Nintendo Switch Brew

NPDM: Difference between revisions

← Older edit
Lioncache (talk | contribs)
92 edits
Add a few missing entries to the FS permission bit flags
 
(38 intermediate revisions by 7 users not shown)
Line 9: Line 9:
| 0x0
| 0x0
| 0x80
| 0x80
| META
| [[#META|META]]
|-
|-
| 0x80
| 0x80
| <Varies>
| <Varies>
| ACID
| [[#ACID|ACID]]
|-
|-
| <See META>
| <See META>
| <See META>
| <See META>
| ACI0
| [[#ACI0|ACI0]]
|}
|}


Line 29: Line 29:
| 0x0
| 0x0
| 0x4
| 0x4
| Magicnum "META"
| Magic ("META")
|-
|-
| 0x4
| 0x4
| 0x4
| [9.0.0+] SignatureKeyGeneration
|-
| 0x8
| 0x8
| 0x4
| Reserved
| Reserved
|-
|-
| 0xC
| 0xC
| 0x1
| 0x1
| MMU flags (bit0 = use 64-bit instructions, bit1 = use 64-bit address space, bit2 = use 32-bit address space, bit3 = use 32-bit address space without reserved region)
| [[#Flags|Flags]]
|-
|-
| 0xD
| 0xD
Line 45: Line 49:
| 0xE
| 0xE
| 0x1
| 0x1
| Main thread priority (0-63)
| [[#MainThreadPriority|MainThreadPriority]]
|-
|-
| 0xF
| 0xF
| 0x1
| 0x1
| Main thread core number
| MainThreadCoreNumber
|-
|-
| 0x10
| 0x10
Line 57: Line 61:
| 0x14
| 0x14
| 0x4
| 0x4
| [3.0.0+] System resource (PersonalMmHeap) size (max size as of 5.x: 534773760)
| [3.0.0+] [[#SystemResourceSize|SystemResourceSize]]
|-
|-
| 0x18
| 0x18
| 0x4
| 0x4
| Process category (0 = regular title, 1 = kernel built-in)
| [[#Version|Version]]
|-
|-
| 0x1C
| 0x1C
| 0x4
| 0x4
| Main thread stack size (Should(?) be page-aligned. In non-nspwn scenarios, values of 0 can also rarely break in Horizon. This might be something auto-adapting or a security feature of some sort?)
| [[#MainThreadStackSize|MainThreadStackSize]]
|-
|-
| 0x20
| 0x20
| 0x10
| 0x10
| Title name (usually/always "Application")
| Name (usually/always "Application")
|-
|-
| 0x30
| 0x30
| 0x10
| 0x10
| Product code (usually/always all zeroes)
| ProductCode (usually/always all zeroes)
|-
|-
| 0x40
| 0x40
Line 81: Line 85:
| 0x70
| 0x70
| 0x4
| 0x4
| [[#ACI0]] offset
| [[#ACI0|AciOffset]]
|-
|-
| 0x74
| 0x74
| 0x4
| 0x4
| [[#ACI0]] size
| [[#ACI0|AciSize]]
|-
|-
| 0x78
| 0x78
| 0x4
| 0x4
| [[#ACID]] offset
| [[#ACID|AcidOffset]]
|-
|-
| 0x7C
| 0x7C
| 0x4
| 0x4
| [[#ACID]] size
| [[#ACID|AcidSize]]
|}
|}
== Flags ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0
| Is64BitInstruction
|-
| 1-3
| ProcessAddressSpace (0x00 = AddressSpace32Bit, 0x01 = AddressSpace64BitOld, 0x02 = AddressSpace32BitNoReserved, 0x03 = AddressSpace64Bit)
|-
| 4
| [7.0.0+] OptimizeMemoryAllocation
|-
| 5
| [11.0.0+] DisableDeviceAddressSpaceMerge
|-
| 6
| [18.0.0+] EnableAliasRegionExtraSize
|-
| 7
| [19.0.0+] PreventCodeReads
|}
== MainThreadPriority ==
Ranges from 0 to 0x3F.
== SystemResourceSize ==
When this is non-zero, the kernel reserves this amount of memory and dynamically uses it as needed for page table pages, KMemoryBlocks, and KBlockInfos. When this is zero, the process uses global shared heaps for these.
This enables a process to sacrifice some of the memory available to it in order to have higher limits on these resources, thus enabling the use of SvcMapPhysicalMemory.
Maximum size as is 0x1FE00000.
== Version ==
0 for all titles.
[8.1.0+] Now set to 1 for certain titles.
[9.0.0+] Now set to a proper version field for all titles.
== MainThreadStackSize ==
Must be aligned to 0x1000. If zero, kernel will start the process's initial thread with sp=0.


= ACID =
= ACID =
Line 113: Line 163:
| 0x200
| 0x200
| 0x4
| 0x4
| Magicnum "ACID"
| Magic ("ACID")
|-
|-
| 0x204
| 0x204
| 0x4
| 0x4
| Data size
| Size
|-
|-
| 0x208
| 0x208
| 0x4
| 0x1
| [9.0.0+] Version
|-
| 0x209
| 0x1
| [14.0.0+]
|-
| 0x20A
| 0x2
| Reserved
| Reserved
|-
|-
| 0x20C
| 0x20C
| 0x4
| 0x4
| Flags (bit0 = ProductionFlag, bit1 = UnqualifiedApproval, [5.0.0+] bit2-3: PoolPartition? For applets set to 0b01, for sysmodules set to 0b10. Exceptions: "starter" is set to 0, "nvservices" is set to 3)
| [[#Flags_2|Flags]]
|-
|-
| 0x210
| 0x210
| 0x8
| 0x8
| TitleIdRange_Min
| ProgramIdMin
|-
|-
| 0x218
| 0x218
| 0x8
| 0x8
| TitleIdRange_Max
| ProgramIdMax
|-
|-
| 0x220
| 0x220
| 0x4
| 0x4
| [[#FS Access Control]] offset
| [[#FsAccessControl|FacOffset]]
|-
|-
| 0x224
| 0x224
| 0x4
| 0x4
| [[#FS Access Control]] size
| [[#FsAccessControl|FacSize]]
|-
|-
| 0x228
| 0x228
| 0x4
| 0x4
| [[#Service Access Control]] offset
| [[#SrvAccessControl|SacOffset]]
|-
|-
| 0x22C
| 0x22C
| 0x4
| 0x4
| [[#Service Access Control]] size
| [[#SrvAccessControl|SacSize]]
|-
|-
| 0x230
| 0x230
| 0x4
| 0x4
| [[#Kernel Access Control]] offset
| [[#KernelCapability|KcOffset]]
|-
|-
| 0x234
| 0x234
| 0x4
| 0x4
| [[#Kernel Access Control]] size
| [[#KernelCapability|KcSize]]
|-
|-
| 0x238
| 0x238
Line 163: Line 221:
| Reserved
| Reserved
|}
|}
== Flags ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 0
| ProductionFlag
|-
| 1
| UnqualifiedApproval
|-
| 2-5
| [5.0.0+] MemoryRegion (0 = Application, 1 = Applet, 2 = SecureSystem, 3 = NonSecureSystem)
|}
MemoryRegion is set to Application for "starter" and NonSecureSystem for "nvservices".


= ACI0 =
= ACI0 =
Line 173: Line 249:
| 0x0
| 0x0
| 0x4
| 0x4
| Magicnum "ACI0"
| Magic ("ACI0")
|-
|-
| 0x4
| 0x4
Line 181: Line 257:
| 0x10
| 0x10
| 0x8
| 0x8
| Title ID
| ProgramId
|-
|-
| 0x18
| 0x18
Line 189: Line 265:
| 0x20
| 0x20
| 0x4
| 0x4
| [[#FS Access Header]] offset
| [[#FsAccessControl|FacOffset]]
|-
|-
| 0x24
| 0x24
| 0x4
| 0x4
| [[#FS Access Header]] size
| [[#FsAccessControl|FacSize]]
|-
|-
| 0x28
| 0x28
| 0x4
| 0x4
| [[#Service Access Control]] offset
| [[#SrvAccessControl|SacOffset]]
|-
|-
| 0x2C
| 0x2C
| 0x4
| 0x4
| [[#Service Access Control]] size
| [[#SrvAccessControl|SacSize]]
|-
|-
| 0x30
| 0x30
| 0x4
| 0x4
| [[#Kernel Access Control]] offset
| [[#KernelCapability|KcOffset]]
|-
|-
| 0x34
| 0x34
| 0x4
| 0x4
| [[#Kernel Access Control]] size
| [[#KernelCapability|KcSize]]
|-
|-
| 0x38
| 0x38
Line 216: Line 292:
|}
|}


= FS Access Header =
= FsAccessControl =
For [[#ACID|ACID]] this is a simple descriptor as follows:
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 228: Line 305:
|-
|-
| 0x1
| 0x1
| 0x1
| [5.0.0+] ContentOwnerIdCount
|-
| 0x2
| 0x1
| [5.0.0+] SaveDataOwnerIdCount
|-
| 0x3
| 0x3
| 0x1
| Padding
| Padding
|-
|-
| 0x4
| 0x4
| 0x8
| 0x8
| Permissions bitmask
| [[#FsAccessFlag|FsAccessFlag]]
|-
|-
| 0xC
| 0xC
| 0x4
| 0x8
| Data Size (always 0x1C)
| ContentOwnerIdMin
|-
| 0x10
| 0x4
| Size of Content Owner ID section.
|-
|-
| 0x14
| 0x14
| 0x4
| 0x8
| Data size (0x1C) plus Content Owner size
| ContentOwnerIdMax
|-
| 0x18
| 0x4
| Size of Save Data owners section (for applications that wish to share save data?)
|-
|-
| 0x1C
| 0x1C
| 0x4
| 0x8
| (OPTIONAL) Amount of content owner id's
| SaveDataOwnerIdMin
|-
|-
| 0x1C
| 0x24
| 0x8 * Content Owner ID's
| 0x8
| Content owner ID's as uint64's.
| SaveDataOwnerIdMax
|-
|-
| VARIABLE
| 0x2C
| 0x4
| 0x8 * ContentOwnerIdCount
| Amount of save owner id's
| [5.0.0+] ContentOwnerIds
|-
|-
| VARIABLE
| Variable
| 0x1 * Save data owner accessibilities (?)
| 0x8 * SaveDataOwnerIdCount
| Sets flags for what save data owners can do with other applications save data (?)
| [5.0.0+] SaveDataOwnerIds
|-
| VARIABLE (Pad to nearest 4 bytes)
| 0x8 * Amount of save owner ID's
| Save data owner ID's
|}
|}


= FS Access Control =
For [[#ACI0|ACI0]] this embeds data as follows:
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
Line 289: Line 362:
| 0x4
| 0x4
| 0x8
| 0x8
| Permissions bitmask
| [[#FsAccessFlag|FsAccessFlag]]
|-
|-
| 0xC
| 0xC
| 0x20
| 0x4
| Reserved
| ContentOwnerInfoOffset
|-
| 0x10
| 0x4
| ContentOwnerInfoSize
|-
| 0x14
| 0x4
| SaveDataOwnerInfoOffset
|-
| 0x18
| 0x4
| SaveDataOwnerInfoSize
|-
| 0x1C
| 0x4
| (Optional) ContentOwnerIdCount
|-
| 0x1C
| 0x8 * ContentOwnerIdCount
| ContentOwnerIds
|-
| Variable
| 0x4
| SaveDataOwnerIdCount
|-
| Variable
| 0x1 * SaveDataOwnerIdCount
| Accessibilities (1=Read, 2=Write, 3=ReadWrite)
|-
| Variable (padded to nearest 4 bytes)
| 0x8 * SaveDataOwnerIdCount
| SaveDataOwnerIds
|}
|}


[[Filesystem_services#Permissions|Permissions]] bitmask:
== FsAccessFlag ==
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Bit
! Bits
! Name
! Name
! Description
! Description
Line 392: Line 497:
|-
|-
| 22
| 22
|  
| Host
|  
|  
|-
|-
| 23
| 23
|  
| FillBis
|  
|  
|-
|-
| 24
| 24
|  
| CorruptSaveData
|  
|  
|-
|-
| 25
| 25
|  
| SaveDataForDebug
|  
|  
|-
|-
Line 420: Line 525:
|-
|-
| 29
| 29
|  
| RegisterUpdatePartition
|  
|  
|-
|-
Line 432: Line 537:
|-
|-
| 32
| 32
|  
| AccessFailureResolution
|  
|  
|-
|-
Line 440: Line 545:
|-
|-
| 34
| 34
| RegisterProgramIndexMapInfo
|
|-
| 35
| CreateOwnSaveData
|
|-
| 36
| MoveCacheStorage
|
|-
| 37
| DeviceTreeBlob
|
|-
| 38
| NotifyErrorContextServiceReady
|
|-
| 39
| CalibrationSystemData
|
|-
| 40
| CalibrationLog
|
|-
| 41
| StorageSecure
|
|-
| 42
| StorageControl
|
|-
| 43
| GameCardReport
|  
|  
| Enables access to [[Filesystem_services|Bis]] partitionID 27 and 28?
|-
|-
| 35-61
| 44
| MarkBeforeEraseBis
|
|-
| 45-61
| Reserved
| Reserved
|  
|  
Line 455: Line 600:
| Enables access to everything: all [[Filesystem_services#Permissions|permission types]] which check a bitmask have this bit set.
| Enables access to everything: all [[Filesystem_services#Permissions|permission types]] which check a bitmask have this bit set.
|}
|}
Controls the [[Filesystem_services#Permissions|filesystem permissions]].


Web-applets permissions:
Web-applets permissions:
Line 461: Line 608:


= Service Access Control =
= Service Access Control =
This is a list of [[Services_API|service]]-name strings which the title has access to, with the following structure:
{| class="wikitable" border="1"
  +0: control_byte
|-
  +1: {service-name without nul-terminator}
! Bits
! Description
|-
| 0-2
| Size (length of the service-name without null-terminator minus 1)
|-
| 7
| IsServer (service is allowed to be registered)
|-
| Variable
| Name
|}


Bitmask 0x07 in control_byte is the {length of the service-name without nul-terminator} - 1.
This is a list of [[Services_API|service]]-name strings which the title has access to.


Bitmask 0x80 in control_byte means service is allowed to be registered.
The service name string starts after the first byte and supports the wildcard <code>*</code> character.
 
The service string can contain a wildcard <code>*</code> character.
 
= Kernel Access Control =
On Switch, descriptors are identified by pattern 01..11 in low bits.


= KernelCapability =
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Pattern of lower bits
! Pattern of lower bits
! Lowest clear bitmask/bit
! Lowest clear bitmask/bit
! Type
! Description
! Fields
|-
|-
| <code>0bxxxxxxxxxxxx0111</code>
| <code>0bxxxxxxxxxxxx0111</code>
| Bit3
| Bit3
| KernelFlags
| [[#ThreadInfo]]
| Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio
|-
|-
| <code>0bxxxxxxxxxxx01111</code>
| <code>0bxxxxxxxxxxx01111</code>
| Bit4
| Bit4
| SyscallMask
| [[#EnableSystemCalls]]
| Bits 29-31: Syscall mask table index; Bits 5-28: Mask
|-
|-
| <code>0bxxxxxxxxx0111111</code>
| <code>0bxxxxxxxxx0111111</code>
| Bit6
| Bit6
| MapIoOrNormalRange
| [[#MemoryMap]]
| Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag
|-
|-
| <code>0bxxxxxxxx01111111</code>
| <code>0bxxxxxxxx01111111</code>
| Bit7
| Bit7
| MapNormalPage (RW)
| [[#IoMemoryMap]]
| Bits 8-31: Page
|-
| <code>0bxxxxx01111111111</code>
| Bit10
| [8.0.0+] [[#MemoryRegionMap]]
|-
|-
| <code>0bxxxx011111111111</code>
| <code>0bxxxx011111111111</code>
| Bit11
| Bit11
| InterruptPair
| [[#EnableInterrupts]]
| Bits 12-21: Irq0, bits 22-31: Irq1, 0x3FF means empty.
|-
|-
| <code>0bxx01111111111111</code>
| <code>0bxx01111111111111</code>
| Bit13
| Bit13
| ApplicationType
| [[#MiscParams]]
| Bit16-14: ApplicationType (0=sysmodule, 1=application, 2=applet), bit16 ignored. Parsed by [[Process Manager services]]. Defaults to 0 if descriptor doesn't exist. Can only run 1 application at a time.
|-
|-
| <code>0bx011111111111111</code>
| <code>0bx011111111111111</code>
| Bit14
| Bit14
| KernelReleaseVersion
| [[#KernelVersion]]
| Bits 15-X: Version. The raw descriptor is compared with 0x80000, when less than an error is returned. This is equivalent to comparing the bits starting at bit15 with 0x10. This enforces a minimum required version, not a maximum.
|-
|-
| <code>0b0111111111111111</code>
| <code>0b0111111111111111</code>
| Bit15
| Bit15
| HandleTableSize
| [[#HandleTableSize]]
| Bit25-16: Number of handles the table shall fit.
|-
|-
| <code>0b1111111111111111</code>
| <code>0b1111111111111111</code>
| Bit16
| Bit16
| DebugFlags
| [[#MiscFlags]]
| Bit17: can be debugged, bit18: can debug others
|-
|-
| All ones
| All ones
|  
|  
| Ignored
| Invalid
|
|}
 
These descriptors are identified by pattern 01..11 in low bits.
 
== ThreadInfo ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 4-9
| LowestPriority
|-
| 10-15
| HighestPriority
|-
| 16-23
| MinCoreNumber
|-
| 24-31
| MaxCoreNumber
|}
 
== EnableSystemCalls ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 5-28
| SystemCallId
|-
| 29-31
| Index
|}
 
== MemoryMap ==
MemoryMap entries are stored in pairs. The first pair will contain BeginAddress and PermissionType, while the second pair will contain Size and MappingType.
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 7-30
| BeginAddress
|-
| 31
| PermissionType (0=RW, 1=RO)
|}
 
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 7-26
| Size
|-
| 27-30
| Reserved
|-
| 31
| MappingType (0=Io, 1=Static)
|}
|}


== Mapping restrictions ==
=== Restrictions ===
The physaddr range 0x80060000-0x2000000000 is not allowed to be mapped as IO.
The physaddr range 0x80060000-0x2000000000 is not allowed to be mapped as IO.
The physaddr range 0x80000000-0x2000000000 is not allowed to be mapped as Normal.
The physaddr range 0x80000000-0x2000000000 is not allowed to be mapped as Normal.
Line 549: Line 759:
[5.0.0+] For IO, this blacklist was abandoned and instead two range checks were added. For Normal mappings it is still applied
[5.0.0+] For IO, this blacklist was abandoned and instead two range checks were added. For Normal mappings it is still applied


== Kernel versions ==
== IoMemoryMap ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 8-31
| BeginAddress
|}
 
== MemoryRegionMap ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 11-16
| RegionType0 (0 = NoMapping, 1 = KernelTraceBuffer, 2 = OnMemoryBootImage, 3 = DTB)
|-
| 17
| RegionIsReadOnly0
|-
| 18-23
| RegionType1 (0 = NoMapping, 1 = KernelTraceBuffer, 2 = OnMemoryBootImage, 3 = DTB)
|-
| 24
| RegionIsReadOnly1
|-
| 25-30
| RegionType2 (0 = NoMapping, 1 = KernelTraceBuffer, 2 = OnMemoryBootImage, 3 = DTB)
|-
| 31
| RegionIsReadOnly2
|}
 
== EnableInterrupts ==
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Firmware || Kernel Version || Minimum Allowed
! Bits
! Description
|-
|-
| 1.0.0 || 5.0.0 || 3.0.0
| 12-21
| InterruptNumber0
|-
|-
| 2.0.0 || 6.1.0 || 3.0.0
| 22-31
| InterruptNumber1
|}
 
0x3FF means empty.
 
== MiscParams ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 14-16
| ProgramType (0 = System, 1 = Application, 2 = Applet)
|}
 
ProgramType is parsed by [[Process Manager services]]. Defaults to 0 if descriptor doesn't exist. Can only run 1 application at a time.
 
== KernelVersion ==
{| class="wikitable" border="1"
|-
|-
| 3.0.0 || 7.4.0 || 3.0.0
! Bits
! Description
|-
|-
| 3.0.2 || 7.4.0 || 3.0.0
| 15-18
| MinorVersion
|-
|-
| 5.0.0 || 9.3.0 || 3.0.0
| 19-31
| MajorVersion
|}
|}


Bit31-19: Major version</br>
This encodes the intended kernel version for the program.
Bit18-15: Minor version</br>
 
Bit14-0: Zeroes
The kernel requires that the intended version is >= the minimum supported version (3.0 for all released kernels), and <= the current version.
 
Kernel version is derived from/equivalent to SDK version:
* Kernel Major = SDK Major + 4
* Kernel Minor = SDK Minor
 
=== Versions ===
{| class="wikitable" border="1"
|-
! Firmware || Kernel Version || Corresponding SDK Version
|-
| 1.0.0 || 5.0 || 1.0.0.0
|-
| 2.0.0 || 6.1 || 2.1.0.0
|-
| 3.0.0 || 7.4 || 3.4.0.0
|-
| 3.0.2 || 7.4 || 3.4.0.0
|-
| 5.0.0 || 9.3 || 5.3.0.0
|-
| 10.0.0 || 14.4 || 10.4.0.0
|-
| 11.0.0 || 15.4 || 11.4.0.0
|-
| 11.0.1 || 15.4 || 11.4.0.0
|}
 
== HandleTableSize ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 16-25
| HandleTableSize
|}
 
== MiscFlags ==
{| class="wikitable" border="1"
|-
! Bits
! Description
|-
| 17
| EnableDebug
|-
| 18
| [19.0.0+] ForceDebugProd ([1.0.0-18.1.0] ForceDebug)
|-
| 19
| [19.0.0+] ForceDebug
|}
Retrieved from "https://switchbrew.org/wiki/NPDM"