rosalina: fix volume slider override value calculation

Below 50%, the volume slider moves the dB value twice as fast. When
linearly interpolating the value in dB (lerp in log-scale), we need to
account for that fact to match how the MCU firmware handles the actual
volume slider.

.github/ISSUE_TEMPLATE/bug-report.md

@@ -25,7 +25,7 @@ about: Use this to report bugs you encounter with Luma3DS. Make sure you upload
 
 **SysNAND version (+emu/redNAND version if applicable):**
 
-[e.g. 11.13.0-45U SysNAND, 11.13.0-45E EmuNAND]
+[e.g. 11.17.0-50U SysNAND, 11.17.0-50E EmuNAND]
 <!--You can check which version you're on in System Settings. It will be on the bottom right of the top screen.-->
 
 **Entrypoint (How/what you're using to boot Luma3DS):**
@@ -34,7 +34,7 @@ about: Use this to report bugs you encounter with Luma3DS. Make sure you upload
 
 **Luma3DS version:**
 
-[e.g. v10.2 stable or if using non-releases specify the commit like this https://github.com/LumaTeam/Luma3DS/commit/0543c208fd154e6326ea5da8cbf66ffcbdef010c]
+[e.g. v13.2.1 stable or if using non-releases specify the commit like this https://github.com/LumaTeam/Luma3DS/commit/988ec17ebfce513fc4589f7b12e0d6e3894ae542]
 
 **Luma3DS configuration/options:**
 
@@ -52,31 +52,26 @@ PIN lock: ( )
 New 3DS CPU: ( )
 <!--This option is only available on New 3DS (XL)/New 2DS XL.-->
 
+Hbmenu autoboot: ( )
+
 --
 
 Autoboot EmuNAND: ( )
 <!--This option is only available if there's at least one EmuNAND.-->
 
-Use EmuNAND FIRM if booting with R: ( )
-<!--This option is only available if there's at least one EmuNAND.-->
-
 Enable loading external FIRMs and modules: ( )
 <!--Firmware (.bin) files are not required by Luma, or NTR CFW anymore.
 -- If you're having issues with this option enabled try deleting them from the luma folder on the root of the SD card or /rw/luma on CTRNAND and disabling this option.-->
 
 Enable game patching: ( )
 
+Redirect app. syscore threads to core2: ( )
+<!--This option is only available on New 3DS (XL)/New 2DS XL.-->
+
 Show NAND or user string in System Settings: ( )
 
 Show GBA boot screen in patched AGB_FIRM: ( )
 
-Set developer UNITINFO: ( )
-
-Disable Arm11 exception handlers: ( )
-
-Enable Rosalina on SAFE_FIRM: ( )
-<!--This option is only available on New 3DS (XL)/New 2DS XL.-->
-
 --
 
 
@@ -94,7 +89,8 @@ Enable Rosalina on SAFE_FIRM: ( )
 2.
 
 
-**Dump file:**
-<!--If the issue leads to a crash you must uncheck the "Disable Arm11 exception handlers" option.
+**Dump file (if applicable):**
+<!--If the issue leads to a crash you must ensure the "Disable Arm11 exception handlers"
+-- option is not disabled in config.ini.
 -- The error message will tell you where the dump is.
 -- Zip the dmp file and drag & drop it below.-->

.gitignore

@@ -21,3 +21,4 @@ exceptions/arm11/build
 .settings
 
 Luma3DS*.zip
+hbmenu.zip

Makefile

@@ -31,16 +31,17 @@ clean:
 	@rm -rf *.firm *.zip *.3dsx
 
 # boot.3dsx comes from https://github.com/fincs/new-hbmenu/releases
-$(NAME)$(REVISION).zip:	boot.firm boot.3dsx
-	@zip -r $@ $^ -x "*.DS_Store*" "*__MACOSX*"
+$(NAME)$(REVISION).zip:	hbmenu.zip boot.firm
+	@cp $< $@
+	@zip $@ boot.firm -x "*.DS_Store*" "*__MACOSX*"
 
 boot.firm:	$(SUBFOLDERS)
 	@firmtool build $@ -D sysmodules/sysmodules.bin arm11/arm11.elf arm9/arm9.elf k11_extension/k11_extension.elf \
 	-A 0x18180000 -C XDMA XDMA NDMA XDMA
 	@echo built... $(notdir $@)
 
-boot.3dsx:
-	@curl -sSfLO "https://github.com/fincs/new-hbmenu/releases/latest/download/$@"
+hbmenu.zip:
+	@curl -sSfL $(shell curl -s https://api.github.com/repos/devkitPro/3ds-hbmenu/releases/latest | grep 'browser_' | cut -d\" -f4) -o $@
 	@echo downloaded... $(notdir $@)
 
 $(SUBFOLDERS):

README.md

@@ -1,36 +1,112 @@
 # Luma3DS
-*Noob-proof (N)3DS "Custom Firmware"*
 
-### What it is
-**Luma3DS** is a program to patch the system software of (New) Nintendo (2)3DS handheld consoles "on the fly", adding features such as per-game language settings, debugging capabilities for developers, and removing restrictions enforced by Nintendo such as the region lock.
+![GitHub Downloads (all assets, all releases)](https://img.shields.io/github/downloads/LumaTeam/Luma3DS/total)
+![License](https://img.shields.io/badge/License-GPLv3-blue.svg)
 
-It also allows you to run unauthorized ("homebrew") content by removing signature checks.
-To use it, you will need a console capable of running homebrew software on the Arm9 processor.
+*Nintendo 3DS "Custom Firmware"*
 
-Since v8.0, Luma3DS has its own in-game menu, triggerable by <kbd>L+Down+Select</kbd> (see the [release notes](https://github.com/LumaTeam/Luma3DS/releases/tag/v8.0)).
+![Boot menu screenshot](img/boot_menu_v1321.png)
+![Rosalina menu screenshot](img/rosalina_menu_v1321.png)
 
-#
-### Compiling
-* Prerequisites
-    1. git
-    2. [makerom](https://github.com/jakcron/Project_CTR) in PATH
-    3. [firmtool](https://github.com/TuxSH/firmtool)
-    4. Up-to-date devkitARM+libctru
-1. Clone the repository with `git clone https://github.com/LumaTeam/Luma3DS.git`
-2. Run `make`.
+## Description
+**Luma3DS** patches and reimplements significant parts of the system software running on all models of the Nintendo 3DS family of consoles. It aims to greatly improve the user experience and support the 3DS far beyond its end-of-life. Features include:
 
-    The produced `boot.firm` is meant to be copied to the root of your SD card for usage with Boot9Strap.
+* **First-class support for homebrew applications**
+* **Rosalina**, an overlay menu (triggered by <kbd>L+Down+Select</kbd> by default), allowing things like:
+    * Taking screenshots while in game
+    * Blue light filters and other screen filters
+    * Input redirection to play with external devices, such as controllers
+    * Using cheat codes
+    * Setting time and date accurately from the network (NTP)
+    * ... and much more!
+* **Many game modding features**, such as, but not limited to:
+    * Game plugins (in 3GX format)
+    * Per-game language overrides ("locale emulation")
+    * Asset content path redirection ("LayeredFS")
+* **Support for user-provided patches and/or full "system modules" replacements**, an essential feature for Nintendo Network replacements (amongst other projects)
+* A **fully-fledged GDB stub**, allowing homebrew developers and reverse-engineers alike to work much more efficiently
+* Ability to chainload other firmware files, including other versions of itself
+* ... and much more!
 
-#
-### Setup / Usage / Features
-See https://github.com/LumaTeam/Luma3DS/wiki
+## Installation and upgrade
+Luma3DS requires [boot9strap](https://github.com/SciresM/boot9strap) to run.
 
-#
-### Credits
-See https://github.com/LumaTeam/Luma3DS/wiki/Credits
+Once boot9strap has been installed, simply download the [latest release archive](https://github.com/LumaTeam/Luma3DS/releases/latest) and extract the archive onto the root of your SD card to "install" or to upgrade Luma3DS alongside the [homebrew menu and certs bundle](https://github.com/devkitPro/3ds-hbmenu) shipped with it. Replace existing files and merge existing folders if necessary.
 
-#
-### Licensing
+## Basic usage
+**The main Luma3DS configuration menu** can be accessed by pressing <kbd>Select</kbd> at boot. The configuration file is stored in `/luma/config.ini` on the SD card (or `/rw/luma/config.ini` on the CTRNAND partition if Luma3DS has been launched from the CTRNAND partition, which happens when SD card is missing).
+
+**The chainloader menu** is accessed by pressing <kbd>Start</kbd> at boot, or from the configuration menu. Payloads are expected to be located in `/luma/payloads` with the `.firm` extension; if there is only one such payload, the aforementionned selection menu will be skipped. Hotkeys can be assigned to payload, for example `x_test.firm` will be chainloaded when <kbd>X</kbd> is pressed at boot.
+
+**The overlay menu, Rosalina**, has a default button combination: <kbd>L+Down+Select</kbd>. For greater flexbility, most Rosalina menu settings aren't saved automatically, hence the "Save settings" option.
+
+**GDB ports**, when enabled, are `4000-4002` for the normal ports. Use of `attach` in "extended-remote" mode, alongside `info os processes` is supported and encouraged (for reverse-engineering, also check out `monitor getmemregions`). The port for the break-on-start feature is `4003` without "extended-remote". Both devkitARM-patched GDB and IDA Pro (without "stepping support" enabled) are actively supported.
+
+We have a wiki, however it is currently very outdated.
+
+## Components
+
+Luma3DS consists of multiple components. While the code style within each component is mostly consistent, these components have been written over many years and may not reflect how maintainers would write new code in new components/projects:
+
+* **arm9**, **arm11**: baremetal main settings menu, chainloader and firmware loader. Aside from showing settings and chainloading to other homebrew firmware files on demand, it is responsible for patching the official firmware to modify `Process9` code and to inject all other custom components. This was the first component ever written for this project, in 2015
+* **k11_extension**: code extending the Arm11 `NATIVE_FIRM` kernel (`Kernel11`). It is injected by the above mentioned baremetal loader into the kernel by hooking its startup code, then hooks itself into the rest of the kernel. Its features include hooking system calls (SVCs), introducing new SVCs and hooking into interprocess communications, to bypass limitations in Nintendo's system design. This is the component that allows Rosalina to pause other processes on overlay menu entry, for example. This was written at a time when we didn't fully reverse-engineer the kernel, and originally released in 2017 alongside Rosalina. Further hooks for "game plugin" support have been merged in 2023
+* **sysmodules**: reimplementation of "system modules" (processes) of the 3DS's OS (except for Rosalina being custom), currently only initial processes loaded directly in-memory by the kernel ("kernel initial process", or KIP in short)
+    * **loader**: process that loads non-KIP processes from storage. Because this is the perfect place to patch/replace executable code, this is where all process patches are done, enabling in particular "game modding" features. This is also the sysmodule handling 3DSX homebrew loading. Introduced in 2016
+    * _**rosalina**_: the most important component of Luma3DS and custom KIP: overlay menu, GDB server, `err:f` (fatal error screen) reimplementation, and much more. Introduced in mid-2017, and has continuously undergone changes and received many external contributions ever since
+    * **pxi**: Arm11<>Arm9 communication KIP, reimplemented just for the sake of it. Introduced late 2017
+    * **sm**: service manager KIP, reimplemented to remove service access control restrictions. Introduced late 2017
+    * **pm**: process manager KIP reponsible of starting/terminating processes and instructing `loader` to load them. The reimplemention allows for break-on-start GDB feature in Rosalina, as well as lifting FS access control restrictions the proper way. Introduced in 2019
+
+## Maintainers
+
+* **[@TuxSH](https://github.com/TuxSH)**: lead developer, created and maintains most features of the project. Joined in 2016
+* **[@AuroraWright](https://github.com/AuroraWright)**: author of the project, implemented the core features (most of the baremetal boot settings menu and firmware loading code) with successful design decisions that made the project popular. Created the project in 2015, currently inactive
+* **[@PabloMK7](https://github.com/PabloMK7)**: maintainer of the plugin loader feature merged for the v13.0 release. Joined in 2023
+
+## Roadmap
+
+There are still a lot more features and consolidation planned for Luma3DS! Here is a list of what is currently in store:
+
+* Full reimplementation of `TwlBg` and `AgbBg`. This will allow much better, and more configurable, upscaling for top screen in DS and GBA games (except on Old 2DS). This is currently being developed privately in C++23 (no ETA). While this is quite a difficult endeavor as this requires rewriting the entire driver stack in semi-bare-metal (limited kernel with no IPC), this is the most critical feature for Luma3DS to have and will make driver sysmodule reimpelementation trivial
+* Reimplementation of `Process9` for `TWL_FIRM` and `AGB_FIRM` to allow for more features in DS and GBA compatibility mode (ones that require file access)
+* Eventually, a full `Kernel11` reimplementation
+
+## Known issues
+
+* **Cheat engine crashes with some applications, in particular Pokémon games**: there is a race condition in Nintendo's `Kernel11` pertaining to attaching a new `KDebugThread` to a `KThread` on thread creation, and another thread null-dereferencing `thread->debugThread`. This causes the cheat engine to crashes games that create and destroy many threads all the time (like Pokémon).
+    * For these games, having a **dedicated "game plugin"** is the only alternative until `Kernel11` is reimplemented.
+* **Applications reacting to Rosalina menu button combo**: Rosalina merely polls button input at an interval to know when to show the menu. This means that the Rosalina menu combo can sometimes be processed by the game/process that is going to be paused.
+    * You can **change the menu combo** in the "Miscellaneous options" submenu (then save it with "Save settings" in the main menu) to work around this.
+
+## Building from source
+
+To build Luma3DS, the following is needed:
+* git
+* [makerom](https://github.com/jakcron/Project_CTR) in `$PATH`
+* [firmtool](https://github.com/TuxSH/firmtool) installed
+* up-to-date devkitARM and libctru:
+    * install `dkp-pacman` (or, for distributions that already provide pacman, add repositories): https://devkitpro.org/wiki/devkitPro_pacman
+    * install packages from `3ds-dev` metapackage: `sudo dkp-pacman -S 3ds-dev --needed`
+    * while libctru and Luma3DS releases are kept in sync, you may have to build libctru from source for non-release Luma3DS commits
+
+While Luma3DS releases are bundled with `3ds-hbmenu`, Luma3DS actually compiles into one single file: `boot.firm`. Just copy it over to the root of your SD card ([ftpd](https://github.com/mtheall/ftpd) is the easiest way to do so), and you're done.
+
+## Licensing
 This software is licensed under the terms of the GPLv3. You can find a copy of the license in the LICENSE.txt file.
 
-Files in the GDB stub are instead triple-licensed as MIT or "GPLv2 or any later version", in which case it's specified in the file header.
+Files in the GDB stub are instead triple-licensed as MIT or "GPLv2 or any later version", in which case it's specified in the file header. PM, SM, PXI reimplementations are also licensed under MIT.
+
+## Credits
+
+Luma3DS would not be what it is without the contributions and constructive feedback of many. We would like to thanks in particular:
+
+* **[@devkitPro](https://github.com/devkitPro)** (especially **[@fincs](https://github.com/fincs)**, **[@WinterMute](https://github.com/WinterMute)** and **[@mtheall](https://github.com/mtheall)**) for providing quality and easy-to-use toolchains with bleeding-edge GCC, and for their continued technical advice
+* **[@Nanquitas](https://github.com/Nanquitas)** for the initial version of the game plugin loader code as well as very useful contributions to the GDB stub
+* **[@piepie62](https://github.com/piepie62)** for the current implementation of the Rosalina cheat engine, **Duckbill** for its original implementation
+* **[@panicbit](https://github.com/panicbit)** for the original implementation of screen filters in Rosalina
+* **[@jasondellaluce](https://github.com/jasondellaluce)** for LayeredFS
+* **[@LiquidFenrir](https://github.com/LiquidFenrir)** for the memory viewer inside Rosalina's "Process List"
+* **ChaN** for [FatFs](http://elm-chan.org/fsw/ff/00index_e.html)
+* Everyone who has contributed to the Luma3DS repository
+* Everyone who has assisted with troubleshooting end-users
+* Everyone who has provided constructive feedback to Luma3DS

arm11/source/main.c

@@ -84,7 +84,8 @@ static void initScreens(u32 brightnessLevel, struct fb *fbs)
     *(vu32 *)0x10400490 = 0x000002D0;
     *(vu32 *)0x1040049C = 0x00000000;
 
-    //Disco register
+    // Color LUT
+    *(vu32 *)0x10400480 = 0;
     for(u32 i = 0; i < 256; i++)
         *(vu32 *)0x10400484 = 0x10101 * i;
 
@@ -119,7 +120,8 @@ static void initScreens(u32 brightnessLevel, struct fb *fbs)
     *(vu32 *)0x10400590 = 0x000002D0;
     *(vu32 *)0x1040059C = 0x00000000;
 
-    //Disco register
+    // Color LUT
+    *(vu32 *)0x10400580 = 0;
     for(u32 i = 0; i < 256; i++)
         *(vu32 *)0x10400584 = 0x10101 * i;
 
@@ -193,6 +195,28 @@ static void deinitScreens(void)
     *(vu32 *)0x10202014 = 0;
 }
 
+static void zerofillN3dsAblRegisters(void)
+{
+    // It should be fine to write to these regs even on O3DS as they
+    // are RAZ/WI
+
+    // TODO: read from calibration, but null values should do just
+    // fine. From testing, LUT explicitly ignores null values, and
+    // it is probably the case of reg @ 0x54 as well.
+    *(vu32 *)0x10202250 = 0; // unknown 24-bit value, seen: 0
+    *(vu32 *)0x10202254 = 0; // unknown 24-bit value, seen: nonzero
+
+    *(vu32 *)0x10202A50 = 0; // unknown 24-bit value, seen: 0
+    *(vu32 *)0x10202A54 = 0; // unknown 24-bit value, seen: nonzero
+
+    for (u32 i = 0; i < 64; i++) {
+        // Blend colors (w/ color multiplication) for each group
+        // of 4 relative-luminance Rs
+        *(vu32 *)(0x10202300 + 4*i) = 0;
+        *(vu32 *)(0x10202B00 + 4*i) = 0;
+    }
+}
+
 void main(void)
 {
     operation = ARM11_READY;
@@ -221,6 +245,9 @@ void main(void)
             case DEINIT_SCREENS:
                 deinitScreens();
                 break;
+            case ZEROFILL_N3DS_ABL_REGISTERS:
+                zerofillN3dsAblRegisters();
+                break;
             case PREPARE_ARM11_FOR_FIRMLAUNCH:
                 memcpy((void *)0x1FFFFC00, (void *)prepareForFirmlaunch, prepareForFirmlaunchSize);
                 *(vu32 *)0x1FFFFFFC = 0;

arm11/source/types.h

@@ -60,6 +60,7 @@ typedef enum
     SWAP_FRAMEBUFFERS,
     UPDATE_BRIGHTNESS,
     DEINIT_SCREENS,
+    ZEROFILL_N3DS_ABL_REGISTERS,
     PREPARE_ARM11_FOR_FIRMLAUNCH,
     ARM11_READY,
 } Arm11Operation;

arm9/linker.ld

@@ -46,6 +46,7 @@ SECTIONS
         chainloader.o(.text*)
         i2c.o(.text*)
         arm9_exception_handlers.o(.text*)
+        KEEP (*(.emunand_patch))
 
         *(.arm9_exception_handlers.rodata*)
         chainloader.o(.rodata*)

arm9/source/config.c

@@ -39,6 +39,7 @@
 #include "pin.h"
 #include "i2c.h"
 #include "ini.h"
+#include "firm.h"
 
 #include "config_template_ini.h" // note that it has an extra NUL byte inserted
 
@@ -64,12 +65,11 @@ static const char *singleOptionIniNamesBoot[] = {
     "app_syscore_threads_on_core_2",
     "show_system_settings_string",
     "show_gba_boot_screen",
-    "enable_dsi_external_filter",
-    "allow_updown_leftright_dsi",
 };
 
 static const char *singleOptionIniNamesMisc[] = {
     "use_dev_unitinfo",
+    "enable_dsi_external_filter",
     "disable_arm11_exception_handlers",
     "enable_safe_firm_rosalina",
 };
@@ -483,7 +483,7 @@ static int configIniHandler(void* user, const char* section, const char* name, c
             return 1;
         } else if (strcmp(name, "screen_filters_top_gamma") == 0) {
             s64 opt;
-            CHECK_PARSE_OPTION(parseDecFloatOption(&opt, value, 0, 1411 * FLOAT_CONV_MULT));
+            CHECK_PARSE_OPTION(parseDecFloatOption(&opt, value, 0, 8 * FLOAT_CONV_MULT));
             cfg->topScreenFilter.gammaEnc = opt;
             return 1;
         } else if (strcmp(name, "screen_filters_top_contrast") == 0) {
@@ -501,6 +501,11 @@ static int configIniHandler(void* user, const char* section, const char* name, c
             CHECK_PARSE_OPTION(parseBoolOption(&opt, value));
             cfg->topScreenFilter.invert = opt;
             return 1;
+        } else if (strcmp(name, "screen_filters_top_color_curve_adj") == 0) {
+            s64 opt;
+            CHECK_PARSE_OPTION(parseDecIntOption(&opt, value, 0, 2));
+            cfg->topScreenFilter.colorCurveCorrection = (u8)opt;
+            return 1;
         } else if (strcmp(name, "screen_filters_bot_cct") == 0) {
             s64 opt;
             CHECK_PARSE_OPTION(parseDecIntOption(&opt, value, 1000, 25100));
@@ -508,7 +513,7 @@ static int configIniHandler(void* user, const char* section, const char* name, c
             return 1;
         } else if (strcmp(name, "screen_filters_bot_gamma") == 0) {
             s64 opt;
-            CHECK_PARSE_OPTION(parseDecFloatOption(&opt, value, 0, 1411 * FLOAT_CONV_MULT));
+            CHECK_PARSE_OPTION(parseDecFloatOption(&opt, value, 0, 8 * FLOAT_CONV_MULT));
             cfg->bottomScreenFilter.gammaEnc = opt;
             return 1;
         } else if (strcmp(name, "screen_filters_bot_contrast") == 0) {
@@ -526,6 +531,11 @@ static int configIniHandler(void* user, const char* section, const char* name, c
             CHECK_PARSE_OPTION(parseBoolOption(&opt, value));
             cfg->bottomScreenFilter.invert = opt;
             return 1;
+        } else if (strcmp(name, "screen_filters_bot_color_curve_adj") == 0) {
+            s64 opt;
+            CHECK_PARSE_OPTION(parseDecIntOption(&opt, value, 0, 2));
+            cfg->bottomScreenFilter.colorCurveCorrection = (u8)opt;
+            return 1;
         } else {
             CHECK_PARSE_OPTION(-1);
         }
@@ -566,6 +576,11 @@ static int configIniHandler(void* user, const char* section, const char* name, c
             } else {
                 CHECK_PARSE_OPTION(-1);
             }
+        } else if (strcmp(name, "volume_slider_override") == 0) {
+            s64 opt;
+            CHECK_PARSE_OPTION(parseDecIntOption(&opt, value, -1, 100));
+            cfg->volumeSliderOverride = (s8)opt;
+            return 1;
         } else {
             CHECK_PARSE_OPTION(-1);
         }
@@ -651,7 +666,6 @@ static size_t saveLumaIniConfigToStr(char *out)
         (int)CONFIG(AUTOBOOTEMU), (int)CONFIG(LOADEXTFIRMSANDMODULES),
         (int)CONFIG(PATCHGAMES), (int)CONFIG(REDIRECTAPPTHREADS),
         (int)CONFIG(PATCHVERSTRING), (int)CONFIG(SHOWGBABOOT),
-        (int)CONFIG(ENABLEDSIEXTFILTER), (int)CONFIG(ALLOWUPDOWNLEFTRIGHTDSI),
 
         1 + (int)MULTICONFIG(DEFAULTEMU), 4 - (int)MULTICONFIG(BRIGHTNESS),
         splashPosStr, (unsigned int)cfg->splashDurationMsec,
@@ -662,6 +676,7 @@ static size_t saveLumaIniConfigToStr(char *out)
         (int)cfg->ntpTzOffetMinutes,
 
         (int)cfg->topScreenFilter.cct, (int)cfg->bottomScreenFilter.cct,
+        (int)cfg->topScreenFilter.colorCurveCorrection, (int)cfg->bottomScreenFilter.colorCurveCorrection,
         topScreenFilterGammaStr, bottomScreenFilterGammaStr,
         topScreenFilterContrastStr, bottomScreenFilterContrastStr,
         topScreenFilterBrightnessStr, bottomScreenFilterBrightnessStr,
@@ -670,15 +685,16 @@ static size_t saveLumaIniConfigToStr(char *out)
         cfg->autobootTwlTitleId, (int)cfg->autobootCtrAppmemtype,
 
         forceAudioOutputStr,
+        cfg->volumeSliderOverride,
 
-        (int)CONFIG(PATCHUNITINFO), (int)CONFIG(DISABLEARM11EXCHANDLERS),
-        (int)CONFIG(ENABLESAFEFIRMROSALINA)
+        (int)CONFIG(PATCHUNITINFO), (int)CONFIG(ENABLEDSIEXTFILTER),
+        (int)CONFIG(DISABLEARM11EXCHANDLERS), (int)CONFIG(ENABLESAFEFIRMROSALINA)
     );
 
     return n < 0 ? 0 : (size_t)n;
 }
 
-static char tmpIniBuffer[0x2000];
+static char tmpIniBuffer[0x2000 + 0x400]; // eyeballed. TODO use #embed
 
 static bool readLumaIniConfig(void)
 {
@@ -693,6 +709,13 @@ static bool readLumaIniConfig(void)
 static bool writeLumaIniConfig(void)
 {
     size_t n = saveLumaIniConfigToStr(tmpIniBuffer);
+
+    // FIXME: this is UB we should port snprintf sometime (as well as fix other tech debt)
+    if (n + 1 >= sizeof(tmpIniBuffer)) {
+        error("Configuration data buffer overflow, please report this issue");
+        __builtin_unreachable();
+    }
+
     return n != 0 && fileWrite(tmpIniBuffer, "config.ini", n);
 }
 
@@ -774,6 +797,7 @@ bool readConfig(void)
         configData.formatVersionMinor = CONFIG_VERSIONMINOR;
         configData.config |= 1u << PATCHVERSTRING;
         configData.splashDurationMsec = 3000;
+        configData.volumeSliderOverride = -1;
         configData.hbldr3dsxTitleId = HBLDR_DEFAULT_3DSX_TID;
         configData.rosalinaMenuCombo = 1u << 9 | 1u << 7 | 1u << 2; // L+Start+Select
         configData.topScreenFilter.cct = 6500; // default temp, no-op
@@ -831,11 +855,10 @@ void configMenu(bool oldPinStatus, u32 oldPinMode)
                                                "( ) Redirect app. syscore threads to core2",
                                                "( ) Show NAND or user string in System Settings",
                                                "( ) Show GBA boot screen in patched AGB_FIRM",
-                                               "( ) Enable custom upscaling filters for DSi",
-                                               "( ) Allow Left+Right / Up+Down combos for DSi",
 
-                                               // Should always be the last entry
-                                               "\nSave and exit"
+                                               // Should always be the last 2 entries
+                                               "\nBoot chainloader",
+                                               "Save and exit"
                                              };
 
     static const char *optionsDescription[]  = { "Select the default EmuNAND.\n\n"
@@ -921,19 +944,9 @@ void configMenu(bool oldPinStatus, u32 oldPinMode)
                                                  "Enable showing the GBA boot screen\n"
                                                  "when booting GBA games.",
 
-                                                 "Enable replacing the default upscaling\n"
-                                                 "filter used for DS(i) software by the\n"
-                                                 "contents of:\n\n"
-                                                 "/luma/twl_upscaling_filter.bin\n\n"
-                                                 "Refer to the wiki for further details.",
+                                                // Should always be the last 2 entries
+                                                "Boot to the Luma3DS chainloader menu.",
 
-                                                 "Allow Left+Right and Up+Down button\n"
-                                                 "combos (using DPAD and CPAD\n"
-                                                 "simultaneously) in DS(i) software.\n\n"
-                                                 "Commercial software filter these\n"
-                                                 "combos on their own too, though.",
-                                                
-                                                 // Should always be the last entry
                                                  "Save the changes and exit. To discard\n"
                                                  "any changes press the POWER button.\n"
                                                  "Use START as a shortcut to this entry."
@@ -976,7 +989,6 @@ void configMenu(bool oldPinStatus, u32 oldPinMode)
         { .visible = true },
         { .visible = true },
         { .visible = true },
-        { .visible = true },
     };
 
     //Calculate the amount of the various kinds of options and pre-select the first single one
@@ -1047,13 +1059,13 @@ void configMenu(bool oldPinStatus, u32 oldPinMode)
     }
 
     drawString(false, 10, 10, COLOR_WHITE, optionsDescription[selectedOption]);
-    
+
     bool startPressed = false;
     //Boring configuration menu
     while(true)
     {
         u32 pressed = 0;
-        if (!startPressed) 
+        if (!startPressed)
         do
         {
             pressed = waitInput(true) & MENU_BUTTONS;
@@ -1061,10 +1073,11 @@ void configMenu(bool oldPinStatus, u32 oldPinMode)
         while(!pressed);
 
         // Force the selection of "save and exit" and trigger it.
-        if(pressed & BUTTON_START) 
+        if(pressed & BUTTON_START)
         {
             startPressed = true;
-            pressed |= (BUTTON_RIGHT);
+            // This moves the cursor to the last entry
+            pressed = BUTTON_RIGHT;
         }
 
         if(pressed & DPAD_BUTTONS)
@@ -1153,6 +1166,10 @@ void configMenu(bool oldPinStatus, u32 oldPinMode)
                     startPressed = false;
                     break;
                 }
+                else if (singleSelected == singleOptionsAmount - 2) {
+                    loadHomebrewFirm(0);
+                    break;
+                }
                 else
                 {
                     bool oldEnabled = singleOptions[singleSelected].enabled;

arm9/source/config.h

@@ -36,7 +36,7 @@
 
 #define CONFIG_FILE         "config.ini"
 #define CONFIG_VERSIONMAJOR 3
-#define CONFIG_VERSIONMINOR 10
+#define CONFIG_VERSIONMINOR 13
 
 #define BOOTCFG_NAND         BOOTCONFIG(0, 1)
 #define BOOTCFG_EMUINDEX     BOOTCONFIG(1, 3)
@@ -62,9 +62,8 @@ enum singleOptions
     REDIRECTAPPTHREADS,
     PATCHVERSTRING,
     SHOWGBABOOT,
-    ENABLEDSIEXTFILTER,
-    ALLOWUPDOWNLEFTRIGHTDSI,
     PATCHUNITINFO,
+    ENABLEDSIEXTFILTER,
     DISABLEARM11EXCHANDLERS,
     ENABLESAFEFIRMROSALINA,
 

arm9/source/deliver_arg.c

@@ -29,6 +29,8 @@
 #include "memory.h"
 #include "config.h"
 #include "fs.h"
+#include "i2c.h"
+#include "screen.h"
 
 u8 *loadDeliverArg(void)
 {
@@ -70,7 +72,7 @@ u8 *loadDeliverArg(void)
                 bool hasMagic = memcmp(tlnc, "TLNC", 4) == 0;
                 u8 crcLen = tlnc[5];
                 u16 crc = *(u16 *)(tlnc + 6);
-                if (!hasMagic || crcLen <= 248 || crc != crc16(tlnc + 8, crcLen, 0xFFFF))
+                if (!hasMagic || (8 + crcLen) > 0x100 || crc != crc16(tlnc + 8, crcLen, 0xFFFF))
                     memset(tlnc, 0, 0x100);
 
                 memset(deliverArg + 0x400, 0, 0xC00);
@@ -140,6 +142,8 @@ static bool configureHomebrewAutobootCtr(u8 *deliverArg)
         return false;
 
     u8 memtype = configData.autobootCtrAppmemtype;
+    // autobootCtrAppmemtype already checked, but it doesn't hurt to check again
+    memtype = memtype >= 5 ? 0 : memtype;
     deliverArg[0x400] = ISN3DS ? appmemtypesN3ds[memtype] : appmemtypesO3ds[memtype];
 
     // Determine whether to load from the SD card or from NAND. We don't support gamecards for this
@@ -151,6 +155,26 @@ static bool configureHomebrewAutobootCtr(u8 *deliverArg)
     // Tell NS to run the title, and that it's not a title jump from legacy mode
     *(u32 *)(deliverArg + 0x460) = (0 << 1) | (1 << 0);
 
+    // Whenever power button is held long enough ("force shutdown"), mcu sysmodule
+    // stores a flag in free reg 0. It will clear it next boot.
+
+    // During that next boot, if that flag was set and if CFG_BOOTENV.bit0 is set
+    // (warmboot/firm chainload, i.e. not coldbooting), then main() will simulate
+    // a "power button held" interrupt (after upgrading mcu fw if necessary -- it
+    // will reboot console after if it has upgraded mcu fw, I guess that's one of
+    // the reasons the flag is there). This obviously cause other processes to initiate
+    // a shutdown, and it also sets that flag again.
+
+    // In the case of autoboot, ns will panic when this happens. This caused
+    // hb autoboot to keep failing over and over again.
+
+    // Select free reg 0, read it, select it again, write it (clearing force shutdown flag)
+    I2C_writeReg(I2C_DEV_MCU, 0x60, 0);
+    u8 flags = I2C_readReg(I2C_DEV_MCU, 0x61);
+    flags &= ~4;
+    I2C_writeReg(I2C_DEV_MCU, 0x60, 0);
+    I2C_writeReg(I2C_DEV_MCU, 0x61, flags);
+
     CFG_BOOTENV = 1;
 
     return true;
@@ -177,6 +201,29 @@ static bool configureHomebrewAutobootTwl(u8 *deliverArg)
 
     *(u16 *)(tlnc + 6) = crc16(tlnc + 8, 0x18, 0xFFFF);
 
+    // Even though (when running TWL/AGB FIRM) the SoC is in O3DS mode, and the GPU also is,
+    // as well as most other components behaving as such (external RAM, L2C not usable, etc.),
+    // this is NOT the case for the LCD and adaptive backlight logic which retains FULL N3DS
+    // functionality, including a feature where the window is blended with a given color depending
+    // on the overall relative luminance of that window.
+
+    // However, Nintendo's own code mistakenly assumes the opposite, and clearly so ("if GPU in N3DS mode"
+    // checks, not passing N3DS extra adaptive backlight (ABL) to TWL/AGB_FIRM). This has implications:
+
+    // - Powersaving (ABL) settings in TWL/AGB_FIRM is inconsistent with *both* O3DS (because the new RGB blend LUT
+    // has been set to its current value by NATIVE_FIRM) and N3DS (because "pwn_cnt" and "inertia" are missing
+    // their N3DS-only bits)
+    // - "rave party" when booting into TWL/AGB_FIRM or O3DS NATIVE_FIRM without these regs (well, the LUT) initialized.
+    // Easiest way to do so is by leveraging the "DSi autooboot" feature Luma provides. It is worth noting at least
+    // the LUT survives hardware reboots (if Nintendo were using DSi software that was using TLNC-based reboots,
+    // they wouldn't have noticed).
+
+    // As such, zerofill these registers (from testing, hardware explicitly discards null values, so this
+    // should be fine). For now, only touch the Luma-initiated autoboot path
+
+    if (ISN3DS)
+        zerofillN3dsAblRegisters();
+
     CFG_BOOTENV = 3;
 
     return true;

arm9/source/emunand.c

@@ -111,19 +111,21 @@ void locateEmuNand(FirmwareSource *nandType, u32 *emunandIndex, bool configureCt
     else *nandType = FIRMWARE_SYSNAND;
 }
 
-static inline bool getFreeK9Space(u8 *pos, u32 size, u8 **freeK9Space)
+static inline u32 getProtoSdmmc(u32 *sdmmc, u32 firmVersion)
 {
-    static const u8 pattern[] = {0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x00};
+    switch(firmVersion)
+    {
+        case 243: // SDK 0.9.x (0.9.7?)
+            *sdmmc = (0x080AAA28 + 0x4e0);
+            break;
+        case 238: // SDK 0.10
+            *sdmmc = (0x080BEA70 + 0x690);
+            break;
+        default:
+            return 1;
+    }
 
-    //Looking for the last free space before Process9
-    *freeK9Space = memsearch(pos, pattern, size, sizeof(pattern));
-
-    if(*freeK9Space == NULL || (u32)(pos + size - *freeK9Space) < 0x455 + emunandPatchSize ||
-       *(u32 *)(*freeK9Space + 0x455 + emunandPatchSize - 4) != 0xFFFFFFFF) return false;
-
-    *freeK9Space += 0x455;
-
-    return true;
+    return 0;
 }
 
 static inline u32 getOldSdmmc(u32 *sdmmc, u32 firmVersion)
@@ -158,7 +160,7 @@ static inline u32 getSdmmc(u8 *pos, u32 size, u32 *sdmmc)
     return 0;
 }
 
-static inline u32 patchNandRw(u8 *pos, u32 size, u32 branchOffset)
+static inline u32 patchNandRw(u8 *pos, u32 size, u32 hookAddr)
 {
     //Look for read/write code
     static const u8 pattern[] = {0x1E, 0x00, 0xC8, 0x05};
@@ -176,32 +178,118 @@ static inline u32 patchNandRw(u8 *pos, u32 size, u32 branchOffset)
     writeOffset -= 3;
     *readOffset = *writeOffset = 0x4C00;
     readOffset[1] = writeOffset[1] = 0x47A0;
-    ((u32 *)writeOffset)[1] = ((u32 *)readOffset)[1] = branchOffset;
+    ((u32 *)writeOffset)[1] = ((u32 *)readOffset)[1] = hookAddr;
 
     return 0;
 }
 
-static inline u32 patchMpu(u8 *pos, u32 size)
+static inline u32 patchProtoNandRw(u8 *pos, u32 size, u32 hookAddr, u32 hookCidAddr)
 {
-    //Look for MPU pattern
-    static const u8 pattern[] = {0x03, 0x00, 0x24, 0x00};
+    //Look for read/write code
+    static const u8 pattern[] = {
+        0x03, 0x00, 0x51, 0xE3, // cmp r1, #3
+        0x02, 0xC0, 0xA0, 0xE1, // mov r12, r2
+        0x04, 0x00, 0x80, 0xE2, // add r0, r0, #4
+    };
 
-    u16 *off = (u16 *)memsearch(pos, pattern, size, sizeof(pattern));
+    u32 *writeOffset = (u32 *)memsearch(pos, pattern, size, sizeof(pattern));
 
-    if(off == NULL) return 1;
+    if(writeOffset == NULL) return 1;
 
-    off[1] = 0x0036;
-    off[0xC] = off[0x12] = 0x0603;
+    u32 *readOffset = (u32 *)memsearch((u8 *)(writeOffset + 3), pattern, 0x400, sizeof(pattern));
+
+    if(readOffset == NULL) return 1;
+
+    // Find the sdmmc mount/init(?) function
+    static const u8 mount_pattern[] = {
+        0x20, 0x00, 0x84, 0xE2, // add r0, r4, 0x20
+        0x01, 0x20, 0xA0, 0xE3, // mov r2, #1
+        0x00, 0x10, 0xA0, 0xE3, // mov r1, #0
+    };
+    u32* mountOffset = (u32*) memsearch(pos, mount_pattern, size, sizeof(mount_pattern));
+    if (mountOffset == NULL) return 1;
+
+    // Find the sdmmc read cid function.
+    static const u8 readcid_pattern[] = {
+        0x31, 0xFF, 0x2F, 0xE1, // blx r1
+        0x20, 0x60, 0x9F, 0xE5, // ldr r6, [pc, #0x20] // =failing_result
+        0x00, 0x00, 0x50, 0xE3, // cmp r0, #0
+    };
+    u32* readCidOffset = (u32*) memsearch(pos, readcid_pattern, size, sizeof(readcid_pattern));
+    if (readCidOffset == NULL) return 1;
+    readCidOffset -= 5;
+
+    mountOffset[1] = 0xe3a02000; // mov r2, #0 // sd-card
+
+    readOffset[0] = writeOffset[0] = 0xe52de004; // push {lr}
+    readOffset[1] = writeOffset[1] = 0xe59fc000; // ldr r12, [pc, #0]
+    readOffset[2] = writeOffset[2] = 0xe12fff3c; // blx r12
+    readOffset[3] = writeOffset[3] = hookAddr;
+
+    readCidOffset[0] = 0xe59fc000; // ldr r12, [pc, #0]
+    readCidOffset[1] = 0xe12fff3c; // blx r12
+    readCidOffset[2] = hookCidAddr;
+
+    // Read the emmc cid into the place hook will copy it from
+    sdmmc_get_cid(1, emunandPatchNandCid);
 
     return 0;
 }
 
-u32 patchEmuNand(u8 *arm9Section, u32 kernel9Size, u8 *process9Offset, u32 process9Size, u8 *kernel9Address, u32 firmVersion)
+static inline u32 patchProtoNandRw238(u8 *pos, u32 size, u32 hookAddr, u32 hookCidAddr)
 {
-    u8 *freeK9Space;
+    //Look for read/write code
+    static const u8 pattern[] = {
+        0x03, 0x00, 0x50, 0xE3, // cmp r0, #3
+        0x00, 0x00, 0xA0, 0x13, // movne r0, #0
+        0x01, 0x00, 0xA0, 0x03, // moveq r0, #1
+    };
 
-    if(!getFreeK9Space(arm9Section, kernel9Size, &freeK9Space)) return 1;
+    u32 *writeOffset = (u32 *)memsearch(pos, pattern, size, sizeof(pattern));
 
+    if(writeOffset == NULL) return 1;
+
+    u32 *readOffset = (u32 *)memsearch((u8 *)(writeOffset + 3), pattern, 0x400, sizeof(pattern));
+
+    if(readOffset == NULL) return 1;
+
+    // Find the mmc static ctor...
+    static const u8 mount_pattern[] = {
+        0x08, // last byte of some ptr to something in P9
+        0x01, 0x01, 0x00, 0x00, // emmc controller id
+    };
+    u8* mountOffset = (u8*) memsearch(pos, mount_pattern, size, sizeof(mount_pattern));
+    if (mountOffset == NULL) return 1;
+    mountOffset++;
+
+    // Find the sdmmc read cid function.
+    static const u8 readcid_pattern[] = {
+        0x31, 0xFF, 0x2F, 0xE1, // blx r1
+        0x20, 0x60, 0x9F, 0xE5, // ldr r6, [pc, #0x20] // =failing_result
+        0x00, 0x00, 0x50, 0xE3, // cmp r0, #0
+    };
+    u32* readCidOffset = (u32*) memsearch(pos, readcid_pattern, size, sizeof(readcid_pattern));
+    if (readCidOffset == NULL) return 1;
+    readCidOffset -= 5;
+
+    *(u32*)mountOffset = 0x300; // sd card
+
+    readOffset[0] = writeOffset[0] = 0xe59fc000; // ldr r12, [pc, #0]
+    readOffset[1] = writeOffset[1] = 0xe12fff3c; // blx r12
+    readOffset[2] = writeOffset[2] = hookAddr;
+
+    readCidOffset[0] = 0xe59fc000; // ldr r12, [pc, #0]
+    readCidOffset[1] = 0xe12fff3c; // blx r12
+    readCidOffset[2] = hookCidAddr;
+
+    // Read the emmc cid into the place hook will copy it from
+    sdmmc_get_cid(1, emunandPatchNandCid);
+
+    return 0;
+}
+
+u32 patchEmuNand(u8 *process9Offset, u32 process9Size, u32 firmVersion)
+{
     u32 ret = 0;
 
     //Add the data of the found EmuNAND
@@ -213,15 +301,38 @@ u32 patchEmuNand(u8 *arm9Section, u32 kernel9Size, u8 *process9Offset, u32 proce
     ret += !ISN3DS && firmVersion < 0x25 ? getOldSdmmc(&sdmmc, firmVersion) : getSdmmc(process9Offset, process9Size, &sdmmc);
     if(!ret) emunandPatchSdmmcStructPtr = sdmmc;
 
-    //Copy EmuNAND code
-    memcpy(freeK9Space, emunandPatch, emunandPatchSize);
-
     //Add EmuNAND hooks
-    u32 branchOffset = (u32)(freeK9Space - arm9Section + kernel9Address);
-    ret += patchNandRw(process9Offset, process9Size, branchOffset);
-
-    //Set MPU
-    ret += patchMpu(arm9Section, kernel9Size);
+    ret += patchNandRw(process9Offset, process9Size, (u32)emunandPatch);
 
     return ret;
 }
+
+u32 patchProtoEmuNand(u8 *process9Offset, u32 process9Size)
+{
+    extern u32 firmProtoVersion;
+    u32 ret = 0;
+
+    // Add the data of the found EmuNAND
+    emunandPatchNandOffset = emuOffset;
+    emunandPatchNcsdHeaderOffset = emuHeader;
+
+    // Find and add the SDMMC struct
+    u32 sdmmc;
+    ret += getProtoSdmmc(&sdmmc, firmProtoVersion);
+    if(!ret) emunandPatchSdmmcStructPtr = sdmmc;
+
+    // Add EmuNAND hooks
+    switch (firmProtoVersion) {
+        case 243: // SDK 0.9.x (0.9.7?)
+            ret += patchProtoNandRw(process9Offset, process9Size, (u32)emunandProtoPatch, (u32)emunandProtoCidPatch);
+            break;
+        case 238: // SDK 0.10.x
+            ret += patchProtoNandRw238(process9Offset, process9Size, (u32)emunandProtoPatch238, (u32)emunandProtoCidPatch);
+            break;
+        default:
+            ret++;
+            break;
+    }
+
+    return ret;
+}

arm9/source/emunand.h

@@ -38,4 +38,5 @@ extern u32 emuOffset,
            emuHeader;
 
 void locateEmuNand(FirmwareSource *nandType, u32 *emunandIndex, bool configureCtrNandParams);
-u32 patchEmuNand(u8 *arm9Section, u32 kernel9Size, u8 *process9Offset, u32 process9Size, u8 *kernel9Address, u32 firmVersion);
+u32 patchEmuNand(u8 *process9Offset, u32 process9Size, u32 firmVersion);
+u32 patchProtoEmuNand(u8 *process9Offset, u32 process9Size);

arm9/source/emunand_patch.s

@@ -0,0 +1,194 @@
+.section .emunand_patch, "aw", %progbits
+.arm
+.align 4
+
+@ Code originally by Normmatt
+
+.global emunandPatch
+emunandPatch:
+    @ Original code that still needs to be executed
+    mov r4, r0
+    mov r5, r1
+    mov r7, r2
+    mov r6, r3
+    @ End
+
+    @ If we're already trying to access the SD, return
+    ldr r2, [r0, #4]
+    ldr r1, emunandPatchSdmmcStructPtr
+    cmp r2, r1
+    beq out
+
+    str r1, [r0, #4] @ Set object to be SD
+    ldr r2, [r0, #8] @ Get sector to read
+    cmp r2, #0 @ For GW compatibility, see if we're trying to read the ncsd header (sector 0)
+
+    ldr r3, emunandPatchNandOffset
+    add r2, r3 @ Add the offset to the NAND in the SD
+
+    ldreq r3, emunandPatchNcsdHeaderOffset
+    addeq r2, r3 @ If we're reading the ncsd header, add the offset of that sector
+
+    str r2, [r0, #8] @ Store sector to read
+
+    out:
+        @ Restore registers.
+        mov r1, r5
+        mov r2, r7
+        mov r3, r6
+
+        @ Return 4 bytes behind where we got called,
+        @ due to the offset of this function being stored there
+        mov r0, lr
+        add r0, #4
+        bx r0
+
+.pool
+
+_emunandPatchEnd:
+
+.global emunandProtoPatch
+emunandProtoPatch:
+    @ Save registers
+    push {r0-r3}
+
+    @ If we're already trying to access the SD, return
+    ldr r2, [r0, #4]
+    ldr r1, emunandPatchSdmmcStructPtr
+    cmp r2, r1
+    beq _out
+
+    ldrb r2, [r1, #0xc] @ Get sdmc->m_isInitialised
+    cmp r2, #0 @ Is initialised?
+    beq _pastSdmc @ if not, use "NAND" object, patched elsewhere to access SD
+    str r1, [r0, #4] @ Set object to be SD
+    _pastSdmc:
+    ldr r2, [r0, #8] @ Get sector to read
+    cmp r2, #0 @ For GW compatibility, see if we're trying to read the ncsd header (sector 0)
+
+    ldr r3, emunandPatchNandOffset
+    add r2, r3 @ Add the offset to the NAND in the SD
+
+    ldreq r3, emunandPatchNcsdHeaderOffset
+    addeq r2, r3 @ If we're reading the ncsd header, add the offset of that sector
+
+    str r2, [r0, #8] @ Store sector to read
+
+    _out:
+        @ Restore registers
+        pop {r0-r3}
+        @ Execute original code that got patched.
+        cmp r1, #3
+        mov r12, r2
+        add r0, r0, #4
+        movne r1, #0
+        moveq r1, #1
+        @ r2 about to be overwritten, so it's free to use here.
+        @ Save off our return address and restore lr.
+        mov r2, lr
+        pop {lr}
+        @ r2+0 is return address (patched movne r1, #0)
+        @ r2+4 is moveq r1, #1
+        @ r2+8 is the following instruction (mov r2, r3)
+        add r2, #8
+        bx r2
+
+.global emunandProtoCidPatch
+emunandProtoCidPatch:
+    @ If we're already trying to access the SD, return
+    ldr r4, emunandPatchSdmmcStructPtr
+    cmp r0, r4
+    beq _cid_return
+    
+    @ Trying to access nand, so copy the NAND cid into r1
+    adr r4, emunandPatchNandCid
+    ldr r2, [r4, #0]
+    ldr r3, [r4, #4]
+    ldr r5, [r4, #8]
+    ldr r6, [r4, #0xc]
+    str r2, [r1, #0]
+    str r3, [r1, #4]
+    str r5, [r1, #8]
+    str r6, [r1, #0xc]
+    @ And return from whence we came
+    mov r0, #0
+    pop {r4-r6, pc}
+    
+    _cid_return:
+        @ Execute original code that got patched.
+        mov r4, r0
+        ldr r0, [r0]
+        mov r5, r1
+        @ lr+0 is return address (patched mov r5, r1)
+        @ lr+4 is following instruction (ldr r1, [r0,#8])
+        add lr, #4
+        bx lr
+
+.global emunandProtoPatch238
+emunandProtoPatch238:
+    @ Save registers
+    push {r0-r3}
+
+    @ If we're already trying to access the SD, return
+    ldr r2, [r4, #4]
+    ldr r1, emunandPatchSdmmcStructPtr
+    cmp r2, r1
+    beq _out238
+
+    ldr r2, [r1, #0x24] @ Get sdmc->m_someObjInitedLater
+    cmp r2, #0 @ Is initialised?
+    beq _pastSdmc238 @ if not, use "NAND" object, patched elsewhere to access SD
+    str r1, [r4, #4] @ Set object to be SD
+    _pastSdmc238:
+
+    ldr r2, [r4, #8] @ Get sector to read
+    cmp r2, #0 @ For GW compatibility, see if we're trying to read the ncsd header (sector 0)
+
+    ldr r3, emunandPatchNandOffset
+    add r2, r3 @ Add the offset to the NAND in the SD
+
+    ldreq r3, emunandPatchNcsdHeaderOffset
+    addeq r2, r3 @ If we're reading the ncsd header, add the offset of that sector
+
+    str r2, [r4, #8] @ Store sector to read
+
+    _out238:
+        @ Restore registers
+        pop {r0-r3}
+        @ Execute original code that got patched.
+        cmp r0, #3
+        movne r0, #0
+        moveq r0, #1
+        @ r1 about to be overwritten, so it's free to use here.
+        @ Save off our return address.
+        mov r1, lr
+        @ r1+0 is return address (patched moveq r1, #1)
+        @ r1+4 is tst r0, #0xff or sub sp, sp, #0xc
+        add r1, #4
+        bx r1
+
+.pool
+
+.global emunandPatchSdmmcStructPtr
+.global emunandPatchNandOffset
+.global emunandPatchNcsdHeaderOffset
+.global emunandPatchNandCid
+
+_emunandPatchBssStart:
+emunandPatchSdmmcStructPtr:     .word   0 @ Pointer to sdmmc struct
+emunandPatchNandOffset:         .word   0 @ For rednand this should be 1
+emunandPatchNcsdHeaderOffset:   .word   0 @ Depends on nand manufacturer + emunand type (GW/RED)
+emunandPatchNandCid:                      @ Store emmc cid here, to override "sdmc's" when trying to read emmc's
+    .word 0,0,0,0 
+_emunandPatchBssEnd:
+
+.pool
+.balign 4
+
+.global emunandPatchSize
+emunandPatchSize:
+    .word _emunandPatchEnd - emunandPatch
+
+.global emunandPatchBssSize
+emunandPatchBssSize:
+    .word _emunandPatchBssEnd - _emunandPatchBssStart

arm9/source/firm.c

@@ -39,6 +39,7 @@
 #include "chainloader.h"
 
 static Firm *firm = (Firm *)0x20001000;
+u32 firmProtoVersion = 0;
 
 static __attribute__((noinline)) bool overlaps(u32 as, u32 ae, u32 bs, u32 be)
 {
@@ -154,7 +155,21 @@ u32 loadNintendoFirm(FirmwareType *firmType, FirmwareSource nandType, bool loadF
     u32 firmVersion = 0xFFFFFFFF,
         firmSize;
 
-    bool ctrNandError = isSdMode && !remountCtrNandPartition(false);
+    bool ctrNandError = true;
+    bool loadedFromStorage = false;
+    bool storageLoadError = false;
+
+    // Try loading FIRM from sdmc first if specified.
+    if (loadFromStorage) {
+        firmSize = loadFirmFromStorage(*firmType);
+        if (firmSize != 0) loadedFromStorage = true;
+        else storageLoadError = true;
+    }
+
+    // Remount ctrnand and load FIRM from it if loading from sdmc failed.
+    if (!loadedFromStorage) {
+        ctrNandError = isSdMode && !remountCtrNandPartition(false);
+    }
 
     if(!ctrNandError)
     {
@@ -169,10 +184,8 @@ u32 loadNintendoFirm(FirmwareType *firmType, FirmwareSource nandType, bool loadF
             if(!firmSize || !checkFirm(firmSize)) ctrNandError = true;
         }
     }
-
-    bool loadedFromStorage = false;
-
-    if(loadFromStorage || ctrNandError)
+    // If CTRNAND load failed, and it wasn't tried yet, load FIRM from sdmc.
+    if (ctrNandError && !storageLoadError)
     {
         u32 result = loadFirmFromStorage(*firmType);
 
@@ -181,11 +194,69 @@ u32 loadNintendoFirm(FirmwareType *firmType, FirmwareSource nandType, bool loadF
             loadedFromStorage = true;
             firmSize = result;
         }
-        else if(ctrNandError) error("Unable to mount CTRNAND or load the CTRNAND FIRM.\nPlease use an external one.");
+        else storageLoadError = true;
     }
+    // If all attempts failed, panic.
+    if(ctrNandError && storageLoadError) error("Unable to mount CTRNAND or load the CTRNAND FIRM.\nPlease use an external one.");
 
     //Check that the FIRM is right for the console from the Arm9 section address
-    if((firm->section[3].offset != 0 ? firm->section[3].address : firm->section[2].address) != (ISN3DS ? (u8 *)0x8006000 : (u8 *)0x8006800))
+    bool isO3dsFirm = firm->section[3].offset == 0 && firm->section[2].address == (u8 *)0x8006800;
+
+    if(loadedFromStorage || ISDEVUNIT)
+    {
+        firmVersion = 0xFFFFFFFF;
+
+        if(isO3dsFirm && (*firmType == NATIVE_FIRM || *firmType == NATIVE_FIRM1X2X))
+        {
+            __attribute__((aligned(4))) static const u8 hashes[5][0x20] = {
+                {0xD7, 0x43, 0x0F, 0x27, 0x8D, 0xC9, 0x3F, 0x4C, 0x96, 0xB5, 0xA8, 0x91, 0x48, 0xDB, 0x08, 0x8A,
+                 0x7E, 0x46, 0xB3, 0x95, 0x65, 0xA2, 0x05, 0xF1, 0xF2, 0x41, 0x21, 0xF1, 0x0C, 0x59, 0x6A, 0x9D},
+                {0x93, 0xDF, 0x49, 0xA1, 0x24, 0x86, 0xBB, 0x6F, 0xAF, 0x49, 0x99, 0x2D, 0xD0, 0x8D, 0xB1, 0x88,
+                 0x8A, 0x00, 0xB6, 0xDD, 0x36, 0x89, 0xC0, 0xE2, 0xC9, 0xA9, 0x99, 0x62, 0x57, 0x5E, 0x6C, 0x23},
+                {0x39, 0x75, 0xB5, 0x28, 0x24, 0x5E, 0x8B, 0x56, 0xBC, 0x83, 0x79, 0x41, 0x09, 0x2C, 0x42, 0xE6,
+                 0x26, 0xB6, 0x80, 0x59, 0xA5, 0x56, 0xF9, 0xF9, 0x6E, 0xF3, 0x63, 0x05, 0x58, 0xDF, 0x35, 0xEF},
+                {0x81, 0x9E, 0x71, 0x58, 0xE5, 0x44, 0x73, 0xF7, 0x48, 0x78, 0x7C, 0xEF, 0x5E, 0x30, 0xE2, 0x28,
+                 0x78, 0x0B, 0x21, 0x23, 0x94, 0x63, 0xE8, 0x4E, 0x06, 0xBB, 0xD6, 0x8D, 0xA0, 0x99, 0xAE, 0x98},
+                {0x1D, 0xD5, 0xB0, 0xC2, 0xD9, 0x4A, 0x4A, 0xF3, 0x23, 0xDD, 0x2F, 0x65, 0x21, 0x95, 0x9B, 0x7E,
+                 0xF2, 0x71, 0x7E, 0xB6, 0x7A, 0x3A, 0x74, 0x78, 0x0D, 0xE3, 0xB5, 0x0C, 0x2B, 0x7F, 0x85, 0x37},
+            };
+
+            u32 i;
+            for(i = 0; i < sizeof(hashes)/sizeof(hashes[0]); i++)
+            {
+                if(memcmp(firm->section[1].hash, hashes[i], 0x20) == 0) break;
+            }
+
+            switch(i)
+            {
+                // Beta
+                case 0:
+                    firmVersion = 0x0;
+                    firmProtoVersion = 243;
+                    *firmType = NATIVE_PROTOTYPE;
+                    break;
+                case 1:
+                    firmVersion = 0x0;
+                    firmProtoVersion = 238;
+                    *firmType = NATIVE_PROTOTYPE;
+                    break;
+                // Release
+                case 2:
+                    firmVersion = 0x18;
+                    break;
+                case 3:
+                    firmVersion = 0x1D;
+                    break;
+                case 4:
+                    firmVersion = 0x1F;
+                    break;
+                default:
+                    break;
+            }
+        }
+    }
+
+    if(*firmType != NATIVE_PROTOTYPE && (firm->section[3].offset != 0 ? firm->section[3].address : firm->section[2].address) != (ISN3DS ? (u8 *)0x8006000 : (u8 *)0x8006800))
         error("The %s FIRM is not for this console.", loadedFromStorage ? "external" : "CTRNAND");
 
     if(!ISN3DS && *firmType == NATIVE_FIRM && firm->section[0].address == (u8 *)0x1FF80000)
@@ -199,41 +270,6 @@ u32 loadNintendoFirm(FirmwareType *firmType, FirmwareSource nandType, bool loadF
         *firmType = NATIVE_FIRM1X2X;
     }
 
-    if(loadedFromStorage || ISDEVUNIT)
-    {
-        firmVersion = 0xFFFFFFFF;
-
-        if(!ISN3DS && *firmType == NATIVE_FIRM)
-        {
-            __attribute__((aligned(4))) static const u8 hashes[3][0x20] = {
-                {0x39, 0x75, 0xB5, 0x28, 0x24, 0x5E, 0x8B, 0x56, 0xBC, 0x83, 0x79, 0x41, 0x09, 0x2C, 0x42, 0xE6,
-                 0x26, 0xB6, 0x80, 0x59, 0xA5, 0x56, 0xF9, 0xF9, 0x6E, 0xF3, 0x63, 0x05, 0x58, 0xDF, 0x35, 0xEF},
-                {0x81, 0x9E, 0x71, 0x58, 0xE5, 0x44, 0x73, 0xF7, 0x48, 0x78, 0x7C, 0xEF, 0x5E, 0x30, 0xE2, 0x28,
-                 0x78, 0x0B, 0x21, 0x23, 0x94, 0x63, 0xE8, 0x4E, 0x06, 0xBB, 0xD6, 0x8D, 0xA0, 0x99, 0xAE, 0x98},
-                {0x1D, 0xD5, 0xB0, 0xC2, 0xD9, 0x4A, 0x4A, 0xF3, 0x23, 0xDD, 0x2F, 0x65, 0x21, 0x95, 0x9B, 0x7E,
-                 0xF2, 0x71, 0x7E, 0xB6, 0x7A, 0x3A, 0x74, 0x78, 0x0D, 0xE3, 0xB5, 0x0C, 0x2B, 0x7F, 0x85, 0x37}
-            };
-
-            u32 i;
-            for(i = 0; i < 3; i++) if(memcmp(firm->section[1].hash, hashes[i], 0x20) == 0) break;
-
-            switch(i)
-            {
-                case 0:
-                    firmVersion = 0x18;
-                    break;
-                case 1:
-                    firmVersion = 0x1D;
-                    break;
-                case 2:
-                    firmVersion = 0x1F;
-                    break;
-                default:
-                    break;
-            }
-        }
-    }
-
     return firmVersion;
 }
 
@@ -422,7 +458,7 @@ static void mergeSection0(FirmwareType firmType, u32 firmVersion, bool loadFromS
     }
 
     // SAFE_FIRM only for N3DS and only if ENABLESAFEFIRMROSALINA is on
-    if((firmType == NATIVE_FIRM || firmType == SAFE_FIRM) && (ISN3DS || firmVersion >= 0x1D))
+    if((firmType == NATIVE_FIRM || firmType == SAFE_FIRM) && (ISN3DS || firmVersion >= 0x25))
     {
         //2) Merge that info with our own modules'
         for(u8 *src = (u8 *)0x18180000; memcmp(((Cxi *)src)->ncch.magic, "NCCH", 4) == 0; src += srcModuleSize)
@@ -471,6 +507,8 @@ static void mergeSection0(FirmwareType firmType, u32 firmVersion, bool loadFromS
                    memcmp(moduleList[i].name, ((Cxi *)dst)->exHeader.systemControlInfo.appTitle, sizeof(((Cxi *)dst)->exHeader.systemControlInfo.appTitle)) != 0)
                     error("An external FIRM module is invalid or corrupted.");
 
+                dst += dstModuleSize;
+                maxModuleSize -= dstModuleSize;
                 continue;
             }
         }
@@ -526,8 +564,8 @@ u32 patchNativeFirm(u32 firmVersion, FirmwareSource nandType, bool loadFromStora
         ret = 0;
 
 #ifndef BUILD_FOR_EXPLOIT_DEV
-    //Skip on FIRMs < 4.0
-    if(ISN3DS || firmVersion >= 0x1D)
+    //Skip on FIRMs < 5.0
+    if(ISN3DS || firmVersion >= 0x25)
     {
         //Find the Kernel11 SVC table and handler, exceptions page and free space locations
         u8 *arm11Section1 = (u8 *)firm + firm->section[1].offset;
@@ -548,7 +586,7 @@ u32 patchNativeFirm(u32 firmVersion, FirmwareSource nandType, bool loadFromStora
     ret += patchSignatureChecks(process9Offset, process9Size);
 
     //Apply EmuNAND patches
-    if(nandType != FIRMWARE_SYSNAND) ret += patchEmuNand(arm9Section, kernel9Size, process9Offset, process9Size, firm->section[2].address, firmVersion);
+    if(nandType != FIRMWARE_SYSNAND) ret += patchEmuNand(process9Offset, process9Size, firmVersion);
 
     //Apply FIRM0/1 writes patches on SysNAND to protect A9LH
     else if(isFirmProtEnabled) ret += patchFirmWrites(process9Offset, process9Size);
@@ -593,6 +631,11 @@ u32 patchNativeFirm(u32 firmVersion, FirmwareSource nandType, bool loadFromStora
 
 u32 patchTwlFirm(u32 firmVersion, bool loadFromStorage, bool doUnitinfoPatch)
 {
+    u8 *section1 = (u8 *)firm + firm->section[1].offset;
+    u32 section1Size = firm->section[1].size;
+    u8 *section2 = (u8 *)firm + firm->section[2].offset;
+    u32 section2Size = firm->section[2].size;
+
     u8 *arm9Section = (u8 *)firm + firm->section[3].offset;
 
     // Below 3.0, do not actually do anything.
@@ -625,6 +668,8 @@ u32 patchTwlFirm(u32 firmVersion, bool loadFromStorage, bool doUnitinfoPatch)
     //Apply UNITINFO patch
     if(doUnitinfoPatch) ret += patchUnitInfoValueSet(arm9Section, kernel9Size);
 
+    ret += patchLgyK11(section1, section1Size, section2, section2Size);
+
     // Also patch TwlBg here
     mergeSection0(TWL_FIRM, 0, loadFromStorage);
     firm->section[0].size = 0;
@@ -636,6 +681,11 @@ u32 patchAgbFirm(bool loadFromStorage, bool doUnitinfoPatch)
 {
     u8 *arm9Section = (u8 *)firm + firm->section[3].offset;
 
+    u8 *section1 = (u8 *)firm + firm->section[1].offset;
+    u32 section1Size = firm->section[1].size;
+    u8 *section2 = (u8 *)firm + firm->section[2].offset;
+    u32 section2Size = firm->section[2].size;
+
     //On N3DS, decrypt Arm9Bin and patch Arm9 entrypoint to skip kernel9loader
     if(ISN3DS)
     {
@@ -653,6 +703,7 @@ u32 patchAgbFirm(bool loadFromStorage, bool doUnitinfoPatch)
 
     ret += patchLgySignatureChecks(process9Offset, process9Size);
     if(CONFIG(SHOWGBABOOT)) ret += patchAgbBootSplash(process9Offset, process9Size);
+    ret += patchLgyK11(section1, section1Size, section2, section2Size);
 
     //Apply UNITINFO patch
     if(doUnitinfoPatch) ret += patchUnitInfoValueSet(arm9Section, kernel9Size);
@@ -722,6 +773,29 @@ u32 patch1x2xNativeAndSafeFirm(void)
     return ret;
 }
 
+u32 patchPrototypeNative(FirmwareSource nandType)
+{
+    u8 *arm9Section = (u8 *)firm + firm->section[2].offset;
+
+    //Find the Process9 .code location, size and memory address
+    u32 process9Size,
+        process9MemAddr;
+    u8 *process9Offset = getProcess9Info(arm9Section, firm->section[2].size, &process9Size, &process9MemAddr);
+
+    u32 kernel9Size = (u32)(process9Offset - arm9Section) - sizeof(Cxi) - 0x200,
+        ret = 0;
+
+    ret += patchProtoNandSignatureCheck(process9Offset, process9Size);
+
+    //Arm9 exception handlers
+    ret += patchArm9ExceptionHandlersInstall(arm9Section, kernel9Size);
+
+    //Apply EmuNAND patches
+    if(nandType != FIRMWARE_SYSNAND) ret += patchProtoEmuNand(process9Offset, process9Size);
+
+    return ret;
+}
+
 void launchFirm(int argc, char **argv)
 {
     prepareArm11ForFirmlaunch();

arm9/source/firm.h

@@ -35,4 +35,5 @@ u32 patchNativeFirm(u32 firmVersion, FirmwareSource nandType, bool loadFromStora
 u32 patchTwlFirm(u32 firmVersion, bool loadFromStorage, bool doUnitinfoPatch);
 u32 patchAgbFirm(bool loadFromStorage, bool doUnitinfoPatch);
 u32 patch1x2xNativeAndSafeFirm(void);
+u32 patchPrototypeNative(FirmwareSource nandType);
 void launchFirm(int argc, char **argv);

arm9/source/fs.c

@@ -81,31 +81,10 @@ bool remountCtrNandPartition(bool switchMainDir)
     static bool nandInitialized = false;
     int res = FR_OK;
 
-#if 0
-    Unfortunately the sdmmc driver is really flaky and returns TMIO_STAT_CMD_RESPEND as error.
-    (after timing out)
-    TODO: fix all this tech debt... one day, maybe?
-
-    if (nandInitialized)
-    {
-        res = f_unmount("nand:");
-        if (res != FR_OK)
-        {
-            error("f_unmount returned %d", res);
-            return false;
-        }
-        nandInitialized = false;
-    }
-#endif
-
     if (!nandInitialized)
     {
         res = f_mount(&nandFs, "nand:", 1);
         nandInitialized = res == FR_OK;
-        if (res != FR_OK)
-        {
-            error("f_mount returned %d", res);
-        }
     }
 
     if (nandInitialized && switchMainDir)
@@ -158,6 +137,7 @@ bool fileWrite(const void *buffer, const char *path, u32 size)
             return result == FR_OK && (u32)written == size;
         }
         case FR_NO_PATH:
+            // Only create the last dir in the hierarchy
             for(u32 i = 1; path[i] != 0; i++)
                 if(path[i] == '/')
                 {
@@ -199,6 +179,7 @@ bool fileCopy(const char *pathSrc, const char *pathDst, bool replace, void *tmpB
     }
     else if (res == FR_NO_PATH)
     {
+        // Only create the last dir in the hierarchy
         const char *c;
         for (c = pathDst + strlen(pathDst); *c != '/' && c >= pathDst; --c);
         if (c >= pathDst && c - pathDst <= FF_MAX_LFN && *c != '\0')
@@ -251,6 +232,12 @@ bool fileCopy(const char *pathSrc, const char *pathDst, bool replace, void *tmpB
     return true;
 }
 
+bool createDir(const char *path)
+{
+    FRESULT res = f_mkdir(path);
+    return res == FR_OK || res == FR_EXIST;
+}
+
 bool findPayload(char *path, u32 pressed)
 {
     const char *pattern;
@@ -456,21 +443,38 @@ static bool backupEssentialFiles(void)
 {
     size_t sz = sizeof(fileCopyBuffer);
 
+    u32 deviceID = *(vu32*)0x01FFB804;
+    char pathStart[0x20];
+    sprintf(pathStart, "backups/%08lX/", deviceID);
+    char fullPath[0x80];
+
+    // Since the other funcs in this file don't create directories recursively (only the last one),
+    // and nor does f_mkdir, create the directories anyway and ignore the result
+    f_mkdir("backups");
+    f_mkdir(pathStart);
+
     bool ok = true;
-    ok = ok && fileCopy("nand:/ro/sys/HWCAL0.dat", "backups/HWCAL0.dat", false, fileCopyBuffer, sz);
-    ok = ok && fileCopy("nand:/ro/sys/HWCAL1.dat", "backups/HWCAL1.dat", false, fileCopyBuffer, sz);
+    sprintf(fullPath, "%sHWCAL0.dat", pathStart);
+    ok = ok && fileCopy("nand:/ro/sys/HWCAL0.dat", fullPath, false, fileCopyBuffer, sz);
+    sprintf(fullPath, "%sHWCAL1.dat", pathStart);
+    ok = ok && fileCopy("nand:/ro/sys/HWCAL1.dat", fullPath, false, fileCopyBuffer, sz);
 
-    ok = ok && fileCopy("nand:/rw/sys/LocalFriendCodeSeed_A", "backups/LocalFriendCodeSeed_A", false, fileCopyBuffer, sz); // often doesn't exist
-    ok = ok && fileCopy("nand:/rw/sys/LocalFriendCodeSeed_B", "backups/LocalFriendCodeSeed_B", false, fileCopyBuffer, sz);
+    sprintf(fullPath, "%sLocalFriendCodeSeed_A", pathStart);
+    ok = ok && fileCopy("nand:/rw/sys/LocalFriendCodeSeed_A", fullPath, false, fileCopyBuffer, sz); // often doesn't exist
+    sprintf(fullPath, "%sLocalFriendCodeSeed_B", pathStart);
+    ok = ok && fileCopy("nand:/rw/sys/LocalFriendCodeSeed_B", fullPath, false, fileCopyBuffer, sz);
 
-    ok = ok && fileCopy("nand:/rw/sys/SecureInfo_A", "backups/SecureInfo_A", false, fileCopyBuffer, sz);
-    ok = ok && fileCopy("nand:/rw/sys/SecureInfo_B", "backups/SecureInfo_B", false, fileCopyBuffer, sz); // often doesn't exist
+    sprintf(fullPath, "%sSecureInfo_A", pathStart);
+    ok = ok && fileCopy("nand:/rw/sys/SecureInfo_A", fullPath, false, fileCopyBuffer, sz);
+    sprintf(fullPath, "%sSecureInfo_B", pathStart);
+    ok = ok && fileCopy("nand:/rw/sys/SecureInfo_B", fullPath, false, fileCopyBuffer, sz); // often doesn't exist
 
     if (!ok) return false;
 
     alignedseqmemcpy(fileCopyBuffer, (const void *)0x10012000, 0x100);
-    if (getFileSize("backups/otp.bin") != 0x100)
-        ok = ok && fileWrite(fileCopyBuffer, "backups/otp.bin", 0x100);
+    sprintf(fullPath, "%sotp.bin", pathStart);
+    if (getFileSize(fullPath) != 0x100)
+        ok = ok && fileWrite(fileCopyBuffer, fullPath, 0x100);
 
     if (!ok) return false;
 
@@ -478,53 +482,38 @@ static bool backupEssentialFiles(void)
     u8 c = mcuConsoleInfo[0];
     if (c == 2 || c == 4 || (ISN3DS && c == 5) || c == 6)
     {
+        sprintf(fullPath, "%sHWCAL_01_EEPROM.dat", pathStart);
         I2C_readRegBuf(I2C_DEV_EEPROM, 0, fileCopyBuffer, 0x1000); // Up to two instances of hwcal, with the second one @0x800
-        if (getFileSize("backups/HWCAL_01_EEPROM.dat") != 0x1000)
-            ok = ok && fileWrite(fileCopyBuffer, "backups/HWCAL_01_EEPROM.dat", 0x1000);
+        if (getFileSize(fullPath) != 0x1000)
+            ok = ok && fileWrite(fileCopyBuffer, fullPath, 0x1000);
     }
 
     // B9S bootrom backups
     u32 hash[32/4];
     sha(hash, (const void *)0x08080000, 0x10000, SHA_256_MODE);
-    if (memcmp(hash, boot9Sha256, 32) == 0 && getFileSize("backups/boot9.bin") != 0x10000)
-        ok = ok && fileWrite((const void *)0x08080000, "backups/boot9.bin", 0x10000);
+    sprintf(fullPath, "%sboot9.bin", pathStart);
+    if (memcmp(hash, boot9Sha256, 32) == 0 && getFileSize(fullPath) != 0x10000)
+        ok = ok && fileWrite((const void *)0x08080000, fullPath, 0x10000);
     sha(hash, (const void *)0x08090000, 0x10000, SHA_256_MODE);
-    if (memcmp(hash, boot11Sha256, 32) == 0 && getFileSize("backups/boot11.bin") != 0x10000)
-        ok = ok && fileWrite((const void *)0x08090000, "backups/boot11.bin", 0x10000);
+    sprintf(fullPath, "%sboot11.bin", pathStart);
+    if (memcmp(hash, boot11Sha256, 32) == 0 && getFileSize(fullPath) != 0x10000)
+        ok = ok && fileWrite((const void *)0x08090000, fullPath, 0x10000);
 
     return ok;
 }
 
 bool doLumaUpgradeProcess(void)
 {
-    FirmwareSource oldCtrNandLocation = ctrNandLocation;
-    bool ok = true, ok2 = true, ok3 = true;
+    bool ok = true, ok2 = true;
 
-#if 0
-    Unfortunately the sdmmc driver is really flaky and returns TMIO_STAT_CMD_RESPEND as error.
-    (after timing out)
-    TODO: fix all this tech debt... one day, maybe?
-
-    // Ensure SysNAND CTRNAND is mounted
-    if (isSdMode)
-    {
-        ctrNandLocation = FIRMWARE_SYSNAND;
-        if (!remountCtrNandPartition(false))
-        {
-            error("failed to mount");
-            ctrNandLocation = oldCtrNandLocation;
-            return false;
-        }
-    }
-#else
-    (void)oldCtrNandLocation;
     // Ensure CTRNAND is mounted
     remountCtrNandPartition(false);
-#endif
 
     // Try to boot.firm to CTRNAND, when applicable
+#ifndef BUILD_FOR_EXPLOIT_DEV
     if (isSdMode && memcmp(launchedPathForFatfs, "sdmc:", 5) == 0)
         ok = fileCopy(launchedPathForFatfs, "nand:/boot.firm", true, fileCopyBuffer, sizeof(fileCopyBuffer));
+#endif
 
     // Try to backup essential files
     ok2 = backupEssentialFiles();
@@ -533,17 +522,8 @@ bool doLumaUpgradeProcess(void)
     fileDelete("sdmc:/luma/config.bin");
     fileDelete("nand:/rw/luma/config.bin");
 
-#if 0
-    if (isSdMode)
-    {
-        ctrNandLocation = oldCtrNandLocation;
-        ok3 = remountCtrNandPartition(false);
-        if (!ok3)
-            error("failed to unmount");
-    }
-#else
-    (void)ok3;
-#endif
+    createDir("sdmc:/luma/payloads");
+    createDir("nand:/rw/luma/payloads");
 
-    return ok && ok2 && ok3;
+    return ok && ok2;
 }

arm9/source/fs.h

@@ -39,6 +39,7 @@ u32 getFileSize(const char *path);
 bool fileWrite(const void *buffer, const char *path, u32 size);
 bool fileDelete(const char *path);
 bool fileCopy(const char *pathSrc, const char *pathDst, bool replace, void *tmpBuffer, size_t bufferSize);
+bool createDir(const char *path);
 bool findPayload(char *path, u32 pressed);
 bool payloadMenu(char *path, bool *hasDisplayedMenu);
 u32 firmRead(void *dest, u32 firmType);

arm9/source/i2c.h

@@ -40,6 +40,8 @@ typedef enum
     I2C_DEV_CAMERA    = 1, 	// Unconfirmed
     I2C_DEV_CAMERA2   = 2, 	// Unconfirmed
     I2C_DEV_MCU       = 3,
+    I2C_DEV_LCD_TOP   = 5,
+    I2C_DEV_LCD_BOT   = 6,
     I2C_DEV_GYRO      = 10,
     I2C_DEV_DEBUG_PAD = 12,
     I2C_DEV_IR        = 13,

arm9/source/large_patches.h

@@ -28,9 +28,11 @@
 
 #include "types.h"
 
-extern const u8 emunandPatch[];
-extern const u32 emunandPatchSize;
+extern const u8 emunandPatch[], emunandProtoPatch[], emunandProtoCidPatch[];
+extern const u8 emunandProtoPatch238[];
+extern const u32 emunandPatchSize, emunandPatchBssSize;
 extern u32 emunandPatchSdmmcStructPtr, emunandPatchNandOffset, emunandPatchNcsdHeaderOffset;
+extern u32 emunandPatchNandCid[4];
 
 extern const u8 rebootPatch[];
 extern const u32 rebootPatchSize;

arm9/source/large_patches.s

@@ -1,67 +1,3 @@
-.section .large_patch.emunand, "aw", %progbits
-.arm
-.align 4
-
-@ Code originally by Normmatt
-
-.global emunandPatch
-emunandPatch:
-    @ Original code that still needs to be executed
-    mov r4, r0
-    mov r5, r1
-    mov r7, r2
-    mov r6, r3
-    @ End
-
-    @ If we're already trying to access the SD, return
-    ldr r2, [r0, #4]
-    ldr r1, emunandPatchSdmmcStructPtr
-    cmp r2, r1
-    beq out
-
-    str r1, [r0, #4] @ Set object to be SD
-    ldr r2, [r0, #8] @ Get sector to read
-    cmp r2, #0 @ For GW compatibility, see if we're trying to read the ncsd header (sector 0)
-
-    ldr r3, emunandPatchNandOffset
-    add r2, r3 @ Add the offset to the NAND in the SD
-
-    ldreq r3, emunandPatchNcsdHeaderOffset
-    addeq r2, r3 @ If we're reading the ncsd header, add the offset of that sector
-
-    str r2, [r0, #8] @ Store sector to read
-
-    out:
-        @ Restore registers.
-        mov r1, r5
-        mov r2, r7
-        mov r3, r6
-
-        @ Return 4 bytes behind where we got called,
-        @ due to the offset of this function being stored there
-        mov r0, lr
-        add r0, #4
-        bx r0
-
-.pool
-
-.global emunandPatchSdmmcStructPtr
-.global emunandPatchNandOffset
-.global emunandPatchNcsdHeaderOffset
-
-emunandPatchSdmmcStructPtr:     .word   0 @ Pointer to sdmmc struct
-emunandPatchNandOffset:         .word   0 @ For rednand this should be 1
-emunandPatchNcsdHeaderOffset:   .word   0 @ Depends on nand manufacturer + emunand type (GW/RED)
-
-.pool
-.balign 4
-
-_emunandPatchEnd:
-
-.global emunandPatchSize
-emunandPatchSize:
-    .word _emunandPatchEnd - emunandPatch
-
 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 
 @ Code originally from delebile and mid-kid

arm9/source/main.c

@@ -386,6 +386,9 @@ boot:
         case NATIVE_FIRM1X2X:
             res = patch1x2xNativeAndSafeFirm();
             break;
+        case NATIVE_PROTOTYPE:
+            res = patchPrototypeNative(nandType);
+            break;
     }
 
     if(res != 0) error("Failed to apply %u FIRM patch(es).", res);

arm9/source/patches.c

@@ -45,6 +45,7 @@
 #define K11EXT_VA         0x70000000
 
 extern u16 launchedPath[];
+extern u32 firmProtoVersion;
 
 u8 *getProcess9Info(u8 *pos, u32 size, u32 *process9Size, u32 *process9MemAddr)
 {
@@ -54,10 +55,20 @@ u8 *getProcess9Info(u8 *pos, u32 size, u32 *process9Size, u32 *process9MemAddr)
 
     Cxi *off = (Cxi *)(temp - 0x100);
 
-    *process9Size = (off->ncch.exeFsSize - 1) * 0x200;
     *process9MemAddr = off->exHeader.systemControlInfo.textCodeSet.address;
 
-    return (u8 *)off + (off->ncch.exeFsOffset + 1) * 0x200;
+    // Prototype FW has a different NCCH format
+    if (firmProtoVersion && firmProtoVersion <= 243)
+    {
+        *process9Size = off->ncch.exeFsSize;
+        return (u8 *)off + off->ncch.exeFsOffset;
+    }
+    else
+    {
+        *process9Size = (off->ncch.exeFsSize - 1) * 0x200;
+        return (u8 *)off + (off->ncch.exeFsOffset + 1) * 0x200;
+    }
+
 }
 
 u32 *getKernel11Info(u8 *pos, u32 size, u32 *baseK11VA, u8 **freeK11Space, u32 **arm11SvcHandler, u32 **arm11ExceptionsPage)
@@ -132,6 +143,7 @@ u32 installK11Extension(u8 *pos, u32 size, bool needToInitSd, u32 baseK11VA, u32
             u16 configFormatVersionMajor, configFormatVersionMinor;
             u32 config, multiConfig, bootConfig;
             u32 splashDurationMsec;
+            s8 volumeSliderOverride;
             u64 hbldr3dsxTitleId;
             u32 rosalinaMenuCombo;
             u32 pluginLoaderFlags;
@@ -215,6 +227,7 @@ u32 installK11Extension(u8 *pos, u32 size, bool needToInitSd, u32 baseK11VA, u32
     info->multiConfig = configData.multiConfig;
     info->bootConfig = configData.bootConfig;
     info->splashDurationMsec = configData.splashDurationMsec;
+    info->volumeSliderOverride = configData.volumeSliderOverride;
     info->hbldr3dsxTitleId = configData.hbldr3dsxTitleId;
     info->rosalinaMenuCombo = configData.rosalinaMenuCombo;
     info->pluginLoaderFlags = configData.pluginLoaderFlags;
@@ -795,17 +808,91 @@ void patchTwlBg(u8 *pos, u32 size)
             // else error("Failed to apply enable_dsi_external_filter.");
         }
     }
+}
 
-    if (CONFIG(ALLOWUPDOWNLEFTRIGHTDSI))
-    {
-        u16 *off2;
-        for (off2 = (u16 *)pos; (u8 *)off2 < pos + size && (off2[0] != 0x2040 || off2[1] != 0x4020); off2++);
+u32 patchLgyK11(u8 *section1, u32 section1Size, u8 *section2, u32 section2Size)
+{
+    u32 *off;
 
-        if ((u8 *)off2 < pos + size)
-        {
-            // else error("Failed to apply allow_updown_leftright_dsi.");
-            for (u32 i = 0; i < 8; i++)
-                off2[i] = 0x46C0;
-        }
+    // Fix a bug where Legacy K11 maps user TLS with "user no access" permissions
+    // Map it as RWX (just like the rest of other user-accessible pages) instead
+    for (off = (u32 *)section1; (u8 *)off <= section1 + section1Size && *off != 0xE0100000; off++);
+
+    if ((u8 *)off >= section1 + section1Size)
+        return 1;
+
+    ++off;
+
+    *off &= ~0x231; // clear APX mask and XN
+    *off |= 0x030; // re-set APX (to user/kernel RW)
+
+    // Patch two pointer-to-bool to point to a non-zero byte, enabling user exception handling.
+    // It is impossible to enable it by normal means, otherwise
+    for (off = (u32 *)section2; (u8 *)off <= section2 + section2Size && *off != 0x100021F; off++);
+    if ((u8 *)off >= section2 + section2Size)
+        return 1;
+    off[1] = 0xFFFF0F00;
+    off[2] = 0xFFFF0F04;
+
+    // Dispatch-to-user code checks for memory block type and permissions (etc.), but
+    // LGY K11 doesn't do any memory management, so these checks will always fail.
+    // Patch with b +0x38 to skip all those checks
+    u16 *off2;
+    for (off2 = (u16 *)section2; (u8 *)off2 <= section2 + section2Size && (off2[0] != 0xDB1F || off2[1] != 0x4915); off2++);
+    if ((u8 *)off2 >= section2 + section2Size)
+        return 1;
+    *off2 = 0xE01A;
+
+    // Patch kernelpanic to skip devunit check, so that it sets the LCD fill regs
+    // which are useful to detect such panics
+    u16 *off3;
+    for (off3 = (u16 *)section1; (u8 *)off3 <= section1 + section1Size && (off3[0] != 0x481D || off3[1] != 0xB570); off3++);
+    if ((u8 *)off3 >= section1 + section1Size)
+        return 1;
+    off3[2] = 0x2001; // movs r0, #1
+
+    // Patch kernel to avoid allocating the two "configuration memory" pages, freeing
+    // 0x2000 bytes of kernel "heap" (which is 0xD000 AXIWRAM bytes on LGY K11 instead
+    // of the entire FCRAM on NFIRM). This is indeed a bug because if prevents two of the
+    // 12 KThread objects from being created
+    u16 *off4;
+    for (off4 = (u16 *)section1; (u8 *)off4 <= section1 + section1Size && (off4[0] != 0xB570 || off4[1] != 0x2200); off4++);
+    if ((u8 *)off4 >= section1 + section1Size)
+        return 1;
+    *off4 = 0x4770; // bx lr
+
+    return 0;
+}
+
+u32 patchProtoNandSignatureCheck(u8 *pos, u32 size) {
+    if (firmProtoVersion == 243) {
+        static const u8 pattern[] = {0x08, 0x31, 0x9F, 0xE5};
+
+        // Signature check function returns 0 if failed and 1 if succeeded.
+        // Proc9 breaks if the returned value is 0, change it to break if
+        // the returned value is 2 (never).
+        u8 *off = memsearch(pos, pattern, size, sizeof(pattern));
+        if (!off)
+            return 1;
+
+        off[0x20] = 2;
     }
+
+    else if (firmProtoVersion == 238) { // SDK 0.10
+        // Same patch as for v243 ported to the different ncsd_read() function
+        static const u8 pattern[] = {
+            0x00, 0x11, 0x9f, 0xe5,
+            0x00, 0x51, 0x9f, 0xe5,
+        };
+
+        u8 *off = memsearch(pos, pattern, size, sizeof(pattern));
+        if (!off)
+            return 1;
+
+        off[0x20] = 2;
+    }
+
+    else return 1;
+
+    return 0;
 }

arm9/source/patches.h

@@ -31,6 +31,7 @@
 *   FIRM partition writes patches by delebile
 *   Idea for svcBreak patches from yellows8 and others on #3dsdev
 *   TWL_FIRM patches by Steveice10 and others
+*   Signature patches for prototype FW by PabloMK7
 */
 
 #pragma once
@@ -67,3 +68,5 @@ u32 patchOldTwlFlashcartChecks(u8 *pos, u32 size);
 u32 patchTwlShaHashChecks(u8 *pos, u32 size);
 u32 patchAgbBootSplash(u8 *pos, u32 size);
 void patchTwlBg(u8 *pos, u32 size); // silently fails
+u32 patchLgyK11(u8 *section1, u32 section1Size, u8 *section2, u32 section2Size);
+u32 patchProtoNandSignatureCheck(u8 *pos, u32 size);

arm9/source/screen.c

@@ -70,6 +70,14 @@ void prepareArm11ForFirmlaunch(void)
 void deinitScreens(void)
 {
     if(ARESCREENSINITIALIZED) invokeArm11Function(DEINIT_SCREENS);
+
+    // Backlight voltage off
+    I2C_writeReg(I2C_DEV_MCU, 0x22, 0x14);
+    wait(50);
+
+    // LCD panel voltage off
+    I2C_writeReg(I2C_DEV_MCU, 0x22, 0x01);
+    wait(50);
 }
 
 void updateBrightness(u32 brightnessIndex)
@@ -102,8 +110,31 @@ void initScreens(void)
             memcpy((void *)(ARM11_PARAMETERS_ADDRESS + 4), fbs, sizeof(fbs));
             invokeArm11Function(INIT_SCREENS);
 
-            //Turn on backlight
-            I2C_writeReg(I2C_DEV_MCU, 0x22, 0x2A);
+            // Fragile code, needs proper fix/total rewrite of the baremetal components anyway
+            // Assume controller revision is not 0x00 for either screen (this revision is extremely
+            // old and shouldn't be seen in retail units nor normal devunits)
+
+            // Controller reset off
+            I2C_writeReg(I2C_DEV_LCD_TOP, 0xFE, 0xAA);
+            I2C_writeReg(I2C_DEV_LCD_BOT, 0xFE, 0xAA);
+            wait(5);
+
+            // Controller power on
+            I2C_writeReg(I2C_DEV_LCD_TOP, 0x01, 0x10);
+            I2C_writeReg(I2C_DEV_LCD_BOT, 0x01, 0x10);
+            wait(5);
+
+            // Clear error flag
+            I2C_writeReg(I2C_DEV_LCD_TOP, 0x60, 0x00);
+            I2C_writeReg(I2C_DEV_LCD_BOT, 0x60, 0x00);
+            wait(5);
+
+            // LCD panel (bias ?) voltage on
+            I2C_writeReg(I2C_DEV_MCU, 0x22, 0x02);
+            wait(50);
+
+            // Backlight voltage on
+            I2C_writeReg(I2C_DEV_MCU, 0x22, 0x28);
             wait(5);
         }
         else updateBrightness(MULTICONFIG(BRIGHTNESS));
@@ -118,3 +149,8 @@ void initScreens(void)
     clearScreens(false);
     swapFramebuffers(false);
 }
+
+void zerofillN3dsAblRegisters(void)
+{
+    invokeArm11Function(ZEROFILL_N3DS_ABL_REGISTERS);
+}

arm9/source/screen.h

@@ -59,6 +59,7 @@ typedef enum
     SWAP_FRAMEBUFFERS,
     UPDATE_BRIGHTNESS,
     DEINIT_SCREENS,
+    ZEROFILL_N3DS_ABL_REGISTERS,
     PREPARE_ARM11_FOR_FIRMLAUNCH,
     ARM11_READY,
 } Arm11Operation;
@@ -73,3 +74,4 @@ void swapFramebuffers(bool isAlternate);
 void updateBrightness(u32 brightnessIndex);
 void clearScreens(bool isAlternate);
 void initScreens(void);
+void zerofillN3dsAblRegisters(void);

arm9/source/types.h

@@ -64,6 +64,7 @@ typedef volatile s64 vs64;
 typedef struct ScreenFiltersCfgData {
     u16 cct;
     bool invert;
+    u8 colorCurveCorrection;
     s64 gammaEnc;
     s64 contrastEnc;
     s64 brightnessEnc;
@@ -74,6 +75,7 @@ typedef struct CfgData {
 
     u32 config, multiConfig, bootConfig;
     u32 splashDurationMsec;
+    s8 volumeSliderOverride;
 
     u64 hbldr3dsxTitleId;
     u32 rosalinaMenuCombo;
@@ -132,7 +134,8 @@ typedef enum FirmwareType
     AGB_FIRM,
     SAFE_FIRM,
     SYSUPDATER_FIRM,
-    NATIVE_FIRM1X2X
+    NATIVE_FIRM1X2X,
+    NATIVE_PROTOTYPE,
 } FirmwareType;
 
 typedef enum bootType

arm9/source/utils.c

@@ -158,23 +158,44 @@ void error(const char *fmt, ...)
     mcuPowerOff();
 }
 
+
+// CRC-16/MODBUS
 u16 crc16(const void *data, size_t size, u16 initialValue)
 {
-    static u16 lut[256] = {0};
-    static bool lutInitialized = false;
-
-    if (!lutInitialized)
-    {
-        static const u16 poly = 0xA001;
-        for (u32 i = 0; i < 256; i++)
-        {
-            u16 r = i;
-            for (u32 j = 0; j < 8; j++)
-                r = (r >> 1) ^ ((r & 1) != 0 ? poly : 0);
-            lut[i] = r;
-        }
-        lutInitialized = true;
-    }
+    static const u16 lut[256] = {
+        0x0000,0xC0C1,0xC181,0x0140,0xC301,0x03C0,0x0280,0xC241,
+        0xC601,0x06C0,0x0780,0xC741,0x0500,0xC5C1,0xC481,0x0440,
+        0xCC01,0x0CC0,0x0D80,0xCD41,0x0F00,0xCFC1,0xCE81,0x0E40,
+        0x0A00,0xCAC1,0xCB81,0x0B40,0xC901,0x09C0,0x0880,0xC841,
+        0xD801,0x18C0,0x1980,0xD941,0x1B00,0xDBC1,0xDA81,0x1A40,
+        0x1E00,0xDEC1,0xDF81,0x1F40,0xDD01,0x1DC0,0x1C80,0xDC41,
+        0x1400,0xD4C1,0xD581,0x1540,0xD701,0x17C0,0x1680,0xD641,
+        0xD201,0x12C0,0x1380,0xD341,0x1100,0xD1C1,0xD081,0x1040,
+        0xF001,0x30C0,0x3180,0xF141,0x3300,0xF3C1,0xF281,0x3240,
+        0x3600,0xF6C1,0xF781,0x3740,0xF501,0x35C0,0x3480,0xF441,
+        0x3C00,0xFCC1,0xFD81,0x3D40,0xFF01,0x3FC0,0x3E80,0xFE41,
+        0xFA01,0x3AC0,0x3B80,0xFB41,0x3900,0xF9C1,0xF881,0x3840,
+        0x2800,0xE8C1,0xE981,0x2940,0xEB01,0x2BC0,0x2A80,0xEA41,
+        0xEE01,0x2EC0,0x2F80,0xEF41,0x2D00,0xEDC1,0xEC81,0x2C40,
+        0xE401,0x24C0,0x2580,0xE541,0x2700,0xE7C1,0xE681,0x2640,
+        0x2200,0xE2C1,0xE381,0x2340,0xE101,0x21C0,0x2080,0xE041,
+        0xA001,0x60C0,0x6180,0xA141,0x6300,0xA3C1,0xA281,0x6240,
+        0x6600,0xA6C1,0xA781,0x6740,0xA501,0x65C0,0x6480,0xA441,
+        0x6C00,0xACC1,0xAD81,0x6D40,0xAF01,0x6FC0,0x6E80,0xAE41,
+        0xAA01,0x6AC0,0x6B80,0xAB41,0x6900,0xA9C1,0xA881,0x6840,
+        0x7800,0xB8C1,0xB981,0x7940,0xBB01,0x7BC0,0x7A80,0xBA41,
+        0xBE01,0x7EC0,0x7F80,0xBF41,0x7D00,0xBDC1,0xBC81,0x7C40,
+        0xB401,0x74C0,0x7580,0xB541,0x7700,0xB7C1,0xB681,0x7640,
+        0x7200,0xB2C1,0xB381,0x7340,0xB101,0x71C0,0x7080,0xB041,
+        0x5000,0x90C1,0x9181,0x5140,0x9301,0x53C0,0x5280,0x9241,
+        0x9601,0x56C0,0x5780,0x9741,0x5500,0x95C1,0x9481,0x5440,
+        0x9C01,0x5CC0,0x5D80,0x9D41,0x5F00,0x9FC1,0x9E81,0x5E40,
+        0x5A00,0x9AC1,0x9B81,0x5B40,0x9901,0x59C0,0x5880,0x9841,
+        0x8801,0x48C0,0x4980,0x8941,0x4B00,0x8BC1,0x8A81,0x4A40,
+        0x4E00,0x8EC1,0x8F81,0x4F40,0x8D01,0x4DC0,0x4C80,0x8C41,
+        0x4400,0x84C1,0x8581,0x4540,0x8701,0x47C0,0x4680,0x8641,
+        0x8201,0x42C0,0x4380,0x8341,0x4100,0x81C1,0x8081,0x4040,
+    };
 
     u16 r = initialValue;
     const u8 *data8 = (const u8 *)data;
@@ -186,21 +207,40 @@ u16 crc16(const void *data, size_t size, u16 initialValue)
 
 u32 crc32(const void *data, size_t size, u32 initialValue)
 {
-    static u32 lut[256] = {0};
-    static bool lutInitialized = false;
-
-    if (!lutInitialized)
-    {
-        static const u32 poly = 0xEDB88320;
-        for (u32 i = 0; i < 256; i++)
-        {
-            u32 r = i;
-            for (u32 j = 0; j < 8; j++)
-                r = (r >> 1) ^ ((r & 1) != 0 ? poly : 0);
-            lut[i] = r;
-        }
-        lutInitialized = true;
-    }
+    static const u32 lut[256] = {
+        0x00000000,0x77073096,0xEE0E612C,0x990951BA,0x076DC419,0x706AF48F,0xE963A535,0x9E6495A3,
+        0x0EDB8832,0x79DCB8A4,0xE0D5E91E,0x97D2D988,0x09B64C2B,0x7EB17CBD,0xE7B82D07,0x90BF1D91,
+        0x1DB71064,0x6AB020F2,0xF3B97148,0x84BE41DE,0x1ADAD47D,0x6DDDE4EB,0xF4D4B551,0x83D385C7,
+        0x136C9856,0x646BA8C0,0xFD62F97A,0x8A65C9EC,0x14015C4F,0x63066CD9,0xFA0F3D63,0x8D080DF5,
+        0x3B6E20C8,0x4C69105E,0xD56041E4,0xA2677172,0x3C03E4D1,0x4B04D447,0xD20D85FD,0xA50AB56B,
+        0x35B5A8FA,0x42B2986C,0xDBBBC9D6,0xACBCF940,0x32D86CE3,0x45DF5C75,0xDCD60DCF,0xABD13D59,
+        0x26D930AC,0x51DE003A,0xC8D75180,0xBFD06116,0x21B4F4B5,0x56B3C423,0xCFBA9599,0xB8BDA50F,
+        0x2802B89E,0x5F058808,0xC60CD9B2,0xB10BE924,0x2F6F7C87,0x58684C11,0xC1611DAB,0xB6662D3D,
+        0x76DC4190,0x01DB7106,0x98D220BC,0xEFD5102A,0x71B18589,0x06B6B51F,0x9FBFE4A5,0xE8B8D433,
+        0x7807C9A2,0x0F00F934,0x9609A88E,0xE10E9818,0x7F6A0DBB,0x086D3D2D,0x91646C97,0xE6635C01,
+        0x6B6B51F4,0x1C6C6162,0x856530D8,0xF262004E,0x6C0695ED,0x1B01A57B,0x8208F4C1,0xF50FC457,
+        0x65B0D9C6,0x12B7E950,0x8BBEB8EA,0xFCB9887C,0x62DD1DDF,0x15DA2D49,0x8CD37CF3,0xFBD44C65,
+        0x4DB26158,0x3AB551CE,0xA3BC0074,0xD4BB30E2,0x4ADFA541,0x3DD895D7,0xA4D1C46D,0xD3D6F4FB,
+        0x4369E96A,0x346ED9FC,0xAD678846,0xDA60B8D0,0x44042D73,0x33031DE5,0xAA0A4C5F,0xDD0D7CC9,
+        0x5005713C,0x270241AA,0xBE0B1010,0xC90C2086,0x5768B525,0x206F85B3,0xB966D409,0xCE61E49F,
+        0x5EDEF90E,0x29D9C998,0xB0D09822,0xC7D7A8B4,0x59B33D17,0x2EB40D81,0xB7BD5C3B,0xC0BA6CAD,
+        0xEDB88320,0x9ABFB3B6,0x03B6E20C,0x74B1D29A,0xEAD54739,0x9DD277AF,0x04DB2615,0x73DC1683,
+        0xE3630B12,0x94643B84,0x0D6D6A3E,0x7A6A5AA8,0xE40ECF0B,0x9309FF9D,0x0A00AE27,0x7D079EB1,
+        0xF00F9344,0x8708A3D2,0x1E01F268,0x6906C2FE,0xF762575D,0x806567CB,0x196C3671,0x6E6B06E7,
+        0xFED41B76,0x89D32BE0,0x10DA7A5A,0x67DD4ACC,0xF9B9DF6F,0x8EBEEFF9,0x17B7BE43,0x60B08ED5,
+        0xD6D6A3E8,0xA1D1937E,0x38D8C2C4,0x4FDFF252,0xD1BB67F1,0xA6BC5767,0x3FB506DD,0x48B2364B,
+        0xD80D2BDA,0xAF0A1B4C,0x36034AF6,0x41047A60,0xDF60EFC3,0xA867DF55,0x316E8EEF,0x4669BE79,
+        0xCB61B38C,0xBC66831A,0x256FD2A0,0x5268E236,0xCC0C7795,0xBB0B4703,0x220216B9,0x5505262F,
+        0xC5BA3BBE,0xB2BD0B28,0x2BB45A92,0x5CB36A04,0xC2D7FFA7,0xB5D0CF31,0x2CD99E8B,0x5BDEAE1D,
+        0x9B64C2B0,0xEC63F226,0x756AA39C,0x026D930A,0x9C0906A9,0xEB0E363F,0x72076785,0x05005713,
+        0x95BF4A82,0xE2B87A14,0x7BB12BAE,0x0CB61B38,0x92D28E9B,0xE5D5BE0D,0x7CDCEFB7,0x0BDBDF21,
+        0x86D3D2D4,0xF1D4E242,0x68DDB3F8,0x1FDA836E,0x81BE16CD,0xF6B9265B,0x6FB077E1,0x18B74777,
+        0x88085AE6,0xFF0F6A70,0x66063BCA,0x11010B5C,0x8F659EFF,0xF862AE69,0x616BFFD3,0x166CCF45,
+        0xA00AE278,0xD70DD2EE,0x4E048354,0x3903B3C2,0xA7672661,0xD06016F7,0x4969474D,0x3E6E77DB,
+        0xAED16A4A,0xD9D65ADC,0x40DF0B66,0x37D83BF0,0xA9BCAE53,0xDEBB9EC5,0x47B2CF7F,0x30B5FFE9,
+        0xBDBDF21C,0xCABAC28A,0x53B39330,0x24B4A3A6,0xBAD03605,0xCDD70693,0x54DE5729,0x23D967BF,
+        0xB3667A2E,0xC4614AB8,0x5D681B02,0x2A6F2B94,0xB40BBE37,0xC30C8EA1,0x5A05DF1B,0x2D02EF8D,
+    };
 
     u32 r = initialValue;
     const u8 *data8 = (const u8 *)data;

k11_extension/include/config.h

@@ -33,9 +33,8 @@ enum singleOptions
     REDIRECTAPPTHREADS,
     PATCHVERSTRING,
     SHOWGBABOOT,
-    ENABLEDSIEXTFILTER,
-    ALLOWUPDOWNLEFTRIGHTDSI,
     PATCHUNITINFO,
+    ENABLEDSIEXTFILTER,
     DISABLEARM11EXCHANDLERS,
     ENABLESAFEFIRMROSALINA,
 };

k11_extension/include/globals.h

@@ -131,6 +131,7 @@ extern void* (*kAlloc)(FcramDescriptor *fcramDesc, u32 nbPages, u32 alignment, u
 typedef struct ScreenFiltersCfgData {
     u16 cct;
     bool invert;
+    u8 colorCurveCorrection;
     s64 gammaEnc;
     s64 contrastEnc;
     s64 brightnessEnc;
@@ -150,6 +151,7 @@ typedef struct CfwInfo
     u16 configFormatVersionMajor, configFormatVersionMinor;
     u32 config, multiConfig, bootConfig;
     u32 splashDurationMsec;
+    s8 volumeSliderOverride;
     u64 hbldr3dsxTitleId;
     u32 rosalinaMenuCombo;
     u32 pluginLoaderFlags;

k11_extension/include/kernel.h

@@ -53,7 +53,7 @@ struct KMutexLinkedList;
 struct KPreemptionTimer;
 
 /* 12 */
-typedef struct ALIGN(4) KAutoObject
+typedef struct CTR_ALIGN(4) KAutoObject
 {
   struct Vtable__KAutoObject *vtable;
   u32 refCount;
@@ -96,7 +96,7 @@ typedef struct KMutexLinkedListNode
 } KMutexLinkedListNode;
 
 /* 1 */
-typedef struct ALIGN(4) KMutex
+typedef struct CTR_ALIGN(4) KMutex
 {
   KSynchronizationObject syncObject;
   KMutexLinkedListNode mutexListNode;
@@ -153,7 +153,7 @@ typedef struct KClassToken
 } KClassToken;
 
 /* 44 */
-typedef struct ALIGN(4) Vtable__KAutoObject
+typedef struct CTR_ALIGN(4) Vtable__KAutoObject
 {
   void *field_0;
   void *field_4;
@@ -174,7 +174,7 @@ typedef struct KBaseInterruptEvent
 } KBaseInterruptEvent;
 
 /* 55 */
-typedef struct ALIGN(4) Vtable__KBaseInterruptEvent
+typedef struct CTR_ALIGN(4) Vtable__KBaseInterruptEvent
 {
   struct KSchedulableInterruptEvent *(*handleInterruptEvent)(KBaseInterruptEvent *, u32);
 } Vtable__KBaseInterruptEvent;
@@ -210,7 +210,7 @@ typedef struct KThreadLinkedListNode
 
 
 /* 93 */
-typedef struct ALIGN(4) KPreemptionTimer
+typedef struct CTR_ALIGN(4) KPreemptionTimer
 {
   u32 nLimitedTicks;
   u32 timer;
@@ -219,7 +219,7 @@ typedef struct ALIGN(4) KPreemptionTimer
 } KPreemptionTimer;
 
 /* 15 */
-typedef struct PACKED ALIGN(4) KThread
+typedef struct CTR_PACKED CTR_ALIGN(4) KThread
 {
   KSynchronizationObject syncObject;
   KTimeableInterruptEvent timeableInterruptEvent;
@@ -277,7 +277,7 @@ typedef enum ProcessStatus
 } ProcessStatus;
 
 /* 3 */
-typedef struct ALIGN(4) HandleDescriptor
+typedef struct CTR_ALIGN(4) HandleDescriptor
 {
   u32 info;
   KAutoObject *pointer;
@@ -297,7 +297,7 @@ typedef struct KProcessHandleTable
 } KProcessHandleTable;
 
 /* 4 */
-typedef struct ALIGN(4) KDebugThread
+typedef struct CTR_ALIGN(4) KDebugThread
 {
   KThread *linkedThread;
   bool usedSvcBreak;
@@ -355,7 +355,7 @@ typedef enum {
 } ExceptionEventType;
 
 /* 6 */
-typedef struct ALIGN(4) KDebug
+typedef struct CTR_ALIGN(4) KDebug
 {
   KSynchronizationObject syncObject;
   KSendableInterruptEvent sendableInterruptEvent;
@@ -422,7 +422,7 @@ typedef struct KCodeSetMemDescriptor
 } KCodeSetMemDescriptor;
 
 /* 5 */
-typedef struct PACKED ALIGN(4) KCodeSet
+typedef struct CTR_PACKED CTR_ALIGN(4) KCodeSet
 {
   KAutoObject autoObject;
   KCodeSetMemDescriptor textSection;
@@ -497,7 +497,7 @@ typedef struct KUserBindableInterruptEvent
 } KUserBindableInterruptEvent;
 
 /* 14 */
-typedef struct ALIGN(4) KEvent
+typedef struct CTR_ALIGN(4) KEvent
 {
   KSynchronizationObject syncObject;
   KUserBindableInterruptEvent userBindableInterruptEvent;
@@ -601,7 +601,7 @@ typedef struct KMemoryBlock
 } KMemoryBlock;
 
 /* 28 */
-typedef struct ALIGN(4) KScheduler
+typedef struct CTR_ALIGN(4) KScheduler
 {
   KSchedulableInterruptEvent interruptEvent;
   u32 threadSwitchAttempts;
@@ -619,7 +619,7 @@ typedef struct ALIGN(4) KScheduler
 } KScheduler;
 
 /* 46 */
-typedef struct PACKED CodeSetInfo
+typedef struct CTR_PACKED CodeSetInfo
 {
   char name[8];
   u16 unknown_1;
@@ -639,7 +639,7 @@ typedef struct PACKED CodeSetInfo
 } CodeSetInfo;
 
 /* 53 */
-typedef struct ALIGN(4) InterruptData
+typedef struct CTR_ALIGN(4) InterruptData
 {
   KBaseInterruptEvent *interruptEvent;
   bool disableUponReceipt;
@@ -740,7 +740,7 @@ typedef enum ResetType
 } ResetType;
 
 /* 81 */
-typedef struct PACKED ALIGN(4) KTimer
+typedef struct CTR_PACKED CTR_ALIGN(4) KTimer
 {
   KSynchronizationObject syncObject;
   KTimeableInterruptEvent timeableInterruptEvent;
@@ -768,7 +768,7 @@ typedef KSchedulableInterruptEvent KThreadTerminationInterruptEvent;
 typedef KSchedulableInterruptEvent KThreadExitInterruptEvent;
 
 /* 89 */
-typedef struct ALIGN(4) KInterruptEventMailbox
+typedef struct CTR_ALIGN(4) KInterruptEventMailbox
 {
   u32 mailboxID;
   KSendableInterruptEvent *first;
@@ -795,7 +795,7 @@ typedef enum LimitableResource
 } LimitableResource;
 
 /* 99 */
-typedef struct ALIGN(4) CpuRegisters
+typedef struct CTR_ALIGN(4) CpuRegisters
 {
   u32 r[13];
   u32 sp;
@@ -809,7 +809,7 @@ typedef struct FpuRegisters
 {
   union
   {
-      struct PACKED { double d[16]; };
+      struct CTR_PACKED { double d[16]; };
       float  s[32];
   };
   u32 fpscr;
@@ -974,7 +974,7 @@ typedef struct KEventInfo
   };
 } KEventInfo;
 
-typedef struct ALIGN(0x1000) KCoreObjectContext
+typedef struct CTR_ALIGN(0x1000) KCoreObjectContext
 {
   KThread *volatile currentThread;
   union KProcess *volatile currentProcess;
@@ -1004,7 +1004,7 @@ extern KCoreContext *coreCtxs;
 
 #define DEFINE_CONSOLE_SPECIFIC_STRUCTS(console, nbCores)
 /* 60 */
-typedef struct ALIGN(4) KProcessHwInfoN3DS
+typedef struct CTR_ALIGN(4) KProcessHwInfoN3DS
 {
   KObjectMutex mutex;
   u32 processTLBEntriesNeedToBeFlushedOnCore[4];
@@ -1023,7 +1023,7 @@ typedef struct ALIGN(4) KProcessHwInfoN3DS
   u32 *mmuTableVA;
 } KProcessHwInfoN3DS;
 
-typedef struct ALIGN(4) KProcessHwInfoO3DS8x
+typedef struct CTR_ALIGN(4) KProcessHwInfoO3DS8x
 {
   KObjectMutex mutex;
   u32 processTLBEntriesNeedToBeFlushedOnCore[2];
@@ -1042,7 +1042,7 @@ typedef struct ALIGN(4) KProcessHwInfoO3DS8x
   u32 *mmuTableVA;
 } KProcessHwInfoO3DS8x;
 
-typedef struct ALIGN(4) KProcessHwInfoO3DSPre8x
+typedef struct CTR_ALIGN(4) KProcessHwInfoO3DSPre8x
 {
   KObjectMutex mutex;
   u32 processTLBEntriesNeedToBeFlushedOnCore[2];

k11_extension/include/svc/MapProcessMemoryEx.h

@@ -30,5 +30,11 @@
 #include "kernel.h"
 #include "svc.h"
 
-Result MapProcessMemoryEx(Handle dstProcessHandle, u32 vaDst, Handle srcProcessHandle, u32 vaSrc, u32 size);
-Result MapProcessMemoryExWrapper(Handle dstProcessHandle, u32 vaDst, Handle srcProcessHandle, u32 vaSrc, u32 size);
+/// Flags for svcMapProcessMemoryEx
+typedef enum MapExFlags
+{
+    MAPEXFLAGS_PRIVATE = BIT(0), ///< Maps the memory as PRIVATE (0xBB05) instead of SHARED (0x5806)
+} MapExFlags;
+
+Result MapProcessMemoryEx(Handle dstProcessHandle, u32 vaDst, Handle srcProcessHandle, u32 vaSrc, u32 size, MapExFlags flags);
+Result MapProcessMemoryExWrapper(Handle dstProcessHandle, u32 vaDst, Handle srcProcessHandle, u32 vaSrc, u32 size, MapExFlags flags);

k11_extension/include/types.h

@@ -69,11 +69,11 @@ typedef s32 Result;                 ///< Function result.
 #define BIT(n) (1U<<(n))
 
 /// Aligns a struct (and other types?) to m, making sure that the size of the struct is a multiple of m.
-#define ALIGN(m)   __attribute__((aligned(m)))
+#define CTR_ALIGN(m)   __attribute__((aligned(m)))
 /// Packs a struct (and other types?) so it won't include padding bytes.
-#define PACKED      __attribute__((packed))
-#define USED        __attribute__((used))
-#define UNUSED      __attribute__((unused))
+#define CTR_PACKED      __attribute__((packed))
+#define CTR_USED        __attribute__((used))
+#define CTR_UNUSED      __attribute__((unused))
 /// Packs a system version from its components.
 #define SYSTEM_VERSION(major, minor, revision) \
     (((major)<<24)|((minor)<<16)|((revision)<<8))

k11_extension/source/debug.c

@@ -31,7 +31,7 @@
 KRecursiveLock dbgParamsLock = { NULL };
 u32 dbgParamWatchpointId, dbgParamDVA, dbgParamWCR, dbgParamContextId;
 
-KSchedulableInterruptEvent *enableMonitorModeDebugging(KBaseInterruptEvent *this UNUSED, u32 interruptID UNUSED)
+KSchedulableInterruptEvent *enableMonitorModeDebugging(KBaseInterruptEvent *this CTR_UNUSED, u32 interruptID CTR_UNUSED)
 {
     coreBarrier();
 
@@ -76,7 +76,7 @@ static void disableWatchpoint1(void)
     __asm__ __volatile__("mcr p14, 0, %[val], c0, c5, 5" :: [val] "r" (control));
 }
 
-KSchedulableInterruptEvent *disableWatchpoint(KBaseInterruptEvent *this UNUSED, u32 interruptID UNUSED)
+KSchedulableInterruptEvent *disableWatchpoint(KBaseInterruptEvent *this CTR_UNUSED, u32 interruptID CTR_UNUSED)
 {
     coreBarrier();
 
@@ -131,7 +131,7 @@ static void setWatchpoint1WithContextId(u32 DVA, u32 WCR, u32 contextId)
     __asm__ __volatile__("mcr p15, 0, %[val], c7, c10, 5" :: [val] "r" (0) : "memory"); // DMB
 }
 
-KSchedulableInterruptEvent *setWatchpointWithContextId(KBaseInterruptEvent *this UNUSED, u32 interruptID UNUSED)
+KSchedulableInterruptEvent *setWatchpointWithContextId(KBaseInterruptEvent *this CTR_UNUSED, u32 interruptID CTR_UNUSED)
 {
     coreBarrier();
 

k11_extension/source/fatalExceptionHandlersMain.c

@@ -130,7 +130,7 @@ void fatalExceptionHandlersMain(u32 *registerDump, u32 type, u32 cpuId)
     registerDump[15] = pc;
 
     //Dump code
-    u8 *instr = (u8 *)pc + ((cpsr & 0x20) ? 2 : 4) - (dumpHeader.codeDumpSize >> 1) ; //wouldn't work well on 32-bit Thumb instructions, but it isn't much of a problem
+    u8 *instr = (u8 *)pc + ((cpsr & 0x20) ? 2 : 4) - dumpHeader.codeDumpSize; //wouldn't work well on 32-bit Thumb instructions, but it isn't much of a problem
     dumpHeader.codeDumpSize = ((u32)instr & (((cpsr & 0x20) != 0) ? 1 : 3)) != 0 ? 0 : safecpy(codeDump, instr, dumpHeader.codeDumpSize);
 
     //Copy register dump and code dump

k11_extension/source/main.c

@@ -46,7 +46,7 @@ struct KExtParameters
     CfwInfo cfwInfo;
 } kExtParameters = { .basePA = 0x12345678 }; // place this in .data
 
-static ALIGN(1024) u32 g_L2Table[256] = {0};
+static CTR_ALIGN(1024) u32 g_L2Table[256] = {0};
 
 void relocateAndSetupMMU(u32 coreId, u32 *L1Table)
 {
@@ -135,33 +135,17 @@ void KProcessHwInfo__MapL2Section_Hook(void);
 
 static void installMmuHooks(void)
 {
-    u32 *mapL1Section = NULL;
-    u32 *mapL2Section = NULL;
+    // Older versions of k11 had different VA memory mappings
+    u32 k11TextStartVa = (u32)originalHandlers[2] & ~0xFFFF;
     u32 *off;
 
-    for(off = (u32 *)officialSVCs[0x1F]; *off != 0xE1CD60F0; ++off);
-    off = decodeArmBranch(off + 1);
+    for (off = (u32 *)k11TextStartVa; off[0] != 0xE3A05801 || off[1] != 0xE2010EE3; off++);
+    for (; (off[0] >> 16) != 0xE92D; off--);
+    u32 *mapL2Section = PA_FROM_VA_PTR(off); // fragile, might break due to cache
 
-    for (; *off != 0xE58D5000; ++off);
-    off = decodeArmBranch(off + 1);
-
-    for (; *off != 0xE58DC000; ++off);
-    off = decodeArmBranch(off + 1);
-    for (; *off != 0xE1A0000B; ++off);
-    off = decodeArmBranch(off + 1);
-    for (; *off != 0xE59D2030; ++off);
-    off = decodeArmBranch(off + 1);
-
-    for (; *off != 0xE88D1100; ++off);
-    mapL2Section = (u32 *)PA_FROM_VA_PTR(decodeArmBranch(off + 1));
-
-    do
-    {
-        for (; *off != 0xE58D8000; ++off);
-        u32 *loc = (u32 *)PA_FROM_VA_PTR(decodeArmBranch(++off));
-        if (loc != mapL2Section)
-            mapL1Section = loc;
-    } while (mapL1Section == NULL);
+    for (off = (u32 *)k11TextStartVa; off[0] != 0x13A0A401 || off[1] != 0x03A0A601; off++);
+    for (; (off[0] >> 16) != 0xE92D; off--);
+    u32 *mapL1Section = PA_FROM_VA_PTR(off);
 
     mapL1Section[1] = 0xE28FE004; // add lr, pc, #4
     mapL1Section[2] = 0xE51FF004; // ldr pc, [pc, #-4]
@@ -176,8 +160,10 @@ static void findUsefulSymbols(void)
 {
     u32 *off;
 
+    // Older versions of k11 had different VA memory mappings
+    u32 k11TextStartVa = (u32)originalHandlers[2] & ~0xFFFF;
     // Get fcramDescriptor
-    for (off = (u32 *)0xFFF00000; ; ++off)
+    for (off = (u32 *)k11TextStartVa; ; ++off)
     {
         if (  (off[0] >> 16) == 0xE59F
            && (off[1] >> 16) == 0xE3A0

k11_extension/source/svc/GetSystemInfo.c

@@ -43,7 +43,7 @@ Result GetSystemInfoHook(s64 *out, s32 type, s32 param)
                 s32 toCopy = (s32)sizeof(cfwInfo.launchedPath) - offset;
                 if (toCopy > 8) toCopy = 8;
                 memcpy(out, (u8*)cfwInfo.launchedPath + offset, (toCopy > 0) ? toCopy : 0);
-            } 
+            }
             else switch(param)
             {
                 // Please do not use these, except 0, 1, and 0x200
@@ -69,6 +69,9 @@ Result GetSystemInfoHook(s64 *out, s32 type, s32 param)
                 case 6:
                     *out = cfwInfo.splashDurationMsec;
                     break;
+                case 7:
+                    *out = (s64)cfwInfo.volumeSliderOverride;
+                    break;
                 case 0x10:
                     *out = (s64)cfwInfo.autobootTwlTitleId;
                     break;
@@ -117,6 +120,12 @@ Result GetSystemInfoHook(s64 *out, s32 type, s32 param)
                 case 0x10C:
                     *out = (s64)cfwInfo.bottomScreenFilter.invert;
                     break;
+                case 0x10D:
+                    *out = (s64)cfwInfo.topScreenFilter.colorCurveCorrection;
+                    break;
+                case 0x10E:
+                    *out = (s64)cfwInfo.bottomScreenFilter.colorCurveCorrection;
+                    break;
                 case 0x180:
                     *out = cfwInfo.pluginLoaderFlags;
                     break;

k11_extension/source/svc/MapProcessMemoryEx.c

@@ -26,7 +26,7 @@
 
 #include "svc/MapProcessMemoryEx.h"
 
-Result  MapProcessMemoryEx(Handle dstProcessHandle, u32 vaDst, Handle srcProcessHandle, u32 vaSrc, u32 size)
+Result  MapProcessMemoryEx(Handle dstProcessHandle, u32 vaDst, Handle srcProcessHandle, u32 vaSrc, u32 size, MapExFlags flags)
 {
     Result          res = 0;
     u32             sizeInPage = size >> 12;
@@ -69,7 +69,7 @@ Result  MapProcessMemoryEx(Handle dstProcessHandle, u32 vaDst, Handle srcProcess
         // Check if the destination address is free and large enough
         res = KProcessHwInfo__CheckVaState(hwInfoOfProcess(dstProcess), vaDst, size, 0, 0);
         if (res == 0)
-            res = KProcessHwInfo__MapListOfKBlockInfo(hwInfoOfProcess(dstProcess), vaDst, &list, 0x5806, MEMPERM_RW | 0x18, 0);
+            res = KProcessHwInfo__MapListOfKBlockInfo(hwInfoOfProcess(dstProcess), vaDst, &list, (flags & MAPEXFLAGS_PRIVATE) ? 0xBB05 : 0x5806, MEMPERM_RW | 0x18, 0);
     }
 
     KLinkedList_KBlockInfo__Clear(&list);

k11_extension/source/svc/SetGpuProt.c

@@ -26,7 +26,7 @@
 
 #include "svc/SetGpuProt.h"
 
-Result SetGpuProt(bool prot UNUSED)
+Result SetGpuProt(bool prot CTR_UNUSED)
 {
     return 0;
 }

k11_extension/source/svc/wrappers.s

@@ -118,8 +118,12 @@ ControlMemoryUnsafeWrapper:
 .global MapProcessMemoryExWrapper
 .type   MapProcessMemoryExWrapper, %function
 MapProcessMemoryExWrapper:
-    push {lr}
+    push {r5, lr} @ We need to save r5 because the old implementation doesn't save it
+    cmp r0, #0xFFFFFFF2 @ Check magic value, for backwards compatibility
+    moveq r0, r6 @ If value present, flags present in r5 and dst process in r6, so move dst process back to r0
+    movne r5, #0 @ If value not present, clear the flags as its the old version
+    str r5, [sp, #-4]!
     str r4, [sp, #-4]!
     bl MapProcessMemoryEx
-    add sp, #4
-    pop {pc}
+    add sp, #8
+    pop {r5, pc}

sysmodules/loader/source/hbldr.c

@@ -34,6 +34,12 @@
 
 extern bool isN3DS;
 
+// Note: just switch to [[attribute]] once we use clangd and cmake
+// vscode-cpptools has (or had?) some issues with C23 support
+#if __GNUC__ >= 15
+// Required by GCC 15+ but ignored (with warning) before
+__attribute__((nonstring))
+#endif
 static const char serviceList[34][8] =
 {
     "APT:U",
@@ -172,7 +178,7 @@ static const u32 kernelCaps[] =
 {
     0xFC00022C, // Kernel release version 8.0 is necessary for using the new linear mapping. Modified below.
 
-    // Normal applications only have access to 0x1FF50000-0x1FF58000, 0x1FF70000-0x1FF78000,
+    // Normal applications only have access to 0x1FF50000-0x1FF58000, 0x1FF70000-0x1FF78000 (both as IO),
     // however we can load unsigned DSP firmware binaries.
     0xFF81FF00, // RW static range mapping: 0x1FF00000 (DSP RAM, start)
     0xFF81FF80, // RW static range mapping: 0x1FF80000 (DSP RAM, end)
@@ -180,6 +186,10 @@ static const u32 kernelCaps[] =
     0xFF91F000, // RO static range mapping: 0x1F000000 (VRAM, start)
     0xFF91F600, // RO static range mapping: 0x1F600000 (VRAM, end)
 
+    // Give access to all Arm11-accessible IO
+    0xFF81EC00, // RW IO range mapping: 0x1EC00000 (PA 0x10100000, start)
+    0xFF81F000, // RW IO range mapping: 0x10500000 (PA 0x10500000, end)
+
     0xFF002109, // Exflags: APPLICATION memtype + "Shared page writing" + "Allow debug" + "Access core2"
     0xFE000200, // Handle table size: 0x200
 

sysmodules/loader/source/ifile.c

@@ -23,7 +23,9 @@ Result IFile_OpenFromArchive(IFile *file, FS_Archive archive, FS_Path filePath,
 
 Result IFile_Close(IFile *file)
 {
-  return FSFILE_Close(file->handle);
+  Result res = file->handle != 0 ? FSFILE_Close(file->handle) : 0;
+  file->handle = 0;
+  return res;
 }
 
 Result IFile_GetSize(IFile *file, u64 *size)

sysmodules/loader/source/loader.c

@@ -25,6 +25,9 @@ extern bool isN3DS, isSdMode, nextGamePatchDisabled;
 static u64 g_cached_programHandle; // for exheader info only
 static ExHeader_Info g_exheaderInfo;
 
+// Last application exheader info, for use with custom cmd 0x102
+static ExHeader_Info g_lastAppExheaderInfo;
+
 static IFile g_cached_sysmoduleCxiFile;
 static u64 g_cached_sysmoduleCxiCookie;
 static Ncch g_cached_sysmoduleCxiNcch;
@@ -269,7 +272,7 @@ Result  PLGLDR__IsPluginLoaderEnabled(bool *isEnabled)
 }
 
 // Try to load a plugin for the game
-static Result PLGLDR_LoadPlugin(u32 processID)
+static Result PLGLDR_LoadPlugin(u32 processID, bool isHomebrew)
 {
     // Special case handling: games rebooting the 3DS on old models
     if (!isN3DS && g_exheaderInfo.aci.local_caps.core_info.o3ds_system_mode > 0)
@@ -285,8 +288,9 @@ static Result PLGLDR_LoadPlugin(u32 processID)
 
     u32* cmdbuf = getThreadCommandBuffer();
 
-    cmdbuf[0] = IPC_MakeHeader(1, 1, 0);
+    cmdbuf[0] = IPC_MakeHeader(1, 2, 0);
     cmdbuf[1] = processID;
+    cmdbuf[2] = isHomebrew;
     return svcSendSyncRequest(plgldrHandle);
 }
 
@@ -380,6 +384,9 @@ static Result GetProgramInfo(u64 programHandle)
     {
         res = GetProgramInfoImpl(&g_exheaderInfo, programHandle);
         g_cached_programHandle = R_SUCCEEDED(res) ? programHandle : 0;
+        if (R_SUCCEEDED(res) && (u32)((g_exheaderInfo.aci.local_caps.title_id >> 0x20) & 0xFFFFFFEDULL) == 0x00040000) {
+            memcpy(&g_lastAppExheaderInfo, &g_exheaderInfo, sizeof(g_lastAppExheaderInfo));
+        }
     }
 
     return res;
@@ -446,12 +453,12 @@ static Result LoadProcessImpl(Handle *outProcessHandle, const ExHeader_Info *exh
             res = R_SUCCEEDED(res) ? 0 : res;
             
             // check for plugin
-            if (!res && !isHomebrew && ((u32)((titleId >> 0x20) & 0xFFFFFFEDULL) == 0x00040000))
+            if (!res && ((u32)((titleId >> 0x20) & 0xFFFFFFEDULL) == 0x00040000))
             {
                 u32 processID;
                 assertSuccess(svcGetProcessId(&processID, *outProcessHandle));
                 assertSuccess(plgldrInit());
-                assertSuccess(PLGLDR_LoadPlugin(processID));
+                assertSuccess(PLGLDR_LoadPlugin(processID, isHomebrew));
                 plgldrExit();
             }
         }
@@ -594,7 +601,13 @@ void loaderHandleCommands(void *ctx)
             cmdbuf[0] = IPC_MakeHeader(0x101, 2, 0);
             cmdbuf[1] = (Result)0;
             memcpy(&cmdbuf[2], &g_memoryOverrideConfig, sizeof(ControlApplicationMemoryModeOverrideConfig));
-            break; 
+            break;
+        case 0x102: // GetLastApplicationProgramInfo
+            cmdbuf[0] = IPC_MakeHeader(0x102, 1, 2);
+            cmdbuf[1] = (Result)0;
+            cmdbuf[2] = IPC_Desc_StaticBuffer(sizeof(ExHeader_Info), 0);
+            cmdbuf[3] = (u32)&g_lastAppExheaderInfo;
+            break;
         default: // error
             cmdbuf[0] = IPC_MakeHeader(0, 1, 0);
             cmdbuf[1] = 0xD900182F;

sysmodules/loader/source/main.c

@@ -10,7 +10,7 @@
 #include "hbldr.h"
 
 u32 config, multiConfig, bootConfig;
-bool isN3DS, isSdMode, nextGamePatchDisabled;
+bool isN3DS, isSdMode, nextGamePatchDisabled, isLumaWithKext;
 
 // MAKE SURE fsreg has been init before calling this
 static Result fsldrPatchPermissions(void)
@@ -33,7 +33,7 @@ static inline void loadCFWInfo(void)
     s64 out;
     u64 hbldrTid = 0;
 
-    bool isLumaWithKext = svcGetSystemInfo(&out, 0x20000, 0) == 1;
+    isLumaWithKext = svcGetSystemInfo(&out, 0x20000, 0) == 1;
     if (isLumaWithKext)
     {
         svcGetSystemInfo(&out, 0x10000, 3);
@@ -59,7 +59,12 @@ static inline void loadCFWInfo(void)
         if (numKips >= 6)
             panic(0xDEADCAFE);
 
-        config = 0; // all options 0
+#ifndef BUILD_FOR_EXPLOIT_DEV
+        // Most options 0, except select ones
+        config = BIT(PATCHVERSTRING) | BIT(PATCHGAMES) | BIT(LOADEXTFIRMSANDMODULES);
+#else
+        config = 0;
+#endif
         multiConfig = 0;
         bootConfig = 0;
         isN3DS = OS_KernelConfig->app_memtype >= 6;
@@ -124,7 +129,7 @@ static const ServiceManagerNotificationEntry notifications[] = {
     { 0x000, NULL },
 };
 
-static u8 ALIGN(4) staticBufferForHbldr[0x400];
+static u8 CTR_ALIGN(4) staticBufferForHbldr[0x400];
 static_assert(ARGVBUF_SIZE > 2 * PATH_MAX, "Wrong 3DSX argv buffer size");
 
 int main(void)

sysmodules/loader/source/patcher.c

@@ -148,7 +148,7 @@ static u32 findFunctionStart(u8 *code, u32 pos)
     return 0xFFFFFFFF;
 }
 
-static inline bool findLayeredFsSymbols(u8 *code, u32 size, u32 *fsMountArchive, u32 *fsRegisterArchive, u32 *fsTryOpenFile, u32 *fsOpenFileDirectly)
+static inline bool findLayeredFsSymbols(u8 *code, u32 size, u32 *fsMountArchive, u32 *fsRegisterArchive, u32 *fsTryOpenFile, u32 *fsOpenFileDirectly, u32 *fsUnMountArchive)
 {
     u32 found = 0,
         *temp = NULL;
@@ -165,6 +165,12 @@ static inline bool findLayeredFsSymbols(u8 *code, u32 size, u32 *fsMountArchive,
             case 0xE24DD028:
                 if(addr <= size - 16 && *fsMountArchive == 0xFFFFFFFF && addr32[1] == 0xE1A04000 && addr32[2] == 0xE59F60A8 && addr32[3] == 0xE3A0C001) temp = fsMountArchive;
                 break;
+            case 0xE2844001:
+                if(addr <= size - 12 && *fsUnMountArchive == 0xFFFFFFFF && addr32[1] == 0xE3540020 && addr32[2] == 0x3AFFFFF0) temp = fsUnMountArchive;
+                break;
+            case 0xE353003A:
+                if(addr <= size - 12 && *fsUnMountArchive == 0xFFFFFFFF && (addr32[1] & 0xFFFFFF0F) == 0x0A000009 && (addr32[2] & 0xFFFF0FF0) == 0xE1A00400) temp = fsUnMountArchive;
+                break;
             case 0xE3500008:
                 if(addr <= size - 12 && *fsRegisterArchive == 0xFFFFFFFF && (addr32[1] & 0xFFF00FF0) == 0xE1800400 && (addr32[2] & 0xFFF00FF0) == 0xE1800FC0) temp = fsRegisterArchive;
                 break;
@@ -183,14 +189,14 @@ static inline bool findLayeredFsSymbols(u8 *code, u32 size, u32 *fsMountArchive,
             if(*temp != 0xFFFFFFFF)
             {
                 found++;
-                if(found == 4) break;
+                if(found == 5) break;
             }
 
             temp = NULL;
         }
     }
 
-    return found == 4;
+    return found == 5;
 }
 
 static inline bool findLayeredFsPayloadOffset(u8 *code, u32 size, u32 roSize, u32 dataSize, u32 roAddress, u32 dataAddress, u32 *payloadOffset, u32 *pathOffset, u32 *pathAddress)
@@ -478,7 +484,7 @@ static inline bool loadTitleLocaleConfig(u64 progId, u8 *mask, u8 *regionId, u8
     if(R_FAILED(IFile_GetSize(&file, &fileSize)) || fileSize < 3) goto exit;
     if(fileSize >= 12) fileSize = 12;
 
-    char buf[12] = "------------";
+    char buf[12+1] = "------------";
     u64 total;
 
     if(R_FAILED(IFile_Read(&file, &total, buf, fileSize))) goto exit;
@@ -502,7 +508,7 @@ static inline bool loadTitleLocaleConfig(u64 progId, u8 *mask, u8 *regionId, u8
                                       "HK", "MO", "--", "--", "--", "--", "--", "--", "ID", "SG", "TH", "PH",
                                       "MY", "--", "--", "--", "CN", "--", "--", "--", "--", "--", "--", "--",
                                       "AE", "IN", "EG", "OM", "QA", "KW", "SA", "SY", "BH", "JO", "--", "--",
-                                      "--", "--", "--", "--", "SM", "VA"};
+                                      "--", "--", "--", "--", "SM", "VA", "BM"};
 
     u32 i;
     for(i = 0; i < sizeof(regions) / sizeof(char *); i++)
@@ -569,6 +575,7 @@ static inline bool patchLayeredFs(u64 progId, u8 *code, u32 size, u32 textSize,
     if(!archiveId) return true;
 
     u32 fsMountArchive = 0xFFFFFFFF,
+        fsUnMountArchive = 0xFFFFFFFF,
         fsRegisterArchive = 0xFFFFFFFF,
         fsTryOpenFile = 0xFFFFFFFF,
         fsOpenFileDirectly = 0xFFFFFFFF,
@@ -576,24 +583,44 @@ static inline bool patchLayeredFs(u64 progId, u8 *code, u32 size, u32 textSize,
         pathOffset = 0,
         pathAddress = 0xDEADCAFE;
 
-    if(!findLayeredFsSymbols(code, textSize, &fsMountArchive, &fsRegisterArchive, &fsTryOpenFile, &fsOpenFileDirectly) ||
+    if(!findLayeredFsSymbols(code, textSize, &fsMountArchive, &fsRegisterArchive, &fsTryOpenFile, &fsOpenFileDirectly, &fsUnMountArchive) ||
        !findLayeredFsPayloadOffset(code, textSize, roSize, dataSize, roAddress, dataAddress, &payloadOffset, &pathOffset, &pathAddress)) return false;
 
-    static const char *updateRomFsMounts[] = { "rom2:",
+    static const char *updateRomFsMounts[] = { "ro2:",
+                                               "rom2:",
                                                "rex:",
                                                "patch:",
                                                "ext:",
                                                "rom:" };
-    u32 updateRomFsIndex;
 
-    //Locate update RomFSes
-    for(updateRomFsIndex = 0; updateRomFsIndex < sizeof(updateRomFsMounts) / sizeof(char *) - 1; updateRomFsIndex++)
+    bool isMarioKart7 = (u32)progId == 0x00030600 || //JPN MK7
+                        (u32)progId == 0x00030700 || //EUR MK7
+                        (u32)progId == 0x00030800 || //USA MK7
+                        (u32)progId == 0x00030A00 || //KOR MK7
+                        (u32)progId == 0x0008B400;   //TWN MK7
+                        // Exclude CHN as it never got updates
+
+    const char *updateRomFsMount;
+
+    if (isMarioKart7)
     {
-        u32 patternSize = strlen(updateRomFsMounts[updateRomFsIndex]);
-        u8 temp[7];
-        temp[0] = 0;
-        memcpy(temp + 1, updateRomFsMounts[updateRomFsIndex], patternSize);
-        if(memsearch(code, temp, size, patternSize + 1) != NULL) break;
+        updateRomFsMount = "pat1"; // Isolated to prevent false-positives
+    }
+
+    else
+    {
+        u32 updateRomFsIndex;
+
+        //Locate update RomFS
+        for(updateRomFsIndex = 0; updateRomFsIndex < sizeof(updateRomFsMounts) / sizeof(char *) - 1; updateRomFsIndex++)
+        {
+            u32 patternSize = strlen(updateRomFsMounts[updateRomFsIndex]);
+            u8 temp[7];
+            temp[0] = 0;
+            memcpy(temp + 1, updateRomFsMounts[updateRomFsIndex], patternSize);
+            if(memsearch(code, temp, size, patternSize + 1) != NULL) break;
+        }
+        updateRomFsMount = updateRomFsMounts[updateRomFsIndex];
     }
 
     //Setup the payload
@@ -604,10 +631,11 @@ static inline bool patchLayeredFs(u64 progId, u8 *code, u32 size, u32 textSize,
     romfsRedirPatchSubstituted2 = *(u32 *)(code + fsTryOpenFile);
     romfsRedirPatchHook2 = MAKE_BRANCH(payloadOffset + (u32)&romfsRedirPatchHook2 - (u32)romfsRedirPatch, fsTryOpenFile + 4);
     romfsRedirPatchCustomPath = pathAddress;
-    romfsRedirPatchFsMountArchive = 0x100000 + fsMountArchive;
-    romfsRedirPatchFsRegisterArchive = 0x100000 + fsRegisterArchive;
+    romfsRedirPatchFsMountArchive = MAKE_BRANCH_LINK(payloadOffset + (u32)&romfsRedirPatchFsMountArchive - (u32)romfsRedirPatch, fsMountArchive);
+    romfsRedirPatchFsUnMountArchive = MAKE_BRANCH_LINK(payloadOffset + (u32)&romfsRedirPatchFsUnMountArchive - (u32)romfsRedirPatch, fsUnMountArchive);
+    romfsRedirPatchFsRegisterArchive = MAKE_BRANCH_LINK(payloadOffset + (u32)&romfsRedirPatchFsRegisterArchive - (u32)romfsRedirPatch, fsRegisterArchive);
     romfsRedirPatchArchiveId = archiveId;
-    memcpy(&romfsRedirPatchUpdateRomFsMount, updateRomFsMounts[updateRomFsIndex], 4);
+    memcpy(&romfsRedirPatchUpdateRomFsMount, updateRomFsMount, 4);
 
     memcpy(payload, romfsRedirPatch, romfsRedirPatchSize);
 
@@ -706,33 +734,65 @@ void patchCode(u64 progId, u16 progVer, u8 *code, u32 size, u32 textSize, u32 ro
              progId == 0x0004001000022000LL || //EUR MSET
              progId == 0x0004001000026000LL || //CHN MSET
              progId == 0x0004001000027000LL || //KOR MSET
-             progId == 0x0004001000028000LL) //TWN MSET
-            && CONFIG(PATCHVERSTRING))
+             progId == 0x0004001000028000LL)) //TWN MSET
     {
-        static const u16 pattern[] = u"Ve";
-        const u16 *patch;
-        u32 patchSize = 0,
-        currentNand = BOOTCFG_NAND;
-
-        u16 customVerString[19];
-        loadCustomVerString(customVerString, &patchSize, currentNand);
-
-        if(patchSize != 0) patch = customVerString;
-        else
+        if (CONFIG(PATCHVERSTRING))
         {
-            patchSize = 8;
+            static const u16 pattern[] = u"Ve";
+            const u16 *patch;
+            u32 patchSize = 0,
+            currentNand = BOOTCFG_NAND;
 
-            static const u16 *const verStringNandEmu[] = { u" Emu", u"Emu2", u"Emu3", u"Emu4" };
-            patch = currentNand == 0 ? u" Sys" : verStringNandEmu[BOOTCFG_EMUINDEX];
+            u16 customVerString[19];
+            loadCustomVerString(customVerString, &patchSize, currentNand);
+
+            if(patchSize != 0) patch = customVerString;
+            else
+            {
+                patchSize = 8;
+
+                static const u16 *const verStringNandEmu[] = { u" Emu", u"Emu2", u"Emu3", u"Emu4" };
+                patch = currentNand == 0 ? u" Sys" : verStringNandEmu[BOOTCFG_EMUINDEX];
+            }
+
+            //Patch Ver. string
+            if(!patchMemory(code, textSize,
+                    pattern,
+                    sizeof(pattern) - 2, 0,
+                    patch,
+                    patchSize, 1
+                )) goto error;
         }
 
-        //Patch Ver. string
-        if(!patchMemory(code, textSize,
-                pattern,
-                sizeof(pattern) - 2, 0,
-                patch,
-                patchSize, 1
-            )) goto error;
+        // Allow date picker to select year up to 2099, not just 2050.
+        // NNID user's year-of-birth seems to have a similar restriction,
+        // I'm not removing that as long as any NNID stuff is still active.
+
+        // Patch date picker check on entry (date load):
+        // Look for:
+        // 32 00 5x E3 CMP             Rx, #0x32
+        // ...
+        // 32 x0 A0 C3 MOVGT           Rx, #0x32
+        u32 *off = (u32 *)code;
+        for (; (u8 *)off < code + textSize && ((off[0] & 0xFFF0FFFF) != 0xE3500032 || (off[2] & 0xFFFF0FFF) != 0xC3A00032); off++)
+        {
+            if (((off[0] >> 16) & 0xF) != ((off[2] >> 12) & 0xF)) // ensure same register used
+                continue;
+        }
+        if ((u8 *)off >= code + textSize) goto error;
+        off[0] = (off[0] & ~0xFF) | 99;
+        off[2] = (off[2] & ~0xFF) | 99;
+
+        // Patch date picker actions:
+        // Look for:
+        // 01 00 80 E2 ADD             R0, R0, #1
+        // 32 00 50 E3 CMP             R0, #0x32
+        off = (u32 *)code;
+        for (; (u8 *)off < code + textSize && (off[0] != 0xE2800001 || off[1] != 0xE3500032); off++);
+        if ((u8 *)off >= code + textSize) goto error;
+
+        off[1] = (off[1] & ~0xFF) | 99; // patch increment wrap-around compare instruction
+        off[9] = (off[9] & ~0xFF) | 99; // patch decrement wrap-around conditional move instruction
     }
 
     else if(progId == 0x0004013000008002LL) //NS
@@ -946,7 +1006,7 @@ void patchCode(u64 progId, u16 progVer, u8 *code, u32 size, u32 textSize, u32 ro
                countryId,
                stateId;
 
-            if(loadTitleLocaleConfig(progId, &mask, &regionId, &languageId, &countryId, &stateId))
+            if(isLumaWithKext && loadTitleLocaleConfig(progId, &mask, &regionId, &languageId, &countryId, &stateId))
                 svcKernelSetState(0x10001, ((u32)stateId << 24) | ((u32)countryId << 16) | ((u32)languageId << 8) | ((u32)regionId << 4) | (u32)mask , progId);
             if(!patchLayeredFs(progId, code, size, textSize, roSize, dataSize, roAddress, dataAddress)) goto error;
         }

sysmodules/loader/source/patcher.h

@@ -36,15 +36,14 @@ enum singleOptions
     REDIRECTAPPTHREADS,
     PATCHVERSTRING,
     SHOWGBABOOT,
-    ENABLEDSIEXTFILTER,
-    ALLOWUPDOWNLEFTRIGHTDSI,
     PATCHUNITINFO,
+    ENABLEDSIEXTFILTER,
     DISABLEARM11EXCHANDLERS,
     ENABLESAFEFIRMROSALINA,
 };
 
 extern u32 config, multiConfig, bootConfig;
-extern bool isN3DS, isSdMode, nextGamePatchDisabled;
+extern bool isN3DS, isSdMode, nextGamePatchDisabled, isLumaWithKext;
 
 void patchCode(u64 progId, u16 progVer, u8 *code, u32 size, u32 textSize, u32 roSize, u32 dataSize, u32 roAddress, u32 dataAddress);
 bool loadTitleCodeSection(u64 progId, u8 *code, u32 size);

sysmodules/loader/source/romfsredir.h

@@ -10,6 +10,7 @@ extern u32 romfsRedirPatchSubstituted2, romfsRedirPatchHook2;
 
 extern u32 romfsRedirPatchArchiveName;
 extern u32 romfsRedirPatchFsMountArchive;
+extern u32 romfsRedirPatchFsUnMountArchive;
 extern u32 romfsRedirPatchFsRegisterArchive;
 extern u32 romfsRedirPatchArchiveId;
 extern u32 romfsRedirPatchRomFsMount;

sysmodules/loader/source/romfsredir.s

@@ -30,17 +30,23 @@ romfsRedirPatch:
         cmp     r3, #3
         bne     romfsRedirPatchSubstituted1
         stmfd   sp!, {r0-r4, lr}
+        adr     r0, romfsRedirPatchArchiveName
+        .global romfsRedirPatchFsUnMountArchive
+        romfsRedirPatchFsUnMountArchive:
+            .word 0xdead0004
         sub     sp, sp, #4
         ldr     r1, romfsRedirPatchArchiveId
         mov     r0, sp
-        ldr     r4, romfsRedirPatchFsMountArchive
-        blx     r4
+        .global romfsRedirPatchFsMountArchive
+        romfsRedirPatchFsMountArchive:
+            .word 0xdead0005
         mov     r3, #0
         mov     r2, #0
         ldr     r1, [sp]
         adr     r0, romfsRedirPatchArchiveName
-        ldr     r4, romfsRedirPatchFsRegisterArchive
-        blx     r4
+        .global romfsRedirPatchFsRegisterArchive
+        romfsRedirPatchFsRegisterArchive:
+            .word 0xdead0006
         add     sp, sp, #4
         ldmfd   sp!, {r0-r4, lr}
         b       romfsRedirPatchSubstituted1
@@ -108,20 +114,16 @@ romfsRedirPatch:
 .balign 4
 
     .global romfsRedirPatchArchiveName
-    .global romfsRedirPatchFsMountArchive
-    .global romfsRedirPatchFsRegisterArchive
     .global romfsRedirPatchArchiveId
     .global romfsRedirPatchRomFsMount
     .global romfsRedirPatchUpdateRomFsMount
     .global romfsRedirPatchCustomPath
 
     romfsRedirPatchArchiveName       : .ascii "lf:\0"
-    romfsRedirPatchFsMountArchive    : .word 0xdead0005
-    romfsRedirPatchFsRegisterArchive : .word 0xdead0006
     romfsRedirPatchArchiveId         : .word 0xdead0007
     romfsRedirPatchRomFsMount        : .ascii "rom:"
     romfsRedirPatchUpdateRomFsMount  : .word 0xdead0008
-    romfsRedirPatchCustomPath        : .word 0xdead0004
+    romfsRedirPatchCustomPath        : .word 0xdead0009
 
 _romfsRedirPatchEnd:
 

sysmodules/pm/source/luma.h

@@ -30,9 +30,8 @@ enum singleOptions
     REDIRECTAPPTHREADS,
     PATCHVERSTRING,
     SHOWGBABOOT,
-    ENABLEDSIEXTFILTER,
-    ALLOWUPDOWNLEFTRIGHTDSI,
     PATCHUNITINFO,
+    ENABLEDSIEXTFILTER,
     DISABLEARM11EXCHANDLERS,
     ENABLESAFEFIRMROSALINA,
 };

sysmodules/pm/source/main.c

@@ -16,9 +16,9 @@
 #include "luma.h"
 
 static MyThread processMonitorThread, taskRunnerThread;
-static u8 ALIGN(8) processDataBuffer[0x40 * sizeof(ProcessData)] = {0};
-static u8 ALIGN(8) exheaderInfoBuffer[6 * sizeof(ExHeader_Info)] = {0};
-static u8 ALIGN(8) threadStacks[2][THREAD_STACK_SIZE] = {0};
+static u8 CTR_ALIGN(8) processDataBuffer[0x40 * sizeof(ProcessData)] = {0};
+static u8 CTR_ALIGN(8) exheaderInfoBuffer[6 * sizeof(ExHeader_Info)] = {0};
+static u8 CTR_ALIGN(8) threadStacks[2][THREAD_STACK_SIZE] = {0};
 
 // this is called after main exits
 void __wrap_exit(int rc)

sysmodules/pxi/source/common.h

@@ -44,7 +44,7 @@ typedef struct SessionManager
 } SessionManager;
 
 //Page alignment is mandatory there
-extern u32 ALIGN(0x1000) staticBuffers[NB_STATIC_BUFFERS][0x1000/4];
+extern u32 CTR_ALIGN(0x1000) staticBuffers[NB_STATIC_BUFFERS][0x1000/4];
 
 extern Handle PXISyncInterrupt, PXITransferMutex;
 extern Handle terminationRequestedEvent;

sysmodules/pxi/source/main.c

@@ -38,7 +38,7 @@ const char *serviceNames[10] =
 
 const u32 nbStaticBuffersByService[10] = {0, 2, 2, 2, 2, 1, 4, 4, 4, 0};
 
-u32 ALIGN(0x1000) staticBuffers[NB_STATIC_BUFFERS][0x400] = {{0}};
+u32 CTR_ALIGN(0x1000) staticBuffers[NB_STATIC_BUFFERS][0x400] = {{0}};
 
 static inline void initPXI(void)
 {
@@ -95,9 +95,9 @@ static inline void exitPXI(void)
     PXIReset();
 }
 
-static u8 ALIGN(8) receiverStack[THREAD_STACK_SIZE];
-static u8 ALIGN(8) senderStack[THREAD_STACK_SIZE];
-static u8 ALIGN(8) PXISRV11HandlerStack[THREAD_STACK_SIZE];
+static u8 CTR_ALIGN(8) receiverStack[THREAD_STACK_SIZE];
+static u8 CTR_ALIGN(8) senderStack[THREAD_STACK_SIZE];
+static u8 CTR_ALIGN(8) PXISRV11HandlerStack[THREAD_STACK_SIZE];
 static MyThread receiverThread = {0}, senderThread = {0}, PXISRV11HandlerThread = {0};
 
 Result __sync_init(void);

sysmodules/rosalina/include/csvc.h

@@ -73,6 +73,13 @@ void svcInvalidateEntireInstructionCache(void);
 
 ///@name Memory management
 ///@{
+
+/// Flags for svcMapProcessMemoryEx
+typedef enum MapExFlags
+{
+    MAPEXFLAGS_PRIVATE = BIT(0), ///< Maps the memory as PRIVATE (0xBB05) instead of SHARED (0x5806)
+} MapExFlags;
+
 /**
  * @brief Maps a block of process memory.
  * @param dstProcessHandle Handle of the process to map the memory in (destination)
@@ -80,8 +87,9 @@ void svcInvalidateEntireInstructionCache(void);
  * @param srcProcessHandle Handle of the process to map the memory from (source)
  * @param srcAddress Start address of the memory block in the source process
  * @param size Size of the block of the memory to map (truncated to a multiple of 0x1000 bytes)
+ * @param flags Extended flags for mapping the memory (see MapExFlags)
 */
-Result svcMapProcessMemoryEx(Handle dstProcessHandle, u32 destAddress, Handle srcProcessHandle, u32 srcAddress, u32 size);
+Result svcMapProcessMemoryEx(Handle dstProcessHandle, u32 destAddress, Handle srcProcessHandle, u32 srcAddress, u32 size, MapExFlags flags);
 
 /**
  * @brief Unmaps a block of process memory.

sysmodules/rosalina/include/draw.h

@@ -108,4 +108,4 @@ u32 Draw_GetCurrentFramebufferAddress(bool top, bool left);
 void Draw_GetCurrentScreenInfo(u32 *width, bool *is3d, bool top);
 
 void Draw_CreateBitmapHeader(u8 *dst, u32 width, u32 heigth);
-void Draw_ConvertFrameBufferLines(u8 *buf, u32 width, u32 startingLine, u32 numLines, bool top, bool left);
+void Draw_ConvertFrameBufferLines(u8 *buf, u32 width, u32 startingLine, u32 numLines, u32 scaleFactorY, bool top, bool left);

sysmodules/rosalina/include/gdb.h

@@ -16,6 +16,9 @@
 #include "memory.h"
 #include "ifile.h"
 
+// Uncomment the line below to dump GDB communications to a file
+//#define DEBUG_GDB_COMMUNICATIONS
+
 #define MAX_DEBUG           3
 #define MAX_DEBUG_THREAD    127
 #define MAX_BREAKPOINT      64
@@ -154,6 +157,10 @@ typedef struct GDBContext
 
     char memoryOsInfoXmlData[0x800];
     char processesOsInfoXmlData[0x1800];
+
+#ifdef DEBUG_GDB_COMMUNICATIONS
+    IFile debugFile;
+#endif
 } GDBContext;
 
 typedef int (*GDBCommandHandler)(GDBContext *ctx);

sysmodules/rosalina/include/ifile.h

@@ -44,3 +44,4 @@ Result IFile_GetSize(IFile *file, u64 *size);
 Result IFile_SetSize(IFile *file, u64 size);
 Result IFile_Read(IFile *file, u64 *total, void *buffer, u32 len);
 Result IFile_Write(IFile *file, u64 *total, const void *buffer, u32 len, u32 flags);
+Result IFile_Flush(IFile *file);

sysmodules/rosalina/include/luma_config.h

@@ -38,9 +38,8 @@ enum singleOptions
     REDIRECTAPPTHREADS,
     PATCHVERSTRING,
     SHOWGBABOOT,
-    ENABLEDSIEXTFILTER,
-    ALLOWUPDOWNLEFTRIGHTDSI,
     PATCHUNITINFO,
+    ENABLEDSIEXTFILTER,
     DISABLEARM11EXCHANDLERS,
     ENABLESAFEFIRMROSALINA,
 };

sysmodules/rosalina/include/menu.h

@@ -62,12 +62,18 @@ typedef struct MenuItem {
 typedef struct Menu {
     const char *title;
 
-    MenuItem items[16];
+    MenuItem items[25];
 } Menu;
 
 extern u32 menuCombo;
 extern bool isHidInitialized;
+extern bool isQtmInitialized;
 extern u32 mcuFwVersion;
+extern u8 mcuInfoTable[10];
+extern bool mcuInfoTableRead;
+extern const char *topScreenType;
+extern const char *bottomScreenType;
+extern bool areScreenTypesInitialized;
 
 // From main.c
 extern bool isN3DS;

sysmodules/rosalina/include/menus.h

@@ -33,13 +33,17 @@
 extern Menu rosalinaMenu;
 
 void RosalinaMenu_TakeScreenshot(void);
-void RosalinaMenu_ChangeScreenBrightness(void);
 void RosalinaMenu_ShowCredits(void);
 void RosalinaMenu_ProcessList(void);
 void RosalinaMenu_SaveSettings(void);
-void RosalinaMenu_PowerOff(void);
-void RosalinaMenu_Reboot(void);
+void RosalinaMenu_ReturnToHomeMenu(void);
 void RosalinaMenu_Cheats(void);
 
+void RosalinaMenu_PowerOffOrReboot(void);
+
+void RosalinaMenu_ShowSystemInfo();
+
 bool rosalinaMenuShouldShowDebugInfo(void);
 void RosalinaMenu_ShowDebugInfo(void);
+
+void menuTakeSelfScreenshot(void);

sysmodules/rosalina/include/menus/n3ds.h

@@ -31,6 +31,12 @@
 
 extern Menu N3DSMenu;
 
+bool N3DSMenu_CheckNotN2dsXl(void);
+
 void N3DSMenu_UpdateStatus(void);
 void N3DSMenu_ChangeClockRate(void);
 void N3DSMenu_EnableDisableL2Cache(void);
+
+void N3DSMenu_ToggleSs3d(void);
+void N3DSMenu_TestBarrierPositions(void);
+void N3DSMenu_Ss3dCalibration(void);

sysmodules/rosalina/include/menus/screen_filters.h

@@ -33,6 +33,7 @@ extern Menu screenFiltersMenu;
 typedef struct ScreenFilter {
     u16 cct;
     bool invert;
+    u8 colorCurveCorrection;
     float gamma;
     float contrast;
     float brightness;
@@ -56,4 +57,9 @@ void ScreenFiltersMenu_SetWarmIncandescent(void);   // 2300K
 void ScreenFiltersMenu_SetCandle(void);             // 1900K
 void ScreenFiltersMenu_SetEmber(void);              // 1200K
 
+void ScreenFiltersMenu_SetTopScreenSrgbColorCurve(void);
+void ScreenFiltersMenu_RestoreTopScreenColorCurve(void);
+void ScreenFiltersMenu_SetBottomScreenSrgbColorCurve(void);
+void ScreenFiltersMenu_RestoreBottomScreenColorCurve(void);
+
 void ScreenFiltersMenu_AdvancedConfiguration(void);

sysmodules/rosalina/include/menus/screen_filters_srgb_tables.h

@@ -0,0 +1,527 @@
+// SPDX-License-Identifier: MIT
+// (c) 2024 LumaTeam
+
+#pragma once
+#include <3ds/types.h>
+
+// Originally from OAF and taken with permission,
+// though it is unclear whether LUT data can be licensed
+// like code is.
+
+static const u8 ctrToSrgbTableTop[256][3] = {
+    { 0x00, 0x00, 0x00, }, // i = 0x00
+    { 0x01, 0x01, 0x01, }, // i = 0x01
+    { 0x02, 0x01, 0x02, }, // i = 0x02
+    { 0x03, 0x02, 0x03, }, // i = 0x03
+    { 0x04, 0x03, 0x04, }, // i = 0x04
+    { 0x05, 0x04, 0x05, }, // i = 0x05
+    { 0x06, 0x04, 0x06, }, // i = 0x06
+    { 0x07, 0x05, 0x06, }, // i = 0x07
+    { 0x08, 0x06, 0x07, }, // i = 0x08
+    { 0x08, 0x06, 0x08, }, // i = 0x09
+    { 0x09, 0x07, 0x09, }, // i = 0x0A
+    { 0x0A, 0x08, 0x0A, }, // i = 0x0B
+    { 0x0B, 0x09, 0x0B, }, // i = 0x0C
+    { 0x0C, 0x09, 0x0B, }, // i = 0x0D
+    { 0x0D, 0x0A, 0x0C, }, // i = 0x0E
+    { 0x0E, 0x0B, 0x0D, }, // i = 0x0F
+    { 0x0F, 0x0B, 0x0E, }, // i = 0x10
+    { 0x10, 0x0C, 0x0F, }, // i = 0x11
+    { 0x10, 0x0D, 0x0F, }, // i = 0x12
+    { 0x11, 0x0E, 0x10, }, // i = 0x13
+    { 0x12, 0x0E, 0x11, }, // i = 0x14
+    { 0x13, 0x0F, 0x12, }, // i = 0x15
+    { 0x14, 0x10, 0x12, }, // i = 0x16
+    { 0x15, 0x11, 0x13, }, // i = 0x17
+    { 0x16, 0x11, 0x14, }, // i = 0x18
+    { 0x16, 0x12, 0x15, }, // i = 0x19
+    { 0x17, 0x13, 0x15, }, // i = 0x1A
+    { 0x18, 0x14, 0x16, }, // i = 0x1B
+    { 0x19, 0x14, 0x17, }, // i = 0x1C
+    { 0x1A, 0x15, 0x18, }, // i = 0x1D
+    { 0x1B, 0x16, 0x18, }, // i = 0x1E
+    { 0x1C, 0x17, 0x19, }, // i = 0x1F
+    { 0x1C, 0x17, 0x1A, }, // i = 0x20
+    { 0x1D, 0x18, 0x1B, }, // i = 0x21
+    { 0x1E, 0x19, 0x1B, }, // i = 0x22
+    { 0x1F, 0x1A, 0x1C, }, // i = 0x23
+    { 0x20, 0x1B, 0x1D, }, // i = 0x24
+    { 0x21, 0x1B, 0x1E, }, // i = 0x25
+    { 0x22, 0x1C, 0x1E, }, // i = 0x26
+    { 0x23, 0x1D, 0x1F, }, // i = 0x27
+    { 0x23, 0x1E, 0x20, }, // i = 0x28
+    { 0x24, 0x1F, 0x21, }, // i = 0x29
+    { 0x25, 0x1F, 0x21, }, // i = 0x2A
+    { 0x26, 0x20, 0x22, }, // i = 0x2B
+    { 0x27, 0x21, 0x23, }, // i = 0x2C
+    { 0x28, 0x22, 0x24, }, // i = 0x2D
+    { 0x29, 0x23, 0x24, }, // i = 0x2E
+    { 0x2A, 0x24, 0x25, }, // i = 0x2F
+    { 0x2B, 0x24, 0x26, }, // i = 0x30
+    { 0x2C, 0x25, 0x27, }, // i = 0x31
+    { 0x2D, 0x26, 0x28, }, // i = 0x32
+    { 0x2E, 0x27, 0x28, }, // i = 0x33
+    { 0x2E, 0x28, 0x29, }, // i = 0x34
+    { 0x2F, 0x29, 0x2A, }, // i = 0x35
+    { 0x30, 0x2A, 0x2B, }, // i = 0x36
+    { 0x31, 0x2B, 0x2B, }, // i = 0x37
+    { 0x32, 0x2B, 0x2C, }, // i = 0x38
+    { 0x33, 0x2C, 0x2D, }, // i = 0x39
+    { 0x34, 0x2D, 0x2E, }, // i = 0x3A
+    { 0x35, 0x2E, 0x2F, }, // i = 0x3B
+    { 0x36, 0x2F, 0x30, }, // i = 0x3C
+    { 0x37, 0x30, 0x30, }, // i = 0x3D
+    { 0x38, 0x31, 0x31, }, // i = 0x3E
+    { 0x39, 0x32, 0x32, }, // i = 0x3F
+    { 0x3A, 0x33, 0x33, }, // i = 0x40
+    { 0x3B, 0x34, 0x34, }, // i = 0x41
+    { 0x3C, 0x35, 0x34, }, // i = 0x42
+    { 0x3D, 0x35, 0x35, }, // i = 0x43
+    { 0x3E, 0x36, 0x36, }, // i = 0x44
+    { 0x3F, 0x37, 0x37, }, // i = 0x45
+    { 0x40, 0x38, 0x38, }, // i = 0x46
+    { 0x41, 0x39, 0x39, }, // i = 0x47
+    { 0x42, 0x3A, 0x3A, }, // i = 0x48
+    { 0x43, 0x3B, 0x3A, }, // i = 0x49
+    { 0x44, 0x3C, 0x3B, }, // i = 0x4A
+    { 0x45, 0x3D, 0x3C, }, // i = 0x4B
+    { 0x46, 0x3E, 0x3D, }, // i = 0x4C
+    { 0x47, 0x3F, 0x3E, }, // i = 0x4D
+    { 0x48, 0x40, 0x3F, }, // i = 0x4E
+    { 0x49, 0x41, 0x40, }, // i = 0x4F
+    { 0x4A, 0x42, 0x41, }, // i = 0x50
+    { 0x4B, 0x43, 0x41, }, // i = 0x51
+    { 0x4C, 0x44, 0x42, }, // i = 0x52
+    { 0x4D, 0x45, 0x43, }, // i = 0x53
+    { 0x4E, 0x46, 0x44, }, // i = 0x54
+    { 0x4F, 0x47, 0x45, }, // i = 0x55
+    { 0x50, 0x48, 0x46, }, // i = 0x56
+    { 0x51, 0x49, 0x47, }, // i = 0x57
+    { 0x52, 0x4A, 0x48, }, // i = 0x58
+    { 0x53, 0x4B, 0x49, }, // i = 0x59
+    { 0x54, 0x4C, 0x4A, }, // i = 0x5A
+    { 0x55, 0x4D, 0x4B, }, // i = 0x5B
+    { 0x56, 0x4E, 0x4B, }, // i = 0x5C
+    { 0x57, 0x4F, 0x4C, }, // i = 0x5D
+    { 0x58, 0x50, 0x4D, }, // i = 0x5E
+    { 0x59, 0x51, 0x4E, }, // i = 0x5F
+    { 0x5B, 0x52, 0x4F, }, // i = 0x60
+    { 0x5C, 0x53, 0x50, }, // i = 0x61
+    { 0x5D, 0x54, 0x51, }, // i = 0x62
+    { 0x5E, 0x55, 0x52, }, // i = 0x63
+    { 0x5F, 0x56, 0x53, }, // i = 0x64
+    { 0x60, 0x57, 0x54, }, // i = 0x65
+    { 0x61, 0x58, 0x55, }, // i = 0x66
+    { 0x62, 0x59, 0x56, }, // i = 0x67
+    { 0x63, 0x5A, 0x57, }, // i = 0x68
+    { 0x64, 0x5B, 0x57, }, // i = 0x69
+    { 0x65, 0x5C, 0x58, }, // i = 0x6A
+    { 0x66, 0x5D, 0x59, }, // i = 0x6B
+    { 0x67, 0x5E, 0x5A, }, // i = 0x6C
+    { 0x68, 0x5F, 0x5B, }, // i = 0x6D
+    { 0x69, 0x60, 0x5C, }, // i = 0x6E
+    { 0x6A, 0x61, 0x5D, }, // i = 0x6F
+    { 0x6B, 0x62, 0x5E, }, // i = 0x70
+    { 0x6C, 0x63, 0x5F, }, // i = 0x71
+    { 0x6D, 0x64, 0x60, }, // i = 0x72
+    { 0x6E, 0x65, 0x61, }, // i = 0x73
+    { 0x6F, 0x66, 0x62, }, // i = 0x74
+    { 0x70, 0x67, 0x63, }, // i = 0x75
+    { 0x71, 0x68, 0x64, }, // i = 0x76
+    { 0x73, 0x69, 0x65, }, // i = 0x77
+    { 0x74, 0x6A, 0x66, }, // i = 0x78
+    { 0x75, 0x6B, 0x67, }, // i = 0x79
+    { 0x76, 0x6C, 0x68, }, // i = 0x7A
+    { 0x77, 0x6D, 0x68, }, // i = 0x7B
+    { 0x78, 0x6E, 0x69, }, // i = 0x7C
+    { 0x79, 0x6F, 0x6A, }, // i = 0x7D
+    { 0x7A, 0x70, 0x6B, }, // i = 0x7E
+    { 0x7B, 0x71, 0x6C, }, // i = 0x7F
+    { 0x7C, 0x72, 0x6D, }, // i = 0x80
+    { 0x7D, 0x73, 0x6E, }, // i = 0x81
+    { 0x7E, 0x74, 0x6F, }, // i = 0x82
+    { 0x7F, 0x75, 0x70, }, // i = 0x83
+    { 0x80, 0x76, 0x71, }, // i = 0x84
+    { 0x81, 0x77, 0x72, }, // i = 0x85
+    { 0x82, 0x78, 0x73, }, // i = 0x86
+    { 0x83, 0x79, 0x74, }, // i = 0x87
+    { 0x84, 0x7A, 0x75, }, // i = 0x88
+    { 0x85, 0x7B, 0x76, }, // i = 0x89
+    { 0x86, 0x7C, 0x77, }, // i = 0x8A
+    { 0x87, 0x7D, 0x78, }, // i = 0x8B
+    { 0x88, 0x7E, 0x79, }, // i = 0x8C
+    { 0x89, 0x7F, 0x7A, }, // i = 0x8D
+    { 0x8A, 0x81, 0x7B, }, // i = 0x8E
+    { 0x8B, 0x82, 0x7C, }, // i = 0x8F
+    { 0x8C, 0x83, 0x7C, }, // i = 0x90
+    { 0x8D, 0x84, 0x7D, }, // i = 0x91
+    { 0x8E, 0x85, 0x7E, }, // i = 0x92
+    { 0x8F, 0x86, 0x7F, }, // i = 0x93
+    { 0x90, 0x87, 0x80, }, // i = 0x94
+    { 0x91, 0x88, 0x81, }, // i = 0x95
+    { 0x92, 0x89, 0x82, }, // i = 0x96
+    { 0x93, 0x8A, 0x83, }, // i = 0x97
+    { 0x94, 0x8B, 0x84, }, // i = 0x98
+    { 0x95, 0x8C, 0x85, }, // i = 0x99
+    { 0x96, 0x8D, 0x86, }, // i = 0x9A
+    { 0x97, 0x8E, 0x87, }, // i = 0x9B
+    { 0x98, 0x8F, 0x88, }, // i = 0x9C
+    { 0x99, 0x90, 0x89, }, // i = 0x9D
+    { 0x9A, 0x91, 0x8A, }, // i = 0x9E
+    { 0x9B, 0x92, 0x8B, }, // i = 0x9F
+    { 0x9C, 0x93, 0x8C, }, // i = 0xA0
+    { 0x9D, 0x94, 0x8D, }, // i = 0xA1
+    { 0x9E, 0x95, 0x8E, }, // i = 0xA2
+    { 0x9F, 0x96, 0x8F, }, // i = 0xA3
+    { 0xA0, 0x97, 0x90, }, // i = 0xA4
+    { 0xA1, 0x98, 0x91, }, // i = 0xA5
+    { 0xA2, 0x99, 0x92, }, // i = 0xA6
+    { 0xA4, 0x9A, 0x93, }, // i = 0xA7
+    { 0xA5, 0x9B, 0x94, }, // i = 0xA8
+    { 0xA6, 0x9C, 0x95, }, // i = 0xA9
+    { 0xA7, 0x9D, 0x96, }, // i = 0xAA
+    { 0xA8, 0x9F, 0x97, }, // i = 0xAB
+    { 0xA9, 0xA0, 0x98, }, // i = 0xAC
+    { 0xAA, 0xA1, 0x99, }, // i = 0xAD
+    { 0xAB, 0xA2, 0x9A, }, // i = 0xAE
+    { 0xAC, 0xA3, 0x9B, }, // i = 0xAF
+    { 0xAD, 0xA4, 0x9C, }, // i = 0xB0
+    { 0xAE, 0xA5, 0x9D, }, // i = 0xB1
+    { 0xAF, 0xA6, 0x9E, }, // i = 0xB2
+    { 0xB0, 0xA7, 0x9F, }, // i = 0xB3
+    { 0xB1, 0xA8, 0xA0, }, // i = 0xB4
+    { 0xB2, 0xA9, 0xA1, }, // i = 0xB5
+    { 0xB3, 0xAA, 0xA2, }, // i = 0xB6
+    { 0xB4, 0xAB, 0xA3, }, // i = 0xB7
+    { 0xB5, 0xAC, 0xA4, }, // i = 0xB8
+    { 0xB6, 0xAD, 0xA5, }, // i = 0xB9
+    { 0xB7, 0xAF, 0xA6, }, // i = 0xBA
+    { 0xB8, 0xB0, 0xA7, }, // i = 0xBB
+    { 0xB9, 0xB1, 0xA9, }, // i = 0xBC
+    { 0xBA, 0xB2, 0xAA, }, // i = 0xBD
+    { 0xBB, 0xB3, 0xAB, }, // i = 0xBE
+    { 0xBC, 0xB4, 0xAC, }, // i = 0xBF
+    { 0xBD, 0xB5, 0xAD, }, // i = 0xC0
+    { 0xBE, 0xB6, 0xAE, }, // i = 0xC1
+    { 0xBF, 0xB7, 0xAF, }, // i = 0xC2
+    { 0xC0, 0xB9, 0xB0, }, // i = 0xC3
+    { 0xC1, 0xBA, 0xB1, }, // i = 0xC4
+    { 0xC3, 0xBB, 0xB2, }, // i = 0xC5
+    { 0xC4, 0xBC, 0xB4, }, // i = 0xC6
+    { 0xC5, 0xBD, 0xB5, }, // i = 0xC7
+    { 0xC6, 0xBE, 0xB6, }, // i = 0xC8
+    { 0xC7, 0xBF, 0xB7, }, // i = 0xC9
+    { 0xC8, 0xC0, 0xB8, }, // i = 0xCA
+    { 0xC9, 0xC2, 0xB9, }, // i = 0xCB
+    { 0xCA, 0xC3, 0xBB, }, // i = 0xCC
+    { 0xCB, 0xC4, 0xBC, }, // i = 0xCD
+    { 0xCC, 0xC5, 0xBD, }, // i = 0xCE
+    { 0xCD, 0xC6, 0xBE, }, // i = 0xCF
+    { 0xCE, 0xC7, 0xBF, }, // i = 0xD0
+    { 0xCF, 0xC8, 0xC1, }, // i = 0xD1
+    { 0xD0, 0xCA, 0xC2, }, // i = 0xD2
+    { 0xD2, 0xCB, 0xC3, }, // i = 0xD3
+    { 0xD3, 0xCC, 0xC4, }, // i = 0xD4
+    { 0xD4, 0xCD, 0xC5, }, // i = 0xD5
+    { 0xD5, 0xCE, 0xC7, }, // i = 0xD6
+    { 0xD6, 0xCF, 0xC8, }, // i = 0xD7
+    { 0xD7, 0xD1, 0xC9, }, // i = 0xD8
+    { 0xD8, 0xD2, 0xCB, }, // i = 0xD9
+    { 0xD9, 0xD3, 0xCC, }, // i = 0xDA
+    { 0xDA, 0xD4, 0xCD, }, // i = 0xDB
+    { 0xDB, 0xD5, 0xCE, }, // i = 0xDC
+    { 0xDC, 0xD7, 0xD0, }, // i = 0xDD
+    { 0xDE, 0xD8, 0xD1, }, // i = 0xDE
+    { 0xDF, 0xD9, 0xD2, }, // i = 0xDF
+    { 0xE0, 0xDA, 0xD4, }, // i = 0xE0
+    { 0xE1, 0xDB, 0xD5, }, // i = 0xE1
+    { 0xE2, 0xDD, 0xD6, }, // i = 0xE2
+    { 0xE3, 0xDE, 0xD8, }, // i = 0xE3
+    { 0xE4, 0xDF, 0xD9, }, // i = 0xE4
+    { 0xE5, 0xE0, 0xDA, }, // i = 0xE5
+    { 0xE6, 0xE1, 0xDC, }, // i = 0xE6
+    { 0xE7, 0xE3, 0xDD, }, // i = 0xE7
+    { 0xE8, 0xE4, 0xDE, }, // i = 0xE8
+    { 0xEA, 0xE5, 0xE0, }, // i = 0xE9
+    { 0xEB, 0xE6, 0xE1, }, // i = 0xEA
+    { 0xEC, 0xE7, 0xE2, }, // i = 0xEB
+    { 0xED, 0xE9, 0xE4, }, // i = 0xEC
+    { 0xEE, 0xEA, 0xE5, }, // i = 0xED
+    { 0xEF, 0xEB, 0xE7, }, // i = 0xEE
+    { 0xF0, 0xEC, 0xE8, }, // i = 0xEF
+    { 0xF1, 0xED, 0xE9, }, // i = 0xF0
+    { 0xF2, 0xEF, 0xEB, }, // i = 0xF1
+    { 0xF3, 0xF0, 0xEC, }, // i = 0xF2
+    { 0xF4, 0xF1, 0xEE, }, // i = 0xF3
+    { 0xF5, 0xF2, 0xEF, }, // i = 0xF4
+    { 0xF6, 0xF3, 0xF1, }, // i = 0xF5
+    { 0xF7, 0xF5, 0xF2, }, // i = 0xF6
+    { 0xF8, 0xF6, 0xF3, }, // i = 0xF7
+    { 0xF9, 0xF7, 0xF5, }, // i = 0xF8
+    { 0xFA, 0xF8, 0xF6, }, // i = 0xF9
+    { 0xFB, 0xF9, 0xF8, }, // i = 0xFA
+    { 0xFC, 0xFA, 0xF9, }, // i = 0xFB
+    { 0xFD, 0xFC, 0xFA, }, // i = 0xFC
+    { 0xFD, 0xFD, 0xFC, }, // i = 0xFD
+    { 0xFE, 0xFE, 0xFD, }, // i = 0xFE
+    { 0xFF, 0xFF, 0xFF, }, // i = 0xFF
+};
+
+static const u8 ctrToSrgbTableBottom[256][3] = {
+    { 0x00, 0x00, 0x00, }, // i = 0x00
+    { 0x01, 0x00, 0x00, }, // i = 0x01
+    { 0x01, 0x00, 0x01, }, // i = 0x02
+    { 0x02, 0x01, 0x01, }, // i = 0x03
+    { 0x02, 0x01, 0x02, }, // i = 0x04
+    { 0x03, 0x01, 0x03, }, // i = 0x05
+    { 0x04, 0x02, 0x03, }, // i = 0x06
+    { 0x04, 0x02, 0x04, }, // i = 0x07
+    { 0x05, 0x02, 0x04, }, // i = 0x08
+    { 0x05, 0x03, 0x05, }, // i = 0x09
+    { 0x06, 0x03, 0x05, }, // i = 0x0A
+    { 0x07, 0x04, 0x06, }, // i = 0x0B
+    { 0x07, 0x04, 0x07, }, // i = 0x0C
+    { 0x08, 0x05, 0x07, }, // i = 0x0D
+    { 0x09, 0x05, 0x08, }, // i = 0x0E
+    { 0x0A, 0x06, 0x08, }, // i = 0x0F
+    { 0x0A, 0x06, 0x09, }, // i = 0x10
+    { 0x0B, 0x07, 0x0A, }, // i = 0x11
+    { 0x0C, 0x08, 0x0A, }, // i = 0x12
+    { 0x0C, 0x08, 0x0B, }, // i = 0x13
+    { 0x0D, 0x09, 0x0C, }, // i = 0x14
+    { 0x0E, 0x09, 0x0C, }, // i = 0x15
+    { 0x0F, 0x0A, 0x0D, }, // i = 0x16
+    { 0x10, 0x0B, 0x0E, }, // i = 0x17
+    { 0x10, 0x0B, 0x0F, }, // i = 0x18
+    { 0x11, 0x0C, 0x0F, }, // i = 0x19
+    { 0x12, 0x0D, 0x10, }, // i = 0x1A
+    { 0x13, 0x0D, 0x11, }, // i = 0x1B
+    { 0x14, 0x0E, 0x12, }, // i = 0x1C
+    { 0x14, 0x0F, 0x12, }, // i = 0x1D
+    { 0x15, 0x10, 0x13, }, // i = 0x1E
+    { 0x16, 0x10, 0x14, }, // i = 0x1F
+    { 0x17, 0x11, 0x15, }, // i = 0x20
+    { 0x18, 0x12, 0x15, }, // i = 0x21
+    { 0x19, 0x13, 0x16, }, // i = 0x22
+    { 0x19, 0x13, 0x17, }, // i = 0x23
+    { 0x1A, 0x14, 0x18, }, // i = 0x24
+    { 0x1B, 0x15, 0x18, }, // i = 0x25
+    { 0x1C, 0x16, 0x19, }, // i = 0x26
+    { 0x1D, 0x17, 0x1A, }, // i = 0x27
+    { 0x1E, 0x18, 0x1B, }, // i = 0x28
+    { 0x1F, 0x18, 0x1C, }, // i = 0x29
+    { 0x20, 0x19, 0x1C, }, // i = 0x2A
+    { 0x21, 0x1A, 0x1D, }, // i = 0x2B
+    { 0x22, 0x1B, 0x1E, }, // i = 0x2C
+    { 0x22, 0x1C, 0x1F, }, // i = 0x2D
+    { 0x23, 0x1D, 0x20, }, // i = 0x2E
+    { 0x24, 0x1E, 0x21, }, // i = 0x2F
+    { 0x25, 0x1E, 0x21, }, // i = 0x30
+    { 0x26, 0x1F, 0x22, }, // i = 0x31
+    { 0x27, 0x20, 0x23, }, // i = 0x32
+    { 0x28, 0x21, 0x24, }, // i = 0x33
+    { 0x29, 0x22, 0x25, }, // i = 0x34
+    { 0x2A, 0x23, 0x26, }, // i = 0x35
+    { 0x2B, 0x24, 0x27, }, // i = 0x36
+    { 0x2C, 0x25, 0x27, }, // i = 0x37
+    { 0x2D, 0x26, 0x28, }, // i = 0x38
+    { 0x2E, 0x27, 0x29, }, // i = 0x39
+    { 0x2F, 0x28, 0x2A, }, // i = 0x3A
+    { 0x30, 0x29, 0x2B, }, // i = 0x3B
+    { 0x31, 0x2A, 0x2C, }, // i = 0x3C
+    { 0x32, 0x2A, 0x2D, }, // i = 0x3D
+    { 0x33, 0x2B, 0x2E, }, // i = 0x3E
+    { 0x34, 0x2C, 0x2E, }, // i = 0x3F
+    { 0x35, 0x2D, 0x2F, }, // i = 0x40
+    { 0x36, 0x2E, 0x30, }, // i = 0x41
+    { 0x37, 0x2F, 0x31, }, // i = 0x42
+    { 0x38, 0x30, 0x32, }, // i = 0x43
+    { 0x39, 0x31, 0x33, }, // i = 0x44
+    { 0x3A, 0x32, 0x34, }, // i = 0x45
+    { 0x3B, 0x33, 0x35, }, // i = 0x46
+    { 0x3C, 0x34, 0x36, }, // i = 0x47
+    { 0x3D, 0x35, 0x36, }, // i = 0x48
+    { 0x3E, 0x36, 0x37, }, // i = 0x49
+    { 0x3F, 0x37, 0x38, }, // i = 0x4A
+    { 0x40, 0x38, 0x39, }, // i = 0x4B
+    { 0x41, 0x39, 0x3A, }, // i = 0x4C
+    { 0x42, 0x3A, 0x3B, }, // i = 0x4D
+    { 0x43, 0x3B, 0x3C, }, // i = 0x4E
+    { 0x44, 0x3C, 0x3D, }, // i = 0x4F
+    { 0x45, 0x3D, 0x3E, }, // i = 0x50
+    { 0x46, 0x3E, 0x3F, }, // i = 0x51
+    { 0x47, 0x3F, 0x40, }, // i = 0x52
+    { 0x49, 0x40, 0x41, }, // i = 0x53
+    { 0x4A, 0x41, 0x42, }, // i = 0x54
+    { 0x4B, 0x42, 0x42, }, // i = 0x55
+    { 0x4C, 0x43, 0x43, }, // i = 0x56
+    { 0x4D, 0x44, 0x44, }, // i = 0x57
+    { 0x4E, 0x45, 0x45, }, // i = 0x58
+    { 0x4F, 0x46, 0x46, }, // i = 0x59
+    { 0x50, 0x47, 0x47, }, // i = 0x5A
+    { 0x51, 0x48, 0x48, }, // i = 0x5B
+    { 0x52, 0x49, 0x49, }, // i = 0x5C
+    { 0x53, 0x4A, 0x4A, }, // i = 0x5D
+    { 0x54, 0x4B, 0x4B, }, // i = 0x5E
+    { 0x55, 0x4C, 0x4C, }, // i = 0x5F
+    { 0x56, 0x4D, 0x4D, }, // i = 0x60
+    { 0x57, 0x4E, 0x4E, }, // i = 0x61
+    { 0x58, 0x4F, 0x4F, }, // i = 0x62
+    { 0x5A, 0x50, 0x50, }, // i = 0x63
+    { 0x5B, 0x51, 0x51, }, // i = 0x64
+    { 0x5C, 0x52, 0x52, }, // i = 0x65
+    { 0x5D, 0x53, 0x53, }, // i = 0x66
+    { 0x5E, 0x54, 0x54, }, // i = 0x67
+    { 0x5F, 0x55, 0x54, }, // i = 0x68
+    { 0x60, 0x56, 0x55, }, // i = 0x69
+    { 0x61, 0x57, 0x56, }, // i = 0x6A
+    { 0x62, 0x58, 0x57, }, // i = 0x6B
+    { 0x63, 0x59, 0x58, }, // i = 0x6C
+    { 0x64, 0x5B, 0x59, }, // i = 0x6D
+    { 0x65, 0x5C, 0x5A, }, // i = 0x6E
+    { 0x66, 0x5D, 0x5B, }, // i = 0x6F
+    { 0x68, 0x5E, 0x5C, }, // i = 0x70
+    { 0x69, 0x5F, 0x5D, }, // i = 0x71
+    { 0x6A, 0x60, 0x5E, }, // i = 0x72
+    { 0x6B, 0x61, 0x5F, }, // i = 0x73
+    { 0x6C, 0x62, 0x60, }, // i = 0x74
+    { 0x6D, 0x63, 0x61, }, // i = 0x75
+    { 0x6E, 0x64, 0x62, }, // i = 0x76
+    { 0x6F, 0x65, 0x63, }, // i = 0x77
+    { 0x70, 0x66, 0x64, }, // i = 0x78
+    { 0x71, 0x67, 0x65, }, // i = 0x79
+    { 0x72, 0x68, 0x66, }, // i = 0x7A
+    { 0x73, 0x69, 0x67, }, // i = 0x7B
+    { 0x74, 0x6A, 0x68, }, // i = 0x7C
+    { 0x76, 0x6B, 0x69, }, // i = 0x7D
+    { 0x77, 0x6C, 0x6A, }, // i = 0x7E
+    { 0x78, 0x6D, 0x6B, }, // i = 0x7F
+    { 0x79, 0x6E, 0x6C, }, // i = 0x80
+    { 0x7A, 0x70, 0x6D, }, // i = 0x81
+    { 0x7B, 0x71, 0x6E, }, // i = 0x82
+    { 0x7C, 0x72, 0x6F, }, // i = 0x83
+    { 0x7D, 0x73, 0x70, }, // i = 0x84
+    { 0x7E, 0x74, 0x71, }, // i = 0x85
+    { 0x7F, 0x75, 0x72, }, // i = 0x86
+    { 0x80, 0x76, 0x73, }, // i = 0x87
+    { 0x82, 0x77, 0x74, }, // i = 0x88
+    { 0x83, 0x78, 0x75, }, // i = 0x89
+    { 0x84, 0x79, 0x76, }, // i = 0x8A
+    { 0x85, 0x7A, 0x77, }, // i = 0x8B
+    { 0x86, 0x7B, 0x78, }, // i = 0x8C
+    { 0x87, 0x7C, 0x79, }, // i = 0x8D
+    { 0x88, 0x7E, 0x7A, }, // i = 0x8E
+    { 0x89, 0x7F, 0x7B, }, // i = 0x8F
+    { 0x8A, 0x80, 0x7C, }, // i = 0x90
+    { 0x8B, 0x81, 0x7D, }, // i = 0x91
+    { 0x8C, 0x82, 0x7E, }, // i = 0x92
+    { 0x8D, 0x83, 0x7F, }, // i = 0x93
+    { 0x8F, 0x84, 0x80, }, // i = 0x94
+    { 0x90, 0x85, 0x81, }, // i = 0x95
+    { 0x91, 0x86, 0x82, }, // i = 0x96
+    { 0x92, 0x87, 0x84, }, // i = 0x97
+    { 0x93, 0x88, 0x85, }, // i = 0x98
+    { 0x94, 0x8A, 0x86, }, // i = 0x99
+    { 0x95, 0x8B, 0x87, }, // i = 0x9A
+    { 0x96, 0x8C, 0x88, }, // i = 0x9B
+    { 0x97, 0x8D, 0x89, }, // i = 0x9C
+    { 0x98, 0x8E, 0x8A, }, // i = 0x9D
+    { 0x99, 0x8F, 0x8B, }, // i = 0x9E
+    { 0x9B, 0x90, 0x8C, }, // i = 0x9F
+    { 0x9C, 0x91, 0x8D, }, // i = 0xA0
+    { 0x9D, 0x92, 0x8E, }, // i = 0xA1
+    { 0x9E, 0x94, 0x8F, }, // i = 0xA2
+    { 0x9F, 0x95, 0x90, }, // i = 0xA3
+    { 0xA0, 0x96, 0x91, }, // i = 0xA4
+    { 0xA1, 0x97, 0x92, }, // i = 0xA5
+    { 0xA2, 0x98, 0x93, }, // i = 0xA6
+    { 0xA3, 0x99, 0x94, }, // i = 0xA7
+    { 0xA4, 0x9A, 0x95, }, // i = 0xA8
+    { 0xA5, 0x9B, 0x97, }, // i = 0xA9
+    { 0xA7, 0x9C, 0x98, }, // i = 0xAA
+    { 0xA8, 0x9E, 0x99, }, // i = 0xAB
+    { 0xA9, 0x9F, 0x9A, }, // i = 0xAC
+    { 0xAA, 0xA0, 0x9B, }, // i = 0xAD
+    { 0xAB, 0xA1, 0x9C, }, // i = 0xAE
+    { 0xAC, 0xA2, 0x9D, }, // i = 0xAF
+    { 0xAD, 0xA3, 0x9E, }, // i = 0xB0
+    { 0xAE, 0xA4, 0x9F, }, // i = 0xB1
+    { 0xAF, 0xA5, 0xA0, }, // i = 0xB2
+    { 0xB0, 0xA7, 0xA1, }, // i = 0xB3
+    { 0xB1, 0xA8, 0xA3, }, // i = 0xB4
+    { 0xB3, 0xA9, 0xA4, }, // i = 0xB5
+    { 0xB4, 0xAA, 0xA5, }, // i = 0xB6
+    { 0xB5, 0xAB, 0xA6, }, // i = 0xB7
+    { 0xB6, 0xAC, 0xA7, }, // i = 0xB8
+    { 0xB7, 0xAD, 0xA8, }, // i = 0xB9
+    { 0xB8, 0xAF, 0xA9, }, // i = 0xBA
+    { 0xB9, 0xB0, 0xAA, }, // i = 0xBB
+    { 0xBA, 0xB1, 0xAB, }, // i = 0xBC
+    { 0xBB, 0xB2, 0xAD, }, // i = 0xBD
+    { 0xBC, 0xB3, 0xAE, }, // i = 0xBE
+    { 0xBD, 0xB4, 0xAF, }, // i = 0xBF
+    { 0xBE, 0xB5, 0xB0, }, // i = 0xC0
+    { 0xC0, 0xB7, 0xB1, }, // i = 0xC1
+    { 0xC1, 0xB8, 0xB2, }, // i = 0xC2
+    { 0xC2, 0xB9, 0xB3, }, // i = 0xC3
+    { 0xC3, 0xBA, 0xB5, }, // i = 0xC4
+    { 0xC4, 0xBB, 0xB6, }, // i = 0xC5
+    { 0xC5, 0xBC, 0xB7, }, // i = 0xC6
+    { 0xC6, 0xBE, 0xB8, }, // i = 0xC7
+    { 0xC7, 0xBF, 0xB9, }, // i = 0xC8
+    { 0xC8, 0xC0, 0xBA, }, // i = 0xC9
+    { 0xC9, 0xC1, 0xBB, }, // i = 0xCA
+    { 0xCA, 0xC2, 0xBD, }, // i = 0xCB
+    { 0xCC, 0xC3, 0xBE, }, // i = 0xCC
+    { 0xCD, 0xC4, 0xBF, }, // i = 0xCD
+    { 0xCE, 0xC6, 0xC0, }, // i = 0xCE
+    { 0xCF, 0xC7, 0xC1, }, // i = 0xCF
+    { 0xD0, 0xC8, 0xC2, }, // i = 0xD0
+    { 0xD1, 0xC9, 0xC4, }, // i = 0xD1
+    { 0xD2, 0xCA, 0xC5, }, // i = 0xD2
+    { 0xD3, 0xCB, 0xC6, }, // i = 0xD3
+    { 0xD4, 0xCD, 0xC7, }, // i = 0xD4
+    { 0xD5, 0xCE, 0xC8, }, // i = 0xD5
+    { 0xD6, 0xCF, 0xCA, }, // i = 0xD6
+    { 0xD7, 0xD0, 0xCB, }, // i = 0xD7
+    { 0xD8, 0xD1, 0xCC, }, // i = 0xD8
+    { 0xD9, 0xD2, 0xCD, }, // i = 0xD9
+    { 0xDB, 0xD4, 0xCE, }, // i = 0xDA
+    { 0xDC, 0xD5, 0xD0, }, // i = 0xDB
+    { 0xDD, 0xD6, 0xD1, }, // i = 0xDC
+    { 0xDE, 0xD7, 0xD2, }, // i = 0xDD
+    { 0xDF, 0xD8, 0xD3, }, // i = 0xDE
+    { 0xE0, 0xD9, 0xD5, }, // i = 0xDF
+    { 0xE1, 0xDB, 0xD6, }, // i = 0xE0
+    { 0xE2, 0xDC, 0xD7, }, // i = 0xE1
+    { 0xE3, 0xDD, 0xD8, }, // i = 0xE2
+    { 0xE4, 0xDE, 0xDA, }, // i = 0xE3
+    { 0xE5, 0xDF, 0xDB, }, // i = 0xE4
+    { 0xE6, 0xE0, 0xDC, }, // i = 0xE5
+    { 0xE7, 0xE2, 0xDD, }, // i = 0xE6
+    { 0xE8, 0xE3, 0xDF, }, // i = 0xE7
+    { 0xE9, 0xE4, 0xE0, }, // i = 0xE8
+    { 0xEA, 0xE5, 0xE1, }, // i = 0xE9
+    { 0xEB, 0xE6, 0xE3, }, // i = 0xEA
+    { 0xEC, 0xE8, 0xE4, }, // i = 0xEB
+    { 0xED, 0xE9, 0xE5, }, // i = 0xEC
+    { 0xEE, 0xEA, 0xE7, }, // i = 0xED
+    { 0xEF, 0xEB, 0xE8, }, // i = 0xEE
+    { 0xF0, 0xEC, 0xE9, }, // i = 0xEF
+    { 0xF1, 0xED, 0xEB, }, // i = 0xF0
+    { 0xF2, 0xEF, 0xEC, }, // i = 0xF1
+    { 0xF3, 0xF0, 0xED, }, // i = 0xF2
+    { 0xF4, 0xF1, 0xEF, }, // i = 0xF3
+    { 0xF5, 0xF2, 0xF0, }, // i = 0xF4
+    { 0xF6, 0xF3, 0xF1, }, // i = 0xF5
+    { 0xF7, 0xF5, 0xF3, }, // i = 0xF6
+    { 0xF8, 0xF6, 0xF4, }, // i = 0xF7
+    { 0xF9, 0xF7, 0xF6, }, // i = 0xF8
+    { 0xFA, 0xF8, 0xF7, }, // i = 0xF9
+    { 0xFB, 0xFA, 0xF8, }, // i = 0xFA
+    { 0xFC, 0xFB, 0xFA, }, // i = 0xFB
+    { 0xFD, 0xFC, 0xFB, }, // i = 0xFC
+    { 0xFE, 0xFD, 0xFD, }, // i = 0xFD
+    { 0xFE, 0xFE, 0xFE, }, // i = 0xFE
+    { 0xFF, 0xFF, 0xFF, }, // i = 0xFF
+};

sysmodules/rosalina/include/menus/sysconfig.h

@@ -31,6 +31,7 @@
 
 extern Menu sysconfigMenu;
 extern bool isConnectionForced;
+extern s8 currVolumeSliderOverride;
 
 void SysConfigMenu_UpdateStatus(bool control);
 
@@ -40,3 +41,6 @@ void SysConfigMenu_TogglePowerButton(void);
 void SysConfigMenu_ControlWifi(void);
 void SysConfigMenu_DisableForcedWifiConnection(void);
 void SysConfigMenu_ToggleCardIfPower(void);
+void SysConfigMenu_LoadConfig(void);
+void SysConfigMenu_AdjustVolume(void);
+void SysConfigMenu_ChangeScreenBrightness(void);

sysmodules/rosalina/include/plugin/3gx.h

@@ -4,7 +4,7 @@
 
 #define _3GX_MAGIC (0x3230303024584733) /* "3GX$0002" */
 
-typedef struct PACKED
+typedef struct CTR_PACKED
 {
     u32             authorLen;
     const char*     authorMsg;
@@ -20,7 +20,12 @@ typedef struct PACKED
             u32     embeddedExeLoadFunc : 1;
             u32     embeddedSwapSaveLoadFunc : 1;
             u32     memoryRegionSize : 2;
-            u32     unused : 28;
+            u32     compatibility : 2;
+            u32     eventsSelfManaged : 1;
+            u32     swapNotNeeded : 1;
+            u32     usePrivateMemory : 1;
+            u32     allowHomebrewLoad : 1;
+            u32     unused : 22;
         };
     };
     u32             exeLoadChecksum;
@@ -28,20 +33,20 @@ typedef struct PACKED
     u32             builtInSwapSaveLoadArgs[4];
 } _3gx_Infos;
 
-typedef struct PACKED
+typedef struct CTR_PACKED
 {
     u32             count;
     u32           * titles;
 }   _3gx_Targets;
 
-typedef struct PACKED
+typedef struct CTR_PACKED
 {
     u32             nbSymbols;
     u32             symbolsOffset;
     u32             nameTableOffset;
 }   _3gx_Symtable;
 
-typedef struct PACKED
+typedef struct CTR_PACKED
 {
     u32             codeOffset;
     u32             rodataOffset;
@@ -55,7 +60,7 @@ typedef struct PACKED
     u32             swapLoadFuncOffset; // NOP terminated
 } _3gx_Executable;
 
-typedef struct PACKED
+typedef struct CTR_PACKED
 {
     u64             magic;
     u32             version;
@@ -67,6 +72,12 @@ typedef struct PACKED
 } _3gx_Header;
 
 
+enum _3gx_Compatibility {
+    PLG_COMPAT_CONSOLE = 0,
+    PLG_COMPAT_EMULATOR = 1,
+    PLG_COMPAT_CONSOLE_EMULATOR = 2,
+};
+
 Result  Check_3gx_Magic(IFile *file);
 Result  Read_3gx_Header(IFile *file, _3gx_Header *header);
 Result  Read_3gx_ParseHeader(IFile *file, _3gx_Header *header);

sysmodules/rosalina/include/plugin/plgldr.h

@@ -11,6 +11,7 @@ typedef struct
 {
     bool    noFlash;
     u8      pluginMemoryStrategy;
+    u8      persistent;
     u32     lowTitleId;
     char    path[256];
     u32     config[32];
@@ -55,10 +56,12 @@ typedef struct
     s32*            plgldrEvent; ///< Used for synchronization
     s32*            plgldrReply; ///< Used for synchronization
     u8              notifyHomeEvent;
-    u8              padding[3];
-    u32             reserved[23];
+    u8              padding[7];
+    u64             waitForReplyTimeout;
+    u32             reserved[20];
     u32             config[32];
-}   PluginHeader;
+} PluginHeader;
+_Static_assert(sizeof(PluginHeader) == 0x100, "Invalid PluginHeader size");
 
 typedef void (*OnPlgLdrEventCb_t)(s32 eventType);
 

sysmodules/rosalina/include/plugin/plgloader.h

@@ -34,7 +34,7 @@ u32         saveSwapFunc(void* startAddr, void* endAddr, void* args);
 u32         loadSwapFunc(void* startAddr, void* endAddr, void* args);
 u32		    loadExeFunc(void* startAddr, void* endAddr, void* args);
 
-bool     TryToLoadPlugin(Handle process);
+bool     TryToLoadPlugin(Handle process, bool isHomebrew);
 void    PLG__NotifyEvent(PLG_Event event, bool signal);
 void     PLG__SetConfigMemoryStatus(u32 status);
 u32      PLG__GetConfigMemoryStatus(void);
@@ -91,6 +91,9 @@ typedef struct
     u8              pluginMemoryStrategy;
     u32             exeLoadChecksum;
     u32             swapLoadChecksum;    
+
+    bool            eventsSelfManaged;
+    bool            isMemPrivate;
 }   PluginLoaderContext;
 
 extern PluginLoaderContext PluginLoaderCtx;

sysmodules/rosalina/include/utils.h

@@ -30,6 +30,7 @@
 #include <3ds/srv.h>
 #include <3ds/result.h>
 #include <3ds/ipc.h>
+#include <assert.h>
 #include "csvc.h"
 #include "luma_shared_config.h"
 

sysmodules/rosalina/source/bootdiag.c

@@ -33,7 +33,7 @@
 #ifdef  BOOTDIAG_ENABLED
 
 static MyThread bootdiagThread;
-static u8 ALIGN(0x1000) bootdiagThreadStack[0x1000];
+static u8 CTR_ALIGN(0x1000) bootdiagThreadStack[0x1000];
 
 #define BOOTDIAG_WAIT_TIME      (3500 * 1000 * 1000u) // 2 seconds
 #define BOOTDIAG_DUMP_PLIST     1

sysmodules/rosalina/source/csvc.s

@@ -59,10 +59,13 @@ SVC_BEGIN svcInvalidateEntireInstructionCache
 SVC_END
 
 SVC_BEGIN svcMapProcessMemoryEx
-    str r4, [sp, #-4]!
-    ldr r4, [sp, #4]
+    push {r4, r5, r6}
+    ldr r4, [sp, #12]
+    ldr r5, [sp, #16]
+    mov r6, r0 @ Move the dst handle to r6 to make room for magic value
+    mov r0, #0xFFFFFFF2 @ Set r0 to magic value, which allows for backwards compatibility
     svc 0xA0
-    ldr r4, [sp], #4
+    pop {r4, r5, r6}
     bx lr
 SVC_END
 

sysmodules/rosalina/source/draw.c

@@ -140,7 +140,7 @@ Result Draw_AllocateFramebufferCache(u32 size)
     if (framebufferCache != NULL)
         __builtin_trap();
 
-    Result res = svcControlMemoryEx(&tmp, addr, 0, size, MEMOP_ALLOC, MEMREGION_SYSTEM | MEMPERM_READWRITE, true);
+    Result res = svcControlMemoryEx(&tmp, addr, 0, size, MEMOP_ALLOC | MEMOP_REGION_SYSTEM, MEMPERM_READWRITE, true);
     if (R_FAILED(res))
     {
         framebufferCache = NULL;
@@ -203,7 +203,7 @@ u32 Draw_SetupFramebuffer(void)
     GPU_FB_BOTTOM_ADDR_1 = GPU_FB_BOTTOM_ADDR_2 = FB_BOTTOM_VRAM_PA;
     GPU_FB_BOTTOM_FMT = format;
     GPU_FB_BOTTOM_STRIDE = 240 * 2;
-    
+
     gpuSavedFillColor = LCD_BOT_FILLCOLOR;
     LCD_BOT_FILLCOLOR = 0;
 
@@ -214,7 +214,7 @@ void Draw_RestoreFramebuffer(void)
 {
     memcpy(FB_BOTTOM_VRAM_ADDR, framebufferCache, FB_BOTTOM_SIZE);
     Draw_FlushFramebuffer();
-    
+
     LCD_BOT_FILLCOLOR = gpuSavedFillColor;
     GPU_FB_BOTTOM_ADDR_1 = gpuSavedFramebufferAddr1;
     GPU_FB_BOTTOM_ADDR_2 = gpuSavedFramebufferAddr2;
@@ -268,14 +268,18 @@ static inline void Draw_WriteUnaligned(u8 *dst, u32 tmp, u32 size)
 void Draw_CreateBitmapHeader(u8 *dst, u32 width, u32 heigth)
 {
     static const u8 bmpHeaderTemplate[54] = {
-        0x42, 0x4D, 0xCC, 0xCC, 0xCC, 0xCC, 0x00, 0x00, 0x00, 0x00, 0x36, 0x00, 0x00, 0x00, 0x28, 0x00,
-        0x00, 0x00, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0x01, 0x00, 0x18, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0xCC, 0xCC, 0xCC, 0xCC, 0x12, 0x0B, 0x00, 0x00, 0x12, 0x0B, 0x00, 0x00, 0x00, 0x00,
+        // BITMAPFILEHEADER
+        0x42, 0x4D, 0xCC, 0xCC, 0xCC, 0xCC, 0x00, 0x00, 0x00, 0x00, 0x40 /* data offset */, 0x00, 0x00, 0x00,
+
+        // BITMAPINFOHEADER
+        0x28, 0x00, 0x00, 0x00, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0x01, 0x00, 0x18, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0xCC, 0xCC, 0xCC, 0xCC, 0x12, 0x0B, 0x00, 0x00, 0x12, 0x0B, 0x00, 0x00, 0x00, 0x00,
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00
     };
 
     memcpy(dst, bmpHeaderTemplate, 54);
-    Draw_WriteUnaligned(dst + 2, 54 + 3 * width * heigth, 4);
+    memset(dst + 54, 0, 64 - 54);
+    Draw_WriteUnaligned(dst + 2, 64 + 3 * width * heigth, 4);
     Draw_WriteUnaligned(dst + 0x12, width, 4);
     Draw_WriteUnaligned(dst + 0x16, heigth, 4);
     Draw_WriteUnaligned(dst + 0x22, 3 * width * heigth, 4);
@@ -350,6 +354,7 @@ typedef struct FrameBufferConvertArgs {
     u32 width;
     u8 startingLine;
     u8 numLines;
+    u8 scaleFactorY;
     bool top;
     bool left;
 } FrameBufferConvertArgs;
@@ -367,16 +372,19 @@ static void Draw_ConvertFrameBufferLinesKernel(const FrameBufferConvertArgs *arg
 
     for (u32 y = args->startingLine; y < args->startingLine + args->numLines; y++)
     {
-        for(u32 x = 0; x < width; x++)
+        for (u8 i = 0; i < args->scaleFactorY; i++)
         {
-            __builtin_prefetch(addr + x * stride + y * formatSizes[fmt], 0, 3);
-            Draw_ConvertPixelToBGR8(args->buf + (x + width * y) * 3 , addr + x * stride + y * formatSizes[fmt], fmt);
+            for(u32 x = 0; x < width; x++)
+            {
+                __builtin_prefetch(addr + x * stride + y * formatSizes[fmt], 0, 3);
+                Draw_ConvertPixelToBGR8(args->buf + (x + width * (args->scaleFactorY * y + i)) * 3 , addr + x * stride + y * formatSizes[fmt], fmt);
+            }
         }
     }
 }
 
-void Draw_ConvertFrameBufferLines(u8 *buf, u32 width, u32 startingLine, u32 numLines, bool top, bool left)
+void Draw_ConvertFrameBufferLines(u8 *buf, u32 width, u32 startingLine, u32 numLines, u32 scaleFactorY, bool top, bool left)
 {
-    FrameBufferConvertArgs args = { buf, width, (u8)startingLine, (u8)numLines, top, left };
+    FrameBufferConvertArgs args = { buf, width, (u8)startingLine, (u8)numLines, (u8)scaleFactorY, top, left };
     svcCustomBackdoor(Draw_ConvertFrameBufferLinesKernel, &args);
 }

sysmodules/rosalina/source/errdisp.c

@@ -35,7 +35,7 @@
 extern Handle preTerminationEvent;
 
 static MyThread errDispThread;
-static u8 ALIGN(8) errDispThreadStack[0xD00];
+static u8 CTR_ALIGN(8) errDispThreadStack[0xD00];
 
 static char userString[0x100 + 1] = {0};
 static char staticBuf[sizeof(userString)] = {0};

sysmodules/rosalina/source/gdb.c

@@ -28,6 +28,10 @@ void GDB_InitializeContext(GDBContext *ctx)
     ctx->eventToWaitFor = ctx->processAttachedEvent;
     ctx->continueFlags = (DebugFlags)(DBG_SIGNAL_FAULT_EXCEPTION_EVENTS | DBG_INHIBIT_USER_CPU_EXCEPTION_HANDLERS);
 
+#ifdef DEBUG_GDB_COMMUNICATIONS
+    IFile_Open(&ctx->debugFile, ARCHIVE_SDMC, fsMakePath(PATH_EMPTY, ""), fsMakePath(PATH_ASCII, "/luma/gdb_debug.txt"), FS_OPEN_READ | FS_OPEN_WRITE | FS_OPEN_CREATE);
+#endif
+
     RecursiveLock_Unlock(&ctx->lock);
 }
 
@@ -40,6 +44,10 @@ void GDB_FinalizeContext(GDBContext *ctx)
     svcCloseHandle(ctx->processAttachedEvent);
     svcCloseHandle(ctx->continuedEvent);
 
+#ifdef DEBUG_GDB_COMMUNICATIONS
+    IFile_Close(&ctx->debugFile);
+#endif
+
     RecursiveLock_Unlock(&ctx->lock);
 }
 

sysmodules/rosalina/source/gdb/net.c

@@ -171,6 +171,17 @@ const char *GDB_ParseHexIntegerList64(u64 *dst, const char *src, u32 nb, char la
     return GDB_ParseIntegerList64(dst, src, nb, ',', lastSep, 16, false);
 }
 
+#ifdef DEBUG_GDB_COMMUNICATIONS
+void GDB_LogPacket(GDBContext *ctx, void* buffer, u32 pLen, bool incoming)
+{
+    u64 written;
+    IFile_Write(&ctx->debugFile, &written, incoming ? "<-\t" : "->\t", 3, 0);
+    IFile_Write(&ctx->debugFile, &written, buffer, pLen, 0);
+    IFile_Write(&ctx->debugFile, &written, "\n", 1, 0);
+    IFile_Flush(&ctx->debugFile);
+}
+#endif
+
 int GDB_ReceivePacket(GDBContext *ctx)
 {
     char backupbuf[GDB_BUF_LEN + 4];
@@ -189,6 +200,9 @@ int GDB_ReceivePacket(GDBContext *ctx)
         r = socRecv(ctx->super.sockfd, ctx->buffer, 1, 0);
         if(r != 1)
             return -1;
+#ifdef DEBUG_GDB_COMMUNICATIONS
+        GDB_LogPacket(ctx, ctx->buffer, r, true);
+#endif
 
         ctx->buffer[0] = 0;
 
@@ -197,9 +211,19 @@ int GDB_ReceivePacket(GDBContext *ctx)
         if(r == -1)
             goto packet_error;
     }
-    else if(ctx->buffer[0] == '-')
+
+#ifdef DEBUG_GDB_COMMUNICATIONS
+        GDB_LogPacket(ctx, ctx->buffer, r, true);
+#endif
+
+    if(ctx->buffer[0] == '-')
     {
         socSend(ctx->super.sockfd, backupbuf, ctx->latestSentPacketSize, 0);
+
+#ifdef DEBUG_GDB_COMMUNICATIONS
+        GDB_LogPacket(ctx, backupbuf, ctx->latestSentPacketSize, false);
+#endif
+
         return 0;
     }
     int maxlen = r > (int)sizeof(ctx->buffer) ? (int)sizeof(ctx->buffer) : r;
@@ -239,6 +263,9 @@ int GDB_ReceivePacket(GDBContext *ctx)
         int r2 = socSend(ctx->super.sockfd, "+", 1, 0);
         if(r2 != 1)
             return -1;
+#ifdef DEBUG_GDB_COMMUNICATIONS
+        GDB_LogPacket(ctx, "+", 1, false);
+#endif
     }
 
     if(ctx->noAckSent)
@@ -255,8 +282,12 @@ packet_error:
         r = socSend(ctx->super.sockfd, "-", 1, 0);
         if(r != 1)
             return -1;
-        else
+        else {
+#ifdef DEBUG_GDB_COMMUNICATIONS
+            GDB_LogPacket(ctx, "-", 1, false);
+#endif
             return 0;
+        }
     }
     else
         return -1;
@@ -265,6 +296,9 @@ packet_error:
 static int GDB_DoSendPacket(GDBContext *ctx, u32 len)
 {
     int r = socSend(ctx->super.sockfd, ctx->buffer, len, 0);
+#ifdef DEBUG_GDB_COMMUNICATIONS
+    GDB_LogPacket(ctx, ctx->buffer, len, false);
+#endif
 
     if(r > 0)
         ctx->latestSentPacketSize = r;

sysmodules/rosalina/source/gdb/tio.c

@@ -85,7 +85,7 @@
 typedef u32 gdbhio_time_t;
 typedef int gdbhio_mode_t;
 
-struct PACKED ALIGN(4) gdbhio_stat {
+struct CTR_PACKED CTR_ALIGN(4) gdbhio_stat {
     u32  gst_dev;               /* device */
     u32  gst_ino;               /* inode */
     gdbhio_mode_t gst_mode;     /* protection */

sysmodules/rosalina/source/ifile.c

@@ -49,7 +49,9 @@ Result IFile_OpenFromArchive(IFile *file, FS_Archive archive, FS_Path filePath,
 
 Result IFile_Close(IFile *file)
 {
-  return FSFILE_Close(file->handle);
+  Result res = file->handle != 0 ? FSFILE_Close(file->handle) : 0;
+  file->handle = 0;
+  return res;
 }
 
 Result IFile_GetSize(IFile *file, u64 *size)
@@ -147,3 +149,8 @@ Result IFile_Write(IFile *file, u64 *total, const void *buffer, u32 len, u32 fla
   *total = cur;
   return res;
 }
+
+Result IFile_Flush(IFile *file)
+{
+  return FSFILE_Flush(file->handle);
+}

sysmodules/rosalina/source/input_redirection.c

@@ -39,7 +39,7 @@ bool inputRedirectionEnabled = false;
 Handle inputRedirectionThreadStartedEvent;
 
 static MyThread inputRedirectionThread;
-static u8 ALIGN(8) inputRedirectionThreadStack[0x4000];
+static u8 CTR_ALIGN(8) inputRedirectionThreadStack[0x4000];
 
 MyThread *inputRedirectionCreateThread(void)
 {
@@ -223,7 +223,7 @@ static Result InputRedirection_DoUndoIrPatches(Handle processHandle, bool doPatc
     totalSize = (u32)(textTotalRoundedSize + rodataTotalRoundedSize + dataTotalRoundedSize);
 
     svcGetProcessInfo(&startAddress, processHandle, 0x10005);
-    res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, 0x00100000, processHandle, (u32) startAddress, totalSize);
+    res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, 0x00100000, processHandle, (u32) startAddress, totalSize, 0);
 
     if(R_SUCCEEDED(res) && !patchPrepared)
     {
@@ -356,7 +356,7 @@ static Result InputRedirection_DoUndoHidPatches(Handle processHandle, bool doPat
     totalSize = (u32)(textTotalRoundedSize + rodataTotalRoundedSize + dataTotalRoundedSize);
 
     svcGetProcessInfo(&startAddress, processHandle, 0x10005);
-    res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, 0x00100000, processHandle, (u32) startAddress, totalSize);
+    res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, 0x00100000, processHandle, (u32) startAddress, totalSize, 0);
 
     if (R_SUCCEEDED(res) && !patchPrepared)
     {

sysmodules/rosalina/source/luma_config.c

@@ -32,6 +32,7 @@
 #include "config_template_ini.h"
 #include "ifile.h"
 #include "menus/miscellaneous.h"
+#include "menus/sysconfig.h"
 #include "plugin/plgloader.h"
 
 typedef struct CfgData {
@@ -39,6 +40,7 @@ typedef struct CfgData {
 
     u32 config, multiConfig, bootConfig;
     u32 splashDurationMsec;
+    s8 volumeSliderOverride;
 
     u64 hbldr3dsxTitleId;
     u32 rosalinaMenuCombo;
@@ -168,7 +170,6 @@ static size_t LumaConfig_SaveLumaIniConfigToStr(char *out, const CfgData *cfg)
         (int)CONFIG(AUTOBOOTEMU), (int)CONFIG(LOADEXTFIRMSANDMODULES),
         (int)CONFIG(PATCHGAMES), (int)CONFIG(REDIRECTAPPTHREADS),
         (int)CONFIG(PATCHVERSTRING), (int)CONFIG(SHOWGBABOOT),
-        (int)CONFIG(ENABLEDSIEXTFILTER), (int)CONFIG(ALLOWUPDOWNLEFTRIGHTDSI),
 
         1 + (int)MULTICONFIG(DEFAULTEMU), 4 - (int)MULTICONFIG(BRIGHTNESS),
         splashPosStr, (unsigned int)cfg->splashDurationMsec,
@@ -179,6 +180,7 @@ static size_t LumaConfig_SaveLumaIniConfigToStr(char *out, const CfgData *cfg)
         (int)cfg->ntpTzOffetMinutes,
 
         (int)cfg->topScreenFilter.cct, (int)cfg->bottomScreenFilter.cct,
+        (int)cfg->topScreenFilter.colorCurveCorrection, (int)cfg->bottomScreenFilter.colorCurveCorrection,
         topScreenFilterGammaStr, bottomScreenFilterGammaStr,
         topScreenFilterContrastStr, bottomScreenFilterContrastStr,
         topScreenFilterBrightnessStr, bottomScreenFilterBrightnessStr,
@@ -187,9 +189,10 @@ static size_t LumaConfig_SaveLumaIniConfigToStr(char *out, const CfgData *cfg)
         cfg->autobootTwlTitleId, (int)cfg->autobootCtrAppmemtype,
 
         forceAudioOutputStr,
+        cfg->volumeSliderOverride,
 
-        (int)CONFIG(PATCHUNITINFO), (int)CONFIG(DISABLEARM11EXCHANDLERS),
-        (int)CONFIG(ENABLESAFEFIRMROSALINA)
+        (int)CONFIG(PATCHUNITINFO), (int)CONFIG(ENABLEDSIEXTFILTER),
+        (int)CONFIG(DISABLEARM11EXCHANDLERS), (int)CONFIG(ENABLESAFEFIRMROSALINA)
     );
 
     return n < 0 ? 0 : (size_t)n;
@@ -201,7 +204,7 @@ void LumaConfig_RequestSaveSettings(void) {
 
 Result LumaConfig_SaveSettings(void)
 {
-    char inibuf[0x2000];
+    char inibuf[0x2000 + 0x400]; // eyeballed. TODO use #embed
 
     Result res;
 
@@ -245,6 +248,7 @@ Result LumaConfig_SaveSettings(void)
     configData.multiConfig = multiConfig;
     configData.bootConfig = bootConfig;
     configData.splashDurationMsec = splashDurationMsec;
+    configData.volumeSliderOverride = currVolumeSliderOverride;
     configData.hbldr3dsxTitleId = Luma_SharedConfig->selected_hbldr_3dsx_tid;
     configData.rosalinaMenuCombo = menuCombo;
     configData.pluginLoaderFlags = PluginLoader__IsEnabled();
@@ -255,6 +259,12 @@ Result LumaConfig_SaveSettings(void)
     configData.autobootCtrAppmemtype = autobootCtrAppmemtype;
 
     size_t n = LumaConfig_SaveLumaIniConfigToStr(inibuf, &configData);
+
+    // FIXME: this is UB we should port snprintf sometime (as well as fix other tech debt in Rosalina)
+    if (n + 1 >= sizeof(inibuf)) {
+        __builtin_trap();
+    }
+
     FS_ArchiveID archiveId = isSdMode ? ARCHIVE_SDMC : ARCHIVE_NAND_RW;
     if (n > 0)
         res = IFile_Open(&file, archiveId, fsMakePath(PATH_EMPTY, ""), fsMakePath(PATH_ASCII, "/luma/config.ini"), FS_OPEN_CREATE | FS_OPEN_WRITE);

sysmodules/rosalina/source/luminance.c

@@ -104,8 +104,13 @@ u32 getMinLuminancePreset(void)
 
 u32 getMaxLuminancePreset(void)
 {
+    // Unlike SetLuminanceLevel, SetLuminance doesn't
+    // check if preset <= 5, and actually allows the lumiance
+    // levels provisioned for the "brightness boost mode" (brighter
+    // when adapter is plugged in), even when the feature is disabled
+    // (it is disabled for anything but the OG model, iirc)
     readCalibration();
-    return s_blPwmData.luminanceLevels[s_blPwmData.numLevels - 1];
+    return s_blPwmData.luminanceLevels[6];
 }
 
 u32 getCurrentLuminance(bool top)
@@ -114,7 +119,8 @@ u32 getCurrentLuminance(bool top)
 
     readCalibration();
 
-    const float *coeffs = s_blPwmData.coeffs[top ? (isN3DS ? 2 : 1) : 0];
+    bool is3d = (REG32(0x10202000 + 0x000) & 1) != 0;
+    const float *coeffs = s_blPwmData.coeffs[top ? (is3d ? 2 : 1) : 0];
     u32 brightness = REG32(regbase + 0x40);
     float ratio = getPwmRatio(s_blPwmData.brightnessMax, REG32(regbase + 0x44));
 

sysmodules/rosalina/source/main.c

@@ -166,7 +166,7 @@ static void handleShellNotification(u32 notificationId)
 {
     // Quick dirty fix
     Sleep__HandleNotification(notificationId);
-    
+
     if (notificationId == 0x213) {
         // Shell opened
         // Note that this notification is also fired on system init.
@@ -205,6 +205,8 @@ static void handlePreTermNotification(u32 notificationId)
     Draw_Lock();
     if (isHidInitialized)
         hidExit();
+    if (isQtmInitialized)
+        svcCloseHandle(*qtmGetSessionHandle()); // qtmExit();
 
     // Termination request
     menuShouldExit = true;
@@ -262,6 +264,7 @@ int main(void)
     Draw_Init();
     Cheat_SeedRng(svcGetSystemTick());
     ScreenFiltersMenu_LoadConfig();
+    SysConfigMenu_LoadConfig();
 
     MyThread *menuThread = menuCreateThread();
     MyThread *taskRunnerThread = taskRunnerCreateThread();

sysmodules/rosalina/source/menu.c

@@ -40,9 +40,18 @@
 #include "menus/screen_filters.h"
 #include "shell.h"
 
+//#define ROSALINA_MENU_SELF_SCREENSHOT 1 // uncomment this to enable the feature
+
 u32 menuCombo = 0;
 bool isHidInitialized = false;
+bool isQtmInitialized = false;
 u32 mcuFwVersion = 0;
+u8 mcuInfoTable[10] = {0};
+bool mcuInfoTableRead = false;
+
+const char *topScreenType = NULL;
+const char *bottomScreenType = NULL;
+bool areScreenTypesInitialized = false;
 
 // libctru redefinition:
 
@@ -54,10 +63,22 @@ bool hidShouldUseIrrst(void)
 
 static inline u32 convertHidKeys(u32 keys)
 {
-    // Nothing to do yet
+    // No actual conversion done
     return keys;
 }
 
+void scanInputHook(void)
+{
+    hidScanInput();
+
+#ifdef ROSALINA_MENU_SELF_SCREENSHOT
+    // Ugly hack but should work. For self-documentation w/o capture card purposes only.
+    u32 selfScreenshotCombo = KEY_L | KEY_DUP | KEY_SELECT;
+    if ((hidKeysHeld() & selfScreenshotCombo) == selfScreenshotCombo && (hidKeysDown() & selfScreenshotCombo) != 0)
+        menuTakeSelfScreenshot();
+#endif
+}
+
 u32 waitInputWithTimeout(s32 msec)
 {
     s32 n = 0;
@@ -75,7 +96,7 @@ u32 waitInputWithTimeout(s32 msec)
         }
         n++;
 
-        hidScanInput();
+        scanInputHook();
         keys = convertHidKeys(hidKeysDown()) | (convertHidKeys(hidKeysDownRepeat()) & DIRECTIONAL_KEYS);
         Draw_Unlock();
     } while (keys == 0 && !menuShouldExit && isHidInitialized && (msec < 0 || n < msec));
@@ -101,7 +122,7 @@ u32 waitInputWithTimeoutEx(u32 *outHeldKeys, s32 msec)
         }
         n++;
 
-        hidScanInput();
+        scanInputHook();
         keys = convertHidKeys(hidKeysDown()) | (convertHidKeys(hidKeysDownRepeat()) & DIRECTIONAL_KEYS);
         *outHeldKeys = convertHidKeys(hidKeysHeld());
         Draw_Unlock();
@@ -126,7 +147,7 @@ static u32 scanHeldKeys(void)
         keys = 0;
     else
     {
-        hidScanInput();
+        scanInputHook();
         keys = convertHidKeys(hidKeysHeld());
     }
 
@@ -174,7 +195,7 @@ u32 waitCombo(void)
 }
 
 static MyThread menuThread;
-static u8 ALIGN(8) menuThreadStack[0x3000];
+static u8 CTR_ALIGN(8) menuThreadStack[0x3000];
 
 static float batteryPercentage;
 static float batteryVoltage;
@@ -226,10 +247,75 @@ static Result menuUpdateMcuInfo(void)
         mcuFwVersion = SYSTEM_VERSION(major - 0x10, minor, 0);
     }
 
+    if (!mcuInfoTableRead)
+        mcuInfoTableRead = R_SUCCEEDED(MCUHWC_ReadRegister(0x7F, mcuInfoTable, sizeof(mcuInfoTable)));
+
     svcCloseHandle(*mcuHwcHandlePtr);
     return res;
 }
 
+static const char *menuGetScreenTypeStr(u8 vendorId)
+{
+    switch (vendorId)
+    {
+        case 1:  return "IPS"; // SHARP
+        case 12: return "TN";  // JDN
+        default: return "unknown";
+    }
+}
+
+static void menuReadScreenTypes(void)
+{
+    if (areScreenTypesInitialized)
+        return;
+
+    if (!isN3DS)
+    {
+        // Old3DS never have IPS screens and GetVendors is not implemented
+        topScreenType = "TN";
+        bottomScreenType = "TN";
+        areScreenTypesInitialized = true;
+    }
+    else
+    {
+        srvSetBlockingPolicy(false);
+
+        Result res = gspLcdInit();
+        if (R_SUCCEEDED(res))
+        {
+            u8 vendors = 0;
+            if (R_SUCCEEDED(GSPLCD_GetVendors(&vendors)))
+            {
+                topScreenType = menuGetScreenTypeStr(vendors >> 4);
+                bottomScreenType = menuGetScreenTypeStr(vendors & 0xF);
+                areScreenTypesInitialized = true;
+            }
+
+            gspLcdExit();
+        }
+
+        srvSetBlockingPolicy(true);
+    }
+}
+
+static void menuInitializeQtm(void)
+{
+    if (isQtmInitialized)
+        return;
+
+    // Steal QTM handle from GSP, because there is a limit of 3 sessions (or 2 before 9.3) for ALL qtm services
+    Handle qtmHandle = 0;
+    for (int i = 0; i < 30 && !qtmIsInitialized(); i++)
+    {
+        if (R_SUCCEEDED(svcControlService(SERVICEOP_STEAL_CLIENT_SESSION, &qtmHandle, "qtm:sp")))
+            *qtmGetSessionHandle() = qtmHandle;
+        else
+            svcSleepThread(100 * 100 * 1000LL);
+    }
+
+    isQtmInitialized = qtmIsInitialized();
+}
+
 static inline u32 menuAdvanceCursor(u32 pos, u32 numItems, s32 displ)
 {
     return (pos + numItems + displ) % numItems;
@@ -264,17 +350,24 @@ u32 g_blockMenuOpen = 0;
 
 void menuThreadMain(void)
 {
-    if(isN3DS)
-        N3DSMenu_UpdateStatus();
-
-    while (!isServiceUsable("ac:u") || !isServiceUsable("hid:USER") || !isServiceUsable("gsp::Gpu") || !isServiceUsable("cdc:CHK"))
+    while (!isServiceUsable("ac:u") || !isServiceUsable("hid:USER") || !isServiceUsable("gsp::Gpu") || !isServiceUsable("gsp::Lcd") || !isServiceUsable("cdc:CHK"))
         svcSleepThread(250 * 1000 * 1000LL);
 
+    if (isN3DS)
+    {
+        while (!isServiceUsable("qtm:u"))
+            svcSleepThread(250 * 1000 * 1000LL);
+        menuInitializeQtm();
+        N3DSMenu_UpdateStatus();
+    }
+
     handleShellOpened();
 
     hidInit(); // assume this doesn't fail
     isHidInitialized = true;
 
+    menuReadScreenTypes();
+
     while(!preTerminationRequested)
     {
         svcSleepThread(50 * 1000 * 1000LL);
@@ -283,7 +376,9 @@ void menuThreadMain(void)
 
         Cheat_ApplyCheats();
 
-        if(((scanHeldKeys() & menuCombo) == menuCombo) && !g_blockMenuOpen)
+        u32 kHeld = scanHeldKeys();
+
+        if(((kHeld & menuCombo) == menuCombo) && !g_blockMenuOpen)
         {
             menuEnter();
             if(isN3DS) N3DSMenu_UpdateStatus();
@@ -380,6 +475,7 @@ static void menuDraw(Menu *menu, u32 selected)
         int n = sprintf(ipBuffer, "%hhu.%hhu.%hhu.%hhu", addr[0], addr[1], addr[2], addr[3]);
         Draw_DrawString(SCREEN_BOT_WIDTH - 10 - SPACING_X * n, 10, COLOR_WHITE, ipBuffer);
     }
+
     else
         Draw_DrawFormattedString(SCREEN_BOT_WIDTH - 10 - SPACING_X * 15, 10, COLOR_WHITE, "%15s", "");
 
@@ -489,17 +585,12 @@ void menuShow(Menu *root)
             else
                 break;
         }
-        else if(pressed & KEY_DOWN)
+        else if(pressed & (KEY_DOWN | KEY_UP))
         {
-            selectedItem = menuAdvanceCursor(selectedItem, numItems, 1);
-            if (menuItemIsHidden(&currentMenu->items[selectedItem]))
-                selectedItem = menuAdvanceCursor(selectedItem, numItems, 1);
-        }
-        else if(pressed & KEY_UP)
-        {
-            selectedItem = menuAdvanceCursor(selectedItem, numItems, -1);
-            if (menuItemIsHidden(&currentMenu->items[selectedItem]))
-                selectedItem = menuAdvanceCursor(selectedItem, numItems, -1);
+            s32 n = (pressed & KEY_DOWN) != 0 ? 1 : -1;
+            do {
+                selectedItem = menuAdvanceCursor(selectedItem, numItems, n);
+            } while (menuItemIsHidden(&currentMenu->items[selectedItem])); // assume at least one item is visible
         }
 
         Draw_Lock();

sysmodules/rosalina/source/menus.c

@@ -40,25 +40,24 @@
 #include "memory.h"
 #include "fmt.h"
 #include "process_patches.h"
-#include "luminance.h"
 #include "luma_config.h"
 
 Menu rosalinaMenu = {
     "Rosalina menu",
     {
         { "Take screenshot", METHOD, .method = &RosalinaMenu_TakeScreenshot },
-        { "Change screen brightness", METHOD, .method = &RosalinaMenu_ChangeScreenBrightness },
+        { "Screen filters...", MENU, .menu = &screenFiltersMenu },
         { "Cheats...", METHOD, .method = &RosalinaMenu_Cheats },
         { "", METHOD, .method = PluginLoader__MenuCallback},
+        { "New 3DS menu...", MENU, .menu = &N3DSMenu, .visibility = &menuCheckN3ds },
         { "Process list", METHOD, .method = &RosalinaMenu_ProcessList },
         { "Debugger options...", MENU, .menu = &debuggerMenu },
         { "System configuration...", MENU, .menu = &sysconfigMenu },
-        { "Screen filters...", MENU, .menu = &screenFiltersMenu },
-        { "New 3DS menu...", MENU, .menu = &N3DSMenu, .visibility = &menuCheckN3ds },
         { "Miscellaneous options...", MENU, .menu = &miscellaneousMenu },
         { "Save settings", METHOD, .method = &RosalinaMenu_SaveSettings },
-        { "Power off", METHOD, .method = &RosalinaMenu_PowerOff },
-        { "Reboot", METHOD, .method = &RosalinaMenu_Reboot },
+        { "Return To Home Menu", METHOD, .method = &RosalinaMenu_ReturnToHomeMenu },
+        { "Power off / reboot", METHOD, .method = &RosalinaMenu_PowerOffOrReboot },
+        { "System info", METHOD, .method = &RosalinaMenu_ShowSystemInfo },
         { "Credits", METHOD, .method = &RosalinaMenu_ShowCredits },
         { "Debug info", METHOD, .method = &RosalinaMenu_ShowDebugInfo, .visibility = &rosalinaMenuShouldShowDebugInfo },
         {},
@@ -96,6 +95,73 @@ void RosalinaMenu_SaveSettings(void)
     while(!(waitInput() & KEY_B) && !menuShouldExit);
 }
 
+void RosalinaMenu_PowerOffOrReboot(void)
+{
+    Draw_Lock();
+    Draw_ClearFramebuffer();
+    Draw_FlushFramebuffer();
+    Draw_Unlock();
+
+    do
+    {
+        Draw_Lock();
+        Draw_DrawString(10, 10, COLOR_TITLE, "Power Off / Reboot");
+        Draw_DrawString(10, 30, COLOR_WHITE, "Press A to power off.\nPress Y to reboot.\nPress B to go back.");
+        Draw_FlushFramebuffer();
+        Draw_Unlock();
+
+        u32 pressed = waitInputWithTimeout(1000);
+
+        if(pressed & KEY_Y)
+        {
+            menuLeave();
+            APT_HardwareResetAsync();
+            return;
+        }
+        else if(pressed & KEY_A)
+        {
+            // Soft shutdown
+            menuLeave();
+            srvPublishToSubscriber(0x203, 0);
+            return;
+        }
+        else if(pressed & KEY_B)
+            return;
+    }
+    while(!menuShouldExit);
+}
+
+void RosalinaMenu_ShowSystemInfo(void)
+{
+    u32 kver = osGetKernelVersion();
+
+    do
+    {
+        Draw_Lock();
+        Draw_DrawString(10, 10, COLOR_TITLE, "Rosalina -- System info");
+
+        u32 posY = 30;
+
+        if (areScreenTypesInitialized)
+        {
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Top screen type:    %s\n", topScreenType);
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Bottom screen type: %s\n\n", bottomScreenType);
+        }
+
+        posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Kernel version:     %lu.%lu-%lu\n\n", GET_VERSION_MAJOR(kver), GET_VERSION_MINOR(kver), GET_VERSION_REVISION(kver));
+        if (mcuFwVersion != 0 && mcuInfoTableRead)
+        {
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "MCU FW version:     %lu.%lu\n", GET_VERSION_MAJOR(mcuFwVersion), GET_VERSION_MINOR(mcuFwVersion));
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "PMIC vendor:        %hhu\n", mcuInfoTable[1]);
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Battery vendor:     %hhu\n\n", mcuInfoTable[2]);
+        }
+
+        Draw_FlushFramebuffer();
+        Draw_Unlock();
+    }
+    while(!(waitInput() & KEY_B) && !menuShouldExit);
+}
+
 void RosalinaMenu_ShowDebugInfo(void)
 {
     Draw_Lock();
@@ -111,7 +177,6 @@ void RosalinaMenu_ShowDebugInfo(void)
     u32 kextPa = (u32)((u64)kextAddrSize >> 32);
     u32 kextSize = (u32)kextAddrSize;
 
-    u32 kernelVer = osGetKernelVersion();
     FS_SdMmcSpeedInfo speedInfo;
 
     do
@@ -119,20 +184,10 @@ void RosalinaMenu_ShowDebugInfo(void)
         Draw_Lock();
         Draw_DrawString(10, 10, COLOR_TITLE, "Rosalina -- Debug info");
 
-        u32 posY = Draw_DrawString(10, 30, COLOR_WHITE, memoryMap);
-        posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Kernel ext PA: %08lx - %08lx\n\n", kextPa, kextPa + kextSize);
-        posY = Draw_DrawFormattedString(
-            10, posY, COLOR_WHITE, "Kernel version: %lu.%lu-%lu\n",
-            GET_VERSION_MAJOR(kernelVer), GET_VERSION_MINOR(kernelVer), GET_VERSION_REVISION(kernelVer)
-        );
-        if (mcuFwVersion != 0)
-        {
-            posY = Draw_DrawFormattedString(
-                10, posY, COLOR_WHITE, "MCU FW version: %lu.%lu\n",
-                GET_VERSION_MAJOR(mcuFwVersion), GET_VERSION_MINOR(mcuFwVersion)
-            );
-        }
+        u32 posY = 30;
 
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, memoryMap);
+        posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Kernel ext PA: %08lx - %08lx\n\n", kextPa, kextPa + kextSize);
         if (R_SUCCEEDED(FSUSER_GetSdmcSpeedInfo(&speedInfo)))
         {
             u32 clkDiv = 1 << (1 + (speedInfo.sdClkCtrl & 0xFF));
@@ -173,7 +228,7 @@ void RosalinaMenu_ShowCredits(void)
         Draw_Lock();
         Draw_DrawString(10, 10, COLOR_TITLE, "Rosalina -- Luma3DS credits");
 
-        u32 posY = Draw_DrawString(10, 30, COLOR_WHITE, "Luma3DS (c) 2016-2023 AuroraWright, TuxSH") + SPACING_Y;
+        u32 posY = Draw_DrawString(10, 30, COLOR_WHITE, "Luma3DS (c) 2016-2025 AuroraWright, TuxSH") + SPACING_Y;
 
         posY = Draw_DrawString(10, posY + SPACING_Y, COLOR_WHITE, "3DSX loading code by fincs");
         posY = Draw_DrawString(10, posY + SPACING_Y, COLOR_WHITE, "Networking code & basic GDB functionality by Stary");
@@ -195,163 +250,6 @@ void RosalinaMenu_ShowCredits(void)
     while(!(waitInput() & KEY_B) && !menuShouldExit);
 }
 
-void RosalinaMenu_Reboot(void)
-{
-    Draw_Lock();
-    Draw_ClearFramebuffer();
-    Draw_FlushFramebuffer();
-    Draw_Unlock();
-
-    do
-    {
-        Draw_Lock();
-        Draw_DrawString(10, 10, COLOR_TITLE, "Reboot");
-        Draw_DrawString(10, 30, COLOR_WHITE, "Press A to reboot, press B to go back.");
-        Draw_FlushFramebuffer();
-        Draw_Unlock();
-
-        u32 pressed = waitInputWithTimeout(1000);
-
-        if(pressed & KEY_A)
-        {
-            menuLeave();
-            APT_HardwareResetAsync();
-            return;
-        } else if(pressed & KEY_B)
-            return;
-    }
-    while(!menuShouldExit);
-}
-
-void RosalinaMenu_ChangeScreenBrightness(void)
-{
-    Draw_Lock();
-    Draw_ClearFramebuffer();
-    Draw_FlushFramebuffer();
-    Draw_Unlock();
-
-    // gsp:LCD GetLuminance is stubbed on O3DS so we have to implement it ourselves... damn it.
-    // Assume top and bottom screen luminances are the same (should be; if not, we'll set them to the same values).
-    u32 luminance = getCurrentLuminance(false);
-    u32 minLum = getMinLuminancePreset();
-    u32 maxLum = getMaxLuminancePreset();
-
-    do
-    {
-        Draw_Lock();
-        Draw_DrawString(10, 10, COLOR_TITLE, "Screen brightness");
-        u32 posY = 30;
-        posY = Draw_DrawFormattedString(
-            10,
-            posY,
-            COLOR_WHITE,
-            "Current luminance: %lu (min. %lu, max. %lu)\n\n",
-            luminance,
-            minLum,
-            maxLum
-        );
-        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Controls: Up/Down for +-1, Right/Left for +-10.\n");
-        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Press A to start, B to exit.\n\n");
-
-        posY = Draw_DrawString(10, posY, COLOR_RED, "WARNING: \n");
-        posY = Draw_DrawString(10, posY, COLOR_WHITE, "  * value will be limited by the presets.\n");
-        posY = Draw_DrawString(10, posY, COLOR_WHITE, "  * bottom framebuffer will be restored until\nyou exit.");
-        Draw_FlushFramebuffer();
-        Draw_Unlock();
-
-        u32 pressed = waitInputWithTimeout(1000);
-
-        if (pressed & KEY_A)
-            break;
-
-        if (pressed & KEY_B)
-            return;
-    }
-    while (!menuShouldExit);
-
-    Draw_Lock();
-
-    Draw_RestoreFramebuffer();
-    Draw_FreeFramebufferCache();
-
-    svcKernelSetState(0x10000, 2); // unblock gsp
-    gspLcdInit(); // assume it doesn't fail. If it does, brightness won't change, anyway.
-
-    // gsp:LCD will normalize the brightness between top/bottom screen, handle PWM, etc.
-
-    s32 lum = (s32)luminance;
-
-    do
-    {
-        u32 pressed = waitInputWithTimeout(1000);
-        if (pressed & DIRECTIONAL_KEYS)
-        {
-            if (pressed & KEY_UP)
-                lum += 1;
-            else if (pressed & KEY_DOWN)
-                lum -= 1;
-            else if (pressed & KEY_RIGHT)
-                lum += 10;
-            else if (pressed & KEY_LEFT)
-                lum -= 10;
-
-            lum = lum < (s32)minLum ? (s32)minLum : lum;
-            lum = lum > (s32)maxLum ? (s32)maxLum : lum;
-
-            // We need to call gsp here because updating the active duty LUT is a bit tedious (plus, GSP has internal state).
-            // This is actually SetLuminance:
-            GSPLCD_SetBrightnessRaw(BIT(GSP_SCREEN_TOP) | BIT(GSP_SCREEN_BOTTOM), lum);
-        }
-
-        if (pressed & KEY_B)
-            break;
-    }
-    while (!menuShouldExit);
-
-    gspLcdExit();
-    svcKernelSetState(0x10000, 2); // block gsp again
-
-    if (R_FAILED(Draw_AllocateFramebufferCache(FB_BOTTOM_SIZE)))
-    {
-        // Shouldn't happen
-        __builtin_trap();
-    }
-    else
-        Draw_SetupFramebuffer();
-
-    Draw_Unlock();
-}
-
-void RosalinaMenu_PowerOff(void) // Soft shutdown.
-{
-    Draw_Lock();
-    Draw_ClearFramebuffer();
-    Draw_FlushFramebuffer();
-    Draw_Unlock();
-
-    do
-    {
-        Draw_Lock();
-        Draw_DrawString(10, 10, COLOR_TITLE, "Power off");
-        Draw_DrawString(10, 30, COLOR_WHITE, "Press A to power off, press B to go back.");
-        Draw_FlushFramebuffer();
-        Draw_Unlock();
-
-        u32 pressed = waitInputWithTimeout(1000);
-
-        if(pressed & KEY_A)
-        {
-            menuLeave();
-            srvPublishToSubscriber(0x203, 0);
-            return;
-        }
-        else if(pressed & KEY_B)
-            return;
-    }
-    while(!menuShouldExit);
-}
-
-
 #define TRY(expr) if(R_FAILED(res = (expr))) goto end;
 
 static s64 timeSpentConvertingScreenshot = 0;
@@ -362,7 +260,12 @@ static Result RosalinaMenu_WriteScreenshot(IFile *file, u32 width, bool top, boo
     u64 total;
     Result res = 0;
     u32 lineSize = 3 * width;
-    u32 remaining = lineSize * 240;
+
+    // When dealing with 800px mode (800x240 with half-width pixels), duplicate each line
+    // to restore aspect ratio and obtain faithful 800x480 screenshots
+    u32 scaleFactorY = width > 400 ? 2 : 1;
+    u32 numLinesScaled = 240 * scaleFactorY;
+    u32 remaining = lineSize * numLinesScaled;
 
     TRY(Draw_AllocateFramebufferCacheForScreenshot(remaining));
 
@@ -370,8 +273,9 @@ static Result RosalinaMenu_WriteScreenshot(IFile *file, u32 width, bool top, boo
     u8 *framebufferCacheEnd = framebufferCache + Draw_GetFramebufferCacheSize();
 
     u8 *buf = framebufferCache;
-    Draw_CreateBitmapHeader(framebufferCache, width, 240);
-    buf += 54;
+    Draw_CreateBitmapHeader(framebufferCache, width, numLinesScaled);
+    const u32 headerSize = 0x40;
+    buf += headerSize;
 
     u32 y = 0;
     // Our buffer might be smaller than the size of the screenshot...
@@ -380,16 +284,16 @@ static Result RosalinaMenu_WriteScreenshot(IFile *file, u32 width, bool top, boo
         s64 t0 = svcGetSystemTick();
         u32 available = (u32)(framebufferCacheEnd - buf);
         u32 size = available < remaining ? available : remaining;
-        u32 nlines = size / lineSize;
-        Draw_ConvertFrameBufferLines(buf, width, y, nlines, top, left);
+        u32 nlines = size / (lineSize * scaleFactorY);
+        Draw_ConvertFrameBufferLines(buf, width, y, nlines, scaleFactorY, top, left);
 
         s64 t1 = svcGetSystemTick();
         timeSpentConvertingScreenshot += t1 - t0;
-        TRY(IFile_Write(file, &total, framebufferCache, (y == 0 ? 54 : 0) + lineSize * nlines, 0)); // don't forget to write the header
+        TRY(IFile_Write(file, &total, framebufferCache, (y == 0 ? headerSize : 0) + lineSize * nlines * scaleFactorY, 0)); // don't forget to write the header
         timeSpentWritingScreenshot += svcGetSystemTick() - t1;
 
         y += nlines;
-        remaining -= lineSize * nlines;
+        remaining -= lineSize * nlines * scaleFactorY;
         buf = framebufferCache;
     }
     end:
@@ -398,9 +302,38 @@ static Result RosalinaMenu_WriteScreenshot(IFile *file, u32 width, bool top, boo
     return res;
 }
 
+void RosalinaMenu_ReturnToHomeMenu(void)
+{
+    Draw_Lock();
+    Draw_ClearFramebuffer();
+    Draw_FlushFramebuffer();
+    Draw_Unlock();
+
+    do
+    {
+        Draw_Lock();
+        Draw_DrawString(10, 10, COLOR_TITLE, "Return to Home Menu");
+        Draw_DrawString(10, 30, COLOR_WHITE, "Press A to confirm.\nPress B to go back.");
+        Draw_FlushFramebuffer();
+        Draw_Unlock();
+
+        u32 pressed = waitInputWithTimeout(1000);
+
+        if(pressed & KEY_A)
+        {
+            menuLeave();
+            srvPublishToSubscriber(0x204, 0);
+            return;
+        }
+        else if(pressed & KEY_B)
+            return;
+    }
+    while(!menuShouldExit);
+}
+
 void RosalinaMenu_TakeScreenshot(void)
 {
-    IFile file;
+    IFile file = {0};
     Result res = 0;
 
     char filename[64];
@@ -438,6 +371,11 @@ void RosalinaMenu_TakeScreenshot(void)
             res = 0;
         FSUSER_CloseArchive(archive);
     }
+    else
+    {
+        archive = 0;
+        goto end;
+    }
 
     dateTimeToString(dateTimeStr, osGetTime(), true);
 
@@ -462,6 +400,9 @@ void RosalinaMenu_TakeScreenshot(void)
 end:
     IFile_Close(&file);
 
+    if (archive != 0)
+        FSUSER_CloseArchive(archive);
+
     if (R_FAILED(Draw_AllocateFramebufferCache(FB_BOTTOM_SIZE)))
         __builtin_trap(); // We're f***ed if this happens
 
@@ -489,6 +430,91 @@ end:
         Draw_Unlock();
     }
     while(!(waitInput() & KEY_B) && !menuShouldExit);
+}
+
+static Result menuWriteSelfScreenshot(IFile *file)
+{
+    u64 total;
+    Result res = 0;
+
+    u32 width = 320;
+    u32 lineSize = 3 * width;
+
+    u32 scaleFactorY = 1;
+    u32 numLinesScaled = 240 * scaleFactorY;
+
+    u32 addr = 0x0D800000; // keep this in check
+    u32 tmp;
+
+    u32 size = ((54 + lineSize * numLinesScaled * scaleFactorY) + 0xFFF) >> 12 << 12; // round-up
+    u8 *buffer = NULL;
+
+    TRY(svcControlMemoryEx(&tmp, addr, 0, size, MEMOP_ALLOC | MEMOP_REGION_SYSTEM, MEMPERM_READWRITE, true));
+    buffer = (u8 *)addr;
+
+    Draw_CreateBitmapHeader(buffer, width, numLinesScaled);
+
+    Draw_ConvertFrameBufferLines(buffer + 54, width, 0, numLinesScaled, scaleFactorY, false, false);
+    TRY(IFile_Write(file, &total, buffer, 54 + lineSize * numLinesScaled * scaleFactorY, 0)); // don't forget to write the header
+
+end:
+    if (buffer)
+        svcControlMemoryEx(&tmp, addr, 0, size, MEMOP_FREE, MEMPERM_DONTCARE, false);
+
+    return res;
+}
+
+void menuTakeSelfScreenshot(void)
+{
+    // Optimized for N3DS. May fail due to OOM.
+
+    IFile file = {0};
+    Result res = 0;
+
+    char filename[100];
+    char dateTimeStr[64];
+
+    FS_Archive archive;
+    FS_ArchiveID archiveId;
+    s64 out;
+    bool isSdMode;
+
+    timeSpentConvertingScreenshot = 0;
+    timeSpentWritingScreenshot = 0;
+
+    if(R_FAILED(svcGetSystemInfo(&out, 0x10000, 0x203))) svcBreak(USERBREAK_ASSERT);
+    isSdMode = (bool)out;
+
+    archiveId = isSdMode ? ARCHIVE_SDMC : ARCHIVE_NAND_RW;
+    Draw_Lock();
+    svcFlushEntireDataCache();
+
+    res = FSUSER_OpenArchive(&archive, archiveId, fsMakePath(PATH_EMPTY, ""));
+    if(R_SUCCEEDED(res))
+    {
+        res = FSUSER_CreateDirectory(archive, fsMakePath(PATH_ASCII, "/luma/screenshots"), 0);
+        if((u32)res == 0xC82044BE) // directory already exists
+            res = 0;
+        FSUSER_CloseArchive(archive);
+    }
+    else
+    {
+        archive = 0;
+        goto end;
+    }
+
+    dateTimeToString(dateTimeStr, osGetTime(), true);
+
+    sprintf(filename, "/luma/screenshots/rosalina_menu_%s.bmp", dateTimeStr);
+
+    TRY(IFile_Open(&file, archiveId, fsMakePath(PATH_EMPTY, ""), fsMakePath(PATH_ASCII, filename), FS_OPEN_CREATE | FS_OPEN_WRITE));
+    TRY(menuWriteSelfScreenshot(&file));
+
+end:
+    IFile_Close(&file);
+
+    if (archive != 0)
+        FSUSER_CloseArchive(archive);
+}
 
 #undef TRY
-}

sysmodules/rosalina/source/menus/debugger.c

@@ -48,8 +48,8 @@ Menu debuggerMenu = {
 
 static MyThread debuggerSocketThread;
 static MyThread debuggerDebugThread;
-static u8 ALIGN(8) debuggerSocketThreadStack[0x5000];
-static u8 ALIGN(8) debuggerDebugThreadStack[0x3000];
+static u8 CTR_ALIGN(8) debuggerSocketThreadStack[0x5000];
+static u8 CTR_ALIGN(8) debuggerDebugThreadStack[0x3000];
 
 GDBServer gdbServer = { 0 };
 

sysmodules/rosalina/source/menus/miscellaneous.c

@@ -321,6 +321,12 @@ void MiscellaneousMenu_UpdateTimeDateNtp(void)
     int utcOffset = dt / 60;
     int utcOffsetMinute = dt%60;
     int absOffset;
+
+    Draw_Lock();
+    Draw_ClearFramebuffer();
+    Draw_FlushFramebuffer();
+    Draw_Unlock();
+
     do
     {
         Draw_Lock();
@@ -331,14 +337,14 @@ void MiscellaneousMenu_UpdateTimeDateNtp(void)
         posY = Draw_DrawFormattedString(10, 30, COLOR_WHITE, "Current UTC offset:  %c%02d%02d", utcOffset < 12 ? '-' : '+', absOffset, utcOffsetMinute);
         posY = Draw_DrawFormattedString(10, posY + SPACING_Y, COLOR_WHITE, "Use DPAD Left/Right to change hour offset.\nUse DPAD Up/Down to change minute offset.\nPress A when done.") + SPACING_Y;
 
-        input = waitInput();
+        Draw_FlushFramebuffer();
+        Draw_Unlock();
 
+        input = waitInput();
         if(input & KEY_LEFT) utcOffset = (27 + utcOffset - 1) % 27; // ensure utcOffset >= 0
         if(input & KEY_RIGHT) utcOffset = (utcOffset + 1) % 27;
         if(input & KEY_UP) utcOffsetMinute = (utcOffsetMinute + 1) % 60;
         if(input & KEY_DOWN) utcOffsetMinute = (60 + utcOffsetMinute - 1) % 60;
-        Draw_FlushFramebuffer();
-        Draw_Unlock();
     }
     while(!(input & (KEY_A | KEY_B)) && !menuShouldExit);
 
@@ -376,13 +382,10 @@ void MiscellaneousMenu_UpdateTimeDateNtp(void)
         else
             Draw_DrawFormattedString(10, posY + 2 * SPACING_Y, COLOR_WHITE, "Time/date updated successfully.") + SPACING_Y;
 
-        input = waitInput();
-
         Draw_FlushFramebuffer();
         Draw_Unlock();
     }
-    while(!(input & KEY_B) && !menuShouldExit);
-
+    while(!(waitInput() & KEY_B) && !menuShouldExit);
 }
 
 void MiscellaneousMenu_NullifyUserTimeOffset(void)

sysmodules/rosalina/source/menus/n3ds.c

@@ -25,23 +25,40 @@
 */
 
 #include <3ds.h>
+#include <math.h>
 #include "fmt.h"
 #include "menus/n3ds.h"
 #include "memory.h"
 #include "menu.h"
+#include "n3ds.h"
+#include "draw.h"
 
 static char clkRateBuf[128 + 1];
 
+static QtmCalibrationData lastQtmCal = {0};
+static bool qtmCalRead = false;
+
 Menu N3DSMenu = {
     "New 3DS menu",
     {
         { "Enable L2 cache", METHOD, .method = &N3DSMenu_EnableDisableL2Cache },
         { clkRateBuf, METHOD, .method = &N3DSMenu_ChangeClockRate },
+        { "Temporarily disable Super-Stable 3D", METHOD, .method = &N3DSMenu_ToggleSs3d, .visibility = &N3DSMenu_CheckNotN2dsXl },
+        { "Test parallax barrier positions", METHOD, .method = &N3DSMenu_TestBarrierPositions, .visibility = &N3DSMenu_CheckNotN2dsXl },
+        { "Super-Stable 3D calibration", METHOD, .method = &N3DSMenu_Ss3dCalibration, .visibility = &N3DSMenu_CheckNotN2dsXl },
         {},
     }
 };
 
 static s64 clkRate = 0, higherClkRate = 0, L2CacheEnabled = 0;
+static bool qtmUnavailableAndNotBlacklisted = false; // true on N2DSXL, though we check MCU system model data first
+static QtmStatus lastUpdatedQtmStatus;
+
+bool N3DSMenu_CheckNotN2dsXl(void)
+{
+    // Also check if qtm could be initialized
+    return isQtmInitialized && mcuInfoTableRead && mcuInfoTable[9] < 5 && !qtmUnavailableAndNotBlacklisted;
+}
 
 void N3DSMenu_UpdateStatus(void)
 {
@@ -51,6 +68,26 @@ void N3DSMenu_UpdateStatus(void)
 
     N3DSMenu.items[0].title = L2CacheEnabled ? "Disable L2 cache" : "Enable L2 cache";
     sprintf(clkRateBuf, "Set clock rate to %luMHz", clkRate != 268 ? 268 : (u32)higherClkRate);
+
+    if (N3DSMenu_CheckNotN2dsXl())
+    {
+        bool blacklisted = false;
+
+        // Read status
+        if (R_FAILED(QTMS_GetQtmStatus(&lastUpdatedQtmStatus)))
+            qtmUnavailableAndNotBlacklisted = true; // stop showing QTM options if unavailable but not blacklisted
+
+        else if (lastUpdatedQtmStatus == QTM_STATUS_UNAVAILABLE)
+            qtmUnavailableAndNotBlacklisted = R_FAILED(QTMU_IsCurrentAppBlacklisted(&blacklisted)) || !blacklisted;
+
+
+        MenuItem *item = &N3DSMenu.items[2];
+
+        if (lastUpdatedQtmStatus == QTM_STATUS_ENABLED)
+            item->title = "Temporarily disable Super-Stable 3D";
+        else
+            item->title = "Temporarily enable Super-Stable 3D";
+    }
 }
 
 void N3DSMenu_ChangeClockRate(void)
@@ -72,3 +109,184 @@ void N3DSMenu_EnableDisableL2Cache(void)
 
     N3DSMenu_UpdateStatus();
 }
+
+void N3DSMenu_ToggleSs3d(void)
+{
+    if (qtmUnavailableAndNotBlacklisted)
+        return;
+
+    if (lastUpdatedQtmStatus == QTM_STATUS_ENABLED)
+        QTMS_SetQtmStatus(QTM_STATUS_SS3D_DISABLED);
+    else // both SS3D disabled and unavailable/blacklisted states
+        QTMS_SetQtmStatus(QTM_STATUS_ENABLED);
+
+    N3DSMenu_UpdateStatus();
+}
+
+void N3DSMenu_TestBarrierPositions(void)
+{
+    Draw_Lock();
+    Draw_ClearFramebuffer();
+    Draw_FlushFramebuffer();
+    Draw_Unlock();
+
+    u8 pos = 0;
+    QTMS_DisableAutoBarrierControl(); // assume it doesn't fail
+    QTMS_GetCurrentBarrierPosition(&pos);
+
+    u32 pressed = 0;
+
+    do
+    {
+        Draw_Lock();
+
+        Draw_DrawString(10, 10, COLOR_TITLE, "New 3DS menu");
+        u32 posY = Draw_DrawString(10, 30, COLOR_WHITE, "Use left/right to adjust the barrier's position.\n\n");
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Each position corresponds to 5.2mm horizontal eye\nmovement (assuming ideal viewing conditions).\n\n");
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Once you figure out the ideal central position, you\ncan then use it in the calibration submenu.\n\n");
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Auto-barrier adjustment behavior is restored on\nexit.\n\n");
+
+        posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Barrier position: %2hhu\n", pos);
+
+        Draw_FlushFramebuffer();
+        pressed = waitInputWithTimeout(1000);
+
+        if (pressed & KEY_LEFT)
+        {
+            pos = pos > 11 ? 11 : pos; // pos is 13 when SS3D is disabled/camera is in use
+            pos = (12 + pos - 1) % 12;
+            QTMS_SetBarrierPosition(pos);
+        }
+        else if (pressed & KEY_RIGHT)
+        {
+            pos = pos > 11 ? 11 : pos; // pos is 13 when SS3D is disabled/camera is in use
+            pos = (pos + 1) % 12;
+            QTMS_SetBarrierPosition(pos);
+        }
+
+        Draw_Unlock();
+    } while(!menuShouldExit && !(pressed & KEY_B));
+
+    QTMS_EnableAutoBarrierControl();
+}
+
+void N3DSMenu_Ss3dCalibration(void)
+{
+    Draw_Lock();
+    Draw_ClearFramebuffer();
+    Draw_FlushFramebuffer();
+    Draw_Unlock();
+
+    u8 currentPos;
+    QtmTrackingData trackingData = {0};
+
+    if (R_FAILED(QTMS_GetCurrentBarrierPosition(&currentPos)))
+        currentPos = 13;
+
+    bool calReadFailed = false;
+
+    if (!qtmCalRead)
+    {
+        cfguInit();
+        calReadFailed =  R_FAILED(CFG_GetConfigInfoBlk8(sizeof(QtmCalibrationData), QTM_CAL_CFG_BLK_ID, &lastQtmCal));
+        cfguExit();
+        if (!calReadFailed)
+            qtmCalRead = true;
+    }
+
+    bool trackingDisabled = currentPos == 13;
+
+    if (currentPos < 12)
+        QTMS_EnableAutoBarrierControl(); // assume this doesn't fail
+
+    u32 pressed = 0;
+    do
+    {
+        if (!trackingDisabled)
+        {
+            QTMS_GetCurrentBarrierPosition(&currentPos);
+            QTMU_GetTrackingData(&trackingData);
+        }
+
+        Draw_Lock();
+
+        Draw_DrawString(10, 10, COLOR_TITLE, "New 3DS menu");
+        u32 posY = 30;
+
+        if (trackingDisabled)
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "SS3D disabled or camera in use.\nPress B to exit this menu.\n");
+        else if (calReadFailed)
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "Failed to read calibration data.\nPress B to exit this menu.\n");
+        else
+        {
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "Right/Left:  +- 1\n");
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "Up/Down:     +- 0.1\n");
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "R/L:         +- 0.01\n");
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "A:           save to system config\n");
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "Y:           reload last saved calibration\n");
+            posY = Draw_DrawString(10, posY, COLOR_WHITE, "B:           exit this menu\n\n");
+
+            char calStr[16];
+            floatToString(calStr, lastQtmCal.centerBarrierPosition, 2, true);
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Center position:          %-5s\n\n", calStr);
+
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Current barrier position: %-2hhu\n", currentPos);
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Current eye distance:     %-2d cm\n", (int)roundf(qtmEstimateEyeToCameraDistance(&trackingData) / 10.0f));
+            posY = Draw_DrawFormattedString(10, posY, COLOR_WHITE, "Optimal eye distance:     %-2d cm\n", (int)roundf(lastQtmCal.viewingDistance / 10.0f));
+        }
+
+        Draw_FlushFramebuffer();
+        pressed = waitInputWithTimeout(15);
+
+        if (!calReadFailed)
+        {
+            if (pressed & KEY_LEFT)
+            {
+                lastQtmCal.centerBarrierPosition = fmodf(12.0f + lastQtmCal.centerBarrierPosition - 1.0f, 12.0f);
+                QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+            else if (pressed & KEY_RIGHT)
+            {
+                lastQtmCal.centerBarrierPosition = fmodf(lastQtmCal.centerBarrierPosition + 1.0f, 12.0f);
+                QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+
+            if (pressed & KEY_DOWN)
+            {
+                lastQtmCal.centerBarrierPosition = fmodf(12.0f + lastQtmCal.centerBarrierPosition - 0.1f, 12.0f);
+                QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+            else if (pressed & KEY_UP)
+            {
+                lastQtmCal.centerBarrierPosition = fmodf(lastQtmCal.centerBarrierPosition + 0.1f, 12.0f);
+                QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+
+            if (pressed & KEY_L)
+            {
+                lastQtmCal.centerBarrierPosition = fmodf(12.0f + lastQtmCal.centerBarrierPosition - 0.01f, 12.0f);
+                QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+            else if (pressed & KEY_R)
+            {
+                lastQtmCal.centerBarrierPosition = fmodf(lastQtmCal.centerBarrierPosition + 0.01f, 12.0f);
+                QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+
+            if (pressed & KEY_A)
+                QTMS_SetCalibrationData(&lastQtmCal, true);
+
+            if (pressed & KEY_Y)
+            {
+                cfguInit();
+                calReadFailed =  R_FAILED(CFG_GetConfigInfoBlk8(sizeof(QtmCalibrationData), QTM_CAL_CFG_BLK_ID, &lastQtmCal));
+                cfguExit();
+                qtmCalRead = !calReadFailed;
+                if (qtmCalRead)
+                    QTMS_SetCalibrationData(&lastQtmCal, false);
+            }
+        }
+
+        Draw_Unlock();
+    } while(!menuShouldExit && !(pressed & KEY_B));
+}

sysmodules/rosalina/source/menus/process_list.c

@@ -245,8 +245,8 @@ static void ProcessListMenu_MemoryViewer(const ProcessInfo *info)
         svcQueryProcessMemory(&mem, &out, processHandle, heapStartAddress);
         heapTotalSize = mem.size;
 
-        Result codeRes = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, codeDestAddress, processHandle, codeStartAddress, codeTotalSize);
-        Result heapRes = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, heapDestAddress, processHandle, heapStartAddress, heapTotalSize);
+        Result codeRes = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, codeDestAddress, processHandle, codeStartAddress, codeTotalSize, 0);
+        Result heapRes = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, heapDestAddress, processHandle, heapStartAddress, heapTotalSize, 0);
 
         bool codeAvailable = R_SUCCEEDED(codeRes);
         bool heapAvailable = R_SUCCEEDED(heapRes);

sysmodules/rosalina/source/menus/screen_filters.c

@@ -29,6 +29,7 @@
 #include "memory.h"
 #include "menu.h"
 #include "menus/screen_filters.h"
+#include "menus/screen_filters_srgb_tables.h"
 #include "draw.h"
 #include "redshift/colorramp.h"
 
@@ -53,6 +54,7 @@ static inline bool ScreenFiltersMenu_IsDefaultSettingsFilter(const ScreenFilter
     ok = ok && filter->gamma == 1.0f;
     ok = ok && filter->contrast == 1.0f;
     ok = ok && filter->brightness == 0.0f;
+    ok = ok && filter->colorCurveCorrection == 0;
     return ok;
 }
 
@@ -89,7 +91,7 @@ static u8 ScreenFilterMenu_CalculatePolynomialColorLutComponent(const float coef
     return (u8)CLAMP(levelInt, 0, 255); // clamp again just to be sure
 }
 
-static void ScreenFilterMenu_WritePolynomialColorLut(bool top, const float coeffs[][3], bool invert, float gamma, u32 dim)
+static void ScreenFilterMenu_WritePolynomialColorLut(bool top, u8 curveCorrection, const float coeffs[][3], bool invert, float gamma, u32 dim)
 {
     if (top)
         GPU_FB_TOP_COL_LUT_INDEX = 0;
@@ -99,9 +101,15 @@ static void ScreenFilterMenu_WritePolynomialColorLut(bool top, const float coeff
     for (int i = 0; i <= 255; i++) {
         Pixel px;
         int inLevel = invert ? 255 - i : i;
-        px.r = ScreenFilterMenu_CalculatePolynomialColorLutComponent(coeffs, 0, gamma, dim, inLevel);
-        px.g = ScreenFilterMenu_CalculatePolynomialColorLutComponent(coeffs, 1, gamma, dim, inLevel);
-        px.b = ScreenFilterMenu_CalculatePolynomialColorLutComponent(coeffs, 2, gamma, dim, inLevel);
+        const u8 (*tbl)[3] = curveCorrection == 2 ? ctrToSrgbTableBottom : ctrToSrgbTableTop;
+
+        u8 inLevelR = curveCorrection > 0 ? tbl[inLevel][0] : inLevel;
+        u8 inLevelG = curveCorrection > 0 ? tbl[inLevel][1] : inLevel;
+        u8 inLevelB = curveCorrection > 0 ? tbl[inLevel][2] : inLevel;
+
+        px.r = ScreenFilterMenu_CalculatePolynomialColorLutComponent(coeffs, 0, gamma, dim, inLevelR);
+        px.g = ScreenFilterMenu_CalculatePolynomialColorLutComponent(coeffs, 1, gamma, dim, inLevelG);
+        px.b = ScreenFilterMenu_CalculatePolynomialColorLutComponent(coeffs, 2, gamma, dim, inLevelB);
         px.z = 0;
 
         if (top)
@@ -127,7 +135,7 @@ static void ScreenFiltersMenu_ApplyColorSettings(bool top)
         { a * wp[0], a * wp[1], a * wp[2] },    // x^1
     };
 
-    ScreenFilterMenu_WritePolynomialColorLut(top, poly, inv, g, 1);
+    ScreenFilterMenu_WritePolynomialColorLut(top, filter->colorCurveCorrection, poly, inv, g, 1);
 }
 
 static void ScreenFiltersMenu_SetCct(u16 cct)
@@ -138,6 +146,41 @@ static void ScreenFiltersMenu_SetCct(u16 cct)
     ScreenFiltersMenu_ApplyColorSettings(false);
 }
 
+static void ScreenFiltersMenu_UpdateEntries(void)
+{
+    if (topScreenFilter.colorCurveCorrection == 0)
+    {
+        screenFiltersMenu.items[10].title = "[IPS recommended] Enhance top screen colors";
+        screenFiltersMenu.items[10].method = &ScreenFiltersMenu_SetTopScreenSrgbColorCurve;
+    }
+    else
+    {
+        screenFiltersMenu.items[10].title = "Restore top screen color curve";
+        screenFiltersMenu.items[10].method = &ScreenFiltersMenu_RestoreTopScreenColorCurve;
+    }
+
+    if (bottomScreenFilter.colorCurveCorrection == 0)
+    {
+        screenFiltersMenu.items[11].title = "[IPS recommended] Enhance bottom screen colors";
+        screenFiltersMenu.items[11].method = &ScreenFiltersMenu_SetBottomScreenSrgbColorCurve;
+    }
+    else
+    {
+        screenFiltersMenu.items[11].title = "Restore bottom screen color curve";
+        screenFiltersMenu.items[11].method = &ScreenFiltersMenu_RestoreBottomScreenColorCurve;
+    }
+}
+static void ScreenFiltersMenu_SetColorCurveCorrection(bool top, u8 colorCurveCorrection)
+{
+    if (top)
+        topScreenFilter.colorCurveCorrection = colorCurveCorrection;
+    else
+        bottomScreenFilter.colorCurveCorrection = colorCurveCorrection;
+
+    ScreenFiltersMenu_ApplyColorSettings(top);
+    ScreenFiltersMenu_UpdateEntries();
+}
+
 Menu screenFiltersMenu = {
     "Screen filters menu",
     {
@@ -151,7 +194,9 @@ Menu screenFiltersMenu = {
         { "[2300K] Warm Incandescent", METHOD, .method = &ScreenFiltersMenu_SetWarmIncandescent },
         { "[1900K] Candle", METHOD, .method = &ScreenFiltersMenu_SetCandle },
         { "[1200K] Ember", METHOD, .method = &ScreenFiltersMenu_SetEmber },
-        { "Advanced configuration", METHOD, .method = &ScreenFiltersMenu_AdvancedConfiguration },
+        { "[IPS recommended] Enhance top screen colors", METHOD, .method = &ScreenFiltersMenu_SetTopScreenSrgbColorCurve },
+        { "[IPS recommended] Enhance bottom screen colors", METHOD, .method = &ScreenFiltersMenu_SetTopScreenSrgbColorCurve },
+        { "Advanced configuration...", METHOD, .method = &ScreenFiltersMenu_AdvancedConfiguration },
         {},
     }
 };
@@ -162,6 +207,12 @@ void ScreenFiltersMenu_Set##name(void)\
     ScreenFiltersMenu_SetCct(temp);\
 }
 
+#define DEF_SRGB_SETTER(top, profile, name)\
+void ScreenFiltersMenu_##name(void)\
+{\
+    ScreenFiltersMenu_SetColorCurveCorrection(top, profile);\
+}
+
 void ScreenFiltersMenu_RestoreSettings(void)
 {
     // Precondition: menu has not been entered
@@ -198,7 +249,7 @@ void ScreenFiltersMenu_LoadConfig(void)
 
     svcGetSystemInfo(&out, 0x10000, 0x104);
     topScreenFilter.gamma = (float)(out / FLOAT_CONV_MULT);
-    if (topScreenFilter.gamma < 0.0f || topScreenFilter.gamma > 1411.0f)
+    if (topScreenFilter.gamma < 0.0f || topScreenFilter.gamma > 8.0f)
         topScreenFilter.gamma = 1.0f;
 
     svcGetSystemInfo(&out, 0x10000, 0x105);
@@ -214,6 +265,9 @@ void ScreenFiltersMenu_LoadConfig(void)
     svcGetSystemInfo(&out, 0x10000, 0x107);
     topScreenFilter.invert = (bool)out;
 
+    svcGetSystemInfo(&out, 0x10000, 0x10D);
+    topScreenFilter.colorCurveCorrection = (u8)out;
+
     svcGetSystemInfo(&out, 0x10000, 0x108);
     bottomScreenFilter.cct = (u16)out;
     if (bottomScreenFilter.cct < 1000 || bottomScreenFilter.cct > 25100)
@@ -221,7 +275,7 @@ void ScreenFiltersMenu_LoadConfig(void)
 
     svcGetSystemInfo(&out, 0x10000, 0x109);
     bottomScreenFilter.gamma = (float)(out / FLOAT_CONV_MULT);
-    if (bottomScreenFilter.gamma < 0.0f || bottomScreenFilter.gamma > 1411.0f)
+    if (bottomScreenFilter.gamma < 0.0f || bottomScreenFilter.gamma > 8.0f)
         bottomScreenFilter.gamma = 1.0f;
 
     svcGetSystemInfo(&out, 0x10000, 0x10A);
@@ -236,6 +290,11 @@ void ScreenFiltersMenu_LoadConfig(void)
 
     svcGetSystemInfo(&out, 0x10000, 0x10C);
     bottomScreenFilter.invert = (bool)out;
+
+    svcGetSystemInfo(&out, 0x10000, 0x10E);
+    bottomScreenFilter.colorCurveCorrection = (u8)out;
+
+    ScreenFiltersMenu_UpdateEntries();
 }
 
 DEF_CCT_SETTER(6500, Default)
@@ -250,10 +309,30 @@ DEF_CCT_SETTER(2300, WarmIncandescent)
 DEF_CCT_SETTER(1900, Candle)
 DEF_CCT_SETTER(1200, Ember)
 
+void ScreenFiltersMenu_SetTopScreenSrgbColorCurve(void)
+{
+    ScreenFiltersMenu_SetColorCurveCorrection(true, 1);
+}
+
+void ScreenFiltersMenu_RestoreTopScreenColorCurve(void)
+{
+    ScreenFiltersMenu_SetColorCurveCorrection(true, 0);
+}
+
+void ScreenFiltersMenu_SetBottomScreenSrgbColorCurve(void)
+{
+    ScreenFiltersMenu_SetColorCurveCorrection(false, 2);
+}
+
+void ScreenFiltersMenu_RestoreBottomScreenColorCurve(void)
+{
+    ScreenFiltersMenu_SetColorCurveCorrection(false, 0);
+}
+
 static void ScreenFiltersMenu_ClampFilter(ScreenFilter *filter)
 {
     filter->cct = CLAMP(filter->cct, 1000, 25100);
-    filter->gamma = CLAMP(filter->gamma, 0.0f, 1411.0f); // ln(255) / ln(254/255): (254/255)^1411 <= 1/255
+    filter->gamma = CLAMP(filter->gamma, 0.0f, 8.0f);
     filter->contrast = CLAMP(filter->contrast, 0.0f, 255.0f);
     filter->brightness = CLAMP(filter->brightness, -1.0f, 1.0f);
 }

sysmodules/rosalina/source/menus/sysconfig.c

@@ -25,26 +25,31 @@
 */
 
 #include <3ds.h>
+#include "luma_config.h"
 #include "menus/sysconfig.h"
 #include "memory.h"
 #include "draw.h"
 #include "fmt.h"
 #include "utils.h"
 #include "ifile.h"
+#include "luminance.h"
 
 Menu sysconfigMenu = {
     "System configuration menu",
     {
+        { "Control volume", METHOD, .method=&SysConfigMenu_AdjustVolume},
         { "Control Wireless connection", METHOD, .method = &SysConfigMenu_ControlWifi },
         { "Toggle LEDs", METHOD, .method = &SysConfigMenu_ToggleLEDs },
         { "Toggle Wireless", METHOD, .method = &SysConfigMenu_ToggleWireless },
         { "Toggle Power Button", METHOD, .method=&SysConfigMenu_TogglePowerButton },
         { "Toggle power to card slot", METHOD, .method=&SysConfigMenu_ToggleCardIfPower},
+        { "Change screen brightness", METHOD, .method = &SysConfigMenu_ChangeScreenBrightness },
         {},
     }
 };
 
 bool isConnectionForced = false;
+s8 currVolumeSliderOverride = -1;
 
 void SysConfigMenu_ToggleLEDs(void)
 {
@@ -131,7 +136,7 @@ void SysConfigMenu_ToggleWireless(void)
 
 void SysConfigMenu_UpdateStatus(bool control)
 {
-    MenuItem *item = &sysconfigMenu.items[0];
+    MenuItem *item = &sysconfigMenu.items[1];
 
     if(control)
     {
@@ -145,7 +150,7 @@ void SysConfigMenu_UpdateStatus(bool control)
     }
 }
 
-static bool SysConfigMenu_ForceWifiConnection(int slot)
+static bool SysConfigMenu_ForceWifiConnection(u32 slot)
 {
     char ssid[0x20 + 1] = {0};
     isConnectionForced = false;
@@ -183,7 +188,7 @@ static bool SysConfigMenu_ForceWifiConnection(int slot)
     if(forcedConnection)
         sprintf(infoString, "Succesfully forced a connection to: %s", ssid);
     else
-       sprintf(infoString, "Failed to connect to slot %d", slot + 1);
+       sprintf(infoString, "Failed to connect to slot %d", (int)slot + 1);
 
     Draw_Lock();
     Draw_ClearFramebuffer();
@@ -258,16 +263,31 @@ void SysConfigMenu_ControlWifi(void)
     Draw_FlushFramebuffer();
     Draw_Unlock();
 
-    int slot = 0;
-    char slotString[12] = {0};
-    sprintf(slotString, ">1<  2   3 ");
+    u32 slot = 0;
+    char ssids[3][32] = {{0}};
+
+    Result resInit = acInit();
+    for (u32 i = 0; i < 3; i++)
+    {
+        if (R_SUCCEEDED(ACI_LoadNetworkSetting(i)))
+            ACI_GetNetworkWirelessEssidSecuritySsid(ssids[i]);
+        else
+            strcpy(ssids[i], "(not configured)");
+    }
+    if (R_SUCCEEDED(resInit))
+        acExit();
+
     do
     {
         Draw_Lock();
         Draw_DrawString(10, 10, COLOR_TITLE, "System configuration menu");
-        Draw_DrawString(10, 30, COLOR_WHITE, "Press A to force a connection to slot:");
-        Draw_DrawString(10, 40, COLOR_WHITE, slotString);
-        Draw_DrawString(10, 60, COLOR_WHITE, "Press B to go back.");
+        u32 posY = Draw_DrawString(10, 30, COLOR_WHITE, "Press A to force a connection to slot, B to go back\n\n");
+
+        for (u32 i = 0; i < 3; i++)
+        {
+            Draw_DrawString(10, posY + SPACING_Y * i, COLOR_TITLE, slot == i ? ">" : " ");
+            Draw_DrawFormattedString(30, posY + SPACING_Y * i, COLOR_WHITE, "[%d] %s", (int)i + 1, ssids[i]);
+        }
 
         Draw_FlushFramebuffer();
         Draw_Unlock();
@@ -287,25 +307,13 @@ void SysConfigMenu_ControlWifi(void)
             Draw_FlushFramebuffer();
             Draw_Unlock();
         }
-        else if(pressed & KEY_LEFT)
+        else if(pressed & KEY_DOWN)
         {
-            slotString[slot * 4] = ' ';
-            slotString[(slot * 4) + 2] = ' ';
-            slot--;
-            if(slot == -1)
-                slot = 2;
-            slotString[slot * 4] = '>';
-            slotString[(slot * 4) + 2] = '<';
+            slot = (slot + 1) % 3;
         }
-        else if(pressed & KEY_RIGHT)
+        else if(pressed & KEY_UP)
         {
-            slotString[slot * 4] = ' ';
-            slotString[(slot * 4) + 2] = ' ';
-            slot++;
-            if(slot == 3)
-                slot = 0;
-            slotString[slot * 4] = '>';
-            slotString[(slot * 4) + 2] = '<';
+            slot = (3 + slot - 1) % 3;
         }
         else if(pressed & KEY_B)
             return;
@@ -378,3 +386,266 @@ void SysConfigMenu_ToggleCardIfPower(void)
     }
     while(!menuShouldExit);
 }
+
+static Result SysConfigMenu_ApplyVolumeOverride(void)
+{
+    // This feature repurposes the functionality used for the camera shutter sound.
+    // As such, it interferes with it:
+    //     - shutter volume is set to the override instead of its default 100% value
+    //     - due to implementation details, having the shutter sound effect play will
+    //       make this feature stop working until the volume override is reapplied by
+    //       going back to this menu
+
+    // Original credit: profi200
+
+    u8 i2s1Mux;
+    u8 i2s2Mux;
+    Result res = cdcChkInit();
+
+    if (R_SUCCEEDED(res)) res = CDCCHK_ReadRegisters2(0,  116, &i2s1Mux, 1); // used for shutter sound in TWL mode, and all GBA/DSi/3DS application
+    if (R_SUCCEEDED(res)) res = CDCCHK_ReadRegisters2(100, 49, &i2s2Mux, 1); // used for shutter sound in CTR mode and CTR mode library applets
+
+    if (currVolumeSliderOverride >= 0)
+    {
+        i2s1Mux &= ~0x80;
+        i2s2Mux |=  0x20;
+    }
+    else
+    {
+        i2s1Mux |=  0x80;
+        i2s2Mux &= ~0x20;
+    }
+
+    s8 i2s1Volume;
+    s8 i2s2Volume;
+    if (currVolumeSliderOverride >= 0)
+    {
+        // Considering I found this table inside MCU fw bin (at around offset 0x1200 in the raw bin):
+        // 127, 126, 125, ... 56
+        // which corresponds to round(127 - 71 * (i/63)) modulo some rounding error, it is certain
+        // that the MCU writes to "Page 0/Register 117: VOL/MICDET-Pin Gain" using linear interpolation
+        // to map the slider position (0..63) to the raw gain values, using 127 ("reserved") as "mute".
+        // Indeed, the value used in all calibration data for shutter volume is -10 dB, which maps to 56.
+
+        // However, if you look at the definition of reg 0,117 closely, you will notice that the mapping
+        // to the 7-bit value is piecewise, with half the resolution (double the slope) for values mapping
+        // to -28 dB or lower, which means that the slider increases volume twice as fast below 50% position.
+
+        // LERP like MCU does, round to nearest integer
+        u8 rawPinGain = 127 - (71 * currVolumeSliderOverride + 50) / 100;
+        s8 volume;
+
+        if (rawPinGain <= 90)
+            volume = 36 - rawPinGain;
+        else if (rawPinGain >= 91 && rawPinGain <= 126)
+            volume = 126 - 2 * rawPinGain;
+        else
+            volume = -128; // mute
+
+        i2s1Volume = volume;
+        i2s2Volume = volume;
+    }
+    else
+    {
+        // Restore shutter sound volumes. This sould be sourced from cfg,
+        // however the values are the same everwhere
+        i2s1Volume =  -3; // -1.5 dB (115.7%, only used by TWL applications when taking photos)
+        i2s2Volume = -20; // -10 dB  (100%)
+    }
+
+    // Write volume overrides values before writing to the pinmux registers
+    if (R_SUCCEEDED(res)) res = CDCCHK_WriteRegisters2(0, 65, &i2s1Volume, 1); // CDC_REG_DAC_L_VOLUME_CTRL
+    if (R_SUCCEEDED(res)) res = CDCCHK_WriteRegisters2(0, 66, &i2s1Volume, 1); // CDC_REG_DAC_R_VOLUME_CTRL
+    if (R_SUCCEEDED(res)) res = CDCCHK_WriteRegisters2(100, 123, &i2s2Volume, 1);
+
+    if (R_SUCCEEDED(res)) res = CDCCHK_WriteRegisters2(0, 116, &i2s1Mux, 1);
+    if (R_SUCCEEDED(res)) res = CDCCHK_WriteRegisters2(100, 49, &i2s2Mux, 1);
+
+    cdcChkExit();
+    return res;
+}
+
+void SysConfigMenu_LoadConfig(void)
+{
+    s64 out = -1;
+    svcGetSystemInfo(&out, 0x10000, 7);
+    currVolumeSliderOverride = (s8)out;
+    if (currVolumeSliderOverride >= 0)
+        SysConfigMenu_ApplyVolumeOverride();
+}
+
+void SysConfigMenu_AdjustVolume(void)
+{
+    Draw_Lock();
+    Draw_ClearFramebuffer();
+    Draw_FlushFramebuffer();
+    Draw_Unlock();
+
+    s8 tempVolumeOverride = currVolumeSliderOverride;
+    static s8 backupVolumeOverride = -1;
+    if (backupVolumeOverride == -1)
+        backupVolumeOverride = tempVolumeOverride >= 0 ? tempVolumeOverride : 85;
+
+    do
+    {
+        Draw_Lock();
+        Draw_DrawString(10, 10, COLOR_TITLE, "System configuration menu");
+        u32 posY = Draw_DrawString(10, 30, COLOR_WHITE, "Y: Toggle volume slider override.\nDPAD/CPAD: Adjust the volume level.\nA: Apply\nB: Go back\n\n");
+        Draw_DrawString(10, posY, COLOR_WHITE, "Current status:");
+        posY = Draw_DrawString(100, posY, (tempVolumeOverride == -1) ? COLOR_RED : COLOR_GREEN, (tempVolumeOverride == -1) ? " DISABLED" : " ENABLED ");
+        if (tempVolumeOverride != -1) {
+            posY = Draw_DrawFormattedString(30, posY, COLOR_WHITE, "\nValue: [%d%%]    ", tempVolumeOverride);
+        } else {
+            posY = Draw_DrawString(30, posY, COLOR_WHITE, "\n                 ");
+        }
+
+        Draw_FlushFramebuffer();
+        Draw_Unlock();
+
+        u32 pressed = waitInputWithTimeout(1000);
+
+        Draw_Lock();
+
+        if(pressed & KEY_A)
+        {
+            currVolumeSliderOverride = tempVolumeOverride;
+            Result res = SysConfigMenu_ApplyVolumeOverride();
+            LumaConfig_SaveSettings();
+            if (R_SUCCEEDED(res))
+                Draw_DrawString(10, posY, COLOR_GREEN, "\nSuccess!");
+            else
+                Draw_DrawFormattedString(10, posY, COLOR_RED, "\nFailed: 0x%08lX", res);
+        }
+        else if(pressed & KEY_B)
+            return;
+        else if(pressed & KEY_Y)
+        {
+            Draw_DrawString(10, posY, COLOR_WHITE, "\n                 ");
+            if (tempVolumeOverride == -1) {
+                tempVolumeOverride = backupVolumeOverride;
+            } else {
+                backupVolumeOverride = tempVolumeOverride;
+                tempVolumeOverride = -1;
+            }
+        }
+        else if ((pressed & (KEY_UP | KEY_DOWN | KEY_LEFT | KEY_RIGHT)) && tempVolumeOverride != -1)
+        {
+            Draw_DrawString(10, posY, COLOR_WHITE, "\n                 ");
+            if (pressed & KEY_UP)
+                tempVolumeOverride++;
+            else if (pressed & KEY_DOWN)
+                tempVolumeOverride--;
+            else if (pressed & KEY_RIGHT)
+                tempVolumeOverride+=10;
+            else if (pressed & KEY_LEFT)
+                tempVolumeOverride-=10;
+
+            if (tempVolumeOverride < 0)
+                tempVolumeOverride = 0;
+            if (tempVolumeOverride > 100)
+                tempVolumeOverride = 100;
+        }
+
+        Draw_FlushFramebuffer();
+        Draw_Unlock();
+    } while(!menuShouldExit);
+}
+
+void SysConfigMenu_ChangeScreenBrightness(void)
+{
+    Draw_Lock();
+    Draw_ClearFramebuffer();
+    Draw_FlushFramebuffer();
+    Draw_Unlock();
+
+    // gsp:LCD GetLuminance is stubbed on O3DS so we have to implement it ourselves... damn it.
+    // Assume top and bottom screen luminances are the same (should be; if not, we'll set them to the same values).
+    u32 luminance = getCurrentLuminance(false);
+    u32 minLum = getMinLuminancePreset();
+    u32 maxLum = getMaxLuminancePreset();
+
+    do
+    {
+        Draw_Lock();
+        Draw_DrawString(10, 10, COLOR_TITLE, "Screen brightness");
+        u32 posY = 30;
+        posY = Draw_DrawFormattedString(
+            10,
+            posY,
+            COLOR_WHITE,
+            "Current luminance: %lu (min. %lu, max. %lu)\n\n",
+            luminance,
+            minLum,
+            maxLum
+        );
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Controls: Up/Down for +-1, Right/Left for +-10.\n");
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "Press A to start, B to exit.\n\n");
+
+        posY = Draw_DrawString(10, posY, COLOR_RED, "WARNING: \n");
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "  * value will be limited by calibration.\n");
+        posY = Draw_DrawString(10, posY, COLOR_WHITE, "  * bottom framebuffer will be restored until\nyou exit.");
+        Draw_FlushFramebuffer();
+        Draw_Unlock();
+
+        u32 pressed = waitInputWithTimeout(1000);
+
+        if (pressed & KEY_A)
+            break;
+
+        if (pressed & KEY_B)
+            return;
+    }
+    while (!menuShouldExit);
+
+    Draw_Lock();
+
+    Draw_RestoreFramebuffer();
+    Draw_FreeFramebufferCache();
+
+    svcKernelSetState(0x10000, 2); // unblock gsp
+    gspLcdInit(); // assume it doesn't fail. If it does, brightness won't change, anyway.
+
+    // gsp:LCD will normalize the brightness between top/bottom screen, handle PWM, etc.
+
+    s32 lum = (s32)luminance;
+
+    do
+    {
+        u32 pressed = waitInputWithTimeout(1000);
+        if (pressed & DIRECTIONAL_KEYS)
+        {
+            if (pressed & KEY_UP)
+                lum += 1;
+            else if (pressed & KEY_DOWN)
+                lum -= 1;
+            else if (pressed & KEY_RIGHT)
+                lum += 10;
+            else if (pressed & KEY_LEFT)
+                lum -= 10;
+
+            lum = lum < (s32)minLum ? (s32)minLum : lum;
+            lum = lum > (s32)maxLum ? (s32)maxLum : lum;
+
+            // We need to call gsp here because updating the active duty LUT is a bit tedious (plus, GSP has internal state).
+            // This is actually SetLuminance:
+            GSPLCD_SetBrightnessRaw(BIT(GSP_SCREEN_TOP) | BIT(GSP_SCREEN_BOTTOM), lum);
+        }
+
+        if (pressed & KEY_B)
+            break;
+    }
+    while (!menuShouldExit);
+
+    gspLcdExit();
+    svcKernelSetState(0x10000, 2); // block gsp again
+
+    if (R_FAILED(Draw_AllocateFramebufferCache(FB_BOTTOM_SIZE)))
+    {
+        // Shouldn't happen
+        __builtin_trap();
+    }
+    else
+        Draw_SetupFramebuffer();
+
+    Draw_Unlock();
+}

sysmodules/rosalina/source/minisoc.c

@@ -110,7 +110,7 @@ Result miniSocInit(void)
     ret = srvGetServiceHandle(&miniSocHandle, "soc:U");
     if(ret != 0) goto cleanup;
 
-    ret = svcControlMemoryEx(&tmp, socContextAddr, 0, socContextSize, MEMOP_ALLOC, MEMREGION_SYSTEM | MEMPERM_READ | MEMPERM_WRITE, true);
+    ret = svcControlMemoryEx(&tmp, socContextAddr, 0, socContextSize, MEMOP_ALLOC | MEMOP_REGION_SYSTEM, MEMPERM_READ | MEMPERM_WRITE, true);
     if(ret != 0) goto cleanup;
 
     socContextAddr = tmp;

sysmodules/rosalina/source/plugin/file_loader.c

@@ -142,7 +142,7 @@ static Result   CheckPluginCompatibility(_3gx_Header *header, u32 processTitle)
     return -1;
 }
 
-bool     TryToLoadPlugin(Handle process)
+bool     TryToLoadPlugin(Handle process, bool isHomebrew)
 {
     u64             tid;
     u64             fileSize;
@@ -168,9 +168,9 @@ bool     TryToLoadPlugin(Handle process)
     pluginHeader->magic = HeaderMagic;
 
     // Try to open plugin file
-    if (ctx->useUserLoadParameters && (u32)tid == ctx->userLoadParameters.lowTitleId)
+    if (ctx->useUserLoadParameters && (ctx->userLoadParameters.lowTitleId == 0 || (u32)tid == ctx->userLoadParameters.lowTitleId))
     {
-        ctx->useUserLoadParameters = false;
+        if (!ctx->userLoadParameters.persistent) ctx->useUserLoadParameters = false;
         ctx->pluginMemoryStrategy = ctx->userLoadParameters.pluginMemoryStrategy;
         if (OpenFile(&plugin, ctx->userLoadParameters.path))
             return false;
@@ -205,6 +205,27 @@ bool     TryToLoadPlugin(Handle process)
     if (!res && R_FAILED((res = Read_3gx_Header(&plugin, &fileHeader))))
         ctx->error.message = "Couldn't read file";
 
+    // Check compatibility
+    if (!res && fileHeader.infos.compatibility == PLG_COMPAT_EMULATOR) {
+        ctx->error.message = "Plugin is only compatible with emulators";
+        res = -1;
+    }
+
+    // Check if plugin can load on homebrew
+    if (!res && (isHomebrew && !fileHeader.infos.allowHomebrewLoad)) {
+        // Do not display message as this is a common case
+        ctx->error.message = NULL;
+        res = -1;
+    }
+
+    // Flags
+    if (!res) {
+        ctx->eventsSelfManaged = fileHeader.infos.eventsSelfManaged;
+        ctx->isMemPrivate = fileHeader.infos.usePrivateMemory;
+        if (ctx->pluginMemoryStrategy == PLG_STRATEGY_SWAP && fileHeader.infos.swapNotNeeded)
+            ctx->pluginMemoryStrategy = PLG_STRATEGY_NONE;
+    }
+
     // Set memory region size according to header
     if (!res && R_FAILED((res = MemoryBlock__SetSize(memRegionSizes[fileHeader.infos.memoryRegionSize])))) {
         ctx->error.message = "Couldn't set memblock size.";
@@ -249,6 +270,7 @@ bool     TryToLoadPlugin(Handle process)
     }
 
     pluginHeader->version = header->version;
+    pluginHeader->waitForReplyTimeout = 10000000000ULL;
     // Code size must be page aligned
     exeHdr = &header->executable;
     pluginHeader->exeSize = (sizeof(PluginHeader) + exeHdr->codeSize + exeHdr->rodataSize + exeHdr->dataSize + exeHdr->bssSize + 0x1000) & ~0xFFF;
@@ -279,7 +301,7 @@ bool     TryToLoadPlugin(Handle process)
 
         extern u32  g_savedGameInstr[2];
 
-        if (R_FAILED((res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, procStart, process, procStart, 0x1000))))
+        if (R_FAILED((res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, procStart, process, procStart, 0x1000, 0))))
         {
             ctx->error.message = "Couldn't map process";
             ctx->error.code = res;

sysmodules/rosalina/source/plugin/memoryblock.c

@@ -205,11 +205,12 @@ Result     MemoryBlock__MountInProcess(void)
     Error           *error = &PluginLoaderCtx.error;
     PluginHeader    *header = &PluginLoaderCtx.header;
     MemoryBlock     *memblock = &PluginLoaderCtx.memblock;
+    bool            isPrivate = PluginLoaderCtx.isMemPrivate;
 
     Result       res = 0;
 
     // Executable
-    if (R_FAILED((res = svcMapProcessMemoryEx(target, 0x07000000, CUR_PROCESS_HANDLE, (u32)memblock->memblock, header->exeSize))))
+    if (R_FAILED((res = svcMapProcessMemoryEx(target, 0x07000000, CUR_PROCESS_HANDLE, (u32) memblock->memblock, header->exeSize, isPrivate ? MAPEXFLAGS_PRIVATE : 0))))
     {
         error->message = "Couldn't map exe memory block";
         error->code = res;
@@ -217,7 +218,7 @@ Result     MemoryBlock__MountInProcess(void)
     }
 
     // Heap (to be used by the plugin)
-    if (R_FAILED((res = svcMapProcessMemoryEx(target, header->heapVA, CUR_PROCESS_HANDLE, (u32)memblock->memblock + header->exeSize, header->heapSize))))
+    if (R_FAILED((res = svcMapProcessMemoryEx(target, header->heapVA, CUR_PROCESS_HANDLE, (u32) memblock->memblock + header->exeSize, header->heapSize, isPrivate ? MAPEXFLAGS_PRIVATE : 0))))
     {
         error->message = "Couldn't map heap memory block";
         error->code = res;
@@ -233,7 +234,7 @@ Result     MemoryBlock__UnmountFromProcess(void)
 
     Result  res = 0;
 
-    res = svcUnmapProcessMemoryEx(target, 0x07000000, header->exeSize);
+    res |= svcUnmapProcessMemoryEx(target, 0x07000000, header->exeSize);
     res |= svcUnmapProcessMemoryEx(target, header->heapVA, header->heapSize);
 
     return res;
@@ -277,5 +278,5 @@ void       MemoryBlock__ResetSwapSettings(void)
 
 PluginHeader* MemoryBlock__GetMappedPluginHeader() {
     MemoryBlock     *memblock = &PluginLoaderCtx.memblock;
-    return memblock->isReady ? NULL : (PluginHeader*)memblock->memblock;
+    return memblock->isReady ? (PluginHeader*)memblock->memblock : NULL;
 }

sysmodules/rosalina/source/plugin/plgldr.c

@@ -113,7 +113,7 @@ Result  PLGLDR__SetPluginLoadParameters(PluginLoadParameters *parameters)
     }
     return res;
 }
-void     Flash(u32 color);
+
 Result  PLGLDR__DisplayMenu(PluginMenu *menu)
 {
     Result res = 0;
@@ -136,7 +136,6 @@ Result  PLGLDR__DisplayMenu(PluginMenu *menu)
     {
         res = cmdbuf[1];
     }
-    else Flash(0xFF0000);
 
     return res;
 }

sysmodules/rosalina/source/plugin/plgloader.c

@@ -10,17 +10,16 @@
 #include "sleep.h"
 #include "task_runner.h"
 
-#define PLGLDR_VERSION (SYSTEM_VERSION(1, 0, 1))
+#define PLGLDR_VERSION (SYSTEM_VERSION(1, 0, 2))
 
 #define THREADVARS_MAGIC  0x21545624 // !TV$
 
+#define PERS_USER_FILE_MAGIC 0x53524550 // PERS
+
 static const char *g_title = "Plugin loader";
 PluginLoaderContext PluginLoaderCtx;
 extern u32 g_blockMenuOpen;
 
-void        IR__Patch(void);
-void        IR__Unpatch(void);
-
 void        PluginLoader__Init(void)
 {
     PluginLoaderContext *ctx = &PluginLoaderCtx;
@@ -43,6 +42,24 @@ void        PluginLoader__Init(void)
     assertSuccess(svcCreateEvent(&ctx->kernelEvent, RESET_ONESHOT));
 
     svcKernelSetState(0x10007, ctx->kernelEvent, 0, 0);
+
+    IFile file;
+    if (R_SUCCEEDED(IFile_Open(&file, ARCHIVE_SDMC, fsMakePath(PATH_EMPTY, ""), fsMakePath(PATH_ASCII, "/luma/plugins/user_param.bin"), FS_OPEN_READ)))
+    {
+        PluginLoadParameters *params = &ctx->userLoadParameters;
+        u64 temp_read;
+        u32 magic = 0;
+        if (R_SUCCEEDED(IFile_Read(&file, &temp_read, &magic, sizeof(magic))) && temp_read == sizeof(magic) && magic == PERS_USER_FILE_MAGIC
+            && R_SUCCEEDED(IFile_Read(&file, &temp_read, params, sizeof(PluginLoadParameters))) && temp_read == sizeof(PluginLoadParameters))
+        {
+            ctx->useUserLoadParameters = true;
+        }
+        else
+        {
+            memset(params, 0, sizeof(PluginLoadParameters));
+        }
+        IFile_Close(&file);
+    }
 }
 
 void    PluginLoader__Error(const char *message, Result res)
@@ -76,7 +93,7 @@ void        PluginLoader__UpdateMenu(void)
 static ControlApplicationMemoryModeOverrideConfig g_memorymodeoverridebackup = { 0 };
 Result  PluginLoader__SetMode3AppMode(bool enable)
 {
-	Handle loaderHandle;
+    Handle loaderHandle;
     Result res = srvGetServiceHandle(&loaderHandle, "Loader");
 
     if (R_FAILED(res)) return res;
@@ -85,7 +102,7 @@ Result  PluginLoader__SetMode3AppMode(bool enable)
 
     if (enable) {
         ControlApplicationMemoryModeOverrideConfig* mode = (ControlApplicationMemoryModeOverrideConfig*)&cmdbuf[1];
-        
+
         memset(mode, 0, sizeof(ControlApplicationMemoryModeOverrideConfig));
         mode->query = true;
         cmdbuf[0] = IPC_MakeHeader(0x101, 1, 0); // ControlApplicationMemoryModeOverride
@@ -110,16 +127,12 @@ Result  PluginLoader__SetMode3AppMode(bool enable)
             res = cmdbuf[1];
         }
     }
-    
-	svcCloseHandle(loaderHandle);
+
+    svcCloseHandle(loaderHandle);
     return res;
 }
 static void j_PluginLoader__SetMode3AppMode(void* arg) {(void)arg; PluginLoader__SetMode3AppMode(false);}
 
-void CheckMemory(void);
-
-void    PLG__NotifyEvent(PLG_Event event, bool signal);
-
 void     PluginLoader__HandleCommands(void *_ctx)
 {
     (void)_ctx;
@@ -131,7 +144,7 @@ void     PluginLoader__HandleCommands(void *_ctx)
     {
         case 1: // Load plugin
         {
-            if (cmdbuf[0] != IPC_MakeHeader(1, 1, 0))
+            if (cmdbuf[0] != IPC_MakeHeader(1, 2, 0))
             {
                 error(cmdbuf, 0xD9001830);
                 break;
@@ -144,7 +157,7 @@ void     PluginLoader__HandleCommands(void *_ctx)
                 TaskRunner_RunTask(j_PluginLoader__SetMode3AppMode, NULL, 0);
 
             bool flash = !(ctx->useUserLoadParameters && ctx->userLoadParameters.noFlash);
-            if (ctx->isEnabled && TryToLoadPlugin(ctx->target))
+            if (ctx->isEnabled && TryToLoadPlugin(ctx->target, cmdbuf[2]))
             {
                 if (flash)
                 {
@@ -156,8 +169,6 @@ void     PluginLoader__HandleCommands(void *_ctx)
                     }
                     REG32(0x10202204) = 0;
                 }
-                //if (!ctx->userLoadParameters.noIRPatch)
-                //    IR__Patch();
                 PLG__SetConfigMemoryStatus(PLG_CFG_RUNNING);
             }
             else
@@ -218,11 +229,25 @@ void     PluginLoader__HandleCommands(void *_ctx)
             ctx->useUserLoadParameters = true;
             params->noFlash = cmdbuf[1] & 0xFF;
             params->pluginMemoryStrategy = (cmdbuf[1] >> 8) & 0xFF;
+            params->persistent = (cmdbuf[1] >> 16) & 0x1;
             params->lowTitleId = cmdbuf[2];
-            
+
             strncpy(params->path, (const char *)cmdbuf[4], 255);
             memcpy(params->config, (void *)cmdbuf[6], 32 * sizeof(u32));
 
+            if (params->persistent)
+            {
+                IFile file;
+                if (R_SUCCEEDED(IFile_Open(&file, ARCHIVE_SDMC, fsMakePath(PATH_EMPTY, ""), fsMakePath(PATH_ASCII, "/luma/plugins/user_param.bin"),
+                                           FS_OPEN_CREATE | FS_OPEN_READ | FS_OPEN_WRITE))) {
+                    u64 tempWritten;
+                    u32 magic = PERS_USER_FILE_MAGIC;
+                    IFile_Write(&file, &tempWritten, &magic, sizeof(magic), 0);
+                    IFile_Write(&file, &tempWritten, params, sizeof(PluginLoadParameters), 0);
+                    IFile_Close(&file);
+                }
+            }
+
             if (params->pluginMemoryStrategy == PLG_STRATEGY_MODE3)
                 cmdbuf[1] = PluginLoader__SetMode3AppMode(true);
             else
@@ -342,9 +367,9 @@ void     PluginLoader__HandleCommands(void *_ctx)
                 error(cmdbuf, 0xD9001830);
                 break;
             }
-            
+
             g_blockMenuOpen = cmdbuf[1];
-            
+
             cmdbuf[0] = IPC_MakeHeader(11, 1, 0);
             cmdbuf[1] = 0;
             break;
@@ -408,7 +433,7 @@ void     PluginLoader__HandleCommands(void *_ctx)
                 Reset_3gx_LoadParams();
                 break;
             }
-            
+
             ctx->isExeLoadFunctionset = true;
 
             svcInvalidateEntireInstructionCache(); // Could use the range one
@@ -417,6 +442,28 @@ void     PluginLoader__HandleCommands(void *_ctx)
             break;
         }
 
+        case 14: // Clear user load parameters
+        {
+            if (cmdbuf[0] != IPC_MakeHeader(14, 0, 0))
+            {
+                error(cmdbuf, 0xD9001830);
+                break;
+            }
+
+            ctx->useUserLoadParameters = false;
+            memset(&ctx->userLoadParameters, 0, sizeof(PluginLoadParameters));
+
+            FS_Archive sd;
+            if(R_SUCCEEDED(FSUSER_OpenArchive(&sd, ARCHIVE_SDMC, fsMakePath(PATH_EMPTY, ""))))
+            {
+                FSUSER_DeleteFile(sd, fsMakePath(PATH_ASCII, "/luma/plugins/user_param.bin"));
+                FSUSER_CloseArchive(sd);
+            }
+
+            cmdbuf[1] = 0;
+            break;
+        }
+
         default: // Unknown command
         {
             error(cmdbuf, 0xD900182F);
@@ -449,7 +496,7 @@ static void     __strex__(s32 *addr, s32 val)
 
 void    PLG__NotifyEvent(PLG_Event event, bool signal)
 {
-    if (!PluginLoaderCtx.plgEventPA) return;
+    if (PluginLoaderCtx.eventsSelfManaged || !PluginLoaderCtx.plgEventPA) return;
 
     __strex__(PluginLoaderCtx.plgEventPA, event);
     if (signal)
@@ -458,8 +505,9 @@ void    PLG__NotifyEvent(PLG_Event event, bool signal)
 
 void    PLG__WaitForReply(void)
 {
+    if (PluginLoaderCtx.eventsSelfManaged) return;
     __strex__(PluginLoaderCtx.plgReplyPA, PLG_WAIT);
-    svcArbitrateAddress(PluginLoaderCtx.arbiter, (u32)PluginLoaderCtx.plgReplyPA, ARBITRATION_WAIT_IF_LESS_THAN_TIMEOUT, PLG_OK, 10000000000ULL);
+    svcArbitrateAddress(PluginLoaderCtx.arbiter, (u32)PluginLoaderCtx.plgReplyPA, ARBITRATION_WAIT_IF_LESS_THAN_TIMEOUT, PLG_OK, MemoryBlock__GetMappedPluginHeader()->waitForReplyTimeout);
 }
 
 void     PLG__SetConfigMemoryStatus(u32 status)
@@ -482,9 +530,9 @@ static void WaitForProcessTerminated(void *arg)
     (void)arg;
     PluginLoaderContext *ctx = &PluginLoaderCtx;
 
-    // Wait until all threads of the process have finished (svcWaitSynchronization == 0) or 5 seconds have passed.
-    for (u32 i = 0; svcWaitSynchronization(ctx->target, 0) != 0 && i < 100; i++) svcSleepThread(50000000); // 50ms
-    
+    // Wait until all threads of the process have finished (svcWaitSynchronization == 0) or 2.5 seconds have passed.
+    for (u32 i = 0; svcWaitSynchronization(ctx->target, 0) != 0 && i < 50; i++) svcSleepThread(50000000); // 50ms
+
     // Unmap plugin's memory before closing the process
     if (!ctx->pluginIsSwapped) {
         MemoryBlock__UnmountFromProcess();
@@ -500,10 +548,10 @@ static void WaitForProcessTerminated(void *arg)
     ctx->isExeLoadFunctionset = false;
     ctx->isSwapFunctionset = false;
     ctx->pluginMemoryStrategy = PLG_STRATEGY_SWAP;
+    ctx->eventsSelfManaged = false;
+    ctx->isMemPrivate = false;
     g_blockMenuOpen = 0;
     MemoryBlock__ResetSwapSettings();
-    //if (!ctx->userLoadParameters.noIRPatch)
-    //    IR__Unpatch();
 }
 
 void    PluginLoader__HandleKernelEvent(u32 notifId)
@@ -563,7 +611,9 @@ void    PluginLoader__HandleKernelEvent(u32 notifId)
             ctx->pluginIsSwapped = !ctx->pluginIsSwapped;
         } else {
             // Needed for compatibility with old plugins that don't expect the PLG_HOME events.
-            volatile PluginHeader* mappedHeader = PA_FROM_VA_PTR(MemoryBlock__GetMappedPluginHeader());
+            // Evades cache by using physical address.
+            volatile PluginHeader* mappedHeader = MemoryBlock__GetMappedPluginHeader();
+            mappedHeader = mappedHeader ? PA_FROM_VA_PTR(mappedHeader) : NULL;
             bool doNotification = mappedHeader ? mappedHeader->notifyHomeEvent : false;
             if (ctx->pluginIsHome)
             {
@@ -582,12 +632,11 @@ void    PluginLoader__HandleKernelEvent(u32 notifId)
                     PLG__NotifyEvent(PLG_HOME_ENTER, false);
                     // Wait for plugin reply
                     PLG__WaitForReply();
-                }                
+                }
                 PLG__SetConfigMemoryStatus(PLG_CFG_INHOME);
             }
             ctx->pluginIsHome = !ctx->pluginIsHome;
         }
-        
     }
     srvPublishToSubscriber(0x1002, 0);
 }

sysmodules/rosalina/source/process_patches.c

@@ -77,7 +77,7 @@ Result OperateOnProcessByName(const char *name, OperateOnProcessCb func)
 
     // NOTE: we suppose .text, .rodata, .data+.bss are contiguous & in that order
     u32 totalSize = (u32)(textSize + roSize + rwSize);
-    if (R_FAILED(res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, 0x00100000, processHandle, (u32) startAddress, totalSize)))
+    if (R_FAILED(res = svcMapProcessMemoryEx(CUR_PROCESS_HANDLE, 0x00100000, processHandle, (u32) startAddress, totalSize, 0)))
     {
         svcCloseHandle(processHandle);
         return res;

sysmodules/rosalina/source/task_runner.c

@@ -5,7 +5,7 @@
 TaskRunner g_taskRunner;
 
 static MyThread taskRunnerThread;
-static u8 ALIGN(8) taskRunnerThreadStack[0x1000];
+static u8 CTR_ALIGN(8) taskRunnerThreadStack[0x1000];
 
 static void taskRunnerNoOpFunction(void *args)
 {

sysmodules/sm/source/main.c

@@ -22,7 +22,7 @@ SessionDataList sessionDataWaitingPortReadyList = {NULL, NULL};
 static SessionData sessionDataPool[76];
 static ProcessData processDataPool[64];
 
-static u8 ALIGN(4) serviceAccessListStaticBuffer[0x110];
+static u8 CTR_ALIGN(4) serviceAccessListStaticBuffer[0x110];
 
 void __ctru_exit(int rc) { (void)rc; } // needed to avoid linking error