Revert "hoc-clk: add live vdd2, live boost clock and basic pwm dimming"
This reverts commit 15b7df8ef1.
This commit is contained in:
@@ -1,103 +0,0 @@
|
||||
exosphere, storage requirements:
|
||||
|
||||
Nonvolatile memory:
|
||||
0xE000
|
||||
|
||||
Volatile memory: 0x2000
|
||||
|
||||
Physical Address Space:
|
||||
-0x7C010000-0x7C012000 - boot code/volatile memory
|
||||
-0x7C012000-0x7C01E000 - program region
|
||||
-0x7C01E000-0x7C01F000 - global data/context
|
||||
-0x7C01F000-0x7C020000 - L2/L3 page table
|
||||
|
||||
-0x7C020000-0x7C040000 - Mariko-only program region
|
||||
-0x7C040000-0x7C048000 - Mariko-only program stack
|
||||
-0x7C048000-0x7C050000 - Reserved Mariko TZRAM (SE context carveouts, etc)
|
||||
|
||||
Virtual Address Space:
|
||||
|
||||
L1: 0x40 bytes.
|
||||
|
||||
L1 Entries:
|
||||
-0 (0x000000000-0x040000000): Empty
|
||||
-1 (0x040000000-0x080000000): Identity Mapping/Empty
|
||||
-2 (0x080000000-0x0C0000000): DRAM Mapping/Empty
|
||||
-3 (0x0C0000000-0x100000000): DRAM Mapping/Empty
|
||||
-4 (0x100000000-0x140000000): Empty
|
||||
-5 (0x140000000-0x180000000): Empty
|
||||
-6 (0x180000000-0x1C0000000): Empty
|
||||
-7 (0x1C0000000-0x200000000): Virtual Region
|
||||
|
||||
L2 Page and L3 page are both0x7C01F000
|
||||
|
||||
L2 Entries:
|
||||
-0x040000000 (Identity IRAM Table)
|
||||
- Entry Used: 0x000
|
||||
-0x07C000000 (Identity TZRAM Table)
|
||||
- Entry Used: 0x1E0
|
||||
-0x1F0000000 (Virtual Region Table)
|
||||
- Entry Used: 0x180
|
||||
|
||||
L3 Entries:
|
||||
- Identity TZRAM mapping (0x7C010000-0x7C020000)
|
||||
- Entry Used: 0x010-0x01F
|
||||
- Identity IRAM mapping (0x40020000-0x40040000)
|
||||
- Entry Used: 0x020-0x03F
|
||||
- Virtual Device region (0x1F0040000-0x1F0080000)
|
||||
- Entry Used: 0x040-0x07F
|
||||
- Read Only TZRAM Alias (0x1F00A0000-0x1F00B0000)
|
||||
- Entry Used: 0x0A0-0x0AF
|
||||
- Program region (0x1F00C0000-0x1F00CC000)
|
||||
- Entry Used: 0x0C0-0x0CB
|
||||
- Mariko Program region (0x1F00D0000-0x1F00F0000)
|
||||
- Entry Used: 0x0D0-0x0EF
|
||||
- Mariko Program stack (0x1F00F4000-0x1F00FC000)
|
||||
- Entry Used: 0x0F4-0x0FB
|
||||
- Secure DRAM Storage (0x1F0100000-0x1F0110000)
|
||||
- Entry Used: 0x100-0x10F
|
||||
- Debug DRAM Storage (0x1F0110000-0x1F0114000)
|
||||
- Entry Used: 0x110-0x113
|
||||
- SC7 IRAM Work Space (0x1F0120000-0x1F0130000)
|
||||
- Entry Used: 0x120-0x12F
|
||||
- SC7 IRAM Firmware (0x1F0140000-0x1F0141000)
|
||||
- Entry Used: 0x140-0x140
|
||||
- Debug Code (0x1F0150000-0x1F0154000)
|
||||
- Entry Used: 0x150-0x153
|
||||
- Reserved For Debug (0x1F0160000-0x1F0170000)
|
||||
- Entry Used: 0x160-0x16F
|
||||
- Boot Code (0x1F01C0000-0x1F01C2000)
|
||||
- Entry Used: 0x1C0-0x1C1
|
||||
- AMS IRAM Page (0x1F01F2000-0x1F01F2000)
|
||||
- Entry Used: 0x1F2-0x1F2
|
||||
- AMS User Page (0x1F01F4000-0x1F01F4000)
|
||||
- Entry Used: 0x1F4-0x1F4
|
||||
- SMC User Page (0x1F01F6000-0x1F01F6000)
|
||||
- Entry Used: 0x1F6-0x1F6
|
||||
- Volatile (Data) (0x1F01F8000-0x1F01F9000)
|
||||
- Entry Used: 0x1F8-0x1F8
|
||||
- Volatile (Stacks) (0x1F01FA000-0x1F01FB000)
|
||||
- Entry Used: 0x1FA-0x1FA
|
||||
- Global Data (0x1F01FC000-0x1F01FD000)
|
||||
|
||||
|
||||
NV Global Data needs:
|
||||
Exosphere + Emummc Config (<=0x200)
|
||||
Boot Config[0x400]
|
||||
RSA Context(0x100)
|
||||
Old Device Keys[0x20][0x10];
|
||||
Old Master Keys[0x20][0x10];
|
||||
Imported Rsa Keys[4][0x200];
|
||||
CPU Ctx[4][0x100];
|
||||
|
||||
Total: 0x1700
|
||||
|
||||
Global Data Page (accessible via X18):
|
||||
0x000-0x200: Exosphere Config
|
||||
0x200-0x400: Emummc Config
|
||||
0x400-0x800: Sealed AES Keys
|
||||
0x800-0xC00: Boot Config
|
||||
0xC00-0xFFF: CPU contexts. Can be replaced, but this fits exactly so minimizes program space waste.
|
||||
|
||||
Volatile Global Data needs:
|
||||
Random Cache 0x400 bytes
|
||||
@@ -1,4 +0,0 @@
|
||||
# emummc
|
||||
emummc is a collaborative project that provides eMMC storage emulation.
|
||||
|
||||
Please refer to the project's repository [here](https://github.com/m4xw/emuMMC) for detailed instructions and documentation.
|
||||
@@ -1,76 +0,0 @@
|
||||
# exosphère
|
||||
exosphère is a customized reimplementation of the Horizon OS's Secure Monitor.
|
||||
The Secure Monitor follows the same design principle as Arm's TrustZone and both terms can be used interchangeably in this context. It runs at the highest privilege mode (EL3) available to the main processor and is responsible for all the sensitive cryptographic operations needed by the system as well as power management for each CPU.
|
||||
|
||||
## Extensions
|
||||
exosphère expands the original Secure Monitor design by providing custom SMCs (Secure Monitor Calls) necessary to the homebrew ecosystem. Currently, these are:
|
||||
```
|
||||
uint32_t smc_ams_iram_copy(smc_args_t *args);
|
||||
uint32_t smc_ams_write_address(smc_args_t *args);
|
||||
uint32_t smc_ams_get_emummc_config(smc_args_t *args);
|
||||
```
|
||||
|
||||
Additionally, exosphère expands the functionality of two SMCs provided by the Horizon OS for getting/setting configuration items. The following custom configuration items are provided by exosphère:
|
||||
```
|
||||
CONFIGITEM_EXOSPHERE_VERSION = 65000,
|
||||
CONFIGITEM_NEEDS_REBOOT = 65001,
|
||||
CONFIGITEM_NEEDS_SHUTDOWN = 65002,
|
||||
CONFIGITEM_EXOSPHERE_VERHASH = 65003,
|
||||
CONFIGITEM_HAS_RCM_BUG_PATCH = 65004,
|
||||
CONFIGITEM_SHOULD_BLANK_PRODINFO = 65005,
|
||||
CONFIGITEM_ALLOW_CAL_WRITES = 65006,
|
||||
```
|
||||
|
||||
### smc_ams_iram_copy
|
||||
This function implements a copy of up to one page between DRAM and IRAM. Its arguments are:
|
||||
```
|
||||
args->X[1] = DRAM address (translated by kernel), must be 4-byte aligned.
|
||||
args->X[2] = IRAM address, must be 4-byte aligned.
|
||||
args->X[3] = Size (must be <= 0x1000 and 4-byte aligned).
|
||||
args->X[4] = 0 for read, 1 for write.
|
||||
```
|
||||
|
||||
### smc_ams_write_address
|
||||
This function implements a write to a DRAM page. Its arguments are:
|
||||
```
|
||||
args->X[1] = Virtual address, must be size-bytes aligned and readable by EL0.
|
||||
args->X[2] = Value.
|
||||
args->X[3] = Size (must be 1, 2, 4, or 8).
|
||||
```
|
||||
|
||||
### smc_ams_get_emummc_config
|
||||
This function retrieves configuration for the current [emummc](emummc.md) context. Its arguments are:
|
||||
```
|
||||
args->X[1] = MMC id, must be size-bytes aligned and readable by EL0.
|
||||
args->X[2] = Pointer to output (for paths for filebased + nintendo dir), must be at least 0x100 bytes.
|
||||
```
|
||||
|
||||
### CONFIGITEM_EXOSPHERE_VERSION
|
||||
This custom configuration item gets information about the current exosphere version.
|
||||
|
||||
### CONFIGITEM_NEEDS_REBOOT
|
||||
This custom configuration item is used to issue a system reboot into RCM or into a warmboot payload leveraging a secondary vulnerability to achieve code execution from warm booting.
|
||||
|
||||
### CONFIGITEM_NEEDS_SHUTDOWN
|
||||
This custom configuration item is used to issue a system shutdown with a warmboot payload leveraging a secondary vulnerability to achieve code execution from warm booting.
|
||||
|
||||
### CONFIGITEM_EXOSPHERE_VERHASH
|
||||
This custom configuration item gets information about the current exosphere git commit hash.
|
||||
|
||||
### CONFIGITEM_HAS_RCM_BUG_PATCH
|
||||
This custom configuration item gets whether the unit has the CVE-2018-6242 vulnerability patched.
|
||||
|
||||
### CONFIGITEM_SHOULD_BLANK_PRODINFO
|
||||
This custom configuration item gets whether the unit should simulate a "blanked" PRODINFO. See [here](../features/configurations.md) for more information.
|
||||
|
||||
### CONFIGITEM_ALLOW_CAL_WRITES
|
||||
This custom configuration item gets whether the unit should allow writing to the calibration partition.
|
||||
|
||||
## lp0fw
|
||||
This is a small, built-in payload that is responsible for waking up the system during a warm boot.
|
||||
|
||||
## sc7fw
|
||||
This is a small, built-in payload that is responsible for putting the system to sleep during a warm boot.
|
||||
|
||||
## rebootstub
|
||||
This is a small, built-in payload that provides functionality to reboot the system into any payload of choice.
|
||||
@@ -1,8 +0,0 @@
|
||||
# fusée
|
||||
fusée is a custom bootloader used to start the Atmosphère environment.
|
||||
|
||||
## fusée
|
||||
fusée is the first piece of Atmosphère's code that runs on the hardware.
|
||||
It is distributed as a standalone payload designed to be launched via RCM by abusing the CVE-2018-6242 vulnerability.
|
||||
|
||||
This payload is responsible for all the low-level hardware initialization required by the Nintendo Switch, setting up the cryptosystem, mounting/emulating the eMMC, injecting/patching system modules, and launching the exosphère component.
|
||||
@@ -1,11 +0,0 @@
|
||||
# libraries
|
||||
This is a collection of libraries for doing operating system development for the Nintendo Switch.
|
||||
|
||||
## libmesosphere
|
||||
libmesosphere is a work-in-progress C++ library implementing functionality for the Horizon Kernel.
|
||||
|
||||
## libstratosphere
|
||||
libstratosphere is a work-in-progress C++ library for development of system modules for the Nintendo Switch.
|
||||
|
||||
## libvapours
|
||||
Common boilerplate code for various purposes.
|
||||
@@ -1,3 +0,0 @@
|
||||
# mesosphère
|
||||
mesosphère is a work in progress customized kernel reimplementation.
|
||||
The Horizon OS's kernel follows microkernel design principles and runs at the EL1 level. It is currently subdivided into a loader (kernel_ldr) and the main kernel code.
|
||||
@@ -1,40 +0,0 @@
|
||||
# ams_mitm
|
||||
This module provides methods to intercept services provided by other system modules. It is further sub-divided according to the service it targets.
|
||||
|
||||
## bpc_mitm
|
||||
bpc_mitm enables intercepting requests to power control services. It currently intercepts:
|
||||
+ `am` system module (to intercept the Reboot/Power buttons in the overlay menu)
|
||||
+ `fatal` system module (to simplify payload reboot logic significantly)
|
||||
+ [nx-hbloader](https://github.com/switchbrew/nx-hbloader) (to allow homebrew to take advantage of the feature)
|
||||
|
||||
## fs_mitm
|
||||
fs_mitm enables intercepting file system operations. It can deny, delay, replace, or redirect any request made to the file system. It enables LayeredFS to function, which allows for replacement of game assets.
|
||||
|
||||
## hid_mitm
|
||||
hid_mitm enables intercepting requests to controller device services. It is currently disabled by default. If enabled, it intercepts:
|
||||
+ [nx-hbloader](https://github.com/switchbrew/nx-hbloader) (to help homebrew not need to be recompiled due to a breaking change introduced in the past)
|
||||
|
||||
Note that hid_mitm is currently deprecated and might be removed entirely in the future.
|
||||
|
||||
## ns_mitm
|
||||
ns_mitm enables intercepting requests to application control services. It currently intercepts:
|
||||
+ Web Applets (to facilitate nx-hbloader web browser launching)
|
||||
|
||||
## set_mitm
|
||||
set_mitm enables intercepting requests to the system settings service. It currently intercepts:
|
||||
+ `ns` system module and games (to allow for overriding game locales)
|
||||
+ All firmware debug settings requests (to allow modification of system settings not directly exposed to the user)
|
||||
|
||||
### Firmware Version
|
||||
set_mitm intercepts the `GetFirmwareVersion` command, if the requester is `qlaunch` or `maintenance`.
|
||||
It modifies the `display_version` field of the returned system version, causing the version to display
|
||||
in settings as `#.#.#|AMS #.#.#|?` with `? = S` when running under system eMMC or `? = E` when running under emulated eMMC. This allows users to easily verify what version of Atmosphère and what eMMC environment they are running.
|
||||
|
||||
### System Settings
|
||||
set_mitm intercepts the `GetSettingsItemValueSize` and `GetSettingsItemValue` commands for all requesters.
|
||||
It does so in order to enable user configuration of system settings, which are parsed from `/atmosphere/system_settings.ini` on boot. See [here](../../features/configurations.md) for more information on the system settings format.
|
||||
|
||||
## dns_mitm
|
||||
dns_mitm enables intercepting requests to dns resolution services, to enable redirecting requests for specified hostnames.
|
||||
|
||||
For documentation, see [here](../../features/dns_mitm.md).
|
||||
@@ -1,4 +0,0 @@
|
||||
# boot
|
||||
This module is a reimplementation of the Horizon OS's `boot` system module, which is responsible for initializing and configuring hardware.
|
||||
|
||||
Atmosphère's reimplementation displays its own black and white splash screen and battery icons as replacements for the original assets used during display initialization.
|
||||
@@ -1,4 +0,0 @@
|
||||
# boot2
|
||||
This module is a reimplementation of the Horizon OS's `boot2` system module, which is responsible for launching all the other necessary system modules.
|
||||
|
||||
Atmosphère's reimplementation allows launching user provided system modules from the SD card. See [here](../../features/configurations.md) for more information.
|
||||
@@ -1,4 +0,0 @@
|
||||
# creport
|
||||
This module is a reimplementation of the Horizon OS's `creport` system module, which is responsible for managing crash reports.
|
||||
|
||||
Atmosphère's reimplementation redirects writing of generated crash reports to the SD card under the folder `/atmosphere/crash_reports/`. It also prevents the automatic uploading of said crash reports.
|
||||
@@ -1,42 +0,0 @@
|
||||
# dmnt
|
||||
This module is a reimplementation of the Horizon OS's `dmnt` system module, which provides a debug monitor.
|
||||
|
||||
## Extensions
|
||||
Atmosphère implements an extension to provide cheat code functionality.
|
||||
|
||||
### Cheat Service
|
||||
A HIPC service API is provided for interacting with the cheat code manager through the service `dmnt:cht`. See [here](../../features/cheats.md) for more information on the cheat code format.
|
||||
|
||||
The SwIPC definition for `dmnt:cht` follows:
|
||||
```
|
||||
interface ams::dmnt::cheat::CheatService is dmnt:cht {
|
||||
[65000] HasCheatProcess() -> sf::Out<bool> out;
|
||||
[65001] GetCheatProcessEvent() -> sf::OutCopyHandle out_event;
|
||||
[65002] GetCheatProcessMetadata() -> sf::Out<CheatProcessMetadata> out_metadata;
|
||||
[65003] ForceOpenCheatProcess();
|
||||
[65004] PauseCheatProcess();
|
||||
[65005] ResumeCheatProcess();
|
||||
|
||||
[65100] GetCheatProcessMappingCount() -> sf::Out<u64> out_count;
|
||||
[65101] GetCheatProcessMappings(u64 offset) -> sf::OutArray<MemoryInfo> &mappings, sf::Out<u64> out_count;
|
||||
[65102] ReadCheatProcessMemory(u64 address, u64 out_size) -> sf::OutBuffer &buffer;
|
||||
[65103] WriteCheatProcessMemory(sf::InBuffer &buffer, u64 address, u64 in_size);
|
||||
[65104] QueryCheatProcessMemory(u64 address) -> sf::Out<MemoryInfo> mapping;
|
||||
|
||||
[65200] GetCheatCount() -> sf::Out<u64> out_count;
|
||||
[65201] GetCheats(u64 offset) -> sf::OutArray<CheatEntry> &cheats, sf::Out<u64> out_count;
|
||||
[65202] GetCheatById(u32 cheat_id) -> sf::Out<CheatEntry> cheat;
|
||||
[65203] ToggleCheat(u32 cheat_id);
|
||||
[65204] AddCheat(CheatDefinition &cheat, bool enabled) -> sf::Out<u32> out_cheat_id;
|
||||
[65205] RemoveCheat(u32 cheat_id);
|
||||
[65206] ReadStaticRegister(u8 which) -> sf::Out<u64> out;
|
||||
[65207] WriteStaticRegister(u8 which, u64 value);
|
||||
[65208] ResetStaticRegisters();
|
||||
|
||||
[65300] GetFrozenAddressCount() -> sf::Out<u64> out_count;
|
||||
[65301] GetFrozenAddresses(u64 offset) ->sf::OutArray<FrozenAddressEntry> &addresses, sf::Out<u64> out_count;
|
||||
[65302] GetFrozenAddress(u64 address) -> sf::Out<FrozenAddressEntry> entry;
|
||||
[65303] EnableFrozenAddress(u64 address, u64 width) -> sf::Out<u64> out_value;
|
||||
[65304] DisableFrozenAddress(u64 address);
|
||||
}
|
||||
```
|
||||
@@ -1,4 +0,0 @@
|
||||
# eclct.stub
|
||||
This module is a reimplementation of the Horizon OS's `eclct` system module, which collects error reports.
|
||||
|
||||
Atmosphère's reimplementation is a stub to remove any and all functionality pertaining to error report collection.
|
||||
@@ -1,4 +0,0 @@
|
||||
# erpt
|
||||
This module is a reimplementation of the Horizon OS's `erpt` system module, which is responsible for managing error reports.
|
||||
|
||||
Atmosphère's reimplementation redirects writing of generated error reports to the SD card under the folder `/atmosphere/erpt_reports/`.
|
||||
@@ -1,4 +0,0 @@
|
||||
# fatal
|
||||
This module is a reimplementation of the Horizon OS's `fatal` system module, which is responsible for managing fatal reports.
|
||||
|
||||
Atmosphère's reimplementation prevents error report creation and draws a custom error screen, showing registers and a backtrace. It also attempts to gather debugging info for any and all crashes and tries to save reports to the SD card under the folder `/atmosphere/fatal_reports/`.
|
||||
@@ -1,4 +0,0 @@
|
||||
# jpegdec
|
||||
This module is a reimplementation of the Horizon OS's `jpegdec` system module, which is responsible for JPEG format decoding.
|
||||
|
||||
Atmosphère's reimplementation allows two sessions instead of 1, so homebrew can use it for software JPEG decoding in addition to the OS itself.
|
||||
@@ -1,106 +0,0 @@
|
||||
# loader
|
||||
This module is a reimplementation of the Horizon OS's `ldr` system module, which is responsible for creating processes from executable NSO images and registering their access control.
|
||||
|
||||
## Extensions
|
||||
Atmosphère extends this module to allow executables to be replaced or patched by files stored on the SD card. Note that a few services are required for SD card access and therefore cannot be replaced or patched in this manner.
|
||||
|
||||
### Exefs Replacement
|
||||
Atmosphère's reimplementation allows replacing executable files in the file system.
|
||||
|
||||
#### Partition Replacement
|
||||
It is possible to replace the full exefs partition at once with a PFS0 file. In that case, Atmosphère will load the following file:
|
||||
```
|
||||
/atmosphere/contents/<program id>/exefs.nsp
|
||||
```
|
||||
|
||||
#### File Replacement
|
||||
When a process is created, loader will search for several NSO filenames in the program's exefs directory.
|
||||
These filenames are, in this order:
|
||||
- rtld
|
||||
- main
|
||||
- subsdk0
|
||||
- subsdk1
|
||||
- ...
|
||||
- subsdk9
|
||||
- sdk
|
||||
|
||||
Each NSO that is found will be loaded into the process contiguously. The process's entrypoint is at the first NSO to be loaded, usually `rtld` or `main`.
|
||||
|
||||
Additionally, when a process is loaded, loader will search for a `main.npdm` file in the exefs directory specifying the program's permissions.
|
||||
|
||||
Atmosphère extends this functionality by also searching for these files on the SD card. When searching for a file, loader will first check if it exists on the SD card. If it does, that file will be used instead. Otherwise, it will use the copy located in the exefs, if that is present. The following directory will be searched:
|
||||
```
|
||||
/atmosphere/contents/<program id>/exefs/
|
||||
```
|
||||
|
||||
This allows the replacement of applets, system modules, or even games with homebrew versions.
|
||||
|
||||
##### File Stubbing
|
||||
In order to prevent an NSO from being loaded even if it exists in the exefs, loader will also check if a stub file exists. If such a file exists, the NSO will not be loaded. The files should be named like `rtld.stub`, `main.stub`, etc. and may be empty.
|
||||
|
||||
##### Technical Semantics
|
||||
|
||||
loader's semantics for content override can (as you may observe from reading the above) be complicated to understand. The following is an abbreviated description of the very technical semantics by which loader decides what content to read when trying to read a file for a program id.
|
||||
|
||||
* If an external content filesystem exists for the program id, the external content filesystem is used directly with no further redirection.
|
||||
* Otherwise, if the program ID is being overridden with [nx-hbloader](https://github.com/switchbrew/nx-hbloader/releases) (see Homebrew Support below), the nsp filesystem for hbl is used directly with no further redirection.
|
||||
* Otherwise, if content redirection is enabled for the program ID (controlled by a configurable button combination) and a loose file exists on the SD card, the loose file is used.
|
||||
* Otherwise, if a stub file exists, a "Not Found" error is returned.
|
||||
* Otherwise, if an SD card executable filesystem ("exefs.nsp") exists, it is used without further redirection.
|
||||
* Finally, the "real"/base code file system is used without further redirection.
|
||||
|
||||
In addition, there are a few other technical details relevant to Atmosphere's redirection:
|
||||
* When overriding with nx-hbloader, the real code filesystem must exist. When "main.npdm" (a program capabilities descriptor file) is read, the content from the real code filesystem is read in order to determine whether an applet or an application is being overridden. This allows nx-hbloader to automatically support both applet and application environments.
|
||||
* When overriding applications, the real code filesystem must exist and contain valid content. This is required to perform accurate-to-Nintendo content verification procedures.
|
||||
* When programs are launched, both a program id and a "storage id" are specified by the launch requester. When the storage id specified is "none" (normally always invalid), Atmosphere assumes that a custom system module is attempting to be launched. This removes the aforementioned requirement on base content validity; the above procedure is still used to determine how to redirect content, however reads to the "real"/base code file system may return "Not Found" errors if the real/base code file system does not exist.
|
||||
|
||||
### NSO Patching
|
||||
When an NSO is loaded, Atmosphère's reimplementation will search for IPS patch files on the SD card in the following locations.
|
||||
```
|
||||
/atmosphere/exefs_patches/<patchset name>/<nso build id>.ips
|
||||
```
|
||||
|
||||
This organization allows patch sets affecting multiple NSOs to be distributed as a single directory and also allows patches from multiple patch sets to be stacked. Patches will be searched for in each patch set directory. The name of each patch file should match the hexadecimal build ID of the NSO to affect, except that trailing zero bytes may be left off. Because the NSO build ID is unique for every NSO, this means patches will only apply to the files they are meant to apply to.
|
||||
|
||||
Patch files are accepted in either IPS format or IPS32 format.
|
||||
|
||||
Because NSO files are compressed, patch files are not made between the original version of a compressed NSO and the modified version of such an NSO. Instead, they are made between the uncompressed version of an NSO and the modified (and still uncompressed) version of that NSO. This also means that a patch file cannot be manually applied to the compressed version of an NSO; it must be applied to the uncompressed version. Atmosphère's reimplementation will correctly apply these patches while loading the process regardless of whether the NSO it finds is compressed or not.
|
||||
|
||||
When authoring patches, [hactool](https://github.com/SciresM/hactool) can be used to find an NSO's build ID and to uncompress NSOs. Recent versions of the [ReSwitched IDA loaders](https://github.com/reswitched/loaders) can be used to load uncompressed NSOs into IDA in such a way that you can [apply patches to the input file](https://www.hex-rays.com/products/ida/support/idadoc/1618.shtml). From there, any IPS tool can be used to create the patch between the original NSO and the patched NSO. Note that if the NSO you are patching is larger than 16 MiB, you will have to use a tool that supports IPS32.
|
||||
|
||||
### Homebrew Support
|
||||
Atmosphère provides first class support for [nx-hbloader](https://github.com/switchbrew/nx-hbloader/releases) and [nx-hbmenu](https://github.com/switchbrew/nx-hbmenu/releases).
|
||||
|
||||
Launching of the nx-hbloader process is controlled by configurable button inputs. See [here](../../features/configurations.md) for more detailed information.
|
||||
|
||||
In addition, loader has extensions to enable homebrew to launch web applets. This normally requires the application launching the applet to have HTML Manual content inside an installed NCA. Atmosphère's reimplementation will automatically ensure that the commands used to check this succeed, and will redirect the relevant file system to the `/atmosphere/hbl_html/` subdirectory.
|
||||
|
||||
### IPC Commands
|
||||
Atmosphère's reimplementation extends the HIPC loader services' API with several custom commands.
|
||||
|
||||
The SwIPC definition for the `ldr:pm` extension commands follows:
|
||||
```
|
||||
interface ams::ldr::pm::ProcessManagerInterface is ldr:pm {
|
||||
...
|
||||
[65000] AtmosphereHasLaunchedProgram(ncm::ProgramId program_id) -> sf::Out<bool> out;
|
||||
[65001] AtmosphereGetProgramInfo(ncm::ProgramLocation &loc) -> sf::Out<ProgramInfo> out_program_info, sf::Out<cfg::OverrideStatus> out_status;
|
||||
[65002] AtmospherePinProgram(ncm::ProgramLocation &loc, cfg::OverrideStatus &override_status) -> sf::Out<PinId> out_id;
|
||||
}
|
||||
```
|
||||
|
||||
The SwIPC definition for the `ldr:dmnt` extension commands follows:
|
||||
```
|
||||
interface ams::ldr::dmnt::DebugMonitorInterface is ldr:dmnt {
|
||||
...
|
||||
[65000] AtmosphereHasLaunchedProgram(ncm::ProgramId program_id) -> sf::Out<bool> out;
|
||||
}
|
||||
```
|
||||
|
||||
The SwIPC definition for the `ldr:shel` extension commands follows:
|
||||
```
|
||||
interface ams::ldr::shell::ShellInterface is ldr:shel {
|
||||
...
|
||||
[65000] AtmosphereRegisterExternalCode(ncm::ProgramId program_id) -> sf::OutMoveHandle out;
|
||||
[65001] AtmosphereUnregisterExternalCode(ncm::ProgramId program_id);
|
||||
}
|
||||
```
|
||||
@@ -1,4 +0,0 @@
|
||||
# ncm
|
||||
This module is a reimplementation of the Horizon OS's `ncm` system module, which is responsible for content management.
|
||||
|
||||
Atmosphère's reimplementation is currently opt-in only. See [here](../../features/configurations.md) for more information.
|
||||
@@ -1,4 +0,0 @@
|
||||
# pgl
|
||||
This module is a reimplementation of the Horizon OS's `pgl` system module, which is responsible for launching programs and was introduced by firmware version `10.0.0`.
|
||||
|
||||
Currently, Atmosphère's reimplementation doesn't backport this module's functionalities to firmware versions lower than `10.0.0`.
|
||||
@@ -1,30 +0,0 @@
|
||||
# pm
|
||||
This module is a reimplementation of the Horizon OS's `pm` system module, which is responsible for tracking running processes on the system, and managing resource limits.
|
||||
|
||||
## Extensions
|
||||
Atmosphère extends this module with extra IPC commands and memory restriction changes.
|
||||
|
||||
### IPC Commands
|
||||
Atmosphère's reimplementation extends the HIPC loader services' API with several custom commands.
|
||||
|
||||
The SwIPC definition for the `pm:dmnt` extension commands follows:
|
||||
```
|
||||
interface ams::pm::dmnt::DebugMonitorServiceBase is pm:dmnt {
|
||||
...
|
||||
[65000] AtmosphereGetProcessInfo(os::ProcessId process_id) -> sf::OutCopyHandle out_process_handle, sf::Out<ncm::ProgramLocation> out_loc, sf::Out<cfg::OverrideStatus> out_status;
|
||||
[65001] AtmosphereGetCurrentLimitInfo(u32 group, u32 resource) -> sf::Out<s64> out_cur_val, sf::Out<s64> out_lim_val;
|
||||
}
|
||||
```
|
||||
|
||||
The SwIPC definition for the `pm:info` extension commands follows:
|
||||
```
|
||||
interface ams::pm::info::InformationService is pm:info {
|
||||
...
|
||||
[65000] AtmosphereGetProcessId(ncm::ProgramId program_id) -> sf::Out<os::ProcessId> out;
|
||||
[65001] AtmosphereHasLaunchedProgram(ncm::ProgramId program_id) -> sf::Out<bool> out;
|
||||
[65002] AtmosphereGetProcessInfo(os::ProcessId process_id) -> sf::Out<ncm::ProgramLocation> out_loc, sf::Out<cfg::OverrideStatus> out_status;
|
||||
}
|
||||
```
|
||||
|
||||
### Extra System Memory
|
||||
Atmosphère's reimplementation shrinks the APPLET memory pool by 24 MiB by default, giving this memory to the SYSTEM pool. This allows custom system modules to use more memory without hitting the SYSTEM memory limit.
|
||||
@@ -1,16 +0,0 @@
|
||||
# ro
|
||||
This module is a reimplementation of the Horizon OS's `ro` system module, which is responsible for loading dynamic libraries and was introduced by firmware version `3.0.0`.
|
||||
|
||||
Atmosphère's reimplementation backports this module's functionalities to firmware versions lower than `3.0.0` where said functionalities were provided by the `ldr` system module instead.
|
||||
|
||||
## Extensions
|
||||
Atmosphère extends this module to allow libraries to be patched by files stored on the SD card.
|
||||
|
||||
### NRO Patching
|
||||
When an NRO is loaded, Atmosphère's reimplementation will search for IPS patch files on the SD card in the following locations.
|
||||
```
|
||||
/atmosphere/nro_patches/<patchset name>/<nro build id>.ips
|
||||
```
|
||||
This organization allows patch sets affecting multiple NROs to be distributed as a single directory. Patches will be searched for in each patch set directory. The name of each patch file should match the hexadecimal build ID of the NRO to affect, except that trailing zero bytes may be left off. Because the NRO build ID is unique for every NRO, this means patches will only apply to the files they are meant to apply to.
|
||||
|
||||
Patch files are accepted in either IPS format or IPS32 format.
|
||||
@@ -1,47 +0,0 @@
|
||||
# sm
|
||||
This module is a reimplementation of the Horizon OS's `sm` system module, which is responsible for service management.
|
||||
|
||||
## Extensions
|
||||
Atmosphère extends this module with extra IPC commands and new services.
|
||||
|
||||
### Debug Monitor
|
||||
Atmosphère's reimplementation provides an interface `sm:dmnt` to allow a debug monitor to query the service manager's state.
|
||||
|
||||
The SwIPC definition for `sm:dmnt` follows:
|
||||
```
|
||||
interface ams::sm::DmntService is sm:dmnt {
|
||||
[65000] AtmosphereGetRecord(ServiceName service) -> sf::Out<ServiceRecord> record;
|
||||
[65001] AtmosphereListRecords(u64 offset) -> sf::OutArray<ServiceRecord> &records, sf::Out<u64> out_count;
|
||||
[65002] AtmosphereGetRecordSize() -> sf::Out<u64> record_size;
|
||||
}
|
||||
```
|
||||
|
||||
### IPC Commands
|
||||
Atmosphère's reimplementation extends the HIPC loader services' API with several custom commands.
|
||||
|
||||
The SwIPC definition for the `sm:` extension commands follows:
|
||||
```
|
||||
interface ams::sm::UserService is sm: {
|
||||
...
|
||||
[65000] AtmosphereInstallMitm(ServiceName service) -> sf::OutMoveHandle srv_h, sf::OutMoveHandle qry_h;
|
||||
[65001] AtmosphereUninstallMitm(ServiceName service);
|
||||
[65002] Deprecated_AtmosphereAssociatePidTidForMitm();
|
||||
[65003] AtmosphereAcknowledgeMitmSession(ServiceName service) -> sf::Out<MitmProcessInfo> client_info, sf::OutMoveHandle fwd_h;
|
||||
[65004] AtmosphereHasMitm(ServiceName service) -> sf::Out<bool> out;
|
||||
[65005] AtmosphereWaitMitm(ServiceName service);
|
||||
[65006] AtmosphereDeclareFutureMitm(ServiceName service);
|
||||
|
||||
[65100] AtmosphereHasService(ServiceName service) -> sf::Out<bool> out;
|
||||
[65101] AtmosphereWaitService(ServiceName service);
|
||||
}
|
||||
```
|
||||
|
||||
The SwIPC definition for the `sm:m` extension commands follows:
|
||||
```
|
||||
interface ams::sm::ManagerService is sm:m {
|
||||
...
|
||||
[65000] AtmosphereEndInitDefers(os::ProcessId process_id, sf::InBuffer &acid_sac, sf::InBuffer &aci_sac);
|
||||
[65001] AtmosphereHasMitm(ServiceName service) -> sf::Out<bool> out;
|
||||
[65002] AtmosphereRegisterProcess(os::ProcessId process_id, ncm::ProgramId program_id, cfg::OverrideStatus override_status, sf::InBuffer &acid_sac, sf::InBuffer &aci_sac);
|
||||
}
|
||||
```
|
||||
@@ -1,2 +0,0 @@
|
||||
# spl
|
||||
This module is a reimplementation of the Horizon OS's `spl` system module, which is responsible for providing secure platform services such as cryptographic operations.
|
||||
@@ -1,21 +0,0 @@
|
||||
# stratosphère
|
||||
stratosphère provides customization of the Horizon OS at the system level. This includes a reimplementation of several system modules and additional, custom system modules that extend or add a variety of features.
|
||||
|
||||
## Modules
|
||||
The modules currently provided by stratosphère are:
|
||||
+ [ams_mitm](modules/ams_mitm.md)
|
||||
+ [boot](modules/boot.md)
|
||||
+ [boot2](modules/boot2.md)
|
||||
+ [creport](modules/creport.md)
|
||||
+ [dmnt](modules/dmnt.md)
|
||||
+ [eclct.stub](modules/eclct.stub.md)
|
||||
+ [erpt](modules/erpt.md)
|
||||
+ [fatal](modules/fatal.md)
|
||||
+ [jpegdec](modules/jpegdec.md)
|
||||
+ [loader](modules/loader.md)
|
||||
+ [ncm](modules/ncm.md)
|
||||
+ [pgl](modules/pgl.md)
|
||||
+ [pm](modules/pm.md)
|
||||
+ [ro](modules/ro.md)
|
||||
+ [sm](modules/sm.md)
|
||||
+ [spl](modules/spl.md)
|
||||
@@ -1,3 +0,0 @@
|
||||
# thermosphère
|
||||
thermosphère is a work in progress hypervisor implementation.
|
||||
This aims to provide functionality at the EL2 level which remains unused by the Horizon OS.
|
||||
@@ -1,5 +0,0 @@
|
||||
# troposphère
|
||||
troposphère provides customization of the Horizon OS at the application level.
|
||||
|
||||
## reboot_to_payload
|
||||
Sample application to perform a system reboot into a payload of choice.
|
||||
Reference in New Issue
Block a user