SVC
System calls
| Id | Name | In | Out |
|---|---|---|---|
| 0x1 | #svcSetHeapSize | W1=size | W0=result, X1=outaddr |
| 0x2 | #svcSetMemoryPermission | X0=addr, X1=size, W2=prot | W0=result |
| 0x3 | #svcSetMemoryAttribute | X0=addr, X1=size, W2=state0, W3=state1 | W0=result |
| 0x4 | #svcMapMemory | X0=dstaddr, X1=srcaddr, X2=size | W0=result |
| 0x5 | #svcUnmapMemory | X0=dstaddr, X1=srcaddr, X2=size | W0=result |
| 0x6 | #svcQueryMemory | X0=MemoryInfo*, X2=addr | W0=result, W1=PageInfo |
| 0x7 | #svcExitProcess | None | |
| 0x8 | #svcCreateThread | X1=entry, X2=arg, X3=stacktop, W4=prio, W5=processor_id | W0=result, W1=handle |
| 0x9 | #svcStartThread | W0=thread_handle | W0=result |
| 0xA | #svcExitThread | None | |
| 0xB | #svcSleepThread | X0=nano | W0=result |
| 0xC | #svcGetThreadPriority | W1=thread_handle | W0=result, W1=prio |
| 0xD | #svcSetThreadPriority | W0=thread_handle, W1=prio | W0=result |
| 0xE | #svcGetThreadCoreMask | W2=thread_handle | W0=result, W1=out, X2=out |
| 0xF | #svcSetThreadCoreMask | W0=thread_handle, W1=in, X2=in2 | W0=result |
| 0x10 | #svcGetCurrentProcessorNumber | None | W0/X0=cpuid |
| 0x11 | svcSignalEvent | W0=wevent_handle | W0=result |
| 0x12 | svcClearEvent | W0=wevent_or_revent_handle | W0=result |
| 0x13 | #svcMapSharedMemory | W0=memblk_handle, X1=addr, X2=size, W3=perm | W0=result |
| 0x14 | svcUnmapSharedMemory | W0=memblk_handle, X1=addr, X2=size | W0=result |
| 0x15 | #svcCreateTransferMemory | X1=addr, X2=size, W3=perm | W0=result, W1=handle |
| 0x16 | svcCloseHandle | W0=handle | W0=result |
| 0x17 | svcResetSignal | W0=handle | W0=result |
| 0x18 | #svcWaitSynchronization | X1=handles_ptr, W2=num_handles. X3=timeout | W0=result, W1=handle_idx |
| 0x19 | svcCancelSynchronization | W0=handle | W0=result |
| 0x1A | svcArbitrateLock | W0=cur_thread_handle, X1=ptr, W2=req_thread_handle | |
| 0x1B | svcArbitrateUnlock | X0=ptr | |
| 0x1C | svcWaitProcessWideKeyAtomic | X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout | W0=result |
| 0x1D | svcSignalProcessWideKey | X0=ptr, W1=value | W0=result |
| 0x1E | svcGetSystemTick | X0={value of cntpct_el0} | |
| 0x1F | svcConnectToNamedPort | X1=port_name_str | W0=result, W1=handle |
| 0x20 | svcSendSyncRequestLight | ||
| 0x21 | svcSendSyncRequest | X0=handle | W0=result |
| 0x22 | #svcSendSyncRequestWithUserBuffer | X0=cmdbufptr, X1=size, X2=handle | W0=result |
| 0x23 | svcSendAsyncRequestWithUserBuffer | ||
| 0x24 | svcGetProcessId | ||
| 0x25 | svcGetThreadId | W0=thread_handle | W0=result, X1=out |
| 0x26 | svcBreak | X0,X1,X2=info | ? |
| 0x27 | svcOutputDebugString | X0=str, X1=size | |
| 0x28 | svcReturnFromException | X0=result | |
| 0x29 | #svcGetInfo | X1=info_id, X2=handle, X3=info_sub_id | W0=result, X1=out |
| 0x2A | svcFlushEntireDataCache | ||
| 0x2B | svcFlushDataCache | ||
| 0x2C | [3.0.0+] svcMapPhysicalMemory | ||
| 0x2D | [3.0.0+] svcUnmapPhysicalMemory | ||
| .... | ? | ? | ? |
| 0x2F | svcGetLastThreadInfo | ||
| 0x30 | svcGetResourceLimitLimitValue | ||
| 0x31 | svcGetResourceLimitCurrentValue | ||
| 0x32 | svcSetThreadActivity | ||
| 0x33 | svcGetThreadContext3 | ||
| 0x3C | svcDumpInfo | ||
| 0x40 | svcCreateSession | W2=?, X3=? | W0=result, W1=client_handle, W2=server_handle |
| 0x41 | svcAcceptSession | W1=port_handle | W0=result, W1=session_handle |
| 0x42 | svcReplyAndReceiveLight | ||
| 0x43 | svcReplyAndReceive | X1=ptr_handles, W2=num_handles, X3=replytarget_handle(0=none), X4=timeout | W0=result, W1=handle_idx |
| 0x44 | svcReplyAndReceiveWithUserBuffer | X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=replytarget_handle(0=none), X6=timeout | W0=result, W1=handle_idx |
| 0x45 | svcCreateEvent | None | W0=result, W1=client_handle ?, W2=server_handle ? |
| 0x4D | svcSleepSystem | ||
| 0x4E | #svcReadWriteRegister | X1=reg_addr, W2=rw_mask, W3=in_val | W0=result, W1=out_val |
| 0x4F | svcSetProcessActivity | ||
| 0x50 | #svcCreateSharedMemory | W1=size?, W2=myperm, W3=otherperm | W0=result, W1=handle |
| 0x51 | #svcMapTransferMemory | X0=mirror_handle, X1=addr, X2=size, W3=perm | W0=result |
| 0x52 | #svcUnmapTransferMemory | W0=mirror_handle, X1=addr, X2=size | W0=result |
| 0x53 | svcCreateInterruptEvent | X1=irq_id, W2=flag | W0=result, W1=handle |
| 0x54 | #svcQueryPhysicalAddress | ||
| 0x55 | #svcQueryIoMapping | X1=physaddr, X2=size | W0=result, X1=virtaddr |
| 0x56 | #svcCreateDeviceAddressSpace | X1=dev_as_start_addr, X2=dev_as_end_addr | W0=result, W1=dev_as_handle |
| 0x57 | #svcAttachDeviceAddressSpace | W0=device, X1=dev_as_handle | W0=result |
| 0x58 | #svcDetachDeviceAddressSpace | W0=device, X1=dev_as_handle | W0=result |
| 0x59 | #svcMapDeviceAddressSpaceByForce | W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm | W0=result |
| 0x5A | #svcMapDeviceAddressSpaceAligned | W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr, W5=perm | W0=result |
| 0x5B | svcMapDeviceAddressSpace | ||
| 0x5C | #svcUnmapDeviceAddressSpace | W0=dev_as_handle, W1=proc_handle, X2=dev_map_addr, X3=dev_as_size, X4=dev_as_addr | W0=result |
| 0x5D | svcInvalidateProcessDataCache | ||
| 0x5E | svcStoreProcessDataCache | ||
| 0x5F | svcFlushProcessDataCache | ||
| 0x60 | svcDebugActiveProcess | X1=processID | W0=result, W1=out_debughandle |
| 0x61 | svcBreakDebugProcess | ||
| 0x62 | svcTerminateDebugProcess | ||
| 0x63 | svcGetDebugEvent | X0=DebugEventInfo*, W1=debughandle | W0=result |
| 0x64 | svcContinueDebugEvent | W0=debughandle, W1=flags, X2=? | W0=result |
| 0x65 | svcGetProcessList | ||
| 0x66 | svcGetThreadList | ||
| 0x67 | svcGetDebugThreadContext | X0=ThreadContext*, X1=debughandle, X2=?, W3=? | W0=result |
| 0x68 | svcSetDebugThreadContext | ||
| 0x69 | svcQueryDebugProcessMemory | X0=MemoryInfo*, X2=debughandle, X3=addr | W0=result, W1=PageInfo |
| 0x6A | svcReadDebugProcessMemory | X0=buffer*, X1=debughandle, X2=src_addr, X3=size | W0=result |
| 0x6B | svcWriteDebugProcessMemory | X0=debughandle, X1=buffer*, X2=dst_addr, X3=size | W0=result |
| 0x6C | svcSetHardwareBreakPoint | ||
| 0x6D | svcGetDebugThreadParam | X2=debughandle, X3=?, W4=DebugThreadParam | W0=result, X1=out0, W2=out1 |
| 0x70 | svcCreatePort | ||
| 0x71 | svcManageNamedPort | X1=namestr*, W2=maxsessions(?) | W0=result, W1=outhandle |
| 0x72 | svcConnectToPort | W1=inhandle | W0=result, W1=outhandle |
| 0x73 | svcSetProcessMemoryPermission | ||
| 0x74 | #svcMapProcessMemory | X0=srcaddr, W1=process_handle, X2=dstaddr, X3=size | W0=result |
| 0x75 | #svcUnmapProcessMemory | W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size | W0=result |
| 0x76 | #svcQueryProcessMemory | X0=meminfo_ptr, W2=process_handle, X3=addr | W0=result, W1=pageinfo |
| 0x77 | svcMapProcessCodeMemory | W0=process_handle, X2=dstaddr, X2=srcaddr, X3=size | W0=result |
| 0x78 | svcUnmapProcessCodeMemory | W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size | W0=result |
| 0x79 | #svcCreateProcess | X1=procinfo_ptr, X2=caps_ptr, W3=cap_num | W0=result, W1=process_handle |
| 0x7A | svcStartProcess | W0=proc_handle, W1=main_thread_prio, W2=default_cpuid, W3=main_thread_stacksz | W0=result |
| 0x7B | svcTerminateProcess | ||
| 0x7C | #svcGetProcessInfo | ||
| 0x7D | svcCreateResourceLimit | ||
| 0x7E | svcSetResourceLimitLimitValue | ||
| 0x7F | svcCallSecureMonitor |
svcSetHeapSize
| Argument | Type | Name | Direction |
|---|---|---|---|
| X0 | u64 | Size |
In |
| W0 | #Result | Ret |
Out |
| X1 | u64 | OutAddr |
Out |
Description: Set the process heap to a given Size. It can both extend and shrink the heap.
Size must be a multiple of 0x2000000.
On success, the heap base-address (which is fixed by kernel, aslr'd) is written to OutAddr.
[2.0.0+] Size must be less than 0x18000000.
svcSetMemoryPermission
Description: Change permission of page-aligned memory region.
Bit2 of permission (exec) is not allowed. Setting write-only is not allowed either (bit1).
This can be used to move back and forth between ---, r-- and rw-.
svcSetMemoryAttribute
Description: Change attribute of page-aligned memory region.
This is used to turn on/off caching for a given memory area. Useful when talking to devices such as the GPU.
What happens "under the hood" is the "Memory Attribute Indirection Register" index is changed from 2 to 3 in the MMU descriptor.
| State0 | State1 | Action |
|---|---|---|
| 0 | 0 | Clear bit3 in #MemoryAttribute. |
| 8 | 0 | Clear bit3 in #MemoryAttribute. |
| 8 | 8 | Set bit3 in #MemoryAttribute. |
svcMapMemory
Description: Maps a memory range into a different range.
Mainly used for adding guard pages around stack.
Source range gets reprotected to --- (it can no longer be accessed), and bit0 is set in the source #MemoryAttribute.
If dstaddr >= LowerTreshold, the dst-range is enforced to be within the process' "MapRegion". Code can get the range of this region from #svcGetInfo id0=2,3.
In this case, the mapped memory will have state 0x5C3C0B.
As long as (dstaddr+size) < LowerThreshold, then you can map anywhere but the mapped memory will have state 0x482907 instead.
LowerTreshold is 0x80000000 for 36-bit address spaces, and 0x40000000 for 32-bit ones.
[2.0.0+] Support for the 0x482907 mappings outside the "MapRegion" were removed.
svcUnmapMemory
Description: Unmaps a region that was previously mapped with #svcMapMemory.
It's possible to unmap ranges partially, you don't need to unmap the entire range "in one go".
The srcaddr/dstaddr must match what was given when the pages were originally mapped.
svcQueryMemory
Description: Query information about an address. Will always fetch the lowest page-aligned mapping that contains the provided address.
Outputs a #MemoryInfo struct.
svcExitProcess
Description: Exits the current process.
svcCreateThread
Description: Create a thread in the current process.
Processor_id must be 0,1,2,3 or -2, where -2 uses the default cpuid for process.
svcStartThread
Description: Starts the thread for the provided handle.
svcExitThread
Description: Exits the current thread.
svcSleepThread
Description: Sleep for a specified amount of time, or yield thread.
Setting nano=0 means "yield thread".
svcGetThreadPriority
Description: Get priority of provided thread handle.
svcSetThreadPriority
Description: Set priority of provided thread handle.
Priority is a number 0-0x3F. Lower value means higher priority.
svcGetThreadCoreMask
Description: Get affinity mask of provided thread handle.
svcSetThreadCoreMask
Description: Set affinity mask of provided thread handle.
svcGetCurrentProcessorNumber
Description: Get which cpu is executing the current thread.
Cpu-id is an integer in the range 0-3.
Maps the block supplied by the handle. The required permissions are different for the process that created the handle and all other processes.
Increases reference count for the KSharedMemory object. Thus in order to release the memory associated with the object, all handles to it must be closed and all mappings must be unmapped.
svcCreateTransferMemory
This one reprotects the src block with perms you give it. It also sets bit0 into #MemoryAttribute.
Executable bit perm not allowed.
Closing all handles automatically causes the bit0 in #MemoryAttribute to clear, and the permission to reset.
svcWaitSynchronization
Works with num_handles <= 0x40, error on num_handles == 0.
Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.
svcSendSyncRequestWithUserBuffer
Size must be 0x1000-aligned.
svcBreak
When used on retail where inx0 bit31 is clear, the system will throw a fatal-error. Otherwise when bit31 is set, it will return 0.
svcGetInfo
| Handle type | Id0 | Id1 | Description |
|---|---|---|---|
| Process | 0 | 0 | AllowedCpuIdBitmask |
| Process | 1 | 0 | AllowedThreadPrioBitmask |
| Process | 2 | 0 | ReservedMapRegionBaseAddress |
| Process | 3 | 0 | ReservedMapRegionSize |
| Process | 4 | 0 | ReservedHeapRegionBaseAddress |
| Process | 5 | 0 | ReservedHeapRegionSize |
| Process | 6 | 0 | TotalMemoryUsage |
| Process | 7 | 0 | TotalHeapUsage |
| Zero | 8 | 0 | IsCurrentProcessBeingDebugged |
| Zero | 9 | 0 | Returns ResourceLimit handle for current process. Used by PM. |
| Zero | 10 | -1, {current coreid} | Unknown. Output data changes each time this SVC is used. Global and core-specific tick-count? |
| Zero | 11 | 0-3 | RandomEntropy from current process. TRNG. Used to seed usermode PRNGs. |
| Process | 12 | 0 | [2.0.0+] AddressSpaceStart |
| Process | 13 | 0 | [2.0.0+] AddressSpaceSize |
| Process | 14 | 0 | [2.0.0+] NewReservedRegionStartAddr |
| Process | 15 | 0 | [2.0.0+] NewReservedRegionSize |
| Process | 18 | 0 | [3.0.0+] Title-id. |
| Thread | 0xF0000002 | 0 | Performance counter related. |
svcDumpInfo
Does nothing, just returns with registers set to all-zero.
svcReadWriteRegister
Read/write IO registers with a hardcoded whitelist. Input address is physical-address and must be aligned to 4.
rw_mask is 0 for reading and 0xffffffff for writing. You can also write individual bits by using a mask value.
You can only write to registers inside physical pages 0x70019000 (MC), 0x7001C000 (MC0), 0x7001D000 (MC1), and they all share the same whitelist.
The whitelist is same for writing as for reading.
The whitelist is:
0x054, 0x090, 0x094, 0x098, 0x09c, 0x0a0, 0x0a4, 0x0a8, 0x0ac, 0x0b0, 0x0b4, 0x0b8, 0x0bc, 0x0c0, 0x0c4, 0x0c8, 0x0d0, 0x0d4, 0x0d8, 0x0dc, 0x0e0, 0x100, 0x108, 0x10c, 0x118, 0x11c, 0x124, 0x128, 0x12c, 0x130, 0x134, 0x138, 0x13c, 0x158, 0x15c, 0x164, 0x168, 0x16c, 0x170, 0x174, 0x178, 0x17c, 0x200, 0x204, 0x2e4, 0x2e8, 0x2ec, 0x2f4, 0x2f8, 0x310, 0x314, 0x320, 0x328, 0x344, 0x348, 0x370, 0x374, 0x37c, 0x380, 0x390, 0x394, 0x398, 0x3ac, 0x3b8, 0x3bc, 0x3c0, 0x3c4, 0x3d8, 0x3e8, 0x41c, 0x420, 0x424, 0x428, 0x42c, 0x430, 0x44c, 0x47c, 0x480, 0x484, 0x50c, 0x554, 0x558, 0x55c, 0x670, 0x674, 0x690, 0x694, 0x698, 0x69c, 0x6a0, 0x6a4, 0x6c0, 0x6c4, 0x6f0, 0x6f4, 0x960, 0x970, 0x974, 0xa20, 0xa24, 0xb88, 0xb8c, 0xbc4, 0xbc8, 0xbcc, 0xbd0, 0xbd4, 0xbd8, 0xbdc, 0xbe0, 0xbe4, 0xbe8, 0xbec, 0xc00, 0xc5c, 0xcac
[2.0.0+] Whitelist was extended with 0x4c4, 0x4c8, 0x4cc, 0x584, 0x588, 0x58c.
[2.0.0+] The IO registers in range 0x7000E400 (PMC) size 0xC00 skip the whitelist, and do a TrustZone call using SMC Id1 0xC3000008(ReadWriteRegister).
Other perm can be used to enforce permission 1, 3, or 0x10000000 if don't care.
svcMapTransferMemory
The newly mapped pages will have #MemoryState type 0xE.
You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.
svcUnmapTransferMemory
Size must match size given in map syscall, otherwise there's an invalid-size error.
svcQueryPhysicalAddress
The inverse operation of #svcQueryIoMapping.
svcQueryIoMapping
Description: Returns a virtual address mapped to a given IO range.
svcCreateDeviceAddressSpace
Description: Creates a virtual address space for binding device address spaces and returns a handle.
dev_as_start_addr is normally set to 0 and dev_as_end_addr is normally set to 0xFFFFFFFF.
svcAttachDeviceAddressSpace
Description: Attaches a device address space to a device.
svcDetachDeviceAddressSpace
Description: Detaches a device address space from a device.
svcMapDeviceAddressSpaceByForce
Description: Maps an attached device address space to an userspace address.
dev_map_addr is the userspace destination address, while dev_as_addr is the source address between dev_as_start_addr and dev_as_end_addr (passed to #svcCreateDeviceAddressSpace).
The userspace destination address must have the MapDeviceAllowed bit set. Bit IsDeviceMapped will be set after mapping.
svcMapDeviceAddressSpaceAligned
Description: Maps an attached device address space to an userspace address.
Same as #svcMapDeviceAddressSpaceByForce, but the userspace destination address must have the MapDeviceAlignedAllowed bit set instead.
svcUnmapDeviceAddressSpace
Description: Unmaps an attached device address space from an userspace address.
svcMapProcessMemory
Maps the src address from the supplied process handle into the current process.
This allows mapping code and rodata with RW- permission.
svcUnmapProcessMemory
Unmaps what was mapped by #svcMapProcessMemory.
svcQueryProcessMemory
Equivalent to #svcQueryMemory except takes a process handle.
svcCreateProcess
Takes a #CreateProcessInfo as input.
svcGetProcessInfo
Returns an enum with value 0-7.
Debugging
[2.0.0+] Exactly 6 debug SVCs require that IsDebugMode is non-zero. Error 0x4201 is returned otherwise.
- svcBreakDebugProcess
- svcContinueDebugEvent
- svcWriteDebugProcessMemory
- svcSetDebugThreadContext
- svcTerminateDebugProcess
- svcSetHardwareBreakPoint
svcDebugActiveProcess stops execution of the target process, the normal method for resuming it requires svcContinueDebugEvent(see above). Closing the debug handle also results in execution being resumed.
Structures
DeviceName
| Value | Name |
|---|---|
| 0 | DeviceName_AFI |
| 1 | DeviceName_AVPC |
| 2 | DeviceName_DC |
| 3 | DeviceName_DCB |
| 4 | DeviceName_HC |
| 5 | DeviceName_HDA |
| 6 | DeviceName_ISP2 |
| 7 | DeviceName_MSENCNVENC |
| 8 | DeviceName_NV |
| 9 | DeviceName_NV2 |
| 10 | DeviceName_PPCS |
| 11 | DeviceName_SATA |
| 12 | DeviceName_VI |
| 13 | DeviceName_VIC |
| 14 | DeviceName_XUSB_HOST |
| 15 | DeviceName_XUSB_DEV |
| 16 | DeviceName_TSEC |
| 17 | DeviceName_PPCS1 |
| 18 | DeviceName_DC1 |
| 19 | DeviceName_SDMMC1A |
| 20 | DeviceName_SDMMC2A |
| 21 | DeviceName_SDMMC3A |
| 22 | DeviceName_SDMMC4A |
| 23 | DeviceName_ISP2B |
| 24 | DeviceName_GPU |
| 25 | DeviceName_GPUB |
| 26 | DeviceName_PPCS2 |
| 27 | DeviceName_NVDEC |
| 28 | DeviceName_APE |
| 29 | DeviceName_SE |
| 30 | DeviceName_NVJPG |
| 31 | DeviceName_HC1 |
| 32 | DeviceName_SE1 |
| 33 | DeviceName_AXIAP |
| 34 | DeviceName_ETR |
| 35 | DeviceName_TSECB |
| 36 | DeviceName_TSEC1 |
| 37 | DeviceName_TSECB1 |
| 38 | DeviceName_NVDEC1 |
CreateProcessInfo
| Offset | Length | Bits | Description |
|---|---|---|---|
| 0 | 12 | ProcessName (doesn't have to be null-terminated) | |
| 0xC | 4 | ||
| 0x10 | 8 | TitleId | |
| 0x18 | 8 | CodeAddr | |
| 0x20 | 4 | CodeNumPages | |
| 0x24 | 4 | MmuFlags | |
| Bit0 | Is64bit | ||
| Bit3-1 | #AddressSpaceType | ||
| Bit4 | |||
| Bit5 | EnableAslr | ||
| Bit6 | IsSystem | ||
| 0x28 | 4 | ResourceLimitHandle | |
| 0x2C | 4 |
AddressSpaceType
| Type | Name | Width | Description |
|---|---|---|---|
| 0 | Normal_32Bit | 32 | |
| 1 | Normal_36Bit | 36 | |
| 2 | WithoutMap_32Bit | 32 | Appears to be missing map region [?] |
| 3 | [2.0.0+] Normal_39Bit | 39 |
MemoryInfo
| Offset | Length | Description |
|---|---|---|
| 0 | 8 | BaseAddress |
| 8 | 8 | Size |
| 0x10 | 4 | MemoryType: lower 8 bits of #MemoryState |
| 0x14 | 4 | #MemoryAttribute |
| 0x18 | 4 | Permission (bit0: R, bit1: W, bit2: X) |
| 0x1C | 4 | DeviceRefCount |
| 0x20 | 4 | IpcRefCount |
| 0x24 | 4 | Padding: always zero |
MemoryAttribute
| Bits | Description |
|---|---|
| 0 | IsBorrowed |
| 1 | IsIpcMapped: when IpcRefCount > 0. |
| 2 | IsDeviceMapped: when DeviceRefCount > 0. |
| 3 | IsUncached |
MemoryState
| Bits | Description |
|---|---|
| 7-0 | Type |
| 8 | PermissionChangeAllowed |
| 9 | IsUserWritable [?] |
| 10 | IpcSendAllowed_Type0 |
| 11 | IpcSendAllowed_Type3 |
| 12 | IpcSendAllowed_Type1 |
| 14 | ProcessPermissionChangeAllowed |
| 15 | MapAllowed |
| 16 | UnmapProcessCodeMemoryAllowed |
| 17 | TransferMemoryAllowed |
| 19 | MapDeviceAllowed (#svcMapDeviceAddressSpace and #svcMapDeviceAddressSpaceByForce) |
| 20 | MapDeviceAlignedAllowed |
| 21 | IpcBufferAllowed |
| 22 | IsPoolAllocated/IsReferenceCounted |
| 23 | MapProcessAllowed |
| 24 | AttributeChangeAllowed |
| Value | Type | Meaning |
|---|---|---|
0x00000000 |
Unmapped | |
0x00002001 |
IO | Mapped by kernel capability parsing in #svcCreateProcess. |
0x00042002 |
Normal | Mapped by kernel capability parsing in #svcCreateProcess. |
0x00DC7E03 |
Code static | Mapped during #svcCreateProcess. |
0x01FEBD04 |
Code | Transition from 0xDC7E03 performed by #svcSetProcessMemoryPermission. |
0x017EBD05 |
Heap | Mapped using #svcSetHeapSize. |
0x00402006 |
Shared memory block | Mapped using #svcMapSharedMemory. |
0x00482907 |
[1.0.0] Weird mapped memory | Mapped using #svcMapMemory. |
0x00DD7E08 |
Module code static | Mapped using #svcMapProcessCodeMemory. |
0x01FFBD09 |
Module code mutable | Transition from 0xDD7E08 performed by #svcSetProcessMemoryPermission. |
0x005C3C0A |
IPC buffers | IPC buffers with descriptor flags=0. |
0x005C3C0B |
Mapped memory | Mapped using #svcMapMemory. |
0x0040200C |
Thread local storage | Mapped during #svcCreateThread. |
0x015C3C0D |
Isolated transfer memory | Mapped using #svcMapTransferMemory when the owning process has perm=0. |
0x005C380E |
Transfer memory | Mapped using #svcMapTransferMemory when the owning process has perm!=0. |
0x0040380F |
Process memory | Mapped using #svcMapProcessMemory. |
0x00000010 |
Reserved | |
0x005C3811 |
IPC buffers | IPC buffers with descriptor flags=1. |
0x004C2812 |
IPC buffers | IPC buffers with descriptor flags=3. |
0x00002013 |
Kernel per-thread stack | Mapped in kernel during #svcCreateThread. |
Exception handling
There is userland code for handling exceptions, however this doesn't seem to be executed on retail mode.
When a usermode exception occurs, it jumps to the main code binary entrypoint (main_binary_address + 0 == _start).
During normal boot _start is invoked with X0=0 and X1=main_thread_handle (triggering normal crt0 setup). During an usermode exception _start is invoked with X0=exception_info0_ptr and X1=exception_info1_ptr instead.
The _start method determines whether to boot normally or handle an exception if X0 is set to 0 or not.
ResourceLimit
For regular-applications, the reslimit(?) seems to only allow 1 NamedPort handle to be open at a time?