Finalize locked CFW boot files via a pre-HOS swap payload

package3 and stratosphere.romfs are locked while Atmosphere runs and can't
be replaced in-session (proven by the [boot] logs). The boot payload must
match package3, so updating fusee/reboot_payload while package3 stays old
is the "incorrect fusee version" brick -- including via an RCM-injected
fusee.bin.

Fix: stage the whole version-matched boot set (package3,
stratosphere.romfs, reboot_payload.bin, root fusee.bin) as .ab_new and
never write any of them in place, so the old matched set always stays
consistent. Reboot into TegraExplorer (bundled, GPL), whose sd:/startup.te
renames the sidecars into place before HOS boots -- when they're unlocked
-- then chainloads the now-consistent CFW. Arming uses Atmosphere's bpc:ams
(amsBpcSetRebootPayload), done dead-last in main() after smExit(); Daybreak's
post-install reboot lands in the payload, so CFW + firmware still take one
reboot. CFW-only updates reboot via cfwMgrReboot.

If anything fails (arming, missing payload, power loss) the old set is
intact, so it just boots the old CFW and retries -- it cannot brick.

- lib/ams_bpc.{c,h}: vendored Atmosphere reboot-to-payload interface
- source/payload_swap.{c,h}: swapPending/swapPrepare/swapArm + startup.te
- romfs/TegraExplorer.bin: stock TegraExplorer v4.2.0 (GPL, suchmememanyskill)
- extract.c: force-stage the boot set, keep it off pending.txt
- firmware_mgr/cfw_mgr/main: arm the swap, clean up stray startup.te

Bump to 2.1.0.

Author: hexbyt3

Makefile

@@ -18,7 +18,7 @@ ROMFS		:=	romfs
 
 APP_TITLE	:=	AetherBlock
 APP_AUTHOR	:=	HeXbyt3
-APP_VERSION	:=	2.0.8
+APP_VERSION	:=	2.1.0
 
 #---------------------------------------------------------------------------------
 ARCH	:=	-march=armv8-a+crc+crypto -mtune=cortex-a57 -mtp=soft -fPIE

README.md

@@ -115,18 +115,18 @@ Atmosphere has to be updated before the reboot that loads the new firmware. New
 
 Extracting the CFW package just places files on the SD card; it doesn't touch the currently running system. The old Atmosphere keeps running in memory while you do everything else. The new files only matter at boot, which is why you can do CFW → firmware → one reboot back to back.
 
-### How AetherBlock Handles Locked Files
+### How AetherBlock Handles Locked Boot Files
 
-A couple of Atmosphere files (`package3`, `stratosphere.romfs`, and sometimes `AetherBlock.nro` itself) are held open by the running CFW and can't be overwritten with a plain file write. AetherBlock handles this transparently:
+`package3` and `stratosphere.romfs` are held open by the running Atmosphere and **cannot** be overwritten, renamed, or deleted while CFW is running — every in-session trick (plain write, stash-and-rename, libnx direct write) fails on them. The boot payload (`fusee.bin` / `reboot_payload.bin`) is the version-matched partner of `package3`; if the payload updates but `package3` doesn't, the console boots to a "incorrect fusee version" fatal. The only safe place to replace `package3` is **before HOS boots**, so AetherBlock finalizes the swap from a reboot payload:
 
-1. During CFW extraction, it first tries a direct write, then a stash-and-rename, then a libnx direct-write path that bypasses stdio's share semantics. Most files land at that stage.
-2. For anything that still refuses to budge, the new content is staged as `<file>.ab_new` and queued in `/config/AetherBlock/pending.txt`.
-3. Right before the post-Daybreak reboot, AetherBlock tries to swap the staged files into place using a backup-rename-restore pattern so the real file is never in a missing state.
-4. On the next launch after reboot, any sidecars that are still around get one more attempt — including a byte-for-byte content check so redundant `.ab_new` files get cleaned up automatically.
+1. During CFW extraction the whole version-matched boot set — `package3`, `stratosphere.romfs`, `atmosphere/reboot_payload.bin`, and the root `fusee.bin` — is staged as `<file>.ab_new` next to the originals and **never written in place**, even the files that aren't locked. That's deliberate: it guarantees neither the reboot payload nor an RCM-injected `fusee.bin` can ever get ahead of `package3`. The old, matched set stays fully in place — the running CFW is never left inconsistent, and no reboot path (normal, RCM jig, or cold boot) can pair a new fusee with an old `package3`.
+2. AetherBlock writes `sd:/startup.te` (a TegraScript) and arms **TegraExplorer** as the next reboot payload via Atmosphere's `bpc:ams` extension (`amsBpcSetRebootPayload`). Arming is done dead-last, after every other service is torn down, because it requires `smExit()`.
+3. The single reboot — Daybreak's post-install reboot, or AetherBlock's own for a CFW-only update — lands in TegraExplorer instead of fusee. Before any menu is drawn, `startup.te` renames each `.ab_new` into place (now unlocked, because HOS hasn't booted) and chainloads the now-consistent CFW.
+4. If anything goes wrong — arming fails, the payload is missing, power is lost — the old set is still intact, so the console simply boots the **old** CFW and the `.ab_new` files wait for a retry. A new fusee never meets an old `package3`, so this path **cannot brick**.
 
-Critically, libnx never flushes SD writes to the card on its own — `fclose` only drops the data into the filesystem cache. After every extraction, after every staged swap, and one final time right before control passes to Daybreak's reboot, AetherBlock calls `fsdevCommitDevice("sdmc")` to force everything to physically persist. Without this, a large file like the 8 MB `package3` can read back stale after the reboot even though every write reported success — leaving a new `fusee` paired with an old `package3` and the dreaded "incorrect fusee version" boot error.
+libnx also never flushes SD writes on its own (`fclose` only fills the FS cache), so AetherBlock calls `fsdevCommitDevice("sdmc")` after extraction, after writing `startup.te`, and on every log line, to guarantee everything is physically on the card before the reboot.
 
-The net effect: you never have to manually rename anything, stale sidecars don't accumulate on the SD card, and the boot files are guaranteed on-disk before the reboot.
+The bundled `romfs/TegraExplorer.bin` is the stock [TegraExplorer](https://github.com/suchmememanyskill/TegraExplorer) v4.2.0 release (GPL-2.0) by suchmememanyskill — used unmodified; it auto-runs `sd:/startup.te` on boot.
 
 ## Building
 

include/config.h

@@ -2,7 +2,7 @@
 #define CONFIG_H
 
 #define APP_NAME            "AetherBlock"
-#define APP_VERSION         "2.0.11"
+#define APP_VERSION         "2.1.0"
 #define APP_AUTHOR          "HeXbyt3"
 
 #define HOSTS_MAX_ENTRIES   256
@@ -41,6 +41,12 @@
 #define AETHERBLOCK_CONFIG_DIR "/config/AetherBlock/"
 #define FW_CLEANUP_MARKER_PATH "/config/AetherBlock/fw_cleanup_pending"
 
+/* pre-HOS swap: TegraExplorer payload + the script it auto-runs on boot.
+   Used to finalize locked boot files (package3, stratosphere.romfs,
+   reboot_payload.bin) that can't be replaced while Atmosphère is running. */
+#define SWAP_PAYLOAD_ROMFS     "romfs:/TegraExplorer.bin"
+#define STARTUP_TE_PATH        "/startup.te"
+
 /* diagnostics + download integrity */
 #define APP_LOG_PATH           "/config/AetherBlock/last_error.log"
 #define APP_LOG_MAX_SIZE       16384   /* rotate the log past this many bytes */

include/payload_swap.h

@@ -0,0 +1,37 @@
+#ifndef PAYLOAD_SWAP_H
+#define PAYLOAD_SWAP_H
+
+#include <stdbool.h>
+
+/*
+ * Finalizes a staged CFW update that couldn't be applied in-session.
+ *
+ * package3 / stratosphere.romfs (and, to keep the boot set atomic,
+ * reboot_payload.bin) are locked while Atmosphère runs and can only be
+ * replaced before HOS boots. We stage them as <file>.ab_new, then reboot into
+ * TegraExplorer, whose sd:/startup.te renames the sidecars into place and
+ * chainloads the now-consistent CFW. The old set stays fully in place until
+ * that swap runs, so a failure here can never brick -- it just boots the old
+ * CFW and leaves the sidecars for a retry.
+ */
+
+/* True if any boot-critical .ab_new sidecar is waiting to be swapped in. */
+bool swapPending(void);
+
+/* Write sd:/startup.te and load the TegraExplorer payload into memory.
+   Must be called while romfs and sdmc are still mounted. Returns 0 on
+   success. After this, call swapArm() once services are being torn down. */
+int swapPrepare(void);
+
+/* True once swapPrepare() has succeeded and an arm is owed. */
+bool swapIsPrepared(void);
+
+/* Stage the loaded payload as the next reboot target via Atmosphère's bpc
+   extension. MUST be called dead-last, after all other service cleanup,
+   because it calls smExit(). If reboot_now is true it also triggers the
+   reboot itself (CFW-only path); otherwise it just arms and returns so a
+   following Daybreak reboot lands in the payload. Erista-only; returns
+   negative and leaves the staged set untouched on Mariko or on failure. */
+int swapArm(bool reboot_now);
+
+#endif /* PAYLOAD_SWAP_H */

lib/ams_bpc.c

@@ -0,0 +1,39 @@
+#include "ams_bpc.h"
+
+/* bpc:ams is a named port exposed by Atmosphère's ams_mitm. We talk to it
+   directly via the kernel (svcConnectToNamedPort) rather than through sm --
+   which is why callers must smExit() before amsBpcInitialize(). Command 65001
+   is SetRebootPayload; it copies the supplied buffer into the live reboot
+   buffer and forces the next reboot to be a payload reboot. */
+
+static Service g_amsBpcSrv;
+static u64     g_refCnt;
+
+Result amsBpcInitialize(void) {
+    if (g_refCnt > 0) {
+        g_refCnt++;
+        return 0;
+    }
+
+    Handle h;
+    Result rc = svcConnectToNamedPort(&h, "bpc:ams");
+    if (R_SUCCEEDED(rc)) {
+        serviceCreate(&g_amsBpcSrv, h);
+        g_refCnt++;
+    }
+    return rc;
+}
+
+void amsBpcExit(void) {
+    if (g_refCnt == 0)
+        return;
+    if (--g_refCnt == 0)
+        serviceClose(&g_amsBpcSrv);
+}
+
+Result amsBpcSetRebootPayload(const void *src, size_t src_size) {
+    return serviceDispatch(&g_amsBpcSrv, 65001,
+        .buffer_attrs = { SfBufferAttr_In | SfBufferAttr_HipcMapAlias },
+        .buffers = { { src, src_size } },
+    );
+}

lib/ams_bpc.h

@@ -0,0 +1,32 @@
+/*
+ * Minimal interface to Atmosphère's bpc:ams extension (reboot-to-payload).
+ *
+ * Vendored from Atmosphère's troposphere/reboot_to_payload (ams_bpc.c/.h).
+ * This is NOT part of libnx -- bpc:ams is an Atmosphère-only named port that
+ * lets a running app stage an arbitrary fusee/RCM payload into the live
+ * ams_mitm reboot buffer, so the next reboot lands in that payload instead
+ * of the normal one. We use it to reboot into TegraExplorer, which finalizes
+ * a staged CFW update (renaming package3 etc.) before HOS boots.
+ *
+ * Atmosphère is MIT/BSD-licensed; see Atmosphere-NX/Atmosphere.
+ */
+#ifndef AMS_BPC_H
+#define AMS_BPC_H
+
+#include <switch.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+Result amsBpcInitialize(void);
+void   amsBpcExit(void);
+
+/* src_size must be <= 0x24000 (the ams_mitm reboot buffer size). */
+Result amsBpcSetRebootPayload(const void *src, size_t src_size);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* AMS_BPC_H */

romfs/TegraExplorer.bin

@@ -2,6 +2,7 @@
 #include "download.h"
 #include "extract.h"
 #include "pending.h"
+#include "payload_swap.h"
 #include "cfw_detect.h"
 #include "config.h"
 #include "applog.h"
@@ -204,16 +205,19 @@ void cfwMgrStartDownload(CfwPackageManager *cm) {
 }
 
 int cfwMgrReboot(bool is_mariko) {
-    /* swap any files that were staged as .ab_new during extraction
-       (package3, stratosphere.romfs, AetherBlock.nro, etc.) — do this
-       right before the reboot call so nothing else has a chance to
-       reopen them first */
+    /* If a CFW update left boot files staged (package3 etc. can't be swapped
+       while Atmosphère runs), reboot into the swap payload instead of a normal
+       reboot: it renames the .ab_new files in place pre-HOS and chainloads the
+       now-consistent CFW. swapArm(true) calls smExit() and reboots, so it does
+       not return on success. On Mariko or any failure it returns and we fall
+       through to a normal reboot -- the old, matched set is still in place, so
+       that just boots the old CFW (no brick). */
+    if (!is_mariko && swapPending() && swapPrepare() == 0)
+        swapArm(true);
+
+    /* swap any ordinary (non-boot) files staged as .ab_new, then flush --
+       fsdev doesn't commit on its own. */
     pendingApply();
-
-    /* fsdev doesn't flush on its own -- make sure every staged swap and
-       freshly written boot file is actually on the card before we pull the
-       trigger, otherwise a stale package3 boots and fails the fusee version
-       check. */
     fsdevCommitDevice("sdmc");
 
     Result rc;

source/cfw_mgr.c

@@ -20,6 +20,20 @@ static bool is_boot_critical(const char *name) {
         || strstr(name, "fusee") || strstr(name, "reboot_payload");
 }
 
+/* The version-matched boot set (package3, stratosphere.romfs,
+   reboot_payload.bin, root fusee.bin) is ALWAYS staged as .ab_new and never
+   written in place -- even the ones that aren't locked. They only flip
+   together in the pre-HOS swap payload (startup.te). This is what makes a
+   failed update non-bricking: until the swap runs, the whole old set is intact
+   and consistent, so no reboot path -- normal reboot, RCM-injected fusee, or
+   cold boot -- can ever pair a new boot payload with an old package3. */
+static bool is_force_stage(const char *name) {
+    return strstr(name, "package3") != NULL
+        || strstr(name, "stratosphere.romfs") != NULL
+        || strstr(name, "reboot_payload.bin") != NULL
+        || strstr(name, "fusee.bin") != NULL;
+}
+
 static bool has_path_traversal(const char *name) {
     if (strcmp(name, "..") == 0) return true;
     if (strncmp(name, "../", 3) == 0) return true;
@@ -183,8 +197,11 @@ int extractZip(const char *zip_path, const char *dest_path,
             bool stashed = false;
             bool staged = false;
             bool wrote_via_libnx = false;
-            FILE *fp = fopen(full_path, "wb");
-            if (!fp) {
+            /* force-staged boot files skip every in-place path and go straight
+               to a .ab_new sidecar, leaving the live file untouched */
+            bool force = stage_locked_files && is_force_stage(filename);
+            FILE *fp = force ? NULL : fopen(full_path, "wb");
+            if (!fp && !force) {
                 /* probably a running sysmodule holding the file open;
                    shove the old one aside and try again */
                 snprintf(stash_path, sizeof(stash_path), "%s.ab_old", full_path);
@@ -194,7 +211,7 @@ int extractZip(const char *zip_path, const char *dest_path,
                     fp = fopen(full_path, "wb");
                 }
             }
-            if (!fp && stage_locked_files) {
+            if (!fp && !force && stage_locked_files) {
                 /* stdio can't touch this file. before we give up and
                    write a sidecar, try the libnx direct path — it uses
                    different open flags and sometimes wins where fopen
@@ -259,11 +276,16 @@ int extractZip(const char *zip_path, const char *dest_path,
                 if (is_boot_critical(filename))
                     appLog("  [boot] %s: write FAILED mid-stream", filename);
             } else if (staged) {
-                /* queued for later; don't count as an error */
-                pendingAdd(full_path);
+                /* Locked files go on the pending list so a later in-session
+                   pass can retry them. Force-staged files (reboot_payload.bin)
+                   deliberately stay OFF the list -- they must only ever be
+                   swapped by the pre-HOS payload, never in-session, or the
+                   live boot payload would race ahead of package3. */
+                if (!force)
+                    pendingAdd(full_path);
                 if (is_boot_critical(filename))
-                    appLog("  [boot] %s: LOCKED -> staged as .ab_new, queued for swap",
-                           filename);
+                    appLog("  [boot] %s: %s -> staged as .ab_new, queued for swap",
+                           filename, force ? "force" : "LOCKED");
             } else if (stashed) {
                 remove(stash_path);
                 if (is_boot_critical(filename))

source/extract.c

@@ -2,6 +2,7 @@
 #include "download.h"
 #include "extract.h"
 #include "pending.h"
+#include "payload_swap.h"
 #include "config.h"
 #include "applog.h"
 #include <cJSON.h>
@@ -213,31 +214,34 @@ int fwMgrLaunchDaybreak(void) {
     if (stat(DAYBREAK_PATH, &st) != 0)
         return -1;
 
-    /* swap in any CFW files that were staged as .ab_new during extraction
-       (package3, stratosphere.romfs, ...) BEFORE we hand off. Daybreak
-       reboots the console itself via reboot-to-payload and never returns
-       control to us, so this is our last chance to get package3 in sync
-       with the new fusee/reboot_payload — skip it and the boot payload
-       loads a stale package3 ("fusee is not on the latest package"). */
     appLogSection("DAYBREAK HANDOFF");
-    appLog("applying any staged CFW swaps before reboot...");
-    pendingApply();
-    if (pendingHasEntries())
-        appLog("WARNING: staged CFW files still pending after swap -- "
-               "package3 is likely STALE; reboot will mismatch fusee");
-    else
-        appLog("no staged CFW files remain pending");
 
-    /* Final flush before we lose control to Daybreak's reboot. fsdev never
-       commits on its own; an uncommitted 8 MB package3 reads stale after the
-       reboot even though every write "succeeded". This is the single most
-       important commit in the whole update flow. */
+    /* package3 / stratosphere.romfs are locked while Atmosphère runs and can't
+       be swapped in-session -- proven by the logs. If any boot file is staged,
+       prepare the pre-HOS swap: write sd:/startup.te and load TegraExplorer.
+       The actual arm (smExit + bpc) happens dead-last in main(), so Daybreak's
+       post-install reboot lands in TegraExplorer, which renames the .ab_new
+       files into place and chainloads the now-consistent CFW.
+
+       We deliberately do NOT pendingApply() here: the locked files can't swap
+       anyway, and force-staged reboot_payload.bin must stay old until the
+       payload flips the whole set at once (that's what prevents a brick). */
+    if (swapPending()) {
+        appLog("staged CFW boot files present -- arming pre-HOS swap payload");
+        if (swapPrepare() != 0)
+            appLog("WARNING: could not arm swap payload; CFW will stay on the "
+                   "old version (no brick) -- finish via PC if needed");
+    } else {
+        /* nothing locked this time -- apply any ordinary staged swaps */
+        pendingApply();
+        appLog("no staged boot files; normal handoff");
+    }
+
+    /* flush everything (startup.te, sidecars, pending list) before we lose
+       control -- fsdev never commits on its own. */
     Result crc = fsdevCommitDevice("sdmc");
     if (R_FAILED(crc))
-        appLog("WARNING: sdmc commit before Daybreak failed (rc=0x%X) -- "
-               "package3 may not have persisted", crc);
-    else
-        appLog("sdmc committed; handing off to Daybreak");
+        appLog("WARNING: sdmc commit before Daybreak failed (rc=0x%X)", crc);
 
     char args[256];
     snprintf(args, sizeof(args), "\"%s\" \"%s\"", DAYBREAK_PATH, FIRMWARE_EXTRACT_PATH);