THIS GUIDE IS DEPRECATED
THIS IS BETTER https://github.com/natinusala/painless-linux

I've successfully booted ArchLinux using ShofEL2. Here is a quick guide on how to do it - I'll assume you're computer literate and know how to use a terminal / Linux commands / git.
Everything is taken from the README of the ShofEL2 repo so if you want to go even faster, go read that instead.

Thanks to NightHammer1000 and Y2K-x for the help !

There is a simplified and faster version of this tutorial available here, with precompiled binaries so you don't have to build everything : https://github.com/SoulCipher/shofel2_linux

The result

Without a SD card ("waiting for root device mmcblk0p2") : https://photos.app.goo.gl/7y6ut5ObuHMUIMZg2
Stock Arch Linux : https://photos.app.goo.gl/yALqe3zMZRe2dSQf1
Arch Linux with LXDE : https://photos.app.goo.gl/xaEgRqeSi8jvAwpz5
RetroArch running : https://photos.app.goo.gl/vBLPo5wiBto1qiUH3
Arch Linux with GNOME : https://gbatemp.net/attachments/img_0005-jpg.121608/
Arch Linux with KDE : https://gbatemp.net/attachments/img_20180427_121605-jpg.121666/

What works / what doesn't

• Desktop environment : Gnome, LXDE, KDE
• Wi-Fi : works
  • You will need to reboot your Switch and run the exploit again to make the Wi-Fi work (it never works on the first boot)
  • Then enter the Network Manager Application and add your network from there
  • If it doesn't work, you will need to edit the configuration on the host computer (see the additional notes at the end of this post)
  • With LXDE : Can cause a kernel panic if used at the same time as Bluetooth
• Bluetooth : works but Joy-Cons can't be paired
• Touch screen : works, although LXDE is not very touch-friendly
• Audio : doesn't work yet
• GPU acceleration : works (via mesa), with OpenGL (and maybe Vulkan too ?)
• Joy-Cons : not recognized
• Volume buttons : working with Gnome but not doing anything since there is no audio device
• Power button : doesn't do anything, no sleep mode, no graceful shutdown
• USB : doesn't work
• Dock : not tested yet, but I bet it doesn't do anything besides charging the battery
• Power management / battery level : working with Gnome

What you'll need

• A computer running Linux with a blue USB SuperSpeed port, or a Mac
  • A Linux VM can work in theory, but it depends on how the USB passthrough is implemented (apparently VMWare works, VirtualBox doesn't)
• A USB A-to-C cable (with data support, obviously)
  • be careful as cheap cables were reported to work randomly / not work at all
• Some time (you know, Linux is kinda large)

Prep work

First, you'll need to install the required toolchains. Open this link and download the tar.gz binaries for

• aarch64-linux-gnu
  
• arm-linux-gnueabi

Be careful to choose the right architecture for your PC (for me it was x86_64 so "gcc-linaro-7.2.1-2017.11-x86_64_arm-linux-gnueabi.tar.xz").

Once you have them, extract them somewhere nice and add the "bin" (not "lib" as I previously stated) folder of both toolchains to your PATH ("$ export PATH=$PATH:/path/to/toolchain1/lib:/path/to/toolchain2/lib"). The building process won't work otherwise.

Then, install those dependencies (how to install them and their name might depend on your distribution) :

• build-essential (sorry I didn't add it it was obvious to me)
• libssl-dev
  
• swig
• bison
• pkg-config
  
• flex
• zlib1g-dev
  
• python3
• python-dev
  
• python3-pip
• pyusb 1.0.0 : "$ sudo pip3 install pyusb==1.0.0"
• libusb-1.0-0-dev

Compiling

Clone each required repository :

$ git clone https://github.com/fail0verflow/shofel2.git
$ git clone --recursive --depth=1 https://github.com/fail0verflow/switch-coreboot.git coreboot
$ git clone https://github.com/fail0verflow/switch-u-boot.git u-boot
$ git clone --depth=1 https://github.com/fail0verflow/switch-linux.git linux
$ git clone https://github.com/boundarydevices/imx_usb_loader.git

You can grab a coffee or two because Linux has more than 5 million files to download.

Then, build everything :

$ cd shofel2/exploit
$ make

$ cd u-boot
$ export CROSS_COMPILE=aarch64-linux-gnu-
$ make nintendo-switch_defconfig
$ make

$ cd coreboot
$ make nintendo_switch_defconfig
$ make iasl
$ make

If you have a tegra_mtc.bin file error, you'll have to extract it from a Pixel C stock image :
"$ ./build/util/cbfstool/cbfstool bootloader-dragon-google_smaug.7900.97.0.img extract -n fallback/tegra_mtc -f tegra_mtc.bin"

Or you can download it directly from here : https://0w0.st/tegra_mtc.bin (thanks to @CptPotato for uploading this)

You'll have to put it in the "coreboot/src/soc/nvidia/tegra210" directory.

$ cd imx_usb_loader
$ git reset --hard 0a322b01cacf03e3be727e3e4c3d46d69f2e343e
$ make

The big one :

$ cd linux
$ export ARCH=arm64
$ export CROSS_COMPILE=aarch64-linux-gnu-
$ make nintendo-switch_defconfig
$ make

If you encounter issues about a missing rule "/lib/firmware/nvidia/tegra210/vic04_ucode.bin" for the target "firmware" you'll have to :

• install the firmware-misc-nonfree package
• if you can't install it, or if it still doesn't work, download the package manually from debian sid and extract the file "/lib/firmware/nvidia/tegra210/vic04_ucode.bin" (from the root of your PC, not on the cloned repo) from the DEB (and chmod it if needed)

If you encounter issues about a missing rule "/lib/firmware/brcm/brcmfmac4356-pcie.txt", download this file and put it in "/lib/firmware/brcm/" (from the root of your PC, not on the cloned repo)

Building the rootfs

This is the annoying part. Download the archive / image corresponding to the distribution you want to use :

• Stock Arch Linux (useless without UART, you can't even log in) : http://os.archlinuxarm.org/os/ArchLinuxARM-aarch64-latest.tar.gz
• Arch Linux with LXDE and touch screen support (credits to @Gigaa) :
  • Without hardware acceleration : https://0w0.st/rootfs.tar.bz2
  • With hardware acceleration : https://0w0.st/rootfs2.tar.bz2
  • With hardware acceleration, Chromium and sudo : https://drive.google.com/open?id=1VIH3GWtBrM4uuVQOQopASYZy4x3Jw1Uv
• Arch Linux with Gnome (credits to @00Cancer) : https://0w0.st/gnome__rootfs.tar.bz2
• (Recommended) Arch Linux with KDE and GPU power management service (credits to @Gigaa) : https://0w0.st/KDE_rootfs3.tar.bz2
• Ubuntu 18.04 (you'll have to build the image yourself) : https://github.com/cmsj/nintendo-switch-ubuntu-builder

If it's a tarball you just downloaded

While it's downloading, you'll have to take a microSD card and, using the software of your choice (I used GParted) :

• remove every existing partition to only have unallocated space on it (do I need to tell you that you're going to loose everything on the card ?)
• create a tiny FAT32 partition (I chose 200mb but it doesn't matter) - that'll be mmcbkl0p1, you can label it "garbage"
• create an ext4 partition on the remaining part of the card - that'll be mmcblk0p2, you can label it "rootfs"
• it's important that the FAT32 partition comes first and the ext4 one comes after - on the Switch, Linux will look for mmcblk0p2, the second partition, if you have scrolling boot logs and then back to RCM it means you did it wrong

Once the rootfs tarball is downloaded, you can simple extract it to the mounting point of the ext4 partition you just created :

$ tar xvf ArchLinuxARM-aarch64-latest.tar.gz -C /mounting/point/of/ext4/partition && sync
$ cp ArchLinuxARM-aarch64-latest.tar.gz /mounting/point/of/ext4/partition/root && sync

("/mounting/point/of/ext4/partition/root" is the "root" directory on the partition)

Don't forget to properly eject the SD Card !

If "tar xvf" doesn't work for you you can install "bsdtar" and use "bsdtar -xpf" instead

Then you can put the SD card in the console.

If it's a img / bin file you just downloaded

You can simply write it on your SD card using :

• If you're on Windows, Ether or Win32DiskImager
• If you're on Linux / Mac OS : "sudo dd if=yourimage.img of=/dev/sdX && sync" where /dev/sdX is the device of your SD card (unmounted)

You will probably want to open a partition manager to resize the ext4 partition once it's flashed, so that it fits your SD card.

Then you can put the SD card in the console.

Booting linux

Run the exploit :

$ cd shofel2/exploit
$ sudo ./shofel2.py cbfs.bin ../../coreboot/build/coreboot.rom

Your terminal should now be waiting for the Switch to enter RCM mode.

To do so : (I don't have pictures but that's the same method as fusée gelée, just look at some video tutorials)

• plug the Switch on your PC using the USB A-to-C cable - use a blue SuperSpeed port if you have one
• shut it down
• remove the right joy-con
• using a method of your choice, short the 10th pin of the right joy-con (the last pin on the right, away from the screen, closer to the back) with the ground : that can be pin 1, 2 or 7, that can also be a screw on the joy-con rack or the console's fan - I personnaly stick a RPi jumper wire in the fan and touch the 10th pin on the other side, works everytime (like this)
• keep the pins shorted and power the Switch while pressing the volume UP button

If it worked, the console will show a black screen and you'll see the exploit running on your terminal. If you see the Nintendo logo, it has failed. You can power off the console and try again.

Then, run those last commands :

$ cd shofel2/usb_loader
$ ../../u-boot/tools/mkimage -A arm64 -T script -C none -n "boot.scr" -d switch.scr switch.scr.img
$ sudo ../../imx_usb_loader/imx_usb -c .

Linux should then boot on your console - first the boot logs with the penguins, and then an ArchLinux login prompt. Voilà !
Again, if you have the boot logs and then a black screen, it means you did the SD card part wrong.

Additional notes

Hardware graphics acceleration

The most recents image already contain this fix.

To add mesa drivers install this package using pacman :
https://0w0.st/mesa-full-tegra-r101876.bf5e0276b6-1-aarch64.pkg.tar.xz

You will need a working internet connection to do so.

Then, use this script to choose your power profile : https://0w0.st/power.sh

Full speed RAM

According to the blog post ("Linux on Switch boot chain" section), you need to extract a file from a Pixel C factory image in order to have the RAM working at full speed. I didn't do it so I won't cover it here.

Fixing calibration issues of the touch screen (thanks to @Wizardy)

To fix calibration issues of the touch screen, edit the file /usr/share/X11/xorg.conf.d/10-evdev.confg (of the rootfs)

And change the InputClass section to :

Section "InputClass"
        Identifier "evdev touchscreen catchall"
        MatchIsTouchscreen "on"
        MatchDevicePath "/dev/input/event*"
        Driver "evdev"
        Option "InvertX" "no"
        Option "InvertY" "yes"
        Option "SwapAxes" "yes"
        Option "Calibration" "0 1279 0 719"
EndSection

Wi-Fi

To setup Wi-Fi, mount the rootfs partition on your host PC and edit the configuration for your network in the file "/etc/NetworkManager/system-connections" (if it doesn't exist, take Gigaspot).

To have a working Wi-Fi you must reboot your Switch and run the exploit again each time you power it off

Moving the rootfs to another partition

If you want to move the rootfs to another partition on your SD card, edit the "shofel2/usb_loader/switch.scr" file and replace "/dev/mmcblk0p2" by the partition you want to use.

 

[Monado_III]

After its done upload it on Mega or Google Drive, I hope it uploads there faster with out shitty Austrian Internet.

--------------------- MERGED ---------------------------


One Question tho. Can you boot back to the normal OS?

yes, just don't use the exploit and it'll boot normally

 

[EpicLPer]

After its done upload it on Mega or Google Drive, I hope it uploads there faster with out shitty Austrian Internet.

--------------------- MERGED ---------------------------


One Question tho. Can you boot back to the normal OS?

Servus fellow Austrian!
Just booted my Switch into APX mode too and I'm waiting for some GUI stuff to appear now, hopefully. At least now I know how it should work!

Tried to 3D print the adapter and took a MicroUSB apart too but failed at the last part, aka. putting it in the adapter and making it work. Pins were constantly falling out because I cut them too short.

 

[natinusala]

Nothing is ever installed, so yes you can just reboot the Switch and it will go back to the normal OS

 

[Xyphoseos]

Look at the photo I posted on the OP, find a wire and shove it in the fan and touch the 10th pin

Or use a paperclip betwen the 1st and 10th pin

--------------------- MERGED ---------------------------



We should have full speed but do we ? Is it enabled ? Is it distribution-dependant ?

the joycon must be on the console isn't it ? If Yes how do I put the paperclip ?
I don't understand how to put the wire on the fan

 

[natinusala]

https://photos.app.goo.gl/cmBfdpD3KVUfu9cF2

• remove the right joycon
• shove one end of the wire in the fan so that it touches the metallic part
• stick the other hand under / on the 10th pin

 

[Admiral124]

the joycon must be on the console isn't it ? If Yes how do I put the paperclip ?
I don't understand how to put the wire on the fan

Putting pin 10 to the fan heatsink simulates a homebutton press on the system. If you're using that method, you don't need the joycon.

 

[ExploitTnT]

https://photos.app.goo.gl/cmBfdpD3KVUfu9cF2

• remove the right joycon
• shove one end of the wire in the fan so that it touches the metallic part
• stick the other hand under / on the 10th pin

Today is a bad day for me. First i broke my Joy Con Pin and now i think my cable for the home button doesnt work because it is so thin

 

[EpicLPer]

Putting pin 10 to the fan heatsink simulates a homebutton press on the joycon. If you're using that method, you don't need the joycon.

Does it simulate a home-button press? I thought it would be a hidden "button", not something you can normally access. Else the whole wire method would just be stupid.

--------------------- MERGED ---------------------------

Today is a bad day for me. First i broke my Joy Con Pin and now i think my cable for the home button doesnt work because it is so thin

Mine was too thin too, just use the edge of the connector as a kind of leaver and hold it there while pushing the buttons. Will work after 2 or 3 tries. Else use a paperclip which has the right thickness.

 

[Xyphoseos]

Putting pin 10 to the fan heatsink simulates a homebutton press on the joycon. If you're using that method, you don't need the joycon.

the pin 10 is on the console ?

 

[Admiral124]

Does it simulate a home-button press? I thought it would be a hidden "button", not something you can normally access. Else the whole wire method would just be stupid.

I meant to say it's a home-button press on the system, not the joycon.

Entering RCM mode
On the Switch, RCM mode can be entered in multiple ways:

1. From prior kernel-mode code execution on the system, e.g. using a WebKit exploit and kernel exploit as an entry points
2. If the eMMC is removed, the Tegra will enter RCM mode on boot
3. If you hold the Volume Up, Home, and Power buttons on the Switch (not joy-cons) at the same time.

Note that the Joy-Con home button won’t work here. You may be wondering about the secret home button on the Nintendo switch itself. As it turns out, what Tegra calls the Home button is actually connected to Pin 10 (the rearmost pin) on the right hand side Joy-Con connector.[\QUOTE]

the pin 10 is on the console ?

It's the rear-most pin (away from the screen) on the right hand side.

 

[NightStorm1000]

After its done upload it on Mega or Google Drive, I hope it uploads there faster with out shitty Austrian Internet.

I upload it to my own Server. I hate mega and Google Drive.

 

[EpicLPer]

I upload it to my own Server. I hate mega and Google Drive.

Please don't... People who live far away from Austria may take a long time to download this then since their route is probably super long to your server then.

 

[natinusala]

The home button doesn't exist on the Switch. But they still needed it, so they wired it to the 10th pin so when you short it to the ground it "presses" the button. It's also practical because they can make fake joycons to "press" it

 

[Xyphoseos]

The home button doesn't exist on the Switch. But they still needed it, so they wired it to the 10th pin so when you short it to the ground it "presses" the button. It's also practical because they can make fake joycons to "press" it

Do you know why 9+10 pins or the tiny solduring will not work ?

 

[flagrama]

Do you know why 9+10 pins or the tiny solduring will not work ?

9+10 don't work because 9 is only a GND while the joycon is connected.

 

[ExploitTnT]

https://photos.app.goo.gl/cmBfdpD3KVUfu9cF2

• remove the right joycon
• shove one end of the wire in the fan so that it touches the metallic part
• stick the other hand under / on the 10th pin

what can i do if i think it will not work with my cable?

 

[EpicLPer]

How do I use the cbfstool to extract the blob? Or how can I compile it? It doesn't exist in the stuff you download, only thing that exists is the .c file of cbfstool.

EDIT: Oh, had to go to the util/cbfstool folder and simply type "make".

 

[Xyphoseos]

9+10 don't work because 9 is only a GND while the joycon is connected.

and 1 and 7 no ? They are on the joy-con too isn't it ?

 

[Gren22]

So I've gotten almost the whole thing working, I am on the very last command and this happens:

ubuntu:~/switchhacks/f0f/shofel2/exploit$ cd ../usb_loader
ubuntu:~/switchhacks/f0f/shofel2/usb_loader$ ../../u-boot/tools/mkimage -A arm64 -T script -C none -n "boot.scr" -d switch.scr switch.scr.img
Image Name:   boot.scr
Created:      Tue Apr 24 13:56:15 2018
Image Type:   AArch64 Linux Script (uncompressed)
Data Size:    290 Bytes = 0.28 KiB = 0.00 MiB
Load Address: 00000000
Entry Point:  00000000
Contents:
   Image 0: 282 Bytes = 0.28 KiB = 0.00 MiB
ubuntu:~/switchhacks/f0f/shofel2/usb_loader$ ../../imx_usb_loader/imx_usb -c .
config file <./imx_usb.conf>
vid=0x0955 pid=0x701a file_name=switch.conf
config file <./switch.conf>
parse ./switch.conf
Trying to open device vid=0x0955 pid=0x701a.........................
Could not open device vid=0x0955 pid=0x701a

I also have a bash script I run that basically does the same commands and it outputs this:

ubuntu:~/switchhacks$ sudo ./run-hack
File descriptor: 9
b'808302090000001483d8296401101062'
entry 400168ed
throwing more
Performing hax...
Size: 0x6c68

b'820000000000686c'
b'02000000000000000000000000000000a029af0100000000716c000000000000000000000000000000000000000000000f0f00000000000000'
URB address: 0x1b16ef0
URB status: -2
b'CBFS\n'
>>> Switching to cbfs mode...
sending 0x7000 bytes @0x0
sending 0x4 bytes @0xffffc
sending 0x20 bytes @0x20138
sending 0x18 bytes @0x20100
sending 0x20 bytes @0x20118
sending 0x18 bytes @0x20180
sending 0x20 bytes @0x20198
sending 0x1c bytes @0x201b8
sending 0x534a bytes @0x201d4
sending 0x100000 bytes @0x0
you have been served
Image Name:   boot.scr
Created:      Tue Apr 24 13:59:32 2018
Image Type:   AArch64 Linux Script (uncompressed)
Data Size:    290 Bytes = 0.28 KiB = 0.00 MiB
Load Address: 00000000
Entry Point:  00000000
Contents:
   Image 0: 282 Bytes = 0.28 KiB = 0.00 MiB
config file <./imx_usb.conf>
vid=0x0955 pid=0x701a file_name=switch.conf
no matching USB device found

anyone got a clue what I am doing wrong? Switch remains black the entire time.

 

[Monado_III]

@Gren22 sudo ../../imx_usb_loader/imx_usb -c .