17.0.0 - Revision history

Yls8bot at 00:28, 21 November 2023

2023-11-20T23:28:41Z

← Older revision		Revision as of 02:28, 21 November 2023
Line 4:		Line 4:

	As of November 9, 2023 (UTC), this sysupdate is now required by [[Account_services\|account]] CDN / [[Network\|dauth]] (required by online-play).		As of November 9, 2023 (UTC), this sysupdate is now required by [[Account_services\|account]] CDN / [[Network\|dauth]] (required by online-play).

			Additionally, a rebootless Switch system update was released for 17.0.0 on November 21, 2023 (UTC). This Switch update was released for the following regions: ALL, and CHN. The following (non-sysver) titles were updated: NgWord, NgWord2.

	==Change-log==		==Change-log==
Line 432:		Line 434:
	System update report(s):		System update report(s):
	* [https://yls8.mtheall.com/ninupdates/reports.php?date=2023-10-11_00-15-06&sys=hac]		* [https://yls8.mtheall.com/ninupdates/reports.php?date=2023-10-11_00-15-06&sys=hac]
			* [https://yls8.mtheall.com/ninupdates/reports.php?date=2023-11-21_00-10-36&sys=hac]

Yellows8 at 02:52, 9 November 2023

2023-11-09T01:52:11Z

← Older revision		Revision as of 04:52, 9 November 2023
Line 3:		Line 3:
	Security flaws fixed: yes.		Security flaws fixed: yes.

	As of November 9, 2023 (UTC), this sysupdate is now required by [[Account_services\|account]] CDN (required by online-play).		As of November 9, 2023 (UTC), this sysupdate is now required by [[Account_services\|account]] CDN / [[Network\|dauth]] (required by online-play).

	==Change-log==		==Change-log==

Yellows8 at 01:42, 9 November 2023

2023-11-09T00:42:45Z

← Older revision		Revision as of 03:42, 9 November 2023
Line 2:		Line 2:

	Security flaws fixed: yes.		Security flaws fixed: yes.

			As of November 9, 2023 (UTC), this sysupdate is now required by [[Account_services\|account]] CDN (required by online-play).

	==Change-log==		==Change-log==

Yellows8 at 05:06, 24 October 2023

2023-10-24T03:06:40Z

← Older revision		Revision as of 07:06, 24 October 2023
Line 417:		Line 417:
	*** Main() now initializes the two KWorkerTaskManagers, and now aborts if their priorities (both constant 11) are zero.		*** Main() now initializes the two KWorkerTaskManagers, and now aborts if their priorities (both constant 11) are zero.
	* KSleepManager's no longer saves and restores tcr_el1 when saving/restoring system registers.		* KSleepManager's no longer saves and restores tcr_el1 when saving/restoring system registers.

			=== [[NV_services\|nvservices]] ===
			A vuln was [[Switch_System_Flaws\|fixed]].

	=== [[NS_services\|ns]] ===		=== [[NS_services\|ns]] ===

Yellows8 at 18:32, 20 October 2023

2023-10-20T16:32:30Z

← Older revision		Revision as of 20:32, 20 October 2023
Line 419:		Line 419:

	=== [[NS_services\|ns]] ===		=== [[NS_services\|ns]] ===
			Besides IPC changes, a vuln was [[Switch_System_Flaws\|fixed]].

			=== [[PSC_services\|psc]] ===
	Besides IPC changes, a vuln was [[Switch_System_Flaws\|fixed]].		Besides IPC changes, a vuln was [[Switch_System_Flaws\|fixed]].

Yellows8 at 02:22, 17 October 2023

2023-10-17T00:22:32Z

← Older revision		Revision as of 04:22, 17 October 2023
Line 1:		Line 1:
	The Switch 17.0.0 system update was released on October 11, 2023 (UTC). This Switch update was released for the following regions: ALL, and CHN.		The Switch 17.0.0 system update was released on October 11, 2023 (UTC). This Switch update was released for the following regions: ALL, and CHN.

	Security flaws fixed: ~~<fill this in manually later, see the updatedetails page from the ninupdates-report page(s) once available for now>~~.		Security flaws fixed: yes.

	==Change-log==		==Change-log==
Line 418:		Line 418:
	* KSleepManager's no longer saves and restores tcr_el1 when saving/restoring system registers.		* KSleepManager's no longer saves and restores tcr_el1 when saving/restoring system registers.

			=== [[NS_services\|ns]] ===
			Besides IPC changes, a vuln was [[Switch_System_Flaws\|fixed]].

	==See Also==		==See Also==

SciresM: secmon diff

2023-10-11T04:16:53Z

secmon diff

← Older revision		Revision as of 08:16, 11 October 2023
Line 319:		Line 319:

	The anti-downgrade fuses were [[Fuses#Anti-downgrade\|updated]].		The anti-downgrade fuses were [[Fuses#Anti-downgrade\|updated]].

			==== Secure Monitor ====
			* Support for a new EsCommonKeyType was added (type = 2).
			** Previously, only 0 (TitleKey) and 1 (ArchiveKey) were supported.
			** Correspondingly, PrepareEsDeviceUniqueKeyOption's type field is now bits 6-7 instead of just bit 6.


	==== Kernel ====		==== Kernel ====

SciresM: Add kernel diff

2023-10-11T04:00:12Z

Add kernel diff

← Older revision		Revision as of 08:00, 11 October 2023
Line 319:		Line 319:

	The anti-downgrade fuses were [[Fuses#Anti-downgrade\|updated]].		The anti-downgrade fuses were [[Fuses#Anti-downgrade\|updated]].

			==== Kernel ====
			* Compiler/libc changes:
			** The kernel is now linked using RELR for relocations instead of RELA (see compiler support in lld for .relr.dyn).
			** This greatly reduces the relocations segment size; it has decreased from 0x3A50 bytes in 16.0.0 to 0x90 in 17.0.0.
			** Many minor optimization changes, e.g. mul+add -> madd, madd -> smaddl/umaddl, (a + b - 1) >> 36 is now (a + b) > 0x1000000000, various reordering.
			* crt0 changes:
			** crt0 is no longer located at _start, instead _start is `b crt0` followed by 0x7FC of zeroes.
			** crt0 is now located at the start of .rodata.
			*** The crt0 page is now identity-mapped R-X in .rodata instead of RWX at start-of-text.
			** Many system registers which were previously set from KInitArguments are now set using a register constants table in the crt0 .rodata segment.
			*** These are ttbr0_el1, ttbr1_el1, tcr_el1, mair_el1, and sctlr_el1.
			*** This table is initially zeroes, and is initialized to the correct values by KernelLdr before returning to Kernel/setting permissions.
			** Kernel Map now stores offsets relative to itself rather than relative to _start.
			*** Kernel map also now stores an additional offset (to the "register constants").
			** The big idea here is to make the crt0 page no longer executable after init.
			*** This mitigates the ability to execute gadgets (via ROP/etc) to set TTBR1_EL1 (and other important registers) to user-controlled values.
			**** The only ttbr1_el1 gadget in all of kernel now sets it to the constant in .rodata, which can't be modified after KernelLdr finishes.
			*** This also enables setting the WXN bit while still identity-mapped, instead of having to do it later in boot.
			* KernelLdr changes:
			** INI1 is now used in-place, if KSystemControl does not have a preferred layout.
			* Initialize0 changes:
			** Initialize0 now receives the initial process binary size from KernelLdr and stores it in a global.
			*** Initialize1 forwards this to the rest of the kernel as with the address.
			** Initialize0 no longer memsets the slab region to zero before calling the ifdef'd out function for the unknown debug region.
			*** This is now done by InitializeSlabHeaps().
			* All exception returns now migitate post-eret speculative execution.
			** All "eret" instructions are now "eret; dsb nsh; isb;"
			* KInitialPageAllocator::Allocate(Aligned) now memsets the pages to zero before returning them to the caller.
			** Correspondingly, KInitialPageTable no longer memsets those pages to zero after allocating them.
			* KInitialProcessReader::CreateProcessParameter now ands sizes with 0x1FFFFF000 before overflow checking.
			** This may actually just be compiler-garbage due to the types being u32-cast-to-higher-width?
			* CreateAndStartInitialProcesses changes:
			** A difference check is now an != when allocating page group.
			** Segment loading/uncompressing has now been refactored:
			*** The entire page group is no longer mapped while loading the segments.
			*** KInitialProcessReader::Load is now responsible; it now takes the page group as argument, clears bss (using linear map), and then calls a helper to load each segment.
			**** This helper creates a page group for just the pages relevant to the segment, copies the data (using linear map), and then if compressed maps the page group, uncompresses, and unmaps.
			* KMemoryRegionType had a number of large changes:
			** A new memory type is now inserted after the SecureAppletMemory region (id is 0xC200028E).
			** Low 0x2 ID derivations changed to accommodate this.
			** As a knock-on effect(?) type IDs for pool partitions changed substantially (likely due to derivation changes elsewhere).
			* New KProcess field ("has application system resource").
			** This is set to 1 when initializing a KProcess with CreateProcessFlag_IsApplication and system_resource_num_pages == 0.
			** When this is true, svc::GetInfo() always returns 0 for InfoType_SystemResourceSizeTotal and InfoType_SystemResourceSizeUsed.
			*** This also modifies the calculations for various SystemResourceSize calculations.
			*** MapPhysicalMemory() and UnmapPhysicalMemory() will also now return svc::ResultInvalidState().
			* The KProcess::Initialize() overload used by initial processes now supports system_resource_num_pages != 0 (and allocates a system resource in this case).
			** NOTE: KInitialProcessReader::CreateProcessParameter still hardcodes param->system_resource_num_pages = 0 for all KIPs.
			* Changes to KPageTable(Base) around KMemoryState:
			** There is no longer a bijective mapping between svc::MemoryState and kern::KMemoryState.
			** In particular, KMemoryState_Io has been split into two memory states:
			*** KMemoryState_Io(Register) no longer has bit 13 (0x2000) set (new value is 0x180001).
			*** For memory mapped with SvcMapIoRegion called with svc::MemoryMapping_Memory, KMemoryState_Io(Memory) retains that bit set (value is 0x182001).
			*** KPageTableBase functions dealing with Io mappings now take in MemoryState arguments, and/or MemoryMapping arguments (for the IoRegion functions).
			** KMemoryState_ThreadLocal no longer has bit 13 (0x2000) set (new value is 0x400000C).
			** KMemoryState_Kernel no longer has bit 13 (0x2000) set (new value is 0x13).
			** KMemoryState_Static no longer has bit 13 (0x2000) set (new value is 0x40002).
			** KMemoryState_Insecure now supports FlagCanQueryPhysical (new value is 0x55C3817).
			** To accommodate this, KPageTableBase::QueryMapping/Contains/GetRegionAddress/GetRegionSize now take an svc::MemoryState (u8) instead of the full KMemoryState.
			*** In a (presumably) happy accident, this produces much, much better assembly for the switch statement.
			** KPageTableBase::CheckMemoryState was made ALWAYS_INLINE and now calls an impl-func which takes KMemoryBlock * as argument.
			* KPageTableBase::MapPageGroup no longer sets the io bit in page properties.
			** This is the overload used by process creation.
			* KMemoryBlockManager::UpdateIfMatch now takes set_disable_attr, clear_disable_attr.
			** KPageTableBase::MapPhysicalMemory passes true for set_disable_attr if the address is exactly the start of the alias region.
			* KPageTableBase::UnmapPhysicalMemory now passes clear_disable_attr = 1 to KMemoryManager::Update if the address is exactly the start of the alias region.
			* KProcessPageTable::Initialize no longer has an unused truncated-process-id argument.
			* Changes to KPageTable(Base) mapping for first-reference:
			** KPageTable::Operate is no longer allowed to take MapFirst as operation.
			** KPageTable::MapContiguousWithBaseAttribute no longer supports not_first argument, always calls OpenAdditionalReference.
			** KPageTable::OperateOnPageGroup is now allowed to take MapFirst as operation, and MapWithPageGroup can now call OpenFirst or OpenAdditional for page group references.
			** KPageTableBase::AllocatePageGroupAndOperate now passes MapFirst.
			* Miscellaneous page table changes:
			** KSupervisorPageTable::Initialize now checks that the WXN bit is set in sctlr_el1 instead of setting it.
			** KPageTable::Finalize now calls a second OnFinalize() stub after NoteUpdated().
			* KPageTableBase::MapStatic alignment checks were loosened/changed.
			* New KMemoryAttribute bit 0x10 ("PermissionLocked").
			** This can be set via SvcSetMemoryAttribute.
			*** NOTE: Once set, this bit is irrevocable and can never be unset.
			**** This is to enable relro (read only relocations).
			*** This requires a new KMemoryStateFlag (bit 27) "FlagCanPermissionLock", which is set only on CodeData and AliasCodeData.
			** KPageTable::SetMemoryAttribute now calls a new KMemoryBlockManager::UpdateAttributes function specifically for updating the attributes.
			** This bit is allowed to be set when unmapped CodeMemory (as it can be set on (Alias)CodeData).
			* HandleException now uses UserspaceAccess functions to retrieve the instruction when EsrEc is Unknown, IllegalState, Bkpt, or Brk.
			* InvalidateProcessDataCache now special-cases being called on the current process, with a simpler (new) KPageTableBase function.
			* Changes around signaling/thread termination.
			** KThread::BeginTerminate no longer calls NotifyAvailable on the thread.
			** KThread::DoWorkerTask now acquires the scheduler lock and calls NotifyAvailable on the thread.
			** KThread and KProcess exit now use separate KWorkerTaskManagers (0 = Thread, 1 = Process).
			*** Main() now initializes the two KWorkerTaskManagers, and now aborts if their priorities (both constant 11) are zero.
			* KSleepManager's no longer saves and restores tcr_el1 when saving/restoring system registers.


	==See Also==		==See Also==

Yls8bot at 03:45, 11 October 2023

2023-10-11T01:45:12Z

← Older revision		Revision as of 05:45, 11 October 2023
Line 317:		Line 317:
	** 0100000000000003 (ProcessMana): MainThreadStackSize updated: 0x1000 -> 0x3000.		** 0100000000000003 (ProcessMana): MainThreadStackSize updated: 0x1000 -> 0x3000.
	** 0100000000000005 (boot): SVC access: added CreateEvent.		** 0100000000000005 (boot): SVC access: added CreateEvent.

			The anti-downgrade fuses were [[Fuses#Anti-downgrade\|updated]].

	==See Also==		==See Also==

SciresM: Add 16 -> 17 ipc diff

2023-10-11T01:13:11Z

Add 16 -> 17 ipc diff

Show changes

← Older revision		Revision as of 20:32, 20 October 2023
Line 419:		Line 419:

	=== [[NS_services\|ns]] ===		=== [[NS_services\|ns]] ===
			Besides IPC changes, a vuln was [[Switch_System_Flaws\|fixed]].

			=== [[PSC_services\|psc]] ===
	Besides IPC changes, a vuln was [[Switch_System_Flaws\|fixed]].		Besides IPC changes, a vuln was [[Switch_System_Flaws\|fixed]].