SVC

From Nintendo Switch Brew
Jump to navigation Jump to search

System calls

Id Name In Out
0x1 #svcSetHeapSize W1=size W0=result, X1=outaddr
0x2 #svcSetMemoryPermission X0=addr, X1=size, W2=prot W0=result
0x3 #svcSetMemoryAttribute X0=addr, X1=size, W2=state0, W3=state1 W0=result
0x4 #svcMapMemory X0=dstaddr, X1=srcaddr, X2=size W0=result
0x5 svcUnmapMemory X0=dstaddr, X1=srcaddr, X2=size W0=result
0x6 svcQueryMemory X0=meminfo_ptr, X2=addr W0=result, W1=pageinfo
0x7 svcExitProcess None
0x8 #svcCreateThread X1=entry, X2=arg, X3=stacktop, W4=prio, W5=processor_id W0=result, W1=handle
0x9 svcStartThread W0=thread_handle
0xA svcExitThread None
0xB #svcSleepThread X0=nano
0xC svcGetThreadPriority W1=thread_handle W0=result, W1=prio
0xD svcSetThreadPriority W0=thread_handle, W1=prio W0=result
0xE svcGetThreadCoreMask W2=thread_handle W0=result, W1=out, X2=out
0xF svcSetThreadCoreMask W0=thread_handle, W1=in, X2=in2 W0=result
0x10 svcGetCurrentProcessorNumber None W0/X0=cpuid
0x11 svcSignalEvent W0=handle ?
0x12 svcClearEvent W0=handle ?
0x13 svcMapSharedMemory W0=memblk_handle, X1=addr, X2=size, W3=perm W0=result
0x14 svcUnmapSharedMemory W0=memblk_handle, X1=addr, X2=size W0=result
0x15 #svcCreateTransferMemory X1=addr, X2=size, W3=perm W0=result, W1=handle
0x16 svcCloseHandle W0=handle W0=result
0x17 svcResetSignal W0=handle W0=result
0x18 #svcWaitSynchronization X1=handles_ptr, W2=num_handles. X3=timeout W0=result, W1=handle_idx
0x19 svcCancelSynchronization W0=handle W0=result
0x1A svcArbitrateLock W0=cur_thread_handle, X1=ptr, W2=req_thread_handle
0x1B svcArbitrateUnlock X0=ptr
0x1C svcWaitProcessWideKeyAtomic X0=ptr0, X1=ptr, W2=thread_handle, X3=timeout W0=result
0x1D svcSignalProcessWideKey X0=ptr, W1=value W0=result
0x1E svcGetSystemTick
0x1F svcConnectToNamedPort X1=port_name_str W0=result, W1=handle
0x20 svcSendSyncRequestLight
0x21 svcSendSyncRequest X0=handle W0=result
0x22 #svcSendSyncRequestWithUserBuffer X0=cmdbufptr, X1=size, X2=handle W0=result
0x23 svcSendAsyncRequestWithUserBuffer
0x24 svcGetProcessId
0x25 svcGetThreadId W0=thread_handle W0=result, X1=out
0x26 svcBreak X0,X1,X2=info ?
0x27 svcOutputDebugString X0=str, X1=size
0x28 svcReturnFromException X0=result
0x29 #svcGetInfo X1=info_id, X2=handle, X3=info_sub_id W0=result, X1=out
0x2A svcFlushEntireDataCache
0x2B svcFlushDataCache
0x2C svcMapPhysicalMemory This SVC was added in version 3.0.0.
0x2D svcUnmapPhysicalMemory This SVC was added in version 3.0.0.
.... ? ? ?
0x2F svcGetLastThreadInfo
0x30 svcGetResourceLimitLimitValue
0x31 svcGetResourceLimitCurrentValue
0x32 svcSetThreadActivity
0x33 svcGetThreadContext3
.... ? ? ?
0x3C svcDumpInfo
.... ? ? ?
0x40 svcCreateSession W2=?, X3=? W0=result, W1=client_handle, W2=server_handle
0x41 svcAcceptSession W1=port_handle W0=result, W1=session_handle
0x42 svcReplyAndReceiveLight
0x43 svcReplyAndReceive X1=ptr_handles, W2=num_handles, X3=?, X4=timeout W0=result, W1=handle_idx
0x44 svcReplyAndReceiveWithUserBuffer X1=buf, X2=sz, X3=ptr_handles, W4=num_handles, X5=?, X6=timeout W0=result, W1=handle_idx
0x45 svcCreateEvent None W0=result, W1=client_handle ?, W2=server_handle ?
.... ? ? ?
0x4D svcSleepSystem
0x4E #svcReadWriteRegister X1=reg_addr, W2=rw_mask, W3=in_val W0=result, W1=out_val
0x4F svcSetProcessActivity
0x50 svcCreateSharedMemory W1=size?, W2=perm0, W3=perm1 W0=result, W1=handle
0x51 #svcMapTransferMemory X0=mirror_handle, X1=addr, X2=size, W3=perm W0=result
0x52 #svcUnmapTransferMemory W0=mirror_handle, X1=addr, X2=size W0=result
0x53 svcCreateInterruptEvent X1=irq_id W0=result, W1=handle
0x54 svcQueryPhysicalAddress
0x55 svcQueryIoMapping X0=physaddr, X1=size X0=virtaddr
0x56 svcCreateDeviceAddressSpace X1=start_addr?, X2=size? W0=result, W1=handle
0x57 svcAttachDeviceAddressSpace W0=handle, X1=device? W0=result
0x58 svcDetachDeviceAddressSpace W0=handle, X1=device? W0=result
0x59 svcMapDeviceAddressSpaceByForce W0=handle, W1=proc_handle?, X2=proc_addr?, X3=size?, X4=map_addr?, W5=perm W0=result
0x5A svcMapDeviceAddressSpaceAligned
0x5B svcMapDeviceAddressSpace
0x5C svcUnmapDeviceAddressSpace
0x5D svcInvalidateProcessDataCache
0x5E svcStoreProcessDataCache
0x5F svcFlushProcessDataCache
0x60 svcDebugActiveProcess
0x61 svcBreakDebugProcess
0x62 svcTerminateDebugProcess
0x63 svcGetDebugEvent
0x64 svcContinueDebugEvent
0x65 svcGetProcessList
0x66 svcGetThreadList
0x67 svcGetDebugThreadContext
0x68 svcSetDebugThreadContext
0x69 svcQueryDebugProcessMemory
0x6A svcReadDebugProcessMemory
0x6B svcWriteDebugProcessMemory
0x6C svcSetHardwareBreakPoint
0x6D svcGetDebugThreadParam
.... ? ? ?
0x70 svcCreatePort
0x71 svcManageNamedPort
0x72 svcConnectToPort
0x73 svcSetProcessMemoryPermission
0x74 svcMapProcessMemory X0=srcaddr, W1=process_handle, X2=dstaddr, X3=size W0=result
0x75 svcUnmapProcessMemory W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size W0=result
0x76 svcQueryProcessMemory
0x77 svcMapProcessCodeMemory W0=process_handle, X21dstaddr, X2=srcaddr, X3=size W0=result
0x78 svcUnmapProcessCodeMemory W0=process_handle, X1=dstaddr, X2=srcaddr, X3=size W0=result
0x79 #svcCreateProcess X1=procinfo_ptr, X2=caps_ptr, W3=cap_num W0=result, W1=process_handle
0x7A svcStartProcess
0x7B svcTerminateProcess
0x7C svcGetProcessInfo
0x7D svcCreateResourceLimit
0x7E svcSetResourceLimitLimitValue
0x7F svcCallSecureMonitor

svcSetHeapSize

Size must be a multiple of 0x2000000. The heap base-address is written to out.

It allows both extending and shrinking the heap.

svcSetMemoryPermission

Bit2 of permission (exec) is not allowed.

Setting write-only is not allowed either (bit1).

svcSetMemoryAttribute

State0 State1 Action
0 0 Clear bit35 in #MemoryAttribute.
8 0 Clear bit35 in #MemoryAttribute.
8 8 Set bit35 in #MemoryAttribute.

This might used for switching between cached and non-cached mappings.

svcMapMemory

Memory is only allowed to be mapped into a special region.

Code can get the range of this region from #svcGetInfo.

The source region gets reprotected to ---, and sets bit32 is set in #MemoryAttribute.

svcCreateThread

Processor_id must be 0,1,2,3 or -2.

svcSleepThread

Setting nano=0 means "yield thread".

svcCreateTransferMemory

This one reprotects the src block with perms you give it. It also sets bit32 into #MemoryAttribute.

Executable bit perm not allowed.

Closing all handles automatically causes the bit32 in #MemoryAttribute to clear, and the permission to reset.

svcWaitSynchronization

Works with num_handles <= 0x40, error on num_handles == 0.

Does not accept 0xFFFF8001 or 0xFFFF8000 as handles.

svcSendSyncRequestWithUserBuffer

Size must be 0x1000-aligned.

svcBreak

When used on retail where inx0 bit31 is clear, the system will throw a fatal-error. Otherwise when bit31 is set, it will return 0.

svcGetInfo

Handle type Id0 Id1 Description
Process 0 0 Core available mask. Always 0xF meaning all 4 cores available.
Process 1 0 Always 0xfffffffff0000000.
Process 2 0 Randomized unknown base-address.
Process 3 0 Always 0x1000000000.
Process 4 0 Heap base. Randomized.
Process 5 0 Heap region size. Always 0x180000000.
Process 6 0 Total memory usage?
Process 7 0 Process heap size.
Zero 8 0 Always 0. Used during exception handling.
Zero 9 0 This creates and returns an unknown handle.
Zero 10 -1, {current coreid} Unknown. Output data changes each time this SVC is used. Global and core-specific tick-count?
Zero 11 0-3 Returns random from TRNG. Used to seed usermode PRNGs. Unknown what exactly causes this output to change, however it does change when exiting+launching a process.
Process 12 0 Address space start. Always 0x8000000.
Process 13 0 Address space size. Always 0x7ff8000000.
Process 14 0 Map region base. Randomized.
Process 15 0 Map region size.
Process 18 0 Title-id, introduced with 3.0.0
? 0xF0000002 0 Unknown. Uses the input handle. Returns a tick-count?

svcReadWriteRegister

Read/write Tegra hardware registers, input address is physical-address.

rw_mask is 0 for reading and -1 for writing.

Registers

Address Register Name Description
0x700192E8 MC_LATENCY_ALLOWANCE_DC_0_0 Latency allowance settings for DC clients
0x700192EC MC_LATENCY_ALLOWANCE_DC_1_0 Latency allowance settings for DC clients
0x700192F0 MC_LATENCY_ALLOWANCE_DC_2_0 Latency allowance settings for DC clients
0x700192F4 MC_LATENCY_ALLOWANCE_DCB_0_0 Latency allowance settings for DCB clients
0x700192F8 MC_LATENCY_ALLOWANCE_DCB_1_0 Latency allowance settings for DCB clients
0x7001941C MC_DIS_PTSA_RATE_0 DDA rate for dis PTSA
0x70019420 MC_DIS_PTSA_MIN_0 DDA minimum value for direct client dis PTSA.
0x70019424 MC_DIS_PTSA_MAX_0 DDA maximum value for direct client dis PTSA.
0x70019428 MC_DISB_PTSA_RATE_0 DDA rate for disb PTSA
0x7001942C MC_DISB_PTSA_MIN_0 DDA minimum value for direct client disb PTSA
0x70019430 MC_DISB_PTSA_MAX_0 DDA maximum value for direct client disb PTSA
0x7001944C MC_MLL_MPCORER_PTSA_RATE_0 DDA rate for mll_mpcorer PTSA
0x7001947C MC_RING1_PTSA_RATE_0 DDA rate for ring1 PTSA
0x70019480 MC_RING1_PTSA_MIN_0 DDA minimum value for direct client ring1 PTSA
0x70019484 MC_RING1_PTSA_MAX_0 DDA maximum value for direct client ring1 PTSA
0x7001950C MC_FTOP_PTSA_RATE_0 DDA rate for ftop PTSA
0x70019670 MC_SEC_CARVEOUT_BOM_0 Baseaddress for the SEC carveout address space.
0x70019674 MC_SEC_CARVEOUT_SIZE_MB_0 Size in MB for the SEC carveout region
0x70019690 MC_SCALED_LATENCY_ALLOWANCE_DISPLAY0A_0 Scaled Latency Allowance settings for DISPLAY0A
0x70019694 MC_SCALED_LATENCY_ALLOWANCE_DISPLAY0AB_0 Scaled Latency Allowance settings for DISPLAY0AB
0x70019698 MC_SCALED_LATENCY_ALLOWANCE_DISPLAY0B_0 Scaled Latency Allowance settings for DISPLAY0B
0x7001969C MC_SCALED_LATENCY_ALLOWANCE_DISPLAY0BB_0 Scaled Latency Allowance settings for DISPLAY0BB
0x700196A0 MC_SCALED_LATENCY_ALLOWANCE_DISPLAY0C_0 Scaled Latency Allowance settings for DISPLAY0C
0x700196A4 MC_SCALED_LATENCY_ALLOWANCE_DISPLAY0CB_0 Scaled Latency Allowance settings for DISPLAY0CB
0x70019C5C

svcMapTransferMemory

The newly mapped pages will have #MemoryAttribute type 0xE.

You must pass same size and permissions as given in svcCreateMemoryMirror, otherwise error.

svcUnmapTransferMemory

Size must match size given in map syscall, otherwise there's an invalid-size error.

svcCreateProcess

Takes a #CreateProcessInfo as input.

Structures

CreateProcessInfo

Offset Length Description
0 8
8 2
0xA 2
0x18 8 ASLR base
0x20 4 Number of ASLR pages
0x24 4 MemoryManagement flags. Bit0: is_64bit (maybe?), bit3-1: MMU table size? (0=32-bit, 1=64-bit 0x800000000, 2=64-bit 0x400000000), bit5, bit6
0x28 4 ResourceLimit handle
0x2C 4

MemoryAttribute

Bits Description
7-0 Type
8 Is #svcSetMemoryPermission allowed?
15 Is #svcMapMemory allowed?
24 Is #svcSetMemoryAttribute allowed?
Value Type Meaning
0x0 Unmapped
0x2001 IO
0x42002 IO
0xDC7E03 Code static .text and .rodata
0x4 Code .data
0x17EBD05 Heap
0x402006 Shared memory block
0x8 Module code static .text and .rodata
0x9 Module code .data
0xB Mapped memory
0xC Thread local storage
0xE Transfer memory
0x10 Reserved

Bit32: is_mirrored Bit34: is_device_mapped Bit35: is_uncached?

Exception Handling

There appears to be userland code for handling exceptions, however this doesn't seem to be executed on retail.

On usermode exception, it jumps to main code binary entrypoint (main_binary_address+0) with X0=exception_info_ptr and X1=exception_info2_ptr. On boot, X0 is set to 0 triggering normal crt0 setup.

Retrieved from "https://switchbrew.org/w/index.php?title=SVC&oldid=1559"