11.0.0 - Revision history

SciresM: /* creport-sysmodule */

2020-12-15T02:08:20Z

creport-sysmodule

← Older revision		Revision as of 05:08, 15 December 2020
Line 254:		Line 254:

	=== [[Creport\|creport]]-sysmodule ===		=== [[Creport\|creport]]-sysmodule ===
	* creport now takes in an additional argument "jit_debug_enabled", when this is "1" the target process is not terminated.		* creport now takes in an additional argument "jit_debug_enabled", when this is "1" the target process is not terminated on report completion.
	* creport now has access to fsp-srv, this is used to retrieve debugging information that is now attached to error reports. The following functions are called (with output/info attached to erpts):		* creport now has access to fsp-srv, this is used to retrieve debugging information that is now attached to error reports. The following functions are called (with output/info attached to erpts):
	** GetSdCardSpeedMode		** GetSdCardSpeedMode

SciresM: /* creport-sysmodule */

2020-12-15T02:08:11Z

creport-sysmodule

← Older revision		Revision as of 05:08, 15 December 2020
Line 254:		Line 254:

	=== [[Creport\|creport]]-sysmodule ===		=== [[Creport\|creport]]-sysmodule ===
			* creport now takes in an additional argument "jit_debug_enabled", when this is "1" the target process is not terminated.
	* creport now has access to fsp-srv, this is used to retrieve debugging information that is now attached to error reports. The following functions are called (with output/info attached to erpts):		* creport now has access to fsp-srv, this is used to retrieve debugging information that is now attached to error reports. The following functions are called (with output/info attached to erpts):
	** GetSdCardSpeedMode		** GetSdCardSpeedMode

SciresM at 02:59, 15 December 2020

2020-12-15T01:59:19Z

← Older revision		Revision as of 04:59, 15 December 2020
Line 252:		Line 252:
	* pgl now detects when SnapShotDumper crashes, and launches creport in that case.		* pgl now detects when SnapShotDumper crashes, and launches creport in that case.
	* pgl now passes an additional argument to creport ("%d", formatted with the value of jit_debug!enable_jit_debug).		* pgl now passes an additional argument to creport ("%d", formatted with the value of jit_debug!enable_jit_debug).

	~~See also [[#OSS]].~~


	=== [[Creport\|creport]]-sysmodule ===		=== [[Creport\|creport]]-sysmodule ===

SciresM: /* System Titles */ pgl diffs

2020-12-15T01:59:01Z

System Titles: pgl diffs

← Older revision		Revision as of 04:59, 15 December 2020
Line 247:		Line 247:

	See also [[#OSS]].		See also [[#OSS]].

			=== [[PGL_services\|pgl]]-sysmodule ===
			* pgl now has a new ipc command, which just returns "ResultNotImplemented()"
			* pgl now detects when SnapShotDumper crashes, and launches creport in that case.
			* pgl now passes an additional argument to creport ("%d", formatted with the value of jit_debug!enable_jit_debug).

			See also [[#OSS]].


	=== [[Creport\|creport]]-sysmodule ===		=== [[Creport\|creport]]-sysmodule ===

Yellows8: /* System Titles */

2020-12-11T17:47:57Z

System Titles

← Older revision		Revision as of 20:47, 11 December 2020
Line 236:		Line 236:

	The new Nintendo Switch Online menu (which can be launched via qlaunch) is handled by [[Internet_Browser#Whitelisted_Applets\|LibraryAppletLoginShare]].		The new Nintendo Switch Online menu (which can be launched via qlaunch) is handled by [[Internet_Browser#Whitelisted_Applets\|LibraryAppletLoginShare]].

			=== [[HID_services\|hid]]-sysmodule ===
			Besides IPC changes, the ButtonConfig cmds updated the input s32 validation: when the input s32 is invalid (which now uses an unsigned compare), it now returns 0 or an error immediately, instead of Aborting.

	=== [[LDN_services\|ldn]]-sysmodule ===		=== [[LDN_services\|ldn]]-sysmodule ===

SciresM: way fewer linked list nodes.

2020-12-10T10:28:23Z

way fewer linked list nodes.

← Older revision		Revision as of 13:28, 10 December 2020
Line 85:		Line 85:
	** Several callsites now verify that last_address != 0xFFFF...		** Several callsites now verify that last_address != 0xFFFF...
	* KMemoryRegionAllocator now uses a slabheap of count 200 instead of 1000.		* KMemoryRegionAllocator now uses a slabheap of count 200 instead of 1000.
			* KLinkedListNode now has slab size = #KThreads instead of #KThreads * 17.
	* "Virtual" cores now supported, KThread now stores core ID/affinity for both virtual and physical.		* "Virtual" cores now supported, KThread now stores core ID/affinity for both virtual and physical.
	* New SVC 0x37 "GetResourceLimitPeakValue"		* New SVC 0x37 "GetResourceLimitPeakValue"

Yellows8: /* Web-applets */

2020-12-09T20:37:37Z

Web-applets

← Older revision		Revision as of 23:37, 9 December 2020
Line 266:		Line 266:
	These are now compiled with compiler Pointer Authentication / CFI mitigations enabled. This does not apply to non-web-applets.		These are now compiled with compiler Pointer Authentication / CFI mitigations enabled. This does not apply to non-web-applets.

	Pointer Authentication uses the crc32x instruction, and x18 as a cryptographically-random u64 provided by the kernel.		Pointer Authentication uses the crc32x instruction, and x18 as a cryptographically-random u64 provided by the kernel. The only userland code using x18 is the mul instruction for this, nothing else (applies to all NSOs/NROs).

	This is used to add/subtract x30 starting with bit40, during functions entry/exit. The code for entry/exit is identical, except that entry does add, and exit uses subtract:		This is used to add/subtract x30 starting with bit40, during functions entry/exit. The code for entry/exit is identical, except that entry does add, and exit uses subtract:

Qlutoo: /* Web-applets */

2020-12-09T17:28:15Z

Web-applets

← Older revision		Revision as of 20:28, 9 December 2020
Line 272:		Line 272:
	* <code>crc32x w17, wzr, x17</code> (which uses the above value)		* <code>crc32x w17, wzr, x17</code> (which uses the above value)
	* Then the previously mentioned add/subtraction operation is done, with the output from the above shifted to bit40.		* Then the previously mentioned add/subtraction operation is done, with the output from the above shifted to bit40.

			The x18 is OR'd by kernel with 1, to make sure it is odd. This means that the multiply is a bijection; in other words, no entropy is lost when doing the multiply. If this had not been done, a random value that is divisible by a large power of two (the attacker can just keep spawning threads until gets such a one), would have weak cookies that allows the scheme to be trivially broken.

	CFI is implemented as follows: blr instructions no longer exist. When funcptrs are called, new functions are now called instead which handles the call. The u32 at funcptr_addr-4 must match 0xe7ffdefe, otherwise it will branch to undefined instruction 0x0000dead. Otherwise, it will jump to the funcptr_addr.		CFI is implemented as follows: blr instructions no longer exist. When funcptrs are called, new functions are now called instead which handles the call. The u32 at funcptr_addr-4 must match 0xe7ffdefe, otherwise it will branch to undefined instruction 0x0000dead. Otherwise, it will jump to the funcptr_addr.

Yellows8: /* Web-applets */

2020-12-09T14:20:44Z

Web-applets

← Older revision		Revision as of 17:20, 9 December 2020
Line 275:		Line 275:
	CFI is implemented as follows: blr instructions no longer exist. When funcptrs are called, new functions are now called instead which handles the call. The u32 at funcptr_addr-4 must match 0xe7ffdefe, otherwise it will branch to undefined instruction 0x0000dead. Otherwise, it will jump to the funcptr_addr.		CFI is implemented as follows: blr instructions no longer exist. When funcptrs are called, new functions are now called instead which handles the call. The u32 at funcptr_addr-4 must match 0xe7ffdefe, otherwise it will branch to undefined instruction 0x0000dead. Otherwise, it will jump to the funcptr_addr.

	Almost all functions now have the above u32 at -4, therefore funcptr calls now have to start at the actual funcptr start. However, this doesn't apply to calls done during functions' exit: these directly br to the funcptr_addr without extra validation.		Almost all functions now have the above u32 at -4, therefore funcptr calls now have to start at the actual funcptr start. However, this doesn't apply to calls done during functions' exit: these directly br to the funcptr_addr without extra validation. The br instructions in the .plt were also replaced with branches to the function described above.

	The above applies to all NSOs in ExeFs, except for LibraryAppletOfflineWeb which doesn't have it enabled. The NROs in the BrowserDll SystemData have it enabled for "/nro/netfront/dll_1/", however "dll_0" doesn't have it enabled (which is used by LibraryAppletOfflineWeb).		The above applies to all NSOs in ExeFs, except for LibraryAppletOfflineWeb which doesn't have it enabled. The NROs in the BrowserDll SystemData have it enabled for "/nro/netfront/dll_1/", however "dll_0" doesn't have it enabled (which is used by LibraryAppletOfflineWeb).

Yellows8 at 02:58, 9 December 2020

2020-12-09T01:58:40Z

← Older revision		Revision as of 04:58, 9 December 2020
Line 101:		Line 101:
	** New nnSdk code relies on this behavior.		** New nnSdk code relies on this behavior.
	* SetupStackForUserModeThreadStarter (KThreadContext::Initialize) now sets X18 to (<cryptographically random u64> \| 1), this value is unique for each thread.		* SetupStackForUserModeThreadStarter (KThreadContext::Initialize) now sets X18 to (<cryptographically random u64> \| 1), this value is unique for each thread.
	** This is used for ~~CFI~~ changes in web browser.		** This is used for Pointer Authentication changes in web browser.
	* KCoreLocalRegion deleted, replaced with pointer-to-current-thread		* KCoreLocalRegion deleted, replaced with pointer-to-current-thread
	** TPIDR_EL1 != X18 now, and TPIDR_EL1 now always points to the exception thread stack.		** TPIDR_EL1 != X18 now, and TPIDR_EL1 now always points to the exception thread stack.
Line 264:		Line 264:

	=== [[Internet_Browser\|Web-applets]] ===		=== [[Internet_Browser\|Web-applets]] ===
	These are now compiled with compiler CFI mitigations enabled. This does not apply to non-web-applets. ~~This~~ uses the crc32x instruction, and x18 as a cryptographically-random u64 provided by the kernel.		These are now compiled with compiler Pointer Authentication / CFI mitigations enabled. This does not apply to non-web-applets.

			Pointer Authentication uses the crc32x instruction, and x18 as a cryptographically-random u64 provided by the kernel.

	This is used to add/subtract x30 starting with bit40, during functions entry/exit. The code for entry/exit is identical, except that entry does add, and exit uses subtract:		This is used to add/subtract x30 starting with bit40, during functions entry/exit. The code for entry/exit is identical, except that entry does add, and exit uses subtract:
Line 271:		Line 273:
	* Then the previously mentioned add/subtraction operation is done, with the output from the above shifted to bit40.		* Then the previously mentioned add/subtraction operation is done, with the output from the above shifted to bit40.

	blr instructions no longer exist~~: when~~ funcptrs are called, new functions are now called instead which handles the call. The u32 at funcptr_addr-4 must match 0xe7ffdefe, otherwise it will branch to undefined instruction 0x0000dead. Otherwise, it will jump to the funcptr_addr.		CFI is implemented as follows: blr instructions no longer exist. When funcptrs are called, new functions are now called instead which handles the call. The u32 at funcptr_addr-4 must match 0xe7ffdefe, otherwise it will branch to undefined instruction 0x0000dead. Otherwise, it will jump to the funcptr_addr.

	Almost all functions now have the above u32 at -4, therefore funcptr calls now have to start at the actual funcptr start. However, this doesn't apply to calls done during functions' exit: these directly br to the funcptr_addr without extra validation.		Almost all functions now have the above u32 at -4, therefore funcptr calls now have to start at the actual funcptr start. However, this doesn't apply to calls done during functions' exit: these directly br to the funcptr_addr without extra validation.

	The above applies to all NSOs in ExeFs, except for LibraryAppletOfflineWeb which doesn't have it enabled. The NROs in the BrowserDll SystemData have ~~CFI~~ enabled for "/nro/netfront/dll_1/", however "dll_0" doesn't have it enabled (which is used by LibraryAppletOfflineWeb).		The above applies to all NSOs in ExeFs, except for LibraryAppletOfflineWeb which doesn't have it enabled. The NROs in the BrowserDll SystemData have it enabled for "/nro/netfront/dll_1/", however "dll_0" doesn't have it enabled (which is used by LibraryAppletOfflineWeb).

	This is referred to in the build-path strings as "NX-NXFP2-a64-cfi" (nnSdkEmpty), and "NX64-cfi" (OSS).		This is referred to in the build-path strings as "NX-NXFP2-a64-cfi" (nnSdkEmpty), and "NX64-cfi" (OSS).