meso: KProcess: add ForEachThread

creport: Add 32 bits stack frames parsing support

.github/ISSUE_TEMPLATE/bug_report.md

@@ -43,7 +43,7 @@ X.X.X</br>
 
 - What bootloader (fusèe, hekate, etc) was Atmosphère launched by:
 - Official release or unofficial build: 
-  - [ Offical release version x.x.x (or) unofficial build ]
+  - [ Official release version x.x.x (or) unofficial build ]
   - [ If using an unofficial build, include details on where/how you acquired the build. ] 
      - [ Ex: Self-compilation ]
      - [ Ex: Kosmos' distribution of Atmosphère ]

.gitignore

@@ -70,13 +70,19 @@ dkms.conf
 *.id1
 *.id2
 *.idb
+*.i64
 *.nam
 *.til
 
+# KEYS file for sept-secondary.
+*.pyc
+sept/sept-secondary/KEYS.py
+
 .**/
 
 # NOTE: make sure to make exceptions to this pattern when needed!
 *.bin
+*.enc
 
 **/out
 **/build

Makefile

@@ -1,12 +1,15 @@
 TOPTARGETS := all clean dist
 AMSBRANCH := $(shell git symbolic-ref --short HEAD)
-AMSREV := $(AMSBRANCH)-$(shell git rev-parse --short HEAD)
+AMSHASH := $(shell git rev-parse --short HEAD)
+AMSREV := $(AMSBRANCH)-$(AMSHASH)
 
 ifneq (, $(strip $(shell git status --porcelain 2>/dev/null)))
     AMSREV := $(AMSREV)-dirty
 endif
 
-all: fusee stratosphere exosphere thermosphere troposphere
+COMPONENTS := fusee stratosphere exosphere thermosphere troposphere
+
+all: $(COMPONENTS)
 
 thermosphere:
 	$(MAKE) -C thermosphere all
@@ -20,13 +23,16 @@ stratosphere: exosphere
 troposphere: stratosphere
 	$(MAKE) -C troposphere all
 
-fusee: exosphere stratosphere
+sept: exosphere
+	$(MAKE) -C sept all
+
+fusee: exosphere stratosphere sept
 	$(MAKE) -C $@ all
 
 clean:
 	$(MAKE) -C fusee clean
 	rm -rf out
-    
+
 dist: all
 	$(eval MAJORVER = $(shell grep '\ATMOSPHERE_RELEASE_VERSION_MAJOR\b' common/include/atmosphere/version.h \
 		| tr -s [:blank:] \
@@ -42,27 +48,40 @@ dist: all
 	rm -rf out
 	mkdir atmosphere-$(AMSVER)
 	mkdir atmosphere-$(AMSVER)/atmosphere
+	mkdir atmosphere-$(AMSVER)/sept
 	mkdir atmosphere-$(AMSVER)/switch
-	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000036
-	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000034
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/010000000000000D
 	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000034
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000036
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000037
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/fatal_errors
 	cp fusee/fusee-primary/fusee-primary.bin atmosphere-$(AMSVER)/atmosphere/reboot_payload.bin
 	cp fusee/fusee-secondary/fusee-secondary.bin atmosphere-$(AMSVER)/atmosphere/fusee-secondary.bin
+	cp fusee/fusee-secondary/fusee-secondary.bin atmosphere-$(AMSVER)/sept/payload.bin
+	cp sept/sept-primary/sept-primary.bin atmosphere-$(AMSVER)/sept/sept-primary.bin
+	cp sept/sept-secondary/sept-secondary.bin atmosphere-$(AMSVER)/sept/sept-secondary.bin
+	cp sept/sept-secondary/sept-secondary.enc atmosphere-$(AMSVER)/sept/sept-secondary.enc
 	cp common/defaults/BCT.ini atmosphere-$(AMSVER)/atmosphere/BCT.ini
 	cp common/defaults/loader.ini atmosphere-$(AMSVER)/atmosphere/loader.ini
 	cp common/defaults/system_settings.ini atmosphere-$(AMSVER)/atmosphere/system_settings.ini
 	cp -r common/defaults/kip_patches atmosphere-$(AMSVER)/atmosphere/kip_patches
-	cp stratosphere/creport/creport.nsp atmosphere-$(AMSVER)/atmosphere/titles/0100000000000036/exefs.nsp
+	cp -r common/defaults/hbl_html atmosphere-$(AMSVER)/atmosphere/hbl_html
+	cp stratosphere/dmnt/dmnt.nsp atmosphere-$(AMSVER)/atmosphere/titles/010000000000000D/exefs.nsp
+	cp stratosphere/eclct.stub/eclct.stub.nsp atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032/exefs.nsp
 	cp stratosphere/fatal/fatal.nsp atmosphere-$(AMSVER)/atmosphere/titles/0100000000000034/exefs.nsp
-	cp stratosphere/set_mitm/set_mitm.nsp atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032/exefs.nsp
-	cp troposphere/reboot_to_payload/reboot_to_payload.nro atmosphere-$(AMSVER)/switch/reboot_to_payload.nro
+	cp stratosphere/creport/creport.nsp atmosphere-$(AMSVER)/atmosphere/titles/0100000000000036/exefs.nsp
+	cp stratosphere/ro/ro.nsp atmosphere-$(AMSVER)/atmosphere/titles/0100000000000037/exefs.nsp
 	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032/flags
 	touch atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032/flags/boot2.flag
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000037/flags
+	touch atmosphere-$(AMSVER)/atmosphere/titles/0100000000000037/flags/boot2.flag
+	cp troposphere/reboot_to_payload/reboot_to_payload.nro atmosphere-$(AMSVER)/switch/reboot_to_payload.nro
 	cd atmosphere-$(AMSVER); zip -r ../atmosphere-$(AMSVER).zip ./*; cd ../;
 	rm -r atmosphere-$(AMSVER)
 	mkdir out
 	mv atmosphere-$(AMSVER).zip out/atmosphere-$(AMSVER).zip
 	cp fusee/fusee-primary/fusee-primary.bin out/fusee-primary.bin
-   
 
-.PHONY: $(TOPTARGETS) fusee
+
+.PHONY: $(TOPTARGETS) $(COMPONENTS)

README.md

@@ -13,11 +13,22 @@ Components
 Atmosphère consists of multiple components, each of which replaces/modifies a different component of the system:
 
 * Fusée: First-stage Loader, responsible for loading and validating stage 2 (custom TrustZone) plus package2 (Kernel/FIRM sysmodules), and patching them as needed. This replaces all functionality normally in Package1loader/NX Bootloader.
+    * Sept: Payload used to enable support for runtime key derivation on 7.0.0.
 * Exosphère: Customized TrustZone, to run a customized Secure Monitor
 * Thermosphère: EL2 EmuNAND support, i.e. backing up and using virtualized/redirected NAND images
 * Stratosphère: Custom Sysmodule(s), both Rosalina style to extend the kernel/provide new features, and of the loader reimplementation style to hook important system actions
 * Troposphère: Application-level Horizon OS patches, used to implement desirable CFW features
 
+Licensing
+=====
+
+This software is licensed under the terms of the GPLv2, with exemptions for specific projects noted below.
+
+You can find a copy of the license in the [LICENSE file](LICENSE).
+
+Exemptions:
+* The [yuzu emulator project](https://github.com/yuzu-emu/yuzu) is exempt from GPLv2 licensing and may (at its option) instead license any source code authored for the Atmosphère project as GPLv2 or later.
+
 Credits
 =====
 
@@ -26,7 +37,7 @@ In no particular order, we credit the following for their invaluable contributio
 
 * __switchbrew__ for the [libnx](https://github.com/switchbrew/libnx) project and the extensive [documentation, research and tool development](http://switchbrew.org) pertaining to the Nintendo Switch.
 * __devkitPro__ for the [devkitA64](https://devkitpro.org/) toolchain and libnx support.
-* __ReSwitched Team__ for additional [documentation, research and tool development](https://reswitched.tech/) pertaining to the Nintendo Switch.
+* __ReSwitched Team__ for additional [documentation, research and tool development](https://reswitched.team/) pertaining to the Nintendo Switch.
 * __ChaN__ for the [FatFs](http://elm-chan.org/fsw/ff/00index_e.html) module.
 * __Marcus Geelnard__ for the [bcl-1.2.0](https://sourceforge.net/projects/bcl/files/bcl/bcl-1.2.0) library.
 * __naehrwert__ and __st4rk__ for the original [hekate](https://github.com/nwert/hekate) project and its hwinit code base.

common/defaults/BCT.ini

@@ -8,6 +8,9 @@ stage2_entrypoint = 0xF0000000
 ; Note: Disabling debugmode will cause parts of ams.tma to not work, in the future.
 debugmode = 1 
 debugmode_user = 0
+; Note: Disabling usermode exception handlers will cause atmosphere to not fail gracefully under error conditions.
+; Support will not be provided to users who disable these. If you do not know what you are doing, leave them on.
+disable_user_exception_handlers = 0
 
 [stratosphere]
 ; To force-enable nogc, add nogc = 1

common/defaults/hbl_html/accessible-urls/accessible-urls.txt

@@ -0,0 +1 @@
+^http*

common/defaults/loader.ini

@@ -1,4 +1,9 @@
-[config]
-hbl_tid=010000000000100D
-hbl_path=atmosphere/hbl.nsp
-override_key=!R
+[hbl_config]
+title_id=010000000000100D
+override_any_app=true
+path=atmosphere/hbl.nsp
+override_key=R
+
+[default_config]
+override_key=!L
+cheat_enable_key=!L

common/defaults/system_settings.ini

@@ -3,4 +3,29 @@
 upload_enabled = u8!0x0
 ; Enable USB 3.0 superspeed for homebrew
 [usb]
-usb30_force_enabled = u8!0x1
+usb30_force_enabled = u8!0x0
+; Control whether RO should ease its validation of NROs.
+; (note: this is normally not necessary, and ips patches can be used.)
+[ro]
+ease_nro_restriction = u8!0x0
+; Atmosphere custom settings
+[atmosphere]
+; Reboot from fatal automatically after some number of milliseconds.
+; If field is not present or 0, fatal will wait indefinitely for user input.
+fatal_auto_reboot_interval = u64!0x0
+; Make the power menu's "reboot" button reboot to payload.
+; Set to "normal" for normal reboot, "rcm" for rcm reboot.
+power_menu_reboot_function = str!payload
+; Controls whether dmnt cheats should be toggled on or off by 
+; default. 1 = toggled on by default, 0 = toggled off by default.
+dmnt_cheats_enabled_by_default = u8!0x1
+; Controls whether dmnt should always save cheat toggle state
+; for restoration on new game launch. 1 = always save toggles,
+; 0 = only save toggles if toggle file exists.
+dmnt_always_save_cheat_toggles = u8!0x0
+; Controls whether fs.mitm should redirect save files
+; to directories on the sd card.
+; 0 = Do not redirect, 1 = Redirect.
+; NOTE: EXPERIMENTAL
+; If you do not know what you are doing, do not touch this yet.
+fsmitm_redirect_saves_to_sd = u8!0x0

common/include/atmosphere.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

common/include/atmosphere/target_fw.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -24,11 +24,13 @@
 #define ATMOSPHERE_TARGET_FIRMWARE_500 5
 #define ATMOSPHERE_TARGET_FIRMWARE_600 6
 #define ATMOSPHERE_TARGET_FIRMWARE_620 7
+#define ATMOSPHERE_TARGET_FIRMWARE_700 8
+#define ATMOSPHERE_TARGET_FIRMWARE_800 9
 
-#define ATMOSPHERE_TARGET_FIRMWARE_CURRENT ATMOSPHERE_TARGET_FIRMWARE_620
+#define ATMOSPHERE_TARGET_FIRMWARE_CURRENT ATMOSPHERE_TARGET_FIRMWARE_800
 
 #define ATMOSPHERE_TARGET_FIRMWARE_MIN ATMOSPHERE_TARGET_FIRMWARE_100
-#define ATMOSPHERE_TARGET_FIRMWARE_MAX ATMOSPHERE_TARGET_FIRMWARE_620
+#define ATMOSPHERE_TARGET_FIRMWARE_MAX ATMOSPHERE_TARGET_FIRMWARE_800
 
 /* TODO: What should this be, for release? */
 #define ATMOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG ATMOSPHERE_TARGET_FIRMWARE_CURRENT

common/include/atmosphere/version.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -19,6 +19,10 @@
 
 #define ATMOSPHERE_RELEASE_VERSION_MAJOR    0
 #define ATMOSPHERE_RELEASE_VERSION_MINOR    8
-#define ATMOSPHERE_RELEASE_VERSION_MICRO    3
+#define ATMOSPHERE_RELEASE_VERSION_MICRO    10
+
+#define ATMOSPHERE_SUPPORTED_HOS_VERSION_MAJOR 8
+#define ATMOSPHERE_SUPPORTED_HOS_VERSION_MINOR 0
+#define ATMOSPHERE_SUPPORTED_HOS_VERSION_MICRO 1
 
 #endif

docs/building.md

@@ -1,6 +1,8 @@
 # Building Atmosphère
 The process for building Atmosphère is similar to building Fusée Gelée payloads and other Switch apps.
 
-In order to build Atmosphère you must have devkitARM and devkitA64 installed on your computer. You can find instructions on how to install and setup devkitARM and devkitA64 on various OSes [here](https://devkitpro.org/wiki/Getting_Started).
+In order to build Atmosphère you must have devkitARM and devkitA64 installed on your computer. You can find instructions on how to install and setup devkitARM and devkitA64 on various OSes [here](https://devkitpro.org/wiki/Getting_Started). You'll need to install the following packages via (dkp-)pacman: switch-dev switch-freetype devkitARM devkitarm-rules
 
-Once you have finished installing devkitARM and devkitA64, simply clone the Atmosphère repo, change to it and run `make`.
+sept requires you have python installed with the pycrypto and pycryptodome PyPi packages (pip install pycrypto pycryptodome). You may also want to install the zip package from your package manager of choice to support the `make dist` recipe.
+
+Once you have finished installing the devkitPro-provided toolchain/libraries, python, and the dependencies, simply clone the Atmosphère repo (clone with the -r flag), change your directory to it and run `make`.

docs/changelog.md

@@ -1,4 +1,140 @@
 # Changelog
+## 0.8.10
++ A bug was fixed that could cause incorrect system memory allocation on 5.0.0.
+  + 5.0.0 should now correctly have an additional 12 MiB allocated for sysmodules.
++ Atmosphère features which check button presses now consider all controllers, isntead of just P1.
++ Support was added for configuring language/region on a per-game basis.
+  + This is managed by editing `atmosphere/titles/<title id>/config.ini` for the game.
+  + To edit title language, edit `override_config!override_language`.
+    + The languages supported are `ja`, `en-US`, `fr`, `de`, `it`, `es`, `zh-CN`, `ko`, `nl`, `pt`, `ru`, `zh-TW`, `en-GB`, `fr-CA`, `es-419`, `zh-Hans`, `zh-Hant`.
+  + To edit title region, edit `override_config!override_region`.
+    + The regions supported are `jpn`, `usa`, `eur`, `aus`, `chn`, `kor`, `twn`.
++ Atmosphère now provides a reimplementation of the `boot` system module.
+  + `boot` is responsible for performing hardware initialization, showing the Nintendo logo, and repairing NAND on system update failure.
+  + Atmosphère's `boot` implementation preserves AutoRCM during NAND repair.
+    + NAND repair occurs when an unexpected shutdown or error happens during a system update.
+    + This fixes a final edge case where AutoRCM might be removed by HOS, which could cause a user to burn fuses.
++ General system stability improvements to enhance the user's experience.
+## 0.8.9
++ A number of bugs were fixed, including:
+  + A data abort was fixed when mounting certain partitions on NAND.
+  + All Stratosphère system modules now only maintain a connection to `sm` when actively using it.
+    + This helps mitigate the scenario where sm hits the limit of 64 active connections and crashes.
+    + This sometimes caused crashes when custom non-Atmosphère sysmodules were active and the user played certain games (ex: Smash's Stage Builder).
+  + fatal now uses the 8.0.0 clkrst API, instead of silently failing to adjust clock rates on that firmware version.
+  + A wait loop is now performed when trying to get a session to `sm`, in the case where `sm:` is not yet registered.
+    + This fixes a race condition that could cause a failure to boot under certain circumstances.
+  + libstratosphere's handling of domain object closing has been improved.
+    + Previously, this code could cause crashes/extremely odd behavior (misinterpreting what object a service is) under certain circumstances.
++ An optional automatic reboot timer was added to fatal.
+  + By setting the system setting `atmosphere!fatal_auto_reboot_interval` to a non-zero u64 value, fatal can be made to automatically reboot after a certain number of milliseconds.
+  + If the setting is zero or not present, fatal will wait for user input as usual.
++ Atmosphère now provides a reimplementation of the `ro` system module.
+  + `ro` is responsible for loading dynamic libraries (NROs) on 3.0.0+.
+    + On 1.0.0-2.3.0, this is handled by `loader`.
+  + Atmosphere's `ro` provides this functionality (`ldr:ro`, `ro:dmnt`) on all firmware versions.
+  + An extension was implemented to provide support for applying IPS patches to NROs.
+    + All patches at paths like /atmosphere/nro_patches/<user-defined patch name>/<Hex Build-ID for NRO to patch>.ips will be applied, allowing for easy distribution of patches.
+    + Both the IPS and IPS32 formats are supported.
++ Atmosphère now provides a reimplementation of the `spl` system module.
+  + `spl` (Secure Platform Services) is responsible for cryptographic operations, including all communications with the secure monitor (exosphère).
+  + In the future, this may be used to provide extensions to the API for interacting with exosphère from userland.
++ General system stability improvements to enhance the user's experience.
+## 0.8.8
++ Support was added for firmware version 8.0.0.
++ Custom exception handlers were added to stratosphere modules.
+  + If a crash happens in a core atmosphere module now, instead of silently failing a reboot will occur to log the information to the SD card.
++ A bug was fixed in creport that caused games to hang when crashing under certain circumstances.
++ A bug was fixed that prevented maintenance mode from booting on 7.0.0+.
++ General system stability improvements to enhance the user's experience.
+## 0.8.7
++ A few bugs were fixed that could cause fatal to fail to show an error under certain circumstances.
++ A bug was fixed that caused an error when launching certain games (e.g. Hellblade: Senua's Sacrifice).
+  + Loader had support added in ams-0.8.4 for a new (7.0.0+) flag bit in NPDMs during process creation, but forgot to allow this bit to be set when validating the NPDM.
++ dmnt's cheat virtual machine received new instructions.
+  + These allow for saving, restoring, or clearing registers to a secondary bank, effectively doubling the number of values that can be stored.
++ SHA256 code has been swapped from linux code to libnx's new hw-accelerated cryptography API.
++ Extensions were added to smcGetInfo:
+  + A ConfigItem was added to detect whether the current unit has the RCM bug patched.
+  + A ConfigItem was added to retrieve the current Atmosphère build hash.
++ Exosphère now tells the kernel to enable user-mode exception handlers, which should allow for better crash reporting/detection from Atmosphère's modules in the future..
++ Opt-in support was added for redirecting game save files to directories on the SD card.
+  + Please note, this feature is **experimental**, and may cause problems. Please use at your own risk (and back up your saves before enabling it), as it still needs testing.
+  + This can be enabled by setting `atmosphere!fsmitm_redirect_saves_to_sd` to 1 in `system_settings.ini`.
++ General system stability improvements to enhance the user's experience.
+## 0.8.6
++ A number of bugs were fixed, including:
+  + A case of inverted logic was fixed in fs.mitm which prevented the flags system from working correctly.
+  + Time service access was corrected in both creport/fatal.
+    + This fixes the timestamps used in fatal/crash report filenames.
+  + A coherency issue was fixed in exosphère's Security Engine driver.
+    + This fixes some instability issues encountered when overclocking the CPU.
+  + Loader now unmaps NROs correctly, when ldr:ro is used.
+    + This fixes a crash when repeatedly launching the web applet on < 3.0.0.
+  + Usage of hidKeysDown was corrected to hidKeysHeld in several modules.
+    + This fixes a rare issue where keypresses may have been incorrectly detected.
+  + An issue with code filesystem unmounting was fixed in loader.
+    + This issue could occasionally cause a fatal error 0x1015 to be thrown on boot.
+  + Two bugs were fixed in the implementations of dmnt's cheat virtual machine.
+    + These could cause cheats to work incorrectly under certain circumstances.
+  + PM now uses a static buffer instead of a dynamically allocated one during process launch.
+    + This fixes a memory exhaustion problem when building with gcc 8.3.0.
+  + A workaround for a deadlock bug in Horizon's kernel on >= 6.0.0 was added in dmnt.
+    + This prevents a system hang when booting certain titles with cheats enabled (ex: Mario Kart 8 Deluxe).
+  + set.mitm now reads the system firmware version directly from the system version archive, instead of calling into set:sys.
+    + This fixes compatibility with 1.0.0, which now successfully boots again.
++ dmnt's cheat virtual machine had some instruction set changes.
+  + A new opcode was added for beginning conditional blocks based on register contents.
+  + More addressing modes were added to the StoreRegisterToAddress opcode.
+  + These should allow for more complex cheats to be implemented.
++ A new system for saving the state of cheat toggles between game boots was added.
+  + Toggles are now saved to `atmosphere/titles/<title id>/cheats/toggles.txt` when either toggles were successfully loaded from that file or the system setting `atmosphere!dmnt_always_save_cheat_toggles` is non-zero.
+  + This removes the need for manually setting cheats from all-on or all-off to the desired state on each game boot.
++ The default behavior for loader's HBL support was changed.
+  + Instead of launching HBL when album is launched without R held, loader now launches HBL when album or any game is launched with R held.
+  + Loader will now override any app in addition to a specific title id when `hbl_config!override_any_app` is true in `loader.ini`.
+    + Accordingly, the `hbl_config!title_id=app` setting was deprecated. Support will be removed in Atmosphère 0.9.0.
++ First-class support was added to loader and fs.mitm for enabling homebrew to launch web applets.
+  + Loader will now cause the "HtmlDocument" NCA path to resolve for whatever title HBL is taking over, even if it would not normally do so.
+  + fs.mitm will also now cause requests to mount the HtmlDocument content for HBL's title to open the `sdmc:/atmosphere/hbl_html` folder.
+    + By default, this just contains a URL whitelist.
++ General system stability improvements to enhance the user's experience.
+## 0.8.5
++ Support was added for overriding content on a per-title basis, separate from HBL override.
+  + This allows for using mods on the same title that one uses to launch HBL.
+  + By default, `!L` is used for title content override (this is configurable by editing `default_config!override_key` in `loader.ini`)
+  + This key combination can be set on a per-title basis by creating a `atmosphere/titles/<title id>/config.ini`, and editing `override_config!override_key`.
++ Content headers were added for the embedded files inside of fusee-secondary.
+  + This will allow non-fusee bootloaders (like `hekate`) to extract the components bundled inside release binaries.
+  + This should greatly simplify the update process in the future, for users who do not launch Atmosphère using fusee.
++ Support for cheat codes was added.
+  + These are handled by a new `dmnt` sysmodule, which will also reimplement Nintendo's Debug Monitor in the future.
+  + Cheat codes can be enabled/disabled at application launch via a per-title key combination. 
+    + For details, please see the [cheat loading documentation](https://github.com/Atmosphere-NX/Atmosphere/blob/master/docs/cheats.md#cheat-loating-process).
+  + Cheat codes are fully backwards compatible with the pre-existing format, although a number of bugs have been fixed and some new features have been added.
+    + For details, please see [the compatibility documentation](https://github.com/Atmosphere-NX/Atmosphere/blob/master/docs/cheats.md#cheat-code-compatibility).
+  + An HIPC service API was added (`dmnt:cht`), that will allow user homebrew to interface with and control Atmosphère's cheat manager.
+    + Please see [the relevant documentation](https://github.com/Atmosphere-NX/Atmosphere/blob/master/docs/modules/dmnt.md).
+    + Full client code can be found in [libstratosphere](https://github.com/Atmosphere-NX/libstratosphere/blob/master/include/stratosphere/services/dmntcht.h).
+    + Users interested in interfacing should see [EdiZon](https://github.com/WerWolv/EdiZon), which should have support for interfacing with Atmosphère's API shortly after 0.8.5 releases.
++ A bug was fixed that would cause Atmosphère's fatal screen to not show on 1.0.0-2.3.0.
++ A bug was fixed that caused Atmosphère's automatic ProdInfo backups to be corrupt.
++ General system stability improvements to enhance the user's experience.
+## 0.8.4
++ Support for 7.0.0/7.0.1 was added.
+  + This is facilitated through a new payload, `sept`, which can be signed, encrypted, and then loaded by Nintendo's TSEC firmware.
+  + `sept` will derive the keys needed to boot new firmware, and then load `sept/payload.bin` off the SD card and jump to it.
++ Recognition of applications for override/mitm has been improved.
+  + Nintendo's official Title ID range (`0x0100000000000000`-`0x01FFFFFFFFFFFFFF`) is now enforced.
++ A deadlock condition was fixed involving libstratosphere mitm sysmodules.
++ Kernel patches for JIT support were added (Thanks, @m4xw!).
+  + These loosen restrictions on caller process in svcControlCodeMemory.
++ `set.mitm` and `fs.mitm` were merged into a single `ams_mitm` sysmodule.
+  + This saves a process ID, allowing users to run one additional process up to the 0x40 process limit.
++ A `bpc.mitm` component was added, performing custom behavior on shutdown/reboot requests from `am` or applications.
+  + Performing a reboot from the reboot menu now reboots to atmosphere. This can be configured via `system_settings.ini`.
+  + Performing a shutdown from the reboot menu now works properly with AutoRCM, and does a real shutdown.
++ General system stability improvements to enhance the user's experience.
 ## 0.8.3
 + A custom warmboot firmware was implemented, which does not perform anti-downgrade fuse checks.
   + This fixes sleep mode when using a downgraded NAND.

docs/cheats.md

@@ -0,0 +1,365 @@
+# Cheats
+Atmosphère supports Action-Replay style cheat codes, with cheats loaded off of the SD card.
+
+## Cheat Loading Process
+By default, Atmosphère will do the following when deciding whether to attach to a new application process:
+
++ Retrieve information about the new application process from `pm` and `loader`.
++ Check whether a user-defined key combination is held, and stop if not.
+  + This defaults to "L is not held", and can be configured the same way as `fs.mitm` override keys.
+  + The ini key to configure this is `cheat_enable_key`.
++ Check whether the process is a real application, and stop if not.
+  + This guards against applying cheat codes to the homebrew loader.
++ Attempt to load cheats from `atmosphere/titles/<title_id>/cheats/<build_id>.txt`, where `build_id` is the hexadecimal representation of the first 8 bytes of the application's main executable's build id.
+  + If no cheats are found, then the cheat manager will stop.
++ Open a kernel debug session for the new application process.
++ Signal to a system event that a new cheat process has been attached to.
+
+This behavior ensures that cheat codes are only loaded when the user would want them to.
+
+In cases where dmnt has not activated the cheat manager, but the user wants to make it do so anyway, the cheat manager's service API provides a `ForceOpenCheatProcess` command that homebrew can use. This command will cause the cheat manager to try to force itself to attach to the process.
+
+By default, all cheat codes listed in the loaded .txt file will be toggled on. This is configurable by the user, and the default can be set to toggled off by editing the `atmosphere!dmnt_cheats_enabled_by_default` entry to 0 instead of 1.
+
+Users may use homebrew programs to toggle cheats on and off at runtime via the cheat manager's service API.
+
+## Cheat Code Compatibility
+
+Atmosphère manages cheat code through the execution of a small, custom virtual machine. Care has been taken to ensure that Atmosphère's cheat code format is fully backwards compatible with the pre-existing cheat code format, though new features have been added and bugs in the pre-existing cheat code applier have been fixed. Here is a short summary of the changes from the pre-existing format:
+
++ A number of bugs were fixed in the processing of conditional instructions.
+  + The pre-existing implementation was fundamentally broken, and checked for the wrong value when detecting the end of a conditional block.
+  + The pre-existing implementation also did not properly decode instructions, and instead linearly scanned for the terminator value. This caused problems if an instruction happened to encode a terminator inside its immediate values.
+  + The pre-existing implementation did not bounds check, and thus certain conditional cheat codes could cause it to read out-of-bounds memory, and potentially crash due to a data abort.
++ Support was added for nesting conditional blocks.
++ An instruction was added to perform much more complex arbitrary arithmetic on two registers.
++ An instruction was added to allow writing the contents of register to a memory address specified by another register.
++ The pre-existing implementation did not correctly synchronize with the application process, and thus would cause heavy lag under certain circumstances (especially around loading screens). This has been fixed in Atmosphère's implementation.
+
+## Cheat Code Format
+
+The following provides documentation of the instruction format for the virtual machine used to manage cheat codes.
+
+Typically, instruction type is encoded in the upper nybble of the first instruction u32.
+
+### Code Type 0: Store Static Value to Memory
+
+Code type 0 allows writing a static value to a memory address.
+
+#### Encoding
+
+`0TMR00AA AAAAAAAA VVVVVVVV (VVVVVVVV)`
+
++ T: width of memory write (1, 2, 4, or 8 bytes)
++ M: memory region to write to (0 = Main NSO, 1 = Heap)
++ R: Register to use as an offset from memory region base.
++ A: Immediate offset to use from memory region base.
++ V: Value to write.
+
+---
+
+### Code Type 1: Begin Conditional Block
+
+Code type 1 performs a comparison of the contents of memory to a static value.
+
+If the condition is not met, all instructions until the appropriate conditional block terminator are skipped.
+
+#### Encoding
+
+`1TMC00AA AAAAAAAA VVVVVVVV (VVVVVVVV)`
+
++ T: width of memory write (1, 2, 4, or 8 bytes)
++ M: memory region to write to (0 = Main NSO, 1 = Heap)
++ C: Condition to use, see below.
++ A: Immediate offset to use from memory region base.
++ V: Value to compare to.
+
+#### Conditions
+
++ 1: >
++ 2: >=
++ 3: <
++ 4: <=
++ 5: ==
++ 6: !=
+
+---
+
+### Code Type 2: End Conditional Block
+
+Code type 2 marks the end of a conditional block (started by Code Type 1 or Code Type 8).
+
+#### Encoding
+
+`20000000`
+
+---
+
+### Code Type 3: Start/End Loop
+
+Code type 3 allows for iterating in a loop a fixed number of times.
+
+#### Start Loop Encoding
+
+`300R0000 VVVVVVVV`
+
++ R: Register to use as loop counter.
++ V: Number of iterations to loop.
+
+#### End Loop Encoding
+
+`310R0000`
+
++ R: Register to use as loop counter.
+
+---
+
+### Code Type 4: Load Register with Static Value
+
+Code type 4 allows setting a register to a constant value.
+
+#### Encoding
+
+`400R0000 VVVVVVVV VVVVVVVV`
+
++ R: Register to use.
++ V: Value to load.
+
+---
+
+### Code Type 5: Load Register with Memory Value
+
+Code type 5 allows loading a value from memory into a register, either using a fixed address or by dereferencing the destination register.
+
+#### Load From Fixed Address Encoding
+
+`5TMR00AA AAAAAAAA`
+
++ T: width of memory read (1, 2, 4, or 8 bytes)
++ M: memory region to write to (0 = Main NSO, 1 = Heap)
++ R: Register to load value into.
++ A: Immediate offset to use from memory region base.
+
+#### Load from Register Address Encoding
+
+`5TMR10AA AAAAAAAA`
+
++ T: width of memory read (1, 2, 4, or 8 bytes)
++ M: memory region to write to (0 = Main NSO, 1 = Heap)
++ R: Register to load value into.
++ A: Immediate offset to use from register R.
+
+---
+
+### Code Type 6: Store Static Value to Register Memory Address
+
+Code type 6 allows writing a fixed value to a memory address specified by a register.
+
+#### Encoding
+
+`6T0RIor0 VVVVVVVV VVVVVVVV`
+
++ T: width of memory write (1, 2, 4, or 8 bytes)
++ R: Register used as base memory address.
++ I: Increment register flag (0 = do not increment R, 1 = increment R by T).
++ o: Offset register enable flag (0 = do not add r to address, 1 = add r to address).
++ r: Register used as offset when o is 1.
++ V: Value to write to memory.
+
+---
+
+### Code Type 7: Legacy Arithmetic
+
+Code type 7 allows performing arithmetic on registers.
+
+However, it has been deprecated by Code type 9, and is only kept for backwards compatibility.
+
+#### Encoding
+
+`7T0RC000 VVVVVVVV`
+
++ T: width of arithmetic operation (1, 2, 4, or 8 bytes)
++ R: Register to apply arithmetic to.
++ C: Arithmetic operation to apply, see below.
++ V: Value to use for arithmetic operation.
+
+#### Arithmetic Types
+
++ 0: Addition
++ 1: Subtraction
++ 2: Multiplication
++ 3: Left Shift
++ 4: Right Shift
+
+---
+
+### Code Type 8: Begin Keypress Conditional Block
+
+Code type 8 enters or skips a conditional block based on whether a key combination is pressed.
+
+#### Encoding
+
+`8kkkkkkk`
+
++ k: Keypad mask to check against, see below.
+
+Note that for multiple button combinations, the bitmasks should be ORd together.
+
+#### Keypad Values
+
+Note: This is the direct output of `hidKeysDown()`.
+
++ 0000001: A
++ 0000002: B
++ 0000004: X
++ 0000008: Y
++ 0000010: Left Stick Pressed
++ 0000020: Right Stick Pressed
++ 0000040: L
++ 0000080: R
++ 0000100: ZL
++ 0000200: ZR
++ 0000400: Plus
++ 0000800: Minus
++ 0001000: Left
++ 0002000: Up
++ 0004000: Right
++ 0008000: Down
++ 0010000: Left Stick Left
++ 0020000: Left Stick Up
++ 0040000: Left Stick Right
++ 0080000: Left Stick Down
++ 0100000: Right Stick Left
++ 0200000: Right Stick Up
++ 0400000: Right Stick Right
++ 0800000: Right Stick Down
++ 1000000: SL
++ 2000000: SR
+
+---
+
+### Code Type 9: Perform Arithmetic
+
+Code type 9 allows performing arithmetic on registers.
+
+#### Register Arithmetic Encoding
+
+`9TCRS0s0`
+
++ T: width of arithmetic operation (1, 2, 4, or 8 bytes)
++ C: Arithmetic operation to apply, see below.
++ R: Register to store result in.
++ S: Register to use as left-hand operand.
++ s: Register to use as right-hand operand.
+
+#### Immediate Value Arithmetic Encoding
+
+`9TCRS100 VVVVVVVV (VVVVVVVV)`
+
++ T: width of arithmetic operation (1, 2, 4, or 8 bytes)
++ C: Arithmetic operation to apply, see below.
++ R: Register to store result in.
++ S: Register to use as left-hand operand.
++ V: Value to use as right-hand operand.
+
+#### Arithmetic Types
+
++ 0: Addition
++ 1: Subtraction
++ 2: Multiplication
++ 3: Left Shift
++ 4: Right Shift
++ 5: Logical And
++ 6: Logical Or
++ 7: Logical Not (discards right-hand operand)
++ 8: Logical Xor
++ 9: None/Move (discards right-hand operand)
+
+---
+
+### Code Type 10: Store Register to Memory Address
+
+Code type 10 allows writing a register to memory.
+
+#### Encoding
+
+`ATSRIOxa (aaaaaaaa)`
+
++ T: width of memory write (1, 2, 4, or 8 bytes)
++ S: Register to write to memory.
++ R: Register to use as base address.
++ I: Increment register flag (0 = do not increment R, 1 = increment R by T).
++ O: Offset type, see below.
++ x: Register used as offset when O is 1, Memory type when O is 3, 4 or 5.
++ a: Value used as offset when O is 2, 4 or 5.
+
+#### Offset Types
+
++ 0: No Offset
++ 1: Use Offset Register
++ 2: Use Fixed Offset
++ 3: Memory Region + Base Register
++ 4: Memory Region + Relative Address (ignore address register)
++ 5: Memory Region + Relative Address + Offset Register
+---
+
+### Code Type 11: Reserved
+
+Code Type 11 is currently reserved for future use.
+
+---
+
+### Code Type 12-15: Extended-Width Instruction
+
+Code Types 12-15 signal to the VM to treat the upper two nybbles of the first dword as instruction type, instead of just the upper nybble.
+
+This reserves an additional 64 opcodes for future use.
+
+---
+
+### Code Type 0xC0: Begin Register Conditional Block
+
+Code type 0xC0 performs a comparison of the contents of a register and another value. This code support multiple operand types, see below.
+
+If the condition is not met, all instructions until the appropriate conditional block terminator are skipped.
+
+#### Encoding
+
+```
+C0TcSX##
+C0TcS0Ma aaaaaaaa
+C0TcS1Mr
+C0TcS2Ra aaaaaaaa
+C0TcS3Rr
+C0TcS400 VVVVVVVV (VVVVVVVV)
+C0TcS5X0
+```
+
++ T: width of memory write (1, 2, 4, or 8 bytes)
++ c: Condition to use, see below.
++ S: Source Register
++ X: Operand Type, see below.
++ M: Memory Type (operand types 0 and 1)
++ R: Address Register (operand types 2 and 3)
++ a: Relative Address (operand types 0 and 2)
++ r: Offset Register (operand types 1 and 3)
++ X: Other Register (used for operand type 5)
++ V: Value to compare to (operand type 4)
+
+#### Operand Type
+
++ 0: Memory Base + Relative Offset
++ 1: Memory Base + Offset Register
++ 2: Register + Relative Offset
++ 3: Register + Offset Register
++ 4: Static Value
++ 5: Other Register
+
+#### Conditions
+
++ 1: >
++ 2: >=
++ 3: <
++ 4: <=
++ 5: ==
++ 6: !=

docs/components/fusee/BCT.md

@@ -1,19 +1,51 @@
 # BCT.ini
-BCT.ini is the configuration file used by fusée-primary and fusée-secondary. It is read by fusee-primary.bin to setup and boot fusee-secondary.bin and is also read by fusee-secondary.bin to configure Exosphère or to specify the environment it should boot.
+BCT.ini is the configuration file used by fusée-primary and fusée-secondary. It is read by fusee-primary.bin to setup and boot fusee-secondary.bin and is also read by fusee-secondary.bin to configure Exosphère, specify the environment it should boot, or configure other miscellaneous options such as setting a custom boot splashscreen.
 
 ## Configuration
-This file is located at the root of your SD.
+This file is located in the `atmosphere` folder on your SD card. The default configuration file will look similar to this.
 ```
 BCT0
 [stage1]
-stage2_path = fusee-secondary.bin
+stage2_path = atmosphere/fusee-secondary.bin
 stage2_addr = 0xF0000000
 stage2_entrypoint = 0xF0000000
+
+[exosphere]
+; Note: Disabling debugmode will cause parts of ams.tma to not work, in the future.
+debugmode = 1 
+debugmode_user = 0
+
+[stratosphere]
+; To force-enable nogc, add nogc = 1
+; To force-disable nogc, add nogc = 0
 ```
-Add the following lines and replace the `X` according to the following list if you have trouble booting past the firmware version detection.
+
+## Adding a Custom Boot Splashscreen
+Add the following lines to BCT.ini and change the value of `custom_splash` to the actual path and filename of your boot splashscreen.
+```
+[stage2]
+custom_splash = /path/to/your/bootlogo.bmp
+```
+
+The boot splashscreen must be a BMP file, it must be 720x1280 (1280x720 rotated 90 degrees left/counterclockwise/anti-clockwise) resolution, and be in 32-bit ARGB format. You can use image editing software such as GIMP or Photoshop to export the image in this format.
+
+## Configuring "nogc" Protection
+Nogc is a feature provided by fusée-secondary which disables the Nintendo Switch's Game Card reader. Its purpose is to prevent the reader from being updated when the console has been updated without burning fuses from a firmware lower than 4.0.0, to a newer firmware that is at least 4.0.0 or higher. By default, Atmosphère will protect the Game Card reader automatically, but you are free to change it.
+
+To change its functionality, add the following line to the `stratosphere` section and change the value of `X` according to the following list.
+```
+nogc = X
+```
+```
+1 = force-enable nogc, so Atmosphère will always disable the Game Card reader.
+0 = force-disable nogc, so Atmosphère will always enable the Game Card reader.
+```
+
+
+## Changing Target Firmware
+Add the following line to the `exosphere` section and replace the `X` according to the following list if you have trouble booting past the firmware version detection.
 `target_firmware` is the OFW major version. 
 ```
-[exosphere]
 target_firmware = X
 ```
 ```
@@ -22,5 +54,20 @@ target_firmware = X
 3.X.X = 3
 4.X.X = 4
 5.X.X = 5
-6.0.0 = 6
+6.X.X = 6
+6.2.0 = 7
+7.X.X = 8
+```
+
+Note that 6.X.X indicates 6.0.0 through 6.1.0.
+
+## Configuring Debugging Modes
+By default, Atmosphère signals to the Horizon kernel that debugging is enabled while leaving usermode debugging disabled, since this can cause undesirable side-effects. If you wish to change these behaviours, go to the `exosphere` section and change the value of `X` according to the following list.
+```
+debugmode = X
+debugmode_user = X
+```
+```
+1 = enable
+0 = disable
 ```

docs/components/fusee/sept.md

@@ -0,0 +1,15 @@
+# sept
+Sept is a payload that facilitates booting Atmosphère when targeting firmware version 7.0.0+.
+
+It consists of a primary and a secondary payload.
+
+## Sept-Primary
+Sept-primary is essentially a stand-in for Nintendo's package1ldr, on 7.0.0+. To use it, the caller (normally Fusée-secondary) loads the sept-primary binary to `0x4003F000`,
+loads the 7.0.0+ TSEC firmware to `0x40010F00`, and loads a signed, encrypted payload to `0x40016FE0`.
+
+This signed, encrypted payload is normally Sept-secondary.
+
+## Sept-Secondary
+Sept-secondary is a payload that performs 7.0.0+ key derivation, and then chainloads to `sept/payload.bin`.
+
+It is normally stored encrypted/signed; if one wishes to build sept-secondary instead of using release builds, one must bring his/her own keys.

docs/components/thermosphere.md

@@ -1,6 +1,4 @@
 # Thermosphère
-Thermosphère is a hypervisor based implementation of emuNAND. An emuNAND is a copy of the firmware on the Switch’s internal memory (sysNAND), and is typically installed on an external SD Card.
+Thermosphère is a hypervisor based implementation of emuNAND.
 
-An emuNAND operates completely independently of the sysNAND. This allows one to make or test various modifications and homebrew safely without needing to restore their NAND backup afterwards by testing things on the emuNAND, and switching back to the sysNAND when finished. In the case of past Nintendo systems such as the 3DS, an emuNAND could also be used to update your system to the latest firmware while keeping your sysNAND on a lower version, however this may be more difficult to do on the Switch due to Nintendo using efuse technology for major system updates.
-
-Thermosphère is currently planned to be included in the 1.0 release of Atmosphère.
+Thermosphère is currently planned to be included in a future release of Atmosphère.

docs/modules/dmnt.md

@@ -0,0 +1,38 @@
+# dmnt
+
+dmnt is a reimplementation of Nintendo's debug monitor. It provides Atmosphère a rich set of debugging functionality, so that users can easily analyze the behaviors of programs. In addition, Atmosphère implements an extension in dmnt to provide cheat code functionality.
+
+## Atmosphère Cheat Extension
+
+In addition to the functionality provided by Nintendo's debug monitor, Atmosphère's dmnt has an extension for providing cheat code functionality. A HIPC Service API is provided for interacting with the cheat code manager, through the service `dmnt:cht`.
+
+Those looking for more information on the cheat code functionality may wish to read `cheats.md`.
+
+The SwIPC definition for `dmnt:cht` follows.
+```
+interface DmntCheatService is dmnt:cht {
+  [65000] HasCheatProcess() -> bool;
+  [65001] GetCheatProcessEvent() -> KObject;
+  [65002] GetCheatProcessMetadata() -> CheatProcessMetadata;
+  [65003] ForceOpenCheatProcess();
+
+  [65100] GetCheatProcessMappingCount() -> u64;
+  [65101] GetCheatProcessMappings(u64 offset) -> buffer<MemoryInfo, 6>, u64 count;
+  [65102] ReadCheatProcessMemory(u64 address, u64 size) -> buffer<u8, 6> data;
+  [65103] WriteCheatProcessMemory(u64 address, u64 size, buffer<u8, 5> data);
+  [65104] QueryCheatProcessMemory(u64 address) -> MemoryInfo;
+
+  [65200] GetCheatCount() -> u64;
+  [65201] GetCheats(u64 offset) -> buffer<CheatEntry, 6>, u64 count;
+  [65202] GetCheatById(u32 cheat_id) -> buffer<CheatEntry, 6> cheat;
+  [65203] ToggleCheat(u32 cheat_id);
+  [65204] AddCheat(buffer<CheatDefinition, 5> cheat, bool enabled) -> u32 cheat_id;
+  [65203] RemoveCheat(u32 cheat_id);
+
+  [65300] GetFrozenAddressCount() -> u64;
+  [65301] GetFrozenAddresses(u64 offset) -> buffer<FrozenAddressEntry, 6>, u64 count;
+  [65302] GetFrozenAddress(u64 address) -> FrozenAddressEntry;
+  [65303] EnableFrozenAddress(u64 address, u64 width) -> u64 value;
+  [65304] DisableFrozenAddress(u64 address);
+}
+```

docs/modules/fs_mitm.md

@@ -1,2 +1,2 @@
 # fs_mitm
-fs_mitm is a sysmodule that enables intercepting file system operations. This module can log, deny, delay, replace, or redirect any request made to the filesystem. It enables LayeredFS to function, which allows for game mods.
+fs_mitm is a sysmodule that enables intercepting file system operations. This module can log, deny, delay, replace, or redirect any request made to the filesystem. It enables LayeredFS to function, which allows for replacement of game assets.

docs/modules/loader.md

@@ -55,13 +55,38 @@ When authoring patches, [hactool](https://github.com/SciresM/hactool) can be use
 
 Atmosphère can use the loader module in order to turn any game on your Switch's home menu into a launchpoint for the Homebrew Menu, rather than launching it through the album applet. This allows one to launch the Homebrew Menu with access to the ~3.2GB of RAM that the Switch reserves for games and applications, as opposed to the 442MB of RAM we are limited to when launching the Homebrew Menu from the album. This also means that it is no longer necessary to install homebrew as `.nsp` files on your Switch so long as you are using this method, as the only reason to do so is to allow the homebrew to access all of the Switch's available memory.
 
-In order to setup this method you will need the latest release of [hbmenu](https://github.com/switchbrew/nx-hbmenu/releases), and the latest release of [hbloader](https://github.com/switchbrew/nx-hbloader/releases). Place `hbmenu.nro` on the root of your Switch's SD Card, and place `hbl.nsp` in the atmosphere folder. From there, simply configure `loader.ini` in the atmosphere folder by replacing the Title ID in the ini (hbl_tid) (it is the Title ID for the album by default) with the Title ID of whatever game you wish to use to launch the Homebrew Menu. A list of Title IDs for Switch Games can be found [here](https://switchbrew.org/wiki/Title_list/Games). Afterwards you may reinsert your SD Card into your Switch and boot into Atmosphère as you normally would. You should now be able to boot into the Homebrew Menu by launching your designated game of choice.
+In order to setup this method you will need the latest release of [hbmenu](https://github.com/switchbrew/nx-hbmenu/releases), and the latest release of [hbloader](https://github.com/switchbrew/nx-hbloader/releases). Place `hbmenu.nro` on the root of your Switch's SD Card, and place `hbl.nsp` in the atmosphere folder. From there, simply launch any title while holding the button specified in `loader.ini`.
+
+In addition, loader has extensions to enable homebrew to launch web applets. This normally requires the application launching the applet have HTML Manual content inside an installed NCA; Atmosphère's loader will automatically ensure that the commands used to check this succeed, and will (in tandem with `fs.mitm`) redirect the relevant filesystem to the `sdmc:/atmosphere/hbl_html/` subdirectory.
 
 ### Button Overrides
 
-By default `loader.ini` is configured to launch the Homebrew Menu when launching the game normally, and launching the game when selecting the game while holding down R. If you wish to change this, you can modify the override_key section of `loader.ini`. Placing an exclamation point in front of whatever button you wish to use will make it so that you will only launch the actual game while holding down that button, otherwise you will go into the Homebrew Menu. Removing the exclamation point will reverse this, meaning that you will boot into the Homebrew Menu only while holding down the assigned button when launching the game.
+By default `loader.ini` is configured to launch the Homebrew Menu when launching any game while holding down the override key (defaults to R). If you wish to change this, you can modify the override_key section of `loader.ini`. Alternatively, if you would like to only allow hbmenu on a specific app, configure `loader.ini` in the atmosphere folder by replacing the Title ID in the ini (title_id in the [hbl_config] section, it is the Title ID for the album by default) with the Title ID of whatever game you wish to use to launch the Homebrew Menu, and set override_any_app to false. A list of Title IDs for Switch Games can be found [here](https://switchbrew.org/wiki/Title_list/Games).
 
-For example, `override_key=!R` will run the game only while holding down R when launching it, otherwise it will boot into the Homebrew Menu. `override_key=R` will only boot into the Homebrew Menu while holding down R when launching the game, otherwise it will launch the game as normal.
+To invert the behaviour of the override key, place an exclamation point in front of whatever button you wish to use. It will launch the actual game while holding down that button, instead of going into the Homebrew Menu. For example, `override_key=!R` will run the game only while holding down R when launching it, otherwise it will boot into the Homebrew Menu. Afterwards you may reinsert your SD Card into your Switch and boot into Atmosphère as you normally would. You should now be able to boot into the Homebrew Menu by launching your designated title of choice.
+
+A list of valid buttons can be found here:
+
+| Formal Name | .ini Name |
+| ----------- | --------- |
+| A Button    | A         |
+| B Button    | B         |
+| X Button    | X         |
+| Y Button    | Y         |
+| Left Stick  | LS        |
+| Right Stick | RS        |
+| L Button    | L         |
+| R Button    | R         |
+| ZL Button   | ZL        |
+| ZR Button   | ZR        |
+| + Button    | PLUS      |
+| - Button    | MINUS     |
+| Left Dpad   | DLEFT     |
+| Up Dpad     | DUP       |
+| Right Dpad  | DRIGHT    |
+| Down Dpad   | DDOWN     |
+| SL Button   | SL        |
+| SR Button   | SR        |
 
 ### SM MITM Integration
 

docs/modules/pm.md

@@ -14,7 +14,7 @@ The SwIPC definition for this command follows.
 ```
 interface nn::pm::detail::IDebugMonitorInterface is pm:dmnt {
   ...
-  [65000] AtmosphereGetProcessHandle(u64 pid) -> handle<copy, process> process_handle;
+  [65000] AtmosphereGetProcessInfo(u64 pid) -> handle<copy, process> process_handle, u64 title_id, u64 storage_id;
 }
 ```
 

docs/modules/set_mitm.md

@@ -50,5 +50,30 @@ upload_enabled = u8!0x0
 
 ### Atmosphère Custom Settings
 
-At present, Atmosphère implements no custom settings. However, this is subject to change in the future, and any\
-custom settings will be documented here as they are added.
+At the time of writing, Atmosphère implements two custom settings, found in the `atmosphere` section.\
+
+While not used for set_mitm, `power_menu_reboot_function` is loaded and controls the reboot behaviour of the console. By default, this value\
+is "payload", where the console will automatically reboot into the RCM payload stored in `sdmc:/atmosphere/reboot_payload.bin`.\
+(This payload is also used for fatal, upon a serious crash.) Setting the value to "rcm" reboots directly into RCM, and setting the value\
+to "normal" skips these behaviours.
+
+```
+[atmosphere]
+power_menu_reboot_function = str!payload
+```
+
+`dmnt_cheats_enabled_by_default` controls the behaviour of dmnt's cheat functionality. By default, this value is "0x1", enabling any cheats\
+defined by the user. Check [cheats](../cheats.md) for more information about Atmosphère's cheat functionality.
+
+```
+[atmosphere]
+dmnt_cheats_enabled_by_default = u8!0x1
+```
+
+`dmnt_always_save_cheat_toggles` controls the behaviour of dmnt's cheat toggle functionality. By default, this value is "0x0", causing toggles to\
+only be saved on game quit if a toggle file existed on game boot. Check [cheats](../cheats.md) for more information about Atmosphère's cheat functionality.
+
+```
+[atmosphere]
+dmnt_always_save_cheat_toggles = u8!0x0
+```

docs/modules/sm.md

@@ -122,4 +122,4 @@ By default, the Stratosphere implementation of PM will raise any session limits
 
 ### Weak Service Verification
 
-In system firmware versions before 3.0.1, if a process did not call the [Initialize](https://reswitched.github.io/SwIPC/ifaces.html#nn::sm::detail::IUserInterface(0)) command on its `sm:` session, normally used to inform sm of the process's identity, sm would assume that the process was a kernel internal process and skip any service registration or access checks. The Stratosphere implementation of sm reimplements this vulnerability, allowing homebrew processes to skip service registration and access checks.
+In system firmware versions before 3.0.1, if a process did not call the [Initialize](https://reswitched.github.io/SwIPC/ifaces.html#nn::sm::detail::IUserInterface(0)) command on its `sm:` session, normally used to inform sm of the process's identity, sm would assume that the process was a kernel internal process and skip any service registration or access checks. The Stratosphere implementation of sm does not implement this vulnerability, and initialization is required on all firmware versions.

exosphere/Makefile

@@ -10,6 +10,7 @@ TOPDIR ?= $(CURDIR)
 include $(DEVKITPRO)/devkitA64/base_rules
 
 AMSBRANCH := $(shell git symbolic-ref --short HEAD)
+AMSHASH = $(shell git rev-parse --short=16 HEAD)
 AMSREV := $(AMSBRANCH)-$(shell git rev-parse --short HEAD)
 
 ifneq (, $(strip $(shell git status --porcelain 2>/dev/null)))
@@ -33,7 +34,7 @@ INCLUDES	:=	include ../common/include
 # options for code generation
 #---------------------------------------------------------------------------------
 ARCH	:=	-march=armv8-a -mtune=cortex-a57 -mgeneral-regs-only #<- important
-DEFINES	:=	-D__CCPLEX__ -DATMOSPHERE_GIT_BRANCH=\"$(AMSBRANCH)\" -DATMOSPHERE_GIT_REV=\"$(AMSREV)\"
+DEFINES	:=	-D__CCPLEX__ -DATMOSPHERE_GIT_BRANCH=\"$(AMSBRANCH)\" -DATMOSPHERE_GIT_REV=\"$(AMSREV)\" -DATMOSPHERE_RELEASE_VERSION_HASH="0x$(AMSHASH)"
 CFLAGS	:= \
 	-g \
 	-O2 \

exosphere/lp0fw/src/car.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/car.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/cluster.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/cluster.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/emc.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/emc.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/flow.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/flow.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/fuse.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/fuse.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/i2c.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/i2c.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/lp0.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/lp0.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/mc.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/mc.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/misc.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/misc.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/pmc.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/se.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/se.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/secmon.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/secmon.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/start.s

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/sysreg.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/timer.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/lp0fw/src/utils.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/rebootstub/src/i2c.c

@@ -0,0 +1,169 @@
+/*
+ * Copyright (c) 2018-2019 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include "max77620.h"
+#include "i2c.h"
+#include "timer.h"
+
+/* Prototypes for internal commands. */
+void i2c_load_config(void);
+int i2c_write(unsigned int device, uint32_t val, unsigned int num_bytes);
+int i2c_read(unsigned int device, void *dst, unsigned num_bytes);
+int i2c_query(uint8_t device, uint8_t r, void *dst, size_t num_bytes); 
+int i2c_send_byte_command(unsigned int device, unsigned char reg, unsigned char b);
+
+/* Load hardware config for I2C4. */
+void i2c_load_config(void) {
+    /* Set MSTR_CONFIG_LOAD, TIMEOUT_CONFIG_LOAD, undocumented bit. */
+    I2C_I2C_CONFIG_LOAD_0 = 0x25;
+
+    /* Wait a bit for master config to be loaded. */
+    for (unsigned int i = 0; i < 20; i++) {
+        timer_wait(1);
+        if (!(I2C_I2C_CONFIG_LOAD_0 & 1)) {
+            break;
+        }
+    }
+}
+
+/* Initialize I2C4. */
+void i2c_init(void) {
+    /* Setup divisor, and clear the bus. */
+    I2C_I2C_CLK_DIVISOR_REGISTER_0 = 0x50001;
+    I2C_I2C_BUS_CLEAR_CONFIG_0 = 0x90003;
+
+    /* Load hardware configuration. */
+    i2c_load_config();
+
+    /* Wait a while until BUS_CLEAR_DONE is set. */
+    for (unsigned int i = 0; i < 10; i++) {
+        timer_wait(20000);
+        if (I2C_INTERRUPT_STATUS_REGISTER_0 & 0x800) {
+            break;
+        }
+    }
+
+    /* Read the BUS_CLEAR_STATUS. Result doesn't matter. */
+    I2C_I2C_BUS_CLEAR_STATUS_0;
+
+    /* Read and set the Interrupt Status. */
+    uint32_t int_status = I2C_INTERRUPT_STATUS_REGISTER_0;
+    I2C_INTERRUPT_STATUS_REGISTER_0 = int_status;
+}
+
+/* Writes a value to an i2c device. */
+int i2c_write(unsigned int device, uint32_t val, unsigned int num_bytes) {
+    if (num_bytes > 4) {
+        return 0;
+    }
+
+    /* Set device for 7-bit mode. */
+    I2C_I2C_CMD_ADDR0_0 = device << 1;
+
+    /* Load in data to write. */
+    I2C_I2C_CMD_DATA1_0 = val;
+
+    /* Set config with LENGTH = num_bytes, NEW_MASTER_FSM, DEBOUNCE_CNT = 4T. */
+    I2C_I2C_CNFG_0 = ((num_bytes << 1) - 2) | 0x2800;
+
+    i2c_load_config();
+
+    /* Config |= SEND; */
+    I2C_I2C_CNFG_0 |= 0x200;
+
+
+    while (I2C_I2C_STATUS_0 & 0x100) {
+        /* Wait until not busy. */
+    }
+
+    /* Return CMD1_STAT == SL1_XFER_SUCCESSFUL. */
+    return (I2C_I2C_STATUS_0 & 0xF) == 0;
+}
+
+/* Reads a value from an i2c device. */
+int i2c_read(unsigned device, void *dst, unsigned num_bytes) {
+    if (num_bytes > 4) {
+        return 0;
+    }
+
+    /* Set device for 7-bit read mode. */
+    I2C_I2C_CMD_ADDR0_0 = (device << 1) | 1;
+
+    /* Set config with LENGTH = num_bytes, NEW_MASTER_FSM, DEBOUNCE_CNT = 4T. */
+    I2C_I2C_CNFG_0 = ((num_bytes << 1) - 2) | 0x2840;
+
+    i2c_load_config();
+
+    /* Config |= SEND; */
+    I2C_I2C_CNFG_0 |= 0x200;
+
+
+    while (I2C_I2C_STATUS_0 & 0x100) {
+        /* Wait until not busy. */
+    }
+    
+    /* Ensure success. */
+    if ((I2C_I2C_STATUS_0 & 0xF) != 0) {
+        return 0;
+    }
+    
+    uint32_t val = I2C_I2C_CMD_DATA1_0;
+    for (size_t i = 0; i < num_bytes; i++) {
+        ((uint8_t *)dst)[i] = ((uint8_t *)&val)[i];
+    }
+    return 1;
+}
+
+/* Queries the value of a register. */
+int i2c_query(uint8_t device, uint8_t r, void *dst, size_t num_bytes) {
+    /* Limit output size to 32-bits. */
+    if (num_bytes > 4) {
+        return 0;
+    }
+    
+    /* Write single byte register ID to device. */
+    if (!i2c_write(device, r, 1)) {
+        return 0;
+    }
+    
+    return i2c_read(device, dst, num_bytes);
+
+}
+
+/* Writes a byte val to reg for given device. */
+int i2c_send_byte_command(unsigned int device, unsigned char reg, unsigned char b) {
+    uint32_t val = (reg) | (b << 8);
+    /* Write 1 byte (reg) + 1 byte (value) */
+    return i2c_write(device, val, 2);
+}
+
+void i2c_stop_rtc_alarm(void) {
+    i2c_send_byte_command(MAX77620_RTC_I2C_ADDR, MAX77620_REG_RTCUPDATE0, 0x10);
+    
+    uint8_t val = 0;
+    for (int i = 0; i < 14; i++) {
+        if (i2c_query(MAX77620_RTC_I2C_ADDR, 0x0E + i, &val, 1)) {
+            val &= 0x7F;
+            i2c_send_byte_command(MAX77620_RTC_I2C_ADDR, 0x0E + i, val);
+        }
+    }
+        
+    i2c_send_byte_command(MAX77620_RTC_I2C_ADDR, MAX77620_REG_RTCUPDATE0, 0x01);
+}
+
+void i2c_send_shutdown_cmd(void) {
+    i2c_send_byte_command(MAX77620_I2C_ADDR, MAX77620_REG_ONOFFCNFG1, MAX77620_ONOFFCNFG1_PWR_OFF);
+}

exosphere/rebootstub/src/i2c.h

@@ -0,0 +1,51 @@
+/*
+ * Copyright (c) 2018-2019 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#ifndef EXOSPHERE_REBOOTSTUB_I2C_H
+#define EXOSPHERE_REBOOTSTUB_I2C_H
+
+#include "utils.h"
+
+/* I2C_BASE = I2C4. */
+#define I2C_BASE (0x7000D000)
+
+#define MAKE_I2C_REG(ofs) (MAKE_REG32(I2C_BASE + ofs))
+
+#define I2C_I2C_CNFG_0                       MAKE_I2C_REG(0x000)
+
+#define I2C_I2C_CMD_ADDR0_0                  MAKE_I2C_REG(0x004)
+
+#define I2C_I2C_CMD_DATA1_0                  MAKE_I2C_REG(0x00C)
+
+#define I2C_I2C_STATUS_0                     MAKE_I2C_REG(0x01C)
+
+#define I2C_INTERRUPT_STATUS_REGISTER_0      MAKE_I2C_REG(0x068)
+
+#define I2C_I2C_CLK_DIVISOR_REGISTER_0       MAKE_I2C_REG(0x06C)
+
+#define I2C_I2C_BUS_CLEAR_CONFIG_0           MAKE_I2C_REG(0x084)
+
+#define I2C_I2C_BUS_CLEAR_STATUS_0           MAKE_I2C_REG(0x088)
+
+
+#define I2C_I2C_CONFIG_LOAD_0                MAKE_I2C_REG(0x08C)
+
+void i2c_init(void);
+
+void i2c_stop_rtc_alarm(void);
+void i2c_send_shutdown_cmd(void);
+
+#endif

exosphere/rebootstub/src/max77620.h

@@ -0,0 +1,360 @@
+/*
+ * Defining registers address and its bit definitions of MAX77620 and MAX20024
+ *
+ * Copyright (C) 2016 NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2018-2019 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ */
+
+#ifndef _MFD_MAX77620_H_
+#define _MFD_MAX77620_H_
+
+#define MAX77620_I2C_ADDR     0x3C
+#define MAX77620_RTC_I2C_ADDR 0x68
+
+/* RTC Registers */
+#define MAX77620_REG_RTCINT     0x00
+#define MAX77620_REG_RTCINTM        0x01
+#define MAX77620_REG_RTCCNTLM       0x02
+#define MAX77620_REG_RTCCNTL        0x03
+#define MAX77620_REG_RTCUPDATE0     0x04
+#define MAX77620_REG_RTCUPDATE1     0x05
+#define MAX77620_REG_RTCSMPL        0x06
+#define MAX77620_REG_RTCSEC     0x07
+#define MAX77620_REG_RTCMIN     0x08
+#define MAX77620_REG_RTCHOUR        0x09
+#define MAX77620_REG_RTCDOW     0x0A
+#define MAX77620_REG_RTCMONTH       0x0B
+#define MAX77620_REG_RTCYEAR        0x0C
+#define MAX77620_REG_RTCDOM     0x0D
+#define MAX77620_REG_RTCSECA1       0x0E
+#define MAX77620_REG_RTCMINA1       0x0F
+#define MAX77620_REG_RTCHOURA1      0x10
+#define MAX77620_REG_RTCDOWA1       0x11
+#define MAX77620_REG_RTCMONTHA1     0x12
+#define MAX77620_REG_RTCYEARA1      0x13
+#define MAX77620_REG_RTCDOMA1       0x14
+#define MAX77620_REG_RTCSECA2       0x15
+#define MAX77620_REG_RTCMINA2       0x16
+#define MAX77620_REG_RTCHOURA2      0x17
+#define MAX77620_REG_RTCDOWA2       0x18
+#define MAX77620_REG_RTCMONTHA2     0x19
+#define MAX77620_REG_RTCYEARA2      0x1A
+#define MAX77620_REG_RTCDOMA2       0x1B
+
+/* GLOBAL, PMIC, GPIO, FPS, ONOFFC, CID Registers */
+#define MAX77620_REG_CNFGGLBL1          0x00
+#define MAX77620_REG_CNFGGLBL2          0x01
+#define MAX77620_REG_CNFGGLBL3          0x02
+#define MAX77620_REG_CNFG1_32K          0x03
+#define MAX77620_REG_CNFGBBC            0x04
+#define MAX77620_REG_IRQTOP         0x05
+#define MAX77620_REG_INTLBT         0x06
+#define MAX77620_REG_IRQSD          0x07
+#define MAX77620_REG_IRQ_LVL2_L0_7      0x08
+#define MAX77620_REG_IRQ_LVL2_L8        0x09
+#define MAX77620_REG_IRQ_LVL2_GPIO      0x0A
+#define MAX77620_REG_ONOFFIRQ           0x0B
+#define MAX77620_REG_NVERC          0x0C
+#define MAX77620_REG_IRQTOPM            0x0D
+#define MAX77620_REG_INTENLBT           0x0E
+#define MAX77620_REG_IRQMASKSD          0x0F
+#define MAX77620_REG_IRQ_MSK_L0_7       0x10
+#define MAX77620_REG_IRQ_MSK_L8         0x11
+#define MAX77620_REG_ONOFFIRQM          0x12
+#define MAX77620_REG_STATLBT            0x13
+#define MAX77620_REG_STATSD         0x14
+#define MAX77620_REG_ONOFFSTAT          0x15
+
+/* SD and LDO Registers */
+#define MAX77620_REG_SD0            0x16
+#define MAX77620_REG_SD1            0x17
+#define MAX77620_REG_SD2            0x18
+#define MAX77620_REG_SD3            0x19
+#define MAX77620_REG_SD4            0x1A
+#define MAX77620_REG_DVSSD0         0x1B
+#define MAX77620_REG_DVSSD1         0x1C
+#define MAX77620_REG_SD0_CFG            0x1D
+#define MAX77620_REG_SD1_CFG            0x1E
+#define MAX77620_REG_SD2_CFG            0x1F
+#define MAX77620_REG_SD3_CFG            0x20
+#define MAX77620_REG_SD4_CFG            0x21
+#define MAX77620_REG_SD_CFG2            0x22
+#define MAX77620_REG_LDO0_CFG           0x23
+#define MAX77620_REG_LDO0_CFG2          0x24
+#define MAX77620_REG_LDO1_CFG           0x25
+#define MAX77620_REG_LDO1_CFG2          0x26
+#define MAX77620_REG_LDO2_CFG           0x27
+#define MAX77620_REG_LDO2_CFG2          0x28
+#define MAX77620_REG_LDO3_CFG           0x29
+#define MAX77620_REG_LDO3_CFG2          0x2A
+#define MAX77620_REG_LDO4_CFG           0x2B
+#define MAX77620_REG_LDO4_CFG2          0x2C
+#define MAX77620_REG_LDO5_CFG           0x2D
+#define MAX77620_REG_LDO5_CFG2          0x2E
+#define MAX77620_REG_LDO6_CFG           0x2F
+#define MAX77620_REG_LDO6_CFG2          0x30
+#define MAX77620_REG_LDO7_CFG           0x31
+#define MAX77620_REG_LDO7_CFG2          0x32
+#define MAX77620_REG_LDO8_CFG           0x33
+#define MAX77620_REG_LDO8_CFG2          0x34
+#define MAX77620_REG_LDO_CFG3           0x35
+
+#define MAX77620_LDO_SLEW_RATE_MASK     0x1
+
+/* LDO Configuration 3 */
+#define MAX77620_TRACK4_MASK            (1 << 5)
+#define MAX77620_TRACK4_SHIFT           5
+
+/* Voltage */
+#define MAX77620_SDX_VOLT_MASK          0xFF
+#define MAX77620_SD0_VOLT_MASK          0x3F
+#define MAX77620_SD1_VOLT_MASK          0x7F
+#define MAX77620_LDO_VOLT_MASK          0x3F
+
+#define MAX77620_REG_GPIO0          0x36
+#define MAX77620_REG_GPIO1          0x37
+#define MAX77620_REG_GPIO2          0x38
+#define MAX77620_REG_GPIO3          0x39
+#define MAX77620_REG_GPIO4          0x3A
+#define MAX77620_REG_GPIO5          0x3B
+#define MAX77620_REG_GPIO6          0x3C
+#define MAX77620_REG_GPIO7          0x3D
+#define MAX77620_REG_PUE_GPIO           0x3E
+#define MAX77620_REG_PDE_GPIO           0x3F
+#define MAX77620_REG_AME_GPIO           0x40
+#define MAX77620_REG_ONOFFCNFG1         0x41
+#define MAX77620_REG_ONOFFCNFG2         0x42
+
+/* FPS Registers */
+#define MAX77620_REG_FPS_CFG0           0x43
+#define MAX77620_REG_FPS_CFG1           0x44
+#define MAX77620_REG_FPS_CFG2           0x45
+#define MAX77620_REG_FPS_LDO0           0x46
+#define MAX77620_REG_FPS_LDO1           0x47
+#define MAX77620_REG_FPS_LDO2           0x48
+#define MAX77620_REG_FPS_LDO3           0x49
+#define MAX77620_REG_FPS_LDO4           0x4A
+#define MAX77620_REG_FPS_LDO5           0x4B
+#define MAX77620_REG_FPS_LDO6           0x4C
+#define MAX77620_REG_FPS_LDO7           0x4D
+#define MAX77620_REG_FPS_LDO8           0x4E
+#define MAX77620_REG_FPS_SD0            0x4F
+#define MAX77620_REG_FPS_SD1            0x50
+#define MAX77620_REG_FPS_SD2            0x51
+#define MAX77620_REG_FPS_SD3            0x52
+#define MAX77620_REG_FPS_SD4            0x53
+#define MAX77620_REG_FPS_NONE           0
+
+#define MAX77620_FPS_SRC_MASK           0xC0
+#define MAX77620_FPS_SRC_SHIFT          6
+#define MAX77620_FPS_PU_PERIOD_MASK     0x38
+#define MAX77620_FPS_PU_PERIOD_SHIFT        3
+#define MAX77620_FPS_PD_PERIOD_MASK     0x07
+#define MAX77620_FPS_PD_PERIOD_SHIFT        0
+#define MAX77620_FPS_TIME_PERIOD_MASK       0x38
+#define MAX77620_FPS_TIME_PERIOD_SHIFT      3
+#define MAX77620_FPS_EN_SRC_MASK        0x06
+#define MAX77620_FPS_EN_SRC_SHIFT       1
+#define MAX77620_FPS_ENFPS_SW_MASK      0x01
+#define MAX77620_FPS_ENFPS_SW           0x01
+
+/* Minimum and maximum FPS period time (in microseconds) are
+ * different for MAX77620 and Max20024.
+ */
+#define MAX77620_FPS_PERIOD_MIN_US      40
+#define MAX20024_FPS_PERIOD_MIN_US      20
+
+#define MAX77620_FPS_PERIOD_MAX_US      2560
+#define MAX20024_FPS_PERIOD_MAX_US      5120
+
+#define MAX77620_REG_FPS_GPIO1          0x54
+#define MAX77620_REG_FPS_GPIO2          0x55
+#define MAX77620_REG_FPS_GPIO3          0x56
+#define MAX77620_REG_FPS_RSO            0x57
+#define MAX77620_REG_CID0           0x58
+#define MAX77620_REG_CID1           0x59
+#define MAX77620_REG_CID2           0x5A
+#define MAX77620_REG_CID3           0x5B
+#define MAX77620_REG_CID4           0x5C
+#define MAX77620_REG_CID5           0x5D
+
+#define MAX77620_REG_DVSSD4         0x5E
+#define MAX20024_REG_MAX_ADD            0x70
+
+#define MAX77620_CID_DIDM_MASK          0xF0
+#define MAX77620_CID_DIDM_SHIFT         4
+
+/* CNCG2SD */
+#define MAX77620_SD_CNF2_ROVS_EN_SD1        (1 << 1)
+#define MAX77620_SD_CNF2_ROVS_EN_SD0        (1 << 2)
+
+/* Device Identification Metal */
+#define MAX77620_CID5_DIDM(n)           (((n) >> 4) & 0xF)
+/* Device Indentification OTP */
+#define MAX77620_CID5_DIDO(n)           ((n) & 0xF)
+
+/* SD CNFG1 */
+#define MAX77620_SD_SR_MASK         0xC0
+#define MAX77620_SD_SR_SHIFT            6
+#define MAX77620_SD_POWER_MODE_MASK     0x30
+#define MAX77620_SD_POWER_MODE_SHIFT        4
+#define MAX77620_SD_CFG1_ADE_MASK       (1 << 3)
+#define MAX77620_SD_CFG1_ADE_DISABLE        0
+#define MAX77620_SD_CFG1_ADE_ENABLE     (1 << 3)
+#define MAX77620_SD_FPWM_MASK           0x04
+#define MAX77620_SD_FPWM_SHIFT          2
+#define MAX77620_SD_FSRADE_MASK         0x01
+#define MAX77620_SD_FSRADE_SHIFT        0
+#define MAX77620_SD_CFG1_FPWM_SD_MASK       (1 << 2)
+#define MAX77620_SD_CFG1_FPWM_SD_SKIP       0
+#define MAX77620_SD_CFG1_FPWM_SD_FPWM       (1 << 2)
+#define MAX20024_SD_CFG1_MPOK_MASK      (1 << 1)
+#define MAX77620_SD_CFG1_FSRADE_SD_MASK     (1 << 0)
+#define MAX77620_SD_CFG1_FSRADE_SD_DISABLE  0
+#define MAX77620_SD_CFG1_FSRADE_SD_ENABLE   (1 << 0)
+
+/* LDO_CNFG2 */
+#define MAX77620_LDO_POWER_MODE_MASK        0xC0
+#define MAX77620_LDO_POWER_MODE_SHIFT       6
+#define MAX20024_LDO_CFG2_MPOK_MASK     (1 << 2)
+#define MAX77620_LDO_CFG2_ADE_MASK      (1 << 1)
+#define MAX77620_LDO_CFG2_ADE_DISABLE       0
+#define MAX77620_LDO_CFG2_ADE_ENABLE        (1 << 1)
+#define MAX77620_LDO_CFG2_SS_MASK       (1 << 0)
+#define MAX77620_LDO_CFG2_SS_FAST       (1 << 0)
+#define MAX77620_LDO_CFG2_SS_SLOW       0
+
+#define MAX77620_IRQ_TOP_GLBL_MASK      (1 << 7)
+#define MAX77620_IRQ_TOP_SD_MASK        (1 << 6)
+#define MAX77620_IRQ_TOP_LDO_MASK       (1 << 5)
+#define MAX77620_IRQ_TOP_GPIO_MASK      (1 << 4)
+#define MAX77620_IRQ_TOP_RTC_MASK       (1 << 3)
+#define MAX77620_IRQ_TOP_32K_MASK       (1 << 2)
+#define MAX77620_IRQ_TOP_ONOFF_MASK     (1 << 1)
+
+#define MAX77620_IRQ_LBM_MASK           (1 << 3)
+#define MAX77620_IRQ_TJALRM1_MASK       (1 << 2)
+#define MAX77620_IRQ_TJALRM2_MASK       (1 << 1)
+
+#define MAX77620_CNFG_GPIO_DRV_MASK     (1 << 0)
+#define MAX77620_CNFG_GPIO_DRV_PUSHPULL     (1 << 0)
+#define MAX77620_CNFG_GPIO_DRV_OPENDRAIN    0
+#define MAX77620_CNFG_GPIO_DIR_MASK     (1 << 1)
+#define MAX77620_CNFG_GPIO_DIR_INPUT        (1 << 1)
+#define MAX77620_CNFG_GPIO_DIR_OUTPUT       0
+#define MAX77620_CNFG_GPIO_INPUT_VAL_MASK   (1 << 2)
+#define MAX77620_CNFG_GPIO_OUTPUT_VAL_MASK  (1 << 3)
+#define MAX77620_CNFG_GPIO_OUTPUT_VAL_HIGH  (1 << 3)
+#define MAX77620_CNFG_GPIO_OUTPUT_VAL_LOW   0
+#define MAX77620_CNFG_GPIO_INT_MASK     (0x3 << 4)
+#define MAX77620_CNFG_GPIO_INT_FALLING      (1 << 4)
+#define MAX77620_CNFG_GPIO_INT_RISING       (1 << 5)
+#define MAX77620_CNFG_GPIO_DBNC_MASK        (0x3 << 6)
+#define MAX77620_CNFG_GPIO_DBNC_None        (0x0 << 6)
+#define MAX77620_CNFG_GPIO_DBNC_8ms     (0x1 << 6)
+#define MAX77620_CNFG_GPIO_DBNC_16ms        (0x2 << 6)
+#define MAX77620_CNFG_GPIO_DBNC_32ms        (0x3 << 6)
+
+#define MAX77620_IRQ_LVL2_GPIO_EDGE0        (1 << 0)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE1        (1 << 1)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE2        (1 << 2)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE3        (1 << 3)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE4        (1 << 4)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE5        (1 << 5)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE6        (1 << 6)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE7        (1 << 7)
+
+#define MAX77620_CNFG1_32K_OUT0_EN      (1 << 2)
+
+#define MAX77620_ONOFFCNFG1_SFT_RST     (1 << 7)
+#define MAX77620_ONOFFCNFG1_MRT_MASK        0x38
+#define MAX77620_ONOFFCNFG1_MRT_SHIFT       0x3
+#define MAX77620_ONOFFCNFG1_SLPEN       (1 << 2)
+#define MAX77620_ONOFFCNFG1_PWR_OFF     (1 << 1)
+#define MAX20024_ONOFFCNFG1_CLRSE       0x18
+
+#define MAX77620_ONOFFCNFG2_SFT_RST_WK      (1 << 7)
+#define MAX77620_ONOFFCNFG2_WD_RST_WK       (1 << 6)
+#define MAX77620_ONOFFCNFG2_SLP_LPM_MSK     (1 << 5)
+#define MAX77620_ONOFFCNFG2_WK_ALARM1       (1 << 2)
+#define MAX77620_ONOFFCNFG2_WK_EN0      (1 << 0)
+
+#define MAX77620_GLBLM_MASK         (1 << 0)
+
+#define MAX77620_WDTC_MASK          0x3
+#define MAX77620_WDTOFFC            (1 << 4)
+#define MAX77620_WDTSLPC            (1 << 3)
+#define MAX77620_WDTEN              (1 << 2)
+
+#define MAX77620_TWD_MASK           0x3
+#define MAX77620_TWD_2s             0x0
+#define MAX77620_TWD_16s            0x1
+#define MAX77620_TWD_64s            0x2
+#define MAX77620_TWD_128s           0x3
+
+#define MAX77620_CNFGGLBL1_LBDAC_EN     (1 << 7)
+#define MAX77620_CNFGGLBL1_MPPLD        (1 << 6)
+#define MAX77620_CNFGGLBL1_LBHYST       ((1 << 5) | (1 << 4))
+#define MAX77620_CNFGGLBL1_LBHYST_N     (1 << 4)
+#define MAX77620_CNFGGLBL1_LBDAC        0x0E
+#define MAX77620_CNFGGLBL1_LBDAC_N      (1 << 1)
+#define MAX77620_CNFGGLBL1_LBRSTEN      (1 << 0)
+
+/* CNFG BBC registers */
+#define MAX77620_CNFGBBC_ENABLE         (1 << 0)
+#define MAX77620_CNFGBBC_CURRENT_MASK       0x06
+#define MAX77620_CNFGBBC_CURRENT_SHIFT      1
+#define MAX77620_CNFGBBC_VOLTAGE_MASK       0x18
+#define MAX77620_CNFGBBC_VOLTAGE_SHIFT      3
+#define MAX77620_CNFGBBC_LOW_CURRENT_DISABLE    (1 << 5)
+#define MAX77620_CNFGBBC_RESISTOR_MASK      0xC0
+#define MAX77620_CNFGBBC_RESISTOR_SHIFT     6
+
+#define MAX77620_FPS_COUNT          3
+
+/* Interrupts */
+enum {
+    MAX77620_IRQ_TOP_GLBL,      /* Low-Battery */
+    MAX77620_IRQ_TOP_SD,        /* SD power fail */
+    MAX77620_IRQ_TOP_LDO,       /* LDO power fail */
+    MAX77620_IRQ_TOP_GPIO,      /* TOP GPIO internal int to MAX77620 */
+    MAX77620_IRQ_TOP_RTC,       /* RTC */
+    MAX77620_IRQ_TOP_32K,       /* 32kHz oscillator */
+    MAX77620_IRQ_TOP_ONOFF,     /* ON/OFF oscillator */
+    MAX77620_IRQ_LBT_MBATLOW,   /* Thermal alarm status, > 120C */
+    MAX77620_IRQ_LBT_TJALRM1,   /* Thermal alarm status, > 120C */
+    MAX77620_IRQ_LBT_TJALRM2,   /* Thermal alarm status, > 140C */
+};
+
+/* GPIOs */
+enum {
+    MAX77620_GPIO0,
+    MAX77620_GPIO1,
+    MAX77620_GPIO2,
+    MAX77620_GPIO3,
+    MAX77620_GPIO4,
+    MAX77620_GPIO5,
+    MAX77620_GPIO6,
+    MAX77620_GPIO7,
+    MAX77620_GPIO_NR,
+};
+
+/* FPS Source */
+enum max77620_fps_src {
+    MAX77620_FPS_SRC_0,
+    MAX77620_FPS_SRC_1,
+    MAX77620_FPS_SRC_2,
+    MAX77620_FPS_SRC_NONE,
+    MAX77620_FPS_SRC_DEF,
+};
+
+enum max77620_chip_id {
+    MAX77620,
+    MAX20024,
+};
+
+#endif /* _MFD_MAX77620_H_ */

exosphere/rebootstub/src/shutdown.c

@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2018-2019 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include "utils.h"
+#include "i2c.h"
+#include "timer.h"
+
+void do_shutdown(void) {
+    /* Initialize i2c. */
+    i2c_init();
+    
+    /* Stop alarm, shutdown. */
+    i2c_stop_rtc_alarm();
+    i2c_send_shutdown_cmd();
+    
+    while (true) { }
+}

exosphere/rebootstub/src/start.s

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -18,11 +18,16 @@
 .align 4
 .global _start
 _start:
-    b crt0
+    ldr r0, reboot_type
+    cmp r0, #0x0
+    beq do_shutdown
+    b jump_to_reboot_payload
+reboot_type:
+.word 0x00000001
 
-.global crt0
-.type crt0, %function
-crt0:
+.global jump_to_reboot_payload
+.type jump_to_reboot_payload, %function
+jump_to_reboot_payload:
     @ clear all registers
     ldr r0, =0x52425430 @ RBT0
     mov r1, #0x0

exosphere/rebootstub/src/timer.h

@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2018-2019 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#ifndef EXOSPHERE_REBOOTSTUB_TIMER_H
+#define EXOSPHERE_REBOOTSTUB_TIMER_H
+
+#include "utils.h"
+
+#define TIMERUS_CNTR_1US_0 MAKE_REG32(0x60005010)
+
+static inline void timer_wait(uint32_t microseconds) {
+    uint32_t old_time = TIMERUS_CNTR_1US_0;
+    while (TIMERUS_CNTR_1US_0 - old_time <= microseconds) {
+        /* Spin-lock. */
+    }
+}
+
+void spinlock_wait(uint32_t count);
+
+#endif

exosphere/rebootstub/src/utils.h

@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2018-2019 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#ifndef EXOSPHERE_REBOOTSTUB_UTILS_H
+#define EXOSPHERE_REBOOTSTUB_UTILS_H
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#define BIT(n)      (1u   << (n))
+#define BITL(n)     (1ull << (n))
+#define MASK(n)     (BIT(n) - 1)
+#define MASKL(n)    (BITL(n) - 1)
+#define MASK2(a,b)  (MASK(a) & ~MASK(b))
+#define MASK2L(a,b) (MASKL(a) & ~MASKL(b))
+
+#define MAKE_REG32(a)   (*(volatile uint32_t *)(a))
+
+#define ALIGN(m)        __attribute__((aligned(m)))
+#define PACKED          __attribute__((packed))
+
+#define ALINLINE        __attribute__((always_inline))
+
+#endif

exosphere/sc7fw/src/emc.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/sc7fw/src/emc.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/sc7fw/src/i2c.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/sc7fw/src/i2c.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/sc7fw/src/pmc.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/sc7fw/src/sc7.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/sc7fw/src/sc7.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/sc7fw/src/start.s

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/sc7fw/src/timer.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/sc7fw/src/utils.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/actmon.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/actmon.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/arm.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/arm.s

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/bootconfig.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -100,6 +100,8 @@ uint64_t bootconfig_get_value_for_sysctr0(void) {
 }
 
 uint64_t bootconfig_get_memory_arrangement(void) {
+    /* TODO: This function has changed pretty significantly since we implemented it. */
+    /* Not relevant for retail, but we'll probably want this to be accurate sooner or later. */
     if (bootconfig_is_debug_mode()) {
         if (fuse_get_dram_id() == 4) {
             if (LOADED_BOOTCONFIG->unsigned_config.data[0x23]) {
@@ -123,7 +125,7 @@ uint64_t bootconfig_get_memory_arrangement(void) {
     }
 }
 
-uint64_t bootconfig_get_kernel_memory_configuration(void) {
+uint64_t bootconfig_get_kernel_configuration(void) {
     if (bootconfig_is_debug_mode()) {
         uint64_t high_val = 0;
         if (fuse_get_dram_id() == 4) {

exosphere/src/bootconfig.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -21,6 +21,14 @@
 #include <stdint.h>
 #include "memory_map.h"
 
+/* This is kind of ConfigItem, but it's stored in BootConfig, so... */
+typedef enum {
+    KERNELCONFIGFLAG_INITIALIZE_MEMORY_TO_PATTERN   = (1 << 0),
+    KERNELCONFIGFLAG_ENABLE_USER_EXCEPTION_HANDLERS = (1 << 1),
+    KERNELCONFIGFLAG_ENABLE_USER_PMU_ACCESS         = (1 << 2),
+    KERNELCONFIGFLAG_CALL_SMC_PANIC_ON_KERNEL_ERROR = (1 << 8),
+} KernelConfigFlag;
+
 /* This provides management for Switch BootConfig. */
 
 #define LOADED_BOOTCONFIG (get_loaded_bootconfig())
@@ -78,7 +86,7 @@ bool bootconfig_take_extabt_serror_to_el3(void);
 uint64_t bootconfig_get_value_for_sysctr0(void);
 
 uint64_t bootconfig_get_memory_arrangement(void);
-uint64_t bootconfig_get_kernel_memory_configuration(void);
+uint64_t bootconfig_get_kernel_configuration(void);
 
 bool bootconfig_is_recovery_boot(void);
 uint64_t bootconfig_get_boot_reason(void);

exosphere/src/bootup.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/bootup.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/bpmp.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/car.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/car.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/coldboot_init.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -26,7 +26,7 @@
 
 #undef  MAILBOX_NX_BOOTLOADER_BASE
 #undef  TIMERS_BASE
-#define MAILBOX_NX_BOOTLOADER_BASE  (MMIO_GET_DEVICE_PA(MMIO_DEVID_NXBOOTLOADER_MAILBOX))
+#define MAILBOX_NX_BOOTLOADER_BASE(targetfw)  (target_firmware >= ATMOSPHERE_TARGET_FIRMWARE_700) ? (MMIO_GET_DEVICE_7X_PA(MMIO_DEVID_NXBOOTLOADER_MAILBOX)) : (MMIO_GET_DEVICE_PA(MMIO_DEVID_NXBOOTLOADER_MAILBOX))
 #define TIMERS_BASE                 (MMIO_GET_DEVICE_PA(MMIO_DEVID_TMRs_WDTs))
 
 extern const uint8_t __start_cold[];
@@ -48,13 +48,16 @@ static void identity_map_all_mappings(uintptr_t *mmu_l1_tbl, uintptr_t *mmu_l3_t
     }
 }
 
-static void mmio_map_all_devices(uintptr_t *mmu_l3_tbl) {
+static void mmio_map_all_devices(uintptr_t *mmu_l3_tbl, unsigned int target_firmware) {
     static const uintptr_t pas[]        =   { TUPLE_FOLD_LEFT_0(EVAL(MMIO_DEVID_MAX), _MMAPDEV, COMMA) };
     static const size_t sizes[]         =   { TUPLE_FOLD_LEFT_1(EVAL(MMIO_DEVID_MAX), _MMAPDEV, COMMA) };
     static const bool is_secure[]       =   { TUPLE_FOLD_LEFT_2(EVAL(MMIO_DEVID_MAX), _MMAPDEV, COMMA) };
+    
+    static const uintptr_t pas_7x[]     =   { TUPLE_FOLD_LEFT_0(EVAL(MMIO_DEVID_MAX), _MMAPDEV7X, COMMA) };
 
     for(size_t i = 0, offset = 0; i < MMIO_DEVID_MAX; i++) {
-        mmio_map_device(mmu_l3_tbl, MMIO_BASE + offset, pas[i], sizes[i], is_secure[i]);
+        uintptr_t pa = (target_firmware < ATMOSPHERE_TARGET_FIRMWARE_700) ? pas[i] : pas_7x[i];
+        mmio_map_device(mmu_l3_tbl, MMIO_BASE + offset, pa, sizes[i], is_secure[i]);
         offset += sizes[i];
         offset += 0x1000;
     }
@@ -127,7 +130,7 @@ static void configure_ttbls(unsigned int target_firmware) {
     mmu_map_table(2, mmu_l2_tbl, 0x1F0000000ull, mmu_l3_tbl, 0);
 
     identity_map_all_mappings(mmu_l1_tbl, mmu_l3_tbl);
-    mmio_map_all_devices(mmu_l3_tbl);
+    mmio_map_all_devices(mmu_l3_tbl, target_firmware);
     lp0_entry_map_all_ram_segments(mmu_l3_tbl);
     warmboot_map_all_ram_segments(mmu_l3_tbl);
     tzram_map_all_segments(mmu_l3_tbl, target_firmware);

exosphere/src/coldboot_main.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/configitem.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -35,13 +35,14 @@
 #undef u8
 #undef u32
 
-static bool g_battery_profile = false;
+static bool g_hiz_mode_enabled = false;
 static bool g_debugmode_override_user = false, g_debugmode_override_priv = false;
+static bool g_enable_usermode_exception_handlers = true;
 
 uint32_t configitem_set(bool privileged, ConfigItem item, uint64_t value) {
     switch (item) {
-        case CONFIGITEM_BATTERYPROFILE:
-            g_battery_profile = (value != 0);
+        case CONFIGITEM_HIZMODE:
+            g_hiz_mode_enabled = (value != 0);
             break;
         case CONFIGITEM_NEEDS_REBOOT:
             /* Force a reboot, if requested. */
@@ -80,6 +81,34 @@ uint32_t configitem_set(bool privileged, ConfigItem item, uint64_t value) {
                 while (1) { }
             }
             break;
+        case CONFIGITEM_NEEDS_SHUTDOWN:
+            /* Force a shutdown, if requested. */
+            {
+                if (value == 0) {
+                    return 0;
+                }
+                /* Set reboot kind = warmboot. */
+                MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC) + 0x450ull) = 0x1;
+                /* Patch SDRAM init to perform an SVC immediately after second write */
+                MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC) + 0x634ull) = 0x2E38DFFF;
+                MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC) + 0x638ull) = 0x6001DC28;
+                /* Set SVC handler to jump to reboot stub in IRAM. */
+                MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC) + 0x520ull) = 0x4003F000;
+                MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC) + 0x53Cull) = 0x6000F208;
+                
+                /* Copy reboot stub payload. */
+                ams_map_irampage(0x4003F000);
+                for (unsigned int i = 0; i < rebootstub_bin_size; i += 4) {
+                    MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_AMS_IRAM_PAGE) + i) = read32le(rebootstub_bin, i);
+                }
+                /* Tell rebootstub to shut down. */
+                MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_AMS_IRAM_PAGE) + 0x10) = 0x0;
+                ams_unmap_irampage();
+                
+                MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC) + 0x400ull) = 0x10;
+                while (1) { }
+            }
+            break;
         default:
             return 2;
     }
@@ -105,8 +134,12 @@ bool configitem_is_retail(void) {
     return is_retail != 0;
 }
 
-bool configitem_should_profile_battery(void) {
-    return g_battery_profile;
+bool configitem_is_hiz_mode_enabled(void) {
+    return g_hiz_mode_enabled;
+}
+
+void configitem_set_hiz_mode_enabled(bool enabled) {
+    g_hiz_mode_enabled = enabled;
 }
 
 bool configitem_is_debugmode_priv(void) {
@@ -131,6 +164,10 @@ void configitem_set_debugmode_override(bool user, bool priv) {
     g_debugmode_override_priv = priv;
 }
 
+void configitem_disable_usermode_exception_handlers(void) {
+    g_enable_usermode_exception_handlers = false;
+}
+
 uint32_t configitem_get(bool privileged, ConfigItem item, uint64_t *p_outvalue) {
     uint32_t result = 0;
     switch (item) {
@@ -178,11 +215,18 @@ uint32_t configitem_get(bool privileged, ConfigItem item, uint64_t *p_outvalue)
                 *p_outvalue = (int)(bootconfig_is_debug_mode());
             }
             break;
-        case CONFIGITEM_KERNELMEMORYCONFIGURATION:
-            *p_outvalue = bootconfig_get_kernel_memory_configuration();
+        case CONFIGITEM_KERNELCONFIGURATION:
+            {
+                uint64_t config = bootconfig_get_kernel_configuration();
+                /* Enable usermode exception handlers by default. */
+                if (g_enable_usermode_exception_handlers) {
+                    config |= KERNELCONFIGFLAG_ENABLE_USER_EXCEPTION_HANDLERS;
+                }
+                *p_outvalue = config;
+            }
             break;
-        case CONFIGITEM_BATTERYPROFILE:
-            *p_outvalue = (int)g_battery_profile;
+        case CONFIGITEM_HIZMODE:
+            *p_outvalue = (int)g_hiz_mode_enabled;
             break;
         case CONFIGITEM_ISQUESTUNIT:
             /* Added on 3.0, used to determine whether console is a kiosk unit. */
@@ -228,6 +272,18 @@ uint32_t configitem_get(bool privileged, ConfigItem item, uint64_t *p_outvalue)
             /* UNOFFICIAL: The fact that we are executing means we aren't in the process of rebooting. */
             *p_outvalue = 0;
             break;
+        case CONFIGITEM_NEEDS_SHUTDOWN:
+            /* UNOFFICIAL: The fact that we are executing means we aren't in the process of shutting down. */
+            *p_outvalue = 0;
+            break;
+        case CONFIGITEM_EXOSPHERE_VERHASH:
+            /* UNOFFICIAL: Gets information about the current exosphere git commit hash. */
+            *p_outvalue = ATMOSPHERE_RELEASE_VERSION_HASH;
+            break;
+        case CONFIGITEM_HAS_RCM_BUG_PATCH:
+            /* UNOFFICIAL: Gets whether this unit has the RCM bug patched. */
+            *p_outvalue = (int)(fuse_has_rcm_bug_patch());;
+            break;
         default:
             result = 2;
             break;

exosphere/src/configitem.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -32,8 +32,8 @@ typedef enum {
     CONFIGITEM_BOOTREASON = 9,
     CONFIGITEM_MEMORYARRANGE = 10,
     CONFIGITEM_ISDEBUGMODE = 11,
-    CONFIGITEM_KERNELMEMORYCONFIGURATION = 12,
-    CONFIGITEM_BATTERYPROFILE = 13,
+    CONFIGITEM_KERNELCONFIGURATION = 12,
+    CONFIGITEM_HIZMODE = 13,
     CONFIGITEM_ISQUESTUNIT = 14,
     CONFIGITEM_NEWHARDWARETYPE_5X = 15,
     CONFIGITEM_NEWKEYGENERATION_5X = 16,
@@ -42,6 +42,9 @@ typedef enum {
     /* These are unofficial, for usage by Exosphere. */
     CONFIGITEM_EXOSPHERE_VERSION = 65000,
     CONFIGITEM_NEEDS_REBOOT = 65001,
+    CONFIGITEM_NEEDS_SHUTDOWN = 65002,
+    CONFIGITEM_EXOSPHERE_VERHASH = 65003,
+    CONFIGITEM_HAS_RCM_BUG_PATCH = 65004,
 } ConfigItem;
 
 #define REBOOT_KIND_NO_REBOOT     0
@@ -53,10 +56,12 @@ uint32_t configitem_get(bool privileged, ConfigItem item, uint64_t *p_outvalue);
 
 bool configitem_is_recovery_boot(void);
 bool configitem_is_retail(void);
-bool configitem_should_profile_battery(void);
+bool configitem_is_hiz_mode_enabled(void);
 bool configitem_is_debugmode_priv(void);
 
 void configitem_set_debugmode_override(bool user, bool priv);
+void configitem_disable_usermode_exception_handlers(void);
+void configitem_set_hiz_mode_enabled(bool enabled);
 
 uint64_t configitem_get_hardware_type(void);
 

exosphere/src/cpu_context.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/cpu_context.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/exocfg.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -22,12 +22,7 @@
 #include "mmu.h"
 #include "memory_map.h"
 
-#define MAILBOX_BASE  (MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_NXBOOTLOADER_MAILBOX))
-
-/* TODO: Should this be at a non-static location? */
-#define MAILBOX_EXOSPHERE_CONFIG (*((volatile exosphere_config_t *)(MAILBOX_BASE + 0xE40ULL)))
-
-static exosphere_config_t g_exosphere_cfg = {MAGIC_EXOSPHERE_BOOTCONFIG, ATMOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG, EXOSPHERE_FLAGS_DEFAULT};
+static exosphere_config_t g_exosphere_cfg = {MAGIC_EXOSPHERE_CONFIG, ATMOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG, EXOSPHERE_FLAGS_DEFAULT};
 static bool g_has_loaded_config = false;
 
 #define EXOSPHERE_CHECK_FLAG(flag) ((g_exosphere_cfg.flags & flag) != 0)
@@ -42,11 +37,8 @@ unsigned int exosphere_load_config(void) {
     
     const unsigned int magic = MAILBOX_EXOSPHERE_CONFIG.magic;
     
-    if (magic == MAGIC_EXOSPHERE_BOOTCONFIG) {
+    if (magic == MAGIC_EXOSPHERE_CONFIG) {
         g_exosphere_cfg = MAILBOX_EXOSPHERE_CONFIG;
-    } else if (magic == MAGIC_EXOSPHERE_BOOTCONFIG_0) {
-        g_exosphere_cfg = MAILBOX_EXOSPHERE_CONFIG;
-        g_exosphere_cfg.flags = EXOSPHERE_FLAGS_DEFAULT;
     }
     
     return g_exosphere_cfg.target_firmware;
@@ -83,3 +75,11 @@ unsigned int exosphere_should_override_debugmode_user(void) {
     
     return EXOSPHERE_CHECK_FLAG(EXOSPHERE_FLAG_IS_DEBUGMODE_USER);
 }
+
+unsigned int exosphere_should_disable_usermode_exception_handlers(void) {
+    if (!g_has_loaded_config) {
+        generic_panic();
+    }
+    
+    return EXOSPHERE_CHECK_FLAG(EXOSPHERE_FLAG_DISABLE_USERMODE_EXCEPTION_HANDLERS);
+}

exosphere/src/exocfg.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -25,27 +25,27 @@
 
 /* This serves to set configuration for *exosphere itself*, separate from the SecMon Exosphere mimics. */
 
-/* "XBC0" */
-#define MAGIC_EXOSPHERE_BOOTCONFIG_0 (0x30434258)
-/* "XBC1" */
-#define MAGIC_EXOSPHERE_BOOTCONFIG (0x31434258)
+/* "EXO0" */
+#define MAGIC_EXOSPHERE_CONFIG (0x304F5845)
 
 #define EXOSPHERE_LOOSEN_PACKAGE2_RESTRICTIONS_FOR_DEBUG 1
 
-#define MAILBOX_BASE_PHYS  (MMIO_GET_DEVICE_PA(MMIO_DEVID_NXBOOTLOADER_MAILBOX))
+#define MAILBOX_EXOSPHERE_CONFIG (*((volatile exosphere_config_t *)(0x8000F000ull)))
 
-/* TODO: Should this be at a non-static location? */
-#define MAILBOX_EXOSPHERE_CONFIG_PHYS (*((volatile exosphere_config_t *)(MAILBOX_BASE_PHYS + 0xE40ULL)))
+/* Exosphere config in DRAM shares physical/virtual mapping. */
+#define MAILBOX_EXOSPHERE_CONFIG_PHYS MAILBOX_EXOSPHERE_CONFIG
 
-#define EXOSPHERE_FLAGS_DEFAULT 0x00000000
-#define EXOSPHERE_FLAG_PERFORM_620_KEYGEN (1 << 0u)
-#define EXOSPHERE_FLAG_IS_DEBUGMODE_PRIV  (1 << 1u)
-#define EXOSPHERE_FLAG_IS_DEBUGMODE_USER  (1 << 2u)
+#define EXOSPHERE_FLAG_PERFORM_620_KEYGEN                   (1 << 0u)
+#define EXOSPHERE_FLAG_IS_DEBUGMODE_PRIV                    (1 << 1u)
+#define EXOSPHERE_FLAG_IS_DEBUGMODE_USER                    (1 << 2u)
+#define EXOSPHERE_FLAG_DISABLE_USERMODE_EXCEPTION_HANDLERS  (1 << 3u)
+#define EXOSPHERE_FLAGS_DEFAULT (EXOSPHERE_FLAG_IS_DEBUGMODE_PRIV)
 
 typedef struct {
     unsigned int magic;
     unsigned int target_firmware;
     unsigned int flags;
+    unsigned int reserved;
 } exosphere_config_t;
 
 unsigned int exosphere_load_config(void);
@@ -53,10 +53,11 @@ unsigned int exosphere_get_target_firmware(void);
 unsigned int exosphere_should_perform_620_keygen(void);
 unsigned int exosphere_should_override_debugmode_priv(void);
 unsigned int exosphere_should_override_debugmode_user(void);
+unsigned int exosphere_should_disable_usermode_exception_handlers(void);
 
 static inline unsigned int exosphere_get_target_firmware_for_init(void) {
     const unsigned int magic = MAILBOX_EXOSPHERE_CONFIG_PHYS.magic;
-    if (magic == MAGIC_EXOSPHERE_BOOTCONFIG || magic == MAGIC_EXOSPHERE_BOOTCONFIG_0) {
+    if (magic == MAGIC_EXOSPHERE_CONFIG) {
         return MAILBOX_EXOSPHERE_CONFIG_PHYS.target_firmware;
     } else {
         return ATMOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG;

exosphere/src/flow.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/fuse.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -23,6 +23,10 @@
 #include "exocfg.h"
 
 #include "masterkey.h"
+
+static bool g_has_checked_for_rcm_bug_patch = false;
+static bool g_has_rcm_bug_patch = false;
+
 /* Prototypes for internal commands. */
 void fuse_make_regs_visible(void);
 
@@ -36,6 +40,11 @@ void fuse_init(void)
     fuse_make_regs_visible();
     fuse_secondary_private_key_disable();
     fuse_disable_programming();
+    
+    /* TODO: Should we allow this to be done later? */
+    if (!g_has_checked_for_rcm_bug_patch) {
+        (void)(fuse_has_rcm_bug_patch());
+    }
 
     /* TODO: Overrides (iROM patches) and various reads happen here */
 }
@@ -257,3 +266,39 @@ void fuse_get_hardware_info(void *dst) {
 
     memcpy(dst, hw_info, 0x10);
 }
+
+bool fuse_has_rcm_bug_patch(void) {
+    /* Only check for RCM bug patch once, and cache our result. */
+    if (!g_has_checked_for_rcm_bug_patch) {
+        /* Patched units have this bit set in reserved_sw, according to reports. */
+        if (FUSE_CHIP_REGS->FUSE_RESERVED_SW & 0x80) {
+            g_has_rcm_bug_patch = true;
+        }
+
+        /* Also check for an ipatch. */
+        {
+            uint32_t word_count = FUSE_CHIP_REGS->FUSE_FIRST_BOOTROM_PATCH_SIZE & 0x7f;
+            uint32_t word_addr = 191;
+
+            while (word_count) {
+                uint32_t word0 = fuse_hw_read(word_addr);
+                uint32_t ipatch_count = (word0 >> 16) & 0xf;
+
+                for (uint32_t i = 0; i < ipatch_count; i++) {
+                    uint32_t word = fuse_hw_read(word_addr - (i + 1));
+                    uint32_t addr = (word >> 16) * 2;
+
+                    if (addr == 0x769a) {
+                        g_has_rcm_bug_patch = true;
+                    }
+                }
+
+                word_addr -= word_count;
+                word_count = word0 >> 25;
+            }
+        }
+    }
+    g_has_checked_for_rcm_bug_patch = true;
+
+    return g_has_rcm_bug_patch;
+}

exosphere/src/fuse.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -74,7 +74,7 @@ typedef struct {
     uint32_t FUSE_CP_REV;
     uint32_t _0x94;
     uint32_t FUSE_TSENSOR_0;
-    uint32_t FUSE_FIRST_BOOTROM_PATCH_SIZE_REG;
+    uint32_t FUSE_FIRST_BOOTROM_PATCH_SIZE;
     uint32_t FUSE_SECURITY_MODE;
     uint32_t FUSE_PRIVATE_KEY[0x4];
     uint32_t FUSE_DEVICE_KEY;
@@ -215,4 +215,6 @@ uint32_t fuse_get_hardware_type(void);
 uint32_t fuse_get_retail_type(void);
 void fuse_get_hardware_info(void *dst);
 
+bool fuse_has_rcm_bug_patch(void);
+
 #endif

exosphere/src/gcm.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/gcm.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/i2c.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/i2c.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/interrupt.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

exosphere/src/interrupt.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 Atmosphère-NX
+ * Copyright (c) 2018-2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,