Process Manager services
LaunchFlags
On 5.0.0+, the LaunchFlag enum looks like this:
| Bit | Mask | Name |
|---|---|---|
| 0 | 1 | LaunchFlags_SignalOnExit |
| 1 | 2 | LaunchFlags_SignalOnStart |
| 2 | 4 | LaunchFlags_SignalOnCrash |
| 3 | 8 | LaunchFlags_SignalOnDebug |
| 4 | 0x10 | LaunchFlags_StartSuspended |
| 5 | 0x20 | LaunchFlags_DisableAslr |
Prior to system version 5.0.0, the LaunchFlag enum had its entries in a different order:
| Bit | Mask | Name |
|---|---|---|
| 0 | 1 | LaunchFlags_SignalOnExit |
| 1 | 2 | LaunchFlags_StartSuspended |
| 2 | 4 | LaunchFlags_SignalOnCrash |
| 3 | 8 | LaunchFlags_DisableAslr |
| 4 | 0x10 | LaunchFlags_SignalOnDebug |
| 5 | 0x20 | [2.0.0+] LaunchFlags_SignalOnStart |
Process Tracker thread
PM has a separate thread that is waiting for synchronization on process handles.
State changes
When the kernel signals a process handle, it uses svcResetSignal on the process handle and then it uses svcGetProcessInfo to read out the ProcessEvent.
If the process moved from non-crashed -> ProcessEvent_Crashed it clears 4 in process flags.
If process flags has mask 8 set:
- If event is ProcessEvent_Running or ProcessEvent_DebugDetached, it clears 0x20 and sets 0x10 in process flags, and signals the ProcessEventWaiter handle.
- If event is ProcessEvent_DebugSuspended, it sets 0x20 and 0x10 in process flags, and signals the ProcessEventWaiter handle.
[2.0.0+] If new state is ProcessEvent_DebugDetached, and process flags has 0x80 set, it sets mask 0x100 and signals the ProcessEventWaiter handle.
If process flags has mask 1 set:
- If new state is ProcessEvent_Exited, it signals the ProcessEventWaiter handle.
If mask 1 is not set, it immediately does what is otherwise done by the #FinalizeDeadProcess command.
Process launch
This thread can also be triggered by the pm:shell #LaunchProcess cmd.
It uses ldr:pm GetProgramInfo with the supplied title-id.
If ApplicationType == Application, it goes through the process list and errors if any has mask 0x40 set. Thus you can only run one Application at a time.
Resource limits for the process is selected by ApplicationType.
It calls ldr:pm RegisterTitle, then ldr:pm CreateProcess, then fsp-pr RegisterTitle, then sm:m RegisterTitle.
[1.0.0] The second input argument for ldr:pm CreateProcess is (launch_flags >> 2) & 3.
[2.0.0+] The second input argument for ldr:pm CreateProcess is ((launch_flags >> 2) & 2) | ((launch_flags >> 1) != 1).
If launch_flags has mask 1 set, it sets mask 1 in process flags.
If launch_flags has mask 0x10 set, it sets mask 8 in process flags.
[2.0.0+] If launch_flags has mask 0x20 set, it sets mask 0x80 in process flags.
[2.0.0+] The launch_flags mask 0x10 and 0x20 will be ignored unless ((*(u8*) (info_output+2)) & 4) is set.
If ApplicationType == Application, it sets 0x40 in the process flags, and signals the event returned by #EnableDebugForApplication. svcStartProcess is not called in this case, it has to be done manually by the #StartProcess command.
If the title-id matches the title-id given in #EnableDebugForTitleId, then svcStartProcess is not called. Instead process remains in suspended state, and has to be done manually by the #StartProcess command.
If launch_flags has mask 2 set, svcStartProcess is skipped.
Finally it does svcStartProcess on the process handle that was returned by ldr:pm CreateProcess, and sets process state to 2.
The arguments for svcStartProcess are process_handle, *(u8*)info_output, *(u8*)(info_output+1), *(u32*)(info_output+4).
Thus at the point of launch, the pid is already registered in ldr, fs, sm, and pm.
pm:bm
This is "nn::pm::detail::IBootModeInterface".
| Cmd | Name |
|---|---|
| 0 | GetBootMode |
| 1 | SetMaintenanceBoot |
pm:dmnt
This is "nn::pm::detail::IDebugMonitorInterface".
| Cmd | Name |
|---|---|
| [1.0.0-4.1.0] 0 | #IsDebugMode |
| 0 ([1.0.0-4.1.0] 1) | #GetDebugProcesses |
| 1 ([1.0.0-4.1.0] 2) | #StartDebugProcess |
| 2 ([1.0.0-4.1.0] 3) | #GetTitlePid |
| 3 ([1.0.0-4.1.0] 4) | #EnableDebugForTitleId |
| 4 ([1.0.0-4.1.0] 5) | #GetApplicationPid |
| 5 ([1.0.0-4.1.0] 6) | #EnableDebugForApplication |
| [6.0.0+] 6 | #DisableDebug |
IsDebugMode
Always returns u32 0 on retail.
[2.0.0+] Additional check on input that can return 0xC0F. The meaning is probably useless because function is somewhat nopped on non-dev builds anyway.
GetDebugProcesses
Returns an array of pids of all processes that have mask 4 set in process flags.
[2.0.0+] Additional check on input that can return 0xC0F. The meaning is probably useless because function is somewhat nopped on non-dev builds anyway.
StartDebugProcess
Takes a pid. Last process event must be ProcessEvent_Created or ProcessEvent_DebugAttached.
Then it uses svcStartProcess(process_handle, u8, u8, u32) with args coming from ldr:pm GetProgramInfo.
After that, it sets last process state to ProcessEvent_DebugDetached.
GetTitlePid
Takes a title-id and returns the pid.
EnableDebugForTitleId
Takes a title-id of the program to debug. Sets this to a global field.
Next time it gets launched it will be handled differently.
Returns an event handle that is signaled when the requested title is about to be launched.
GetApplicationPid
Returns the pid of the application process.
EnableDebugForApplication
Does *not* take a specific title-id as input.
Returns an event handle that is triggered for application titles.
DisableDebug
Takes in a u32 of bitflags.
Disables debugging/clears the globally specified tid if bit 0 is set, disables debugging/clears the next application if bit 1 is set.
pm:info
This is "nn::pm::detail::IInformationInterface".
| Cmd | Name |
|---|---|
| 0 | #GetTitleId |
GetTitleId
Takes a pid and returns the title-id associated with the process.
pm:shell
This is "nn::pm::detail::IShellInterface".
| Cmd | Name |
|---|---|
| 0 | #LaunchProcess |
| 1 | TerminateProcessByPid |
| 2 | TerminateProcessByTitleId |
| 3 | GetProcessEventWaiter |
| 4 | #GetProcessEventType |
| ([1.0.0-4.1.0] 5) | #FinalizeDeadProcess |
| ([1.0.0-4.1.0] 6) | #ClearProcessNotificationFlag |
| 5 ([1.0.0-4.1.0] 7) | #NotifyBootFinished |
| 6 ([1.0.0-4.1.0] 8) | #GetApplicationPid |
| 7 ([4.0.0-4.1.0] 9) | [4.0.0+] #BoostSystemMemoryResourceLimit |
LaunchProcess
Takes launch_flags, title-id, and storageID. See #Process launch.
Returns the u64 title PID.
GetProcessEventType
Returns 1 if flags has mask 2 set.
Returns 2 if flags has mask 1 set and state is 6.
Returns 3 if flags has mask 0x10 set and not 0x20.
Returns 4 if flags has mask 0x30 set.
[2.0.0+] returns 5 if state >= 2 and flags has mask 0x100 set.
Returns 0 if process is not found.
FinalizeDeadProcess
Takes a pid as input. If the process with pid has the state "dead", it unregisters the pid in fsp:pr, sm:m, and ldr:pm.
Then it removes the process from PMs internal linked-list of active processes.
[5.0.0+] This command was removed.
ClearProcessNotificationFlag
Takes a pid as input. Clears 0x10 from process flags.
[5.0.0+] This command was removed.
NotifyBootFinished
This launches the boot2 title.
[4.0.0+] When booting from SafeMode Firmware, instead of boot2, this launches the following titles in order:
- 0100000000000009 (settings)
- 0100000000000006 (usb)
- 010000000000001D (pcie)
- 0100000000000007 (tma)
- 010000000000001F (ns)
- 0100000000000015 (lm)
- 0100000000000010 (ptm)
- 0100000000000016 (wlan)
- 0100000000000012 (bsdsockets)
- 010000000000000F (nifm)
- 0100000000000024 (ssl)
- 0100000000000025 (nim)
- 0100000000000031 (glue)
- 010000000000003D (safemode)
GetApplicationPid
Loops through the internal linked-list of processes, looks for mask 0x40 set in process flags. Returns pid of first such entry.
BoostSystemMemoryResourceLimit
Takes an u64 mem_size as input. If the desired memory size doesn't exceed an internal limit (imposed by PM by looking at the MemoryArrange ConfigItem), PM calls svcSetResourceLimitLimitValue to set the new LimitableResource_Memory value.
This is used directly by ns:am2 BoostSystemMemoryResourceLimit.