Bump version to 0.10.2

The call to serviceCreate(...) tries to query pointer buffer size, but
since we haven't had a chance to return the server side of the session
yet, this deadlocks. Instead, we defer creating the session and
mounting the filesystem until the first time the ECS object is
used. If mounting the filesystem fails, the ECS is silently discarded.

.gitattributes

@@ -0,0 +1 @@
+config_templates/hbl_html/accessible-urls/accessible-urls.txt text eol=lf

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: ReSwitched Discord
+    url: https://discordapp.com/invite/DThbZ7z
+    about: Please ask questions here, instead of making GitHub issues.

.github/ISSUE_TEMPLATE/question.md

@@ -1,7 +0,0 @@
----
-name: Question
-about: Please ask questions in the ReSwitched discord, instead of making issues. 
---- 
-We would like to use GitHub to keep track of problems/feature requests.  
-If you have a question, please join the ReSwitched discord for help. 
-- Discord link: https://discordapp.com/invite/DThbZ7z 

.gitmodules

@@ -1,6 +0,0 @@
-[submodule "common/include/boost"]
-	path = common/include/boost
-	url = https://github.com/Atmosphere-NX/ext-boost.git
-[submodule "stratosphere/libstratosphere"]
-	path = stratosphere/libstratosphere
-	url = https://github.com/Atmosphere-NX/libstratosphere.git

Makefile

@@ -7,7 +7,7 @@ ifneq (, $(strip $(shell git status --porcelain 2>/dev/null)))
     AMSREV := $(AMSREV)-dirty
 endif
 
-COMPONENTS := fusee stratosphere exosphere thermosphere troposphere
+COMPONENTS := fusee stratosphere mesosphere exosphere thermosphere troposphere libraries
 
 all: $(COMPONENTS)
 
@@ -17,30 +17,36 @@ thermosphere:
 exosphere: thermosphere
 	$(MAKE) -C exosphere all
 
-stratosphere: exosphere
+stratosphere: exosphere libraries
 	$(MAKE) -C stratosphere all
 
+mesosphere: exosphere libraries
+	$(MAKE) -C mesosphere all
+
 troposphere: stratosphere
 	$(MAKE) -C troposphere all
 
 sept: exosphere
 	$(MAKE) -C sept all
 
-fusee: exosphere stratosphere sept
+fusee: exosphere mesosphere stratosphere sept
 	$(MAKE) -C $@ all
 
+libraries:
+	$(MAKE) -C libraries all
+
 clean:
 	$(MAKE) -C fusee clean
 	rm -rf out
 
 dist: all
-	$(eval MAJORVER = $(shell grep '\ATMOSPHERE_RELEASE_VERSION_MAJOR\b' common/include/atmosphere/version.h \
+	$(eval MAJORVER = $(shell grep 'define ATMOSPHERE_RELEASE_VERSION_MAJOR\b' libraries/libvapours/include/vapours/ams/ams_api_version.h \
 		| tr -s [:blank:] \
 		| cut -d' ' -f3))
-	$(eval MINORVER = $(shell grep '\ATMOSPHERE_RELEASE_VERSION_MINOR\b' common/include/atmosphere/version.h \
+	$(eval MINORVER = $(shell grep 'define ATMOSPHERE_RELEASE_VERSION_MINOR\b' libraries/libvapours/include/vapours/ams/ams_api_version.h \
 		| tr -s [:blank:] \
 		| cut -d' ' -f3))
-	$(eval MICROVER = $(shell grep '\ATMOSPHERE_RELEASE_VERSION_MICRO\b' common/include/atmosphere/version.h \
+	$(eval MICROVER = $(shell grep 'define ATMOSPHERE_RELEASE_VERSION_MICRO\b' libraries/libvapours/include/vapours/ams/ams_api_version.h \
 		| tr -s [:blank:] \
 		| cut -d' ' -f3))
 	$(eval AMSVER = $(MAJORVER).$(MINORVER).$(MICROVER)-$(AMSREV))
@@ -50,33 +56,38 @@ dist: all
 	mkdir atmosphere-$(AMSVER)/atmosphere
 	mkdir atmosphere-$(AMSVER)/sept
 	mkdir atmosphere-$(AMSVER)/switch
-	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/010000000000000D
-	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032
-	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000034
-	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000036
-	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000037
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/contents/0100000000000008
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/contents/010000000000000D
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/contents/0100000000000032
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/contents/0100000000000034
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/contents/0100000000000036
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/contents/0100000000000037
 	mkdir -p atmosphere-$(AMSVER)/atmosphere/fatal_errors
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/config_templates
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/config
 	cp fusee/fusee-primary/fusee-primary.bin atmosphere-$(AMSVER)/atmosphere/reboot_payload.bin
+	cp fusee/fusee-mtc/fusee-mtc.bin atmosphere-$(AMSVER)/atmosphere/fusee-mtc.bin
 	cp fusee/fusee-secondary/fusee-secondary.bin atmosphere-$(AMSVER)/atmosphere/fusee-secondary.bin
 	cp fusee/fusee-secondary/fusee-secondary.bin atmosphere-$(AMSVER)/sept/payload.bin
 	cp sept/sept-primary/sept-primary.bin atmosphere-$(AMSVER)/sept/sept-primary.bin
 	cp sept/sept-secondary/sept-secondary.bin atmosphere-$(AMSVER)/sept/sept-secondary.bin
 	cp sept/sept-secondary/sept-secondary_00.enc atmosphere-$(AMSVER)/sept/sept-secondary_00.enc
 	cp sept/sept-secondary/sept-secondary_01.enc atmosphere-$(AMSVER)/sept/sept-secondary_01.enc
-	cp common/defaults/BCT.ini atmosphere-$(AMSVER)/atmosphere/BCT.ini
-	cp common/defaults/loader.ini atmosphere-$(AMSVER)/atmosphere/loader.ini
-	cp common/defaults/system_settings.ini atmosphere-$(AMSVER)/atmosphere/system_settings.ini
-	cp -r common/defaults/kip_patches atmosphere-$(AMSVER)/atmosphere/kip_patches
-	cp -r common/defaults/hbl_html atmosphere-$(AMSVER)/atmosphere/hbl_html
-	cp stratosphere/dmnt/dmnt.nsp atmosphere-$(AMSVER)/atmosphere/titles/010000000000000D/exefs.nsp
-	cp stratosphere/eclct.stub/eclct.stub.nsp atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032/exefs.nsp
-	cp stratosphere/fatal/fatal.nsp atmosphere-$(AMSVER)/atmosphere/titles/0100000000000034/exefs.nsp
-	cp stratosphere/creport/creport.nsp atmosphere-$(AMSVER)/atmosphere/titles/0100000000000036/exefs.nsp
-	cp stratosphere/ro/ro.nsp atmosphere-$(AMSVER)/atmosphere/titles/0100000000000037/exefs.nsp
-	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032/flags
-	touch atmosphere-$(AMSVER)/atmosphere/titles/0100000000000032/flags/boot2.flag
-	mkdir -p atmosphere-$(AMSVER)/atmosphere/titles/0100000000000037/flags
-	touch atmosphere-$(AMSVER)/atmosphere/titles/0100000000000037/flags/boot2.flag
+	cp config_templates/BCT.ini atmosphere-$(AMSVER)/atmosphere/config/BCT.ini
+	cp config_templates/override_config.ini atmosphere-$(AMSVER)/atmosphere/config_templates/override_config.ini
+	cp config_templates/system_settings.ini atmosphere-$(AMSVER)/atmosphere/config_templates/system_settings.ini
+	cp -r config_templates/kip_patches atmosphere-$(AMSVER)/atmosphere/kip_patches
+	cp -r config_templates/hbl_html atmosphere-$(AMSVER)/atmosphere/hbl_html
+	cp stratosphere/boot2/boot2.nsp atmosphere-$(AMSVER)/atmosphere/contents/0100000000000008/exefs.nsp
+	cp stratosphere/dmnt/dmnt.nsp atmosphere-$(AMSVER)/atmosphere/contents/010000000000000D/exefs.nsp
+	cp stratosphere/eclct.stub/eclct.stub.nsp atmosphere-$(AMSVER)/atmosphere/contents/0100000000000032/exefs.nsp
+	cp stratosphere/fatal/fatal.nsp atmosphere-$(AMSVER)/atmosphere/contents/0100000000000034/exefs.nsp
+	cp stratosphere/creport/creport.nsp atmosphere-$(AMSVER)/atmosphere/contents/0100000000000036/exefs.nsp
+	cp stratosphere/ro/ro.nsp atmosphere-$(AMSVER)/atmosphere/contents/0100000000000037/exefs.nsp
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/contents/0100000000000032/flags
+	touch atmosphere-$(AMSVER)/atmosphere/contents/0100000000000032/flags/boot2.flag
+	mkdir -p atmosphere-$(AMSVER)/atmosphere/contents/0100000000000037/flags
+	touch atmosphere-$(AMSVER)/atmosphere/contents/0100000000000037/flags/boot2.flag
 	cp troposphere/reboot_to_payload/reboot_to_payload.nro atmosphere-$(AMSVER)/switch/reboot_to_payload.nro
 	cd atmosphere-$(AMSVER); zip -r ../atmosphere-$(AMSVER).zip ./*; cd ../;
 	rm -r atmosphere-$(AMSVER)

common/defaults/loader.ini

@@ -1,9 +0,0 @@
-[hbl_config]
-title_id=010000000000100D
-override_any_app=true
-path=atmosphere/hbl.nsp
-override_key=R
-
-[default_config]
-override_key=!L
-cheat_enable_key=!L

common/defaults/system_settings.ini

@@ -1,31 +0,0 @@
-; Disable uploading error reports to Nintendo
-[eupld]
-upload_enabled = u8!0x0
-; Enable USB 3.0 superspeed for homebrew
-[usb]
-usb30_force_enabled = u8!0x0
-; Control whether RO should ease its validation of NROs.
-; (note: this is normally not necessary, and ips patches can be used.)
-[ro]
-ease_nro_restriction = u8!0x0
-; Atmosphere custom settings
-[atmosphere]
-; Reboot from fatal automatically after some number of milliseconds.
-; If field is not present or 0, fatal will wait indefinitely for user input.
-fatal_auto_reboot_interval = u64!0x0
-; Make the power menu's "reboot" button reboot to payload.
-; Set to "normal" for normal reboot, "rcm" for rcm reboot.
-power_menu_reboot_function = str!payload
-; Controls whether dmnt cheats should be toggled on or off by 
-; default. 1 = toggled on by default, 0 = toggled off by default.
-dmnt_cheats_enabled_by_default = u8!0x1
-; Controls whether dmnt should always save cheat toggle state
-; for restoration on new game launch. 1 = always save toggles,
-; 0 = only save toggles if toggle file exists.
-dmnt_always_save_cheat_toggles = u8!0x0
-; Controls whether fs.mitm should redirect save files
-; to directories on the sd card.
-; 0 = Do not redirect, 1 = Redirect.
-; NOTE: EXPERIMENTAL
-; If you do not know what you are doing, do not touch this yet.
-fsmitm_redirect_saves_to_sd = u8!0x0

config_templates/BCT.ini

@@ -1,16 +1,19 @@
 BCT0
 [stage1]
 stage2_path = atmosphere/fusee-secondary.bin
+stage2_mtc_path = atmosphere/fusee-mtc.bin
 stage2_addr = 0xF0000000
 stage2_entrypoint = 0xF0000000
 
 [exosphere]
 ; Note: Disabling debugmode will cause parts of ams.tma to not work, in the future.
-debugmode = 1 
+debugmode = 1
 debugmode_user = 0
 ; Note: Disabling usermode exception handlers will cause atmosphere to not fail gracefully under error conditions.
 ; Support will not be provided to users who disable these. If you do not know what you are doing, leave them on.
 disable_user_exception_handlers = 0
+; Note: It's currently unknown what effects enabling the usermode PMU register access may have on official code.
+enable_user_pmu_access = 0
 
 [stratosphere]
 ; To force-enable nogc, add nogc = 1

config_templates/override_config.ini

@@ -0,0 +1,19 @@
+[hbl_config]
+; Program Specific Config
+; Up to 8 program-specific configurations can be set.
+; These use `program_id_#` and `override_key_#`
+; where # is in range [0,7].
+; program_id_0=010000000000100D
+; override_key_0=!R
+
+; Any Application Config
+; Note that this will only apply to program IDs that
+; are both applications and not specified above
+; by a program specific config.
+; override_any_app=true
+; override_any_app_key=R
+; path=atmosphere/hbl.nsp
+
+[default_config]
+; override_key=!L
+; cheat_enable_key=!L

config_templates/system_settings.ini

@@ -0,0 +1,49 @@
+; Disable uploading error reports to Nintendo
+[eupld]
+; upload_enabled = u8!0x0
+; Control whether RO should ease its validation of NROs.
+; (note: this is normally not necessary, and ips patches can be used.)
+[ro]
+; ease_nro_restriction = u8!0x0
+; Atmosphere custom settings
+[atmosphere]
+; Reboot from fatal automatically after some number of milliseconds.
+; If field is not present or 0, fatal will wait indefinitely for user input.
+; fatal_auto_reboot_interval = u64!0x0
+; Make the power menu's "reboot" button reboot to payload.
+; Set to "normal" for normal reboot, "rcm" for rcm reboot.
+; power_menu_reboot_function = str!payload
+; Controls whether dmnt cheats should be toggled on or off by
+; default. 1 = toggled on by default, 0 = toggled off by default.
+; dmnt_cheats_enabled_by_default = u8!0x1
+; Controls whether dmnt should always save cheat toggle state
+; for restoration on new game launch. 1 = always save toggles,
+; 0 = only save toggles if toggle file exists.
+; dmnt_always_save_cheat_toggles = u8!0x0
+; Enable writing to BIS partitions for HBL.
+; This is probably undesirable for normal usage.
+; enable_hbl_bis_write = u8!0x0
+; Enable reading the CAL0 partition for HBL.
+; This is probably undesirable for normal usage.
+; enable_hbl_cal_read = u8!0x0
+; Controls whether fs.mitm should redirect save files
+; to directories on the sd card.
+; 0 = Do not redirect, 1 = Redirect.
+; NOTE: EXPERIMENTAL
+; If you do not know what you are doing, do not touch this yet.
+; fsmitm_redirect_saves_to_sd = u8!0x0
+; Controls whether to enable the deprecated hid mitm
+; to fix compatibility with old homebrew.
+; 0 = Do not enable, 1 = Enable.
+; Please note this setting may be removed in a
+; future release of Atmosphere.
+; enable_deprecated_hid_mitm = u8!0x0
+[hbloader]
+; Controls the size of the homebrew heap when running as applet.
+; If set to zero, all available applet memory is used as heap.
+; The default is zero.
+; applet_heap_size = u64!0x0
+; Controls the amount of memory to reserve when running as applet
+; for usage by other applets. This setting has no effect if
+; applet_heap_size is non-zero. The default is 0x8600000.
+; applet_heap_reservation_size = u64!0x8600000

docs/changelog.md

@@ -1,4 +1,172 @@
 # Changelog
+## 0.10.2
++ hbl configuration was made more flexible.
+  + Up to eight specific program ids can now be specified to have their own override keys.
+  + This allows designating both the album applet and a specific game as hbl by default as desired.
+  + Configuration targeting a specific program is now mutually exclusive with override-any-app for that program.
+    + This fixes unintuitive behavior when override key differed for an application specific program.
++ Loader's external content fileystem support was fixed (thanks @misson20000!).
++ KernelLdr was reimplemented.
+  + This is the first step towards developing mesosphere, Atmosphere's planned reimplementation of the Switch's Kernel.
+  + The typical user won't notice anything different, as there are no extensions, but a lot of groundwork was laid for future development.
++ Improvements were made to the way Atmosphere's buildsystem detects source code files.
+  + This significantly reduces compilation time (saving >30 seconds) on the machine that builds official releases.
++ Certain device code was cleaned up and made more correct in fusee/sept/exosphere (thanks @hexkyz!).
++ A number of changes were made to the way fs.mitm builds images when providing a layeredfs romfs.
+  + Some games (Resident Evil 6, Football Manager 2020 Touch, possibly others) have enormous numbers of files.
+  + Attempting to create a layeredfs mod for these games actually caused fs.mitm to run out of memory, causing a fatal error.
+  + The code that creates these images was changed to be significantly more memory efficient.
+  + However, these changes also cause a significant slowdown in the romfs building code (~2-5x).
+  + This introduced a noticeable stutter when launching a game, because the UI thread would block on the romfs creation.
+  + To solve this, fs.mitm now lazily initializes the image in a background thread.
+  + This fixes stutter issues, however some games may be slightly slower (~1-2s in the worst cases) to transition from the "loading" GIF to gameplay now.
+    + Please note: the slowdown is not noticeable in the common case where games don't have tons of files (typical is ~0.1-0.2 seconds).
+    + Once the image has been built, there is no further speed penalty at runtime -- only when the game is launched.
++ A number of other bugs were fixed, including:
+  + Several minor logic inversions that could have caused fatal errors when modding games.
+  + Atmosphere's new-ipc code did not handle "automatic" recvlist buffers correctly, so some non-libnx homebrew could crash.
+  + fs.mitm now correctly mitms sdb, which makes redirection of certain system data archives work again.
+    + In 0.10.0/0.10.1, changing the system font/language did not work correctly due to this.
+  +  A bug was fixed in process cleanup that caused the system to hang on < 5.0.0.
++ The temporary hid-mitm added in Atmosphere 0.9.0 was disabled by default.
+  + Please ensure your homebrew is updated.
+  + For now, users may re-enable this mitm by use of a custom setting (`atmosphere!enable_deprecated_hid_mitm`) to ease the transition process some.
+  + Please note: support for this setting may be removed to save memory in a future atmosphere release.
++ General system stability improvements to enhance the user's experience.
+## 0.10.1
++ A bug was fixed that caused memory reallocation to the system pool to work improperly on firmware 5.0.0 and above.
+  + Atmosphere was always trying to deallocate memory away from the applet pool and towards the system pool.
+    + The intent of this is to facilitate running more custom sysmodules/atmosphere binaries.
+  + However, while memory was always successfully taken away from the applet pool, on 5.0.0+ granting it to the system pool did not work for technical reasons.
+    + If you are interested in the technical details, talk to SciresM.
+  + This has now been fixed by adding new kernel patches, and memory is correctly granted to the system pool as intended.
++ Atmosphere's library system has been overhauled:
+  + libstratosphere's repository has been rebranded, more generally, to "Atmosphere-libs".
+    + In addition to libstratosphere, a new general library for not-stratosphere-specific code has been added.
+      + This is currently named `libvapours`.
+    + In the future, kernel functionality will be available as `libmesosphere`.
+  + The build system for stratosphere system modules has been similarly overhauled.
++ A number of other bugs were fixed, including:
+  + A bug was fixed that could cause memory corruption when redirecting certain Romfs content.
+  + A bug was fixed that could cause an infinite loop when redirecting certain Romfs content.
+  + A bug was fixed that could cause certain NROs to fail to load.
+    + This caused the latest version of Super Smash Bros to display "An error has occurred" on launch.
+  + A bug was fixed that caused input/output array sizes for certain circumstances to be calculated incorrectly.
+    + This caused cheats to fail to function properly.
+  + C++ exception code is now more thoroughly removed from stratosphere executables.
+    + This saves a minor amount of memory.
+  + A number of minor logic inversions were fixed in libstratosphere.
+    + These did not affect any code currently used by released Atmosphere binaries.
++ *Please note**: Because this update is releasing so soon after 0.10.0, the removal of the temporary hid-mitm has been postponed to 0.10.2.
+    + Please ensure your homebrew is updated.
++ Random number generation now uses TinyMT instead of XorShift.
++ General system stability improvements to enhance the user's experience.
+## 0.10.0
++ Support was added for 9.1.0
+  + **Please note**: The temporary hid-mitm added in Atmosphere 0.9.0 will be removed in Atmosphere 0.10.1.
+    + Please ensure your homebrew is updated.
++ The Stratosphere rewrite was completed.
+  + libstratosphere was rewritten as part of Stratosphere's refactor.
+    + Code responsible for providing and managing IPC services was greatly improved.
+      + The new code is significantly more accurate (it is bug-for-bug compatible with Nintendo's code), and significantly faster.
+  + ams.mitm was rewritten as part of Stratosphere's refactor.
+    + Saves redirected to the SD card are now separated for sysmmc vs emummc.
+    + **Please note**: If you find any bugs, please report them so they can be fixed.
++ Thanks to the rewrite, Atmosphere now uses significantly less memory.
+  + Roughly 10 additional megabytes are now available for custom system modules to use.
+  + This means you can potentially run more custom system modules simultaneously.
+    + If system modules are incompatible, please ask their authors to reduce their memory footprints.
++ Atmosphere's configuration layout has had major changes.
+  + Configuration now lives inside /atmosphere/config/.
+  + Atmosphere code now knows what default values should be, and includes them in code.
+    + It is no longer an error if configuration inis are not present.
+  + Correspondingly, Atmosphere no longer distributes default configuration inis.
+    + Templates are provided in /atmosphere/config_templates.
+  + loader.ini was renamed to override_config.ini.
+  + This fixes the longstanding problem that atmosphere updates overwrote user configuration when extracted.
++ Atmosphere's process override layout was changed.
+  + Atmosphere now uses the /atmosphere/contents directory, instead of /atmosphere/titles.
+    + This goes along with a refactoring to remove all reference to "title id" from code, as Nintendo does not use the term.
+  + To make this transition easier, a temporary functionality has been added that migrates folders to the new directory.
+    + When booting into 0.10.0, Atmosphere will rename /atmosphere/titles/`<program id>` to /atmosphere/contents/`<program id>`.
+      + This functionality may or may not be removed in some future update.
+    + This should solve any transition difficulties for the typical user.
+    + Please make sure that any future mods you install extract to the correct directory.
++ Support for configuring override keys for hbl was improved.
+  + The key used to override applications versus a specific program can now be different.
+    + The key to override a specific program can be managed via override_key.
+    + The key to override any app can be managed via override_any_app_key.
+  + Default override behavior was changed.
+    + By default, atmosphere will now override the album applet with hbl unless R is held.
+    + By default, atmosphere will now override any application with hbl only if R is held.
++ The default amount of applet memory reserved has been slightly increased.
+  + This allows the profile selector applet to work by default in applet mode.
++ The way process override status is captured was changed.
+  + Process override keys are now captured exactly once, when the process is created.
+    + This fixes the longstanding issue where letting go of the override button partway into the process launch could cause problems.
+  + The Mitm API was changed to pass around override status.
+    + Mitm services now know what keys were held when the client was created, as well as whether the client is HBL/should override contents.
+  + An extension was added to pm:info to allow querying a process's override status.
++ Thanks to process override capture improvements, hbl html behavior has been greatly improved.
+  + Web applets launched by hbl will now always see the /atmosphere/hbl_html filesystem
++ Support was added to exosphere for enabling usermode access to the PMU registers.
+  + This can be controlled via exosphere!enable_user_pmu_access in BCT.ini.
++ An enormous number of minor bugs were fixed.
+  + dmnt's cheat VM had a fix for an inversion in opcode behavior.
+  + An issue was fixed in fs.mitm's management of domain object IDs that could lead to system corruption in rare cases.
+  + The Mitm API no longer silently fails when attempting to handle commands passing C descriptors.
+    + On previous atmosphere versions, certain commands to FS would silently fail due to this...
+      + No users reported any visible errors, but it was definitely a problem behind the scenes.
+    + These commands are now handled correctly.
+  + Atmosphere can now display a fatal error screen significantly earlier in the boot process, if things go wrong early on.
+  + The temporary hid mitm will no longer sometimes cause games to fail to detect input.
+  + Mitm Domain object ID management no longer desynchronizes from the host process.
+  + An issue was fixed that could cause service acquisition to hang forever if certain sm commands were called in a precise order.
+  + An off-by-one was fixed that could cause memory corruption in server memory management.
+  + ... and too many more bugs fixed to reasonably list them all :)
++ General system stability improvements to enhance the user's experience.
+## 0.9.4
++ Support was added for 9.0.0.
+  + **Please note**: 9.0.0 made a number of changes that may cause some issues with homebrew. Details:
+  + 9.0.0 changed HID in a way that causes libnx to be unable to detect button input.
+    + Homebrew should be recompiled with newest libnx to fix this.
+    + Atmosphere now provides a temporary hid-mitm that will cause homebrew to continue to work as expected.
+      + This mitm will be removed in a future Atmosphere revision once homebrew has been updated, to allow users to use a custom hid mitm again if they desire.
+  + 9.0.0 introduced an dependency in FS on the USB system module in order to launch the SD card.
+    + This means the USB system module must now be launched before the SD card is initialized.
+    + Correspondingly, the USB system module can no longer be IPS patched, and its settings cannot be reliably mitm'd.
+    + We know this is frustrating, so we'll be looking into whether there is some way of addressing this in the future.
++ An off-by-one error was fixed in `boot` system module's pinmux initialization.
+  + This could theoretically have caused issues with HdmiCec communication.
+  + No users reported issues, so it's unclear if this was a problem in practice.
++ A bug was fixed that could cause webapplet launching homebrew to improperly set the accessible url whitelist.
++ BIS key generation has been fixed for newer hardware.
+  + Newer hardware uses new, per-firmware device key to generate BIS keys instead of the first device key, so previously the wrong keys were generated as backup.
+  + This only affects units manufactured after ~5.0.0.
++ General system stability improvements to enhance the user's experience.
+## 0.9.3
++ Thanks to hexkyz, fusee's boot sequence has been greatly optimized.
+  + Memory training is now managed by a separate binary (`fusee-mtc`, loaded by fusee-primary before fusee-secondary).
+  + Unnecessarily long splash screen display times were reduced.
+  + The end result is that Atmosphere now boots *significantly* faster. :)
+  + **Note:** This means fusee-primary must be updated for Atmosphere to boot successfully.
++ The version string was adjusted, and now informs users whether or not they are using emummc.
++ Atmosphere now automatically backs up the user's BIS keys on boot.
+  + This should prevent a user from corrupting nand without access to a copy of the keys needed to fix it.
+    + This is especially relevant on ipatched units, where the RCM vulnerability is not an option for addressing bricks.
++ The `pm` system module was rewritten as part of Stratosphere's ongoing refactor.
+  + Support was added for forward-declaring a mitm'd service before a custom user sysmodule is launched.
+    + This should help resolve dependency issues with service registration times.
+  + SM is now informed of every process's title id, including built-in system modules.
++ The `creport` system module was rewritten as part of Stratosphere's ongoing refactor.
+  + creport now dumps up to 0x100 of stack from each thread in the target process.
+  + A few bugs were fixed, including one that caused creport to incorrectly dump process dying messages.
++ Defaults were added to `system_settings.ini` for controlling hbloader's memory usage in applet mode.
+  + These defaults reserve enough memory so that homebrew can launch swkbd while in applet mode.
++ The `fatal` system module was rewritten as part of Stratosphere's ongoing refactor.
+  + Incorrect display output ("2000-0000") has been fixed. Fatal will now correctly show 2162-0002 when this occurs.
+  + A longstanding bug in how fatal manages the displays has been fixed, and official display init behavior is now matched precisely.
++ General system stability improvements to enhance the user's experience.
 ## 0.9.2
 + A number of emummc bugfixes were added (all thanks to @m4xw's hard work). The following is a summary of emummc changes:
   + Support for file-based emummc instances was fixed.

emummc/.gitrepo

@@ -6,7 +6,7 @@
 [subrepo]
 	remote = https://github.com/m4xw/emuMMC
 	branch = develop
-	commit = 5f51fa3b81d2b14b348f6e8579454007019fc7a6
-	parent = e871a754a87631c3036ca985ff1c223e00ef4dda
+	commit = bd81a674a946c30b566e1732a95c18f19b701558
+	parent = 6ee525201ccef107c61d81ba73c891e3eb5f0215
 	method = rebase
 	cmdver = 0.4.0

emummc/README.md

@@ -1,21 +1,21 @@
 # emuMMC
-*A SDMMC driver replacement for Nintendo's Filesystem Services, by **m4xw***  
+*A SDMMC driver replacement for Nintendo's Filesystem Services, by **m4xw***
 
 ### Supported Horizon Versions
-**1.0.0 - 8.1.0**
+**1.0.0 - 9.1.0**
 
 ## Features
-* Arbitrary SDMMC backend selection  
+* Arbitrary SDMMC backend selection
   **This allows loading eMMC from SD or even SD from eMMC**
-* On the fly hooking / patching, fully self-infesting  
+* On the fly hooking / patching, fully self-infesting
   **Only one payload required for all versions!**
-* File-based SDMMC backend support (from SD)  
+* File-based SDMMC backend support (from SD)
   **This allows loading eMMC images from hekate-backups (split or not)**
-* SDMMC device based sector offset (*currently eMMC only*)  
+* SDMMC device based sector offset (*currently eMMC only*)
   **Raw partition support for eMMC from SD with less performance overhead**
-* Full support for `/Nintendo` folder redirection to a arbitrary path  
+* Full support for `/Nintendo` folder redirection to a arbitrary path
   **No 8 char length restriction!**
-* exosphere based context configuration  
+* exosphere based context configuration
   **This includes full support for multiple emuMMC images**
 
 ## Compiling

emummc/source/FS/FS_offsets.c

@@ -41,6 +41,10 @@
 #include "offsets/800_exfat.h"
 #include "offsets/810.h"
 #include "offsets/810_exfat.h"
+#include "offsets/900.h"
+#include "offsets/900_exfat.h"
+#include "offsets/910.h"
+#include "offsets/910_exfat.h"
 #include "../utils/fatal.h"
 
 #define GET_OFFSET_STRUCT_NAME(vers) g_offsets##vers
@@ -92,6 +96,10 @@ DEFINE_OFFSET_STRUCT(_800);
 DEFINE_OFFSET_STRUCT(_800_EXFAT);
 DEFINE_OFFSET_STRUCT(_810);
 DEFINE_OFFSET_STRUCT(_810_EXFAT);
+DEFINE_OFFSET_STRUCT(_900);
+DEFINE_OFFSET_STRUCT(_900_EXFAT);
+DEFINE_OFFSET_STRUCT(_910);
+DEFINE_OFFSET_STRUCT(_910_EXFAT);
 
 const fs_offsets_t *get_fs_offsets(enum FS_VER version) {
     switch (version) {
@@ -145,6 +153,14 @@ const fs_offsets_t *get_fs_offsets(enum FS_VER version) {
             return &(GET_OFFSET_STRUCT_NAME(_810));
         case FS_VER_8_1_0_EXFAT:
             return &(GET_OFFSET_STRUCT_NAME(_810_EXFAT));
+        case FS_VER_9_0_0:
+            return &(GET_OFFSET_STRUCT_NAME(_900));
+        case FS_VER_9_0_0_EXFAT:
+            return &(GET_OFFSET_STRUCT_NAME(_900_EXFAT));
+        case FS_VER_9_1_0:
+            return &(GET_OFFSET_STRUCT_NAME(_910));
+        case FS_VER_9_1_0_EXFAT:
+            return &(GET_OFFSET_STRUCT_NAME(_910_EXFAT));
         default:
             fatal_abort(Fatal_UnknownVersion);
     }

emummc/source/FS/FS_versions.h

@@ -59,6 +59,12 @@ enum FS_VER
     FS_VER_8_1_0,
     FS_VER_8_1_0_EXFAT,
 
+    FS_VER_9_0_0,
+    FS_VER_9_0_0_EXFAT,
+
+    FS_VER_9_1_0,
+    FS_VER_9_1_0_EXFAT,
+
     FS_VER_MAX,
 };
 

emummc/source/FS/offsets/900.h

@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2019 m4xw <m4x@m4xw.net>
+ * Copyright (c) 2019 Atmosphere-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __FS_900_H__
+#define __FS_900_H__
+
+// Accessor vtable getters
+#define FS_OFFSET_900_SDMMC_ACCESSOR_GC   0x1430F0
+#define FS_OFFSET_900_SDMMC_ACCESSOR_SD   0x141200
+#define FS_OFFSET_900_SDMMC_ACCESSOR_NAND 0x13C080
+
+// Hooks
+#define FS_OFFSET_900_SDMMC_WRAPPER_READ  0x1377E0
+#define FS_OFFSET_900_SDMMC_WRAPPER_WRITE 0x1378C0
+#define FS_OFFSET_900_RTLD                0x454
+#define FS_OFFSET_900_RTLD_DESTINATION    0x9C
+
+#define FS_OFFSET_900_CLKRST_SET_MIN_V_CLK_RATE 0x136A00
+
+// Misc funcs
+#define FS_OFFSET_900_LOCK_MUTEX          0x25280
+#define FS_OFFSET_900_UNLOCK_MUTEX        0x252D0
+
+#define FS_OFFSET_900_SDMMC_WRAPPER_CONTROLLER_CLOSE 0x137740
+
+// Misc Data
+#define FS_OFFSET_900_SD_MUTEX            0xE1D3E8
+#define FS_OFFSET_900_NAND_MUTEX          0xE18258
+#define FS_OFFSET_900_ACTIVE_PARTITION    0xE18298
+#define FS_OFFSET_900_SDMMC_DAS_HANDLE    0xDFEFA0
+
+// NOPs
+#define FS_OFFSET_900_SD_DAS_INIT         0x1472BC
+
+// Nintendo Paths
+#define FS_OFFSET_900_NINTENDO_PATHS \
+{ \
+	{.opcode_reg = 3, .adrp_offset = 0x00068A60, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 3, .adrp_offset = 0x00070A40, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 3, .adrp_offset = 0x00081CB4, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 3, .adrp_offset = 0x00081EF4, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 4, .adrp_offset = 0x0008211C, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 0, .adrp_offset = 0, .add_rel_offset = 0}, \
+}
+
+#endif // __FS_900_H__

emummc/source/FS/offsets/900_exfat.h

@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2019 m4xw <m4x@m4xw.net>
+ * Copyright (c) 2019 Atmosphere-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __FS_900_EXFAT_H__
+#define __FS_900_EXFAT_H__
+
+// Accessor vtable getters
+#define FS_OFFSET_900_EXFAT_SDMMC_ACCESSOR_GC   0x1430F0
+#define FS_OFFSET_900_EXFAT_SDMMC_ACCESSOR_SD   0x141200
+#define FS_OFFSET_900_EXFAT_SDMMC_ACCESSOR_NAND 0x13C080
+
+// Hooks
+#define FS_OFFSET_900_EXFAT_SDMMC_WRAPPER_READ  0x1377E0
+#define FS_OFFSET_900_EXFAT_SDMMC_WRAPPER_WRITE 0x1378C0
+#define FS_OFFSET_900_EXFAT_RTLD                0x454
+#define FS_OFFSET_900_EXFAT_RTLD_DESTINATION    0x9C
+
+#define FS_OFFSET_900_EXFAT_CLKRST_SET_MIN_V_CLK_RATE 0x136A00
+
+// Misc funcs
+#define FS_OFFSET_900_EXFAT_LOCK_MUTEX          0x25280
+#define FS_OFFSET_900_EXFAT_UNLOCK_MUTEX        0x252D0
+
+#define FS_OFFSET_900_EXFAT_SDMMC_WRAPPER_CONTROLLER_CLOSE 0x137740
+
+// Misc Data
+#define FS_OFFSET_900_EXFAT_SD_MUTEX            0xE2B3E8
+#define FS_OFFSET_900_EXFAT_NAND_MUTEX          0xE26258
+#define FS_OFFSET_900_EXFAT_ACTIVE_PARTITION    0xE26298
+#define FS_OFFSET_900_EXFAT_SDMMC_DAS_HANDLE    0xE0CFA0
+
+// NOPs
+#define FS_OFFSET_900_EXFAT_SD_DAS_INIT         0x1472BC
+
+// Nintendo Paths
+#define FS_OFFSET_900_EXFAT_NINTENDO_PATHS \
+{ \
+	{.opcode_reg = 3, .adrp_offset = 0x00068A60, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 3, .adrp_offset = 0x00070A40, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 3, .adrp_offset = 0x00081CB4, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 3, .adrp_offset = 0x00081EF4, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 4, .adrp_offset = 0x0008211C, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 0, .adrp_offset = 0, .add_rel_offset = 0}, \
+}
+
+#endif // __FS_900_EXFAT_H__

emummc/source/FS/offsets/910.h

@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2019 m4xw <m4x@m4xw.net>
+ * Copyright (c) 2019 Atmosphere-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __FS_910_H__
+#define __FS_910_H__
+
+// Accessor vtable getters
+#define FS_OFFSET_910_SDMMC_ACCESSOR_GC   0x143100
+#define FS_OFFSET_910_SDMMC_ACCESSOR_SD   0x141210
+#define FS_OFFSET_910_SDMMC_ACCESSOR_NAND 0x13C090
+
+// Hooks
+#define FS_OFFSET_910_SDMMC_WRAPPER_READ  0x1377F0
+#define FS_OFFSET_910_SDMMC_WRAPPER_WRITE 0x1378D0
+#define FS_OFFSET_910_RTLD                0x454
+#define FS_OFFSET_910_RTLD_DESTINATION    0x9C
+
+#define FS_OFFSET_910_CLKRST_SET_MIN_V_CLK_RATE 0x136A10
+
+// Misc funcs
+#define FS_OFFSET_910_LOCK_MUTEX          0x25280
+#define FS_OFFSET_910_UNLOCK_MUTEX        0x252D0
+
+#define FS_OFFSET_910_SDMMC_WRAPPER_CONTROLLER_CLOSE 0x137750
+
+// Misc Data
+#define FS_OFFSET_910_SD_MUTEX            0xE1D3E8
+#define FS_OFFSET_910_NAND_MUTEX          0xE18258
+#define FS_OFFSET_910_ACTIVE_PARTITION    0xE18298
+#define FS_OFFSET_910_SDMMC_DAS_HANDLE    0xDFEFA0
+
+// NOPs
+#define FS_OFFSET_910_SD_DAS_INIT         0x1472CC
+
+// Nintendo Paths
+#define FS_OFFSET_910_NINTENDO_PATHS \
+{ \
+	{.opcode_reg = 3, .adrp_offset = 0x00068A70, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 3, .adrp_offset = 0x00070A50, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 3, .adrp_offset = 0x00081CC4, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 3, .adrp_offset = 0x00081F04, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 4, .adrp_offset = 0x0008212C, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 0, .adrp_offset = 0, .add_rel_offset = 0}, \
+}
+
+#endif // __FS_910_H__

emummc/source/FS/offsets/910_exfat.h

@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2019 m4xw <m4x@m4xw.net>
+ * Copyright (c) 2019 Atmosphere-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __FS_910_EXFAT_H__
+#define __FS_910_EXFAT_H__
+
+// Accessor vtable getters
+#define FS_OFFSET_910_EXFAT_SDMMC_ACCESSOR_GC   0x143100
+#define FS_OFFSET_910_EXFAT_SDMMC_ACCESSOR_SD   0x141210
+#define FS_OFFSET_910_EXFAT_SDMMC_ACCESSOR_NAND 0x13C090
+
+// Hooks
+#define FS_OFFSET_910_EXFAT_SDMMC_WRAPPER_READ  0x1377F0
+#define FS_OFFSET_910_EXFAT_SDMMC_WRAPPER_WRITE 0x1378D0
+#define FS_OFFSET_910_EXFAT_RTLD                0x454
+#define FS_OFFSET_910_EXFAT_RTLD_DESTINATION    0x9C
+
+#define FS_OFFSET_910_EXFAT_CLKRST_SET_MIN_V_CLK_RATE 0x136A10
+
+// Misc funcs
+#define FS_OFFSET_910_EXFAT_LOCK_MUTEX          0x25280
+#define FS_OFFSET_910_EXFAT_UNLOCK_MUTEX        0x252D0
+
+#define FS_OFFSET_910_EXFAT_SDMMC_WRAPPER_CONTROLLER_CLOSE 0x137750
+
+// Misc Data
+#define FS_OFFSET_910_EXFAT_SD_MUTEX            0xE2B3E8
+#define FS_OFFSET_910_EXFAT_NAND_MUTEX          0xE26258
+#define FS_OFFSET_910_EXFAT_ACTIVE_PARTITION    0xE26298
+#define FS_OFFSET_910_EXFAT_SDMMC_DAS_HANDLE    0xE0CFA0
+
+// NOPs
+#define FS_OFFSET_910_EXFAT_SD_DAS_INIT         0x1472CC
+
+// Nintendo Paths
+#define FS_OFFSET_910_EXFAT_NINTENDO_PATHS \
+{ \
+	{.opcode_reg = 3, .adrp_offset = 0x00068A70, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 3, .adrp_offset = 0x00070A50, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 3, .adrp_offset = 0x00081CC4, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 3, .adrp_offset = 0x00081F04, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 4, .adrp_offset = 0x0008212C, .add_rel_offset = 0x00000004}, \
+	{.opcode_reg = 0, .adrp_offset = 0, .add_rel_offset = 0}, \
+}
+
+#endif // __FS_910_EXFAT_H__

emummc/source/utils/fatal.c

@@ -15,13 +15,26 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <string.h>
 #include "fatal.h"
 
 void __attribute__((noreturn)) fatal_abort(enum FatalReason abortReason)
 {
+    atmosphere_fatal_error_ctx error_ctx;
+    memset(&error_ctx, 0, sizeof(atmosphere_fatal_error_ctx));
+
+    // Basic error storage for Atmosphere
+    // TODO: Maybe include a small reboot2payload stub?
+    error_ctx.magic = ATMOSPHERE_REBOOT_TO_FATAL_MAGIC;
+    error_ctx.title_id = 0x0100000000000000; // FS
+    error_ctx.error_desc = abortReason;
+
+    // Copy fatal context
+    smcCopyToIram(ATMOSPHERE_FATAL_ERROR_ADDR, &error_ctx, sizeof(atmosphere_fatal_error_ctx));
+
     // Reboot to RCM
     smcRebootToRcm();
 
-    while(true)
+    while (true)
         ; // Should never be reached
 }

emummc/source/utils/fatal.h

@@ -18,7 +18,8 @@
 #pragma once
 #include "../nx/smc.h"
 
-enum FatalReason {
+enum FatalReason
+{
     Fatal_InitMMC = 0,
     Fatal_InitSD,
     Fatal_InvalidAccessor,
@@ -32,4 +33,45 @@ enum FatalReason {
     Fatal_Max
 };
 
+#define AMS_FATAL_ERROR_MAX_STACKTRACE 0x20
+#define AMS_FATAL_ERROR_MAX_STACKDUMP 0x100
+
+/* Atmosphere reboot-to-fatal-error. */
+typedef struct
+{
+    uint32_t magic;
+    uint32_t error_desc;
+    uint64_t title_id;
+    union {
+        uint64_t gprs[32];
+        struct
+        {
+            uint64_t _gprs[29];
+            uint64_t fp;
+            uint64_t lr;
+            uint64_t sp;
+        };
+    };
+    uint64_t pc;
+    uint64_t module_base;
+    uint32_t pstate;
+    uint32_t afsr0;
+    uint32_t afsr1;
+    uint32_t esr;
+    uint64_t far;
+    uint64_t report_identifier; /* Normally just system tick. */
+    uint64_t stack_trace_size;
+    uint64_t stack_dump_size;
+    uint64_t stack_trace[AMS_FATAL_ERROR_MAX_STACKTRACE];
+    uint8_t stack_dump[AMS_FATAL_ERROR_MAX_STACKDUMP];
+} atmosphere_fatal_error_ctx;
+
+/* "AFE1" */
+#define ATMOSPHERE_REBOOT_TO_FATAL_MAGIC 0x31454641
+/* "AFE0" */
+#define ATMOSPHERE_REBOOT_TO_FATAL_MAGIC_0 0x30454641
+
+#define ATMOSPHERE_FATAL_ERROR_ADDR 0x4003E000
+#define ATMOSPHERE_FATAL_ERROR_CONTEXT ((volatile atmosphere_fatal_error_ctx *)(ATMOSPHERE_FATAL_ERROR_ADDR))
+
 void __attribute__((noreturn)) fatal_abort(enum FatalReason abortReason);

exosphere/Makefile

@@ -28,7 +28,7 @@ TARGET		:=	$(notdir $(CURDIR))
 BUILD		:=	build
 SOURCES		:=	src src/dbg
 DATA		:=	data
-INCLUDES	:=	include ../common/include
+INCLUDES	:=	include ../libraries/libvapours/include
 
 #---------------------------------------------------------------------------------
 # options for code generation
@@ -48,7 +48,7 @@ CFLAGS	:= \
 	-Wall \
 	$(ARCH) $(DEFINES)
 
-CFLAGS	+=	$(INCLUDE) 
+CFLAGS	+=	$(INCLUDE)
 
 CXXFLAGS	:= $(CFLAGS) -fno-rtti -fno-exceptions -std=gnu++11
 

exosphere/lp0fw/Makefile

@@ -20,7 +20,7 @@ TARGET		:=	$(notdir $(CURDIR))
 BUILD		:=	build
 SOURCES		:=	src
 DATA		:=	data
-INCLUDES	:=	include ../../common/include
+INCLUDES	:=	include ../../libraries/libvapours/include
 
 #---------------------------------------------------------------------------------
 # options for code generation

exosphere/lp0fw/src/car.c

@@ -13,7 +13,7 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
- 
+
 #include <stdint.h>
 
 #include "utils.h"
@@ -33,7 +33,7 @@ static inline uint32_t get_special_clk_reg(CarDevice dev) {
         case CARDEVICE_BPMP: return 0;
         default: reboot();
     }
-} 
+}
 
 static inline uint32_t get_special_clk_val(CarDevice dev) {
     switch (dev) {
@@ -48,19 +48,19 @@ static inline uint32_t get_special_clk_val(CarDevice dev) {
 }
 
 static uint32_t g_clk_reg_offsets[NUM_CAR_BANKS] = {0x010, 0x014, 0x018, 0x360, 0x364, 0x280, 0x298};
-static uint32_t g_rst_reg_offsets[NUM_CAR_BANKS] = {0x004, 0x008, 0x00C, 0x358, 0x35C, 0x28C, 0x2A4}; 
+static uint32_t g_rst_reg_offsets[NUM_CAR_BANKS] = {0x004, 0x008, 0x00C, 0x358, 0x35C, 0x28C, 0x2A4};
 
 static uint32_t g_clk_clr_reg_offsets[NUM_CAR_BANKS] = {0x324, 0x32C, 0x334, 0x444, 0x44C, 0x228, 0x2A0};
 
 void car_configure_oscillators(void) {
     /* Enable the crystal oscillator, setting drive strength to the saved value in PMC. */
     CLK_RST_CONTROLLER_OSC_CTRL_0 = (CLK_RST_CONTROLLER_OSC_CTRL_0 & 0xFFFFFC0E) | 1 | (((APBDEV_PMC_OSC_EDPD_OVER_0 >> 1) & 0x3F) << 4);
-    
+
     /* Set CLK_M_DIVISOR to 1 (causes actual division by 2.) */
     CLK_RST_CONTROLLER_SPARE_REG0_0 = (1 << 2);
     /* Reading the register after writing it is required to ensure value takes. */
     (void)(CLK_RST_CONTROLLER_SPARE_REG0_0);
-    
+
     /* Set TIMERUS_USEC_CFG to cycle at 0x60 / 0x5 = 19.2 MHz. */
     /* Value is (dividend << 8) | (divisor). */
     TIMERUS_USEC_CFG_0 = 0x45F;
@@ -68,30 +68,30 @@ void car_configure_oscillators(void) {
 
 void car_mbist_workaround(void) {
     /* This code works around MBIST bug. */
-    
+
     /* Clear LVL2_CLK_GATE_OVR* registers. */
     CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRA_0 = 0;
     CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRB_0 = 0;
     CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRC_0 = 0;
     CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRD_0 = 0;
     CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRE_0 = 0;
-    
+
     /* Clear bit patterns in CAR. */
-    /* L: Reset all but RTC, TMR, GPIO, BPMP Cache (CACHE2). */ 
+    /* L: Reset all but RTC, TMR, GPIO, BPMP Cache (CACHE2). */
     MAKE_CAR_REG(g_clk_clr_reg_offsets[0]) = MAKE_CAR_REG(g_clk_reg_offsets[0]) & 0x7FFFFECF;
-    /* H: Reset all but MC, PMC, FUSE, EMC. */ 
+    /* H: Reset all but MC, PMC, FUSE, EMC. */
     MAKE_CAR_REG(g_clk_clr_reg_offsets[1]) = MAKE_CAR_REG(g_clk_reg_offsets[1]) & 0xFDFFFF3E;
-    /* U: Reset all but CSITE, IRAM[A-D], BPMP Cache RAM (CRAM2). */ 
+    /* U: Reset all but CSITE, IRAM[A-D], BPMP Cache RAM (CRAM2). */
     MAKE_CAR_REG(g_clk_clr_reg_offsets[2]) = MAKE_CAR_REG(g_clk_reg_offsets[2]) & 0xFE0FFDFF;
-    /* V: Reset all but MSELECT, S/PDIF audio doubler, TZRAM, SE. */ 
+    /* V: Reset all but MSELECT, S/PDIF audio doubler, TZRAM, SE. */
     MAKE_CAR_REG(g_clk_clr_reg_offsets[3]) = MAKE_CAR_REG(g_clk_reg_offsets[3]) & 0x3FBFFFF7;
-    /* W: Reset all but PCIERX[0-5], ENTROPY. */ 
+    /* W: Reset all but PCIERX[0-5], ENTROPY. */
     MAKE_CAR_REG(g_clk_clr_reg_offsets[4]) = MAKE_CAR_REG(g_clk_reg_offsets[4]) & 0xFFDFFF03;
-    /* X: Reset all but ETC, MCLK, MCLK2, I2C6, EMC_DLL, GPU, DBGAPB, PLLG_REF, . */ 
+    /* X: Reset all but ETC, MCLK, MCLK2, I2C6, EMC_DLL, GPU, DBGAPB, PLLG_REF, . */
     MAKE_CAR_REG(g_clk_clr_reg_offsets[5]) = MAKE_CAR_REG(g_clk_reg_offsets[5]) & 0xDCFFB87F;
-    /* Y: Reset all but MC_CDPA, MC_CCPA. */ 
+    /* Y: Reset all but MC_CDPA, MC_CCPA. */
     MAKE_CAR_REG(g_clk_clr_reg_offsets[6]) = MAKE_CAR_REG(g_clk_reg_offsets[6]) & 0xFFFFFCFF;
-    
+
     /* Enable clock to MC1, if CH1 is enabled in EMC. */
     if (EMC_FBIO_CFG7_0 & 4) { /* CH1_ENABLE */
         CLK_RST_CONTROLLER_CLK_ENB_W_SET_0 |= 0x40000000; /* SET_CLK_ENB_MC1 */
@@ -132,3 +132,7 @@ void clkrst_reboot(CarDevice dev) {
     clkrst_disable(dev);
     clkrst_enable(dev);
 }
+
+void clkrst_enable_fuse_regs(bool enable) {
+    CLK_RST_CONTROLLER_MISC_CLK_ENB_0 = ((CLK_RST_CONTROLLER_MISC_CLK_ENB_0 & 0xEFFFFFFF) | ((enable & 1) << 28));
+}

exosphere/lp0fw/src/car.h

@@ -79,7 +79,7 @@ typedef enum {
     CARDEVICE_UARTC = ((1 << 5) | 0x17),
     CARDEVICE_I2C1 = ((0 << 5) | 0xC),
     CARDEVICE_I2C5 = ((1 << 5) | 0xF),
-    CARDEVICE_UNK = ((3 << 5) | 0x1E),
+    CARDEVICE_TZRAM = ((3 << 5) | 0x1E),
     CARDEVICE_SE = ((3 << 5) | 0x1F),
     CARDEVICE_HOST1X = ((0 << 5) | 0x1C),
     CARDEVICE_TSEC = ((2 << 5) | 0x13),
@@ -103,7 +103,8 @@ void rst_disable(CarDevice dev);
 
 void clkrst_enable(CarDevice dev);
 void clkrst_disable(CarDevice dev);
-
 void clkrst_reboot(CarDevice dev);
 
+void clkrst_enable_fuse_regs(bool enable);
+
 #endif

exosphere/lp0fw/src/fuse.c

@@ -29,7 +29,7 @@ bool fuse_check_downgrade_status(void) {
 }
 
 void fuse_disable_programming(void) {
-    FUSE_REGS->FUSE_DIS_PGM = 1;
+    FUSE_REGS->FUSE_DISABLEREGPROGRAM = 1;
 }
 
 static fuse_bypass_data_t g_fuse_bypass_entries[NUM_FUSE_BYPASS_ENTRIES] = {
@@ -37,13 +37,14 @@ static fuse_bypass_data_t g_fuse_bypass_entries[NUM_FUSE_BYPASS_ENTRIES] = {
 };
 
 void fuse_configure_fuse_bypass(void) {
-    /* Enable fuses in CAR? This seems to affect fuse data visibility. */
-    CLK_RST_CONTROLLER_MISC_CLK_ENB_0 |= 0x10000000;
+    /* Make all fuse registers visible. */
+    clkrst_enable_fuse_regs(true);
     
-    /* Configure bypass/override, only if programming is allowed.  */
-    if (!(FUSE_REGS->FUSE_DIS_PGM & 1)) {
-        /* Enable write access. */
-        FUSE_REGS->FUSE_WRITE_ACCESS = (FUSE_REGS->FUSE_WRITE_ACCESS & ~0x1) | 0x10000;
+    /* Configure bypass/override, only if programming is allowed. */
+    if (!(FUSE_REGS->FUSE_DISABLEREGPROGRAM & 1)) {
+        /* Enable write access and flush status. */
+        FUSE_REGS->FUSE_WRITE_ACCESS_SW = (FUSE_REGS->FUSE_WRITE_ACCESS_SW & ~0x1) | 0x10000;
+        
         /* Enable fuse bypass config. */
         FUSE_REGS->FUSE_FUSEBYPASS = 1;
         
@@ -53,7 +54,7 @@ void fuse_configure_fuse_bypass(void) {
         }
         
         /* Disable fuse write access. */
-        FUSE_REGS->FUSE_WRITE_ACCESS |= 1;
+        FUSE_REGS->FUSE_WRITE_ACCESS_SW |= 1;
         
         /* Enable fuse bypass config. */
         /* I think this is a bug, and Nintendo meant to write 0 here? */
@@ -63,7 +64,7 @@ void fuse_configure_fuse_bypass(void) {
         /* I have no idea why this happens. What? */
         /* This is probably also either a bug or does nothing. */
         /* Is this bit even clearable? */
-        FUSE_REGS->FUSE_DIS_PGM &= 0xFFFFFFFE;
+        FUSE_REGS->FUSE_DISABLEREGPROGRAM &= 0xFFFFFFFE;
         
         /* Restore saved private key disable bit. */
         FUSE_REGS->FUSE_PRIVATEKEYDISABLE |= (APBDEV_PMC_SECURE_SCRATCH21_0 & 0x10);
@@ -71,5 +72,4 @@ void fuse_configure_fuse_bypass(void) {
         /* Lock private key disable secure scratch. */
         APBDEV_PMC_SEC_DISABLE2_0 |= 0x4000000;
     }
-    
-}
+}

exosphere/lp0fw/src/fuse.h

@@ -23,154 +23,167 @@
 #include "utils.h"
 
 typedef struct {
-    uint32_t FUSE_CTRL;
-    uint32_t FUSE_REG_ADDR;
-    uint32_t FUSE_REG_READ;
-    uint32_t FUSE_REG_WRITE;
-    uint32_t FUSE_TIME_RD1;
-    uint32_t FUSE_TIME_RD2;
-    uint32_t FUSE_TIME_PGM1;
-    uint32_t FUSE_TIME_PGM2;
-    uint32_t FUSE_PRIV2INTFC;
+    uint32_t FUSE_FUSECTRL;
+    uint32_t FUSE_FUSEADDR;
+    uint32_t FUSE_FUSERDATA;
+    uint32_t FUSE_FUSEWDATA;
+    uint32_t FUSE_FUSETIME_RD1;
+    uint32_t FUSE_FUSETIME_RD2;
+    uint32_t FUSE_FUSETIME_PGM1;
+    uint32_t FUSE_FUSETIME_PGM2;
+    uint32_t FUSE_PRIV2INTFC_START;
     uint32_t FUSE_FUSEBYPASS;
     uint32_t FUSE_PRIVATEKEYDISABLE;
-    uint32_t FUSE_DIS_PGM;
-    uint32_t FUSE_WRITE_ACCESS;
+    uint32_t FUSE_DISABLEREGPROGRAM;
+    uint32_t FUSE_WRITE_ACCESS_SW;
     uint32_t FUSE_PWR_GOOD_SW;
-    uint32_t _0x38[0x32];
-} fuse_registers_t;
+    uint32_t _0x38;
+    uint32_t FUSE_PRIV2RESHIFT;
+    uint32_t _0x40[0x3];
+    uint32_t FUSE_FUSETIME_RD3;
+    uint32_t _0x50[0xC];
+    uint32_t FUSE_PRIVATE_KEY0_NONZERO;
+    uint32_t FUSE_PRIVATE_KEY1_NONZERO;
+    uint32_t FUSE_PRIVATE_KEY2_NONZERO;
+    uint32_t FUSE_PRIVATE_KEY3_NONZERO;
+    uint32_t FUSE_PRIVATE_KEY4_NONZERO;
+    uint32_t _0x90[0x1C];
+} tegra_fuse_t;
 
 typedef struct {
     uint32_t FUSE_PRODUCTION_MODE;
-    uint32_t _0x4;
-    uint32_t _0x8;
-    uint32_t _0xC;
+    uint32_t FUSE_JTAG_SECUREID_VALID;
+    uint32_t FUSE_ODM_LOCK;
+    uint32_t FUSE_OPT_OPENGL_EN;
     uint32_t FUSE_SKU_INFO;
-    uint32_t FUSE_CPU_SPEEDO_0;
-    uint32_t FUSE_CPU_IDDQ;
-    uint32_t _0x1C;
-    uint32_t _0x20;
-    uint32_t _0x24;
-    uint32_t FUSE_FT_REV;
-    uint32_t FUSE_CPU_SPEEDO_1;
-    uint32_t FUSE_CPU_SPEEDO_2;
-    uint32_t FUSE_SOC_SPEEDO_0;
-    uint32_t FUSE_SOC_SPEEDO_1;
-    uint32_t FUSE_SOC_SPEEDO_2;
-    uint32_t FUSE_SOC_IDDQ;
-    uint32_t _0x44;
+    uint32_t FUSE_CPU_SPEEDO_0_CALIB;
+    uint32_t FUSE_CPU_IDDQ_CALIB;
+    uint32_t FUSE_DAC_CRT_CALIB;
+    uint32_t FUSE_DAC_HDTV_CALIB;
+    uint32_t FUSE_DAC_SDTV_CALIB;
+    uint32_t FUSE_OPT_FT_REV;
+    uint32_t FUSE_CPU_SPEEDO_1_CALIB;
+    uint32_t FUSE_CPU_SPEEDO_2_CALIB;
+    uint32_t FUSE_SOC_SPEEDO_0_CALIB;
+    uint32_t FUSE_SOC_SPEEDO_1_CALIB;
+    uint32_t FUSE_SOC_SPEEDO_2_CALIB;
+    uint32_t FUSE_SOC_IDDQ_CALIB;
+    uint32_t FUSE_RESERVED_PRODUCTION_WP;
     uint32_t FUSE_FA;
-    uint32_t _0x4C;
-    uint32_t _0x50;
-    uint32_t _0x54;
-    uint32_t _0x58;
-    uint32_t _0x5C;
-    uint32_t _0x60;
+    uint32_t FUSE_RESERVED_PRODUCTION;
+    uint32_t FUSE_HDMI_LANE0_CALIB;
+    uint32_t FUSE_HDMI_LANE1_CALIB;
+    uint32_t FUSE_HDMI_LANE2_CALIB;
+    uint32_t FUSE_HDMI_LANE3_CALIB;
+    uint32_t FUSE_ENCRYPTION_RATE;
     uint32_t FUSE_PUBLIC_KEY[0x8];
-    uint32_t FUSE_TSENSOR_1;
-    uint32_t FUSE_TSENSOR_2;
-    uint32_t _0x8C;
-    uint32_t FUSE_CP_REV;
-    uint32_t _0x94;
-    uint32_t FUSE_TSENSOR_0;
-    uint32_t FUSE_FIRST_BOOTROM_PATCH_SIZE_REG;
+    uint32_t FUSE_TSENSOR1_CALIB;
+    uint32_t FUSE_TSENSOR2_CALIB;
+    uint32_t FUSE_VSENSOR_CALIB;
+    uint32_t FUSE_OPT_CP_REV;
+    uint32_t FUSE_OPT_PFG;
+    uint32_t FUSE_TSENSOR0_CALIB;
+    uint32_t FUSE_FIRST_BOOTROM_PATCH_SIZE;
     uint32_t FUSE_SECURITY_MODE;
-    uint32_t FUSE_PRIVATE_KEY[0x4];
-    uint32_t FUSE_DEVICE_KEY;
-    uint32_t _0xB8;
-    uint32_t _0xBC;
+    uint32_t FUSE_PRIVATE_KEY[0x5];
+    uint32_t FUSE_ARM_JTAG_DIS;
+    uint32_t FUSE_BOOT_DEVICE_INFO;
     uint32_t FUSE_RESERVED_SW;
-    uint32_t FUSE_VP8_ENABLE;
+    uint32_t FUSE_OPT_VP9_DISABLE;
     uint32_t FUSE_RESERVED_ODM[0x8];
-    uint32_t _0xE8;
-    uint32_t _0xEC;
-    uint32_t FUSE_SKU_USB_CALIB;
+    uint32_t FUSE_OBS_DIS;
+    uint32_t FUSE_NOR_INFO;
+    uint32_t FUSE_USB_CALIB;
     uint32_t FUSE_SKU_DIRECT_CONFIG;
-    uint32_t _0xF8;
-    uint32_t _0xFC;
-    uint32_t FUSE_VENDOR_CODE;
-    uint32_t FUSE_FAB_CODE;
-    uint32_t FUSE_LOT_CODE_0;
-    uint32_t FUSE_LOT_CODE_1;
-    uint32_t FUSE_WAFER_ID;
-    uint32_t FUSE_X_COORDINATE;
-    uint32_t FUSE_Y_COORDINATE;
-    uint32_t _0x11C;
-    uint32_t _0x120;
+    uint32_t FUSE_KFUSE_PRIVKEY_CTRL;
+    uint32_t FUSE_PACKAGE_INFO;
+    uint32_t FUSE_OPT_VENDOR_CODE;
+    uint32_t FUSE_OPT_FAB_CODE;
+    uint32_t FUSE_OPT_LOT_CODE_0;
+    uint32_t FUSE_OPT_LOT_CODE_1;
+    uint32_t FUSE_OPT_WAFER_ID;
+    uint32_t FUSE_OPT_X_COORDINATE;
+    uint32_t FUSE_OPT_Y_COORDINATE;
+    uint32_t FUSE_OPT_SEC_DEBUG_EN;
+    uint32_t FUSE_OPT_OPS_RESERVED;
     uint32_t FUSE_SATA_CALIB;
-    uint32_t FUSE_GPU_IDDQ;
-    uint32_t FUSE_TSENSOR_3;
-    uint32_t _0x130;
-    uint32_t _0x134;
-    uint32_t _0x138;
-    uint32_t _0x13C;
-    uint32_t _0x140;
-    uint32_t _0x144;
+    uint32_t FUSE_GPU_IDDQ_CALIB;
+    uint32_t FUSE_TSENSOR3_CALIB;
+    uint32_t FUSE_SKU_BOND_OUT_L;
+    uint32_t FUSE_SKU_BOND_OUT_H;
+    uint32_t FUSE_SKU_BOND_OUT_U;
+    uint32_t FUSE_SKU_BOND_OUT_V;
+    uint32_t FUSE_SKU_BOND_OUT_W;
+    uint32_t FUSE_OPT_SAMPLE_TYPE;
     uint32_t FUSE_OPT_SUBREVISION;
-    uint32_t _0x14C;
-    uint32_t _0x150;
-    uint32_t FUSE_TSENSOR_4;
-    uint32_t FUSE_TSENSOR_5;
-    uint32_t FUSE_TSENSOR_6;
-    uint32_t FUSE_TSENSOR_7;
-    uint32_t FUSE_OPT_PRIV_SEC_DIS;
+    uint32_t FUSE_OPT_SW_RESERVED_0;
+    uint32_t FUSE_OPT_SW_RESERVED_1;
+    uint32_t FUSE_TSENSOR4_CALIB;
+    uint32_t FUSE_TSENSOR5_CALIB;
+    uint32_t FUSE_TSENSOR6_CALIB;
+    uint32_t FUSE_TSENSOR7_CALIB;
+    uint32_t FUSE_OPT_PRIV_SEC_EN;
     uint32_t FUSE_PKC_DISABLE;
     uint32_t _0x16C;
     uint32_t _0x170;
     uint32_t _0x174;
     uint32_t _0x178;
-    uint32_t _0x17C;
+    uint32_t FUSE_FUSE2TSEC_DEBUG_DISABLE;
     uint32_t FUSE_TSENSOR_COMMON;
-    uint32_t _0x184;
-    uint32_t _0x188;
-    uint32_t _0x18C;
-    uint32_t _0x190;
+    uint32_t FUSE_OPT_CP_BIN;
+    uint32_t FUSE_OPT_GPU_DISABLE;
+    uint32_t FUSE_OPT_FT_BIN;
+    uint32_t FUSE_OPT_DONE_MAP;
     uint32_t _0x194;
-    uint32_t _0x198;
-    uint32_t FUSE_DEBUG_AUTH_OVERRIDE;
+    uint32_t FUSE_APB2JTAG_DISABLE;
+    uint32_t FUSE_ODM_INFO;
     uint32_t _0x1A0;
     uint32_t _0x1A4;
-    uint32_t _0x1A8;
+    uint32_t FUSE_ARM_CRYPT_DE_FEATURE;
     uint32_t _0x1AC;
     uint32_t _0x1B0;
     uint32_t _0x1B4;
     uint32_t _0x1B8;
     uint32_t _0x1BC;
-    uint32_t _0x1D0;
-    uint32_t FUSE_TSENSOR_8;
+    uint32_t FUSE_WOA_SKU_FLAG;
+    uint32_t FUSE_ECO_RESERVE_1;
+    uint32_t FUSE_GCPLEX_CONFIG_FUSE;
+    uint32_t FUSE_PRODUCTION_MONTH;
+    uint32_t FUSE_RAM_REPAIR_INDICATOR;
+    uint32_t FUSE_TSENSOR9_CALIB;
     uint32_t _0x1D8;
-    uint32_t _0x1DC;
-    uint32_t _0x1E0;
-    uint32_t _0x1E4;
-    uint32_t _0x1E8;
-    uint32_t _0x1EC;
-    uint32_t _0x1F0;
-    uint32_t _0x1F4;
-    uint32_t _0x1F8;
+    uint32_t FUSE_VMIN_CALIBRATION;
+    uint32_t FUSE_AGING_SENSOR_CALIBRATION;
+    uint32_t FUSE_DEBUG_AUTHENTICATION;
+    uint32_t FUSE_SECURE_PROVISION_INDEX;
+    uint32_t FUSE_SECURE_PROVISION_INFO;
+    uint32_t FUSE_OPT_GPU_DISABLE_CP1;
+    uint32_t FUSE_SPARE_ENDIS;
+    uint32_t FUSE_ECO_RESERVE_0;
     uint32_t _0x1FC;
     uint32_t _0x200;
-    uint32_t FUSE_RESERVED_CALIB;
-    uint32_t _0x208;
-    uint32_t _0x20C;
-    uint32_t _0x210;
-    uint32_t _0x214;
-    uint32_t _0x218;
-    uint32_t FUSE_TSENSOR_9;
-    uint32_t _0x220;
-    uint32_t _0x224;
-    uint32_t _0x228;
-    uint32_t _0x22C;
-    uint32_t _0x230;
-    uint32_t _0x234;
-    uint32_t _0x238;
-    uint32_t _0x23C;
-    uint32_t _0x240;
-    uint32_t _0x244;
-    uint32_t _0x248;
-    uint32_t _0x24C;
+    uint32_t FUSE_RESERVED_CALIB0;
+    uint32_t FUSE_RESERVED_CALIB1;
+    uint32_t FUSE_OPT_GPU_TPC0_DISABLE;
+    uint32_t FUSE_OPT_GPU_TPC0_DISABLE_CP1;
+    uint32_t FUSE_OPT_CPU_DISABLE;
+    uint32_t FUSE_OPT_CPU_DISABLE_CP1;
+    uint32_t FUSE_TSENSOR10_CALIB;
+    uint32_t FUSE_TSENSOR10_CALIB_AUX;
+    uint32_t FUSE_OPT_RAM_SVOP_DP;
+    uint32_t FUSE_OPT_RAM_SVOP_PDP;
+    uint32_t FUSE_OPT_RAM_SVOP_REG;
+    uint32_t FUSE_OPT_RAM_SVOP_SP;
+    uint32_t FUSE_OPT_RAM_SVOP_SMPDP;
+    uint32_t FUSE_OPT_GPU_TPC0_DISABLE_CP2;
+    uint32_t FUSE_OPT_GPU_TPC1_DISABLE;
+    uint32_t FUSE_OPT_GPU_TPC1_DISABLE_CP1;
+    uint32_t FUSE_OPT_GPU_TPC1_DISABLE_CP2;
+    uint32_t FUSE_OPT_CPU_DISABLE_CP2;
+    uint32_t FUSE_OPT_GPU_DISABLE_CP2;
     uint32_t FUSE_USB_CALIB_EXT;
-    uint32_t _0x254;
-    uint32_t _0x258;
+    uint32_t FUSE_RESERVED_FIELD;
+    uint32_t FUSE_OPT_ECC_EN;
     uint32_t _0x25C;
     uint32_t _0x260;
     uint32_t _0x264;
@@ -179,12 +192,12 @@ typedef struct {
     uint32_t _0x270;
     uint32_t _0x274;
     uint32_t _0x278;
-    uint32_t _0x27C;
+    uint32_t FUSE_SPARE_REALIGNMENT_REG;
     uint32_t FUSE_SPARE_BIT[0x20];
-} fuse_chip_registers_t;
+} tegra_fuse_chip_t;
 
-#define FUSE_REGS       ((volatile fuse_registers_t *)(0x7000F800))
-#define FUSE_CHIP_REGS  ((volatile fuse_chip_registers_t *)(0x7000F900))
+#define FUSE_REGS       ((volatile tegra_fuse_t *)(0x7000F800))
+#define FUSE_CHIP_REGS  ((volatile tegra_fuse_chip_t *)(0x7000F900))
 
 #define MAKE_FUSE_REG(n) MAKE_REG32(0x7000F800 + n)
 
@@ -194,9 +207,7 @@ typedef struct {
 } fuse_bypass_data_t;
 
 bool fuse_check_downgrade_status(void);
-
 void fuse_configure_fuse_bypass(void);
-
 void fuse_disable_programming(void);
 
 #endif

exosphere/lp0fw/src/mc.h

@@ -35,6 +35,14 @@
 #define MC_SMMU_PTB_DATA                                        0x20
 #define MC_SMMU_TLB_FLUSH                                       0x30
 #define MC_SMMU_PTC_FLUSH                                       0x34
+#define MC_SMMU_ASID_SECURITY                                   0x38
+#define MC_SMMU_ASID_SECURITY_1                                 0x3c
+#define MC_SMMU_ASID_SECURITY_2                                 0x9e0
+#define MC_SMMU_ASID_SECURITY_3                                 0x9e4
+#define MC_SMMU_ASID_SECURITY_4                                 0x9e8
+#define MC_SMMU_ASID_SECURITY_5                                 0x9ec
+#define MC_SMMU_ASID_SECURITY_6                                 0x9f0
+#define MC_SMMU_ASID_SECURITY_7                                 0x9f4
 #define MC_SMMU_AFI_ASID                                        0x238
 #define MC_SMMU_AVPC_ASID                                       0x23c
 #define MC_SMMU_PPCS1_ASID                                      0x298

exosphere/lp0fw/src/misc.c

@@ -23,26 +23,26 @@
 #include "pmc.h"
 
 void misc_configure_device_dbg_settings(void) {
-    /* Enable RTCK daisychaining by setting TBE bit. */
+    /* Set APB_MISC_PP_CONFIG_CTL_TBE (enables RTCK daisy-chaining). */
     APB_MISC_PP_CONFIG_CTL_0 = 0x80;
     
-    /* Literally none of this is documented in the TRM, lol. */
+    /* Configure JTAG and debug bits. */
     if (FUSE_CHIP_REGS->FUSE_SECURITY_MODE == 1) {
-        uint32_t secure_boot_val = 0b0100; /* Sets NIDEN for aarch64. */
-        uint32_t misc_val = 0x40;
+        uint32_t secure_boot_val = 0b0100;      /* Set NIDEN for aarch64. */
+        uint32_t pp_config_ctl_val = 0x40;      /* Set APB_MISC_PP_CONFIG_CTL_JTAG. */
         if (APBDEV_PMC_STICKY_BITS_0 & 0x40) {
-            misc_val = 0x0;
+            pp_config_ctl_val = 0x0;
         } else {
-            secure_boot_val = 0b1101; /* Sets SPNIDEN, NIDEN, DBGEN for aarch64. */
+            secure_boot_val = 0b1101;           /* Set SPNIDEN, NIDEN, DBGEN for aarch64. */
         }
-        SB_PFCFG_0 = (SB_PFCFG_0 & ~0b1111) | secure_boot_val; /* Configures debug bits. */
-        APB_MISC_PP_CONFIG_CTL_0 |= misc_val; /* Undocumented, seems to control invasive debugging/JTAG. */
+        SB_PFCFG_0 = (SB_PFCFG_0 & ~0b1111) | secure_boot_val;      /* Configure debug bits. */
+        APB_MISC_PP_CONFIG_CTL_0 |= pp_config_ctl_val;              /* Configure JTAG. */
     }
     
-    /* Set sticky bits based SECURITY_MODE. */
+    /* Set HDA_LPBK_DIS if FUSE_SECURITY_MODE is set (disables HDA codec loopback). */
     APBDEV_PMC_STICKY_BITS_0 |= FUSE_CHIP_REGS->FUSE_SECURITY_MODE;
     
-    /* Set E_INPUT in PINMUX_AUX_GPIO_PA6_0 */
+    /* Set E_INPUT in PINMUX_AUX_GPIO_PA6_0 (needed by the XUSB and SATA controllers). */
     PINMUX_AUX_GPIO_PA6_0 |= 0x40;
 }
 

exosphere/lp0fw/src/misc.h

@@ -26,17 +26,14 @@
 #define MAKE_MISC_REG(n) MAKE_REG32(MISC_BASE + n)
 
 #define APB_MISC_PP_CONFIG_CTL_0 MAKE_MISC_REG(0x024)
-
 #define APB_MISC_GP_ASDBGREG_0 MAKE_MISC_REG(0x810)
 
 #define PINMUX_AUX_PWR_I2C_SCL_0 MAKE_MISC_REG(0x30DC)
 #define PINMUX_AUX_PWR_I2C_SDA_0 MAKE_MISC_REG(0x30E0)
 #define PINMUX_AUX_DVFS_PWM_0    MAKE_MISC_REG(0x3184)
-
 #define PINMUX_AUX_GPIO_PA6_0 MAKE_MISC_REG(0x3244)
 
 void misc_configure_device_dbg_settings(void);
-
 void misc_restore_ram_svop(void);
 
 #endif

exosphere/lp0fw/src/pmc.h

@@ -23,47 +23,35 @@
 
 #define MAKE_PMC_REG(ofs) (MAKE_REG32(PMC_BASE + ofs))
 
-#define APBDEV_PMC_CNTRL_0           MAKE_PMC_REG(0x000)
-
-#define APBDEV_PMC_DPD_SAMPLE_0      MAKE_PMC_REG(0x020)
-
-#define APBDEV_PMC_DPD_ENABLE_0      MAKE_PMC_REG(0x024)
-
-#define APBDEV_PMC_CLAMP_STATUS_0    MAKE_PMC_REG(0x02C)
-
-#define APBDEV_PMC_PWRGATE_TOGGLE_0       MAKE_PMC_REG(0x030)
-#define APBDEV_PMC_REMOVE_CLAMPING_CMD_0  MAKE_PMC_REG(0x034)
-#define APBDEV_PMC_PWRGATE_STATUS_0       MAKE_PMC_REG(0x038)
-
-#define APBDEV_PMC_SCRATCH12_0       MAKE_PMC_REG(0x080)
-#define APBDEV_PMC_SCRATCH13_0       MAKE_PMC_REG(0x084)
-#define APBDEV_PMC_SCRATCH18_0       MAKE_PMC_REG(0x098)
-#define APBDEV_PMC_SCRATCH190_0      MAKE_PMC_REG(0x818)
-
-#define APBDEV_PMC_OSC_EDPD_OVER_0   MAKE_PMC_REG(0x1A4)
-
-#define APBDEV_PMC_STICKY_BITS_0     MAKE_PMC_REG(0x2C0)
-#define APBDEV_PMC_SEC_DISABLE2_0    MAKE_PMC_REG(0x2C4)
-#define APBDEV_PMC_WEAK_BIAS_0       MAKE_PMC_REG(0x2C8)
-
-#define APBDEV_PMC_SECURE_SCRATCH21_0 MAKE_PMC_REG(0x334)
-#define APBDEV_PMC_SECURE_SCRATCH32_0 MAKE_PMC_REG(0x360)
-#define APBDEV_PMC_SECURE_SCRATCH34_0 MAKE_PMC_REG(0x368)
-#define APBDEV_PMC_SECURE_SCRATCH35_0 MAKE_PMC_REG(0x36C)
-
-#define APBDEV_PMC_SECURE_SCRATCH112_0 MAKE_PMC_REG(0xB18)
-#define APBDEV_PMC_SECURE_SCRATCH113_0 MAKE_PMC_REG(0xB1C)
-#define APBDEV_PMC_SECURE_SCRATCH114_0 MAKE_PMC_REG(0xB20)
-#define APBDEV_PMC_SECURE_SCRATCH115_0 MAKE_PMC_REG(0xB24)
-
-#define APBDEV_PMC_IO_DPD3_REQ_0     MAKE_PMC_REG(0x45C)
-#define APBDEV_PMC_IO_DPD3_STATUS_0  MAKE_PMC_REG(0x460)
-
-#define APBDEV_PMC_IO_DPD4_REQ_0     MAKE_PMC_REG(0x464)
-#define APBDEV_PMC_IO_DPD4_STATUS_0  MAKE_PMC_REG(0x468)
-
-#define APBDEV_PMC_SET_SW_CLAMP_0    MAKE_PMC_REG(0x47C)
-
-#define APBDEV_PMC_DDR_CNTRL_0       MAKE_PMC_REG(0x4E4)
+#define APBDEV_PMC_CNTRL_0                  MAKE_PMC_REG(0x000)
+#define APBDEV_PMC_DPD_SAMPLE_0             MAKE_PMC_REG(0x020)
+#define APBDEV_PMC_DPD_ENABLE_0             MAKE_PMC_REG(0x024)
+#define APBDEV_PMC_CLAMP_STATUS_0           MAKE_PMC_REG(0x02C)
+#define APBDEV_PMC_PWRGATE_TOGGLE_0         MAKE_PMC_REG(0x030)
+#define APBDEV_PMC_REMOVE_CLAMPING_CMD_0    MAKE_PMC_REG(0x034)
+#define APBDEV_PMC_PWRGATE_STATUS_0         MAKE_PMC_REG(0x038)
+#define APBDEV_PMC_SCRATCH12_0              MAKE_PMC_REG(0x080)
+#define APBDEV_PMC_SCRATCH13_0              MAKE_PMC_REG(0x084)
+#define APBDEV_PMC_SCRATCH18_0              MAKE_PMC_REG(0x098)
+#define APBDEV_PMC_SCRATCH190_0             MAKE_PMC_REG(0x818)
+#define APBDEV_PMC_OSC_EDPD_OVER_0          MAKE_PMC_REG(0x1A4)
+#define APBDEV_PMC_STICKY_BITS_0            MAKE_PMC_REG(0x2C0)
+#define APBDEV_PMC_SEC_DISABLE2_0           MAKE_PMC_REG(0x2C4)
+#define APBDEV_PMC_WEAK_BIAS_0              MAKE_PMC_REG(0x2C8)
+#define APBDEV_PMC_SECURE_SCRATCH21_0       MAKE_PMC_REG(0x334)
+#define APBDEV_PMC_SECURE_SCRATCH32_0       MAKE_PMC_REG(0x360)
+#define APBDEV_PMC_SECURE_SCRATCH34_0       MAKE_PMC_REG(0x368)
+#define APBDEV_PMC_SECURE_SCRATCH35_0       MAKE_PMC_REG(0x36C)
+#define APBDEV_PMC_SECURE_SCRATCH112_0      MAKE_PMC_REG(0xB18)
+#define APBDEV_PMC_SECURE_SCRATCH113_0      MAKE_PMC_REG(0xB1C)
+#define APBDEV_PMC_SECURE_SCRATCH114_0      MAKE_PMC_REG(0xB20)
+#define APBDEV_PMC_SECURE_SCRATCH115_0      MAKE_PMC_REG(0xB24)
+#define APBDEV_PMC_FUSE_CTRL                MAKE_PMC_REG(0x450)
+#define APBDEV_PMC_IO_DPD3_REQ_0            MAKE_PMC_REG(0x45C)
+#define APBDEV_PMC_IO_DPD3_STATUS_0         MAKE_PMC_REG(0x460)
+#define APBDEV_PMC_IO_DPD4_REQ_0            MAKE_PMC_REG(0x464)
+#define APBDEV_PMC_IO_DPD4_STATUS_0         MAKE_PMC_REG(0x468)
+#define APBDEV_PMC_SET_SW_CLAMP_0           MAKE_PMC_REG(0x47C)
+#define APBDEV_PMC_DDR_CNTRL_0              MAKE_PMC_REG(0x4E4)
 
 #endif

exosphere/lp0fw/src/se.c

@@ -36,20 +36,20 @@ static void __attribute__((__noinline__)) ll_init(volatile se_ll_t *ll, void *bu
 }
 
 void se_check_error_status_reg(void) {
-    if (se_get_regs()->ERR_STATUS_REG) {
+    if (se_get_regs()->SE_ERR_STATUS) {
         reboot();
     }
 }
 
 void se_check_for_error(void) {
     volatile tegra_se_t *se = se_get_regs();
-    if (se->INT_STATUS_REG & 0x10000 || se->FLAGS_REG & 3 || se->ERR_STATUS_REG) {
+    if (se->SE_INT_STATUS & 0x10000 || se->SE_STATUS & 3 || se->SE_ERR_STATUS) {
         reboot();
     }
 }
 
 void se_verify_flags_cleared(void) {
-    if (se_get_regs()->FLAGS_REG & 3) {
+    if (se_get_regs()->SE_STATUS & 3) {
         reboot();
     }
 }
@@ -63,8 +63,8 @@ void clear_aes_keyslot(unsigned int keyslot) {
 
     /* Zero out the whole keyslot and IV. */
     for (unsigned int i = 0; i < 0x10; i++) {
-        se->AES_KEYTABLE_ADDR = (keyslot << 4) | i;
-        se->AES_KEYTABLE_DATA = 0;
+        se->SE_CRYPTO_KEYTABLE_ADDR = (keyslot << 4) | i;
+        se->SE_CRYPTO_KEYTABLE_DATA = 0;
     }
 }
 
@@ -78,13 +78,13 @@ void clear_rsa_keyslot(unsigned int keyslot) {
     /* Zero out the whole keyslot. */
     for (unsigned int i = 0; i < 0x40; i++) {
         /* Select Keyslot Modulus[i] */
-        se->RSA_KEYTABLE_ADDR = (keyslot << 7) | i | 0x40;
-        se->RSA_KEYTABLE_DATA = 0;
+        se->SE_RSA_KEYTABLE_ADDR = (keyslot << 7) | i | 0x40;
+        se->SE_RSA_KEYTABLE_DATA = 0;
     }
     for (unsigned int i = 0; i < 0x40; i++) {
         /* Select Keyslot Expontent[i] */
-        se->RSA_KEYTABLE_ADDR = (keyslot << 7) | i;
-        se->RSA_KEYTABLE_DATA = 0;
+        se->SE_RSA_KEYTABLE_ADDR = (keyslot << 7) | i;
+        se->SE_RSA_KEYTABLE_DATA = 0;
     }
 }
 
@@ -96,8 +96,8 @@ void clear_aes_keyslot_iv(unsigned int keyslot) {
     }
 
     for (size_t i = 0; i < (0x10 >> 2); i++) {
-        se->AES_KEYTABLE_ADDR = (keyslot << 4) | 8 | i;
-        se->AES_KEYTABLE_DATA = 0;
+        se->SE_CRYPTO_KEYTABLE_ADDR = (keyslot << 4) | 8 | i;
+        se->SE_CRYPTO_KEYTABLE_DATA = 0;
     }
 }
 
@@ -111,15 +111,15 @@ void trigger_se_blocking_op(unsigned int op, void *dst, size_t dst_size, const v
     ll_init(&out_ll, dst, dst_size);
 
     /* Set the LLs. */
-    se->IN_LL_ADDR_REG = (uint32_t)(&in_ll);
-    se->OUT_LL_ADDR_REG = (uint32_t) (&out_ll);
+    se->SE_IN_LL_ADDR = (uint32_t)(&in_ll);
+    se->SE_OUT_LL_ADDR = (uint32_t) (&out_ll);
 
     /* Set registers for operation. */
-    se->ERR_STATUS_REG = se->ERR_STATUS_REG;
-    se->INT_STATUS_REG = se->INT_STATUS_REG;
-    se->OPERATION_REG = op;
+    se->SE_ERR_STATUS = se->SE_ERR_STATUS;
+    se->SE_INT_STATUS = se->SE_INT_STATUS;
+    se->SE_OPERATION = op;
 
-    while (!(se->INT_STATUS_REG & 0x10)) { /* Wait a while */ }
+    while (!(se->SE_INT_STATUS & 0x10)) { /* Wait a while */ }
     se_check_for_error();
 }
 
@@ -137,7 +137,7 @@ void se_perform_aes_block_operation(void *dst, size_t dst_size, const void *src,
     }
 
     /* Trigger AES operation. */
-    se_get_regs()->BLOCK_COUNT_REG = 0;
+    se_get_regs()->SE_CRYPTO_LAST_BLOCK = 0;
     trigger_se_blocking_op(OP_START, block, sizeof(block), block, sizeof(block));
 
     /* Copy output data into dst. */
@@ -154,8 +154,8 @@ void se_aes_ecb_encrypt_block(unsigned int keyslot, void *dst, size_t dst_size,
     }
 
     /* Set configuration high (256-bit vs 128-bit) based on parameter. */
-    se->CONFIG_REG = (ALG_AES_ENC | DST_MEMORY) | (config_high << 16);
-    se->CRYPTO_REG = keyslot << 24 | 0x100;
+    se->SE_CONFIG = (ALG_AES_ENC | DST_MEMORY) | (config_high << 16);
+    se->SE_CRYPTO_CONFIG = keyslot << 24 | 0x100;
     se_perform_aes_block_operation(dst, 0x10, src, 0x10);
 }
 
@@ -166,8 +166,8 @@ void se_aes_ecb_decrypt_block(unsigned int keyslot, void *dst, size_t dst_size,
         reboot();
     }
 
-    se->CONFIG_REG = (ALG_AES_DEC | DST_MEMORY);
-    se->CRYPTO_REG = keyslot << 24;
+    se->SE_CONFIG = (ALG_AES_DEC | DST_MEMORY);
+    se->SE_CRYPTO_CONFIG = keyslot << 24;
     se_perform_aes_block_operation(dst, 0x10, src, 0x10);
 }
 
@@ -198,16 +198,16 @@ void se_compute_aes_cmac(unsigned int keyslot, void *cmac, size_t cmac_size, con
         shift_left_xor_rb(derived_key);
     }
 
-    se->CONFIG_REG = (ALG_AES_ENC | DST_HASHREG) | (config_high << 16);
-    se->CRYPTO_REG = (keyslot << 24) | (0x145);
+    se->SE_CONFIG = (ALG_AES_ENC | DST_HASHREG) | (config_high << 16);
+    se->SE_CRYPTO_CONFIG = (keyslot << 24) | (0x145);
     clear_aes_keyslot_iv(keyslot);
 
     unsigned int num_blocks = (data_size + 0xF) >> 4;
     /* Handle aligned blocks. */
     if (num_blocks > 1) {
-        se->BLOCK_COUNT_REG = num_blocks - 2;
+        se->SE_CRYPTO_LAST_BLOCK = num_blocks - 2;
         trigger_se_blocking_op(OP_START, NULL, 0, data, data_size);
-        se->CRYPTO_REG |= 0x80;
+        se->SE_CRYPTO_CONFIG |= 0x80;
     }
 
     /* Create final block. */
@@ -224,12 +224,12 @@ void se_compute_aes_cmac(unsigned int keyslot, void *cmac, size_t cmac_size, con
     }
 
     /* Perform last operation. */
-    se->BLOCK_COUNT_REG = 0;
+    se->SE_CRYPTO_LAST_BLOCK = 0;
     trigger_se_blocking_op(OP_START, NULL, 0, last_block, sizeof(last_block));
 
     /* Copy output CMAC. */
     for (unsigned int i = 0; i < (cmac_size >> 2); i++) {
-        ((uint32_t *)cmac)[i] = ((volatile uint32_t *)se->HASH_RESULT_REG)[i];
+        ((uint32_t *)cmac)[i] = ((volatile uint32_t *)se->SE_HASH_RESULT)[i];
     }
 }
 
@@ -244,9 +244,9 @@ void se_aes_256_cbc_decrypt(unsigned int keyslot, void *dst, size_t dst_size, co
         reboot();
     }
 
-    se->CONFIG_REG = (ALG_AES_DEC | DST_MEMORY) | (0x202 << 16);
-    se->CRYPTO_REG = (keyslot << 24) | 0x66;
+    se->SE_CONFIG = (ALG_AES_DEC | DST_MEMORY) | (0x202 << 16);
+    se->SE_CRYPTO_CONFIG = (keyslot << 24) | 0x66;
     clear_aes_keyslot_iv(keyslot);
-    se->BLOCK_COUNT_REG = (src_size >> 4) - 1;
+    se->SE_CRYPTO_LAST_BLOCK = (src_size >> 4) - 1;
     trigger_se_blocking_op(OP_START, dst, dst_size, src, src_size);
 }

exosphere/lp0fw/src/se.h

@@ -92,71 +92,59 @@
 #define RSA_2048_BYTES 0x100
 
 typedef struct {
-    uint32_t _0x0;
-    uint32_t _0x4;
-    uint32_t OPERATION_REG;
-    uint32_t INT_ENABLE_REG;
-    uint32_t INT_STATUS_REG;
-    uint32_t CONFIG_REG;
-    uint32_t IN_LL_ADDR_REG;
-    uint32_t _0x1C;
-    uint32_t _0x20;
-    uint32_t OUT_LL_ADDR_REG;
-    uint32_t _0x28;
-    uint32_t _0x2C;
-    uint8_t HASH_RESULT_REG[0x20];
-    uint8_t _0x50[0x20];
-    uint32_t CONTEXT_SAVE_CONFIG_REG;
-    uint8_t _0x74[0x18C];
-    uint32_t SHA_CONFIG_REG;
-    uint32_t SHA_MSG_LENGTH_REG;
-    uint32_t _0x208;
-    uint32_t _0x20C;
-    uint32_t _0x210;
-    uint32_t SHA_MSG_LEFT_REG;
-    uint32_t _0x218;
-    uint32_t _0x21C;
-    uint32_t _0x220;
-    uint32_t _0x224;
-    uint8_t _0x228[0x58];
-    uint32_t AES_KEY_READ_DISABLE_REG;
-    uint32_t AES_KEYSLOT_FLAGS[0x10];
-    uint8_t _0x2C4[0x3C];
-    uint32_t _0x300;
-    uint32_t CRYPTO_REG;
-    uint32_t CRYPTO_CTR_REG[4];
-    uint32_t BLOCK_COUNT_REG;
-    uint32_t AES_KEYTABLE_ADDR;
-    uint32_t AES_KEYTABLE_DATA;
-    uint32_t _0x324;
-    uint32_t _0x328;
-    uint32_t _0x32C;
-    uint32_t CRYPTO_KEYTABLE_DST_REG;
-    uint8_t _0x334[0xC];
-    uint32_t RNG_CONFIG_REG;
-    uint32_t RNG_SRC_CONFIG_REG;
-    uint32_t RNG_RESEED_INTERVAL_REG;
-    uint8_t _0x34C[0xB4];
-    uint32_t RSA_CONFIG;
-    uint32_t RSA_KEY_SIZE_REG;
-    uint32_t RSA_EXP_SIZE_REG;
-    uint32_t RSA_KEY_READ_DISABLE_REG;
-    uint32_t RSA_KEYSLOT_FLAGS[2];
-    uint32_t _0x418;
-    uint32_t _0x41C;
-    uint32_t RSA_KEYTABLE_ADDR;
-    uint32_t RSA_KEYTABLE_DATA;
-    uint8_t RSA_OUTPUT[0x100];
-    uint8_t _0x528[0x2D8];
-    uint32_t FLAGS_REG;
-    uint32_t ERR_STATUS_REG;
-    uint32_t _0x808;
-    uint32_t SPARE_0;
-    uint32_t _0x810;
+    uint32_t SE_SE_SECURITY;
+    uint32_t SE_TZRAM_SECURITY;
+    uint32_t SE_OPERATION;
+    uint32_t SE_INT_ENABLE;
+    uint32_t SE_INT_STATUS;
+    uint32_t SE_CONFIG;
+    uint32_t SE_IN_LL_ADDR;
+    uint32_t SE_IN_CUR_BYTE_ADDR;
+    uint32_t SE_IN_CUR_LL_ID;
+    uint32_t SE_OUT_LL_ADDR;
+    uint32_t SE_OUT_CUR_BYTE_ADDR;
+    uint32_t SE_OUT_CUR_LL_ID;
+    uint32_t SE_HASH_RESULT[0x10];
+    uint32_t SE_CTX_SAVE_CONFIG;
+    uint32_t _0x74[0x63];
+    uint32_t SE_SHA_CONFIG;
+    uint32_t SE_SHA_MSG_LENGTH[0x4];
+    uint32_t SE_SHA_MSG_LEFT[0x4];
+    uint32_t _0x224[0x17];
+    uint32_t SE_CRYPTO_SECURITY_PERKEY;
+    uint32_t SE_CRYPTO_KEYTABLE_ACCESS[0x10];
+    uint32_t _0x2C4[0x10];
+    uint32_t SE_CRYPTO_CONFIG;
+    uint32_t SE_CRYPTO_LINEAR_CTR[0x4];
+    uint32_t SE_CRYPTO_LAST_BLOCK;
+    uint32_t SE_CRYPTO_KEYTABLE_ADDR;
+    uint32_t SE_CRYPTO_KEYTABLE_DATA;
+    uint32_t _0x324[0x3];
+    uint32_t SE_CRYPTO_KEYTABLE_DST;
+    uint32_t _0x334[0x3];
+    uint32_t SE_RNG_CONFIG;
+    uint32_t SE_RNG_SRC_CONFIG;
+    uint32_t SE_RNG_RESEED_INTERVAL;
+    uint32_t _0x34C[0x2D];
+    uint32_t SE_RSA_CONFIG;
+    uint32_t SE_RSA_KEY_SIZE;
+    uint32_t SE_RSA_EXP_SIZE;
+    uint32_t SE_RSA_SECURITY_PERKEY;
+    uint32_t SE_RSA_KEYTABLE_ACCESS[0x2];
+    uint32_t _0x418[0x2];
+    uint32_t SE_RSA_KEYTABLE_ADDR;
+    uint32_t SE_RSA_KEYTABLE_DATA;
+    uint32_t SE_RSA_OUTPUT[0x40];
+    uint32_t _0x528[0xB6];
+    uint32_t SE_STATUS;
+    uint32_t SE_ERR_STATUS;
+    uint32_t SE_MISC;
+    uint32_t SE_SPARE;
+    uint32_t SE_ENTROPY_DEBUG_COUNTER;
     uint32_t _0x814;
     uint32_t _0x818;
     uint32_t _0x81C;
-    uint8_t _0x820[0x17E0];
+    uint32_t _0x820[0x5F8];
 } tegra_se_t;
 
 typedef struct {

exosphere/lp0fw/src/secmon.c

@@ -46,7 +46,7 @@ void secmon_restore_to_tzram(const uint32_t target_firmware) {
     }
 
     /* Make security engine require secure busmaster. */
-    se_get_regs()->_0x4 = 0;
+    se_get_regs()->SE_TZRAM_SECURITY = 0;
 
     /* TODO: se_verify_keys_unreadable(); */
 

exosphere/lp0fw/src/utils.h

@@ -13,14 +13,14 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
- 
+
 #ifndef EXOSPHERE_WARMBOOT_BIN_UTILS_H
 #define EXOSPHERE_WARMBOOT_BIN_UTILS_H
 
 #include <stdbool.h>
 #include <stddef.h>
 #include <stdint.h>
-#include <atmosphere.h>
+#include <vapours/ams_version.h>
 
 #define BIT(n)      (1u   << (n))
 #define BITL(n)     (1ull << (n))

exosphere/src/bootup.c

@@ -13,7 +13,7 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
- 
+
 #include <stdint.h>
 #include <stdbool.h>
 
@@ -64,7 +64,7 @@ void setup_dram_magic_numbers(void) {
 void bootup_misc_mmio(void) {
     /* Initialize Fuse registers. */
     fuse_init();
-    
+
     /* Verify Security Engine sanity. */
     se_set_in_context_save_mode(false);
     /* TODO: se_verify_keys_unreadable(); */
@@ -85,6 +85,9 @@ void bootup_misc_mmio(void) {
         setup_dram_magic_numbers();
     }
 
+    /* On 9.0.0+, Nintendo writes random values to context save scratch here, and locks the SRK scratch. */
+    /* There's no real need for us to do this, so we won't. */
+
     /* Mark TMR5, TMR6, TMR7, TMR8, WDT0, WDT1, WDT2 and WDT3 as secure. */
     SHARED_TIMER_SECURE_CFG_0 = 0xF1E0;
 
@@ -111,7 +114,7 @@ void bootup_misc_mmio(void) {
     MAKE_MC_REG(MC_SECURITY_CFG1) = 0;
     MAKE_MC_REG(MC_SECURITY_CFG3) = 3;
     configure_default_carveouts();
-        
+
     /* Mark registers secure world only. */
     if (exosphere_get_target_firmware() == ATMOSPHERE_TARGET_FIRMWARE_100) {
         APB_MISC_SECURE_REGS_APB_SLAVE_SECURITY_ENABLE_REG0_0 = APB_SSER0_SATA_AUX | APB_SSER0_DTV | APB_SSER0_QSPI | APB_SSER0_SATA | APB_SSER0_LA;
@@ -140,28 +143,26 @@ void bootup_misc_mmio(void) {
         APB_MISC_SECURE_REGS_APB_SLAVE_SECURITY_ENABLE_REG2_0 = sec_disable_2;
     }
 
-    /* Reset Translation Enable Registers. */
+    /* Reset Translation Enable registers. */
     MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_0) = 0xFFFFFFFF;
     MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_1) = 0xFFFFFFFF;
     MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_2) = 0xFFFFFFFF;
     MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_3) = 0xFFFFFFFF;
     MAKE_MC_REG(MC_SMMU_TRANSLATION_ENABLE_4) = 0xFFFFFFFF;
 
-    /* TODO: What are these MC reg writes? */
+    /* Set SMMU ASID security registers. */
     if (exosphere_get_target_firmware() >= ATMOSPHERE_TARGET_FIRMWARE_400) {
-        MAKE_MC_REG(0x038) = 0xE;
+        MAKE_MC_REG(MC_SMMU_ASID_SECURITY) = 0xE;
     } else {
-        MAKE_MC_REG(0x038) = 0x0;
+        MAKE_MC_REG(MC_SMMU_ASID_SECURITY) = 0x0;
     }
-    MAKE_MC_REG(0x03C) = 0;
-
-    /* MISC registers. */
-    MAKE_MC_REG(0x9E0) = 0;
-    MAKE_MC_REG(0x9E4) = 0;
-    MAKE_MC_REG(0x9E8) = 0;
-    MAKE_MC_REG(0x9EC) = 0;
-    MAKE_MC_REG(0x9F0) = 0;
-    MAKE_MC_REG(0x9F4) = 0;
+    MAKE_MC_REG(MC_SMMU_ASID_SECURITY_1) = 0;
+    MAKE_MC_REG(MC_SMMU_ASID_SECURITY_2) = 0;
+    MAKE_MC_REG(MC_SMMU_ASID_SECURITY_3) = 0;
+    MAKE_MC_REG(MC_SMMU_ASID_SECURITY_4) = 0;
+    MAKE_MC_REG(MC_SMMU_ASID_SECURITY_5) = 0;
+    MAKE_MC_REG(MC_SMMU_ASID_SECURITY_6) = 0;
+    MAKE_MC_REG(MC_SMMU_ASID_SECURITY_7) = 0;
 
     if (exosphere_get_target_firmware() >= ATMOSPHERE_TARGET_FIRMWARE_400) {
         MAKE_MC_REG(MC_SMMU_PTB_ASID) = 0;
@@ -176,7 +177,7 @@ void bootup_misc_mmio(void) {
     (void)MAKE_MC_REG(MC_SMMU_TLB_CONFIG);
     MAKE_MC_REG(MC_SMMU_CONFIG) = 1;        /* Enable SMMU. */
     (void)MAKE_MC_REG(MC_SMMU_TLB_CONFIG);
-    
+
     /* Clear RESET Vector, setup CPU Secure Boot RESET Vectors. */
     uint32_t reset_vec;
     if (exosphere_get_target_firmware() >= ATMOSPHERE_TARGET_FIRMWARE_500) {
@@ -204,7 +205,7 @@ void bootup_misc_mmio(void) {
     intr_set_enabled(INTERRUPT_ID_SECURITY_ENGINE, 1);
     intr_set_cpu_mask(INTERRUPT_ID_SECURITY_ENGINE, 8);
     intr_set_edge_level(INTERRUPT_ID_SECURITY_ENGINE, 0);
-    
+
     if (exosphere_get_target_firmware() >= ATMOSPHERE_TARGET_FIRMWARE_400) {
         intr_set_priority(INTERRUPT_ID_ACTIVITY_MONITOR_4X, 0);
         intr_set_group(INTERRUPT_ID_ACTIVITY_MONITOR_4X, 0);
@@ -215,10 +216,10 @@ void bootup_misc_mmio(void) {
 
     if (!g_has_booted_up) {
         /* N doesn't do this, but we should for compatibility. */
-        uart_select(UART_A);
+        uart_config(UART_A);
         clkrst_reboot(CARDEVICE_UARTA);
         uart_init(UART_A, 115200);
-        
+
         intr_register_handler(INTERRUPT_ID_SECURITY_ENGINE, se_operation_completed);
         if (exosphere_get_target_firmware() >= ATMOSPHERE_TARGET_FIRMWARE_400) {
             intr_register_handler(INTERRUPT_ID_ACTIVITY_MONITOR_4X, actmon_interrupt_handler);

exosphere/src/car.c

@@ -13,7 +13,7 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
- 
+
 #include <stdint.h>
 
 #include "utils.h"
@@ -30,7 +30,7 @@ static inline uint32_t get_special_clk_reg(CarDevice dev) {
         case CARDEVICE_BPMP: return 0;
         default: generic_panic();
     }
-} 
+}
 
 static inline uint32_t get_special_clk_val(CarDevice dev) {
     switch (dev) {
@@ -45,7 +45,7 @@ static inline uint32_t get_special_clk_val(CarDevice dev) {
 }
 
 static uint32_t g_clk_reg_offsets[NUM_CAR_BANKS] = {0x010, 0x014, 0x018, 0x360, 0x364, 0x280, 0x298};
-static uint32_t g_rst_reg_offsets[NUM_CAR_BANKS] = {0x004, 0x008, 0x00C, 0x358, 0x35C, 0x28C, 0x2A4}; 
+static uint32_t g_rst_reg_offsets[NUM_CAR_BANKS] = {0x004, 0x008, 0x00C, 0x358, 0x35C, 0x28C, 0x2A4};
 
 void clk_enable(CarDevice dev) {
     uint32_t special_reg;
@@ -67,7 +67,6 @@ void rst_disable(CarDevice dev) {
     MAKE_CAR_REG(g_rst_reg_offsets[dev >> 5]) &= ~(BIT(dev & 0x1F));
 }
 
-
 void clkrst_enable(CarDevice dev) {
     clk_enable(dev);
     rst_disable(dev);
@@ -82,3 +81,7 @@ void clkrst_reboot(CarDevice dev) {
     clkrst_disable(dev);
     clkrst_enable(dev);
 }
+
+void clkrst_enable_fuse_regs(bool enable) {
+    CLK_RST_CONTROLLER_MISC_CLK_ENB_0 = ((CLK_RST_CONTROLLER_MISC_CLK_ENB_0 & 0xEFFFFFFF) | ((enable & 1) << 28));
+}

exosphere/src/car.h

@@ -51,7 +51,8 @@ void rst_disable(CarDevice dev);
 
 void clkrst_enable(CarDevice dev);
 void clkrst_disable(CarDevice dev);
-
 void clkrst_reboot(CarDevice dev);
 
+void clkrst_enable_fuse_regs(bool enable);
+
 #endif

exosphere/src/configitem.c

@@ -13,9 +13,9 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
- 
+
 #include <stdint.h>
-#include <atmosphere/version.h>
+#include <vapours/ams_version.h>
 
 #include "bootconfig.h"
 #include "configitem.h"
@@ -38,6 +38,7 @@
 static bool g_hiz_mode_enabled = false;
 static bool g_debugmode_override_user = false, g_debugmode_override_priv = false;
 static bool g_enable_usermode_exception_handlers = true;
+static bool g_enable_usermode_pmu_access = false;
 
 uint32_t configitem_set(bool privileged, ConfigItem item, uint64_t value) {
     switch (item) {
@@ -63,14 +64,14 @@ uint32_t configitem_set(bool privileged, ConfigItem item, uint64_t value) {
                         /* Set SVC handler to jump to reboot stub in IRAM. */
                         MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC) + 0x520ull) = 0x4003F000;
                         MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC) + 0x53Cull) = 0x6000F208;
-                        
+
                         /* Copy reboot stub payload. */
                         ams_map_irampage(0x4003F000);
                         for (unsigned int i = 0; i < rebootstub_bin_size; i += 4) {
                             MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_AMS_IRAM_PAGE) + i) = read32le(rebootstub_bin, i);
                         }
                         ams_unmap_irampage();
-                        
+
                         /* Ensure stub is flushed. */
                         flush_dcache_all();
                         break;
@@ -95,7 +96,7 @@ uint32_t configitem_set(bool privileged, ConfigItem item, uint64_t value) {
                 /* Set SVC handler to jump to reboot stub in IRAM. */
                 MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC) + 0x520ull) = 0x4003F000;
                 MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC) + 0x53Cull) = 0x6000F208;
-                
+
                 /* Copy reboot stub payload. */
                 ams_map_irampage(0x4003F000);
                 for (unsigned int i = 0; i < rebootstub_bin_size; i += 4) {
@@ -104,7 +105,7 @@ uint32_t configitem_set(bool privileged, ConfigItem item, uint64_t value) {
                 /* Tell rebootstub to shut down. */
                 MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_AMS_IRAM_PAGE) + 0x10) = 0x0;
                 ams_unmap_irampage();
-                
+
                 MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC) + 0x400ull) = 0x10;
                 while (1) { }
             }
@@ -112,7 +113,7 @@ uint32_t configitem_set(bool privileged, ConfigItem item, uint64_t value) {
         default:
             return 2;
     }
-    
+
     return 0;
 }
 
@@ -168,6 +169,10 @@ void configitem_disable_usermode_exception_handlers(void) {
     g_enable_usermode_exception_handlers = false;
 }
 
+void configitem_enable_usermode_pmu_access(void) {
+    g_enable_usermode_pmu_access = true;
+}
+
 uint32_t configitem_get(bool privileged, ConfigItem item, uint64_t *p_outvalue) {
     uint32_t result = 0;
     switch (item) {
@@ -182,11 +187,10 @@ uint32_t configitem_get(bool privileged, ConfigItem item, uint64_t *p_outvalue)
             *p_outvalue = INTERRUPT_ID_USER_SECURITY_ENGINE;
             break;
         case CONFIGITEM_VERSION:
-            /* Always returns maxver - 1 on hardware. */
-            *p_outvalue = PACKAGE2_MAXVER_400_410 - 1;
+            *p_outvalue = fuse_get_expected_fuse_version(exosphere_get_target_firmware());
             break;
         case CONFIGITEM_HARDWARETYPE:
-            *p_outvalue = fuse_get_hardware_type();
+            *p_outvalue = fuse_get_hardware_type(exosphere_get_target_firmware());
             break;
         case CONFIGITEM_ISRETAIL:
             *p_outvalue = fuse_get_retail_type();
@@ -222,6 +226,10 @@ uint32_t configitem_get(bool privileged, ConfigItem item, uint64_t *p_outvalue)
                 if (g_enable_usermode_exception_handlers) {
                     config |= KERNELCONFIGFLAG_ENABLE_USER_EXCEPTION_HANDLERS;
                 }
+                /* Allow for enabling usermode pmu access. */
+                if (g_enable_usermode_pmu_access) {
+                    config |= KERNELCONFIGFLAG_ENABLE_USER_PMU_ACCESS;
+                }
                 *p_outvalue = config;
             }
             break;
@@ -262,7 +270,7 @@ uint32_t configitem_get(bool privileged, ConfigItem item, uint64_t *p_outvalue)
             break;
         case CONFIGITEM_EXOSPHERE_VERSION:
             /* UNOFFICIAL: Gets information about the current exosphere version. */
-            *p_outvalue = ((uint64_t)(ATMOSPHERE_RELEASE_VERSION_MAJOR & 0xFF) << 32ull) | 
+            *p_outvalue = ((uint64_t)(ATMOSPHERE_RELEASE_VERSION_MAJOR & 0xFF) << 32ull) |
                           ((uint64_t)(ATMOSPHERE_RELEASE_VERSION_MINOR & 0xFF) << 24ull) |
                           ((uint64_t)(ATMOSPHERE_RELEASE_VERSION_MICRO & 0xFF) << 16ull) |
                           ((uint64_t)(exosphere_get_target_firmware() & 0xFF) << 8ull) |

exosphere/src/configitem.h

@@ -13,7 +13,7 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
- 
+
 #ifndef EXOSPHERE_CFG_ITEM_H
 #define EXOSPHERE_CFG_ITEM_H
 
@@ -38,7 +38,7 @@ typedef enum {
     CONFIGITEM_NEWHARDWARETYPE_5X = 15,
     CONFIGITEM_NEWKEYGENERATION_5X = 16,
     CONFIGITEM_PACKAGE2HASH_5X = 17,
-    
+
     /* These are unofficial, for usage by Exosphere. */
     CONFIGITEM_EXOSPHERE_VERSION = 65000,
     CONFIGITEM_NEEDS_REBOOT = 65001,
@@ -61,6 +61,7 @@ bool configitem_is_debugmode_priv(void);
 
 void configitem_set_debugmode_override(bool user, bool priv);
 void configitem_disable_usermode_exception_handlers(void);
+void configitem_enable_usermode_pmu_access(void);
 void configitem_set_hiz_mode_enabled(bool enabled);
 
 uint64_t configitem_get_hardware_type(void);

exosphere/src/emummc_cfg.h

@@ -13,12 +13,12 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
- 
+
 #ifndef EXOSPHERE_EMUMMC_CONFIG_H
 #define EXOSPHERE_EMUMMC_CONFIG_H
 
 #include <stdint.h>
-#include <atmosphere.h>
+#include <vapours/ams_version.h>
 #include "utils.h"
 
 /* "EFS0" */

exosphere/src/exceptions.s

@@ -4,7 +4,7 @@
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
- 
+
 
 /*
  * Declare the exception vector table, enforcing it is aligned on a
@@ -92,7 +92,7 @@ vector_entry fiq_spx
 vector_entry serror_spx
     b unknown_exception
     check_vector_size serror_spx
-    
+
 /* Lower EL, A64 */
 vector_entry synch_a64
     stp x29, x30, [sp, #-0x10]!

exosphere/src/exocfg.c

@@ -22,7 +22,7 @@
 #include "mmu.h"
 #include "memory_map.h"
 
-static exosphere_config_t g_exosphere_cfg = {MAGIC_EXOSPHERE_CONFIG, ATMOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG, EXOSPHERE_FLAGS_DEFAULT};
+static exosphere_config_t g_exosphere_cfg = {MAGIC_EXOSPHERE_CONFIG, ATMOSPHERE_TARGET_FIRMWARE_CURRENT, EXOSPHERE_FLAGS_DEFAULT};
 static bool g_has_loaded_config = false;
 
 #define EXOSPHERE_CHECK_FLAG(flag) ((g_exosphere_cfg.flags & flag) != 0)
@@ -84,6 +84,14 @@ unsigned int exosphere_should_disable_usermode_exception_handlers(void) {
     return EXOSPHERE_CHECK_FLAG(EXOSPHERE_FLAG_DISABLE_USERMODE_EXCEPTION_HANDLERS);
 }
 
+unsigned int exosphere_should_enable_usermode_pmu_access(void) {
+    if (!g_has_loaded_config) {
+        generic_panic();
+    }
+
+    return EXOSPHERE_CHECK_FLAG(EXOSPHERE_FLAG_ENABLE_USERMODE_PMU_ACCESS);
+}
+
 const exo_emummc_config_t *exosphere_get_emummc_config(void) {
     if (!g_has_loaded_config) {
         generic_panic();

exosphere/src/exocfg.h

@@ -18,7 +18,7 @@
 #define EXOSPHERE_EXOSPHERE_CONFIG_H
 
 #include <stdint.h>
-#include <atmosphere.h>
+#include <vapours/ams_version.h>
 #include "utils.h"
 
 #include "memory_map.h"
@@ -40,6 +40,7 @@
 #define EXOSPHERE_FLAG_IS_DEBUGMODE_PRIV                    (1 << 1u)
 #define EXOSPHERE_FLAG_IS_DEBUGMODE_USER                    (1 << 2u)
 #define EXOSPHERE_FLAG_DISABLE_USERMODE_EXCEPTION_HANDLERS  (1 << 3u)
+#define EXOSPHERE_FLAG_ENABLE_USERMODE_PMU_ACCESS           (1 << 4u)
 #define EXOSPHERE_FLAGS_DEFAULT (EXOSPHERE_FLAG_IS_DEBUGMODE_PRIV)
 
 typedef struct {
@@ -58,6 +59,7 @@ unsigned int exosphere_should_perform_620_keygen(void);
 unsigned int exosphere_should_override_debugmode_priv(void);
 unsigned int exosphere_should_override_debugmode_user(void);
 unsigned int exosphere_should_disable_usermode_exception_handlers(void);
+unsigned int exosphere_should_enable_usermode_pmu_access(void);
 
 const exo_emummc_config_t *exosphere_get_emummc_config(void);
 
@@ -66,7 +68,7 @@ static inline unsigned int exosphere_get_target_firmware_for_init(void) {
     if (magic == MAGIC_EXOSPHERE_CONFIG) {
         return MAILBOX_EXOSPHERE_CONFIG_PHYS.target_firmware;
     } else {
-        return ATMOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG;
+        return ATMOSPHERE_TARGET_FIRMWARE_CURRENT;
     }
 }
 

exosphere/src/fuse.c

@@ -13,185 +13,168 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
- 
+
 #include <string.h>
+#include <vapours/ams_version.h>
 
 #include "car.h"
 #include "fuse.h"
-#include "utils.h"
-#include "timers.h"
-#include "exocfg.h"
-
 #include "masterkey.h"
+#include "pmc.h"
+#include "timers.h"
 
 static bool g_has_checked_for_rcm_bug_patch = false;
 static bool g_has_rcm_bug_patch = false;
 
 /* Prototypes for internal commands. */
-void fuse_make_regs_visible(void);
-
 void fuse_enable_power(void);
 void fuse_disable_power(void);
 void fuse_wait_idle(void);
 
-/* Initialize the FUSE driver */
-void fuse_init(void)
-{
-    fuse_make_regs_visible();
-    fuse_secondary_private_key_disable();
+/* Initialize the fuse driver */
+void fuse_init(void) {
+    /* Make all fuse registers visible, disable the private key and disable programming. */
+    clkrst_enable_fuse_regs(true);
+    fuse_disable_private_key();
     fuse_disable_programming();
-    
+
     /* TODO: Should we allow this to be done later? */
     if (!g_has_checked_for_rcm_bug_patch) {
         (void)(fuse_has_rcm_bug_patch());
     }
-
-    /* TODO: Overrides (iROM patches) and various reads happen here */
 }
 
-/* Make all fuse registers visible */
-void fuse_make_regs_visible(void)
-{
-    CLK_RST_CONTROLLER_MISC_CLK_ENB_0 |= BIT(28);
-}
-
-/* Enable power to the fuse hardware array */
-void fuse_enable_power(void)
-{
-    FUSE_REGS->FUSE_PWR_GOOD_SW = 1;
-    wait(1);
-}
-
-/* Disable power to the fuse hardware array */
-void fuse_disable_power(void)
-{
-    FUSE_REGS->FUSE_PWR_GOOD_SW = 0;
-    wait(1);
-}
-
-/* Wait for the fuse driver to go idle */
-void fuse_wait_idle(void)
-{
-    uint32_t ctrl_val = 0;
-
-    /* Wait for STATE_IDLE */
-    while ((ctrl_val & (0xF0000)) != 0x40000)
-    {
-        wait(1);
-        ctrl_val = FUSE_REGS->FUSE_CTRL;
-    }
-}
-
-/* Read a fuse from the hardware array */
-uint32_t fuse_hw_read(uint32_t addr)
-{
-    fuse_wait_idle();
-
-    /* Program the target address */
-    FUSE_REGS->FUSE_REG_ADDR = addr;
-
-    /* Enable read operation in control register */
-    uint32_t ctrl_val = FUSE_REGS->FUSE_CTRL;
-    ctrl_val &= ~0x3;
-    ctrl_val |= 0x1;    /* Set FUSE_READ command */
-    FUSE_REGS->FUSE_CTRL = ctrl_val;
-
-    fuse_wait_idle();
-
-    return FUSE_REGS->FUSE_REG_READ;
-}
-
-/* Write a fuse in the hardware array */
-void fuse_hw_write(uint32_t value, uint32_t addr)
-{
-    fuse_wait_idle();
-
-    /* Program the target address and value */
-    FUSE_REGS->FUSE_REG_ADDR = addr;
-    FUSE_REGS->FUSE_REG_WRITE = value;
-
-    /* Enable write operation in control register */
-    uint32_t ctrl_val = FUSE_REGS->FUSE_CTRL;
-    ctrl_val &= ~0x3;
-    ctrl_val |= 0x2;    /* Set FUSE_WRITE command */
-    FUSE_REGS->FUSE_CTRL = ctrl_val;
-
-    fuse_wait_idle();
-}
-
-/* Sense the fuse hardware array into the shadow cache */
-void fuse_hw_sense(void)
-{
-    fuse_wait_idle();
-
-    /* Enable sense operation in control register */
-    uint32_t ctrl_val = FUSE_REGS->FUSE_CTRL;
-    ctrl_val &= ~0x3;
-    ctrl_val |= 0x3;    /* Set FUSE_SENSE command */
-    FUSE_REGS->FUSE_CTRL = ctrl_val;
-
-    fuse_wait_idle();
+/* Disable access to the private key and set the TZ sticky bit. */
+void fuse_disable_private_key(void) {
+    FUSE_REGS->FUSE_PRIVATEKEYDISABLE = 0x10;
 }
 
 /* Disables all fuse programming. */
 void fuse_disable_programming(void) {
-    FUSE_REGS->FUSE_DIS_PGM = 1;
+    FUSE_REGS->FUSE_DISABLEREGPROGRAM = 1;
 }
 
-/* Unknown exactly what this does, but it alters the contents read from the fuse cache. */
-void fuse_secondary_private_key_disable(void) {
-    FUSE_REGS->FUSE_PRIVATEKEYDISABLE = 0x10;
+/* Enable power to the fuse hardware array. */
+void fuse_enable_power(void) {
+    APBDEV_PMC_FUSE_CTRL &= ~(0x200);      /* Clear PMC_FUSE_CTRL_PS18_LATCH_CLEAR. */
+    mdelay(1);
+    APBDEV_PMC_FUSE_CTRL |= 0x100;         /* Set PMC_FUSE_CTRL_PS18_LATCH_SET. */
+    mdelay(1);
 }
 
+/* Disable power to the fuse hardware array. */
+void fuse_disable_power(void) {
+    APBDEV_PMC_FUSE_CTRL &= ~(0x100);      /* Clear PMC_FUSE_CTRL_PS18_LATCH_SET. */
+    mdelay(1);
+    APBDEV_PMC_FUSE_CTRL |= 0x200;         /* Set PMC_FUSE_CTRL_PS18_LATCH_CLEAR. */
+    mdelay(1);
+}
 
-/* Read the SKU info register from the shadow cache */
-uint32_t fuse_get_sku_info(void)
-{
+/* Wait for the fuse driver to go idle. */
+void fuse_wait_idle(void) {
+    uint32_t ctrl_val = 0;
+
+    /* Wait for STATE_IDLE */
+    while ((ctrl_val & (0xF0000)) != 0x40000)
+        ctrl_val = FUSE_REGS->FUSE_FUSECTRL;
+}
+
+/* Read a fuse from the hardware array. */
+uint32_t fuse_hw_read(uint32_t addr) {
+    /* Wait for idle state. */
+    fuse_wait_idle();
+
+    /* Program the target address. */
+    FUSE_REGS->FUSE_FUSEADDR = addr;
+
+    /* Enable read operation in control register. */
+    uint32_t ctrl_val = FUSE_REGS->FUSE_FUSECTRL;
+    ctrl_val &= ~0x3;
+    ctrl_val |= 0x1;    /* Set READ command. */
+    FUSE_REGS->FUSE_FUSECTRL = ctrl_val;
+
+    /* Wait for idle state. */
+    fuse_wait_idle();
+
+    return FUSE_REGS->FUSE_FUSERDATA;
+}
+
+/* Write a fuse in the hardware array. */
+void fuse_hw_write(uint32_t value, uint32_t addr) {
+    /* Wait for idle state. */
+    fuse_wait_idle();
+
+    /* Program the target address and value. */
+    FUSE_REGS->FUSE_FUSEADDR = addr;
+    FUSE_REGS->FUSE_FUSEWDATA = value;
+
+    /* Enable write operation in control register. */
+    uint32_t ctrl_val = FUSE_REGS->FUSE_FUSECTRL;
+    ctrl_val &= ~0x3;
+    ctrl_val |= 0x2;    /* Set WRITE command. */
+    FUSE_REGS->FUSE_FUSECTRL = ctrl_val;
+
+    /* Wait for idle state. */
+    fuse_wait_idle();
+}
+
+/* Sense the fuse hardware array into the shadow cache. */
+void fuse_hw_sense(void) {
+    /* Wait for idle state. */
+    fuse_wait_idle();
+
+    /* Enable sense operation in control register */
+    uint32_t ctrl_val = FUSE_REGS->FUSE_FUSECTRL;
+    ctrl_val &= ~0x3;
+    ctrl_val |= 0x3;    /* Set SENSE_CTRL command */
+    FUSE_REGS->FUSE_FUSECTRL = ctrl_val;
+
+    /* Wait for idle state. */
+    fuse_wait_idle();
+}
+
+/* Read the SKU info register from the shadow cache. */
+uint32_t fuse_get_sku_info(void) {
     return FUSE_CHIP_REGS->FUSE_SKU_INFO;
 }
 
-/* Read the bootrom patch version from a register in the shadow cache */
-uint32_t fuse_get_bootrom_patch_version(void)
-{
-    return FUSE_CHIP_REGS->FUSE_SOC_SPEEDO_1;
+/* Read the bootrom patch version from a register in the shadow cache. */
+uint32_t fuse_get_bootrom_patch_version(void) {
+    return FUSE_CHIP_REGS->FUSE_SOC_SPEEDO_1_CALIB;
 }
 
 /* Read a spare bit register from the shadow cache */
-uint32_t fuse_get_spare_bit(uint32_t idx)
-{
-    if (idx >= 32) {
-        return 0;
-    }
-
-    return FUSE_CHIP_REGS->FUSE_SPARE_BIT[idx];
-}
-
-/* Read a reserved ODM register from the shadow cache */
-uint32_t fuse_get_reserved_odm(uint32_t idx)
-{
-    if (idx >= 8) {
-        return 0;
-    }
-
-    return FUSE_CHIP_REGS->FUSE_RESERVED_ODM[idx];
-}
-
-uint32_t fuse_get_5x_key_generation(void) {
-    if ((fuse_get_reserved_odm(4) & 0x800) && fuse_get_reserved_odm(0) == 0x8E61ECAE && fuse_get_reserved_odm(1) == 0xF2BA3BB2) {
-        return fuse_get_reserved_odm(2) & 0x1F;
+uint32_t fuse_get_spare_bit(uint32_t idx) {
+    if (idx < 32) {
+        return FUSE_CHIP_REGS->FUSE_SPARE_BIT[idx];
     } else {
         return 0;
     }
 }
 
-/* Derive the Device ID using values in the shadow cache */
+/* Read a reserved ODM register from the shadow cache. */
+uint32_t fuse_get_reserved_odm(uint32_t idx) {
+    if (idx < 8) {
+        return FUSE_CHIP_REGS->FUSE_RESERVED_ODM[idx];
+    } else {
+        return 0;
+    }
+}
+
+/* Get the DRAM ID using values in the shadow cache. */
+uint32_t fuse_get_dram_id(void) {
+    return ((fuse_get_reserved_odm(4) >> 3) & 0x7);
+}
+
+/* Derive the Device ID using values in the shadow cache. */
 uint64_t fuse_get_device_id(void) {
     uint64_t device_id = 0;
-    uint64_t y_coord = FUSE_CHIP_REGS->FUSE_Y_COORDINATE & 0x1FF;
-    uint64_t x_coord = FUSE_CHIP_REGS->FUSE_X_COORDINATE & 0x1FF;
-    uint64_t wafer_id = FUSE_CHIP_REGS->FUSE_WAFER_ID & 0x3F;
-    uint32_t lot_code = FUSE_CHIP_REGS->FUSE_LOT_CODE_0;
-    uint64_t fab_code = FUSE_CHIP_REGS->FUSE_FAB_CODE & 0x3F;
+    uint64_t y_coord = FUSE_CHIP_REGS->FUSE_OPT_Y_COORDINATE & 0x1FF;
+    uint64_t x_coord = FUSE_CHIP_REGS->FUSE_OPT_X_COORDINATE & 0x1FF;
+    uint64_t wafer_id = FUSE_CHIP_REGS->FUSE_OPT_WAFER_ID & 0x3F;
+    uint32_t lot_code = FUSE_CHIP_REGS->FUSE_OPT_LOT_CODE_0;
+    uint64_t fab_code = FUSE_CHIP_REGS->FUSE_OPT_FAB_CODE & 0x3F;
+
     uint64_t derived_lot_code = 0;
     for (unsigned int i = 0; i < 5; i++) {
         derived_lot_code = (derived_lot_code * 0x24) + ((lot_code >> (24 - 6*i)) & 0x3F);
@@ -203,40 +186,41 @@ uint64_t fuse_get_device_id(void) {
     device_id |= wafer_id << 18;
     device_id |= derived_lot_code << 24;
     device_id |= fab_code << 50;
+
     return device_id;
 }
 
-/* Get the DRAM ID using values in the shadow cache */
-uint32_t fuse_get_dram_id(void) {
-    return (FUSE_CHIP_REGS->FUSE_RESERVED_ODM[4] >> 3) & 0x7;
-}
+/* Derive the Hardware Type using values in the shadow cache. */
+uint32_t fuse_get_hardware_type(uint32_t target_firmware) {
+    uint32_t fuse_reserved_odm4 = fuse_get_reserved_odm(4);
+    uint32_t hardware_type = (((fuse_reserved_odm4 >> 7) & 2) | ((fuse_reserved_odm4 >> 2) & 1));
 
-/* Derive the Hardware Type using values in the shadow cache */
-uint32_t fuse_get_hardware_type(void) {
-    /* This function is very different between 4.x and < 4.x */
-    uint32_t hardware_type = ((FUSE_CHIP_REGS->FUSE_RESERVED_ODM[4] >> 7) & 2) | ((FUSE_CHIP_REGS->FUSE_RESERVED_ODM[4] >> 2) & 1);
-    
-    if (exosphere_get_target_firmware() >= ATMOSPHERE_TARGET_FIRMWARE_400) {
-        static const uint32_t types[] = {0,1,4,3};
-
-        hardware_type |= (FUSE_CHIP_REGS->FUSE_RESERVED_ODM[4] >> 14) & 0x3C;
-        hardware_type--;
-        return hardware_type > 3 ? 4 : types[hardware_type];
-    } else {
+    /* Firmware from versions 1.0.0 to 3.0.2. */
+    if (target_firmware < ATMOSPHERE_TARGET_FIRMWARE_400) {
+        volatile tegra_fuse_chip_t *fuse_chip = fuse_chip_get_regs();
         if (hardware_type >= 1) {
-            return hardware_type > 2 ? 3 : hardware_type - 1; 
-        } else if ((FUSE_CHIP_REGS->FUSE_SPARE_BIT[9] & 1) == 0) {
+            return (hardware_type > 2) ? 3 : hardware_type - 1;
+        } else if ((fuse_chip->FUSE_SPARE_BIT[9] & 1) == 0) {
             return 0;
         } else {
             return 3;
         }
+    } else if (target_firmware < ATMOSPHERE_TARGET_FIRMWARE_700) {      /* Firmware versions from 4.0.0 to 6.2.0. */
+        static const uint32_t types[] = {0,1,4,3};
+        hardware_type |= ((fuse_reserved_odm4 >> 14) & 0x3C);
+        hardware_type--;
+        return (hardware_type > 3) ? 4 : types[hardware_type];
+    } else {    /* Firmware versions from 7.0.0 onwards. */
+        /* Always return 0 in retail. */
+        return 0;
     }
 }
 
-/* Derive the Retail Type using values in the shadow cache */
+/* Derive the Retail Type using values in the shadow cache. */
 uint32_t fuse_get_retail_type(void) {
-    /* Retail type = IS_RETAIL | UNIT_TYPE */
-    uint32_t retail_type = ((FUSE_CHIP_REGS->FUSE_RESERVED_ODM[4] >> 7) & 4) | (FUSE_CHIP_REGS->FUSE_RESERVED_ODM[4] & 3);
+    /* Retail Type = IS_RETAIL | UNIT_TYPE. */
+    uint32_t fuse_reserved_odm4 = fuse_get_reserved_odm(4);
+    uint32_t retail_type = (((fuse_reserved_odm4 >> 7) & 4) | (fuse_reserved_odm4 & 3));
     if (retail_type == 4) { /* Standard retail unit, IS_RETAIL | 0. */
         return 1;
     } else if (retail_type == 3) { /* Standard dev unit, 0 | DEV_UNIT. */
@@ -249,17 +233,17 @@ uint32_t fuse_get_retail_type(void) {
 void fuse_get_hardware_info(void *dst) {
     uint32_t hw_info[0x4];
 
-    uint32_t unk_hw_fuse = FUSE_CHIP_REGS->_0x120 & 0x3F;
-    uint32_t y_coord = FUSE_CHIP_REGS->FUSE_Y_COORDINATE & 0x1FF;
-    uint32_t x_coord = FUSE_CHIP_REGS->FUSE_X_COORDINATE & 0x1FF;
-    uint32_t wafer_id = FUSE_CHIP_REGS->FUSE_WAFER_ID & 0x3F;
-    uint32_t lot_code_0 = FUSE_CHIP_REGS->FUSE_LOT_CODE_0;
-    uint32_t lot_code_1 = FUSE_CHIP_REGS->FUSE_LOT_CODE_1 & 0x0FFFFFFF;
-    uint32_t fab_code = FUSE_CHIP_REGS->FUSE_FAB_CODE & 0x3F;
-    uint32_t vendor_code = FUSE_CHIP_REGS->FUSE_VENDOR_CODE & 0xF;
+    uint32_t ops_reserved = FUSE_CHIP_REGS->FUSE_OPT_OPS_RESERVED & 0x3F;
+    uint32_t y_coord = FUSE_CHIP_REGS->FUSE_OPT_Y_COORDINATE & 0x1FF;
+    uint32_t x_coord = FUSE_CHIP_REGS->FUSE_OPT_X_COORDINATE & 0x1FF;
+    uint32_t wafer_id = FUSE_CHIP_REGS->FUSE_OPT_WAFER_ID & 0x3F;
+    uint32_t lot_code_0 = FUSE_CHIP_REGS->FUSE_OPT_LOT_CODE_0;
+    uint32_t lot_code_1 = FUSE_CHIP_REGS->FUSE_OPT_LOT_CODE_1 & 0x0FFFFFFF;
+    uint32_t fab_code = FUSE_CHIP_REGS->FUSE_OPT_FAB_CODE & 0x3F;
+    uint32_t vendor_code = FUSE_CHIP_REGS->FUSE_OPT_VENDOR_CODE & 0xF;
 
-    /* Hardware Info = unk_hw_fuse || Y_COORD || X_COORD || WAFER_ID || LOT_CODE || FAB_CODE || VENDOR_ID */
-    hw_info[0] = (uint32_t)((lot_code_1 << 30) | (wafer_id << 24) | (x_coord << 15) | (y_coord << 6) | (unk_hw_fuse));
+    /* Hardware Info = OPS_RESERVED || Y_COORD || X_COORD || WAFER_ID || LOT_CODE || FAB_CODE || VENDOR_ID */
+    hw_info[0] = (uint32_t)((lot_code_1 << 30) | (wafer_id << 24) | (x_coord << 15) | (y_coord << 6) | (ops_reserved));
     hw_info[1] = (uint32_t)((lot_code_0 << 26) | (lot_code_1 >> 2));
     hw_info[2] = (uint32_t)((fab_code << 26) | (lot_code_0 >> 6));
     hw_info[3] = (uint32_t)(vendor_code);
@@ -267,15 +251,50 @@ void fuse_get_hardware_info(void *dst) {
     memcpy(dst, hw_info, 0x10);
 }
 
+/* Get the Key Generation value. */
+uint32_t fuse_get_5x_key_generation(void) {
+    if ((fuse_get_reserved_odm(4) & 0x800) && (fuse_get_reserved_odm(0) == 0x8E61ECAE) && (fuse_get_reserved_odm(1) == 0xF2BA3BB2)) {
+        return (fuse_get_reserved_odm(2) & 0x1F);
+    } else {
+        return 0;
+    }
+}
+
+/* Returns the fuse version expected for the firmware. */
+uint32_t fuse_get_expected_fuse_version(uint32_t target_firmware) {
+    static const uint8_t expected_versions[ATMOSPHERE_TARGET_FIRMWARE_COUNT+1] = {
+        [ATMOSPHERE_TARGET_FIRMWARE_100] = 1,
+        [ATMOSPHERE_TARGET_FIRMWARE_200] = 2,
+        [ATMOSPHERE_TARGET_FIRMWARE_300] = 3,
+     /* [ATMOSPHERE_TARGET_FIRMWARE_302] = 4, */
+        [ATMOSPHERE_TARGET_FIRMWARE_400] = 5,
+        [ATMOSPHERE_TARGET_FIRMWARE_500] = 6,
+        [ATMOSPHERE_TARGET_FIRMWARE_600] = 7,
+        [ATMOSPHERE_TARGET_FIRMWARE_620] = 8,
+        [ATMOSPHERE_TARGET_FIRMWARE_700] = 9,
+        [ATMOSPHERE_TARGET_FIRMWARE_800] = 9,
+        [ATMOSPHERE_TARGET_FIRMWARE_810] = 10,
+        [ATMOSPHERE_TARGET_FIRMWARE_900] = 11,
+        [ATMOSPHERE_TARGET_FIRMWARE_910] = 12,
+    };
+
+    if (target_firmware > ATMOSPHERE_TARGET_FIRMWARE_COUNT) {
+        generic_panic();
+    }
+
+    return expected_versions[target_firmware];
+}
+
+/* Check for RCM bug patches. */
 bool fuse_has_rcm_bug_patch(void) {
     /* Only check for RCM bug patch once, and cache our result. */
     if (!g_has_checked_for_rcm_bug_patch) {
-        /* Patched units have this bit set in reserved_sw, according to reports. */
+        /* Some patched units use XUSB in RCM. */
         if (FUSE_CHIP_REGS->FUSE_RESERVED_SW & 0x80) {
             g_has_rcm_bug_patch = true;
         }
 
-        /* Also check for an ipatch. */
+        /* Other units have a proper ipatch instead. */
         {
             uint32_t word_count = FUSE_CHIP_REGS->FUSE_FIRST_BOOTROM_PATCH_SIZE & 0x7f;
             uint32_t word_addr = 191;
@@ -301,4 +320,4 @@ bool fuse_has_rcm_bug_patch(void) {
     g_has_checked_for_rcm_bug_patch = true;
 
     return g_has_rcm_bug_patch;
-}
+}

exosphere/src/fuse.h

@@ -13,7 +13,7 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
- 
+
 #ifndef EXOSPHERE_FUSE_H
 #define EXOSPHERE_FUSE_H
 
@@ -24,154 +24,167 @@
 /* Exosphere driver for the Tegra X1 FUSE registers. */
 
 typedef struct {
-    uint32_t FUSE_CTRL;
-    uint32_t FUSE_REG_ADDR;
-    uint32_t FUSE_REG_READ;
-    uint32_t FUSE_REG_WRITE;
-    uint32_t FUSE_TIME_RD1;
-    uint32_t FUSE_TIME_RD2;
-    uint32_t FUSE_TIME_PGM1;
-    uint32_t FUSE_TIME_PGM2;
-    uint32_t FUSE_PRIV2INTFC;
+    uint32_t FUSE_FUSECTRL;
+    uint32_t FUSE_FUSEADDR;
+    uint32_t FUSE_FUSERDATA;
+    uint32_t FUSE_FUSEWDATA;
+    uint32_t FUSE_FUSETIME_RD1;
+    uint32_t FUSE_FUSETIME_RD2;
+    uint32_t FUSE_FUSETIME_PGM1;
+    uint32_t FUSE_FUSETIME_PGM2;
+    uint32_t FUSE_PRIV2INTFC_START;
     uint32_t FUSE_FUSEBYPASS;
     uint32_t FUSE_PRIVATEKEYDISABLE;
-    uint32_t FUSE_DIS_PGM;
-    uint32_t FUSE_WRITE_ACCESS;
+    uint32_t FUSE_DISABLEREGPROGRAM;
+    uint32_t FUSE_WRITE_ACCESS_SW;
     uint32_t FUSE_PWR_GOOD_SW;
-    uint32_t _0x38[0x32];
-} fuse_registers_t;
+    uint32_t _0x38;
+    uint32_t FUSE_PRIV2RESHIFT;
+    uint32_t _0x40[0x3];
+    uint32_t FUSE_FUSETIME_RD3;
+    uint32_t _0x50[0xC];
+    uint32_t FUSE_PRIVATE_KEY0_NONZERO;
+    uint32_t FUSE_PRIVATE_KEY1_NONZERO;
+    uint32_t FUSE_PRIVATE_KEY2_NONZERO;
+    uint32_t FUSE_PRIVATE_KEY3_NONZERO;
+    uint32_t FUSE_PRIVATE_KEY4_NONZERO;
+    uint32_t _0x90[0x1C];
+} tegra_fuse_t;
 
 typedef struct {
     uint32_t FUSE_PRODUCTION_MODE;
-    uint32_t _0x4;
-    uint32_t _0x8;
-    uint32_t _0xC;
+    uint32_t FUSE_JTAG_SECUREID_VALID;
+    uint32_t FUSE_ODM_LOCK;
+    uint32_t FUSE_OPT_OPENGL_EN;
     uint32_t FUSE_SKU_INFO;
-    uint32_t FUSE_CPU_SPEEDO_0;
-    uint32_t FUSE_CPU_IDDQ;
-    uint32_t _0x1C;
-    uint32_t _0x20;
-    uint32_t _0x24;
-    uint32_t FUSE_FT_REV;
-    uint32_t FUSE_CPU_SPEEDO_1;
-    uint32_t FUSE_CPU_SPEEDO_2;
-    uint32_t FUSE_SOC_SPEEDO_0;
-    uint32_t FUSE_SOC_SPEEDO_1;
-    uint32_t FUSE_SOC_SPEEDO_2;
-    uint32_t FUSE_SOC_IDDQ;
-    uint32_t _0x44;
+    uint32_t FUSE_CPU_SPEEDO_0_CALIB;
+    uint32_t FUSE_CPU_IDDQ_CALIB;
+    uint32_t FUSE_DAC_CRT_CALIB;
+    uint32_t FUSE_DAC_HDTV_CALIB;
+    uint32_t FUSE_DAC_SDTV_CALIB;
+    uint32_t FUSE_OPT_FT_REV;
+    uint32_t FUSE_CPU_SPEEDO_1_CALIB;
+    uint32_t FUSE_CPU_SPEEDO_2_CALIB;
+    uint32_t FUSE_SOC_SPEEDO_0_CALIB;
+    uint32_t FUSE_SOC_SPEEDO_1_CALIB;
+    uint32_t FUSE_SOC_SPEEDO_2_CALIB;
+    uint32_t FUSE_SOC_IDDQ_CALIB;
+    uint32_t FUSE_RESERVED_PRODUCTION_WP;
     uint32_t FUSE_FA;
-    uint32_t _0x4C;
-    uint32_t _0x50;
-    uint32_t _0x54;
-    uint32_t _0x58;
-    uint32_t _0x5C;
-    uint32_t _0x60;
+    uint32_t FUSE_RESERVED_PRODUCTION;
+    uint32_t FUSE_HDMI_LANE0_CALIB;
+    uint32_t FUSE_HDMI_LANE1_CALIB;
+    uint32_t FUSE_HDMI_LANE2_CALIB;
+    uint32_t FUSE_HDMI_LANE3_CALIB;
+    uint32_t FUSE_ENCRYPTION_RATE;
     uint32_t FUSE_PUBLIC_KEY[0x8];
-    uint32_t FUSE_TSENSOR_1;
-    uint32_t FUSE_TSENSOR_2;
-    uint32_t _0x8C;
-    uint32_t FUSE_CP_REV;
-    uint32_t _0x94;
-    uint32_t FUSE_TSENSOR_0;
+    uint32_t FUSE_TSENSOR1_CALIB;
+    uint32_t FUSE_TSENSOR2_CALIB;
+    uint32_t FUSE_VSENSOR_CALIB;
+    uint32_t FUSE_OPT_CP_REV;
+    uint32_t FUSE_OPT_PFG;
+    uint32_t FUSE_TSENSOR0_CALIB;
     uint32_t FUSE_FIRST_BOOTROM_PATCH_SIZE;
     uint32_t FUSE_SECURITY_MODE;
-    uint32_t FUSE_PRIVATE_KEY[0x4];
-    uint32_t FUSE_DEVICE_KEY;
-    uint32_t _0xB8;
-    uint32_t _0xBC;
+    uint32_t FUSE_PRIVATE_KEY[0x5];
+    uint32_t FUSE_ARM_JTAG_DIS;
+    uint32_t FUSE_BOOT_DEVICE_INFO;
     uint32_t FUSE_RESERVED_SW;
-    uint32_t FUSE_VP8_ENABLE;
+    uint32_t FUSE_OPT_VP9_DISABLE;
     uint32_t FUSE_RESERVED_ODM[0x8];
-    uint32_t _0xE8;
-    uint32_t _0xEC;
-    uint32_t FUSE_SKU_USB_CALIB;
+    uint32_t FUSE_OBS_DIS;
+    uint32_t FUSE_NOR_INFO;
+    uint32_t FUSE_USB_CALIB;
     uint32_t FUSE_SKU_DIRECT_CONFIG;
-    uint32_t _0xF8;
-    uint32_t _0xFC;
-    uint32_t FUSE_VENDOR_CODE;
-    uint32_t FUSE_FAB_CODE;
-    uint32_t FUSE_LOT_CODE_0;
-    uint32_t FUSE_LOT_CODE_1;
-    uint32_t FUSE_WAFER_ID;
-    uint32_t FUSE_X_COORDINATE;
-    uint32_t FUSE_Y_COORDINATE;
-    uint32_t _0x11C;
-    uint32_t _0x120;
+    uint32_t FUSE_KFUSE_PRIVKEY_CTRL;
+    uint32_t FUSE_PACKAGE_INFO;
+    uint32_t FUSE_OPT_VENDOR_CODE;
+    uint32_t FUSE_OPT_FAB_CODE;
+    uint32_t FUSE_OPT_LOT_CODE_0;
+    uint32_t FUSE_OPT_LOT_CODE_1;
+    uint32_t FUSE_OPT_WAFER_ID;
+    uint32_t FUSE_OPT_X_COORDINATE;
+    uint32_t FUSE_OPT_Y_COORDINATE;
+    uint32_t FUSE_OPT_SEC_DEBUG_EN;
+    uint32_t FUSE_OPT_OPS_RESERVED;
     uint32_t FUSE_SATA_CALIB;
-    uint32_t FUSE_GPU_IDDQ;
-    uint32_t FUSE_TSENSOR_3;
-    uint32_t _0x130;
-    uint32_t _0x134;
-    uint32_t _0x138;
-    uint32_t _0x13C;
-    uint32_t _0x140;
-    uint32_t _0x144;
+    uint32_t FUSE_GPU_IDDQ_CALIB;
+    uint32_t FUSE_TSENSOR3_CALIB;
+    uint32_t FUSE_SKU_BOND_OUT_L;
+    uint32_t FUSE_SKU_BOND_OUT_H;
+    uint32_t FUSE_SKU_BOND_OUT_U;
+    uint32_t FUSE_SKU_BOND_OUT_V;
+    uint32_t FUSE_SKU_BOND_OUT_W;
+    uint32_t FUSE_OPT_SAMPLE_TYPE;
     uint32_t FUSE_OPT_SUBREVISION;
-    uint32_t _0x14C;
-    uint32_t _0x150;
-    uint32_t FUSE_TSENSOR_4;
-    uint32_t FUSE_TSENSOR_5;
-    uint32_t FUSE_TSENSOR_6;
-    uint32_t FUSE_TSENSOR_7;
-    uint32_t FUSE_OPT_PRIV_SEC_DIS;
+    uint32_t FUSE_OPT_SW_RESERVED_0;
+    uint32_t FUSE_OPT_SW_RESERVED_1;
+    uint32_t FUSE_TSENSOR4_CALIB;
+    uint32_t FUSE_TSENSOR5_CALIB;
+    uint32_t FUSE_TSENSOR6_CALIB;
+    uint32_t FUSE_TSENSOR7_CALIB;
+    uint32_t FUSE_OPT_PRIV_SEC_EN;
     uint32_t FUSE_PKC_DISABLE;
     uint32_t _0x16C;
     uint32_t _0x170;
     uint32_t _0x174;
     uint32_t _0x178;
-    uint32_t _0x17C;
+    uint32_t FUSE_FUSE2TSEC_DEBUG_DISABLE;
     uint32_t FUSE_TSENSOR_COMMON;
-    uint32_t _0x184;
-    uint32_t _0x188;
-    uint32_t _0x18C;
-    uint32_t _0x190;
+    uint32_t FUSE_OPT_CP_BIN;
+    uint32_t FUSE_OPT_GPU_DISABLE;
+    uint32_t FUSE_OPT_FT_BIN;
+    uint32_t FUSE_OPT_DONE_MAP;
     uint32_t _0x194;
-    uint32_t _0x198;
-    uint32_t FUSE_DEBUG_AUTH_OVERRIDE;
+    uint32_t FUSE_APB2JTAG_DISABLE;
+    uint32_t FUSE_ODM_INFO;
     uint32_t _0x1A0;
     uint32_t _0x1A4;
-    uint32_t _0x1A8;
+    uint32_t FUSE_ARM_CRYPT_DE_FEATURE;
     uint32_t _0x1AC;
     uint32_t _0x1B0;
     uint32_t _0x1B4;
     uint32_t _0x1B8;
     uint32_t _0x1BC;
-    uint32_t _0x1D0;
-    uint32_t FUSE_TSENSOR_8;
+    uint32_t FUSE_WOA_SKU_FLAG;
+    uint32_t FUSE_ECO_RESERVE_1;
+    uint32_t FUSE_GCPLEX_CONFIG_FUSE;
+    uint32_t FUSE_PRODUCTION_MONTH;
+    uint32_t FUSE_RAM_REPAIR_INDICATOR;
+    uint32_t FUSE_TSENSOR9_CALIB;
     uint32_t _0x1D8;
-    uint32_t _0x1DC;
-    uint32_t _0x1E0;
-    uint32_t _0x1E4;
-    uint32_t _0x1E8;
-    uint32_t _0x1EC;
-    uint32_t _0x1F0;
-    uint32_t _0x1F4;
-    uint32_t _0x1F8;
+    uint32_t FUSE_VMIN_CALIBRATION;
+    uint32_t FUSE_AGING_SENSOR_CALIBRATION;
+    uint32_t FUSE_DEBUG_AUTHENTICATION;
+    uint32_t FUSE_SECURE_PROVISION_INDEX;
+    uint32_t FUSE_SECURE_PROVISION_INFO;
+    uint32_t FUSE_OPT_GPU_DISABLE_CP1;
+    uint32_t FUSE_SPARE_ENDIS;
+    uint32_t FUSE_ECO_RESERVE_0;
     uint32_t _0x1FC;
     uint32_t _0x200;
-    uint32_t FUSE_RESERVED_CALIB;
-    uint32_t _0x208;
-    uint32_t _0x20C;
-    uint32_t _0x210;
-    uint32_t _0x214;
-    uint32_t _0x218;
-    uint32_t FUSE_TSENSOR_9;
-    uint32_t _0x220;
-    uint32_t _0x224;
-    uint32_t _0x228;
-    uint32_t _0x22C;
-    uint32_t _0x230;
-    uint32_t _0x234;
-    uint32_t _0x238;
-    uint32_t _0x23C;
-    uint32_t _0x240;
-    uint32_t _0x244;
-    uint32_t _0x248;
-    uint32_t _0x24C;
+    uint32_t FUSE_RESERVED_CALIB0;
+    uint32_t FUSE_RESERVED_CALIB1;
+    uint32_t FUSE_OPT_GPU_TPC0_DISABLE;
+    uint32_t FUSE_OPT_GPU_TPC0_DISABLE_CP1;
+    uint32_t FUSE_OPT_CPU_DISABLE;
+    uint32_t FUSE_OPT_CPU_DISABLE_CP1;
+    uint32_t FUSE_TSENSOR10_CALIB;
+    uint32_t FUSE_TSENSOR10_CALIB_AUX;
+    uint32_t FUSE_OPT_RAM_SVOP_DP;
+    uint32_t FUSE_OPT_RAM_SVOP_PDP;
+    uint32_t FUSE_OPT_RAM_SVOP_REG;
+    uint32_t FUSE_OPT_RAM_SVOP_SP;
+    uint32_t FUSE_OPT_RAM_SVOP_SMPDP;
+    uint32_t FUSE_OPT_GPU_TPC0_DISABLE_CP2;
+    uint32_t FUSE_OPT_GPU_TPC1_DISABLE;
+    uint32_t FUSE_OPT_GPU_TPC1_DISABLE_CP1;
+    uint32_t FUSE_OPT_GPU_TPC1_DISABLE_CP2;
+    uint32_t FUSE_OPT_CPU_DISABLE_CP2;
+    uint32_t FUSE_OPT_GPU_DISABLE_CP2;
     uint32_t FUSE_USB_CALIB_EXT;
-    uint32_t _0x254;
-    uint32_t _0x258;
+    uint32_t FUSE_RESERVED_FIELD;
+    uint32_t FUSE_OPT_ECC_EN;
     uint32_t _0x25C;
     uint32_t _0x260;
     uint32_t _0x264;
@@ -180,41 +193,42 @@ typedef struct {
     uint32_t _0x270;
     uint32_t _0x274;
     uint32_t _0x278;
-    uint32_t _0x27C;
+    uint32_t FUSE_SPARE_REALIGNMENT_REG;
     uint32_t FUSE_SPARE_BIT[0x20];
-} fuse_chip_registers_t;
+} tegra_fuse_chip_t;
 
-static inline volatile fuse_registers_t *get_fuse_regs(void) {
-    return (volatile fuse_registers_t *)(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_FUSE) + 0x800);
+static inline volatile tegra_fuse_t *fuse_get_regs(void) {
+    return (volatile tegra_fuse_t *)(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_FUSE) + 0x800);
 }
 
-static inline volatile fuse_chip_registers_t *get_fuse_chip_regs(void) {
-    return (volatile fuse_chip_registers_t *)(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_FUSE) + 0x900);
+static inline volatile tegra_fuse_chip_t *fuse_chip_get_regs(void) {
+    return (volatile tegra_fuse_chip_t *)(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_FUSE) + 0x900);
 }
-#define FUSE_REGS       (get_fuse_regs())
-#define FUSE_CHIP_REGS  (get_fuse_chip_regs())
+
+#define FUSE_REGS       (fuse_get_regs())
+#define FUSE_CHIP_REGS  (fuse_chip_get_regs())
 
 void fuse_init(void);
-
-uint32_t fuse_hw_read(uint32_t addr);
-void fuse_hw_write(uint32_t value, uint32_t addr);
-void fuse_hw_sense(void);
 void fuse_disable_programming(void);
-void fuse_secondary_private_key_disable(void);
+void fuse_disable_private_key(void);
 
 uint32_t fuse_get_sku_info(void);
 uint32_t fuse_get_spare_bit(uint32_t idx);
 uint32_t fuse_get_reserved_odm(uint32_t idx);
-
-uint32_t fuse_get_5x_key_generation(void);
-
 uint32_t fuse_get_bootrom_patch_version(void);
 uint64_t fuse_get_device_id(void);
 uint32_t fuse_get_dram_id(void);
-uint32_t fuse_get_hardware_type(void);
+uint32_t fuse_get_hardware_type(uint32_t target_firmware);
 uint32_t fuse_get_retail_type(void);
 void fuse_get_hardware_info(void *dst);
-
+uint32_t fuse_get_5x_key_generation(void);
 bool fuse_has_rcm_bug_patch(void);
 
+uint32_t fuse_hw_read(uint32_t addr);
+void fuse_hw_write(uint32_t value, uint32_t addr);
+void fuse_hw_sense(void);
+
+
+uint32_t fuse_get_expected_fuse_version(uint32_t target_firmware);
+
 #endif

exosphere/src/i2c.c

@@ -13,26 +13,57 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
- 
-#include <string.h>
 
 #include "i2c.h"
 #include "utils.h"
 #include "timers.h"
+#include "pinmux.h"
 
 /* Prototypes for internal commands. */
-volatile i2c_registers_t *i2c_get_registers_from_id(unsigned int id);
-void i2c_load_config(volatile i2c_registers_t *regs);
+volatile tegra_i2c_t *i2c_get_registers_from_id(I2CDevice id);
+void i2c_load_config(volatile tegra_i2c_t *regs);
 
-bool i2c_query(unsigned int id, uint8_t device, uint8_t r, void *dst, size_t dst_size);
-bool i2c_send(unsigned int id, uint8_t device, uint8_t r, void *src, size_t src_size);
+bool i2c_query(I2CDevice id, uint8_t device, uint8_t r, void *dst, size_t dst_size);
+bool i2c_send(I2CDevice id, uint8_t device, uint8_t r, void *src, size_t src_size);
 
-bool i2c_write(volatile i2c_registers_t *regs, uint8_t device, void *src, size_t src_size);
-bool i2c_read(volatile i2c_registers_t *regs, uint8_t device, void *dst, size_t dst_size);
+bool i2c_write(volatile tegra_i2c_t *regs, uint8_t device, void *src, size_t src_size);
+bool i2c_read(volatile tegra_i2c_t *regs, uint8_t device, void *dst, size_t dst_size);
+
+/* Configure I2C pinmux. */
+void i2c_config(I2CDevice id) {
+    volatile tegra_pinmux_t *pinmux = pinmux_get_regs();
+
+    switch (id) {
+        case I2C_1:
+            pinmux->gen1_i2c_scl = PINMUX_INPUT;
+            pinmux->gen1_i2c_sda = PINMUX_INPUT;
+            break;
+        case I2C_2:
+            pinmux->gen2_i2c_scl = PINMUX_INPUT;
+            pinmux->gen2_i2c_sda = PINMUX_INPUT;
+            break;
+        case I2C_3:
+            pinmux->gen3_i2c_scl = PINMUX_INPUT;
+            pinmux->gen3_i2c_sda = PINMUX_INPUT;
+            break;
+        case I2C_4:
+            pinmux->cam_i2c_scl = PINMUX_INPUT;
+            pinmux->cam_i2c_sda = PINMUX_INPUT;
+            break;
+        case I2C_5:
+            pinmux->pwr_i2c_scl = PINMUX_INPUT;
+            pinmux->pwr_i2c_sda = PINMUX_INPUT;
+            break;
+        case I2C_6:
+            /* Unused. */
+            break;
+        default: break;
+    }
+}
 
 /* Initialize I2C based on registers. */
-void i2c_init(unsigned int id) {
-    volatile i2c_registers_t *regs = i2c_get_registers_from_id(id);
+void i2c_init(I2CDevice id) {
+    volatile tegra_i2c_t *regs = i2c_get_registers_from_id(id);
 
     /* Setup divisor, and clear the bus. */
     regs->I2C_I2C_CLK_DIVISOR_REGISTER_0 = 0x50001;
@@ -43,7 +74,7 @@ void i2c_init(unsigned int id) {
 
     /* Wait a while until BUS_CLEAR_DONE is set. */
     for (unsigned int i = 0; i < 10; i++) {
-        wait(20000);
+        wait(25);
         if (regs->I2C_INTERRUPT_STATUS_REGISTER_0 & 0x800) {
             break;
         }
@@ -57,20 +88,20 @@ void i2c_init(unsigned int id) {
     regs->I2C_INTERRUPT_STATUS_REGISTER_0 = int_status;
 }
 
-/* Sets a bit in a PMIC register over I2C during CPU shutdown. */ 
+/* Sets a bit in a PMIC register over I2C during CPU shutdown. */
 void i2c_send_pmic_cpu_shutdown_cmd(void) {
     uint32_t val = 0;
     /* PMIC == Device 4:3C. */
-    i2c_query(4, 0x3C, 0x41, &val, 1);
+    i2c_query(I2C_5, MAX77620_PWR_I2C_ADDR, 0x41, &val, 1);
     val |= 4;
-    i2c_send(4, 0x3C, 0x41, &val, 1);
+    i2c_send(I2C_5, MAX77620_PWR_I2C_ADDR, 0x41, &val, 1);
 }
 
 /* Queries the value of TI charger bit over I2C. */
 bool i2c_query_ti_charger_bit_7(void) {
     uint32_t val = 0;
     /* TI Charger = Device 0:6B. */
-    i2c_query(0, 0x6B, 0, &val, 1);
+    i2c_query(I2C_1, BQ24193_I2C_ADDR, 0, &val, 1);
     return (val & 0x80) != 0;
 }
 
@@ -78,34 +109,34 @@ bool i2c_query_ti_charger_bit_7(void) {
 void i2c_clear_ti_charger_bit_7(void) {
     uint32_t val = 0;
     /* TI Charger = Device 0:6B. */
-    i2c_query(0, 0x6B, 0, &val, 1);
+    i2c_query(I2C_1, BQ24193_I2C_ADDR, 0, &val, 1);
     val &= 0x7F;
-    i2c_send(0, 0x6B, 0, &val, 1);
+    i2c_send(I2C_1, BQ24193_I2C_ADDR, 0, &val, 1);
 }
 
 /* Sets TI charger bit over I2C. */
 void i2c_set_ti_charger_bit_7(void) {
     uint32_t val = 0;
     /* TI Charger = Device 0:6B. */
-    i2c_query(0, 0x6B, 0, &val, 1);
+    i2c_query(I2C_1, BQ24193_I2C_ADDR, 0, &val, 1);
     val |= 0x80;
-    i2c_send(0, 0x6B, 0, &val, 1);
+    i2c_send(I2C_1, BQ24193_I2C_ADDR, 0, &val, 1);
 }
 
 /* Get registers pointer based on I2C ID. */
-volatile i2c_registers_t *i2c_get_registers_from_id(unsigned int id) {
+volatile tegra_i2c_t *i2c_get_registers_from_id(I2CDevice id) {
     switch (id) {
-        case 0:
+        case I2C_1:
             return I2C1_REGS;
-        case 1:
+        case I2C_2:
             return I2C2_REGS;
-        case 2:
+        case I2C_3:
             return I2C3_REGS;
-        case 3:
+        case I2C_4:
             return I2C4_REGS;
-        case 4:
+        case I2C_5:
             return I2C5_REGS;
-        case 5:
+        case I2C_6:
             return I2C6_REGS;
         default:
             generic_panic();
@@ -114,7 +145,7 @@ volatile i2c_registers_t *i2c_get_registers_from_id(unsigned int id) {
 }
 
 /* Load hardware config for I2C4. */
-void i2c_load_config(volatile i2c_registers_t *regs) {
+void i2c_load_config(volatile tegra_i2c_t *regs) {
     /* Set MSTR_CONFIG_LOAD, TIMEOUT_CONFIG_LOAD, undocumented bit. */
     regs->I2C_I2C_CONFIG_LOAD_0 = 0x25;
 
@@ -128,10 +159,10 @@ void i2c_load_config(volatile i2c_registers_t *regs) {
 }
 
 /* Reads a register from a device over I2C, writes result to output. */
-bool i2c_query(unsigned int id, uint8_t device, uint8_t r, void *dst, size_t dst_size) {
-    volatile i2c_registers_t *regs = i2c_get_registers_from_id(id);
+bool i2c_query(I2CDevice id, uint8_t device, uint8_t r, void *dst, size_t dst_size) {
+    volatile tegra_i2c_t *regs = i2c_get_registers_from_id(id);
     uint32_t val = r;
-    
+
     /* Write single byte register ID to device. */
     if (!i2c_write(regs, device, &val, 1)) {
         return false;
@@ -140,12 +171,12 @@ bool i2c_query(unsigned int id, uint8_t device, uint8_t r, void *dst, size_t dst
     if (dst_size > 4) {
         return false;
     }
-    
+
     return i2c_read(regs, device, dst, dst_size);
 }
 
 /* Writes a value to a register over I2C. */
-bool i2c_send(unsigned int id, uint8_t device, uint8_t r, void *src, size_t src_size) {    
+bool i2c_send(I2CDevice id, uint8_t device, uint8_t r, void *src, size_t src_size) {
     uint32_t val = r;
     if (src_size == 0) {
         return true;
@@ -158,7 +189,7 @@ bool i2c_send(unsigned int id, uint8_t device, uint8_t r, void *src, size_t src_
 }
 
 /* Writes bytes to device over I2C. */
-bool i2c_write(volatile i2c_registers_t *regs, uint8_t device, void *src, size_t src_size) {
+bool i2c_write(volatile tegra_i2c_t *regs, uint8_t device, void *src, size_t src_size) {
     if (src_size > 4) {
         return false;
     } else if (src_size == 0) {
@@ -177,8 +208,7 @@ bool i2c_write(volatile i2c_registers_t *regs, uint8_t device, void *src, size_t
     i2c_load_config(regs);
 
     /* Config |= SEND; */
-    regs->I2C_I2C_CNFG_0 |= 0x200;
-
+    regs->I2C_I2C_CNFG_0 = ((regs->I2C_I2C_CNFG_0 & 0xFFFFFDFF) | 0x200);
 
     while (regs->I2C_I2C_STATUS_0 & 0x100) {
         /* Wait until not busy. */
@@ -189,7 +219,7 @@ bool i2c_write(volatile i2c_registers_t *regs, uint8_t device, void *src, size_t
 }
 
 /* Reads bytes from device over I2C. */
-bool i2c_read(volatile i2c_registers_t *regs, uint8_t device, void *dst, size_t dst_size) {
+bool i2c_read(volatile tegra_i2c_t *regs, uint8_t device, void *dst, size_t dst_size) {
     if (dst_size > 4) {
         return false;
     } else if (dst_size == 0) {
@@ -205,13 +235,12 @@ bool i2c_read(volatile i2c_registers_t *regs, uint8_t device, void *dst, size_t
     i2c_load_config(regs);
 
     /* Config |= SEND; */
-    regs->I2C_I2C_CNFG_0 |= 0x200;
-
+    regs->I2C_I2C_CNFG_0 = ((regs->I2C_I2C_CNFG_0 & 0xFFFFFDFF) | 0x200);
 
     while (regs->I2C_I2C_STATUS_0 & 0x100) {
         /* Wait until not busy. */
     }
-    
+
     /* Ensure success. */
     if ((regs->I2C_I2C_STATUS_0 & 0xF) != 0) {
         return false;

exosphere/src/i2c.h

@@ -19,10 +19,27 @@
 
 #include <stdbool.h>
 #include <stdint.h>
+#include <string.h>
 #include "memory_map.h"
 
 /* Exosphere driver for the Tegra X1 I2C registers. */
 
+#define MAX77621_CPU_I2C_ADDR       0x1B
+#define MAX77621_GPU_I2C_ADDR       0x1C
+#define MAX17050_I2C_ADDR           0x36
+#define MAX77620_PWR_I2C_ADDR       0x3C
+#define MAX77620_RTC_I2C_ADDR       0x68
+#define BQ24193_I2C_ADDR            0x6B
+
+typedef enum {
+    I2C_1 = 0,
+    I2C_2 = 1,
+    I2C_3 = 2,
+    I2C_4 = 3,
+    I2C_5 = 4,
+    I2C_6 = 5,
+} I2CDevice;
+
 typedef struct {
     uint32_t I2C_I2C_CNFG_0;
     uint32_t I2C_I2C_CMD_ADDR0_0;
@@ -65,7 +82,7 @@ typedef struct {
     uint32_t I2C_I2C_INTERFACE_TIMING_1_0;
     uint32_t I2C_I2C_HS_INTERFACE_TIMING_0_0;
     uint32_t I2C_I2C_HS_INTERFACE_TIMING_1_0;
-} i2c_registers_t;
+} tegra_i2c_t;
 
 static inline uintptr_t get_i2c_dtv_234_base(void) {
     return MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_DTV_I2C234);
@@ -75,17 +92,20 @@ static inline uintptr_t get_i2c56_spi2b_base(void) {
     return MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_I2C56_SPI2B);
 }
 
-#define I2C1_REGS ((volatile i2c_registers_t *)(get_i2c_dtv_234_base() + 0x000))
-#define I2C2_REGS ((volatile i2c_registers_t *)(get_i2c_dtv_234_base() + 0x400))
-#define I2C3_REGS ((volatile i2c_registers_t *)(get_i2c_dtv_234_base() + 0x500))
-#define I2C4_REGS ((volatile i2c_registers_t *)(get_i2c_dtv_234_base() + 0x700))
-#define I2C5_REGS ((volatile i2c_registers_t *)(get_i2c56_spi2b_base() + 0x000))
-#define I2C6_REGS ((volatile i2c_registers_t *)(get_i2c56_spi2b_base() + 0x100))
+#define I2C1_REGS ((volatile tegra_i2c_t *)(get_i2c_dtv_234_base() + 0x000))
+#define I2C2_REGS ((volatile tegra_i2c_t *)(get_i2c_dtv_234_base() + 0x400))
+#define I2C3_REGS ((volatile tegra_i2c_t *)(get_i2c_dtv_234_base() + 0x500))
+#define I2C4_REGS ((volatile tegra_i2c_t *)(get_i2c_dtv_234_base() + 0x700))
+#define I2C5_REGS ((volatile tegra_i2c_t *)(get_i2c56_spi2b_base() + 0x000))
+#define I2C6_REGS ((volatile tegra_i2c_t *)(get_i2c56_spi2b_base() + 0x100))
 
-void i2c_init(unsigned int id);
+void i2c_config(I2CDevice id);
+
+void i2c_init(I2CDevice id);
+bool i2c_query(I2CDevice id, uint8_t device, uint8_t r, void *dst, size_t dst_size);
+bool i2c_send(I2CDevice id, uint8_t device, uint8_t r, void *src, size_t src_size);
 
 void i2c_send_pmic_cpu_shutdown_cmd(void);
-
 bool i2c_query_ti_charger_bit_7(void);
 void i2c_clear_ti_charger_bit_7(void);
 void i2c_set_ti_charger_bit_7(void);

exosphere/src/masterkey.c

@@ -43,6 +43,8 @@ static const uint8_t mkey_vectors_dev[MASTERKEY_REVISION_MAX][0x10] =
     {0x6F, 0xD2, 0x84, 0x1D, 0x05, 0xEC, 0x40, 0x94, 0x5F, 0x18, 0xB3, 0x81, 0x09, 0x98, 0x8D, 0x4E}, /* Master key 05 encrypted with Master key 06. */
     {0x37, 0xAF, 0xAB, 0x35, 0x79, 0x09, 0xD9, 0x48, 0x29, 0xD2, 0xDB, 0xA5, 0xA5, 0xF5, 0x30, 0x19}, /* Master key 06 encrypted with Master key 07. */
     {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* TODO: Master key 07 encrypted with Master key 08. */
+    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* TODO: Master key 08 encrypted with Master key 09. */
+    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* TODO: Master key 09 encrypted with Master key 0A. */
 };
 
 /* Retail unit keys. */
@@ -57,6 +59,8 @@ static const uint8_t mkey_vectors[MASTERKEY_REVISION_MAX][0x10] =
     {0x1E, 0x1E, 0x22, 0xC0, 0x5A, 0x33, 0x3C, 0xB9, 0x0B, 0xA9, 0x03, 0x04, 0xBA, 0xDB, 0x07, 0x57}, /* Master key 05 encrypted with Master key 06. */
     {0xA4, 0xD4, 0x52, 0x6F, 0xD1, 0xE4, 0x36, 0xAA, 0x9F, 0xCB, 0x61, 0x27, 0x1C, 0x67, 0x65, 0x1F}, /* Master key 06 encrypted with Master key 07. */
     {0xEA, 0x60, 0xB3, 0xEA, 0xCE, 0x8F, 0x24, 0x46, 0x7D, 0x33, 0x9C, 0xD1, 0xBC, 0x24, 0x98, 0x29}, /* Master key 07 encrypted with Master key 08. */
+    {0x4D, 0xD9, 0x98, 0x42, 0x45, 0x0D, 0xB1, 0x3C, 0x52, 0x0C, 0x9A, 0x44, 0xBB, 0xAD, 0xAF, 0x80}, /* Master key 08 encrypted with Master key 09. */
+    {0xB8, 0x96, 0x9E, 0x4A, 0x00, 0x0D, 0xD6, 0x28, 0xB3, 0xD1, 0xDB, 0x68, 0x5F, 0xFB, 0xE1, 0x2A}, /* Master key 09 encrypted with Master key 0A. */
 };
 
 bool check_mkey_revision(unsigned int revision, bool is_retail) {

exosphere/src/masterkey.h

@@ -19,8 +19,8 @@
 
 /* This is glue code to enable master key support across versions. */
 
-/* TODO: Update to 0xA on release of new master key. */
-#define MASTERKEY_REVISION_MAX 0x9
+/* TODO: Update to 0xC on release of new master key. */
+#define MASTERKEY_REVISION_MAX 0xB
 
 #define MASTERKEY_REVISION_100_230     0x00
 #define MASTERKEY_REVISION_300         0x01
@@ -29,8 +29,10 @@
 #define MASTERKEY_REVISION_500_510     0x04
 #define MASTERKEY_REVISION_600_610     0x05
 #define MASTERKEY_REVISION_620         0x06
-#define MASTERKEY_REVISION_700_800 0x07
-#define MASTERKEY_REVISION_810_CURRENT 0x08
+#define MASTERKEY_REVISION_700_800     0x07
+#define MASTERKEY_REVISION_810         0x08
+#define MASTERKEY_REVISION_900         0x09
+#define MASTERKEY_REVISION_910_CURRENT 0x0A
 
 #define MASTERKEY_NUM_NEW_DEVICE_KEYS (MASTERKEY_REVISION_MAX - MASTERKEY_REVISION_400_410)
 

exosphere/src/mc.h

@@ -40,6 +40,14 @@ static inline uintptr_t get_mc_base(void) {
 #define MC_SMMU_PTB_DATA                                        0x20
 #define MC_SMMU_TLB_FLUSH                                       0x30
 #define MC_SMMU_PTC_FLUSH                                       0x34
+#define MC_SMMU_ASID_SECURITY                                   0x38
+#define MC_SMMU_ASID_SECURITY_1                                 0x3c
+#define MC_SMMU_ASID_SECURITY_2                                 0x9e0
+#define MC_SMMU_ASID_SECURITY_3                                 0x9e4
+#define MC_SMMU_ASID_SECURITY_4                                 0x9e8
+#define MC_SMMU_ASID_SECURITY_5                                 0x9ec
+#define MC_SMMU_ASID_SECURITY_6                                 0x9f0
+#define MC_SMMU_ASID_SECURITY_7                                 0x9f4
 #define MC_SMMU_AFI_ASID                                        0x238
 #define MC_SMMU_AVPC_ASID                                       0x23c
 #define MC_SMMU_PPCS1_ASID                                      0x298

exosphere/src/misc.h

@@ -18,26 +18,15 @@
 #define EXOSPHERE_MISC_H
 
 #include <stdint.h>
-
 #include "memory_map.h"
 
 /* Exosphere driver for the Tegra X1 MISC Registers. */
 
 #define MISC_BASE  (MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_MISC))
-
 #define MAKE_MISC_REG(n) MAKE_REG32(MISC_BASE + n)
 
-
 #define APB_MISC_SECURE_REGS_APB_SLAVE_SECURITY_ENABLE_REG0_0 MAKE_MISC_REG(0x0C00)
 #define APB_MISC_SECURE_REGS_APB_SLAVE_SECURITY_ENABLE_REG1_0 MAKE_MISC_REG(0x0C04)
 #define APB_MISC_SECURE_REGS_APB_SLAVE_SECURITY_ENABLE_REG2_0 MAKE_MISC_REG(0x0C08)
 
-#define PINMUX_AUX_GEN1_I2C_SCL_0 MAKE_MISC_REG(0x30BC)
-#define PINMUX_AUX_GEN1_I2C_SDA_0 MAKE_MISC_REG(0x30C0)
-
-#define PINMUX_AUX_UARTn_TX_0(n)    MAKE_MISC_REG(0x30E4 + 0x10 * (n))
-#define PINMUX_AUX_UARTn_RX_0(n)    MAKE_MISC_REG(0x30E8 + 0x10 * (n))
-#define PINMUX_AUX_UARTn_RTS_0(n)   MAKE_MISC_REG(0x30EC + 0x10 * (n))
-#define PINMUX_AUX_UARTn_CTS_0(n)   MAKE_MISC_REG(0x30F0 + 0x10 * (n))
-
 #endif

exosphere/src/package2.c

@@ -43,7 +43,9 @@ static const uint8_t new_device_key_sources[MASTERKEY_NUM_NEW_DEVICE_KEYS][0x10]
     {0x70, 0x08, 0x1B, 0x97, 0x44, 0x64, 0xF8, 0x91, 0x54, 0x9D, 0xC6, 0x84, 0x8F, 0x1A, 0xB2, 0xE4}, /* 6.x   New Device Key Source. */
     {0x8E, 0x09, 0x1F, 0x7A, 0xBB, 0xCA, 0x6A, 0xFB, 0xB8, 0x9B, 0xD5, 0xC1, 0x25, 0x9C, 0xA9, 0x17}, /* 6.2.0 New Device Key Source. */
     {0x8F, 0x77, 0x5A, 0x96, 0xB0, 0x94, 0xFD, 0x8D, 0x28, 0xE4, 0x19, 0xC8, 0x16, 0x1C, 0xDB, 0x3D}, /* 7.0.0 New Device Key Source. */
-    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* TODO: 8.1.0 New Device Key Source to be added on next change-of-keys. */
+    {0x67, 0x62, 0xD4, 0x8E, 0x55, 0xCF, 0xFF, 0x41, 0x31, 0x15, 0x3B, 0x24, 0x0C, 0x7C, 0x07, 0xAE}, /* 8.1.0 New Device Key Source. */
+    {0x4A, 0xC3, 0x4E, 0x14, 0x8B, 0x96, 0x4A, 0xD5, 0xD4, 0x99, 0x73, 0xC4, 0x45, 0xAB, 0x8B, 0x49}, /* 9.0.0 New Device Key Source. */
+    {0x14, 0xB8, 0x74, 0x12, 0xCB, 0xBD, 0x0B, 0x8F, 0x20, 0xFB, 0x30, 0xDA, 0x27, 0xE4, 0x58, 0x94}, /* 9.1.0 New Device Key Source. */
 };
 
 static const uint8_t new_device_keygen_sources[MASTERKEY_NUM_NEW_DEVICE_KEYS][0x10] = {
@@ -52,7 +54,9 @@ static const uint8_t new_device_keygen_sources[MASTERKEY_NUM_NEW_DEVICE_KEYS][0x
     {0x99, 0xFA, 0x98, 0xBD, 0x15, 0x1C, 0x72, 0xFD, 0x7D, 0x9A, 0xD5, 0x41, 0x00, 0xFD, 0xB2, 0xEF}, /* 6.x   New Device Keygen Source. */
     {0x81, 0x3C, 0x6C, 0xBF, 0x5D, 0x21, 0xDE, 0x77, 0x20, 0xD9, 0x6C, 0xE3, 0x22, 0x06, 0xAE, 0xBB}, /* 6.2.0 New Device Keygen Source. */
     {0x86, 0x61, 0xB0, 0x16, 0xFA, 0x7A, 0x9A, 0xEA, 0xF6, 0xF5, 0xBE, 0x1A, 0x13, 0x5B, 0x6D, 0x9E}, /* 7.0.0 New Device Keygen Source. */
-    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* TODO: 8.1.0 New Device Key Source to be added on next change-of-keys. */
+    {0xA6, 0x81, 0x71, 0xE7, 0xB5, 0x23, 0x74, 0xB0, 0x39, 0x8C, 0xB7, 0xFF, 0xA0, 0x62, 0x9F, 0x8D}, /* 8.1.0 New Device Keygen Source. */
+    {0x03, 0xE7, 0xEB, 0x43, 0x1B, 0xCF, 0x5F, 0xB5, 0xED, 0xDC, 0x97, 0xAE, 0x21, 0x8D, 0x19, 0xED}, /* 9.0.0 New Device Keygen Source. */
+    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* TODO: 9.1.0 New Device Keygen Source to be added on next change-of-keys. */
 };
 
 static const uint8_t new_device_keygen_sources_dev[MASTERKEY_NUM_NEW_DEVICE_KEYS][0x10] = {
@@ -61,7 +65,9 @@ static const uint8_t new_device_keygen_sources_dev[MASTERKEY_NUM_NEW_DEVICE_KEYS
     {0xF6, 0xD8, 0x59, 0x63, 0x8F, 0x47, 0xCB, 0x4A, 0xD8, 0x74, 0x05, 0x7F, 0x88, 0x92, 0x33, 0xA5}, /* 6.x   New Device Keygen Source. */
     {0x20, 0xAB, 0xF2, 0x0F, 0x05, 0xE3, 0xDE, 0x2E, 0xA1, 0xFB, 0x37, 0x5E, 0x8B, 0x22, 0x1A, 0x38}, /* 6.2.0 New Device Keygen Source. */
     {0x60, 0xAE, 0x56, 0x68, 0x11, 0xE2, 0x0C, 0x99, 0xDE, 0x05, 0xAE, 0x68, 0x78, 0x85, 0x04, 0xAE}, /* 7.0.0 New Device Keygen Source. */
-    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* TODO: 8.1.0 New Device Key Source to be added on next change-of-keys. */
+    {0x94, 0xD6, 0xA8, 0xC0, 0x95, 0xAF, 0xD0, 0xA6, 0x27, 0x53, 0x5E, 0xE5, 0x8E, 0x70, 0x1F, 0x87}, /* 8.1.0 New Device Keygen Source. */
+    {0x61, 0x6A, 0x88, 0x21, 0xA3, 0x52, 0xB0, 0x19, 0x16, 0x25, 0xA4, 0xE3, 0x4C, 0x54, 0x02, 0x0F}, /* 9.0.0 New Device Keygen Source. */
+    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* TODO: 9.1.0 New Device Keygen Source to be added on next change-of-keys. */
 };
 
 static void derive_new_device_keys(unsigned int keygen_keyslot) {
@@ -100,15 +106,15 @@ static void setup_se(void) {
 
     /* Perform some sanity initialization. */
     volatile tegra_se_t *se = se_get_regs();
-    se->_0x0 &= 0xFFFEFFFF; /* Clear bit 16. */
-    (void)(se->FLAGS_REG);
+    se->SE_SE_SECURITY &= 0xFFFEFFFF; /* Clear bit 16. */
+    (void)(se->SE_STATUS);
     __dsb_sy();
 
     /* NOTE: On 8.1.0+, Nintendo does not make keyslots 0-5 unreadable. */
-    se->_0x4 = 0;
-    se->AES_KEY_READ_DISABLE_REG = 0;
-    se->RSA_KEY_READ_DISABLE_REG = 0;
-    se->_0x0 &= 0xFFFFFFFB;
+    se->SE_TZRAM_SECURITY = 0;
+    se->SE_CRYPTO_SECURITY_PERKEY = 0;
+    se->SE_RSA_SECURITY_PERKEY = 0;
+    se->SE_SE_SECURITY &= 0xFFFFFFFB;
 
     /* Currently unknown what each flag does. */
     for (unsigned int i = 0; i < KEYSLOT_AES_MAX; i++) {
@@ -141,6 +147,8 @@ static void setup_se(void) {
         case ATMOSPHERE_TARGET_FIRMWARE_700:
         case ATMOSPHERE_TARGET_FIRMWARE_800:
         case ATMOSPHERE_TARGET_FIRMWARE_810:
+        case ATMOSPHERE_TARGET_FIRMWARE_900:
+        case ATMOSPHERE_TARGET_FIRMWARE_910:
             derive_new_device_keys(KEYSLOT_SWITCH_5XNEWDEVICEKEYGENKEY);
             break;
     }
@@ -330,7 +338,7 @@ static bool validate_package2_metadata(package2_meta_t *metadata) {
 
     /* Perform version checks. */
     /* We will be compatible with all package2s released before current, but not newer ones. */
-    if (metadata->version_max >= PACKAGE2_MINVER_THEORETICAL && metadata->version_min < PACKAGE2_MAXVER_810_CURRENT) {
+    if (metadata->version_max >= PACKAGE2_MINVER_THEORETICAL && metadata->version_min < PACKAGE2_MAXVER_910_CURRENT) {
         return true;
     }
 
@@ -456,6 +464,8 @@ static void copy_warmboot_bin_to_dram() {
         case ATMOSPHERE_TARGET_FIRMWARE_700:
         case ATMOSPHERE_TARGET_FIRMWARE_800:
         case ATMOSPHERE_TARGET_FIRMWARE_810:
+        case ATMOSPHERE_TARGET_FIRMWARE_900:
+        case ATMOSPHERE_TARGET_FIRMWARE_910:
             warmboot_src = (uint8_t *)0x4003E000;
             break;
     }
@@ -502,6 +512,9 @@ void load_package2(coldboot_crt0_reloc_list_t *reloc_list) {
     if (exosphere_should_disable_usermode_exception_handlers() != 0) {
         configitem_disable_usermode_exception_handlers();
     }
+    if (exosphere_should_enable_usermode_pmu_access()) {
+        configitem_enable_usermode_pmu_access();
+    }
 
     /* Setup the Security Engine. */
     setup_se();
@@ -532,6 +545,12 @@ void load_package2(coldboot_crt0_reloc_list_t *reloc_list) {
             case ATMOSPHERE_TARGET_FIRMWARE_810:
                 MAKE_REG32(PMC_BASE + 0x360) = 0x14A;
                 break;
+            case ATMOSPHERE_TARGET_FIRMWARE_900:
+                MAKE_REG32(PMC_BASE + 0x360) = 0x16B;
+                break;
+            case ATMOSPHERE_TARGET_FIRMWARE_910:
+                MAKE_REG32(PMC_BASE + 0x360) = 0x18C;
+                break;
         }
     }
 

exosphere/src/package2.h

@@ -71,7 +71,9 @@ static inline uintptr_t get_nx_bootloader_mailbox_base(unsigned int targetfw) {
 #define PACKAGE2_MAXVER_600_610 0x8
 #define PACKAGE2_MAXVER_620 0x9
 #define PACKAGE2_MAXVER_700_800 0xA
-#define PACKAGE2_MAXVER_810_CURRENT 0xB
+#define PACKAGE2_MAXVER_810 0xB
+#define PACKAGE2_MAXVER_900 0xC
+#define PACKAGE2_MAXVER_910_CURRENT 0xD
 
 #define PACKAGE2_MINVER_100 0x3
 #define PACKAGE2_MINVER_200 0x4
@@ -82,7 +84,9 @@ static inline uintptr_t get_nx_bootloader_mailbox_base(unsigned int targetfw) {
 #define PACKAGE2_MINVER_600_610 0x9
 #define PACKAGE2_MINVER_620 0xA
 #define PACKAGE2_MINVER_700_800 0xB
-#define PACKAGE2_MINVER_810_CURRENT 0xC
+#define PACKAGE2_MINVER_810 0xC
+#define PACKAGE2_MINVER_900 0xD
+#define PACKAGE2_MINVER_910_CURRENT 0xE
 
 typedef struct {
     union {

exosphere/src/pinmux.h

@@ -0,0 +1,214 @@
+/*
+ * Copyright (c) 2018-2019 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#ifndef EXOSPHERE_PINMUX_H
+#define EXOSPHERE_PINMUX_H
+
+#include <stdint.h>
+#include "memory_map.h"
+
+#define PINMUX_BASE (MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_MISC) + 0x3000)
+#define MAKE_PINMUX_REG(n) MAKE_REG32(PINMUX_BASE + n)
+
+#define PINMUX_TRISTATE             (1 << 4)
+#define PINMUX_PARKED               (1 << 5)
+#define PINMUX_INPUT                (1 << 6)
+#define PINMUX_PULL_NONE            (0 << 2)
+#define PINMUX_PULL_DOWN            (1 << 2)
+#define PINMUX_PULL_UP              (2 << 2)
+#define PINMUX_SELECT_FUNCTION0     0
+#define PINMUX_SELECT_FUNCTION1     1
+#define PINMUX_SELECT_FUNCTION2     2
+#define PINMUX_SELECT_FUNCTION3     3    
+#define PINMUX_DRIVE_1X             (0 << 13)
+#define PINMUX_DRIVE_2X             (1 << 13)
+#define PINMUX_DRIVE_3X             (2 << 13)
+#define PINMUX_DRIVE_4X             (3 << 13)
+
+typedef struct {
+    uint32_t sdmmc1_clk;
+    uint32_t sdmmc1_cmd;
+    uint32_t sdmmc1_dat3;
+    uint32_t sdmmc1_dat2;
+    uint32_t sdmmc1_dat1;
+    uint32_t sdmmc1_dat0;
+    uint32_t _r18;
+    uint32_t sdmmc3_clk;
+    uint32_t sdmmc3_cmd;
+    uint32_t sdmmc3_dat0;
+    uint32_t sdmmc3_dat1;
+    uint32_t sdmmc3_dat2;
+    uint32_t sdmmc3_dat3;
+    uint32_t _r34;
+    uint32_t pex_l0_rst_n;
+    uint32_t pex_l0_clkreq_n;
+    uint32_t pex_wake_n;
+    uint32_t pex_l1_rst_n;
+    uint32_t pex_l1_clkreq_n;
+    uint32_t sata_led_active;
+    uint32_t spi1_mosi;
+    uint32_t spi1_miso;
+    uint32_t spi1_sck;
+    uint32_t spi1_cs0;
+    uint32_t spi1_cs1;
+    uint32_t spi2_mosi;
+    uint32_t spi2_miso;
+    uint32_t spi2_sck;
+    uint32_t spi2_cs0;
+    uint32_t spi2_cs1;
+    uint32_t spi4_mosi;
+    uint32_t spi4_miso;
+    uint32_t spi4_sck;
+    uint32_t spi4_cs0;
+    uint32_t qspi_sck;
+    uint32_t qspi_cs_n;
+    uint32_t qspi_io0;
+    uint32_t qspi_io1;
+    uint32_t qspi_io2;
+    uint32_t qspi_io3;
+    uint32_t _ra0;
+    uint32_t dmic1_clk;
+    uint32_t dmic1_dat;
+    uint32_t dmic2_clk;
+    uint32_t dmic2_dat;
+    uint32_t dmic3_clk;
+    uint32_t dmic3_dat;
+    uint32_t gen1_i2c_scl;
+    uint32_t gen1_i2c_sda;
+    uint32_t gen2_i2c_scl;
+    uint32_t gen2_i2c_sda;
+    uint32_t gen3_i2c_scl;
+    uint32_t gen3_i2c_sda;
+    uint32_t cam_i2c_scl;
+    uint32_t cam_i2c_sda;
+    uint32_t pwr_i2c_scl;
+    uint32_t pwr_i2c_sda;
+    uint32_t uart1_tx;
+    uint32_t uart1_rx;
+    uint32_t uart1_rts;
+    uint32_t uart1_cts;
+    uint32_t uart2_tx;
+    uint32_t uart2_rx;
+    uint32_t uart2_rts;
+    uint32_t uart2_cts;
+    uint32_t uart3_tx;
+    uint32_t uart3_rx;
+    uint32_t uart3_rts;
+    uint32_t uart3_cts;
+    uint32_t uart4_tx;
+    uint32_t uart4_rx;
+    uint32_t uart4_rts;
+    uint32_t uart4_cts;
+    uint32_t dap1_fs;
+    uint32_t dap1_din;
+    uint32_t dap1_dout;
+    uint32_t dap1_sclk;
+    uint32_t dap2_fs;
+    uint32_t dap2_din;
+    uint32_t dap2_dout;
+    uint32_t dap2_sclk;
+    uint32_t dap4_fs;
+    uint32_t dap4_din;
+    uint32_t dap4_dout;
+    uint32_t dap4_sclk;
+    uint32_t cam1_mclk;
+    uint32_t cam2_mclk;
+    uint32_t jtag_rtck;
+    uint32_t clk_32k_in;
+    uint32_t clk_32k_out;
+    uint32_t batt_bcl;
+    uint32_t clk_req;
+    uint32_t cpu_pwr_req;
+    uint32_t pwr_int_n;
+    uint32_t shutdown;
+    uint32_t core_pwr_req;
+    uint32_t aud_mclk;
+    uint32_t dvfs_pwm;
+    uint32_t dvfs_clk;
+    uint32_t gpio_x1_aud;
+    uint32_t gpio_x3_aud;
+    uint32_t pcc7;
+    uint32_t hdmi_cec;
+    uint32_t hdmi_int_dp_hpd;
+    uint32_t spdif_out;
+    uint32_t spdif_in;
+    uint32_t usb_vbus_en0;
+    uint32_t usb_vbus_en1;
+    uint32_t dp_hpd0;
+    uint32_t wifi_en;
+    uint32_t wifi_rst;
+    uint32_t wifi_wake_ap;
+    uint32_t ap_wake_bt;
+    uint32_t bt_rst;
+    uint32_t bt_wake_ap;
+    uint32_t ap_wake_nfc;
+    uint32_t nfc_en;
+    uint32_t nfc_int;
+    uint32_t gps_en;
+    uint32_t gps_rst;
+    uint32_t cam_rst;
+    uint32_t cam_af_en;
+    uint32_t cam_flash_en;
+    uint32_t cam1_pwdn;
+    uint32_t cam2_pwdn;
+    uint32_t cam1_strobe;
+    uint32_t lcd_te;
+    uint32_t lcd_bl_pwm;
+    uint32_t lcd_bl_en;
+    uint32_t lcd_rst;
+    uint32_t lcd_gpio1;
+    uint32_t lcd_gpio2;
+    uint32_t ap_ready;
+    uint32_t touch_rst;
+    uint32_t touch_clk;
+    uint32_t modem_wake_ap;
+    uint32_t touch_int;
+    uint32_t motion_int;
+    uint32_t als_prox_int;
+    uint32_t temp_alert;
+    uint32_t button_power_on;
+    uint32_t button_vol_up;
+    uint32_t button_vol_down;
+    uint32_t button_slide_sw;
+    uint32_t button_home;
+    uint32_t pa6;
+    uint32_t pe6;
+    uint32_t pe7;
+    uint32_t ph6;
+    uint32_t pk0;
+    uint32_t pk1;
+    uint32_t pk2;
+    uint32_t pk3;
+    uint32_t pk4;
+    uint32_t pk5;
+    uint32_t pk6;
+    uint32_t pk7;
+    uint32_t pl0;
+    uint32_t pl1;
+    uint32_t pz0;
+    uint32_t pz1;
+    uint32_t pz2;
+    uint32_t pz3;
+    uint32_t pz4;
+    uint32_t pz5;
+} tegra_pinmux_t;
+
+static inline volatile tegra_pinmux_t *pinmux_get_regs(void)
+{
+    return (volatile tegra_pinmux_t *)PINMUX_BASE;
+}
+
+#endif

exosphere/src/pmc.h

@@ -29,32 +29,24 @@ static inline uintptr_t get_pmc_base(void) {
 #define PMC_BASE (get_pmc_base())
 
 #define APBDEV_PMC_DPD_ENABLE_0 MAKE_REG32(PMC_BASE + 0x24)
-
 #define APBDEV_PMC_PWRGATE_TOGGLE_0 MAKE_REG32(PMC_BASE + 0x30)
 #define APBDEV_PMC_PWRGATE_STATUS_0 MAKE_REG32(PMC_BASE + 0x38)
-
 #define APBDEV_PMC_SCRATCH0_0 MAKE_REG32(PMC_BASE + 0x50)
-
 #define APBDEV_PMC_CRYPTO_OP_0 MAKE_REG32(PMC_BASE + 0xF4)
-
 #define APBDEV_PM_0 MAKE_REG32(PMC_BASE + 0x14)
 #define APBDEV_PMC_WAKE2_STATUS_0 MAKE_REG32(PMC_BASE + 0x168)
 #define APBDEV_PMC_CNTRL2_0 MAKE_REG32(PMC_BASE + 0x440)
-
+#define APBDEV_PMC_FUSE_CTRL MAKE_REG32(PMC_BASE + 0x450)
 #define APBDEV_PMC_SCRATCH43_0 MAKE_REG32(PMC_BASE + 0x22C)
 #define APBDEV_PMC_SEC_DISABLE8_0 MAKE_REG32(PMC_BASE + 0x5C0)
 #define APBDEV_PMC_SECURE_SCRATCH112_0 MAKE_REG32(PMC_BASE + 0xB18)
 #define APBDEV_PMC_SECURE_SCRATCH113_0 MAKE_REG32(PMC_BASE + 0xB1C)
 #define APBDEV_PMC_SECURE_SCRATCH114_0 MAKE_REG32(PMC_BASE + 0xB20)
 #define APBDEV_PMC_SECURE_SCRATCH115_0 MAKE_REG32(PMC_BASE + 0xB24)
-
 #define APBDEV_PMC_SCRATCH200_0 MAKE_REG32(PMC_BASE + 0x840)
-
-
 #define APBDEV_PMC_SEC_DISABLE3_0 MAKE_REG32(PMC_BASE + 0x2D8)
 #define APBDEV_PMC_SECURE_SCRATCH34_0 MAKE_REG32(PMC_BASE + 0x368)
 #define APBDEV_PMC_SECURE_SCRATCH35_0 MAKE_REG32(PMC_BASE + 0x36C)
-
 #define APBDEV_PMC_SECURE_SCRATCH16_0 MAKE_REG32(PMC_BASE + 0x320)
 #define APBDEV_PMC_SECURE_SCRATCH51_0 MAKE_REG32(PMC_BASE + 0x3AC)
 #define APBDEV_PMC_SECURE_SCRATCH55_0 MAKE_REG32(PMC_BASE + 0x3BC)
@@ -70,5 +62,4 @@ static inline uintptr_t get_pmc_base(void) {
 #define APBDEV_PMC_SECURE_SCRATCH103_0 MAKE_REG32(PMC_BASE + 0xAF4)
 #define APBDEV_PMC_SECURE_SCRATCH39_0 MAKE_REG32(PMC_BASE + 0x37C)
 
-
 #endif

exosphere/src/sc7.c

@@ -13,7 +13,7 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
- 
+
 #include <stdint.h>
 #include <stdbool.h>
 #include <string.h>
@@ -77,6 +77,7 @@ static void enable_lp0_wake_events(void) {
 
 static void notify_pmic_shutdown(void) {
     clkrst_reboot(CARDEVICE_I2C5);
+    i2c_init(I2C_5);
     if (fuse_get_bootrom_patch_version() >= 0x7F) {
         i2c_send_pmic_cpu_shutdown_cmd();
     }
@@ -132,7 +133,7 @@ static void setup_bpmp_sc7_firmware(void) {
     BPMP_VECTOR_UNK = 0x40003004; /* Reboot. */
     BPMP_VECTOR_IRQ = 0x40003004; /* Reboot. */
     BPMP_VECTOR_FIQ = 0x40003004; /* Reboot. */
-    
+
     /* Hold the BPMP in reset. */
     MAKE_CAR_REG(0x300) = 2;
 
@@ -141,7 +142,7 @@ static void setup_bpmp_sc7_firmware(void) {
     for (unsigned int i = 0; i < sc7fw_bin_size; i += 4) {
         write32le(lp0_entry_code, i, read32le(sc7fw_bin, i));
     }
-        
+
     flush_dcache_range(lp0_entry_code, lp0_entry_code + sc7fw_bin_size);
 
     /* Take the BPMP out of reset. */
@@ -181,7 +182,7 @@ static void save_tzram_state(void) {
     flush_dcache_range(tzram_encryption_dst, tzram_encryption_dst + LP0_TZRAM_SAVE_SIZE);
     flush_dcache_range(tzram_encryption_src, tzram_encryption_src + LP0_TZRAM_SAVE_SIZE);
 
-    /* Use the all-zero cmac buffer as an IV. */    
+    /* Use the all-zero cmac buffer as an IV. */
     se_aes_256_cbc_encrypt(KEYSLOT_SWITCH_LP0TZRAMKEY, tzram_encryption_dst, LP0_TZRAM_SAVE_SIZE, tzram_encryption_src, LP0_TZRAM_SAVE_SIZE, tzram_cmac);
     flush_dcache_range(tzram_encryption_dst, tzram_encryption_dst + LP0_TZRAM_SAVE_SIZE);
 
@@ -189,12 +190,12 @@ static void save_tzram_state(void) {
     for (unsigned int i = 0; i < LP0_TZRAM_SAVE_SIZE; i += 4) {
         write32le(tzram_store_address, i, read32le(tzram_encryption_dst, i));
     }
-    
+
     flush_dcache_range(tzram_store_address, tzram_store_address + LP0_TZRAM_SAVE_SIZE);
 
     /* Compute CMAC. */
     se_compute_aes_256_cmac(KEYSLOT_SWITCH_LP0TZRAMKEY, tzram_cmac, sizeof(tzram_cmac), tzram_encryption_src, LP0_TZRAM_SAVE_SIZE);
-    
+
     /* Write CMAC, lock registers. */
     APBDEV_PMC_SECURE_SCRATCH112_0 = tzram_cmac[0];
     APBDEV_PMC_SECURE_SCRATCH113_0 = tzram_cmac[1];
@@ -240,7 +241,7 @@ void save_se_and_power_down_cpu(void) {
     /* Save context for warmboot to restore. */
     save_tzram_state();
     save_se_state();
-    
+
     /* Patch the bootrom to disable warmboot signature checks. */
     MAKE_REG32(PMC_BASE + 0x118) = 0x2202E012;
     MAKE_REG32(PMC_BASE + 0x11C) = 0x6001DC28;
@@ -248,14 +249,14 @@ void save_se_and_power_down_cpu(void) {
     if (!configitem_is_retail()) {
         uart_send(UART_A, "OYASUMI", 8);
     }
-    
+
     finalize_powerdown();
 }
 
 uint32_t cpu_suspend(uint64_t power_state, uint64_t entrypoint, uint64_t argument) {
     /* TODO: 6.0.0 introduces heavy deja vu mitigations. */
     /* Exosphere may want to implement these. */
-    
+
     /* Ensure SMC call is to enter deep sleep. */
     if ((power_state & 0x17FFF) != 0x1001B) {
         return 0xFFFFFFFD;
@@ -285,7 +286,7 @@ uint32_t cpu_suspend(uint64_t power_state, uint64_t entrypoint, uint64_t argumen
 
     /* Prepare the current core for sleep. */
     configure_flow_regs_for_sleep();
-    
+
     /* Save core context. */
     set_core_entrypoint_and_argument(get_core_id(), entrypoint, argument);
     save_current_core_context();

exosphere/src/se.c

@@ -61,7 +61,7 @@ void set_security_engine_callback(unsigned int (*callback)(void)) {
 
 /* Fires on Security Engine operation completion. */
 void se_operation_completed(void) {
-    se_get_regs()->INT_ENABLE_REG = 0;
+    se_get_regs()->SE_INT_ENABLE = 0;
     if (g_se_callback != NULL) {
         g_se_callback();
         g_se_callback = NULL;
@@ -69,14 +69,14 @@ void se_operation_completed(void) {
 }
 
 void se_check_error_status_reg(void) {
-    if (se_get_regs()->ERR_STATUS_REG) {
+    if (se_get_regs()->SE_ERR_STATUS) {
         generic_panic();
     }
 }
 
 void se_check_for_error(void) {
     volatile tegra_se_t *se = se_get_regs();
-    if (se->INT_STATUS_REG & 0x10000 || se->FLAGS_REG & 3 || se->ERR_STATUS_REG) {
+    if (se->SE_INT_STATUS & 0x10000 || se->SE_STATUS & 3 || se->SE_ERR_STATUS) {
         generic_panic();
     }
 }
@@ -86,7 +86,7 @@ void se_trigger_interrupt(void) {
 }
 
 void se_verify_flags_cleared(void) {
-    if (se_get_regs()->FLAGS_REG & 3) {
+    if (se_get_regs()->SE_STATUS & 3) {
         generic_panic();
     }
 }
@@ -129,12 +129,12 @@ void set_aes_keyslot_flags(unsigned int keyslot, unsigned int flags) {
 
     /* Misc flags. */
     if (flags & ~0x80) {
-        se->AES_KEYSLOT_FLAGS[keyslot] = ~flags;
+        se->SE_CRYPTO_KEYTABLE_ACCESS[keyslot] = ~flags;
     }
 
     /* Disable keyslot reads. */
     if (flags & 0x80) {
-        se->AES_KEY_READ_DISABLE_REG &= ~(1 << keyslot);
+        se->SE_CRYPTO_SECURITY_PERKEY &= ~(1 << keyslot);
     }
 }
 
@@ -149,12 +149,12 @@ void set_rsa_keyslot_flags(unsigned int keyslot, unsigned int flags) {
     /* Misc flags. */
     if (flags & ~0x80) {
         /* TODO: Why are flags assigned this way? */
-        se->RSA_KEYSLOT_FLAGS[keyslot] = (((flags >> 4) & 4) | (flags & 3)) ^ 7;
+        se->SE_RSA_KEYTABLE_ACCESS[keyslot] = (((flags >> 4) & 4) | (flags & 3)) ^ 7;
     }
 
     /* Disable keyslot reads. */
     if (flags & 0x80) {
-        se->RSA_KEY_READ_DISABLE_REG &= ~(1 << keyslot);
+        se->SE_RSA_SECURITY_PERKEY &= ~(1 << keyslot);
     }
 }
 
@@ -167,8 +167,8 @@ void clear_aes_keyslot(unsigned int keyslot) {
 
     /* Zero out the whole keyslot and IV. */
     for (unsigned int i = 0; i < 0x10; i++) {
-        se->AES_KEYTABLE_ADDR = (keyslot << 4) | i;
-        se->AES_KEYTABLE_DATA = 0;
+        se->SE_CRYPTO_KEYTABLE_ADDR = (keyslot << 4) | i;
+        se->SE_CRYPTO_KEYTABLE_DATA = 0;
     }
 }
 
@@ -182,13 +182,13 @@ void clear_rsa_keyslot(unsigned int keyslot) {
     /* Zero out the whole keyslot. */
     for (unsigned int i = 0; i < 0x40; i++) {
         /* Select Keyslot Modulus[i] */
-        se->RSA_KEYTABLE_ADDR = (keyslot << 7) | i | 0x40;
-        se->RSA_KEYTABLE_DATA = 0;
+        se->SE_RSA_KEYTABLE_ADDR = (keyslot << 7) | i | 0x40;
+        se->SE_RSA_KEYTABLE_DATA = 0;
     }
     for (unsigned int i = 0; i < 0x40; i++) {
         /* Select Keyslot Expontent[i] */
-        se->RSA_KEYTABLE_ADDR = (keyslot << 7) | i;
-        se->RSA_KEYTABLE_DATA = 0;
+        se->SE_RSA_KEYTABLE_ADDR = (keyslot << 7) | i;
+        se->SE_RSA_KEYTABLE_DATA = 0;
     }
 }
 
@@ -200,8 +200,8 @@ void set_aes_keyslot(unsigned int keyslot, const void *key, size_t key_size) {
     }
 
     for (size_t i = 0; i < (key_size >> 2); i++) {
-        se->AES_KEYTABLE_ADDR = (keyslot << 4) | i;
-        se->AES_KEYTABLE_DATA = read32le(key, 4 * i);
+        se->SE_CRYPTO_KEYTABLE_ADDR = (keyslot << 4) | i;
+        se->SE_CRYPTO_KEYTABLE_DATA = read32le(key, 4 * i);
     }
 }
 
@@ -213,13 +213,13 @@ void set_rsa_keyslot(unsigned int keyslot, const void  *modulus, size_t modulus_
     }
 
     for (size_t i = 0; i < (modulus_size >> 2); i++) {
-        se->RSA_KEYTABLE_ADDR = (keyslot << 7) | 0x40 | i;
-        se->RSA_KEYTABLE_DATA = read32be(modulus, (4 * (modulus_size >> 2)) - (4 * i) - 4);
+        se->SE_RSA_KEYTABLE_ADDR = (keyslot << 7) | 0x40 | i;
+        se->SE_RSA_KEYTABLE_DATA = read32be(modulus, (4 * (modulus_size >> 2)) - (4 * i) - 4);
     }
 
     for (size_t i = 0; i < (exp_size >> 2); i++) {
-        se->RSA_KEYTABLE_ADDR = (keyslot << 7) | i;
-        se->RSA_KEYTABLE_DATA = read32be(exponent, (4 * (exp_size >> 2)) - (4 * i) - 4);
+        se->SE_RSA_KEYTABLE_ADDR = (keyslot << 7) | i;
+        se->SE_RSA_KEYTABLE_DATA = read32be(exponent, (4 * (exp_size >> 2)) - (4 * i) - 4);
     }
 
     g_se_modulus_sizes[keyslot] = modulus_size;
@@ -234,8 +234,8 @@ void set_aes_keyslot_iv(unsigned int keyslot, const void *iv, size_t iv_size) {
     }
 
     for (size_t i = 0; i < (iv_size >> 2); i++) {
-        se->AES_KEYTABLE_ADDR = (keyslot << 4) | 8 | i;
-        se->AES_KEYTABLE_DATA = read32le(iv, 4 * i);
+        se->SE_CRYPTO_KEYTABLE_ADDR = (keyslot << 4) | 8 | i;
+        se->SE_CRYPTO_KEYTABLE_DATA = read32le(iv, 4 * i);
     }
 }
 
@@ -247,14 +247,14 @@ void clear_aes_keyslot_iv(unsigned int keyslot) {
     }
 
     for (size_t i = 0; i < (0x10 >> 2); i++) {
-        se->AES_KEYTABLE_ADDR = (keyslot << 4) | 8 | i;
-        se->AES_KEYTABLE_DATA = 0;
+        se->SE_CRYPTO_KEYTABLE_ADDR = (keyslot << 4) | 8 | i;
+        se->SE_CRYPTO_KEYTABLE_DATA = 0;
     }
 }
 
 void set_se_ctr(const void *ctr) {
     for (unsigned int i = 0; i < 4; i++) {
-        se_get_regs()->CRYPTO_CTR_REG[i] = read32le(ctr, i * 4);
+        se_get_regs()->SE_CRYPTO_LINEAR_CTR[i] = read32le(ctr, i * 4);
     }
 }
 
@@ -265,10 +265,10 @@ void decrypt_data_into_keyslot(unsigned int keyslot_dst, unsigned int keyslot_sr
         generic_panic();
     }
 
-    se->CONFIG_REG = (ALG_AES_DEC | DST_KEYTAB);
-    se->CRYPTO_REG = keyslot_src << 24;
-    se->BLOCK_COUNT_REG = 0;
-    se->CRYPTO_KEYTABLE_DST_REG = keyslot_dst << 8;
+    se->SE_CONFIG = (ALG_AES_DEC | DST_KEYTAB);
+    se->SE_CRYPTO_CONFIG = keyslot_src << 24;
+    se->SE_CRYPTO_LAST_BLOCK = 0;
+    se->SE_CRYPTO_KEYTABLE_DST = keyslot_dst << 8;
 
     flush_dcache_range(wrapped_key, (const uint8_t *)wrapped_key + wrapped_key_size);
     trigger_se_blocking_op(OP_START, NULL, 0, wrapped_key, wrapped_key_size);
@@ -287,35 +287,35 @@ void se_aes_crypt_insecure_internal(unsigned int keyslot, uint32_t out_ll_paddr,
 
     /* Setup Config register. */
     if (encrypt) {
-        se->CONFIG_REG = (ALG_AES_ENC | DST_MEMORY);
+        se->SE_CONFIG = (ALG_AES_ENC | DST_MEMORY);
     } else {
-        se->CONFIG_REG = (ALG_AES_DEC | DST_MEMORY);
+        se->SE_CONFIG = (ALG_AES_DEC | DST_MEMORY);
     }
 
     /* Setup Crypto register. */
-    se->CRYPTO_REG = crypt_config | (keyslot << 24) | (encrypt << 8);
+    se->SE_CRYPTO_CONFIG = crypt_config | (keyslot << 24) | (encrypt << 8);
 
     /* Mark this encryption as insecure -- this makes the SE not a secure busmaster. */
-    se->CRYPTO_REG |= 0x80000000;
+    se->SE_CRYPTO_CONFIG |= 0x80000000;
 
     /* Appropriate number of blocks. */
-    se->BLOCK_COUNT_REG = (size >> 4) - 1;
+    se->SE_CRYPTO_LAST_BLOCK = (size >> 4) - 1;
 
     /* Set the callback, for after the async operation. */
     set_security_engine_callback(callback);
 
     /* Enable SE Interrupt firing for async op. */
-    se->INT_ENABLE_REG = 0x10;
+    se->SE_INT_ENABLE = 0x10;
 
     /* Setup Input/Output lists */
-    se->IN_LL_ADDR_REG = in_ll_paddr;
-    se->OUT_LL_ADDR_REG = out_ll_paddr;
+    se->SE_IN_LL_ADDR = in_ll_paddr;
+    se->SE_OUT_LL_ADDR = out_ll_paddr;
 
     /* Set registers for operation. */
-    se->ERR_STATUS_REG = se->ERR_STATUS_REG;
-    se->INT_STATUS_REG = se->INT_STATUS_REG;
-    se->OPERATION_REG = 1;
-    (void)(se->OPERATION_REG);
+    se->SE_ERR_STATUS = se->SE_ERR_STATUS;
+    se->SE_INT_STATUS = se->SE_INT_STATUS;
+    se->SE_OPERATION = 1;
+    (void)(se->SE_OPERATION);
 
     /* Ensure writes go through. */
     __dsb_ish();
@@ -323,7 +323,7 @@ void se_aes_crypt_insecure_internal(unsigned int keyslot, uint32_t out_ll_paddr,
 
 void se_aes_ctr_crypt_insecure(unsigned int keyslot, uint32_t out_ll_paddr, uint32_t in_ll_paddr, size_t size, const void *ctr, unsigned int (*callback)(void)) {
     /* Unknown what this write does, but official code writes it for CTR mode. */
-    se_get_regs()->SPARE_0 = 1;
+    se_get_regs()->SE_SPARE = 1;
     set_se_ctr(ctr);
     se_aes_crypt_insecure_internal(keyslot, out_ll_paddr, in_ll_paddr, size, 0x81E, true, callback);
 }
@@ -351,20 +351,20 @@ void se_exp_mod(unsigned int keyslot, void *buf, size_t size, unsigned int (*cal
         stack_buf[i] = *((uint8_t *)buf + size - i - 1);
     }
 
-    se->CONFIG_REG = (ALG_RSA | DST_RSAREG);
-    se->RSA_CONFIG = keyslot << 24;
-    se->RSA_KEY_SIZE_REG = (g_se_modulus_sizes[keyslot] >> 6) - 1;
-    se->RSA_EXP_SIZE_REG = g_se_exp_sizes[keyslot] >> 2;
+    se->SE_CONFIG = (ALG_RSA | DST_RSAREG);
+    se->SE_RSA_CONFIG = keyslot << 24;
+    se->SE_RSA_KEY_SIZE = (g_se_modulus_sizes[keyslot] >> 6) - 1;
+    se->SE_RSA_EXP_SIZE = g_se_exp_sizes[keyslot] >> 2;
 
     set_security_engine_callback(callback);
 
-    /* Enable SE Interrupt firing for async op. */
-    se->INT_ENABLE_REG = 0x10;
+    /* Enable SE interrupt firing for async op. */
+    se->SE_INT_ENABLE = 0x10;
 
     flush_dcache_range(stack_buf, stack_buf + KEYSIZE_RSA_MAX);
     trigger_se_rsa_op(stack_buf, size);
 
-    while (!(se->INT_STATUS_REG & 2)) { /* Wait a while */ }
+    while (!(se->SE_INT_STATUS & 2)) { /* Wait a while */ }
 }
 
 void se_synchronous_exp_mod(unsigned int keyslot, void *dst, size_t dst_size, const void *src, size_t src_size) {
@@ -380,10 +380,10 @@ void se_synchronous_exp_mod(unsigned int keyslot, void *dst, size_t dst_size, co
         stack_buf[i] = *((uint8_t *)src + src_size - i - 1);
     }
 
-    se->CONFIG_REG = (ALG_RSA | DST_RSAREG);
-    se->RSA_CONFIG = keyslot << 24;
-    se->RSA_KEY_SIZE_REG = (g_se_modulus_sizes[keyslot] >> 6) - 1;
-    se->RSA_EXP_SIZE_REG = g_se_exp_sizes[keyslot] >> 2;
+    se->SE_CONFIG = (ALG_RSA | DST_RSAREG);
+    se->SE_RSA_CONFIG = keyslot << 24;
+    se->SE_RSA_KEY_SIZE = (g_se_modulus_sizes[keyslot] >> 6) - 1;
+    se->SE_RSA_EXP_SIZE = g_se_exp_sizes[keyslot] >> 2;
 
     flush_dcache_range(stack_buf, stack_buf + KEYSIZE_RSA_MAX);
     trigger_se_blocking_op(OP_START, NULL, 0, stack_buf, src_size);
@@ -401,7 +401,7 @@ void se_get_exp_mod_output(void *buf, size_t size) {
 
     /* Copy endian swapped output. */
     while (num_dwords) {
-        *p_out = read32be(se_get_regs()->RSA_OUTPUT, offset);
+        *p_out = read32be(se_get_regs()->SE_RSA_OUTPUT, offset);
         offset += 4;
         p_out--;
         num_dwords--;
@@ -472,13 +472,13 @@ void trigger_se_rsa_op(void *buf, size_t size) {
     ll_init(&in_ll, (void *)buf, size);
 
     /* Set the input LL. */
-    se->IN_LL_ADDR_REG = (uint32_t) get_physical_address(&in_ll);
+    se->SE_IN_LL_ADDR = (uint32_t) get_physical_address(&in_ll);
 
     /* Set registers for operation. */
-    se->ERR_STATUS_REG = se->ERR_STATUS_REG;
-    se->INT_STATUS_REG = se->INT_STATUS_REG;
-    se->OPERATION_REG = 1;
-    (void)(se->OPERATION_REG);
+    se->SE_ERR_STATUS = se->SE_ERR_STATUS;
+    se->SE_INT_STATUS = se->SE_INT_STATUS;
+    se->SE_OPERATION = 1;
+    (void)(se->SE_OPERATION);
 
     /* Ensure writes go through. */
     __dsb_ish();
@@ -495,18 +495,18 @@ void trigger_se_blocking_op(unsigned int op, void *dst, size_t dst_size, const v
     __dsb_sy();
 
     /* Set the LLs. */
-    se->IN_LL_ADDR_REG = (uint32_t) get_physical_address(&in_ll);
-    se->OUT_LL_ADDR_REG = (uint32_t) get_physical_address(&out_ll);
+    se->SE_IN_LL_ADDR = (uint32_t) get_physical_address(&in_ll);
+    se->SE_OUT_LL_ADDR = (uint32_t) get_physical_address(&out_ll);
     
     /* Set registers for operation. */
-    se->ERR_STATUS_REG = se->ERR_STATUS_REG;
-    se->INT_STATUS_REG = se->INT_STATUS_REG;
-    se->OPERATION_REG = op;
-    (void)(se->OPERATION_REG);
+    se->SE_ERR_STATUS = se->SE_ERR_STATUS;
+    se->SE_INT_STATUS = se->SE_INT_STATUS;
+    se->SE_OPERATION = op;
+    (void)(se->SE_OPERATION);
     
     __dsb_ish();
 
-    while (!(se->INT_STATUS_REG & 0x10)) { /* Wait a while */ }
+    while (!(se->SE_INT_STATUS & 0x10)) { /* Wait a while */ }
 
     se_check_for_error();
 }
@@ -526,7 +526,7 @@ void se_perform_aes_block_operation(void *dst, size_t dst_size, const void *src,
     flush_dcache_range(block, block + sizeof(block));
 
     /* Trigger AES operation. */
-    se_get_regs()->BLOCK_COUNT_REG = 0;
+    se_get_regs()->SE_CRYPTO_LAST_BLOCK = 0;
     trigger_se_blocking_op(OP_START, block, sizeof(block), block, sizeof(block));
 
     /* Copy output data into dst. */
@@ -553,15 +553,15 @@ void se_aes_ctr_crypt(unsigned int keyslot, void *dst, size_t dst_size, const vo
     unsigned int num_blocks = src_size >> 4;
 
     /* Unknown what this write does, but official code writes it for CTR mode. */
-    se->SPARE_0 = 1;
-    se->CONFIG_REG = (ALG_AES_ENC | DST_MEMORY);
-    se->CRYPTO_REG = (keyslot << 24) | 0x91E;
+    se->SE_SPARE = 1;
+    se->SE_CONFIG = (ALG_AES_ENC | DST_MEMORY);
+    se->SE_CRYPTO_CONFIG = (keyslot << 24) | 0x91E;
     set_se_ctr(ctr);
 
     /* Handle any aligned blocks. */
     size_t aligned_size = (size_t)num_blocks << 4;
     if (aligned_size) {
-        se->BLOCK_COUNT_REG = num_blocks - 1;
+        se->SE_CRYPTO_LAST_BLOCK = num_blocks - 1;
         trigger_se_blocking_op(OP_START, dst, dst_size, src, aligned_size);
     }
 
@@ -587,8 +587,8 @@ void se_aes_ecb_encrypt_block(unsigned int keyslot, void *dst, size_t dst_size,
     }
 
     /* Set configuration high (256-bit vs 128-bit) based on parameter. */
-    se->CONFIG_REG = (ALG_AES_ENC | DST_MEMORY) | (config_high << 16);
-    se->CRYPTO_REG = keyslot << 24 | 0x100;
+    se->SE_CONFIG = (ALG_AES_ENC | DST_MEMORY) | (config_high << 16);
+    se->SE_CRYPTO_CONFIG = keyslot << 24 | 0x100;
     flush_dcache_range((uint8_t *)src, (uint8_t *)src + 0x10);
     se_perform_aes_block_operation(dst, 0x10, src, 0x10);
     flush_dcache_range((uint8_t *)dst, (uint8_t *)dst + 0x10);
@@ -611,8 +611,8 @@ void se_aes_ecb_decrypt_block(unsigned int keyslot, void *dst, size_t dst_size,
         generic_panic();
     }
 
-    se->CONFIG_REG = (ALG_AES_DEC | DST_MEMORY);
-    se->CRYPTO_REG = keyslot << 24;
+    se->SE_CONFIG = (ALG_AES_DEC | DST_MEMORY);
+    se->SE_CRYPTO_CONFIG = keyslot << 24;
     flush_dcache_range((uint8_t *)src, (uint8_t *)src + 0x10);
     se_perform_aes_block_operation(dst, 0x10, src, 0x10);
     flush_dcache_range((uint8_t *)dst, (uint8_t *)dst + 0x10);
@@ -649,16 +649,16 @@ void se_compute_aes_cmac(unsigned int keyslot, void *cmac, size_t cmac_size, con
         shift_left_xor_rb(derived_key);
     }
 
-    se->CONFIG_REG = (ALG_AES_ENC | DST_HASHREG) | (config_high << 16);
-    se->CRYPTO_REG = (keyslot << 24) | (0x145);
+    se->SE_CONFIG = (ALG_AES_ENC | DST_HASHREG) | (config_high << 16);
+    se->SE_CRYPTO_CONFIG = (keyslot << 24) | (0x145);
     clear_aes_keyslot_iv(keyslot);
     
     unsigned int num_blocks = (data_size + 0xF) >> 4;
     /* Handle aligned blocks. */
     if (num_blocks > 1) {
-        se->BLOCK_COUNT_REG = num_blocks - 2;
+        se->SE_CRYPTO_LAST_BLOCK = num_blocks - 2;
         trigger_se_blocking_op(OP_START, NULL, 0, data, data_size);
-        se->CRYPTO_REG |= 0x80;
+        se->SE_CRYPTO_CONFIG |= 0x80;
     }
     
     /* Create final block. */
@@ -675,13 +675,13 @@ void se_compute_aes_cmac(unsigned int keyslot, void *cmac, size_t cmac_size, con
     }
     
     /* Perform last operation. */
-    se->BLOCK_COUNT_REG = 0;
+    se->SE_CRYPTO_LAST_BLOCK = 0;
     flush_dcache_range(last_block, last_block + sizeof(last_block));
     trigger_se_blocking_op(OP_START, NULL, 0, last_block, sizeof(last_block));
 
     /* Copy output CMAC. */
     for (unsigned int i = 0; i < (cmac_size >> 2); i++) {
-        ((uint32_t *)cmac)[i] = read32le(se->HASH_RESULT_REG, i << 2);
+        ((uint32_t *)cmac)[i] = read32le(se->SE_HASH_RESULT, i << 2);
     }
 }
 
@@ -699,10 +699,10 @@ void se_aes_256_cbc_encrypt(unsigned int keyslot, void *dst, size_t dst_size, co
         generic_panic();
     }
     
-    se->CONFIG_REG = (ALG_AES_ENC | DST_MEMORY) | (0x202 << 16);
-    se->CRYPTO_REG = (keyslot << 24) | 0x144;
+    se->SE_CONFIG = (ALG_AES_ENC | DST_MEMORY) | (0x202 << 16);
+    se->SE_CRYPTO_CONFIG = (keyslot << 24) | 0x144;
     set_aes_keyslot_iv(keyslot, iv, 0x10);
-    se->BLOCK_COUNT_REG = (src_size >> 4) - 1;
+    se->SE_CRYPTO_LAST_BLOCK = (src_size >> 4) - 1;
     trigger_se_blocking_op(OP_START, dst, dst_size, src, src_size);
 }
 
@@ -711,23 +711,23 @@ void se_calculate_sha256(void *dst, const void *src, size_t src_size) {
     volatile tegra_se_t *se = se_get_regs();
     
     /* Setup config for SHA256, size = BITS(src_size) */
-    se->CONFIG_REG = (ENCMODE_SHA256 | ALG_SHA | DST_HASHREG);
-    se->SHA_CONFIG_REG = 1;
-    se->SHA_MSG_LENGTH_REG = (uint32_t)(src_size << 3);
-    se->_0x208 = 0;
-    se->_0x20C = 0;
-    se->_0x210 = 0;
-    se->SHA_MSG_LEFT_REG = (uint32_t)(src_size << 3);
-    se->_0x218 = 0;
-    se->_0x21C = 0;
-    se->_0x220 = 0;
+    se->SE_CONFIG = (ENCMODE_SHA256 | ALG_SHA | DST_HASHREG);
+    se->SE_SHA_CONFIG = 1;
+    se->SE_SHA_MSG_LENGTH[0] = (uint32_t)(src_size << 3);
+    se->SE_SHA_MSG_LENGTH[1] = 0;
+    se->SE_SHA_MSG_LENGTH[2] = 0;
+    se->SE_SHA_MSG_LENGTH[3] = 0;
+    se->SE_SHA_MSG_LEFT[0] = (uint32_t)(src_size << 3);
+    se->SE_SHA_MSG_LEFT[1] = 0;
+    se->SE_SHA_MSG_LEFT[2] = 0;
+    se->SE_SHA_MSG_LEFT[3] = 0;
     
     /* Trigger the operation. */
     trigger_se_blocking_op(OP_START, NULL, 0, src, src_size);
 
     /* Copy output hash. */
     for (unsigned int i = 0; i < (0x20 >> 2); i++) {
-        ((uint32_t *)dst)[i] = read32be(se->HASH_RESULT_REG, i << 2);
+        ((uint32_t *)dst)[i] = read32be(se->SE_HASH_RESULT, i << 2);
     }
 }
 
@@ -743,12 +743,12 @@ void se_initialize_rng(unsigned int keyslot) {
     /* This will be discarded, when done. */
     uint8_t output_buf[0x10];
 
-    se->RNG_SRC_CONFIG_REG = 3; /* Entropy enable + Entropy lock enable */
-    se->RNG_RESEED_INTERVAL_REG = 70001;
-    se->CONFIG_REG = (ALG_RNG | DST_MEMORY);
-    se->CRYPTO_REG = (keyslot << 24) | 0x108;
-    se->RNG_CONFIG_REG = 5;
-    se->BLOCK_COUNT_REG = 0;
+    se->SE_RNG_SRC_CONFIG = 3; /* Entropy enable + Entropy lock enable */
+    se->SE_RNG_RESEED_INTERVAL = 70001;
+    se->SE_CONFIG = (ALG_RNG | DST_MEMORY);
+    se->SE_CRYPTO_CONFIG = (keyslot << 24) | 0x108;
+    se->SE_RNG_CONFIG = 5;
+    se->SE_CRYPTO_LAST_BLOCK = 0;
     trigger_se_blocking_op(OP_START, output_buf, 0x10, NULL, 0);
 }
 
@@ -761,12 +761,12 @@ void se_generate_random(unsigned int keyslot, void *dst, size_t size) {
 
     uint32_t num_blocks = size >> 4;
     size_t aligned_size = num_blocks << 4;
-    se->CONFIG_REG = (ALG_RNG | DST_MEMORY);
-    se->CRYPTO_REG = (keyslot << 24) | 0x108;
-    se->RNG_CONFIG_REG = 4;
+    se->SE_CONFIG = (ALG_RNG | DST_MEMORY);
+    se->SE_CRYPTO_CONFIG = (keyslot << 24) | 0x108;
+    se->SE_RNG_CONFIG = 4;
 
     if (num_blocks >= 1) {
-        se->BLOCK_COUNT_REG = num_blocks - 1;
+        se->SE_CRYPTO_LAST_BLOCK = num_blocks - 1;
         trigger_se_blocking_op(OP_START, dst, aligned_size, NULL, 0);
     }
     if (size > aligned_size) {
@@ -778,15 +778,15 @@ void se_generate_random(unsigned int keyslot, void *dst, size_t size) {
 void se_set_in_context_save_mode(bool is_context_save_mode) {
     volatile tegra_se_t *se = se_get_regs();
     
-    uint32_t val = se->_0x0;
+    uint32_t val = se->SE_SE_SECURITY;
     if (is_context_save_mode) {
         val |= 0x10000;
     } else {
         val &= 0xFFFEFFFF;
     }
-    se->_0x0 = val;
+    se->SE_SE_SECURITY = val;
     /* Perform a useless read from flags reg. */
-    (void)(se->FLAGS_REG);
+    (void)(se->SE_STATUS);
 }
 
 void se_generate_random_key(unsigned int dst_keyslot, unsigned int rng_keyslot) {
@@ -797,26 +797,26 @@ void se_generate_random_key(unsigned int dst_keyslot, unsigned int rng_keyslot)
     }
 
     /* Setup Config. */
-    se->CONFIG_REG = (ALG_RNG | DST_KEYTAB);
-    se->CRYPTO_REG = (rng_keyslot << 24) | 0x108;
-    se->RNG_CONFIG_REG = 4;
-    se->BLOCK_COUNT_REG = 0;
+    se->SE_CONFIG = (ALG_RNG | DST_KEYTAB);
+    se->SE_CRYPTO_CONFIG = (rng_keyslot << 24) | 0x108;
+    se->SE_RNG_CONFIG = 4;
+    se->SE_CRYPTO_LAST_BLOCK = 0;
     
     /* Generate low part of key. */
-    se->CRYPTO_KEYTABLE_DST_REG = (dst_keyslot << 8);
+    se->SE_CRYPTO_KEYTABLE_DST = (dst_keyslot << 8);
     trigger_se_blocking_op(OP_START, NULL, 0, NULL, 0);
     /* Generate high part of key. */
-    se->CRYPTO_KEYTABLE_DST_REG = (dst_keyslot << 8) | 1;
+    se->SE_CRYPTO_KEYTABLE_DST = (dst_keyslot << 8) | 1;
     trigger_se_blocking_op(OP_START, NULL, 0, NULL, 0);
 }
 
 void se_generate_srk(unsigned int srkgen_keyslot) {
     volatile tegra_se_t *se = se_get_regs();
     
-    se->CONFIG_REG = (ALG_RNG | DST_SRK);
-    se->CRYPTO_REG = (srkgen_keyslot << 24) | 0x108;
-    se->RNG_CONFIG_REG = 6;
-    se->BLOCK_COUNT_REG = 0;
+    se->SE_CONFIG = (ALG_RNG | DST_SRK);
+    se->SE_CRYPTO_CONFIG = (srkgen_keyslot << 24) | 0x108;
+    se->SE_RNG_CONFIG = 6;
+    se->SE_CRYPTO_LAST_BLOCK = 0;
     trigger_se_blocking_op(OP_START, NULL, 0, NULL, 0);
 }
 
@@ -853,39 +853,39 @@ void se_save_context(unsigned int srkgen_keyslot, unsigned int rng_keyslot, void
     flush_dcache_range(work_buf, work_buf + 0x10);
         
     /* Save random initial block. */
-    se->CONFIG_REG = (ALG_AES_ENC | DST_MEMORY);
-    se->CONTEXT_SAVE_CONFIG_REG = (CTX_SAVE_SRC_MEM);
-    se->BLOCK_COUNT_REG = 0;
+    se->SE_CONFIG = (ALG_AES_ENC | DST_MEMORY);
+    se->SE_CTX_SAVE_CONFIG = (CTX_SAVE_SRC_MEM);
+    se->SE_CRYPTO_LAST_BLOCK = 0;
     se_encrypt_with_srk(dst, 0x10, work_buf, 0x10);
     
     /* Save Sticky Bits. */
     for (unsigned int i = 0; i < 0x2; i++) {
-        se->CONTEXT_SAVE_CONFIG_REG = (CTX_SAVE_SRC_STICKY_BITS) | (i << CTX_SAVE_STICKY_BIT_INDEX_SHIFT);
-        se->BLOCK_COUNT_REG = 0;
+        se->SE_CTX_SAVE_CONFIG = (CTX_SAVE_SRC_STICKY_BITS) | (i << CTX_SAVE_STICKY_BIT_INDEX_SHIFT);
+        se->SE_CRYPTO_LAST_BLOCK = 0;
         se_encrypt_with_srk(dst + 0x10 + (i * 0x10), 0x10, NULL, 0);
     }
     
     /* Save AES Key Table. */
     for (unsigned int i = 0; i < KEYSLOT_AES_MAX; i++) {
-        se->CONTEXT_SAVE_CONFIG_REG = (CTX_SAVE_SRC_KEYTABLE_AES) | (i << CTX_SAVE_KEY_INDEX_SHIFT) | (CTX_SAVE_KEY_LOW_BITS);
-        se->BLOCK_COUNT_REG = 0;
+        se->SE_CTX_SAVE_CONFIG = (CTX_SAVE_SRC_KEYTABLE_AES) | (i << CTX_SAVE_KEY_INDEX_SHIFT) | (CTX_SAVE_KEY_LOW_BITS);
+        se->SE_CRYPTO_LAST_BLOCK = 0;
         se_encrypt_with_srk(dst + 0x30 + (i * 0x20), 0x10, NULL, 0);
-        se->CONTEXT_SAVE_CONFIG_REG = (CTX_SAVE_SRC_KEYTABLE_AES) | (i << CTX_SAVE_KEY_INDEX_SHIFT) | (CTX_SAVE_KEY_HIGH_BITS);
-        se->BLOCK_COUNT_REG = 0;
+        se->SE_CTX_SAVE_CONFIG = (CTX_SAVE_SRC_KEYTABLE_AES) | (i << CTX_SAVE_KEY_INDEX_SHIFT) | (CTX_SAVE_KEY_HIGH_BITS);
+        se->SE_CRYPTO_LAST_BLOCK = 0;
         se_encrypt_with_srk(dst + 0x40 + (i * 0x20), 0x10, NULL, 0);
     }
     
     /* Save AES Original IVs. */
     for (unsigned int i = 0; i < KEYSLOT_AES_MAX; i++) {
-        se->CONTEXT_SAVE_CONFIG_REG = (CTX_SAVE_SRC_KEYTABLE_AES) | (i << CTX_SAVE_KEY_INDEX_SHIFT) | (CTX_SAVE_KEY_ORIGINAL_IV);
-        se->BLOCK_COUNT_REG = 0;
+        se->SE_CTX_SAVE_CONFIG = (CTX_SAVE_SRC_KEYTABLE_AES) | (i << CTX_SAVE_KEY_INDEX_SHIFT) | (CTX_SAVE_KEY_ORIGINAL_IV);
+        se->SE_CRYPTO_LAST_BLOCK = 0;
         se_encrypt_with_srk(dst + 0x230 + (i * 0x10), 0x10, NULL, 0);
     }
     
     /* Save AES Updated IVs */
     for (unsigned int i = 0; i < KEYSLOT_AES_MAX; i++) {
-        se->CONTEXT_SAVE_CONFIG_REG = (CTX_SAVE_SRC_KEYTABLE_AES) | (i << CTX_SAVE_KEY_INDEX_SHIFT) | (CTX_SAVE_KEY_UPDATED_IV);
-        se->BLOCK_COUNT_REG = 0;
+        se->SE_CTX_SAVE_CONFIG = (CTX_SAVE_SRC_KEYTABLE_AES) | (i << CTX_SAVE_KEY_INDEX_SHIFT) | (CTX_SAVE_KEY_UPDATED_IV);
+        se->SE_CRYPTO_LAST_BLOCK = 0;
         se_encrypt_with_srk(dst + 0x330 + (i * 0x10), 0x10, NULL, 0);
     }
     
@@ -894,8 +894,8 @@ void se_save_context(unsigned int srkgen_keyslot, unsigned int rng_keyslot, void
     for (unsigned int rsa_key = 0; rsa_key < KEYSLOT_RSA_MAX; rsa_key++) {
         for (unsigned int mod_exp = 0; mod_exp < 2; mod_exp++) {
             for (unsigned int sub_block = 0; sub_block < 0x10; sub_block++) {
-                se->CONTEXT_SAVE_CONFIG_REG = (CTX_SAVE_SRC_KEYTABLE_RSA) | ((2 * rsa_key + (1 - mod_exp)) << CTX_SAVE_RSA_KEY_INDEX_SHIFT) | (sub_block << CTX_SAVE_RSA_KEY_BLOCK_INDEX_SHIFT);
-                se->BLOCK_COUNT_REG = 0;
+                se->SE_CTX_SAVE_CONFIG = (CTX_SAVE_SRC_KEYTABLE_RSA) | ((2 * rsa_key + (1 - mod_exp)) << CTX_SAVE_RSA_KEY_INDEX_SHIFT) | (sub_block << CTX_SAVE_RSA_KEY_BLOCK_INDEX_SHIFT);
+                se->SE_CRYPTO_LAST_BLOCK = 0;
                 se_encrypt_with_srk(rsa_ctx_out, 0x10, NULL, 0);
                 rsa_ctx_out += 0x10;
             }
@@ -904,14 +904,14 @@ void se_save_context(unsigned int srkgen_keyslot, unsigned int rng_keyslot, void
     
     /* Save "Known Pattern. " */
     static const uint8_t context_save_known_pattern[0x10] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f};
-    se->CONTEXT_SAVE_CONFIG_REG = (CTX_SAVE_SRC_MEM);
-    se->BLOCK_COUNT_REG = 0;
+    se->SE_CTX_SAVE_CONFIG = (CTX_SAVE_SRC_MEM);
+    se->SE_CRYPTO_LAST_BLOCK = 0;
     se_encrypt_with_srk(dst + 0x830, 0x10, context_save_known_pattern, 0x10);
     
     /* Save SRK into PMC registers. */
-    se->CONTEXT_SAVE_CONFIG_REG = (CTX_SAVE_SRC_SRK);
-    se->BLOCK_COUNT_REG = 0;
+    se->SE_CTX_SAVE_CONFIG = (CTX_SAVE_SRC_SRK);
+    se->SE_CRYPTO_LAST_BLOCK = 0;
     se_encrypt_with_srk(work_buf, 0, NULL, 0);
-    se->CONFIG_REG = 0;
+    se->SE_CONFIG = 0;
     se_encrypt_with_srk(work_buf, 0, NULL, 0);
 }

exosphere/src/se.h

@@ -103,71 +103,59 @@
 #define RSA_2048_BYTES 0x100
 
 typedef struct {
-    uint32_t _0x0;
-    uint32_t _0x4;
-    uint32_t OPERATION_REG;
-    uint32_t INT_ENABLE_REG;
-    uint32_t INT_STATUS_REG;
-    uint32_t CONFIG_REG;
-    uint32_t IN_LL_ADDR_REG;
-    uint32_t _0x1C;
-    uint32_t _0x20;
-    uint32_t OUT_LL_ADDR_REG;
-    uint32_t _0x28;
-    uint32_t _0x2C;
-    uint8_t HASH_RESULT_REG[0x20];
-    uint8_t _0x50[0x20];
-    uint32_t CONTEXT_SAVE_CONFIG_REG;
-    uint8_t _0x74[0x18C];
-    uint32_t SHA_CONFIG_REG;
-    uint32_t SHA_MSG_LENGTH_REG;
-    uint32_t _0x208;
-    uint32_t _0x20C;
-    uint32_t _0x210;
-    uint32_t SHA_MSG_LEFT_REG;
-    uint32_t _0x218;
-    uint32_t _0x21C;
-    uint32_t _0x220;
-    uint32_t _0x224;
-    uint8_t _0x228[0x58];
-    uint32_t AES_KEY_READ_DISABLE_REG;
-    uint32_t AES_KEYSLOT_FLAGS[0x10];
-    uint8_t _0x2C4[0x3C];
-    uint32_t _0x300;
-    uint32_t CRYPTO_REG;
-    uint32_t CRYPTO_CTR_REG[4];
-    uint32_t BLOCK_COUNT_REG;
-    uint32_t AES_KEYTABLE_ADDR;
-    uint32_t AES_KEYTABLE_DATA;
-    uint32_t _0x324;
-    uint32_t _0x328;
-    uint32_t _0x32C;
-    uint32_t CRYPTO_KEYTABLE_DST_REG;
-    uint8_t _0x334[0xC];
-    uint32_t RNG_CONFIG_REG;
-    uint32_t RNG_SRC_CONFIG_REG;
-    uint32_t RNG_RESEED_INTERVAL_REG;
-    uint8_t _0x34C[0xB4];
-    uint32_t RSA_CONFIG;
-    uint32_t RSA_KEY_SIZE_REG;
-    uint32_t RSA_EXP_SIZE_REG;
-    uint32_t RSA_KEY_READ_DISABLE_REG;
-    uint32_t RSA_KEYSLOT_FLAGS[2];
-    uint32_t _0x418;
-    uint32_t _0x41C;
-    uint32_t RSA_KEYTABLE_ADDR;
-    uint32_t RSA_KEYTABLE_DATA;
-    uint8_t RSA_OUTPUT[0x100];
-    uint8_t _0x528[0x2D8];
-    uint32_t FLAGS_REG;
-    uint32_t ERR_STATUS_REG;
-    uint32_t _0x808;
-    uint32_t SPARE_0;
-    uint32_t _0x810;
+    uint32_t SE_SE_SECURITY;
+    uint32_t SE_TZRAM_SECURITY;
+    uint32_t SE_OPERATION;
+    uint32_t SE_INT_ENABLE;
+    uint32_t SE_INT_STATUS;
+    uint32_t SE_CONFIG;
+    uint32_t SE_IN_LL_ADDR;
+    uint32_t SE_IN_CUR_BYTE_ADDR;
+    uint32_t SE_IN_CUR_LL_ID;
+    uint32_t SE_OUT_LL_ADDR;
+    uint32_t SE_OUT_CUR_BYTE_ADDR;
+    uint32_t SE_OUT_CUR_LL_ID;
+    uint32_t SE_HASH_RESULT[0x10];
+    uint32_t SE_CTX_SAVE_CONFIG;
+    uint32_t _0x74[0x63];
+    uint32_t SE_SHA_CONFIG;
+    uint32_t SE_SHA_MSG_LENGTH[0x4];
+    uint32_t SE_SHA_MSG_LEFT[0x4];
+    uint32_t _0x224[0x17];
+    uint32_t SE_CRYPTO_SECURITY_PERKEY;
+    uint32_t SE_CRYPTO_KEYTABLE_ACCESS[0x10];
+    uint32_t _0x2C4[0x10];
+    uint32_t SE_CRYPTO_CONFIG;
+    uint32_t SE_CRYPTO_LINEAR_CTR[0x4];
+    uint32_t SE_CRYPTO_LAST_BLOCK;
+    uint32_t SE_CRYPTO_KEYTABLE_ADDR;
+    uint32_t SE_CRYPTO_KEYTABLE_DATA;
+    uint32_t _0x324[0x3];
+    uint32_t SE_CRYPTO_KEYTABLE_DST;
+    uint32_t _0x334[0x3];
+    uint32_t SE_RNG_CONFIG;
+    uint32_t SE_RNG_SRC_CONFIG;
+    uint32_t SE_RNG_RESEED_INTERVAL;
+    uint32_t _0x34C[0x2D];
+    uint32_t SE_RSA_CONFIG;
+    uint32_t SE_RSA_KEY_SIZE;
+    uint32_t SE_RSA_EXP_SIZE;
+    uint32_t SE_RSA_SECURITY_PERKEY;
+    uint32_t SE_RSA_KEYTABLE_ACCESS[0x2];
+    uint32_t _0x418[0x2];
+    uint32_t SE_RSA_KEYTABLE_ADDR;
+    uint32_t SE_RSA_KEYTABLE_DATA;
+    uint32_t SE_RSA_OUTPUT[0x40];
+    uint32_t _0x528[0xB6];
+    uint32_t SE_STATUS;
+    uint32_t SE_ERR_STATUS;
+    uint32_t SE_MISC;
+    uint32_t SE_SPARE;
+    uint32_t SE_ENTROPY_DEBUG_COUNTER;
     uint32_t _0x814;
     uint32_t _0x818;
     uint32_t _0x81C;
-    uint8_t _0x820[0x17E0];
+    uint32_t _0x820[0x5F8];
 } tegra_se_t;
 
 typedef struct {

exosphere/src/smc_api.c

@@ -186,6 +186,8 @@ void set_version_specific_smcs(void) {
         case ATMOSPHERE_TARGET_FIRMWARE_700:
         case ATMOSPHERE_TARGET_FIRMWARE_800:
         case ATMOSPHERE_TARGET_FIRMWARE_810:
+        case ATMOSPHERE_TARGET_FIRMWARE_900:
+        case ATMOSPHERE_TARGET_FIRMWARE_910:
             /* No more LoadSecureExpModKey. */
             g_smc_user_table[0xE].handler = NULL;
             g_smc_user_table[0xC].id = 0xC300D60C;
@@ -316,7 +318,7 @@ void call_smc_handler(uint32_t handler_id, smc_args_t *args) {
 #endif
 
 #if DEBUG_PANIC_ON_FAILURE
-    if (args->X[0] && (!is_aes_kek || args->X[3] <= ATMOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG))
+    if (args->X[0] && (!is_aes_kek || args->X[3] <= ATMOSPHERE_TARGET_FIRMWARE_CURRENT))
     {
         MAKE_REG32(get_iram_address_for_debug() + 0x4FF0) = handler_id;
         MAKE_REG32(get_iram_address_for_debug() + 0x4FF4) = smc_id;

exosphere/src/smc_user.c

@@ -53,6 +53,8 @@ static bool is_user_keyslot_valid(unsigned int keyslot) {
         case ATMOSPHERE_TARGET_FIRMWARE_700:
         case ATMOSPHERE_TARGET_FIRMWARE_800:
         case ATMOSPHERE_TARGET_FIRMWARE_810:
+        case ATMOSPHERE_TARGET_FIRMWARE_900:
+        case ATMOSPHERE_TARGET_FIRMWARE_910:
         default:
             return keyslot <= 5;
     }

exosphere/src/timers.h

@@ -26,13 +26,25 @@ static inline uintptr_t get_timers_base(void) {
     return MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_TMRs_WDTs);
 }
 
+static inline uintptr_t get_rtc_base(void) {
+    return MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC);
+}
+
 #define TIMERS_BASE (get_timers_base())
 #define MAKE_TIMERS_REG(n) MAKE_REG32(TIMERS_BASE + n)
 
 #define TIMERUS_CNTR_1US_0 MAKE_TIMERS_REG(0x10)
+#define TIMERUS_USEC_CFG_0 MAKE_TIMERS_REG(0x14)
 #define SHARED_INTR_STATUS_0 MAKE_TIMERS_REG(0x1A0)
 #define SHARED_TIMER_SECURE_CFG_0 MAKE_TIMERS_REG(0x1A4)
 
+#define RTC_BASE (get_rtc_base())
+#define MAKE_RTC_REG(n) MAKE_REG32(RTC_BASE + n)
+
+#define RTC_SECONDS MAKE_RTC_REG(0x08)
+#define RTC_SHADOW_SECONDS MAKE_RTC_REG(0x0C)
+#define RTC_MILLI_SECONDS MAKE_RTC_REG(0x10)
+
 typedef struct {
     uint32_t CONFIG;
     uint32_t STATUS;
@@ -46,10 +58,54 @@ typedef struct {
 
 void wait(uint32_t microseconds);
 
-static inline uint32_t get_time(void) {
+static inline uint32_t get_time_s(void) {
+    return RTC_SECONDS;
+}
+
+static inline uint32_t get_time_ms(void) {
+    return (RTC_MILLI_SECONDS | (RTC_SHADOW_SECONDS << 10));
+}
+
+static inline uint32_t get_time_us(void) {
     return TIMERUS_CNTR_1US_0;
 }
 
-__attribute__ ((noreturn)) void watchdog_reboot(void);
+/**
+ * Returns the time in microseconds.
+ */
+static inline uint32_t get_time(void) {
+    return get_time_us();
+}
 
+/**
+ * Returns the number of microseconds that have passed since a given get_time().
+ */
+static inline uint32_t get_time_since(uint32_t base) {
+    return get_time_us() - base;
+}
+
+/**
+ * Delays for a given number of microseconds.
+ */
+static inline void udelay(uint32_t usecs) {
+    uint32_t start = get_time_us();
+    while (get_time_us() - start < usecs);
+}
+
+/**
+ * Delays until a number of usecs have passed since an absolute start time.
+ */
+static inline void udelay_absolute(uint32_t start, uint32_t usecs) {
+    while (get_time_us() - start < usecs);
+}
+
+/**
+ * Delays for a given number of milliseconds.
+ */
+static inline void mdelay(uint32_t msecs) {
+    uint32_t start = get_time_ms();
+    while (get_time_ms() - start < msecs);
+}
+
+__attribute__ ((noreturn)) void watchdog_reboot(void);
 #endif

exosphere/src/uart.c

@@ -15,66 +15,120 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
  
-#include "timers.h"
 #include "uart.h"
-#include "misc.h"
+#include "timers.h"
+#include "pinmux.h"
 
-void uart_select(UartDevice dev) {
-    unsigned int id = (unsigned int)dev;
-    PINMUX_AUX_UARTn_TX_0(id) = 0; /* UART */
-    PINMUX_AUX_UARTn_RX_0(id) = 0x48; /* UART, enable, pull up */
-    PINMUX_AUX_UARTn_RTS_0(id) = 0; /* UART */
-    PINMUX_AUX_UARTn_CTS_0(id) = 0x44; /* UART, enable, pull down */
+static inline void uart_wait_cycles(uint32_t baud, uint32_t num)
+{
+    wait((num * 1000000 + 16 * baud - 1) / (16 * baud));
+}
+
+static inline void uart_wait_syms(uint32_t baud, uint32_t num)
+{
+    wait((num * 1000000 + baud - 1) / baud);
+}
+
+void uart_config(UartDevice dev) {
+    volatile tegra_pinmux_t *pinmux = pinmux_get_regs();
+
+    switch (dev) {
+        case UART_A:
+            pinmux->uart1_tx = 0;
+            pinmux->uart1_rx = (PINMUX_INPUT | PINMUX_PULL_UP);
+            pinmux->uart1_rts = 0;
+            pinmux->uart1_cts = (PINMUX_INPUT | PINMUX_PULL_DOWN);
+            break;
+        case UART_B:
+            pinmux->uart2_tx = 0;
+            pinmux->uart2_rx = (PINMUX_INPUT | PINMUX_PULL_UP);
+            pinmux->uart2_rts = 0;
+            pinmux->uart2_cts = (PINMUX_INPUT | PINMUX_PULL_DOWN);
+            break;
+        case UART_C:
+            pinmux->uart3_tx = 0;
+            pinmux->uart3_rx = (PINMUX_INPUT | PINMUX_PULL_UP);
+            pinmux->uart3_rts = 0;
+            pinmux->uart3_cts = (PINMUX_INPUT | PINMUX_PULL_DOWN);
+            break;
+        case UART_D:
+            pinmux->uart4_tx = 0;
+            pinmux->uart4_rx = (PINMUX_INPUT | PINMUX_PULL_UP);
+            pinmux->uart4_rts = 0;
+            pinmux->uart4_cts = (PINMUX_INPUT | PINMUX_PULL_DOWN);
+            break;
+        case UART_E:
+            /* Unused. */
+            break;
+        default: break;
+    }
 }
 
 void uart_init(UartDevice dev, uint32_t baud) {
-    volatile uart_t *uart = get_uart_device(dev);
+    volatile tegra_uart_t *uart = uart_get_regs(dev);
 
-    /* Set baud rate. */
+    /* Wait for idle state. */
+    uart_wait_idle(dev, UART_VENDOR_STATE_TX_IDLE);
+
+    /* Calculate baud rate, round to nearest. */
     uint32_t rate = (8 * baud + 408000000) / (16 * baud);
-    uart->UART_LCR = UART_LCR_DLAB; /* Enable DLAB. */
-    uart->UART_THR_DLAB = (uint8_t)rate; /* Divisor latch LSB. */
-    uart->UART_IER_DLAB = (uint8_t)(rate >> 8); /* Divisor latch MSB. */
-    uart->UART_LCR = 0; /* Diable DLAB. */
 
-    /* Setup UART in fifo mode. */
+    /* Setup UART in FIFO mode. */
     uart->UART_IER_DLAB = 0;
-    uart->UART_IIR_FCR = UART_FCR_FCR_EN_FIFO | UART_FCR_RX_CLR | UART_FCR_TX_CLR; /* Enable and clear TX and RX FIFOs. */
-    uart->UART_LSR;
-    wait(3 * ((baud + 999999) / baud));
-    uart->UART_LCR = UART_LCR_WD_LENGTH_8; /* Set word length 8. */
     uart->UART_MCR = 0;
-    uart->UART_MSR = 0;
-    uart->UART_IRDA_CSR = 0;
-    uart->UART_RX_FIFO_CFG = 1; /* Set RX_FIFO trigger level */
-    uart->UART_MIE = 0;
-    uart->UART_ASR = 0;
+    uart->UART_LCR = (UART_LCR_DLAB | UART_LCR_WD_LENGTH_8);        /* Enable DLAB and set word length 8. */
+    uart->UART_THR_DLAB = (uint8_t)rate;                            /* Divisor latch LSB. */
+    uart->UART_IER_DLAB = (uint8_t)(rate >> 8);                     /* Divisor latch MSB. */
+    uart->UART_LCR &= ~(UART_LCR_DLAB);                             /* Disable DLAB. */
+    uart->UART_SPR;                                                 /* Dummy read. */
+    uart_wait_syms(baud, 3);                                        /* Wait for 3 symbols at the new baudrate. */
+
+    /* Enable FIFO with default settings. */
+    uart->UART_IIR_FCR = UART_FCR_FCR_EN_FIFO;
+    uart->UART_SPR;                                                 /* Dummy read as mandated by TRM. */
+    uart_wait_cycles(baud, 3);                                      /* Wait for 3 baud cycles, as mandated by TRM (erratum). */
+
+    /* Flush FIFO. */
+    uart_wait_idle(dev, UART_VENDOR_STATE_TX_IDLE);                 /* Make sure there's no data being written in TX FIFO (TRM). */
+    uart->UART_IIR_FCR |= UART_FCR_RX_CLR | UART_FCR_TX_CLR;        /* Clear TX and RX FIFOs. */
+    uart_wait_cycles(baud, 32);                                     /* Wait for 32 baud cycles (TRM, erratum). */
+    /* Wait for idle state (TRM). */
+    uart_wait_idle(dev, UART_VENDOR_STATE_TX_IDLE | UART_VENDOR_STATE_RX_IDLE);
 }
 
-/* This function blocks until the UART device (dev) is in the desired state (status). Make sure the desired state can be reached! */
+/* This function blocks until the UART device is in the desired state. */
 void uart_wait_idle(UartDevice dev, UartVendorStatus status) {
-    while (!(get_uart_device(dev)->UART_VENDOR_STATUS & status)) {
-        /* Wait */
+    volatile tegra_uart_t *uart = uart_get_regs(dev);
+    
+    if (status & UART_VENDOR_STATE_TX_IDLE) {
+        while (!(uart->UART_LSR & UART_LSR_TMTY)) {
+            /* Wait */
+        }
+    }
+    if (status & UART_VENDOR_STATE_RX_IDLE) {
+        while (uart->UART_LSR & UART_LSR_RDR) {
+            /* Wait */
+        }
     }
 }
 
 void uart_send(UartDevice dev, const void *buf, size_t len) {
-    volatile uart_t *uart = get_uart_device(dev);
+    volatile tegra_uart_t *uart = uart_get_regs(dev);
 
     for (size_t i = 0; i < len; i++) {
-        while (uart->UART_LSR & UART_LSR_TX_FIFO_FULL) {
-            /* Wait until the TX FIFO isn't full */
+        while (!(uart->UART_LSR & UART_LSR_THRE)) {
+            /* Wait until it's possible to send data. */
         }
         uart->UART_THR_DLAB = *((const uint8_t *)buf + i);
     }
 }
 
 void uart_recv(UartDevice dev, void *buf, size_t len) {
-    volatile uart_t *uart = get_uart_device(dev);
+    volatile tegra_uart_t *uart = uart_get_regs(dev);
 
     for (size_t i = 0; i < len; i++) {
-        while (uart->UART_LSR & UART_LSR_RX_FIFO_EMPTY) {
-            /* Wait until the RX FIFO isn't empty */
+        while (!(uart->UART_LSR & UART_LSR_RDR)) {
+            /* Wait until it's possible to receive data. */
         }
         *((uint8_t *)buf + i) = uart->UART_THR_DLAB;
     }

exosphere/src/uart.h

@@ -31,7 +31,7 @@ static inline uintptr_t get_uart_base(void) {
 
 #define BAUD_115200 115200
 
-/* Exosphère: add the clkreset values for UART C,D,E */
+/* UART devices */
 typedef enum {
     UART_A = 0,
     UART_B = 1,
@@ -148,31 +148,31 @@ typedef enum {
 } UartInterruptIdentification;
 
 typedef struct {
-    /* 0x00 */ uint32_t UART_THR_DLAB;
-    /* 0x04 */ uint32_t UART_IER_DLAB;
-    /* 0x08 */ uint32_t UART_IIR_FCR;
-    /* 0x0C */ uint32_t UART_LCR;
-    /* 0x10 */ uint32_t UART_MCR;
-    /* 0x14 */ uint32_t UART_LSR;
-    /* 0x18 */ uint32_t UART_MSR;
-    /* 0x1C */ uint32_t UART_SPR;
-    /* 0x20 */ uint32_t UART_IRDA_CSR;
-    /* 0x24 */ uint32_t UART_RX_FIFO_CFG;
-    /* 0x28 */ uint32_t UART_MIE;
-    /* 0x2C */ uint32_t UART_VENDOR_STATUS;
-    /* 0x30 */ uint8_t _pad_30[0x0C];
-    /* 0x3C */ uint32_t UART_ASR;
-} uart_t;
+    uint32_t UART_THR_DLAB;
+    uint32_t UART_IER_DLAB;
+    uint32_t UART_IIR_FCR;
+    uint32_t UART_LCR;
+    uint32_t UART_MCR;
+    uint32_t UART_LSR;
+    uint32_t UART_MSR;
+    uint32_t UART_SPR;
+    uint32_t UART_IRDA_CSR;
+    uint32_t UART_RX_FIFO_CFG;
+    uint32_t UART_MIE;
+    uint32_t UART_VENDOR_STATUS;
+    uint8_t _0x30[0x0C];
+    uint32_t UART_ASR;
+} tegra_uart_t;
 
-void uart_select(UartDevice dev);
+void uart_config(UartDevice dev);
 void uart_init(UartDevice dev, uint32_t baud);
 void uart_wait_idle(UartDevice dev, UartVendorStatus status);
 void uart_send(UartDevice dev, const void *buf, size_t len);
 void uart_recv(UartDevice dev, void *buf, size_t len);
 
-static inline volatile uart_t *get_uart_device(UartDevice dev) {
+static inline volatile tegra_uart_t *uart_get_regs(UartDevice dev) {
     static const size_t offsets[] = {0, 0x40, 0x200, 0x300, 0x400};
-    return (volatile uart_t *)(UART_BASE + offsets[dev]);
+    return (volatile tegra_uart_t *)(UART_BASE + offsets[dev]);
 }
 
 #endif

exosphere/src/utils.c

@@ -13,7 +13,7 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
- 
+
 #include <stdbool.h>
 #include <string.h>
 #include "utils.h"
@@ -29,7 +29,7 @@ __attribute__ ((noreturn)) void panic(uint32_t code) {
     if (APBDEV_PMC_SCRATCH200_0 == 0) {
         APBDEV_PMC_SCRATCH200_0 = code;
     }
-    
+
     /* // Uncomment for Debugging.
     uint64_t temp_reg;
     MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_DEBUG_IRAM)) = APBDEV_PMC_SCRATCH200_0;
@@ -38,8 +38,8 @@ __attribute__ ((noreturn)) void panic(uint32_t code) {
     SAVE_SYSREG64(FAR_EL3, 0x20);
     MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC) + 0x450ull) = 0x2;
     MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_RTC_PMC) + 0x400ull) = 0x10; */
-    
-    
+
+
     /* TODO: Custom Panic Driver, which displays to screen without rebooting. */
     /* For now, just use NX BOOTLOADER's panic. */
     fuse_disable_programming();
@@ -50,7 +50,7 @@ __attribute__ ((noreturn)) void panic(uint32_t code) {
 
 __attribute__ ((noreturn)) void generic_panic(void) {
     /* //Uncomment for Debugging.
-    uint64_t temp_reg;    
+    uint64_t temp_reg;
     do { __asm__ __volatile__ ("mov %0, LR" : "=r"(temp_reg) :: "memory"); } while (false);
     MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_DEBUG_IRAM) + 0x28) = (uint32_t)((temp_reg >> 0) & 0xFFFFFFFFULL);
     MAKE_REG32(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_DEBUG_IRAM) + 0x28 + 4) = (uint32_t)((temp_reg >> 32) & 0xFFFFFFFFULL);

exosphere/src/warmboot_main.c

@@ -24,7 +24,6 @@
 #include "bootup.h"
 #include "smc_api.h"
 #include "exocfg.h"
-
 #include "se.h"
 #include "mc.h"
 #include "car.h"
@@ -32,7 +31,6 @@
 #include "misc.h"
 #include "uart.h"
 #include "interrupt.h"
-
 #include "pmc.h"
 
 uintptr_t get_warmboot_main_stack_address(void) {
@@ -41,8 +39,7 @@ uintptr_t get_warmboot_main_stack_address(void) {
 
 static void warmboot_configure_hiz_mode(void) {
     /* Enable input to I2C1 */
-    PINMUX_AUX_GEN1_I2C_SCL_0 = 0x40;
-    PINMUX_AUX_GEN1_I2C_SDA_0 = 0x40;
+    i2c_config(I2C_1);
 
     clkrst_reboot(CARDEVICE_I2C1);
     i2c_init(0);
@@ -69,7 +66,7 @@ void __attribute__((noreturn)) warmboot_main(void) {
     if (VIRT_MC_SECURITY_CFG3 == 0) {
         /* N only does this on dev units, but we will do it unconditionally. */
         {
-            uart_select(UART_A);
+            uart_config(UART_A);
             clkrst_reboot(CARDEVICE_UARTA);
             uart_init(UART_A, 115200);
         }

fusee/Makefile

@@ -1,4 +1,4 @@
-SUBFOLDERS := fusee-primary fusee-secondary
+SUBFOLDERS := fusee-primary fusee-mtc fusee-secondary
 
 TOPTARGETS := all clean
 

fusee/fusee-mtc/Makefile

@@ -0,0 +1,163 @@
+#---------------------------------------------------------------------------------
+.SUFFIXES:
+#---------------------------------------------------------------------------------
+
+ifeq ($(strip $(DEVKITARM)),)
+$(error "Please set DEVKITARM in your environment. export DEVKITARM=<path to>devkitARM")
+endif
+
+TOPDIR ?= $(CURDIR)
+
+AMS		:= $(TOPDIR)/../../
+include $(DEVKITARM)/base_rules
+
+AMSBRANCH := $(shell git symbolic-ref --short HEAD)
+AMSREV := $(AMSBRANCH)-$(shell git rev-parse --short HEAD)
+
+ifneq (, $(strip $(shell git status --porcelain 2>/dev/null)))
+    AMSREV := $(AMSREV)-dirty
+endif
+
+#---------------------------------------------------------------------------------
+# TARGET is the name of the output
+# BUILD is the directory where object files & intermediate files will be placed
+# SOURCES is a list of directories containing source code
+# DATA is a list of directories containing data files
+# INCLUDES is a list of directories containing header files
+#---------------------------------------------------------------------------------
+TARGET		:=	$(notdir $(CURDIR))
+BUILD		:=	build
+SOURCES		:=	src src/lib src/display
+DATA		:=	data
+INCLUDES	:=	include ../../libraries/libvapours/include
+
+#---------------------------------------------------------------------------------
+# options for code generation
+#---------------------------------------------------------------------------------
+ARCH	:=	-march=armv4t -mtune=arm7tdmi -mthumb -mthumb-interwork
+DEFINES :=	-D__BPMP__ -DFUSEE_STAGE1_SRC -DATMOSPHERE_GIT_BRANCH=\"$(AMSBRANCH)\" -DATMOSPHERE_GIT_REV=\"$(AMSREV)\"
+
+CFLAGS	:= \
+	-g \
+	-O2 \
+	-fomit-frame-pointer \
+	-ffunction-sections \
+	-fdata-sections \
+	-std=gnu11 \
+	-Werror \
+	-Wall \
+	-fstrict-volatile-bitfields \
+	$(ARCH) $(DEFINES)
+
+CFLAGS	+=	$(INCLUDE)
+
+CXXFLAGS	:= $(CFLAGS) -fno-rtti -fno-exceptions -std=gnu++11
+
+ASFLAGS	:=	-g $(ARCH)
+LDFLAGS	=	-specs=$(TOPDIR)/linker.specs -g $(ARCH) -Wl,-Map,$(notdir $*.map)
+
+LIBS	:=
+
+#---------------------------------------------------------------------------------
+# list of directories containing libraries, this must be the top level containing
+# include and lib
+#---------------------------------------------------------------------------------
+LIBDIRS	:=
+
+
+#---------------------------------------------------------------------------------
+# no real need to edit anything past this point unless you need to add additional
+# rules for different file extensions
+#---------------------------------------------------------------------------------
+ifneq ($(BUILD),$(notdir $(CURDIR)))
+#---------------------------------------------------------------------------------
+
+export OUTPUT	:=	$(CURDIR)/$(TARGET)
+export TOPDIR	:=	$(CURDIR)
+
+export VPATH	:=	$(foreach dir,$(SOURCES),$(CURDIR)/$(dir)) \
+			$(foreach dir,$(DATA),$(CURDIR)/$(dir))
+
+export DEPSDIR	:=	$(CURDIR)/$(BUILD)
+
+CFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.c)))
+CPPFILES	:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.cpp)))
+SFILES		:=	$(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.s)))
+BINFILES	:=	$(foreach dir,$(DATA),$(notdir $(wildcard $(dir)/*.*)))
+
+#---------------------------------------------------------------------------------
+# use CXX for linking C++ projects, CC for standard C
+#---------------------------------------------------------------------------------
+ifeq ($(strip $(CPPFILES)),)
+#---------------------------------------------------------------------------------
+	export LD	:=	$(CC)
+#---------------------------------------------------------------------------------
+else
+#---------------------------------------------------------------------------------
+	export LD	:=	$(CXX)
+#---------------------------------------------------------------------------------
+endif
+#---------------------------------------------------------------------------------
+
+export OFILES_BIN	:=	$(addsuffix .o,$(BINFILES))
+export OFILES_SRC	:=	$(CPPFILES:.cpp=.o) $(CFILES:.c=.o) $(SFILES:.s=.o)
+export OFILES 		:=	$(OFILES_BIN) $(OFILES_SRC)
+export HFILES_BIN	:=	$(addsuffix .h,$(subst .,_,$(BINFILES)))
+
+export INCLUDE	:=	$(foreach dir,$(INCLUDES),-I$(CURDIR)/$(dir)) \
+			$(foreach dir,$(LIBDIRS),-I$(dir)/include) \
+			-I$(CURDIR)/$(BUILD)
+
+export LIBPATHS	:=	$(foreach dir,$(LIBDIRS),-L$(dir)/lib)
+
+.PHONY: $(BUILD) clean all
+
+#---------------------------------------------------------------------------------
+all: $(BUILD)
+
+$(BUILD):
+	@[ -d $@ ] || mkdir -p $@
+	@$(MAKE) --no-print-directory -C $(BUILD) -f $(CURDIR)/Makefile
+
+#---------------------------------------------------------------------------------
+clean:
+	@echo clean ...
+	@rm -fr $(BUILD) $(TARGET).bin $(TARGET).elf
+
+#---------------------------------------------------------------------------------
+else
+.PHONY:	all
+
+DEPENDS	:=	$(OFILES:.o=.d)
+
+#---------------------------------------------------------------------------------
+# main targets
+#---------------------------------------------------------------------------------
+all	:	$(OUTPUT).bin
+
+$(OUTPUT).bin	:	$(OUTPUT).elf
+	$(OBJCOPY) -S -O binary $< $@
+	@echo built ... $(notdir $@)
+
+$(OUTPUT).elf	:	$(OFILES)
+
+%.elf: $(OFILES)
+	@echo linking $(notdir $@)
+	@$(LD) $(LDFLAGS) $(OFILES) $(LIBPATHS) $(LIBS) -o $@
+	@$(NM) -CSn $@ > $(notdir $*.lst)
+
+$(OFILES_SRC)	: $(HFILES_BIN)
+
+#---------------------------------------------------------------------------------
+# you need a rule like this for each extension you use as binary data
+#---------------------------------------------------------------------------------
+%.bin.o	%_bin.h:	%.bin
+#---------------------------------------------------------------------------------
+	@echo $(notdir $<)
+	@$(bin2o)
+
+-include $(DEPENDS)
+
+#---------------------------------------------------------------------------------------
+endif
+#---------------------------------------------------------------------------------------

fusee/fusee-mtc/linker.ld

@@ -0,0 +1,170 @@
+OUTPUT_FORMAT("elf32-littlearm", "elf32-bigarm", "elf32-littlearm")
+OUTPUT_ARCH(arm)
+ENTRY(_start)
+
+PHDRS
+{
+    crt0        PT_LOAD;
+    main        PT_LOAD;
+}
+
+/* Mostly copied from https://github.com/devkitPro/buildscripts/blob/master/dkarm-eabi/crtls/3dsx.ld */
+MEMORY
+{
+    NULL        : ORIGIN = 0x00000000, LENGTH = 0x1000
+    main        : ORIGIN = 0xF0000000, LENGTH = 0x10000000
+}
+
+SECTIONS
+{
+    PROVIDE(__start__           = 0xF0000000);
+    PROVIDE(__stack_bottom__    = 0x90010000);
+    PROVIDE(__stack_top__       = 0x90020000);
+    PROVIDE(__heap_start__      = 0x90020000);
+    PROVIDE(__heap_end__        = 0xA0020000);
+
+    . = __start__;
+    
+    .crt0 :
+    {
+        KEEP( *(.text.start) )
+        KEEP( *(.init) )
+        . = ALIGN(32);
+    } >main :crt0
+    
+    .text :
+    {
+        . = ALIGN(32);
+        /* .text */
+        *(.text)
+        *(.text.*)
+        *(.glue_7)
+        *(.glue_7t)
+        *(.stub)
+        *(.gnu.warning)
+        *(.gnu.linkonce.t*)
+
+        /* .fini */
+        KEEP( *(.fini) )
+        . = ALIGN(8);
+    } >main :main
+
+    .rodata :
+    {
+        *(.rodata)
+        *(.roda)
+        *(.rodata.*)
+        *all.rodata*(*)
+        *(.gnu.linkonce.r*)
+        SORT(CONSTRUCTORS)
+        . = ALIGN(8);
+    } >main
+    
+    .preinit_array :
+    {
+        PROVIDE (__preinit_array_start = .);
+        KEEP (*(.preinit_array))
+        PROVIDE (__preinit_array_end = .);
+    } >main
+
+    .init_array ALIGN(4) :
+    {
+        PROVIDE (__init_array_start = .);
+        KEEP (*(SORT(.init_array.*)))
+        KEEP (*(.init_array))
+        PROVIDE (__init_array_end = .);
+    } >main
+
+    .fini_array ALIGN(4) :
+    {
+        PROVIDE (__fini_array_start = .);
+        KEEP (*(.fini_array))
+        KEEP (*(SORT(.fini_array.*)))
+        PROVIDE (__fini_array_end = .);
+    } >main
+
+    .ctors ALIGN(4) :
+    {
+        KEEP (*crtbegin.o(.ctors)) /* MUST be first -- GCC requires it */
+        KEEP (*(EXCLUDE_FILE (*crtend.o) .ctors))
+        KEEP (*(SORT(.ctors.*)))
+        KEEP (*(.ctors))
+        . = ALIGN(4);   /* REQUIRED. LD is flaky without it. */
+    } >main
+
+    .dtors ALIGN(4) :
+    {
+        KEEP (*crtbegin.o(.dtors))
+        KEEP (*(EXCLUDE_FILE (*crtend.o) .dtors))
+        KEEP (*(SORT(.dtors.*)))
+        KEEP (*(.dtors))
+        . = ALIGN(4);   /* REQUIRED. LD is flaky without it. */
+    } >main
+
+    .ARM.extab : { *(.ARM.extab* .gnu.linkonce.armextab.*) __exidx_start = ABSOLUTE(.);} >main
+    ARM.exidx : { *(.ARM.exidx* .gnu.linkonce.armexidx.*)  __exidx_end = ABSOLUTE(.);} >main
+
+    .data :
+    {
+        *(.data)
+        *(.data.*)
+        *(.gnu.linkonce.d*)
+        CONSTRUCTORS
+        . = ALIGN(32);
+    } >main
+
+    .bss (NOLOAD) :
+    {
+        . = ALIGN(32);
+        PROVIDE (__bss_start__ = ABSOLUTE(.));
+        *(.dynbss)
+        *(.bss)
+        *(.bss.*)
+        *(.gnu.linkonce.b*)
+        *(COMMON)
+        . = ALIGN(32);
+        PROVIDE (__bss_end__ = ABSOLUTE(.));
+    } >main :NONE
+    __end__ = ABSOLUTE(.) ;
+
+
+    /* ==================
+       ==== Metadata ====
+       ================== */
+
+    /* Discard sections that difficult post-processing */
+    /DISCARD/ : { *(.group .comment .note) }
+
+    /* Stabs debugging sections. */
+    .stab          0 : { *(.stab) }
+    .stabstr       0 : { *(.stabstr) }
+    .stab.excl     0 : { *(.stab.excl) }
+    .stab.exclstr  0 : { *(.stab.exclstr) }
+    .stab.index    0 : { *(.stab.index) }
+    .stab.indexstr 0 : { *(.stab.indexstr) }
+
+    /* DWARF debug sections.
+       Symbols in the DWARF debugging sections are relative to the beginning
+       of the section so we begin them at 0. */
+
+    /* DWARF 1 */
+    .debug          0 : { *(.debug) }
+    .line           0 : { *(.line) }
+
+    /* GNU DWARF 1 extensions */
+    .debug_srcinfo  0 : { *(.debug_srcinfo) }
+    .debug_sfnames  0 : { *(.debug_sfnames) }
+
+    /* DWARF 1.1 and DWARF 2 */
+    .debug_aranges  0 : { *(.debug_aranges) }
+    .debug_pubnames 0 : { *(.debug_pubnames) }
+
+    /* DWARF 2 */
+    .debug_info     0 : { *(.debug_info) }
+    .debug_abbrev   0 : { *(.debug_abbrev) }
+    .debug_line     0 : { *(.debug_line) }
+    .debug_frame    0 : { *(.debug_frame) }
+    .debug_str      0 : { *(.debug_str) }
+    .debug_loc      0 : { *(.debug_loc) }
+    .debug_macinfo  0 : { *(.debug_macinfo) }
+}

fusee/fusee-mtc/linker.specs

@@ -0,0 +1,7 @@
+%rename link                old_link
+
+*link:
+%(old_link) -T %:getenv(TOPDIR /linker.ld) --nmagic --gc-sections
+
+*startfile:
+crti%O%s crtbegin%O%s

fusee/fusee-mtc/src/car.c

@@ -0,0 +1,139 @@
+/*
+ * Copyright (c) 2018-2019 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#include "car.h"
+#include "timers.h"
+#include "utils.h"
+
+static inline uint32_t get_clk_source_reg(CarDevice dev) {
+    switch (dev) {
+        case CARDEVICE_UARTA: return 0x178;
+        case CARDEVICE_UARTB: return 0x17C;
+        case CARDEVICE_UARTC: return 0x1A0;
+        case CARDEVICE_I2C1: return 0x124;
+        case CARDEVICE_I2C5: return 0x128;
+        case CARDEVICE_TZRAM: return 0;
+        case CARDEVICE_SE: return 0x42C;
+        case CARDEVICE_HOST1X: return 0x180;
+        case CARDEVICE_TSEC: return 0x1F4;
+        case CARDEVICE_SOR_SAFE: return 0;
+        case CARDEVICE_SOR0: return 0;
+        case CARDEVICE_SOR1: return 0x410;
+        case CARDEVICE_KFUSE: return 0;
+        case CARDEVICE_CL_DVFS: return 0;
+        case CARDEVICE_CORESIGHT: return 0x1D4;
+        case CARDEVICE_ACTMON: return 0x3E8;
+        case CARDEVICE_BPMP: return 0;
+        default: generic_panic();
+    }
+} 
+
+static inline uint32_t get_clk_source_val(CarDevice dev) {
+    switch (dev) {
+        case CARDEVICE_UARTA: return 0;
+        case CARDEVICE_UARTB: return 0;
+        case CARDEVICE_UARTC: return 0;
+        case CARDEVICE_I2C1: return 6;
+        case CARDEVICE_I2C5: return 6;
+        case CARDEVICE_TZRAM: return 0;
+        case CARDEVICE_SE: return 0;
+        case CARDEVICE_HOST1X: return 4;
+        case CARDEVICE_TSEC: return 0;
+        case CARDEVICE_SOR_SAFE: return 0;
+        case CARDEVICE_SOR0: return 0;
+        case CARDEVICE_SOR1: return 0;
+        case CARDEVICE_KFUSE: return 0;
+        case CARDEVICE_CL_DVFS: return 0;
+        case CARDEVICE_CORESIGHT: return 0;
+        case CARDEVICE_ACTMON: return 6;
+        case CARDEVICE_BPMP: return 0;
+        default: generic_panic();
+    }
+}
+
+static inline uint32_t get_clk_source_div(CarDevice dev) {
+    switch (dev) {
+        case CARDEVICE_UARTA: return 0;
+        case CARDEVICE_UARTB: return 0;
+        case CARDEVICE_UARTC: return 0;
+        case CARDEVICE_I2C1: return 0;
+        case CARDEVICE_I2C5: return 0;
+        case CARDEVICE_TZRAM: return 0;
+        case CARDEVICE_SE: return 0;
+        case CARDEVICE_HOST1X: return 3;
+        case CARDEVICE_TSEC: return 2;
+        case CARDEVICE_SOR_SAFE: return 0;
+        case CARDEVICE_SOR0: return 0;
+        case CARDEVICE_SOR1: return 2;
+        case CARDEVICE_KFUSE: return 0;
+        case CARDEVICE_CL_DVFS: return 0;
+        case CARDEVICE_CORESIGHT: return 4;
+        case CARDEVICE_ACTMON: return 0;
+        case CARDEVICE_BPMP: return 0;
+        default: generic_panic();
+    }
+}
+
+static uint32_t g_clk_reg_offsets[NUM_CAR_BANKS] = {0x010, 0x014, 0x018, 0x360, 0x364, 0x280, 0x298};
+static uint32_t g_rst_reg_offsets[NUM_CAR_BANKS] = {0x004, 0x008, 0x00C, 0x358, 0x35C, 0x28C, 0x2A4}; 
+
+void clk_enable(CarDevice dev) {
+    uint32_t clk_source_reg;
+    if ((clk_source_reg = get_clk_source_reg(dev))) {
+        MAKE_CAR_REG(clk_source_reg) = (get_clk_source_val(dev) << 29) | get_clk_source_div(dev);
+    }
+    MAKE_CAR_REG(g_clk_reg_offsets[dev >> 5]) |= BIT(dev & 0x1F);
+}
+
+void clk_disable(CarDevice dev) {
+    MAKE_CAR_REG(g_clk_reg_offsets[dev >> 5]) &= ~(BIT(dev & 0x1F));
+}
+
+void rst_enable(CarDevice dev) {
+    MAKE_CAR_REG(g_rst_reg_offsets[dev >> 5]) |= BIT(dev & 0x1F);
+}
+
+void rst_disable(CarDevice dev) {
+    MAKE_CAR_REG(g_rst_reg_offsets[dev >> 5]) &= ~(BIT(dev & 0x1F));
+}
+
+void clkrst_enable(CarDevice dev) {
+    clk_enable(dev);
+    rst_disable(dev);
+}
+
+void clkrst_disable(CarDevice dev) {
+    rst_enable(dev);
+    clk_disable(dev);
+}
+
+void clkrst_reboot(CarDevice dev) {
+    clkrst_disable(dev);
+    if (dev == CARDEVICE_KFUSE) {
+        /* Workaround for KFUSE clock. */
+        clk_enable(dev);
+        udelay(100);
+        rst_disable(dev);
+        udelay(200);
+    } else {
+        clkrst_enable(dev);
+    }
+}
+
+void clkrst_enable_fuse_regs(bool enable) {
+    volatile tegra_car_t *car = car_get_regs();
+    car->misc_clk_enb = ((car->misc_clk_enb & 0xEFFFFFFF) | ((enable & 1) << 28));
+}

fusee/fusee-mtc/src/car.h

@@ -0,0 +1,505 @@
+/*
+ * Copyright (c) 2018-2019 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+ 
+#ifndef FUSEE_CAR_H
+#define FUSEE_CAR_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#define CAR_BASE 0x60006000
+#define MAKE_CAR_REG(n) MAKE_REG32(CAR_BASE + n)
+
+#define CLK_L_SDMMC1    (1 << 14)
+#define CLK_L_SDMMC2    (1 << 9)
+#define CLK_U_SDMMC3    (1 << 5)
+#define CLK_L_SDMMC4    (1 << 15)
+
+#define CLK_SOURCE_MASK             (0b111 << 29)
+#define CLK_SOURCE_FIRST            (0b000 << 29)
+#define CLK_DIVIDER_MASK            (0xff << 0)
+#define CLK_DIVIDER_UNITY           (0x00 << 0)
+
+#define NUM_CAR_BANKS 7
+
+/* Clock and reset devices. */
+typedef enum {
+    CARDEVICE_UARTA = ((0 << 5) | 0x6),
+    CARDEVICE_UARTB = ((0 << 5) | 0x7),
+    CARDEVICE_UARTC = ((1 << 5) | 0x17),
+    CARDEVICE_I2C1 = ((0 << 5) | 0xC),
+    CARDEVICE_I2C5 = ((1 << 5) | 0xF),
+    CARDEVICE_TZRAM = ((3 << 5) | 0x1E),
+    CARDEVICE_SE = ((3 << 5) | 0x1F),
+    CARDEVICE_HOST1X = ((0 << 5) | 0x1C),
+    CARDEVICE_TSEC = ((2 << 5) | 0x13),
+    CARDEVICE_SOR_SAFE = ((6 << 5) | 0x1E),
+    CARDEVICE_SOR0 = ((5 << 5) | 0x16),
+    CARDEVICE_SOR1 = ((5 << 5) | 0x17),
+    CARDEVICE_KFUSE = ((1 << 5) | 0x8),
+    CARDEVICE_CL_DVFS = ((4 << 5) | 0x1B),
+    CARDEVICE_CORESIGHT = ((2 << 5) | 0x9),
+    CARDEVICE_ACTMON = ((3 << 5) | 0x17),
+    CARDEVICE_BPMP = ((0 << 5) | 0x1)
+} CarDevice;
+
+/* Clock/Reset Controller (CLK_RST_CONTROLLER_) regs */
+typedef struct {
+    uint32_t rst_src;           /* _RST_SOURCE_0,   0x00 */
+
+    /* _RST_DEVICES_L/H/U_0     0x4-0xc */
+    uint32_t rst_dev_l;
+    uint32_t rst_dev_h;
+    uint32_t rst_dev_u;
+
+    /* _CLK_OUT_ENB_L/H/U_0     0x10-0x18 */
+    uint32_t clk_out_enb_l;
+    uint32_t clk_out_enb_h;
+    uint32_t clk_out_enb_u;
+
+    uint32_t _0x1C;
+    uint32_t cclk_brst_pol;     /* _CCLK_BURST_POLICY_0,    0x20 */
+    uint32_t super_cclk_div;    /* _SUPER_CCLK_DIVIDER_0,   0x24 */
+    uint32_t sclk_brst_pol;     /* _SCLK_BURST_POLICY_0,    0x28 */
+    uint32_t super_sclk_div;    /* _SUPER_SCLK_DIVIDER_0,   0x2c */
+    uint32_t clk_sys_rate;      /* _CLK_SYSTEM_RATE_0,      0x30 */
+    uint32_t prog_dly_clk;      /* _PROG_DLY_CLK_0,         0x34 */
+    uint32_t aud_sync_clk_rate; /* _AUDIO_SYNC_CLK_RATE_0,  0x38 */
+    uint32_t _0x3C;
+    uint32_t cop_clk_skip_plcy; /* _COP_CLK_SKIP_POLICY_0,  0x40 */
+    uint32_t clk_mask_arm;      /* _CLK_MASK_ARM_0,         0x44 */
+    uint32_t misc_clk_enb;      /* _MISC_CLK_ENB_0,         0x48 */
+    uint32_t clk_cpu_cmplx;     /* _CLK_CPU_CMPLX_0,        0x4c */
+    uint32_t osc_ctrl;          /* _OSC_CTRL_0,             0x50 */
+    uint32_t pll_lfsr;          /* _PLL_LFSR_0,             0x54 */
+    uint32_t osc_freq_det;      /* _OSC_FREQ_DET_0,         0x58 */
+    uint32_t osc_freq_det_stat; /* _OSC_FREQ_DET_STATUS_0,  0x5c */
+    uint32_t _0x60[2];
+    uint32_t plle_ss_cntl;      /* _PLLE_SS_CNTL_0,         0x68 */
+    uint32_t plle_misc1;        /* _PLLE_MISC1_0,           0x6c */
+    uint32_t _0x70[4];
+
+    /* PLLC 0x80-0x8c */
+    uint32_t pllc_base;
+    uint32_t pllc_out;
+    uint32_t pllc_misc0;
+    uint32_t pllc_misc1;
+    
+    /* PLLM 0x90-0x9c */
+    uint32_t pllm_base;
+    uint32_t pllm_out;
+    uint32_t pllm_misc1;
+    uint32_t pllm_misc2;
+    
+    /* PLLP 0xa0-0xac */
+    uint32_t pllp_base;
+    uint32_t pllp_outa;
+    uint32_t pllp_outb;
+    uint32_t pllp_misc;
+    
+    /* PLLA 0xb0-0xbc */
+    uint32_t plla_base;
+    uint32_t plla_out;
+    uint32_t plla_misc0;
+    uint32_t plla_misc1;
+    
+    /* PLLU 0xc0-0xcc */
+    uint32_t pllu_base;
+    uint32_t pllu_out;
+    uint32_t pllu_misc1;
+    uint32_t pllu_misc2;
+    
+    /* PLLD 0xd0-0xdc */
+    uint32_t plld_base;
+    uint32_t plld_out;
+    uint32_t plld_misc1;
+    uint32_t plld_misc2;
+
+    /* PLLX 0xe0-0xe4 */
+    uint32_t pllx_base;
+    uint32_t pllx_misc;
+    
+    /* PLLE 0xe8-0xf4 */
+    uint32_t plle_base;
+    uint32_t plle_misc;
+    uint32_t plle_ss_cntl1;
+    uint32_t plle_ss_cntl2;
+    
+    uint32_t lvl2_clk_gate_ovra;            /* _LVL2_CLK_GATE_OVRA_0,   0xf8 */
+    uint32_t lvl2_clk_gate_ovrb;            /* _LVL2_CLK_GATE_OVRB_0,   0xfc */
+
+    uint32_t clk_source_i2s2;               /* _CLK_SOURCE_I2S2_0,      0x100 */
+    uint32_t clk_source_i2s3;               /* _CLK_SOURCE_I2S3_0,      0x104 */
+    uint32_t clk_source_spdif_out;          /* _CLK_SOURCE_SPDIF_OUT_0, 0x108 */
+    uint32_t clk_source_spdif_in;           /* _CLK_SOURCE_SPDIF_IN_0,  0x10c */
+    uint32_t clk_source_pwm;                /* _CLK_SOURCE_PWM_0,       0x110 */
+    uint32_t _0x114;
+    uint32_t clk_source_spi2;               /* _CLK_SOURCE_SPI2_0,      0x118 */
+    uint32_t clk_source_spi3;               /* _CLK_SOURCE_SPI3_0,      0x11c */
+    uint32_t _0x120;
+    uint32_t clk_source_i2c1;               /* _CLK_SOURCE_I2C1_0,      0x124 */
+    uint32_t clk_source_i2c5;               /* _CLK_SOURCE_I2C5_0,      0x128 */
+    uint32_t _0x12c[2];
+    uint32_t clk_source_spi1;               /* _CLK_SOURCE_SPI1_0,      0x134 */
+    uint32_t clk_source_disp1;              /* _CLK_SOURCE_DISP1_0,     0x138 */
+    uint32_t clk_source_disp2;              /* _CLK_SOURCE_DISP2_0,     0x13c */
+    uint32_t _0x140;
+    uint32_t clk_source_isp;                /* _CLK_SOURCE_ISP_0,       0x144 */
+    uint32_t clk_source_vi;                 /* _CLK_SOURCE_VI_0,        0x148 */
+    uint32_t _0x14c;
+    uint32_t clk_source_sdmmc1;             /* _CLK_SOURCE_SDMMC1_0,    0x150 */
+    uint32_t clk_source_sdmmc2;             /* _CLK_SOURCE_SDMMC2_0,    0x154 */
+    uint32_t _0x158[3];
+    uint32_t clk_source_sdmmc4;             /* _CLK_SOURCE_SDMMC4_0,    0x164 */
+    uint32_t _0x168[4];
+    uint32_t clk_source_uarta;              /* _CLK_SOURCE_UARTA_0,     0x178 */
+    uint32_t clk_source_uartb;              /* _CLK_SOURCE_UARTB_0,     0x17c */
+    uint32_t clk_source_host1x;             /* _CLK_SOURCE_HOST1X_0,    0x180 */
+    uint32_t _0x184[5];
+    uint32_t clk_source_i2c2;               /* _CLK_SOURCE_I2C2_0,      0x198 */
+    uint32_t clk_source_emc;                /* _CLK_SOURCE_EMC_0,       0x19c */
+    uint32_t clk_source_uartc;              /* _CLK_SOURCE_UARTC_0,     0x1a0 */
+    uint32_t _0x1a4;
+    uint32_t clk_source_vi_sensor;          /* _CLK_SOURCE_VI_SENSOR_0, 0x1a8 */
+    uint32_t _0x1ac[2];
+    uint32_t clk_source_spi4;               /* _CLK_SOURCE_SPI4_0,      0x1b4 */
+    uint32_t clk_source_i2c3;               /* _CLK_SOURCE_I2C3_0,      0x1b8 */
+    uint32_t clk_source_sdmmc3;             /* _CLK_SOURCE_SDMMC3_0,    0x1bc */
+    uint32_t clk_source_uartd;              /* _CLK_SOURCE_UARTD_0,     0x1c0 */
+    uint32_t _0x1c4[2];
+    uint32_t clk_source_owr;                /* _CLK_SOURCE_OWR_0,       0x1cc */
+    uint32_t _0x1d0;
+    uint32_t clk_source_csite;              /* _CLK_SOURCE_CSITE_0,     0x1d4 */
+    uint32_t clk_source_i2s1;               /* _CLK_SOURCE_I2S1_0,      0x1d8 */
+    uint32_t clk_source_dtv;                /* _CLK_SOURCE_DTV_0,       0x1dc */
+    uint32_t _0x1e0[5];
+    uint32_t clk_source_tsec;               /* _CLK_SOURCE_TSEC_0,      0x1f4 */
+    uint32_t _0x1f8;
+    
+    uint32_t clk_spare2;                    /* _CLK_SPARE2_0,       0x1fc */
+    uint32_t _0x200[32];
+
+    uint32_t clk_out_enb_x;                 /* _CLK_OUT_ENB_X_0,    0x280 */
+    uint32_t clk_enb_x_set;                 /* _CLK_ENB_X_SET_0,    0x284 */
+    uint32_t clk_enb_x_clr;                 /* _CLK_ENB_X_CLR_0,    0x288 */
+
+    uint32_t rst_devices_x;                 /* _RST_DEVICES_X_0,    0x28c */
+    uint32_t rst_dev_x_set;                 /* _RST_DEV_X_SET_0,    0x290 */
+    uint32_t rst_dev_x_clr;                 /* _RST_DEV_X_CLR_0,    0x294 */
+
+    uint32_t clk_out_enb_y;                 /* _CLK_OUT_ENB_Y_0,    0x298 */
+    uint32_t clk_enb_y_set;                 /* _CLK_ENB_Y_SET_0,    0x29c */
+    uint32_t clk_enb_y_clr;                 /* _CLK_ENB_Y_CLR_0,    0x2a0 */
+
+    uint32_t rst_devices_y;                 /* _RST_DEVICES_Y_0,    0x2a4 */
+    uint32_t rst_dev_y_set;                 /* _RST_DEV_Y_SET_0,    0x2a8 */
+    uint32_t rst_dev_y_clr;                 /* _RST_DEV_Y_CLR_0,    0x2ac */
+
+    uint32_t _0x2b0[17];
+    uint32_t dfll_base;                     /* _DFLL_BASE_0,        0x2f4 */
+    uint32_t _0x2f8[2];
+
+    /* _RST_DEV_L/H/U_SET_0 0x300-0x314 */
+    uint32_t rst_dev_l_set;
+    uint32_t rst_dev_l_clr;
+    uint32_t rst_dev_h_set;
+    uint32_t rst_dev_h_clr;
+    uint32_t rst_dev_u_set;
+    uint32_t rst_dev_u_clr;
+
+    uint32_t _0x318[2];
+
+    /* _CLK_ENB_L/H/U_CLR_0 0x320-0x334 */
+    uint32_t clk_enb_l_set;
+    uint32_t clk_enb_l_clr;
+    uint32_t clk_enb_h_set;
+    uint32_t clk_enb_h_clr;
+    uint32_t clk_enb_u_set;
+    uint32_t clk_enb_u_clr;
+
+    uint32_t _0x338;
+    uint32_t ccplex_pg_sm_ovrd;         /* _CCPLEX_PG_SM_OVRD_0,    0x33c */
+    uint32_t rst_cpu_cmplx_set;         /* _RST_CPU_CMPLX_SET_0,    0x340 */
+    uint32_t rst_cpu_cmplx_clr;         /* _RST_CPU_CMPLX_CLR_0,    0x344 */
+
+    /* Additional (T30) registers */
+    uint32_t clk_cpu_cmplx_set;         /* _CLK_CPU_CMPLX_SET_0,    0x348 */
+    uint32_t clk_cpu_cmplx_clr;         /* _CLK_CPU_CMPLX_SET_0,    0x34c */
+
+    uint32_t _0x350[2];
+    uint32_t rst_dev_v;                 /* _RST_DEVICES_V_0,        0x358 */
+    uint32_t rst_dev_w;                 /* _RST_DEVICES_W_0,        0x35c */
+    uint32_t clk_out_enb_v;             /* _CLK_OUT_ENB_V_0,        0x360 */
+    uint32_t clk_out_enb_w;             /* _CLK_OUT_ENB_W_0,        0x364 */
+    uint32_t cclkg_brst_pol;            /* _CCLKG_BURST_POLICY_0,   0x368 */
+    uint32_t super_cclkg_div;           /* _SUPER_CCLKG_DIVIDER_0,  0x36c */
+    uint32_t cclklp_brst_pol;           /* _CCLKLP_BURST_POLICY_0,  0x370 */
+    uint32_t super_cclkp_div;           /* _SUPER_CCLKLP_DIVIDER_0, 0x374 */
+    uint32_t clk_cpug_cmplx;            /* _CLK_CPUG_CMPLX_0,       0x378 */
+    uint32_t clk_cpulp_cmplx;           /* _CLK_CPULP_CMPLX_0,      0x37c */
+    uint32_t cpu_softrst_ctrl;          /* _CPU_SOFTRST_CTRL_0,     0x380 */
+    uint32_t cpu_softrst_ctrl1;         /* _CPU_SOFTRST_CTRL1_0,    0x384 */
+    uint32_t cpu_softrst_ctrl2;         /* _CPU_SOFTRST_CTRL2_0,    0x388 */
+    uint32_t _0x38c[5];
+    uint32_t lvl2_clk_gate_ovrc;        /* _LVL2_CLK_GATE_OVRC,     0x3a0 */
+    uint32_t lvl2_clk_gate_ovrd;        /* _LVL2_CLK_GATE_OVRD,     0x3a4 */
+    uint32_t _0x3a8[2];
+    
+    uint32_t _0x3b0;
+    uint32_t clk_source_mselect;        /* _CLK_SOURCE_MSELECT_0,       0x3b4 */
+    uint32_t clk_source_tsensor;        /* _CLK_SOURCE_TSENSOR_0,       0x3b8 */
+    uint32_t clk_source_i2s4;           /* _CLK_SOURCE_I2S4_0,          0x3bc */
+    uint32_t clk_source_i2s5;           /* _CLK_SOURCE_I2S5_0,          0x3c0 */
+    uint32_t clk_source_i2c4;           /* _CLK_SOURCE_I2C4_0,          0x3c4 */
+    uint32_t _0x3c8[2];
+    uint32_t clk_source_ahub;           /* _CLK_SOURCE_AHUB_0,          0x3d0 */
+    uint32_t _0x3d4[4];
+    uint32_t clk_source_hda2codec_2x;   /* _CLK_SOURCE_HDA2CODEC_2X_0,  0x3e4 */
+    uint32_t clk_source_actmon;         /* _CLK_SOURCE_ACTMON_0,        0x3e8 */
+    uint32_t clk_source_extperiph1;     /* _CLK_SOURCE_EXTPERIPH1_0,    0x3ec */
+    uint32_t clk_source_extperiph2;     /* _CLK_SOURCE_EXTPERIPH2_0,    0x3f0 */
+    uint32_t clk_source_extperiph3;     /* _CLK_SOURCE_EXTPERIPH3_0,    0x3f4 */
+    uint32_t _0x3f8;
+    uint32_t clk_source_i2c_slow;       /* _CLK_SOURCE_I2C_SLOW_0,      0x3fc */
+    uint32_t clk_source_sys;            /* _CLK_SOURCE_SYS_0,           0x400 */
+    uint32_t clk_source_ispb;           /* _CLK_SOURCE_ISPB_0,          0x404 */
+    uint32_t _0x408[2];
+    uint32_t clk_source_sor1;           /* _CLK_SOURCE_SOR1_0,          0x410 */
+    uint32_t clk_source_sor0;           /* _CLK_SOURCE_SOR0_0,          0x414 */
+    uint32_t _0x418[2];
+    uint32_t clk_source_sata_oob;       /* _CLK_SOURCE_SATA_OOB_0,      0x420 */
+    uint32_t clk_source_sata;           /* _CLK_SOURCE_SATA_0,          0x424 */
+    uint32_t clk_source_hda;            /* _CLK_SOURCE_HDA_0,           0x428 */
+    uint32_t _0x42c;
+
+    /* _RST_DEV_V/W_SET_0 0x430-0x43c */
+    uint32_t rst_dev_v_set;
+    uint32_t rst_dev_v_clr;
+    uint32_t rst_dev_w_set;
+    uint32_t rst_dev_w_clr;
+
+    /* _CLK_ENB_V/W_CLR_0 0x440-0x44c */
+    uint32_t clk_enb_v_set;
+    uint32_t clk_enb_v_clr;
+    uint32_t clk_enb_w_set;
+    uint32_t clk_enb_w_clr;
+
+    /* Additional (T114+) registers */
+    uint32_t rst_cpug_cmplx_set;    /* _RST_CPUG_CMPLX_SET_0,   0x450 */
+    uint32_t rst_cpug_cmplx_clr;    /* _RST_CPUG_CMPLX_CLR_0,   0x454 */
+    uint32_t rst_cpulp_cmplx_set;   /* _RST_CPULP_CMPLX_SET_0,  0x458 */
+    uint32_t rst_cpulp_cmplx_clr;   /* _RST_CPULP_CMPLX_CLR_0,  0x45c */
+    uint32_t clk_cpug_cmplx_set;    /* _CLK_CPUG_CMPLX_SET_0,   0x460 */
+    uint32_t clk_cpug_cmplx_clr;    /* _CLK_CPUG_CMPLX_CLR_0,   0x464 */
+    uint32_t clk_cpulp_cmplx_set;   /* _CLK_CPULP_CMPLX_SET_0,  0x468 */
+    uint32_t clk_cpulp_cmplx_clr;   /* _CLK_CPULP_CMPLX_CLR_0,  0x46c */
+    uint32_t cpu_cmplx_status;      /* _CPU_CMPLX_STATUS_0,     0x470 */
+    uint32_t _0x474;
+    uint32_t intstatus;             /* _INTSTATUS_0,            0x478 */
+    uint32_t intmask;               /* _INTMASK_0,              0x47c */
+    uint32_t utmip_pll_cfg0;        /* _UTMIP_PLL_CFG0_0,       0x480 */
+    uint32_t utmip_pll_cfg1;        /* _UTMIP_PLL_CFG1_0,       0x484 */
+    uint32_t utmip_pll_cfg2;        /* _UTMIP_PLL_CFG2_0,       0x488 */
+
+    uint32_t plle_aux;              /* _PLLE_AUX_0,             0x48c */
+    uint32_t sata_pll_cfg0;         /* _SATA_PLL_CFG0_0,        0x490 */
+    uint32_t sata_pll_cfg1;         /* _SATA_PLL_CFG1_0,        0x494 */
+    uint32_t pcie_pll_cfg0;         /* _PCIE_PLL_CFG0_0,        0x498 */
+
+    uint32_t prog_audio_dly_clk;    /* _PROG_AUDIO_DLY_CLK_0,   0x49c */
+    uint32_t audio_sync_clk_i2s0;   /* _AUDIO_SYNC_CLK_I2S0_0,  0x4a0 */
+    uint32_t audio_sync_clk_i2s1;   /* _AUDIO_SYNC_CLK_I2S1_0,  0x4a4 */
+    uint32_t audio_sync_clk_i2s2;   /* _AUDIO_SYNC_CLK_I2S2_0,  0x4a8 */
+    uint32_t audio_sync_clk_i2s3;   /* _AUDIO_SYNC_CLK_I2S3_0,  0x4ac */
+    uint32_t audio_sync_clk_i2s4;   /* _AUDIO_SYNC_CLK_I2S4_0,  0x4b0 */
+    uint32_t audio_sync_clk_spdif;  /* _AUDIO_SYNC_CLK_SPDIF_0, 0x4b4 */
+
+    uint32_t plld2_base;            /* _PLLD2_BASE_0, 0x4b8 */
+    uint32_t plld2_misc;            /* _PLLD2_MISC_0, 0x4bc */
+    uint32_t utmip_pll_cfg3;        /* _UTMIP_PLL_CFG3_0, 0x4c0 */
+    uint32_t pllrefe_base;          /* _PLLREFE_BASE_0, 0x4c4 */
+    uint32_t pllrefe_misc;          /* _PLLREFE_MISC_0, 0x4c8 */
+    uint32_t pllrefe_out;           /* _PLLREFE_OUT_0, 0x4cc */
+    uint32_t cpu_finetrim_byp;      /* _CPU_FINETRIM_BYP_0, 0x4d0 */
+    uint32_t cpu_finetrim_select;   /* _CPU_FINETRIM_SELECT_0, 0x4d4 */
+    uint32_t cpu_finetrim_dr;       /* _CPU_FINETRIM_DR_0, 0x4d8 */
+    uint32_t cpu_finetrim_df;       /* _CPU_FINETRIM_DF_0, 0x4dc */
+    uint32_t cpu_finetrim_f;        /* _CPU_FINETRIM_F_0, 0x4e0 */
+    uint32_t cpu_finetrim_r;        /* _CPU_FINETRIM_R_0, 0x4e4 */
+    uint32_t pllc2_base;            /* _PLLC2_BASE_0, 0x4e8 */
+    uint32_t pllc2_misc0;           /* _PLLC2_MISC_0_0, 0x4ec */
+    uint32_t pllc2_misc1;           /* _PLLC2_MISC_1_0, 0x4f0 */
+    uint32_t pllc2_misc2;           /* _PLLC2_MISC_2_0, 0x4f4 */
+    uint32_t pllc2_misc3;           /* _PLLC2_MISC_3_0, 0x4f8 */
+    uint32_t pllc3_base;            /* _PLLC3_BASE_0, 0x4fc */
+    uint32_t pllc3_misc0;           /* _PLLC3_MISC_0_0, 0x500 */
+    uint32_t pllc3_misc1;           /* _PLLC3_MISC_1_0, 0x504 */
+    uint32_t pllc3_misc2;           /* _PLLC3_MISC_2_0, 0x508 */
+    uint32_t pllc3_misc3;           /* _PLLC3_MISC_3_0, 0x50c */
+    uint32_t pllx_misc1;            /* _PLLX_MISC_1_0, 0x510 */
+    uint32_t pllx_misc2;            /* _PLLX_MISC_2_0, 0x514 */
+    uint32_t pllx_misc3;            /* _PLLX_MISC_3_0, 0x518 */
+    uint32_t xusbio_pll_cfg0;       /* _XUSBIO_PLL_CFG0_0, 0x51c */
+    uint32_t xusbio_pll_cfg1;       /* _XUSBIO_PLL_CFG0_1, 0x520 */
+    uint32_t plle_aux1;             /* _PLLE_AUX1_0, 0x524 */
+    uint32_t pllp_reshift;          /* _PLLP_RESHIFT_0, 0x528 */
+    uint32_t utmipll_hw_pwrdn_cfg0; /* _UTMIPLL_HW_PWRDN_CFG0_0, 0x52c */
+    uint32_t pllu_hw_pwrdn_cfg0;    /* _PLLU_HW_PWRDN_CFG0_0, 0x530 */
+    uint32_t xusb_pll_cfg0;         /* _XUSB_PLL_CFG0_0, 0x534 */
+    uint32_t _0x538;
+    uint32_t clk_cpu_misc;          /* _CLK_CPU_MISC_0, 0x53c */
+    uint32_t clk_cpug_misc;         /* _CLK_CPUG_MISC_0, 0x540 */
+    uint32_t clk_cpulp_misc;        /* _CLK_CPULP_MISC_0, 0x544 */
+    uint32_t pllx_hw_ctrl_cfg;      /* _PLLX_HW_CTRL_CFG_0, 0x548 */
+    uint32_t pllx_sw_ramp_cfg;      /* _PLLX_SW_RAMP_CFG_0, 0x54c */
+    uint32_t pllx_hw_ctrl_status;   /* _PLLX_HW_CTRL_STATUS_0, 0x550 */
+    uint32_t lvl2_clk_gate_ovre;    /* _LVL2_CLK_GATE_OVRE, 0x554 */
+    uint32_t super_gr3d_clk_div;    /* _SUPER_GR3D_CLK_DIVIDER_0, 0x558 */
+    uint32_t spare_reg0;            /* _SPARE_REG0_0, 0x55c */
+    uint32_t audio_sync_clk_dmic1;  /* _AUDIO_SYNC_CLK_DMIC1_0, 0x560 */
+    uint32_t audio_sync_clk_dmic2;  /* _AUDIO_SYNC_CLK_DMIC2_0, 0x564 */
+    
+    uint32_t _0x568[2];
+    uint32_t plld2_ss_cfg;          /* _PLLD2_SS_CFG,           0x570 */
+    uint32_t plld2_ss_ctrl1;        /* _PLLD2_SS_CTRL1_0,       0x574 */
+    uint32_t plld2_ss_ctrl2;        /* _PLLD2_SS_CTRL2_0,       0x578 */
+    uint32_t _0x57c[5];
+    
+    uint32_t plldp_base;            /* _PLLDP_BASE, 0x590*/
+    uint32_t plldp_misc;            /* _PLLDP_MISC, 0x594 */
+    uint32_t plldp_ss_cfg;          /* _PLLDP_SS_CFG, 0x598 */
+    uint32_t plldp_ss_ctrl1;        /* _PLLDP_SS_CTRL1_0, 0x59c */
+    uint32_t plldp_ss_ctrl2;        /* _PLLDP_SS_CTRL2_0, 0x5a0 */
+    uint32_t pllc4_base;            /* _PLLC4_BASE_0, 0x5a4 */
+    uint32_t pllc4_misc;            /* _PLLC4_MISC_0, 0x5a8 */
+    uint32_t _0x5ac[6];
+    uint32_t clk_spare0;            /* _CLK_SPARE0_0, 0x5c4 */
+    uint32_t clk_spare1;            /* _CLK_SPARE1_0, 0x5c8 */
+    uint32_t gpu_isob_ctrl;         /* _GPU_ISOB_CTRL_0, 0x5cc */
+    uint32_t pllc_misc2;            /* _PLLC_MISC_2_0, 0x5d0 */
+    uint32_t pllc_misc3;            /* _PLLC_MISC_3_0, 0x5d4 */
+    uint32_t plla_misc2;            /* _PLLA_MISC2_0, 0x5d8 */
+    uint32_t _0x5dc[2];
+    uint32_t pllc4_out;             /* _PLLC4_OUT_0, 0x5e4 */
+    uint32_t pllmb_base;            /* _PLLMB_BASE_0, 0x5e8 */
+    uint32_t pllmb_misc1;           /* _PLLMB_MISC1_0, 0x5ec */
+    uint32_t pllx_misc4;            /* _PLLX_MISC_4_0, 0x5f0 */
+    uint32_t pllx_misc5;            /* _PLLX_MISC_5_0, 0x5f4 */
+    uint32_t _0x5f8[2];
+    
+    uint32_t clk_source_xusb_core_host;             /* _CLK_SOURCE_XUSB_CORE_HOST_0,    0x600 */
+    uint32_t clk_source_xusb_falcon;                /* _CLK_SOURCE_XUSB_FALCON_0,    0x604 */
+    uint32_t clk_source_xusb_fs;                    /* _CLK_SOURCE_XUSB_FS_0,    0x608 */
+    uint32_t clk_source_xusb_core_dev;              /* _CLK_SOURCE_XUSB_CORE_DEV_0,    0x60c */
+    uint32_t clk_source_xusb_ss;                    /* _CLK_SOURCE_XUSB_SS_0,    0x610 */
+    uint32_t clk_source_cilab;                      /* _CLK_SOURCE_CILAB_0,    0x614 */
+    uint32_t clk_source_cilcd;                      /* _CLK_SOURCE_CILCD_0,    0x618 */
+    uint32_t clk_source_cilef;                      /* _CLK_SOURCE_CILEF_0,    0x61c */
+    uint32_t clk_source_dsia_lp;                    /* _CLK_SOURCE_DSIA_LP_0,    0x620 */
+    uint32_t clk_source_dsib_lp;                    /* _CLK_SOURCE_DSIB_LP_0,    0x624 */
+    uint32_t clk_source_entropy;                    /* _CLK_SOURCE_ENTROPY_0,    0x628 */
+    uint32_t clk_source_dvfs_ref;                   /* _CLK_SOURCE_DVFS_REF_0,    0x62c */
+    uint32_t clk_source_dvfs_soc;                   /* _CLK_SOURCE_DVFS_SOC_0,    0x630 */
+    uint32_t _0x634[3];
+    uint32_t clk_source_emc_latency;                /* _CLK_SOURCE_EMC_LATENCY_0,    0x640 */
+    uint32_t clk_source_soc_therm;                  /* _CLK_SOURCE_SOC_THERM_0,    0x644 */
+    uint32_t _0x648;
+    uint32_t clk_source_dmic1;                      /* _CLK_SOURCE_DMIC1_0,    0x64c */
+    uint32_t clk_source_dmic2;                      /* _CLK_SOURCE_DMIC2_0,    0x650 */
+    uint32_t _0x654;
+    uint32_t clk_source_vi_sensor2;                 /* _CLK_SOURCE_VI_SENSOR2_0,    0x658 */
+    uint32_t clk_source_i2c6;                       /* _CLK_SOURCE_I2C6_0,    0x65c */
+    uint32_t clk_source_mipibif;                    /* _CLK_SOURCE_MIPIBIF_0,    0x660 */
+    uint32_t clk_source_emc_dll;                    /* _CLK_SOURCE_EMC_DLL_0,    0x664 */
+    uint32_t _0x668;
+    uint32_t clk_source_uart_fst_mipi_cal;          /* _CLK_SOURCE_UART_FST_MIPI_CAL_0,    0x66c */
+    uint32_t _0x670[2];
+    uint32_t clk_source_vic;                        /* _CLK_SOURCE_VIC_0,    0x678 */
+    
+    uint32_t pllp_outc;                             /* _PLLP_OUTC_0, 0x67c */
+    uint32_t pllp_misc1;                            /* _PLLP_MISC1_0, 0x680 */
+    uint32_t _0x684[2];
+    uint32_t emc_div_clk_shaper_ctrl;               /* _EMC_DIV_CLK_SHAPER_CTRL_0, 0x68c */
+    uint32_t emc_pllc_shaper_ctrl;                  /* _EMC_PLLC_SHAPER_CTRL_0, 0x690 */
+
+    uint32_t clk_source_sdmmc_legacy_tm;            /* _CLK_SOURCE_SDMMC_LEGACY_TM_0,    0x694 */
+    uint32_t clk_source_nvdec;                      /* _CLK_SOURCE_NVDEC_0,    0x698 */
+    uint32_t clk_source_nvjpg;                      /* _CLK_SOURCE_NVJPG_0,    0x69c */
+    uint32_t clk_source_nvenc;                      /* _CLK_SOURCE_NVENC_0,    0x6a0 */
+    
+    uint32_t plla1_base;                            /* _PLLA1_BASE_0, 0x6a4 */
+    uint32_t plla1_misc0;                           /* _PLLA1_MISC_0_0, 0x6a8 */
+    uint32_t plla1_misc1;                           /* _PLLA1_MISC_1_0, 0x6ac */
+    uint32_t plla1_misc2;                           /* _PLLA1_MISC_2_0, 0x6b0 */
+    uint32_t plla1_misc3;                           /* _PLLA1_MISC_3_0, 0x6b4 */
+    uint32_t audio_sync_clk_dmic3;                  /* _AUDIO_SYNC_CLK_DMIC3_0, 0x6b8 */
+    
+    uint32_t clk_source_dmic3;                      /* _CLK_SOURCE_DMIC3_0,    0x6bc */
+    uint32_t clk_source_ape;                        /* _CLK_SOURCE_APE_0,    0x6c0 */
+    uint32_t clk_source_qspi;                       /* _CLK_SOURCE_QSPI_0,    0x6c4 */
+    uint32_t clk_source_vi_i2c;                     /* _CLK_SOURCE_VI_I2C_0,    0x6c8 */
+    uint32_t clk_source_usb2_hsic_trk;              /* _CLK_SOURCE_USB2_HSIC_TRK_0,    0x6cc */
+    uint32_t clk_source_pex_sata_usb_rx_byp;        /* _CLK_SOURCE_PEX_SATA_USB_RX_BYP_0,    0x6d0 */
+    uint32_t clk_source_maud;                       /* _CLK_SOURCE_MAUD_0,    0x6d4 */
+    uint32_t clk_source_tsecb;                      /* _CLK_SOURCE_TSECB_0,    0x6d8 */
+    
+    uint32_t clk_cpug_misc1;                        /* _CLK_CPUG_MISC1_0, 0x6dc */
+    uint32_t aclk_burst_policy;                     /* _ACLK_BURST_POLICY_0, 0x6e0 */
+    uint32_t super_aclk_divider;                    /* _SUPER_ACLK_DIVIDER_0, 0x6e4 */
+    
+    uint32_t nvenc_super_clk_divider;               /* _NVENC_SUPER_CLK_DIVIDER_0, 0x6e8 */
+    uint32_t vi_super_clk_divider;                  /* _VI_SUPER_CLK_DIVIDER_0, 0x6ec */
+    uint32_t vic_super_clk_divider;                 /* _VIC_SUPER_CLK_DIVIDER_0, 0x6f0 */
+    uint32_t nvdec_super_clk_divider;               /* _NVDEC_SUPER_CLK_DIVIDER_0, 0x6f4 */
+    uint32_t isp_super_clk_divider;                 /* _ISP_SUPER_CLK_DIVIDER_0, 0x6f8 */
+    uint32_t ispb_super_clk_divider;                /* _ISPB_SUPER_CLK_DIVIDER_0, 0x6fc */
+    uint32_t nvjpg_super_clk_divider;               /* _NVJPG_SUPER_CLK_DIVIDER_0, 0x700 */
+    uint32_t se_super_clk_divider;                  /* _SE_SUPER_CLK_DIVIDER_0, 0x704 */
+    uint32_t tsec_super_clk_divider;                /* _TSEC_SUPER_CLK_DIVIDER_0, 0x708 */
+    uint32_t tsecb_super_clk_divider;               /* _TSECB_SUPER_CLK_DIVIDER_0, 0x70c */
+    
+    uint32_t clk_source_uartape;                    /* _CLK_SOURCE_UARTAPE_0, 0x710 */
+    uint32_t clk_cpug_misc2;                        /* _CLK_CPUG_MISC2_0, 0x714 */
+    uint32_t clk_source_dbgapb;                     /* _CLK_SOURCE_DBGAPB_0, 0x718 */
+    uint32_t clk_ccplex_cc4_ret_clk_enb;            /* _CLK_CCPLEX_CC4_RET_CLK_ENB_0, 0x71c */
+    uint32_t actmon_cpu_clk;                        /* _ACTMON_CPU_CLK_0, 0x720 */
+    uint32_t clk_source_emc_safe;                   /* _CLK_SOURCE_EMC_SAFE_0, 0x724 */
+    uint32_t sdmmc2_pllc4_out0_shaper_ctrl;         /* _SDMMC2_PLLC4_OUT0_SHAPER_CTRL_0, 0x728 */
+    uint32_t sdmmc2_pllc4_out1_shaper_ctrl;         /* _SDMMC2_PLLC4_OUT1_SHAPER_CTRL_0, 0x72c */
+    uint32_t sdmmc2_pllc4_out2_shaper_ctrl;         /* _SDMMC2_PLLC4_OUT2_SHAPER_CTRL_0, 0x730 */
+    uint32_t sdmmc2_div_clk_shaper_ctrl;            /* _SDMMC2_DIV_CLK_SHAPER_CTRL_0, 0x734 */
+    uint32_t sdmmc4_pllc4_out0_shaper_ctrl;         /* _SDMMC4_PLLC4_OUT0_SHAPER_CTRL_0, 0x738 */
+    uint32_t sdmmc4_pllc4_out1_shaper_ctrl;         /* _SDMMC4_PLLC4_OUT1_SHAPER_CTRL_0, 0x73c */
+    uint32_t sdmmc4_pllc4_out2_shaper_ctrl;         /* _SDMMC4_PLLC4_OUT2_SHAPER_CTRL_0, 0x740 */
+    uint32_t sdmmc4_div_clk_shaper_ctrl;            /* _SDMMC4_DIV_CLK_SHAPER_CTRL_0, 0x744 */    
+} tegra_car_t;
+
+static inline volatile tegra_car_t *car_get_regs(void) {
+    return (volatile tegra_car_t *)CAR_BASE;
+}
+
+void clk_enable(CarDevice dev);
+void clk_disable(CarDevice dev);
+void rst_enable(CarDevice dev);
+void rst_disable(CarDevice dev);
+
+void clkrst_enable(CarDevice dev);
+void clkrst_disable(CarDevice dev);
+void clkrst_reboot(CarDevice dev);
+
+void clkrst_enable_fuse_regs(bool enable);
+
+#endif

fusee/fusee-mtc/src/display/video_fb.h

@@ -0,0 +1,57 @@
+/*
+ * (C) Copyright 1997-2002 ELTEC Elektronik AG
+ * Frank Gottschling <fgottschling@eltec.de>
+ *
+ * See file CREDITS for list of people who contributed to this
+ * project.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+ * MA 02111-1307 USA
+ */
+
+#ifndef _VIDEO_FB_H_
+#define _VIDEO_FB_H_
+
+#define CONSOLE_BG_COL            0x00
+#define CONSOLE_FG_COL            0xa0
+
+/* Try using the small font */
+#define CONFIG_VIDEO_FONT_SMALL
+
+/*
+ * Graphic Data Format (GDF) bits for VIDEO_DATA_FORMAT
+ */
+#define GDF__8BIT_INDEX         0
+#define GDF_15BIT_555RGB        1
+#define GDF_16BIT_565RGB        2
+#define GDF_32BIT_X888RGB       3
+#define GDF_24BIT_888RGB        4
+#define GDF__8BIT_332RGB        5
+
+#define CONFIG_VIDEO_FB_LITTLE_ENDIAN
+#define CONFIG_VIDEO_VISIBLE_COLS 720
+#define CONFIG_VIDEO_VISIBLE_ROWS 1280
+#define CONFIG_VIDEO_COLS         768
+#define CONFIG_VIDEO_PIXEL_SIZE   4
+#define CONFIG_VIDEO_DATA_FORMAT  GDF_32BIT_X888RGB /* BGR actually, but w/e */
+
+int video_get_col(void);
+int video_get_row(void);
+
+int video_init(void *fb);
+int video_resume(void *fb, int row, int col);
+void video_puts(const char *s);
+
+#endif /*_VIDEO_FB_H_ */

fusee/fusee-mtc/src/fuse.c

@@ -0,0 +1,263 @@
+/*
+ * Copyright (c) 2018-2019 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <string.h>
+#include <vapours/ams_version.h>
+
+#include "car.h"
+#include "fuse.h"
+#include "pmc.h"
+#include "timers.h"
+
+/* Prototypes for internal commands. */
+void fuse_enable_power(void);
+void fuse_disable_power(void);
+void fuse_wait_idle(void);
+
+/* Initialize the fuse driver */
+void fuse_init(void) {
+    /* Make all fuse registers visible, disable the private key and disable programming. */
+    clkrst_enable_fuse_regs(true);
+    fuse_disable_private_key();
+    fuse_disable_programming();
+}
+
+/* Disable access to the private key and set the TZ sticky bit. */
+void fuse_disable_private_key(void) {
+    volatile tegra_fuse_t *fuse = fuse_get_regs();
+    fuse->FUSE_PRIVATEKEYDISABLE = 0x10;
+}
+
+/* Disables all fuse programming. */
+void fuse_disable_programming(void) {
+    volatile tegra_fuse_t *fuse = fuse_get_regs();
+    fuse->FUSE_DISABLEREGPROGRAM = 1;
+}
+
+/* Enable power to the fuse hardware array. */
+void fuse_enable_power(void) {
+    volatile tegra_pmc_t *pmc = pmc_get_regs();
+    pmc->fuse_control &= ~(0x200);      /* Clear PMC_FUSE_CTRL_PS18_LATCH_CLEAR. */
+    mdelay(1);
+    pmc->fuse_control |= 0x100;         /* Set PMC_FUSE_CTRL_PS18_LATCH_SET. */
+    mdelay(1);
+}
+
+/* Disable power to the fuse hardware array. */
+void fuse_disable_power(void) {
+    volatile tegra_pmc_t *pmc = pmc_get_regs();
+    pmc->fuse_control &= ~(0x100);      /* Clear PMC_FUSE_CTRL_PS18_LATCH_SET. */
+    mdelay(1);
+    pmc->fuse_control |= 0x200;         /* Set PMC_FUSE_CTRL_PS18_LATCH_CLEAR. */
+    mdelay(1);
+}
+
+/* Wait for the fuse driver to go idle. */
+void fuse_wait_idle(void) {
+    volatile tegra_fuse_t *fuse = fuse_get_regs();
+    uint32_t ctrl_val = 0;
+
+    /* Wait for STATE_IDLE */
+    while ((ctrl_val & (0xF0000)) != 0x40000)
+        ctrl_val = fuse->FUSE_FUSECTRL;
+}
+
+/* Read a fuse from the hardware array. */
+uint32_t fuse_hw_read(uint32_t addr) {
+    volatile tegra_fuse_t *fuse = fuse_get_regs();
+
+    /* Wait for idle state. */
+    fuse_wait_idle();
+
+    /* Program the target address. */
+    fuse->FUSE_FUSEADDR = addr;
+
+    /* Enable read operation in control register. */
+    uint32_t ctrl_val = fuse->FUSE_FUSECTRL;
+    ctrl_val &= ~0x3;
+    ctrl_val |= 0x1;    /* Set READ command. */
+    fuse->FUSE_FUSECTRL = ctrl_val;
+
+    /* Wait for idle state. */
+    fuse_wait_idle();
+
+    return fuse->FUSE_FUSERDATA;
+}
+
+/* Write a fuse in the hardware array. */
+void fuse_hw_write(uint32_t value, uint32_t addr) {
+    volatile tegra_fuse_t *fuse = fuse_get_regs();
+
+    /* Wait for idle state. */
+    fuse_wait_idle();
+
+    /* Program the target address and value. */
+    fuse->FUSE_FUSEADDR = addr;
+    fuse->FUSE_FUSEWDATA = value;
+
+    /* Enable write operation in control register. */
+    uint32_t ctrl_val = fuse->FUSE_FUSECTRL;
+    ctrl_val &= ~0x3;
+    ctrl_val |= 0x2;    /* Set WRITE command. */
+    fuse->FUSE_FUSECTRL = ctrl_val;
+
+    /* Wait for idle state. */
+    fuse_wait_idle();
+}
+
+/* Sense the fuse hardware array into the shadow cache. */
+void fuse_hw_sense(void) {
+    volatile tegra_fuse_t *fuse = fuse_get_regs();
+
+    /* Wait for idle state. */
+    fuse_wait_idle();
+
+    /* Enable sense operation in control register */
+    uint32_t ctrl_val = fuse->FUSE_FUSECTRL;
+    ctrl_val &= ~0x3;
+    ctrl_val |= 0x3;    /* Set SENSE_CTRL command */
+    fuse->FUSE_FUSECTRL = ctrl_val;
+
+    /* Wait for idle state. */
+    fuse_wait_idle();
+}
+
+/* Read the SKU info register from the shadow cache. */
+uint32_t fuse_get_sku_info(void) {
+    volatile tegra_fuse_chip_t *fuse_chip = fuse_chip_get_regs();
+    return fuse_chip->FUSE_SKU_INFO;
+}
+
+/* Read the bootrom patch version from a register in the shadow cache. */
+uint32_t fuse_get_bootrom_patch_version(void) {
+    volatile tegra_fuse_chip_t *fuse_chip = fuse_chip_get_regs();
+    return fuse_chip->FUSE_SOC_SPEEDO_1_CALIB;
+}
+
+/* Read a spare bit register from the shadow cache */
+uint32_t fuse_get_spare_bit(uint32_t idx) {
+    if (idx < 32) {
+        volatile tegra_fuse_chip_t *fuse_chip = fuse_chip_get_regs();
+        return fuse_chip->FUSE_SPARE_BIT[idx];
+    } else {
+        return 0;
+    }
+}
+
+/* Read a reserved ODM register from the shadow cache. */
+uint32_t fuse_get_reserved_odm(uint32_t idx) {
+    if (idx < 8) {
+        volatile tegra_fuse_chip_t *fuse_chip = fuse_chip_get_regs();
+        return fuse_chip->FUSE_RESERVED_ODM[idx];
+    } else {
+        return 0;
+    }
+}
+
+/* Get the DRAM ID using values in the shadow cache. */
+uint32_t fuse_get_dram_id(void) {
+    return ((fuse_get_reserved_odm(4) >> 3) & 0x7);
+}
+
+/* Derive the Device ID using values in the shadow cache. */
+uint64_t fuse_get_device_id(void) {
+    volatile tegra_fuse_chip_t *fuse_chip = fuse_chip_get_regs();
+
+    uint64_t device_id = 0;
+    uint64_t y_coord = fuse_chip->FUSE_OPT_Y_COORDINATE & 0x1FF;
+    uint64_t x_coord = fuse_chip->FUSE_OPT_X_COORDINATE & 0x1FF;
+    uint64_t wafer_id = fuse_chip->FUSE_OPT_WAFER_ID & 0x3F;
+    uint32_t lot_code = fuse_chip->FUSE_OPT_LOT_CODE_0;
+    uint64_t fab_code = fuse_chip->FUSE_OPT_FAB_CODE & 0x3F;
+
+    uint64_t derived_lot_code = 0;
+    for (unsigned int i = 0; i < 5; i++) {
+        derived_lot_code = (derived_lot_code * 0x24) + ((lot_code >> (24 - 6*i)) & 0x3F);
+    }
+    derived_lot_code &= 0x03FFFFFF;
+
+    device_id |= y_coord << 0;
+    device_id |= x_coord << 9;
+    device_id |= wafer_id << 18;
+    device_id |= derived_lot_code << 24;
+    device_id |= fab_code << 50;
+
+    return device_id;
+}
+
+/* Derive the Hardware Type using values in the shadow cache. */
+uint32_t fuse_get_hardware_type(uint32_t target_firmware) {
+    uint32_t fuse_reserved_odm4 = fuse_get_reserved_odm(4);
+    uint32_t hardware_type = (((fuse_reserved_odm4 >> 7) & 2) | ((fuse_reserved_odm4 >> 2) & 1));
+
+    /* Firmware from versions 1.0.0 to 3.0.2. */
+    if (target_firmware < ATMOSPHERE_TARGET_FIRMWARE_400) {
+        volatile tegra_fuse_chip_t *fuse_chip = fuse_chip_get_regs();
+        if (hardware_type >= 1) {
+            return (hardware_type > 2) ? 3 : hardware_type - 1;
+        } else if ((fuse_chip->FUSE_SPARE_BIT[9] & 1) == 0) {
+            return 0;
+        } else {
+            return 3;
+        }
+    } else if (target_firmware < ATMOSPHERE_TARGET_FIRMWARE_700) {      /* Firmware versions from 4.0.0 to 6.2.0. */
+        static const uint32_t types[] = {0,1,4,3};
+        hardware_type |= ((fuse_reserved_odm4 >> 14) & 0x3C);
+        hardware_type--;
+        return (hardware_type > 3) ? 4 : types[hardware_type];
+    } else {    /* Firmware versions from 7.0.0 onwards. */
+        /* Always return 0 in retail. */
+        return 0;
+    }
+}
+
+/* Derive the Retail Type using values in the shadow cache. */
+uint32_t fuse_get_retail_type(void) {
+    /* Retail Type = IS_RETAIL | UNIT_TYPE. */
+    uint32_t fuse_reserved_odm4 = fuse_get_reserved_odm(4);
+    uint32_t retail_type = (((fuse_reserved_odm4 >> 7) & 4) | (fuse_reserved_odm4 & 3));
+    if (retail_type == 4) { /* Standard retail unit, IS_RETAIL | 0. */
+        return 1;
+    } else if (retail_type == 3) { /* Standard dev unit, 0 | DEV_UNIT. */
+        return 0;
+    }
+    return 2; /* IS_RETAIL | DEV_UNIT */
+}
+
+/* Derive the 16-byte Hardware Info using values in the shadow cache, and copy to output buffer. */
+void fuse_get_hardware_info(void *dst) {
+    volatile tegra_fuse_chip_t *fuse_chip = fuse_chip_get_regs();
+    uint32_t hw_info[0x4];
+
+    uint32_t ops_reserved = fuse_chip->FUSE_OPT_OPS_RESERVED & 0x3F;
+    uint32_t y_coord = fuse_chip->FUSE_OPT_Y_COORDINATE & 0x1FF;
+    uint32_t x_coord = fuse_chip->FUSE_OPT_X_COORDINATE & 0x1FF;
+    uint32_t wafer_id = fuse_chip->FUSE_OPT_WAFER_ID & 0x3F;
+    uint32_t lot_code_0 = fuse_chip->FUSE_OPT_LOT_CODE_0;
+    uint32_t lot_code_1 = fuse_chip->FUSE_OPT_LOT_CODE_1 & 0x0FFFFFFF;
+    uint32_t fab_code = fuse_chip->FUSE_OPT_FAB_CODE & 0x3F;
+    uint32_t vendor_code = fuse_chip->FUSE_OPT_VENDOR_CODE & 0xF;
+
+    /* Hardware Info = OPS_RESERVED || Y_COORD || X_COORD || WAFER_ID || LOT_CODE || FAB_CODE || VENDOR_ID */
+    hw_info[0] = (uint32_t)((lot_code_1 << 30) | (wafer_id << 24) | (x_coord << 15) | (y_coord << 6) | (ops_reserved));
+    hw_info[1] = (uint32_t)((lot_code_0 << 26) | (lot_code_1 >> 2));
+    hw_info[2] = (uint32_t)((fab_code << 26) | (lot_code_0 >> 6));
+    hw_info[3] = (uint32_t)(vendor_code);
+
+    memcpy(dst, hw_info, 0x10);
+}