4 files changed, 42 insertions, 15 deletions

diff --git a/src/core/core.cpp b/src/core/core.cpp
index 2f67e60a9..e95ae80da 100644
--- a/src/core/core.cpp
+++ b/src/core/core.cpp
@@ -273,7 +273,8 @@ struct System::Impl {
         time_manager.Initialize();
 
         is_powered_on = true;
-        exit_lock = false;
+        exit_locked = false;
+        exit_requested = false;
 
         microprofile_cpu[0] = MICROPROFILE_TOKEN(ARM_CPU0);
         microprofile_cpu[1] = MICROPROFILE_TOKEN(ARM_CPU1);
@@ -398,7 +399,8 @@ struct System::Impl {
         }
 
         is_powered_on = false;
-        exit_lock = false;
+        exit_locked = false;
+        exit_requested = false;
 
         if (gpu_core != nullptr) {
             gpu_core->NotifyShutdown();
@@ -507,7 +509,8 @@ struct System::Impl {
 
     CpuManager cpu_manager;
     std::atomic_bool is_powered_on{};
-    bool exit_lock = false;
+    bool exit_locked = false;
+    bool exit_requested = false;
 
     bool nvdec_active{};
 
@@ -943,12 +946,20 @@ const Service::Time::TimeManager& System::GetTimeManager() const {
     return impl->time_manager;
 }
 
-void System::SetExitLock(bool locked) {
-    impl->exit_lock = locked;
+void System::SetExitLocked(bool locked) {
+    impl->exit_locked = locked;
 }
 
-bool System::GetExitLock() const {
-    return impl->exit_lock;
+bool System::GetExitLocked() const {
+    return impl->exit_locked;
+}
+
+void System::SetExitRequested(bool requested) {
+    impl->exit_requested = requested;
+}
+
+bool System::GetExitRequested() const {
+    return impl->exit_requested;
 }
 
 void System::SetApplicationProcessBuildID(const CurrentBuildProcessID& id) {
diff --git a/src/core/core.h b/src/core/core.h
index c70ea1965..a9ff9315e 100644
--- a/src/core/core.h
+++ b/src/core/core.h
@@ -412,8 +412,11 @@ public:
     /// Gets an immutable reference to the Room Network.
     [[nodiscard]] const Network::RoomNetwork& GetRoomNetwork() const;
 
-    void SetExitLock(bool locked);
-    [[nodiscard]] bool GetExitLock() const;
+    void SetExitLocked(bool locked);
+    bool GetExitLocked() const;
+
+    void SetExitRequested(bool requested);
+    bool GetExitRequested() const;
 
     void SetApplicationProcessBuildID(const CurrentBuildProcessID& id);
     [[nodiscard]] const CurrentBuildProcessID& GetApplicationProcessBuildID() const;
diff --git a/src/core/file_sys/content_archive.cpp b/src/core/file_sys/content_archive.cpp
index 44e6852fe..7d2f0abb8 100644
--- a/src/core/file_sys/content_archive.cpp
+++ b/src/core/file_sys/content_archive.cpp
@@ -22,6 +22,10 @@
 
 namespace FileSys {
 
+static u8 MasterKeyIdForKeyGeneration(u8 key_generation) {
+    return std::max<u8>(key_generation, 1) - 1;
+}
+
 NCA::NCA(VirtualFile file_, const NCA* base_nca)
     : file(std::move(file_)), keys{Core::Crypto::KeyManager::Instance()} {
     if (file == nullptr) {
@@ -41,12 +45,17 @@ NCA::NCA(VirtualFile file_, const NCA* base_nca)
         return;
     }
 
+    // Ensure we have the proper key area keys to continue.
+    const u8 master_key_id = MasterKeyIdForKeyGeneration(reader->GetKeyGeneration());
+    if (!keys.HasKey(Core::Crypto::S128KeyType::KeyArea, master_key_id, reader->GetKeyIndex())) {
+        status = Loader::ResultStatus::ErrorMissingKeyAreaKey;
+        return;
+    }
+
     RightsId rights_id{};
     reader->GetRightsId(rights_id.data(), rights_id.size());
     if (rights_id != RightsId{}) {
         // External decryption key required; provide it here.
-        const auto key_generation = std::max<s32>(reader->GetKeyGeneration(), 1) - 1;
-
         u128 rights_id_u128;
         std::memcpy(rights_id_u128.data(), rights_id.data(), sizeof(rights_id));
 
@@ -57,12 +66,12 @@ NCA::NCA(VirtualFile file_, const NCA* base_nca)
             return;
         }
 
-        if (!keys.HasKey(Core::Crypto::S128KeyType::Titlekek, key_generation)) {
+        if (!keys.HasKey(Core::Crypto::S128KeyType::Titlekek, master_key_id)) {
             status = Loader::ResultStatus::ErrorMissingTitlekek;
             return;
         }
 
-        auto titlekek = keys.GetKey(Core::Crypto::S128KeyType::Titlekek, key_generation);
+        auto titlekek = keys.GetKey(Core::Crypto::S128KeyType::Titlekek, master_key_id);
         Core::Crypto::AESCipher<Core::Crypto::Key128> cipher(titlekek, Core::Crypto::Mode::ECB);
         cipher.Transcode(titlekey.data(), titlekey.size(), titlekey.data(),
                          Core::Crypto::Op::Decrypt);
diff --git a/src/core/hle/service/am/am.cpp b/src/core/hle/service/am/am.cpp
index da33f0e44..e92f400de 100644
--- a/src/core/hle/service/am/am.cpp
+++ b/src/core/hle/service/am/am.cpp
@@ -341,7 +341,7 @@ void ISelfController::Exit(HLERequestContext& ctx) {
 void ISelfController::LockExit(HLERequestContext& ctx) {
     LOG_DEBUG(Service_AM, "called");
 
-    system.SetExitLock(true);
+    system.SetExitLocked(true);
 
     IPC::ResponseBuilder rb{ctx, 2};
     rb.Push(ResultSuccess);
@@ -350,10 +350,14 @@ void ISelfController::LockExit(HLERequestContext& ctx) {
 void ISelfController::UnlockExit(HLERequestContext& ctx) {
     LOG_DEBUG(Service_AM, "called");
 
-    system.SetExitLock(false);
+    system.SetExitLocked(false);
 
     IPC::ResponseBuilder rb{ctx, 2};
     rb.Push(ResultSuccess);
+
+    if (system.GetExitRequested()) {
+        system.Exit();
+    }
 }
 
 void ISelfController::EnterFatalSection(HLERequestContext& ctx) {