18.0.0 - Revision history

Yellows8: /* IPC Interface Changes */

2024-07-12T23:03:07Z

IPC Interface Changes

Yellows8: /* System Titles */

2024-03-30T03:19:23Z

System Titles

← Older revision		Revision as of 06:19, 30 March 2024
Line 24:		Line 24:
	* ldn: Service access: added lm.		* ldn: Service access: added lm.
	* ns: Service access: added ldn:s.		* ns: Service access: added ldn:s.
			** ldn is currently unused in the main-codebin (on NX at least).
	* psc: Service access: added ovln:snd, psc:m.		* psc: Service access: added ovln:snd, psc:m.
	* ssl: Service access: added srepo:u, arp:r.		* ssl: Service access: added srepo:u, arp:r.

SciresM: /* Kernel */ This was in my notes and somehow didn't end up on the wiki

2024-03-28T04:11:20Z

Kernel: This was in my notes and somehow didn't end up on the wiki

← Older revision		Revision as of 07:11, 28 March 2024
Line 527:		Line 527:
	** This wasn't a vulnerability before, because prior to this the ABI meant userland would receive whatever was in the userland register at call time.		** This wasn't a vulnerability before, because prior to this the ABI meant userland would receive whatever was in the userland register at call time.
	* CreateProcessParameter now zeroes many fields before performing initialization.		* CreateProcessParameter now zeroes many fields before performing initialization.
			* When making a deep copy of the KPageGroup for loading InitialProcess segments, a new helper with full error checking/etc is now used instead of doing the copy inline
	* New CreateProcessFlag 0x2000 is "EnableReservedRegionExtraSize", when set the reserved region size is increased by (AddressSpaceSize / 8).		* New CreateProcessFlag 0x2000 is "EnableReservedRegionExtraSize", when set the reserved region size is increased by (AddressSpaceSize / 8).
	** Currently, CreateProcess will return svc::ResultInvalidState() unless all the following conditions are met:		** Currently, CreateProcess will return svc::ResultInvalidState() unless all the following conditions are met:

SciresM: /* BootImagePackages */ Kernel diff

2024-03-27T22:38:05Z

BootImagePackages: Kernel diff

← Older revision		Revision as of 01:38, 28 March 2024
Line 515:		Line 515:

	Using updated master-key: master_key_11 (previously master_key_10). See [[NCA]] for the KeyGeneration listing.		Using updated master-key: master_key_11 (previously master_key_10). See [[NCA]] for the KeyGeneration listing.

			==== Kernel ====
			* Compiler/libc was upgraded, this results in various minor optimizations throughout the whole kernel.
			** Many, many minor changes that this is almost certainly the cause for, e.g. KThread::SuspendRequest now calculates requested value as (0x10 << suspend_type) instead of (1 << (suspend_type + 4)).
			** Biggest one is that sp/lr are now much more commonly not saved to stack until actually needed, if a function has a return path which does not make calls/does not need lr/sp saved.
			* Initialize0 changes:
			** The physical base address of the kernel is now passed by KernelLdr for use during KernelSlab virtual memory region setup.
			*** This replaces the previous call to KInitialPageTable::GetPhysicalAddress.
			* SVC-handler accesses to the thread local region's disable count now use userspace access instructions.
			* SvcSetHeapSize now only sets the output address on success.
			** This wasn't a vulnerability before, because prior to this the ABI meant userland would receive whatever was in the userland register at call time.
			* CreateProcessParameter now zeroes many fields before performing initialization.
			* New CreateProcessFlag 0x2000 is "EnableReservedRegionExtraSize", when set the reserved region size is increased by (AddressSpaceSize / 8).
			** Currently, CreateProcess will return svc::ResultInvalidState() unless all the following conditions are met:
			*** Address space type must be 39-bit
			*** System resource size must be > 0
			*** KTargetSystem::IsDebugMode() must be true.
			** New InfoType (0x1C) "InfoType_ReservedRegionExtraSize" retrieves the extra size, which is a member of KPageTableBase.
			** Loader does not currently support passing this flag in any capacity yet.
			** nn::os::VammManager currently calculates the reserved region as [start, end - extra size], and will not map to the extra part of the region.
			* Various KPageTable(Base/Impl) changes:
			** InitializeForProcess now takes in the create process flags directly instead of parsing as a bunch of bools.
			** InitializeForProcess now performs much more complicated initialization/randomization of the four aslr'd regions, dividing them up before/after the process code using largest-region first selection for randomization order.
			** KPageTableImpl's traversal functions now take an additional output byte (which is also a new member at +0x11 in the traversal block and in KMemoryRange), this is always set to zero.
			*** This byte is checked when traversing by ::Finalize and ::GetContiguousRangeWithMemoryState, but not other page table functions.
			*** This byte is also stored as a new member of the memory range struct returned by GetContiguousRangeWithMemoryState
			** AllocateAndMapPagesImpl now takes in the page properties by reference instead of by value.
			** Read/WriteReadDebugIoMemory now use simpler logic for determining the current readable size.
			* The KMemoryBlock helper "ConvertToKMemoryPermission" was changed to only copy the user-write bit to KernelWrite.
			** This fixes a longstanding bug where the input was AND'd with KMemoryPermission_UserReadWrite, and these bits were then ORR'd into the final permission <<='d with KernelShift.
			** The intent here was to copy the user read/write permissions into the kernel read/write permissions, but KMemoryPermission_UserReadWrite is not bitmask 0x3, it's bitmask 0x1B (including the KernelRead/Write bits).
			** Thus, previously this would allow an input with KernelRead bit to spuriously set the NotMapped bit, and an input with KernelWrite bit to spuriously set the unused top bit.
			** This was unexploitable, except maybe for causing a kernel-mode access exception.
			* HandleException now handles EsrEc_DataAbortEl0 specially when determining the debug exception type.
			** When ESR_EL1.IFSC is 0b100001 ("Alignment Fault"), ExceptionType_UnalignedData is selected instead of ExceptionType_DataAbort.
			* KMemoryManager(Impl)/KPageHeap changes:
			** KPageHeap's heap_virtual_address member is now removed and is a part of KMemoryManagerImpl now (this is still unused in non-debug kernel).
			** KMemoryManager::AllocatePageGroup now takes a parameter for the required minimum alignment for the page group.
			*** This is currently passed as 1 page (minimum alignment) at all callsites.
			* SecureMonitor access was refactored, actual smc invocation is now in its own helper separate from interrupt disable/enable (and helpers which invoke without interrupt disable now exist).

	=== [[Audio_services\|audio]] ===		=== [[Audio_services\|audio]] ===

Yellows8: /* audio */

2024-03-27T03:03:44Z

audio

← Older revision		Revision as of 06:03, 27 March 2024
Line 517:		Line 517:

	=== [[Audio_services\|audio]] ===		=== [[Audio_services\|audio]] ===
	Besides IPC changes, ~~a vuln was~~ [[Switch_System_Flaws\|fixed]].		Besides IPC changes, vulns were [[Switch_System_Flaws\|fixed]].

	=== [[JIT_services\|jit]] ===		=== [[JIT_services\|jit]] ===

Yellows8 at 20:15, 26 March 2024

2024-03-26T19:15:16Z

← Older revision		Revision as of 22:15, 26 March 2024
Line 515:		Line 515:

	Using updated master-key: master_key_11 (previously master_key_10). See [[NCA]] for the KeyGeneration listing.		Using updated master-key: master_key_11 (previously master_key_10). See [[NCA]] for the KeyGeneration listing.

			=== [[Audio_services\|audio]] ===
			Besides IPC changes, a vuln was [[Switch_System_Flaws\|fixed]].

	=== [[JIT_services\|jit]] ===		=== [[JIT_services\|jit]] ===

Yellows8 at 01:57, 26 March 2024

2024-03-26T00:57:44Z

← Older revision		Revision as of 03:57, 26 March 2024
Line 515:		Line 515:

	Using updated master-key: master_key_11 (previously master_key_10). See [[NCA]] for the KeyGeneration listing.		Using updated master-key: master_key_11 (previously master_key_10). See [[NCA]] for the KeyGeneration listing.

			=== [[JIT_services\|jit]] ===
			Symbols were stripped from the main-codebin.

	==See Also==		==See Also==

Yls8bot: Created page with "The Switch 18.0.0 system update was released on March 26, 2024 (UTC). This Switch update was released for the following regions: CHN, and ALL. Security flaws fixed:
2024-03-26T00:28:28Z

Created page with "The Switch 18.0.0 system update was released on March 26, 2024 (UTC). This Switch update was released for the following regions: CHN, and ALL. Security flaws fixed: <fill thi..."
Show changes

← Older revision		Revision as of 06:03, 27 March 2024
Line 517:		Line 517:

	=== [[Audio_services\|audio]] ===		=== [[Audio_services\|audio]] ===
	Besides IPC changes, ~~a vuln was~~ [[Switch_System_Flaws\|fixed]].		Besides IPC changes, vulns were [[Switch_System_Flaws\|fixed]].

	=== [[JIT_services\|jit]] ===		=== [[JIT_services\|jit]] ===