Add NX2_NOTES.md and Switch 2 analysis helpers

npdm_info.py dumps META/ACI0 and kernel caps; nso_dis.py disassembles
part of an NSO with clang + llvm-objdump.

4 files changed, 187 insertions, 0 deletions

diff --git a/NX2_NOTES.md b/NX2_NOTES.md
new file mode 100644
index 0000000000..1bc145c485
--- /dev/null
+++ b/NX2_NOTES.md
@@ -0,0 +1,99 @@
+# Eden on Switch 2 titles (branch `nx2`)
+
+Local experiment: get Eden (Switch 1 emulator) to load a Switch 2 title's loose ExeFS and push
+boot as far as it goes. Nothing here is upstreamed or pushed. Graphics (Ampere / NVN2) is out of
+scope for this pass.
+
+## Setup
+
+- Source + build live in `C:\dev\eden` (a worktree of `eden-nx2/`, branch `nx2`). The original
+  working folder path is ~180 chars, and `cl.exe` can't open its PDB from a build folder there
+  (C1041), so the build moved to a short path.
+- Toolchain: VS 2026 (MSVC 14.51) via `vcvars64.bat`, Ninja from VS, CMake 4.4.
+- Configure:
+  `cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_INTERMEDIATE_DIR_STRATEGY=SHORT -DENABLE_QT=OFF -DYUZU_CMD=ON -DENABLE_WEB_SERVICE=OFF -DYUZU_ROOM=OFF -DYUZU_TESTS=OFF -DENABLE_WERROR=OFF -DENABLE_UPDATE_CHECKER=OFF`
+- Build: `cmake --build build --target yuzu-cmd` -> `build/bin/eden-cli.exe`.
+- Run (portable mode, `build/bin/user/` holds config/logs; no keys or firmware installed):
+  `eden-cli.exe -g "<title>\exefs\main"`
+- Debug helpers:
+  - `EDEN_NX2_SVC_TRACE=1` logs every SVC with arguments and results.
+  - `tools/nx2/a64_coverage.py <a64.inc> <nso>...` lists encodings in an NSO's .text that
+    dynarmic's decoder table doesn't match.
+  - `tools/nx2/npdm_info.py <main.npdm>` dumps the META/ACI0 header, services and kernel caps.
+  - `tools/nx2/nso_dis.py <llvm bin> <nso> <text_off> <count> <workdir>` disassembles part of an
+    NSO's .text (clang + llvm-objdump from VS 2022's LLVM).
+  - Under cdb, stop only on second-chance AVs (`sxd -c2 "..." av`): dynarmic fastmem uses
+    first-chance access violations.
+
+## Titles
+
+All three titles with a `main.npdm` share the same layout: 64-bit, 39-bit address space,
+ThreadInfo cores 0..5 (core mask 0x3f), priorities 28..59, KernelVersion cap 9.1, SVCs 0x01-0x36
+plus 0x80, Switch 2 ACID layout. The fourth title's ExeFS has no `main.npdm`.
+
+## Blockers hit, in order
+
+| # | Where it stopped | Cause | Fix (commit) |
+|---|---|---|---|
+| 1 | CMake try-compile | C1041, PDB path ~290 chars | build in `C:\dev\eden` |
+| 2 | Compile | MSVC 14.51: `reinterpret_cast<u64>(ULONG_PTR)`, C4505 on amalgamated zstd.c, C4800 int->bool | Fix build with MSVC 14.51 |
+| 3 | Decoder | dynarmic had no LSE atomics, CAS/CASP, LDAPR, RETAA/RETAB, BRA*/BLRA*, LDRA*, PAC*/AUT*/XPAC*, PACGA, MTE ops. Title 1 has ~115k RETAB, ~37k LDAPR, ~25k LSE, ~6.6k CAS, ~2.5k SWP | dynarmic: decode ARMv8.1-8.5 instructions (atomics are exclusive load/op/store with retry; PAC is identity; MTE tags are 0) |
+| 4 | Loader | `main` identified as a bare NSO, so main.npdm/rtld/sdk were skipped, then a crash writing into an uninitialised process | loader: load a loose ExeFS when given its main |
+| 5 | NPDM parse (ErrorBadFileAccessControl) | Switch 2 ACID has a 0x300-byte signature/key area (Switch 1: 0x200); FAC/FAH offsets were also read without the block base | npdm: parse the Switch 2 ACID layout |
+| 6 | eden-cli crash on start/exit | `*appstate` never set, SDL3 callbacks returned SUCCESS (quit), InputSubsystem was a local of SDL_AppInit, mouse timer before mouse driver | eden-cli: fix SDL3 main-callback lifetime bugs |
+| 7 | `nnosInitialize` abort | `svcGetInfo` 29/30 unknown (region between alias and ASLR) | kernel: stub ids 29/30 (empty region after alias) |
+| 8 | `VammManager::InitializeIfEnabled` abort | `svcGetInfo` 33 unknown; it's a page granule (module ranges are checked against `value-1`; VAMM maps one granule first) | return 0x1000 |
+| 9 | `nn::am::InitializeApplicationInterfaces` | `appletOE` cmd 10 (Switch 2 OpenApplicationProxy) | alias to cmd 0 |
+| 10 | same | `IApplicationProxy` cmds 60 and 40: new getters | return a generic `nx2:` stub interface (`nx2_stub_interface.h`); calls on it are auto-stubbed and logged |
+| 11 | `nn::oe::SetupGpuErrorHandler` -> CreateThread | thread on virtual core 5; Eden emulates 4 cores | fold virtual cores 4/5 onto 0/1 in CreateThread/SetThreadCoreMask |
+| 12 | (title 3) `nn::oe` init | `IApplicationFunctions` 320 has no handler | empty-success stub |
+
+Also changed: `svcGetInfo` 29/30 now report the upper half of the alias region instead of an
+empty region (guess: VAMM address space). It made no visible difference for title 1.
+
+Run settings used (in `build/bin/user/config/sdl2-config.ini`): `memory_layout_mode=4`
+(12 GB). With the default 4 GB layout title 1 picks a 1.6 GB heap; with 12 GB it picks 6.5 GB.
+Both stop at the same point. No GPU/nvdrv call is reached yet in any title.
+
+## Where it stops now
+
+**Title 1** (`first switch game`, program id 0400C3F00006E000, main module `Drive.nss`):
+rtld -> nn::init -> nnosInitialize -> VAMM -> nn::oe (applet proxy, window, focus) all complete;
+the game's own static initializers run. It then builds an SDK allocator object at address 0
+(writes to 0x0..0xF8; vtable 0x...14d8 inside sdk) and calls through its null function pointer
+(`main+0xF04E8 blr x8`, PC=0). The chain starts at `main+0xCF25A8`, which fills a settings struct
+with a fixed 0x1BD600000 (7.46 GB) budget and 0xB000000/0xC000000 sizes. Whatever should supply
+the object's memory returns 0 without any failing SVC or IPC call in the trace. The next step is to
+find that source, probably an SDK memory API whose Switch 2 behaviour differs (VAMM / address
+region / `nn::mem`).
+
+**Title 2** (`second switch game`): can't be tested with these files. Its rtld is intact, but the
+`main`, `sdk` and `subsdk0` segments fail LZ4 decompression or their SHA-256 check (checked with
+`a64_coverage.py`'s decoder and Eden's `nso.cpp:124`). The dump/extraction needs redoing.
+
+**Title 3** (`third switch game`, 04005B902517C000): same path as title 1 through nn::oe, then
+`IApplicationFunctions` 321 (unknown) and an abort with result 2002-1002 (fs, path not found) from
+game code. Most likely the game's first file/RomFS mount; the title's `romfs/` folder isn't wired up
+for loose-ExeFS boots yet.
+
+**Title 4** (`fourth switch game/base/exefs`): ExeFS has `main` but no `main.npdm`; not run.
+
+## Prioritized next steps
+
+1. **Title 1 null allocator**: break at `main+0xCF25A8` (cdb or the SVC trace plus a dynarmic
+   breakpoint) and find which SDK call should hand back the allocator's memory. Likely a
+   VAMM/address-region or `nn::mem` API that relies on the ids 29/30/33 semantics guessed here.
+2. **Pin down the new svcGetInfo ids (29, 30, 33)** from the SDK code that consumes them; they
+   decide memory layout for every later step.
+3. **RomFS/save for loose ExeFS** (title 3's 2002-1002): mount `../romfs` next to `exefs`, then
+   trace the fs IPC that fails.
+4. **New IPC commands**: `IApplicationProxy` 40/60 (now stub interfaces; log what is called on
+   them), `IApplicationFunctions` 321, `appletOE` 10 args. Each needs its real reply layout.
+5. **Six cores**: the folding hack works for boot but changes scheduling; a 6-core kernel/CPU
+   manager would be more faithful.
+6. **Rare SIMD encodings** still undecoded (~60 in title 1, e.g. `5f119f9c`, `4ea05c42`,
+   `0f413044`): FP16 by-element / v8.2 SIMD forms. They'll trap when reached.
+7. **GPU**: nvdrv/NVN2 (Ampere) is untouched; every title will stop at its first nvdrv ioctl once
+   the steps above are done. Start by logging nvdrv ioctls and stubbing what blocks boot.
+8. Upstream-worthy pieces independent of Switch 2: MSVC 14.51 build fixes, eden-cli SDL3
+   lifetime fixes, the ExeFS loader fix, FAC/FAH offset fix.
diff --git a/tools/nx2/.gitignore b/tools/nx2/.gitignore
new file mode 100644
index 0000000000..c18dd8d83c
--- /dev/null
+++ b/tools/nx2/.gitignore
@@ -0,0 +1 @@
+__pycache__/
diff --git a/tools/nx2/npdm_info.py b/tools/nx2/npdm_info.py
new file mode 100644
index 0000000000..20fe713163
--- /dev/null
+++ b/tools/nx2/npdm_info.py
@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+# Print the META header and kernel capabilities of a main.npdm (read only).
+import struct
+import sys
+
+d = open(sys.argv[1], "rb").read()
+assert d[:4] == b"META"
+flags = d[0xC]
+print(f"META flags=0x{flags:02x} is64={flags & 1} address_space_type={(flags >> 1) & 7} "
+      f"prio={d[0xE]} core={d[0xF]} sys_res=0x{struct.unpack_from('<I', d, 0x10)[0]:x} "
+      f"version=0x{struct.unpack_from('<I', d, 0x14)[0]:x} stack=0x{struct.unpack_from('<I', d, 0x1C)[0]:x} "
+      f"name={d[0x20:0x30].rstrip(bytes(1)).decode(errors='replace')}")
+aci_off, aci_sz, acid_off, acid_sz = struct.unpack_from("<IIII", d, 0x70)
+print(f"ACI0 @0x{aci_off:x}+0x{aci_sz:x}  ACID @0x{acid_off:x}+0x{acid_sz:x}")
+a = d[aci_off:aci_off + aci_sz]
+assert a[:4] == b"ACI0", a[:4]
+pid = struct.unpack_from("<Q", a, 0x10)[0]
+fs_off, fs_sz, sac_off, sac_sz, kc_off, kc_sz = struct.unpack_from("<IIIIII", a, 0x20)
+print(f"program_id={pid:016x}  fs=0x{fs_sz:x} sac=0x{sac_sz:x} kc=0x{kc_sz:x}")
+sac = a[sac_off:sac_off + sac_sz]
+i, names = 0, []
+while i < len(sac):
+    ctl = sac[i]
+    n = (ctl & 7) + 1
+    names.append(("S:" if ctl & 0x80 else "") + sac[i + 1:i + 1 + n].decode(errors="replace"))
+    i += 1 + n
+print("services:", " ".join(names))
+kc = a[kc_off:kc_off + kc_sz]
+svcs = set()
+for (cap,) in struct.iter_unpack("<I", kc):
+    if cap == 0xFFFFFFFF:
+        continue
+    t = (~cap & (cap + 1)).bit_length() - 1  # number of trailing ones
+    if t == 3:
+        lo, hi = cap >> 4 & 0x3F, cap >> 10 & 0x3F
+        cl, ch = cap >> 16 & 0xFF, cap >> 24
+        print(f"  ThreadInfo prio {lo}..{hi} cores {cl}..{ch}")
+    elif t == 4:
+        idx, mask = cap >> 29, cap >> 5 & 0xFFFFFF
+        for b in range(24):
+            if mask >> b & 1:
+                svcs.add(idx * 24 + b)
+    elif t == 6:
+        print(f"  MapRange 0x{cap:08x}")
+    elif t == 7:
+        print(f"  MapIoPage 0x{cap:08x}")
+    elif t == 10:
+        print(f"  MapRegion 0x{cap:08x}")
+    elif t == 11:
+        print(f"  EnableInterrupts 0x{cap:08x}")
+    elif t == 13:
+        print(f"  ProgramType {cap >> 14 & 7}")
+    elif t == 14:
+        print(f"  KernelVersion {cap >> 19 & 0x1FFF}.{cap >> 15 & 0xF}")
+    elif t == 15:
+        print(f"  HandleTableSize {cap >> 16 & 0x3FF}")
+    elif t == 16:
+        print(f"  DebugFlags 0x{cap:08x}")
+    else:
+        print(f"  unknown cap type {t}: 0x{cap:08x}")
+print("SVCs:", " ".join(f"{s:02x}" for s in sorted(svcs)))
diff --git a/tools/nx2/nso_dis.py b/tools/nx2/nso_dis.py
new file mode 100644
index 0000000000..5e899b0264
--- /dev/null
+++ b/tools/nx2/nso_dis.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+# Disassemble a range of an NSO's .text using clang + llvm-objdump.
+# Usage: nso_dis.py <llvm bin dir> <nso> <text_offset_hex> <count> <work dir>
+# The NSO is only read; scratch files go to <work dir>.
+import subprocess
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from a64_coverage import nso_text  # noqa: E402
+
+llvm, nso, off, count, work = sys.argv[1], sys.argv[2], int(sys.argv[3], 16), int(sys.argv[4]), Path(sys.argv[5])
+work.mkdir(parents=True, exist_ok=True)
+text = nso_text(nso)
+words = [int.from_bytes(text[i:i + 4], "little") for i in range(off, off + count * 4, 4)]
+# .inst (not .incbin) so the bytes get a code mapping symbol and objdump decodes them.
+(work / "range.s").write_text(".text\n" + "".join(f".inst 0x{w:08x}\n" for w in words))
+subprocess.run([str(Path(llvm) / "clang.exe"), "--target=aarch64-none-elf", "-c", "range.s", "-o", "range.o"],
+               cwd=work, check=True)
+out = subprocess.run([str(Path(llvm) / "llvm-objdump.exe"), "-d", "-j", ".text", "--no-show-raw-insn",
+                      "--mattr=+v8.5a,+mte,+lse,+rcpc,+pauth,+crc,+sha2,+dotprod,+fullfp16", "range.o"],
+                     cwd=work, capture_output=True, text=True, check=True).stdout
+for line in out.splitlines():
+    parts = line.split(":", 1)
+    if len(parts) == 2 and parts[0].strip() and all(c in "0123456789abcdef" for c in parts[0].strip()):
+        print(f"{off + int(parts[0], 16):08x}:{parts[1].strip()}")