directly launch applications since [[APT:StartApplication]] launches the process without terminating the currently running application.

APT:PrepareToDoApplicationJump and APT:DoApplicationJump are used by applications, for launching native/<non-NATIVE_FIRM> applications. These commands notify Home Menu that title launching needs done, Home Menu does the actual title launching via NS commands.

== AppletAttr ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-2
| [[NS_and_APT_Services#AppletPos|AppletPos]]
|-
| 3
| Manually Acquire/Release GPU Rights
|-
| 4
| Manually Acquire/Release DSP Rights
|-
| 5
| ?
|}

== DisplayBufferMode ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| FORMAT_R8G8B8A8
|-
| 1
| FORMAT_R8G8B8
|-
| 2
| FORMAT_R5G6B5
|-
| 3
| FORMAT_R5G5B5A1
|-
| 4
| FORMAT_R4G4B4A4
|-
| 0xFFFFFFFF
| FORMAT_UNIMPORTABLE
|}

This is the same mapping as used for the [[GPU/External_Registers#Framebuffer_color_formats|GPU framebuffer color formats]].

== AppletPos ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1
| POS_NONE
|-
| 0
| POS_APP
|-
| 1
| POS_APPLIB
|-
| 2
| POS_SYS
|-
| 3
| POS_SYSLIB
|-
| 4
| POS_RESIDENT
|}

== QueryReply ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| REPLY_REJECT
|-
| 1
| REPLY_ACCEPT
|-
| 2
| REPLY_LATER
|}

== Notification ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NOTIFICATION_NONE
|-
| 1
| NOTIFICATION_HOME_BUTTON_1
|-
| 2
| NOTIFICATION_HOME_BUTTON_2
|-
| 3
| NOTIFICATION_SLEEP_QUERY
|-
| 4
| NOTIFICATION_SLEEP_CANCELED_BY_OPEN
|-
| 5
| NOTIFICATION_SLEEP_ACCEPTED
|-
| 6
| NOTIFICATION_SLEEP_AWAKE
|-
| 7
| NOTIFICATION_SHUTDOWN
|-
| 8
| NOTIFICATION_POWER_BUTTON_CLICK
|-
| 9
| NOTIFICATION_POWER_BUTTON_CLEAR
|-
| 10
| NOTIFICATION_TRY_SLEEP
|-
| 11
| NOTIFICATION_ORDER_TO_CLOSE
|}

== Command ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| COMMAND_NONE
|-
| 1
| COMMAND_WAKEUP
|-
| 2
| COMMAND_REQUEST
|-
| 3
| COMMAND_RESPONSE
|-
| 4
| COMMAND_EXIT
|-
| 5
| COMMAND_MESSAGE
|-
| 6
| COMMAND_HOME_BUTTON_SINGLE
|-
| 7
| COMMAND_HOME_BUTTON_DOUBLE
|-
| 8
| COMMAND_DSP_SLEEP
|-
| 9
| COMMAND_DSP_WAKEUP
|-
| 10
| COMMAND_WAKEUP_BY_EXIT
|-
| 11
| COMMAND_WAKEUP_BY_PAUSE
|-
| 12
| COMMAND_WAKEUP_BY_CANCEL
|-
| 13
| COMMAND_WAKEUP_BY_CANCELALL
|-
| 14
| COMMAND_WAKEUP_BY_POWER_BUTTON_CLICK
|-
| 15
| COMMAND_WAKEUP_TO_JUMP_HOME
|-
| 16
| COMMAND_REQUEST_FOR_SYS_APPLET
|-
| 17
| COMMAND_WAKEUP_TO_LAUNCH_APPLICATION
|-
| 0x41
| Unknown. [[APT:ReceiveParameter|Received]] by Home Menu during boot when the Home Menu process doesn't terminate properly(svcExitProcess/crash).
|}

== AppletPreparationState ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NO_PREPARATION
|-
| 1
| PREPARED_TO_LAUNCH_APP
|-
| 2
| PREPARED_TO_CLOSE_APP
|-
| 3
| PREPARED_TO_FORCE_TO_CLOSE_APP
|-
| 4
| PREPARED_TO_PRELOAD_APPLIB
|-
| 5
| PREPARED_TO_LAUNCH_APPLIB
|-
| 6
| PREPARED_TO_CLOSE_APPLIB
|-
| 7
| PREPARED_TO_LAUNCH_SYS
|-
| 8
| PREPARED_TO_CLOSE_SYS
|-
| 9
| PREPARED_TO_PRELOAD_SYSLIB
|-
| 10
| PREPARED_TO_LAUNCH_SYSLIB
|-
| 11
| PREPARED_TO_CLOSE_SYSLIB
|-
| 12
| PREPARED_TO_LAUNCH_RESIDENT
|-
| 13
| PREPARED_TO_LEAVE_RESIDENT
|-
| 14
| PREPARED_TO_DO_HOMEMENU
|-
| 15
| PREPARED_TO_LEAVE_HOMEMENU
|-
| 16
| PREPARED_TO_START_RESIDENT
|-
| 17
| PREPARED_TO_DO_APP_JUMP
|-
| 18
| PREPARED_TO_FORCE_TO_CLOSE_SYS
|-
| 19
| PREPARED_TO_LAUNCH_OTHER_SYS
|-
| 20
| PREPARED_TO_JUMP_TO_APP
|}

== StartupArgumentType ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| STARTUP_ARGUMENT_TYPE_OTHER_APP
|-
| 1
| STARTUP_ARGUMENT_TYPE_RESTART
|-
| 2
| STARTUP_ARGUMENT_TYPE_OTHER_MEDIA
|}

== CaptureBufferInfo ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, Size
|-
| 0x4
| 0x1
| u8, 3D (0 = not 3D, 1 = 3D)
|-
| 0x5
| 0x3
| Reserved
|-
| 0x8
| 0x4
| Main Screen Left Offset
|-
| 0xC
| 0x4
| Main Screen Right Offset
|-
| 0x10
| 0x4
| Main Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|-
| 0x14
| 0x4
| Sub Screen Left Offset
|-
| 0x18
| 0x4
| Sub Screen Right Offset
|-
| 0x1C
| 0x4
| Sub Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|}

==WirelessRebootInfo==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address.
|-
| 0x6
| 0x9
| WirelessRebootPassphrase
|-
| 0xF
| 0x1
| Uninitialized
|}

This is [[NSS:SetWirelessRebootInfo|setup]] by the dlplay system-application, before launching the DLP-child which can then use [[APT:GetWirelessRebootInfo]]. The MAC address and passphrase is used for connecting to the host by the DLP-child. See also [[DLP_Services|here]].

="APT:A" Service=
This was added with [[7.0.0-13|7.0.0-X]]. Official apps built with the CTRSDK for system-version >=[[7.0.0-13|7.0.0-X]] normally use the "APT:A" service instead of "APT:U". Those processes also have "APT:A" instead of "APT:U" in the service-access-control. Unlike APT:U, APT:A can call [[APT:GetAppletInfo]] with applet ID 0x300.

=Applets=
NS module does not verify that the input appID for the APT service cmds are correct for that type of command. For example, a process-launch of a SystemApplet via LibraryApplet commands works fine(minus the launched-process side of APT probably).

==System Applets==
On Old3DS there could only be one applet here(Home Menu, Internet Browser, Friend-List, etc) with programID-high 00040030 running at a time. On Old3DS when directly launching one of these 00040030 applets with Home Menu, the Home Menu process will terminate once the process is launched. On Old3DS when returning to Home Menu from that launched process, the Home Menu process is launched again.

On New3DS the Home Menu process is still running/in-memory, while another system-applet is running. On New3DS it appears that the Home Menu process is terminated+relaunched, when another system-applet terminated without exiting with APT properly.

==Library Applets==
Library applets can be launched by applications and regular applets. These library applets render to the screen(s) when running, etc. For example, this includes swkbd for text input. See the below appIDs in the 0x2XX range, the actual appID used is 0x4XX however.

Input data can be sent to the library applet via the NS [[APT:SendParameter|parameter]] buffer, and/or with shared-memory with a shared-mem handle sent to the library applet. Output data from the library applet can be received by [[APT:ReceiveParameter]], the library applet can also use the specified shared-mem for output too.

=AppIDs=
{| class="wikitable" border="1"
|-
! AppID
! Description
|-
| 0x101
| [[Home Menu]] (menu)
|-
| 0x103
| Alternate Menu
|-
| 0x110
| Camera applet ([[Camera Applet|CtrApp]])
|-
| 0x112
| Friends List applet ([[Friend List|friend]])
|-
| 0x113
| Game Notes applet (Cherry)
|-
| 0x114
| [[Internet Browser]] (spider/SKATER)
|-
| 0x115
| Instruction Manual applet
|-
| 0x116
| [[Notifications]] applet (newslist)
|-
| 0x117
| Miiverse applet (olv)
|-
| 0x118
| [[Miiverse]] posting applet (solv3)
|-
| 0x119
| Amiibo settings (cabinet)
|-
| 0x201
| Software Keyboard (swkbd) (?)
|-
| 0x202
| [[Mii Selector]] (appletEd) (?)
|-
| 0x204
| Photo Selector (PNOTE_AP) (?)
|-
| 0x205
| Sound Selector (SNOTE_AP) (?)
|-
| 0x206
| Error Display ([[ErrDisp|error]]) (?)
|-
| 0x207
| eShop applet ([[EShop#NS_eShop_application_parameters|mint]]) (?)
|-
| 0x208
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]]) (?)
|-
| 0x209
| Notepad (memolib) (?)
|-
| 0x300
| Application
|-
| 0x301
| eShop (tiger)
|-
| 0x401
| Software Keyboard (swkbd)
|-
| 0x402
| Mii Selector (appletEd)
|-
| 0x404
| Photo Selector (PNOTE_AP)
|-
| 0x405
| Sound Selector (SNOTE_AP)
|-
| 0x406
| Error Display (error)
|-
| 0x407
| eShop applet (mint)
|-
| 0x408
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]])
|-
| 0x409
| Notepad (memolib)
|-
| 0xF10
| ProgramID: 0004003000008900.
|-
| 0xF11
| ProgramID: 000400000FFFFD00.
|-
| 0xF12
| ProgramID: 000400000FFFFC00.
|-
| 0xF13
| ProgramID: 000400000FFFFB00.
|-
| 0xF14
| ProgramID: 000400000FFFF900.
|-
| 0xF15
| ProgramID: 000400000FFFF800.
|-
| 0xF16
| ProgramID: 000400000FFFF700.
|-
| 0xF17
| ProgramID: 000400000FFFF600.
|-
| 0xF18
| ProgramID: 000400000FFFF500.
|}

These AppIDs are all for NAND titles, except for 0x300. AppIDs in the 0x1XX range are applets(programID-high 00040030), and the AppIDs in the 0x2XX range are "system libraries"(programID-high 00040030). The 0xFXX AppID range is for development NAND applications, these are not available for retail.

Note that at some point the total AppID entry count was changed from 28 to 27.

NS and APT Services

2023-07-23T20:36:34Z

Steveice10: /* APT Services */

[[Category:Services]]
The NS ('''N'''intendo User Interface '''S'''hell) system module is the first module launched from a CTR-NAND title after the [[FIRM]] processes are loaded (also see [[Bootloader]]). This module is launched by the pm process, with the titleID loaded from NS state(hard-coded TID initialized during applet TID-array initialization). NS first launches [[ErrDisp]], then the menu. On retail the menu TID is loaded from NS state, while on dev/debug the menu TID is loaded from [[Config_Savegame|config]]. On dev-units if the menu TID block doesn't exist in [[Config_Savegame|config]], NS will attempt to launch the alternate menu instead. The TID of the launched menu is then written to [[Configuration Memory|ACTIVEMENUTID]]. NS uses [[PMApp:LaunchTitle|pm:app]] to launch titles.

NS will not trigger the [[ErrDisp|fatal-error]] screen when launching the regular/alternate menu fails.

Like home menu NS is constantly running while the system is in 3DS-mode. When attempting to return to home-menu when the home-menu process isn't running(like when the process terminated/crashed), NS will trigger a [[ErrDisp|fatal]] error.

= Alternate menu =
When launching the regular menu fails, NS will then attempt to launch the alternate menu. This title could be used as a recovery process, however it's normally not used after the factory.

At the factory for all 3DS systems, [[3DS Development Unit GUI#Test Menu|Test Menu]] is installed with this TID. On retail this title is eventually deleted during [[Factory Setup]].

= Auto-boot =
After [[PMApp:GetFIRMLaunchParams|loading]] [[FIRM]] params and prior to launching [[ErrDisp]]/Home Menu, NS handles auto-booting titles. The same code called by [[APT:Reboot]] is used for launching FIRM here. When the [[Configuration_Memory|UPDATEFLAG]] is set, NS will launch SAFE_MODE_FIRM with the application titleID set to the [[System_Settings#System_Updater|System Updater]] titleID for this region. When the UPDATEFLAG is not set, NS can auto-boot the following titles as well if [[Configuration_Memory|0x1FF80016]] bit0 is set.

When bit1 and bit2 are value zero in [[Configuration_Memory|0x1FF80016]], NS will [[NSS:LaunchFIRM|launch]] the title specified by the [[FIRM]] parameters if the title-info is set. This FIRM launch is done after launching [[ErrDisp]] and Home Menu. Otherwise when [[Configuration_Memory|0x1FF80016]] is value 2 and the output u8 from [[PTM|PTMSYSM]] command 0x08140000 is value 0, NS will boot the title specified from the TWL TLNC block from FIRMparams+0x300. This is the same TLNC block which DSi titles wrote to RAM+0x300 for launching other titles via the launcher title. When handling the TLNC block, NS will boot the 3DS System Settings title when the TLNC titleID is the DSi System Settings titleID(the region field in the TLNC TID is not checked/used). When the TLNC titleID is not System Settings, NS will convert the input DSi titleID-high to the 3DS TWL titleID-high(tidhigh = (TLNCtidhigh & 0x7FFF) | 0x48000), then launch TWL_FIRM to run the title. NS does not support launching from gamecard via TLNC.

= NS Workaround =
A "ns_workaround" was [[5.1.0-11|added]] in NS to workaround the flaw added with [[5.0.0-11]]. When NS is loading before launching any ARM11 processes and certain [[Configuration Memory]] fields are set, NS will launch [[Application_Manager_Services|AM]] then use command [[AM:InstallNATIVEFIRM]]. NS will then execute the code called by [[APT:StartNewestHomeMenu]], the code related to APT:PrepareToStartNewestHomeMenu is not executed here.

NS will only execute this code-path when [[Configuration Memory|0x1FF80016]] is value zero, when KERNEL_VERSIONMAJOR is value 2, and when KERNEL_VERSIONMINOR is less than 35. Therefore, this code-path is only executed when the running NATIVE_FIRM version is prior to [[5.0.0-11]].

= NS Service "ns:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchFIRM|LaunchFIRM]]
|-
| 0x000200C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchTitle|LaunchTitle]]
|-
| 0x00030000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateApplication|TerminateApplication]]
|-
| 0x00040040
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateProcess|TerminateProcess]]
|-
| 0x000500C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchApplicationFIRM|LaunchApplicationFIRM]]
|-
| 0x00060042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetWirelessRebootInfo|SetWirelessRebootInfo]]
|-
| 0x00070042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateInitialize|CardUpdateInitialize]]
|-
| 0x00080000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateShutdown|CardUpdateShutdown]]
|-
| 0x00090000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000A0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000B0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000C0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000D0140
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetTWLBannerHMAC|SetTWLBannerHMAC]]
|-
| 0x000E0000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:ShutdownAsync|ShutdownAsync]]
|-
| 0x000F0000
| [[1.0.0-0]] - [[2.0.0-2]]
| This calls [[APT:AppletUtility]] with fixed input params.
|-
| 0x00100180
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:RebootSystem|RebootSystem]]
|-
| 0x00110100
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateTitle|TerminateTitle]]
|-
| 0x001200C0
| ?
| [[NSS:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00130000
| ?
| ?
|-
| 0x00140042
| ?
| ?
|-
| 0x00150140
| ?
| [[NSS:LaunchApplication|LaunchApplication]]
|-
| 0x00160000
| [[8.0.0-18]]
| [[NSS:RebootSystemClean|RebootSystemClean]]
|}

The maximum sessions that can be used with this service is two, therefore only two processes can use this service at the same time.

=NS Power Service "ns:p"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| [[NSP:RebootSystem|RebootSystem]]
|-
| 0x00020000
| [[NSS:ShutdownAsync|ShutdownAsync]]
|}

This was added with [[3.0.0-5]]. The PTM sysmodule connects to this service, and syncs whenever [[PTM|ptm:s GetShellState()]] changes.

=NS Service "ns:c"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010100
| [[NSC:LockSpecialContent|LockSpecialContent]]
|-
| 0x00020100
| [[NSC:UnlockSpecialContent|UnlockSpecialContent]]
|}

This was added with [[5.0.0-11]]. It is used by the Instruction Manual applet, and is likely related to triggering SD/Game Card removal errors when ejecting the media the manual is stored on.

=APT Services=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Accessible with APT:U
! Accessible with APT:A
! Description
|-
| 0x00010040
|
| Yes
| Yes
| [[APT:GetLockHandle|GetLockHandle]]
|-
| 0x00020080
|
| See [[APT:Initialize|here]].
| See [[APT:Initialize|here]].
| [[APT:Initialize|Initialize]]
|-
| 0x00030040
|
| Yes
| Yes
| [[APT:Enable|Enable]]
|-
| 0x00040040
|
| Yes
| Yes
| [[APT:Finalize|Finalize]]
|-
| 0x00050040
|
| Yes
| Yes
| [[APT:GetAppletManInfo|GetAppletManInfo]]
|-
| 0x00060040
|
| Yes (AppID != 0x300)
| Yes
| [[APT:GetAppletInfo|GetAppletInfo]]
|-
| 0x00070000
|
| Yes
| Yes
| [[APT:GetLastSignaledAppletId|GetLastSignaledAppletId]]
|-
| 0x00080000
|
| Yes
| Yes
| [[APT:CountRegisteredApplet|CountRegisteredApplet]]
|-
| 0x00090040
|
| Yes
| Yes
| [[APT:IsRegistered|IsRegistered]]
|-
| 0x000A0040
|
| Yes
| Yes
| [[APT:GetAttribute|GetAttribute]]
|-
| 0x000B0040
|
| Yes
| Yes
| [[APT:InquireNotification|InquireNotification]]
|-
| 0x000C0104
|
| Yes
| Yes
| [[APT:SendParameter|SendParameter]]
|-
| 0x000D0080
|
| Yes
| Yes
| [[APT:ReceiveParameter|ReceiveParameter]]
|-
| 0x000E0080
|
| Yes
| Yes
| [[APT:GlanceParameter|GlanceParameter]]
|-
| 0x000F0100
|
| Yes
| Yes
| [[APT:CancelParameter|CancelParameter]]
|-
| 0x001000C2
|
| Yes
| Yes
| [[APT:DebugFunc|DebugFunc]]
|-
| 0x001100C0
|
| Yes
| Yes
| [[APT:MapProgramIdForDebug|MapProgramIdForDebug]]
|-
| 0x00120040
|
| Yes
| Yes
| [[APT:SetHomeMenuAppletIdForDebug|SetHomeMenuAppletIdForDebug]]
|-
| 0x00130000
|
| Yes
| Yes
| [[APT:GetPreparationState|GetPreparationState]]
|-
| 0x00140040
|
| Yes
| Yes
| [[APT:SetPreparationState|SetPreparationState]]
|-
| 0x00150140
|
| No
| No
| [[APT:PrepareToStartApplication|PrepareToStartApplication]]
|-
| 0x00160040
|
| Yes
| Yes
| [[APT:PreloadLibraryApplet|PreloadLibraryApplet]]
|-
| 0x00170040
|
| Yes
| Yes
| [[APT:FinishPreloadingLibraryApplet|FinishPreloadingLibraryApplet]]
|-
| 0x00180040
|
| Yes
| Yes
| [[APT:PrepareToStartLibraryApplet|PrepareToStartLibraryApplet]]
|-
| 0x00190040
|
| Yes
| Yes
| [[APT:PrepareToStartSystemApplet|PrepareToStartSystemApplet]]
|-
| 0x001A0000
|
| Yes
| Yes
| [[APT:PrepareToStartNewestHomeMenu|PrepareToStartNewestHomeMenu]]
|-
| 0x001B00C4
|
| Yes
| Yes
| [[APT:StartApplication|StartApplication]]
|-
| 0x001C0000
|
| Yes
| Yes
| [[APT:WakeupApplication|WakeupApplication]]
|-
| 0x001D0000
|
| Yes
| Yes
| [[APT:CancelApplication|CancelApplication]]
|-
| 0x001E0084
|
| Yes
| Yes
| [[APT:StartLibraryApplet|StartLibraryApplet]]
|-
| 0x001F0084
|
| Yes
| Yes
| [[APT:StartSystemApplet|StartSystemApplet]]
|-
| 0x00200044
|
| Yes
| Yes
| [[APT:StartNewestHomeMenu|StartNewestHomeMenu]]
|-
| 0x00210000
|
| No
| No
| [[APT:OrderToCloseApplication|OrderToCloseApplication]]
|-
| 0x00220040
|
| Yes
| Yes
| [[APT:PrepareToCloseApplication|PrepareToCloseApplication]]
|-
| 0x00230040
|
| Yes
| Yes
| [[APT:PrepareToJumpToApplication|PrepareToJumpToApplication]]
|-
| 0x00240044
|
| Yes
| Yes
| [[APT:JumpToApplication|JumpToApplication]]
|-
| 0x002500C0
|
| Yes
| Yes
| [[APT:PrepareToCloseLibraryApplet|PrepareToCloseLibraryApplet]]
|-
| 0x00260000
|
| Yes
| Yes
| [[APT:PrepareToCloseSystemApplet|PrepareToCloseSystemApplet]]
|-
| 0x00270044
|
| Yes
| Yes
| [[APT:CloseApplication|CloseApplication]]
|-
| 0x00280044
|
| Yes
| Yes
| [[APT:CloseLibraryApplet|CloseLibraryApplet]]
|-
| 0x00290044
|
| Yes
| Yes
| [[APT:CloseSystemApplet|CloseSystemApplet]]
|-
| 0x002A0000
|
| Yes
| Yes
| [[APT:OrderToCloseSystemApplet|OrderToCloseSystemApplet]]
|-
| 0x002B0000
|
| Yes
| Yes
| [[APT:PrepareToJumpToHomeMenu|PrepareToJumpToHomeMenu]]
|-
| 0x002C0044
|
| Yes
| Yes
| [[APT:JumpToHomeMenu|JumpToHomeMenu]]
|-
| 0x002D0000
|
| Yes
| Yes
| [[APT:PrepareToLeaveHomeMenu|PrepareToLeaveHomeMenu]]
|-
| 0x002E0044
|
| Yes
| Yes
| [[APT:LeaveHomeMenu|LeaveHomeMenu]]
|-
| 0x002F0040
|
| Yes
| Yes
| [[APT:PrepareToLeaveResidentApplet|PrepareToLeaveResidentApplet]]
|-
| 0x00300044
|
| Yes
| Yes
| [[APT:LeaveResidentApplet|LeaveResidentApplet]]
|-
| 0x00310100
|
| Yes
| Yes
| [[APT:PrepareToDoApplicationJump|PrepareToDoApplicationJump]]
|-
| 0x00320084
|
| Yes
| Yes
| [[APT:DoApplicationJump|DoApplicationJump]]
|-
| 0x00330000
|
| Yes
| Yes
| [[APT:GetProgramIdOnApplicationJump|GetProgramIdOnApplicationJump]]
|-
| 0x00340084
|
| Yes
| Yes
| [[APT:SendDeliverArg|SendDeliverArg]]
|-
| 0x00350080
|
| Yes
| Yes
| [[APT:ReceiveDeliverArg|ReceiveDeliverArg]]
|-
| 0x00360040
|
| Yes
| Yes
| [[APT:LoadSysMenuArg|LoadSysMenuArg]]
|-
| 0x00370042
|
| Yes
| Yes
| [[APT:StoreSysMenuArg|StoreSysMenuArg]]
|-
| 0x00380040
|
| Yes
| Yes
| [[APT:PreloadResidentApplet|PreloadResidentApplet]]
|-
| 0x00390040
|
| Yes
| Yes
| [[APT:PrepareToStartResidentApplet|PrepareToStartResidentApplet]]
|-
| 0x003A0044
|
| Yes
| Yes
| [[APT:StartResidentApplet|StartResidentApplet]]
|-
| 0x003B0040
|
| Yes
| Yes
| [[APT:CancelLibraryApplet|CancelLibraryApplet]]
|-
| 0x003C0042
|
| Yes
| Yes
| [[APT:SendDspSleep|SendDspSleep]]
|-
| 0x003D0042
|
| Yes
| Yes
| [[APT:SendDspWakeUp|SendDspWakeUp]]
|-
| 0x003E0080
|
| Yes
| Yes
| [[APT:ReplySleepQuery|ReplySleepQuery]]
|-
| 0x003F0040
|
| Yes
| Yes
| [[APT:ReplySleepNotificationComplete|ReplySleepNotificationComplete]]
|-
| 0x00400042
|
| Yes
| Yes
| [[APT:SendCaptureBufferInfo|SendCaptureBufferInfo]]
|-
| 0x00410040
|
| Yes
| Yes
| [[APT:ReceiveCaptureBufferInfo|ReceiveCaptureBufferInfo]]
|-
| 0x00420080
|
| Yes
| Yes
| [[APT:SleepSystem|SleepSystem]]
|-
| 0x00430040
|
| Yes
| Yes
| [[APT:NotifyToWait|NotifyToWait]]
|-
| 0x00440000
|
| Yes
| Yes
| [[APT:GetSharedFont|GetSharedFont]]
|-
| 0x00450040
|
| Yes
| Yes
| [[APT:GetWirelessRebootInfo|GetWirelessRebootInfo]]
|-
| 0x00460104
|
| Yes
| Yes
| [[APT:Wrap|Wrap]]
|-
| 0x00470104
|
| Yes
| Yes
| [[APT:Unwrap|Unwrap]]
|-
| 0x00480100
|
| No
| No
| [[APT:GetProgramInfo|GetProgramInfo]]
|-
| 0x00490180
|
| No
| No
| [[APT:Reboot|Reboot]]
|-
| 0x004A0040
|
| Yes
| Yes
| [[APT:GetCaptureInfo|GetCaptureInfo]]
|-
| 0x004B00C2
|
| Yes
| Yes
| [[APT:AppletUtility|AppletUtility]]
|-
| 0x004C0000
|
| Yes
| Yes
| [[APT:SetFatalErrDispMode|SetFatalErrDispMode]]
|-
| 0x004D0080
|
| Yes
| Yes
| [[APT:GetAppletProgramInfo|GetAppletProgramInfo]]
|-
| 0x004E0000
|
| Yes
| Yes
| [[APT:HardwareResetAsync|HardwareResetAsync]]
|-
| 0x004F0080
| [[2.2.0-X]]
| Yes
| Yes
| [[APT:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00500040
| [[2.2.0-X]]
| Yes
| Yes
| [[APT:GetApplicationCpuTimeLimit|GetApplicationCpuTimeLimit]]
|-
| 0x00510080
| [[3.0.0-5]]
| Yes
| Yes
| [[APT:GetStartupArgument|GetStartupArgument]]
|-
| 0x00520104
| [[4.0.0-7]]
| Yes
| Yes
| [[APT:Wrap1|Wrap1]]
|-
| 0x00530104
| [[4.0.0-7]]
| Yes
| Yes
| [[APT:Unwrap1|Unwrap1]]
|-
| 0x00540040
| [[5.0.0-11]]
| Yes
| Yes
| Takes an unknown parameter, outputs a result code and media type.
|-
| 0x00550040
| [[7.0.0-13]]
| Yes
| Yes
| [[APT:SetScreenCapturePostPermission|SetScreenCapturePostPermission]]
|-
| 0x00560000
| [[7.0.0-13]]
| Yes
| Yes
| [[APT:GetScreenCapturePostPermission|GetScreenCapturePostPermission]]
|-
| 0x00570044
| [[7.0.0-13]]
| Yes
| Yes
| [[APT:WakeupApplication2|WakeupApplication2]]
|-
| 0x00580002
| [[7.0.0-13]]
| Yes
| Yes
| [[APT:GetProgramID|GetProgramID]]
|-
| 0x01010000
| [[8.0.0-18]]
| Yes
| Yes
| [[APT:GetTargetPlatform|GetTargetPlatform]]
|-
| 0x01020000
| [[8.0.0-18]]
| Yes
| Yes
| [[APT:CheckNew3DS|CheckNew3DS]]
|-
| 0x01030000
| [[8.0.0-18]]
| Yes
| Yes
| [[APT:GetApplicationRunningMode|GetApplicationRunningMode]]
|-
| 0x01040000
| [[8.0.0-18]]
| Yes
| Yes
| [[APT:IsStandardMemoryLayout|IsStandardMemoryLayout]]
|-
| 0x01050100
| [[10.4.0-29]]
| Yes
| Yes
| [[APT:IsTitleAllowed|IsTitleAllowed]]
|}

These "APT:U" and "APT:S" NS services can handle launching titles/"applets", these services handle signaling for home/power button as well. Only one session for either APT service can be open at a time, normally processes close the service handle immediately once finished using the service. The commands for APT:U and APT:S are exactly the same, however certain commands are only accessible with APT:S(NS module will call [[SVC|svcBreak]] when the command isn't accessible).

Applets returning to home-menu first use commands APT:PrepareToJumpToHomeMenu and APT:JumpToHomeMenu, followed by these commands to launch home-menu: [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]]. [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]] are also used for launching the [[Internet Browser]], the camera applet, etc.

Processes launch applications via home-menu, not directly with [[APT:PrepareToStartApplication]] and [[APT:StartApplication]]. Regular applications can't directly launch applications since [[APT:StartApplication]] launches the process without terminating the currently running application.

APT:PrepareToDoApplicationJump and APT:DoApplicationJump are used by applications, for launching native/<non-NATIVE_FIRM> applications. These commands notify Home Menu that title launching needs done, Home Menu does the actual title launching via NS commands.

== AppletAttr ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-2
| [[NS_and_APT_Services#AppletPos|AppletPos]]
|-
| 3
| Manually Acquire/Release GPU Rights
|-
| 4
| Manually Acquire/Release DSP Rights
|-
| 5
| ?
|}

== DisplayBufferMode ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| FORMAT_R8G8B8A8
|-
| 1
| FORMAT_R8G8B8
|-
| 2
| FORMAT_R5G6B5
|-
| 3
| FORMAT_R5G5B5A1
|-
| 4
| FORMAT_R4G4B4A4
|-
| 0xFFFFFFFF
| FORMAT_UNIMPORTABLE
|}

This is the same mapping as used for the [[GPU/External_Registers#Framebuffer_color_formats|GPU framebuffer color formats]].

== AppletPos ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1
| POS_NONE
|-
| 0
| POS_APP
|-
| 1
| POS_APPLIB
|-
| 2
| POS_SYS
|-
| 3
| POS_SYSLIB
|-
| 4
| POS_RESIDENT
|}

== QueryReply ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| REPLY_REJECT
|-
| 1
| REPLY_ACCEPT
|-
| 2
| REPLY_LATER
|}

== Notification ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NOTIFICATION_NONE
|-
| 1
| NOTIFICATION_HOME_BUTTON_1
|-
| 2
| NOTIFICATION_HOME_BUTTON_2
|-
| 3
| NOTIFICATION_SLEEP_QUERY
|-
| 4
| NOTIFICATION_SLEEP_CANCELED_BY_OPEN
|-
| 5
| NOTIFICATION_SLEEP_ACCEPTED
|-
| 6
| NOTIFICATION_SLEEP_AWAKE
|-
| 7
| NOTIFICATION_SHUTDOWN
|-
| 8
| NOTIFICATION_POWER_BUTTON_CLICK
|-
| 9
| NOTIFICATION_POWER_BUTTON_CLEAR
|-
| 10
| NOTIFICATION_TRY_SLEEP
|-
| 11
| NOTIFICATION_ORDER_TO_CLOSE
|}

== Command ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| COMMAND_NONE
|-
| 1
| COMMAND_WAKEUP
|-
| 2
| COMMAND_REQUEST
|-
| 3
| COMMAND_RESPONSE
|-
| 4
| COMMAND_EXIT
|-
| 5
| COMMAND_MESSAGE
|-
| 6
| COMMAND_HOME_BUTTON_SINGLE
|-
| 7
| COMMAND_HOME_BUTTON_DOUBLE
|-
| 8
| COMMAND_DSP_SLEEP
|-
| 9
| COMMAND_DSP_WAKEUP
|-
| 10
| COMMAND_WAKEUP_BY_EXIT
|-
| 11
| COMMAND_WAKEUP_BY_PAUSE
|-
| 12
| COMMAND_WAKEUP_BY_CANCEL
|-
| 13
| COMMAND_WAKEUP_BY_CANCELALL
|-
| 14
| COMMAND_WAKEUP_BY_POWER_BUTTON_CLICK
|-
| 15
| COMMAND_WAKEUP_TO_JUMP_HOME
|-
| 16
| COMMAND_REQUEST_FOR_SYS_APPLET
|-
| 17
| COMMAND_WAKEUP_TO_LAUNCH_APPLICATION
|-
| 0x41
| Unknown. [[APT:ReceiveParameter|Received]] by Home Menu during boot when the Home Menu process doesn't terminate properly(svcExitProcess/crash).
|}

== AppletPreparationState ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NO_PREPARATION
|-
| 1
| PREPARED_TO_LAUNCH_APP
|-
| 2
| PREPARED_TO_CLOSE_APP
|-
| 3
| PREPARED_TO_FORCE_TO_CLOSE_APP
|-
| 4
| PREPARED_TO_PRELOAD_APPLIB
|-
| 5
| PREPARED_TO_LAUNCH_APPLIB
|-
| 6
| PREPARED_TO_CLOSE_APPLIB
|-
| 7
| PREPARED_TO_LAUNCH_SYS
|-
| 8
| PREPARED_TO_CLOSE_SYS
|-
| 9
| PREPARED_TO_PRELOAD_SYSLIB
|-
| 10
| PREPARED_TO_LAUNCH_SYSLIB
|-
| 11
| PREPARED_TO_CLOSE_SYSLIB
|-
| 12
| PREPARED_TO_LAUNCH_RESIDENT
|-
| 13
| PREPARED_TO_LEAVE_RESIDENT
|-
| 14
| PREPARED_TO_DO_HOMEMENU
|-
| 15
| PREPARED_TO_LEAVE_HOMEMENU
|-
| 16
| PREPARED_TO_START_RESIDENT
|-
| 17
| PREPARED_TO_DO_APP_JUMP
|-
| 18
| PREPARED_TO_FORCE_TO_CLOSE_SYS
|-
| 19
| PREPARED_TO_LAUNCH_OTHER_SYS
|-
| 20
| PREPARED_TO_JUMP_TO_APP
|}

== StartupArgumentType ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| STARTUP_ARGUMENT_TYPE_OTHER_APP
|-
| 1
| STARTUP_ARGUMENT_TYPE_RESTART
|-
| 2
| STARTUP_ARGUMENT_TYPE_OTHER_MEDIA
|}

== CaptureBufferInfo ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, Size
|-
| 0x4
| 0x1
| u8, 3D (0 = not 3D, 1 = 3D)
|-
| 0x5
| 0x3
| Reserved
|-
| 0x8
| 0x4
| Main Screen Left Offset
|-
| 0xC
| 0x4
| Main Screen Right Offset
|-
| 0x10
| 0x4
| Main Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|-
| 0x14
| 0x4
| Sub Screen Left Offset
|-
| 0x18
| 0x4
| Sub Screen Right Offset
|-
| 0x1C
| 0x4
| Sub Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|}

==WirelessRebootInfo==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address.
|-
| 0x6
| 0x9
| WirelessRebootPassphrase
|-
| 0xF
| 0x1
| Uninitialized
|}

This is [[NSS:SetWirelessRebootInfo|setup]] by the dlplay system-application, before launching the DLP-child which can then use [[APT:GetWirelessRebootInfo]]. The MAC address and passphrase is used for connecting to the host by the DLP-child. See also [[DLP_Services|here]].

="APT:A" Service=
This was added with [[7.0.0-13|7.0.0-X]]. Official apps built with the CTRSDK for system-version >=[[7.0.0-13|7.0.0-X]] normally use the "APT:A" service instead of "APT:U". Those processes also have "APT:A" instead of "APT:U" in the service-access-control. It's unknown whether there's anything which is only accessible via "APT:A".

=Applets=
NS module does not verify that the input appID for the APT service cmds are correct for that type of command. For example, a process-launch of a SystemApplet via LibraryApplet commands works fine(minus the launched-process side of APT probably).

==System Applets==
On Old3DS there could only be one applet here(Home Menu, Internet Browser, Friend-List, etc) with programID-high 00040030 running at a time. On Old3DS when directly launching one of these 00040030 applets with Home Menu, the Home Menu process will terminate once the process is launched. On Old3DS when returning to Home Menu from that launched process, the Home Menu process is launched again.

On New3DS the Home Menu process is still running/in-memory, while another system-applet is running. On New3DS it appears that the Home Menu process is terminated+relaunched, when another system-applet terminated without exiting with APT properly.

==Library Applets==
Library applets can be launched by applications and regular applets. These library applets render to the screen(s) when running, etc. For example, this includes swkbd for text input. See the below appIDs in the 0x2XX range, the actual appID used is 0x4XX however.

Input data can be sent to the library applet via the NS [[APT:SendParameter|parameter]] buffer, and/or with shared-memory with a shared-mem handle sent to the library applet. Output data from the library applet can be received by [[APT:ReceiveParameter]], the library applet can also use the specified shared-mem for output too.

=AppIDs=
{| class="wikitable" border="1"
|-
! AppID
! Description
|-
| 0x101
| [[Home Menu]] (menu)
|-
| 0x103
| Alternate Menu
|-
| 0x110
| Camera applet ([[Camera Applet|CtrApp]])
|-
| 0x112
| Friends List applet ([[Friend List|friend]])
|-
| 0x113
| Game Notes applet (Cherry)
|-
| 0x114
| [[Internet Browser]] (spider/SKATER)
|-
| 0x115
| Instruction Manual applet
|-
| 0x116
| [[Notifications]] applet (newslist)
|-
| 0x117
| Miiverse applet (olv)
|-
| 0x118
| [[Miiverse]] posting applet (solv3)
|-
| 0x119
| Amiibo settings (cabinet)
|-
| 0x201
| Software Keyboard (swkbd) (?)
|-
| 0x202
| [[Mii Selector]] (appletEd) (?)
|-
| 0x204
| Photo Selector (PNOTE_AP) (?)
|-
| 0x205
| Sound Selector (SNOTE_AP) (?)
|-
| 0x206
| Error Display ([[ErrDisp|error]]) (?)
|-
| 0x207
| eShop applet ([[EShop#NS_eShop_application_parameters|mint]]) (?)
|-
| 0x208
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]]) (?)
|-
| 0x209
| Notepad (memolib) (?)
|-
| 0x300
| Application
|-
| 0x301
| eShop (tiger)
|-
| 0x401
| Software Keyboard (swkbd)
|-
| 0x402
| Mii Selector (appletEd)
|-
| 0x404
| Photo Selector (PNOTE_AP)
|-
| 0x405
| Sound Selector (SNOTE_AP)
|-
| 0x406
| Error Display (error)
|-
| 0x407
| eShop applet (mint)
|-
| 0x408
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]])
|-
| 0x409
| Notepad (memolib)
|-
| 0xF10
| ProgramID: 0004003000008900.
|-
| 0xF11
| ProgramID: 000400000FFFFD00.
|-
| 0xF12
| ProgramID: 000400000FFFFC00.
|-
| 0xF13
| ProgramID: 000400000FFFFB00.
|-
| 0xF14
| ProgramID: 000400000FFFF900.
|-
| 0xF15
| ProgramID: 000400000FFFF800.
|-
| 0xF16
| ProgramID: 000400000FFFF700.
|-
| 0xF17
| ProgramID: 000400000FFFF600.
|-
| 0xF18
| ProgramID: 000400000FFFF500.
|}

These AppIDs are all for NAND titles, except for 0x300. AppIDs in the 0x1XX range are applets(programID-high 00040030), and the AppIDs in the 0x2XX range are "system libraries"(programID-high 00040030). The 0xFXX AppID range is for development NAND applications, these are not available for retail.

Note that at some point the total AppID entry count was changed from 28 to 27.

NS and APT Services

2023-07-23T20:30:58Z

Steveice10: /* APT Services */

[[Category:Services]]
The NS ('''N'''intendo User Interface '''S'''hell) system module is the first module launched from a CTR-NAND title after the [[FIRM]] processes are loaded (also see [[Bootloader]]). This module is launched by the pm process, with the titleID loaded from NS state(hard-coded TID initialized during applet TID-array initialization). NS first launches [[ErrDisp]], then the menu. On retail the menu TID is loaded from NS state, while on dev/debug the menu TID is loaded from [[Config_Savegame|config]]. On dev-units if the menu TID block doesn't exist in [[Config_Savegame|config]], NS will attempt to launch the alternate menu instead. The TID of the launched menu is then written to [[Configuration Memory|ACTIVEMENUTID]]. NS uses [[PMApp:LaunchTitle|pm:app]] to launch titles.

NS will not trigger the [[ErrDisp|fatal-error]] screen when launching the regular/alternate menu fails.

Like home menu NS is constantly running while the system is in 3DS-mode. When attempting to return to home-menu when the home-menu process isn't running(like when the process terminated/crashed), NS will trigger a [[ErrDisp|fatal]] error.

= Alternate menu =
When launching the regular menu fails, NS will then attempt to launch the alternate menu. This title could be used as a recovery process, however it's normally not used after the factory.

At the factory for all 3DS systems, [[3DS Development Unit GUI#Test Menu|Test Menu]] is installed with this TID. On retail this title is eventually deleted during [[Factory Setup]].

= Auto-boot =
After [[PMApp:GetFIRMLaunchParams|loading]] [[FIRM]] params and prior to launching [[ErrDisp]]/Home Menu, NS handles auto-booting titles. The same code called by [[APT:Reboot]] is used for launching FIRM here. When the [[Configuration_Memory|UPDATEFLAG]] is set, NS will launch SAFE_MODE_FIRM with the application titleID set to the [[System_Settings#System_Updater|System Updater]] titleID for this region. When the UPDATEFLAG is not set, NS can auto-boot the following titles as well if [[Configuration_Memory|0x1FF80016]] bit0 is set.

When bit1 and bit2 are value zero in [[Configuration_Memory|0x1FF80016]], NS will [[NSS:LaunchFIRM|launch]] the title specified by the [[FIRM]] parameters if the title-info is set. This FIRM launch is done after launching [[ErrDisp]] and Home Menu. Otherwise when [[Configuration_Memory|0x1FF80016]] is value 2 and the output u8 from [[PTM|PTMSYSM]] command 0x08140000 is value 0, NS will boot the title specified from the TWL TLNC block from FIRMparams+0x300. This is the same TLNC block which DSi titles wrote to RAM+0x300 for launching other titles via the launcher title. When handling the TLNC block, NS will boot the 3DS System Settings title when the TLNC titleID is the DSi System Settings titleID(the region field in the TLNC TID is not checked/used). When the TLNC titleID is not System Settings, NS will convert the input DSi titleID-high to the 3DS TWL titleID-high(tidhigh = (TLNCtidhigh & 0x7FFF) | 0x48000), then launch TWL_FIRM to run the title. NS does not support launching from gamecard via TLNC.

= NS Workaround =
A "ns_workaround" was [[5.1.0-11|added]] in NS to workaround the flaw added with [[5.0.0-11]]. When NS is loading before launching any ARM11 processes and certain [[Configuration Memory]] fields are set, NS will launch [[Application_Manager_Services|AM]] then use command [[AM:InstallNATIVEFIRM]]. NS will then execute the code called by [[APT:StartNewestHomeMenu]], the code related to APT:PrepareToStartNewestHomeMenu is not executed here.

NS will only execute this code-path when [[Configuration Memory|0x1FF80016]] is value zero, when KERNEL_VERSIONMAJOR is value 2, and when KERNEL_VERSIONMINOR is less than 35. Therefore, this code-path is only executed when the running NATIVE_FIRM version is prior to [[5.0.0-11]].

= NS Service "ns:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchFIRM|LaunchFIRM]]
|-
| 0x000200C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchTitle|LaunchTitle]]
|-
| 0x00030000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateApplication|TerminateApplication]]
|-
| 0x00040040
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateProcess|TerminateProcess]]
|-
| 0x000500C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchApplicationFIRM|LaunchApplicationFIRM]]
|-
| 0x00060042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetWirelessRebootInfo|SetWirelessRebootInfo]]
|-
| 0x00070042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateInitialize|CardUpdateInitialize]]
|-
| 0x00080000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateShutdown|CardUpdateShutdown]]
|-
| 0x00090000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000A0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000B0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000C0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000D0140
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetTWLBannerHMAC|SetTWLBannerHMAC]]
|-
| 0x000E0000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:ShutdownAsync|ShutdownAsync]]
|-
| 0x000F0000
| [[1.0.0-0]] - [[2.0.0-2]]
| This calls [[APT:AppletUtility]] with fixed input params.
|-
| 0x00100180
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:RebootSystem|RebootSystem]]
|-
| 0x00110100
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateTitle|TerminateTitle]]
|-
| 0x001200C0
| ?
| [[NSS:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00130000
| ?
| ?
|-
| 0x00140042
| ?
| ?
|-
| 0x00150140
| ?
| [[NSS:LaunchApplication|LaunchApplication]]
|-
| 0x00160000
| [[8.0.0-18]]
| [[NSS:RebootSystemClean|RebootSystemClean]]
|}

The maximum sessions that can be used with this service is two, therefore only two processes can use this service at the same time.

=NS Power Service "ns:p"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| [[NSP:RebootSystem|RebootSystem]]
|-
| 0x00020000
| [[NSS:ShutdownAsync|ShutdownAsync]]
|}

This was added with [[3.0.0-5]]. The PTM sysmodule connects to this service, and syncs whenever [[PTM|ptm:s GetShellState()]] changes.

=NS Service "ns:c"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010100
| [[NSC:LockSpecialContent|LockSpecialContent]]
|-
| 0x00020100
| [[NSC:UnlockSpecialContent|UnlockSpecialContent]]
|}

This was added with [[5.0.0-11]]. It is used by the Instruction Manual applet, and is likely related to triggering SD/Game Card removal errors when ejecting the media the manual is stored on.

=APT Services=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Accessible with APT:U
! Accessible with APT:A
! Description
|-
| 0x00010040
|
| Yes
| Yes
| [[APT:GetLockHandle|GetLockHandle]]
|-
| 0x00020080
|
| See [[APT:Initialize|here]].
| See [[APT:Initialize|here]].
| [[APT:Initialize|Initialize]]
|-
| 0x00030040
|
| Yes
| Yes
| [[APT:Enable|Enable]]
|-
| 0x00040040
|
| Yes
| Yes
| [[APT:Finalize|Finalize]]
|-
| 0x00050040
|
| Yes
| Yes
| [[APT:GetAppletManInfo|GetAppletManInfo]]
|-
| 0x00060040
|
| Yes (AppID != 0x300)
| Yes
| [[APT:GetAppletInfo|GetAppletInfo]]
|-
| 0x00070000
|
| Yes
| Yes
| [[APT:GetLastSignaledAppletId|GetLastSignaledAppletId]]
|-
| 0x00080000
|
| Yes
| Yes
| [[APT:CountRegisteredApplet|CountRegisteredApplet]]
|-
| 0x00090040
|
| Yes
| Yes
| [[APT:IsRegistered|IsRegistered]]
|-
| 0x000A0040
|
| Yes
| Yes
| [[APT:GetAttribute|GetAttribute]]
|-
| 0x000B0040
|
| Yes
| Yes
| [[APT:InquireNotification|InquireNotification]]
|-
| 0x000C0104
|
| Yes
| Yes
| [[APT:SendParameter|SendParameter]]
|-
| 0x000D0080
|
| Yes
| Yes
| [[APT:ReceiveParameter|ReceiveParameter]]
|-
| 0x000E0080
|
| Yes
| Yes
| [[APT:GlanceParameter|GlanceParameter]]
|-
| 0x000F0100
|
| Yes
| Yes
| [[APT:CancelParameter|CancelParameter]]
|-
| 0x001000C2
|
| Yes
| Yes
| [[APT:DebugFunc|DebugFunc]]
|-
| 0x001100C0
|
| Yes
| Yes
| [[APT:MapProgramIdForDebug|MapProgramIdForDebug]]
|-
| 0x00120040
|
| Yes
| Yes
| [[APT:SetHomeMenuAppletIdForDebug|SetHomeMenuAppletIdForDebug]]
|-
| 0x00130000
|
| Yes
| Yes
| [[APT:GetPreparationState|GetPreparationState]]
|-
| 0x00140040
|
| Yes
| Yes
| [[APT:SetPreparationState|SetPreparationState]]
|-
| 0x00150140
|
| No
| No
| [[APT:PrepareToStartApplication|PrepareToStartApplication]]
|-
| 0x00160040
|
| Yes
| Yes
| [[APT:PreloadLibraryApplet|PreloadLibraryApplet]]
|-
| 0x00170040
|
| Yes
| Yes
| [[APT:FinishPreloadingLibraryApplet|FinishPreloadingLibraryApplet]]
|-
| 0x00180040
|
| Yes
| Yes
| [[APT:PrepareToStartLibraryApplet|PrepareToStartLibraryApplet]]
|-
| 0x00190040
|
| Yes
| Yes
| [[APT:PrepareToStartSystemApplet|PrepareToStartSystemApplet]]
|-
| 0x001A0000
|
| Yes
| Yes
| [[APT:PrepareToStartNewestHomeMenu|PrepareToStartNewestHomeMenu]]
|-
| 0x001B00C4
|
| Yes
| Yes
| [[APT:StartApplication|StartApplication]]
|-
| 0x001C0000
|
| Yes
| Yes
| [[APT:WakeupApplication|WakeupApplication]]
|-
| 0x001D0000
|
| Yes
| Yes
| [[APT:CancelApplication|CancelApplication]]
|-
| 0x001E0084
|
| Yes
| Yes
| [[APT:StartLibraryApplet|StartLibraryApplet]]
|-
| 0x001F0084
|
| Yes
| Yes
| [[APT:StartSystemApplet|StartSystemApplet]]
|-
| 0x00200044
|
| Yes
| Yes
| [[APT:StartNewestHomeMenu|StartNewestHomeMenu]]
|-
| 0x00210000
|
| No
| No
| [[APT:OrderToCloseApplication|OrderToCloseApplication]]
|-
| 0x00220040
|
| Yes
| Yes
| [[APT:PrepareToCloseApplication|PrepareToCloseApplication]]
|-
| 0x00230040
|
| Yes
| Yes
| [[APT:PrepareToJumpToApplication|PrepareToJumpToApplication]]
|-
| 0x00240044
|
| Yes
| Yes
| [[APT:JumpToApplication|JumpToApplication]]
|-
| 0x002500C0
|
| Yes
| Yes
| [[APT:PrepareToCloseLibraryApplet|PrepareToCloseLibraryApplet]]
|-
| 0x00260000
|
| Yes
| Yes
| [[APT:PrepareToCloseSystemApplet|PrepareToCloseSystemApplet]]
|-
| 0x00270044
|
| Yes
| Yes
| [[APT:CloseApplication|CloseApplication]]
|-
| 0x00280044
|
| Yes
| Yes
| [[APT:CloseLibraryApplet|CloseLibraryApplet]]
|-
| 0x00290044
|
| Yes
| Yes
| [[APT:CloseSystemApplet|CloseSystemApplet]]
|-
| 0x002A0000
|
| Yes
| Yes
| [[APT:OrderToCloseSystemApplet|OrderToCloseSystemApplet]]
|-
| 0x002B0000
|
| Yes
| Yes
| [[APT:PrepareToJumpToHomeMenu|PrepareToJumpToHomeMenu]]
|-
| 0x002C0044
|
| Yes
| Yes
| [[APT:JumpToHomeMenu|JumpToHomeMenu]]
|-
| 0x002D0000
|
| Yes
| Yes
| [[APT:PrepareToLeaveHomeMenu|PrepareToLeaveHomeMenu]]
|-
| 0x002E0044
|
| Yes
| Yes
| [[APT:LeaveHomeMenu|LeaveHomeMenu]]
|-
| 0x002F0040
|
| Yes
| Yes
| [[APT:PrepareToLeaveResidentApplet|PrepareToLeaveResidentApplet]]
|-
| 0x00300044
|
| Yes
| Yes
| [[APT:LeaveResidentApplet|LeaveResidentApplet]]
|-
| 0x00310100
|
| Yes
| Yes
| [[APT:PrepareToDoApplicationJump|PrepareToDoApplicationJump]]
|-
| 0x00320084
|
| Yes
| Yes
| [[APT:DoApplicationJump|DoApplicationJump]]
|-
| 0x00330000
|
| Yes
| Yes
| [[APT:GetProgramIdOnApplicationJump|GetProgramIdOnApplicationJump]]
|-
| 0x00340084
|
| Yes
| Yes
| [[APT:SendDeliverArg|SendDeliverArg]]
|-
| 0x00350080
|
| Yes
| Yes
| [[APT:ReceiveDeliverArg|ReceiveDeliverArg]]
|-
| 0x00360040
|
| Yes
| Yes
| [[APT:LoadSysMenuArg|LoadSysMenuArg]]
|-
| 0x00370042
|
| Yes
| Yes
| [[APT:StoreSysMenuArg|StoreSysMenuArg]]
|-
| 0x00380040
|
| Yes
| Yes
| [[APT:PreloadResidentApplet|PreloadResidentApplet]]
|-
| 0x00390040
|
| Yes
| Yes
| [[APT:PrepareToStartResidentApplet|PrepareToStartResidentApplet]]
|-
| 0x003A0044
|
| Yes
| Yes
| [[APT:StartResidentApplet|StartResidentApplet]]
|-
| 0x003B0040
|
| Yes
| Yes
| [[APT:CancelLibraryApplet|CancelLibraryApplet]]
|-
| 0x003C0042
|
| Yes
| Yes
| [[APT:SendDspSleep|SendDspSleep]]
|-
| 0x003D0042
|
| Yes
| Yes
| [[APT:SendDspWakeUp|SendDspWakeUp]]
|-
| 0x003E0080
|
| Yes
| Yes
| [[APT:ReplySleepQuery|ReplySleepQuery]]
|-
| 0x003F0040
|
| Yes
| Yes
| [[APT:ReplySleepNotificationComplete|ReplySleepNotificationComplete]]
|-
| 0x00400042
|
| Yes
| Yes
| [[APT:SendCaptureBufferInfo|SendCaptureBufferInfo]]
|-
| 0x00410040
|
| Yes
| Yes
| [[APT:ReceiveCaptureBufferInfo|ReceiveCaptureBufferInfo]]
|-
| 0x00420080
|
| Yes
| Yes
| [[APT:SleepSystem|SleepSystem]]
|-
| 0x00430040
|
| Yes
| Yes
| [[APT:NotifyToWait|NotifyToWait]]
|-
| 0x00440000
|
| Yes
| Yes
| [[APT:GetSharedFont|GetSharedFont]]
|-
| 0x00450040
|
| Yes
| Yes
| [[APT:GetWirelessRebootInfo|GetWirelessRebootInfo]]
|-
| 0x00460104
|
| Yes
| Yes
| [[APT:Wrap|Wrap]]
|-
| 0x00470104
|
| Yes
| Yes
| [[APT:Unwrap|Unwrap]]
|-
| 0x00480100
|
| No
| No
| [[APT:GetProgramInfo|GetProgramInfo]]
|-
| 0x00490180
|
| No
| No
| [[APT:Reboot|Reboot]]
|-
| 0x004A0040
|
| Yes
| Yes
| [[APT:GetCaptureInfo|GetCaptureInfo]]
|-
| 0x004B00C2
|
| Yes
| Yes
| [[APT:AppletUtility|AppletUtility]]
|-
| 0x004C0000
|
| Yes
| Yes
| [[APT:SetFatalErrDispMode|SetFatalErrDispMode]]
|-
| 0x004D0080
|
| Yes
| Yes
| [[APT:GetAppletProgramInfo|GetAppletProgramInfo]]
|-
| 0x004E0000
|
| Yes
| Yes
| [[APT:HardwareResetAsync|HardwareResetAsync]]
|-
| 0x004F0080
| [[2.2.0-X]]
| Yes
| Yes
| [[APT:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00500040
| [[2.2.0-X]]
| Yes
| Yes
| [[APT:GetApplicationCpuTimeLimit|GetApplicationCpuTimeLimit]]
|-
| 0x00510080
| [[3.0.0-5]]
| Yes
| Yes
| [[APT:GetStartupArgument|GetStartupArgument]]
|-
| 0x00520104
| [[4.0.0-7]]
| Yes
| Yes
| [[APT:Wrap1|Wrap1]]
|-
| 0x00530104
| [[4.0.0-7]]
| Yes
| Yes
| [[APT:Unwrap1|Unwrap1]]
|-
| 0x00540040
| [[5.0.0-11]]
| Yes
| Yes
| ?
|-
| 0x00550040
| [[7.0.0-13]]
| Yes
| Yes
| [[APT:SetScreenCapturePostPermission|SetScreenCapturePostPermission]]
|-
| 0x00560000
| [[7.0.0-13]]
| Yes
| Yes
| [[APT:GetScreenCapturePostPermission|GetScreenCapturePostPermission]]
|-
| 0x00570044
| [[7.0.0-13]]
| Yes
| Yes
| [[APT:WakeupApplication2|WakeupApplication2]]
|-
| 0x00580002
| [[7.0.0-13]]
| Yes
| Yes
| [[APT:GetProgramID|GetProgramID]]
|-
| 0x01010000
| [[8.0.0-18]]
| Yes
| Yes
| [[APT:GetTargetPlatform|GetTargetPlatform]]
|-
| 0x01020000
| [[8.0.0-18]]
| Yes
| Yes
| [[APT:CheckNew3DS|CheckNew3DS]]
|-
| 0x01030000
| [[8.0.0-18]]
| Yes
| Yes
| [[APT:GetApplicationRunningMode|GetApplicationRunningMode]]
|-
| 0x01040000
| [[8.0.0-18]]
| Yes
| Yes
| [[APT:IsStandardMemoryLayout|IsStandardMemoryLayout]]
|-
| 0x01050100
| [[10.4.0-29]]
| Yes
| Yes
| [[APT:IsTitleAllowed|IsTitleAllowed]]
|}

These "APT:U" and "APT:S" NS services can handle launching titles/"applets", these services handle signaling for home/power button as well. Only one session for either APT service can be open at a time, normally processes close the service handle immediately once finished using the service. The commands for APT:U and APT:S are exactly the same, however certain commands are only accessible with APT:S(NS module will call [[SVC|svcBreak]] when the command isn't accessible).

Applets returning to home-menu first use commands APT:PrepareToJumpToHomeMenu and APT:JumpToHomeMenu, followed by these commands to launch home-menu: [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]]. [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]] are also used for launching the [[Internet Browser]], the camera applet, etc.

Processes launch applications via home-menu, not directly with [[APT:PrepareToStartApplication]] and [[APT:StartApplication]]. Regular applications can't directly launch applications since [[APT:StartApplication]] launches the process without terminating the currently running application.

APT:PrepareToDoApplicationJump and APT:DoApplicationJump are used by applications, for launching native/<non-NATIVE_FIRM> applications. These commands notify Home Menu that title launching needs done, Home Menu does the actual title launching via NS commands.

== AppletAttr ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-2
| [[NS_and_APT_Services#AppletPos|AppletPos]]
|-
| 3
| Manually Acquire/Release GPU Rights
|-
| 4
| Manually Acquire/Release DSP Rights
|-
| 5
| ?
|}

== DisplayBufferMode ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| FORMAT_R8G8B8A8
|-
| 1
| FORMAT_R8G8B8
|-
| 2
| FORMAT_R5G6B5
|-
| 3
| FORMAT_R5G5B5A1
|-
| 4
| FORMAT_R4G4B4A4
|-
| 0xFFFFFFFF
| FORMAT_UNIMPORTABLE
|}

This is the same mapping as used for the [[GPU/External_Registers#Framebuffer_color_formats|GPU framebuffer color formats]].

== AppletPos ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1
| POS_NONE
|-
| 0
| POS_APP
|-
| 1
| POS_APPLIB
|-
| 2
| POS_SYS
|-
| 3
| POS_SYSLIB
|-
| 4
| POS_RESIDENT
|}

== QueryReply ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| REPLY_REJECT
|-
| 1
| REPLY_ACCEPT
|-
| 2
| REPLY_LATER
|}

== Notification ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NOTIFICATION_NONE
|-
| 1
| NOTIFICATION_HOME_BUTTON_1
|-
| 2
| NOTIFICATION_HOME_BUTTON_2
|-
| 3
| NOTIFICATION_SLEEP_QUERY
|-
| 4
| NOTIFICATION_SLEEP_CANCELED_BY_OPEN
|-
| 5
| NOTIFICATION_SLEEP_ACCEPTED
|-
| 6
| NOTIFICATION_SLEEP_AWAKE
|-
| 7
| NOTIFICATION_SHUTDOWN
|-
| 8
| NOTIFICATION_POWER_BUTTON_CLICK
|-
| 9
| NOTIFICATION_POWER_BUTTON_CLEAR
|-
| 10
| NOTIFICATION_TRY_SLEEP
|-
| 11
| NOTIFICATION_ORDER_TO_CLOSE
|}

== Command ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| COMMAND_NONE
|-
| 1
| COMMAND_WAKEUP
|-
| 2
| COMMAND_REQUEST
|-
| 3
| COMMAND_RESPONSE
|-
| 4
| COMMAND_EXIT
|-
| 5
| COMMAND_MESSAGE
|-
| 6
| COMMAND_HOME_BUTTON_SINGLE
|-
| 7
| COMMAND_HOME_BUTTON_DOUBLE
|-
| 8
| COMMAND_DSP_SLEEP
|-
| 9
| COMMAND_DSP_WAKEUP
|-
| 10
| COMMAND_WAKEUP_BY_EXIT
|-
| 11
| COMMAND_WAKEUP_BY_PAUSE
|-
| 12
| COMMAND_WAKEUP_BY_CANCEL
|-
| 13
| COMMAND_WAKEUP_BY_CANCELALL
|-
| 14
| COMMAND_WAKEUP_BY_POWER_BUTTON_CLICK
|-
| 15
| COMMAND_WAKEUP_TO_JUMP_HOME
|-
| 16
| COMMAND_REQUEST_FOR_SYS_APPLET
|-
| 17
| COMMAND_WAKEUP_TO_LAUNCH_APPLICATION
|-
| 0x41
| Unknown. [[APT:ReceiveParameter|Received]] by Home Menu during boot when the Home Menu process doesn't terminate properly(svcExitProcess/crash).
|}

== AppletPreparationState ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NO_PREPARATION
|-
| 1
| PREPARED_TO_LAUNCH_APP
|-
| 2
| PREPARED_TO_CLOSE_APP
|-
| 3
| PREPARED_TO_FORCE_TO_CLOSE_APP
|-
| 4
| PREPARED_TO_PRELOAD_APPLIB
|-
| 5
| PREPARED_TO_LAUNCH_APPLIB
|-
| 6
| PREPARED_TO_CLOSE_APPLIB
|-
| 7
| PREPARED_TO_LAUNCH_SYS
|-
| 8
| PREPARED_TO_CLOSE_SYS
|-
| 9
| PREPARED_TO_PRELOAD_SYSLIB
|-
| 10
| PREPARED_TO_LAUNCH_SYSLIB
|-
| 11
| PREPARED_TO_CLOSE_SYSLIB
|-
| 12
| PREPARED_TO_LAUNCH_RESIDENT
|-
| 13
| PREPARED_TO_LEAVE_RESIDENT
|-
| 14
| PREPARED_TO_DO_HOMEMENU
|-
| 15
| PREPARED_TO_LEAVE_HOMEMENU
|-
| 16
| PREPARED_TO_START_RESIDENT
|-
| 17
| PREPARED_TO_DO_APP_JUMP
|-
| 18
| PREPARED_TO_FORCE_TO_CLOSE_SYS
|-
| 19
| PREPARED_TO_LAUNCH_OTHER_SYS
|-
| 20
| PREPARED_TO_JUMP_TO_APP
|}

== StartupArgumentType ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| STARTUP_ARGUMENT_TYPE_OTHER_APP
|-
| 1
| STARTUP_ARGUMENT_TYPE_RESTART
|-
| 2
| STARTUP_ARGUMENT_TYPE_OTHER_MEDIA
|}

== CaptureBufferInfo ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, Size
|-
| 0x4
| 0x1
| u8, 3D (0 = not 3D, 1 = 3D)
|-
| 0x5
| 0x3
| Reserved
|-
| 0x8
| 0x4
| Main Screen Left Offset
|-
| 0xC
| 0x4
| Main Screen Right Offset
|-
| 0x10
| 0x4
| Main Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|-
| 0x14
| 0x4
| Sub Screen Left Offset
|-
| 0x18
| 0x4
| Sub Screen Right Offset
|-
| 0x1C
| 0x4
| Sub Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|}

==WirelessRebootInfo==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address.
|-
| 0x6
| 0x9
| WirelessRebootPassphrase
|-
| 0xF
| 0x1
| Uninitialized
|}

This is [[NSS:SetWirelessRebootInfo|setup]] by the dlplay system-application, before launching the DLP-child which can then use [[APT:GetWirelessRebootInfo]]. The MAC address and passphrase is used for connecting to the host by the DLP-child. See also [[DLP_Services|here]].

="APT:A" Service=
This was added with [[7.0.0-13|7.0.0-X]]. Official apps built with the CTRSDK for system-version >=[[7.0.0-13|7.0.0-X]] normally use the "APT:A" service instead of "APT:U". Those processes also have "APT:A" instead of "APT:U" in the service-access-control. It's unknown whether there's anything which is only accessible via "APT:A".

=Applets=
NS module does not verify that the input appID for the APT service cmds are correct for that type of command. For example, a process-launch of a SystemApplet via LibraryApplet commands works fine(minus the launched-process side of APT probably).

==System Applets==
On Old3DS there could only be one applet here(Home Menu, Internet Browser, Friend-List, etc) with programID-high 00040030 running at a time. On Old3DS when directly launching one of these 00040030 applets with Home Menu, the Home Menu process will terminate once the process is launched. On Old3DS when returning to Home Menu from that launched process, the Home Menu process is launched again.

On New3DS the Home Menu process is still running/in-memory, while another system-applet is running. On New3DS it appears that the Home Menu process is terminated+relaunched, when another system-applet terminated without exiting with APT properly.

==Library Applets==
Library applets can be launched by applications and regular applets. These library applets render to the screen(s) when running, etc. For example, this includes swkbd for text input. See the below appIDs in the 0x2XX range, the actual appID used is 0x4XX however.

Input data can be sent to the library applet via the NS [[APT:SendParameter|parameter]] buffer, and/or with shared-memory with a shared-mem handle sent to the library applet. Output data from the library applet can be received by [[APT:ReceiveParameter]], the library applet can also use the specified shared-mem for output too.

=AppIDs=
{| class="wikitable" border="1"
|-
! AppID
! Description
|-
| 0x101
| [[Home Menu]] (menu)
|-
| 0x103
| Alternate Menu
|-
| 0x110
| Camera applet ([[Camera Applet|CtrApp]])
|-
| 0x112
| Friends List applet ([[Friend List|friend]])
|-
| 0x113
| Game Notes applet (Cherry)
|-
| 0x114
| [[Internet Browser]] (spider/SKATER)
|-
| 0x115
| Instruction Manual applet
|-
| 0x116
| [[Notifications]] applet (newslist)
|-
| 0x117
| Miiverse applet (olv)
|-
| 0x118
| [[Miiverse]] posting applet (solv3)
|-
| 0x119
| Amiibo settings (cabinet)
|-
| 0x201
| Software Keyboard (swkbd) (?)
|-
| 0x202
| [[Mii Selector]] (appletEd) (?)
|-
| 0x204
| Photo Selector (PNOTE_AP) (?)
|-
| 0x205
| Sound Selector (SNOTE_AP) (?)
|-
| 0x206
| Error Display ([[ErrDisp|error]]) (?)
|-
| 0x207
| eShop applet ([[EShop#NS_eShop_application_parameters|mint]]) (?)
|-
| 0x208
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]]) (?)
|-
| 0x209
| Notepad (memolib) (?)
|-
| 0x300
| Application
|-
| 0x301
| eShop (tiger)
|-
| 0x401
| Software Keyboard (swkbd)
|-
| 0x402
| Mii Selector (appletEd)
|-
| 0x404
| Photo Selector (PNOTE_AP)
|-
| 0x405
| Sound Selector (SNOTE_AP)
|-
| 0x406
| Error Display (error)
|-
| 0x407
| eShop applet (mint)
|-
| 0x408
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]])
|-
| 0x409
| Notepad (memolib)
|-
| 0xF10
| ProgramID: 0004003000008900.
|-
| 0xF11
| ProgramID: 000400000FFFFD00.
|-
| 0xF12
| ProgramID: 000400000FFFFC00.
|-
| 0xF13
| ProgramID: 000400000FFFFB00.
|-
| 0xF14
| ProgramID: 000400000FFFF900.
|-
| 0xF15
| ProgramID: 000400000FFFF800.
|-
| 0xF16
| ProgramID: 000400000FFFF700.
|-
| 0xF17
| ProgramID: 000400000FFFF600.
|-
| 0xF18
| ProgramID: 000400000FFFF500.
|}

These AppIDs are all for NAND titles, except for 0x300. AppIDs in the 0x1XX range are applets(programID-high 00040030), and the AppIDs in the 0x2XX range are "system libraries"(programID-high 00040030). The 0xFXX AppID range is for development NAND applications, these are not available for retail.

Note that at some point the total AppID entry count was changed from 28 to 27.

NS and APT Services

2023-07-23T20:28:33Z

Steveice10: /* APT Services */

[[Category:Services]]
The NS ('''N'''intendo User Interface '''S'''hell) system module is the first module launched from a CTR-NAND title after the [[FIRM]] processes are loaded (also see [[Bootloader]]). This module is launched by the pm process, with the titleID loaded from NS state(hard-coded TID initialized during applet TID-array initialization). NS first launches [[ErrDisp]], then the menu. On retail the menu TID is loaded from NS state, while on dev/debug the menu TID is loaded from [[Config_Savegame|config]]. On dev-units if the menu TID block doesn't exist in [[Config_Savegame|config]], NS will attempt to launch the alternate menu instead. The TID of the launched menu is then written to [[Configuration Memory|ACTIVEMENUTID]]. NS uses [[PMApp:LaunchTitle|pm:app]] to launch titles.

NS will not trigger the [[ErrDisp|fatal-error]] screen when launching the regular/alternate menu fails.

Like home menu NS is constantly running while the system is in 3DS-mode. When attempting to return to home-menu when the home-menu process isn't running(like when the process terminated/crashed), NS will trigger a [[ErrDisp|fatal]] error.

= Alternate menu =
When launching the regular menu fails, NS will then attempt to launch the alternate menu. This title could be used as a recovery process, however it's normally not used after the factory.

At the factory for all 3DS systems, [[3DS Development Unit GUI#Test Menu|Test Menu]] is installed with this TID. On retail this title is eventually deleted during [[Factory Setup]].

= Auto-boot =
After [[PMApp:GetFIRMLaunchParams|loading]] [[FIRM]] params and prior to launching [[ErrDisp]]/Home Menu, NS handles auto-booting titles. The same code called by [[APT:Reboot]] is used for launching FIRM here. When the [[Configuration_Memory|UPDATEFLAG]] is set, NS will launch SAFE_MODE_FIRM with the application titleID set to the [[System_Settings#System_Updater|System Updater]] titleID for this region. When the UPDATEFLAG is not set, NS can auto-boot the following titles as well if [[Configuration_Memory|0x1FF80016]] bit0 is set.

When bit1 and bit2 are value zero in [[Configuration_Memory|0x1FF80016]], NS will [[NSS:LaunchFIRM|launch]] the title specified by the [[FIRM]] parameters if the title-info is set. This FIRM launch is done after launching [[ErrDisp]] and Home Menu. Otherwise when [[Configuration_Memory|0x1FF80016]] is value 2 and the output u8 from [[PTM|PTMSYSM]] command 0x08140000 is value 0, NS will boot the title specified from the TWL TLNC block from FIRMparams+0x300. This is the same TLNC block which DSi titles wrote to RAM+0x300 for launching other titles via the launcher title. When handling the TLNC block, NS will boot the 3DS System Settings title when the TLNC titleID is the DSi System Settings titleID(the region field in the TLNC TID is not checked/used). When the TLNC titleID is not System Settings, NS will convert the input DSi titleID-high to the 3DS TWL titleID-high(tidhigh = (TLNCtidhigh & 0x7FFF) | 0x48000), then launch TWL_FIRM to run the title. NS does not support launching from gamecard via TLNC.

= NS Workaround =
A "ns_workaround" was [[5.1.0-11|added]] in NS to workaround the flaw added with [[5.0.0-11]]. When NS is loading before launching any ARM11 processes and certain [[Configuration Memory]] fields are set, NS will launch [[Application_Manager_Services|AM]] then use command [[AM:InstallNATIVEFIRM]]. NS will then execute the code called by [[APT:StartNewestHomeMenu]], the code related to APT:PrepareToStartNewestHomeMenu is not executed here.

NS will only execute this code-path when [[Configuration Memory|0x1FF80016]] is value zero, when KERNEL_VERSIONMAJOR is value 2, and when KERNEL_VERSIONMINOR is less than 35. Therefore, this code-path is only executed when the running NATIVE_FIRM version is prior to [[5.0.0-11]].

= NS Service "ns:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchFIRM|LaunchFIRM]]
|-
| 0x000200C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchTitle|LaunchTitle]]
|-
| 0x00030000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateApplication|TerminateApplication]]
|-
| 0x00040040
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateProcess|TerminateProcess]]
|-
| 0x000500C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchApplicationFIRM|LaunchApplicationFIRM]]
|-
| 0x00060042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetWirelessRebootInfo|SetWirelessRebootInfo]]
|-
| 0x00070042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateInitialize|CardUpdateInitialize]]
|-
| 0x00080000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateShutdown|CardUpdateShutdown]]
|-
| 0x00090000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000A0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000B0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000C0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000D0140
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetTWLBannerHMAC|SetTWLBannerHMAC]]
|-
| 0x000E0000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:ShutdownAsync|ShutdownAsync]]
|-
| 0x000F0000
| [[1.0.0-0]] - [[2.0.0-2]]
| This calls [[APT:AppletUtility]] with fixed input params.
|-
| 0x00100180
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:RebootSystem|RebootSystem]]
|-
| 0x00110100
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateTitle|TerminateTitle]]
|-
| 0x001200C0
| ?
| [[NSS:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00130000
| ?
| ?
|-
| 0x00140042
| ?
| ?
|-
| 0x00150140
| ?
| [[NSS:LaunchApplication|LaunchApplication]]
|-
| 0x00160000
| [[8.0.0-18]]
| [[NSS:RebootSystemClean|RebootSystemClean]]
|}

The maximum sessions that can be used with this service is two, therefore only two processes can use this service at the same time.

=NS Power Service "ns:p"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| [[NSP:RebootSystem|RebootSystem]]
|-
| 0x00020000
| [[NSS:ShutdownAsync|ShutdownAsync]]
|}

This was added with [[3.0.0-5]]. The PTM sysmodule connects to this service, and syncs whenever [[PTM|ptm:s GetShellState()]] changes.

=NS Service "ns:c"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010100
| [[NSC:LockSpecialContent|LockSpecialContent]]
|-
| 0x00020100
| [[NSC:UnlockSpecialContent|UnlockSpecialContent]]
|}

This was added with [[5.0.0-11]]. It is used by the Instruction Manual applet, and is likely related to triggering SD/Game Card removal errors when ejecting the media the manual is stored on.

=APT Services=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Accessible with APT:U / APT:A
! Description
|-
| 0x00010040
|
| Yes
| [[APT:GetLockHandle|GetLockHandle]]
|-
| 0x00020080
|
| See [[APT:Initialize|here]].
| [[APT:Initialize|Initialize]]
|-
| 0x00030040
|
| Yes
| [[APT:Enable|Enable]]
|-
| 0x00040040
|
| Yes
| [[APT:Finalize|Finalize]]
|-
| 0x00050040
|
| Yes
| [[APT:GetAppletManInfo|GetAppletManInfo]]
|-
| 0x00060040
|
| Yes, unless using APT:U and AppID == 0x300
| [[APT:GetAppletInfo|GetAppletInfo]]
|-
| 0x00070000
|
| Yes
| [[APT:GetLastSignaledAppletId|GetLastSignaledAppletId]]
|-
| 0x00080000
|
| Yes
| [[APT:CountRegisteredApplet|CountRegisteredApplet]]
|-
| 0x00090040
|
| Yes
| [[APT:IsRegistered|IsRegistered]]
|-
| 0x000A0040
|
| Yes
| [[APT:GetAttribute|GetAttribute]]
|-
| 0x000B0040
|
| Yes
| [[APT:InquireNotification|InquireNotification]]
|-
| 0x000C0104
|
| Yes
| [[APT:SendParameter|SendParameter]]
|-
| 0x000D0080
|
| Yes
| [[APT:ReceiveParameter|ReceiveParameter]]
|-
| 0x000E0080
|
| Yes
| [[APT:GlanceParameter|GlanceParameter]]
|-
| 0x000F0100
|
| Yes
| [[APT:CancelParameter|CancelParameter]]
|-
| 0x001000C2
|
| Yes
| [[APT:DebugFunc|DebugFunc]]
|-
| 0x001100C0
|
| Yes
| [[APT:MapProgramIdForDebug|MapProgramIdForDebug]]
|-
| 0x00120040
|
| Yes
| [[APT:SetHomeMenuAppletIdForDebug|SetHomeMenuAppletIdForDebug]]
|-
| 0x00130000
|
| Yes
| [[APT:GetPreparationState|GetPreparationState]]
|-
| 0x00140040
|
| Yes
| [[APT:SetPreparationState|SetPreparationState]]
|-
| 0x00150140
|
| No
| [[APT:PrepareToStartApplication|PrepareToStartApplication]]
|-
| 0x00160040
|
| Yes
| [[APT:PreloadLibraryApplet|PreloadLibraryApplet]]
|-
| 0x00170040
|
| Yes
| [[APT:FinishPreloadingLibraryApplet|FinishPreloadingLibraryApplet]]
|-
| 0x00180040
|
| Yes
| [[APT:PrepareToStartLibraryApplet|PrepareToStartLibraryApplet]]
|-
| 0x00190040
|
| Yes
| [[APT:PrepareToStartSystemApplet|PrepareToStartSystemApplet]]
|-
| 0x001A0000
|
| Yes
| [[APT:PrepareToStartNewestHomeMenu|PrepareToStartNewestHomeMenu]]
|-
| 0x001B00C4
|
| Yes
| [[APT:StartApplication|StartApplication]]
|-
| 0x001C0000
|
| Yes
| [[APT:WakeupApplication|WakeupApplication]]
|-
| 0x001D0000
|
| Yes
| [[APT:CancelApplication|CancelApplication]]
|-
| 0x001E0084
|
| Yes
| [[APT:StartLibraryApplet|StartLibraryApplet]]
|-
| 0x001F0084
|
| Yes
| [[APT:StartSystemApplet|StartSystemApplet]]
|-
| 0x00200044
|
| Yes
| [[APT:StartNewestHomeMenu|StartNewestHomeMenu]]
|-
| 0x00210000
|
| No
| [[APT:OrderToCloseApplication|OrderToCloseApplication]]
|-
| 0x00220040
|
| Yes
| [[APT:PrepareToCloseApplication|PrepareToCloseApplication]]
|-
| 0x00230040
|
| Yes
| [[APT:PrepareToJumpToApplication|PrepareToJumpToApplication]]
|-
| 0x00240044
|
| Yes
| [[APT:JumpToApplication|JumpToApplication]]
|-
| 0x002500C0
|
| Yes
| [[APT:PrepareToCloseLibraryApplet|PrepareToCloseLibraryApplet]]
|-
| 0x00260000
|
| Yes
| [[APT:PrepareToCloseSystemApplet|PrepareToCloseSystemApplet]]
|-
| 0x00270044
|
| Yes
| [[APT:CloseApplication|CloseApplication]]
|-
| 0x00280044
|
| Yes
| [[APT:CloseLibraryApplet|CloseLibraryApplet]]
|-
| 0x00290044
|
| Yes
| [[APT:CloseSystemApplet|CloseSystemApplet]]
|-
| 0x002A0000
|
| Yes
| [[APT:OrderToCloseSystemApplet|OrderToCloseSystemApplet]]
|-
| 0x002B0000
|
| Yes
| [[APT:PrepareToJumpToHomeMenu|PrepareToJumpToHomeMenu]]
|-
| 0x002C0044
|
| Yes
| [[APT:JumpToHomeMenu|JumpToHomeMenu]]
|-
| 0x002D0000
|
| Yes
| [[APT:PrepareToLeaveHomeMenu|PrepareToLeaveHomeMenu]]
|-
| 0x002E0044
|
| Yes
| [[APT:LeaveHomeMenu|LeaveHomeMenu]]
|-
| 0x002F0040
|
| Yes
| [[APT:PrepareToLeaveResidentApplet|PrepareToLeaveResidentApplet]]
|-
| 0x00300044
|
| Yes
| [[APT:LeaveResidentApplet|LeaveResidentApplet]]
|-
| 0x00310100
|
| Yes
| [[APT:PrepareToDoApplicationJump|PrepareToDoApplicationJump]]
|-
| 0x00320084
|
| Yes
| [[APT:DoApplicationJump|DoApplicationJump]]
|-
| 0x00330000
|
| Yes
| [[APT:GetProgramIdOnApplicationJump|GetProgramIdOnApplicationJump]]
|-
| 0x00340084
|
| Yes
| [[APT:SendDeliverArg|SendDeliverArg]]
|-
| 0x00350080
|
| Yes
| [[APT:ReceiveDeliverArg|ReceiveDeliverArg]]
|-
| 0x00360040
|
| Yes
| [[APT:LoadSysMenuArg|LoadSysMenuArg]]
|-
| 0x00370042
|
| Yes
| [[APT:StoreSysMenuArg|StoreSysMenuArg]]
|-
| 0x00380040
|
| Yes
| [[APT:PreloadResidentApplet|PreloadResidentApplet]]
|-
| 0x00390040
|
| Yes
| [[APT:PrepareToStartResidentApplet|PrepareToStartResidentApplet]]
|-
| 0x003A0044
|
| Yes
| [[APT:StartResidentApplet|StartResidentApplet]]
|-
| 0x003B0040
|
| Yes
| [[APT:CancelLibraryApplet|CancelLibraryApplet]]
|-
| 0x003C0042
|
| Yes
| [[APT:SendDspSleep|SendDspSleep]]
|-
| 0x003D0042
|
| Yes
| [[APT:SendDspWakeUp|SendDspWakeUp]]
|-
| 0x003E0080
|
| Yes
| [[APT:ReplySleepQuery|ReplySleepQuery]]
|-
| 0x003F0040
|
| Yes
| [[APT:ReplySleepNotificationComplete|ReplySleepNotificationComplete]]
|-
| 0x00400042
|
| Yes
| [[APT:SendCaptureBufferInfo|SendCaptureBufferInfo]]
|-
| 0x00410040
|
| Yes
| [[APT:ReceiveCaptureBufferInfo|ReceiveCaptureBufferInfo]]
|-
| 0x00420080
|
| Yes
| [[APT:SleepSystem|SleepSystem]]
|-
| 0x00430040
|
| Yes
| [[APT:NotifyToWait|NotifyToWait]]
|-
| 0x00440000
|
| Yes
| [[APT:GetSharedFont|GetSharedFont]]
|-
| 0x00450040
|
| Yes
| [[APT:GetWirelessRebootInfo|GetWirelessRebootInfo]]
|-
| 0x00460104
|
| Yes
| [[APT:Wrap|Wrap]]
|-
| 0x00470104
|
| Yes
| [[APT:Unwrap|Unwrap]]
|-
| 0x00480100
|
| No
| [[APT:GetProgramInfo|GetProgramInfo]]
|-
| 0x00490180
|
| No
| [[APT:Reboot|Reboot]]
|-
| 0x004A0040
|
| Yes
| [[APT:GetCaptureInfo|GetCaptureInfo]]
|-
| 0x004B00C2
|
| Yes
| [[APT:AppletUtility|AppletUtility]]
|-
| 0x004C0000
|
| Yes
| [[APT:SetFatalErrDispMode|SetFatalErrDispMode]]
|-
| 0x004D0080
|
| Yes
| [[APT:GetAppletProgramInfo|GetAppletProgramInfo]]
|-
| 0x004E0000
|
| Yes
| [[APT:HardwareResetAsync|HardwareResetAsync]]
|-
| 0x004F0080
| [[2.2.0-X]]
| Yes
| [[APT:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00500040
| [[2.2.0-X]]
| Yes
| [[APT:GetApplicationCpuTimeLimit|GetApplicationCpuTimeLimit]]
|-
| 0x00510080
| [[3.0.0-5]]
| Yes
| [[APT:GetStartupArgument|GetStartupArgument]]
|-
| 0x00520104
| [[4.0.0-7]]
| Yes
| [[APT:Wrap1|Wrap1]]
|-
| 0x00530104
| [[4.0.0-7]]
| Yes
| [[APT:Unwrap1|Unwrap1]]
|-
| 0x00540040
| [[5.0.0-11]]
| ?
| ?
|-
| 0x00550040
| [[7.0.0-13]]
| Yes
| [[APT:SetScreenCapturePostPermission|SetScreenCapturePostPermission]]
|-
| 0x00560000
| [[7.0.0-13]]
| Yes
| [[APT:GetScreenCapturePostPermission|GetScreenCapturePostPermission]]
|-
| 0x00570044
| [[7.0.0-13]]
| ?
| [[APT:WakeupApplication2|WakeupApplication2]]
|-
| 0x00580002
| [[7.0.0-13]]
| Yes
| [[APT:GetProgramID|GetProgramID]]
|-
| 0x01010000
| [[8.0.0-18]]
| Yes
| [[APT:GetTargetPlatform|GetTargetPlatform]]
|-
| 0x01020000
| [[8.0.0-18]]
| Yes
| [[APT:CheckNew3DS|CheckNew3DS]]
|-
| 0x01030000
| [[8.0.0-18]]
| Yes
| [[APT:GetApplicationRunningMode|GetApplicationRunningMode]]
|-
| 0x01040000
| [[8.0.0-18]]
| ?
| [[APT:IsStandardMemoryLayout|IsStandardMemoryLayout]]
|-
| 0x01050100
| [[10.4.0-29]]
| ?
| [[APT:IsTitleAllowed|IsTitleAllowed]]
|}

These "APT:U" and "APT:S" NS services can handle launching titles/"applets", these services handle signaling for home/power button as well. Only one session for either APT service can be open at a time, normally processes close the service handle immediately once finished using the service. The commands for APT:U and APT:S are exactly the same, however certain commands are only accessible with APT:S(NS module will call [[SVC|svcBreak]] when the command isn't accessible).

Applets returning to home-menu first use commands APT:PrepareToJumpToHomeMenu and APT:JumpToHomeMenu, followed by these commands to launch home-menu: [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]]. [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]] are also used for launching the [[Internet Browser]], the camera applet, etc.

Processes launch applications via home-menu, not directly with [[APT:PrepareToStartApplication]] and [[APT:StartApplication]]. Regular applications can't directly launch applications since [[APT:StartApplication]] launches the process without terminating the currently running application.

APT:PrepareToDoApplicationJump and APT:DoApplicationJump are used by applications, for launching native/<non-NATIVE_FIRM> applications. These commands notify Home Menu that title launching needs done, Home Menu does the actual title launching via NS commands.

== AppletAttr ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-2
| [[NS_and_APT_Services#AppletPos|AppletPos]]
|-
| 3
| Manually Acquire/Release GPU Rights
|-
| 4
| Manually Acquire/Release DSP Rights
|-
| 5
| ?
|}

== DisplayBufferMode ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| FORMAT_R8G8B8A8
|-
| 1
| FORMAT_R8G8B8
|-
| 2
| FORMAT_R5G6B5
|-
| 3
| FORMAT_R5G5B5A1
|-
| 4
| FORMAT_R4G4B4A4
|-
| 0xFFFFFFFF
| FORMAT_UNIMPORTABLE
|}

This is the same mapping as used for the [[GPU/External_Registers#Framebuffer_color_formats|GPU framebuffer color formats]].

== AppletPos ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1
| POS_NONE
|-
| 0
| POS_APP
|-
| 1
| POS_APPLIB
|-
| 2
| POS_SYS
|-
| 3
| POS_SYSLIB
|-
| 4
| POS_RESIDENT
|}

== QueryReply ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| REPLY_REJECT
|-
| 1
| REPLY_ACCEPT
|-
| 2
| REPLY_LATER
|}

== Notification ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NOTIFICATION_NONE
|-
| 1
| NOTIFICATION_HOME_BUTTON_1
|-
| 2
| NOTIFICATION_HOME_BUTTON_2
|-
| 3
| NOTIFICATION_SLEEP_QUERY
|-
| 4
| NOTIFICATION_SLEEP_CANCELED_BY_OPEN
|-
| 5
| NOTIFICATION_SLEEP_ACCEPTED
|-
| 6
| NOTIFICATION_SLEEP_AWAKE
|-
| 7
| NOTIFICATION_SHUTDOWN
|-
| 8
| NOTIFICATION_POWER_BUTTON_CLICK
|-
| 9
| NOTIFICATION_POWER_BUTTON_CLEAR
|-
| 10
| NOTIFICATION_TRY_SLEEP
|-
| 11
| NOTIFICATION_ORDER_TO_CLOSE
|}

== Command ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| COMMAND_NONE
|-
| 1
| COMMAND_WAKEUP
|-
| 2
| COMMAND_REQUEST
|-
| 3
| COMMAND_RESPONSE
|-
| 4
| COMMAND_EXIT
|-
| 5
| COMMAND_MESSAGE
|-
| 6
| COMMAND_HOME_BUTTON_SINGLE
|-
| 7
| COMMAND_HOME_BUTTON_DOUBLE
|-
| 8
| COMMAND_DSP_SLEEP
|-
| 9
| COMMAND_DSP_WAKEUP
|-
| 10
| COMMAND_WAKEUP_BY_EXIT
|-
| 11
| COMMAND_WAKEUP_BY_PAUSE
|-
| 12
| COMMAND_WAKEUP_BY_CANCEL
|-
| 13
| COMMAND_WAKEUP_BY_CANCELALL
|-
| 14
| COMMAND_WAKEUP_BY_POWER_BUTTON_CLICK
|-
| 15
| COMMAND_WAKEUP_TO_JUMP_HOME
|-
| 16
| COMMAND_REQUEST_FOR_SYS_APPLET
|-
| 17
| COMMAND_WAKEUP_TO_LAUNCH_APPLICATION
|-
| 0x41
| Unknown. [[APT:ReceiveParameter|Received]] by Home Menu during boot when the Home Menu process doesn't terminate properly(svcExitProcess/crash).
|}

== AppletPreparationState ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NO_PREPARATION
|-
| 1
| PREPARED_TO_LAUNCH_APP
|-
| 2
| PREPARED_TO_CLOSE_APP
|-
| 3
| PREPARED_TO_FORCE_TO_CLOSE_APP
|-
| 4
| PREPARED_TO_PRELOAD_APPLIB
|-
| 5
| PREPARED_TO_LAUNCH_APPLIB
|-
| 6
| PREPARED_TO_CLOSE_APPLIB
|-
| 7
| PREPARED_TO_LAUNCH_SYS
|-
| 8
| PREPARED_TO_CLOSE_SYS
|-
| 9
| PREPARED_TO_PRELOAD_SYSLIB
|-
| 10
| PREPARED_TO_LAUNCH_SYSLIB
|-
| 11
| PREPARED_TO_CLOSE_SYSLIB
|-
| 12
| PREPARED_TO_LAUNCH_RESIDENT
|-
| 13
| PREPARED_TO_LEAVE_RESIDENT
|-
| 14
| PREPARED_TO_DO_HOMEMENU
|-
| 15
| PREPARED_TO_LEAVE_HOMEMENU
|-
| 16
| PREPARED_TO_START_RESIDENT
|-
| 17
| PREPARED_TO_DO_APP_JUMP
|-
| 18
| PREPARED_TO_FORCE_TO_CLOSE_SYS
|-
| 19
| PREPARED_TO_LAUNCH_OTHER_SYS
|-
| 20
| PREPARED_TO_JUMP_TO_APP
|}

== StartupArgumentType ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| STARTUP_ARGUMENT_TYPE_OTHER_APP
|-
| 1
| STARTUP_ARGUMENT_TYPE_RESTART
|-
| 2
| STARTUP_ARGUMENT_TYPE_OTHER_MEDIA
|}

== CaptureBufferInfo ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, Size
|-
| 0x4
| 0x1
| u8, 3D (0 = not 3D, 1 = 3D)
|-
| 0x5
| 0x3
| Reserved
|-
| 0x8
| 0x4
| Main Screen Left Offset
|-
| 0xC
| 0x4
| Main Screen Right Offset
|-
| 0x10
| 0x4
| Main Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|-
| 0x14
| 0x4
| Sub Screen Left Offset
|-
| 0x18
| 0x4
| Sub Screen Right Offset
|-
| 0x1C
| 0x4
| Sub Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|}

==WirelessRebootInfo==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address.
|-
| 0x6
| 0x9
| WirelessRebootPassphrase
|-
| 0xF
| 0x1
| Uninitialized
|}

This is [[NSS:SetWirelessRebootInfo|setup]] by the dlplay system-application, before launching the DLP-child which can then use [[APT:GetWirelessRebootInfo]]. The MAC address and passphrase is used for connecting to the host by the DLP-child. See also [[DLP_Services|here]].

="APT:A" Service=
This was added with [[7.0.0-13|7.0.0-X]]. Official apps built with the CTRSDK for system-version >=[[7.0.0-13|7.0.0-X]] normally use the "APT:A" service instead of "APT:U". Those processes also have "APT:A" instead of "APT:U" in the service-access-control. It's unknown whether there's anything which is only accessible via "APT:A".

=Applets=
NS module does not verify that the input appID for the APT service cmds are correct for that type of command. For example, a process-launch of a SystemApplet via LibraryApplet commands works fine(minus the launched-process side of APT probably).

==System Applets==
On Old3DS there could only be one applet here(Home Menu, Internet Browser, Friend-List, etc) with programID-high 00040030 running at a time. On Old3DS when directly launching one of these 00040030 applets with Home Menu, the Home Menu process will terminate once the process is launched. On Old3DS when returning to Home Menu from that launched process, the Home Menu process is launched again.

On New3DS the Home Menu process is still running/in-memory, while another system-applet is running. On New3DS it appears that the Home Menu process is terminated+relaunched, when another system-applet terminated without exiting with APT properly.

==Library Applets==
Library applets can be launched by applications and regular applets. These library applets render to the screen(s) when running, etc. For example, this includes swkbd for text input. See the below appIDs in the 0x2XX range, the actual appID used is 0x4XX however.

Input data can be sent to the library applet via the NS [[APT:SendParameter|parameter]] buffer, and/or with shared-memory with a shared-mem handle sent to the library applet. Output data from the library applet can be received by [[APT:ReceiveParameter]], the library applet can also use the specified shared-mem for output too.

=AppIDs=
{| class="wikitable" border="1"
|-
! AppID
! Description
|-
| 0x101
| [[Home Menu]] (menu)
|-
| 0x103
| Alternate Menu
|-
| 0x110
| Camera applet ([[Camera Applet|CtrApp]])
|-
| 0x112
| Friends List applet ([[Friend List|friend]])
|-
| 0x113
| Game Notes applet (Cherry)
|-
| 0x114
| [[Internet Browser]] (spider/SKATER)
|-
| 0x115
| Instruction Manual applet
|-
| 0x116
| [[Notifications]] applet (newslist)
|-
| 0x117
| Miiverse applet (olv)
|-
| 0x118
| [[Miiverse]] posting applet (solv3)
|-
| 0x119
| Amiibo settings (cabinet)
|-
| 0x201
| Software Keyboard (swkbd) (?)
|-
| 0x202
| [[Mii Selector]] (appletEd) (?)
|-
| 0x204
| Photo Selector (PNOTE_AP) (?)
|-
| 0x205
| Sound Selector (SNOTE_AP) (?)
|-
| 0x206
| Error Display ([[ErrDisp|error]]) (?)
|-
| 0x207
| eShop applet ([[EShop#NS_eShop_application_parameters|mint]]) (?)
|-
| 0x208
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]]) (?)
|-
| 0x209
| Notepad (memolib) (?)
|-
| 0x300
| Application
|-
| 0x301
| eShop (tiger)
|-
| 0x401
| Software Keyboard (swkbd)
|-
| 0x402
| Mii Selector (appletEd)
|-
| 0x404
| Photo Selector (PNOTE_AP)
|-
| 0x405
| Sound Selector (SNOTE_AP)
|-
| 0x406
| Error Display (error)
|-
| 0x407
| eShop applet (mint)
|-
| 0x408
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]])
|-
| 0x409
| Notepad (memolib)
|-
| 0xF10
| ProgramID: 0004003000008900.
|-
| 0xF11
| ProgramID: 000400000FFFFD00.
|-
| 0xF12
| ProgramID: 000400000FFFFC00.
|-
| 0xF13
| ProgramID: 000400000FFFFB00.
|-
| 0xF14
| ProgramID: 000400000FFFF900.
|-
| 0xF15
| ProgramID: 000400000FFFF800.
|-
| 0xF16
| ProgramID: 000400000FFFF700.
|-
| 0xF17
| ProgramID: 000400000FFFF600.
|-
| 0xF18
| ProgramID: 000400000FFFF500.
|}

These AppIDs are all for NAND titles, except for 0x300. AppIDs in the 0x1XX range are applets(programID-high 00040030), and the AppIDs in the 0x2XX range are "system libraries"(programID-high 00040030). The 0xFXX AppID range is for development NAND applications, these are not available for retail.

Note that at some point the total AppID entry count was changed from 28 to 27.

Titles With Code Symbols

2023-07-23T09:18:28Z

Steveice10:

This page lists titles containing any kind of useful symbol information.

{| class="wikitable" border="1"
|-
! Title name
! Notes
|-
| Brunswick Pro Bowling
| Contains an ELF binary with full symbol information in its RomFS root
|-
| Fire Emblem: If/Fates
| All released versions of the game contain "name.StackTrace" and "addr.StackTrace" files in the "debug" folder in the RomFS, which provide full function names/signatures for the game's code.bin
|-
| Inazuma Eleven 3 Lightning Bolt / Team Ogre Attacks / Bomb Blast
| CRO/CRS contains symbols
|-
| Mario & Luigi: Bowser's Inside Story + Bowser Jr's Journey
| CRO/CRS contains symbols
|-
| Mario Kart 7
| Only the DLP-child has symbols, not the main app/update-title
|-
| Megaman Legacy Collection
| CRO/CRS contains symbols
|-
| Nintendogs
| Only the Korean and Taiwan localizations contain full symbol information in RomFS:/debug/memmap.txt
|-
| Pokémon Sun and Moon (demo)
| CROs and ExeFS code binary contain symbols
|-
| Puzzle & Dragons Z + Puzzle & Dragons Super Mario Bros. Edition
| CRO/CRS contains symbols
|-
| Rhythm Thief & the Emperor's Treasure
| Code binary contains debug strings (the calls to functions referring to them are replaced by nops, though)
|-
| Steel Diver: Sub Wars
| Newer versions of the update-title don't have the "map" file any more
|-
| Super Smash Bros.
| CRO/CRS contains symbols
|-
| The Amazing Spider-Man
| Contains an ELF binary with full symbol information in its RomFS root
|-
| Chibi-Robo! Photo Finder
| ExeFS code binary some result code symbols for boss, friends, and ac.
|-
| Tank Troopers
| RomFS contains file 'map_release' which contains symbols for the code binary, similar to Steel Diver: Sub Wars. The addresses do not seem to line up correctly though(?)
|-
|}

Titles With Code Symbols

2023-07-23T09:04:38Z

Steveice10:

Titles With Code Symbols

2023-07-23T07:49:56Z

Steveice10:

NS and APT Services

2023-07-23T06:27:17Z

Steveice10: /* APT Services */

[[Category:Services]]
The NS ('''N'''intendo User Interface '''S'''hell) system module is the first module launched from a CTR-NAND title after the [[FIRM]] processes are loaded (also see [[Bootloader]]). This module is launched by the pm process, with the titleID loaded from NS state(hard-coded TID initialized during applet TID-array initialization). NS first launches [[ErrDisp]], then the menu. On retail the menu TID is loaded from NS state, while on dev/debug the menu TID is loaded from [[Config_Savegame|config]]. On dev-units if the menu TID block doesn't exist in [[Config_Savegame|config]], NS will attempt to launch the alternate menu instead. The TID of the launched menu is then written to [[Configuration Memory|ACTIVEMENUTID]]. NS uses [[PMApp:LaunchTitle|pm:app]] to launch titles.

NS will not trigger the [[ErrDisp|fatal-error]] screen when launching the regular/alternate menu fails.

Like home menu NS is constantly running while the system is in 3DS-mode. When attempting to return to home-menu when the home-menu process isn't running(like when the process terminated/crashed), NS will trigger a [[ErrDisp|fatal]] error.

= Alternate menu =
When launching the regular menu fails, NS will then attempt to launch the alternate menu. This title could be used as a recovery process, however it's normally not used after the factory.

At the factory for all 3DS systems, [[3DS Development Unit GUI#Test Menu|Test Menu]] is installed with this TID. On retail this title is eventually deleted during [[Factory Setup]].

= Auto-boot =
After [[PMApp:GetFIRMLaunchParams|loading]] [[FIRM]] params and prior to launching [[ErrDisp]]/Home Menu, NS handles auto-booting titles. The same code called by [[APT:Reboot]] is used for launching FIRM here. When the [[Configuration_Memory|UPDATEFLAG]] is set, NS will launch SAFE_MODE_FIRM with the application titleID set to the [[System_Settings#System_Updater|System Updater]] titleID for this region. When the UPDATEFLAG is not set, NS can auto-boot the following titles as well if [[Configuration_Memory|0x1FF80016]] bit0 is set.

When bit1 and bit2 are value zero in [[Configuration_Memory|0x1FF80016]], NS will [[NSS:LaunchFIRM|launch]] the title specified by the [[FIRM]] parameters if the title-info is set. This FIRM launch is done after launching [[ErrDisp]] and Home Menu. Otherwise when [[Configuration_Memory|0x1FF80016]] is value 2 and the output u8 from [[PTM|PTMSYSM]] command 0x08140000 is value 0, NS will boot the title specified from the TWL TLNC block from FIRMparams+0x300. This is the same TLNC block which DSi titles wrote to RAM+0x300 for launching other titles via the launcher title. When handling the TLNC block, NS will boot the 3DS System Settings title when the TLNC titleID is the DSi System Settings titleID(the region field in the TLNC TID is not checked/used). When the TLNC titleID is not System Settings, NS will convert the input DSi titleID-high to the 3DS TWL titleID-high(tidhigh = (TLNCtidhigh & 0x7FFF) | 0x48000), then launch TWL_FIRM to run the title. NS does not support launching from gamecard via TLNC.

= NS Workaround =
A "ns_workaround" was [[5.1.0-11|added]] in NS to workaround the flaw added with [[5.0.0-11]]. When NS is loading before launching any ARM11 processes and certain [[Configuration Memory]] fields are set, NS will launch [[Application_Manager_Services|AM]] then use command [[AM:InstallNATIVEFIRM]]. NS will then execute the code called by [[APT:StartNewestHomeMenu]], the code related to APT:PrepareToStartNewestHomeMenu is not executed here.

NS will only execute this code-path when [[Configuration Memory|0x1FF80016]] is value zero, when KERNEL_VERSIONMAJOR is value 2, and when KERNEL_VERSIONMINOR is less than 35. Therefore, this code-path is only executed when the running NATIVE_FIRM version is prior to [[5.0.0-11]].

= NS Service "ns:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchFIRM|LaunchFIRM]]
|-
| 0x000200C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchTitle|LaunchTitle]]
|-
| 0x00030000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateApplication|TerminateApplication]]
|-
| 0x00040040
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateProcess|TerminateProcess]]
|-
| 0x000500C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchApplicationFIRM|LaunchApplicationFIRM]]
|-
| 0x00060042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetWirelessRebootInfo|SetWirelessRebootInfo]]
|-
| 0x00070042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateInitialize|CardUpdateInitialize]]
|-
| 0x00080000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateShutdown|CardUpdateShutdown]]
|-
| 0x00090000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000A0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000B0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000C0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000D0140
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetTWLBannerHMAC|SetTWLBannerHMAC]]
|-
| 0x000E0000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:ShutdownAsync|ShutdownAsync]]
|-
| 0x000F0000
| [[1.0.0-0]] - [[2.0.0-2]]
| This calls [[APT:AppletUtility]] with fixed input params.
|-
| 0x00100180
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:RebootSystem|RebootSystem]]
|-
| 0x00110100
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateTitle|TerminateTitle]]
|-
| 0x001200C0
| ?
| [[NSS:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00130000
| ?
| ?
|-
| 0x00140042
| ?
| ?
|-
| 0x00150140
| ?
| [[NSS:LaunchApplication|LaunchApplication]]
|-
| 0x00160000
| [[8.0.0-18]]
| [[NSS:RebootSystemClean|RebootSystemClean]]
|}

The maximum sessions that can be used with this service is two, therefore only two processes can use this service at the same time.

=NS Power Service "ns:p"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| [[NSP:RebootSystem|RebootSystem]]
|-
| 0x00020000
| [[NSS:ShutdownAsync|ShutdownAsync]]
|}

This was added with [[3.0.0-5]]. The PTM sysmodule connects to this service, and syncs whenever [[PTM|ptm:s GetShellState()]] changes.

=NS Service "ns:c"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010100
| [[NSC:LockSpecialContent|LockSpecialContent]]
|-
| 0x00020100
| [[NSC:UnlockSpecialContent|UnlockSpecialContent]]
|}

This was added with [[5.0.0-11]]. It is used by the Instruction Manual applet, and is likely related to triggering SD/Game Card removal errors when ejecting the media the manual is stored on.

=APT Services=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Accessible with APT:U
! Description
|-
| 0x00010040
|
| Yes
| [[APT:GetLockHandle|GetLockHandle]]
|-
| 0x00020080
|
| See [[APT:Initialize|here]].
| [[APT:Initialize|Initialize]]
|-
| 0x00030040
|
| Yes
| [[APT:Enable|Enable]]
|-
| 0x00040040
|
| Yes
| [[APT:Finalize|Finalize]]
|-
| 0x00050040
|
| Yes
| [[APT:GetAppletManInfo|GetAppletManInfo]]
|-
| 0x00060040
|
| Yes, for AppID != 0x300
| [[APT:GetAppletInfo|GetAppletInfo]]
|-
| 0x00070000
|
| Yes
| [[APT:GetLastSignaledAppletId|GetLastSignaledAppletId]]
|-
| 0x00080000
|
| Yes
| [[APT:CountRegisteredApplet|CountRegisteredApplet]]
|-
| 0x00090040
|
| Yes
| [[APT:IsRegistered|IsRegistered]]
|-
| 0x000A0040
|
| Yes
| [[APT:GetAttribute|GetAttribute]]
|-
| 0x000B0040
|
| Yes
| [[APT:InquireNotification|InquireNotification]]
|-
| 0x000C0104
|
| Yes
| [[APT:SendParameter|SendParameter]]
|-
| 0x000D0080
|
| Yes
| [[APT:ReceiveParameter|ReceiveParameter]]
|-
| 0x000E0080
|
| Yes
| [[APT:GlanceParameter|GlanceParameter]]
|-
| 0x000F0100
|
| Yes
| [[APT:CancelParameter|CancelParameter]]
|-
| 0x001000C2
|
| Yes
| [[APT:DebugFunc|DebugFunc]]
|-
| 0x001100C0
|
| Yes
| [[APT:MapProgramIdForDebug|MapProgramIdForDebug]]
|-
| 0x00120040
|
| Yes
| [[APT:SetHomeMenuAppletIdForDebug|SetHomeMenuAppletIdForDebug]]
|-
| 0x00130000
|
| Yes
| [[APT:GetPreparationState|GetPreparationState]]
|-
| 0x00140040
|
| Yes
| [[APT:SetPreparationState|SetPreparationState]]
|-
| 0x00150140
|
| No
| [[APT:PrepareToStartApplication|PrepareToStartApplication]]
|-
| 0x00160040
|
| Yes
| [[APT:PreloadLibraryApplet|PreloadLibraryApplet]]
|-
| 0x00170040
|
| Yes
| [[APT:FinishPreloadingLibraryApplet|FinishPreloadingLibraryApplet]]
|-
| 0x00180040
|
| Yes
| [[APT:PrepareToStartLibraryApplet|PrepareToStartLibraryApplet]]
|-
| 0x00190040
|
| Yes
| [[APT:PrepareToStartSystemApplet|PrepareToStartSystemApplet]]
|-
| 0x001A0000
|
| Yes
| [[APT:PrepareToStartNewestHomeMenu|PrepareToStartNewestHomeMenu]]
|-
| 0x001B00C4
|
| Yes
| [[APT:StartApplication|StartApplication]]
|-
| 0x001C0000
|
| Yes
| [[APT:WakeupApplication|WakeupApplication]]
|-
| 0x001D0000
|
| Yes
| [[APT:CancelApplication|CancelApplication]]
|-
| 0x001E0084
|
| Yes
| [[APT:StartLibraryApplet|StartLibraryApplet]]
|-
| 0x001F0084
|
| Yes
| [[APT:StartSystemApplet|StartSystemApplet]]
|-
| 0x00200044
|
| Yes
| [[APT:StartNewestHomeMenu|StartNewestHomeMenu]]
|-
| 0x00210000
|
| No
| [[APT:OrderToCloseApplication|OrderToCloseApplication]]
|-
| 0x00220040
|
| Yes
| [[APT:PrepareToCloseApplication|PrepareToCloseApplication]]
|-
| 0x00230040
|
| Yes
| [[APT:PrepareToJumpToApplication|PrepareToJumpToApplication]]
|-
| 0x00240044
|
| Yes
| [[APT:JumpToApplication|JumpToApplication]]
|-
| 0x002500C0
|
| Yes
| [[APT:PrepareToCloseLibraryApplet|PrepareToCloseLibraryApplet]]
|-
| 0x00260000
|
| Yes
| [[APT:PrepareToCloseSystemApplet|PrepareToCloseSystemApplet]]
|-
| 0x00270044
|
| Yes
| [[APT:CloseApplication|CloseApplication]]
|-
| 0x00280044
|
| Yes
| [[APT:CloseLibraryApplet|CloseLibraryApplet]]
|-
| 0x00290044
|
| Yes
| [[APT:CloseSystemApplet|CloseSystemApplet]]
|-
| 0x002A0000
|
| Yes
| [[APT:OrderToCloseSystemApplet|OrderToCloseSystemApplet]]
|-
| 0x002B0000
|
| Yes
| [[APT:PrepareToJumpToHomeMenu|PrepareToJumpToHomeMenu]]
|-
| 0x002C0044
|
| Yes
| [[APT:JumpToHomeMenu|JumpToHomeMenu]]
|-
| 0x002D0000
|
| Yes
| [[APT:PrepareToLeaveHomeMenu|PrepareToLeaveHomeMenu]]
|-
| 0x002E0044
|
| Yes
| [[APT:LeaveHomeMenu|LeaveHomeMenu]]
|-
| 0x002F0040
|
| Yes
| [[APT:PrepareToLeaveResidentApplet|PrepareToLeaveResidentApplet]]
|-
| 0x00300044
|
| Yes
| [[APT:LeaveResidentApplet|LeaveResidentApplet]]
|-
| 0x00310100
|
| Yes
| [[APT:PrepareToDoApplicationJump|PrepareToDoApplicationJump]]
|-
| 0x00320084
|
| Yes
| [[APT:DoApplicationJump|DoApplicationJump]]
|-
| 0x00330000
|
| Yes
| [[APT:GetProgramIdOnApplicationJump|GetProgramIdOnApplicationJump]]
|-
| 0x00340084
|
| Yes
| [[APT:SendDeliverArg|SendDeliverArg]]
|-
| 0x00350080
|
| Yes
| [[APT:ReceiveDeliverArg|ReceiveDeliverArg]]
|-
| 0x00360040
|
| Yes
| [[APT:LoadSysMenuArg|LoadSysMenuArg]]
|-
| 0x00370042
|
| Yes
| [[APT:StoreSysMenuArg|StoreSysMenuArg]]
|-
| 0x00380040
|
| Yes
| [[APT:PreloadResidentApplet|PreloadResidentApplet]]
|-
| 0x00390040
|
| Yes
| [[APT:PrepareToStartResidentApplet|PrepareToStartResidentApplet]]
|-
| 0x003A0044
|
| Yes
| [[APT:StartResidentApplet|StartResidentApplet]]
|-
| 0x003B0040
|
| Yes
| [[APT:CancelLibraryApplet|CancelLibraryApplet]]
|-
| 0x003C0042
|
| Yes
| [[APT:SendDspSleep|SendDspSleep]]
|-
| 0x003D0042
|
| Yes
| [[APT:SendDspWakeUp|SendDspWakeUp]]
|-
| 0x003E0080
|
| Yes
| [[APT:ReplySleepQuery|ReplySleepQuery]]
|-
| 0x003F0040
|
| Yes
| [[APT:ReplySleepNotificationComplete|ReplySleepNotificationComplete]]
|-
| 0x00400042
|
| Yes
| [[APT:SendCaptureBufferInfo|SendCaptureBufferInfo]]
|-
| 0x00410040
|
| Yes
| [[APT:ReceiveCaptureBufferInfo|ReceiveCaptureBufferInfo]]
|-
| 0x00420080
|
| Yes
| [[APT:SleepSystem|SleepSystem]]
|-
| 0x00430040
|
| Yes
| [[APT:NotifyToWait|NotifyToWait]]
|-
| 0x00440000
|
| Yes
| [[APT:GetSharedFont|GetSharedFont]]
|-
| 0x00450040
|
| Yes
| [[APT:GetWirelessRebootInfo|GetWirelessRebootInfo]]
|-
| 0x00460104
|
| Yes
| [[APT:Wrap|Wrap]]
|-
| 0x00470104
|
| Yes
| [[APT:Unwrap|Unwrap]]
|-
| 0x00480100
|
| No
| [[APT:GetProgramInfo|GetProgramInfo]]
|-
| 0x00490180
|
| No
| [[APT:Reboot|Reboot]]
|-
| 0x004A0040
|
| Yes
| [[APT:GetCaptureInfo|GetCaptureInfo]]
|-
| 0x004B00C2
|
| Yes
| [[APT:AppletUtility|AppletUtility]]
|-
| 0x004C0000
|
| Yes
| [[APT:SetFatalErrDispMode|SetFatalErrDispMode]]
|-
| 0x004D0080
|
| Yes
| [[APT:GetAppletProgramInfo|GetAppletProgramInfo]]
|-
| 0x004E0000
|
| Yes
| [[APT:HardwareResetAsync|HardwareResetAsync]]
|-
| 0x004F0080
| [[2.2.0-X]]
| Yes
| [[APT:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00500040
| [[2.2.0-X]]
| Yes
| [[APT:GetApplicationCpuTimeLimit|GetApplicationCpuTimeLimit]]
|-
| 0x00510080
| [[3.0.0-5]]
| Yes
| [[APT:GetStartupArgument|GetStartupArgument]]
|-
| 0x00520104
| [[4.0.0-7]]
| Yes
| [[APT:Wrap1|Wrap1]]
|-
| 0x00530104
| [[4.0.0-7]]
| Yes
| [[APT:Unwrap1|Unwrap1]]
|-
| 0x00540040
| [[5.0.0-11]]
| ?
| ?
|-
| 0x00550040
| [[7.0.0-13]]
| Yes
| [[APT:SetScreenCapturePostPermission|SetScreenCapturePostPermission]]
|-
| 0x00560000
| [[7.0.0-13]]
| Yes
| [[APT:GetScreenCapturePostPermission|GetScreenCapturePostPermission]]
|-
| 0x00570044
| [[7.0.0-13]]
| ?
| [[APT:WakeupApplication2|WakeupApplication2]]
|-
| 0x00580002
| [[7.0.0-13]]
| Yes
| [[APT:GetProgramID|GetProgramID]]
|-
| 0x01010000
| [[8.0.0-18]]
| Yes
| [[APT:GetTargetPlatform|GetTargetPlatform]]
|-
| 0x01020000
| [[8.0.0-18]]
| Yes
| [[APT:CheckNew3DS|CheckNew3DS]]
|-
| 0x01030000
| [[8.0.0-18]]
| Yes
| [[APT:GetApplicationRunningMode|GetApplicationRunningMode]]
|-
| 0x01040000
| [[8.0.0-18]]
| ?
| [[APT:IsStandardMemoryLayout|IsStandardMemoryLayout]]
|-
| 0x01050100
| [[10.4.0-29]]
| ?
| [[APT:IsTitleAllowed|IsTitleAllowed]]
|}

These "APT:U" and "APT:S" NS services can handle launching titles/"applets", these services handle signaling for home/power button as well. Only one session for either APT service can be open at a time, normally processes close the service handle immediately once finished using the service. The commands for APT:U and APT:S are exactly the same, however certain commands are only accessible with APT:S(NS module will call [[SVC|svcBreak]] when the command isn't accessible).

Applets returning to home-menu first use commands APT:PrepareToJumpToHomeMenu and APT:JumpToHomeMenu, followed by these commands to launch home-menu: [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]]. [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]] are also used for launching the [[Internet Browser]], the camera applet, etc.

Processes launch applications via home-menu, not directly with [[APT:PrepareToStartApplication]] and [[APT:StartApplication]]. Regular applications can't directly launch applications since [[APT:StartApplication]] launches the process without terminating the currently running application.

APT:PrepareToDoApplicationJump and APT:DoApplicationJump are used by applications, for launching native/<non-NATIVE_FIRM> applications. These commands notify Home Menu that title launching needs done, Home Menu does the actual title launching via NS commands.

== AppletAttr ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-2
| [[NS_and_APT_Services#AppletPos|AppletPos]]
|-
| 3
| Manually Acquire/Release GPU Rights
|-
| 4
| Manually Acquire/Release DSP Rights
|-
| 5
| ?
|}

== DisplayBufferMode ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| FORMAT_R8G8B8A8
|-
| 1
| FORMAT_R8G8B8
|-
| 2
| FORMAT_R5G6B5
|-
| 3
| FORMAT_R5G5B5A1
|-
| 4
| FORMAT_R4G4B4A4
|-
| 0xFFFFFFFF
| FORMAT_UNIMPORTABLE
|}

This is the same mapping as used for the [[GPU/External_Registers#Framebuffer_color_formats|GPU framebuffer color formats]].

== AppletPos ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1
| POS_NONE
|-
| 0
| POS_APP
|-
| 1
| POS_APPLIB
|-
| 2
| POS_SYS
|-
| 3
| POS_SYSLIB
|-
| 4
| POS_RESIDENT
|}

== QueryReply ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| REPLY_REJECT
|-
| 1
| REPLY_ACCEPT
|-
| 2
| REPLY_LATER
|}

== Notification ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NOTIFICATION_NONE
|-
| 1
| NOTIFICATION_HOME_BUTTON_1
|-
| 2
| NOTIFICATION_HOME_BUTTON_2
|-
| 3
| NOTIFICATION_SLEEP_QUERY
|-
| 4
| NOTIFICATION_SLEEP_CANCELED_BY_OPEN
|-
| 5
| NOTIFICATION_SLEEP_ACCEPTED
|-
| 6
| NOTIFICATION_SLEEP_AWAKE
|-
| 7
| NOTIFICATION_SHUTDOWN
|-
| 8
| NOTIFICATION_POWER_BUTTON_CLICK
|-
| 9
| NOTIFICATION_POWER_BUTTON_CLEAR
|-
| 10
| NOTIFICATION_TRY_SLEEP
|-
| 11
| NOTIFICATION_ORDER_TO_CLOSE
|}

== Command ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| COMMAND_NONE
|-
| 1
| COMMAND_WAKEUP
|-
| 2
| COMMAND_REQUEST
|-
| 3
| COMMAND_RESPONSE
|-
| 4
| COMMAND_EXIT
|-
| 5
| COMMAND_MESSAGE
|-
| 6
| COMMAND_HOME_BUTTON_SINGLE
|-
| 7
| COMMAND_HOME_BUTTON_DOUBLE
|-
| 8
| COMMAND_DSP_SLEEP
|-
| 9
| COMMAND_DSP_WAKEUP
|-
| 10
| COMMAND_WAKEUP_BY_EXIT
|-
| 11
| COMMAND_WAKEUP_BY_PAUSE
|-
| 12
| COMMAND_WAKEUP_BY_CANCEL
|-
| 13
| COMMAND_WAKEUP_BY_CANCELALL
|-
| 14
| COMMAND_WAKEUP_BY_POWER_BUTTON_CLICK
|-
| 15
| COMMAND_WAKEUP_TO_JUMP_HOME
|-
| 16
| COMMAND_REQUEST_FOR_SYS_APPLET
|-
| 17
| COMMAND_WAKEUP_TO_LAUNCH_APPLICATION
|-
| 0x41
| Unknown. [[APT:ReceiveParameter|Received]] by Home Menu during boot when the Home Menu process doesn't terminate properly(svcExitProcess/crash).
|}

== AppletPreparationState ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NO_PREPARATION
|-
| 1
| PREPARED_TO_LAUNCH_APP
|-
| 2
| PREPARED_TO_CLOSE_APP
|-
| 3
| PREPARED_TO_FORCE_TO_CLOSE_APP
|-
| 4
| PREPARED_TO_PRELOAD_APPLIB
|-
| 5
| PREPARED_TO_LAUNCH_APPLIB
|-
| 6
| PREPARED_TO_CLOSE_APPLIB
|-
| 7
| PREPARED_TO_LAUNCH_SYS
|-
| 8
| PREPARED_TO_CLOSE_SYS
|-
| 9
| PREPARED_TO_PRELOAD_SYSLIB
|-
| 10
| PREPARED_TO_LAUNCH_SYSLIB
|-
| 11
| PREPARED_TO_CLOSE_SYSLIB
|-
| 12
| PREPARED_TO_LAUNCH_RESIDENT
|-
| 13
| PREPARED_TO_LEAVE_RESIDENT
|-
| 14
| PREPARED_TO_DO_HOMEMENU
|-
| 15
| PREPARED_TO_LEAVE_HOMEMENU
|-
| 16
| PREPARED_TO_START_RESIDENT
|-
| 17
| PREPARED_TO_DO_APP_JUMP
|-
| 18
| PREPARED_TO_FORCE_TO_CLOSE_SYS
|-
| 19
| PREPARED_TO_LAUNCH_OTHER_SYS
|-
| 20
| PREPARED_TO_JUMP_TO_APP
|}

== StartupArgumentType ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| STARTUP_ARGUMENT_TYPE_OTHER_APP
|-
| 1
| STARTUP_ARGUMENT_TYPE_RESTART
|-
| 2
| STARTUP_ARGUMENT_TYPE_OTHER_MEDIA
|}

== CaptureBufferInfo ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, Size
|-
| 0x4
| 0x1
| u8, 3D (0 = not 3D, 1 = 3D)
|-
| 0x5
| 0x3
| Reserved
|-
| 0x8
| 0x4
| Main Screen Left Offset
|-
| 0xC
| 0x4
| Main Screen Right Offset
|-
| 0x10
| 0x4
| Main Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|-
| 0x14
| 0x4
| Sub Screen Left Offset
|-
| 0x18
| 0x4
| Sub Screen Right Offset
|-
| 0x1C
| 0x4
| Sub Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|}

==WirelessRebootInfo==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address.
|-
| 0x6
| 0x9
| WirelessRebootPassphrase
|-
| 0xF
| 0x1
| Uninitialized
|}

This is [[NSS:SetWirelessRebootInfo|setup]] by the dlplay system-application, before launching the DLP-child which can then use [[APT:GetWirelessRebootInfo]]. The MAC address and passphrase is used for connecting to the host by the DLP-child. See also [[DLP_Services|here]].

="APT:A" Service=
This was added with [[7.0.0-13|7.0.0-X]]. Official apps built with the CTRSDK for system-version >=[[7.0.0-13|7.0.0-X]] normally use the "APT:A" service instead of "APT:U". Those processes also have "APT:A" instead of "APT:U" in the service-access-control. It's unknown whether there's anything which is only accessible via "APT:A".

=Applets=
NS module does not verify that the input appID for the APT service cmds are correct for that type of command. For example, a process-launch of a SystemApplet via LibraryApplet commands works fine(minus the launched-process side of APT probably).

==System Applets==
On Old3DS there could only be one applet here(Home Menu, Internet Browser, Friend-List, etc) with programID-high 00040030 running at a time. On Old3DS when directly launching one of these 00040030 applets with Home Menu, the Home Menu process will terminate once the process is launched. On Old3DS when returning to Home Menu from that launched process, the Home Menu process is launched again.

On New3DS the Home Menu process is still running/in-memory, while another system-applet is running. On New3DS it appears that the Home Menu process is terminated+relaunched, when another system-applet terminated without exiting with APT properly.

==Library Applets==
Library applets can be launched by applications and regular applets. These library applets render to the screen(s) when running, etc. For example, this includes swkbd for text input. See the below appIDs in the 0x2XX range, the actual appID used is 0x4XX however.

Input data can be sent to the library applet via the NS [[APT:SendParameter|parameter]] buffer, and/or with shared-memory with a shared-mem handle sent to the library applet. Output data from the library applet can be received by [[APT:ReceiveParameter]], the library applet can also use the specified shared-mem for output too.

=AppIDs=
{| class="wikitable" border="1"
|-
! AppID
! Description
|-
| 0x101
| [[Home Menu]] (menu)
|-
| 0x103
| Alternate Menu
|-
| 0x110
| Camera applet ([[Camera Applet|CtrApp]])
|-
| 0x112
| Friends List applet ([[Friend List|friend]])
|-
| 0x113
| Game Notes applet (Cherry)
|-
| 0x114
| [[Internet Browser]] (spider/SKATER)
|-
| 0x115
| Instruction Manual applet
|-
| 0x116
| [[Notifications]] applet (newslist)
|-
| 0x117
| Miiverse applet (olv)
|-
| 0x118
| [[Miiverse]] posting applet (solv3)
|-
| 0x119
| Amiibo settings (cabinet)
|-
| 0x201
| Software Keyboard (swkbd) (?)
|-
| 0x202
| [[Mii Selector]] (appletEd) (?)
|-
| 0x204
| Photo Selector (PNOTE_AP) (?)
|-
| 0x205
| Sound Selector (SNOTE_AP) (?)
|-
| 0x206
| Error Display ([[ErrDisp|error]]) (?)
|-
| 0x207
| eShop applet ([[EShop#NS_eShop_application_parameters|mint]]) (?)
|-
| 0x208
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]]) (?)
|-
| 0x209
| Notepad (memolib) (?)
|-
| 0x300
| Application
|-
| 0x301
| eShop (tiger)
|-
| 0x401
| Software Keyboard (swkbd)
|-
| 0x402
| Mii Selector (appletEd)
|-
| 0x404
| Photo Selector (PNOTE_AP)
|-
| 0x405
| Sound Selector (SNOTE_AP)
|-
| 0x406
| Error Display (error)
|-
| 0x407
| eShop applet (mint)
|-
| 0x408
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]])
|-
| 0x409
| Notepad (memolib)
|-
| 0xF10
| ProgramID: 0004003000008900.
|-
| 0xF11
| ProgramID: 000400000FFFFD00.
|-
| 0xF12
| ProgramID: 000400000FFFFC00.
|-
| 0xF13
| ProgramID: 000400000FFFFB00.
|-
| 0xF14
| ProgramID: 000400000FFFF900.
|-
| 0xF15
| ProgramID: 000400000FFFF800.
|-
| 0xF16
| ProgramID: 000400000FFFF700.
|-
| 0xF17
| ProgramID: 000400000FFFF600.
|-
| 0xF18
| ProgramID: 000400000FFFF500.
|}

These AppIDs are all for NAND titles, except for 0x300. AppIDs in the 0x1XX range are applets(programID-high 00040030), and the AppIDs in the 0x2XX range are "system libraries"(programID-high 00040030). The 0xFXX AppID range is for development NAND applications, these are not available for retail.

Note that at some point the total AppID entry count was changed from 28 to 27.

APT:SetScreencapPostPermission

2023-07-23T06:27:00Z

Steveice10: Steveice10 moved page APT:SetScreencapPostPermission to APT:SetScreenCapturePostPermission

#REDIRECT [[APT:SetScreenCapturePostPermission]]

APT:SetScreenCapturePostPermission

2023-07-23T06:27:00Z

Steveice10: Steveice10 moved page APT:SetScreencapPostPermission to APT:SetScreenCapturePostPermission

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00550040]
|-
| 1
| Permission to post screenshots to Miiverse
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This sets whether or not screenshots may be posted on Miiverse.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 1
| the user has no explicit setting
|-
| 2
| screenshot posting to Miiverse is enabled
|-
| 3
| screenshot posting to Miiverse is disabled
|}

APT:GetScreencapPostPermission

2023-07-23T06:26:58Z

Steveice10: Steveice10 moved page APT:GetScreencapPostPermission to APT:GetScreenCapturePostPermission

#REDIRECT [[APT:GetScreenCapturePostPermission]]

APT:GetScreenCapturePostPermission

2023-07-23T06:26:58Z

Steveice10: Steveice10 moved page APT:GetScreencapPostPermission to APT:GetScreenCapturePostPermission

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00560000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| The screenshot posting permission
|}

=Description=
This returns whether or not screenshots may be posted on Miiverse.

{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 1
| the user has no explicit setting
|-
| 2
| screenshot posting to Miiverse is enabled
|-
| 3
| screenshot posting to Miiverse is disabled
|}

APT:GetApplicationRunningMode

2023-07-23T06:21:01Z

Steveice10:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x01030000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| u8, Application Running Mode
|}

=Description=
This outputs a value based on whether the system is running using New 3DS CPU speed and whether the application is registered with APT (see [[APT:Enable]]).

Using New 3DS CPU speed (i.e. modes 2 and 4) seems to be known as running as an "ext application" (probably for "extended application").

==Application Running Mode==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| No application is running
|-
| 1
| Old 3DS CPU speed, registered with APT
|-
| 2
| New 3DS CPU speed, registered with APT
|-
| 3
| Old 3DS CPU speed, not registered with APT
|-
| 4
| New 3DS CPU speed, not registered with APT
|}

APT:GetApplicationRunningMode

2023-07-23T05:24:05Z

Steveice10:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x01030000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| u8, Application Running Mode (?)
|}

=Description=
This writes an output u8 to cmdreply[2], the value is determined by checking various NS internal state + whether this is a New3DS.

The normal output seems to be value 0x2. Forcing this value to 0x1 causes New3DS HID usage(via ir:USER) in Smash Bros to be disabled.

Values 0x2 or 0x4 seem to indicate that it's running as an "ext application"(?)

APT:GetApplicationRunningMode

2023-07-23T05:23:52Z

Steveice10: Created page with "=Request= {| class="wikitable" border="1" |- ! Index Word ! Description |- | 0 | Header code [0x01030000] |} =Response= {| class="wikitable" border="1" |- ! Index Word !..."

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x01030000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| u8, Application Running Mode ()
|}

=Description=
This writes an output u8 to cmdreply[2], the value is determined by checking various NS internal state + whether this is a New3DS.

The normal output seems to be value 0x2. Forcing this value to 0x1 causes New3DS HID usage(via ir:USER) in Smash Bros to be disabled.

Values 0x2 or 0x4 seem to indicate that it's running as an "ext application"(?)

APT:GetTargetPlatform

2023-07-23T05:20:16Z

Steveice10:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x01010000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| u8, Target Platform (0 = Old 3DS, 1 = New 3DS)
|}

=Description=
This writes an output u8 to cmdreply indexword[2]. This uses [[PTMSYSM:CheckNew3DS]]. When a certain NS state field is non-zero, the output value is zero, otherwise the output is from [[PTMSYSM:CheckNew3DS]]. Normally this NS state field is zero, however this state field is set to 1 when [[APT:PrepareToStartApplication]] is used with flags bit8 is set.

APT:CheckNew3DSApp

2023-07-23T05:19:55Z

Steveice10: Steveice10 moved page APT:CheckNew3DSApp to APT:GetTargetPlatform

#REDIRECT [[APT:GetTargetPlatform]]

APT:GetTargetPlatform

2023-07-23T05:19:55Z

Steveice10: Steveice10 moved page APT:CheckNew3DSApp to APT:GetTargetPlatform

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x01010000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|-
| 2
| u8, Status (0 = Old 3DS, 1 = New 3DS)
|}

=Description=
This writes an output u8 to cmdreply indexword[2]. This uses [[PTMSYSM:CheckNew3DS]]. When a certain NS state field is non-zero, the output value is zero, otherwise the output is from [[PTMSYSM:CheckNew3DS]]. Normally this NS state field is zero, however this state field is set to 1 when [[APT:PrepareToStartApplication]] is used with flags bit8 is set.

NS and APT Services

2023-07-23T05:19:38Z

Steveice10: Two commands from FE Fates

[[Category:Services]]
The NS ('''N'''intendo User Interface '''S'''hell) system module is the first module launched from a CTR-NAND title after the [[FIRM]] processes are loaded (also see [[Bootloader]]). This module is launched by the pm process, with the titleID loaded from NS state(hard-coded TID initialized during applet TID-array initialization). NS first launches [[ErrDisp]], then the menu. On retail the menu TID is loaded from NS state, while on dev/debug the menu TID is loaded from [[Config_Savegame|config]]. On dev-units if the menu TID block doesn't exist in [[Config_Savegame|config]], NS will attempt to launch the alternate menu instead. The TID of the launched menu is then written to [[Configuration Memory|ACTIVEMENUTID]]. NS uses [[PMApp:LaunchTitle|pm:app]] to launch titles.

NS will not trigger the [[ErrDisp|fatal-error]] screen when launching the regular/alternate menu fails.

Like home menu NS is constantly running while the system is in 3DS-mode. When attempting to return to home-menu when the home-menu process isn't running(like when the process terminated/crashed), NS will trigger a [[ErrDisp|fatal]] error.

= Alternate menu =
When launching the regular menu fails, NS will then attempt to launch the alternate menu. This title could be used as a recovery process, however it's normally not used after the factory.

At the factory for all 3DS systems, [[3DS Development Unit GUI#Test Menu|Test Menu]] is installed with this TID. On retail this title is eventually deleted during [[Factory Setup]].

= Auto-boot =
After [[PMApp:GetFIRMLaunchParams|loading]] [[FIRM]] params and prior to launching [[ErrDisp]]/Home Menu, NS handles auto-booting titles. The same code called by [[APT:Reboot]] is used for launching FIRM here. When the [[Configuration_Memory|UPDATEFLAG]] is set, NS will launch SAFE_MODE_FIRM with the application titleID set to the [[System_Settings#System_Updater|System Updater]] titleID for this region. When the UPDATEFLAG is not set, NS can auto-boot the following titles as well if [[Configuration_Memory|0x1FF80016]] bit0 is set.

When bit1 and bit2 are value zero in [[Configuration_Memory|0x1FF80016]], NS will [[NSS:LaunchFIRM|launch]] the title specified by the [[FIRM]] parameters if the title-info is set. This FIRM launch is done after launching [[ErrDisp]] and Home Menu. Otherwise when [[Configuration_Memory|0x1FF80016]] is value 2 and the output u8 from [[PTM|PTMSYSM]] command 0x08140000 is value 0, NS will boot the title specified from the TWL TLNC block from FIRMparams+0x300. This is the same TLNC block which DSi titles wrote to RAM+0x300 for launching other titles via the launcher title. When handling the TLNC block, NS will boot the 3DS System Settings title when the TLNC titleID is the DSi System Settings titleID(the region field in the TLNC TID is not checked/used). When the TLNC titleID is not System Settings, NS will convert the input DSi titleID-high to the 3DS TWL titleID-high(tidhigh = (TLNCtidhigh & 0x7FFF) | 0x48000), then launch TWL_FIRM to run the title. NS does not support launching from gamecard via TLNC.

= NS Workaround =
A "ns_workaround" was [[5.1.0-11|added]] in NS to workaround the flaw added with [[5.0.0-11]]. When NS is loading before launching any ARM11 processes and certain [[Configuration Memory]] fields are set, NS will launch [[Application_Manager_Services|AM]] then use command [[AM:InstallNATIVEFIRM]]. NS will then execute the code called by [[APT:StartNewestHomeMenu]], the code related to APT:PrepareToStartNewestHomeMenu is not executed here.

NS will only execute this code-path when [[Configuration Memory|0x1FF80016]] is value zero, when KERNEL_VERSIONMAJOR is value 2, and when KERNEL_VERSIONMINOR is less than 35. Therefore, this code-path is only executed when the running NATIVE_FIRM version is prior to [[5.0.0-11]].

= NS Service "ns:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchFIRM|LaunchFIRM]]
|-
| 0x000200C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchTitle|LaunchTitle]]
|-
| 0x00030000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateApplication|TerminateApplication]]
|-
| 0x00040040
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateProcess|TerminateProcess]]
|-
| 0x000500C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchApplicationFIRM|LaunchApplicationFIRM]]
|-
| 0x00060042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetWirelessRebootInfo|SetWirelessRebootInfo]]
|-
| 0x00070042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateInitialize|CardUpdateInitialize]]
|-
| 0x00080000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateShutdown|CardUpdateShutdown]]
|-
| 0x00090000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000A0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000B0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000C0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000D0140
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetTWLBannerHMAC|SetTWLBannerHMAC]]
|-
| 0x000E0000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:ShutdownAsync|ShutdownAsync]]
|-
| 0x000F0000
| [[1.0.0-0]] - [[2.0.0-2]]
| This calls [[APT:AppletUtility]] with fixed input params.
|-
| 0x00100180
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:RebootSystem|RebootSystem]]
|-
| 0x00110100
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateTitle|TerminateTitle]]
|-
| 0x001200C0
| ?
| [[NSS:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00130000
| ?
| ?
|-
| 0x00140042
| ?
| ?
|-
| 0x00150140
| ?
| [[NSS:LaunchApplication|LaunchApplication]]
|-
| 0x00160000
| [[8.0.0-18]]
| [[NSS:RebootSystemClean|RebootSystemClean]]
|}

The maximum sessions that can be used with this service is two, therefore only two processes can use this service at the same time.

=NS Power Service "ns:p"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| [[NSP:RebootSystem|RebootSystem]]
|-
| 0x00020000
| [[NSS:ShutdownAsync|ShutdownAsync]]
|}

This was added with [[3.0.0-5]]. The PTM sysmodule connects to this service, and syncs whenever [[PTM|ptm:s GetShellState()]] changes.

=NS Service "ns:c"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010100
| [[NSC:LockSpecialContent|LockSpecialContent]]
|-
| 0x00020100
| [[NSC:UnlockSpecialContent|UnlockSpecialContent]]
|}

This was added with [[5.0.0-11]]. It is used by the Instruction Manual applet, and is likely related to triggering SD/Game Card removal errors when ejecting the media the manual is stored on.

=APT Services=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Accessible with APT:U
! Description
|-
| 0x00010040
|
| Yes
| [[APT:GetLockHandle|GetLockHandle]]
|-
| 0x00020080
|
| See [[APT:Initialize|here]].
| [[APT:Initialize|Initialize]]
|-
| 0x00030040
|
| Yes
| [[APT:Enable|Enable]]
|-
| 0x00040040
|
| Yes
| [[APT:Finalize|Finalize]]
|-
| 0x00050040
|
| Yes
| [[APT:GetAppletManInfo|GetAppletManInfo]]
|-
| 0x00060040
|
| Yes, for AppID != 0x300
| [[APT:GetAppletInfo|GetAppletInfo]]
|-
| 0x00070000
|
| Yes
| [[APT:GetLastSignaledAppletId|GetLastSignaledAppletId]]
|-
| 0x00080000
|
| Yes
| [[APT:CountRegisteredApplet|CountRegisteredApplet]]
|-
| 0x00090040
|
| Yes
| [[APT:IsRegistered|IsRegistered]]
|-
| 0x000A0040
|
| Yes
| [[APT:GetAttribute|GetAttribute]]
|-
| 0x000B0040
|
| Yes
| [[APT:InquireNotification|InquireNotification]]
|-
| 0x000C0104
|
| Yes
| [[APT:SendParameter|SendParameter]]
|-
| 0x000D0080
|
| Yes
| [[APT:ReceiveParameter|ReceiveParameter]]
|-
| 0x000E0080
|
| Yes
| [[APT:GlanceParameter|GlanceParameter]]
|-
| 0x000F0100
|
| Yes
| [[APT:CancelParameter|CancelParameter]]
|-
| 0x001000C2
|
| Yes
| [[APT:DebugFunc|DebugFunc]]
|-
| 0x001100C0
|
| Yes
| [[APT:MapProgramIdForDebug|MapProgramIdForDebug]]
|-
| 0x00120040
|
| Yes
| [[APT:SetHomeMenuAppletIdForDebug|SetHomeMenuAppletIdForDebug]]
|-
| 0x00130000
|
| Yes
| [[APT:GetPreparationState|GetPreparationState]]
|-
| 0x00140040
|
| Yes
| [[APT:SetPreparationState|SetPreparationState]]
|-
| 0x00150140
|
| No
| [[APT:PrepareToStartApplication|PrepareToStartApplication]]
|-
| 0x00160040
|
| Yes
| [[APT:PreloadLibraryApplet|PreloadLibraryApplet]]
|-
| 0x00170040
|
| Yes
| [[APT:FinishPreloadingLibraryApplet|FinishPreloadingLibraryApplet]]
|-
| 0x00180040
|
| Yes
| [[APT:PrepareToStartLibraryApplet|PrepareToStartLibraryApplet]]
|-
| 0x00190040
|
| Yes
| [[APT:PrepareToStartSystemApplet|PrepareToStartSystemApplet]]
|-
| 0x001A0000
|
| Yes
| [[APT:PrepareToStartNewestHomeMenu|PrepareToStartNewestHomeMenu]]
|-
| 0x001B00C4
|
| Yes
| [[APT:StartApplication|StartApplication]]
|-
| 0x001C0000
|
| Yes
| [[APT:WakeupApplication|WakeupApplication]]
|-
| 0x001D0000
|
| Yes
| [[APT:CancelApplication|CancelApplication]]
|-
| 0x001E0084
|
| Yes
| [[APT:StartLibraryApplet|StartLibraryApplet]]
|-
| 0x001F0084
|
| Yes
| [[APT:StartSystemApplet|StartSystemApplet]]
|-
| 0x00200044
|
| Yes
| [[APT:StartNewestHomeMenu|StartNewestHomeMenu]]
|-
| 0x00210000
|
| No
| [[APT:OrderToCloseApplication|OrderToCloseApplication]]
|-
| 0x00220040
|
| Yes
| [[APT:PrepareToCloseApplication|PrepareToCloseApplication]]
|-
| 0x00230040
|
| Yes
| [[APT:PrepareToJumpToApplication|PrepareToJumpToApplication]]
|-
| 0x00240044
|
| Yes
| [[APT:JumpToApplication|JumpToApplication]]
|-
| 0x002500C0
|
| Yes
| [[APT:PrepareToCloseLibraryApplet|PrepareToCloseLibraryApplet]]
|-
| 0x00260000
|
| Yes
| [[APT:PrepareToCloseSystemApplet|PrepareToCloseSystemApplet]]
|-
| 0x00270044
|
| Yes
| [[APT:CloseApplication|CloseApplication]]
|-
| 0x00280044
|
| Yes
| [[APT:CloseLibraryApplet|CloseLibraryApplet]]
|-
| 0x00290044
|
| Yes
| [[APT:CloseSystemApplet|CloseSystemApplet]]
|-
| 0x002A0000
|
| Yes
| [[APT:OrderToCloseSystemApplet|OrderToCloseSystemApplet]]
|-
| 0x002B0000
|
| Yes
| [[APT:PrepareToJumpToHomeMenu|PrepareToJumpToHomeMenu]]
|-
| 0x002C0044
|
| Yes
| [[APT:JumpToHomeMenu|JumpToHomeMenu]]
|-
| 0x002D0000
|
| Yes
| [[APT:PrepareToLeaveHomeMenu|PrepareToLeaveHomeMenu]]
|-
| 0x002E0044
|
| Yes
| [[APT:LeaveHomeMenu|LeaveHomeMenu]]
|-
| 0x002F0040
|
| Yes
| [[APT:PrepareToLeaveResidentApplet|PrepareToLeaveResidentApplet]]
|-
| 0x00300044
|
| Yes
| [[APT:LeaveResidentApplet|LeaveResidentApplet]]
|-
| 0x00310100
|
| Yes
| [[APT:PrepareToDoApplicationJump|PrepareToDoApplicationJump]]
|-
| 0x00320084
|
| Yes
| [[APT:DoApplicationJump|DoApplicationJump]]
|-
| 0x00330000
|
| Yes
| [[APT:GetProgramIdOnApplicationJump|GetProgramIdOnApplicationJump]]
|-
| 0x00340084
|
| Yes
| [[APT:SendDeliverArg|SendDeliverArg]]
|-
| 0x00350080
|
| Yes
| [[APT:ReceiveDeliverArg|ReceiveDeliverArg]]
|-
| 0x00360040
|
| Yes
| [[APT:LoadSysMenuArg|LoadSysMenuArg]]
|-
| 0x00370042
|
| Yes
| [[APT:StoreSysMenuArg|StoreSysMenuArg]]
|-
| 0x00380040
|
| Yes
| [[APT:PreloadResidentApplet|PreloadResidentApplet]]
|-
| 0x00390040
|
| Yes
| [[APT:PrepareToStartResidentApplet|PrepareToStartResidentApplet]]
|-
| 0x003A0044
|
| Yes
| [[APT:StartResidentApplet|StartResidentApplet]]
|-
| 0x003B0040
|
| Yes
| [[APT:CancelLibraryApplet|CancelLibraryApplet]]
|-
| 0x003C0042
|
| Yes
| [[APT:SendDspSleep|SendDspSleep]]
|-
| 0x003D0042
|
| Yes
| [[APT:SendDspWakeUp|SendDspWakeUp]]
|-
| 0x003E0080
|
| Yes
| [[APT:ReplySleepQuery|ReplySleepQuery]]
|-
| 0x003F0040
|
| Yes
| [[APT:ReplySleepNotificationComplete|ReplySleepNotificationComplete]]
|-
| 0x00400042
|
| Yes
| [[APT:SendCaptureBufferInfo|SendCaptureBufferInfo]]
|-
| 0x00410040
|
| Yes
| [[APT:ReceiveCaptureBufferInfo|ReceiveCaptureBufferInfo]]
|-
| 0x00420080
|
| Yes
| [[APT:SleepSystem|SleepSystem]]
|-
| 0x00430040
|
| Yes
| [[APT:NotifyToWait|NotifyToWait]]
|-
| 0x00440000
|
| Yes
| [[APT:GetSharedFont|GetSharedFont]]
|-
| 0x00450040
|
| Yes
| [[APT:GetWirelessRebootInfo|GetWirelessRebootInfo]]
|-
| 0x00460104
|
| Yes
| [[APT:Wrap|Wrap]]
|-
| 0x00470104
|
| Yes
| [[APT:Unwrap|Unwrap]]
|-
| 0x00480100
|
| No
| [[APT:GetProgramInfo|GetProgramInfo]]
|-
| 0x00490180
|
| No
| [[APT:Reboot|Reboot]]
|-
| 0x004A0040
|
| Yes
| [[APT:GetCaptureInfo|GetCaptureInfo]]
|-
| 0x004B00C2
|
| Yes
| [[APT:AppletUtility|AppletUtility]]
|-
| 0x004C0000
|
| Yes
| [[APT:SetFatalErrDispMode|SetFatalErrDispMode]]
|-
| 0x004D0080
|
| Yes
| [[APT:GetAppletProgramInfo|GetAppletProgramInfo]]
|-
| 0x004E0000
|
| Yes
| [[APT:HardwareResetAsync|HardwareResetAsync]]
|-
| 0x004F0080
| [[2.2.0-X]]
| Yes
| [[APT:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00500040
| [[2.2.0-X]]
| Yes
| [[APT:GetApplicationCpuTimeLimit|GetApplicationCpuTimeLimit]]
|-
| 0x00510080
| [[3.0.0-5]]
| Yes
| [[APT:GetStartupArgument|GetStartupArgument]]
|-
| 0x00520104
| [[4.0.0-7]]
| Yes
| [[APT:Wrap1|Wrap1]]
|-
| 0x00530104
| [[4.0.0-7]]
| Yes
| [[APT:Unwrap1|Unwrap1]]
|-
| 0x00540040
| [[5.0.0-11]]
| ?
| ?
|-
| 0x00550040
| [[7.0.0-13]]
| Yes
| [[APT:SetScreencapPostPermission|SetScreencapPostPermission]]
|-
| 0x00560000
| [[7.0.0-13]]
| Yes
| [[APT:GetScreencapPostPermission|GetScreencapPostPermission]]
|-
| 0x00570044
| [[7.0.0-13]]
| ?
| [[APT:WakeupApplication2|WakeupApplication2]]
|-
| 0x00580002
| [[7.0.0-13]]
| Yes
| [[APT:GetProgramID|GetProgramID]]
|-
| 0x01010000
| [[8.0.0-18]]
| Yes
| [[APT:GetTargetPlatform|GetTargetPlatform]]
|-
| 0x01020000
| [[8.0.0-18]]
| Yes
| [[APT:CheckNew3DS|CheckNew3DS]]
|-
| 0x01030000
| [[8.0.0-18]]
| Yes
| [[APT:GetApplicationRunningMode|GetApplicationRunningMode]]
|-
| 0x01040000
| [[8.0.0-18]]
| ?
| [[APT:IsStandardMemoryLayout|IsStandardMemoryLayout]]
|-
| 0x01050100
| [[10.4.0-29]]
| ?
| [[APT:IsTitleAllowed|IsTitleAllowed]]
|}

These "APT:U" and "APT:S" NS services can handle launching titles/"applets", these services handle signaling for home/power button as well. Only one session for either APT service can be open at a time, normally processes close the service handle immediately once finished using the service. The commands for APT:U and APT:S are exactly the same, however certain commands are only accessible with APT:S(NS module will call [[SVC|svcBreak]] when the command isn't accessible).

Applets returning to home-menu first use commands APT:PrepareToJumpToHomeMenu and APT:JumpToHomeMenu, followed by these commands to launch home-menu: [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]]. [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]] are also used for launching the [[Internet Browser]], the camera applet, etc.

Processes launch applications via home-menu, not directly with [[APT:PrepareToStartApplication]] and [[APT:StartApplication]]. Regular applications can't directly launch applications since [[APT:StartApplication]] launches the process without terminating the currently running application.

APT:PrepareToDoApplicationJump and APT:DoApplicationJump are used by applications, for launching native/<non-NATIVE_FIRM> applications. These commands notify Home Menu that title launching needs done, Home Menu does the actual title launching via NS commands.

== AppletAttr ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-2
| [[NS_and_APT_Services#AppletPos|AppletPos]]
|-
| 3
| Manually Acquire/Release GPU Rights
|-
| 4
| Manually Acquire/Release DSP Rights
|-
| 5
| ?
|}

== DisplayBufferMode ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| FORMAT_R8G8B8A8
|-
| 1
| FORMAT_R8G8B8
|-
| 2
| FORMAT_R5G6B5
|-
| 3
| FORMAT_R5G5B5A1
|-
| 4
| FORMAT_R4G4B4A4
|-
| 0xFFFFFFFF
| FORMAT_UNIMPORTABLE
|}

This is the same mapping as used for the [[GPU/External_Registers#Framebuffer_color_formats|GPU framebuffer color formats]].

== AppletPos ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1
| POS_NONE
|-
| 0
| POS_APP
|-
| 1
| POS_APPLIB
|-
| 2
| POS_SYS
|-
| 3
| POS_SYSLIB
|-
| 4
| POS_RESIDENT
|}

== QueryReply ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| REPLY_REJECT
|-
| 1
| REPLY_ACCEPT
|-
| 2
| REPLY_LATER
|}

== Notification ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NOTIFICATION_NONE
|-
| 1
| NOTIFICATION_HOME_BUTTON_1
|-
| 2
| NOTIFICATION_HOME_BUTTON_2
|-
| 3
| NOTIFICATION_SLEEP_QUERY
|-
| 4
| NOTIFICATION_SLEEP_CANCELED_BY_OPEN
|-
| 5
| NOTIFICATION_SLEEP_ACCEPTED
|-
| 6
| NOTIFICATION_SLEEP_AWAKE
|-
| 7
| NOTIFICATION_SHUTDOWN
|-
| 8
| NOTIFICATION_POWER_BUTTON_CLICK
|-
| 9
| NOTIFICATION_POWER_BUTTON_CLEAR
|-
| 10
| NOTIFICATION_TRY_SLEEP
|-
| 11
| NOTIFICATION_ORDER_TO_CLOSE
|}

== Command ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| COMMAND_NONE
|-
| 1
| COMMAND_WAKEUP
|-
| 2
| COMMAND_REQUEST
|-
| 3
| COMMAND_RESPONSE
|-
| 4
| COMMAND_EXIT
|-
| 5
| COMMAND_MESSAGE
|-
| 6
| COMMAND_HOME_BUTTON_SINGLE
|-
| 7
| COMMAND_HOME_BUTTON_DOUBLE
|-
| 8
| COMMAND_DSP_SLEEP
|-
| 9
| COMMAND_DSP_WAKEUP
|-
| 10
| COMMAND_WAKEUP_BY_EXIT
|-
| 11
| COMMAND_WAKEUP_BY_PAUSE
|-
| 12
| COMMAND_WAKEUP_BY_CANCEL
|-
| 13
| COMMAND_WAKEUP_BY_CANCELALL
|-
| 14
| COMMAND_WAKEUP_BY_POWER_BUTTON_CLICK
|-
| 15
| COMMAND_WAKEUP_TO_JUMP_HOME
|-
| 16
| COMMAND_REQUEST_FOR_SYS_APPLET
|-
| 17
| COMMAND_WAKEUP_TO_LAUNCH_APPLICATION
|-
| 0x41
| Unknown. [[APT:ReceiveParameter|Received]] by Home Menu during boot when the Home Menu process doesn't terminate properly(svcExitProcess/crash).
|}

== AppletPreparationState ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NO_PREPARATION
|-
| 1
| PREPARED_TO_LAUNCH_APP
|-
| 2
| PREPARED_TO_CLOSE_APP
|-
| 3
| PREPARED_TO_FORCE_TO_CLOSE_APP
|-
| 4
| PREPARED_TO_PRELOAD_APPLIB
|-
| 5
| PREPARED_TO_LAUNCH_APPLIB
|-
| 6
| PREPARED_TO_CLOSE_APPLIB
|-
| 7
| PREPARED_TO_LAUNCH_SYS
|-
| 8
| PREPARED_TO_CLOSE_SYS
|-
| 9
| PREPARED_TO_PRELOAD_SYSLIB
|-
| 10
| PREPARED_TO_LAUNCH_SYSLIB
|-
| 11
| PREPARED_TO_CLOSE_SYSLIB
|-
| 12
| PREPARED_TO_LAUNCH_RESIDENT
|-
| 13
| PREPARED_TO_LEAVE_RESIDENT
|-
| 14
| PREPARED_TO_DO_HOMEMENU
|-
| 15
| PREPARED_TO_LEAVE_HOMEMENU
|-
| 16
| PREPARED_TO_START_RESIDENT
|-
| 17
| PREPARED_TO_DO_APP_JUMP
|-
| 18
| PREPARED_TO_FORCE_TO_CLOSE_SYS
|-
| 19
| PREPARED_TO_LAUNCH_OTHER_SYS
|-
| 20
| PREPARED_TO_JUMP_TO_APP
|}

== StartupArgumentType ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| STARTUP_ARGUMENT_TYPE_OTHER_APP
|-
| 1
| STARTUP_ARGUMENT_TYPE_RESTART
|-
| 2
| STARTUP_ARGUMENT_TYPE_OTHER_MEDIA
|}

== CaptureBufferInfo ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, Size
|-
| 0x4
| 0x1
| u8, 3D (0 = not 3D, 1 = 3D)
|-
| 0x5
| 0x3
| Reserved
|-
| 0x8
| 0x4
| Main Screen Left Offset
|-
| 0xC
| 0x4
| Main Screen Right Offset
|-
| 0x10
| 0x4
| Main Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|-
| 0x14
| 0x4
| Sub Screen Left Offset
|-
| 0x18
| 0x4
| Sub Screen Right Offset
|-
| 0x1C
| 0x4
| Sub Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|}

==WirelessRebootInfo==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address.
|-
| 0x6
| 0x9
| WirelessRebootPassphrase
|-
| 0xF
| 0x1
| Uninitialized
|}

This is [[NSS:SetWirelessRebootInfo|setup]] by the dlplay system-application, before launching the DLP-child which can then use [[APT:GetWirelessRebootInfo]]. The MAC address and passphrase is used for connecting to the host by the DLP-child. See also [[DLP_Services|here]].

="APT:A" Service=
This was added with [[7.0.0-13|7.0.0-X]]. Official apps built with the CTRSDK for system-version >=[[7.0.0-13|7.0.0-X]] normally use the "APT:A" service instead of "APT:U". Those processes also have "APT:A" instead of "APT:U" in the service-access-control. It's unknown whether there's anything which is only accessible via "APT:A".

=Applets=
NS module does not verify that the input appID for the APT service cmds are correct for that type of command. For example, a process-launch of a SystemApplet via LibraryApplet commands works fine(minus the launched-process side of APT probably).

==System Applets==
On Old3DS there could only be one applet here(Home Menu, Internet Browser, Friend-List, etc) with programID-high 00040030 running at a time. On Old3DS when directly launching one of these 00040030 applets with Home Menu, the Home Menu process will terminate once the process is launched. On Old3DS when returning to Home Menu from that launched process, the Home Menu process is launched again.

On New3DS the Home Menu process is still running/in-memory, while another system-applet is running. On New3DS it appears that the Home Menu process is terminated+relaunched, when another system-applet terminated without exiting with APT properly.

==Library Applets==
Library applets can be launched by applications and regular applets. These library applets render to the screen(s) when running, etc. For example, this includes swkbd for text input. See the below appIDs in the 0x2XX range, the actual appID used is 0x4XX however.

Input data can be sent to the library applet via the NS [[APT:SendParameter|parameter]] buffer, and/or with shared-memory with a shared-mem handle sent to the library applet. Output data from the library applet can be received by [[APT:ReceiveParameter]], the library applet can also use the specified shared-mem for output too.

=AppIDs=
{| class="wikitable" border="1"
|-
! AppID
! Description
|-
| 0x101
| [[Home Menu]] (menu)
|-
| 0x103
| Alternate Menu
|-
| 0x110
| Camera applet ([[Camera Applet|CtrApp]])
|-
| 0x112
| Friends List applet ([[Friend List|friend]])
|-
| 0x113
| Game Notes applet (Cherry)
|-
| 0x114
| [[Internet Browser]] (spider/SKATER)
|-
| 0x115
| Instruction Manual applet
|-
| 0x116
| [[Notifications]] applet (newslist)
|-
| 0x117
| Miiverse applet (olv)
|-
| 0x118
| [[Miiverse]] posting applet (solv3)
|-
| 0x119
| Amiibo settings (cabinet)
|-
| 0x201
| Software Keyboard (swkbd) (?)
|-
| 0x202
| [[Mii Selector]] (appletEd) (?)
|-
| 0x204
| Photo Selector (PNOTE_AP) (?)
|-
| 0x205
| Sound Selector (SNOTE_AP) (?)
|-
| 0x206
| Error Display ([[ErrDisp|error]]) (?)
|-
| 0x207
| eShop applet ([[EShop#NS_eShop_application_parameters|mint]]) (?)
|-
| 0x208
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]]) (?)
|-
| 0x209
| Notepad (memolib) (?)
|-
| 0x300
| Application
|-
| 0x301
| eShop (tiger)
|-
| 0x401
| Software Keyboard (swkbd)
|-
| 0x402
| Mii Selector (appletEd)
|-
| 0x404
| Photo Selector (PNOTE_AP)
|-
| 0x405
| Sound Selector (SNOTE_AP)
|-
| 0x406
| Error Display (error)
|-
| 0x407
| eShop applet (mint)
|-
| 0x408
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]])
|-
| 0x409
| Notepad (memolib)
|-
| 0xF10
| ProgramID: 0004003000008900.
|-
| 0xF11
| ProgramID: 000400000FFFFD00.
|-
| 0xF12
| ProgramID: 000400000FFFFC00.
|-
| 0xF13
| ProgramID: 000400000FFFFB00.
|-
| 0xF14
| ProgramID: 000400000FFFF900.
|-
| 0xF15
| ProgramID: 000400000FFFF800.
|-
| 0xF16
| ProgramID: 000400000FFFF700.
|-
| 0xF17
| ProgramID: 000400000FFFF600.
|-
| 0xF18
| ProgramID: 000400000FFFF500.
|}

These AppIDs are all for NAND titles, except for 0x300. AppIDs in the 0x1XX range are applets(programID-high 00040030), and the AppIDs in the 0x2XX range are "system libraries"(programID-high 00040030). The 0xFXX AppID range is for development NAND applications, these are not available for retail.

Note that at some point the total AppID entry count was changed from 28 to 27.

NWMUDS:ScanOnConnection

2023-07-23T04:41:33Z

Steveice10: /* Description */

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00220402]
|-
| 1
| Output buffer max size
|-
| 2-14
| Input [[NWM_Services|ScanInputStruct]].
|-
| 15
| [[NWM_Services|wlancommID]]
|-
| 16
| This is the ID also located at offset 0xE in the CTR-generation [[NWM_Services|structure]].
|-
| 17
| (Size<<4) <nowiki>|</nowiki> 12
|-
| 28
| Output [[NWM_Services|BeaconDataReply]] buffer ptr
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This is about the same as [[NWMUDS:StartScan]] except this only returns already received beacon data, and it can ''only'' be used when connected to a network.

NWMUDS:SetProbeResponseParam

2023-07-23T04:41:21Z

Steveice10: /* Description */

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00210080]
|-
| 1
| 3-byte OUI followed by the the u8 OUI type(type0 normally). Hence, this field is normally 0x00321F00.
|-
| 2
| s8 data, can be zero.
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
Used before using [[NWMUDS:CreateNetwork2]].

NWM Services

2023-07-23T04:40:19Z

Steveice10: /* NWM local-WLAN service "nwm::UDS" */

[[Category:Services]]

These NWM services are used for local-WLAN communications, NWM module handles regular wifi APs as well. These services are used for creating/connecting to networks, and for sending/receiving data over the network etc. NWM module uses the wifi SDIO hardware via the IO registers for this.

=NWM local-WLAN service "nwm::UDS"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000102C2
|
| Initialize Deprecated. Appears to be handled about the same way as [[NWMUDS:InitializeWithVersion]], except this uses version=0x100 internally instead of loading it from the command request.
|-
| 0x00020000
|
| Scrap Not used by sub-wars. This sets a state value to 0x2 then signals an event. This is probably some sort of shutdown command since this state write will result in all UDS commands returning an error if used afterwards.
|-
| 0x00030000
|
| [[NWMUDS:Finalize|Finalize]]
|-
| 0x00040402
|
| CreateNetwork Deprecated. Only used by very old titles.
|-
| 0x00050040
|
| [[NWMUDS:EjectClient|EjectClient]]
|-
| 0x00060000
|
| [[NWMUDS:EjectSpectator|EjectSpectator]]
|-
| 0x00070080
|
| [[NWMUDS:UpdateNetworkAttribute|UpdateNetworkAttribute]]
|-
| 0x00080000
|
| [[NWMUDS:DestroyNetwork|DestroyNetwork]]
|-
| 0x00090442
|
| ConnectNetwork Deprecated. Only used by very old titles.
|-
| 0x000A0000
|
| [[NWMUDS:DisconnectNetwork|DisconnectNetwork]]
|-
| 0x000B0000
|
| [[NWMUDS:GetConnectionStatus|GetConnectionStatus]]
|-
| 0x000C0000
|
| This writes two output u8 values to cmdreply[2] +0/+1. Not used by sub-wars.
|-
| 0x000D0040
|
| [[NWMUDS:GetNodeInformation|GetNodeInformation]]
|-
| 0x000E0006
|
| ''Identical'' to [[NWMUDS:GetNodeInformationList|GetNodeInformationList]]. Deprecated, only used by old titles.
|-
| 0x000F0404
|
| [[NWMUDS:StartScan|StartScan]]
|-
| 0x00100042
|
| [[NWMUDS:SetApplicationData|SetApplicationData]]
|-
| 0x00110040
|
| [[NWMUDS:GetApplicationData|GetApplicationData]]
|-
| 0x00120100
|
| [[NWMUDS:Bind|Bind]]
|-
| 0x00130040
|
| [[NWMUDS:Unbind|Unbind]]
|-
| 0x001400C0
|
| [[NWMUDS:PullPacket|PullPacket]]
|-
| 0x00150080
|
| SetMaxSendDelay(u64 unk) Not used by sub-wars.
|-
| 0x00160040
|
| (u8 inputval) Unknown. Not used by sub-wars.
|-
| 0x00170182
|
| [[NWMUDS:SendTo|SendTo]]
|-
| 0x00180040
|
| (u16 inputval) Unknown. Not used by sub-wars.
|-
| 0x00190040
|
| (u32 inputval) Unknown. Not used by sub-wars.
|-
| 0x001A0000
|
| [[NWMUDS:GetChannel|GetChannel]]
|-
| 0x001B0302
|
| [[NWMUDS:InitializeWithVersion|InitializeWithVersion]]
|-
| 0x001C0040
|
| (u8 inputval) Unknown. Not used by sub-wars.
|-
| 0x001D0044
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:CreateNetwork2|CreateNetwork2]] This is a replacement for the original network-creation command.
|-
| 0x001E0084
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:ConnectNetwork2|ConnectNetwork2]] This is a replacement for the original network-connection command.
|-
| 0x001F0006
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:GetNodeInformationList|GetNodeInformationList]]
|-
| 0x00200040
| Unknown, >[[2.0.0-2]]
| Flush (u8 data_frame_index) Unknown. Not used by sub-wars.
|-
| 0x00210080
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:SetProbeResponseParam|SetProbeResponseParam]]
|-
| 0x00220402
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:ScanOnConnection|ScanOnConnection]]
|-
| 0x00230000
| Unknown, >[[2.0.0-2]]
| This writes an output u16 value to cmdreply[2]. Unknown. Not used by sub-wars.
|}

PullPacket is used for receiving data over the network and SendTo is for sending data over the network.

=NWM infrastructure service "nwm::INF"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| ?
|-
| 0x00020000
| ?
|-
| 0x00030000
| ?
|-
| 0x00040000
| ?
|-
| 0x00050000
| ?
|-
| 0x000603C4
| [[NWMINF:RecvBeaconBroadcastData|RecvBeaconBroadcastData]]
|-
| 0x00070742
| [[NWMINF:ConnectToEncryptedAP|ConnectToEncryptedAP]]
|-
| 0x00080302
| [[NWMINF:ConnectToAP|ConnectToAP]]
|-
| 0x00090000
| ?
|-
| 0x000A0000
| ?
|-
| 0x000B0000
| ?, return event handle in cmdbuf[3]
|-
| 0x000C0040
| ?
|-
| 0x000D0000
| ?
|-
| 0x000E0002
| ?
|-
| 0x000F0082
| ?
|-
| 0x00100040
| ?
|}

=NWM socket service "nwm::SOC"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010042
| (u32 size, <static_buffer translate-hdr with static_buf_id=0>, addr) ?
|-
| 0x00020080
| (u32 unk, u32 size) Unknown. Uses size=0x5F8 internally unless the input is <=0x5F8. Uses an ipc static_buffer(static_buf_id=0) for output with the specified size(also used when writing the translate-hdr). Writes an output u32 to cmdreply[2].
|-
| 0x00030042
| (u32 unk, u32 size, <static_buffer translate-hdr with static_buf_id=0>, addr) ?
|-
| 0x00040042
| (u32 size, u32 unk, <static_buffer translate-hdr with static_buf_id=1>, addr) ?
|-
| 0x00050040
| (u32 unk) ?
|-
| 0x00060080
| (u32 unk0, u16 unk1) ?
|-
| 0x00070040
| (u16 unk) This writes an output u32 to cmdreply[2].
|-
| 0x00080040
| [[NWMSOC:GetMACAddress|GetMACAddress]]
|-
| 0x00090000
| This just copies data from state to the cmdreply, this always returns 0. u32 cmdreply[2] = sharedmem_size, cmdreply[4] = [[NWM_Shared_Memory|sharedmem_handle]], cmdreply[5] = eventhandle.
|-
| 0x000A0040
| (u32 unk) ?
|-
| 0x000B0040
| (u32 unk) This writes an output u32 to cmdreply[2].
|-
| 0x000C0040
| (u32 unk) ?
|-
| 0x000D0002
| ([[IPC|kernel_processid_translatehdr]], u32 processid) ?
|}

The only sysmodule which uses this is [[Socket_Services|socket]]-sysmodule. The first command used by socket-module is cmd9.

=NWM service "nwm::SAP"=

=NWM local-WLAN [[StreetPass]] service "nwm::CEC"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00060002
| Unknown, called by CECD module, cmdbuf[2] takes an event handle.
|-
| 0x000D0082
| [[NWMCEC:SendProbeRequest|SendProbeRequest]]
|}

=NWM service "nwm::EXT"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010000
| <=[[2.0.0-2]]
| ?
|-
| 0x00020000
| <=[[2.0.0-2]]
| ?
|-
| 0x00030000
| <=[[2.0.0-2]]
| ?
|-
| 0x00040040
| <=[[2.0.0-2]]
| ?
|-
| 0x00050002
| <=[[2.0.0-2]]
| ?
|-
| 0x00060000
| <=[[2.0.0-2]]
| ?
|-
| 0x00070000
| <=[[2.0.0-2]]
| This copies 0x1C-bytes from NWM-module state to the data starting at cmdreply[2].
|-
| 0x00080040
| <=[[2.0.0-2]]
| [[NWMEXT:ControlWirelessEnabled|ControlWirelessEnabled]]
|-
| 0x00090000
| <=[[2.0.0-2]]
| ?
|}

=NWM service "nwm::TST"=

=BeaconDataReply Structure=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Max output size, from the command request.
|-
| 0x4
| 0x4
| Total amount of output data written relative to struct+0. 0xC when there's no entries.
|-
| 0x8
| 0x4
| Total entries, 0 for none.
|-
| 0xC
| <Rest of the structure>
| Beacon entries.
|}

Beacon entry:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Size of this entire entry. The next entry starts at curentry_startoffset+curentry_size.
|-
| 0x4
| 0x1
| ?
|-
| 0x5
| 0x1
| AP wifi channel.
|-
| 0x6
| 0x1
| ?
|-
| 0x7
| 0x1
| ?
|-
| 0x8
| 0x6
| AP MAC address.
|-
| 0xE
| 0x6
| ?
|-
| 0x14
| 0x4
| Size of this entire entry, games use this value to traverse the beacons list.
|-
| 0x18
| 0x4
| Value 0x1C(size of this header and/or offset to the actual beacon data).
|-
| 0x1C
| Entry_size - 0x1C
| The actual beacon data is located here, starting at the 802.11 management frame header.
|}

This section describes the structure returned by [[NWMINF:RecvBeaconBroadcastData]] and [[NWMUDS:RecvBeaconBroadcastData]].

=ScanInputStruct=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Two unknown u16s.
|-
| 1
| Two unknown u16s.
|-
| 2-3
| Host MAC address. The 6-bytes located here are normally all 0xFF, for all hosts. Otherwise when not set to broadcast-MAC, the command will only return info for the specified host MAC address.
|-
| 4-12
| Uninitialized for UDS.
|}

This section describes the 0x34-byte input structure used by [[NWMINF:RecvBeaconBroadcastData]] and [[NWMUDS:RecvBeaconBroadcastData]].

=Local-WLAN=
UDS is used for 3DS<>3DS local-WLAN communications, and for 3DS<>Wii U communications. The latter is mainly only used for multi-player in games.

All UDS local-WLAN communications have the CCMP key for data encryption generated via NWM module. The CCMP key passed to nwm::CEC commands(stored in a 0x44-byte input structure) for [[StreetPass]] is generated by the CECD module. The input data used with [[Process_Services|EncryptDecryptAes]] with [[PSPXI:EncryptDecryptAes|keytype1]] is a MD5 hash over the input passphrase. This input passphrase is fixed for [[Download Play]], it's unique per local-WLAN application. The CTR is a MD5 hash over the below 0x10-byte structure. The output from encrypting that data with AES-CTR is the final CCMP key. This passphrase is a raw input buffer: while the passphrase specified by user-processes is normally a string with the NUL-terminator included, it can be anything(like the [[DLP_Services|WirelessRebootPassphrase]] for example).

The maximum number of nodes(including the host) which can be on an UDS network is 16.

==NodeID==
There are two types of client connections: regular Client, and Spectator. The latter ''never'' sends ''any'' 802.11 frame at all to the host, hence ''nothing'' actually connected to the network(including the host) can know about any spectators. Once a spectator is "connected" to a network, it can only receive broadcasted data, no sending.

DLP-client connects to the network as a spectator during DLP scanning to get various [[Download_Play|metadata]] including icon data.

===NetworkNodeID===
This is the network u16 ID for each device on the UDS network. NodeID 0xFFFF is a broadcast alias. 0x1 is for the host, the 0x2 for the first client, 0x3 for the second client, and so on.

The spectator doesn't have a NetworkNodeID, since it can't [[NWMUDS:SendTo|send]] any data.

NetworkNodeIDs for clients do not change when any clients disconnect, likewise for the encrypted node-listing stored in the wifi beacons. When a client disconnects, the corresponding NetworkNodeID bit in the [[NWMUDS:GetConnectionStatus|node_bitmask]] is cleared. When a client is connecting, the client is assigned the NetworkNodeID with the lowest corresponding clear-bit in the [[NWMUDS:GetConnectionStatus|node_bitmask]], then that bit is set.

===BindNodeID===
This u32 is an ID only used on the local device. How many devices are on the network or which device this system is does not affect this ID.

The spectator uses BindNodeID 0x1. DLP uses BindNodeID 0x3 when connecting as an actual client. Hence, it seems BindNodeID bit0 is spectator-related. All normal nodes(host/client) start with BindNodeID 0x2. When connecting to a network again(and probably with network creation) without reinitializing NWMUDS, official user processes increase the used BindNodeID by 0x2.

BindNodeID value 0x0 is invalid. The maximum number of BindNodeIDs which can be open at the same time is 16.

==Application data transfer==
The protocol used for sending/receiving data over the network with UDS by official applications is [[PRUDP]](in some cases at least). Mario Kart 7 uses PRUDP here. Triforce Heroes uses plaintext for whatever protocol it uses for UDS.

The UDS version of [[PRUDP]] is different from the normal UDP version it appears(no afa1/a1af data for example).

==Communication protocol==
The process of connecting to a host and exchanging data follows the sequence:

Client->Server: Authentication frame SEQ1

Server->Client: Authentication frame SEQ2

[There does not appear to be an association request frame sent by the client to the server, it is however possible that it was sent and just not captured by the test equipment]

Server->Client: Association Response frame with association id

[From here on, the client is connected to the server]

Client->Server: Encrypted data packet containing an 8-byte 802.2 LLC header with ethertype = EAPoL (0x888E) and an u16 header of 0x201 ([[NWM_Services#EAPoL-Start frame|EAPoL-Start]])

Server->Broadcast: Encrypted data packet containing the updated node information after the client connected (Using ethertype = SecureData).

Server->Client: Encrypted data packet containing an 8-byte 802.2 LLC header with ethertype = EAPoL (0x888E) and an u16 header of 0x0202([[NWM_Services#EAPoL-Logoff frame|EAPoL-Logoff]])

[From here on, data packets sent using SendTo are encapsulated with an LLC header with ethertype = 0x876D ([[NWM_Services#SecureData NWM header|SecureData]])]

[The client also sends periodic SecureData data frames on its own, these are probably ping frames]

==Data frames==
Data is transferred over the network using [[NWMUDS:PullPacket]]/[[NWMUDS:SendTo]]. That data is transferred using 802.11 data frames using CCMP encryption. The encrypted data contained in the frame starts with the 0x8-byte [https://en.wikipedia.org/wiki/Subnetwork_Access_Protocol#Use LLC header], then the 0xE-byte NWM header, followed by the actual application data from the previously mentioned commands. When [[NWMUDS:SendTo]] was used with dst_NodeID = broadcast, the data frame is sent to the 802.11 broadcast MAC address. Otherwise with a specific NodeID, the data frame is sent to the actual MAC address for that device.

Official application data is normally stored here as big-endian.

Application data packets are sent to the host using 802.11 unicast, which then acts as a router and forwards the packet to the right destination node id based on the SecureData header using either broadcast or unicast, it is not yet known how it chooses which to use.

==Special data channels==
{| class="wikitable" border="1"
|-
! Channel
! Description
|-
| 0x101
| Used when broadcasting the updated node information after a new client connects.
|-
| 0x103
| Used when sending what appears to be "ping" or "null" frames.
|-
| 0x104
| Used to signal the ejection of all spectators in the network.
|}

==SecureData NWM header==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Size of the entire frame minus the 8 bytes from the LLC header.
|-
| 0x2
| 0x2
| unknown
|-
| 0x4
| 0x2
| Size of the entire frame minus 12 bytes.
|-
| 0x6
| 0x2
| Data channel. Applications can only use the low 8 bits, channels greater than 255 are reserved for management functions.
|-
| 0x8
| 0x2
| Sequence number, incremented after each sent packet.
|-
| 0xA
| 0x2
| Destination network node id
|-
| 0xC
| 0x2
| Source network node id
|}

This data is stored as big-endian.

==EAPoL-Start frame==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Always 0x201 in big-endian.
|-
| 0x2
| 0x2
| Association id of the sending client in big-endian.
|-
| 0x4
| 0x2
| Unknown. Always 0x1 in big-endian. The parser for this packet errors out if this is > 3.
|-
| 0x6
| 0x2
| Unknown
|-
| 0x8
| 0x28
| NodeInfo structure with all fields in big-endian
|}

This data is stored as big-endian.

==EAPoL-Logoff frame==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Always 0x202 in big-endian.
|-
| 0x2
| 0x2
| Unknown. Always 0?
|-
| 0x4
| 0x2
| Assigned network node id.
|-
| 0x6
| 0x6
| Mac address of the newly connected client.
|-
| 0xC
| 0x4
| Unknown
|-
| 0x10
| 0x2
| Unknown. Always 0.
|-
| 0x12
| 0x1
| Number of connected nodes, including the new client.
|-
| 0x13
| 0x1
| Max number of nodes.
|-
| 0x14
| 0x2
| Always 0.
|-
| 0x16
| 0x2
| Unknown.
|-
| 0x18
| 0x280
| List of 16 NodeInfo structures with all fields in big-endian
|}

This data is stored as big-endian.

==Structure used for generating the CTR for CCMP key generation==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| wlancommID
|-
| 0x4
| 0x4
| networkID
|-
| 0x8
| 0x6
| Host MAC address.
|-
| 0xE
| 0x2
| id8
|}

This data is stored as little-endian.

==CTR used for beacon tags crypto==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address
|-
| 0x6
| 0x4
| wlancommID
|-
| 0xA
| 0x1
| id8
|-
| 0xB
| 0x1
| Padding, value zero.
|-
| 0xC
| 0x4
| networkID
|}

This data is stored as little-endian. All data here is all-zero except for the MAC address, when the u8 at offset 0x8 in the network-struct is 0.

==Network structure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| This is the MAC address of the host. This is used for when [[NWMUDS:ConnectToNetwork|connecting]] to the network.
|-
| 0x6
| 0x1
| This is actually written as an u16 without byte-swapping. This is the network wifi channel. When connecting this is normally non-zero. When hosting, this can be 0 to automatically select a channel, otherwise the specified channel is used. When non-zero official user-processes require this value to be one of the following when hosting: 1, 6, or 11.
|-
| 0x7
| 0x1
| Padding
|-
| 0x8
| 0x1
| Initialized flag. Must be non-zero otherwise NWM-module will use value 0x0 for most/all(?) fields in this structure when reading these fields.
|-
| 0xC
| 0x3
| This is the OUI value for use with the beacon tags. Normally this is 001F32.
|-
| 0xF
| 0x1
| OUI type (21/0x15)
|-
| 0x10
| 0x4
| wlancommID. Local-WLAN communication ID, normally this is: (user_process [[Title_list|uniqueID]] << 8) | val. Where val is 0x10 on retail([[Configuration_Memory#ENVINFO|ENVINFO]] bit0 set), 0x90 for devunit. Official software includes an input bool flag parameter for setting bit0 in this wlancommID, normally that flag isn't set. For [[Download Play]], this is always 0x2810 on retail(0x2890 on devunit).

This wlancommID can have the side affect of region-locking when the title uses the uniqueID for the current title(hard-coded in .text normally), instead of using a fixed input uniqueID for each region of the title.
|-
| 0x14
| 0x1
| id8. ID, for [[Download Play]] this is 0x55. 0x55/'U' seems to be used for networks where Wii U can host it(Download Play, Smash Bros, ...) - this value isn't known to be actually checked anywhere however.
|-
| 0x15
| 0x1
| Number of times the network structure hash was updated.
|-
| 0x16
| 0x2
| This network attributes u16 bitmask can be written via [[NWMUDS:UpdateNetworkAttribute]].
Bitmasks:
* 0x1: When set, spectators are not allowed to connect(see [[NWMUDS:EjectSpectator|here]]). Checked by official user-processes before using [[NWMUDS:ConnectToNetwork]], when connecting as a Spectator. Must be clear otherwise that code returns error 0xE10113EA. If the initialized_flag at offset 0x8 is zero, this code handles it the same way as if this bit was set. The latest NWM-module handles checking this bit itself however.
* 0x2: When set, new regular-clients are not allowed to connect.
* 0x4: Unknown, has no affect on new clients/spectators connecting. Official software has an option for setting this bit via an input flag from the same code using bitmask 0x2. Official software always clears bitmask 0x6 when unblocking new connections.
|-
| 0x18
| 0x4
| u32 networkID, randomly-generated when creating the network. The network SSID used when a client connects to the network is sprintf(out, "%08X", networkID).
|-
| 0x1C
| 0x1
| Total number of currently connected nodes, including the host.
|-
| 0x1D
| 0x1
| Maximum number of nodes, including the host. This also is the total number of entries stored under the array in the encrypted beacon data.
|-
| 0x1E
| 0xD
| ?
|-
| 0x2B
| 0x14
| SHA1 hash of the network structure, starting at the OUI field (offset 0xC) and spanning SizeOfAppData + 0x34. The unused space of the app data buffer is not hashed.
|-
| 0x3F
| 0x1
| Size of appdata.
|-
| 0x40
| 0xC8
| Appdata(Application data), if any. Size of the appdata is specified via the u8 at offset 0x3F. This data is not used when the size-field is zero.
|}

This 0x108-byte structure is used for [[NWMUDS:BeginHostingNetwork]], [[NWMUDS:ConnectToNetwork]], etc. This data is stored as big-endian.

==NodeInfo structure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| u64 ID, this is the UDS version of the FriendCodeSeed. This is loaded from BlkID 0x00090000 in the [[Config_Savegame|system-config]] via [[CfgS:GetConfigInfoBlk2]].
|-
| 0x8
| 0x14
| The first 0x18-bytes from BlkID 0x000A0000 in the [[Config_Savegame|system-config]] loaded via [[CfgS:GetConfigInfoBlk2]] is written here by user-processes. However, the data at +0x14(absolute offset 0x1C) is written by NWM-module later.
|-
| 0x1C
| 0x2
| u16, unknown. Set to 0x0 with the output from [[NWMUDS:DecryptBeaconData]].
|-
| 0x1E
| 0x1
| u8 flag, unknown. Originates from the u16 bitmask in the beacon node-list header. This flag is normally 0 since that bitmask is normally 0?
|-
| 0x1F
| 0x1
| Padding?
|-
| 0x20
| 0x2
| u16 NetworkNodeID
|-
| 0x22
| 0x6
| Normally zero?
|}

The first 0x20-bytes are written by the user-process before using this structure with [[NWMUDS:InitializeWithVersion]]. The data starting at offset 0x8 is only initialized by NWM-module.

== UDS Beacons ==
The UDS host broadcasts a beacon containing at least two Nintendo-vendor tags(tag number 0xDD, see above for the OUI), normally the data stored in these tags are static. The second tag contains the big-endian u32 networkID, used by the clients when connecting to the host and for the above CCMP key generation. The Nintendo-vendor tag(s) following the first two are unique to the process using UDS, these tags are used for broadcasting metadata regarding the host.

A tool for these beacons is available here: [https://github.com/yellows8/ctr-wlanbeacontool]

=== UDS Beacon Tags ===
The following is the structure of each tag, starting at the OUI. The order of the tags is the same as listed below. All data stored under these tags are stored as big-endian.

==== OUI Type 20 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (20/0x14)
|-
| 0x4
| 0x3
| Sample data: 0a 00 00
|}

Normally the size of this tag(from the tag size field) is 0x07.

==== OUI Type 21 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1F
| This is the network structure starting at offset 0xC, with the first 0x1F-bytes from there.
|-
| 0x1F
| 0x14
| SHA1 hash. When doing the hashing, this hash is cleared to zero. The hash data starts at offset 0x0(OUI), and the size is 0x34 + <value of the u8 at offset 0x33>.
|-
| 0x33
| 0x1
| Size of appdata. Normally zero. When non-zero this appdata is located at offset 0x34.
|}

Normally the size of this tag(from the tag size field) is 0x34, not including appdata.

==== OUI Type 24 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (24/0x18)
|-
| 0x4
| See below
| Encrypted data
|}

This is the tag0 used with [[NWMUDS:DecryptBeaconData]]. The size of data stored under this tag has a maximum size of 0xFA-bytes, however normally the size is smaller than that. Additional encrypted data, if any, is stored under the below tag1.

==== OUI Type 25 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (25/0x19)
|-
| 0x4
| See above
| Encrypted data
|}

When this exists in the beacon, this is the tag1 used with [[NWMUDS:DecryptBeaconData]]. The data stored here is the 0xFA-bytes following the previous encrypted data in tag0, for more space for storing the encrypted data.

==== Encrypted beacon data ====
The following structure is for the plaintext version of the encrypted data, stored as big-endian.

This data is encrypted with AES-CTR, by NWM module in software. The AES key is stored in NWM module itself. See above for the CTR. The size of this encrypted data is 0x12 + (0x1E*val), where val is the u8 from networkstruct offset 0x1D.

===== Structure =====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x10
| MD5 over the rest of the data following this(plaintext).
|-
| 0x10
| 0x2
| u16 bitmask. Unknown, normally 0? Bit0 is for entry0, bit1 for entry1, and so on.
|-
| 0x12
| 0x1E * <total array entries>
| This is an array of entries for each of the devices on this network, the first entry is for the host and the rest is for the client(s).
|}

===== Array entry =====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1C
| This is the first 0x1C-bytes of the NodeInfo structure, stored as big-endian.
|-
| 0x1C
| 0x2
| u16 NetworkNodeID, stored as big-endian.
|}

Each entry is for a node.

= Mapped IO =
''All'' of the [[IO_Registers|IO]] mapped under the NWM-module process is listed below:

{| class="wikitable" border="1"
|-
! Userland address
! Physical address
! Size
! Description
|-
| 0x1EC22000
| 0x10122000
| 0x1000
| [[WIFI_Registers]]
|-
| 0x1EC40000
| 0x10140000
| 0x1000
| [[PDN_Registers]]
|-
| 0x1EE22000
| 0x10322000
| 0x1000
|
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error code
! Description
|-
| 0xC8A06C0D
| The operation being performed is already done (e.g., if you run NWMEXT_ControlWirelessEnabled to turn wifi on when it's on already, you can't turn it on again).
|-
| 0xC8A113EA
| Returned when the command isn't allowed to be used on this device.
|-
| 0xC90113FA
| Node doesn't exist / invalid NetworkNodeID?
|-
| 0xC92113FB
| Returned when trying to connect to a host when the host has the specified connection-type blocked via the network attributes. There might be other causes too.
|-
| 0xE10113E9
| Returned when the input size is invalid. Returned by [[NWMUDS:PullPacket]] when the input size is smaller than the frame_size.
|-
| 0xE10113EA
| Invalid bind / data_channel is invalid(0x0).
|}

NWMUDS:GetNodeInformationList

2023-07-23T04:39:43Z

Steveice10:

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x001F0006]
|-
| 1
| (NetworkStructSize<<12) <nowiki>|</nowiki> 0x402
|-
| 2
| Input network struct buffer ptr
|-
| 3
| (Tag0BufSize<<12) <nowiki>|</nowiki> 0x802
|-
| 4
| Tag0 data buffer ptr
|-
| 5
| (Tag1BufSize<<12) <nowiki>|</nowiki> 0xC02
|-
| 6
| Tag1 data buffer ptr
|}

The following is located 0x100-bytes after the beginning of the above command buffer:
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| (Size<<14) <nowiki>|</nowiki> 2
|-
| 1
| Ptr to output buffer, size is hard-coded to 0x280.
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
The sizes of the input/output buffers are hard-coded. The tag-data buffers begin at the OUI field in the tags(this data is from [[NWMUDS:StartScan]]). Normally tag1buf is unused(all-zero), tag1 is only used when the crypt-size is larger than 0xFA. The decrypted data is byte-swapped to little-endian when copying to the output buffer.

While the input tag-data can be from arbitrary tags, the user-process normally uses OUI type 24/0x18 for tag0 and type 25/0x19 for tag1(when it exists).

NWM Services

2023-07-23T04:39:05Z

Steveice10: /* NWM local-WLAN service "nwm::UDS" */

[[Category:Services]]

These NWM services are used for local-WLAN communications, NWM module handles regular wifi APs as well. These services are used for creating/connecting to networks, and for sending/receiving data over the network etc. NWM module uses the wifi SDIO hardware via the IO registers for this.

=NWM local-WLAN service "nwm::UDS"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000102C2
|
| Initialize Deprecated. Appears to be handled about the same way as [[NWMUDS:InitializeWithVersion]], except this uses version=0x100 internally instead of loading it from the command request.
|-
| 0x00020000
|
| Scrap Not used by sub-wars. This sets a state value to 0x2 then signals an event. This is probably some sort of shutdown command since this state write will result in all UDS commands returning an error if used afterwards.
|-
| 0x00030000
|
| [[NWMUDS:Finalize|Finalize]]
|-
| 0x00040402
|
| CreateNetwork Deprecated. Only used by very old titles.
|-
| 0x00050040
|
| [[NWMUDS:EjectClient|EjectClient]]
|-
| 0x00060000
|
| [[NWMUDS:EjectSpectator|EjectSpectator]]
|-
| 0x00070080
|
| [[NWMUDS:UpdateNetworkAttribute|UpdateNetworkAttribute]]
|-
| 0x00080000
|
| [[NWMUDS:DestroyNetwork|DestroyNetwork]]
|-
| 0x00090442
|
| ConnectNetwork Deprecated. Only used by very old titles.
|-
| 0x000A0000
|
| [[NWMUDS:DisconnectNetwork|DisconnectNetwork]]
|-
| 0x000B0000
|
| [[NWMUDS:GetConnectionStatus|GetConnectionStatus]]
|-
| 0x000C0000
|
| This writes two output u8 values to cmdreply[2] +0/+1. Not used by sub-wars.
|-
| 0x000D0040
|
| [[NWMUDS:GetNodeInformation|GetNodeInformation]]
|-
| 0x000E0006
|
| ''Identical'' to [[NWMUDS:DecryptBeaconData|DecryptBeaconData]]. Deprecated, only used by old titles.
|-
| 0x000F0404
|
| [[NWMUDS:StartScan|StartScan]]
|-
| 0x00100042
|
| [[NWMUDS:SetApplicationData|SetApplicationData]]
|-
| 0x00110040
|
| [[NWMUDS:GetApplicationData|GetApplicationData]]
|-
| 0x00120100
|
| [[NWMUDS:Bind|Bind]]
|-
| 0x00130040
|
| [[NWMUDS:Unbind|Unbind]]
|-
| 0x001400C0
|
| [[NWMUDS:PullPacket|PullPacket]]
|-
| 0x00150080
|
| SetMaxSendDelay(u64 unk) Not used by sub-wars.
|-
| 0x00160040
|
| (u8 inputval) Unknown. Not used by sub-wars.
|-
| 0x00170182
|
| [[NWMUDS:SendTo|SendTo]]
|-
| 0x00180040
|
| (u16 inputval) Unknown. Not used by sub-wars.
|-
| 0x00190040
|
| (u32 inputval) Unknown. Not used by sub-wars.
|-
| 0x001A0000
|
| [[NWMUDS:GetChannel|GetChannel]]
|-
| 0x001B0302
|
| [[NWMUDS:InitializeWithVersion|InitializeWithVersion]]
|-
| 0x001C0040
|
| (u8 inputval) Unknown. Not used by sub-wars.
|-
| 0x001D0044
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:CreateNetwork2|CreateNetwork2]] This is a replacement for the original network-creation command.
|-
| 0x001E0084
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:ConnectNetwork2|ConnectNetwork2]] This is a replacement for the original network-connection command.
|-
| 0x001F0006
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:GetNodeInformationList|GetNodeInformationList]]
|-
| 0x00200040
| Unknown, >[[2.0.0-2]]
| Flush (u8 data_frame_index) Unknown. Not used by sub-wars.
|-
| 0x00210080
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:SetProbeResponseParam|SetProbeResponseParam]]
|-
| 0x00220402
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:ScanOnConnection|ScanOnConnection]]
|-
| 0x00230000
| Unknown, >[[2.0.0-2]]
| This writes an output u16 value to cmdreply[2]. Unknown. Not used by sub-wars.
|}

PullPacket is used for receiving data over the network and SendTo is for sending data over the network.

=NWM infrastructure service "nwm::INF"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| ?
|-
| 0x00020000
| ?
|-
| 0x00030000
| ?
|-
| 0x00040000
| ?
|-
| 0x00050000
| ?
|-
| 0x000603C4
| [[NWMINF:RecvBeaconBroadcastData|RecvBeaconBroadcastData]]
|-
| 0x00070742
| [[NWMINF:ConnectToEncryptedAP|ConnectToEncryptedAP]]
|-
| 0x00080302
| [[NWMINF:ConnectToAP|ConnectToAP]]
|-
| 0x00090000
| ?
|-
| 0x000A0000
| ?
|-
| 0x000B0000
| ?, return event handle in cmdbuf[3]
|-
| 0x000C0040
| ?
|-
| 0x000D0000
| ?
|-
| 0x000E0002
| ?
|-
| 0x000F0082
| ?
|-
| 0x00100040
| ?
|}

=NWM socket service "nwm::SOC"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010042
| (u32 size, <static_buffer translate-hdr with static_buf_id=0>, addr) ?
|-
| 0x00020080
| (u32 unk, u32 size) Unknown. Uses size=0x5F8 internally unless the input is <=0x5F8. Uses an ipc static_buffer(static_buf_id=0) for output with the specified size(also used when writing the translate-hdr). Writes an output u32 to cmdreply[2].
|-
| 0x00030042
| (u32 unk, u32 size, <static_buffer translate-hdr with static_buf_id=0>, addr) ?
|-
| 0x00040042
| (u32 size, u32 unk, <static_buffer translate-hdr with static_buf_id=1>, addr) ?
|-
| 0x00050040
| (u32 unk) ?
|-
| 0x00060080
| (u32 unk0, u16 unk1) ?
|-
| 0x00070040
| (u16 unk) This writes an output u32 to cmdreply[2].
|-
| 0x00080040
| [[NWMSOC:GetMACAddress|GetMACAddress]]
|-
| 0x00090000
| This just copies data from state to the cmdreply, this always returns 0. u32 cmdreply[2] = sharedmem_size, cmdreply[4] = [[NWM_Shared_Memory|sharedmem_handle]], cmdreply[5] = eventhandle.
|-
| 0x000A0040
| (u32 unk) ?
|-
| 0x000B0040
| (u32 unk) This writes an output u32 to cmdreply[2].
|-
| 0x000C0040
| (u32 unk) ?
|-
| 0x000D0002
| ([[IPC|kernel_processid_translatehdr]], u32 processid) ?
|}

The only sysmodule which uses this is [[Socket_Services|socket]]-sysmodule. The first command used by socket-module is cmd9.

=NWM service "nwm::SAP"=

=NWM local-WLAN [[StreetPass]] service "nwm::CEC"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00060002
| Unknown, called by CECD module, cmdbuf[2] takes an event handle.
|-
| 0x000D0082
| [[NWMCEC:SendProbeRequest|SendProbeRequest]]
|}

=NWM service "nwm::EXT"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010000
| <=[[2.0.0-2]]
| ?
|-
| 0x00020000
| <=[[2.0.0-2]]
| ?
|-
| 0x00030000
| <=[[2.0.0-2]]
| ?
|-
| 0x00040040
| <=[[2.0.0-2]]
| ?
|-
| 0x00050002
| <=[[2.0.0-2]]
| ?
|-
| 0x00060000
| <=[[2.0.0-2]]
| ?
|-
| 0x00070000
| <=[[2.0.0-2]]
| This copies 0x1C-bytes from NWM-module state to the data starting at cmdreply[2].
|-
| 0x00080040
| <=[[2.0.0-2]]
| [[NWMEXT:ControlWirelessEnabled|ControlWirelessEnabled]]
|-
| 0x00090000
| <=[[2.0.0-2]]
| ?
|}

=NWM service "nwm::TST"=

=BeaconDataReply Structure=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Max output size, from the command request.
|-
| 0x4
| 0x4
| Total amount of output data written relative to struct+0. 0xC when there's no entries.
|-
| 0x8
| 0x4
| Total entries, 0 for none.
|-
| 0xC
| <Rest of the structure>
| Beacon entries.
|}

Beacon entry:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Size of this entire entry. The next entry starts at curentry_startoffset+curentry_size.
|-
| 0x4
| 0x1
| ?
|-
| 0x5
| 0x1
| AP wifi channel.
|-
| 0x6
| 0x1
| ?
|-
| 0x7
| 0x1
| ?
|-
| 0x8
| 0x6
| AP MAC address.
|-
| 0xE
| 0x6
| ?
|-
| 0x14
| 0x4
| Size of this entire entry, games use this value to traverse the beacons list.
|-
| 0x18
| 0x4
| Value 0x1C(size of this header and/or offset to the actual beacon data).
|-
| 0x1C
| Entry_size - 0x1C
| The actual beacon data is located here, starting at the 802.11 management frame header.
|}

This section describes the structure returned by [[NWMINF:RecvBeaconBroadcastData]] and [[NWMUDS:RecvBeaconBroadcastData]].

=ScanInputStruct=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Two unknown u16s.
|-
| 1
| Two unknown u16s.
|-
| 2-3
| Host MAC address. The 6-bytes located here are normally all 0xFF, for all hosts. Otherwise when not set to broadcast-MAC, the command will only return info for the specified host MAC address.
|-
| 4-12
| Uninitialized for UDS.
|}

This section describes the 0x34-byte input structure used by [[NWMINF:RecvBeaconBroadcastData]] and [[NWMUDS:RecvBeaconBroadcastData]].

=Local-WLAN=
UDS is used for 3DS<>3DS local-WLAN communications, and for 3DS<>Wii U communications. The latter is mainly only used for multi-player in games.

All UDS local-WLAN communications have the CCMP key for data encryption generated via NWM module. The CCMP key passed to nwm::CEC commands(stored in a 0x44-byte input structure) for [[StreetPass]] is generated by the CECD module. The input data used with [[Process_Services|EncryptDecryptAes]] with [[PSPXI:EncryptDecryptAes|keytype1]] is a MD5 hash over the input passphrase. This input passphrase is fixed for [[Download Play]], it's unique per local-WLAN application. The CTR is a MD5 hash over the below 0x10-byte structure. The output from encrypting that data with AES-CTR is the final CCMP key. This passphrase is a raw input buffer: while the passphrase specified by user-processes is normally a string with the NUL-terminator included, it can be anything(like the [[DLP_Services|WirelessRebootPassphrase]] for example).

The maximum number of nodes(including the host) which can be on an UDS network is 16.

==NodeID==
There are two types of client connections: regular Client, and Spectator. The latter ''never'' sends ''any'' 802.11 frame at all to the host, hence ''nothing'' actually connected to the network(including the host) can know about any spectators. Once a spectator is "connected" to a network, it can only receive broadcasted data, no sending.

DLP-client connects to the network as a spectator during DLP scanning to get various [[Download_Play|metadata]] including icon data.

===NetworkNodeID===
This is the network u16 ID for each device on the UDS network. NodeID 0xFFFF is a broadcast alias. 0x1 is for the host, the 0x2 for the first client, 0x3 for the second client, and so on.

The spectator doesn't have a NetworkNodeID, since it can't [[NWMUDS:SendTo|send]] any data.

NetworkNodeIDs for clients do not change when any clients disconnect, likewise for the encrypted node-listing stored in the wifi beacons. When a client disconnects, the corresponding NetworkNodeID bit in the [[NWMUDS:GetConnectionStatus|node_bitmask]] is cleared. When a client is connecting, the client is assigned the NetworkNodeID with the lowest corresponding clear-bit in the [[NWMUDS:GetConnectionStatus|node_bitmask]], then that bit is set.

===BindNodeID===
This u32 is an ID only used on the local device. How many devices are on the network or which device this system is does not affect this ID.

The spectator uses BindNodeID 0x1. DLP uses BindNodeID 0x3 when connecting as an actual client. Hence, it seems BindNodeID bit0 is spectator-related. All normal nodes(host/client) start with BindNodeID 0x2. When connecting to a network again(and probably with network creation) without reinitializing NWMUDS, official user processes increase the used BindNodeID by 0x2.

BindNodeID value 0x0 is invalid. The maximum number of BindNodeIDs which can be open at the same time is 16.

==Application data transfer==
The protocol used for sending/receiving data over the network with UDS by official applications is [[PRUDP]](in some cases at least). Mario Kart 7 uses PRUDP here. Triforce Heroes uses plaintext for whatever protocol it uses for UDS.

The UDS version of [[PRUDP]] is different from the normal UDP version it appears(no afa1/a1af data for example).

==Communication protocol==
The process of connecting to a host and exchanging data follows the sequence:

Client->Server: Authentication frame SEQ1

Server->Client: Authentication frame SEQ2

[There does not appear to be an association request frame sent by the client to the server, it is however possible that it was sent and just not captured by the test equipment]

Server->Client: Association Response frame with association id

[From here on, the client is connected to the server]

Client->Server: Encrypted data packet containing an 8-byte 802.2 LLC header with ethertype = EAPoL (0x888E) and an u16 header of 0x201 ([[NWM_Services#EAPoL-Start frame|EAPoL-Start]])

Server->Broadcast: Encrypted data packet containing the updated node information after the client connected (Using ethertype = SecureData).

Server->Client: Encrypted data packet containing an 8-byte 802.2 LLC header with ethertype = EAPoL (0x888E) and an u16 header of 0x0202([[NWM_Services#EAPoL-Logoff frame|EAPoL-Logoff]])

[From here on, data packets sent using SendTo are encapsulated with an LLC header with ethertype = 0x876D ([[NWM_Services#SecureData NWM header|SecureData]])]

[The client also sends periodic SecureData data frames on its own, these are probably ping frames]

==Data frames==
Data is transferred over the network using [[NWMUDS:PullPacket]]/[[NWMUDS:SendTo]]. That data is transferred using 802.11 data frames using CCMP encryption. The encrypted data contained in the frame starts with the 0x8-byte [https://en.wikipedia.org/wiki/Subnetwork_Access_Protocol#Use LLC header], then the 0xE-byte NWM header, followed by the actual application data from the previously mentioned commands. When [[NWMUDS:SendTo]] was used with dst_NodeID = broadcast, the data frame is sent to the 802.11 broadcast MAC address. Otherwise with a specific NodeID, the data frame is sent to the actual MAC address for that device.

Official application data is normally stored here as big-endian.

Application data packets are sent to the host using 802.11 unicast, which then acts as a router and forwards the packet to the right destination node id based on the SecureData header using either broadcast or unicast, it is not yet known how it chooses which to use.

==Special data channels==
{| class="wikitable" border="1"
|-
! Channel
! Description
|-
| 0x101
| Used when broadcasting the updated node information after a new client connects.
|-
| 0x103
| Used when sending what appears to be "ping" or "null" frames.
|-
| 0x104
| Used to signal the ejection of all spectators in the network.
|}

==SecureData NWM header==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Size of the entire frame minus the 8 bytes from the LLC header.
|-
| 0x2
| 0x2
| unknown
|-
| 0x4
| 0x2
| Size of the entire frame minus 12 bytes.
|-
| 0x6
| 0x2
| Data channel. Applications can only use the low 8 bits, channels greater than 255 are reserved for management functions.
|-
| 0x8
| 0x2
| Sequence number, incremented after each sent packet.
|-
| 0xA
| 0x2
| Destination network node id
|-
| 0xC
| 0x2
| Source network node id
|}

This data is stored as big-endian.

==EAPoL-Start frame==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Always 0x201 in big-endian.
|-
| 0x2
| 0x2
| Association id of the sending client in big-endian.
|-
| 0x4
| 0x2
| Unknown. Always 0x1 in big-endian. The parser for this packet errors out if this is > 3.
|-
| 0x6
| 0x2
| Unknown
|-
| 0x8
| 0x28
| NodeInfo structure with all fields in big-endian
|}

This data is stored as big-endian.

==EAPoL-Logoff frame==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Always 0x202 in big-endian.
|-
| 0x2
| 0x2
| Unknown. Always 0?
|-
| 0x4
| 0x2
| Assigned network node id.
|-
| 0x6
| 0x6
| Mac address of the newly connected client.
|-
| 0xC
| 0x4
| Unknown
|-
| 0x10
| 0x2
| Unknown. Always 0.
|-
| 0x12
| 0x1
| Number of connected nodes, including the new client.
|-
| 0x13
| 0x1
| Max number of nodes.
|-
| 0x14
| 0x2
| Always 0.
|-
| 0x16
| 0x2
| Unknown.
|-
| 0x18
| 0x280
| List of 16 NodeInfo structures with all fields in big-endian
|}

This data is stored as big-endian.

==Structure used for generating the CTR for CCMP key generation==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| wlancommID
|-
| 0x4
| 0x4
| networkID
|-
| 0x8
| 0x6
| Host MAC address.
|-
| 0xE
| 0x2
| id8
|}

This data is stored as little-endian.

==CTR used for beacon tags crypto==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address
|-
| 0x6
| 0x4
| wlancommID
|-
| 0xA
| 0x1
| id8
|-
| 0xB
| 0x1
| Padding, value zero.
|-
| 0xC
| 0x4
| networkID
|}

This data is stored as little-endian. All data here is all-zero except for the MAC address, when the u8 at offset 0x8 in the network-struct is 0.

==Network structure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| This is the MAC address of the host. This is used for when [[NWMUDS:ConnectToNetwork|connecting]] to the network.
|-
| 0x6
| 0x1
| This is actually written as an u16 without byte-swapping. This is the network wifi channel. When connecting this is normally non-zero. When hosting, this can be 0 to automatically select a channel, otherwise the specified channel is used. When non-zero official user-processes require this value to be one of the following when hosting: 1, 6, or 11.
|-
| 0x7
| 0x1
| Padding
|-
| 0x8
| 0x1
| Initialized flag. Must be non-zero otherwise NWM-module will use value 0x0 for most/all(?) fields in this structure when reading these fields.
|-
| 0xC
| 0x3
| This is the OUI value for use with the beacon tags. Normally this is 001F32.
|-
| 0xF
| 0x1
| OUI type (21/0x15)
|-
| 0x10
| 0x4
| wlancommID. Local-WLAN communication ID, normally this is: (user_process [[Title_list|uniqueID]] << 8) | val. Where val is 0x10 on retail([[Configuration_Memory#ENVINFO|ENVINFO]] bit0 set), 0x90 for devunit. Official software includes an input bool flag parameter for setting bit0 in this wlancommID, normally that flag isn't set. For [[Download Play]], this is always 0x2810 on retail(0x2890 on devunit).

This wlancommID can have the side affect of region-locking when the title uses the uniqueID for the current title(hard-coded in .text normally), instead of using a fixed input uniqueID for each region of the title.
|-
| 0x14
| 0x1
| id8. ID, for [[Download Play]] this is 0x55. 0x55/'U' seems to be used for networks where Wii U can host it(Download Play, Smash Bros, ...) - this value isn't known to be actually checked anywhere however.
|-
| 0x15
| 0x1
| Number of times the network structure hash was updated.
|-
| 0x16
| 0x2
| This network attributes u16 bitmask can be written via [[NWMUDS:UpdateNetworkAttribute]].
Bitmasks:
* 0x1: When set, spectators are not allowed to connect(see [[NWMUDS:EjectSpectator|here]]). Checked by official user-processes before using [[NWMUDS:ConnectToNetwork]], when connecting as a Spectator. Must be clear otherwise that code returns error 0xE10113EA. If the initialized_flag at offset 0x8 is zero, this code handles it the same way as if this bit was set. The latest NWM-module handles checking this bit itself however.
* 0x2: When set, new regular-clients are not allowed to connect.
* 0x4: Unknown, has no affect on new clients/spectators connecting. Official software has an option for setting this bit via an input flag from the same code using bitmask 0x2. Official software always clears bitmask 0x6 when unblocking new connections.
|-
| 0x18
| 0x4
| u32 networkID, randomly-generated when creating the network. The network SSID used when a client connects to the network is sprintf(out, "%08X", networkID).
|-
| 0x1C
| 0x1
| Total number of currently connected nodes, including the host.
|-
| 0x1D
| 0x1
| Maximum number of nodes, including the host. This also is the total number of entries stored under the array in the encrypted beacon data.
|-
| 0x1E
| 0xD
| ?
|-
| 0x2B
| 0x14
| SHA1 hash of the network structure, starting at the OUI field (offset 0xC) and spanning SizeOfAppData + 0x34. The unused space of the app data buffer is not hashed.
|-
| 0x3F
| 0x1
| Size of appdata.
|-
| 0x40
| 0xC8
| Appdata(Application data), if any. Size of the appdata is specified via the u8 at offset 0x3F. This data is not used when the size-field is zero.
|}

This 0x108-byte structure is used for [[NWMUDS:BeginHostingNetwork]], [[NWMUDS:ConnectToNetwork]], etc. This data is stored as big-endian.

==NodeInfo structure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| u64 ID, this is the UDS version of the FriendCodeSeed. This is loaded from BlkID 0x00090000 in the [[Config_Savegame|system-config]] via [[CfgS:GetConfigInfoBlk2]].
|-
| 0x8
| 0x14
| The first 0x18-bytes from BlkID 0x000A0000 in the [[Config_Savegame|system-config]] loaded via [[CfgS:GetConfigInfoBlk2]] is written here by user-processes. However, the data at +0x14(absolute offset 0x1C) is written by NWM-module later.
|-
| 0x1C
| 0x2
| u16, unknown. Set to 0x0 with the output from [[NWMUDS:DecryptBeaconData]].
|-
| 0x1E
| 0x1
| u8 flag, unknown. Originates from the u16 bitmask in the beacon node-list header. This flag is normally 0 since that bitmask is normally 0?
|-
| 0x1F
| 0x1
| Padding?
|-
| 0x20
| 0x2
| u16 NetworkNodeID
|-
| 0x22
| 0x6
| Normally zero?
|}

The first 0x20-bytes are written by the user-process before using this structure with [[NWMUDS:InitializeWithVersion]]. The data starting at offset 0x8 is only initialized by NWM-module.

== UDS Beacons ==
The UDS host broadcasts a beacon containing at least two Nintendo-vendor tags(tag number 0xDD, see above for the OUI), normally the data stored in these tags are static. The second tag contains the big-endian u32 networkID, used by the clients when connecting to the host and for the above CCMP key generation. The Nintendo-vendor tag(s) following the first two are unique to the process using UDS, these tags are used for broadcasting metadata regarding the host.

A tool for these beacons is available here: [https://github.com/yellows8/ctr-wlanbeacontool]

=== UDS Beacon Tags ===
The following is the structure of each tag, starting at the OUI. The order of the tags is the same as listed below. All data stored under these tags are stored as big-endian.

==== OUI Type 20 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (20/0x14)
|-
| 0x4
| 0x3
| Sample data: 0a 00 00
|}

Normally the size of this tag(from the tag size field) is 0x07.

==== OUI Type 21 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1F
| This is the network structure starting at offset 0xC, with the first 0x1F-bytes from there.
|-
| 0x1F
| 0x14
| SHA1 hash. When doing the hashing, this hash is cleared to zero. The hash data starts at offset 0x0(OUI), and the size is 0x34 + <value of the u8 at offset 0x33>.
|-
| 0x33
| 0x1
| Size of appdata. Normally zero. When non-zero this appdata is located at offset 0x34.
|}

Normally the size of this tag(from the tag size field) is 0x34, not including appdata.

==== OUI Type 24 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (24/0x18)
|-
| 0x4
| See below
| Encrypted data
|}

This is the tag0 used with [[NWMUDS:DecryptBeaconData]]. The size of data stored under this tag has a maximum size of 0xFA-bytes, however normally the size is smaller than that. Additional encrypted data, if any, is stored under the below tag1.

==== OUI Type 25 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (25/0x19)
|-
| 0x4
| See above
| Encrypted data
|}

When this exists in the beacon, this is the tag1 used with [[NWMUDS:DecryptBeaconData]]. The data stored here is the 0xFA-bytes following the previous encrypted data in tag0, for more space for storing the encrypted data.

==== Encrypted beacon data ====
The following structure is for the plaintext version of the encrypted data, stored as big-endian.

This data is encrypted with AES-CTR, by NWM module in software. The AES key is stored in NWM module itself. See above for the CTR. The size of this encrypted data is 0x12 + (0x1E*val), where val is the u8 from networkstruct offset 0x1D.

===== Structure =====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x10
| MD5 over the rest of the data following this(plaintext).
|-
| 0x10
| 0x2
| u16 bitmask. Unknown, normally 0? Bit0 is for entry0, bit1 for entry1, and so on.
|-
| 0x12
| 0x1E * <total array entries>
| This is an array of entries for each of the devices on this network, the first entry is for the host and the rest is for the client(s).
|}

===== Array entry =====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1C
| This is the first 0x1C-bytes of the NodeInfo structure, stored as big-endian.
|-
| 0x1C
| 0x2
| u16 NetworkNodeID, stored as big-endian.
|}

Each entry is for a node.

= Mapped IO =
''All'' of the [[IO_Registers|IO]] mapped under the NWM-module process is listed below:

{| class="wikitable" border="1"
|-
! Userland address
! Physical address
! Size
! Description
|-
| 0x1EC22000
| 0x10122000
| 0x1000
| [[WIFI_Registers]]
|-
| 0x1EC40000
| 0x10140000
| 0x1000
| [[PDN_Registers]]
|-
| 0x1EE22000
| 0x10322000
| 0x1000
|
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error code
! Description
|-
| 0xC8A06C0D
| The operation being performed is already done (e.g., if you run NWMEXT_ControlWirelessEnabled to turn wifi on when it's on already, you can't turn it on again).
|-
| 0xC8A113EA
| Returned when the command isn't allowed to be used on this device.
|-
| 0xC90113FA
| Node doesn't exist / invalid NetworkNodeID?
|-
| 0xC92113FB
| Returned when trying to connect to a host when the host has the specified connection-type blocked via the network attributes. There might be other causes too.
|-
| 0xE10113E9
| Returned when the input size is invalid. Returned by [[NWMUDS:PullPacket]] when the input size is smaller than the frame_size.
|-
| 0xE10113EA
| Invalid bind / data_channel is invalid(0x0).
|}

NWMUDS:DecryptBeaconData

2023-07-23T04:38:58Z

Steveice10: Steveice10 moved page NWMUDS:DecryptBeaconData to NWMUDS:GetNodeInformationList

#REDIRECT [[NWMUDS:GetNodeInformationList]]

NWMUDS:GetNodeInformationList

2023-07-23T04:38:58Z

Steveice10: Steveice10 moved page NWMUDS:DecryptBeaconData to NWMUDS:GetNodeInformationList

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x001F0006]
|-
| 1
| (NetworkStructSize<<12) <nowiki>|</nowiki> 0x402
|-
| 2
| Input network struct buffer ptr
|-
| 3
| (Tag0BufSize<<12) <nowiki>|</nowiki> 0x802
|-
| 4
| Tag0 data buffer ptr
|-
| 5
| (Tag1BufSize<<12) <nowiki>|</nowiki> 0xC02
|-
| 6
| Tag1 data buffer ptr
|}

The following is located 0x100-bytes after the beginning of the above command buffer:
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| (Size<<14) <nowiki>|</nowiki> 2
|-
| 1
| Ptr to output buffer, size is hard-coded to 0x280.
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
The sizes of the input/output buffers are hard-coded. The tag-data buffers begin at the OUI field in the tags(this data is from [[NWMUDS:RecvBeaconBroadcastData]]). Normally tag1buf is unused(all-zero), tag1 is only used when the crypt-size is larger than 0xFA. The decrypted data is byte-swapped to little-endian when copying to the output buffer.

While the input tag-data can be from arbitrary tags, the user-process normally uses OUI type 24/0x18 for tag0 and type 25/0x19 for tag1(when it exists).

NWMUDS:ConnectToNetwork

2023-07-23T04:38:56Z

Steveice10: Steveice10 moved page NWMUDS:ConnectToNetwork to NWMUDS:ConnectNetwork2

#REDIRECT [[NWMUDS:ConnectNetwork2]]

NWMUDS:ConnectNetwork2

2023-07-23T04:38:56Z

Steveice10: Steveice10 moved page NWMUDS:ConnectToNetwork to NWMUDS:ConnectNetwork2

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x001E0084]
|-
| 1
| u8 Connection type: 0x1 = Client, 0x2 = Spectator.
|-
| 2
| [[NWM_Services|Passphrase]] buffer size
|-
| 3
| (NetworkStructSize<<12) <nowiki>|</nowiki> 0x402
|-
| 4
| Input network struct buffer ptr
|-
| 5
| (PassphraseSize<<12) <nowiki>|</nowiki> 2
|-
| 6
| Input passphrase buffer ptr
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This connects to the specified network.

Before using this command official user-processes verify that the passphrase_buf is not NULL, and that PassphraseSize is >=8 and <=0xFF. On fail that user-process code returns 0xE10113FD for that. That user-process code also checks the network attributes bitmask 0x1, see [[NWM_Services|here]].

NWMUDS:BeginHostingNetwork

2023-07-23T04:38:54Z

Steveice10: Steveice10 moved page NWMUDS:BeginHostingNetwork to NWMUDS:CreateNetwork2

#REDIRECT [[NWMUDS:CreateNetwork2]]

NWMUDS:CreateNetwork2

2023-07-23T04:38:54Z

Steveice10: Steveice10 moved page NWMUDS:BeginHostingNetwork to NWMUDS:CreateNetwork2

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x001D0044]
|-
| 1
| [[NWM_Services|Passphrase]] buffer size
|-
| 2
| (NetworkStructSize<<12) <nowiki>|</nowiki> 0x402
|-
| 3
| Input network [[NWM_Services|struct]] buffer ptr
|-
| 4
| (PassphraseSize<<12) <nowiki>|</nowiki> 2
|-
| 5
| Input passphrase buffer ptr
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This begins hosting an UDS local-WLAN AP. NWM-module itself throws a fatal-error if the max_nodes field in the NetworkStruct is set to 0x1.

NWMUDS:RecvBeaconBroadcastData

2023-07-23T04:38:51Z

Steveice10: Steveice10 moved page NWMUDS:RecvBeaconBroadcastData to NWMUDS:StartScan

#REDIRECT [[NWMUDS:StartScan]]

NWMUDS:StartScan

2023-07-23T04:38:51Z

Steveice10: Steveice10 moved page NWMUDS:RecvBeaconBroadcastData to NWMUDS:StartScan

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x000F0404]
|-
| 1
| Output buffer max size
|-
| 2-14
| Input [[NWM_Services|ScanInputStruct]].
|-
| 15
| [[NWM_Services|wlancommID]]
|-
| 16
| This is the ID also located at offset 0xE in the CTR-generation [[NWM_Services|structure]].
|-
| 17
| Value 0x0
|-
| 18
| Input event handle
|-
| 19
| (Size<<4) <nowiki>|</nowiki> 12
|-
| 20
| Output [[NWM_Services|BeaconDataReply]] buffer ptr
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

=Description=
This returns beacon data for all UDS wifi beacons received by this system, with the specified wlancommID+ID8. See also the scaninput struct.

Official user processes create a new event handle which is then passed to this command. However, those user processes don't save that handle ''anywhere'' afterwards.

This command can ''only'' be used when not connected to a network.

NWMUDS:Shutdown

2023-07-23T04:38:47Z

Steveice10: Steveice10 moved page NWMUDS:Shutdown to NWMUDS:Finalize

#REDIRECT [[NWMUDS:Finalize]]

NWMUDS:Finalize

2023-07-23T04:38:47Z

Steveice10: Steveice10 moved page NWMUDS:Shutdown to NWMUDS:Finalize

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00030000]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code
|-
| 1
| Result code
|}

NWM Services

2023-07-23T04:36:59Z

Steveice10: Function names from FE Fates

[[Category:Services]]

These NWM services are used for local-WLAN communications, NWM module handles regular wifi APs as well. These services are used for creating/connecting to networks, and for sending/receiving data over the network etc. NWM module uses the wifi SDIO hardware via the IO registers for this.

=NWM local-WLAN service "nwm::UDS"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000102C2
|
| Initialize Deprecated. Appears to be handled about the same way as [[NWMUDS:InitializeWithVersion]], except this uses version=0x100 internally instead of loading it from the command request.
|-
| 0x00020000
|
| Scrap Not used by sub-wars. This sets a state value to 0x2 then signals an event. This is probably some sort of shutdown command since this state write will result in all UDS commands returning an error if used afterwards.
|-
| 0x00030000
|
| [[NWMUDS:Shutdown|Finalize]]
|-
| 0x00040402
|
| CreateNetwork Deprecated. Only used by very old titles.
|-
| 0x00050040
|
| [[NWMUDS:EjectClient|EjectClient]]
|-
| 0x00060000
|
| [[NWMUDS:EjectSpectator|EjectSpectator]]
|-
| 0x00070080
|
| [[NWMUDS:UpdateNetworkAttribute|UpdateNetworkAttribute]]
|-
| 0x00080000
|
| [[NWMUDS:DestroyNetwork|DestroyNetwork]]
|-
| 0x00090442
|
| ConnectNetwork Deprecated. Only used by very old titles.
|-
| 0x000A0000
|
| [[NWMUDS:DisconnectNetwork|DisconnectNetwork]]
|-
| 0x000B0000
|
| [[NWMUDS:GetConnectionStatus|GetConnectionStatus]]
|-
| 0x000C0000
|
| This writes two output u8 values to cmdreply[2] +0/+1. Not used by sub-wars.
|-
| 0x000D0040
|
| [[NWMUDS:GetNodeInformation|GetNodeInformation]]
|-
| 0x000E0006
|
| ''Identical'' to [[NWMUDS:DecryptBeaconData|DecryptBeaconData]]. Deprecated, only used by old titles.
|-
| 0x000F0404
|
| [[NWMUDS:RecvBeaconBroadcastData|StartScan]]
|-
| 0x00100042
|
| [[NWMUDS:SetApplicationData|SetApplicationData]]
|-
| 0x00110040
|
| [[NWMUDS:GetApplicationData|GetApplicationData]]
|-
| 0x00120100
|
| [[NWMUDS:Bind|Bind]]
|-
| 0x00130040
|
| [[NWMUDS:Unbind|Unbind]]
|-
| 0x001400C0
|
| [[NWMUDS:PullPacket|PullPacket]]
|-
| 0x00150080
|
| SetMaxSendDelay(u64 unk) Not used by sub-wars.
|-
| 0x00160040
|
| (u8 inputval) Unknown. Not used by sub-wars.
|-
| 0x00170182
|
| [[NWMUDS:SendTo|SendTo]]
|-
| 0x00180040
|
| (u16 inputval) Unknown. Not used by sub-wars.
|-
| 0x00190040
|
| (u32 inputval) Unknown. Not used by sub-wars.
|-
| 0x001A0000
|
| [[NWMUDS:GetChannel|GetChannel]]
|-
| 0x001B0302
|
| [[NWMUDS:InitializeWithVersion|InitializeWithVersion]]
|-
| 0x001C0040
|
| (u8 inputval) Unknown. Not used by sub-wars.
|-
| 0x001D0044
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:BeginHostingNetwork|CreateNetwork2]] This is a replacement for the original network-creation command.
|-
| 0x001E0084
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:ConnectToNetwork|ConnectNetwork2]] This is a replacement for the original network-connection command.
|-
| 0x001F0006
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:DecryptBeaconData|GetNodeInformationList]]
|-
| 0x00200040
| Unknown, >[[2.0.0-2]]
| Flush (u8 data_frame_index) Unknown. Not used by sub-wars.
|-
| 0x00210080
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:SetProbeResponseParam|SetProbeResponseParam]]
|-
| 0x00220402
| Unknown, >[[2.0.0-2]]
| [[NWMUDS:ScanOnConnection|ScanOnConnection]]
|-
| 0x00230000
| Unknown, >[[2.0.0-2]]
| This writes an output u16 value to cmdreply[2]. Unknown. Not used by sub-wars.
|}

PullPacket is used for receiving data over the network and SendTo is for sending data over the network.

=NWM infrastructure service "nwm::INF"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010000
| ?
|-
| 0x00020000
| ?
|-
| 0x00030000
| ?
|-
| 0x00040000
| ?
|-
| 0x00050000
| ?
|-
| 0x000603C4
| [[NWMINF:RecvBeaconBroadcastData|RecvBeaconBroadcastData]]
|-
| 0x00070742
| [[NWMINF:ConnectToEncryptedAP|ConnectToEncryptedAP]]
|-
| 0x00080302
| [[NWMINF:ConnectToAP|ConnectToAP]]
|-
| 0x00090000
| ?
|-
| 0x000A0000
| ?
|-
| 0x000B0000
| ?, return event handle in cmdbuf[3]
|-
| 0x000C0040
| ?
|-
| 0x000D0000
| ?
|-
| 0x000E0002
| ?
|-
| 0x000F0082
| ?
|-
| 0x00100040
| ?
|}

=NWM socket service "nwm::SOC"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010042
| (u32 size, <static_buffer translate-hdr with static_buf_id=0>, addr) ?
|-
| 0x00020080
| (u32 unk, u32 size) Unknown. Uses size=0x5F8 internally unless the input is <=0x5F8. Uses an ipc static_buffer(static_buf_id=0) for output with the specified size(also used when writing the translate-hdr). Writes an output u32 to cmdreply[2].
|-
| 0x00030042
| (u32 unk, u32 size, <static_buffer translate-hdr with static_buf_id=0>, addr) ?
|-
| 0x00040042
| (u32 size, u32 unk, <static_buffer translate-hdr with static_buf_id=1>, addr) ?
|-
| 0x00050040
| (u32 unk) ?
|-
| 0x00060080
| (u32 unk0, u16 unk1) ?
|-
| 0x00070040
| (u16 unk) This writes an output u32 to cmdreply[2].
|-
| 0x00080040
| [[NWMSOC:GetMACAddress|GetMACAddress]]
|-
| 0x00090000
| This just copies data from state to the cmdreply, this always returns 0. u32 cmdreply[2] = sharedmem_size, cmdreply[4] = [[NWM_Shared_Memory|sharedmem_handle]], cmdreply[5] = eventhandle.
|-
| 0x000A0040
| (u32 unk) ?
|-
| 0x000B0040
| (u32 unk) This writes an output u32 to cmdreply[2].
|-
| 0x000C0040
| (u32 unk) ?
|-
| 0x000D0002
| ([[IPC|kernel_processid_translatehdr]], u32 processid) ?
|}

The only sysmodule which uses this is [[Socket_Services|socket]]-sysmodule. The first command used by socket-module is cmd9.

=NWM service "nwm::SAP"=

=NWM local-WLAN [[StreetPass]] service "nwm::CEC"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00060002
| Unknown, called by CECD module, cmdbuf[2] takes an event handle.
|-
| 0x000D0082
| [[NWMCEC:SendProbeRequest|SendProbeRequest]]
|}

=NWM service "nwm::EXT"=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010000
| <=[[2.0.0-2]]
| ?
|-
| 0x00020000
| <=[[2.0.0-2]]
| ?
|-
| 0x00030000
| <=[[2.0.0-2]]
| ?
|-
| 0x00040040
| <=[[2.0.0-2]]
| ?
|-
| 0x00050002
| <=[[2.0.0-2]]
| ?
|-
| 0x00060000
| <=[[2.0.0-2]]
| ?
|-
| 0x00070000
| <=[[2.0.0-2]]
| This copies 0x1C-bytes from NWM-module state to the data starting at cmdreply[2].
|-
| 0x00080040
| <=[[2.0.0-2]]
| [[NWMEXT:ControlWirelessEnabled|ControlWirelessEnabled]]
|-
| 0x00090000
| <=[[2.0.0-2]]
| ?
|}

=NWM service "nwm::TST"=

=BeaconDataReply Structure=
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Max output size, from the command request.
|-
| 0x4
| 0x4
| Total amount of output data written relative to struct+0. 0xC when there's no entries.
|-
| 0x8
| 0x4
| Total entries, 0 for none.
|-
| 0xC
| <Rest of the structure>
| Beacon entries.
|}

Beacon entry:
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| Size of this entire entry. The next entry starts at curentry_startoffset+curentry_size.
|-
| 0x4
| 0x1
| ?
|-
| 0x5
| 0x1
| AP wifi channel.
|-
| 0x6
| 0x1
| ?
|-
| 0x7
| 0x1
| ?
|-
| 0x8
| 0x6
| AP MAC address.
|-
| 0xE
| 0x6
| ?
|-
| 0x14
| 0x4
| Size of this entire entry, games use this value to traverse the beacons list.
|-
| 0x18
| 0x4
| Value 0x1C(size of this header and/or offset to the actual beacon data).
|-
| 0x1C
| Entry_size - 0x1C
| The actual beacon data is located here, starting at the 802.11 management frame header.
|}

This section describes the structure returned by [[NWMINF:RecvBeaconBroadcastData]] and [[NWMUDS:RecvBeaconBroadcastData]].

=ScanInputStruct=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Two unknown u16s.
|-
| 1
| Two unknown u16s.
|-
| 2-3
| Host MAC address. The 6-bytes located here are normally all 0xFF, for all hosts. Otherwise when not set to broadcast-MAC, the command will only return info for the specified host MAC address.
|-
| 4-12
| Uninitialized for UDS.
|}

This section describes the 0x34-byte input structure used by [[NWMINF:RecvBeaconBroadcastData]] and [[NWMUDS:RecvBeaconBroadcastData]].

=Local-WLAN=
UDS is used for 3DS<>3DS local-WLAN communications, and for 3DS<>Wii U communications. The latter is mainly only used for multi-player in games.

All UDS local-WLAN communications have the CCMP key for data encryption generated via NWM module. The CCMP key passed to nwm::CEC commands(stored in a 0x44-byte input structure) for [[StreetPass]] is generated by the CECD module. The input data used with [[Process_Services|EncryptDecryptAes]] with [[PSPXI:EncryptDecryptAes|keytype1]] is a MD5 hash over the input passphrase. This input passphrase is fixed for [[Download Play]], it's unique per local-WLAN application. The CTR is a MD5 hash over the below 0x10-byte structure. The output from encrypting that data with AES-CTR is the final CCMP key. This passphrase is a raw input buffer: while the passphrase specified by user-processes is normally a string with the NUL-terminator included, it can be anything(like the [[DLP_Services|WirelessRebootPassphrase]] for example).

The maximum number of nodes(including the host) which can be on an UDS network is 16.

==NodeID==
There are two types of client connections: regular Client, and Spectator. The latter ''never'' sends ''any'' 802.11 frame at all to the host, hence ''nothing'' actually connected to the network(including the host) can know about any spectators. Once a spectator is "connected" to a network, it can only receive broadcasted data, no sending.

DLP-client connects to the network as a spectator during DLP scanning to get various [[Download_Play|metadata]] including icon data.

===NetworkNodeID===
This is the network u16 ID for each device on the UDS network. NodeID 0xFFFF is a broadcast alias. 0x1 is for the host, the 0x2 for the first client, 0x3 for the second client, and so on.

The spectator doesn't have a NetworkNodeID, since it can't [[NWMUDS:SendTo|send]] any data.

NetworkNodeIDs for clients do not change when any clients disconnect, likewise for the encrypted node-listing stored in the wifi beacons. When a client disconnects, the corresponding NetworkNodeID bit in the [[NWMUDS:GetConnectionStatus|node_bitmask]] is cleared. When a client is connecting, the client is assigned the NetworkNodeID with the lowest corresponding clear-bit in the [[NWMUDS:GetConnectionStatus|node_bitmask]], then that bit is set.

===BindNodeID===
This u32 is an ID only used on the local device. How many devices are on the network or which device this system is does not affect this ID.

The spectator uses BindNodeID 0x1. DLP uses BindNodeID 0x3 when connecting as an actual client. Hence, it seems BindNodeID bit0 is spectator-related. All normal nodes(host/client) start with BindNodeID 0x2. When connecting to a network again(and probably with network creation) without reinitializing NWMUDS, official user processes increase the used BindNodeID by 0x2.

BindNodeID value 0x0 is invalid. The maximum number of BindNodeIDs which can be open at the same time is 16.

==Application data transfer==
The protocol used for sending/receiving data over the network with UDS by official applications is [[PRUDP]](in some cases at least). Mario Kart 7 uses PRUDP here. Triforce Heroes uses plaintext for whatever protocol it uses for UDS.

The UDS version of [[PRUDP]] is different from the normal UDP version it appears(no afa1/a1af data for example).

==Communication protocol==
The process of connecting to a host and exchanging data follows the sequence:

Client->Server: Authentication frame SEQ1

Server->Client: Authentication frame SEQ2

[There does not appear to be an association request frame sent by the client to the server, it is however possible that it was sent and just not captured by the test equipment]

Server->Client: Association Response frame with association id

[From here on, the client is connected to the server]

Client->Server: Encrypted data packet containing an 8-byte 802.2 LLC header with ethertype = EAPoL (0x888E) and an u16 header of 0x201 ([[NWM_Services#EAPoL-Start frame|EAPoL-Start]])

Server->Broadcast: Encrypted data packet containing the updated node information after the client connected (Using ethertype = SecureData).

Server->Client: Encrypted data packet containing an 8-byte 802.2 LLC header with ethertype = EAPoL (0x888E) and an u16 header of 0x0202([[NWM_Services#EAPoL-Logoff frame|EAPoL-Logoff]])

[From here on, data packets sent using SendTo are encapsulated with an LLC header with ethertype = 0x876D ([[NWM_Services#SecureData NWM header|SecureData]])]

[The client also sends periodic SecureData data frames on its own, these are probably ping frames]

==Data frames==
Data is transferred over the network using [[NWMUDS:PullPacket]]/[[NWMUDS:SendTo]]. That data is transferred using 802.11 data frames using CCMP encryption. The encrypted data contained in the frame starts with the 0x8-byte [https://en.wikipedia.org/wiki/Subnetwork_Access_Protocol#Use LLC header], then the 0xE-byte NWM header, followed by the actual application data from the previously mentioned commands. When [[NWMUDS:SendTo]] was used with dst_NodeID = broadcast, the data frame is sent to the 802.11 broadcast MAC address. Otherwise with a specific NodeID, the data frame is sent to the actual MAC address for that device.

Official application data is normally stored here as big-endian.

Application data packets are sent to the host using 802.11 unicast, which then acts as a router and forwards the packet to the right destination node id based on the SecureData header using either broadcast or unicast, it is not yet known how it chooses which to use.

==Special data channels==
{| class="wikitable" border="1"
|-
! Channel
! Description
|-
| 0x101
| Used when broadcasting the updated node information after a new client connects.
|-
| 0x103
| Used when sending what appears to be "ping" or "null" frames.
|-
| 0x104
| Used to signal the ejection of all spectators in the network.
|}

==SecureData NWM header==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Size of the entire frame minus the 8 bytes from the LLC header.
|-
| 0x2
| 0x2
| unknown
|-
| 0x4
| 0x2
| Size of the entire frame minus 12 bytes.
|-
| 0x6
| 0x2
| Data channel. Applications can only use the low 8 bits, channels greater than 255 are reserved for management functions.
|-
| 0x8
| 0x2
| Sequence number, incremented after each sent packet.
|-
| 0xA
| 0x2
| Destination network node id
|-
| 0xC
| 0x2
| Source network node id
|}

This data is stored as big-endian.

==EAPoL-Start frame==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Always 0x201 in big-endian.
|-
| 0x2
| 0x2
| Association id of the sending client in big-endian.
|-
| 0x4
| 0x2
| Unknown. Always 0x1 in big-endian. The parser for this packet errors out if this is > 3.
|-
| 0x6
| 0x2
| Unknown
|-
| 0x8
| 0x28
| NodeInfo structure with all fields in big-endian
|}

This data is stored as big-endian.

==EAPoL-Logoff frame==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Always 0x202 in big-endian.
|-
| 0x2
| 0x2
| Unknown. Always 0?
|-
| 0x4
| 0x2
| Assigned network node id.
|-
| 0x6
| 0x6
| Mac address of the newly connected client.
|-
| 0xC
| 0x4
| Unknown
|-
| 0x10
| 0x2
| Unknown. Always 0.
|-
| 0x12
| 0x1
| Number of connected nodes, including the new client.
|-
| 0x13
| 0x1
| Max number of nodes.
|-
| 0x14
| 0x2
| Always 0.
|-
| 0x16
| 0x2
| Unknown.
|-
| 0x18
| 0x280
| List of 16 NodeInfo structures with all fields in big-endian
|}

This data is stored as big-endian.

==Structure used for generating the CTR for CCMP key generation==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| wlancommID
|-
| 0x4
| 0x4
| networkID
|-
| 0x8
| 0x6
| Host MAC address.
|-
| 0xE
| 0x2
| id8
|}

This data is stored as little-endian.

==CTR used for beacon tags crypto==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address
|-
| 0x6
| 0x4
| wlancommID
|-
| 0xA
| 0x1
| id8
|-
| 0xB
| 0x1
| Padding, value zero.
|-
| 0xC
| 0x4
| networkID
|}

This data is stored as little-endian. All data here is all-zero except for the MAC address, when the u8 at offset 0x8 in the network-struct is 0.

==Network structure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| This is the MAC address of the host. This is used for when [[NWMUDS:ConnectToNetwork|connecting]] to the network.
|-
| 0x6
| 0x1
| This is actually written as an u16 without byte-swapping. This is the network wifi channel. When connecting this is normally non-zero. When hosting, this can be 0 to automatically select a channel, otherwise the specified channel is used. When non-zero official user-processes require this value to be one of the following when hosting: 1, 6, or 11.
|-
| 0x7
| 0x1
| Padding
|-
| 0x8
| 0x1
| Initialized flag. Must be non-zero otherwise NWM-module will use value 0x0 for most/all(?) fields in this structure when reading these fields.
|-
| 0xC
| 0x3
| This is the OUI value for use with the beacon tags. Normally this is 001F32.
|-
| 0xF
| 0x1
| OUI type (21/0x15)
|-
| 0x10
| 0x4
| wlancommID. Local-WLAN communication ID, normally this is: (user_process [[Title_list|uniqueID]] << 8) | val. Where val is 0x10 on retail([[Configuration_Memory#ENVINFO|ENVINFO]] bit0 set), 0x90 for devunit. Official software includes an input bool flag parameter for setting bit0 in this wlancommID, normally that flag isn't set. For [[Download Play]], this is always 0x2810 on retail(0x2890 on devunit).

This wlancommID can have the side affect of region-locking when the title uses the uniqueID for the current title(hard-coded in .text normally), instead of using a fixed input uniqueID for each region of the title.
|-
| 0x14
| 0x1
| id8. ID, for [[Download Play]] this is 0x55. 0x55/'U' seems to be used for networks where Wii U can host it(Download Play, Smash Bros, ...) - this value isn't known to be actually checked anywhere however.
|-
| 0x15
| 0x1
| Number of times the network structure hash was updated.
|-
| 0x16
| 0x2
| This network attributes u16 bitmask can be written via [[NWMUDS:UpdateNetworkAttribute]].
Bitmasks:
* 0x1: When set, spectators are not allowed to connect(see [[NWMUDS:EjectSpectator|here]]). Checked by official user-processes before using [[NWMUDS:ConnectToNetwork]], when connecting as a Spectator. Must be clear otherwise that code returns error 0xE10113EA. If the initialized_flag at offset 0x8 is zero, this code handles it the same way as if this bit was set. The latest NWM-module handles checking this bit itself however.
* 0x2: When set, new regular-clients are not allowed to connect.
* 0x4: Unknown, has no affect on new clients/spectators connecting. Official software has an option for setting this bit via an input flag from the same code using bitmask 0x2. Official software always clears bitmask 0x6 when unblocking new connections.
|-
| 0x18
| 0x4
| u32 networkID, randomly-generated when creating the network. The network SSID used when a client connects to the network is sprintf(out, "%08X", networkID).
|-
| 0x1C
| 0x1
| Total number of currently connected nodes, including the host.
|-
| 0x1D
| 0x1
| Maximum number of nodes, including the host. This also is the total number of entries stored under the array in the encrypted beacon data.
|-
| 0x1E
| 0xD
| ?
|-
| 0x2B
| 0x14
| SHA1 hash of the network structure, starting at the OUI field (offset 0xC) and spanning SizeOfAppData + 0x34. The unused space of the app data buffer is not hashed.
|-
| 0x3F
| 0x1
| Size of appdata.
|-
| 0x40
| 0xC8
| Appdata(Application data), if any. Size of the appdata is specified via the u8 at offset 0x3F. This data is not used when the size-field is zero.
|}

This 0x108-byte structure is used for [[NWMUDS:BeginHostingNetwork]], [[NWMUDS:ConnectToNetwork]], etc. This data is stored as big-endian.

==NodeInfo structure==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x8
| u64 ID, this is the UDS version of the FriendCodeSeed. This is loaded from BlkID 0x00090000 in the [[Config_Savegame|system-config]] via [[CfgS:GetConfigInfoBlk2]].
|-
| 0x8
| 0x14
| The first 0x18-bytes from BlkID 0x000A0000 in the [[Config_Savegame|system-config]] loaded via [[CfgS:GetConfigInfoBlk2]] is written here by user-processes. However, the data at +0x14(absolute offset 0x1C) is written by NWM-module later.
|-
| 0x1C
| 0x2
| u16, unknown. Set to 0x0 with the output from [[NWMUDS:DecryptBeaconData]].
|-
| 0x1E
| 0x1
| u8 flag, unknown. Originates from the u16 bitmask in the beacon node-list header. This flag is normally 0 since that bitmask is normally 0?
|-
| 0x1F
| 0x1
| Padding?
|-
| 0x20
| 0x2
| u16 NetworkNodeID
|-
| 0x22
| 0x6
| Normally zero?
|}

The first 0x20-bytes are written by the user-process before using this structure with [[NWMUDS:InitializeWithVersion]]. The data starting at offset 0x8 is only initialized by NWM-module.

== UDS Beacons ==
The UDS host broadcasts a beacon containing at least two Nintendo-vendor tags(tag number 0xDD, see above for the OUI), normally the data stored in these tags are static. The second tag contains the big-endian u32 networkID, used by the clients when connecting to the host and for the above CCMP key generation. The Nintendo-vendor tag(s) following the first two are unique to the process using UDS, these tags are used for broadcasting metadata regarding the host.

A tool for these beacons is available here: [https://github.com/yellows8/ctr-wlanbeacontool]

=== UDS Beacon Tags ===
The following is the structure of each tag, starting at the OUI. The order of the tags is the same as listed below. All data stored under these tags are stored as big-endian.

==== OUI Type 20 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (20/0x14)
|-
| 0x4
| 0x3
| Sample data: 0a 00 00
|}

Normally the size of this tag(from the tag size field) is 0x07.

==== OUI Type 21 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1F
| This is the network structure starting at offset 0xC, with the first 0x1F-bytes from there.
|-
| 0x1F
| 0x14
| SHA1 hash. When doing the hashing, this hash is cleared to zero. The hash data starts at offset 0x0(OUI), and the size is 0x34 + <value of the u8 at offset 0x33>.
|-
| 0x33
| 0x1
| Size of appdata. Normally zero. When non-zero this appdata is located at offset 0x34.
|}

Normally the size of this tag(from the tag size field) is 0x34, not including appdata.

==== OUI Type 24 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (24/0x18)
|-
| 0x4
| See below
| Encrypted data
|}

This is the tag0 used with [[NWMUDS:DecryptBeaconData]]. The size of data stored under this tag has a maximum size of 0xFA-bytes, however normally the size is smaller than that. Additional encrypted data, if any, is stored under the below tag1.

==== OUI Type 25 ====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x3
| OUI, see above.
|-
| 0x3
| 0x1
| OUI type (25/0x19)
|-
| 0x4
| See above
| Encrypted data
|}

When this exists in the beacon, this is the tag1 used with [[NWMUDS:DecryptBeaconData]]. The data stored here is the 0xFA-bytes following the previous encrypted data in tag0, for more space for storing the encrypted data.

==== Encrypted beacon data ====
The following structure is for the plaintext version of the encrypted data, stored as big-endian.

This data is encrypted with AES-CTR, by NWM module in software. The AES key is stored in NWM module itself. See above for the CTR. The size of this encrypted data is 0x12 + (0x1E*val), where val is the u8 from networkstruct offset 0x1D.

===== Structure =====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x10
| MD5 over the rest of the data following this(plaintext).
|-
| 0x10
| 0x2
| u16 bitmask. Unknown, normally 0? Bit0 is for entry0, bit1 for entry1, and so on.
|-
| 0x12
| 0x1E * <total array entries>
| This is an array of entries for each of the devices on this network, the first entry is for the host and the rest is for the client(s).
|}

===== Array entry =====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1C
| This is the first 0x1C-bytes of the NodeInfo structure, stored as big-endian.
|-
| 0x1C
| 0x2
| u16 NetworkNodeID, stored as big-endian.
|}

Each entry is for a node.

= Mapped IO =
''All'' of the [[IO_Registers|IO]] mapped under the NWM-module process is listed below:

{| class="wikitable" border="1"
|-
! Userland address
! Physical address
! Size
! Description
|-
| 0x1EC22000
| 0x10122000
| 0x1000
| [[WIFI_Registers]]
|-
| 0x1EC40000
| 0x10140000
| 0x1000
| [[PDN_Registers]]
|-
| 0x1EE22000
| 0x10322000
| 0x1000
|
|}

=Errors=
{| class="wikitable" border="1"
|-
! Error code
! Description
|-
| 0xC8A06C0D
| The operation being performed is already done (e.g., if you run NWMEXT_ControlWirelessEnabled to turn wifi on when it's on already, you can't turn it on again).
|-
| 0xC8A113EA
| Returned when the command isn't allowed to be used on this device.
|-
| 0xC90113FA
| Node doesn't exist / invalid NetworkNodeID?
|-
| 0xC92113FB
| Returned when trying to connect to a host when the host has the specified connection-type blocked via the network attributes. There might be other causes too.
|-
| 0xE10113E9
| Returned when the input size is invalid. Returned by [[NWMUDS:PullPacket]] when the input size is smaller than the frame_size.
|-
| 0xE10113EA
| Invalid bind / data_channel is invalid(0x0).
|}

Config Savegame

2023-07-19T19:50:42Z

Steveice10: /* Configuration blocks */

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Access Flags
|}

===Access Flags===
{| class="wikitable" border="1"
|-
! Bit Mask
! Description
|-
| 0x2
| User Readable (cfg:u)
|-
| 0x4
| System Writable (cfg:s / cfg:i)
|-
| 0x8
| System Readable (cfg:s / cfg:i)
|}

Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Access Flags
! Description
|-
| 0x00000000
| 0x2
| 0xC
| Config savegame version?
|-
| 0x00010000
| 0x1
| 0xC
| [[Hardware_calibration#RTC|RTC compensation value]]
|-
| 0x00020000
| 0x134
| 0xC
| [[Hardware_calibration#CDC|Codec]]
|-
| 0x00030000
| 0x1
| 0xC
| Leap Year Counter (read By PTM)
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD): displayed timestamp - rtc timestamp
|-
| 0x00030002
| 0x8
| 0xC
| Settings time offset: newly set timestamp - rtc timestamp
|-
| 0x00040000
| 0x10
| 0xC
| [[Hardware_calibration#Touch|Touch calibration]] (read by HID)
|-
| 0x00040001
| 0x1C
| 0xC
| Analog Stick Calibration Param?(read by HID)
|-
| 0x00040002
| 0x12
| 0xC
| [[Hardware_calibration#Gyro|Gyroscope]] (read by HID)
|-
| 0x00040003
| 0xC
| 0xC
| [[Hardware_calibration#Accel|Accelerometer]] (read by HID)
|-
| 0x00040004
| 0x1C
| 0xC
| [[Hardware_calibration#CStick|CStick calibration data]]
|-
| 0x00050000
| 0x2
| 0xC
| [[Hardware_calibration#Screen_flicker|Screen flicker]]
|-
| 0x00050001
| 0x2
| 0xC
| Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|-
| 0x00050002
| 0x38
| 0xC
| [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP)
|-
| 0x00050003
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP)
|-
| 0x00050004
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (for legacy FIRM)
|-
| 0x00050005
| 0x20
| 0xE
| Stereo display settings (HWCAL block 0x470)
|-
| 0x00050006
| 0x2
| 0xC
| [[Hardware_calibration#ULCD_delay|3D switching delay]]
|-
| 0x00050007
| 0x4
| 0xC
| ?
|-
| 0x00050008
| 0x10C
| 0xC
| [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]]
|-
| 0x00050009
| 0x8
| 0xC
| new3DS only(?) backlight control (5th byte: auto-brightness enable)
|-
| 0x00060000
| 0x96
| 0xC
| ??? (HWCAL block 0x500)
|-
| 0x00070000
| 0x214
| 0xE
| [[Hardware_calibration#3D_filters|3D filters]]
|-
| 0x00070001
| 0x1
| 0xE
| Sound output mode (mono=0, stereo=1, surround=2)
|-
| 0x00070002
| 0x8
| 0xE
| [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]]
|-
| 0x00080000
| 0xC00
| 0xC
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0xC
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0xC
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0xE
| This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word.
|-
| 0x00090001
| 0x8
| 0xE
| Same content as 0x0009000? This console-unique u64 is used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]. It is generated by <code>((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48))</code>, where random16 is generated by [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x00090002
| 0x4
| 0xE
| The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros.
|-
| 0x000A0000
| 0x1C
| 0xE
| Username in UTF16
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
| 0x000A0002
| 0x1
| 0xE
| Language
|-
| 0x000B0000
| 0x4
| 0xE
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0xE
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
| 0x000B0002
| 0x800
| 0xE
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees

|-
| 0x000C0000
| 0xC0
| 0xE
| Restricted photo exchange data, and other info (includes a mirror of Parental Restrictions PIN/Secret Answer)
|-
| 0x000C0001
| 0x14
| 0xE
| COPPACS restriction data
|-
| 0x000C0002
| 0x200
| 0xE
| ? Contains the email address set during Parental Restriction setup.
|-
| 0x000D0000
| 0x4
| 0xE
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. u16 @ 0x02: latest version
|-
| 0x000E0000
| 0x1
| 0xE
| ?
|-
| 0x000F0000
| 0x10
| 0xC
| Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|-
| 0x000F0001
| 0x8
| 0xC
| ?
|-
| 0x000F0003
| 0x1
| 0xC
| ?
|-
| 0x000F0004
| 0x4
| 0xC
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x000F0005
| 0x4
| 0xC
| The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]).
|-
| 0x000F0006
| 0x28
| 0xC
| In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
|-
| 0x00100000
| 0x2
| 0xC
| TWL EULA info ({bool agreed; u8 agreedVersion})
|-
| 0x00100001
| 0x94
| 0xC
| Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
|-
| 0x00100002
| 0x1
| 0xC
| TWL country code
|-
| 0x00100003
| 0x10
| 0xC
| TWL movable unique ID, used for DSiWare exports
|-
| 0x00110000
| 0x4
| 0xC
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xC
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0xC
| Volume Slider Bounds (Read by HID and PTM)
|-
| 0x00130000
| 0x4
| 0xE
| If response is 0x100 then debug mode is enabled.
|-
| 0x00150000
| 0x4
| 0xC
| Clock Sequence (u16) used for generating UUIDs in [[ACT_Services|ACT]].
|-
| 0x00150001
| 0x8
| 0xC
| ?
|-
| 0x00150002
| 0x4
| 0xE
| In NIM, taken as an u32, using the low u16, casted to a char, and turned lower case for the making of the url for NPNS.
|-
| 0x00160000
| 0x4
| 0xE
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00170000
| 0x4
| 0xE
| Miiverse (OLV) access key
|-
| 0x00180000
| 0x4
| 0xC
| QTM Infrared LED related, can be 0 or 1
|-
| 0x00180001
| 0x18
| 0xC
| [[Hardware_calibration#QTM|QTM calibration data]]
|-
| 0x00190000
| 0x1
| 0xC
| Unknown. NFC-module checks for value1/non-value1.
|}

The developer unit TID block only exists on developer units.

===Stereo Display Settings===
All values are hard-coded in cfg module.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Value
! Description
|-
| 0x0
| 4
| 62.0f
|assumed pupillary distance in mm?
|-
| 0x4
| 4
| 289.0f
|assumed distance in mm between player's eyes and upper screen?
|-
| 0x8
| 4
| 76.80f
|width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0xC
| 4
| 46.08f
|height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0x10
| 4
| 10.0f
|
|-
| 0x14
| 4
| 5.0f
|
|-
| 0x18
| 4
| 55.58f
|
|-
| 0x1C
| 4
| 21.57f
|
|}

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|-
| 11
| TW
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
| State/Province code.
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===0x000A0000 Block===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x0-0x13
| UTF-16 username, with no NULL-terminator.
|-
| 0x14-17
| Usually zero?
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

===WiFi Slot Structure===

====Network structure====
This is used twice in the actual WiFi slot structure.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Whether the network was set or not?
|-
| 0x1
| 0x1
| Whether to use this network strucutre to connect?
|-
| 0x2
| 0x1
| Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|-
| 0x3
| 0x1
| Padding ?
|-
| 0x4
| 0x20
| SSID of the network, without a trailing nullbyte.
|-
| 0x24
| 0x1
| Length of the SSID.
|-
| 0x25
| 0x1
| [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]]
|-
| 0x26
| 0x2
| Padding ?
|-
| 0x28
| 0x40
| Plaintext of the passphrase of the network, without a trailing nullbyte.
|-
| 0x68
| 0x20
| PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|-
|}

====Actual structure====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes.
|-
| 0x4
| 0x88
| First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|-
| 0x8C
| 0x20
| Padding.
|-
| 0xAC
| 0x88
| Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|-
| 0x134
| 0x20C
| Padding.
|-
| 0x340
| 0x1
| Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|-
| 0x341
| 0x1
| Whether to automatically get the DNS or not, defaults to 1.
|-
| 0x342
| 0x2
| Padding ?
|-
| 0x344
| 0x4
| IP address, to use if 0x340 is false.
|-
| 0x348
| 0x4
| IP address of the gateway, to use if 0x340 is false.
|-
| 0x34C
| 0x4
| Subnetwork mask, to use if 0x340 is false.
|-
| 0x350
| 0x4
| IP address of the primary DNS , to use if 0x341 is false.
|-
| 0x354
| 0x4
| IP address of the secondary DNS, to use if 0x341 is false.
|-
| 0x358
| 0x4
| Always 0x01050000 ? Only set if the network was the last to be set during the session.
|-
| 0x35C
| 0x4
| IP address to use. Only set if the network was the last to be set during the session.
|-
| 0x360
| 0x6
| MAC address of the AP. Only set if the network was the last to be set during the session.
|-
| 0x366
| 0x1
| Channel. Only set if the network was the last to be set during the session.
|-
| 0x367
| 0x1
| Padding ? Only set if the network was the last to be set during the session.
|-
| 0x368
| 0x1
| Whether to use a proxy or not, defaults to 0.
|-
| 0x369
| 0x1
| Whether to use a basic authentication for the proxy, defaults to 0.
|-
| 0x36A
| 0x2
| Port to use for the proxy, defaults to 1.
|-
| 0x36C
| 0x30
| URL/address of the proxy, including a trailing nullbyte.
|-
| 0x39C
| 0x34
| Padding.
|-
| 0x3D0
| 0x20
| Username to use for basic authentication, including a trailing nullbyte.
|-
| 0x3F0
| 0x20
| Password to use for basic authentication, including a trailing nullbyte.
|-
| 0x410
| 0x2
| Padding ?
|-
| 0x412
| 0x2
| MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|-
| 0x414
| 0x7EC
| Padding.
|-
|}

===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

===Parental control Block 0x00100001===
{| class="wikitable" border="1"
|-
! Byte
! Size in bytes
! Description
|-
| 0x0
| 0xD
| Unknown.
|-
| 0xD
| 0x4
| PIN
|-
| 0x11
| 0x20
| Secret answer in UTF-16
|}

===Parental Control setting block 0xC0000===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[#Parental Control restriction bitmask|Parental Control restriction bitmask]]
|-
| 0x0C
| 0x04
| Parental Controls PIN code
|}

====Parental Control restriction bitmask====
{| class="wikitable" border="1"
|-
! Bit
! Restriction name
|-
| 0
| Global Parental Controls enable
|-
| 3
| Sharing Images/Audio/Video/Long Text Data
|-
| 4
| Internet Browser
|-
| 5
| StreetPass
|-
| 6
| Friend Registration
|-
| 8
| eShop
|-
| 10
| Miiverse (view)
|-
| 11
| Miiverse (post)
|-
| 31
| "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]])
|}

Config Savegame

2023-07-19T19:49:53Z

Steveice10: /* Configuration block entry */

This page describes the format of the [[Config_Services|Cfg]] [[System_SaveData|NAND]] savegame. These blocks can be accessed with the Cfg service commands.

==Structure of save-file "/config"==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| Total entries
|-
| 0x2
| 0x2
| Data entries offset
|-
| 0x4
| 0x4558
| Block entries
|-
| 0x455C
|
| Data for the entries
|}

The filesize for this /config file is 0x8000-bytes.

==Configuration block entry ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| BlkID
|-
| 0x4
| 0x4
| Offset to the data for this block when size is >4, otherwise this word is the data for this block
|-
| 0x8
| 0x2
| Size
|-
| 0xA
| 0x2
| Access Flags
|}

===Access Flags===
{| class="wikitable" border="1"
|-
! Bit Mask
! Description
|-
| 0x2
| User Readable (cfg:u)
|-
| 0x4
| System Writable (cfg:s / cfg:i)
|-
| 0x8
| System Readable (cfg:s / cfg:i)
|}

Config blocks will typically either use 0xC for system readable/writable or 0xE for all 3.

==Configuration blocks==
{| class="wikitable" border="1"
|-
! BlkID
! Size
! Flags
! Description
|-
| 0x00000000
| 0x2
| 0xC
| Config savegame version?
|-
| 0x00010000
| 0x1
| 0xC
| [[Hardware_calibration#RTC|RTC compensation value]]
|-
| 0x00020000
| 0x134
| 0xC
| [[Hardware_calibration#CDC|Codec]]
|-
| 0x00030000
| 0x1
| 0xC
| Leap Year Counter (read By PTM)
|-
| 0x00030001
| 0x8
| 0xE
| User time offset (read by CECD): displayed timestamp - rtc timestamp
|-
| 0x00030002
| 0x8
| 0xC
| Settings time offset: newly set timestamp - rtc timestamp
|-
| 0x00040000
| 0x10
| 0xC
| [[Hardware_calibration#Touch|Touch calibration]] (read by HID)
|-
| 0x00040001
| 0x1C
| 0xC
| Analog Stick Calibration Param?(read by HID)
|-
| 0x00040002
| 0x12
| 0xC
| [[Hardware_calibration#Gyro|Gyroscope]] (read by HID)
|-
| 0x00040003
| 0xC
| 0xC
| [[Hardware_calibration#Accel|Accelerometer]] (read by HID)
|-
| 0x00040004
| 0x1C
| 0xC
| [[Hardware_calibration#CStick|CStick calibration data]]
|-
| 0x00050000
| 0x2
| 0xC
| [[Hardware_calibration#Screen_flicker|Screen flicker]]
|-
| 0x00050001
| 0x2
| 0xC
| Backlight controls (u8 ABL_powersave_enable, u8 brightness_level) (read by GSP)
|-
| 0x00050002
| 0x38
| 0xC
| [[Hardware_calibration#BLPWM|Backlight PWM]] (read by GSP)
|-
| 0x00050003
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (read by GSP)
|-
| 0x00050004
| 0x20
| 0xC
| [[Hardware_calibration#ABL|Power saving mode (ABL) calibration]] (for legacy FIRM)
|-
| 0x00050005
| 0x20
| 0xE
| Stereo display settings (HWCAL block 0x470)
|-
| 0x00050006
| 0x2
| 0xC
| [[Hardware_calibration#ULCD_delay|3D switching delay]]
|-
| 0x00050007
| 0x4
| 0xC
| ?
|-
| 0x00050008
| 0x10C
| 0xC
| [[Hardware_calibration#ABL_extra|Power saving mode (ABL) extra config]]
|-
| 0x00050009
| 0x8
| 0xC
| new3DS only(?) backlight control (5th byte: auto-brightness enable)
|-
| 0x00060000
| 0x96
| 0xC
| ??? (HWCAL block 0x500)
|-
| 0x00070000
| 0x214
| 0xE
| [[Hardware_calibration#3D_filters|3D filters]]
|-
| 0x00070001
| 0x1
| 0xE
| Sound output mode (mono=0, stereo=1, surround=2)
|-
| 0x00070002
| 0x8
| 0xE
| [[Hardware_calibration#Microphone_echo_cancel|Microphone echo cancellation params]]
|-
| 0x00080000
| 0xC00
| 0xC
| WiFi configuration slot 0
|-
| 0x00080001
| 0xC00
| 0xC
| WiFi configuration slot 1
|-
| 0x00080002
| 0xC00
| 0xC
| WiFi configuration slot 2
|-
| 0x00090000
| 0x8
| 0xE
| This contains a u64 ID, used by processes using [[NWMUDS:InitializeWithVersion]]. The first word is the same as [[CfgS:GetLocalFriendCodeSeed|LocalFriendCodeSeed]], while the latter is a separate word.
|-
| 0x00090001
| 0x8
| 0xE
| Same content as 0x0009000? This console-unique u64 is used by [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]. It is generated by <code>((0x3FFFFFFFF) & LocalFriendCodeSeed) | (random16 << 48))</code>, where random16 is generated by [[PSPXI:GenerateRandomBytes|GenerateRandomBytes]]
|-
| 0x00090002
| 0x4
| 0xE
| The first two bytes are the same random16 used in 0x00090001. The second two bytes are zeros.
|-
| 0x000A0000
| 0x1C
| 0xE
| Username in UTF16
|-
| 0x000A0001
| 0x2
| 0xE
| Birthday (u8 month, u8 day)
|-
| 0x000A0002
| 0x1
| 0xE
| Language
|-
| 0x000B0000
| 0x4
| 0xE
| CountryInfo
|-
| 0x000B0001
| 0x800
| 0xE
| Country name in UTF-16, every 0x80-bytes is an entry for each language, in the order of the Language table below (not all entries are set)
|-
| 0x000B0002
| 0x800
| 0xE
| State name in UTF-16, every 0x80-bytes is an entry for each language
|-
| 0x000B0003
| 0x4
| 0xE
| Coordinates. A pair of s16 represents latitude and longitude, respectively. One need to multiply both value by 180/32768 to get coordinates in degrees

|-
| 0x000C0000
| 0xC0
| 0xE
| Restricted photo exchange data, and other info (includes a mirror of Parental Restrictions PIN/Secret Answer)
|-
| 0x000C0001
| 0x14
| 0xE
| COPPACS restriction data
|-
| 0x000C0002
| 0x200
| 0xE
| ? Contains the email address set during Parental Restriction setup.
|-
| 0x000D0000
| 0x4
| 0xE
| u16 at offset 0x0: [[SMDH#EULA_Version|EULA Version]] which was agreed to. u16 @ 0x02: latest version
|-
| 0x000E0000
| 0x1
| 0xE
| ?
|-
| 0x000F0000
| 0x10
| 0xC
| Debug configuration, read by [[NS]] on dev-units: on startup, NS does <code>svcKernelSetState(6, 1, (u64)debug_flags & 1);
svcKernelSetState(6, 2, (u64)debug_flags & 2);</code> (see [[SVC#KernelSetState|here]]) where <code>debug_flags</code> is the u32 located at offset 0xC in this struct. Then it compares the u32 from +8 in this config-block with the [[Configuration_Memory#APPMEMTYPE|APPMEMTYPE]]. When those don't match NS starts a FIRM-launch (with the same FIRM titleID as the currently running one) to boot into a FIRM with the APPMEMTYPE value from this config-block. The byte at offset 0x0 is related to the memtype as well.
|-
| 0x000F0001
| 0x8
| 0xC
| ?
|-
| 0x000F0003
| 0x1
| 0xC
| ?
|-
| 0x000F0004
| 0x4
| 0xC
| The first u8 is the System-Model [[Cfg:GetSystemModel|value]], the last 3-bytes are unknown
|-
| 0x000F0005
| 0x4
| 0xC
| The first u8 indicates whether network updates are enabled (however, NIM only checks this flag with developer [[Configuration_Memory#ENVINFO|ENVINFO]]).
|-
| 0x000F0006
| 0x28
| 0xC
| In NIM, taken as a (hopefully null terminated) string used for the "X-Device-Token" http header field for NPNS url.
|-
| 0x00100000
| 0x2
| 0xC
| TWL EULA info ({bool agreed; u8 agreedVersion})
|-
| 0x00100001
| 0x94
| 0xC
| Stores Parental Restrictions PIN/Secret Answer and other info for TWL mode
|-
| 0x00100002
| 0x1
| 0xC
| TWL country code
|-
| 0x00100003
| 0x10
| 0xC
| TWL movable unique ID, used for DSiWare exports
|-
| 0x00110000
| 0x4
| 0xC
| The low u16 indicates whether the system setup is required, such as when the system is booted for the first time or after doing a [[System Settings|System Format]]: 0 = setup required, non-zero = no setup required
|-
| 0x00110001
| 0x8
| 0xC
| TitleID of the menu to launch, used by [[NS]] on dev units (this block can be edited on dev units with [[3DS Development Unit Software#Config|Config]])
|-
| 0x00120000
| 0x8
| 0xC
| Volume Slider Bounds (Read by HID and PTM)
|-
| 0x00130000
| 0x4
| 0xE
| If response is 0x100 then debug mode is enabled.
|-
| 0x00150000
| 0x4
| 0xC
| Clock Sequence (u16) used for generating UUIDs in [[ACT_Services|ACT]].
|-
| 0x00150001
| 0x8
| 0xC
| ?
|-
| 0x00150002
| 0x4
| 0xE
| In NIM, taken as an u32, using the low u16, casted to a char, and turned lower case for the making of the url for NPNS.
|-
| 0x00160000
| 0x4
| 0xE
| Unknown, first byte is used by config service-cmd [[Config_Services|0x00070040]]. (Unknown whether the last 3-bytes are used)
|-
| 0x00170000
| 0x4
| 0xE
| Miiverse (OLV) access key
|-
| 0x00180000
| 0x4
| 0xC
| QTM Infrared LED related, can be 0 or 1
|-
| 0x00180001
| 0x18
| 0xC
| [[Hardware_calibration#QTM|QTM calibration data]]
|-
| 0x00190000
| 0x1
| 0xC
| Unknown. NFC-module checks for value1/non-value1.
|}

The developer unit TID block only exists on developer units.

===Stereo Display Settings===
All values are hard-coded in cfg module.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Value
! Description
|-
| 0x0
| 4
| 62.0f
|assumed pupillary distance in mm?
|-
| 0x4
| 4
| 289.0f
|assumed distance in mm between player's eyes and upper screen?
|-
| 0x8
| 4
| 76.80f
|width in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0xC
| 4
| 46.08f
|height in mm of (old) 3DS upper screen (doesn't vary for different models?)
|-
| 0x10
| 4
| 10.0f
|
|-
| 0x14
| 4
| 5.0f
|
|-
| 0x18
| 4
| 55.58f
|
|-
| 0x1C
| 4
| 21.57f
|
|}

===Languages===
{| class="wikitable" border="1"
|-
! ID
! Description
|-
| 0
| JP
|-
| 1
| EN
|-
| 2
| FR
|-
| 3
| DE
|-
| 4
| IT
|-
| 5
| ES
|-
| 6
| ZH
|-
| 7
| KO
|-
| 8
| NL
|-
| 9
| PT
|-
| 10
| RU
|-
| 11
| TW
|}

===CountryInfo===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0
|?
|-
| 1
|?
|-
| 2
| State/Province code.
|-
| 3
| Country code, same as DSi/Wii country codes. Value 0xFF is invalid.
|}

===0x000A0000 Block===
{| class="wikitable" border="1"
|-
! Byte
! Description
|-
| 0x0-0x13
| UTF-16 username, with no NULL-terminator.
|-
| 0x14-17
| Usually zero?
|-
| 0x18-0x1B
| u32 NGWord version the username was last checked with. If this value is less than the u32 stored in the NGWord CFA "romfs:/version.dat", the system then checks the username string with the bad-word list CFA again, then updates this field with the value from the CFA
|}

===WiFi Slot Structure===

====Network structure====
This is used twice in the actual WiFi slot structure.
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| Whether the network was set or not?
|-
| 0x1
| 0x1
| Whether to use this network strucutre to connect?
|-
| 0x2
| 0x1
| Whether this structure is the first (0) or the second (1) in the larger WiFi slot structure?
|-
| 0x3
| 0x1
| Padding ?
|-
| 0x4
| 0x20
| SSID of the network, without a trailing nullbyte.
|-
| 0x24
| 0x1
| Length of the SSID.
|-
| 0x25
| 0x1
| [[Nintendo_Zone#Beacon_payload_format|AP crypto key type]]
|-
| 0x26
| 0x2
| Padding ?
|-
| 0x28
| 0x40
| Plaintext of the passphrase of the network, without a trailing nullbyte.
|-
| 0x68
| 0x20
| PBKDF2 of the passphrase and SSID (http://jorisvr.nl/wpapsk.html).
|-
|}

====Actual structure====
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x2
| ?
|-
| 0x2
| 0x2
| [https://github.com/lammertb/libcrc/blob/v2.0/src/crc16.c#L43-L76 CRC-16 checksum] of the next 0x410 bytes.
|-
| 0x4
| 0x88
| First network structure. Only set if the network was set "normally", or was the last to be set using WPS during the session.
|-
| 0x8C
| 0x20
| Padding.
|-
| 0xAC
| 0x88
| Second network structure. Only set if the network was set using WPS, otherwise 0-filled.
|-
| 0x134
| 0x20C
| Padding.
|-
| 0x340
| 0x1
| Whether to automatically get the IP address (use DHCP) or not, defaults to 1.
|-
| 0x341
| 0x1
| Whether to automatically get the DNS or not, defaults to 1.
|-
| 0x342
| 0x2
| Padding ?
|-
| 0x344
| 0x4
| IP address, to use if 0x340 is false.
|-
| 0x348
| 0x4
| IP address of the gateway, to use if 0x340 is false.
|-
| 0x34C
| 0x4
| Subnetwork mask, to use if 0x340 is false.
|-
| 0x350
| 0x4
| IP address of the primary DNS , to use if 0x341 is false.
|-
| 0x354
| 0x4
| IP address of the secondary DNS, to use if 0x341 is false.
|-
| 0x358
| 0x4
| Always 0x01050000 ? Only set if the network was the last to be set during the session.
|-
| 0x35C
| 0x4
| IP address to use. Only set if the network was the last to be set during the session.
|-
| 0x360
| 0x6
| MAC address of the AP. Only set if the network was the last to be set during the session.
|-
| 0x366
| 0x1
| Channel. Only set if the network was the last to be set during the session.
|-
| 0x367
| 0x1
| Padding ? Only set if the network was the last to be set during the session.
|-
| 0x368
| 0x1
| Whether to use a proxy or not, defaults to 0.
|-
| 0x369
| 0x1
| Whether to use a basic authentication for the proxy, defaults to 0.
|-
| 0x36A
| 0x2
| Port to use for the proxy, defaults to 1.
|-
| 0x36C
| 0x30
| URL/address of the proxy, including a trailing nullbyte.
|-
| 0x39C
| 0x34
| Padding.
|-
| 0x3D0
| 0x20
| Username to use for basic authentication, including a trailing nullbyte.
|-
| 0x3F0
| 0x20
| Password to use for basic authentication, including a trailing nullbyte.
|-
| 0x410
| 0x2
| Padding ?
|-
| 0x412
| 0x2
| MTU value, defaults to 1400 and ranges between 576 and 1500, inclusive.
|-
| 0x414
| 0x7EC
| Padding.
|-
|}

===LCD display config===
There seems to be some sort of LCD display configuration stored in this cfg. When using the cfg-save from an Old3DS on a New3DS without formatting the cfg first, the bottom-screen display is somewhat off(which is fixed by formatting the cfg-save).

===Parental control Block 0x00100001===
{| class="wikitable" border="1"
|-
! Byte
! Size in bytes
! Description
|-
| 0x0
| 0xD
| Unknown.
|-
| 0xD
| 0x4
| PIN
|-
| 0x11
| 0x20
| Secret answer in UTF-16
|}

===Parental Control setting block 0xC0000===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x00
| 0x04
| [[#Parental Control restriction bitmask|Parental Control restriction bitmask]]
|-
| 0x0C
| 0x04
| Parental Controls PIN code
|}

====Parental Control restriction bitmask====
{| class="wikitable" border="1"
|-
! Bit
! Restriction name
|-
| 0
| Global Parental Controls enable
|-
| 3
| Sharing Images/Audio/Video/Long Text Data
|-
| 4
| Internet Browser
|-
| 5
| StreetPass
|-
| 6
| Friend Registration
|-
| 8
| eShop
|-
| 10
| Miiverse (view)
|-
| 11
| Miiverse (post)
|-
| 31
| "Child Online Privacy Protection" (see [[Cfg:GetRegionCanadaUSA|CFG:IsCoppacsSupported]])
|}

Config Services

2023-07-19T19:46:30Z

Steveice10: /* Config service "cfg:s" */

[[Category:Services]]

= Config service "cfg:u" =

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010082
|
| [[CfgS:GetConfigInfoBlk2|GetConfigInfoBlk2]]/GetConfig
|-
| 0x00020000
|
| [[Cfg:SecureInfoGetRegion|SecureInfoGetRegion]]/GetRegion
|-
| 0x00030040
|
| [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]/GetTransferableId
|-
| 0x00040000
| [[3.0.0-5]]
| [[Cfg:GetRegionCanadaUSA|GetRegionCanadaUSA]]/IsCoppacsSupported
|-
| 0x00050000
| [[5.0.0-11]]
| [[Cfg:GetSystemModel|GetSystemModel]]
|-
| 0x00060000
| [[6.0.0-11]]
| [[Cfg:GetModelNintendo2DS|GetModelNintendo2DS]]
|-
| 0x00070040
| [[7.0.0-13]]
| (u8 val) This writes the input u8 to the first byte in the config-block for blkID [[Config_Savegame|0x00160000]].
|-
| 0x00080080
| [[7.0.0-13]]
| [[Cfg:TranslateCountryInfo|TranslateCountryInfo]]
|-
| 0x00090040
| [[7.0.0-13]]
| [[Cfg:GetCountryCodeString|GetCountryCodeString]]
|-
| 0x000A0040
| [[7.0.0-13]]
| [[Cfg:GetCountryCodeID|GetCountryCodeID]]
|-
| 0x000B0000
| [[9.3.0-21|9.3.0-X]]
| IsFangateSupported
|}

= Config service "cfg:s" =
cfg:s contains all the commands in cfg:u, in addition to the following:

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x04010082
|
| [[CfgS:GetConfigInfoBlk8|GetConfigInfoBlk8]]
|-
| 0x04020082
|
| [[CfgS:SetConfigInfoBlk4|SetConfigInfoBlk4]]
|-
| 0x04030000
|
| [[Cfg:UpdateConfigNANDSavegame|UpdateConfigNANDSavegame]]
|-
| 0x04040042
|
| [[Cfg:GetLocalFriendCodeSeedData|GetLocalFriendCodeSeedData]]
|-
| 0x04050000
|
| [[CfgS:GetLocalFriendCodeSeed|GetLocalFriendCodeSeed]]
|-
| 0x04060000
|
| [[Cfg:SecureInfoGetRegion|SecureInfoGetRegion]]
|-
| 0x04070000
|
| [[CfgS:SecureInfoGetByte101|SecureInfoGetByte101]]
|-
| 0x04080042
|
| [[CfgS:SecureInfoGetSerialNo|SecureInfoGetSerialNo]]
|-
| 0x04090000
|
| [[Cfg:UpdateConfigBlk00040003|UpdateConfigBlk00040003]]
|-
| 0x040A0000
| ?
| ?
|-
| 0x040B0000
| ?
| ?
|-
| 0x040C0000
| ?
| ?
|-
| 0x040D0040
| ?
| ?
|-
| 0x040E0000
| ?
| ?
|-
| 0x040F0000
|
| [[CfgS:ClearParentalControls|ClearParentalControls]]
|}

CfgS command 0x04060000(SecureInfoGetRegion) is used by NIM module to determine the SOAP RegionId, when sending SOAP requests. See [[Nandrw/sys/SecureInfo_A|here]].

= Config service "cfg:i" =
cfg:i contains all the commands in cfg:u and cfg:s, in addition to the following:

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x08010082
|
| [[CfgS:GetConfigInfoBlk8|GetConfigInfoBlk8]]
|-
| 0x08020082
|
| [[CfgS:SetConfigInfoBlk4|SetConfigInfoBlk4]]
|-
| 0x08030000
|
| [[Cfg:UpdateConfigNANDSavegame|UpdateConfigNANDSavegame]]
|-
| 0x080400C2
|
| [[CfgI:CreateConfigInfoBlk|CreateConfigInfoBlk]]
|-
| 0x08050000
|
| [[CfgI:DeleteConfigNANDSavefile|DeleteConfigNANDSavefile]]
|-
| 0x08060000
|
| [[CfgI:FormatConfig|FormatConfig]]
|-
| 0x08070000
|
| This basically just returns result-code value 0x0, due to code this eventually executes being NOPed out.
|-
| 0x08080000
|
| This updates the config blocks for blkIDs 0x0 and 0x20000. In certain cases this may call the code for [[CfgI:FormatConfig|FormatConfig]].
|-
| 0x08090000
|
| This updates the config block for blkID 0x60000.
|-
| 0x080A0000
|
| ResetAnalogStickCalibrationParam? This updates the config block for blkID 0x00040001.
|-
| 0x080B0082
|
| [[CfgI:SetGetLocalFriendCodeSeedData|SetGetLocalFriendCodeSeedData]]
|-
| 0x080C0042
|
| [[CfgI:SetLocalFriendCodeSeedSignature|SetLocalFriendCodeSeedSignature]]
|-
| 0x080D0000
|
| [[CfgI:DeleteCreateNANDLocalFriendCodeSeed|DeleteCreateNANDLocalFriendCodeSeed]]
|-
| 0x080E0000
|
| [[CfgI:VerifySigLocalFriendCodeSeed|VerifySigLocalFriendCodeSeed]]
|-
| 0x080F0042
|
| [[Cfg:GetLocalFriendCodeSeedData|GetLocalFriendCodeSeedData]]
|-
| 0x08100000
|
| [[CfgS:GetLocalFriendCodeSeed|GetLocalFriendCodeSeed]]
|-
| 0x08110084
|
| [[CfgI:SetSecureInfo|SetSecureInfo]]
|-
| 0x08120000
|
| [[CfgI:DeleteCreateNANDSecureInfo|DeleteCreateNANDSecureInfo]]
|-
| 0x08130000
|
| [[CfgI:VerifySigSecureInfo|VerifySigSecureInfo]]
|-
| 0x08140042
|
| [[CfgI:SecureInfoGetData|SecureInfoGetData]]
|-
| 0x08150042
|
| [[CfgI:SecureInfoGetSignature|SecureInfoGetSignature]]
|-
| 0x08160000
|
| [[Cfg:SecureInfoGetRegion|SecureInfoGetRegion]]
|-
| 0x08170000
|
| [[CfgS:SecureInfoGetByte101|SecureInfoGetByte101]]
|-
| 0x08180042
|
| [[CfgS:SecureInfoGetSerialNo|SecureInfoGetSerialNo]]
|-
| 0x0819....
| ?
| ?
|-
| 0x081A....
| ?
| ?
|-
| 0x081B....
| ?
| ?
|-
| 0x081C....
| ?
| ?
|-
| 0x081D....
| ?
| ?
|-
| 0x081E....
| ?
| ?
|-
| 0x081F....
| ?
| ?
|-
| 0x0820....
| ?
| ?
|}

= Config NVRAM service "cfg:nor" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| [[CfgNor:Initialize|Initialize]]
|-
| 0x00020000
| [[CfgNor:Shutdown|Shutdown]]
|-
| 0x00030040
| (u8 flag) Writes the input flag to state. Uses SPI service command [[SPI_Services|EnableSpiBus]].
|-
| 0x00040000
| Writes the u8 from the state written by 0x00030040 to cmdreply[2].
|-
| 0x00050082
| [[CfgNor:ReadData|ReadData]]
|-
| 0x00060082
| [[CfgNor:WriteData|WriteData]]
|-
| 0x00070000
| This just uses the WREN command.
|-
| 0x00080000
| This just uses the WRDI command.
|-
| 0x00090000
| [[CfgNor:ReadIdentification|ReadIdentification]]
|-
| 0x000A0000
| This waits for the WIP bit in the status register to clear(wait for writing to finish).
|-
| 0x000B0000
| This waits for the WEL bit in the status register to become set(write enabled).
|-
| 0x000C0000
| This writes the value of the WIP bit in the status register to u8 cmdreply[2].
|-
| 0x000D0000
| This writes the value of the WIP bit in the status register to u8 cmdreply[2].
|-
| 0x000E0000
| [[CfgNor:ReadStatusRegister|ReadStatusRegister]]
|-
| 0x000F0082
| [[CfgNor:ReadDataOther|ReadDataOther]]
|-
| 0x00100082
| [[CfgNor:WriteDataOther|WriteDataOther]]
|-
| 0x00110040
| (u32 offset) Uses command WREN then waits for WEL to become enabled. Sends command 0xDB to SPI followed by the specified flash offset.
|-
| 0x00120040
| (u32 offset) Identical to 0x00110040 except this uses SPI-command 0xD8 instead("block erase").
|-
| 0x00130000
| This uses SPI command 0xB9 for "Deep power down".
|-
| 0x00140000
| This uses SPI command 0xAB for "Release from deep power down".
|}
This is an interface for the "SPI::NOR" service, for accessing the Wifi NVRAM/SPI Flash.

Config Services

2023-07-19T19:46:00Z

Steveice10: /* Config service "cfg:u" */

[[Category:Services]]

= Config service "cfg:u" =

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010082
|
| [[CfgS:GetConfigInfoBlk2|GetConfigInfoBlk2]]/GetConfig
|-
| 0x00020000
|
| [[Cfg:SecureInfoGetRegion|SecureInfoGetRegion]]/GetRegion
|-
| 0x00030040
|
| [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]/GetTransferableId
|-
| 0x00040000
| [[3.0.0-5]]
| [[Cfg:GetRegionCanadaUSA|GetRegionCanadaUSA]]/IsCoppacsSupported
|-
| 0x00050000
| [[5.0.0-11]]
| [[Cfg:GetSystemModel|GetSystemModel]]
|-
| 0x00060000
| [[6.0.0-11]]
| [[Cfg:GetModelNintendo2DS|GetModelNintendo2DS]]
|-
| 0x00070040
| [[7.0.0-13]]
| (u8 val) This writes the input u8 to the first byte in the config-block for blkID [[Config_Savegame|0x00160000]].
|-
| 0x00080080
| [[7.0.0-13]]
| [[Cfg:TranslateCountryInfo|TranslateCountryInfo]]
|-
| 0x00090040
| [[7.0.0-13]]
| [[Cfg:GetCountryCodeString|GetCountryCodeString]]
|-
| 0x000A0040
| [[7.0.0-13]]
| [[Cfg:GetCountryCodeID|GetCountryCodeID]]
|-
| 0x000B0000
| [[9.3.0-21|9.3.0-X]]
| IsFangateSupported
|}

= Config service "cfg:s" =
cfg:s contains all the commands in cfg:u, in addition to the following:

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00050000
|
| Same as cfg:u 0x00050000 cmd?
|-
| 0x04010082
|
| [[CfgS:GetConfigInfoBlk8|GetConfigInfoBlk8]]
|-
| 0x04020082
|
| [[CfgS:SetConfigInfoBlk4|SetConfigInfoBlk4]]
|-
| 0x04030000
|
| [[Cfg:UpdateConfigNANDSavegame|UpdateConfigNANDSavegame]]
|-
| 0x04040042
|
| [[Cfg:GetLocalFriendCodeSeedData|GetLocalFriendCodeSeedData]]
|-
| 0x04050000
|
| [[CfgS:GetLocalFriendCodeSeed|GetLocalFriendCodeSeed]]
|-
| 0x04060000
|
| [[Cfg:SecureInfoGetRegion|SecureInfoGetRegion]]
|-
| 0x04070000
|
| [[CfgS:SecureInfoGetByte101|SecureInfoGetByte101]]
|-
| 0x04080042
|
| [[CfgS:SecureInfoGetSerialNo|SecureInfoGetSerialNo]]
|-
| 0x04090000
|
| [[Cfg:UpdateConfigBlk00040003|UpdateConfigBlk00040003]]
|-
| 0x040A0000
| ?
| ?
|-
| 0x040B0000
| ?
| ?
|-
| 0x040C0000
| ?
| ?
|-
| 0x040D0040
| ?
| ?
|-
| 0x040E0000
| ?
| ?
|-
| 0x040F0000
|
| [[CfgS:ClearParentalControls|ClearParentalControls]]
|}

CfgS command 0x04060000(SecureInfoGetRegion) is used by NIM module to determine the SOAP RegionId, when sending SOAP requests. See [[Nandrw/sys/SecureInfo_A|here]].

= Config service "cfg:i" =
cfg:i contains all the commands in cfg:u and cfg:s, in addition to the following:

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x08010082
|
| [[CfgS:GetConfigInfoBlk8|GetConfigInfoBlk8]]
|-
| 0x08020082
|
| [[CfgS:SetConfigInfoBlk4|SetConfigInfoBlk4]]
|-
| 0x08030000
|
| [[Cfg:UpdateConfigNANDSavegame|UpdateConfigNANDSavegame]]
|-
| 0x080400C2
|
| [[CfgI:CreateConfigInfoBlk|CreateConfigInfoBlk]]
|-
| 0x08050000
|
| [[CfgI:DeleteConfigNANDSavefile|DeleteConfigNANDSavefile]]
|-
| 0x08060000
|
| [[CfgI:FormatConfig|FormatConfig]]
|-
| 0x08070000
|
| This basically just returns result-code value 0x0, due to code this eventually executes being NOPed out.
|-
| 0x08080000
|
| This updates the config blocks for blkIDs 0x0 and 0x20000. In certain cases this may call the code for [[CfgI:FormatConfig|FormatConfig]].
|-
| 0x08090000
|
| This updates the config block for blkID 0x60000.
|-
| 0x080A0000
|
| ResetAnalogStickCalibrationParam? This updates the config block for blkID 0x00040001.
|-
| 0x080B0082
|
| [[CfgI:SetGetLocalFriendCodeSeedData|SetGetLocalFriendCodeSeedData]]
|-
| 0x080C0042
|
| [[CfgI:SetLocalFriendCodeSeedSignature|SetLocalFriendCodeSeedSignature]]
|-
| 0x080D0000
|
| [[CfgI:DeleteCreateNANDLocalFriendCodeSeed|DeleteCreateNANDLocalFriendCodeSeed]]
|-
| 0x080E0000
|
| [[CfgI:VerifySigLocalFriendCodeSeed|VerifySigLocalFriendCodeSeed]]
|-
| 0x080F0042
|
| [[Cfg:GetLocalFriendCodeSeedData|GetLocalFriendCodeSeedData]]
|-
| 0x08100000
|
| [[CfgS:GetLocalFriendCodeSeed|GetLocalFriendCodeSeed]]
|-
| 0x08110084
|
| [[CfgI:SetSecureInfo|SetSecureInfo]]
|-
| 0x08120000
|
| [[CfgI:DeleteCreateNANDSecureInfo|DeleteCreateNANDSecureInfo]]
|-
| 0x08130000
|
| [[CfgI:VerifySigSecureInfo|VerifySigSecureInfo]]
|-
| 0x08140042
|
| [[CfgI:SecureInfoGetData|SecureInfoGetData]]
|-
| 0x08150042
|
| [[CfgI:SecureInfoGetSignature|SecureInfoGetSignature]]
|-
| 0x08160000
|
| [[Cfg:SecureInfoGetRegion|SecureInfoGetRegion]]
|-
| 0x08170000
|
| [[CfgS:SecureInfoGetByte101|SecureInfoGetByte101]]
|-
| 0x08180042
|
| [[CfgS:SecureInfoGetSerialNo|SecureInfoGetSerialNo]]
|-
| 0x0819....
| ?
| ?
|-
| 0x081A....
| ?
| ?
|-
| 0x081B....
| ?
| ?
|-
| 0x081C....
| ?
| ?
|-
| 0x081D....
| ?
| ?
|-
| 0x081E....
| ?
| ?
|-
| 0x081F....
| ?
| ?
|-
| 0x0820....
| ?
| ?
|}

= Config NVRAM service "cfg:nor" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| [[CfgNor:Initialize|Initialize]]
|-
| 0x00020000
| [[CfgNor:Shutdown|Shutdown]]
|-
| 0x00030040
| (u8 flag) Writes the input flag to state. Uses SPI service command [[SPI_Services|EnableSpiBus]].
|-
| 0x00040000
| Writes the u8 from the state written by 0x00030040 to cmdreply[2].
|-
| 0x00050082
| [[CfgNor:ReadData|ReadData]]
|-
| 0x00060082
| [[CfgNor:WriteData|WriteData]]
|-
| 0x00070000
| This just uses the WREN command.
|-
| 0x00080000
| This just uses the WRDI command.
|-
| 0x00090000
| [[CfgNor:ReadIdentification|ReadIdentification]]
|-
| 0x000A0000
| This waits for the WIP bit in the status register to clear(wait for writing to finish).
|-
| 0x000B0000
| This waits for the WEL bit in the status register to become set(write enabled).
|-
| 0x000C0000
| This writes the value of the WIP bit in the status register to u8 cmdreply[2].
|-
| 0x000D0000
| This writes the value of the WIP bit in the status register to u8 cmdreply[2].
|-
| 0x000E0000
| [[CfgNor:ReadStatusRegister|ReadStatusRegister]]
|-
| 0x000F0082
| [[CfgNor:ReadDataOther|ReadDataOther]]
|-
| 0x00100082
| [[CfgNor:WriteDataOther|WriteDataOther]]
|-
| 0x00110040
| (u32 offset) Uses command WREN then waits for WEL to become enabled. Sends command 0xDB to SPI followed by the specified flash offset.
|-
| 0x00120040
| (u32 offset) Identical to 0x00110040 except this uses SPI-command 0xD8 instead("block erase").
|-
| 0x00130000
| This uses SPI command 0xB9 for "Deep power down".
|-
| 0x00140000
| This uses SPI command 0xAB for "Release from deep power down".
|}
This is an interface for the "SPI::NOR" service, for accessing the Wifi NVRAM/SPI Flash.

Config Services

2023-04-02T22:50:26Z

Steveice10: Clarify and reduce duplication of shared commands

[[Category:Services]]

= Config service "cfg:u" =

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00010082
|
| [[CfgS:GetConfigInfoBlk2|GetConfigInfoBlk2]]
|-
| 0x00020000
|
| [[Cfg:SecureInfoGetRegion|SecureInfoGetRegion]]
|-
| 0x00030040
|
| [[Cfg:GenHashConsoleUnique|GenHashConsoleUnique]]/GetTransferableId
|-
| 0x00040000
| [[3.0.0-5]]
| [[Cfg:GetRegionCanadaUSA|GetRegionCanadaUSA]]/IsCoppacsSupported
|-
| 0x00050000
| [[5.0.0-11]]
| [[Cfg:GetSystemModel|GetSystemModel]]
|-
| 0x00060000
| [[6.0.0-11]]
| [[Cfg:GetModelNintendo2DS|GetModelNintendo2DS]]
|-
| 0x00070040
| [[7.0.0-13]]
| (u8 val) This writes the input u8 to the first byte in the config-block for blkID [[Config_Savegame|0x00160000]].
|-
| 0x00080080
| [[7.0.0-13]]
| [[Cfg:TranslateCountryInfo|TranslateCountryInfo]]
|-
| 0x00090040
| [[7.0.0-13]]
| [[Cfg:GetCountryCodeString|GetCountryCodeString]]
|-
| 0x000A0040
| [[7.0.0-13]]
| [[Cfg:GetCountryCodeID|GetCountryCodeID]]
|-
| 0x000B0000
| [[9.3.0-21|9.3.0-X]]
| IsFangateSupported
|}

= Config service "cfg:s" =
cfg:s contains all the commands in cfg:u, in addition to the following:

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x00050000
|
| Same as cfg:u 0x00050000 cmd?
|-
| 0x04010082
|
| [[CfgS:GetConfigInfoBlk8|GetConfigInfoBlk8]]
|-
| 0x04020082
|
| [[CfgS:SetConfigInfoBlk4|SetConfigInfoBlk4]]
|-
| 0x04030000
|
| [[Cfg:UpdateConfigNANDSavegame|UpdateConfigNANDSavegame]]
|-
| 0x04040042
|
| [[Cfg:GetLocalFriendCodeSeedData|GetLocalFriendCodeSeedData]]
|-
| 0x04050000
|
| [[CfgS:GetLocalFriendCodeSeed|GetLocalFriendCodeSeed]]
|-
| 0x04060000
|
| [[Cfg:SecureInfoGetRegion|SecureInfoGetRegion]]
|-
| 0x04070000
|
| [[CfgS:SecureInfoGetByte101|SecureInfoGetByte101]]
|-
| 0x04080042
|
| [[CfgS:SecureInfoGetSerialNo|SecureInfoGetSerialNo]]
|-
| 0x04090000
|
| [[Cfg:UpdateConfigBlk00040003|UpdateConfigBlk00040003]]
|-
| 0x040A0000
| ?
| ?
|-
| 0x040B0000
| ?
| ?
|-
| 0x040C0000
| ?
| ?
|-
| 0x040D0040
| ?
| ?
|-
| 0x040E0000
| ?
| ?
|-
| 0x040F0000
|
| [[CfgS:ClearParentalControls|ClearParentalControls]]
|}

CfgS command 0x04060000(SecureInfoGetRegion) is used by NIM module to determine the SOAP RegionId, when sending SOAP requests. See [[Nandrw/sys/SecureInfo_A|here]].

= Config service "cfg:i" =
cfg:i contains all the commands in cfg:u and cfg:s, in addition to the following:

{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x08010082
|
| [[CfgS:GetConfigInfoBlk8|GetConfigInfoBlk8]]
|-
| 0x08020082
|
| [[CfgS:SetConfigInfoBlk4|SetConfigInfoBlk4]]
|-
| 0x08030000
|
| [[Cfg:UpdateConfigNANDSavegame|UpdateConfigNANDSavegame]]
|-
| 0x080400C2
|
| [[CfgI:CreateConfigInfoBlk|CreateConfigInfoBlk]]
|-
| 0x08050000
|
| [[CfgI:DeleteConfigNANDSavefile|DeleteConfigNANDSavefile]]
|-
| 0x08060000
|
| [[CfgI:FormatConfig|FormatConfig]]
|-
| 0x08070000
|
| This basically just returns result-code value 0x0, due to code this eventually executes being NOPed out.
|-
| 0x08080000
|
| This updates the config blocks for blkIDs 0x0 and 0x20000. In certain cases this may call the code for [[CfgI:FormatConfig|FormatConfig]].
|-
| 0x08090000
|
| This updates the config block for blkID 0x60000.
|-
| 0x080A0000
|
| ResetAnalogStickCalibrationParam? This updates the config block for blkID 0x00040001.
|-
| 0x080B0082
|
| [[CfgI:SetGetLocalFriendCodeSeedData|SetGetLocalFriendCodeSeedData]]
|-
| 0x080C0042
|
| [[CfgI:SetLocalFriendCodeSeedSignature|SetLocalFriendCodeSeedSignature]]
|-
| 0x080D0000
|
| [[CfgI:DeleteCreateNANDLocalFriendCodeSeed|DeleteCreateNANDLocalFriendCodeSeed]]
|-
| 0x080E0000
|
| [[CfgI:VerifySigLocalFriendCodeSeed|VerifySigLocalFriendCodeSeed]]
|-
| 0x080F0042
|
| [[Cfg:GetLocalFriendCodeSeedData|GetLocalFriendCodeSeedData]]
|-
| 0x08100000
|
| [[CfgS:GetLocalFriendCodeSeed|GetLocalFriendCodeSeed]]
|-
| 0x08110084
|
| [[CfgI:SetSecureInfo|SetSecureInfo]]
|-
| 0x08120000
|
| [[CfgI:DeleteCreateNANDSecureInfo|DeleteCreateNANDSecureInfo]]
|-
| 0x08130000
|
| [[CfgI:VerifySigSecureInfo|VerifySigSecureInfo]]
|-
| 0x08140042
|
| [[CfgI:SecureInfoGetData|SecureInfoGetData]]
|-
| 0x08150042
|
| [[CfgI:SecureInfoGetSignature|SecureInfoGetSignature]]
|-
| 0x08160000
|
| [[Cfg:SecureInfoGetRegion|SecureInfoGetRegion]]
|-
| 0x08170000
|
| [[CfgS:SecureInfoGetByte101|SecureInfoGetByte101]]
|-
| 0x08180042
|
| [[CfgS:SecureInfoGetSerialNo|SecureInfoGetSerialNo]]
|-
| 0x0819....
| ?
| ?
|-
| 0x081A....
| ?
| ?
|-
| 0x081B....
| ?
| ?
|-
| 0x081C....
| ?
| ?
|-
| 0x081D....
| ?
| ?
|-
| 0x081E....
| ?
| ?
|-
| 0x081F....
| ?
| ?
|-
| 0x0820....
| ?
| ?
|}

= Config NVRAM service "cfg:nor" =
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| [[CfgNor:Initialize|Initialize]]
|-
| 0x00020000
| [[CfgNor:Shutdown|Shutdown]]
|-
| 0x00030040
| (u8 flag) Writes the input flag to state. Uses SPI service command [[SPI_Services|EnableSpiBus]].
|-
| 0x00040000
| Writes the u8 from the state written by 0x00030040 to cmdreply[2].
|-
| 0x00050082
| [[CfgNor:ReadData|ReadData]]
|-
| 0x00060082
| [[CfgNor:WriteData|WriteData]]
|-
| 0x00070000
| This just uses the WREN command.
|-
| 0x00080000
| This just uses the WRDI command.
|-
| 0x00090000
| [[CfgNor:ReadIdentification|ReadIdentification]]
|-
| 0x000A0000
| This waits for the WIP bit in the status register to clear(wait for writing to finish).
|-
| 0x000B0000
| This waits for the WEL bit in the status register to become set(write enabled).
|-
| 0x000C0000
| This writes the value of the WIP bit in the status register to u8 cmdreply[2].
|-
| 0x000D0000
| This writes the value of the WIP bit in the status register to u8 cmdreply[2].
|-
| 0x000E0000
| [[CfgNor:ReadStatusRegister|ReadStatusRegister]]
|-
| 0x000F0082
| [[CfgNor:ReadDataOther|ReadDataOther]]
|-
| 0x00100082
| [[CfgNor:WriteDataOther|WriteDataOther]]
|-
| 0x00110040
| (u32 offset) Uses command WREN then waits for WEL to become enabled. Sends command 0xDB to SPI followed by the specified flash offset.
|-
| 0x00120040
| (u32 offset) Identical to 0x00110040 except this uses SPI-command 0xD8 instead("block erase").
|-
| 0x00130000
| This uses SPI command 0xB9 for "Deep power down".
|-
| 0x00140000
| This uses SPI command 0xAB for "Release from deep power down".
|}
This is an interface for the "SPI::NOR" service, for accessing the Wifi NVRAM/SPI Flash.

NSC:LockSpecialContent

2023-04-02T17:00:33Z

Steveice10: /* Description */

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00010100]
|-
| 1
| [[Filesystem_services#MediaType|MediaType]]
|-
| 2-3
| Title ID
|-
| 4
| [[Filesystem_services#SpecialContentType|SpecialContentType]]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00010040]
|-
| 1
| Result code
|}

=Description=

If a content is not already locked, this stores the provided parameters in the service's data structure and increments global counters for locked SD card and game card titles based on the media type. If an update title is available for the provided application, the appropriate counter will be incremented as well based on its media type. This also calls into some FS service functions in the range 0x870-0x878 with currently unknown purpose.

If a content is already locked, error C8A12406 will be returned.

If the ns:c session is closed, [[NSC:UnlockSpecialContent|UnlockSpecialContent]] will be called internally to clean up the locked content.

This is used by the Instruction Manual applet, and is likely related to triggering SD/Game Card removal errors when ejecting the media the manual is stored on.

NS and APT Services

2023-04-02T16:33:02Z

Steveice10: /* NS Service "ns:c" */

[[Category:Services]]
The NS ('''N'''intendo User Interface '''S'''hell) system module is the first module launched from a CTR-NAND title after the [[FIRM]] processes are loaded (also see [[Bootloader]]). This module is launched by the pm process, with the titleID loaded from NS state(hard-coded TID initialized during applet TID-array initialization). NS first launches [[ErrDisp]], then the menu. On retail the menu TID is loaded from NS state, while on dev/debug the menu TID is loaded from [[Config_Savegame|config]]. On dev-units if the menu TID block doesn't exist in [[Config_Savegame|config]], NS will attempt to launch the alternate menu instead. The TID of the launched menu is then written to [[Configuration Memory|ACTIVEMENUTID]]. NS uses [[PMApp:LaunchTitle|pm:app]] to launch titles.

NS will not trigger the [[ErrDisp|fatal-error]] screen when launching the regular/alternate menu fails.

Like home menu NS is constantly running while the system is in 3DS-mode. When attempting to return to home-menu when the home-menu process isn't running(like when the process terminated/crashed), NS will trigger a [[ErrDisp|fatal]] error.

= Alternate menu =
When launching the regular menu fails, NS will then attempt to launch the alternate menu. This title could be used as a recovery process, however it's normally not used after the factory.

At the factory for all 3DS systems, [[3DS Development Unit GUI#Test Menu|Test Menu]] is installed with this TID. On retail this title is eventually deleted during [[Factory Setup]].

= Auto-boot =
After [[PMApp:GetFIRMLaunchParams|loading]] [[FIRM]] params and prior to launching [[ErrDisp]]/Home Menu, NS handles auto-booting titles. The same code called by [[APT:Reboot]] is used for launching FIRM here. When the [[Configuration_Memory|UPDATEFLAG]] is set, NS will launch SAFE_MODE_FIRM with the application titleID set to the [[System_Settings#System_Updater|System Updater]] titleID for this region. When the UPDATEFLAG is not set, NS can auto-boot the following titles as well if [[Configuration_Memory|0x1FF80016]] bit0 is set.

When bit1 and bit2 are value zero in [[Configuration_Memory|0x1FF80016]], NS will [[NSS:LaunchFIRM|launch]] the title specified by the [[FIRM]] parameters if the title-info is set. This FIRM launch is done after launching [[ErrDisp]] and Home Menu. Otherwise when [[Configuration_Memory|0x1FF80016]] is value 2 and the output u8 from [[PTM|PTMSYSM]] command 0x08140000 is value 0, NS will boot the title specified from the TWL TLNC block from FIRMparams+0x300. This is the same TLNC block which DSi titles wrote to RAM+0x300 for launching other titles via the launcher title. When handling the TLNC block, NS will boot the 3DS System Settings title when the TLNC titleID is the DSi System Settings titleID(the region field in the TLNC TID is not checked/used). When the TLNC titleID is not System Settings, NS will convert the input DSi titleID-high to the 3DS TWL titleID-high(tidhigh = (TLNCtidhigh & 0x7FFF) | 0x48000), then launch TWL_FIRM to run the title. NS does not support launching from gamecard via TLNC.

= NS Workaround =
A "ns_workaround" was [[5.1.0-11|added]] in NS to workaround the flaw added with [[5.0.0-11]]. When NS is loading before launching any ARM11 processes and certain [[Configuration Memory]] fields are set, NS will launch [[Application_Manager_Services|AM]] then use command [[AM:InstallNATIVEFIRM]]. NS will then execute the code called by [[APT:StartNewestHomeMenu]], the code related to APT:PrepareToStartNewestHomeMenu is not executed here.

NS will only execute this code-path when [[Configuration Memory|0x1FF80016]] is value zero, when KERNEL_VERSIONMAJOR is value 2, and when KERNEL_VERSIONMINOR is less than 35. Therefore, this code-path is only executed when the running NATIVE_FIRM version is prior to [[5.0.0-11]].

= NS Service "ns:s" =
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Description
|-
| 0x000100C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchFIRM|LaunchFIRM]]
|-
| 0x000200C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchTitle|LaunchTitle]]
|-
| 0x00030000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateApplication|TerminateApplication]]
|-
| 0x00040040
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateProcess|TerminateProcess]]
|-
| 0x000500C0
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:LaunchApplicationFIRM|LaunchApplicationFIRM]]
|-
| 0x00060042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetWirelessRebootInfo|SetWirelessRebootInfo]]
|-
| 0x00070042
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateInitialize|CardUpdateInitialize]]
|-
| 0x00080000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:CardUpdateShutdown|CardUpdateShutdown]]
|-
| 0x00090000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000A0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000B0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000C0000
| [[1.0.0-0]] - [[2.0.0-2]]
| Gamecard system update related.
|-
| 0x000D0140
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:SetTWLBannerHMAC|SetTWLBannerHMAC]]
|-
| 0x000E0000
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:ShutdownAsync|ShutdownAsync]]
|-
| 0x000F0000
| [[1.0.0-0]] - [[2.0.0-2]]
| This calls [[APT:AppletUtility]] with fixed input params.
|-
| 0x00100180
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:RebootSystem|RebootSystem]]
|-
| 0x00110100
| [[1.0.0-0]] - [[2.0.0-2]]
| [[NSS:TerminateTitle|TerminateTitle]]
|-
| 0x001200C0
| ?
| [[NSS:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00130000
| ?
| ?
|-
| 0x00140042
| ?
| ?
|-
| 0x00150140
| ?
| [[NSS:LaunchApplication|LaunchApplication]]
|-
| 0x00160000
| [[8.0.0-18]]
| [[NSS:RebootSystemClean|RebootSystemClean]]
|}

The maximum sessions that can be used with this service is two, therefore only two processes can use this service at the same time.

=NS Power Service "ns:p"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010040
| [[NSP:RebootSystem|RebootSystem]]
|-
| 0x00020000
| [[NSS:ShutdownAsync|ShutdownAsync]]
|}

This was added with [[3.0.0-5]]. The PTM sysmodule connects to this service, and syncs whenever [[PTM|ptm:s GetShellState()]] changes.

=NS Service "ns:c"=
{| class="wikitable" border="1"
|-
! Command Header
! Description
|-
| 0x00010100
| [[NSC:LockSpecialContent|LockSpecialContent]]
|-
| 0x00020100
| [[NSC:UnlockSpecialContent|UnlockSpecialContent]]
|}

This was added with [[5.0.0-11]]. It is used by the Instruction Manual applet, and is likely related to triggering SD/Game Card removal errors when ejecting the media the manual is stored on.

=APT Services=
{| class="wikitable" border="1"
|-
! Command Header
! Available since system version
! Accessible with APT:U
! Description
|-
| 0x00010040
|
| Yes
| [[APT:GetLockHandle|GetLockHandle]]
|-
| 0x00020080
|
| See [[APT:Initialize|here]].
| [[APT:Initialize|Initialize]]
|-
| 0x00030040
|
| Yes
| [[APT:Enable|Enable]]
|-
| 0x00040040
|
| Yes
| [[APT:Finalize|Finalize]]
|-
| 0x00050040
|
| Yes
| [[APT:GetAppletManInfo|GetAppletManInfo]]
|-
| 0x00060040
|
| Yes, for AppID != 0x300
| [[APT:GetAppletInfo|GetAppletInfo]]
|-
| 0x00070000
|
| Yes
| [[APT:GetLastSignaledAppletId|GetLastSignaledAppletId]]
|-
| 0x00080000
|
| Yes
| [[APT:CountRegisteredApplet|CountRegisteredApplet]]
|-
| 0x00090040
|
| Yes
| [[APT:IsRegistered|IsRegistered]]
|-
| 0x000A0040
|
| Yes
| [[APT:GetAttribute|GetAttribute]]
|-
| 0x000B0040
|
| Yes
| [[APT:InquireNotification|InquireNotification]]
|-
| 0x000C0104
|
| Yes
| [[APT:SendParameter|SendParameter]]
|-
| 0x000D0080
|
| Yes
| [[APT:ReceiveParameter|ReceiveParameter]]
|-
| 0x000E0080
|
| Yes
| [[APT:GlanceParameter|GlanceParameter]]
|-
| 0x000F0100
|
| Yes
| [[APT:CancelParameter|CancelParameter]]
|-
| 0x001000C2
|
| Yes
| [[APT:DebugFunc|DebugFunc]]
|-
| 0x001100C0
|
| Yes
| [[APT:MapProgramIdForDebug|MapProgramIdForDebug]]
|-
| 0x00120040
|
| Yes
| [[APT:SetHomeMenuAppletIdForDebug|SetHomeMenuAppletIdForDebug]]
|-
| 0x00130000
|
| Yes
| [[APT:GetPreparationState|GetPreparationState]]
|-
| 0x00140040
|
| Yes
| [[APT:SetPreparationState|SetPreparationState]]
|-
| 0x00150140
|
| No
| [[APT:PrepareToStartApplication|PrepareToStartApplication]]
|-
| 0x00160040
|
| Yes
| [[APT:PreloadLibraryApplet|PreloadLibraryApplet]]
|-
| 0x00170040
|
| Yes
| [[APT:FinishPreloadingLibraryApplet|FinishPreloadingLibraryApplet]]
|-
| 0x00180040
|
| Yes
| [[APT:PrepareToStartLibraryApplet|PrepareToStartLibraryApplet]]
|-
| 0x00190040
|
| Yes
| [[APT:PrepareToStartSystemApplet|PrepareToStartSystemApplet]]
|-
| 0x001A0000
|
| Yes
| [[APT:PrepareToStartNewestHomeMenu|PrepareToStartNewestHomeMenu]]
|-
| 0x001B00C4
|
| Yes
| [[APT:StartApplication|StartApplication]]
|-
| 0x001C0000
|
| Yes
| [[APT:WakeupApplication|WakeupApplication]]
|-
| 0x001D0000
|
| Yes
| [[APT:CancelApplication|CancelApplication]]
|-
| 0x001E0084
|
| Yes
| [[APT:StartLibraryApplet|StartLibraryApplet]]
|-
| 0x001F0084
|
| Yes
| [[APT:StartSystemApplet|StartSystemApplet]]
|-
| 0x00200044
|
| Yes
| [[APT:StartNewestHomeMenu|StartNewestHomeMenu]]
|-
| 0x00210000
|
| No
| [[APT:OrderToCloseApplication|OrderToCloseApplication]]
|-
| 0x00220040
|
| Yes
| [[APT:PrepareToCloseApplication|PrepareToCloseApplication]]
|-
| 0x00230040
|
| Yes
| [[APT:PrepareToJumpToApplication|PrepareToJumpToApplication]]
|-
| 0x00240044
|
| Yes
| [[APT:JumpToApplication|JumpToApplication]]
|-
| 0x002500C0
|
| Yes
| [[APT:PrepareToCloseLibraryApplet|PrepareToCloseLibraryApplet]]
|-
| 0x00260000
|
| Yes
| [[APT:PrepareToCloseSystemApplet|PrepareToCloseSystemApplet]]
|-
| 0x00270044
|
| Yes
| [[APT:CloseApplication|CloseApplication]]
|-
| 0x00280044
|
| Yes
| [[APT:CloseLibraryApplet|CloseLibraryApplet]]
|-
| 0x00290044
|
| Yes
| [[APT:CloseSystemApplet|CloseSystemApplet]]
|-
| 0x002A0000
|
| Yes
| [[APT:OrderToCloseSystemApplet|OrderToCloseSystemApplet]]
|-
| 0x002B0000
|
| Yes
| [[APT:PrepareToJumpToHomeMenu|PrepareToJumpToHomeMenu]]
|-
| 0x002C0044
|
| Yes
| [[APT:JumpToHomeMenu|JumpToHomeMenu]]
|-
| 0x002D0000
|
| Yes
| [[APT:PrepareToLeaveHomeMenu|PrepareToLeaveHomeMenu]]
|-
| 0x002E0044
|
| Yes
| [[APT:LeaveHomeMenu|LeaveHomeMenu]]
|-
| 0x002F0040
|
| Yes
| [[APT:PrepareToLeaveResidentApplet|PrepareToLeaveResidentApplet]]
|-
| 0x00300044
|
| Yes
| [[APT:LeaveResidentApplet|LeaveResidentApplet]]
|-
| 0x00310100
|
| Yes
| [[APT:PrepareToDoApplicationJump|PrepareToDoApplicationJump]]
|-
| 0x00320084
|
| Yes
| [[APT:DoApplicationJump|DoApplicationJump]]
|-
| 0x00330000
|
| Yes
| [[APT:GetProgramIdOnApplicationJump|GetProgramIdOnApplicationJump]]
|-
| 0x00340084
|
| Yes
| [[APT:SendDeliverArg|SendDeliverArg]]
|-
| 0x00350080
|
| Yes
| [[APT:ReceiveDeliverArg|ReceiveDeliverArg]]
|-
| 0x00360040
|
| Yes
| [[APT:LoadSysMenuArg|LoadSysMenuArg]]
|-
| 0x00370042
|
| Yes
| [[APT:StoreSysMenuArg|StoreSysMenuArg]]
|-
| 0x00380040
|
| Yes
| [[APT:PreloadResidentApplet|PreloadResidentApplet]]
|-
| 0x00390040
|
| Yes
| [[APT:PrepareToStartResidentApplet|PrepareToStartResidentApplet]]
|-
| 0x003A0044
|
| Yes
| [[APT:StartResidentApplet|StartResidentApplet]]
|-
| 0x003B0040
|
| Yes
| [[APT:CancelLibraryApplet|CancelLibraryApplet]]
|-
| 0x003C0042
|
| Yes
| [[APT:SendDspSleep|SendDspSleep]]
|-
| 0x003D0042
|
| Yes
| [[APT:SendDspWakeUp|SendDspWakeUp]]
|-
| 0x003E0080
|
| Yes
| [[APT:ReplySleepQuery|ReplySleepQuery]]
|-
| 0x003F0040
|
| Yes
| [[APT:ReplySleepNotificationComplete|ReplySleepNotificationComplete]]
|-
| 0x00400042
|
| Yes
| [[APT:SendCaptureBufferInfo|SendCaptureBufferInfo]]
|-
| 0x00410040
|
| Yes
| [[APT:ReceiveCaptureBufferInfo|ReceiveCaptureBufferInfo]]
|-
| 0x00420080
|
| Yes
| [[APT:SleepSystem|SleepSystem]]
|-
| 0x00430040
|
| Yes
| [[APT:NotifyToWait|NotifyToWait]]
|-
| 0x00440000
|
| Yes
| [[APT:GetSharedFont|GetSharedFont]]
|-
| 0x00450040
|
| Yes
| [[APT:GetWirelessRebootInfo|GetWirelessRebootInfo]]
|-
| 0x00460104
|
| Yes
| [[APT:Wrap|Wrap]]
|-
| 0x00470104
|
| Yes
| [[APT:Unwrap|Unwrap]]
|-
| 0x00480100
|
| No
| [[APT:GetProgramInfo|GetProgramInfo]]
|-
| 0x00490180
|
| No
| [[APT:Reboot|Reboot]]
|-
| 0x004A0040
|
| Yes
| [[APT:GetCaptureInfo|GetCaptureInfo]]
|-
| 0x004B00C2
|
| Yes
| [[APT:AppletUtility|AppletUtility]]
|-
| 0x004C0000
|
| Yes
| [[APT:SetFatalErrDispMode|SetFatalErrDispMode]]
|-
| 0x004D0080
|
| Yes
| [[APT:GetAppletProgramInfo|GetAppletProgramInfo]]
|-
| 0x004E0000
|
| Yes
| [[APT:HardwareResetAsync|HardwareResetAsync]]
|-
| 0x004F0080
| [[2.2.0-X]]
| Yes
| [[APT:SetApplicationCpuTimeLimit|SetApplicationCpuTimeLimit]]
|-
| 0x00500040
| [[2.2.0-X]]
| Yes
| [[APT:GetApplicationCpuTimeLimit|GetApplicationCpuTimeLimit]]
|-
| 0x00510080
| [[3.0.0-5]]
| Yes
| [[APT:GetStartupArgument|GetStartupArgument]]
|-
| 0x00520104
| [[4.0.0-7]]
| Yes
| [[APT:Wrap1|Wrap1]]
|-
| 0x00530104
| [[4.0.0-7]]
| Yes
| [[APT:Unwrap1|Unwrap1]]
|-
| 0x00540040
| [[5.0.0-11]]
| ?
| ?
|-
| 0x00550040
| [[7.0.0-13]]
| Yes
| [[APT:SetScreencapPostPermission|SetScreencapPostPermission]]
|-
| 0x00560000
| [[7.0.0-13]]
| Yes
| [[APT:GetScreencapPostPermission|GetScreencapPostPermission]]
|-
| 0x00570044
| [[7.0.0-13]]
| ?
| [[APT:WakeupApplication2|WakeupApplication2]]
|-
| 0x00580002
| [[7.0.0-13]]
| Yes
| [[APT:GetProgramID|GetProgramID]]
|-
| 0x01010000
| [[8.0.0-18]]
| Yes
| [[APT:CheckNew3DSApp|CheckNew3DSApp]]
|-
| 0x01020000
| [[8.0.0-18]]
| Yes
| [[APT:CheckNew3DS|CheckNew3DS]]
|-
| 0x01030000
| [[8.0.0-18]]
| Yes
| This writes an output u8 to cmdreply[2], the value is determined by checking various NS internal state + whether this is a New3DS.
The normal output seems to be value 0x2. Forcing this value to 0x1 causes New3DS HID usage(via ir:USER) in Smash Bros to be disabled.
|-
| 0x01040000
| [[8.0.0-18]]
| ?
| [[APT:IsStandardMemoryLayout|IsStandardMemoryLayout]]
|-
| 0x01050100
| [[10.4.0-29]]
| ?
| [[APT:IsTitleAllowed|IsTitleAllowed]]
|}

These "APT:U" and "APT:S" NS services can handle launching titles/"applets", these services handle signaling for home/power button as well. Only one session for either APT service can be open at a time, normally processes close the service handle immediately once finished using the service. The commands for APT:U and APT:S are exactly the same, however certain commands are only accessible with APT:S(NS module will call [[SVC|svcBreak]] when the command isn't accessible).

Applets returning to home-menu first use commands APT:PrepareToJumpToHomeMenu and APT:JumpToHomeMenu, followed by these commands to launch home-menu: [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]]. [[APT:PrepareToStartSystemApplet]] and [[APT:StartSystemApplet]] are also used for launching the [[Internet Browser]], the camera applet, etc.

Processes launch applications via home-menu, not directly with [[APT:PrepareToStartApplication]] and [[APT:StartApplication]]. Regular applications can't directly launch applications since [[APT:StartApplication]] launches the process without terminating the currently running application.

APT:PrepareToDoApplicationJump and APT:DoApplicationJump are used by applications, for launching native/<non-NATIVE_FIRM> applications. These commands notify Home Menu that title launching needs done, Home Menu does the actual title launching via NS commands.

== AppletAttr ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0-2
| [[NS_and_APT_Services#AppletPos|AppletPos]]
|-
| 3
| Manually Acquire/Release GPU Rights
|-
| 4
| Manually Acquire/Release DSP Rights
|-
| 5
| ?
|}

== DisplayBufferMode ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| FORMAT_R8G8B8A8
|-
| 1
| FORMAT_R8G8B8
|-
| 2
| FORMAT_R5G6B5
|-
| 3
| FORMAT_R5G5B5A1
|-
| 4
| FORMAT_R4G4B4A4
|-
| 0xFFFFFFFF
| FORMAT_UNIMPORTABLE
|}

This is the same mapping as used for the [[GPU/External_Registers#Framebuffer_color_formats|GPU framebuffer color formats]].

== AppletPos ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| -1
| POS_NONE
|-
| 0
| POS_APP
|-
| 1
| POS_APPLIB
|-
| 2
| POS_SYS
|-
| 3
| POS_SYSLIB
|-
| 4
| POS_RESIDENT
|}

== QueryReply ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| REPLY_REJECT
|-
| 1
| REPLY_ACCEPT
|-
| 2
| REPLY_LATER
|}

== Notification ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NOTIFICATION_NONE
|-
| 1
| NOTIFICATION_HOME_BUTTON_1
|-
| 2
| NOTIFICATION_HOME_BUTTON_2
|-
| 3
| NOTIFICATION_SLEEP_QUERY
|-
| 4
| NOTIFICATION_SLEEP_CANCELED_BY_OPEN
|-
| 5
| NOTIFICATION_SLEEP_ACCEPTED
|-
| 6
| NOTIFICATION_SLEEP_AWAKE
|-
| 7
| NOTIFICATION_SHUTDOWN
|-
| 8
| NOTIFICATION_POWER_BUTTON_CLICK
|-
| 9
| NOTIFICATION_POWER_BUTTON_CLEAR
|-
| 10
| NOTIFICATION_TRY_SLEEP
|-
| 11
| NOTIFICATION_ORDER_TO_CLOSE
|}

== Command ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| COMMAND_NONE
|-
| 1
| COMMAND_WAKEUP
|-
| 2
| COMMAND_REQUEST
|-
| 3
| COMMAND_RESPONSE
|-
| 4
| COMMAND_EXIT
|-
| 5
| COMMAND_MESSAGE
|-
| 6
| COMMAND_HOME_BUTTON_SINGLE
|-
| 7
| COMMAND_HOME_BUTTON_DOUBLE
|-
| 8
| COMMAND_DSP_SLEEP
|-
| 9
| COMMAND_DSP_WAKEUP
|-
| 10
| COMMAND_WAKEUP_BY_EXIT
|-
| 11
| COMMAND_WAKEUP_BY_PAUSE
|-
| 12
| COMMAND_WAKEUP_BY_CANCEL
|-
| 13
| COMMAND_WAKEUP_BY_CANCELALL
|-
| 14
| COMMAND_WAKEUP_BY_POWER_BUTTON_CLICK
|-
| 15
| COMMAND_WAKEUP_TO_JUMP_HOME
|-
| 16
| COMMAND_REQUEST_FOR_SYS_APPLET
|-
| 17
| COMMAND_WAKEUP_TO_LAUNCH_APPLICATION
|-
| 0x41
| Unknown. [[APT:ReceiveParameter|Received]] by Home Menu during boot when the Home Menu process doesn't terminate properly(svcExitProcess/crash).
|}

== AppletPreparationState ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| NO_PREPARATION
|-
| 1
| PREPARED_TO_LAUNCH_APP
|-
| 2
| PREPARED_TO_CLOSE_APP
|-
| 3
| PREPARED_TO_FORCE_TO_CLOSE_APP
|-
| 4
| PREPARED_TO_PRELOAD_APPLIB
|-
| 5
| PREPARED_TO_LAUNCH_APPLIB
|-
| 6
| PREPARED_TO_CLOSE_APPLIB
|-
| 7
| PREPARED_TO_LAUNCH_SYS
|-
| 8
| PREPARED_TO_CLOSE_SYS
|-
| 9
| PREPARED_TO_PRELOAD_SYSLIB
|-
| 10
| PREPARED_TO_LAUNCH_SYSLIB
|-
| 11
| PREPARED_TO_CLOSE_SYSLIB
|-
| 12
| PREPARED_TO_LAUNCH_RESIDENT
|-
| 13
| PREPARED_TO_LEAVE_RESIDENT
|-
| 14
| PREPARED_TO_DO_HOMEMENU
|-
| 15
| PREPARED_TO_LEAVE_HOMEMENU
|-
| 16
| PREPARED_TO_START_RESIDENT
|-
| 17
| PREPARED_TO_DO_APP_JUMP
|-
| 18
| PREPARED_TO_FORCE_TO_CLOSE_SYS
|-
| 19
| PREPARED_TO_LAUNCH_OTHER_SYS
|-
| 20
| PREPARED_TO_JUMP_TO_APP
|}

== StartupArgumentType ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0
| STARTUP_ARGUMENT_TYPE_OTHER_APP
|-
| 1
| STARTUP_ARGUMENT_TYPE_RESTART
|-
| 2
| STARTUP_ARGUMENT_TYPE_OTHER_MEDIA
|}

== CaptureBufferInfo ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4
| u32, Size
|-
| 0x4
| 0x1
| u8, 3D (0 = not 3D, 1 = 3D)
|-
| 0x5
| 0x3
| Reserved
|-
| 0x8
| 0x4
| Main Screen Left Offset
|-
| 0xC
| 0x4
| Main Screen Right Offset
|-
| 0x10
| 0x4
| Main Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|-
| 0x14
| 0x4
| Sub Screen Left Offset
|-
| 0x18
| 0x4
| Sub Screen Right Offset
|-
| 0x1C
| 0x4
| Sub Screen [[NS_and_APT_Services#DisplayBufferMode|DisplayBufferMode]]
|}

==WirelessRebootInfo==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x6
| Host MAC address.
|-
| 0x6
| 0x9
| WirelessRebootPassphrase
|-
| 0xF
| 0x1
| Uninitialized
|}

This is [[NSS:SetWirelessRebootInfo|setup]] by the dlplay system-application, before launching the DLP-child which can then use [[APT:GetWirelessRebootInfo]]. The MAC address and passphrase is used for connecting to the host by the DLP-child. See also [[DLP_Services|here]].

="APT:A" Service=
This was added with [[7.0.0-13|7.0.0-X]]. Official apps built with the CTRSDK for system-version >=[[7.0.0-13|7.0.0-X]] normally use the "APT:A" service instead of "APT:U". Those processes also have "APT:A" instead of "APT:U" in the service-access-control. It's unknown whether there's anything which is only accessible via "APT:A".

=Applets=
NS module does not verify that the input appID for the APT service cmds are correct for that type of command. For example, a process-launch of a SystemApplet via LibraryApplet commands works fine(minus the launched-process side of APT probably).

==System Applets==
On Old3DS there could only be one applet here(Home Menu, Internet Browser, Friend-List, etc) with programID-high 00040030 running at a time. On Old3DS when directly launching one of these 00040030 applets with Home Menu, the Home Menu process will terminate once the process is launched. On Old3DS when returning to Home Menu from that launched process, the Home Menu process is launched again.

On New3DS the Home Menu process is still running/in-memory, while another system-applet is running. On New3DS it appears that the Home Menu process is terminated+relaunched, when another system-applet terminated without exiting with APT properly.

==Library Applets==
Library applets can be launched by applications and regular applets. These library applets render to the screen(s) when running, etc. For example, this includes swkbd for text input. See the below appIDs in the 0x2XX range, the actual appID used is 0x4XX however.

Input data can be sent to the library applet via the NS [[APT:SendParameter|parameter]] buffer, and/or with shared-memory with a shared-mem handle sent to the library applet. Output data from the library applet can be received by [[APT:ReceiveParameter]], the library applet can also use the specified shared-mem for output too.

=AppIDs=
{| class="wikitable" border="1"
|-
! AppID
! Description
|-
| 0x101
| [[Home Menu]] (menu)
|-
| 0x103
| Alternate Menu
|-
| 0x110
| Camera applet ([[Camera Applet|CtrApp]])
|-
| 0x112
| Friends List applet ([[Friend List|friend]])
|-
| 0x113
| Game Notes applet (Cherry)
|-
| 0x114
| [[Internet Browser]] (spider/SKATER)
|-
| 0x115
| Instruction Manual applet
|-
| 0x116
| [[Notifications]] applet (newslist)
|-
| 0x117
| Miiverse applet (olv)
|-
| 0x118
| [[Miiverse]] posting applet (solv3)
|-
| 0x119
| Amiibo settings (cabinet)
|-
| 0x201
| Software Keyboard (swkbd) (?)
|-
| 0x202
| [[Mii Selector]] (appletEd) (?)
|-
| 0x204
| Photo Selector (PNOTE_AP) (?)
|-
| 0x205
| Sound Selector (SNOTE_AP) (?)
|-
| 0x206
| Error Display ([[ErrDisp|error]]) (?)
|-
| 0x207
| eShop applet ([[EShop#NS_eShop_application_parameters|mint]]) (?)
|-
| 0x208
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]]) (?)
|-
| 0x209
| Notepad (memolib) (?)
|-
| 0x300
| Application
|-
| 0x301
| eShop (tiger)
|-
| 0x401
| Software Keyboard (swkbd)
|-
| 0x402
| Mii Selector (appletEd)
|-
| 0x404
| Photo Selector (PNOTE_AP)
|-
| 0x405
| Sound Selector (SNOTE_AP)
|-
| 0x406
| Error Display (error)
|-
| 0x407
| eShop applet (mint)
|-
| 0x408
| Circle Pad Pro Calibrator ([[Extrapad_Applet|extrapad]])
|-
| 0x409
| Notepad (memolib)
|-
| 0xF10
| ProgramID: 0004003000008900.
|-
| 0xF11
| ProgramID: 000400000FFFFD00.
|-
| 0xF12
| ProgramID: 000400000FFFFC00.
|-
| 0xF13
| ProgramID: 000400000FFFFB00.
|-
| 0xF14
| ProgramID: 000400000FFFF900.
|-
| 0xF15
| ProgramID: 000400000FFFF800.
|-
| 0xF16
| ProgramID: 000400000FFFF700.
|-
| 0xF17
| ProgramID: 000400000FFFF600.
|-
| 0xF18
| ProgramID: 000400000FFFF500.
|}

These AppIDs are all for NAND titles, except for 0x300. AppIDs in the 0x1XX range are applets(programID-high 00040030), and the AppIDs in the 0x2XX range are "system libraries"(programID-high 00040030). The 0xFXX AppID range is for development NAND applications, these are not available for retail.

Note that at some point the total AppID entry count was changed from 28 to 27.

NSC:UnlockSpecialContent

2023-04-02T16:32:47Z

Steveice10: Created page with "=Request= {| class="wikitable" border="1" |- ! Index Word ! Description |- | 0 | Header code [0x00020100] |- | 1 | MediaType |- | 2-3 | Tit..."

=Request=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00020100]
|-
| 1
| [[Filesystem_services#MediaType|MediaType]]
|-
| 2-3
| Title ID
|-
| 4
| [[Filesystem_services#SpecialContentType|SpecialContentType]]
|}

=Response=
{| class="wikitable" border="1"
|-
! Index Word
! Description
|-
| 0
| Header code [0x00020040]
|-
| 1
| Result code
|}

=Description=

If a content is currently locked and the inputs match the locked content parameters, this decrements global counters for locked SD card and game card titles based on the media type. If an update title is available for the provided application, the appropriate counter will be decremented as well based on its media type. This also calls into some FS service functions in the range 0x870-0x878 with currently unknown purpose.

If a content is not locked or the provided parameters do not match, error C8A12405 will be returned.

This is used by the Instruction Manual applet, and is likely related to triggering SD/Game Card removal errors when ejecting the media the manual is stored on.