Bump version to 0.8.0

Implement custom fatal sysmodule.

Makefile

@@ -40,13 +40,16 @@ dist: all
 	mkdir atmosphere-$(AMSVER)
 	mkdir atmosphere-$(AMSVER)/atmosphere
 	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000036
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000034
 	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032
 	cp fusee/fusee-secondary/fusee-secondary.bin atmosphere-$(AMSVER)/fusee-secondary.bin
 	cp common/defaults/BCT.ini atmosphere-$(AMSVER)/BCT.ini
 	cp common/defaults/loader.ini atmosphere-$(AMSVER)/atmosphere/loader.ini
 	cp stratosphere/creport/creport.nsp atmosphere-$(AMSVER)/atmosphere/titles/0100000000000036/exefs.nsp
+	cp stratosphere/fatal/fatal.nsp atmosphere-$(AMSVER)/atmosphere/titles/0100000000000034/exefs.nsp
 	cp stratosphere/set_mitm/set_mitm.nsp atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032/exefs.nsp
-	touch atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032/boot2.flag
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032/flags
+	touch atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032/flags/boot2.flag
 	cd atmosphere-$(AMSVER); zip -r ../atmosphere-$(AMSVER).zip ./*; cd ../;
 	rm -r atmosphere-$(AMSVER)
 	mkdir out

common/include/atmosphere/version.h

@@ -18,7 +18,7 @@
 #define ATMOSPHERE_VERSION_H
 
 #define ATMOSPHERE_RELEASE_VERSION_MAJOR    0
-#define ATMOSPHERE_RELEASE_VERSION_MINOR    7
-#define ATMOSPHERE_RELEASE_VERSION_MICRO    5
+#define ATMOSPHERE_RELEASE_VERSION_MINOR    8
+#define ATMOSPHERE_RELEASE_VERSION_MICRO    0
 
 #endif

docs/changelog.md

@@ -1,4 +1,36 @@
 # Changelog
+## 0.8.0
++ A custom `fatal` system module was added.
+  + This re-implements and extends Nintendo's fatal module, with the following features:
+    + Atmosphère's `fatal` does not create error reports.
+    + Atmosphère's `fatal` draws a custom error screen, showing registers and a backtrace.
+    + Atmosphère's `fatal` attempts to gather debugging info for all crashes, and not just ones that include info.
+    + Atmosphère's `fatal` will attempt saving reports to the SD, if a crash report was not generated by `creport`.
++ Title flag handling was changed to prevent folder clutter.
+  + Instead of living in `atmosphere/titles/<tid>/%s.flag`, flags are now located in `atmosphere/titles/<tid>/flags/%s.flag`
+    + The old format will continue to be supported for some time, but is deprecated.
+  + Flags can now be applied to HBL by placing them at `atmosphere/flags/hbl_%s.flag`.
++ Changes were made to the mitm API, greatly improving caller semantics.
+  + `sm` now informs mitm services of a new session's process id, enabling custom handling based on title id/process id.
++ smhax is no longer enabled, because it is no longer needed and breaks significant functionality.
+  + Users with updated HBL/homebrew should see no observable differences due to this change.
++ Functionality was added implementing basic protections for NAND from userland homebrew:
+  + BOOT0 now has write protection for the BCT public key and keyblob regions.
+    + The `ns` sysmodule is no longer allowed to write the BCT public keys; all other processes can.
+      + This should prevent system updates from removing AutoRCM.
+    + No processes should be allowed to write to the keyblob region.
+  + By default, BIS partitions other than BOOT0 are now read-only, and CAL0 is neither readable nor writable.
+    + Adding a `bis_write` flag for a title will allow it to write to BIS.
+    + Adding a `cal_read` flag for a title will allow it to read CAL0.
+  + An automatic backup is now made of CAL0 on boot.
+    + `fs.mitm` maintains a file handle to this backup, so userland software cannot read it.
+  + To facilitate this, `fs.mitm` now mitms all sessions for non-system modules; content overriding has been made separate from service interception.
+  + Please note: these protections are basic, and sufficiently malicious homebrew ++can defeat them++.
+    + Please be careful to only run homebrew software from sources that you trust.
++ Support was added for system version 6.2.0; our thanks to @motezazer for his invaluable help.
+  + By default, new keys will automatically be derived without user input.
+  + Support is also present for loading new keys from `atmosphere/prod.keys` or `atmosphere/dev.keys`
++ General system stability improvements to enhance the user's experience.
 ## 0.7.5
 + DRAM training was added to fusee-secondary, courtesy @hexkyz.
   + This greatly improves the speed of memory accesses during boot, resulting in a boot time that is ~200-400% faster.

docs/modules/loader.md

@@ -66,3 +66,17 @@ For example, `override_key=!R` will run the game only while holding down R when
 ### SM MITM Integration
 
 When the Stratosphere implementation of loader creates a new process, it notifies [sm](sm.md) through the `AtmosphereAssociatePidTidForMitm` command to notify any MITM services of new processes' identities.
+
+### IPC: AtmosphereSetExternalContentSource
+
+An additional command is added to the [`ldr:shel`](https://reswitched.github.io/SwIPC/ifaces.html#nn::ro::detail::ILdrShellInterface) interface, called `AtmosphereSetExternalContentSource`. It's command ID is `65000` on all system firmware versions. It takes a `u64 tid` and returns a server-side session handle. The client is expected to implement the `IFileSystem` interface on the returned handle. The next time the title specified by the given title ID is launched, its ExeFS contents will be loaded from the custom `IFileSystem` instead of from SD card or original ExeFS. NSOs loaded from external content source may still be subject to exefs IPS patches. After the title is launched, the `IFileSystem` is closed and the external content source override is removed. If `AtmosphereSetExternalContentSource` is called on a title that already has an external content source set for it, the existing one will be removed and replaced with the new one. It is illegal to call `AtmosphereSetExternalContentSource` while the title is being launched.
+
+The `IFileSystem` only needs to implement `OpenFile`. The paths received by the `IFileSystem`'s `OpenFile` command begin with slashes, as in `/main`, `/rtld`, and `/main.npdm`. A result code of 0x202 should be returned if the file does not exist. The `IFile`s returned from `OpenFile` only need to implement `Read` and `GetSize`.
+
+The SwIPC definition for the `AtmosphereSetExternalContentSource` command follows.
+```
+interface nn::ldr::detail::IShellInterface is ldr:shel {
+  ...
+  [65000] AtmosphereSetExternalContentSource(u64 tid) -> handle<copy, session_server> ifilesystem_handle;
+}
+```

exosphere/Makefile

@@ -9,6 +9,13 @@ endif
 TOPDIR ?= $(CURDIR)
 include $(DEVKITPRO)/devkitA64/base_rules
 
+AMSBRANCH := $(shell git symbolic-ref --short HEAD)
+AMSREV := $(AMSBRANCH)-$(shell git rev-parse --short HEAD)
+
+ifneq (, $(strip $(shell git status --porcelain 2>/dev/null)))
+    AMSREV := $(AMSREV)-dirty
+endif
+
 #---------------------------------------------------------------------------------
 # TARGET is the name of the output
 # BUILD is the directory where object files & intermediate files will be placed
@@ -26,7 +33,7 @@ INCLUDES	:=	include ../common/include
 # options for code generation
 #---------------------------------------------------------------------------------
 ARCH	:=	-march=armv8-a -mtune=cortex-a57 -mgeneral-regs-only #<- important
-DEFINES	:=	-D__CCPLEX__
+DEFINES	:=	-D__CCPLEX__ -DATMOSPHERE_GIT_BRANCH=\"$(AMSBRANCH)\" -DATMOSPHERE_GIT_REV=\"$(AMSREV)\"
 CFLAGS	:= \
 	-g \
 	-O2 \

exosphere/src/bootup.c

@@ -46,19 +46,16 @@
 
 static bool g_has_booted_up = false;
 
-
 void setup_dram_magic_numbers(void) {
-    /* TODO: Why does these DRAM write occur? */
+    /* These DRAM writes test and set values for the GPU UCODE carveout. */
     unsigned int target_fw = exosphere_get_target_firmware();
-    if (EXOSPHERE_TARGET_FIRMWARE_400 <= target_fw) {
-        (*(volatile uint32_t *)(0x8005FFFC)) = 0xC0EDBBCC;
-        flush_dcache_range((void *)0x8005FFFC, (void *)0x80060000);
-        if (EXOSPHERE_TARGET_FIRMWARE_600 <= target_fw) {
-            (*(volatile uint32_t *)(0x8005FF00)) = 0x00000083;
-            (*(volatile uint32_t *)(0x8005FF04)) = 0x00000002;
-            (*(volatile uint32_t *)(0x8005FF08)) = 0x00000210;
-            flush_dcache_range((void *)0x8005FF00, (void *)0x8005FF0C);
-        }
+    (*(volatile uint32_t *)(0x8005FFFC)) = 0xC0EDBBCC;              /* Access test value. */
+    flush_dcache_range((void *)0x8005FFFC, (void *)0x80060000);
+    if (EXOSPHERE_TARGET_FIRMWARE_600 <= target_fw) {
+        (*(volatile uint32_t *)(0x8005FF00)) = 0x00000083;          /* SKU code. */
+        (*(volatile uint32_t *)(0x8005FF04)) = 0x00000002;
+        (*(volatile uint32_t *)(0x8005FF08)) = 0x00000210;          /* Tegra210 code. */
+        flush_dcache_range((void *)0x8005FF00, (void *)0x8005FF0C);
     }
     __dsb_sy();
 }
@@ -83,35 +80,35 @@ void bootup_misc_mmio(void) {
     se_generate_random_key(KEYSLOT_SWITCH_SRKGENKEY, KEYSLOT_SWITCH_RNGKEY);
     se_generate_srk(KEYSLOT_SWITCH_SRKGENKEY);
 
-    if (!g_has_booted_up && EXOSPHERE_TARGET_FIRMWARE_600 > exosphere_get_target_firmware() && exosphere_get_target_firmware() >= EXOSPHERE_TARGET_FIRMWARE_400) {
+    if (!g_has_booted_up && (EXOSPHERE_TARGET_FIRMWARE_600 > exosphere_get_target_firmware())) {
         setup_dram_magic_numbers();
     }
 
-    /* Todo: What? */
-    MAKE_TIMERS_REG(0x1A4) = 0xF1E0;
+    /* Mark TMR5, TMR6, TMR7, TMR8, WDT0, WDT1, WDT2 and WDT3 as secure. */
+    SHARED_TIMER_SECURE_CFG_0 = 0xF1E0;
 
-    FLOW_CTLR_BPMP_CLUSTER_CONTROL_0 = 4; /* ACTIVE_CLUSTER_LOCK. */
-    FLOW_CTLR_FLOW_DBG_QUAL_0 = 0x10000000; /* Enable FIQ2CCPLEX */
+    FLOW_CTLR_BPMP_CLUSTER_CONTROL_0 = 4;       /* ACTIVE_CLUSTER_LOCK. */
+    FLOW_CTLR_FLOW_DBG_QUAL_0 = 0x10000000;     /* Enable FIQ2CCPLEX */
 
     /* Disable Deep Power Down. */
     APBDEV_PMC_DPD_ENABLE_0 = 0;
 
-    /* Setup MC. */
-    /* TODO: What are these MC reg writes? */
-    MAKE_MC_REG(0x984) = 1;
-    MAKE_MC_REG(0x648) = 0;
-    MAKE_MC_REG(0x64C) = 0;
-    MAKE_MC_REG(0x650) = 1;
-    MAKE_MC_REG(0x670) = 0;
-    MAKE_MC_REG(0x674) = 0;
-    MAKE_MC_REG(0x678) = 1;
-    MAKE_MC_REG(0x9A0) = 0;
-    MAKE_MC_REG(0x9A4) = 0;
-    MAKE_MC_REG(0x9A8) = 0;
-    MAKE_MC_REG(0x9AC) = 1;
-    MC_SECURITY_CFG0_0 = 0;
-    MC_SECURITY_CFG1_0 = 0;
-    MC_SECURITY_CFG3_0 = 3;
+    /* Setup MC carveouts. */
+    MAKE_MC_REG(MC_VIDEO_PROTECT_GPU_OVERRIDE_0) = 1;
+    MAKE_MC_REG(MC_VIDEO_PROTECT_GPU_OVERRIDE_1) = 0;
+    MAKE_MC_REG(MC_VIDEO_PROTECT_BOM) = 0;
+    MAKE_MC_REG(MC_VIDEO_PROTECT_SIZE_MB) = 0;
+    MAKE_MC_REG(MC_VIDEO_PROTECT_REG_CTRL) = 1;
+    MAKE_MC_REG(MC_SEC_CARVEOUT_BOM) = 0;
+    MAKE_MC_REG(MC_SEC_CARVEOUT_SIZE_MB) = 0;
+    MAKE_MC_REG(MC_SEC_CARVEOUT_REG_CTRL) = 1;
+    MAKE_MC_REG(MC_MTS_CARVEOUT_BOM) = 0;
+    MAKE_MC_REG(MC_MTS_CARVEOUT_SIZE_MB) = 0;
+    MAKE_MC_REG(MC_MTS_CARVEOUT_ADR_HI) = 0;
+    MAKE_MC_REG(MC_MTS_CARVEOUT_REG_CTRL) = 1;
+    MAKE_MC_REG(MC_SECURITY_CFG0) = 0;
+    MAKE_MC_REG(MC_SECURITY_CFG1) = 0;
+    MAKE_MC_REG(MC_SECURITY_CFG3) = 3;
     configure_default_carveouts();
         
     /* Mark registers secure world only. */
@@ -142,12 +139,12 @@ void bootup_misc_mmio(void) {
         APB_MISC_SECURE_REGS_APB_SLAVE_SECURITY_ENABLE_REG2_0 = sec_disable_2;
     }
 
-    /* reset Translation Enable Registers */
-    MC_SMMU_TRANSLATION_ENABLE_0_0 = 0xFFFFFFFF;
-    MC_SMMU_TRANSLATION_ENABLE_1_0 = 0xFFFFFFFF;
-    MC_SMMU_TRANSLATION_ENABLE_2_0 = 0xFFFFFFFF;
-    MC_SMMU_TRANSLATION_ENABLE_3_0 = 0xFFFFFFFF;
-    MC_SMMU_TRANSLATION_ENABLE_4_0 = 0xFFFFFFFF;
+    /* Reset Translation Enable Registers. */
+    MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_0) = 0xFFFFFFFF;
+    MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_1) = 0xFFFFFFFF;
+    MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_2) = 0xFFFFFFFF;
+    MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_3) = 0xFFFFFFFF;
+    MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_4) = 0xFFFFFFFF;
 
     /* TODO: What are these MC reg writes? */
     if (exosphere_get_target_firmware() >= EXOSPHERE_TARGET_FIRMWARE_400) {
@@ -157,7 +154,7 @@ void bootup_misc_mmio(void) {
     }
     MAKE_MC_REG(0x03C) = 0;
 
-    /* MISC registers*/
+    /* MISC registers. */
     MAKE_MC_REG(0x9E0) = 0;
     MAKE_MC_REG(0x9E4) = 0;
     MAKE_MC_REG(0x9E8) = 0;
@@ -166,18 +163,18 @@ void bootup_misc_mmio(void) {
     MAKE_MC_REG(0x9F4) = 0;
 
     if (exosphere_get_target_firmware() >= EXOSPHERE_TARGET_FIRMWARE_400) {
-        MC_SMMU_PTB_ASID_0 = 0;
+        MAKE_MC_REG(MC_SMMU_PTB_ASID) = 0;
     }
-    MC_SMMU_PTB_DATA_0 = 0;
-    MC_SMMU_TLB_CONFIG_0 = 0x30000030;
-    MC_SMMU_PTC_CONFIG_0 = 0x2800003F;
-    (void)MC_SMMU_TLB_CONFIG_0;
-    MC_SMMU_PTC_FLUSH_0 = 0;
-    (void)MC_SMMU_TLB_CONFIG_0;
-    MC_SMMU_TLB_FLUSH_0 = 0;
-    (void)MC_SMMU_TLB_CONFIG_0;
-    MC_SMMU_CONFIG_0 = 1; /* enable SMMU */
-    (void)MC_SMMU_TLB_CONFIG_0;
+    MAKE_MC_REG(MC_SMMU_PTB_DATA) = 0;
+    MAKE_MC_REG(MC_SMMU_TLB_CONFIG) = 0x30000030;
+    MAKE_MC_REG(MC_SMMU_PTC_CONFIG) = 0x2800003F;
+    (void)MAKE_MC_REG(MC_SMMU_TLB_CONFIG);
+    MAKE_MC_REG(MC_SMMU_PTC_FLUSH) = 0;
+    (void)MAKE_MC_REG(MC_SMMU_TLB_CONFIG);
+    MAKE_MC_REG(MC_SMMU_TLB_FLUSH) = 0;
+    (void)MAKE_MC_REG(MC_SMMU_TLB_CONFIG);
+    MAKE_MC_REG(MC_SMMU_CONFIG) = 1;        /* Enable SMMU. */
+    (void)MAKE_MC_REG(MC_SMMU_TLB_CONFIG);
     
     /* Clear RESET Vector, setup CPU Secure Boot RESET Vectors. */
     uint32_t reset_vec;
@@ -200,13 +197,13 @@ void bootup_misc_mmio(void) {
 
     /* Setup FIQs. */
 
-
     /* And assign "se_operation_completed" to Interrupt 0x5A. */
     intr_set_priority(INTERRUPT_ID_SECURITY_ENGINE, 0);
     intr_set_group(INTERRUPT_ID_SECURITY_ENGINE, 0);
     intr_set_enabled(INTERRUPT_ID_SECURITY_ENGINE, 1);
     intr_set_cpu_mask(INTERRUPT_ID_SECURITY_ENGINE, 8);
     intr_set_edge_level(INTERRUPT_ID_SECURITY_ENGINE, 0);
+    
     if (exosphere_get_target_firmware() >= EXOSPHERE_TARGET_FIRMWARE_400) {
         intr_set_priority(INTERRUPT_ID_ACTIVITY_MONITOR_4X, 0);
         intr_set_group(INTERRUPT_ID_ACTIVITY_MONITOR_4X, 0);
@@ -225,10 +222,10 @@ void bootup_misc_mmio(void) {
         }
         g_has_booted_up = true;
     } else if (exosphere_get_target_firmware() < EXOSPHERE_TARGET_FIRMWARE_400) {
-        /* TODO: What are these MC reg writes? */
-        MAKE_MC_REG(0x65C) = 0xFFFFF000;
-        MAKE_MC_REG(0x660) = 0;
-        MAKE_MC_REG(0x964) |= 1;
+        /* Disable AHB redirect. */
+        MAKE_MC_REG(MC_IRAM_BOM) = 0xFFFFF000;
+        MAKE_MC_REG(MC_IRAM_TOM) = 0;
+        MAKE_MC_REG(MC_IRAM_REG_CTRL) |= 1;
         CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRD_0 &= 0xFFF7FFFF;
     }
 }
@@ -237,10 +234,11 @@ void setup_4x_mmio(void) {
     if (exosphere_get_target_firmware() >= EXOSPHERE_TARGET_FIRMWARE_600) {
         configure_gpu_ucode_carveout();
     }
-    /* TODO: What are these MC reg writes? */
-    MAKE_MC_REG(0x65C) = 0xFFFFF000;
-    MAKE_MC_REG(0x660) = 0;
-    MAKE_MC_REG(0x964) |= 1;
+
+    /* Disable AHB redirect. */
+    MAKE_MC_REG(MC_IRAM_BOM) = 0xFFFFF000;
+    MAKE_MC_REG(MC_IRAM_TOM) = 0;
+    MAKE_MC_REG(MC_IRAM_REG_CTRL) |= 1;
     CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRD_0 &= 0xFFF7FFFF;
 
     /* TODO: What are these PMC scratch writes? */
@@ -275,16 +273,16 @@ void setup_4x_mmio(void) {
     AHB_ARBITRATION_DISABLE_0 |= 2;
 
     /* Set SMMU for BPMP/APB-DMA to point to TZRAM. */
-    MC_SMMU_PTB_ASID_0 = 1;
-    (void)MC_SMMU_TLB_CONFIG_0;
-    MC_SMMU_PTB_DATA_0 = 0x70012;
-    MC_SMMU_AVPC_ASID_0 = 0x80000001;
-    MC_SMMU_PPCS1_ASID_0 = 0x80000001;
-    (void)MC_SMMU_TLB_CONFIG_0;
-    MC_SMMU_PTC_FLUSH_0 = 0;
-    (void)MC_SMMU_TLB_CONFIG_0;
-    MC_SMMU_TLB_FLUSH_0 = 0;
-    (void)MC_SMMU_TLB_CONFIG_0;
+    MAKE_MC_REG(MC_SMMU_PTB_ASID) = 1;
+    (void)MAKE_MC_REG(MC_SMMU_TLB_CONFIG);
+    MAKE_MC_REG(MC_SMMU_PTB_DATA) = 0x70012;
+    MAKE_MC_REG(MC_SMMU_AVPC_ASID) = 0x80000001;
+    MAKE_MC_REG(MC_SMMU_PPCS1_ASID) = 0x80000001;
+    (void)MAKE_MC_REG(MC_SMMU_TLB_CONFIG);
+    MAKE_MC_REG(MC_SMMU_PTC_FLUSH) = 0;
+    (void)MAKE_MC_REG(MC_SMMU_TLB_CONFIG);
+    MAKE_MC_REG(MC_SMMU_TLB_FLUSH) = 0;
+    (void)MAKE_MC_REG(MC_SMMU_TLB_CONFIG);
 
     /* Wait for the BPMP to halt. */
     while ((FLOW_CTLR_HALT_COP_EVENTS_0 >> 29) != 2) {
@@ -321,7 +319,7 @@ void setup_current_core_state(void) {
 
     __isb();
 
-    SET_SYSREG(cntfrq_el0, MAKE_SYSCTR0_REG(0x20)); /* TODO: Reg name. */
+    SET_SYSREG(cntfrq_el0, SYSCTR0_CNTFID0_0);
     SET_SYSREG(cnthctl_el2, 3ull);
 
     __isb();

exosphere/src/exocfg.c

@@ -27,9 +27,12 @@
 /* TODO: Should this be at a non-static location? */
 #define MAILBOX_EXOSPHERE_CONFIG (*((volatile exosphere_config_t *)(MAILBOX_BASE + 0xE40ULL)))
 
-static exosphere_config_t g_exosphere_cfg = {MAGIC_EXOSPHERE_BOOTCONFIG, EXOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG};
+static exosphere_config_t g_exosphere_cfg = {MAGIC_EXOSPHERE_BOOTCONFIG, EXOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG, EXOSPHERE_FLAGS_DEFAULT};
 static bool g_has_loaded_config = false;
 
+#define EXOSPHERE_CHECK_FLAG(flag) ((g_exosphere_cfg.flags & flag) != 0)
+
+
 /* Read config out of IRAM, return target firmware version. */
 unsigned int exosphere_load_config(void) {
     if (g_has_loaded_config) {
@@ -37,8 +40,13 @@ unsigned int exosphere_load_config(void) {
     }
     g_has_loaded_config = true;
     
-    if (MAILBOX_EXOSPHERE_CONFIG.magic == MAGIC_EXOSPHERE_BOOTCONFIG) {
+    const unsigned int magic = MAILBOX_EXOSPHERE_CONFIG.magic;
+    
+    if (magic == MAGIC_EXOSPHERE_BOOTCONFIG) {
         g_exosphere_cfg = MAILBOX_EXOSPHERE_CONFIG;
+    } else if (magic == MAGIC_EXOSPHERE_BOOTCONFIG_0) {
+        g_exosphere_cfg = MAILBOX_EXOSPHERE_CONFIG;
+        g_exosphere_cfg.flags = EXOSPHERE_FLAGS_DEFAULT;
     }
     
     return g_exosphere_cfg.target_firmware;
@@ -50,4 +58,12 @@ unsigned int exosphere_get_target_firmware(void) {
     }
     
     return g_exosphere_cfg.target_firmware;
-}
+}
+
+unsigned int exosphere_should_perform_620_keygen(void) {
+    if (!g_has_loaded_config) {
+        generic_panic();
+    }
+    
+    return g_exosphere_cfg.target_firmware >= EXOSPHERE_TARGET_FIRMWARE_620 && EXOSPHERE_CHECK_FLAG(EXOSPHERE_FLAG_PERFORM_620_KEYGEN);
+}

exosphere/src/exocfg.h

@@ -25,7 +25,9 @@
 /* This serves to set configuration for *exosphere itself*, separate from the SecMon Exosphere mimics. */
 
 /* "XBC0" */
-#define MAGIC_EXOSPHERE_BOOTCONFIG (0x30434258)
+#define MAGIC_EXOSPHERE_BOOTCONFIG_0 (0x30434258)
+/* "XBC1" */
+#define MAGIC_EXOSPHERE_BOOTCONFIG (0x31434258)
 
 #define EXOSPHERE_TARGET_FIRMWARE_100 1
 #define EXOSPHERE_TARGET_FIRMWARE_200 2
@@ -33,9 +35,12 @@
 #define EXOSPHERE_TARGET_FIRMWARE_400 4
 #define EXOSPHERE_TARGET_FIRMWARE_500 5
 #define EXOSPHERE_TARGET_FIRMWARE_600 6
+#define EXOSPHERE_TARGET_FIRMWARE_620 7
+
+#define EXOSPHERE_TARGET_FIRMWARE_CURRENT EXOSPHERE_TARGET_FIRMWARE_620
 
 /* TODO: What should this be, for release? */
-#define EXOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG EXOSPHERE_TARGET_FIRMWARE_600
+#define EXOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG EXOSPHERE_TARGET_FIRMWARE_CURRENT
 #define EXOSPHERE_LOOSEN_PACKAGE2_RESTRICTIONS_FOR_DEBUG 1
 
 #define MAILBOX_BASE_PHYS  (MMIO_GET_DEVICE_PA(MMIO_DEVID_NXBOOTLOADER_MAILBOX))
@@ -43,17 +48,26 @@
 /* TODO: Should this be at a non-static location? */
 #define MAILBOX_EXOSPHERE_CONFIG_PHYS (*((volatile exosphere_config_t *)(MAILBOX_BASE_PHYS + 0xE40ULL)))
 
+#define EXOSPHERE_FLAGS_DEFAULT 0x00000000
+#define EXOSPHERE_FLAG_PERFORM_620_KEYGEN (1 << 0u)
 
 typedef struct {
     unsigned int magic;
     unsigned int target_firmware;
+    unsigned int flags;
 } exosphere_config_t;
 
 unsigned int exosphere_load_config(void);
 unsigned int exosphere_get_target_firmware(void);
+unsigned int exosphere_should_perform_620_keygen(void);
 
 static inline unsigned int exosphere_get_target_firmware_for_init(void) {
-    return MAILBOX_EXOSPHERE_CONFIG_PHYS.magic == MAGIC_EXOSPHERE_BOOTCONFIG ? MAILBOX_EXOSPHERE_CONFIG_PHYS.target_firmware : EXOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG;
+    const unsigned int magic = MAILBOX_EXOSPHERE_CONFIG_PHYS.magic;
+    if (magic == MAGIC_EXOSPHERE_BOOTCONFIG || magic == MAGIC_EXOSPHERE_BOOTCONFIG_0) {
+        return MAILBOX_EXOSPHERE_CONFIG_PHYS.target_firmware;
+    } else {
+        return EXOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG;
+    }
 }
 
 #endif

exosphere/src/masterkey.c

@@ -40,6 +40,7 @@ static const uint8_t mkey_vectors_dev[MASTERKEY_REVISION_MAX][0x10] =
     {0x2C, 0xCA, 0x9C, 0x31, 0x1E, 0x07, 0xB0, 0x02, 0x97, 0x0A, 0xD8, 0x03, 0xA2, 0x76, 0x3F, 0xA3}, /* Master key 02 encrypted with Master key 03. */
     {0x9B, 0x84, 0x76, 0x14, 0x72, 0x94, 0x52, 0xCB, 0x54, 0x92, 0x9B, 0xC4, 0x8C, 0x5B, 0x0F, 0xBA}, /* Master key 03 encrypted with Master key 04. */
     {0x78, 0xD5, 0xF1, 0x20, 0x3D, 0x16, 0xE9, 0x30, 0x32, 0x27, 0x34, 0x6F, 0xCF, 0xE0, 0x27, 0xDC}, /* Master key 04 encrypted with Master key 05. */
+    {0x6F, 0xD2, 0x84, 0x1D, 0x05, 0xEC, 0x40, 0x94, 0x5F, 0x18, 0xB3, 0x81, 0x09, 0x98, 0x8D, 0x4E}, /* Master key 05 encrypted with Master key 06. */
 };
 
 /* Retail unit keys. */
@@ -51,6 +52,7 @@ static const uint8_t mkey_vectors[MASTERKEY_REVISION_MAX][0x10] =
     {0x0A, 0x0D, 0xDF, 0x34, 0x22, 0x06, 0x6C, 0xA4, 0xE6, 0xB1, 0xEC, 0x71, 0x85, 0xCA, 0x4E, 0x07}, /* Master key 02 encrypted with Master key 03. */
     {0x6E, 0x7D, 0x2D, 0xC3, 0x0F, 0x59, 0xC8, 0xFA, 0x87, 0xA8, 0x2E, 0xD5, 0x89, 0x5E, 0xF3, 0xE9}, /* Master key 03 encrypted with Master key 04. */
     {0xEB, 0xF5, 0x6F, 0x83, 0x61, 0x9E, 0xF8, 0xFA, 0xE0, 0x87, 0xD7, 0xA1, 0x4E, 0x25, 0x36, 0xEE}, /* Master key 04 encrypted with Master key 05. */
+    {0x1E, 0x1E, 0x22, 0xC0, 0x5A, 0x33, 0x3C, 0xB9, 0x0B, 0xA9, 0x03, 0x04, 0xBA, 0xDB, 0x07, 0x57}, /* Master key 05 encrypted with Master key 06. */
 };
 
 bool check_mkey_revision(unsigned int revision, bool is_retail) {
@@ -123,7 +125,7 @@ unsigned int mkey_get_keyslot(unsigned int revision) {
 
 
 void set_old_devkey(unsigned int revision, const uint8_t *key) {
-    if (revision < MASTERKEY_REVISION_400_410 || MASTERKEY_REVISION_600_CURRENT <= revision) {
+    if (revision < MASTERKEY_REVISION_400_410 || MASTERKEY_REVISION_MAX <= revision) {
         generic_panic();
     }
 
@@ -140,7 +142,7 @@ unsigned int devkey_get_keyslot(unsigned int revision) {
     }
 
     if (revision >= 1) {
-        if (revision == MASTERKEY_REVISION_600_CURRENT) {
+        if (revision == MASTERKEY_REVISION_MAX) {
             return KEYSLOT_SWITCH_DEVICEKEY;
         } else {
             /* Load into a temp keyslot. */

exosphere/src/masterkey.h

@@ -19,15 +19,16 @@
 
 /* This is glue code to enable master key support across versions. */
 
-/* TODO: Update to 0x7 on release of new master key. */
-#define MASTERKEY_REVISION_MAX 0x6
+/* TODO: Update to 0x8 on release of new master key. */
+#define MASTERKEY_REVISION_MAX 0x7
 
 #define MASTERKEY_REVISION_100_230     0x00
 #define MASTERKEY_REVISION_300         0x01
 #define MASTERKEY_REVISION_301_302     0x02
 #define MASTERKEY_REVISION_400_410     0x03
 #define MASTERKEY_REVISION_500_510     0x04
-#define MASTERKEY_REVISION_600_CURRENT 0x05
+#define MASTERKEY_REVISION_600_610     0x05
+#define MASTERKEY_REVISION_620_CURRENT 0x06
 
 #define MASTERKEY_NUM_NEW_DEVICE_KEYS (MASTERKEY_REVISION_MAX - MASTERKEY_REVISION_400_410)
 

exosphere/src/mc.c

@@ -39,23 +39,23 @@ volatile security_carveout_t *get_carveout_by_id(unsigned int carveout) {
 }
 
 void configure_gpu_ucode_carveout(void) {
-    /* Starting in 6.0.0, Carveout 2 is configured later on. */
+    /* Starting in 6.0.0, Carveout 2 is configured later on and adds read permission to TSEC. */
     /* This is a helper function to make this easier... */
     volatile security_carveout_t *carveout = get_carveout_by_id(2);
     carveout->paddr_low = 0x80020000;
     carveout->paddr_high = 0;
-    carveout->size_big_pages = 2; /* 0x40000 */
-    carveout->flags_0 = 0;
-    carveout->flags_1 = 0;
-    carveout->flags_2 = 0x3000000;
-    carveout->flags_3 = 0;
-    carveout->flags_4 = 0x300;
-    carveout->flags_5 = 0;
-    carveout->flags_6 = 0;
-    carveout->flags_7 = 0;
-    carveout->flags_8 = 0;
-    carveout->flags_9 = 0;
-    carveout->allowed_clients = 0x440167E;
+    carveout->size_big_pages = 2;       /* 0x40000 */
+    carveout->client_access_0 = 0;
+    carveout->client_access_1 = 0;
+    carveout->client_access_2 = (exosphere_get_target_firmware() >= EXOSPHERE_TARGET_FIRMWARE_600) ? (BIT(CSR_GPUSRD) | BIT(CSW_GPUSWR) | BIT(CSR_TSECSRD)) : (BIT(CSR_GPUSRD) | BIT(CSW_GPUSWR));
+    carveout->client_access_3 = 0;
+    carveout->client_access_4 = (BIT(CSR_GPUSRD2) | BIT(CSW_GPUSWR2));
+    carveout->client_force_internal_access_0 = 0;
+    carveout->client_force_internal_access_1 = 0;
+    carveout->client_force_internal_access_2 = 0;
+    carveout->client_force_internal_access_3 = 0;
+    carveout->client_force_internal_access_4 = 0;
+    carveout->config = 0x440167E;
 }
 
 void configure_default_carveouts(void) {
@@ -64,17 +64,17 @@ void configure_default_carveouts(void) {
     carveout->paddr_low = 0;
     carveout->paddr_high = 0;
     carveout->size_big_pages = 0;
-    carveout->flags_0 = 0;
-    carveout->flags_1 = 0;
-    carveout->flags_2 = 0;
-    carveout->flags_3 = 0;
-    carveout->flags_4 = 0;
-    carveout->flags_5 = 0;
-    carveout->flags_6 = 0;
-    carveout->flags_7 = 0;
-    carveout->flags_8 = 0;
-    carveout->flags_9 = 0;
-    carveout->allowed_clients = 0x04000006;
+    carveout->client_access_0 = 0;
+    carveout->client_access_1 = 0;
+    carveout->client_access_2 = 0;
+    carveout->client_access_3 = 0;
+    carveout->client_access_4 = 0;
+    carveout->client_force_internal_access_0 = 0;
+    carveout->client_force_internal_access_1 = 0;
+    carveout->client_force_internal_access_2 = 0;
+    carveout->client_force_internal_access_3 = 0;
+    carveout->client_force_internal_access_4 = 0;
+    carveout->config = 0x4000006;
 
     /* Configure Carveout 2 (GPU UCODE) */
     if (exosphere_get_target_firmware() < EXOSPHERE_TARGET_FIRMWARE_600) {
@@ -86,17 +86,17 @@ void configure_default_carveouts(void) {
     carveout->paddr_low = 0;
     carveout->paddr_high = 0;
     carveout->size_big_pages = 0;
-    carveout->flags_0 = 0;
-    carveout->flags_1 = 0;
-    carveout->flags_2 = 0x3000000;
-    carveout->flags_3 = 0;
-    carveout->flags_4 = 0x300;
-    carveout->flags_5 = 0;
-    carveout->flags_6 = 0;
-    carveout->flags_7 = 0;
-    carveout->flags_8 = 0;
-    carveout->flags_9 = 0;
-    carveout->allowed_clients = 0x4401E7E;
+    carveout->client_access_0 = 0;
+    carveout->client_access_1 = 0;
+    carveout->client_access_2 = (BIT(CSR_GPUSRD) | BIT(CSW_GPUSWR));
+    carveout->client_access_3 = 0;
+    carveout->client_access_4 = (BIT(CSR_GPUSRD2) | BIT(CSW_GPUSWR2));
+    carveout->client_force_internal_access_0 = 0;
+    carveout->client_force_internal_access_1 = 0;
+    carveout->client_force_internal_access_2 = 0;
+    carveout->client_force_internal_access_3 = 0;
+    carveout->client_force_internal_access_4 = 0;
+    carveout->config = 0x4401E7E;
 
     /* Configure default Kernel carveouts based on 2.0.0+. */
     if (exosphere_get_target_firmware() >= EXOSPHERE_TARGET_FIRMWARE_200) {
@@ -111,17 +111,17 @@ void configure_default_carveouts(void) {
             carveout->paddr_low = 0;
             carveout->paddr_high = 0;
             carveout->size_big_pages = 0;
-            carveout->flags_0 = 0;
-            carveout->flags_1 = 0;
-            carveout->flags_2 = 0;
-            carveout->flags_3 = 0;
-            carveout->flags_4 = 0;
-            carveout->flags_5 = 0;
-            carveout->flags_6 = 0;
-            carveout->flags_7 = 0;
-            carveout->flags_8 = 0;
-            carveout->flags_9 = 0;
-            carveout->allowed_clients = 0x4000006;
+            carveout->client_access_0 = 0;
+            carveout->client_access_1 = 0;
+            carveout->client_access_2 = 0;
+            carveout->client_access_3 = 0;
+            carveout->client_access_4 = 0;
+            carveout->client_force_internal_access_0 = 0;
+            carveout->client_force_internal_access_1 = 0;
+            carveout->client_force_internal_access_2 = 0;
+            carveout->client_force_internal_access_3 = 0;
+            carveout->client_force_internal_access_4 = 0;
+            carveout->config = 0x4000006;
         }
     }
 }
@@ -138,15 +138,15 @@ void configure_kernel_carveout(unsigned int carveout_id, uint64_t address, uint6
     carveout->paddr_low = (uint32_t)(address & 0xFFFFFFFF);
     carveout->paddr_high = (uint32_t)(address >> 32);
     carveout->size_big_pages = (uint32_t)(size >> 17);
-    carveout->flags_0 = 0x70E3407F;
-    carveout->flags_1 = 0x1A620880;
-    carveout->flags_2 = 0x303C00;
-    carveout->flags_3 = 0xCF0830BB;
-    carveout->flags_4 = 0x3;
-    carveout->flags_5 = exosphere_get_target_firmware() >= EXOSPHERE_TARGET_FIRMWARE_400 && carveout_id == 4 ? 0x8000 : 0;
-    carveout->flags_6 = exosphere_get_target_firmware() >= EXOSPHERE_TARGET_FIRMWARE_400 && carveout_id == 4 ? 0x40000 : 0;
-    carveout->flags_7 = 0;
-    carveout->flags_8 = 0;
-    carveout->flags_9 = 0;
-    carveout->allowed_clients = 0x8B;
+    carveout->client_access_0 = (BIT(CSR_PTCR) | BIT(CSR_DISPLAY0A) | BIT(CSR_DISPLAY0AB) | BIT(CSR_DISPLAY0B) | BIT(CSR_DISPLAY0BB) | BIT(CSR_DISPLAY0C) | BIT(CSR_DISPLAY0CB) | BIT(CSR_AFIR) | BIT(CSR_DISPLAYHC) | BIT(CSR_DISPLAYHCB) | BIT(CSR_HDAR) | BIT(CSR_HOST1XDMAR) | BIT(CSR_HOST1XR) | BIT(CSR_NVENCSRD) | BIT(CSR_PPCSAHBDMAR) | BIT(CSR_PPCSAHBSLVR));
+    carveout->client_access_1 = (BIT(CSR_MPCORER) | BIT(CSW_NVENCSWR) | BIT(CSW_AFIW) | BIT(CSW_HDAW) | BIT(CSW_HOST1XW) | BIT(CSW_MPCOREW) | BIT(CSW_PPCSAHBDMAW) | BIT(CSW_PPCSAHBSLVW));
+    carveout->client_access_2 = (BIT(CSR_XUSB_HOSTR) | BIT(CSW_XUSB_HOSTW) | BIT(CSR_XUSB_DEVR) | BIT(CSW_XUSB_DEVW) | BIT(CSR_TSECSRD) | BIT(CSW_TSECSWR));
+    carveout->client_access_3 = (BIT(CSR_SDMMCRA) | BIT(CSR_SDMMCRAA) | BIT(CSR_SDMMCRAB) | BIT(CSW_SDMMCWA) | BIT(CSW_SDMMCWAA) | BIT(CSW_SDMMCWAB) | BIT(CSR_VICSRD) | BIT(CSW_VICSWR) | BIT(CSR_DISPLAYD) | BIT(CSR_NVDECSRD) | BIT(CSW_NVDECSWR) | BIT(CSR_APER) | BIT(CSW_APEW) | BIT(CSR_NVJPGSRD) | BIT(CSW_NVJPGSWR));
+    carveout->client_access_4 = (BIT(CSR_SESRD) | BIT(CSW_SESWR));
+    carveout->client_force_internal_access_0 = ((exosphere_get_target_firmware() >= EXOSPHERE_TARGET_FIRMWARE_400) && (carveout_id == 4)) ? BIT(CSR_AVPCARM7R) : 0;
+    carveout->client_force_internal_access_1 = ((exosphere_get_target_firmware() >= EXOSPHERE_TARGET_FIRMWARE_400) && (carveout_id == 4)) ? BIT(CSW_AVPCARM7W) : 0;
+    carveout->client_force_internal_access_2 = 0;
+    carveout->client_force_internal_access_3 = 0;
+    carveout->client_force_internal_access_4 = 0;
+    carveout->config = 0x8B;
 }

exosphere/src/mc.h

@@ -27,60 +27,597 @@ static inline uintptr_t get_mc_base(void) {
 }
 
 #define MC_BASE  (get_mc_base())
-
 #define MAKE_MC_REG(n) MAKE_REG32(MC_BASE + n)
 
-#define MC_SMMU_CONFIG_0     MAKE_MC_REG(0x010)
-#define MC_SMMU_TLB_CONFIG_0 MAKE_MC_REG(0x014)
-#define MC_SMMU_PTC_CONFIG_0 MAKE_MC_REG(0x018)
-#define MC_SMMU_PTB_ASID_0   MAKE_MC_REG(0x01C)
-#define MC_SMMU_PTB_DATA_0   MAKE_MC_REG(0x020)
-#define MC_SMMU_TLB_FLUSH_0  MAKE_MC_REG(0x030)
-#define MC_SMMU_PTC_FLUSH_0  MAKE_MC_REG(0x034)
-#define MC_SMMU_AFI_ASID_0   MAKE_MC_REG(0x238)
-#define MC_SMMU_AVPC_ASID_0  MAKE_MC_REG(0x23C)
+#define MC_INTSTATUS                                            0x0
+#define MC_INTMASK                                              0x4
+#define MC_ERR_STATUS                                           0x8
+#define MC_ERR_ADR                                              0xc
+#define MC_SMMU_CONFIG                                          0x10
+#define MC_SMMU_TLB_CONFIG                                      0x14
+#define MC_SMMU_PTC_CONFIG                                      0x18
+#define MC_SMMU_PTB_ASID                                        0x1c
+#define MC_SMMU_PTB_DATA                                        0x20
+#define MC_SMMU_TLB_FLUSH                                       0x30
+#define MC_SMMU_PTC_FLUSH                                       0x34
+#define MC_SMMU_AFI_ASID                                        0x238
+#define MC_SMMU_AVPC_ASID                                       0x23c
+#define MC_SMMU_PPCS1_ASID                                      0x298
+#define MC_SMMU_TRANSLATION_ENABLE_0                            0x228
+#define MC_SMMU_TRANSLATION_ENABLE_1                            0x22c
+#define MC_SMMU_TRANSLATION_ENABLE_2                            0x230
+#define MC_SMMU_TRANSLATION_ENABLE_3                            0x234
+#define MC_SMMU_TRANSLATION_ENABLE_4                            0xb98
+#define MC_PCFIFO_CLIENT_CONFIG0                                0xdd0
+#define MC_PCFIFO_CLIENT_CONFIG1                                0xdd4
+#define MC_PCFIFO_CLIENT_CONFIG2                                0xdd8
+#define MC_PCFIFO_CLIENT_CONFIG3                                0xddc
+#define MC_PCFIFO_CLIENT_CONFIG4                                0xde0
+#define MC_EMEM_CFG                                             0x50
+#define MC_EMEM_ADR_CFG                                         0x54
+#define MC_EMEM_ADR_CFG_DEV0                                    0x58
+#define MC_EMEM_ADR_CFG_DEV1                                    0x5c
+#define MC_EMEM_ADR_CFG_CHANNEL_MASK                            0x60
+#define MC_EMEM_ADR_CFG_BANK_MASK_0                             0x64
+#define MC_EMEM_ADR_CFG_BANK_MASK_1                             0x68
+#define MC_EMEM_ADR_CFG_BANK_MASK_2                             0x6c
+#define MC_SECURITY_CFG0                                        0x70
+#define MC_SECURITY_CFG1                                        0x74
+#define MC_SECURITY_CFG3                                        0x9bc
+#define MC_SECURITY_RSV                                         0x7c
+#define MC_EMEM_ARB_CFG                                         0x90
+#define MC_EMEM_ARB_OUTSTANDING_REQ                             0x94
+#define MC_EMEM_ARB_TIMING_RCD                                  0x98
+#define MC_EMEM_ARB_TIMING_RP                                   0x9c
+#define MC_EMEM_ARB_TIMING_RC                                   0xa0
+#define MC_EMEM_ARB_TIMING_RAS                                  0xa4
+#define MC_EMEM_ARB_TIMING_FAW                                  0xa8
+#define MC_EMEM_ARB_TIMING_RRD                                  0xac
+#define MC_EMEM_ARB_TIMING_RAP2PRE                              0xb0
+#define MC_EMEM_ARB_TIMING_WAP2PRE                              0xb4
+#define MC_EMEM_ARB_TIMING_R2R                                  0xb8
+#define MC_EMEM_ARB_TIMING_W2W                                  0xbc
+#define MC_EMEM_ARB_TIMING_R2W                                  0xc0
+#define MC_EMEM_ARB_TIMING_W2R                                  0xc4
+#define MC_EMEM_ARB_TIMING_RFCPB                                0x6c0
+#define MC_EMEM_ARB_TIMING_CCDMW                                0x6c4
+#define MC_EMEM_ARB_REFPB_HP_CTRL                               0x6f0
+#define MC_EMEM_ARB_REFPB_BANK_CTRL                             0x6f4
+#define MC_EMEM_ARB_DA_TURNS                                    0xd0
+#define MC_EMEM_ARB_DA_COVERS                                   0xd4
+#define MC_EMEM_ARB_MISC0                                       0xd8
+#define MC_EMEM_ARB_MISC1                                       0xdc
+#define MC_EMEM_ARB_MISC2                                       0xc8
+#define MC_EMEM_ARB_RING1_THROTTLE                              0xe0
+#define MC_EMEM_ARB_RING3_THROTTLE                              0xe4
+#define MC_EMEM_ARB_NISO_THROTTLE                               0x6b0
+#define MC_EMEM_ARB_OVERRIDE                                    0xe8
+#define MC_EMEM_ARB_RSV                                         0xec
+#define MC_CLKEN_OVERRIDE                                       0xf4
+#define MC_TIMING_CONTROL_DBG                                   0xf8
+#define MC_TIMING_CONTROL                                       0xfc
+#define MC_STAT_CONTROL                                         0x100
+#define MC_STAT_STATUS                                          0x104
+#define MC_STAT_EMC_CLOCK_LIMIT                                 0x108
+#define MC_STAT_EMC_CLOCK_LIMIT_MSBS                            0x10c
+#define MC_STAT_EMC_CLOCKS                                      0x110
+#define MC_STAT_EMC_CLOCKS_MSBS                                 0x114
+#define MC_STAT_EMC_FILTER_SET0_ADR_LIMIT_LO                    0x118
+#define MC_STAT_EMC_FILTER_SET1_ADR_LIMIT_LO                    0x158
+#define MC_STAT_EMC_FILTER_SET0_ADR_LIMIT_HI                    0x11c
+#define MC_STAT_EMC_FILTER_SET1_ADR_LIMIT_HI                    0x15c
+#define MC_STAT_EMC_FILTER_SET0_ADR_LIMIT_UPPER                 0xa20
+#define MC_STAT_EMC_FILTER_SET1_ADR_LIMIT_UPPER                 0xa24
+#define MC_STAT_EMC_FILTER_SET0_VIRTUAL_ADR_LIMIT_LO            0x198
+#define MC_STAT_EMC_FILTER_SET1_VIRTUAL_ADR_LIMIT_LO            0x1a8
+#define MC_STAT_EMC_FILTER_SET0_VIRTUAL_ADR_LIMIT_HI            0x19c
+#define MC_STAT_EMC_FILTER_SET1_VIRTUAL_ADR_LIMIT_HI            0x1ac
+#define MC_STAT_EMC_FILTER_SET0_VIRTUAL_ADR_LIMIT_UPPER         0xa28
+#define MC_STAT_EMC_FILTER_SET1_VIRTUAL_ADR_LIMIT_UPPER         0xa2c
+#define MC_STAT_EMC_FILTER_SET0_ASID                            0x1a0
+#define MC_STAT_EMC_FILTER_SET1_ASID                            0x1b0
+#define MC_STAT_EMC_FILTER_SET0_SLACK_LIMIT                     0x120
+#define MC_STAT_EMC_FILTER_SET1_SLACK_LIMIT                     0x160
+#define MC_STAT_EMC_FILTER_SET0_CLIENT_0                        0x128
+#define MC_STAT_EMC_FILTER_SET1_CLIENT_0                        0x168
+#define MC_STAT_EMC_FILTER_SET0_CLIENT_1                        0x12c
+#define MC_STAT_EMC_FILTER_SET1_CLIENT_1                        0x16c
+#define MC_STAT_EMC_FILTER_SET0_CLIENT_2                        0x130
+#define MC_STAT_EMC_FILTER_SET1_CLIENT_2                        0x170
+#define MC_STAT_EMC_FILTER_SET0_CLIENT_3                        0x134
+#define MC_STAT_EMC_FILTER_SET0_CLIENT_4                        0xb88
+#define MC_STAT_EMC_FILTER_SET1_CLIENT_3                        0x174
+#define MC_STAT_EMC_FILTER_SET1_CLIENT_4                        0xb8c
+#define MC_STAT_EMC_SET0_COUNT                                  0x138
+#define MC_STAT_EMC_SET0_COUNT_MSBS                             0x13c
+#define MC_STAT_EMC_SET1_COUNT                                  0x178
+#define MC_STAT_EMC_SET1_COUNT_MSBS                             0x17c
+#define MC_STAT_EMC_SET0_SLACK_ACCUM                            0x140
+#define MC_STAT_EMC_SET0_SLACK_ACCUM_MSBS                       0x144
+#define MC_STAT_EMC_SET1_SLACK_ACCUM                            0x180
+#define MC_STAT_EMC_SET1_SLACK_ACCUM_MSBS                       0x184
+#define MC_STAT_EMC_SET0_HISTO_COUNT                            0x148
+#define MC_STAT_EMC_SET0_HISTO_COUNT_MSBS                       0x14c
+#define MC_STAT_EMC_SET1_HISTO_COUNT                            0x188
+#define MC_STAT_EMC_SET1_HISTO_COUNT_MSBS                       0x18c
+#define MC_STAT_EMC_SET0_MINIMUM_SLACK_OBSERVED                 0x150
+#define MC_STAT_EMC_SET1_MINIMUM_SLACK_OBSERVED                 0x190
+#define MC_STAT_EMC_SET0_IDLE_CYCLE_COUNT                       0x1b8
+#define MC_STAT_EMC_SET0_IDLE_CYCL_COUNT_MSBS                   0x1bc
+#define MC_STAT_EMC_SET1_IDLE_CYCLE_COUNT                       0x1c8
+#define MC_STAT_EMC_SET1_IDLE_CYCL_COUNT_MSBS                   0x1cc
+#define MC_STAT_EMC_SET0_IDLE_CYCLE_PARTITION_SELECT            0x1c0
+#define MC_STAT_EMC_SET1_IDLE_CYCLE_PARTITION_SELECT            0x1d0
+#define MC_CLIENT_HOTRESET_CTRL                                 0x200
+#define MC_CLIENT_HOTRESET_CTRL_1                               0x970
+#define MC_CLIENT_HOTRESET_STATUS                               0x204
+#define MC_CLIENT_HOTRESET_STATUS_1                             0x974
+#define MC_EMEM_ARB_ISOCHRONOUS_0                               0x208
+#define MC_EMEM_ARB_ISOCHRONOUS_1                               0x20c
+#define MC_EMEM_ARB_ISOCHRONOUS_2                               0x210
+#define MC_EMEM_ARB_ISOCHRONOUS_3                               0x214
+#define MC_EMEM_ARB_ISOCHRONOUS_4                               0xb94
+#define MC_EMEM_ARB_HYSTERESIS_0                                0x218
+#define MC_EMEM_ARB_HYSTERESIS_1                                0x21c
+#define MC_EMEM_ARB_HYSTERESIS_2                                0x220
+#define MC_EMEM_ARB_HYSTERESIS_3                                0x224
+#define MC_EMEM_ARB_HYSTERESIS_4                                0xb84
+#define MC_EMEM_ARB_DHYSTERESIS_0                               0xbb0
+#define MC_EMEM_ARB_DHYSTERESIS_1                               0xbb4
+#define MC_EMEM_ARB_DHYSTERESIS_2                               0xbb8
+#define MC_EMEM_ARB_DHYSTERESIS_3                               0xbbc
+#define MC_EMEM_ARB_DHYSTERESIS_4                               0xbc0
+#define MC_EMEM_ARB_DHYST_CTRL                                  0xbcc
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_0                        0xbd0
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_1                        0xbd4
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_2                        0xbd8
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_3                        0xbdc
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_4                        0xbe0
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_5                        0xbe4
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_6                        0xbe8
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_7                        0xbec
+#define MC_RESERVED_RSV                                         0x3fc
+#define MC_DISB_EXTRA_SNAP_LEVELS                               0x408
+#define MC_APB_EXTRA_SNAP_LEVELS                                0x2a4
+#define MC_AHB_EXTRA_SNAP_LEVELS                                0x2a0
+#define MC_USBD_EXTRA_SNAP_LEVELS                               0xa18
+#define MC_ISP_EXTRA_SNAP_LEVELS                                0xa08
+#define MC_AUD_EXTRA_SNAP_LEVELS                                0xa10
+#define MC_MSE_EXTRA_SNAP_LEVELS                                0x40c
+#define MC_GK2_EXTRA_SNAP_LEVELS                                0xa40
+#define MC_A9AVPPC_EXTRA_SNAP_LEVELS                            0x414
+#define MC_FTOP_EXTRA_SNAP_LEVELS                               0x2bc
+#define MC_JPG_EXTRA_SNAP_LEVELS                                0xa3c
+#define MC_HOST_EXTRA_SNAP_LEVELS                               0xa14
+#define MC_SAX_EXTRA_SNAP_LEVELS                                0x2c0
+#define MC_DIS_EXTRA_SNAP_LEVELS                                0x2ac
+#define MC_VICPC_EXTRA_SNAP_LEVELS                              0xa1c
+#define MC_HDAPC_EXTRA_SNAP_LEVELS                              0xa48
+#define MC_AVP_EXTRA_SNAP_LEVELS                                0x2a8
+#define MC_USBX_EXTRA_SNAP_LEVELS                               0x404
+#define MC_PCX_EXTRA_SNAP_LEVELS                                0x2b8
+#define MC_SD_EXTRA_SNAP_LEVELS                                 0xa04
+#define MC_DFD_EXTRA_SNAP_LEVELS                                0xa4c
+#define MC_VE_EXTRA_SNAP_LEVELS                                 0x2d8
+#define MC_GK_EXTRA_SNAP_LEVELS                                 0xa00
+#define MC_VE2_EXTRA_SNAP_LEVELS                                0x410
+#define MC_SDM_EXTRA_SNAP_LEVELS                                0xa44
+#define MC_VIDEO_PROTECT_BOM                                    0x648
+#define MC_VIDEO_PROTECT_SIZE_MB                                0x64c
+#define MC_VIDEO_PROTECT_BOM_ADR_HI                             0x978
+#define MC_VIDEO_PROTECT_REG_CTRL                               0x650
+#define MC_ERR_VPR_STATUS                                       0x654
+#define MC_ERR_VPR_ADR                                          0x658
+#define MC_VIDEO_PROTECT_VPR_OVERRIDE                           0x418
+#define MC_VIDEO_PROTECT_VPR_OVERRIDE1                          0x590
+#define MC_IRAM_BOM                                             0x65c
+#define MC_IRAM_TOM                                             0x660
+#define MC_IRAM_ADR_HI                                          0x980
+#define MC_IRAM_REG_CTRL                                        0x964
+#define MC_EMEM_CFG_ACCESS_CTRL                                 0x664
+#define MC_TZ_SECURITY_CTRL                                     0x668
+#define MC_EMEM_ARB_OUTSTANDING_REQ_RING3                       0x66c
+#define MC_EMEM_ARB_OUTSTANDING_REQ_NISO                        0x6b4
+#define MC_EMEM_ARB_RING0_THROTTLE_MASK                         0x6bc
+#define MC_EMEM_ARB_NISO_THROTTLE_MASK                          0x6b8
+#define MC_EMEM_ARB_NISO_THROTTLE_MASK_1                        0xb80
+#define MC_SEC_CARVEOUT_BOM                                     0x670
+#define MC_SEC_CARVEOUT_SIZE_MB                                 0x674
+#define MC_SEC_CARVEOUT_ADR_HI                                  0x9d4
+#define MC_SEC_CARVEOUT_REG_CTRL                                0x678
+#define MC_ERR_SEC_STATUS                                       0x67c
+#define MC_ERR_SEC_ADR                                          0x680
+#define MC_PC_IDLE_CLOCK_GATE_CONFIG                            0x684
+#define MC_STUTTER_CONTROL                                      0x688
+#define MC_RESERVED_RSV_1                                       0x958
+#define MC_DVFS_PIPE_SELECT                                     0x95c
+#define MC_AHB_PTSA_MIN                                         0x4e0
+#define MC_AUD_PTSA_MIN                                         0x54c
+#define MC_MLL_MPCORER_PTSA_RATE                                0x44c
+#define MC_RING2_PTSA_RATE                                      0x440
+#define MC_USBD_PTSA_RATE                                       0x530
+#define MC_USBX_PTSA_MIN                                        0x528
+#define MC_USBD_PTSA_MIN                                        0x534
+#define MC_APB_PTSA_MAX                                         0x4f0
+#define MC_JPG_PTSA_RATE                                        0x584
+#define MC_DIS_PTSA_MIN                                         0x420
+#define MC_AVP_PTSA_MAX                                         0x4fc
+#define MC_AVP_PTSA_RATE                                        0x4f4
+#define MC_RING1_PTSA_MIN                                       0x480
+#define MC_DIS_PTSA_MAX                                         0x424
+#define MC_SD_PTSA_MAX                                          0x4d8
+#define MC_MSE_PTSA_RATE                                        0x4c4
+#define MC_VICPC_PTSA_MIN                                       0x558
+#define MC_PCX_PTSA_MAX                                         0x4b4
+#define MC_ISP_PTSA_RATE                                        0x4a0
+#define MC_A9AVPPC_PTSA_MIN                                     0x48c
+#define MC_RING2_PTSA_MAX                                       0x448
+#define MC_AUD_PTSA_RATE                                        0x548
+#define MC_HOST_PTSA_MIN                                        0x51c
+#define MC_MLL_MPCORER_PTSA_MAX                                 0x454
+#define MC_SD_PTSA_MIN                                          0x4d4
+#define MC_RING1_PTSA_RATE                                      0x47c
+#define MC_JPG_PTSA_MIN                                         0x588
+#define MC_HDAPC_PTSA_MIN                                       0x62c
+#define MC_AVP_PTSA_MIN                                         0x4f8
+#define MC_JPG_PTSA_MAX                                         0x58c
+#define MC_VE_PTSA_MAX                                          0x43c
+#define MC_DFD_PTSA_MAX                                         0x63c
+#define MC_VICPC_PTSA_RATE                                      0x554
+#define MC_GK_PTSA_MAX                                          0x544
+#define MC_VICPC_PTSA_MAX                                       0x55c
+#define MC_SDM_PTSA_MAX                                         0x624
+#define MC_SAX_PTSA_RATE                                        0x4b8
+#define MC_PCX_PTSA_MIN                                         0x4b0
+#define MC_APB_PTSA_MIN                                         0x4ec
+#define MC_GK2_PTSA_MIN                                         0x614
+#define MC_PCX_PTSA_RATE                                        0x4ac
+#define MC_RING1_PTSA_MAX                                       0x484
+#define MC_HDAPC_PTSA_RATE                                      0x628
+#define MC_MLL_MPCORER_PTSA_MIN                                 0x450
+#define MC_GK2_PTSA_MAX                                         0x618
+#define MC_AUD_PTSA_MAX                                         0x550
+#define MC_GK2_PTSA_RATE                                        0x610
+#define MC_ISP_PTSA_MAX                                         0x4a8
+#define MC_DISB_PTSA_RATE                                       0x428
+#define MC_VE2_PTSA_MAX                                         0x49c
+#define MC_DFD_PTSA_MIN                                         0x638
+#define MC_FTOP_PTSA_RATE                                       0x50c
+#define MC_A9AVPPC_PTSA_RATE                                    0x488
+#define MC_VE2_PTSA_MIN                                         0x498
+#define MC_USBX_PTSA_MAX                                        0x52c
+#define MC_DIS_PTSA_RATE                                        0x41c
+#define MC_USBD_PTSA_MAX                                        0x538
+#define MC_A9AVPPC_PTSA_MAX                                     0x490
+#define MC_USBX_PTSA_RATE                                       0x524
+#define MC_FTOP_PTSA_MAX                                        0x514
+#define MC_HDAPC_PTSA_MAX                                       0x630
+#define MC_SD_PTSA_RATE                                         0x4d0
+#define MC_DFD_PTSA_RATE                                        0x634
+#define MC_FTOP_PTSA_MIN                                        0x510
+#define MC_SDM_PTSA_RATE                                        0x61c
+#define MC_AHB_PTSA_RATE                                        0x4dc
+#define MC_SMMU_SMMU_PTSA_MAX                                   0x460
+#define MC_RING2_PTSA_MIN                                       0x444
+#define MC_SDM_PTSA_MIN                                         0x620
+#define MC_APB_PTSA_RATE                                        0x4e8
+#define MC_MSE_PTSA_MIN                                         0x4c8
+#define MC_HOST_PTSA_RATE                                       0x518
+#define MC_VE_PTSA_RATE                                         0x434
+#define MC_AHB_PTSA_MAX                                         0x4e4
+#define MC_SAX_PTSA_MIN                                         0x4bc
+#define MC_SMMU_SMMU_PTSA_MIN                                   0x45c
+#define MC_ISP_PTSA_MIN                                         0x4a4
+#define MC_HOST_PTSA_MAX                                        0x520
+#define MC_SAX_PTSA_MAX                                         0x4c0
+#define MC_VE_PTSA_MIN                                          0x438
+#define MC_GK_PTSA_MIN                                          0x540
+#define MC_MSE_PTSA_MAX                                         0x4cc
+#define MC_DISB_PTSA_MAX                                        0x430
+#define MC_DISB_PTSA_MIN                                        0x42c
+#define MC_SMMU_SMMU_PTSA_RATE                                  0x458
+#define MC_VE2_PTSA_RATE                                        0x494
+#define MC_GK_PTSA_RATE                                         0x53c
+#define MC_PTSA_GRANT_DECREMENT                                 0x960
+#define MC_LATENCY_ALLOWANCE_AVPC_0                             0x2e4
+#define MC_LATENCY_ALLOWANCE_AXIAP_0                            0x3a0
+#define MC_LATENCY_ALLOWANCE_XUSB_1                             0x380
+#define MC_LATENCY_ALLOWANCE_ISP2B_0                            0x384
+#define MC_LATENCY_ALLOWANCE_SDMMCAA_0                          0x3bc
+#define MC_LATENCY_ALLOWANCE_SDMMCA_0                           0x3b8
+#define MC_LATENCY_ALLOWANCE_ISP2_0                             0x370
+#define MC_LATENCY_ALLOWANCE_SE_0                               0x3e0
+#define MC_LATENCY_ALLOWANCE_ISP2_1                             0x374
+#define MC_LATENCY_ALLOWANCE_DC_0                               0x2e8
+#define MC_LATENCY_ALLOWANCE_VIC_0                              0x394
+#define MC_LATENCY_ALLOWANCE_DCB_1                              0x2f8
+#define MC_LATENCY_ALLOWANCE_NVDEC_0                            0x3d8
+#define MC_LATENCY_ALLOWANCE_DCB_2                              0x2fc
+#define MC_LATENCY_ALLOWANCE_TSEC_0                             0x390
+#define MC_LATENCY_ALLOWANCE_DC_2                               0x2f0
+#define MC_SCALED_LATENCY_ALLOWANCE_DISPLAY0AB                  0x694
+#define MC_LATENCY_ALLOWANCE_PPCS_1                             0x348
+#define MC_LATENCY_ALLOWANCE_XUSB_0                             0x37c
+#define MC_LATENCY_ALLOWANCE_PPCS_0                             0x344
+#define MC_LATENCY_ALLOWANCE_TSECB_0                            0x3f0
+#define MC_LATENCY_ALLOWANCE_AFI_0                              0x2e0
+#define MC_SCALED_LATENCY_ALLOWANCE_DISPLAY0B                   0x698
+#define MC_LATENCY_ALLOWANCE_DC_1                               0x2ec
+#define MC_LATENCY_ALLOWANCE_APE_0                              0x3dc
+#define MC_SCALED_LATENCY_ALLOWANCE_DISPLAY0C                   0x6a0
+#define MC_LATENCY_ALLOWANCE_A9AVP_0                            0x3a4
+#define MC_LATENCY_ALLOWANCE_GPU2_0                             0x3e8
+#define MC_LATENCY_ALLOWANCE_DCB_0                              0x2f4
+#define MC_LATENCY_ALLOWANCE_HC_1                               0x314
+#define MC_LATENCY_ALLOWANCE_SDMMC_0                            0x3c0
+#define MC_LATENCY_ALLOWANCE_NVJPG_0                            0x3e4
+#define MC_LATENCY_ALLOWANCE_PTC_0                              0x34c
+#define MC_LATENCY_ALLOWANCE_ETR_0                              0x3ec
+#define MC_LATENCY_ALLOWANCE_MPCORE_0                           0x320
+#define MC_LATENCY_ALLOWANCE_VI2_0                              0x398
+#define MC_SCALED_LATENCY_ALLOWANCE_DISPLAY0BB                  0x69c
+#define MC_SCALED_LATENCY_ALLOWANCE_DISPLAY0CB                  0x6a4
+#define MC_LATENCY_ALLOWANCE_SATA_0                             0x350
+#define MC_SCALED_LATENCY_ALLOWANCE_DISPLAY0A                   0x690
+#define MC_LATENCY_ALLOWANCE_HC_0                               0x310
+#define MC_LATENCY_ALLOWANCE_DC_3                               0x3c8
+#define MC_LATENCY_ALLOWANCE_GPU_0                              0x3ac
+#define MC_LATENCY_ALLOWANCE_SDMMCAB_0                          0x3c4
+#define MC_LATENCY_ALLOWANCE_ISP2B_1                            0x388
+#define MC_LATENCY_ALLOWANCE_NVENC_0                            0x328
+#define MC_LATENCY_ALLOWANCE_HDA_0                              0x318
+#define MC_MIN_LENGTH_APE_0                                     0xb34
+#define MC_MIN_LENGTH_DCB_2                                     0x8a8
+#define MC_MIN_LENGTH_A9AVP_0                                   0x950
+#define MC_MIN_LENGTH_TSEC_0                                    0x93c
+#define MC_MIN_LENGTH_DC_1                                      0x898
+#define MC_MIN_LENGTH_AXIAP_0                                   0x94c
+#define MC_MIN_LENGTH_ISP2B_0                                   0x930
+#define MC_MIN_LENGTH_VI2_0                                     0x944
+#define MC_MIN_LENGTH_DCB_0                                     0x8a0
+#define MC_MIN_LENGTH_DCB_1                                     0x8a4
+#define MC_MIN_LENGTH_PPCS_1                                    0x8f4
+#define MC_MIN_LENGTH_NVJPG_0                                   0xb3c
+#define MC_MIN_LENGTH_HDA_0                                     0x8c4
+#define MC_MIN_LENGTH_NVENC_0                                   0x8d4
+#define MC_MIN_LENGTH_SDMMC_0                                   0xb18
+#define MC_MIN_LENGTH_ISP2B_1                                   0x934
+#define MC_MIN_LENGTH_HC_1                                      0x8c0
+#define MC_MIN_LENGTH_DC_3                                      0xb20
+#define MC_MIN_LENGTH_AVPC_0                                    0x890
+#define MC_MIN_LENGTH_VIC_0                                     0x940
+#define MC_MIN_LENGTH_ISP2_0                                    0x91c
+#define MC_MIN_LENGTH_HC_0                                      0x8bc
+#define MC_MIN_LENGTH_SE_0                                      0xb38
+#define MC_MIN_LENGTH_NVDEC_0                                   0xb30
+#define MC_MIN_LENGTH_SATA_0                                    0x8fc
+#define MC_MIN_LENGTH_DC_0                                      0x894
+#define MC_MIN_LENGTH_XUSB_1                                    0x92c
+#define MC_MIN_LENGTH_DC_2                                      0x89c
+#define MC_MIN_LENGTH_SDMMCAA_0                                 0xb14
+#define MC_MIN_LENGTH_GPU_0                                     0xb04
+#define MC_MIN_LENGTH_ETR_0                                     0xb44
+#define MC_MIN_LENGTH_AFI_0                                     0x88c
+#define MC_MIN_LENGTH_PPCS_0                                    0x8f0
+#define MC_MIN_LENGTH_ISP2_1                                    0x920
+#define MC_MIN_LENGTH_XUSB_0                                    0x928
+#define MC_MIN_LENGTH_MPCORE_0                                  0x8cc
+#define MC_MIN_LENGTH_TSECB_0                                   0xb48
+#define MC_MIN_LENGTH_SDMMCA_0                                  0xb10
+#define MC_MIN_LENGTH_GPU2_0                                    0xb40
+#define MC_MIN_LENGTH_SDMMCAB_0                                 0xb1c
+#define MC_MIN_LENGTH_PTC_0                                     0x8f8
+#define MC_EMEM_ARB_OVERRIDE_1                                  0x968
+#define MC_VIDEO_PROTECT_GPU_OVERRIDE_0                         0x984
+#define MC_VIDEO_PROTECT_GPU_OVERRIDE_1                         0x988
+#define MC_EMEM_ARB_STATS_0                                     0x990
+#define MC_EMEM_ARB_STATS_1                                     0x994
+#define MC_MTS_CARVEOUT_BOM                                     0x9a0
+#define MC_MTS_CARVEOUT_SIZE_MB                                 0x9a4
+#define MC_MTS_CARVEOUT_ADR_HI                                  0x9a8
+#define MC_MTS_CARVEOUT_REG_CTRL                                0x9ac
+#define MC_ERR_MTS_STATUS                                       0x9b0
+#define MC_ERR_MTS_ADR                                          0x9b4
+#define MC_ERR_GENERALIZED_CARVEOUT_STATUS                      0xc00
+#define MC_ERR_GENERALIZED_CARVEOUT_ADR                         0xc04
+#define MC_SECURITY_CARVEOUT5_CLIENT_FORCE_INTERNAL_ACCESS2     0xd74
+#define MC_SECURITY_CARVEOUT4_CFG0                              0xcf8
+#define MC_SECURITY_CARVEOUT4_CLIENT_ACCESS2                    0xd10
+#define MC_SECURITY_CARVEOUT4_SIZE_128KB                        0xd04
+#define MC_SECURITY_CARVEOUT1_CLIENT_ACCESS4                    0xc28
+#define MC_SECURITY_CARVEOUT1_CLIENT_FORCE_INTERNAL_ACCESS1     0xc30
+#define MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS4     0xc8c
+#define MC_SECURITY_CARVEOUT4_CLIENT_FORCE_INTERNAL_ACCESS0     0xd1c
+#define MC_SECURITY_CARVEOUT5_CLIENT_FORCE_INTERNAL_ACCESS1     0xd70
+#define MC_SECURITY_CARVEOUT1_CLIENT_FORCE_INTERNAL_ACCESS0     0xc2c
+#define MC_SECURITY_CARVEOUT5_CLIENT_FORCE_INTERNAL_ACCESS4     0xd7c
+#define MC_SECURITY_CARVEOUT3_SIZE_128KB                        0xcb4
+#define MC_SECURITY_CARVEOUT2_CFG0                              0xc58
+#define MC_SECURITY_CARVEOUT1_CFG0                              0xc08
+#define MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS2     0xc84
+#define MC_SECURITY_CARVEOUT2_CLIENT_ACCESS0                    0xc68
+#define MC_SECURITY_CARVEOUT3_BOM                               0xcac
+#define MC_SECURITY_CARVEOUT2_CLIENT_ACCESS2                    0xc70
+#define MC_SECURITY_CARVEOUT5_CLIENT_FORCE_INTERNAL_ACCESS3     0xd78
+#define MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS0     0xc7c
+#define MC_SECURITY_CARVEOUT4_CLIENT_ACCESS4                    0xd18
+#define MC_SECURITY_CARVEOUT3_CLIENT_ACCESS1                    0xcbc
+#define MC_SECURITY_CARVEOUT1_CLIENT_FORCE_INTERNAL_ACCESS3     0xc38
+#define MC_SECURITY_CARVEOUT1_CLIENT_FORCE_INTERNAL_ACCESS2     0xc34
+#define MC_SECURITY_CARVEOUT3_CLIENT_ACCESS2                    0xcc0
+#define MC_SECURITY_CARVEOUT5_CLIENT_ACCESS2                    0xd60
+#define MC_SECURITY_CARVEOUT3_CFG0                              0xca8
+#define MC_SECURITY_CARVEOUT3_CLIENT_ACCESS0                    0xcb8
+#define MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS3     0xc88
+#define MC_SECURITY_CARVEOUT2_SIZE_128KB                        0xc64
+#define MC_SECURITY_CARVEOUT5_BOM_HI                            0xd50
+#define MC_SECURITY_CARVEOUT1_SIZE_128KB                        0xc14
+#define MC_SECURITY_CARVEOUT4_CLIENT_ACCESS3                    0xd14
+#define MC_SECURITY_CARVEOUT1_BOM                               0xc0c
+#define MC_SECURITY_CARVEOUT4_CLIENT_FORCE_INTERNAL_ACCESS4     0xd2c
+#define MC_SECURITY_CARVEOUT5_CLIENT_ACCESS4                    0xd68
+#define MC_SECURITY_CARVEOUT3_CLIENT_ACCESS4                    0xcc8
+#define MC_SECURITY_CARVEOUT5_CLIENT_ACCESS0                    0xd58
+#define MC_SECURITY_CARVEOUT4_CLIENT_FORCE_INTERNAL_ACCESS2     0xd24
+#define MC_SECURITY_CARVEOUT3_CLIENT_ACCESS3                    0xcc4
+#define MC_SECURITY_CARVEOUT2_CLIENT_ACCESS4                    0xc78
+#define MC_SECURITY_CARVEOUT1_CLIENT_ACCESS1                    0xc1c
+#define MC_SECURITY_CARVEOUT1_CLIENT_ACCESS0                    0xc18
+#define MC_SECURITY_CARVEOUT4_CLIENT_FORCE_INTERNAL_ACCESS3     0xd28
+#define MC_SECURITY_CARVEOUT5_CLIENT_ACCESS1                    0xd5c
+#define MC_SECURITY_CARVEOUT3_BOM_HI                            0xcb0
+#define MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS3     0xcd8
+#define MC_SECURITY_CARVEOUT2_BOM_HI                            0xc60
+#define MC_SECURITY_CARVEOUT4_BOM_HI                            0xd00
+#define MC_SECURITY_CARVEOUT5_CLIENT_ACCESS3                    0xd64
+#define MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS4     0xcdc
+#define MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS1     0xc80
+#define MC_SECURITY_CARVEOUT5_SIZE_128KB                        0xd54
+#define MC_SECURITY_CARVEOUT4_CLIENT_FORCE_INTERNAL_ACCESS1     0xd20
+#define MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS2     0xcd4
+#define MC_SECURITY_CARVEOUT4_CLIENT_ACCESS1                    0xd0c
+#define MC_SECURITY_CARVEOUT2_CLIENT_ACCESS3                    0xc74
+#define MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS0     0xccc
+#define MC_SECURITY_CARVEOUT4_BOM                               0xcfc
+#define MC_SECURITY_CARVEOUT5_CFG0                              0xd48
+#define MC_SECURITY_CARVEOUT2_BOM                               0xc5c
+#define MC_SECURITY_CARVEOUT5_BOM                               0xd4c
+#define MC_SECURITY_CARVEOUT1_CLIENT_ACCESS3                    0xc24
+#define MC_SECURITY_CARVEOUT5_CLIENT_FORCE_INTERNAL_ACCESS0     0xd6c
+#define MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS1     0xcd0
+#define MC_SECURITY_CARVEOUT1_BOM_HI                            0xc10
+#define MC_SECURITY_CARVEOUT1_CLIENT_ACCESS2                    0xc20
+#define MC_SECURITY_CARVEOUT1_CLIENT_FORCE_INTERNAL_ACCESS4     0xc3c
+#define MC_SECURITY_CARVEOUT2_CLIENT_ACCESS1                    0xc6c
+#define MC_SECURITY_CARVEOUT4_CLIENT_ACCESS0                    0xd08
+#define MC_ERR_APB_ASID_UPDATE_STATUS                           0x9d0
+#define MC_DA_CONFIG0                                           0x9dc
 
-#define MC_SMMU_TRANSLATION_ENABLE_0_0 MAKE_MC_REG(0x228)
-#define MC_SMMU_TRANSLATION_ENABLE_1_0 MAKE_MC_REG(0x22C)
-#define MC_SMMU_TRANSLATION_ENABLE_2_0 MAKE_MC_REG(0x230)
-#define MC_SMMU_TRANSLATION_ENABLE_3_0 MAKE_MC_REG(0x234)
-#define MC_SMMU_TRANSLATION_ENABLE_4_0 MAKE_MC_REG(0xB98)
-
-#define MC_SMMU_PPCS1_ASID_0 MAKE_MC_REG(0x298)
-
-#define MC_SECURITY_CFG0_0 MAKE_MC_REG(0x070)
-#define MC_SECURITY_CFG1_0 MAKE_MC_REG(0x074)
-#define MC_SECURITY_CFG3_0 MAKE_MC_REG(0x9BC)
+/* Virtual aliases */
+#define VIRT_MC_SECURITY_CFG3   MAKE_MC_REG(MC_SECURITY_CFG3)
 
+/* Memory Controller clients */
+#define CLIENT_ACCESS_NUM_CLIENTS   32
+typedef enum {
+    /* _ACCESS0 */
+    CSR_PTCR = (0 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0A = (1 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0AB = (2 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0B = (3 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0BB = (4 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0C = (5 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0CB = (6 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_AFIR = (14 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_AVPCARM7R = (15 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAYHC = (16 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAYHCB = (17 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_HDAR = (21 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_HOST1XDMAR = (22 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_HOST1XR = (23 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_NVENCSRD = (28 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_PPCSAHBDMAR = (29 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_PPCSAHBSLVR = (30 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_SATAR = (31 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    
+    /* _ACCESS1 */
+    CSR_VDEBSEVR = (34 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_VDEMBER = (35 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_VDEMCER = (36 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_VDETPER = (37 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_MPCORELPR = (38 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_MPCORER = (39 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_NVENCSWR = (43 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_AFIW = (49 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_AVPCARM7W = (50 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_HDAW = (53 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_HOST1XW = (54 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_MPCORELPW = (56 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_MPCOREW = (57 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_PPCSAHBDMAW = (59 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_PPCSAHBSLVW = (60 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_SATAW = (61 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_VDEBSEVW = (62 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_VDEDBGW = (63 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    
+    /* _ACCESS2 */
+    CSW_VDEMBEW = (64 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_VDETPMW = (65 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_ISPRA = (68 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_ISPWA = (70 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_ISPWB = (71 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_XUSB_HOSTR = (74 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_XUSB_HOSTW = (75 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_XUSB_DEVR = (76 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_XUSB_DEVW = (77 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_ISPRAB = (78 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_ISPWAB = (80 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_ISPWBB = (81 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_TSECSRD = (84 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_TSECSWR = (85 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_A9AVPSCR = (86 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_A9AVPSCW = (87 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_GPUSRD = (88 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_GPUSWR = (89 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_DISPLAYT = (90 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    
+    /* _ACCESS3 */
+    CSR_SDMMCRA = (96 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_SDMMCRAA = (97 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_SDMMCR = (98 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_SDMMCRAB = (99 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_SDMMCWA = (100 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_SDMMCWAA = (101 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_SDMMCW = (102 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_SDMMCWAB = (103 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_VICSRD = (108 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_VICSWR = (109 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_VIW = (114 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_DISPLAYD = (115 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_NVDECSRD = (120 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_NVDECSWR = (121 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_APER = (122 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_APEW = (123 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_NVJPGSRD = (126 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_NVJPGSWR = (127 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    
+    /* _ACCESS4 */
+    CSR_SESRD = (128 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_SESWR = (129 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSR_AXIAPR = (130 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_AXIAPW = (131 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSR_ETRR = (132 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_ETRW = (133 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSR_TSECSRDB = (134 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_TSECSWRB = (135 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSR_GPUSRD2 = (136 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_GPUSWR2 = (137 - (CLIENT_ACCESS_NUM_CLIENTS * 4))
+} McClient;
 
+/* Memory Controller carveouts */
 #define CARVEOUT_ID_MIN 1
 #define CARVEOUT_ID_MAX 5
-
 #define KERNEL_CARVEOUT_SIZE_MAX 0x1FFE0000
-
 typedef struct {
-    uint32_t allowed_clients;
+    uint32_t config;
     uint32_t paddr_low;
     uint32_t paddr_high;
     uint32_t size_big_pages;
-    uint32_t flags_0;
-    uint32_t flags_1;
-    uint32_t flags_2;
-    uint32_t flags_3;
-    uint32_t flags_4;
-    uint32_t flags_5;
-    uint32_t flags_6;
-    uint32_t flags_7;
-    uint32_t flags_8;
-    uint32_t flags_9;
+    uint32_t client_access_0;
+    uint32_t client_access_1;
+    uint32_t client_access_2;
+    uint32_t client_access_3;
+    uint32_t client_access_4;
+    uint32_t client_force_internal_access_0;
+    uint32_t client_force_internal_access_1;
+    uint32_t client_force_internal_access_2;
+    uint32_t client_force_internal_access_3;
+    uint32_t client_force_internal_access_4;
     uint8_t padding[0x18];
 } security_carveout_t;
 
-
 volatile security_carveout_t *get_carveout_by_id(unsigned int carveout);
 void configure_default_carveouts(void);
 void configure_gpu_ucode_carveout(void);
 void configure_kernel_carveout(unsigned int carveout_id, uint64_t address, uint64_t size);
 
-
-#endif
+#endif

exosphere/src/package2.c

@@ -38,21 +38,48 @@ extern void *__start_cold_addr;
 extern size_t __bin_size;
 
 static const uint8_t new_device_key_sources[MASTERKEY_NUM_NEW_DEVICE_KEYS][0x10] = {
-    {0x8B, 0x4E, 0x1C, 0x22, 0x42, 0x07, 0xC8, 0x73, 0x56, 0x94, 0x08, 0x8B, 0xCC, 0x47, 0x0F, 0x5D}, /* 4.x New Device Key Source. */
-    {0x6C, 0xEF, 0xC6, 0x27, 0x8B, 0xEC, 0x8A, 0x91, 0x99, 0xAB, 0x24, 0xAC, 0x4F, 0x1C, 0x8F, 0x1C}, /* 5.x New Device Key Source. */
-    {0x70, 0x08, 0x1B, 0x97, 0x44, 0x64, 0xF8, 0x91, 0x54, 0x9D, 0xC6, 0x84, 0x8F, 0x1A, 0xB2, 0xE4}  /* 6.x New Device Key Source. */
+    {0x8B, 0x4E, 0x1C, 0x22, 0x42, 0x07, 0xC8, 0x73, 0x56, 0x94, 0x08, 0x8B, 0xCC, 0x47, 0x0F, 0x5D}, /* 4.x   New Device Key Source. */
+    {0x6C, 0xEF, 0xC6, 0x27, 0x8B, 0xEC, 0x8A, 0x91, 0x99, 0xAB, 0x24, 0xAC, 0x4F, 0x1C, 0x8F, 0x1C}, /* 5.x   New Device Key Source. */
+    {0x70, 0x08, 0x1B, 0x97, 0x44, 0x64, 0xF8, 0x91, 0x54, 0x9D, 0xC6, 0x84, 0x8F, 0x1A, 0xB2, 0xE4}, /* 6.x   New Device Key Source. */
+    {0x8E, 0x09, 0x1F, 0x7A, 0xBB, 0xCA, 0x6A, 0xFB, 0xB8, 0x9B, 0xD5, 0xC1, 0x25, 0x9C, 0xA9, 0x17}  /* 6.2.0 New Device Key Source. */
 };
 
 static const uint8_t new_device_keygen_sources[MASTERKEY_NUM_NEW_DEVICE_KEYS][0x10] = {
-    {0x88, 0x62, 0x34, 0x6E, 0xFA, 0xF7, 0xD8, 0x3F, 0xE1, 0x30, 0x39, 0x50, 0xF0, 0xB7, 0x5D, 0x5D}, /* 4.x New Device Keygen Source. */
-    {0x06, 0x1E, 0x7B, 0xE9, 0x6D, 0x47, 0x8C, 0x77, 0xC5, 0xC8, 0xE7, 0x94, 0x9A, 0xA8, 0x5F, 0x2E}, /* 5.x New Device Keygen Source. */
-    {0x99, 0xFA, 0x98, 0xBD, 0x15, 0x1C, 0x72, 0xFD, 0x7D, 0x9A, 0xD5, 0x41, 0x00, 0xFD, 0xB2, 0xEF}  /* 6.x New Device Keygen Source. */
+    {0x88, 0x62, 0x34, 0x6E, 0xFA, 0xF7, 0xD8, 0x3F, 0xE1, 0x30, 0x39, 0x50, 0xF0, 0xB7, 0x5D, 0x5D}, /* 4.x   New Device Keygen Source. */
+    {0x06, 0x1E, 0x7B, 0xE9, 0x6D, 0x47, 0x8C, 0x77, 0xC5, 0xC8, 0xE7, 0x94, 0x9A, 0xA8, 0x5F, 0x2E}, /* 5.x   New Device Keygen Source. */
+    {0x99, 0xFA, 0x98, 0xBD, 0x15, 0x1C, 0x72, 0xFD, 0x7D, 0x9A, 0xD5, 0x41, 0x00, 0xFD, 0xB2, 0xEF}, /* 6.x   New Device Keygen Source. */
+    {0x81, 0x3C, 0x6C, 0xBF, 0x5D, 0x21, 0xDE, 0x77, 0x20, 0xD9, 0x6C, 0xE3, 0x22, 0x06, 0xAE, 0xBB}  /* 6.2.0 New Device Keygen Source. */
 };
 
 static const uint8_t new_device_keygen_sources_dev[MASTERKEY_NUM_NEW_DEVICE_KEYS][0x10] = {
-    {0xD6, 0xBD, 0x9F, 0xC6, 0x18, 0x09, 0xE1, 0x96, 0x20, 0x39, 0x60, 0xD2, 0x89, 0x83, 0x31, 0x34}, /* 4.x New Device Keygen Source. */
-    {0x59, 0x2D, 0x20, 0x69, 0x33, 0xB5, 0x17, 0xBA, 0xCF, 0xB1, 0x4E, 0xFD, 0xE4, 0xC2, 0x7B, 0xA8}, /* 5.x New Device Keygen Source. */
-    {0xF6, 0xD8, 0x59, 0x63, 0x8F, 0x47, 0xCB, 0x4A, 0xD8, 0x74, 0x05, 0x7F, 0x88, 0x92, 0x33, 0xA5}  /* 6.x New Device Keygen Source. */
+    {0xD6, 0xBD, 0x9F, 0xC6, 0x18, 0x09, 0xE1, 0x96, 0x20, 0x39, 0x60, 0xD2, 0x89, 0x83, 0x31, 0x34}, /* 4.x   New Device Keygen Source. */
+    {0x59, 0x2D, 0x20, 0x69, 0x33, 0xB5, 0x17, 0xBA, 0xCF, 0xB1, 0x4E, 0xFD, 0xE4, 0xC2, 0x7B, 0xA8}, /* 5.x   New Device Keygen Source. */
+    {0xF6, 0xD8, 0x59, 0x63, 0x8F, 0x47, 0xCB, 0x4A, 0xD8, 0x74, 0x05, 0x7F, 0x88, 0x92, 0x33, 0xA5}, /* 6.x   New Device Keygen Source. */
+    {0x20, 0xAB, 0xF2, 0x0F, 0x05, 0xE3, 0xDE, 0x2E, 0xA1, 0xFB, 0x37, 0x5E, 0x8B, 0x22, 0x1A, 0x38}  /* 6.2.0 New Device Keygen Source. */
+};
+
+static const uint8_t new_master_kek_sources[1][0x10] = {
+    {0x37, 0x4B, 0x77, 0x29, 0x59, 0xB4, 0x04, 0x30, 0x81, 0xF6, 0xE5, 0x8C, 0x6D, 0x36, 0x17, 0x9A}, /* 6.2.0 Master Kek Source. */
+};
+
+static const uint8_t keyblob_key_seed_00[0x10] = {
+    0xDF, 0x20, 0x6F, 0x59, 0x44, 0x54, 0xEF, 0xDC, 0x70, 0x74, 0x48, 0x3B, 0x0D, 0xED, 0x9F, 0xD3
+};
+
+static const uint8_t devicekey_seed[0x10] = {
+    0x4F, 0x02, 0x5F, 0x0E, 0xB6, 0x6D, 0x11, 0x0E, 0xDC, 0x32, 0x7D, 0x41, 0x86, 0xC2, 0xF4, 0x78
+};
+
+static const uint8_t devicekey_4x_seed[0x10] = {
+    0x0C, 0x91, 0x09, 0xDB, 0x93, 0x93, 0x07, 0x81, 0x07, 0x3C, 0xC4, 0x16, 0x22, 0x7C, 0x6C, 0x28
+};
+
+static const uint8_t masterkey_seed[0x10] = {
+    0xD8, 0xA2, 0x41, 0x0A, 0xC6, 0xC5, 0x90, 0x01, 0xC6, 0x1D, 0x6A, 0x26, 0x7C, 0x51, 0x3F, 0x3C
+};
+
+static const uint8_t devicekek_4x_seed[0x10] = {
+    0x2D, 0xC1, 0xF4, 0x8D, 0xF3, 0x5B, 0x69, 0x33, 0x42, 0x10, 0xAC, 0x65, 0xDA, 0x90, 0x46, 0x66
 };
 
 static void derive_new_device_keys(unsigned int keygen_keyslot) {
@@ -105,6 +132,20 @@ static void setup_se(void) {
     for (unsigned int i = 0; i < KEYSLOT_RSA_MAX; i++) {
         set_rsa_keyslot_flags(i, 0x41);
     }
+    
+    if (exosphere_get_target_firmware() >= EXOSPHERE_TARGET_FIRMWARE_620 && exosphere_should_perform_620_keygen()) {
+        /* Start by generating device keys. */
+        se_aes_ecb_decrypt_block(KEYSLOT_SWITCH_6XTSECKEY, work_buffer, 0x10, keyblob_key_seed_00, 0x10);
+        decrypt_data_into_keyslot(KEYSLOT_SWITCH_4XOLDDEVICEKEY, KEYSLOT_SWITCH_6XSBK, work_buffer, 0x10);
+        decrypt_data_into_keyslot(KEYSLOT_SWITCH_4XNEWCONSOLEKEYGENKEY, KEYSLOT_SWITCH_4XOLDDEVICEKEY, devicekey_4x_seed, 0x10);
+        decrypt_data_into_keyslot(KEYSLOT_SWITCH_4XOLDDEVICEKEY, KEYSLOT_SWITCH_4XOLDDEVICEKEY, devicekey_seed, 0x10);
+        
+        /* Next, generate the master kek, and from there master key/device kek. We use different keyslots than Nintendo, here. */
+        decrypt_data_into_keyslot(KEYSLOT_SWITCH_6XTSECROOTKEY, KEYSLOT_SWITCH_6XTSECROOTKEY, new_master_kek_sources[0], 0x10);
+        decrypt_data_into_keyslot(KEYSLOT_SWITCH_MASTERKEY, KEYSLOT_SWITCH_6XTSECROOTKEY, masterkey_seed, 0x10);
+        decrypt_data_into_keyslot(KEYSLOT_SWITCH_5XNEWDEVICEKEYGENKEY, KEYSLOT_SWITCH_6XTSECROOTKEY, devicekek_4x_seed, 0x10);
+        clear_aes_keyslot(KEYSLOT_SWITCH_6XTSECROOTKEY);  
+    }
 
     /* Detect Master Key revision. */
     mkey_detect_revision();
@@ -120,6 +161,7 @@ static void setup_se(void) {
             break;
         case EXOSPHERE_TARGET_FIRMWARE_500:
         case EXOSPHERE_TARGET_FIRMWARE_600:
+        case EXOSPHERE_TARGET_FIRMWARE_620:
             derive_new_device_keys(KEYSLOT_SWITCH_5XNEWDEVICEKEYGENKEY);
             break;
     }
@@ -304,7 +346,7 @@ static bool validate_package2_metadata(package2_meta_t *metadata) {
 
     /* Perform version checks. */
     /* We will be compatible with all package2s released before current, but not newer ones. */
-    if (metadata->version_max >= PACKAGE2_MINVER_THEORETICAL && metadata->version_min < PACKAGE2_MAXVER_600_CURRENT) {
+    if (metadata->version_max >= PACKAGE2_MINVER_THEORETICAL && metadata->version_min < PACKAGE2_MAXVER_620_CURRENT) {
         return true;
     }
 
@@ -424,6 +466,7 @@ static void copy_warmboot_bin_to_dram() {
             warmboot_src = (uint8_t *)0x4003B000;
             break;
         case EXOSPHERE_TARGET_FIRMWARE_600:
+        case EXOSPHERE_TARGET_FIRMWARE_620:
             warmboot_src = (uint8_t *)0x4003D800;
             break;
     }
@@ -486,6 +529,9 @@ void load_package2(coldboot_crt0_reloc_list_t *reloc_list) {
             case EXOSPHERE_TARGET_FIRMWARE_600:
                 MAKE_REG32(PMC_BASE + 0x360) = 0x87;
                 break;
+            case EXOSPHERE_TARGET_FIRMWARE_620:
+                MAKE_REG32(PMC_BASE + 0x360) = 0xA8;
+                break;
         }
     }
 

exosphere/src/package2.h

@@ -67,7 +67,8 @@ static inline uintptr_t get_nx_bootloader_mailbox_base(void) {
 #define PACKAGE2_MAXVER_302 0x5
 #define PACKAGE2_MAXVER_400_410 0x6
 #define PACKAGE2_MAXVER_500_510 0x7
-#define PACKAGE2_MAXVER_600_CURRENT 0x8
+#define PACKAGE2_MAXVER_600_610 0x8
+#define PACKAGE2_MAXVER_620_CURRENT 0x9
 
 #define PACKAGE2_MINVER_100 0x3
 #define PACKAGE2_MINVER_200 0x4
@@ -75,7 +76,8 @@ static inline uintptr_t get_nx_bootloader_mailbox_base(void) {
 #define PACKAGE2_MINVER_302 0x6
 #define PACKAGE2_MINVER_400_410 0x7
 #define PACKAGE2_MINVER_500_510 0x8
-#define PACKAGE2_MINVER_600_CURRENT 0x9
+#define PACKAGE2_MINVER_600_610 0x9
+#define PACKAGE2_MINVER_620_CURRENT 0xA
 
 typedef struct {
     union {

exosphere/src/se.h

@@ -43,6 +43,11 @@
 /* This keyslot was added in 5.0.0. */
 #define KEYSLOT_SWITCH_5XNEWDEVICEKEYGENKEY 0xA
 
+/* This keyslot was added in 6.00. */
+#define KEYSLOT_SWITCH_6XTSECKEY 0xC
+#define KEYSLOT_SWITCH_6XTSECROOTKEY 0xD
+#define KEYSLOT_SWITCH_6XSBK 0xE
+
 #define KEYSLOT_AES_MAX 0x10
 #define KEYSLOT_RSA_MAX 0x2
 

exosphere/src/smc_api.c

@@ -159,6 +159,7 @@ void set_version_specific_smcs(void) {
             break;
         case EXOSPHERE_TARGET_FIRMWARE_500:
         case EXOSPHERE_TARGET_FIRMWARE_600:
+        case EXOSPHERE_TARGET_FIRMWARE_620:
             /* No more LoadSecureExpModKey. */
             g_smc_user_table[0xE].handler = NULL;
             g_smc_user_table[0xC].id = 0xC300D60C;

exosphere/src/smc_user.c

@@ -49,6 +49,7 @@ static bool is_user_keyslot_valid(unsigned int keyslot) {
         case EXOSPHERE_TARGET_FIRMWARE_500:
             return keyslot <= 3;
         case EXOSPHERE_TARGET_FIRMWARE_600:
+        case EXOSPHERE_TARGET_FIRMWARE_620:
         default:
             return keyslot <= 5;
     }
@@ -166,7 +167,7 @@ uint32_t user_generate_aes_kek(smc_args_t *args) {
     /* 5.0.0+ Bounds checking. */
     if (exosphere_get_target_firmware() >= EXOSPHERE_TARGET_FIRMWARE_500) {
         if (is_personalized) {
-            if (master_key_rev > MASTERKEY_REVISION_600_CURRENT || ((1 << (master_key_rev + 1)) & 0x73) == 0) {
+            if (master_key_rev >= MASTERKEY_REVISION_MAX || (MASTERKEY_REVISION_300 <= master_key_rev && master_key_rev < MASTERKEY_REVISION_400_410)) {
                 return 2;
             }
             if (mask_id > 3 || usecase >= CRYPTOUSECASE_MAX_5X) {

exosphere/src/timers.h

@@ -27,10 +27,11 @@ static inline uintptr_t get_timers_base(void) {
 }
 
 #define TIMERS_BASE (get_timers_base())
-
 #define MAKE_TIMERS_REG(n) MAKE_REG32(TIMERS_BASE + n)
 
-#define TIMERUS_CNTR_1US_0 MAKE_REG32(TIMERS_BASE + 0x10)
+#define TIMERUS_CNTR_1US_0 MAKE_TIMERS_REG(0x10)
+#define SHARED_INTR_STATUS_0 MAKE_TIMERS_REG(0x1A0)
+#define SHARED_TIMER_SECURE_CFG_0 MAKE_TIMERS_REG(0x1A4)
 
 typedef struct {
     uint32_t CONFIG;
@@ -41,7 +42,7 @@ typedef struct {
 
 #define GET_WDT(n) ((volatile watchdog_timers_t *)(TIMERS_BASE + 0x100 + 0x20 * n))
 #define WDT_REBOOT_PATTERN 0xC45A
-#define GET_WDT_REBOOT_CFG_REG(n) MAKE_REG32(TIMERS_BASE + 0x60 + 0x8*n)
+#define GET_WDT_REBOOT_CFG_REG(n) MAKE_REG32(TIMERS_BASE + 0x60 + 0x8 * n)
 
 void wait(uint32_t microseconds);
 

exosphere/src/warmboot_init.c

@@ -199,7 +199,7 @@ void warmboot_init(void) {
     invalidate_icache_all();
     
     /* On warmboot (not cpu_on) only */
-    if (MC_SECURITY_CFG3_0 == 0) {
+    if (VIRT_MC_SECURITY_CFG3 == 0) {
         init_dma_controllers(g_exosphere_target_firmware_for_init);
     }
     

exosphere/src/warmboot_main.c

@@ -54,7 +54,7 @@ void __attribute__((noreturn)) warmboot_main(void) {
     identity_unmap_iram_cd_tzram();
 
     /* On warmboot (not cpu_on) only */
-    if (MC_SECURITY_CFG3_0 == 0) {
+    if (VIRT_MC_SECURITY_CFG3 == 0) {
         if (!configitem_is_retail()) {
             /* TODO: uart_log("OHAYO"); */
         }

fusee/fusee-primary/Makefile

@@ -9,6 +9,13 @@ endif
 TOPDIR ?= $(CURDIR)
 include $(DEVKITARM)/base_rules
 
+AMSBRANCH := $(shell git symbolic-ref --short HEAD)
+AMSREV := $(AMSBRANCH)-$(shell git rev-parse --short HEAD)
+
+ifneq (, $(strip $(shell git status --porcelain 2>/dev/null)))
+    AMSREV := $(AMSREV)-dirty
+endif
+
 #---------------------------------------------------------------------------------
 # TARGET is the name of the output
 # BUILD is the directory where object files & intermediate files will be placed
@@ -26,7 +33,7 @@ INCLUDES	:=	include  ../../common/include
 # options for code generation
 #---------------------------------------------------------------------------------
 ARCH	:=	-march=armv4t -mtune=arm7tdmi -mthumb -mthumb-interwork
-DEFINES :=	-D__BPMP__ -DFUSEE_STAGE1_SRC
+DEFINES :=	-D__BPMP__ -DFUSEE_STAGE1_SRC -DATMOSPHERE_GIT_BRANCH=\"$(AMSBRANCH)\" -DATMOSPHERE_GIT_REV=\"$(AMSREV)\"
 
 CFLAGS	:= \
 	-g \

fusee/fusee-primary/src/hwinit.c

@@ -213,8 +213,8 @@ void nx_hwinit()
     APB_MISC_PP_PINMUX_GLOBAL_0 = 0;
     
     /* Configure GPIOs. */
-    /* NOTE: In 3.x+ part of the GPIO configuration is skipped if the unit is SDEV. */
-    /* NOTE: In 6.x+ the GPIO configuration's order was changed a bit. */
+    /* NOTE: [3.0.0+] Part of the GPIO configuration is skipped if the unit is SDEV. */
+    /* NOTE: [6.0.0+] The GPIO configuration's order was changed a bit. */
     config_gpios();
 
     /* Uncomment for UART debugging. */
@@ -233,14 +233,14 @@ void nx_hwinit()
     clkrst_reboot(CARDEVICE_I2C5);
     
     /* Reboot SE. */
-    /* NOTE: In 4.x+ this was removed. */
-    clkrst_reboot(CARDEVICE_SE);
+    /* NOTE: [4.0.0+] This was removed. */
+    /* clkrst_reboot(CARDEVICE_SE); */
     
     /* Reboot unknown device. */
     clkrst_reboot(CARDEVICE_UNK);
 
     /* Initialize I2C1. */
-    /* NOTE: In 6.x+ this was moved to after the PMIC is configured. */
+    /* NOTE: [6.0.0+] This was moved to after the PMIC is configured. */
     i2c_init(I2C_1);
     
     /* Initialize I2C5. */
@@ -268,11 +268,9 @@ void nx_hwinit()
     val = 0x1B;
     i2c_send(I2C_5, MAX77620_PWR_I2C_ADDR, MAX77620_REG_FPS_SD3, &val, 1);
     
-    /* TODO: In 3.x+ this was added. */
-    /*
+    /* NOTE: [3.0.0+] This was added. */
     val = 0x22;
     i2c_send(I2C_5, MAX77620_PWR_I2C_ADDR, MAX77620_REG_FPS_GPIO3, &val, 1);
-    */
     
     /* TODO: In 3.x+, if the unit is SDEV, the MBLPD bit is set. */
     /*
@@ -286,15 +284,15 @@ void nx_hwinit()
     i2c_send(I2C_5, MAX77620_PWR_I2C_ADDR, MAX77620_REG_SD0, &val, 1);
 
     /* Configure and lock PMC scratch registers. */
-    /* NOTE: In 4.x+ this was removed. */
+    /* NOTE: [4.0.0+] This was removed. */
     config_pmc_scratch();
 
     /* Set super clock burst policy. */
     car->sclk_brst_pol = ((car->sclk_brst_pol & 0xFFFF8888) | 0x3333);
 
     /* Configure memory controller carveouts. */
-    /* NOTE: In 4.x+ this was removed. */
-    mc_config_carveout();
+    /* NOTE: [4.0.0+] This is now done in the Secure Monitor. */
+    /* mc_config_carveout(); */
 
     /* Initialize SDRAM. */
     sdram_init();

fusee/fusee-primary/src/mc.c

@@ -31,6 +31,7 @@ void mc_config_tsec_carveout(uint32_t bom, uint32_t size1mb, bool lock)
 void mc_config_carveout()
 {
     *(volatile uint32_t *)0x8005FFFC = 0xC0EDBBCC;
+    
     MAKE_MC_REG(MC_VIDEO_PROTECT_GPU_OVERRIDE_0) = 1;
     MAKE_MC_REG(MC_VIDEO_PROTECT_GPU_OVERRIDE_1) = 0;
     MAKE_MC_REG(MC_VIDEO_PROTECT_BOM) = 0;
@@ -43,6 +44,7 @@ void mc_config_carveout()
     MAKE_MC_REG(MC_MTS_CARVEOUT_SIZE_MB) = 0;
     MAKE_MC_REG(MC_MTS_CARVEOUT_ADR_HI) = 0;
     MAKE_MC_REG(MC_MTS_CARVEOUT_REG_CTRL) = 1;
+    
     MAKE_MC_REG(MC_SECURITY_CARVEOUT1_BOM) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT1_BOM_HI) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT1_SIZE_128KB) = 0;
@@ -63,15 +65,16 @@ void mc_config_carveout()
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_SIZE_128KB) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS0) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS1) = 0;
-    MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS2) = 0x3000000;
+    MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS2) = (BIT(CSR_GPUSRD) | BIT(CSW_GPUSWR));
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS3) = 0;
-    MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS4) = 0x300;
+    MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS4) = (BIT(CSR_GPUSRD2) | BIT(CSW_GPUSWR2));
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS0) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS1) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS2) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS3) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS4) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CFG0) = 0x4401E7E;
+    
     MAKE_MC_REG(MC_SECURITY_CARVEOUT4_BOM) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT4_BOM_HI) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT4_SIZE_128KB) = 0;
@@ -86,6 +89,7 @@ void mc_config_carveout()
     MAKE_MC_REG(MC_SECURITY_CARVEOUT4_CLIENT_FORCE_INTERNAL_ACCESS3) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT4_CLIENT_FORCE_INTERNAL_ACCESS4) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT4_CFG0) = 0x8F;
+    
     MAKE_MC_REG(MC_SECURITY_CARVEOUT5_BOM) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT5_BOM_HI) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT5_SIZE_128KB) = 0;
@@ -109,9 +113,9 @@ void mc_config_carveout_finalize()
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_SIZE_128KB) = 2;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS0) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS1) = 0;
-    MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS2) = 0x3000000;
+    MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS2) = (BIT(CSR_GPUSRD) | BIT(CSW_GPUSWR));
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS3) = 0;
-    MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS4) = 0x300;
+    MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS4) = (BIT(CSR_GPUSRD2) | BIT(CSW_GPUSWR2));
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS0) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS1) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS2) = 0;
@@ -156,7 +160,9 @@ void mc_enable()
     car->clk_enb_x_set = ((car->clk_enb_x_set & 0xFFFFBFFF) | 0x4000);
     
     /* Clear EMC and MC reset. */
-    car->rst_dev_h_set = 0x2000001; 
+    /* NOTE: [4.0.0+] This was changed to use the right register. */
+    /* car->rst_dev_h_set = 0x2000001; */
+    car->rst_dev_h_clr = 0x2000001; 
     udelay(5);
 
     mc_disable_ahb_redirect();

fusee/fusee-primary/src/mc.h

@@ -29,6 +29,23 @@
 #define MC_INTMASK                                              0x4
 #define MC_ERR_STATUS                                           0x8
 #define MC_ERR_ADR                                              0xc
+#define MC_SMMU_CONFIG                                          0x10
+#define MC_SMMU_TLB_CONFIG                                      0x14
+#define MC_SMMU_PTC_CONFIG                                      0x18
+#define MC_SMMU_PTB_ASID                                        0x1c
+#define MC_SMMU_PTB_DATA                                        0x20
+#define MC_SMMU_TLB_FLUSH                                       0x30
+#define MC_SMMU_PTC_FLUSH                                       0x34
+#define MC_SMMU_ASID_SECURITY                                   0x38
+#define MC_SMMU_AFI_ASID                                        0x238
+#define MC_SMMU_AVPC_ASID                                       0x23c
+#define MC_SMMU_TSEC_ASID                                       0x294
+#define MC_SMMU_PPCS1_ASID                                      0x298
+#define MC_SMMU_TRANSLATION_ENABLE_0                            0x228
+#define MC_SMMU_TRANSLATION_ENABLE_1                            0x22c
+#define MC_SMMU_TRANSLATION_ENABLE_2                            0x230
+#define MC_SMMU_TRANSLATION_ENABLE_3                            0x234
+#define MC_SMMU_TRANSLATION_ENABLE_4                            0xb98
 #define MC_PCFIFO_CLIENT_CONFIG0                                0xdd0
 #define MC_PCFIFO_CLIENT_CONFIG1                                0xdd4
 #define MC_PCFIFO_CLIENT_CONFIG2                                0xdd8
@@ -474,6 +491,103 @@
 #define MC_ERR_APB_ASID_UPDATE_STATUS                           0x9d0
 #define MC_DA_CONFIG0                                           0x9dc
 
+/* Memory Controller clients */
+#define CLIENT_ACCESS_NUM_CLIENTS   32
+typedef enum {
+    /* _ACCESS0 */
+    CSR_PTCR = (0 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0A = (1 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0AB = (2 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0B = (3 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0BB = (4 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0C = (5 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0CB = (6 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_AFIR = (14 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_AVPCARM7R = (15 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAYHC = (16 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAYHCB = (17 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_HDAR = (21 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_HOST1XDMAR = (22 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_HOST1XR = (23 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_NVENCSRD = (28 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_PPCSAHBDMAR = (29 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_PPCSAHBSLVR = (30 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_SATAR = (31 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    
+    /* _ACCESS1 */
+    CSR_VDEBSEVR = (34 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_VDEMBER = (35 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_VDEMCER = (36 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_VDETPER = (37 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_MPCORELPR = (38 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_MPCORER = (39 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_NVENCSWR = (43 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_AFIW = (49 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_AVPCARM7W = (50 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_HDAW = (53 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_HOST1XW = (54 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_MPCORELPW = (56 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_MPCOREW = (57 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_PPCSAHBDMAW = (59 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_PPCSAHBSLVW = (60 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_SATAW = (61 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_VDEBSEVW = (62 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_VDEDBGW = (63 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    
+    /* _ACCESS2 */
+    CSW_VDEMBEW = (64 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_VDETPMW = (65 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_ISPRA = (68 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_ISPWA = (70 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_ISPWB = (71 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_XUSB_HOSTR = (74 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_XUSB_HOSTW = (75 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_XUSB_DEVR = (76 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_XUSB_DEVW = (77 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_ISPRAB = (78 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_ISPWAB = (80 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_ISPWBB = (81 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_TSECSRD = (84 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_TSECSWR = (85 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_A9AVPSCR = (86 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_A9AVPSCW = (87 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_GPUSRD = (88 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_GPUSWR = (89 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_DISPLAYT = (90 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    
+    /* _ACCESS3 */
+    CSR_SDMMCRA = (96 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_SDMMCRAA = (97 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_SDMMCR = (98 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_SDMMCRAB = (99 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_SDMMCWA = (100 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_SDMMCWAA = (101 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_SDMMCW = (102 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_SDMMCWAB = (103 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_VICSRD = (108 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_VICSWR = (109 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_VIW = (114 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_DISPLAYD = (115 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_NVDECSRD = (120 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_NVDECSWR = (121 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_APER = (122 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_APEW = (123 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_NVJPGSRD = (126 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_NVJPGSWR = (127 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    
+    /* _ACCESS4 */
+    CSR_SESRD = (128 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_SESWR = (129 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSR_AXIAPR = (130 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_AXIAPW = (131 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSR_ETRR = (132 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_ETRW = (133 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSR_TSECSRDB = (134 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_TSECSWRB = (135 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSR_GPUSRD2 = (136 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_GPUSWR2 = (137 - (CLIENT_ACCESS_NUM_CLIENTS * 4))
+} McClient;
+
 void mc_config_tsec_carveout(uint32_t bom, uint32_t size1mb, bool lock);
 void mc_config_carveout();
 void mc_config_carveout_finalize();

fusee/fusee-primary/src/timers.h

@@ -21,11 +21,15 @@
 
 #define TIMERS_BASE 0x60005000
 #define MAKE_TIMERS_REG(n) MAKE_REG32(TIMERS_BASE + n)
+
 #define TIMERUS_CNTR_1US_0 MAKE_TIMERS_REG(0x10)
 #define TIMERUS_USEC_CFG_0 MAKE_TIMERS_REG(0x14)
+#define SHARED_INTR_STATUS_0 MAKE_TIMERS_REG(0x1A0)
+#define SHARED_TIMER_SECURE_CFG_0 MAKE_TIMERS_REG(0x1A4)
 
 #define RTC_BASE 0x7000E000
 #define MAKE_RTC_REG(n) MAKE_REG32(RTC_BASE + n)
+
 #define RTC_SECONDS MAKE_RTC_REG(0x08)
 #define RTC_SHADOW_SECONDS MAKE_RTC_REG(0x0C)
 #define RTC_MILLI_SECONDS MAKE_RTC_REG(0x10)
@@ -39,7 +43,7 @@ typedef struct {
 
 #define GET_WDT(n) ((volatile watchdog_timers_t *)(TIMERS_BASE + 0x100 + 0x20 * n))
 #define WDT_REBOOT_PATTERN 0xC45A
-#define GET_WDT_REBOOT_CFG_REG(n) MAKE_TIMERS_REG(0x60 + 0x8 * n)
+#define GET_WDT_REBOOT_CFG_REG(n) MAKE_REG32(TIMERS_BASE + 0x60 + 0x8 * n)
 
 void wait(uint32_t microseconds);
 

fusee/fusee-secondary/Makefile

@@ -12,6 +12,13 @@ AMS		:= $(TOPDIR)/../../
 
 include $(DEVKITARM)/base_rules
 
+AMSBRANCH := $(shell git symbolic-ref --short HEAD)
+AMSREV := $(AMSBRANCH)-$(shell git rev-parse --short HEAD)
+
+ifneq (, $(strip $(shell git status --porcelain 2>/dev/null)))
+    AMSREV := $(AMSREV)-dirty
+endif
+
 #---------------------------------------------------------------------------------
 # TARGET is the name of the output
 # BUILD is the directory where object files & intermediate files will be placed
@@ -29,7 +36,7 @@ INCLUDES	:=	include ../../common/include
 # options for code generation
 #---------------------------------------------------------------------------------
 ARCH	:=	-march=armv4t -mtune=arm7tdmi -marm
-DEFINES :=	-D__BPMP__ -DFUSEE_STAGE2_SRC
+DEFINES :=	-D__BPMP__ -DFUSEE_STAGE2_SRC -DATMOSPHERE_GIT_BRANCH=\"$(AMSBRANCH)\" -DATMOSPHERE_GIT_REV=\"$(AMSREV)\"
 
 CFLAGS	:= \
 	-g \

fusee/fusee-secondary/src/cluster.c

@@ -22,6 +22,7 @@
 #include "sysreg.h"
 #include "i2c.h"
 #include "car.h"
+#include "mc.h"
 #include "timers.h"
 #include "pmc.h"
 #include "max77620.h"
@@ -141,6 +142,10 @@ void cluster_boot_cpu0(uint32_t entry)
     SB_CSR_0 = 2;
     (void)SB_CSR_0;
 
+    /* Set CPU_STRICT_TZ_APERTURE_CHECK. */
+    /* NOTE: [4.0.0+] This was added, but it breaks Exosphère. */
+    /* MAKE_MC_REG(MC_TZ_SECURITY_CTRL) = 1; */
+    
     /* Clear MSELECT reset. */
     car->rst_dev_v &= 0xFFFFFFF7;
     
@@ -148,5 +153,7 @@ void cluster_boot_cpu0(uint32_t entry)
     car->rst_cpug_cmplx_clr = 0x20000000;
     
     /* Clear CPU{0,1,2,3} POR and CORE, CX0, L2, and DBG reset.*/
-    car->rst_cpug_cmplx_clr = 0x411F000F;
+    /* NOTE: [5.0.0+] This was changed so only CPU0 reset is cleared. */
+    /* car->rst_cpug_cmplx_clr = 0x411F000F; */
+    car->rst_cpug_cmplx_clr = 0x41010001;
 }

fusee/fusee-secondary/src/exocfg.h

@@ -20,7 +20,9 @@
 /* This serves to set configuration for *exosphere itself*, separate from the SecMon Exosphere mimics. */
 
 /* "XBC0" */
-#define MAGIC_EXOSPHERE_BOOTCONFIG (0x30434258)
+#define MAGIC_EXOSPHERE_BOOTCONFIG_0 (0x30434258)
+/* "XBC1" */
+#define MAGIC_EXOSPHERE_BOOTCONFIG   (0x31434258)
 
 #define EXOSPHERE_TARGET_FIRMWARE_100 1
 #define EXOSPHERE_TARGET_FIRMWARE_200 2
@@ -28,13 +30,18 @@
 #define EXOSPHERE_TARGET_FIRMWARE_400 4
 #define EXOSPHERE_TARGET_FIRMWARE_500 5
 #define EXOSPHERE_TARGET_FIRMWARE_600 6
+#define EXOSPHERE_TARGET_FIRMWARE_620 7
 
 #define EXOSPHERE_TARGET_FIRMWARE_MIN EXOSPHERE_TARGET_FIRMWARE_100
-#define EXOSPHERE_TARGET_FIRMWARE_MAX EXOSPHERE_TARGET_FIRMWARE_600
+#define EXOSPHERE_TARGET_FIRMWARE_MAX EXOSPHERE_TARGET_FIRMWARE_620
+
+#define EXOSPHERE_FLAGS_DEFAULT 0x00000000
+#define EXOSPHERE_FLAG_PERFORM_620_KEYGEN (1 << 0u)
 
 typedef struct {
     unsigned int magic;
     unsigned int target_firmware;
+    unsigned int flags;
 } exosphere_config_t;
 
 #define MAILBOX_EXOSPHERE_CONFIGURATION ((volatile exosphere_config_t *)(0x40002E40))

fusee/fusee-secondary/src/extkeys.c

@@ -0,0 +1,216 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include "extkeys.h"
+
+/**
+ * Reads a line from file f and parses out the key and value from it.
+ * The format of a line must match /^ *[A-Za-z0-9_] *[,=] *.+$/.
+ * If a line ends in \r, the final \r is stripped.
+ * The input file is assumed to have been opened with the 'b' flag.
+ * The input file is assumed to contain only ASCII.
+ *
+ * A line cannot exceed 512 bytes in length.
+ * Lines that are excessively long will be silently truncated.
+ *
+ * On success, *key and *value will be set to point to the key and value in
+ * the input line, respectively.
+ * *key and *value may also be NULL in case of empty lines.
+ * On failure, *key and *value will be set to NULL.
+ * End of file is considered failure.
+ *
+ * Because *key and *value will point to a static buffer, their contents must be
+ * copied before calling this function again.
+ * For the same reason, this function is not thread-safe.
+ *
+ * The key will be converted to lowercase.
+ * An empty key is considered a parse error, but an empty value is returned as
+ * success.
+ *
+ * This function assumes that the file can be trusted not to contain any NUL in
+ * the contents.
+ *
+ * Whitespace (' ', ASCII 0x20, as well as '\t', ASCII 0x09) at the beginning of
+ * the line, at the end of the line as well as around = (or ,) will be ignored.
+ *
+ * @param f the file to read
+ * @param key pointer to change to point to the key
+ * @param value pointer to change to point to the value
+ * @return 0 on success,
+ *         1 on end of file,
+ *         -1 on parse error (line too long, line malformed)
+ *         -2 on I/O error
+ */
+static int get_kv(FILE *f, char **key, char **value) {
+#define SKIP_SPACE(p)   do {\
+    for (; *p == ' ' || *p == '\t'; ++p)\
+        ;\
+} while(0);
+    static char line[1024];
+    char *k, *v, *p, *end;
+
+    *key = *value = NULL;
+
+    errno = 0;
+    if (fgets(line, (int)sizeof(line), f) == NULL) {
+        if (feof(f))
+            return 1;
+        else
+            return -2;
+    }
+    if (errno != 0)
+        return -2;
+
+    if (*line == '\n' || *line == '\r' || *line == '\0')
+        return 0;
+
+    /* Not finding \r or \n is not a problem.
+     * The line might just be exactly 512 characters long, we have no way to
+     * tell.
+     * Additionally, it's possible that the last line of a file is not actually
+     * a line (i.e., does not end in '\n'); we do want to handle those.
+     */
+    if ((p = strchr(line, '\r')) != NULL || (p = strchr(line, '\n')) != NULL) {
+        end = p;
+        *p = '\0';
+    } else {
+        end = line + strlen(line) + 1;
+    }
+
+    p = line;
+    SKIP_SPACE(p);
+    k = p;
+
+    /* Validate key and convert to lower case. */
+    for (; *p != ' ' && *p != ',' && *p != '\t' && *p != '='; ++p) {
+        if (*p == '\0')
+            return -1;
+
+        if (*p >= 'A' && *p <= 'Z') {
+            *p = 'a' + (*p - 'A');
+            continue;
+        }
+
+        if (*p != '_' &&
+                (*p < '0' || *p > '9') &&
+                (*p < 'a' || *p > 'z')) {
+            return -1;
+        }
+    }
+
+    /* Bail if the final ++p put us at the end of string */
+    if (*p == '\0')
+        return -1;
+
+    /* We should be at the end of key now and either whitespace or [,=]
+     * follows.
+     */
+    if (*p == '=' || *p == ',') {
+        *p++ = '\0';
+    } else {
+        *p++ = '\0';
+        SKIP_SPACE(p);
+        if (*p != '=' && *p != ',')
+            return -1;
+        *p++ = '\0';
+    }
+
+    /* Empty key is an error. */
+    if (*k == '\0')
+        return -1;
+
+    SKIP_SPACE(p);
+    v = p;
+
+    /* Skip trailing whitespace */
+    for (p = end - 1; *p == '\t' || *p == ' '; --p)
+        ;
+
+    *(p + 1) = '\0';
+
+    *key = k;
+    *value = v;
+
+    return 0;
+#undef SKIP_SPACE
+}
+
+static int ishex(char c) {
+    if ('a' <= c && c <= 'f') return 1;
+    if ('A' <= c && c <= 'F') return 1;
+    if ('0' <= c && c <= '9') return 1;
+    return 0;
+}
+
+static char hextoi(char c) {
+    if ('a' <= c && c <= 'f') return c - 'a' + 0xA;
+    if ('A' <= c && c <= 'F') return c - 'A' + 0xA;
+    if ('0' <= c && c <= '9') return c - '0';
+    return 0;
+}
+
+void parse_hex_key(unsigned char *key, const char *hex, unsigned int len) {
+    if (strlen(hex) != 2 * len) {
+        fatal_error("Key (%s) must be %x hex digits!\n", hex, 2 * len);
+    }
+
+    for (unsigned int i = 0; i < 2 * len; i++) {
+        if (!ishex(hex[i])) {
+            fatal_error("Key (%s) must be %x hex digits!\n", hex, 2 * len);
+        }
+    }
+
+    memset(key, 0, len);
+
+    for (unsigned int i = 0; i < 2 * len; i++) {
+        char val = hextoi(hex[i]);
+        if ((i & 1) == 0) {
+            val <<= 4;
+        }
+        key[i >> 1] |= val;
+    }
+}
+
+void extkeys_initialize_keyset(fusee_extkeys_t *keyset, FILE *f) {
+    char *key, *value;
+    int ret;
+    
+    while ((ret = get_kv(f, &key, &value)) != 1 && ret != -2) {
+        if (ret == 0) {
+            if (key == NULL || value == NULL) {
+                continue;
+            }
+            int matched_key = 0;
+            if (strcmp(key, "tsec_root_key") == 0 || strcmp(key, "tsec_root_key_00") == 0) {
+                parse_hex_key(keyset->tsec_root_key, value, sizeof(keyset->tsec_root_key));
+                matched_key = 1;
+            } else {
+                char test_name[0x100] = {0};
+                for (unsigned int i = 0; i < 0x20 && !matched_key; i++) { 
+                    snprintf(test_name, sizeof(test_name), "master_kek_%02x", i);
+                    if (strcmp(key, test_name) == 0) {
+                        parse_hex_key(keyset->master_keks[i], value, sizeof(keyset->master_keks[i]));
+                        matched_key = 1;
+                        break;
+                    }
+                }
+            }
+        }
+    }
+}

fusee/fusee-secondary/src/extkeys.h

@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#ifndef FUSEE_EXTKEYS_H
+#define FUSEE_EXTKEYS_H
+
+#include <string.h>
+#include "utils.h"
+#include "masterkey.h"
+
+typedef struct {
+    unsigned char tsec_root_key[0x10];
+    unsigned char master_keks[0x20][0x10];
+} fusee_extkeys_t;
+
+void parse_hex_key(unsigned char *key, const char *hex, unsigned int len);
+void extkeys_initialize_keyset(fusee_extkeys_t *keyset, FILE *f);
+
+#endif

fusee/fusee-secondary/src/key_derivation.c

@@ -13,13 +13,14 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
- 
+
+#include <stdio.h>
 #include "key_derivation.h"
 #include "masterkey.h"
 #include "se.h"
 #include "exocfg.h"
 #include "fuse.h"
-#include "tsec.h"
+#include "extkeys.h"
 #include "utils.h"
 
 #define AL16 ALIGN(16)
@@ -53,11 +54,11 @@ static const uint8_t AL16 masterkey_4x_seed[0x10] = {
     0x2D, 0xC1, 0xF4, 0x8D, 0xF3, 0x5B, 0x69, 0x33, 0x42, 0x10, 0xAC, 0x65, 0xDA, 0x90, 0x46, 0x66
 };
 
-static nx_dec_keyblob_t AL16 g_dec_keyblobs[32];
+static const uint8_t AL16 new_master_kek_seeds[1][0x10] = {
+    {0x37, 0x4B, 0x77, 0x29, 0x59, 0xB4, 0x04, 0x30, 0x81, 0xF6, 0xE5, 0x8C, 0x6D, 0x36, 0x17, 0x9A}, /* MasterKek seed 06. */
+};
 
-static int get_tsec_key(void *dst, const void *tsec_fw, size_t tsec_fw_size, uint32_t tsec_key_id) {
-    return tsec_get_key(dst, tsec_key_id, tsec_fw);
-}
+static nx_dec_keyblob_t AL16 g_dec_keyblobs[32];
 
 static int get_keyblob(nx_keyblob_t *dst, uint32_t revision, const nx_keyblob_t *keyblobs, uint32_t available_revision) {
     if (revision >= 0x20) {
@@ -108,44 +109,85 @@ static int decrypt_keyblob(const nx_keyblob_t *keyblobs, uint32_t revision, uint
 }
 
 int load_package1_key(uint32_t revision) {
-    if (revision > MASTERKEY_REVISION_600_CURRENT) {
+    if (revision > MASTERKEY_REVISION_600_610) {
         return -1;
     }
     
-    set_aes_keyslot(0xB, g_dec_keyblobs[revision].keys[8], 0x10);
+    set_aes_keyslot(0xB, g_dec_keyblobs[revision].package1_key, 0x10);
     return 0;
 }
 
 /* Derive all Switch keys. */
-int derive_nx_keydata(uint32_t target_firmware, const nx_keyblob_t *keyblobs, uint32_t available_revision, const void *tsec_fw, size_t tsec_fw_size) {
+int derive_nx_keydata(uint32_t target_firmware, const nx_keyblob_t *keyblobs, uint32_t available_revision, const void *tsec_key, void *tsec_root_key, unsigned int *out_keygen_type) {
     uint8_t AL16 work_buffer[0x10];
+    uint8_t AL16 zeroes[0x10] = {0};
+    
+    /* Initialize keygen type. */
+    *out_keygen_type = 0;
 
     /* TODO: Set keyslot flags properly in preparation of derivation. */
     set_aes_keyslot_flags(0xE, 0x15);
     set_aes_keyslot_flags(0xD, 0x15);
-
-    /* Set TSEC key. */
-    if  (get_tsec_key(work_buffer, tsec_fw, tsec_fw_size, 1) != 0) {
-        return -1;
-    }
-    set_aes_keyslot(0xD, work_buffer, 0x10);
     
+    /* Set the TSEC key. */
+    set_aes_keyslot(0xD, tsec_key, 0x10);
+        
     /* Decrypt all keyblobs, setting keyslot 0xF correctly. */
-    for (unsigned int rev = 0; rev < MASTERKEY_REVISION_MAX; rev++) {
+    for (unsigned int rev = 0; rev <= MASTERKEY_REVISION_600_610; rev++) {
         int ret = decrypt_keyblob(keyblobs, rev, available_revision);
         if (ret) {
             return ret;
         }
     }
 
+    /* Do 6.2.0+ keygen. */
+    if (target_firmware >= EXOSPHERE_TARGET_FIRMWARE_620) {
+        if (memcmp(tsec_root_key, zeroes, 0x10) != 0) {
+            /* We got a valid key from emulation. */
+            set_aes_keyslot(0xC, tsec_root_key, 0x10);
+            for (unsigned int rev = MASTERKEY_REVISION_620_CURRENT; rev < MASTERKEY_REVISION_MAX; rev++) {
+                se_aes_ecb_decrypt_block(0xC, work_buffer, 0x10, new_master_kek_seeds[rev - MASTERKEY_REVISION_620_CURRENT], 0x10);
+                memcpy(g_dec_keyblobs[rev].master_kek, work_buffer, 0x10);
+            }
+        } else {
+            /* Try reading the keys from a file. */
+            const char *keyfile = fuse_get_retail_type() != 0 ? "atmosphere/prod.keys" : "atmosphere/dev.keys";
+            FILE *extkey_file = fopen(keyfile, "r");
+            AL16 fusee_extkeys_t extkeys = {0};
+            if (extkey_file == NULL) {
+                fatal_error("Error: failed to read %s, needed for 6.2.0+ key derivation!", keyfile);
+            }
+            extkeys_initialize_keyset(&extkeys, extkey_file);
+            fclose(extkey_file);
+        
+            if (memcmp(extkeys.tsec_root_key, zeroes, 0x10) != 0) {
+                set_aes_keyslot(0xC, extkeys.tsec_root_key, 0x10);
+                for (unsigned int rev = MASTERKEY_REVISION_620_CURRENT; rev < MASTERKEY_REVISION_MAX; rev++) {
+                    se_aes_ecb_decrypt_block(0xC, work_buffer, 0x10, new_master_kek_seeds[rev - MASTERKEY_REVISION_620_CURRENT], 0x10);
+                    memcpy(g_dec_keyblobs[rev].master_kek, work_buffer, 0x10);
+                }
+            } else {
+                for (unsigned int rev = MASTERKEY_REVISION_620_CURRENT; rev < MASTERKEY_REVISION_MAX; rev++) {
+                    memcpy(g_dec_keyblobs[rev].master_kek, extkeys.master_keks[rev], 0x10);
+                }
+            }
+        }
+        
+        if (memcmp(g_dec_keyblobs[available_revision].master_kek, zeroes, 0x10) == 0) {
+            fatal_error("Error: failed to derive master_kek_%02x!", available_revision);
+        }
+    }
+    
     /* Clear the SBK. */
     clear_aes_keyslot(0xE);
 
     /* Get needed data. */
-    set_aes_keyslot(0xC, g_dec_keyblobs[MASTERKEY_REVISION_600_CURRENT].keys[0], 0x10);
+    set_aes_keyslot(0xC, g_dec_keyblobs[available_revision].master_kek, 0x10);
 
     /* Also set the Package1 key for the revision that is stored on the eMMC boot0 partition. */
-    load_package1_key(available_revision);
+    if (target_firmware < EXOSPHERE_TARGET_FIRMWARE_620) {
+        load_package1_key(available_revision);
+    }
 
     /* Derive keys for Exosphere, lock critical keyslots. */
     switch (target_firmware) {
@@ -163,6 +205,7 @@ int derive_nx_keydata(uint32_t target_firmware, const nx_keyblob_t *keyblobs, ui
             break;
         case EXOSPHERE_TARGET_FIRMWARE_500:
         case EXOSPHERE_TARGET_FIRMWARE_600:
+        case EXOSPHERE_TARGET_FIRMWARE_620:
             decrypt_data_into_keyslot(0xA, 0xF, devicekey_4x_seed, 0x10);
             decrypt_data_into_keyslot(0xF, 0xF, devicekey_seed, 0x10);
             decrypt_data_into_keyslot(0xE, 0xC, masterkey_4x_seed, 0x10);

fusee/fusee-secondary/src/key_derivation.h

@@ -28,7 +28,14 @@ typedef enum BisPartition {
 } BisPartition;
 
 typedef struct {
-    uint8_t keys[9][0x10];
+    union {
+        uint8_t keys[9][0x10];
+        struct {
+            uint8_t master_kek[0x10];
+            uint8_t _keys[7][0x10];
+            uint8_t package1_key[0x10];
+        };
+    };
 } nx_dec_keyblob_t;
 
 typedef struct nx_keyblob_t {
@@ -40,7 +47,7 @@ typedef struct nx_keyblob_t {
     };
 } nx_keyblob_t;
 
-int derive_nx_keydata(uint32_t target_firmware, const nx_keyblob_t *keyblobs, uint32_t available_revision, const void *tsec_fw, size_t tsec_fw_size);
+int derive_nx_keydata(uint32_t target_firmware, const nx_keyblob_t *keyblobs, uint32_t available_revision, const void *tsec_key, void *tsec_root_key, unsigned int *out_keygen_type);
 int load_package1_key(uint32_t revision);
 void finalize_nx_keydata(uint32_t target_firmware);
 void derive_bis_key(void *dst, BisPartition partition_id, uint32_t target_firmware);

fusee/fusee-secondary/src/masterkey.c

@@ -26,7 +26,6 @@ static unsigned int g_mkey_revision = 0;
 static bool g_determined_mkey_revision = false;
 
 static uint8_t g_old_masterkeys[MASTERKEY_REVISION_MAX][0x10];
-static uint8_t g_old_devicekeys[MASTERKEY_NUM_NEW_DEVICE_KEYS - 1][0x10];
 
 /* TODO: Extend with new vectors, as needed. */
 /* Dev unit keys. */
@@ -38,6 +37,7 @@ static const uint8_t mkey_vectors_dev[MASTERKEY_REVISION_MAX][0x10] =
     {0x2C, 0xCA, 0x9C, 0x31, 0x1E, 0x07, 0xB0, 0x02, 0x97, 0x0A, 0xD8, 0x03, 0xA2, 0x76, 0x3F, 0xA3}, /* Master key 02 encrypted with Master key 03. */
     {0x9B, 0x84, 0x76, 0x14, 0x72, 0x94, 0x52, 0xCB, 0x54, 0x92, 0x9B, 0xC4, 0x8C, 0x5B, 0x0F, 0xBA}, /* Master key 03 encrypted with Master key 04. */
     {0x78, 0xD5, 0xF1, 0x20, 0x3D, 0x16, 0xE9, 0x30, 0x32, 0x27, 0x34, 0x6F, 0xCF, 0xE0, 0x27, 0xDC}, /* Master key 04 encrypted with Master key 05. */
+    {0x6F, 0xD2, 0x84, 0x1D, 0x05, 0xEC, 0x40, 0x94, 0x5F, 0x18, 0xB3, 0x81, 0x09, 0x98, 0x8D, 0x4E}, /* Master key 05 encrypted with Master key 06. */
 };
 
 /* Retail unit keys. */
@@ -49,6 +49,7 @@ static const uint8_t mkey_vectors[MASTERKEY_REVISION_MAX][0x10] =
     {0x0A, 0x0D, 0xDF, 0x34, 0x22, 0x06, 0x6C, 0xA4, 0xE6, 0xB1, 0xEC, 0x71, 0x85, 0xCA, 0x4E, 0x07}, /* Master key 02 encrypted with Master key 03. */
     {0x6E, 0x7D, 0x2D, 0xC3, 0x0F, 0x59, 0xC8, 0xFA, 0x87, 0xA8, 0x2E, 0xD5, 0x89, 0x5E, 0xF3, 0xE9}, /* Master key 03 encrypted with Master key 04. */
     {0xEB, 0xF5, 0x6F, 0x83, 0x61, 0x9E, 0xF8, 0xFA, 0xE0, 0x87, 0xD7, 0xA1, 0x4E, 0x25, 0x36, 0xEE}, /* Master key 04 encrypted with Master key 05. */
+    {0x1E, 0x1E, 0x22, 0xC0, 0x5A, 0x33, 0x3C, 0xB9, 0x0B, 0xA9, 0x03, 0x04, 0xBA, 0xDB, 0x07, 0x57}, /* Master key 05 encrypted with Master key 06. */
 };
 
 static bool check_mkey_revision(unsigned int revision, bool is_retail) {
@@ -119,33 +120,3 @@ unsigned int mkey_get_keyslot(unsigned int revision) {
         return KEYSLOT_SWITCH_TEMPKEY;
     }
 }
-
-void set_old_devkey(unsigned int revision, const uint8_t *key) {
-    if (revision < MASTERKEY_REVISION_400_410 || MASTERKEY_REVISION_600_CURRENT <= revision) {
-        generic_panic();
-    }
-
-    memcpy(g_old_devicekeys[revision - MASTERKEY_REVISION_400_410], key, 0x10);
-}
-
-unsigned int devkey_get_keyslot(unsigned int revision) {
-    if (!g_determined_mkey_revision || revision >= MASTERKEY_REVISION_MAX) {
-        generic_panic();
-    }
-
-    if (revision > g_mkey_revision) {
-        generic_panic();
-    }
-
-    if (revision >= 1) {
-        if (revision == MASTERKEY_REVISION_600_CURRENT) {
-            return KEYSLOT_SWITCH_DEVICEKEY;
-        } else {
-            /* Load into a temp keyslot. */
-            set_aes_keyslot(KEYSLOT_SWITCH_TEMPKEY, g_old_devicekeys[revision - MASTERKEY_REVISION_400_410], 0x10);
-            return KEYSLOT_SWITCH_TEMPKEY;
-        }
-    } else {
-        return KEYSLOT_SWITCH_4XOLDDEVICEKEY;
-    }
-}

fusee/fusee-secondary/src/masterkey.h

@@ -19,15 +19,16 @@
 
 /* This is glue code to enable master key support across versions. */
 
-/* TODO: Update to 0x7 on release of new master key. */
-#define MASTERKEY_REVISION_MAX 0x6
+/* TODO: Update to 0x8 on release of new master key. */
+#define MASTERKEY_REVISION_MAX 0x7
 
 #define MASTERKEY_REVISION_100_230     0x00
 #define MASTERKEY_REVISION_300         0x01
 #define MASTERKEY_REVISION_301_302     0x02
 #define MASTERKEY_REVISION_400_410     0x03
 #define MASTERKEY_REVISION_500_510     0x04
-#define MASTERKEY_REVISION_600_CURRENT 0x05
+#define MASTERKEY_REVISION_600_610     0x05
+#define MASTERKEY_REVISION_620_CURRENT 0x06
 
 #define MASTERKEY_NUM_NEW_DEVICE_KEYS (MASTERKEY_REVISION_MAX - MASTERKEY_REVISION_400_410)
 

fusee/fusee-secondary/src/mc.c

@@ -31,6 +31,7 @@ void mc_config_tsec_carveout(uint32_t bom, uint32_t size1mb, bool lock)
 void mc_config_carveout()
 {
     *(volatile uint32_t *)0x8005FFFC = 0xC0EDBBCC;
+    
     MAKE_MC_REG(MC_VIDEO_PROTECT_GPU_OVERRIDE_0) = 1;
     MAKE_MC_REG(MC_VIDEO_PROTECT_GPU_OVERRIDE_1) = 0;
     MAKE_MC_REG(MC_VIDEO_PROTECT_BOM) = 0;
@@ -43,6 +44,7 @@ void mc_config_carveout()
     MAKE_MC_REG(MC_MTS_CARVEOUT_SIZE_MB) = 0;
     MAKE_MC_REG(MC_MTS_CARVEOUT_ADR_HI) = 0;
     MAKE_MC_REG(MC_MTS_CARVEOUT_REG_CTRL) = 1;
+    
     MAKE_MC_REG(MC_SECURITY_CARVEOUT1_BOM) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT1_BOM_HI) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT1_SIZE_128KB) = 0;
@@ -63,15 +65,16 @@ void mc_config_carveout()
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_SIZE_128KB) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS0) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS1) = 0;
-    MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS2) = 0x3000000;
+    MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS2) = (BIT(CSR_GPUSRD) | BIT(CSW_GPUSWR));
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS3) = 0;
-    MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS4) = 0x300;
+    MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_ACCESS4) = (BIT(CSR_GPUSRD2) | BIT(CSW_GPUSWR2));
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS0) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS1) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS2) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS3) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS4) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT3_CFG0) = 0x4401E7E;
+    
     MAKE_MC_REG(MC_SECURITY_CARVEOUT4_BOM) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT4_BOM_HI) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT4_SIZE_128KB) = 0;
@@ -86,6 +89,7 @@ void mc_config_carveout()
     MAKE_MC_REG(MC_SECURITY_CARVEOUT4_CLIENT_FORCE_INTERNAL_ACCESS3) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT4_CLIENT_FORCE_INTERNAL_ACCESS4) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT4_CFG0) = 0x8F;
+    
     MAKE_MC_REG(MC_SECURITY_CARVEOUT5_BOM) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT5_BOM_HI) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT5_SIZE_128KB) = 0;
@@ -109,9 +113,9 @@ void mc_config_carveout_finalize()
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_SIZE_128KB) = 2;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS0) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS1) = 0;
-    MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS2) = 0x3000000;
+    MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS2) = (BIT(CSR_GPUSRD) | BIT(CSW_GPUSWR));
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS3) = 0;
-    MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS4) = 0x300;
+    MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS4) = (BIT(CSR_GPUSRD2) | BIT(CSW_GPUSWR2));
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS0) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS1) = 0;
     MAKE_MC_REG(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS2) = 0;

fusee/fusee-secondary/src/mc.h

@@ -29,6 +29,23 @@
 #define MC_INTMASK                                              0x4
 #define MC_ERR_STATUS                                           0x8
 #define MC_ERR_ADR                                              0xc
+#define MC_SMMU_CONFIG                                          0x10
+#define MC_SMMU_TLB_CONFIG                                      0x14
+#define MC_SMMU_PTC_CONFIG                                      0x18
+#define MC_SMMU_PTB_ASID                                        0x1c
+#define MC_SMMU_PTB_DATA                                        0x20
+#define MC_SMMU_TLB_FLUSH                                       0x30
+#define MC_SMMU_PTC_FLUSH                                       0x34
+#define MC_SMMU_ASID_SECURITY                                   0x38
+#define MC_SMMU_AFI_ASID                                        0x238
+#define MC_SMMU_AVPC_ASID                                       0x23c
+#define MC_SMMU_TSEC_ASID                                       0x294
+#define MC_SMMU_PPCS1_ASID                                      0x298
+#define MC_SMMU_TRANSLATION_ENABLE_0                            0x228
+#define MC_SMMU_TRANSLATION_ENABLE_1                            0x22c
+#define MC_SMMU_TRANSLATION_ENABLE_2                            0x230
+#define MC_SMMU_TRANSLATION_ENABLE_3                            0x234
+#define MC_SMMU_TRANSLATION_ENABLE_4                            0xb98
 #define MC_PCFIFO_CLIENT_CONFIG0                                0xdd0
 #define MC_PCFIFO_CLIENT_CONFIG1                                0xdd4
 #define MC_PCFIFO_CLIENT_CONFIG2                                0xdd8
@@ -474,6 +491,103 @@
 #define MC_ERR_APB_ASID_UPDATE_STATUS                           0x9d0
 #define MC_DA_CONFIG0                                           0x9dc
 
+/* Memory Controller clients */
+#define CLIENT_ACCESS_NUM_CLIENTS   32
+typedef enum {
+    /* _ACCESS0 */
+    CSR_PTCR = (0 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0A = (1 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0AB = (2 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0B = (3 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0BB = (4 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0C = (5 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAY0CB = (6 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_AFIR = (14 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_AVPCARM7R = (15 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAYHC = (16 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_DISPLAYHCB = (17 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_HDAR = (21 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_HOST1XDMAR = (22 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_HOST1XR = (23 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_NVENCSRD = (28 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_PPCSAHBDMAR = (29 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_PPCSAHBSLVR = (30 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    CSR_SATAR = (31 - (CLIENT_ACCESS_NUM_CLIENTS * 0)),
+    
+    /* _ACCESS1 */
+    CSR_VDEBSEVR = (34 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_VDEMBER = (35 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_VDEMCER = (36 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_VDETPER = (37 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_MPCORELPR = (38 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSR_MPCORER = (39 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_NVENCSWR = (43 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_AFIW = (49 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_AVPCARM7W = (50 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_HDAW = (53 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_HOST1XW = (54 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_MPCORELPW = (56 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_MPCOREW = (57 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_PPCSAHBDMAW = (59 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_PPCSAHBSLVW = (60 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_SATAW = (61 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_VDEBSEVW = (62 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    CSW_VDEDBGW = (63 - (CLIENT_ACCESS_NUM_CLIENTS * 1)),
+    
+    /* _ACCESS2 */
+    CSW_VDEMBEW = (64 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_VDETPMW = (65 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_ISPRA = (68 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_ISPWA = (70 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_ISPWB = (71 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_XUSB_HOSTR = (74 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_XUSB_HOSTW = (75 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_XUSB_DEVR = (76 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_XUSB_DEVW = (77 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_ISPRAB = (78 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_ISPWAB = (80 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_ISPWBB = (81 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_TSECSRD = (84 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_TSECSWR = (85 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_A9AVPSCR = (86 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_A9AVPSCW = (87 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_GPUSRD = (88 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSW_GPUSWR = (89 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    CSR_DISPLAYT = (90 - (CLIENT_ACCESS_NUM_CLIENTS * 2)),
+    
+    /* _ACCESS3 */
+    CSR_SDMMCRA = (96 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_SDMMCRAA = (97 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_SDMMCR = (98 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_SDMMCRAB = (99 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_SDMMCWA = (100 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_SDMMCWAA = (101 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_SDMMCW = (102 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_SDMMCWAB = (103 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_VICSRD = (108 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_VICSWR = (109 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_VIW = (114 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_DISPLAYD = (115 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_NVDECSRD = (120 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_NVDECSWR = (121 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_APER = (122 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_APEW = (123 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSR_NVJPGSRD = (126 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    CSW_NVJPGSWR = (127 - (CLIENT_ACCESS_NUM_CLIENTS * 3)),
+    
+    /* _ACCESS4 */
+    CSR_SESRD = (128 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_SESWR = (129 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSR_AXIAPR = (130 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_AXIAPW = (131 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSR_ETRR = (132 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_ETRW = (133 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSR_TSECSRDB = (134 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_TSECSWRB = (135 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSR_GPUSRD2 = (136 - (CLIENT_ACCESS_NUM_CLIENTS * 4)),
+    CSW_GPUSWR2 = (137 - (CLIENT_ACCESS_NUM_CLIENTS * 4))
+} McClient;
+
 void mc_config_tsec_carveout(uint32_t bom, uint32_t size1mb, bool lock);
 void mc_config_carveout();
 void mc_config_carveout_finalize();

fusee/fusee-secondary/src/nxboot.c

@@ -36,6 +36,8 @@
 #include "key_derivation.h"
 #include "package1.h"
 #include "package2.h"
+#include "smmu.h"
+#include "tsec.h"
 #include "loader.h"
 #include "splash_screen.h"
 #include "exocfg.h"
@@ -76,18 +78,30 @@ static uint32_t nxboot_get_target_firmware(const void *package1loader) {
             return EXOSPHERE_TARGET_FIRMWARE_400;
         case 0x0B:          /* 5.0.0 - 5.1.0 */
             return EXOSPHERE_TARGET_FIRMWARE_500;
-        case 0x0E:          /* 6.0.0 */
-            return EXOSPHERE_TARGET_FIRMWARE_600;
+        case 0x0E: {        /* 6.0.0 - 6.2.0 */
+            if (memcmp(package1loader_header->build_timestamp, "20180802", 8) == 0) {
+                return EXOSPHERE_TARGET_FIRMWARE_600;
+            } else if (memcmp(package1loader_header->build_timestamp, "20181107", 8) == 0) {
+                return EXOSPHERE_TARGET_FIRMWARE_620;
+            } else {
+                fatal_error("[NXBOOT]: Unable to identify package1!\n");
+            }
+        }
         default:
             return 0;
     }
 }
 
-static void nxboot_configure_exosphere(uint32_t target_firmware) {
+static void nxboot_configure_exosphere(uint32_t target_firmware, unsigned int keygen_type) {
     exosphere_config_t exo_cfg = {0};
 
     exo_cfg.magic = MAGIC_EXOSPHERE_BOOTCONFIG;
     exo_cfg.target_firmware = target_firmware;
+    if (keygen_type) {
+        exo_cfg.flags = EXOSPHERE_FLAGS_DEFAULT | EXOSPHERE_FLAG_PERFORM_620_KEYGEN;
+    } else {
+        exo_cfg.flags = EXOSPHERE_FLAGS_DEFAULT;
+    }
 
     if (ini_parse_string(get_loader_ctx()->bct0, exosphere_ini_handler, &exo_cfg) < 0) {
         fatal_error("[NXBOOT]: Failed to parse BCT.ini!\n");
@@ -260,11 +274,18 @@ uint32_t nxboot_main(void) {
         fatal_error("[NXBOOT]: Couldn't parse boot0: %s!\n", strerror(errno));
     }
     fclose(boot0);
+    
+    /* Find the system's target firmware. */
+    uint32_t target_firmware = nxboot_get_target_firmware(package1loader);
+    if (!target_firmware)
+        fatal_error("[NXBOOT]: Failed to detect target firmware!\n");
+    else
+        print(SCREEN_LOG_LEVEL_INFO, "[NXBOOT]: Detected target firmware %ld!\n", target_firmware);
 
     /* Read the TSEC firmware from a file, otherwise from PK1L. */
     if (loader_ctx->tsecfw_path[0] != '\0') {
         tsec_fw_size = get_file_size(loader_ctx->tsecfw_path);
-        if ((tsec_fw_size != 0) && (tsec_fw_size != 0xF00)) {
+        if ((tsec_fw_size != 0) && (tsec_fw_size != 0xF00 && tsec_fw_size != 0x2900)) {
             fatal_error("[NXBOOT]: TSEC firmware from %s has a wrong size!\n", loader_ctx->tsecfw_path);
         } else if (tsec_fw_size == 0) {
             fatal_error("[NXBOOT]: Could not read the TSEC firmware from %s!\n", loader_ctx->tsecfw_path);
@@ -280,23 +301,45 @@ uint32_t nxboot_main(void) {
             fatal_error("[NXBOOT]: Could not read the TSEC firmware from %s!\n", loader_ctx->tsecfw_path);
         }
     } else {
-        tsec_fw_size = package1_get_tsec_fw(&tsec_fw, package1loader, package1loader_size);
-        if (tsec_fw_size == 0) {
+        if (!package1_get_tsec_fw(&tsec_fw, package1loader, package1loader_size)) {
             fatal_error("[NXBOOT]: Failed to read the TSEC firmware from Package1loader!\n");
         }
+        if (target_firmware >= EXOSPHERE_TARGET_FIRMWARE_620) {
+            tsec_fw_size = 0x2900;
+        } else {
+            tsec_fw_size = 0xF00;
+        }
     }
     
-    /* Find the system's target firmware. */
-    uint32_t target_firmware = nxboot_get_target_firmware(package1loader);
-    if (!target_firmware)
-        fatal_error("[NXBOOT]: Failed to detect target firmware!\n");
-    else
-        print(SCREEN_LOG_LEVEL_INFO, "[NXBOOT]: Detected target firmware %ld!\n", target_firmware);
-    
     print(SCREEN_LOG_LEVEL_MANDATORY, "[NXBOOT]: Loaded firmware from eMMC...\n");
 
+    /* Get the TSEC keys. */
+    uint8_t tsec_key[0x10] = {0};
+    uint8_t tsec_root_key[0x10] = {0};
+    if (target_firmware >= EXOSPHERE_TARGET_FIRMWARE_620) {
+        uint8_t tsec_keys[0x20] = {0};
+        
+        /* Emulate the TSEC payload on 6.2.0+. */
+        smmu_emulate_tsec((void *)tsec_keys, package1loader, package1loader_size, package1loader);
+        
+        /* Copy back the keys. */
+        memcpy((void *)tsec_key, (void *)tsec_keys, 0x10);
+        memcpy((void *)tsec_root_key, (void *)tsec_keys + 0x10, 0x10);
+    } else {
+        /* Run the TSEC payload and get the key. */
+        if (tsec_get_key(tsec_key, 1, tsec_fw, tsec_fw_size) != 0) {
+            fatal_error("[NXBOOT]: Failed to get TSEC key!\n");
+        }
+    }
+    
+    /* Derive keydata. */
+    unsigned int keygen_type = 0;
+    if (derive_nx_keydata(target_firmware, g_keyblobs, available_revision, tsec_key, tsec_root_key, &keygen_type) != 0) {
+        fatal_error("[NXBOOT]: Key derivation failed!\n");
+    }
+
     /* Setup boot configuration for Exosphère. */
-    nxboot_configure_exosphere(target_firmware);
+    nxboot_configure_exosphere(target_firmware, keygen_type);
 
     /* Initialize Boot Reason on older firmware versions. */
     if (MAILBOX_EXOSPHERE_CONFIGURATION->target_firmware < EXOSPHERE_TARGET_FIRMWARE_400) {
@@ -304,11 +347,6 @@ uint32_t nxboot_main(void) {
         nxboot_set_bootreason();
     }
 
-    /* Derive keydata. */
-    if (derive_nx_keydata(MAILBOX_EXOSPHERE_CONFIGURATION->target_firmware, g_keyblobs, available_revision, tsec_fw, tsec_fw_size) != 0) {
-        fatal_error("[NXBOOT]: Key derivation failed!\n");
-    }
-
     /* Read the warmboot firmware from a file, otherwise from PK1. */
     if (loader_ctx->warmboot_path[0] != '\0') {
         warmboot_fw_size = get_file_size(loader_ctx->warmboot_path);
@@ -326,16 +364,26 @@ uint32_t nxboot_main(void) {
             fatal_error("[NXBOOT]: Could not read the warmboot firmware from %s!\n", loader_ctx->warmboot_path);
         }
     } else {
-        uint8_t ctr[16];
-        package1_size = package1_get_encrypted_package1(&package1, ctr, package1loader, package1loader_size);
-        if (package1_decrypt(package1, package1_size, ctr)) {
+        if (target_firmware >= EXOSPHERE_TARGET_FIRMWARE_620) {
+            /* Package1 was decrypted during TSEC emulation. */
+            const uint8_t *package1_hdr = (const uint8_t *)package1loader + 0x7000 - 0x20;
+            package1 = (package1_header_t *)(package1_hdr + 0x20);
+            package1_size = *(uint32_t *)package1_hdr;
             warmboot_fw = package1_get_warmboot_fw(package1);
             warmboot_fw_size = package1->warmboot_size;
         } else {
-            warmboot_fw = NULL;
-            warmboot_fw_size = 0;
+            /* Decrypt package1 and extract the warmboot firmware. */
+            uint8_t ctr[16];
+            package1_size = package1_get_encrypted_package1(&package1, ctr, package1loader, package1loader_size);
+            if (package1_decrypt(package1, package1_size, ctr)) {
+                warmboot_fw = package1_get_warmboot_fw(package1);
+                warmboot_fw_size = package1->warmboot_size;
+            } else {
+                warmboot_fw = NULL;
+                warmboot_fw_size = 0;
+            }
         }
-
+        
         if (warmboot_fw_size == 0) {
             fatal_error("[NXBOOT]: Could not read the warmboot firmware from Package1!\n");
         }

fusee/fusee-secondary/src/nxboot_iram.c

@@ -23,7 +23,9 @@
 #include "mc.h"
 #include "nxboot.h"
 #include "se.h"
+#include "smmu.h"
 #include "timers.h"
+#include "sysreg.h"
 
 void nxboot_finish(uint32_t boot_memaddr) {
     volatile tegra_se_t *se = se_get_regs();
@@ -41,7 +43,8 @@ void nxboot_finish(uint32_t boot_memaddr) {
     }
     
     /* Finalize the GPU UCODE carveout. */
-    mc_config_carveout_finalize();
+    /* NOTE: [4.0.0+] This is now done in the Secure Monitor. */
+    /* mc_config_carveout_finalize(); */
     
     /* Lock AES keyslots. */
     for (uint32_t i = 0; i < 16; i++)
@@ -68,8 +71,21 @@ void nxboot_finish(uint32_t boot_memaddr) {
     /* Terminate the display. */
     display_end();
     
-    /* Boot CPU0. */
-    cluster_boot_cpu0(boot_memaddr);
+    /* Check if SMMU emulation has been used. */
+    uint32_t smmu_magic = *(uint32_t *)(SMMU_AARCH64_PAYLOAD_ADDR + 0xFC);
+    if (smmu_magic == 0xDEADC0DE) {
+        /* Clear the magic. */
+        *(uint32_t *)(SMMU_AARCH64_PAYLOAD_ADDR + 0xFC) = 0;
+        
+        /* Pass the boot address to the already running payload. */
+        *(uint32_t *)(SMMU_AARCH64_PAYLOAD_ADDR + 0xF0) = boot_memaddr;
+        
+        /* Wait a while. */
+        mdelay(500);
+    } else {
+        /* Boot CPU0. */
+        cluster_boot_cpu0(boot_memaddr);
+    }
     
     /* Wait for Exosphère to wake up. */
     while (MAILBOX_NX_BOOTLOADER_IS_SECMON_AWAKE == 0) {

fusee/fusee-secondary/src/package1.c

@@ -90,15 +90,19 @@ int package1_read_and_parse_boot0(void **package1loader, size_t *package1loader_
     return 0;
 }
 
-size_t package1_get_tsec_fw(void **tsec_fw, const void *package1loader, size_t package1loader_size) {
+bool package1_get_tsec_fw(void **tsec_fw, const void *package1loader, size_t package1loader_size) {
     /* The TSEC firmware is always located at a 256-byte aligned address. */
-    /* We're looking for its 4 first bytes. We assume its size is always 0xF00 bytes. */
+    /* We're looking for its 4 first bytes. */
     const uint32_t *pos;
     uintptr_t pk1l = (uintptr_t)package1loader;
-    for (pos = (const uint32_t *)pk1l; (uintptr_t)pos < pk1l + package1loader_size && *pos != 0xCF42004D; pos += 0x40);
-
-    (*tsec_fw) = (void *)pos;
-    return 0xF00;
+    for (pos = (const uint32_t *)pk1l; (uintptr_t)pos < pk1l + package1loader_size; pos += 0x40) {
+        if (*pos == 0xCF42004D) {
+            (*tsec_fw) = (void *)pos;
+            return true;
+        }
+    }
+    
+    return false;
 }
 
 size_t package1_get_encrypted_package1(package1_header_t **package1, uint8_t *ctr, const void *package1loader, size_t package1loader_size) {
@@ -127,7 +131,7 @@ void *package1_get_warmboot_fw(const package1_header_t *package1) {
         https://github.com/ARM-software/arm-trusted-firmware/blob/master/plat/nvidia/tegra/common/aarch64/tegra_helpers.S#L312
         and thus by 0xD5034FDF.
 
-        Nx-bootloader seems to always start by 0xE328F0C0 (msr cpsr_f, 0xc0).
+        Nx-bootloader starts by 0xE328F0C0 (msr cpsr_f, 0xc0) before 6.2.0 and by 0xF0C0A7F0 afterwards.
     */
     const uint32_t *data = (const uint32_t *)package1->data;
     for (size_t i = 0; i < 3; i++) {
@@ -136,6 +140,7 @@ void *package1_get_warmboot_fw(const package1_header_t *package1) {
                 data += package1->secmon_size / 4;
                 break;
             case 0xE328F0C0:
+            case 0xF0C0A7F0:
                 data += package1->nx_bootloader_size / 4;
                 break;
             default:

fusee/fusee-secondary/src/package1.h

@@ -46,7 +46,7 @@ typedef struct {
 
 int package1_read_and_parse_boot0(void **package1loader, size_t *package1loader_size, nx_keyblob_t *keyblobs, uint32_t *revision, FILE *boot0);
 
-size_t package1_get_tsec_fw(void **tsec_fw, const void *package1loader, size_t package1loader_size);
+bool package1_get_tsec_fw(void **tsec_fw, const void *package1loader, size_t package1loader_size);
 size_t package1_get_encrypted_package1(package1_header_t **package1, uint8_t *ctr, const void *package1loader, size_t package1loader_size);
 
 /* Must be aligned to 16 bytes. */

fusee/fusee-secondary/src/package2.c

@@ -214,7 +214,7 @@ static bool package2_validate_metadata(package2_meta_t *metadata, uint8_t data[]
 
     /* Perform version checks. */
     /* We will be compatible with all package2s released before current, but not newer ones. */
-    if (metadata->version_max >= PACKAGE2_MINVER_THEORETICAL && metadata->version_min < PACKAGE2_MAXVER_600_CURRENT) {
+    if (metadata->version_max >= PACKAGE2_MINVER_THEORETICAL && metadata->version_min < PACKAGE2_MAXVER_620_CURRENT) {
         return true;
     }
 

fusee/fusee-secondary/src/package2.h

@@ -34,7 +34,8 @@
 #define PACKAGE2_MAXVER_302 0x5
 #define PACKAGE2_MAXVER_400_410 0x6
 #define PACKAGE2_MAXVER_500_510 0x7
-#define PACKAGE2_MAXVER_600_CURRENT 0x8
+#define PACKAGE2_MAXVER_600_610 0x8
+#define PACKAGE2_MAXVER_620_CURRENT 0x9
 
 #define PACKAGE2_MINVER_100 0x3
 #define PACKAGE2_MINVER_200 0x4
@@ -42,7 +43,8 @@
 #define PACKAGE2_MINVER_302 0x6
 #define PACKAGE2_MINVER_400_410 0x7
 #define PACKAGE2_MINVER_500_510 0x8
-#define PACKAGE2_MINVER_600_CURRENT 0x9
+#define PACKAGE2_MINVER_600_610 0x9
+#define PACKAGE2_MINVER_620_CURRENT 0xA
 
 #define NX_BOOTLOADER_PACKAGE2_LOAD_ADDRESS ((void *)(0xA9800000ull))
 

fusee/fusee-secondary/src/smmu.c

@@ -0,0 +1,259 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "smmu.h"
+#include "cluster.h"
+#include "mc.h"
+#include "timers.h"
+#include "tsec.h"
+
+void *smmu_heap = (void *)SMMU_HEAP_BASE_ADDR;
+
+static void safe_memcpy(void *dst, void *src, uint32_t sz) {
+    /* Aligned memcpy to read MMIO correctly. */
+    for (size_t i = 0; i < (sz/4); i++) {
+        ((volatile uint32_t *)dst)[i] = ((volatile uint32_t *)src)[i];
+    }
+}
+
+static void smmu_flush_ppsb() {
+    /* Read-back barrier for interactions between the PPSB and the APB/AHB. */
+    (void)MAKE_MC_REG(MC_SMMU_TLB_CONFIG);
+}
+
+static void smmu_flush_regs() {
+    /* Flush all TLB and PTC entries. */
+    MAKE_MC_REG(MC_SMMU_PTC_FLUSH) = 0;
+    smmu_flush_ppsb();
+    MAKE_MC_REG(MC_SMMU_TLB_FLUSH) = 0;
+    smmu_flush_ppsb();
+}
+
+static void *smmu_alloc_page(uint32_t page_count) {
+    void *cur_page = smmu_heap;
+    smmu_heap += (page_count * SMMU_PAGE_SIZE);
+    memset(cur_page, 0, (page_count * SMMU_PAGE_SIZE));
+    return cur_page;
+}
+
+static uint32_t *smmu_alloc_pdir() {
+    uint32_t *pdir = (uint32_t *)smmu_alloc_page(1);
+    for (int pdn = 0; pdn < SMMU_PDIR_COUNT; pdn++) {
+        pdir[pdn] = _PDE_VACANT(pdn);
+    }
+    return pdir;
+}
+
+static uint32_t *smmu_locate_pte(uint32_t *pdir_page, uint32_t iova) {
+    uint32_t ptn = SMMU_ADDR_TO_PFN(iova);
+    uint32_t pdn = SMMU_ADDR_TO_PDN(iova);
+    uint32_t *pdir = pdir_page;
+    uint32_t *ptbl;
+
+    if (pdir[pdn] != _PDE_VACANT(pdn)) {
+        /* Mapped entry table already exists. */
+        ptbl = (uint32_t *)SMMU_EX_PTBL_PAGE(pdir[pdn]);
+    } else {
+        /* Allocate page table. */
+        ptbl = (uint32_t *)smmu_alloc_page(1);
+        uint32_t addr = SMMU_PDN_TO_ADDR(pdn);
+        for (int pn = 0; pn < SMMU_PTBL_COUNT; pn++, addr += SMMU_PAGE_SIZE) {
+            ptbl[pn] = _PTE_VACANT(addr);
+        }
+        pdir[pdn] = SMMU_MK_PDE((uint32_t)ptbl, _PDE_ATTR | _PDE_NEXT);
+        smmu_flush_regs();
+    }
+
+    return &ptbl[ptn % SMMU_PTBL_COUNT];
+}
+
+static void smmu_map(uint32_t *pdir, uint32_t addr, uint32_t ptpage, int pcount, uint32_t pte_attr) {
+    for (int i = 0; i < pcount; i++) {
+        uint32_t *pte = smmu_locate_pte(pdir, addr);
+        *pte = SMMU_PFN_TO_PTE(SMMU_ADDR_TO_PFN(ptpage), pte_attr);
+        addr += SMMU_PAGE_SIZE;
+        ptpage += SMMU_PAGE_SIZE;
+    }
+    smmu_flush_regs();
+}
+
+static uint32_t *smmu_setup_tsec_as(uint32_t asid) {
+    /* Allocate the page directory. */
+    uint32_t *pdir_page = smmu_alloc_pdir();
+
+    /* Set the PTB ASID and point it to the PDIR. */
+    MAKE_MC_REG(MC_SMMU_PTB_ASID) = asid;
+    MAKE_MC_REG(MC_SMMU_PTB_DATA) = SMMU_MK_PDIR((uint32_t)pdir_page, _PDIR_ATTR);
+    smmu_flush_ppsb();
+    
+    /* Assign the ASID to TSEC. */
+    MAKE_MC_REG(MC_SMMU_TSEC_ASID) = SMMU_ASID_ENABLE((asid << 24) | (asid << 16) | (asid << 8) | asid);
+    smmu_flush_ppsb();
+
+    return pdir_page;
+}
+
+static void smmu_clear_tsec_as(uint32_t asid) {
+    /* Set the PTB ASID and clear it's data. */
+    MAKE_MC_REG(MC_SMMU_PTB_ASID) = asid;
+    MAKE_MC_REG(MC_SMMU_PTB_DATA) = 0;
+    
+    /* Clear the ASID from TSEC. */
+    MAKE_MC_REG(MC_SMMU_TSEC_ASID) = SMMU_ASID_DISABLE;
+    smmu_flush_ppsb();
+}
+
+static void smmu_enable() {
+    /* AARCH64 payload for enabling the SMMU. */
+    /* Write 1 to MC_SMMU_CONFIG, read back and write the result to 0x40003F80. */
+    /* This will leave the CPU waiting until 0x40003FF0 is set to Exosphère's address. */
+    static const uint32_t aarch64_payload[20] = {
+        0x52800020, 0x58000162, 0x58000183, 0xB9000040,
+        0xB9400041, 0xB9000061, 0x58000142, 0xF9400040,
+        0xF100001F, 0x54FFFFA0, 0xD61F0000, 0x00000000,
+        0x70019010, 0x00000000, 0x40003F80, 0x00000000,
+        0x40003FF0, 0x00000000, 0x00000000, 0x00000000
+    };
+    
+    /* Reset Translation Enable Registers. */
+    MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_0) = 0xFFFFFFFF;
+    MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_1) = 0xFFFFFFFF;
+    MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_2) = 0xFFFFFFFF;
+    MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_3) = 0xFFFFFFFF;
+    MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_4) = 0xFFFFFFFF;
+    
+    /* Setup initial TLB and PTC configuration. */
+    MAKE_MC_REG(MC_SMMU_PTB_ASID) = 0;
+    MAKE_MC_REG(MC_SMMU_PTB_DATA) = 0;
+    MAKE_MC_REG(MC_SMMU_TLB_CONFIG) = 0x30000030;
+    MAKE_MC_REG(MC_SMMU_PTC_CONFIG) = 0x2800003F;
+    smmu_flush_regs();
+    
+    /* Power on the CCPLEX to enable the SMMU globally (requires a secure write). */
+    volatile uint32_t *aarch64_payload_res = (volatile uint32_t *)(SMMU_AARCH64_PAYLOAD_ADDR + 0x80);
+    memset((void *)SMMU_AARCH64_PAYLOAD_ADDR, 0, 0x100);
+    memcpy((void *)SMMU_AARCH64_PAYLOAD_ADDR, aarch64_payload, 20 * 4);
+    cluster_boot_cpu0(SMMU_AARCH64_PAYLOAD_ADDR);
+    mdelay(500);
+    if (*aarch64_payload_res != 1) {
+        fatal_error("[SMMU]: Failed to enable SMMU!\n");
+    }
+    
+    /* Write magic for nxboot. */
+    *(uint32_t *)(SMMU_AARCH64_PAYLOAD_ADDR + 0xFC) = 0xDEADC0DE;
+    
+    /* Flush TLB and PTC entries. */
+    smmu_flush_regs();
+}
+
+void smmu_emulate_tsec(void *tsec_keys, const void *package1, size_t package1_size, void *package1_dec) {
+    volatile tegra_tsec_t *tsec = tsec_get_regs();
+    
+    /* Backup IRAM to DRAM. */
+    memcpy((void *)SMMU_IRAM_BACKUP_ADDR, (void *)0x40010000, 0x30000);
+    
+    /* Copy package1 into IRAM. */
+    memcpy((void *)0x40010000, package1, package1_size);
+    
+    /* Load the TSEC firmware from IRAM. */
+    if (tsec_load_fw((void *)(0x40010000 + 0xE00), 0x2900) < 0) {
+        fatal_error("[SMMU]: Failed to load TSEC firmware!\n");
+    }
+    
+    /* Disable the aperture since it has precedence over the SMMU. */
+    mc_disable_ahb_redirect();
+    
+    /* Setup TSEC's address space. */
+    uint32_t *pdir = smmu_setup_tsec_as(1);
+
+    /* Allocate pages for MMIO and IRAM. */
+    volatile uint32_t *car_page = smmu_alloc_page(1);
+    volatile uint32_t *fuse_page = smmu_alloc_page(1);
+    volatile uint32_t *pmc_page = smmu_alloc_page(1);
+    volatile uint32_t *flow_page = smmu_alloc_page(1);
+    volatile uint32_t *se_page = smmu_alloc_page(1);
+    volatile uint32_t *mc_page = smmu_alloc_page(1);
+    volatile uint32_t *iram_pages = smmu_alloc_page(48);
+    volatile uint32_t *expv_page = smmu_alloc_page(1);
+    
+    /* Copy CAR, MC and FUSE. */
+    safe_memcpy((void *)car_page, (void *)0x60006000, 0x1000);
+    safe_memcpy((void *)mc_page, (void *)0x70019000, 0x1000);
+    safe_memcpy((void *)&fuse_page[0x800/4], (void *)0x7000F800, 0x400);
+    
+    /* Copy IRAM. */
+    memcpy((void *)iram_pages, (void *)0x40010000, 0x30000);
+        
+    /* TSEC wants CLK_RST_CONTROLLER_CLK_SOURCE_TSEC_0 to be equal to 2. */
+    car_page[0x1F4/4] = 2;
+    
+    /* TSEC wants the aperture fully open. */
+    mc_page[0x65C/4] = 0;
+    mc_page[0x660/4] = 0x80000000;
+    
+    /* Map all necessary pages. */
+    smmu_map(pdir, 0x60006000, (uint32_t)car_page, 1, _READABLE | _WRITABLE | _NONSECURE);
+    smmu_map(pdir, 0x7000F000, (uint32_t)fuse_page, 1, _READABLE | _NONSECURE);
+    smmu_map(pdir, 0x7000E000, (uint32_t)pmc_page, 1, _READABLE | _NONSECURE);
+    smmu_map(pdir, 0x60007000, (uint32_t)flow_page, 1, _WRITABLE | _NONSECURE);
+    smmu_map(pdir, 0x70012000, (uint32_t)se_page, 1, _READABLE | _WRITABLE | _NONSECURE);
+    smmu_map(pdir, 0x70019000, (uint32_t)mc_page, 1, _READABLE | _NONSECURE);
+    smmu_map(pdir, 0x40010000, (uint32_t)iram_pages, 48, _READABLE | _WRITABLE | _NONSECURE);
+    smmu_map(pdir, 0x6000F000, (uint32_t)expv_page, 1, _READABLE | _WRITABLE | _NONSECURE);
+
+    /* Enable the SMMU. */
+    smmu_enable();
+    
+    /* Run the TSEC firmware. */
+    tsec_run_fw();
+    
+    /* Extract the keys from SE. */
+    uint32_t key_buf[0x20/4] = {0};
+    volatile uint32_t *key_data = (volatile uint32_t *)((void *)se_page + 0x320);
+    uint32_t old_key_data = *key_data;
+    uint32_t buf_counter = 0;
+    while (!(tsec->FALCON_CPUCTL & 0x10)) {
+        if (*key_data != old_key_data) {
+            old_key_data = *key_data;
+            key_buf[buf_counter] = *key_data;
+            buf_counter++;
+        }
+    }
+    
+    /* Check if the TSEC firmware wrote over the exception vectors. */
+    volatile uint32_t *tsec_done_check = (volatile uint32_t *)((void *)expv_page + 0x200);
+    if (!(*tsec_done_check)) {
+        fatal_error("[SMMU]: Failed to emulate the TSEC firmware!\n");
+    }
+
+    /* Copy back the extracted keys. */
+    memcpy((void *)tsec_keys, (void *)key_buf, 0x20);
+    
+    /* Manually disable TSEC clocks. */
+    tsec_disable_clkrst();
+    
+    /* Clear TSEC's address space. */
+    smmu_clear_tsec_as(1);
+    
+    /* Enable back the aperture. */
+    mc_enable_ahb_redirect();
+    
+    /* Return the decrypted package1 from emulated IRAM. */
+    memcpy(package1_dec, (void *)iram_pages, package1_size);
+    
+    /* Restore IRAM from DRAM. */
+    memcpy((void *)0x40010000, (void *)SMMU_IRAM_BACKUP_ADDR, 0x30000);
+}

fusee/fusee-secondary/src/smmu.h

@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef FUSEE_SMMU_H_
+#define FUSEE_SMMU_H_
+
+#include <stddef.h>
+#include <stdint.h>
+#include <stdbool.h>
+
+#define SMMU_HEAP_BASE_ADDR             0x81000000
+#define SMMU_IRAM_BACKUP_ADDR           0x82000000
+#define SMMU_AARCH64_PAYLOAD_ADDR       0x40003F00
+
+#define SMMU_PAGE_SHIFT 12
+#define SMMU_PAGE_SIZE  (1 << SMMU_PAGE_SHIFT)
+#define SMMU_PDIR_COUNT 1024
+#define SMMU_PDIR_SIZE  (sizeof(uint32_t) * SMMU_PDIR_COUNT)
+#define SMMU_PTBL_COUNT 1024
+#define SMMU_PTBL_SIZE  (sizeof(uint32_t) * SMMU_PTBL_COUNT)
+#define SMMU_PDIR_SHIFT 12
+#define SMMU_PDE_SHIFT  12
+#define SMMU_PTE_SHIFT  12
+#define SMMU_PFN_MASK   0x000fffff
+#define SMMU_PDE_NEXT_SHIFT     28
+#define SMMU_ADDR_TO_PFN(addr)  ((addr) >> 12)
+#define SMMU_ADDR_TO_PDN(addr)  ((addr) >> 22)
+#define SMMU_PDN_TO_ADDR(pdn)   ((pdn) << 22)
+#define _READABLE   (1 << 31)
+#define _WRITABLE   (1 << 30)
+#define _NONSECURE  (1 << 29)
+#define _PDE_NEXT   (1 << SMMU_PDE_NEXT_SHIFT)
+#define _MASK_ATTR  (_READABLE | _WRITABLE | _NONSECURE)
+#define _PDIR_ATTR  (_READABLE | _WRITABLE | _NONSECURE)
+#define _PDE_ATTR   (_READABLE | _WRITABLE | _NONSECURE)
+#define _PDE_ATTR_N (_PDE_ATTR | _PDE_NEXT)
+#define _PDE_VACANT(pdn)    (((pdn) << 10) | _PDE_ATTR)
+#define _PTE_ATTR   (_READABLE | _WRITABLE | _NONSECURE)
+#define _PTE_VACANT(addr)   (((addr) >> SMMU_PAGE_SHIFT) | _PTE_ATTR)
+#define SMMU_MK_PDIR(page, attr)    (((page) >> SMMU_PDIR_SHIFT) | (attr))
+#define SMMU_MK_PDE(page, attr) (((page) >> SMMU_PDE_SHIFT) | (attr))
+#define SMMU_EX_PTBL_PAGE(pde)  (((pde) & SMMU_PFN_MASK) << SMMU_PDIR_SHIFT)
+#define SMMU_PFN_TO_PTE(pfn, attr)  ((pfn) | (attr))
+#define SMMU_ASID_ENABLE(asid)  ((asid) | (1 << 31))
+#define SMMU_ASID_DISABLE   0
+#define SMMU_ASID_ASID(n)   ((n) & ~SMMU_ASID_ENABLE(0))
+
+void smmu_emulate_tsec(void *tsec_keys, const void *package1, size_t package1_size, void *package1_dec);
+
+#endif

fusee/fusee-secondary/src/splash_screen.c

@@ -44,7 +44,7 @@ void display_splash_screen_bmp(const char *custom_splash_path, void *fb_address)
     
     /* Try to load an external custom splash screen. */
     if ((custom_splash_path != NULL) && (custom_splash_path[0] != '\x00')) {
-        if (!read_from_file(splash_screen, sizeof(&splash_screen_bmp), custom_splash_path)) {
+        if (!read_from_file(splash_screen, splash_screen_bmp_size, custom_splash_path)) {
             fatal_error("Failed to read custom splash screen from %s!\n", custom_splash_path);
         }
     }

fusee/fusee-secondary/src/timers.h

@@ -21,11 +21,15 @@
 
 #define TIMERS_BASE 0x60005000
 #define MAKE_TIMERS_REG(n) MAKE_REG32(TIMERS_BASE + n)
+
 #define TIMERUS_CNTR_1US_0 MAKE_TIMERS_REG(0x10)
 #define TIMERUS_USEC_CFG_0 MAKE_TIMERS_REG(0x14)
+#define SHARED_INTR_STATUS_0 MAKE_TIMERS_REG(0x1A0)
+#define SHARED_TIMER_SECURE_CFG_0 MAKE_TIMERS_REG(0x1A4)
 
 #define RTC_BASE 0x7000E000
 #define MAKE_RTC_REG(n) MAKE_REG32(RTC_BASE + n)
+
 #define RTC_SECONDS MAKE_RTC_REG(0x08)
 #define RTC_SHADOW_SECONDS MAKE_RTC_REG(0x0C)
 #define RTC_MILLI_SECONDS MAKE_RTC_REG(0x10)
@@ -39,7 +43,7 @@ typedef struct {
 
 #define GET_WDT(n) ((volatile watchdog_timers_t *)(TIMERS_BASE + 0x100 + 0x20 * n))
 #define WDT_REBOOT_PATTERN 0xC45A
-#define GET_WDT_REBOOT_CFG_REG(n) MAKE_TIMERS_REG(0x60 + 0x8 * n)
+#define GET_WDT_REBOOT_CFG_REG(n) MAKE_REG32(TIMERS_BASE + 0x60 + 0x8 * n)
 
 void wait(uint32_t microseconds);
 

fusee/fusee-secondary/src/tsec.c

@@ -49,17 +49,34 @@ static int tsec_dma_phys_to_flcn(bool is_imem, uint32_t flcn_offset, uint32_t ph
     return tsec_dma_wait_idle();
 }
 
-int tsec_get_key(uint8_t *key, uint32_t rev, const void *tsec_fw)
+void tsec_enable_clkrst()
 {
-    volatile tegra_tsec_t *tsec = tsec_get_regs();
-
-    /* Enable clocks. */
+    /* Enable all devices used by TSEC. */
     clkrst_reboot(CARDEVICE_HOST1X);
     clkrst_reboot(CARDEVICE_TSEC);
     clkrst_reboot(CARDEVICE_SOR_SAFE);
     clkrst_reboot(CARDEVICE_SOR0);
     clkrst_reboot(CARDEVICE_SOR1);
     clkrst_reboot(CARDEVICE_KFUSE);
+}
+
+void tsec_disable_clkrst()
+{
+    /* Disable all devices used by TSEC. */
+    clkrst_disable(CARDEVICE_KFUSE);
+    clkrst_disable(CARDEVICE_SOR1);
+    clkrst_disable(CARDEVICE_SOR0);
+    clkrst_disable(CARDEVICE_SOR_SAFE);
+    clkrst_disable(CARDEVICE_TSEC);
+    clkrst_disable(CARDEVICE_HOST1X);
+}
+
+int tsec_get_key(uint8_t *key, uint32_t rev, const void *tsec_fw, size_t tsec_fw_size)
+{
+    volatile tegra_tsec_t *tsec = tsec_get_regs();
+
+    /* Enable clocks. */
+    tsec_enable_clkrst();
 
     /* Configure Falcon. */
     tsec->FALCON_DMACTL = 0;
@@ -70,29 +87,19 @@ int tsec_get_key(uint8_t *key, uint32_t rev, const void *tsec_fw)
     if (!tsec_dma_wait_idle())
     {
         /* Disable clocks. */
-        clkrst_disable(CARDEVICE_KFUSE);
-        clkrst_disable(CARDEVICE_SOR1);
-        clkrst_disable(CARDEVICE_SOR0);
-        clkrst_disable(CARDEVICE_SOR_SAFE);
-        clkrst_disable(CARDEVICE_TSEC);
-        clkrst_disable(CARDEVICE_HOST1X);
+        tsec_disable_clkrst();
     
         return -1;
     }
     
     /* Load firmware. */
     tsec->FALCON_DMATRFBASE = (uint32_t)tsec_fw >> 8;
-    for (uint32_t addr = 0; addr < 0xF00; addr += 0x100)
+    for (uint32_t addr = 0; addr < tsec_fw_size; addr += 0x100)
     {
         if (!tsec_dma_phys_to_flcn(true, addr, addr))
         {
             /* Disable clocks. */
-            clkrst_disable(CARDEVICE_KFUSE);
-            clkrst_disable(CARDEVICE_SOR1);
-            clkrst_disable(CARDEVICE_SOR0);
-            clkrst_disable(CARDEVICE_SOR_SAFE);
-            clkrst_disable(CARDEVICE_TSEC);
-            clkrst_disable(CARDEVICE_HOST1X);
+            tsec_disable_clkrst();
         
             return -2;
         }
@@ -110,12 +117,7 @@ int tsec_get_key(uint8_t *key, uint32_t rev, const void *tsec_fw)
     if (!tsec_dma_wait_idle())
     {
         /* Disable clocks. */
-        clkrst_disable(CARDEVICE_KFUSE);
-        clkrst_disable(CARDEVICE_SOR1);
-        clkrst_disable(CARDEVICE_SOR0);
-        clkrst_disable(CARDEVICE_SOR_SAFE);
-        clkrst_disable(CARDEVICE_TSEC);
-        clkrst_disable(CARDEVICE_HOST1X);
+        tsec_disable_clkrst();
     
         return -3;
     }
@@ -126,12 +128,7 @@ int tsec_get_key(uint8_t *key, uint32_t rev, const void *tsec_fw)
         if (get_time_ms() > timeout)
         {
             /* Disable clocks. */
-            clkrst_disable(CARDEVICE_KFUSE);
-            clkrst_disable(CARDEVICE_SOR1);
-            clkrst_disable(CARDEVICE_SOR0);
-            clkrst_disable(CARDEVICE_SOR_SAFE);
-            clkrst_disable(CARDEVICE_TSEC);
-            clkrst_disable(CARDEVICE_HOST1X);
+            tsec_disable_clkrst();
         
             return -4;
         }
@@ -140,12 +137,7 @@ int tsec_get_key(uint8_t *key, uint32_t rev, const void *tsec_fw)
     if (tsec->FALCON_SCRATCH1 != 0xB0B0B0B0)
     {
         /* Disable clocks. */
-        clkrst_disable(CARDEVICE_KFUSE);
-        clkrst_disable(CARDEVICE_SOR1);
-        clkrst_disable(CARDEVICE_SOR0);
-        clkrst_disable(CARDEVICE_SOR_SAFE);
-        clkrst_disable(CARDEVICE_TSEC);
-        clkrst_disable(CARDEVICE_HOST1X);
+        tsec_disable_clkrst();
     
         return -5;
     }
@@ -170,4 +162,55 @@ int tsec_get_key(uint8_t *key, uint32_t rev, const void *tsec_fw)
     memcpy(key, &tmp, 0x10);
 
     return 0;
+}
+
+int tsec_load_fw(const void *tsec_fw, size_t tsec_fw_size)
+{
+    volatile tegra_tsec_t *tsec = tsec_get_regs();
+
+    /* Enable clocks. */
+    tsec_enable_clkrst();
+
+    /* Configure Falcon. */
+    tsec->FALCON_DMACTL = 0;
+    tsec->FALCON_IRQMSET = 0xFFF2;
+    tsec->FALCON_IRQDEST = 0xFFF0;
+    tsec->FALCON_ITFEN = 3;
+    
+    if (!tsec_dma_wait_idle())
+    {
+        /* Disable clocks. */
+        tsec_disable_clkrst();
+    
+        return -1;
+    }
+    
+    /* Load firmware. */
+    tsec->FALCON_DMATRFBASE = (uint32_t)tsec_fw >> 8;
+    for (uint32_t addr = 0; addr < tsec_fw_size; addr += 0x100)
+    {
+        if (!tsec_dma_phys_to_flcn(true, addr, addr))
+        {
+            /* Disable clocks. */
+            tsec_disable_clkrst();
+        
+            return -2;
+        }
+    }
+
+    return 0;
+}
+
+void tsec_run_fw()
+{
+    volatile tegra_tsec_t *tsec = tsec_get_regs();
+    
+    /* Unknown host1x write. */
+    MAKE_HOST1X_REG(0x3300) = 0x34C2E1DA;
+    
+    /* Execute firmware. */
+    tsec->FALCON_SCRATCH1 = 0;
+    tsec->FALCON_SCRATCH0 = 1;
+    tsec->FALCON_BOOTVEC = 0;
+    tsec->FALCON_CPUCTL = 2;
 }

fusee/fusee-secondary/src/tsec.h

@@ -109,6 +109,10 @@ static inline volatile tegra_tsec_t *tsec_get_regs(void)
     return (volatile tegra_tsec_t *)TSEC_BASE;
 }
 
-int tsec_get_key(uint8_t *key, uint32_t rev, const void *tsec_fw);
+void tsec_enable_clkrst();
+void tsec_disable_clkrst();
+int tsec_get_key(uint8_t *key, uint32_t rev, const void *tsec_fw, size_t tsec_fw_size);
+int tsec_load_fw(const void *tsec_fw, size_t tsec_fw_size);
+void tsec_run_fw();
 
 #endif

stratosphere/Makefile

@@ -1,4 +1,4 @@
-KIPS := loader pm sm boot fs_mitm set_mitm creport
+KIPS := loader pm sm boot fs_mitm set_mitm creport fatal
 
 #TODO: boot2 ?
 

stratosphere/boot/Makefile

@@ -9,6 +9,14 @@ endif
 TOPDIR ?= $(CURDIR)
 include $(DEVKITPRO)/libnx/switch_rules
 
+AMSBRANCH := $(shell git symbolic-ref --short HEAD)
+AMSREV := $(AMSBRANCH)-$(shell git rev-parse --short HEAD)
+
+ifneq (, $(strip $(shell git status --porcelain 2>/dev/null)))
+    AMSREV := $(AMSREV)-dirty
+endif
+
+
 #---------------------------------------------------------------------------------
 # TARGET is the name of the output
 # BUILD is the directory where object files & intermediate files will be placed
@@ -24,7 +32,7 @@ DATA		:=	data
 INCLUDES	:=	include ../../common/include
 EXEFS_SRC	:=	exefs_src
 
-DEFINES	:=	-DDISABLE_IPC
+DEFINES	:=	-DDISABLE_IPC -DATMOSPHERE_GIT_BRANCH=\"$(AMSBRANCH)\" -DATMOSPHERE_GIT_REV=\"$(AMSREV)\"
 
 #---------------------------------------------------------------------------------
 # options for code generation

stratosphere/creport/Makefile

@@ -9,6 +9,13 @@ endif
 TOPDIR ?= $(CURDIR)
 include $(DEVKITPRO)/libnx/switch_rules
 
+AMSBRANCH := $(shell git symbolic-ref --short HEAD)
+AMSREV := $(AMSBRANCH)-$(shell git rev-parse --short HEAD)
+
+ifneq (, $(strip $(shell git status --porcelain 2>/dev/null)))
+    AMSREV := $(AMSREV)-dirty
+endif
+
 #---------------------------------------------------------------------------------
 # TARGET is the name of the output
 # BUILD is the directory where object files & intermediate files will be placed
@@ -24,7 +31,7 @@ DATA		:=	data
 INCLUDES	:=	include ../../common/include
 EXEFS_SRC	:=	exefs_src
 
-DEFINES	:=	-DDISABLE_IPC
+DEFINES	:=	-DDISABLE_IPC -DATMOSPHERE_GIT_BRANCH=\"$(AMSBRANCH)\" -DATMOSPHERE_GIT_REV=\"$(AMSREV)\"
 
 #---------------------------------------------------------------------------------
 # options for code generation

stratosphere/creport/source/creport_code_info.hpp

@@ -29,7 +29,7 @@ struct CodeInfo {
 };
 
 class CodeList {
-    private:
+    public:
         static const size_t max_code_count = 0x60;
         u32 code_count = 0;
         CodeInfo code_infos[max_code_count];

stratosphere/creport/source/creport_crash_report.cpp

@@ -47,6 +47,35 @@ void CrashReport::BuildReport(u64 pid, bool has_extra_info) {
     }
 }
 
+FatalContext *CrashReport::GetFatalContext() {
+    FatalContext *ctx = new FatalContext;
+    *ctx = (FatalContext){0};
+    
+    ctx->is_aarch32 = false;
+    ctx->type = static_cast<u32>(this->exception_info.type);
+    
+    for (size_t i = 0; i < 29; i++) {
+        ctx->aarch64_ctx.x[i] = this->crashed_thread_info.context.cpu_gprs[i].x;
+    }
+    ctx->aarch64_ctx.fp = this->crashed_thread_info.context.fp;
+    ctx->aarch64_ctx.lr = this->crashed_thread_info.context.lr;
+    ctx->aarch64_ctx.pc = this->crashed_thread_info.context.pc.x;
+    
+    ctx->aarch64_ctx.stack_trace_size = this->crashed_thread_info.stack_trace_size;
+    for (size_t i = 0; i < ctx->aarch64_ctx.stack_trace_size; i++) {
+        ctx->aarch64_ctx.stack_trace[i] = this->crashed_thread_info.stack_trace[i];
+    }
+    
+    if (this->code_list.code_count) {
+        ctx->aarch64_ctx.start_address = this->code_list.code_infos[0].start_address;
+    }
+    
+    /* For ams fatal... */
+    ctx->aarch64_ctx.afsr0 = this->process_info.title_id;
+    
+    return ctx;
+}
+
 void CrashReport::ProcessExceptions() {
     if (!IsOpen()) {
         return;
@@ -233,7 +262,7 @@ void CrashReport::EnsureReportDirectories() {
 }
 
 void CrashReport::SaveReport() {
-    /* TODO: Save the report to the SD card. */
+    /* Save the report to the SD card. */
     char report_path[FS_MAX_PATH];
     
     /* Ensure path exists. */

stratosphere/creport/source/creport_crash_report.hpp

@@ -61,6 +61,7 @@ class CrashReport {
         
     public:
         void BuildReport(u64 pid, bool has_extra_info);
+        FatalContext *GetFatalContext();
         void SaveReport();
         
         bool IsAddressReadable(u64 address, u64 size, MemoryInfo *mi = NULL);

stratosphere/creport/source/creport_main.cpp

@@ -132,7 +132,9 @@ int main(int argc, char **argv) {
             return 0;
         }
         
-        fatalWithType(g_Creport.GetResult(), FatalType_ErrorScreen);
+        FatalContext *ctx = g_Creport.GetFatalContext();
+        
+        fatalWithContext(g_Creport.GetResult(), FatalType_ErrorScreen, ctx);
     }
     
 }

stratosphere/creport/source/creport_thread_info.hpp

@@ -23,7 +23,7 @@
 class CodeList;
 
 class ThreadInfo {
-    private:
+    public:
         ThreadContext context{};
         u64 thread_id = 0;
         u64 stack_top = 0;

stratosphere/fatal/Makefile

@@ -0,0 +1,166 @@
+#---------------------------------------------------------------------------------
+.SUFFIXES:
+#---------------------------------------------------------------------------------
+
+ifeq ($(strip $(DEVKITPRO)),)
+$(error "Please set DEVKITPRO in your environment. export DEVKITPRO=<path to>/devkitpro")
+endif
+
+TOPDIR ?= $(CURDIR)
+include $(DEVKITPRO)/libnx/switch_rules
+
+AMSBRANCH := $(shell git symbolic-ref --short HEAD)
+AMSREV := $(AMSBRANCH)-$(shell git rev-parse --short HEAD)
+
+ifneq (, $(strip $(shell git status --porcelain 2>/dev/null)))
+    AMSREV := $(AMSREV)-dirty
+endif
+
+#---------------------------------------------------------------------------------
+# TARGET is the name of the output
+# BUILD is the directory where object files & intermediate files will be placed
+# SOURCES is a list of directories containing source code
+# DATA is a list of directories containing data files
+# INCLUDES is a list of directories containing header files
+# EXEFS_SRC is the optional input directory containing data copied into exefs, if anything this normally should only contain "main.npdm".
+#---------------------------------------------------------------------------------
+TARGET		:=	$(notdir $(CURDIR))
+BUILD		:=	build
+SOURCES		:=	source
+DATA		:=	data
+INCLUDES	:=	include ../../common/include
+EXEFS_SRC	:=	exefs_src
+
+DEFINES	:=	-DDISABLE_IPC -DATMOSPHERE_GIT_BRANCH=\"$(AMSBRANCH)\" -DATMOSPHERE_GIT_REV=\"$(AMSREV)\"
+
+#---------------------------------------------------------------------------------
+# options for code generation
+#---------------------------------------------------------------------------------
+ARCH	:=	-march=armv8-a -mtune=cortex-a57 -mtp=soft -fPIE
+
+CFLAGS	:=	-g -Wall -O2 -ffunction-sections \
+			$(ARCH) $(DEFINES)
+
+CFLAGS	+=	$(INCLUDE) -D__SWITCH__ `freetype-config --cflags`
+
+CXXFLAGS	:= $(CFLAGS) -fno-rtti -fno-exceptions -std=gnu++17
+
+ASFLAGS	:=	-g $(ARCH)
+LDFLAGS	=	-specs=$(DEVKITPRO)/libnx/switch.specs -g $(ARCH) -Wl,-Map,$(notdir $*.map)
+
+LIBS	:= `freetype-config --libs` -lstratosphere -lnx
+
+#---------------------------------------------------------------------------------
+# list of directories containing libraries, this must be the top level containing
+# include and lib
+#---------------------------------------------------------------------------------
+LIBDIRS	:= $(PORTLIBS) $(LIBNX) $(CURDIR)/../libstratosphere
+
+
+#---------------------------------------------------------------------------------
+# no real need to edit anything past this point unless you need to add additional
+# rules for different file extensions
+#---------------------------------------------------------------------------------
+ifneq ($(BUILD),$(notdir $(CURDIR)))
+#---------------------------------------------------------------------------------
+
+export OUTPUT	:=	$(CURDIR)/$(TARGET)
+export TOPDIR	:=	$(CURDIR)
+
+export VPATH	:=	$(foreach dir,$(SOURCES),$(CURDIR)/$(dir)) \
+			$(foreach dir,$(DATA),$(CURDIR)/$(dir))
+
+export DEPSDIR	:=	$(CURDIR)/$(BUILD)
+
+CFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.c)))
+CPPFILES	:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.cpp)))
+SFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.s)))
+BINFILES	:=	$(foreach dir,$(DATA),$(notdir $(wildcard $(dir)/*.*)))
+
+#---------------------------------------------------------------------------------
+# use CXX for linking C++ projects, CC for standard C
+#---------------------------------------------------------------------------------
+ifeq ($(strip $(CPPFILES)),)
+#---------------------------------------------------------------------------------
+	export LD	:=	$(CC)
+#---------------------------------------------------------------------------------
+else
+#---------------------------------------------------------------------------------
+	export LD	:=	$(CXX)
+#---------------------------------------------------------------------------------
+endif
+#---------------------------------------------------------------------------------
+
+export OFILES	:=	$(addsuffix .o,$(BINFILES)) \
+			$(CPPFILES:.cpp=.o) $(CFILES:.c=.o) $(SFILES:.s=.o)
+
+export INCLUDE	:=	$(foreach dir,$(INCLUDES),-I$(CURDIR)/$(dir)) \
+			$(foreach dir,$(LIBDIRS),-I$(dir)/include) \
+			-I$(CURDIR)/$(BUILD)
+
+export LIBPATHS	:=	$(foreach dir,$(LIBDIRS),-L$(dir)/lib)
+
+export BUILD_EXEFS_SRC := $(TOPDIR)/$(EXEFS_SRC)
+
+ifeq ($(strip $(CONFIG_JSON)),)
+	jsons := $(wildcard *.json)
+	ifneq (,$(findstring $(TARGET).json,$(jsons)))
+		export APP_JSON := $(TOPDIR)/$(TARGET).json
+	else
+		ifneq (,$(findstring config.json,$(jsons)))
+			export APP_JSON := $(TOPDIR)/config.json
+		endif
+	endif
+else
+	export APP_JSON := $(TOPDIR)/$(CONFIG_JSON)
+endif
+
+.PHONY: $(BUILD) clean all
+
+#---------------------------------------------------------------------------------
+all: $(BUILD)
+
+$(BUILD):
+	@[ -d $@ ] || mkdir -p $@
+	@$(MAKE) --no-print-directory -C $(BUILD) -f $(CURDIR)/Makefile
+
+#---------------------------------------------------------------------------------
+clean:
+	@echo clean ...
+	@rm -fr $(BUILD) $(TARGET).nsp $(TARGET).npdm $(TARGET).nso $(TARGET).elf
+
+
+#---------------------------------------------------------------------------------
+else
+.PHONY:	all
+
+DEPENDS	:=	$(OFILES:.o=.d)
+
+#---------------------------------------------------------------------------------
+# main targets
+#---------------------------------------------------------------------------------
+all	:	$(OUTPUT).nsp
+
+ifeq ($(strip $(APP_JSON)),)
+$(OUTPUT).nsp	:	$(OUTPUT).nso
+else
+$(OUTPUT).nsp	:	$(OUTPUT).nso $(OUTPUT).npdm
+endif
+
+$(OUTPUT).nso	:	$(OUTPUT).elf
+
+$(OUTPUT).elf	:	$(OFILES)
+
+#---------------------------------------------------------------------------------
+# you need a rule like this for each extension you use as binary data
+#---------------------------------------------------------------------------------
+%.bin.o	:	%.bin
+#---------------------------------------------------------------------------------
+	@echo $(notdir $<)
+	@$(bin2o)
+
+-include $(DEPENDS)
+
+#---------------------------------------------------------------------------------------
+endif
+#---------------------------------------------------------------------------------------

stratosphere/fatal/fatal.json

@@ -0,0 +1,95 @@
+{
+	"name":	"fatal",
+	"title_id":	"0x0100000000000034",
+	"title_id_range_min":	"0x0100000000000034",
+	"title_id_range_max":	"0x0100000000000034",
+	"main_thread_stack_size":	"0x00010000",
+	"main_thread_priority":	37,
+	"default_cpu_id":	3,
+	"process_category":	0,
+	"is_retail":	true,
+	"pool_partition":	2,
+	"is_64_bit":	true,
+	"address_space_type":	3,
+	"filesystem_access":	{
+		"permissions":	"0xFFFFFFFFFFFFFFFF"
+	},
+	"service_access":	["bpc", "bpc:c", "erpt:c", "fsp-srv", "gpio", "i2c", "lbl", "lm", "nvdrv:s", "pcv", "pl:u", "pm:info", "psm", "set", "set:sys", "spsm", "vi:m", "vi:s"],
+	"service_host":	["fatal:p", "fatal:u", "time:s"],
+	"kernel_capabilities":	[{
+			"type":	"kernel_flags",
+			"value":	{
+				"highest_thread_priority":	63,
+				"lowest_thread_priority":	12,
+				"lowest_cpu_id":	0,
+				"highest_cpu_id":	3
+			}
+		}, {
+			"type":	"syscalls",
+			"value":	{
+				"svcSetHeapSize":	"0x01",
+				"svcSetMemoryPermission":	"0x02",
+				"svcSetMemoryAttribute":	"0x03",
+				"svcMapMemory":	"0x04",
+				"svcUnmapMemory":	"0x05",
+				"svcQueryMemory":	"0x06",
+				"svcExitProcess":	"0x07",
+				"svcCreateThread":	"0x08",
+				"svcStartThread":	"0x09",
+				"svcExitThread":	"0x0a",
+				"svcSleepThread":	"0x0b",
+				"svcGetThreadPriority":	"0x0c",
+				"svcSetThreadPriority":	"0x0d",
+				"svcGetThreadCoreMask":	"0x0e",
+				"svcSetThreadCoreMask":	"0x0f",
+				"svcGetCurrentProcessorNumber":	"0x10",
+				"svcSignalEvent":	"0x11",
+				"svcClearEvent":	"0x12",
+				"svcMapSharedMemory":	"0x13",
+				"svcUnmapSharedMemory":	"0x14",
+				"svcCreateTransferMemory":	"0x15",
+				"svcCloseHandle":	"0x16",
+				"svcResetSignal":	"0x17",
+				"svcWaitSynchronization":	"0x18",
+				"svcCancelSynchronization":	"0x19",
+				"svcArbitrateLock":	"0x1a",
+				"svcArbitrateUnlock":	"0x1b",
+				"svcWaitProcessWideKeyAtomic":	"0x1c",
+				"svcSignalProcessWideKey":	"0x1d",
+				"svcGetSystemTick":	"0x1e",
+				"svcConnectToNamedPort":	"0x1f",
+				"svcSendSyncRequestLight":	"0x20",
+				"svcSendSyncRequest":	"0x21",
+				"svcSendSyncRequestWithUserBuffer":	"0x22",
+				"svcSendAsyncRequestWithUserBuffer":	"0x23",
+				"svcGetProcessId":	"0x24",
+				"svcGetThreadId":	"0x25",
+				"svcBreak":	"0x26",
+				"svcOutputDebugString":	"0x27",
+				"svcReturnFromException":	"0x28",
+				"svcGetInfo":	"0x29",
+				"svcWaitForAddress":	"0x34",
+				"svcSignalToAddress":	"0x35",
+				"svcCreateSession":	"0x40",
+				"svcAcceptSession":	"0x41",
+				"svcReplyAndReceiveLight":	"0x42",
+				"svcReplyAndReceive":	"0x43",
+				"svcReplyAndReceiveWithUserBuffer":	"0x44",
+				"svcCreateEvent":	"0x45",
+				"svcReadWriteRegister":	"0x4E",
+                "svcDebugActiveProcess": "0x60",
+                "svcGetDebugEvent": "0x63",
+                "svcGetThreadList": "0x66",
+                "svcGetDebugThreadContext": "0x67",
+                "svcQueryDebugProcessMemory": "0x69",
+                "svcReadDebugProcessMemory": "0x6a",
+                "svcGetDebugThreadParam": "0x6d"
+			}
+		}, {
+			"type":	"min_kernel_version",
+			"value":	"0x0060"
+		}, {
+			"type":	"handle_table_size",
+			"value":	128
+		}]
+}

stratosphere/fatal/source/fatal_config.cpp

@@ -0,0 +1,88 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <switch.h>
+#include "fatal_types.hpp"
+#include "fatal_config.hpp"
+
+static FatalConfig g_fatal_config;
+
+static IEvent *g_fatal_settings_event = nullptr;
+
+FatalConfig *GetFatalConfig() {
+    return &g_fatal_config;
+}
+
+static void UpdateLanguageCode() {
+    setGetLanguageCode(&GetFatalConfig()->language_code);
+}
+
+IEvent *GetFatalSettingsEvent() {
+    if (g_fatal_settings_event == nullptr) {
+        Event evt;
+        if (R_FAILED(setsysBindFatalDirtyFlagEvent(&evt))) {
+            std::abort();
+        }
+        g_fatal_settings_event = LoadReadOnlySystemEvent(evt.revent, [](u64 timeout) {
+            u64 flags_0, flags_1;
+            if (R_SUCCEEDED(setsysGetFatalDirtyFlags(&flags_0, &flags_1)) && (flags_0 & 1)) { 
+                UpdateLanguageCode();
+            }
+            return 0;
+        }, true);
+    }
+    
+    return g_fatal_settings_event;
+}
+
+static void SetupConfigLanguages() {
+    FatalConfig *config = GetFatalConfig();
+    
+    /* Defaults. */
+    config->error_msg   = u8"Error Code: 2%03d-%04d (0x%x)\n";
+    
+    if (config->quest_flag) {
+        config->error_desc = u8"Please call 1-800-875-1852 for service.\n";
+    } else {
+        config->error_desc = u8"An error has occured.\n\n"
+                             u8"Please press the POWER Button to restart the console. If you are\n"
+                             u8"unable to restart the console, hold the POWER Button for 12 seconds\n"
+                             u8"to turn the console off.\n\n"
+                             u8"If the problem persists, refer to the Nintendo Support Website.\n"
+                             u8"support.nintendo.com/switch/error\n";
+    }
+    
+    /* TODO: Try to load dynamically. */
+    /* FsStorage message_storage; */
+    /* TODO: if (R_SUCCEEDED(fsOpenDataStorageByDataId(0x010000000000081D, "fatal_msg"))) { ... } */
+}
+
+void InitializeFatalConfig() {
+    FatalConfig *config = GetFatalConfig();
+    
+    memset(config, 0, sizeof(*config));
+    setsysGetSerialNumber(config->serial_number);
+    setsysGetFirmwareVersion(&config->firmware_version);
+    UpdateLanguageCode();
+    
+    setsysGetSettingsItemValue("fatal", "transition_to_fatal", &config->transition_to_fatal, sizeof(config->transition_to_fatal));
+    setsysGetSettingsItemValue("fatal", "show_extra_info", &config->show_extra_info, sizeof(config->show_extra_info));
+    setsysGetSettingsItemValue("fatal", "quest_reboot_interval_second", &config->quest_reboot_interval_second, sizeof(config->quest_reboot_interval_second));
+    
+    setsysGetFlag(SetSysFlag_Quest, &config->quest_flag);
+    
+    SetupConfigLanguages();
+}

stratosphere/fatal/source/fatal_config.hpp

@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+
+struct FatalConfig {
+    char serial_number[0x18];
+    SetSysFirmwareVersion firmware_version;
+    u64 language_code;
+    u64 quest_reboot_interval_second;
+    bool transition_to_fatal;
+    bool show_extra_info;
+    bool quest_flag;
+    const char *error_msg;
+    const char *error_desc;
+    const char *quest_desc;
+};
+
+IEvent *GetFatalSettingsEvent();
+FatalConfig *GetFatalConfig();
+
+void InitializeFatalConfig();

stratosphere/fatal/source/fatal_debug.cpp

@@ -0,0 +1,267 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <map>
+#include <switch.h>
+#include "fatal_debug.hpp"
+#include "fatal_config.hpp"
+
+static bool IsAddressReadable(Handle debug_handle, u64 address, u64 size, MemoryInfo *o_mi) {
+    MemoryInfo mi;
+    u32 pi;
+    
+    if (o_mi == NULL) {
+        o_mi = &mi;
+    }
+    
+    if (R_FAILED(svcQueryDebugProcessMemory(o_mi, &pi, debug_handle, address))) {
+        return false;
+    }
+    
+    /* Must be readable */
+    if ((o_mi->perm & Perm_R) != Perm_R) {
+        return false;
+    }
+    
+    /* Must have space for both userdata address and userdata size. */
+    if (address < o_mi->addr || o_mi->addr + o_mi->size < address + size) {
+        return false;
+    }
+
+    return true;
+}
+
+static bool CheckThreadIsFatalCaller(FatalThrowContext *ctx, u64 debug_handle, u64 thread_id, u64 thread_tls_addr, ThreadContext *thread_ctx) {
+    /* Verify that the thread is running or waiting. */
+    {
+        u64 _;
+        u32 thread_state;
+        if (R_FAILED(svcGetDebugThreadParam(&_, &thread_state, debug_handle, thread_id, DebugThreadParam_State))) {
+            return false;
+        }
+        
+        if (thread_state > 1) {
+            return false;
+        }
+    }
+        
+    /* Get the thread context. */
+    if (R_FAILED(svcGetDebugThreadContext(thread_ctx, debug_handle, thread_id, 0xF))) {
+        return false;
+    }
+    
+    /* Check if PC is readable. */
+    if (!IsAddressReadable(debug_handle, thread_ctx->pc.x, sizeof(u32), NULL)) {
+        return false;
+    }
+    
+    /* Try to read the current instruction. */
+    u32 insn;
+    if (R_FAILED(svcReadDebugProcessMemory(&insn, debug_handle, thread_ctx->pc.x, sizeof(insn)))) {
+        return false;
+    }
+    
+    /* If the instruction isn't svcSendSyncRequest, it's not the fatal caller. */
+    if (insn != 0xD4000421) {
+        return false;
+    }
+    
+    /* The fatal caller will have readable tls. */
+    if (!IsAddressReadable(debug_handle, thread_tls_addr, 0x100, NULL)) {
+        return false;
+    }
+    
+    /* Read in the fatal caller's tls. */
+    u8 thread_tls[0x100];
+    if (R_FAILED(svcReadDebugProcessMemory(thread_tls, debug_handle, thread_tls_addr, sizeof(thread_tls)))) {
+        return false;
+    }
+    
+    /* Replace our tls with the fatal caller's. */
+    std::memcpy(armGetTls(), thread_tls, sizeof(thread_tls));
+    
+    /* Parse the command that the thread sent. */
+    {
+        IpcParsedCommand r;
+        if (R_FAILED(ipcParse(&r))) {
+            return false;
+        }
+        
+        /* Fatal command takes in a PID, only one buffer max. */
+        if (!r.HasPid || r.NumStatics || r.NumStaticsOut || r.NumHandles) {
+            return false;
+        }
+        
+        struct {
+            u32 magic;
+            u32 version;
+            u64 cmd_id;
+            u32 err_code;
+        } *raw = (decltype(raw))(r.Raw);
+        
+        if (raw->magic != SFCI_MAGIC) {
+            return false;
+        }
+        
+        if (raw->cmd_id > 2) {
+            return false;
+        }
+        
+        if (raw->cmd_id != 2 && r.NumBuffers) {
+            return false;
+        }
+        
+        if (raw->err_code != ctx->error_code) {
+            return false;
+        }
+    }
+    
+    /* We found our caller. */
+    return true;
+}
+
+void TryCollectDebugInformation(FatalThrowContext *ctx, u64 pid) {
+    Handle debug_handle;
+    if (R_SUCCEEDED(svcDebugActiveProcess(&debug_handle, pid))) {
+        /* Ensure we close the debugged process. */
+        ON_SCOPE_EXIT { svcCloseHandle(debug_handle); };
+        
+        /* First things first, check if process is 64 bits, and get list of thread infos. */
+        std::unordered_map<u64, u64> thread_id_to_tls;
+        {
+            bool got_attach_process = false;
+            DebugEventInfo d;
+            while (R_SUCCEEDED(svcGetDebugEvent((u8 *)&d, debug_handle))) {
+                if (d.type == DebugEventType::AttachProcess) {
+                    ctx->cpu_ctx.is_aarch32 = (d.info.attach_process.flags & 1) == 0;
+                    memcpy(ctx->proc_name, d.info.attach_process.name, sizeof(d.info.attach_process.name));
+                    got_attach_process = true;
+                } else if (d.type == DebugEventType::AttachThread) {
+                    thread_id_to_tls[d.info.attach_thread.thread_id] = d.info.attach_thread.tls_address;
+                }
+            }
+            
+            if (!got_attach_process) {
+                return;
+            }
+        }
+        
+        /* TODO: Try to collect information on 32-bit fatals. This shouldn't really matter for any real use case. */
+        if (ctx->cpu_ctx.is_aarch32) {
+            return;
+        }
+        
+        /* Welcome to hell. */
+        bool found_fatal_caller = false;
+        u64 thread_id = 0;
+        ThreadContext thread_ctx;
+        {
+            /* We start by trying to get a list of threads. */
+            u32 thread_count;
+            u64 thread_ids[0x60];
+            if (R_FAILED(svcGetThreadList(&thread_count, thread_ids, 0x60, debug_handle))) {
+                return;
+            }
+            
+            /* We need to locate the thread that's called fatal. */
+            for (u32 i = 0; i < thread_count; i++) {
+                const u64 cur_thread_id = thread_ids[i];
+                if (thread_id_to_tls.find(cur_thread_id) == thread_id_to_tls.end()) {
+                    continue;
+                }
+                
+                if (CheckThreadIsFatalCaller(ctx, debug_handle, cur_thread_id, thread_id_to_tls[cur_thread_id], &thread_ctx)) {
+                    thread_id = cur_thread_id;
+                    found_fatal_caller = true;
+                    break;
+                }
+            }
+            if (!found_fatal_caller) {
+                return;
+            }
+        }
+        if (R_FAILED(svcGetDebugThreadContext(&thread_ctx, debug_handle, thread_id, 0xF))) {
+            return;
+        }
+        
+        /* So we found our caller. */
+        for (u32 i = 0; i < 29; i++) {
+            /* GetDebugThreadContext won't give us any of these registers, because thread is in SVC :( */
+            ctx->has_gprs[i] = false;
+        }
+        for (u32 i = 29; i < NumAarch64Gprs; i++) {
+            ctx->has_gprs[i] = true;
+        }
+        ctx->cpu_ctx.aarch64_ctx.fp = thread_ctx.fp;
+        ctx->cpu_ctx.aarch64_ctx.lr = thread_ctx.lr;
+        ctx->cpu_ctx.aarch64_ctx.sp = thread_ctx.sp;
+        ctx->cpu_ctx.aarch64_ctx.pc = thread_ctx.pc.x;
+        
+
+        /* Parse a stack trace. */
+        u64 cur_fp = thread_ctx.fp;
+        for (unsigned int i = 0; i < sizeof(ctx->cpu_ctx.aarch64_ctx.stack_trace)/sizeof(u64); i++) {
+            /* Validate the current frame. */
+            if (cur_fp == 0 || (cur_fp & 0xF)) {
+                break;
+            }
+            
+            /* Read a new frame. */
+            StackFrame cur_frame;
+            if (R_FAILED(svcReadDebugProcessMemory(&cur_frame, debug_handle, cur_fp, sizeof(StackFrame)))) {
+                break;
+            }
+            
+            /* Advance to the next frame. */
+            ctx->cpu_ctx.aarch64_ctx.stack_trace[ctx->cpu_ctx.aarch64_ctx.stack_trace_size++] = cur_frame.lr;
+            cur_fp = cur_frame.fp;
+        }
+        
+        /* Try to read up to 0x100 of stack. */
+        for (size_t sz = 0x100; sz > 0; sz -= 0x10) {
+            if (IsAddressReadable(debug_handle, ctx->cpu_ctx.aarch64_ctx.sp, sz, nullptr)) {
+                if (R_SUCCEEDED(svcReadDebugProcessMemory(ctx->stack_dump, debug_handle, ctx->cpu_ctx.aarch64_ctx.sp, sz))) {
+                    ctx->stack_dump_size = sz;
+                }
+                break;
+            }
+        }
+        
+        /* Parse the starting address. */
+        {
+            u64 guess = thread_ctx.pc.x;
+            MemoryInfo mi;
+            u32 pi;
+            if (R_FAILED(svcQueryDebugProcessMemory(&mi, &pi, debug_handle, guess)) || mi.perm != Perm_Rx) {
+                return;
+            }
+            
+            /* Iterate backwards until we find the memory before the code region. */
+            while (mi.addr > 0) {
+                if (R_FAILED(svcQueryDebugProcessMemory(&mi, &pi, debug_handle, guess))) {
+                    return;
+                }
+                
+                if (mi.type == MemType_Unmapped) {
+                    /* Code region will be at the end of the unmapped region preceding it. */
+                    ctx->cpu_ctx.aarch64_ctx.start_address = mi.addr + mi.size;
+                    break;
+                }
+                
+                guess -= 4;
+            }
+        }
+    }
+}

stratosphere/fatal/source/fatal_debug.hpp

@@ -0,0 +1,149 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+
+#include "fatal_types.hpp"
+
+void TryCollectDebugInformation(FatalThrowContext *ctx, u64 pid);
+
+struct StackFrame {
+    u64 fp;
+    u64 lr;
+};
+
+struct AttachProcessInfo {
+    u64 title_id;
+    u64 process_id;
+    char name[0xC];
+    u32 flags;
+    u64 user_exception_context_address; /* 5.0.0+ */
+};
+
+struct AttachThreadInfo {
+    u64 thread_id;
+    u64 tls_address;
+    u64 entrypoint;
+};
+
+/* TODO: ExitProcessInfo */
+/* TODO: ExitThreadInfo */
+
+enum class DebugExceptionType : u32 {
+    UndefinedInstruction = 0,
+    InstructionAbort = 1,
+    DataAbort = 2,
+    AlignmentFault = 3,
+    DebuggerAttached = 4,
+    BreakPoint = 5,
+    UserBreak = 6,
+    DebuggerBreak = 7,
+    BadSvc = 8,
+    UnknownNine = 9,
+};
+
+static inline const char *GetDebugExceptionTypeStr(DebugExceptionType type) {
+    switch (type) {
+        case DebugExceptionType::UndefinedInstruction:
+            return "Undefined Instruction";
+        case DebugExceptionType::InstructionAbort:
+            return "Instruction Abort";
+        case DebugExceptionType::DataAbort:
+            return "Data Abort";
+        case DebugExceptionType::AlignmentFault:
+            return "Alignment Fault";
+        case DebugExceptionType::DebuggerAttached:
+            return "Debugger Attached";
+        case DebugExceptionType::BreakPoint:
+            return "Break Point";
+        case DebugExceptionType::UserBreak:
+            return "User Break";
+        case DebugExceptionType::DebuggerBreak:
+            return "Debugger Break";
+        case DebugExceptionType::BadSvc:
+            return "Bad Svc";
+        case DebugExceptionType::UnknownNine:
+            return "Unknown Nine";
+        default:
+            return "Unknown";
+    }
+}
+
+struct UndefinedInstructionInfo {
+    u32 insn;
+};
+
+struct DataAbortInfo {
+    u64 address;
+};
+
+struct AlignmentFaultInfo {
+    u64 address;
+};
+
+struct UserBreakInfo {
+    u64 break_reason;
+    u64 address;
+    u64 size;
+};
+
+struct BadSvcInfo {
+    u32 id;
+};
+
+union SpecificExceptionInfo {
+    UndefinedInstructionInfo undefined_instruction;
+    DataAbortInfo data_abort;
+    AlignmentFaultInfo alignment_fault;
+    UserBreakInfo user_break;
+    BadSvcInfo bad_svc;
+    u64 raw;
+};
+
+struct ExceptionInfo {
+    DebugExceptionType type;
+    u64 address;
+    SpecificExceptionInfo specific;
+};
+
+
+enum class DebugEventType : u32 {
+    AttachProcess = 0,
+    AttachThread = 1,
+    ExitProcess = 2,
+    ExitThread = 3,
+    Exception = 4
+};
+
+union DebugInfo {
+    AttachProcessInfo attach_process;
+    AttachThreadInfo attach_thread;
+    ExceptionInfo exception;
+};
+
+struct DebugEventInfo {
+    DebugEventType type;
+    u32 flags;
+    u64 thread_id;
+    union {
+        DebugInfo info;
+        u64 _[0x40/sizeof(u64)];
+    };
+};
+
+static_assert(sizeof(DebugEventInfo) >= 0x50, "Incorrect DebugEventInfo definition!");

stratosphere/fatal/source/fatal_event_manager.cpp

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <switch.h>
+#include "fatal_types.hpp"
+#include "fatal_event_manager.hpp"
+
+static FatalEventManager g_event_manager;
+
+FatalEventManager *GetEventManager() {
+    return &g_event_manager;
+}
+
+FatalEventManager::FatalEventManager() {
+    /* Just create all the events. */
+    for (size_t i = 0; i < FatalEventManager::NumFatalEvents; i++) {
+        if (R_FAILED(eventCreate(&this->events[i], true))) {
+            std::abort();
+        }
+    }
+}
+
+Result FatalEventManager::GetEvent(Handle *out) {
+    std::scoped_lock<HosMutex> lk{this->lock};
+    
+    /* Only allow GetEvent to succeed NumFatalEvents times. */
+    if (this->events_gotten >= FatalEventManager::NumFatalEvents) {
+        return FatalResult_TooManyEvents;
+    }
+    
+    *out = this->events[this->events_gotten++].revent;
+    return 0;
+}
+
+void FatalEventManager::SignalEvents() {
+    for (size_t i = 0; i < FatalEventManager::NumFatalEvents; i++) {
+        eventFire(&this->events[i]);
+    }
+}

stratosphere/fatal/source/fatal_event_manager.hpp

@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+
+class FatalEventManager {
+    private:
+        static constexpr size_t NumFatalEvents = 3;
+        
+        HosMutex lock;
+        size_t events_gotten = 0;
+        Event events[NumFatalEvents];
+    public:
+        FatalEventManager();
+        Result GetEvent(Handle *out);
+        void SignalEvents();
+};
+
+FatalEventManager *GetEventManager();

stratosphere/fatal/source/fatal_font.cpp

@@ -0,0 +1,237 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+
+#include <switch.h>
+#include "fatal_types.hpp"
+
+#include <cstring>
+#include <cstdlib>
+#include <cstdio>
+
+#include <ft2build.h>
+#include FT_FREETYPE_H
+
+#include "fatal_config.hpp"
+#include "fatal_font.hpp"
+
+static u16 *g_fb = nullptr;
+static u32 (*g_unswizzle_func)(u32, u32) = nullptr;
+static u16 g_font_color = 0xFFFF;
+static float g_font_sz = 16.0f;
+static u32 g_line_x = 0, g_cur_x = 0, g_cur_y = 0;
+
+static u32 g_mono_adv = 0;
+
+static PlFontData g_font;
+static PlFontData g_fonts[PlSharedFontType_Total];
+static FT_Library g_library;
+static FT_Face g_face;
+static FT_Error g_ft_err = 0;
+
+static u16 Blend(u16 color, u16 bg, u8 alpha) {
+    const u32 c_r = RGB565_GET_R8(color);
+    const u32 c_g = RGB565_GET_G8(color);
+    const u32 c_b = RGB565_GET_B8(color);
+    const u32 b_r = RGB565_GET_R8(bg);
+    const u32 b_g = RGB565_GET_G8(bg);
+    const u32 b_b = RGB565_GET_B8(bg);
+    
+    const u32 r = ((alpha * c_r) + ((0xFF - alpha) * b_r)) / 0xFF;
+    const u32 g = ((alpha * c_g) + ((0xFF - alpha) * b_g)) / 0xFF;
+    const u32 b = ((alpha * c_b) + ((0xFF - alpha) * b_b)) / 0xFF;
+    
+    return RGB888_TO_RGB565(r, g, b);
+}
+
+static void DrawGlyph(FT_Bitmap *bitmap, u32 x, u32 y) {
+    u8* imageptr = bitmap->buffer;
+
+    if (bitmap->pixel_mode!=FT_PIXEL_MODE_GRAY) return;
+    
+    for (u32 tmpy = 0; tmpy < bitmap->rows; tmpy++) {
+        for (u32 tmpx = 0; tmpx < bitmap->width; tmpx++) {
+            /* Implement very simple blending, as the bitmap value is an alpha value. */
+            u16 *ptr = &g_fb[g_unswizzle_func(x + tmpx, y + tmpy)];
+            *ptr = Blend(g_font_color, *ptr, imageptr[tmpx]);
+        }
+        imageptr += bitmap->pitch;
+    }
+}
+
+static void DrawString(const char *str, bool add_line, bool mono = false) {
+    FT_UInt glyph_index;
+    FT_GlyphSlot slot = g_face->glyph;
+    
+    const size_t len = strlen(str);
+    
+    u32 cur_x = g_cur_x, cur_y = g_cur_y;
+    ON_SCOPE_EXIT { 
+        if (add_line) {
+            /* Advance to next line. */
+            g_cur_x = g_line_x;
+            g_cur_y = cur_y + (g_face->size->metrics.height >> 6); 
+        } else {
+            g_cur_x = cur_x;
+            g_cur_y = cur_y;
+        }
+    };
+    
+    for (u32 i = 0; i < len; ) {
+        u32 cur_char;
+        ssize_t unit_count = decode_utf8(&cur_char, reinterpret_cast<const u8 *>(&str[i]));
+        if (unit_count <= 0) break;
+        i += unit_count;
+        
+        if (cur_char == '\n') {
+            cur_x = g_line_x;
+            cur_y += g_face->size->metrics.height >> 6;
+            continue;
+        }
+        
+        glyph_index = FT_Get_Char_Index(g_face, cur_char);
+        
+        g_ft_err = FT_Load_Glyph(g_face, glyph_index, FT_LOAD_DEFAULT);
+        
+        if (g_ft_err == 0) {
+            g_ft_err = FT_Render_Glyph(g_face->glyph, FT_RENDER_MODE_NORMAL);
+        }
+        
+        if (g_ft_err) {
+            return;
+        }
+        
+        DrawGlyph(&slot->bitmap, cur_x + slot->bitmap_left + ((mono && g_mono_adv > slot->advance.x) ? ((g_mono_adv - slot->advance.x) >> 7) : 0), cur_y - slot->bitmap_top);
+        
+        cur_x += (mono ? g_mono_adv : slot->advance.x) >> 6;
+        cur_y += slot->advance.y >> 6;
+    }
+}
+
+void FontManager::PrintLine(const char *str) {
+    return DrawString(str, true);
+}
+
+void FontManager::PrintFormatLine(const char *format, ...) {
+    va_list va_arg;
+    va_start(va_arg, format);
+    
+    char char_buf[0x400];
+    vsnprintf(char_buf, sizeof(char_buf), format, va_arg);
+    
+    PrintLine(char_buf);
+}
+
+void FontManager::Print(const char *str) {
+    return DrawString(str, false);
+}
+
+void FontManager::PrintFormat(const char *format, ...) {
+    va_list va_arg;
+    va_start(va_arg, format);
+    
+    char char_buf[0x400];
+    vsnprintf(char_buf, sizeof(char_buf), format, va_arg);
+    
+    Print(char_buf);
+}
+
+void FontManager::PrintMonospaceU64(u64 x) {    
+    char char_buf[0x400];
+    snprintf(char_buf, sizeof(char_buf), "%016lX", x);
+    
+    DrawString(char_buf, false, true);
+}
+
+void FontManager::PrintMonospaceU32(u32 x) {    
+    char char_buf[0x400];
+    snprintf(char_buf, sizeof(char_buf), "%08X", x);
+    
+    DrawString(char_buf, false, true);
+}
+
+void FontManager::PrintMonospaceBlank(u32 width) {
+    char char_buf[0x400] = {0};
+    for (size_t i = 0; i < width && i < sizeof(char_buf); i++) {
+        char_buf[i] = ' ';
+    }
+    
+    DrawString(char_buf, false, true);
+}
+
+void FontManager::SetFontColor(u16 color) {
+    g_font_color = color;
+}
+
+void FontManager::SetPosition(u32 x, u32 y) {
+    g_line_x = x;
+    g_cur_x = x;
+    g_cur_y = y;
+}
+
+u32 FontManager::GetX() {
+    return g_cur_x;
+}
+
+u32 FontManager::GetY() {
+    return g_cur_y;
+}
+
+void FontManager::SetFontSize(float fsz) {
+    g_font_sz = fsz;
+    g_ft_err = FT_Set_Char_Size(g_face, 0, static_cast<u32>(g_font_sz * 64.0f), 96, 96);
+        
+    g_ft_err = FT_Load_Glyph(g_face, FT_Get_Char_Index(g_face, 'A'), FT_LOAD_DEFAULT);
+    
+    if (g_ft_err == 0) {
+        g_ft_err = FT_Render_Glyph(g_face->glyph, FT_RENDER_MODE_NORMAL);
+    }
+    if (g_ft_err == 0) {
+        g_mono_adv = g_face->glyph->advance.x;
+    }
+}
+
+void FontManager::AddSpacingLines(float num_lines) {
+    g_cur_x = g_line_x;
+    g_cur_y += static_cast<u32>((static_cast<float>(g_face->size->metrics.height) * num_lines) / 64.0f);
+}
+
+void FontManager::ConfigureFontFramebuffer(u16 *fb, u32 (*unswizzle_func)(u32, u32)) {
+    g_fb = fb;
+    g_unswizzle_func = unswizzle_func;
+}
+
+Result FontManager::InitializeSharedFont() {
+    Result rc;
+    size_t total_fonts = 0;
+    
+    if (R_FAILED((rc = plGetSharedFont(GetFatalConfig()->language_code, g_fonts, PlSharedFontType_Total, &total_fonts)))) {
+        return rc;
+    }
+
+    if (R_FAILED((rc = plGetSharedFontByType(&g_font, PlSharedFontType_Standard)))) {
+        return rc;
+    }
+    
+    g_ft_err = FT_Init_FreeType(&g_library);
+    if (g_ft_err) return g_ft_err;
+    
+    g_ft_err = FT_New_Memory_Face(g_library, reinterpret_cast<const FT_Byte *>(g_font.address), g_font.size, 0, &g_face);
+    if (g_ft_err) return g_ft_err;
+    
+    SetFontSize(g_font_sz);
+    return g_ft_err;
+}

stratosphere/fatal/source/fatal_font.hpp

@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <cstdarg>
+#include <switch.h>
+#include <stratosphere.hpp>
+
+#define RGB888_TO_RGB565(r, g, b) ((((r >> 3) << 11) & 0xF800) | (((g >> 2) << 5) & 0x7E0) | ((b >> 3) & 0x1F))
+#define RGB565_GET_R8(c) ((((c >> 11) & 0x1F) << 3) | ((c >> 13) & 7))
+#define RGB565_GET_G8(c) ((((c >> 5) & 0x3F) << 2) | ((c >> 9) & 3))
+#define RGB565_GET_B8(c) ((((c >> 0) & 0x1F) << 3) | ((c >> 2) & 7))
+
+class FontManager {        
+    public:
+        static Result InitializeSharedFont();
+        static void ConfigureFontFramebuffer(u16 *fb, u32 (*unswizzle_func)(u32, u32));
+
+        static void SetFontColor(u16 color);
+        static void SetPosition(u32 x, u32 y);
+        static u32 GetX();
+        static u32 GetY();
+        static void SetFontSize(float fsz);
+        static void AddSpacingLines(float num_lines);
+        static void PrintLine(const char *str);
+        static void PrintFormatLine(const char *format, ...);
+        static void Print(const char *str);
+        static void PrintFormat(const char *format, ...);
+        static void PrintMonospaceU64(u64 x);
+        static void PrintMonospaceU32(u32 x);
+        static void PrintMonospaceBlank(u32 width);
+};

stratosphere/fatal/source/fatal_main.cpp

@@ -0,0 +1,184 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <cstdlib>
+#include <cstdint>
+#include <cstring>
+#include <malloc.h>
+
+#include <switch.h>
+#include <atmosphere.h>
+#include <stratosphere.hpp>
+
+#include "fatal_types.hpp"
+#include "fatal_private.hpp"
+#include "fatal_user.hpp"
+#include "fatal_config.hpp"
+#include "fatal_repair.hpp"
+#include "fatal_font.hpp"
+
+extern "C" {
+    extern u32 __start__;
+
+    u32 __nx_applet_type = AppletType_None;
+
+    #define INNER_HEAP_SIZE 0x2A0000
+    size_t nx_inner_heap_size = INNER_HEAP_SIZE;
+    char   nx_inner_heap[INNER_HEAP_SIZE];
+    
+    u32 __nx_nv_transfermem_size = 0x40000;
+    ViLayerFlags __nx_vi_stray_layer_flags = (ViLayerFlags)0;
+    
+    void __libnx_initheap(void);
+    void __appInit(void);
+    void __appExit(void);
+}
+
+
+void __libnx_initheap(void) {
+	void*  addr = nx_inner_heap;
+	size_t size = nx_inner_heap_size;
+
+	/* Newlib */
+	extern char* fake_heap_start;
+	extern char* fake_heap_end;
+
+	fake_heap_start = (char*)addr;
+	fake_heap_end   = (char*)addr + size;
+}
+
+void __appInit(void) {
+    Result rc;
+    
+    rc = smInitialize();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    rc = setInitialize();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    rc = setsysInitialize();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    rc = pminfoInitialize();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    rc = i2cInitialize();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    rc = bpcInitialize();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    rc = pcvInitialize();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    rc = lblInitialize();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    rc = psmInitialize();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    rc = spsmInitialize();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    rc = plInitialize();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    rc = fsInitialize();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    rc = fsInitialize();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    rc = fsdevMountSdmc();
+    if (R_FAILED(rc)) {
+        std::abort();
+    }
+    
+    /* fatal cannot throw fatal, so don't do: CheckAtmosphereVersion(CURRENT_ATMOSPHERE_VERSION); */
+}
+
+void __appExit(void) {
+    /* Cleanup services. */
+    fsdevUnmountAll();
+    fsExit();
+    plExit();
+    spsmExit();
+    psmExit();
+    lblExit();
+    pcvExit();
+    bpcExit();
+    i2cExit();
+    pminfoExit();
+    setsysExit();
+    setExit();
+    smExit();
+}
+
+int main(int argc, char **argv)
+{
+    /* Load settings from set:sys. */
+    InitializeFatalConfig();
+    
+    /* Load shared font. */
+    if (R_FAILED(FontManager::InitializeSharedFont())) {
+        std::abort();
+    }
+
+    /* Check whether we should throw fatal due to repair process. */
+    CheckRepairStatus();
+
+    /* TODO: What's a good timeout value to use here? */
+    auto server_manager = new WaitableManager(1);
+
+    /* Create services. */
+    server_manager->AddWaitable(new ServiceServer<PrivateService>("fatal:p", 4));
+    server_manager->AddWaitable(new ServiceServer<UserService>("fatal:u", 4));
+    server_manager->AddWaitable(GetFatalSettingsEvent());
+
+    /* Loop forever, servicing our services. */
+    server_manager->Process();
+
+    delete server_manager;
+
+    return 0;
+}
+

stratosphere/fatal/source/fatal_private.cpp

@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <switch.h>
+#include "fatal_private.hpp"
+#include "fatal_event_manager.hpp"
+
+Result PrivateService::GetFatalEvent(Out<CopiedHandle> out_h) {
+    return GetEventManager()->GetEvent(out_h.GetHandlePointer());
+}

stratosphere/fatal/source/fatal_private.hpp

@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+
+enum PrivateCmd {
+    Private_Cmd_GetFatalEvent = 0,
+};
+
+class PrivateService final : public IServiceObject {
+    private:
+        /* Actual commands. */
+        Result GetFatalEvent(Out<CopiedHandle> out_h);
+    public:
+        DEFINE_SERVICE_DISPATCH_TABLE {
+            MakeServiceCommandMeta<Private_Cmd_GetFatalEvent, &PrivateService::GetFatalEvent>(),
+        };
+};

stratosphere/fatal/source/fatal_repair.cpp

@@ -0,0 +1,106 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <switch.h>
+#include <stratosphere.hpp>
+#include "fatal_types.hpp"
+#include "fatal_repair.hpp"
+#include "fatal_throw.hpp"
+
+static bool InRepairWithoutVolHeld() {
+    if (GetRuntimeFirmwareVersion() < FirmwareVersion_300) {
+        return false;
+    }
+    
+    bool in_repair;
+    if (R_FAILED(setsysGetFlag(SetSysFlag_InRepairProcessEnable, &in_repair)) || !in_repair) {
+        return false;
+    }
+    
+    {
+        GpioPadSession vol_btn;
+        if (R_FAILED(gpioOpenSession(&vol_btn, GpioPadName_ButtonVolUp))) {
+            return true;
+        }
+        
+        /* Ensure we close even on early return. */
+        ON_SCOPE_EXIT { gpioPadClose(&vol_btn); };
+        
+        /* Set direction input. */
+        gpioPadSetDirection(&vol_btn, GpioDirection_Input);
+
+        /* Ensure that we're holding the volume button for a full second. */
+        TimeoutHelper timeout_helper(1000000000UL);
+        while (!timeout_helper.TimedOut()) {
+            GpioValue val;
+            if (R_FAILED(gpioPadGetValue(&vol_btn, &val)) || val != GpioValue_Low) {
+                return true;
+            }
+            
+            /* Sleep for 100 ms. */
+            svcSleepThread(100000000UL);
+        }            
+    }
+    
+    return false;
+}
+
+static bool InRepairWithoutTimeReviserCartridge() {
+    if (GetRuntimeFirmwareVersion() < FirmwareVersion_500) {
+        return false;
+    }
+    
+    bool requires_time_reviser;
+    if (R_FAILED(setsysGetFlag(SetSysFlag_RequiresRunRepairTimeReviser, &requires_time_reviser)) || !requires_time_reviser) {
+        return false;
+    }
+    
+    FsGameCardHandle gc_hnd;
+    u8 gc_attr;
+    {
+        FsDeviceOperator devop;
+        if (R_FAILED(fsOpenDeviceOperator(&devop))) {
+            return true;
+        }
+        
+        /* Ensure we close even on early return. */
+        ON_SCOPE_EXIT { fsDeviceOperatorClose(&devop); };
+        
+        /* Check that a gamecard is inserted. */
+        bool inserted;
+        if (R_FAILED(fsDeviceOperatorIsGameCardInserted(&devop, &inserted)) || !inserted) {
+            return true;
+        }
+        
+        /* Check that we can retrieve the gamecard's attributes. */
+        if (R_FAILED(fsDeviceOperatorGetGameCardHandle(&devop, &gc_hnd)) || R_FAILED(fsDeviceOperatorGetGameCardAttribute(&devop, &gc_hnd, &gc_attr))) {
+            return true;
+        }
+    }
+        
+    /* Check that the gamecard is a repair tool. */
+    return (gc_attr & FsGameCardAttribute_Repair) == FsGameCardAttribute_Repair;
+}
+
+void CheckRepairStatus() {
+    if (InRepairWithoutVolHeld()) {
+        ThrowFatalForSelf(FatalResult_InRepairWithoutVolHeld);
+    }
+    
+    if (InRepairWithoutTimeReviserCartridge()) {
+        ThrowFatalForSelf(FatalResult_InRepairWithoutTimeReviserCartridge);
+    }
+}

stratosphere/fatal/source/fatal_repair.hpp

@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+
+void CheckRepairStatus();

stratosphere/fatal/source/fatal_task.cpp

@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <switch.h>
+#include "fatal_types.hpp"
+#include "fatal_task.hpp"
+
+#include "fatal_task_error_report.hpp"
+#include "fatal_task_screen.hpp"
+#include "fatal_task_sound.hpp"
+#include "fatal_task_clock.hpp"
+#include "fatal_task_power.hpp"
+
+
+static constexpr size_t MaxTasks = 8;
+static HosThread g_task_threads[MaxTasks];
+static size_t g_num_threads = 0;
+
+
+static void RunTaskThreadFunc(void *arg) {
+    IFatalTask *task = reinterpret_cast<IFatalTask *>(arg);
+    
+    Result rc = task->Run();
+    if (R_FAILED(rc)) {
+        /* TODO: Log task failure, somehow? */
+    }
+    
+    /* Finish. */
+    svcExitThread();
+}
+
+static void RunTask(IFatalTask *task, u32 stack_size = 0x4000) {    
+    if (g_num_threads >= MaxTasks) {
+        std::abort();
+    }
+    
+    HosThread *cur_thread = &g_task_threads[g_num_threads++];
+    
+    cur_thread->Initialize(&RunTaskThreadFunc, task, stack_size, 15);
+    cur_thread->Start();
+}
+
+void RunFatalTasks(FatalThrowContext *ctx, u64 title_id, bool error_report, Event *erpt_event, Event *battery_event) {
+    RunTask(new ErrorReportTask(ctx, title_id, error_report, erpt_event));
+    RunTask(new PowerControlTask(ctx, title_id, erpt_event, battery_event));
+    RunTask(new ShowFatalTask(ctx, title_id, battery_event), 0x10000);
+    RunTask(new StopSoundTask(ctx, title_id));
+    RunTask(new BacklightControlTask(ctx, title_id));
+    RunTask(new AdjustClockTask(ctx, title_id));
+    RunTask(new PowerButtonObserveTask(ctx, title_id, erpt_event));
+    RunTask(new StateTransitionStopTask(ctx, title_id));
+}

stratosphere/fatal/source/fatal_task.hpp

@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+#include "fatal_types.hpp"
+
+class IFatalTask {
+    protected:
+        FatalThrowContext *ctx;
+        u64 title_id;
+    public:
+        IFatalTask(FatalThrowContext *ctx, u64 tid) : ctx(ctx), title_id(tid) { }
+        virtual Result Run() = 0;
+        virtual const char *GetName() const = 0;
+};
+
+void RunFatalTasks(FatalThrowContext *ctx, u64 title_id, bool error_report, Event *erpt_event, Event *battery_event);

stratosphere/fatal/source/fatal_task_clock.cpp

@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <switch.h>
+#include "fatal_task_clock.hpp"
+
+
+Result AdjustClockTask::AdjustClock() {
+    /* Fatal sets the CPU to 1020MHz, the GPU to 307 MHz, and the EMC to 1331MHz. */
+    constexpr u32 CPU_CLOCK_1020MHZ = 0x3CCBF700L;
+    constexpr u32 GPU_CLOCK_307MHZ = 0x124F8000L;
+    constexpr u32 EMC_CLOCK_1331MHZ = 0x4F588000L;
+    Result rc = 0;
+    
+    if (R_FAILED((rc = pcvSetClockRate(PcvModule_Cpu, CPU_CLOCK_1020MHZ)))) {
+        return rc;
+    }
+    
+    if (R_FAILED((rc = pcvSetClockRate(PcvModule_Gpu, GPU_CLOCK_307MHZ)))) {
+        return rc;
+    }
+    
+    if (R_FAILED((rc = pcvSetClockRate(PcvModule_Emc, EMC_CLOCK_1331MHZ)))) {
+        return rc;
+    }
+    
+    return rc;
+}
+
+Result AdjustClockTask::Run() {
+    return AdjustClock();
+}

stratosphere/fatal/source/fatal_task_clock.hpp

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+#include "fatal_task.hpp"
+
+class AdjustClockTask : public IFatalTask {
+    private:
+        Result AdjustClock();
+    public:
+        AdjustClockTask(FatalThrowContext *ctx, u64 title_id) : IFatalTask(ctx, title_id) { }
+        virtual Result Run() override;
+        virtual const char *GetName() const override {
+            return "AdjustClockTask";
+        }
+};

stratosphere/fatal/source/fatal_task_error_report.cpp

@@ -0,0 +1,140 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <cstdio>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <switch.h>
+#include <atmosphere/version.h>
+
+#include "fatal_task_error_report.hpp"
+#include "fatal_config.hpp"
+
+void ErrorReportTask::EnsureReportDirectories() {
+    char path[FS_MAX_PATH];  
+    strcpy(path, "sdmc:/atmosphere");
+    mkdir(path, S_IRWXU);
+    strcat(path, "/fatal_reports");
+    mkdir(path, S_IRWXU);
+    strcat(path, "/dumps");
+    mkdir(path, S_IRWXU);
+}
+
+bool ErrorReportTask::GetCurrentTime(u64 *out) {
+    *out = 0;
+    
+    /* Verify that pcv isn't dead. */
+    {
+        Handle dummy;
+        if (R_SUCCEEDED(smRegisterService(&dummy, "time:s", false, 0x20))) {
+            svcCloseHandle(dummy);
+            return false;
+        }
+    }
+    
+    /* Try to get the current time. */
+    bool success = false;
+    if (R_SUCCEEDED(timeInitialize())) {
+        if (R_SUCCEEDED(timeGetCurrentTime(TimeType_LocalSystemClock, out))) {
+            success = true;
+        }
+        timeExit();
+    }
+    return success;
+}
+
+void ErrorReportTask::SaveReportToSdCard() {
+    char file_path[FS_MAX_PATH];
+    
+    /* Ensure path exists. */
+    EnsureReportDirectories();
+    
+    /* Get a timestamp. */
+    u64 timestamp;
+    if (!GetCurrentTime(&timestamp)) {
+        timestamp = svcGetSystemTick();
+    }
+    
+    /* Open report file. */
+    snprintf(file_path, sizeof(file_path) - 1, "sdmc:/atmosphere/fatal_reports/%011lu_%016lx.log", timestamp, this->title_id);
+    FILE *f_report = fopen(file_path, "w");
+    if (f_report != NULL) {
+        ON_SCOPE_EXIT { fclose(f_report); };
+        
+        fprintf(f_report, "Atmosphère Fatal Report (v1.0):\n");
+        fprintf(f_report, "Result:                          0x%X (2%03d-%04d)\n\n", this->ctx->error_code, R_MODULE(this->ctx->error_code), R_DESCRIPTION(this->ctx->error_code));
+        fprintf(f_report, "Title ID:                        %016lx\n", this->title_id);
+        if (strlen(this->ctx->proc_name)) {
+            fprintf(f_report, "Process Name:                    %s\n", this->ctx->proc_name);
+        }
+        fprintf(f_report, u8"Firmware:                        %s (Atmosphère %u.%u.%u-%s)\n", GetFatalConfig()->firmware_version.display_version, CURRENT_ATMOSPHERE_VERSION, GetAtmosphereGitRevision());
+        
+        if (this->ctx->cpu_ctx.is_aarch32) {
+            fprintf(f_report, "General Purpose Registers:\n");
+            for (size_t i = 0; i < NumAarch32Gprs; i++) {
+                if (this->ctx->has_gprs[i]) {
+                    fprintf(f_report,  "        %3s:                     %08x\n", Aarch32GprNames[i], this->ctx->cpu_ctx.aarch32_ctx.r[i]);
+                }
+            }
+            fprintf(f_report, "    PC:                          %08x\n", this->ctx->cpu_ctx.aarch32_ctx.pc);
+            fprintf(f_report, "Start Address:                   %08x\n", this->ctx->cpu_ctx.aarch32_ctx.start_address);
+            fprintf(f_report, "Stack Trace:\n");
+            for (unsigned int i = 0; i < this->ctx->cpu_ctx.aarch32_ctx.stack_trace_size; i++) {
+                fprintf(f_report, "        ReturnAddress[%02u]:       %08x\n", i, this->ctx->cpu_ctx.aarch32_ctx.stack_trace[i]);
+            }
+        } else {
+            fprintf(f_report, "General Purpose Registers:\n");
+            for (size_t i = 0; i < NumAarch64Gprs; i++) {
+                if (this->ctx->has_gprs[i]) {
+                    fprintf(f_report,  "        %3s:                     %016lx\n", Aarch64GprNames[i], this->ctx->cpu_ctx.aarch64_ctx.x[i]);
+                }
+            }
+            fprintf(f_report, "    PC:                          %016lx\n", this->ctx->cpu_ctx.aarch64_ctx.pc);
+            fprintf(f_report, "Start Address:                   %016lx\n", this->ctx->cpu_ctx.aarch64_ctx.start_address);
+            fprintf(f_report, "Stack Trace:\n");
+            for (unsigned int i = 0; i < this->ctx->cpu_ctx.aarch64_ctx.stack_trace_size; i++) {
+                fprintf(f_report, "        ReturnAddress[%02u]:       %016lx\n", i, this->ctx->cpu_ctx.aarch64_ctx.stack_trace[i]);
+            }
+        }
+        
+    }
+    
+    if (this->ctx->stack_dump_size) {
+        snprintf(file_path, sizeof(file_path) - 1, "sdmc:/atmosphere/fatal_reports/dumps/%011lu_%016lx.bin", timestamp, this->title_id);
+        FILE *f_stackdump = fopen(file_path, "wb");
+        if (f_stackdump == NULL) { return; }
+        ON_SCOPE_EXIT { fclose(f_stackdump); };
+        
+        fwrite(this->ctx->stack_dump, this->ctx->stack_dump_size, 1, f_stackdump);
+    }
+}
+
+Result ErrorReportTask::Run() {
+    if (this->create_report) {
+        /* Here, Nintendo creates an error report with erpt. AMS will not do that. */
+    }
+    
+    /* Save report to SD card. */
+    if (!this->ctx->is_creport) {
+        SaveReportToSdCard();
+    }
+    
+    /* Signal we're done with our job. */
+    eventFire(this->erpt_event);
+    
+    
+    return 0;
+}

stratosphere/fatal/source/fatal_task_error_report.hpp

@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+#include "fatal_task.hpp"
+
+class ErrorReportTask : public IFatalTask {
+    private:
+        bool create_report;
+        Event *erpt_event;
+    private:
+        void EnsureReportDirectories();
+        bool GetCurrentTime(u64 *out);
+        void SaveReportToSdCard();
+    public:
+        ErrorReportTask(FatalThrowContext *ctx, u64 title_id, bool error_report, Event *evt) : IFatalTask(ctx, title_id), create_report(error_report), erpt_event(evt) { }
+        virtual Result Run() override;
+        virtual const char *GetName() const override {
+            return "WriteErrorReport";
+        }
+};

stratosphere/fatal/source/fatal_task_power.cpp

@@ -0,0 +1,128 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <switch.h>
+#include "fatal_task_power.hpp"
+#include "fatal_config.hpp"
+
+bool PowerControlTask::TryShutdown() {
+    /* Set a timeout of 30 seconds. */
+    TimeoutHelper timeout_helper(30000000000UL); 
+    bool cancel_shutdown = false;
+    PsmBatteryVoltageState bv_state = PsmBatteryVoltageState_Normal;
+    
+    while (true) {
+        if (timeout_helper.TimedOut()) {
+            break;
+        }
+        
+        if (R_FAILED(psmGetBatteryVoltageState(&bv_state)) || bv_state == PsmBatteryVoltageState_NeedsShutdown) {
+            break;
+        }
+        
+        if (bv_state == PsmBatteryVoltageState_Normal) {
+            cancel_shutdown = true;
+            break;
+        }
+        
+        /* Query voltage state every 5 seconds, for 30 seconds. */
+        svcSleepThread(5000000000UL);
+    }
+    
+    if (!cancel_shutdown) {
+        bpcShutdownSystem();
+        return true;
+    } else {
+        return false;
+    }
+}
+
+void PowerControlTask::MonitorBatteryState() {
+    PsmBatteryVoltageState bv_state = PsmBatteryVoltageState_Normal;
+    
+    /* Check the battery state, and shutdown on low voltage. */
+    if (R_FAILED(psmGetBatteryVoltageState(&bv_state)) || bv_state == PsmBatteryVoltageState_NeedsShutdown) {
+        /* Wait a second for the error report task to finish. */
+        eventWait(this->erpt_event, TimeoutHelper::NsToTick(1000000000UL));
+        this->TryShutdown();
+        return;
+    }
+    
+    /* Signal we've checked the battery at least once. */
+    eventFire(this->battery_event);
+    
+    while (true) {
+        if (R_FAILED(psmGetBatteryVoltageState(&bv_state))) {
+            bv_state = PsmBatteryVoltageState_NeedsShutdown;
+        }
+        
+        switch (bv_state) {
+            case PsmBatteryVoltageState_NeedsShutdown:
+            case PsmBatteryVoltageState_NeedsSleep:
+                {
+                    bool shutdown = this->TryShutdown();
+                    if (shutdown) {
+                        return;
+                    }
+                }
+                break;
+            default:
+                break;
+        }
+        
+        /* Query voltage state every 5 seconds. */
+        svcSleepThread(5000000000UL);
+    }
+}
+
+void PowerButtonObserveTask::WaitForPowerButton() {
+    /* Wait up to a second for error report generation to finish. */
+    eventWait(this->erpt_event, TimeoutHelper::NsToTick(1000000000UL));
+    
+    /* Force a reboot after some time if kiosk unit. */
+    const FatalConfig *config = GetFatalConfig();
+    TimeoutHelper reboot_helper(config->quest_reboot_interval_second * 1000000000UL); 
+    
+    BpcSleepButtonState state;
+    while (true) {
+        
+        
+        Result rc = bpcGetSleepButtonState(&state);
+        if ((R_SUCCEEDED(rc) && state == BpcSleepButtonState_Held) || (config->quest_flag && reboot_helper.TimedOut())) {
+            bpcRebootSystem();
+            return;
+        }
+        
+        /* Wait 100 ms between button checks. */
+        svcSleepThread(100000000UL);
+    }
+}
+
+Result PowerControlTask::Run() {
+    MonitorBatteryState();
+    return 0;
+}
+
+Result PowerButtonObserveTask::Run() {
+    WaitForPowerButton();
+    return 0;
+}
+
+Result StateTransitionStopTask::Run() {
+    /* Nintendo ignores the output of this call... */
+    spsmPutErrorState();
+    return 0;
+}

stratosphere/fatal/source/fatal_task_power.hpp

@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+#include "fatal_task.hpp"
+
+class PowerControlTask : public IFatalTask {
+    private:
+        Event *erpt_event;
+        Event *battery_event;
+    private:
+        bool TryShutdown();
+        void MonitorBatteryState();
+    public:
+        PowerControlTask(FatalThrowContext *ctx, u64 title_id, Event *er_evt, Event *bt_evt) : IFatalTask(ctx, title_id), erpt_event(er_evt), battery_event(bt_evt) { }
+        virtual Result Run() override;
+        virtual const char *GetName() const override {
+            return "PowerControlTask";
+        }
+};
+
+class PowerButtonObserveTask : public IFatalTask {
+    private:
+        Event *erpt_event;
+    private:
+        void WaitForPowerButton();
+    public:
+        PowerButtonObserveTask(FatalThrowContext *ctx, u64 title_id, Event *er_evt) : IFatalTask(ctx, title_id), erpt_event(er_evt) { }
+        virtual Result Run() override;
+        virtual const char *GetName() const override {
+            return "PowerButtonObserveTask";
+        }
+};
+
+class StateTransitionStopTask : public IFatalTask {
+    public:
+        StateTransitionStopTask(FatalThrowContext *ctx, u64 title_id) : IFatalTask(ctx, title_id) { }
+        virtual Result Run() override;
+        virtual const char *GetName() const override {
+            return "StateTransitionStopTask";
+        }
+};

stratosphere/fatal/source/fatal_task_screen.cpp

@@ -0,0 +1,410 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <switch.h>
+
+#include <atmosphere/version.h>
+
+#include "fatal_task_screen.hpp"
+#include "fatal_config.hpp"
+#include "fatal_font.hpp"
+#include "ams_logo.hpp"
+
+static constexpr u32 FatalScreenWidth = 1280;
+static constexpr u32 FatalScreenHeight = 720;
+static constexpr u32 FatalScreenBpp = 2;
+
+static constexpr u32 FatalScreenWidthAlignedBytes = (FatalScreenWidth * FatalScreenBpp + 63) & ~63;
+static constexpr u32 FatalScreenWidthAligned = FatalScreenWidthAlignedBytes / FatalScreenBpp;
+
+u32 GetPixelOffset(uint32_t x, uint32_t y)
+{
+    u32 tmp_pos;
+
+    tmp_pos = ((y & 127) / 16) + (x/32*8) + ((y/16/8)*(((FatalScreenWidthAligned/2)/16*8)));
+    tmp_pos *= 16*16 * 4;
+
+    tmp_pos += ((y%16)/8)*512 + ((x%32)/16)*256 + ((y%8)/2)*64 + ((x%16)/8)*32 + (y%2)*16 + (x%8)*2;//This line is a modified version of code from the Tegra X1 datasheet.
+
+    return tmp_pos / 2;
+}
+
+Result ShowFatalTask::SetupDisplayInternal() {
+    Result rc;
+    ViDisplay display;
+    /* Try to open the display. */
+    if (R_FAILED((rc = viOpenDisplay("Internal", &display)))) {
+        if (rc == 0xE72) {
+            return 0;
+        } else {
+            return rc;
+        }
+    }
+    /* Guarantee we close the display. */
+    ON_SCOPE_EXIT { viCloseDisplay(&display); };
+    
+    /* Turn on the screen. */
+    if (R_FAILED((rc = viSetDisplayPowerState(&display, ViPowerState_On)))) {
+        return rc;
+    }
+    
+    /* Set alpha to 1.0f. */
+    if (R_FAILED((rc = viSetDisplayAlpha(&display, 1.0f)))) {
+        return rc;
+    }
+    
+    return rc;
+}
+
+Result ShowFatalTask::SetupDisplayExternal() {
+    Result rc;
+    ViDisplay display;
+    /* Try to open the display. */
+    if (R_FAILED((rc = viOpenDisplay("External", &display)))) {
+        if (rc == 0xE72) {
+            return 0;
+        } else {
+            return rc;
+        }
+    }
+    /* Guarantee we close the display. */
+    ON_SCOPE_EXIT { viCloseDisplay(&display); };
+    
+    /* Set alpha to 1.0f. */
+    if (R_FAILED((rc = viSetDisplayAlpha(&display, 1.0f)))) {
+        return rc;
+    }
+    
+    return rc;
+}
+
+Result ShowFatalTask::PrepareScreenForDrawing() {
+    Result rc = 0;
+    
+    /* Connect to vi. */
+    if (R_FAILED((rc = viInitialize(ViServiceType_Manager)))) {
+        return rc;
+    }
+    
+    /* Close other content. */
+    viSetContentVisibility(false);
+    
+    /* Setup the two displays. */
+    if (R_FAILED((rc = SetupDisplayInternal())) || R_FAILED((rc = SetupDisplayExternal()))) {
+        return rc;
+    }
+    
+    /* Open the default display. */
+    if (R_FAILED((rc = viOpenDefaultDisplay(&this->display)))) {
+        return rc;
+    }
+    
+    /* Reset the display magnification to its default value. */
+    u32 display_width, display_height;
+    if (R_FAILED((rc = viGetDisplayLogicalResolution(&this->display, &display_width, &display_height)))) {
+        return rc;
+    }
+    if (R_FAILED((rc = viSetDisplayMagnification(&this->display, 0, 0, display_width, display_height)))) {
+        return rc;
+    }
+    
+    /* Create layer to draw to. */
+    if (R_FAILED((rc = viCreateLayer(&this->display, &this->layer)))) {
+        return rc;
+    }
+    
+    /* Setup the layer. */
+    {
+        /* Display a layer of 1280 x 720 at 1.5x magnification */
+        /* NOTE: N uses 2 (770x400) RGBA4444 buffers (tiled buffer + linear). */
+        /* We use a single 1280x720 tiled RGB565 buffer. */
+        constexpr u32 raw_width = FatalScreenWidth;
+        constexpr u32 raw_height = FatalScreenHeight;
+        constexpr u32 layer_width = ((raw_width) * 3) / 2;
+        constexpr u32 layer_height = ((raw_height) * 3) / 2;
+        
+        const float layer_x = static_cast<float>((display_width - layer_width) / 2);
+        const float layer_y = static_cast<float>((display_height - layer_height) / 2);
+        u64 layer_z;
+        
+        if (R_FAILED((rc = viSetLayerSize(&this->layer, layer_width, layer_height)))) {
+            return rc;
+        }
+        
+        /* Set the layer's Z at display maximum, to be above everything else .*/
+        /* NOTE: Fatal hardcodes 100 here. */
+        if (R_SUCCEEDED((rc = viGetDisplayMaximumZ(&this->display, &layer_z)))) {
+            if (R_FAILED((rc = viSetLayerZ(&this->layer, layer_z)))) {
+                return rc;
+            }
+        }
+        
+        /* Center the layer in the screen. */
+        if (R_FAILED((rc = viSetLayerPosition(&this->layer, layer_x, layer_y)))) {
+            return rc;
+        }
+    
+        /* Create framebuffer. */
+        if (R_FAILED(rc = nwindowCreateFromLayer(&this->win, &this->layer))) {
+            return rc;
+        }
+        if (R_FAILED(rc = framebufferCreate(&this->fb, &this->win, raw_width, raw_height, PIXEL_FORMAT_RGB_565, 1))) {
+            return rc;
+        }
+    }
+    
+
+    return rc;
+}
+
+Result ShowFatalTask::ShowFatal() {
+    Result rc = 0;
+    const FatalConfig *config = GetFatalConfig();
+
+    if (R_FAILED((rc = PrepareScreenForDrawing()))) {
+        *(volatile u32 *)(0xCAFEBABE) = rc;
+        return rc;
+    }
+    
+    /* Dequeue a buffer. */
+    u16 *tiled_buf = reinterpret_cast<u16 *>(framebufferBegin(&this->fb, NULL));
+    if (tiled_buf == nullptr) {
+        return FatalResult_NullGfxBuffer;
+    }
+    
+    /* Let the font manager know about our framebuffer. */
+    FontManager::ConfigureFontFramebuffer(tiled_buf, GetPixelOffset);
+    FontManager::SetFontColor(0xFFFF);
+    
+    /* Draw a background. */
+    for (size_t i = 0; i < this->fb.fb_size / sizeof(*tiled_buf); i++) {
+        tiled_buf[i] = 0x39C9;
+    }
+    
+    /* Draw the atmosphere logo in the bottom right corner. */
+    for (size_t y = 0; y < AMS_LOGO_HEIGHT; y++) {
+        for (size_t x = 0; x < AMS_LOGO_WIDTH; x++) {
+            tiled_buf[GetPixelOffset(FatalScreenWidth - AMS_LOGO_WIDTH - 32 + x, 32 + y)] = AMS_LOGO_BIN[y * AMS_LOGO_WIDTH + x];
+        }
+    }
+    
+    /* TODO: Actually draw meaningful shit here. */
+    FontManager::SetPosition(32, 64);
+    FontManager::SetFontSize(16.0f);
+    FontManager::PrintFormat(config->error_msg, R_MODULE(this->ctx->error_code), R_DESCRIPTION(this->ctx->error_code), this->ctx->error_code);
+    FontManager::AddSpacingLines(0.5f);
+    FontManager::PrintFormatLine("Title: %016lX", this->title_id);
+    FontManager::AddSpacingLines(0.5f);
+    FontManager::PrintFormatLine(u8"Firmware: %s (Atmosphère %u.%u.%u-%s)", GetFatalConfig()->firmware_version.display_version, CURRENT_ATMOSPHERE_VERSION, GetAtmosphereGitRevision());
+    FontManager::AddSpacingLines(1.5f);
+    FontManager::Print(config->error_desc);
+    
+    /* Add a line. */
+    for (size_t x = 32; x < FatalScreenWidth - 32; x++) {
+        tiled_buf[GetPixelOffset(x, FontManager::GetY())] = 0xFFFF;
+    }
+    
+    
+    FontManager::AddSpacingLines(1.5f);
+    
+    u32 backtrace_y = FontManager::GetY();
+    u32 backtrace_x = 0;
+    
+    /* Print GPRs. */
+    FontManager::SetFontSize(14.0f);
+    FontManager::Print("General Purpose Registers      ");
+    {
+        FontManager::SetPosition(FontManager::GetX() + 2, FontManager::GetY());
+        u32 x = FontManager::GetX();
+        FontManager::Print("PC: ");
+        FontManager::SetPosition(x + 47, FontManager::GetY());
+    }
+    if (this->ctx->cpu_ctx.is_aarch32) {
+        FontManager::PrintMonospaceU32(this->ctx->cpu_ctx.aarch32_ctx.pc);
+    } else {
+        FontManager::PrintMonospaceU64(this->ctx->cpu_ctx.aarch64_ctx.pc);
+    }
+    FontManager::PrintLine("");
+    FontManager::SetPosition(32, FontManager::GetY());
+    FontManager::AddSpacingLines(0.5f);
+    if (this->ctx->cpu_ctx.is_aarch32) {
+        for (size_t i = 0; i < (NumAarch32Gprs / 2); i++) {
+            u32 x = FontManager::GetX();
+            FontManager::PrintFormat("%s:", Aarch32GprNames[i]);
+            FontManager::SetPosition(x + 47, FontManager::GetY());
+            if (this->ctx->has_gprs[i]) {
+                FontManager::PrintMonospaceU32(this->ctx->cpu_ctx.aarch32_ctx.r[i]);
+            } else {
+                FontManager::PrintMonospaceBlank(8);
+            }
+            FontManager::Print("  ");
+            x = FontManager::GetX();
+            FontManager::PrintFormat("%s:", Aarch32GprNames[i + (NumAarch32Gprs / 2)]);
+            FontManager::SetPosition(x + 47, FontManager::GetY());
+            if (this->ctx->has_gprs[i + (NumAarch32Gprs / 2)]) {
+                FontManager::PrintMonospaceU32(this->ctx->cpu_ctx.aarch32_ctx.r[i + (NumAarch32Gprs / 2)]);
+            } else {
+                FontManager::PrintMonospaceBlank(8);
+            }
+
+            if (i == (NumAarch32Gprs / 2) - 1) {
+                FontManager::Print("    ");
+                backtrace_x = FontManager::GetX();
+            }
+            
+            FontManager::PrintLine("");
+            FontManager::SetPosition(32, FontManager::GetY());
+        }
+    } else {
+        for (size_t i = 0; i < NumAarch64Gprs / 2; i++) {
+            u32 x = FontManager::GetX();
+            FontManager::PrintFormat("%s:", Aarch64GprNames[i]);
+            FontManager::SetPosition(x + 47, FontManager::GetY());
+            if (this->ctx->has_gprs[i]) {
+                FontManager::PrintMonospaceU64(this->ctx->cpu_ctx.aarch64_ctx.x[i]);
+            } else {
+                FontManager::PrintMonospaceBlank(16);
+            }
+            FontManager::Print("  ");
+            x = FontManager::GetX();
+            FontManager::PrintFormat("%s:", Aarch64GprNames[i + (NumAarch64Gprs / 2)]);
+            FontManager::SetPosition(x + 47, FontManager::GetY());
+            if (this->ctx->has_gprs[i + (NumAarch64Gprs / 2)]) {
+                FontManager::PrintMonospaceU64(this->ctx->cpu_ctx.aarch64_ctx.x[i + (NumAarch64Gprs / 2)]);
+            } else {
+                FontManager::PrintMonospaceBlank(16);
+            }
+
+            if (i == (NumAarch64Gprs / 2) - 1) {
+                FontManager::Print("    ");
+                backtrace_x = FontManager::GetX();
+            }
+            
+            FontManager::PrintLine("");
+            FontManager::SetPosition(32, FontManager::GetY());
+        }
+    }
+    
+    /* Print Backtrace. */
+    u32 bt_size;
+    if (this->ctx->cpu_ctx.is_aarch32) {
+        bt_size = this->ctx->cpu_ctx.aarch32_ctx.stack_trace_size;
+    } else {
+        bt_size = this->ctx->cpu_ctx.aarch64_ctx.stack_trace_size;
+    }
+    
+    
+    FontManager::SetPosition(backtrace_x, backtrace_y);
+    if (bt_size == 0) {
+        if (this->ctx->cpu_ctx.is_aarch32) {
+            FontManager::Print("Start Address: ");
+            FontManager::PrintMonospaceU32(this->ctx->cpu_ctx.aarch32_ctx.start_address);
+            FontManager::PrintLine("");
+        } else {
+            FontManager::Print("Start Address: ");
+            FontManager::PrintMonospaceU64(this->ctx->cpu_ctx.aarch64_ctx.start_address);
+            FontManager::PrintLine("");
+        }
+    } else {
+        if (this->ctx->cpu_ctx.is_aarch32) {
+            FontManager::Print("Backtrace - Start Address: ");
+            FontManager::PrintMonospaceU32(this->ctx->cpu_ctx.aarch32_ctx.start_address);
+            FontManager::PrintLine("");
+            FontManager::AddSpacingLines(0.5f);
+            for (u32 i = 0; i < Aarch32CpuContext::MaxStackTraceDepth / 2; i++) {
+                u32 bt_cur = 0, bt_next = 0;
+                if (i < this->ctx->cpu_ctx.aarch32_ctx.stack_trace_size) {
+                    bt_cur = this->ctx->cpu_ctx.aarch32_ctx.stack_trace[i];
+                }
+                if (i + Aarch32CpuContext::MaxStackTraceDepth / 2 < this->ctx->cpu_ctx.aarch32_ctx.stack_trace_size) {
+                    bt_next = this->ctx->cpu_ctx.aarch32_ctx.stack_trace[i + Aarch32CpuContext::MaxStackTraceDepth / 2];
+                }
+                
+                if (i < this->ctx->cpu_ctx.aarch32_ctx.stack_trace_size) {
+                    u32 x = FontManager::GetX();
+                    FontManager::PrintFormat("BT[%02d]: ", i);
+                    FontManager::SetPosition(x + 72, FontManager::GetY());
+                    FontManager::PrintMonospaceU32(bt_cur);
+                    FontManager::Print("  ");
+                }
+                
+                if (i + Aarch32CpuContext::MaxStackTraceDepth / 2 < this->ctx->cpu_ctx.aarch32_ctx.stack_trace_size) {
+                    u32 x = FontManager::GetX();
+                    FontManager::PrintFormat("BT[%02d]: ", i + Aarch32CpuContext::MaxStackTraceDepth / 2);
+                    FontManager::SetPosition(x + 72, FontManager::GetY());
+                    FontManager::PrintMonospaceU32(bt_next);
+                }
+                
+                FontManager::PrintLine("");
+                FontManager::SetPosition(backtrace_x, FontManager::GetY());
+            }
+        } else {
+            FontManager::Print("Backtrace - Start Address: ");
+            FontManager::PrintMonospaceU64(this->ctx->cpu_ctx.aarch64_ctx.start_address);
+            FontManager::PrintLine("");
+            FontManager::AddSpacingLines(0.5f);
+            for (u32 i = 0; i < Aarch64CpuContext::MaxStackTraceDepth / 2; i++) {
+                u64 bt_cur = 0, bt_next = 0;
+                if (i < this->ctx->cpu_ctx.aarch64_ctx.stack_trace_size) {
+                    bt_cur = this->ctx->cpu_ctx.aarch64_ctx.stack_trace[i];
+                }
+                if (i + Aarch64CpuContext::MaxStackTraceDepth / 2 < this->ctx->cpu_ctx.aarch64_ctx.stack_trace_size) {
+                    bt_next = this->ctx->cpu_ctx.aarch64_ctx.stack_trace[i + Aarch64CpuContext::MaxStackTraceDepth / 2];
+                }
+                
+                if (i < this->ctx->cpu_ctx.aarch64_ctx.stack_trace_size) {
+                    u32 x = FontManager::GetX();
+                    FontManager::PrintFormat("BT[%02d]: ", i);
+                    FontManager::SetPosition(x + 72, FontManager::GetY());
+                    FontManager::PrintMonospaceU64(bt_cur);
+                    FontManager::Print("  ");
+                }
+                
+                if (i + Aarch64CpuContext::MaxStackTraceDepth / 2 < this->ctx->cpu_ctx.aarch64_ctx.stack_trace_size) {
+                    u32 x = FontManager::GetX();
+                    FontManager::PrintFormat("BT[%02d]: ", i + Aarch64CpuContext::MaxStackTraceDepth / 2);
+                    FontManager::SetPosition(x + 72, FontManager::GetY());
+                    FontManager::PrintMonospaceU64(bt_next);
+                }
+                
+                FontManager::PrintLine("");
+                FontManager::SetPosition(backtrace_x, FontManager::GetY());
+            }
+        }
+    }
+    
+    
+    /* Enqueue the buffer. */
+    framebufferEnd(&fb);
+    
+    return rc;
+}
+
+Result ShowFatalTask::Run() {
+    /* Don't show the fatal error screen until we've verified the battery is okay. */
+    eventWait(this->battery_event, U64_MAX);
+
+    return ShowFatal();
+}
+
+void BacklightControlTask::TurnOnBacklight() {
+    lblSwitchBacklightOn(0);
+}
+
+Result BacklightControlTask::Run() {
+    TurnOnBacklight();
+    return 0;
+}

stratosphere/fatal/source/fatal_task_screen.hpp

@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+#include "fatal_task.hpp"
+
+class ShowFatalTask : public IFatalTask {
+    private:
+        Event *battery_event;
+        ViDisplay display;
+        ViLayer layer;
+        NWindow win;
+        Framebuffer fb;
+    private:
+        Result SetupDisplayInternal();
+        Result SetupDisplayExternal();
+        Result PrepareScreenForDrawing();
+        Result ShowFatal();
+    public:
+        ShowFatalTask(FatalThrowContext *ctx, u64 title_id, Event *evt) : IFatalTask(ctx, title_id), battery_event(evt) { }
+        virtual Result Run() override;
+        virtual const char *GetName() const override {
+            return "ShowFatal";
+        }
+};
+
+class BacklightControlTask : public IFatalTask {
+    private:
+        void TurnOnBacklight();
+    public:
+        BacklightControlTask(FatalThrowContext *ctx, u64 title_id) : IFatalTask(ctx, title_id) { }
+        virtual Result Run() override;
+        virtual const char *GetName() const override {
+            return "BacklightControlTask";
+        }
+};

stratosphere/fatal/source/fatal_task_sound.cpp

@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <switch.h>
+#include "fatal_task_sound.hpp"
+
+
+void StopSoundTask::StopSound() {
+    /* Talk to the ALC5639 over I2C, and disable audio output. */
+    {
+        I2cSession audio;
+        if (R_SUCCEEDED(i2cOpenSession(&audio, I2cDevice_AudioCodec))) {
+            struct {
+                u16 dev;
+                u8 val;
+            } __attribute__((packed)) cmd;
+            static_assert(sizeof(cmd) == 3, "I2C command definition!");
+
+            cmd.dev = 0xC801;
+            cmd.val = 200;
+            i2csessionSendAuto(&audio, &cmd, sizeof(cmd), I2cTransactionOption_All);
+
+            cmd.dev = 0xC802;
+            cmd.val = 200;
+            i2csessionSendAuto(&audio, &cmd, sizeof(cmd), I2cTransactionOption_All);
+
+            cmd.dev = 0xC802;
+            cmd.val = 200;
+            i2csessionSendAuto(&audio, &cmd, sizeof(cmd), I2cTransactionOption_All);
+            
+            for (u16 dev = 97; dev <= 102; dev++) {
+                cmd.dev = dev;
+                cmd.val = 0;
+                i2csessionSendAuto(&audio, &cmd, sizeof(cmd), I2cTransactionOption_All);
+            }
+            
+            i2csessionClose(&audio);
+        }
+    }
+    
+    /* Talk to the ALC5639 over GPIO, and disable audio output */
+    {
+        GpioPadSession audio;
+        if (R_SUCCEEDED(gpioOpenSession(&audio, GpioPadName_AudioCodec))) {
+            /* Set direction output, sleep 200 ms so it can take effect. */
+            gpioPadSetDirection(&audio, GpioDirection_Output);
+            svcSleepThread(200000000UL);
+            
+            /* Pull audio codec low. */
+            gpioPadSetValue(&audio, GpioValue_Low);
+            
+            gpioPadClose(&audio);
+        }
+    }
+}
+
+Result StopSoundTask::Run() {
+    StopSound();
+    return 0;
+}

stratosphere/fatal/source/fatal_task_sound.hpp

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+#include "fatal_task.hpp"
+
+class StopSoundTask : public IFatalTask {
+    private:
+        void StopSound();
+    public:
+        StopSoundTask(FatalThrowContext *ctx, u64 title_id) : IFatalTask(ctx, title_id) { }
+        virtual Result Run() override;
+        virtual const char *GetName() const override {
+            return "SoundTask";
+        }
+};

stratosphere/fatal/source/fatal_throw.cpp

@@ -0,0 +1,116 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <switch.h>
+#include "fatal_throw.hpp"
+#include "fatal_event_manager.hpp"
+#include "fatal_task.hpp"
+#include "fatal_config.hpp"
+#include "fatal_debug.hpp"
+
+static bool g_thrown = false;
+
+static Result SetThrown() {
+    /* This should be fine, since fatal only has a single IPC thread. */
+    if (g_thrown) {
+        return FatalResult_AlreadyThrown;
+    }
+    
+    g_thrown = true;
+    return 0;
+}
+
+Result ThrowFatalForSelf(u32 error) {
+    u64 pid = 0;
+    
+    svcGetProcessId(&pid, CUR_PROCESS_HANDLE);
+    return ThrowFatalImpl(error, pid, FatalType_ErrorScreen, nullptr);
+}
+
+Result ThrowFatalImpl(u32 error, u64 pid, FatalType policy, FatalCpuContext *cpu_ctx) {
+    Result rc = 0;
+    FatalThrowContext ctx = {0};
+    ctx.error_code = error;
+    if (cpu_ctx != nullptr) {
+        ctx.cpu_ctx = *cpu_ctx;
+        /* Assume if we're provided a context that it's complete. */
+        for (u32 i = 0; i < NumAarch64Gprs; i++) {
+            ctx.has_gprs[i] = true;
+        }
+    } else {
+        std::memset(&ctx.cpu_ctx, 0, sizeof(ctx.cpu_ctx));
+        cpu_ctx = &ctx.cpu_ctx;
+    }
+    
+    /* Get config. */
+    const FatalConfig *config = GetFatalConfig();
+    
+    /* Get title id. On failure, it'll be zero. */
+    u64 title_id = 0;
+    pminfoGetTitleId(&title_id, pid);   
+    ctx.is_creport = title_id == 0x0100000000000036;
+    
+    /* Support for ams creport. TODO: Make this its own command? */
+    if (ctx.is_creport && !cpu_ctx->is_aarch32 && cpu_ctx->aarch64_ctx.afsr0 != 0) {
+        title_id = cpu_ctx->aarch64_ctx.afsr0;
+    }
+    
+    /* Atmosphere extension: automatic debug info collection. */
+    if (GetRuntimeFirmwareVersion() >= FirmwareVersion_200 && !ctx.is_creport) {
+        if ((cpu_ctx->is_aarch32 && cpu_ctx->aarch32_ctx.stack_trace_size == 0) || (!cpu_ctx->is_aarch32 && cpu_ctx->aarch32_ctx.stack_trace_size == 0)) {
+            TryCollectDebugInformation(&ctx, pid);
+        }
+    }
+    
+    switch (policy) {
+        case FatalType_ErrorReport:
+            /* TODO: Don't write an error report. */
+            break;
+        case FatalType_ErrorReportAndErrorScreen:
+        case FatalType_ErrorScreen:
+            {
+                /* Ensure we only throw once. */
+                if (R_FAILED((rc = SetThrown()))) {
+                    return rc;
+                }
+                                
+                /* Signal that fatal is about to happen. */
+                GetEventManager()->SignalEvents();
+                
+                /* Create events. */
+                Event erpt_event;
+                Event battery_event;
+                if (R_FAILED(eventCreate(&erpt_event, false)) || R_FAILED(eventCreate(&battery_event, false))) {
+                    std::abort();
+                }
+                
+                /* Run tasks. */
+                if (config->transition_to_fatal) {
+                    RunFatalTasks(&ctx, title_id, policy == FatalType_ErrorReportAndErrorScreen, &erpt_event, &battery_event);
+                } else {
+                    /* If flag is not set, don't show the fatal screen. */
+                    return 0;
+                }
+                
+            }
+            break;
+        default:
+            /* N aborts here. Should we just return an error code? */
+            std::abort();
+    }
+    
+    return 0;
+}

stratosphere/fatal/source/fatal_throw.hpp

@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+
+#include "fatal_types.hpp"
+
+Result ThrowFatalForSelf(u32 error);
+Result ThrowFatalImpl(u32 error, u64 pid, FatalType policy, FatalCpuContext *cpu_ctx);

stratosphere/fatal/source/fatal_types.hpp

@@ -0,0 +1,167 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+
+enum FatalResult : Result {
+    FatalResult_NullGfxBuffer = 0x4A3,
+    FatalResult_AlreadyThrown = 0x6A3,
+    FatalResult_TooManyEvents = 0x8A3,
+    FatalResult_InRepairWithoutVolHeld = 0xAA3,
+    FatalResult_InRepairWithoutTimeReviserCartridge = 0xCA3,
+};
+
+static constexpr size_t NumAarch64Gprs = 32;
+static constexpr size_t NumAarch32Gprs = 16;
+
+struct Aarch64CpuContext {
+    using RegisterType = u64;
+    static constexpr size_t MaxStackTraceDepth = 0x20;
+    
+    /* Registers, exception context. N left names for these fields in fatal .rodata. */
+    union {
+        RegisterType x[NumAarch64Gprs];
+        struct {
+            RegisterType _x[29];
+            RegisterType fp;
+            RegisterType lr;
+            RegisterType sp;
+            RegisterType pc;
+        };
+    };
+    RegisterType pstate;
+    RegisterType afsr0;
+    RegisterType afsr1;
+    RegisterType esr;
+    RegisterType far;
+    
+    /* Misc. */
+    RegisterType stack_trace[MaxStackTraceDepth];
+    RegisterType start_address;
+    RegisterType register_set_flags;
+    u32 stack_trace_size;
+};
+
+struct Aarch32CpuContext {
+    using RegisterType = u32;
+    static constexpr size_t MaxStackTraceDepth = 0x20;
+    
+    /* Registers, exception context. N left names for these fields in fatal .rodata. */
+    union {
+        RegisterType r[NumAarch32Gprs];
+        struct {
+            RegisterType _r[11];
+            RegisterType fp;
+            RegisterType ip;
+            RegisterType sp;
+            RegisterType lr;
+            RegisterType pc;
+        };
+    };
+    RegisterType pstate;
+    RegisterType afsr0;
+    RegisterType afsr1;
+    RegisterType esr;
+    RegisterType far;
+    
+    /* Misc. Yes, stack_trace_size is really laid out differently than aarch64... */
+    RegisterType stack_trace[MaxStackTraceDepth];
+    u32 stack_trace_size;
+    RegisterType start_address;
+    RegisterType register_set_flags;
+};
+
+struct FatalCpuContext {
+    union {
+        Aarch64CpuContext aarch64_ctx;
+        Aarch32CpuContext aarch32_ctx;
+    };
+    
+    bool is_aarch32;
+    u32 type;
+};
+
+struct FatalThrowContext {
+    u32 error_code;
+    bool is_creport;
+    bool has_gprs[NumAarch64Gprs];
+    size_t stack_dump_size;
+    u8 stack_dump[0x100];
+    char proc_name[0xD];
+    FatalCpuContext cpu_ctx;
+};
+
+static_assert(sizeof(Aarch64CpuContext) == 0x248, "Aarch64CpuContext definition!");
+static_assert(sizeof(Aarch32CpuContext) == 0xE0, "Aarch32CpuContext definition!");
+static_assert(sizeof(FatalCpuContext) == 0x250, "FatalCpuContext definition!");
+static_assert(std::is_pod_v<FatalCpuContext>, "FatalCpuContext definition!");
+
+static constexpr const char *Aarch64GprNames[NumAarch64Gprs] = {
+    u8"X0",
+    u8"X1",
+    u8"X2",
+    u8"X3",
+    u8"X4",
+    u8"X5",
+    u8"X6",
+    u8"X7",
+    u8"X8",
+    u8"X9",
+    u8"X10",
+    u8"X11",
+    u8"X12",
+    u8"X13",
+    u8"X14",
+    u8"X15",
+    u8"X16",
+    u8"X17",
+    u8"X18",
+    u8"X19",
+    u8"X20",
+    u8"X21",
+    u8"X22",
+    u8"X23",
+    u8"X24",
+    u8"X25",
+    u8"X26",
+    u8"X27",
+    u8"X28",
+    u8"FP",
+    u8"LR",
+    u8"SP",
+};
+
+static constexpr const char *Aarch32GprNames[NumAarch32Gprs] = {
+    u8"R0",
+    u8"R1",
+    u8"R2",
+    u8"R3",
+    u8"R4",
+    u8"R5",
+    u8"R6",
+    u8"R7",
+    u8"R8",
+    u8"R9",
+    u8"R10",
+    u8"FP",
+    u8"IP",
+    u8"LR",
+    u8"SP",
+    u8"PC",
+};
+

stratosphere/fatal/source/fatal_user.cpp

@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <switch.h>
+#include "fatal_user.hpp"
+#include "fatal_throw.hpp"
+#include "fatal_event_manager.hpp"
+#include "fatal_task.hpp"
+
+Result UserService::ThrowFatal(u32 error, PidDescriptor pid_desc) {
+    return ThrowFatalImpl(error, pid_desc.pid, FatalType_ErrorReportAndErrorScreen, nullptr);
+}
+
+Result UserService::ThrowFatalWithPolicy(u32 error, PidDescriptor pid_desc, FatalType policy) {
+    return ThrowFatalImpl(error, pid_desc.pid, policy, nullptr);
+}
+
+Result UserService::ThrowFatalWithCpuContext(u32 error, PidDescriptor pid_desc, FatalType policy, InBuffer<u8> _ctx) {
+    if (_ctx.num_elements < sizeof(FatalCpuContext)) {
+        return ThrowFatalImpl(error, pid_desc.pid, policy, nullptr);
+    } else {
+        return ThrowFatalImpl(error, pid_desc.pid, policy, reinterpret_cast<FatalCpuContext *>(_ctx.buffer));
+    }
+}

stratosphere/fatal/source/fatal_user.hpp

@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <stratosphere.hpp>
+
+#include "fatal_types.hpp"
+
+enum UserCmd {
+    User_Cmd_ThrowFatal = 0,
+    User_Cmd_ThrowFatalWithPolicy = 1,
+    User_Cmd_ThrowFatalWithCpuContext = 2,
+};
+
+class UserService final : public IServiceObject {
+    private:    
+        /* Actual commands. */
+        Result ThrowFatal(u32 error, PidDescriptor pid_desc);
+        Result ThrowFatalWithPolicy(u32 error, PidDescriptor pid_desc, FatalType policy);
+        Result ThrowFatalWithCpuContext(u32 error, PidDescriptor pid_desc, FatalType policy, InBuffer<u8> _ctx);
+    public:
+        DEFINE_SERVICE_DISPATCH_TABLE {
+            MakeServiceCommandMeta<User_Cmd_ThrowFatal, &UserService::ThrowFatal>(),
+            MakeServiceCommandMeta<User_Cmd_ThrowFatalWithPolicy, &UserService::ThrowFatalWithPolicy>(),
+            MakeServiceCommandMeta<User_Cmd_ThrowFatalWithCpuContext, &UserService::ThrowFatalWithCpuContext>(),
+        };
+};

stratosphere/fs_mitm/Makefile

@@ -9,6 +9,13 @@ endif
 TOPDIR ?= $(CURDIR)
 include $(DEVKITPRO)/libnx/switch_rules
 
+AMSBRANCH := $(shell git symbolic-ref --short HEAD)
+AMSREV := $(AMSBRANCH)-$(shell git rev-parse --short HEAD)
+
+ifneq (, $(strip $(shell git status --porcelain 2>/dev/null)))
+    AMSREV := $(AMSREV)-dirty
+endif
+
 #---------------------------------------------------------------------------------
 # TARGET is the name of the output
 # BUILD is the directory where object files & intermediate files will be placed
@@ -24,7 +31,7 @@ DATA		:=	data
 INCLUDES	:=	include ../../common/include
 EXEFS_SRC	:=	exefs_src
 
-DEFINES	:=	-DDISABLE_IPC
+DEFINES	:=	-DDISABLE_IPC -DATMOSPHERE_GIT_BRANCH=\"$(AMSBRANCH)\" -DATMOSPHERE_GIT_REV=\"$(AMSREV)\"
 
 #---------------------------------------------------------------------------------
 # options for code generation

stratosphere/fs_mitm/source/fs_istorage.hpp

@@ -61,7 +61,6 @@ class IStorageInterface : public IServiceObject {
         };
         virtual Result Write(InBuffer<u8, BufferType_Type1> buffer, u64 offset, u64 size) final {
            return this->base_storage->Write(buffer.buffer, std::min(buffer.num_elements, size), offset);
-
         };
         virtual Result Flush() final {
             return this->base_storage->Flush();
@@ -108,3 +107,65 @@ class IROStorage : public IStorage {
         virtual Result GetSize(u64 *out_size) = 0;
         virtual Result OperateRange(u32 operation_type, u64 offset, u64 size, FsRangeInfo *out_range_info) = 0;
 };
+
+
+class ProxyStorage : public IStorage {
+    private:
+        FsStorage *base_storage;
+    public:
+        ProxyStorage(FsStorage *s) : base_storage(s) {
+            /* ... */
+        };
+        ProxyStorage(FsStorage s) {
+            this->base_storage = new FsStorage(s);
+        };
+        virtual ~ProxyStorage() {
+            fsStorageClose(base_storage);
+            delete base_storage;
+        };
+    public:
+        virtual Result Read(void *buffer, size_t size, u64 offset) override {
+            return fsStorageRead(this->base_storage, offset, buffer, size);
+        };
+        virtual Result Write(void *buffer, size_t size, u64 offset) override {
+            return fsStorageWrite(this->base_storage, offset, buffer, size);
+        };
+        virtual Result Flush() override {
+            return fsStorageFlush(this->base_storage);
+        };
+        virtual Result GetSize(u64 *out_size) override {
+            return fsStorageGetSize(this->base_storage, out_size);
+        };
+        virtual Result SetSize(u64 size) override {
+            return fsStorageSetSize(this->base_storage, size);
+        };
+        virtual Result OperateRange(u32 operation_type, u64 offset, u64 size, FsRangeInfo *out_range_info) override {
+            return fsStorageOperateRange(this->base_storage, operation_type, offset, size, out_range_info);
+        };
+};
+
+class ROProxyStorage : public IROStorage {
+    private:
+        FsStorage *base_storage;
+    public:
+        ROProxyStorage(FsStorage *s) : base_storage(s) {
+            /* ... */
+        };
+        ROProxyStorage(FsStorage s) {
+            this->base_storage = new FsStorage(s);
+        };
+        virtual ~ROProxyStorage() {
+            fsStorageClose(base_storage);
+            delete base_storage;
+        };
+    public:
+        virtual Result Read(void *buffer, size_t size, u64 offset) override {
+            return fsStorageRead(this->base_storage, offset, buffer, size);
+        };
+        virtual Result GetSize(u64 *out_size) override {
+            return fsStorageGetSize(this->base_storage, out_size);
+        };
+        virtual Result OperateRange(u32 operation_type, u64 offset, u64 size, FsRangeInfo *out_range_info) override {
+            return fsStorageOperateRange(this->base_storage, operation_type, offset, size, out_range_info);
+        };
+};

stratosphere/fs_mitm/source/fs_shim.c

@@ -18,6 +18,44 @@
 #include "fs_shim.h"
 
 /* Missing fsp-srv commands. */
+Result fsOpenBisStorageFwd(Service* s, FsStorage* out, u32 PartitionId) {
+    IpcCommand c;
+    ipcInitialize(&c);
+
+    struct {
+        u64 magic;
+        u64 cmd_id;
+        u32 PartitionId;
+    } *raw;
+
+    raw = serviceIpcPrepareHeader(s, &c, sizeof(*raw));
+
+    raw->magic = SFCI_MAGIC;
+    raw->cmd_id = 12;
+    raw->PartitionId = PartitionId;
+
+    Result rc = serviceIpcDispatch(s);
+
+    if (R_SUCCEEDED(rc)) {
+        IpcParsedCommand r;
+        struct {
+            u64 magic;
+            u64 result;
+        } *resp;
+
+        serviceIpcParse(s, &r, sizeof(*resp));
+        resp = r.Raw;
+
+        rc = resp->result;
+
+        if (R_SUCCEEDED(rc)) {
+            serviceCreateSubservice(&out->s, s, &r, 0);
+        }
+    }
+
+    return rc;
+}
+
 Result fsOpenDataStorageByCurrentProcessFwd(Service* s, FsStorage* out) {
     IpcCommand c;
     ipcInitialize(&c);

stratosphere/fs_mitm/source/fs_shim.h

@@ -17,6 +17,7 @@ typedef struct {
 } FsRangeInfo;
 
 /* Missing fsp-srv commands. */
+Result fsOpenBisStorageFwd(Service* s, FsStorage* out, u32 PartitionId);
 Result fsOpenDataStorageByCurrentProcessFwd(Service* s, FsStorage* out);
 Result fsOpenDataStorageByDataIdFwd(Service* s, FsStorageId storage_id, u64 data_id, FsStorage* out);
 

stratosphere/fs_mitm/source/fsmitm_boot0storage.cpp

@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include <switch.h>
+#include <cstring>
+#include <stratosphere.hpp>
+
+#include "fsmitm_boot0storage.hpp"
+
+static HosMutex g_boot0_mutex;
+static u8 g_boot0_bct_buffer[Boot0Storage::BctEndOffset];
+
+bool Boot0Storage::CanModifyBctPubks() {
+    return this->title_id != 0x010000000000001FULL;
+}
+
+Result Boot0Storage::Read(void *_buffer, size_t size, u64 offset) {
+    std::scoped_lock<HosMutex> lk{g_boot0_mutex};
+            
+    return Base::Read(_buffer, size, offset);
+}
+
+Result Boot0Storage::Write(void *_buffer, size_t size, u64 offset) {
+    std::scoped_lock<HosMutex> lk{g_boot0_mutex};
+    
+    Result rc = 0;
+    u8 *buffer = static_cast<u8 *>(_buffer);
+    
+    /* Protect the keyblob region from writes. */
+    if (offset <= EksStart) {
+        if (offset + size < EksStart) {
+            /* Fall through, no need to do anything here. */
+        } else {
+            if (offset + size < EksEnd) {
+                /* Adjust size to avoid writing end of data. */
+                size = EksStart - offset;
+            } else {
+                /* Perform portion of write falling past end of keyblobs. */
+                const u64 diff = EksEnd - offset;
+                if (R_FAILED((rc = Base::Write(buffer + diff, size - diff, EksEnd)))) {
+                    return rc;
+                }
+                /* Adjust size to avoid writing end of data. */
+                size = EksStart - offset;
+            }
+        }
+    } else {
+        if (offset < EksEnd) {
+            if (offset + size < EksEnd) {
+                /* Ignore writes falling strictly within the region. */
+                return 0;
+            } else {
+                /* Only write past the end of the keyblob region. */
+                buffer = buffer + (EksEnd - offset);
+                size -= (EksEnd - offset);
+                offset = EksEnd;
+            }
+        } else {
+            /* Fall through, no need to do anything here. */
+        }
+    }
+    
+    if (size == 0) {
+        return 0;
+    }
+    
+    /* We care about protecting autorcm from NS. */
+    if (CanModifyBctPubks() || offset >= BctEndOffset || (offset + BctSize >= BctEndOffset && offset % BctSize >= BctPubkEnd)) {
+        return Base::Write(buffer, size, offset);
+    }
+    
+    /* First, let's deal with the data past the end. */
+    if (offset + size >= BctEndOffset) {
+        const u64 diff = BctEndOffset - offset;
+        if (R_FAILED((rc = ProxyStorage::Write(buffer + diff, size - diff, BctEndOffset)))) {
+            return rc;
+        }
+        size -= diff;
+    }
+    
+    /* Read in the current BCT region. */
+    if (R_FAILED((rc = ProxyStorage::Read(g_boot0_bct_buffer, BctEndOffset, 0)))) {
+        return rc;
+    }
+    
+    /* Update the bct buffer. */
+    for (u64 cur_ofs = offset; cur_ofs < BctEndOffset && cur_ofs < offset + size; cur_ofs++) {
+        const u64 cur_bct_rel_ofs = cur_ofs % BctSize;
+        if (cur_bct_rel_ofs < BctPubkStart || BctPubkEnd <= cur_bct_rel_ofs) {
+            g_boot0_bct_buffer[cur_ofs] = buffer[cur_ofs - offset];
+        }
+    }
+            
+    return ProxyStorage::Write(g_boot0_bct_buffer, BctEndOffset, 0);
+}

stratosphere/fs_mitm/source/fsmitm_boot0storage.hpp

@@ -0,0 +1,159 @@
+/*
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#pragma once
+#include <switch.h>
+#include <cstring>
+#include <stratosphere.hpp>
+
+#include "fs_istorage.hpp"
+
+/* Represents a sectored storage. */
+template<u64 SectorSize> 
+class SectoredProxyStorage : public ProxyStorage {
+    private:
+        u64 cur_seek = 0;
+        u64 cur_sector = 0;
+        u64 cur_sector_ofs = 0;
+        u8  sector_buf[SectorSize];
+    private:
+        void Seek(u64 offset) {
+            this->cur_sector_ofs = offset % SectorSize;
+            this->cur_seek = offset - this->cur_sector_ofs;
+        }
+    public:
+        SectoredProxyStorage(FsStorage *s) : ProxyStorage(s) { }
+        SectoredProxyStorage(FsStorage s) : ProxyStorage(s) { }
+    public:
+        virtual Result Read(void *_buffer, size_t size, u64 offset) override {
+            Result rc = 0;
+            u8 *buffer = static_cast<u8 *>(_buffer);
+            this->Seek(offset);
+            
+            if (this->cur_sector_ofs == 0 && size % SectorSize == 0) {
+                /* Fast case. */
+                return ProxyStorage::Read(buffer, size, offset);
+            }
+            
+            if (R_FAILED((rc = ProxyStorage::Read(this->sector_buf, SectorSize, this->cur_seek)))) {
+                return rc;
+            }
+            
+            if (size + this->cur_sector_ofs <= SectorSize) {
+                memcpy(buffer, sector_buf + this->cur_sector_ofs, size);
+            } else {
+                /* Leaving the sector... */
+                size_t ofs = SectorSize - this->cur_sector_ofs;
+                memcpy(buffer, sector_buf + this->cur_sector_ofs, ofs);
+                size -= ofs;
+                
+                /* We're guaranteed alignment, here. */
+                const size_t aligned_remaining_size = size - (size % SectorSize);
+                if (aligned_remaining_size) {
+                    if (R_FAILED((rc = ProxyStorage::Read(buffer + ofs, aligned_remaining_size, offset + ofs)))) {
+                        return rc;
+                    }
+                    ofs += aligned_remaining_size;
+                    size -= aligned_remaining_size;
+                }
+                
+                /* Read any leftover data. */
+                if (size) {
+                    if (R_FAILED((rc = ProxyStorage::Read(this->sector_buf, SectorSize, offset + ofs)))) {
+                        return rc;
+                    }
+                    memcpy(buffer + ofs, sector_buf, size);
+                }
+            }
+            
+            return rc;
+        };
+        virtual Result Write(void *_buffer, size_t size, u64 offset) override {
+            Result rc = 0;
+            u8 *buffer = static_cast<u8 *>(_buffer);
+            this->Seek(offset);
+            
+            if (this->cur_sector_ofs == 0 && size % SectorSize == 0) {
+                /* Fast case. */
+                return ProxyStorage::Write(buffer, size, offset);
+            }
+            
+            if (R_FAILED((rc = ProxyStorage::Read(this->sector_buf, SectorSize, this->cur_seek)))) {
+                return rc;
+            }
+            
+            
+            if (size + this->cur_sector_ofs <= SectorSize) {
+                memcpy(this->sector_buf + this->cur_sector_ofs, buffer, size);
+                rc = ProxyStorage::Write(this->sector_buf, SectorSize, this->cur_seek);
+            } else {
+                /* Leaving the sector... */
+                size_t ofs = SectorSize - this->cur_sector_ofs;
+                memcpy(this->sector_buf + this->cur_sector_ofs, buffer, ofs);
+                if (R_FAILED((rc = ProxyStorage::Write(this->sector_buf, ofs, this->cur_seek)))) {
+                    return rc;
+                }
+                size -= ofs;
+                
+                /* We're guaranteed alignment, here. */
+                const size_t aligned_remaining_size = size - (size % SectorSize);
+                if (aligned_remaining_size) {
+                    if (R_FAILED((rc = ProxyStorage::Write(buffer + ofs, aligned_remaining_size, offset + ofs)))) {
+                        return rc;
+                    }
+                    ofs += aligned_remaining_size;
+                    size -= aligned_remaining_size;
+                }
+                
+                /* Write any leftover data. */
+                if (size) {
+                    if (R_FAILED((rc = ProxyStorage::Read(this->sector_buf, SectorSize, offset + ofs)))) {
+                        return rc;
+                    }
+                    memcpy(this->sector_buf, buffer + ofs, size);
+                    rc = ProxyStorage::Write(this->sector_buf, SectorSize, this->cur_seek);
+                }
+            }     
+            
+            return rc;
+        };
+};
+
+/* Represents an RCM-preserving BOOT0 partition. */
+class Boot0Storage : public SectoredProxyStorage<0x200> {
+    using Base = SectoredProxyStorage<0x200>;
+    
+    public:
+        static constexpr u64 BctEndOffset = 0xFC000;
+        static constexpr u64 BctSize = 0x4000;
+        static constexpr u64 BctPubkStart = 0x210;
+        static constexpr u64 BctPubkSize = 0x100;
+        static constexpr u64 BctPubkEnd = BctPubkStart + BctPubkSize;
+        
+        static constexpr u64 EksStart = 0x180000;
+        static constexpr u64 EksSize = 0x4000;
+        static constexpr u64 EksEnd = EksStart + EksSize;
+    private:
+        u64 title_id;
+    private:
+        bool CanModifyBctPubks();
+    public:
+        Boot0Storage(FsStorage *s, u64 t) : Base(s), title_id(t) { }
+        Boot0Storage(FsStorage s, u64 t) : Base(s), title_id(t) { }
+    public:
+        virtual Result Read(void *_buffer, size_t size, u64 offset) override; 
+        virtual Result Write(void *_buffer, size_t size, u64 offset) override;
+};

stratosphere/fs_mitm/source/fsmitm_main.cpp

@@ -78,7 +78,7 @@ void __appExit(void) {
 
 struct FsMitmManagerOptions {
     static const size_t PointerBufferSize = 0x800;
-    static const size_t MaxDomains = 0x10;
+    static const size_t MaxDomains = 0x40;
     static const size_t MaxDomainObjects = 0x4000;
 };
 using FsMitmManager = WaitableManager<FsMitmManagerOptions>;
@@ -88,7 +88,7 @@ int main(int argc, char **argv)
     Thread sd_initializer_thread = {0};
     Thread hid_initializer_thread = {0};
     consoleDebugInit(debugDevice_SVC);
-        
+    
     if (R_FAILED(threadCreate(&sd_initializer_thread, &Utils::InitializeSdThreadFunc, NULL, 0x4000, 0x15, 0))) {
         /* TODO: Panic. */
     }

stratosphere/fs_mitm/source/fsmitm_romstorage.hpp

@@ -31,7 +31,7 @@ class RomFileStorage : public IROStorage {
         RomFileStorage(FsFile f) {
             this->base_file = new FsFile(f);
         };
-        ~RomFileStorage() {
+        virtual ~RomFileStorage() {
             fsFileClose(base_file);
             delete base_file;
         };
@@ -54,30 +54,4 @@ class RomFileStorage : public IROStorage {
 };
 
 /* Represents a RomFS accessed via some IStorage. */
-class RomInterfaceStorage : public IROStorage {
-    private:
-        FsStorage *base_storage;
-    public:
-        RomInterfaceStorage(FsStorage *s) : base_storage(s) {
-            /* ... */
-        };
-        RomInterfaceStorage(FsStorage s) {
-            this->base_storage = new FsStorage(s);
-        };
-        ~RomInterfaceStorage() {
-            fsStorageClose(base_storage);
-            delete base_storage;
-        };
-    public:
-        Result Read(void *buffer, size_t size, u64 offset) override {
-            return fsStorageRead(this->base_storage, offset, buffer, size);
-        };
-        Result GetSize(u64 *out_size) override {
-            /* TODO: Merge into libnx? */
-            return fsStorageGetSize(this->base_storage, out_size);
-        };
-        Result OperateRange(u32 operation_type, u64 offset, u64 size, FsRangeInfo *out_range_info) override {
-            /* TODO: Merge into libnx? */
-            return fsStorageOperateRange(this->base_storage, operation_type, offset, size, out_range_info);
-        };
-};
+using RomInterfaceStorage = ROProxyStorage;

stratosphere/fs_mitm/source/fsmitm_service.cpp

@@ -24,6 +24,7 @@
 #include "fs_shim.h"
 
 #include "fsmitm_utils.hpp"
+#include "fsmitm_boot0storage.hpp"
 #include "fsmitm_romstorage.hpp"
 #include "fsmitm_layeredrom.hpp"
 
@@ -79,12 +80,67 @@ void FsMitmService::PostProcess(IMitmServiceObject *obj, IpcResponseContext *ctx
     }
 }
 
+/* Gate access to the BIS partitions. */
+Result FsMitmService::OpenBisStorage(Out<std::shared_ptr<IStorageInterface>> out_storage, u32 bis_partition_id) {
+    std::shared_ptr<IStorageInterface> storage = nullptr;
+    u32 out_domain_id = 0;
+    Result rc = 0;
+    
+    ON_SCOPE_EXIT {
+        if (R_SUCCEEDED(rc)) {
+            out_storage.SetValue(std::move(storage));
+            if (out_storage.IsDomain()) {
+                out_storage.ChangeObjectId(out_domain_id);
+            }
+        }
+    };
+    
+    {
+        FsStorage bis_storage;
+        rc = fsOpenBisStorageFwd(this->forward_service.get(), &bis_storage, bis_partition_id);
+        if (R_SUCCEEDED(rc)) {
+            const bool is_sysmodule = this->title_id < 0x0100000000001000;
+            const bool has_bis_write_flag = Utils::HasFlag(this->title_id, "bis_write");
+            const bool has_cal0_read_flag = Utils::HasFlag(this->title_id, "cal_read");
+            if (bis_partition_id == BisStorageId_Boot0) {
+                storage = std::make_shared<IStorageInterface>(new Boot0Storage(bis_storage, this->title_id));
+            } else if (bis_partition_id == BisStorageId_Prodinfo) {
+                /* PRODINFO should *never* be writable. */
+                if (is_sysmodule || has_cal0_read_flag) {
+                    storage = std::make_shared<IStorageInterface>(new ROProxyStorage(bis_storage));
+                } else {
+                    /* Do not allow non-sysmodules to read *or* write CAL0. */
+                    fsStorageClose(&bis_storage);
+                    return 0x320002;
+                }
+            } else {
+                if (is_sysmodule || has_bis_write_flag) {
+                    /* Sysmodules should still be allowed to read and write. */
+                    storage = std::make_shared<IStorageInterface>(new ProxyStorage(bis_storage));
+                } else {
+                    /* Non-sysmodules should be allowed to read. */
+                    storage = std::make_shared<IStorageInterface>(new ROProxyStorage(bis_storage));
+                }
+            }
+            if (out_storage.IsDomain()) {
+                out_domain_id = bis_storage.s.object_id;
+            }
+        }
+    }
+    
+    return rc;
+}
+
 /* Add redirection for RomFS to the SD card. */
 Result FsMitmService::OpenDataStorageByCurrentProcess(Out<std::shared_ptr<IStorageInterface>> out_storage) {
     std::shared_ptr<IStorageInterface> storage = nullptr;
     u32 out_domain_id = 0;
     Result rc = 0;
     
+    if (!this->should_override_contents) {
+        return RESULT_FORWARD_TO_SESSION;
+    }
+    
     bool has_cache = StorageCacheGetEntry(this->title_id, &storage);
     
     ON_SCOPE_EXIT {
@@ -148,6 +204,10 @@ Result FsMitmService::OpenDataStorageByDataId(Out<std::shared_ptr<IStorageInterf
     FsStorageId storage_id = (FsStorageId)sid;
     FsStorage data_storage;
     FsFile data_file;
+    
+    if (!this->should_override_contents) {
+        return RESULT_FORWARD_TO_SESSION;
+    }
         
     std::shared_ptr<IStorageInterface> storage = nullptr;
     u32 out_domain_id = 0;

stratosphere/fs_mitm/source/fsmitm_service.hpp

@@ -22,33 +22,51 @@
 
 enum FspSrvCmd : u32 {
     FspSrvCmd_SetCurrentProcess = 1,
+    FspSrvCmd_OpenBisStorage = 12,
     FspSrvCmd_OpenDataStorageByCurrentProcess = 200,
     FspSrvCmd_OpenDataStorageByDataId = 202,
 };
 
-class FsMitmService : public IMitmServiceObject {      
+class FsMitmService : public IMitmServiceObject {
     private:
         bool has_initialized = false;
+        bool should_override_contents;
     public:
-        FsMitmService(std::shared_ptr<Service> s) : IMitmServiceObject(s) {
-            /* ... */
+        FsMitmService(std::shared_ptr<Service> s, u64 pid) : IMitmServiceObject(s, pid) {
+            if (Utils::HasSdDisableMitMFlag(this->title_id)) {
+                this->should_override_contents = false;
+            } else {
+                this->should_override_contents = (this->title_id >= 0x0100000000010000ULL || Utils::HasSdMitMFlag(this->title_id)) && Utils::HasOverrideButton(this->title_id);
+            }
         }
         
         static bool ShouldMitm(u64 pid, u64 tid) {
-            if (Utils::HasSdDisableMitMFlag(tid)) {
+            /* Don't Mitm KIPs */
+            if (pid < 0x50) {
                 return false;
             }
-            return (tid >= 0x0100000000010000ULL || Utils::HasSdMitMFlag(tid)) && Utils::HasOverrideButton(tid);
+            
+            static std::atomic_bool has_launched_qlaunch = false;
+
+            /* TODO: intercepting everything seems to cause issues with sleep mode, for some reason. */
+            /* Figure out why, and address it. */
+            if (tid == 0x0100000000001000ULL) {
+                has_launched_qlaunch = true;
+            }
+            
+            return has_launched_qlaunch || tid == 0x010000000000001FULL || tid >= 0x0100000000010000ULL || Utils::HasSdMitMFlag(tid);
         }
         
         static void PostProcess(IMitmServiceObject *obj, IpcResponseContext *ctx);
             
     protected:
         /* Overridden commands. */
+        Result OpenBisStorage(Out<std::shared_ptr<IStorageInterface>> out, u32 bis_partition_id);
         Result OpenDataStorageByCurrentProcess(Out<std::shared_ptr<IStorageInterface>> out);
         Result OpenDataStorageByDataId(Out<std::shared_ptr<IStorageInterface>> out, u64 data_id, u8 storage_id);
     public:
         DEFINE_SERVICE_DISPATCH_TABLE {
+            MakeServiceCommandMeta<FspSrvCmd_OpenBisStorage, &FsMitmService::OpenBisStorage>(),
             MakeServiceCommandMeta<FspSrvCmd_OpenDataStorageByCurrentProcess, &FsMitmService::OpenDataStorageByCurrentProcess>(),
             MakeServiceCommandMeta<FspSrvCmd_OpenDataStorageByDataId, &FsMitmService::OpenDataStorageByDataId>(),
         };

stratosphere/fs_mitm/source/fsmitm_utils.cpp

@@ -23,6 +23,7 @@
 #include "debug.hpp"
 #include "fsmitm_utils.hpp"
 #include "ini.h"
+#include "sha256.h"
 
 static FsFileSystem g_sd_filesystem = {0};
 static std::vector<u64> g_mitm_flagged_tids;
@@ -31,11 +32,18 @@ static std::atomic_bool g_has_initialized = false;
 static std::atomic_bool g_has_hid_session = false;
 
 static u64 g_override_key_combination = KEY_R;
+static u64 g_override_hbl_tid = 0x010000000000100DULL;
 static bool g_override_by_default = true;
 
 /* Static buffer for loader.ini contents at runtime. */
 static char g_config_ini_data[0x800];
 
+/* Backup file for CAL0 partition. */
+static constexpr size_t ProdinfoSize = 0x8000;
+static FsFile g_cal0_file = {0};
+static u8 g_cal0_storage_backup[ProdinfoSize];
+static u8 g_cal0_backup[ProdinfoSize];
+
 static bool IsHexadecimal(const char *str) {
     while (*str) {
         if (isxdigit(*str)) {
@@ -64,6 +72,60 @@ void Utils::InitializeSdThreadFunc(void *args) {
         svcSleepThread(1000ULL);
     }
     
+    /* Back up CAL0, if it's not backed up already. */
+    fsFsCreateDirectory(&g_sd_filesystem, "/atmosphere/automatic_backups");
+    {
+        FsStorage cal0_storage;
+        if (R_FAILED(fsOpenBisStorage(&cal0_storage, BisStorageId_Prodinfo)) || R_FAILED(fsStorageRead(&cal0_storage, 0, g_cal0_storage_backup, ProdinfoSize))) {
+            std::abort();
+        }
+        fsStorageClose(&cal0_storage);
+        
+        char serial_number[0x40] = {0};
+        memcpy(serial_number, g_cal0_storage_backup + 0x250, 0x18);
+        
+        
+        char prodinfo_backup_path[FS_MAX_PATH] = {0};
+        if (strlen(serial_number) > 0) {
+            snprintf(prodinfo_backup_path, sizeof(prodinfo_backup_path) - 1, "/atmosphere/automatic_backups/%s_PRODINFO.bin", serial_number);
+        } else {
+            snprintf(prodinfo_backup_path, sizeof(prodinfo_backup_path) - 1, "/atmosphere/automatic_backups/PRODINFO.bin");
+        }
+        
+        fsFsCreateFile(&g_sd_filesystem, prodinfo_backup_path, ProdinfoSize, 0);
+        if (R_SUCCEEDED(fsFsOpenFile(&g_sd_filesystem, prodinfo_backup_path, FS_OPEN_READ | FS_OPEN_WRITE, &g_cal0_file))) {
+            bool has_auto_backup = false;
+            size_t read = 0;
+            if (R_SUCCEEDED(fsFileRead(&g_cal0_file, 0, g_cal0_backup, sizeof(g_cal0_backup), &read)) && read == sizeof(g_cal0_backup)) {
+                bool is_cal0_valid = true;
+                is_cal0_valid &= memcmp(g_cal0_backup, "CAL0", 4) == 0;
+                is_cal0_valid &= memcmp(g_cal0_backup + 0x250, serial_number, 0x18) == 0;
+                u32 cal0_size = ((u32 *)g_cal0_backup)[2];
+                is_cal0_valid &= cal0_size + 0x40 <= ProdinfoSize;
+                if (is_cal0_valid) {
+                    struct sha256_state sha_ctx;
+                    u8 calc_hash[0x20];
+                    sha256_init(&sha_ctx);
+                    sha256_update(&sha_ctx, g_cal0_backup + 0x40, cal0_size);
+                    sha256_finalize(&sha_ctx);
+                    sha256_finish(&sha_ctx, calc_hash);
+                    is_cal0_valid &= memcmp(calc_hash, g_cal0_backup + 0x20, sizeof(calc_hash)) == 0;
+                }
+                has_auto_backup = is_cal0_valid;
+            }
+            
+            if (!has_auto_backup) {
+                fsFileSetSize(&g_cal0_file, ProdinfoSize);
+                fsFileWrite(&g_cal0_file, 0, g_cal0_backup, ProdinfoSize);
+                fsFileFlush(&g_cal0_file);
+            }
+            
+            /* NOTE: g_cal0_file is intentionally not closed here. This prevents any other process from opening it. */
+            memset(g_cal0_storage_backup, 0, sizeof(g_cal0_storage_backup));
+            memset(g_cal0_backup, 0, sizeof(g_cal0_backup));
+        }
+    }
+    
     /* Check for MitM flags. */
     FsDir titles_dir;
     if (R_SUCCEEDED(fsFsOpenDirectory(&g_sd_filesystem, "/atmosphere/titles", FS_DIROPEN_DIRECTORY, &titles_dir))) {
@@ -76,19 +138,39 @@ void Utils::InitializeSdThreadFunc(void *args) {
                 char title_path[FS_MAX_PATH] = {0};
                 strcpy(title_path, "/atmosphere/titles/");
                 strcat(title_path, dir_entry.name);
-                strcat(title_path, "/fsmitm.flag");
+                strcat(title_path, "/flags/fsmitm.flag");
                 if (R_SUCCEEDED(fsFsOpenFile(&g_sd_filesystem, title_path, FS_OPEN_READ, &f))) {
                     g_mitm_flagged_tids.push_back(title_id);
                     fsFileClose(&f);
+                } else {
+                    /* TODO: Deprecate. */
+                    memset(title_path, 0, sizeof(title_path));
+                    strcpy(title_path, "/atmosphere/titles/");
+                    strcat(title_path, dir_entry.name);
+                    strcat(title_path, "/fsmitm.flag");
+                    if (R_SUCCEEDED(fsFsOpenFile(&g_sd_filesystem, title_path, FS_OPEN_READ, &f))) {
+                        g_mitm_flagged_tids.push_back(title_id);
+                        fsFileClose(&f);
+                    }
                 }
                 
                 memset(title_path, 0, sizeof(title_path));
                 strcpy(title_path, "/atmosphere/titles/");
                 strcat(title_path, dir_entry.name);
-                strcat(title_path, "/fsmitm_disable.flag");
+                strcat(title_path, "/flags/fsmitm_disable.flag");
                 if (R_SUCCEEDED(fsFsOpenFile(&g_sd_filesystem, title_path, FS_OPEN_READ, &f))) {
                     g_disable_mitm_flagged_tids.push_back(title_id);
                     fsFileClose(&f);
+                } else {
+                    /* TODO: Deprecate. */
+                    memset(title_path, 0, sizeof(title_path));
+                    strcpy(title_path, "/atmosphere/titles/");
+                    strcat(title_path, dir_entry.name);
+                    strcat(title_path, "/fsmitm_disable.flag");
+                    if (R_SUCCEEDED(fsFsOpenFile(&g_sd_filesystem, title_path, FS_OPEN_READ, &f))) {
+                        g_disable_mitm_flagged_tids.push_back(title_id);
+                        fsFileClose(&f);
+                    }
                 }
             }
         }
@@ -264,7 +346,56 @@ Result Utils::SaveSdFileForAtmosphere(u64 title_id, const char *fn, void *data,
     return rc;
 }
 
+bool Utils::HasTitleFlag(u64 tid, const char *flag) {
+    if (IsSdInitialized()) {
+        FsFile f;
+        char flag_path[FS_MAX_PATH];
+        
+        memset(flag_path, 0, sizeof(flag_path));
+        snprintf(flag_path, sizeof(flag_path) - 1, "flags/%s.flag", flag);
+        if (OpenSdFileForAtmosphere(tid, flag_path, FS_OPEN_READ, &f)) {
+            fsFileClose(&f);
+            return true;
+        }
+        
+        /* TODO: Deprecate. */
+        snprintf(flag_path, sizeof(flag_path) - 1, "%s.flag", flag);
+        if (OpenSdFileForAtmosphere(tid, flag_path, FS_OPEN_READ, &f)) {
+            fsFileClose(&f);
+            return true;
+        }
+    }
+    return false;
+}
+
+bool Utils::HasGlobalFlag(const char *flag) {
+    if (IsSdInitialized()) {
+        FsFile f;
+        char flag_path[FS_MAX_PATH] = {0};
+        snprintf(flag_path, sizeof(flag_path), "/atmosphere/flags/%s.flag", flag);
+        if (fsFsOpenFile(&g_sd_filesystem, flag_path, FS_OPEN_READ, &f)) {
+            fsFileClose(&f);
+            return true;
+        }
+    }
+    return false;
+}
+
+bool Utils::HasHblFlag(const char *flag) {
+    char hbl_flag[FS_MAX_PATH] = {0};
+    snprintf(hbl_flag, sizeof(hbl_flag), "hbl_%s", flag);
+    return HasGlobalFlag(hbl_flag);
+}
+
+bool Utils::HasFlag(u64 tid, const char *flag) {
+    return HasTitleFlag(tid, flag) || (tid == g_override_hbl_tid && HasHblFlag(flag));
+}
+
 bool Utils::HasSdMitMFlag(u64 tid) {
+    if (tid == g_override_hbl_tid) {
+        return true;
+    }
+    
     if (IsSdInitialized()) {
         return std::find(g_mitm_flagged_tids.begin(), g_mitm_flagged_tids.end(), tid) != g_mitm_flagged_tids.end();
     }
@@ -306,7 +437,12 @@ bool Utils::HasOverrideButton(u64 tid) {
 static int FsMitMIniHandler(void *user, const char *section, const char *name, const char *value) {
     /* Taken and modified, with love, from Rajkosto's implementation. */
     if (strcasecmp(section, "config") == 0) {
-        if (strcasecmp(name, "override_key") == 0) {
+        if (strcasecmp(name, "hbl_tid") == 0) {
+            u64 override_tid = strtoul(value, NULL, 16);
+            if (override_tid != 0) {
+                g_override_hbl_tid = override_tid;
+            }
+        } else if (strcasecmp(name, "override_key") == 0) {
             if (value[0] == '!') {
                 g_override_by_default = true;
                 value++;