Bump version to v4.10.0

Additionally, allow pkg1 to be dumped if unknown fw version.

Makefile

@@ -4,88 +4,106 @@ endif
 
 include $(DEVKITARM)/base_rules
 
+################################################################################
+
+IPL_LOAD_ADDR := 0x40008000
+IPL_MAGIC := 0x43544349 #"ICTC"
+BLVERSION_MAJOR := 4
+BLVERSION_MINOR := 10
+BLVERSION_HOTFX := 0
+
+BL_RESERVED := 0
+
+################################################################################
+
 TARGET := hekate
-BUILD := build
-OUTPUT := output
+BUILDDIR := build
+OUTPUTDIR := output
 SOURCEDIR = bootloader
 VPATH = $(dir $(wildcard ./$(SOURCEDIR)/*/)) $(dir $(wildcard ./$(SOURCEDIR)/*/*/))
 
-OBJS = $(addprefix $(BUILD)/$(TARGET)/, \
+# Main and graphics.
+OBJS = $(addprefix $(BUILDDIR)/$(TARGET)/, \
 	start.o \
-	main.o \
-	config.o \
-	btn.o \
-	clock.o \
-	cluster.o \
-	fuse.o \
-	gpio.o \
-	heap.o \
-	hos.o \
-	i2c.o \
-	kfuse.o \
-	bq24193.o \
-	max7762x.o \
-	max17050.o \
-	mc.o \
-	nx_emmc.o \
-	sdmmc.o \
-	sdmmc_driver.o \
-	sdram.o \
-	tui.o \
-	util.o \
-	di.o \
-	gfx.o \
-	pinmux.o \
-	pkg1.o \
-	pkg2.o \
-	se.o \
-	tsec.o \
-	uart.o \
-	dirlist.o \
-	ini.o \
-	ianos.o \
+	main.o heap.o \
+	gfx.o tui.o \
+	fe_emmc_tools.o fe_info.o fe_tools.o \
 )
 
-OBJS += $(addprefix $(BUILD)/$(TARGET)/, \
+# Hardware.
+OBJS += $(addprefix $(BUILDDIR)/$(TARGET)/, \
+	clock.o cluster.o di.o gpio.o i2c.o mc.o sdram.o pinmux.o se.o smmu.o tsec.o uart.o \
+	fuse.o kfuse.o \
+	sdmmc.o sdmmc_driver.o \
+	bq24193.o max17050.o max7762x.o max77620-rtc.o \
+	hw_init.o \
+)
+
+# Utilities.
+OBJS += $(addprefix $(BUILDDIR)/$(TARGET)/, \
+	btn.o dirlist.o ianos.o util.o \
+	config.o ini.o \
+)
+
+# Horizon.
+OBJS += $(addprefix $(BUILDDIR)/$(TARGET)/, \
+	nx_emmc.o \
+	hos.o hos_config.o pkg1.o pkg2.o fss.o secmon_exo.o sept.o \
+)
+
+# Libraries.
+OBJS += $(addprefix $(BUILDDIR)/$(TARGET)/, \
 	lz.o blz.o \
 	diskio.o ff.o ffunicode.o ffsystem.o \
 	elfload.o elfreloc_arm.o \
 )
 
+################################################################################
+
+CUSTOMDEFINES := -DIPL_LOAD_ADDR=$(IPL_LOAD_ADDR) -DBL_MAGIC=$(IPL_MAGIC)
+CUSTOMDEFINES += -DBL_VER_MJ=$(BLVERSION_MAJOR) -DBL_VER_MN=$(BLVERSION_MINOR) -DBL_VER_HF=$(BLVERSION_HOTFX) -DBL_RESERVED=$(BL_RESERVED)
+CUSTOMDEFINES += -DMENU_LOGO_ENABLE
+
+# 0: UART_A, 1: UART_B.
+#CUSTOMDEFINES += -DDEBUG_UART_PORT=0
+
+#CUSTOMDEFINES += -DDEBUG
+
 ARCH := -march=armv4t -mtune=arm7tdmi -mthumb -mthumb-interwork
-CUSTOMDEFINES := -DMENU_LOGO_ENABLE #-DDEBUG
 CFLAGS = $(ARCH) -O2 -nostdlib -ffunction-sections -fdata-sections -fomit-frame-pointer -fno-inline -std=gnu11 -Wall $(CUSTOMDEFINES)
-LDFLAGS = $(ARCH) -nostartfiles -lgcc -Wl,--nmagic,--gc-sections
+LDFLAGS = $(ARCH) -nostartfiles -lgcc -Wl,--nmagic,--gc-sections -Xlinker --defsym=IPL_LOAD_ADDR=$(IPL_LOAD_ADDR)
 
 MODULEDIRS := $(wildcard modules/*)
 
+################################################################################
+
 .PHONY: all clean $(MODULEDIRS)
 
 all: $(TARGET).bin
 	@echo -n "Payload size is "
-	@wc -c < $(OUTPUT)/$(TARGET).bin
+	@wc -c < $(OUTPUTDIR)/$(TARGET).bin
 	@echo "Max size is 126296 Bytes."
 
 clean:
 	@rm -rf $(OBJS)
-	@rm -rf $(BUILD)
-	@rm -rf $(OUTPUT)
+	@rm -rf $(BUILDDIR)
+	@rm -rf $(OUTPUTDIR)
 
 $(MODULEDIRS):
 	$(MAKE) -C $@ $(MAKECMDGOALS)
 
-$(TARGET).bin: $(BUILD)/$(TARGET)/$(TARGET).elf $(MODULEDIRS)
-	$(OBJCOPY) -S -O binary $< $(OUTPUT)/$@
-	@printf ICTC$(BLVERSION_MAJOR)$(BLVERSION_MINOR) >> $(OUTPUT)/$@
+$(TARGET).bin: $(BUILDDIR)/$(TARGET)/$(TARGET).elf $(MODULEDIRS)
+	$(OBJCOPY) -S -O binary $< $(OUTPUTDIR)/$@
+	@printf ICTC49 >> $(OUTPUTDIR)/$@
 
-$(BUILD)/$(TARGET)/$(TARGET).elf: $(OBJS)
+$(BUILDDIR)/$(TARGET)/$(TARGET).elf: $(OBJS)
 	$(CC) $(LDFLAGS) -T $(SOURCEDIR)/link.ld $^ -o $@
 
-$(BUILD)/$(TARGET)/%.o: %.c
+$(BUILDDIR)/$(TARGET)/%.o: %.c
 	$(CC) $(CFLAGS) -c $< -o $@
 
-$(BUILD)/$(TARGET)/%.o: %.S
-	@mkdir -p "$(BUILD)"
-	@mkdir -p "$(BUILD)/$(TARGET)"
-	@mkdir -p "$(OUTPUT)"
+$(BUILDDIR)/$(TARGET)/%.o: %.S
+	@mkdir -p "$(BUILDDIR)"
+	@mkdir -p "$(BUILDDIR)/$(TARGET)"
+	@mkdir -p "$(OUTPUTDIR)"
 	$(CC) $(CFLAGS) -c $< -o $@

README.md

@@ -20,6 +20,8 @@ Custom Nintendo Switch bootloader, firmware patcher, and more.
 | bootloader/payloads/ | For payloads. 'Payloads...' menu. Autoboot only supported by including them into an ini. All CFW bootloaders, tools, Linux payloads are supported. |
 | bootloader/libtools/ | Future reserved                                                       |
 
+**Note**: Sept files for booting 7.0.0 and up are expected at /sept folder at root of sd card.
+
 
 ## Bootloader configuration
 
@@ -29,14 +31,17 @@ The bootloader can be configured via 'bootloader/hekate_ipl.ini' (if it is prese
 There are four possible type of entries. "**[ ]**": Boot entry, "**{ }**": Caption, "**#**": Comment, "*newline*": .ini cosmetic newline.
 
 
-### Configuration keys/values when boot entry is **config**:
+### Global Configuration keys/values when boot entry is **config**:
 
 | Config option      | Description                                                |
 | ------------------ | ---------------------------------------------------------- |
 | autoboot=0         | 0: Disable, #: Boot entry number to auto boot.             |
-| bootwait=3         | 0: Disable (Having VOL- pressed since injection goes to menu. It also disables bootlogo.), #: Time to wait for **VOL-** to enter menu. |
-| customlogo=0       | 0: Use default hekate bootlogo, 1: Use bootlogo.bmp.       |
+| autoboot_list=0    | 0: Read `autoboot` boot entry from hekate_ipl.ini, 1: Read from ini folder (ini files are ASCII ordered). |
+| bootwait=3         | 0: Disable (It also disables bootlogo. Having **VOL-** pressed since injection goes to menu.), #: Time to wait for **VOL-** to enter menu. |
 | verification=2     | 0: Disable Backup/Restore verification, 1: Sparse (block based, fast and not 100% reliable), 2: Full (sha256 based, slow and 100% reliable). |
+| autohosoff=1       | 0: Disable, 1: If woke up from HOS via an RTC alarm, shows logo, then powers off completely, 2: No logo, immediately powers off.|
+| autonogc=1         | 0: Disable, 1: Automatically applies nogc patch if unburnt fuses found and a >= 4.0.0 HOS is booted. |
+| backlight=100      | Screen backlight level. 0-255.                             |
 
 
 ### Possible boot entry key/value combinations:
@@ -48,15 +53,40 @@ There are four possible type of entries. "**[ ]**": Boot entry, "**{ }**": Capti
 | secmon={SD path}   | Replaces the security monitor binary                       |
 | kernel={SD path}   | Replaces the kernel binary                                 |
 | kip1={SD path}     | Replaces/Adds kernel initial process. Multiple can be set. |
-| kip1patch=patchname| Enables a kip1 patch. Specify with multiple lines and/or as CSV. Implemented patches right now are nosigchk,nogc |
-| fullsvcperm=1      | Disables SVC verification                                  |
-| debugmode=1        | Enables Debug mode                                         |
+| kip1={SD folder}/* | Loads every .kip/.kip1 inside a folder. Compatible with single kip1 keys. |
+| fss0={SD path}     | Takes a fusee-secondary binary and extracts all needed parts from it. |
+| kip1patch=patchname| Enables a kip1 patch. Specify with multiple lines and/or as CSV. Current available patches nosigchk. |
+| fullsvcperm=1      | Disables SVC verification (full services permission)       |
+| debugmode=1        | Enables Debug mode. Obsolete when used with exosphere as secmon. |
 | atmosphere=1       | Enables Atmosphère patching                                |
+| stock=1            | Disables unneeded kernel patching when running stock or semi-stock. |
 | payload={SD path}  | Payload launching. Tools, Linux, CFW bootloaders, etc.     |
 
+**Note1**: When using the wildcard (`/*`) with `kip1` you can still use the normal `kip1` after that to load extra single kips.
+
+**Note2**: When using FSS0 it parses exosphere, warmboot and all core kips. You can override the first 2 by using `secmon`/`warmboot` after defining `fss0`.
+You can define `kip1` to load an extra kip or many via the wildcard (`/*`) usage.
+
+**Warning**: Never define core kips when using `fss0` and make sure that the folder (when using `/*`), does not include them.
+
+
+### Payload storage:
+
+Hekate now has a new storage in the binary that helps it configure it outside of BPMP enviroment:
+
+| Offset / Name        | Description                                                       |
+| -------------------- | ----------------------------------------------------------------- |
+| '0x94' boot_cfg      | bit0: Force AutoBoot, bit1: Show launch log, bit2: sept run.      |
+| '0x95' autoboot      | If `Force AutoBoot`: 0: Force go to menu, else boot that entry.   |
+| '0x96' autoboot_list | If `Force AutoBoot` and `autoboot` then it boots from ini folder. |
+| '0x97' extra_cfg     | Reserved.                                                         |
+| '0x98' rsvd[128]     | Reserved.                                                         |
+
 
 You can find a template [Here](./res/hekate_ipl_template.ini)
 
+If the main .ini is not found, it is created on the first hekate boot.
+
 
 ```
 hekate     (C) 2018 naehrwert, st4rk

bootloader/config/config.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 CTCaer
+ * Copyright (c) 2018-2019 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -17,20 +17,15 @@
 #include <string.h>
 #include <stdlib.h>
 
-#include "../utils/btn.h"
 #include "config.h"
-#include "../libs/fatfs/ff.h"
 #include "ini.h"
-#include "../utils/list.h"
-#include "../gfx/tui.h"
-#include "../utils/util.h"
 #include "../gfx/gfx.h"
-
-extern gfx_ctxt_t gfx_ctxt;
-extern gfx_con_t gfx_con;
-//TODO: Create more macros (info, header, debug, etc) with different colors and utilize them for consistency.
-#define EPRINTF(text) gfx_printf(&gfx_con, "%k"text"%k\n", 0xFFFF0000, 0xFFCCCCCC)
-#define EPRINTFARGS(text, args...) gfx_printf(&gfx_con, "%k"text"%k\n", 0xFFFF0000, args, 0xFFCCCCCC)
+#include "../gfx/tui.h"
+#include "../libs/fatfs/ff.h"
+#include "../soc/t210.h"
+#include "../utils/btn.h"
+#include "../utils/list.h"
+#include "../utils/util.h"
 
 extern hekate_config h_cfg;
 extern int sd_mount();
@@ -41,10 +36,15 @@ void set_default_configuration()
 	h_cfg.autoboot = 0;
 	h_cfg.autoboot_list = 0;
 	h_cfg.bootwait = 3;
-	h_cfg.customlogo = 0;
-	h_cfg.verification = 2;
+	h_cfg.verification = 1;
 	h_cfg.se_keygen_done = 0;
 	h_cfg.sbar_time_keeping = 0;
+	h_cfg.backlight = 100;
+	h_cfg.autohosoff = 0;
+	h_cfg.errors = 0;
+	h_cfg.autonogc = 1;
+	h_cfg.sept_run = EMC(EMC_SCRATCH0) & EMC_SEPT_RUN;
+	h_cfg.rcm_patched = true;
 }
 
 int create_config_entry()
@@ -54,31 +54,58 @@ int create_config_entry()
 
 	char lbuf[16];
 	FIL fp;
+	bool mainIniFound = false;
 
 	LIST_INIT(ini_sections);
 
 	if (ini_parse(&ini_sections, "bootloader/hekate_ipl.ini", false))
+		mainIniFound = true;
+	else
 	{
-		if (f_open(&fp, "bootloader/hekate_ipl.ini", FA_WRITE | FA_CREATE_ALWAYS) != FR_OK)
-			return 0;
-		// Add config entry.
-		f_puts("[config]\nautoboot=", &fp);
-		itoa(h_cfg.autoboot, lbuf, 10);
-		f_puts(lbuf, &fp);
-		f_puts("\nautoboot_list=", &fp);
-		itoa(h_cfg.autoboot_list, lbuf, 10);
-		f_puts(lbuf, &fp);
-		f_puts("\nbootwait=", &fp);
-		itoa(h_cfg.bootwait, lbuf, 10);
-		f_puts(lbuf, &fp);
-		f_puts("\ncustomlogo=", &fp);
-		itoa(h_cfg.customlogo, lbuf, 10);
-		f_puts(lbuf, &fp);
-		f_puts("\nverification=", &fp);
-		itoa(h_cfg.verification, lbuf, 10);
-		f_puts(lbuf, &fp);
-		f_puts("\n", &fp);
+		u8 res = f_open(&fp, "bootloader/hekate_ipl.ini", FA_READ);
+		if (res == FR_NO_FILE || res == FR_NO_PATH)
+		{
+			f_mkdir("bootloader");
+			f_mkdir("bootloader/ini");
+			f_mkdir("bootloader/payloads");
+			f_mkdir("bootloader/sys");
+		}
+		else
+		{
+			if (!res)
+				f_close(&fp);
+			return 1;
+		}
+	}
 
+	if (f_open(&fp, "bootloader/hekate_ipl.ini", FA_WRITE | FA_CREATE_ALWAYS) != FR_OK)
+		return 1;
+	// Add config entry.
+	f_puts("[config]\nautoboot=", &fp);
+	itoa(h_cfg.autoboot, lbuf, 10);
+	f_puts(lbuf, &fp);
+	f_puts("\nautoboot_list=", &fp);
+	itoa(h_cfg.autoboot_list, lbuf, 10);
+	f_puts(lbuf, &fp);
+	f_puts("\nbootwait=", &fp);
+	itoa(h_cfg.bootwait, lbuf, 10);
+	f_puts(lbuf, &fp);
+	f_puts("\nverification=", &fp);
+	itoa(h_cfg.verification, lbuf, 10);
+	f_puts(lbuf, &fp);
+	f_puts("\nbacklight=", &fp);
+	itoa(h_cfg.backlight, lbuf, 10);
+	f_puts(lbuf, &fp);
+	f_puts("\nautohosoff=", &fp);
+	itoa(h_cfg.autohosoff, lbuf, 10);
+	f_puts(lbuf, &fp);
+	f_puts("\nautonogc=", &fp);
+	itoa(h_cfg.autonogc, lbuf, 10);
+	f_puts(lbuf, &fp);
+	f_puts("\n", &fp);
+
+	if (mainIniFound)
+	{
 		// Re-construct existing entries.
 		LIST_FOREACH_ENTRY(ini_sec_t, ini_sec, &ini_sections, link)
 		{
@@ -115,22 +142,33 @@ int create_config_entry()
 				break;
 			}
 		}
-
-		f_close(&fp);
-		sd_unmount();
 	}
-	else
-		return 1;
 
-	ini_free(&ini_sections);
+	f_close(&fp);
+	sd_unmount();
+
+	if (mainIniFound)
+		ini_free(&ini_sections);
 
 	return 0;
 }
 
-void _config_autoboot_list()
+static void _save_config()
 {
-	gfx_clear_grey(&gfx_ctxt, 0x1B);
-	gfx_con_setpos(&gfx_con, 0, 0);
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	if (!create_config_entry())
+		gfx_puts("\nConfiguration was saved!\n");
+	else
+		EPRINTF("\nConfiguration saving failed!");
+	gfx_puts("\nPress any key...");
+}
+
+static void _config_autoboot_list(void *ent)
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
 
 	u32 *temp_autoboot = NULL;
 
@@ -173,7 +211,7 @@ void _config_autoboot_list()
 
 						else
 							boot_text[(i - 1) * 512] = '*';
-						memcpy(boot_text + (i - 1) * 512 + 1, ini_sec->name, strlen(ini_sec->name));
+						memcpy(boot_text + (i - 1) * 512 + 1, ini_sec->name, strlen(ini_sec->name) + 1);
 						boot_text[strlen(ini_sec->name) + (i - 1) * 512 + 1] = 0;
 						ments[i].caption = &boot_text[(i - 1) * 512];
 					}
@@ -185,35 +223,25 @@ void _config_autoboot_list()
 						break;
 				}
 			}
-			if (i < 3)
-			{
-				EPRINTF("No launch configurations found.");
-				goto out;
-			}
 
 			memset(&ments[i], 0, sizeof(ment_t));
-			menu_t menu = {ments, "Select a list entry to auto boot", 0, 0};
-			temp_autoboot = (u32 *)tui_do_menu(&gfx_con, &menu);
+			menu_t menu = {ments, "Select an entry to auto boot", 0, 0};
+			temp_autoboot = (u32 *)tui_do_menu(&menu);
 			if (temp_autoboot != NULL)
 			{
-				gfx_clear_grey(&gfx_ctxt, 0x1B);
-				gfx_con_setpos(&gfx_con, 0, 0);
-
 				h_cfg.autoboot = *(u32 *)temp_autoboot;
 				h_cfg.autoboot_list = 1;
-				// Save choice to ini file.
-				if (!create_config_entry())
-					gfx_puts(&gfx_con, "\nConfiguration was saved!\n");
-				else
-					EPRINTF("\nConfiguration saving failed!");
-				gfx_puts(&gfx_con, "\nPress any key...");
+				_save_config();
+
+				ment_t *tmp = (ment_t *)ent;
+				tmp->data = NULL;
 			}
 			else
 				goto out2;
 		}
 		else
 		{
-			EPRINTF("Could not open 'bootloader/hekate_ipl.ini'.\nMake sure it exists in SD Card!.");
+			EPRINTF("Could not open 'bootloader/hekate_ipl.ini'.\nMake sure it exists!.");
 			goto out;
 		}
 	}
@@ -227,15 +255,12 @@ out2:;
 	ini_free(&ini_sections);
 
 	sd_unmount();
-
-	if (temp_autoboot == NULL)
-		return;
 }
 
 void config_autoboot()
 {
-	gfx_clear_grey(&gfx_ctxt, 0x1B);
-	gfx_con_setpos(&gfx_con, 0, 0);
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
 
 	u32 *temp_autoboot = NULL;
 
@@ -260,20 +285,20 @@ void config_autoboot()
 
 			ments[1].type = MENT_CHGLINE;
 
-			ments[2].type = MENT_CHOICE;
+			ments[2].type = MENT_DATA;
 			if (!h_cfg.autoboot)
 				ments[2].caption = "*Disable";
 			else
 				ments[2].caption = " Disable";
 			ments[2].data = &boot_values[0];
 
-			ments[3].type = MENT_HANDLER;
+			ments[3].type = MENT_HDLR_RE;
 			if (h_cfg.autoboot_list)
 				ments[3].caption = "*More configs...";
 			else
 				ments[3].caption = " More configs...";
 			ments[3].handler = _config_autoboot_list;
-			ments[3].data = NULL;
+			ments[3].data = (void *)0xCAFE;
 
 			ments[4].type = MENT_CHGLINE;
 
@@ -295,7 +320,7 @@ void config_autoboot()
 
 						else
 							boot_text[(i - 4) * 512] = '*';
-						memcpy(boot_text + (i - 4) * 512 + 1, ini_sec->name, strlen(ini_sec->name));
+						memcpy(boot_text + (i - 4) * 512 + 1, ini_sec->name, strlen(ini_sec->name) + 1);
 						boot_text[strlen(ini_sec->name) + (i - 4) * 512 + 1] = 0;
 						ments[i].caption = &boot_text[(i - 4) * 512];
 					}
@@ -309,33 +334,27 @@ void config_autoboot()
 			}
 			if (i < 6 && !h_cfg.autoboot_list)
 			{
-				EPRINTF("No launch configurations found.");
-				goto out;
+				ments[i].type = MENT_CAPTION;
+				ments[i].caption = "No main configurations found...";
+				ments[i].color = 0xFFFFDD00;
+				i++;
 			}
 
 			memset(&ments[i], 0, sizeof(ment_t));
 			menu_t menu = {ments, "Disable or select entry to auto boot", 0, 0};
-			temp_autoboot = (u32 *)tui_do_menu(&gfx_con, &menu);
+			temp_autoboot = (u32 *)tui_do_menu(&menu);
 			if (temp_autoboot != NULL)
 			{
-				gfx_clear_grey(&gfx_ctxt, 0x1B);
-				gfx_con_setpos(&gfx_con, 0, 0);
-
 				h_cfg.autoboot = *(u32 *)temp_autoboot;
 				h_cfg.autoboot_list = 0;
-				// Save choice to ini file.
-				if (!create_config_entry())
-					gfx_puts(&gfx_con, "\nConfiguration was saved!\n");
-				else
-					EPRINTF("\nConfiguration saving failed!");
-				gfx_puts(&gfx_con, "\nPress any key...");
+				_save_config();
 			}
 			else
 				goto out2;
 		}
 		else
 		{
-			EPRINTF("Could not open 'bootloader/hekate_ipl.ini'.\nMake sure it exists in SD Card!.");
+			EPRINTF("Could not open 'bootloader/hekate_ipl.ini'.\nMake sure it exists!.");
 			goto out;
 		}
 	}
@@ -356,8 +375,8 @@ out2:;
 
 void config_bootdelay()
 {
-	gfx_clear_grey(&gfx_ctxt, 0x1B);
-	gfx_con_setpos(&gfx_con, 0, 0);
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
 
 	u32 delay_entries = 6;
 
@@ -373,7 +392,7 @@ void config_bootdelay()
 
 	ments[1].type = MENT_CHGLINE;
 
-	ments[2].type = MENT_CHOICE;
+	ments[2].type = MENT_DATA;
 	if (h_cfg.bootwait)
 		ments[2].caption = " 0 seconds (Bootlogo disabled)";
 	else
@@ -390,7 +409,7 @@ void config_bootdelay()
 		delay_text[i * 32 + 1] = i + '0';
 		memcpy(delay_text + i * 32 + 2, " seconds", 9);
 
-		ments[i + 2].type = MENT_CHOICE;
+		ments[i + 2].type = MENT_DATA;
 		ments[i + 2].caption = delay_text + i * 32;
 		ments[i + 2].data = &delay_values[i];
 	}
@@ -398,19 +417,11 @@ void config_bootdelay()
 	memset(&ments[i + 2], 0, sizeof(ment_t));
 	menu_t menu = {ments, "Time delay for entering bootloader menu", 0, 0};
 
-	u32 *temp_bootwait = (u32 *)tui_do_menu(&gfx_con, &menu);
+	u32 *temp_bootwait = (u32 *)tui_do_menu(&menu);
 	if (temp_bootwait != NULL)
 	{
-		gfx_clear_grey(&gfx_ctxt, 0x1B);
-		gfx_con_setpos(&gfx_con, 0, 0);
-
 		h_cfg.bootwait = *(u32 *)temp_bootwait;
-		// Save choice to ini file.
-		if (!create_config_entry())
-			gfx_puts(&gfx_con, "\nConfiguration was saved!\n");
-		else
-			EPRINTF("\nConfiguration saving failed!");
-		gfx_puts(&gfx_con, "\nPress any key...");
+		_save_config();
 	}
 
 	free(ments);
@@ -422,68 +433,10 @@ void config_bootdelay()
 	btn_wait();
 }
 
-void config_customlogo()
-{
-	gfx_clear_grey(&gfx_ctxt, 0x1B);
-	gfx_con_setpos(&gfx_con, 0, 0);
-
-	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * 5);
-	u32 *cb_values = (u32 *)malloc(sizeof(u32) * 2);
-
-	for (u32 j = 0; j < 2; j++)
-	{
-		cb_values[j] = j;
-		ments[j + 2].type = MENT_CHOICE;
-		ments[j + 2].data = &cb_values[j];
-	}
-
-	ments[0].type = MENT_BACK;
-	ments[0].caption = "Back";
-
-	ments[1].type = MENT_CHGLINE;
-
-	if (h_cfg.customlogo)
-	{
-		ments[2].caption = " Disable";
-		ments[3].caption = "*Enable";
-
-	}
-	else
-	{
-		ments[2].caption = "*Disable";
-		ments[3].caption = " Enable";
-	}
-
-	memset(&ments[4], 0, sizeof(ment_t));
-	menu_t menu = {ments, "Custom bootlogo", 0, 0};
-
-	u32 *temp_customlogo = (u32 *)tui_do_menu(&gfx_con, &menu);
-	if (temp_customlogo != NULL)
-	{
-		gfx_clear_grey(&gfx_ctxt, 0x1B);
-		gfx_con_setpos(&gfx_con, 0, 0);
-
-		h_cfg.customlogo = *(u32 *)temp_customlogo;
-		// Save choice to ini file.
-		if (!create_config_entry())
-			gfx_puts(&gfx_con, "\nConfiguration was saved!\n");
-		else
-			EPRINTF("\nConfiguration saving failed!");
-		gfx_puts(&gfx_con, "\nPress any key...");
-	}
-
-	free(ments);
-	free(cb_values);
-
-	if (temp_customlogo == NULL)
-		return;
-	btn_wait();
-}
-
 void config_verification()
 {
-	gfx_clear_grey(&gfx_ctxt, 0x1B);
-	gfx_con_setpos(&gfx_con, 0, 0);
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
 
 	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * 6);
 	u32 *vr_values = (u32 *)malloc(sizeof(u32) * 3);
@@ -492,7 +445,7 @@ void config_verification()
 	for (u32 j = 0; j < 3; j++)
 	{
 		vr_values[j] = j;
-		ments[j + 2].type = MENT_CHOICE;
+		ments[j + 2].type = MENT_DATA;
 		ments[j + 2].data = &vr_values[j];
 	}
 
@@ -501,40 +454,27 @@ void config_verification()
 
 	ments[1].type = MENT_CHGLINE;
 
-	memcpy(vr_text,       " Disable", 9);
-	memcpy(vr_text + 64,  " Sparse (Fast - Not  reliable)", 31);
-	memcpy(vr_text + 128, " Full   (Slow - 100% reliable)", 31);
+	memcpy(vr_text,       " Disable (Fastest - Unsafe)", 28);
+	memcpy(vr_text + 64,  " Sparse  (Fast - Safe)", 23);
+	memcpy(vr_text + 128, " Full    (Slow - Safe)", 23);
 
 	for (u32 i = 0; i < 3; i++)
 	{
 		if (h_cfg.verification != i)
-		{
 			vr_text[64 * i] = ' ';
-			ments[2 + i].caption = vr_text + (i * 64);
-		}
 		else
-		{
 			vr_text[64 * i] = '*';
-			ments[2 + i].caption = vr_text + (i * 64);
-		}
+		ments[2 + i].caption = vr_text + (i * 64);
 	}
 
 	memset(&ments[5], 0, sizeof(ment_t));
 	menu_t menu = {ments, "Backup & Restore verification", 0, 0};
 
-	u32 *temp_verification = (u32 *)tui_do_menu(&gfx_con, &menu);
+	u32 *temp_verification = (u32 *)tui_do_menu(&menu);
 	if (temp_verification != NULL)
 	{
-		gfx_clear_grey(&gfx_ctxt, 0x1B);
-		gfx_con_setpos(&gfx_con, 0, 0);
-
 		h_cfg.verification = *(u32 *)temp_verification;
-		// Save choice to ini file.
-		if (!create_config_entry())
-			gfx_puts(&gfx_con, "\nConfiguration was saved!\n");
-		else
-			EPRINTF("\nConfiguration saving failed!");
-		gfx_puts(&gfx_con, "\nPress any key...");
+		_save_config();
 	}
 
 	free(ments);
@@ -545,3 +485,168 @@ void config_verification()
 		return;
 	btn_wait();
 }
+
+void config_backlight()
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	u32 bri_entries = 11;
+
+	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (bri_entries + 3));
+	u32 *bri_values = (u32 *)malloc(sizeof(u32) * bri_entries);
+	char *bri_text = (char *)malloc(8 * bri_entries);
+
+	for (u32 j = 1; j < bri_entries; j++)
+		bri_values[j] = j * 10;
+
+	ments[0].type = MENT_BACK;
+	ments[0].caption = "Back";
+
+	ments[1].type = MENT_CHGLINE;
+
+	u32 i = 0;
+	for (i = 1; i < bri_entries; i++)
+	{
+		if ((h_cfg.backlight / 20) != i)
+			bri_text[i * 32] = ' ';
+		else
+			bri_text[i * 32] = '*';
+		
+		if (i < 10)
+		{
+			bri_text[i * 32 + 1] = i + '0';
+			memcpy(bri_text + i * 32 + 2, "0%", 3);
+		}
+		else
+			memcpy(bri_text + i * 32 + 1, "100%", 5);
+
+		ments[i + 1].type = MENT_DATA;
+		ments[i + 1].caption = bri_text + i * 32;
+		ments[i + 1].data = &bri_values[i];
+	}
+
+	memset(&ments[i + 1], 0, sizeof(ment_t));
+	menu_t menu = {ments, "Backlight brightness", 0, 0};
+
+	u32 *temp_backlight = (u32 *)tui_do_menu(&menu);
+	if (temp_backlight != NULL)
+	{
+		h_cfg.backlight = (*(u32 *)temp_backlight) * 2;
+		_save_config();
+	}
+
+	free(ments);
+	free(bri_values);
+	free(bri_text);
+
+	if (temp_backlight == NULL)
+		return;
+	btn_wait();
+}
+
+void config_auto_hos_poweroff()
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * 6);
+	u32 *hp_values = (u32 *)malloc(sizeof(u32) * 3);
+
+	for (u32 j = 0; j < 3; j++)
+	{
+		hp_values[j] = j;
+		ments[j + 2].type = MENT_DATA;
+		ments[j + 2].data = &hp_values[j];
+	}
+
+	ments[0].type = MENT_BACK;
+	ments[0].caption = "Back";
+
+	ments[1].type = MENT_CHGLINE;
+
+	if (h_cfg.autohosoff == 1)
+	{
+		ments[2].caption = " Disable";
+		ments[3].caption = "*Enable";
+		ments[4].caption = " Enable (No logo)";
+	}
+	else if (h_cfg.autohosoff >= 2)
+	{
+		ments[2].caption = " Disable";
+		ments[3].caption = " Enable";
+		ments[4].caption = "*Enable (No logo)";
+	}
+	else
+	{
+		ments[2].caption = "*Disable";
+		ments[3].caption = " Enable";
+		ments[4].caption = " Enable (No logo)";
+	}
+
+	memset(&ments[5], 0, sizeof(ment_t));
+	menu_t menu = {ments, "Power off if woke up from HOS", 0, 0};
+
+	u32 *temp_autohosoff = (u32 *)tui_do_menu(&menu);
+	if (temp_autohosoff != NULL)
+	{
+		h_cfg.autohosoff = *(u32 *)temp_autohosoff;
+		_save_config();
+	}
+
+	free(ments);
+	free(hp_values);
+
+	if (temp_autohosoff == NULL)
+		return;
+	btn_wait();
+}
+
+void config_nogc()
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * 5);
+	u32 *cb_values = (u32 *)malloc(sizeof(u32) * 2);
+
+	for (u32 j = 0; j < 2; j++)
+	{
+		cb_values[j] = j;
+		ments[j + 2].type = MENT_DATA;
+		ments[j + 2].data = &cb_values[j];
+	}
+
+	ments[0].type = MENT_BACK;
+	ments[0].caption = "Back";
+
+	ments[1].type = MENT_CHGLINE;
+
+	if (h_cfg.autonogc)
+	{
+		ments[2].caption = " Disable";
+		ments[3].caption = "*Auto";
+	}
+	else
+	{
+		ments[2].caption = "*Disable";
+		ments[3].caption = " Auto";
+	}
+
+	memset(&ments[4], 0, sizeof(ment_t));
+	menu_t menu = {ments, "No Gamecard", 0, 0};
+
+	u32 *temp_nogc = (u32 *)tui_do_menu(&menu);
+	if (temp_nogc != NULL)
+	{
+		h_cfg.autonogc = *(u32 *)temp_nogc;
+		_save_config();
+	}
+
+	free(ments);
+	free(cb_values);
+
+	if (temp_nogc == NULL)
+		return;
+	btn_wait();
+}

bootloader/config/config.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018 CTCaer
+ * Copyright (c) 2018-2019 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -21,21 +21,34 @@
 
 typedef struct _hekate_config
 {
+	// Non-volatile config.
 	u32 autoboot;
 	u32 autoboot_list;
 	u32 bootwait;
-	u32 customlogo;
 	u32 verification;
+	u32 backlight;
+	u32 autohosoff;
+	u32 autonogc;
 	// Global temporary config.
-	int se_keygen_done;
+	bool se_keygen_done;
 	u32 sbar_time_keeping;
+	u32 errors;
+	int sept_run;
+	bool rcm_patched;
 } hekate_config;
 
+typedef enum
+{
+	ERR_LIBSYS_LP0 = (1 << 0),
+} hsysmodule_t;
+
 void set_default_configuration();
 int create_config_entry();
 void config_autoboot();
 void config_bootdelay();
-void config_customlogo();
 void config_verification();
+void config_backlight();
+void config_auto_hos_poweroff();
+void config_nogc();
 
 #endif /* _CONFIG_H_ */

bootloader/config/ini.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (C) 2018-2019 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -24,11 +24,39 @@
 
 static char *_strdup(char *str)
 {
+	if (!str)
+		return NULL;
 	char *res = (char *)malloc(strlen(str) + 1);
 	strcpy(res, str);
+
 	return res;
 }
 
+u32 _find_section_name(char *lbuf, u32 lblen, char schar)
+{
+	u32 i;
+	for (i = 0; i < lblen  && lbuf[i] != schar && lbuf[i] != '\n' && lbuf[i] != '\r'; i++)
+		;
+	lbuf[i] = 0;
+
+	return i;
+}
+
+ini_sec_t *_ini_create_section(link_t *dst, ini_sec_t *csec, char *name, u8 type)
+{
+	if (csec)
+	{
+		list_append(dst, &csec->link);
+		csec = NULL;
+	}
+
+	csec = (ini_sec_t *)malloc(sizeof(ini_sec_t));
+	csec->name = _strdup(name);
+	csec->type = type;
+
+	return csec;
+}
+
 int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 {
 	u32 lblen;
@@ -43,9 +71,10 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 
 	memcpy(filename, ini_path, pathlen + 1);
 
+	// Get all ini filenames.
 	if (is_dir)
 	{
-		filelist = dirlist(filename);
+		filelist = dirlist(filename, "*.ini", false);
 		if (!filelist)
 		{
 			free(filename);
@@ -57,6 +86,7 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 
 	do
 	{
+		// Copy ini filename in path string.
 		if (is_dir)
 		{
 			if (filelist[k * 256])
@@ -68,6 +98,7 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 				break;
 		}
 
+		// Open ini.
 		if (f_open(&fp, filename, FA_READ) != FR_OK)
 		{
 			free(filelist);
@@ -84,80 +115,36 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 			lblen = strlen(lbuf);
 
 			// Remove trailing newline.
-			if (lbuf[lblen - 1] == '\n')
+			if (lbuf[lblen - 1] == '\n' || lbuf[lblen - 1] == '\r')
 				lbuf[lblen - 1] = 0;
 
 			if (lblen > 2 && lbuf[0] == '[') // Create new section.
 			{
-				if (csec)
-				{
-					list_append(dst, &csec->link);
-					csec = NULL;
-				}
+				_find_section_name(lbuf, lblen, ']');
 
-				u32 i;
-				for (i = 0; i < lblen && lbuf[i] != '\n' && lbuf[i] != ']'; i++)
-					;
-				lbuf[i] = 0;
-
-				csec = (ini_sec_t *)malloc(sizeof(ini_sec_t));
-				csec->name = _strdup(&lbuf[1]);
-				csec->type = INI_CHOICE;
+				csec = _ini_create_section(dst, csec, &lbuf[1], INI_CHOICE);
 				list_init(&csec->kvs);
 			}
 			else if (lblen > 2 && lbuf[0] == '{') //Create new caption.
 			{
-				if (csec)
-				{
-					list_append(dst, &csec->link);
-					csec = NULL;
-				}
+				_find_section_name(lbuf, lblen, '}');
 
-				u32 i;
-				for (i = 0; i < lblen && lbuf[i] != '\n' && lbuf[i] != '}'; i++)
-					;
-				lbuf[i] = 0;
-
-				csec = (ini_sec_t *)malloc(sizeof(ini_sec_t));
-				csec->name = _strdup(&lbuf[1]);
-				csec->type = INI_CAPTION;
+				csec = _ini_create_section(dst, csec, &lbuf[1], INI_CAPTION);
 				csec->color = 0xFF0AB9E6;
 			}
 			else if (lblen > 2 && lbuf[0] == '#') //Create empty lines and comments.
 			{
-				if (csec)
-				{
-					list_append(dst, &csec->link);
-					csec = NULL;
-				}
+				_find_section_name(lbuf, lblen, '\0');
 
-				u32 i;
-				for (i = 0; i < lblen && lbuf[i] != '\n'; i++)
-					;
-				lbuf[i] = 0;
-
-				csec = (ini_sec_t *)malloc(sizeof(ini_sec_t));
-				csec->name = _strdup(&lbuf[1]);
-				csec->type = INI_COMMENT;
+				csec = _ini_create_section(dst, csec, &lbuf[1], INI_COMMENT);
 			}
 			else if (lblen < 2)
 			{
-				if (csec)
-				{
-					list_append(dst, &csec->link);
-					csec = NULL;
-				}
-
-				csec = (ini_sec_t *)malloc(sizeof(ini_sec_t));
-				csec->name = NULL;
-				csec->type = INI_NEWLINE;
+				csec = _ini_create_section(dst, csec, NULL, INI_NEWLINE);
 			}
 			else if (csec && csec->type == INI_CHOICE) //Extract key/value.
 			{
-				u32 i;
-				for (i = 0; i < lblen && lbuf[i] != '\n' && lbuf[i] != '='; i++)
-					;
-				lbuf[i] = 0;
+				u32 i = _find_section_name(lbuf, lblen, '=');
 
 				ini_kv_t *kv = (ini_kv_t *)malloc(sizeof(ini_kv_t));
 				kv->key = _strdup(&lbuf[0]);
@@ -169,8 +156,11 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 		f_close(&fp);
 
 		if (csec)
+		{
 			list_append(dst, &csec->link);
-
+			if (is_dir)
+				csec = NULL;
+		}
 	} while (is_dir);
 
 	free(filename);
@@ -192,11 +182,10 @@ void ini_free(link_t *dst)
 			{
 				free(kv->key);
 				free(kv->val);
-				free(kv);
+				//free(kv);
 			}
 		}
 		free(ini_sec->name);
-		//TODO: Free section structs.
 		//free(ini_sec);
 	}
 
@@ -231,9 +220,9 @@ void ini_free_section(ini_sec_t *cfg)
 	{
 		free(kv->key);
 		free(kv->val);
-		free(kv);
+		//free(kv);
 	}
-	free(cfg);
+	//free(cfg);
 
 	cfg = NULL;
 }
@@ -255,15 +244,7 @@ char *ini_check_payload_section(ini_sec_t *cfg)
 	}
 
 	if (path)
-	{
-		if (strlen(path) > 1)
-			return path;
-		else
-		{
-			free(path);
-			return NULL;
-		}
-	}
+		return path;
 	else
 		return NULL;
 }

bootloader/frontend/fe_emmc_tools.c

@@ -0,0 +1,937 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018 Rajko Stojadinovic
+ * Copyright (c) 2018-2019 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <string.h>
+#include <stdlib.h>
+
+#include "fe_emmc_tools.h"
+#include "../config/config.h"
+#include "../gfx/gfx.h"
+#include "../gfx/tui.h"
+#include "../libs/fatfs/ff.h"
+#include "../mem/heap.h"
+#include "../sec/se.h"
+#include "../storage/nx_emmc.h"
+#include "../storage/sdmmc.h"
+#include "../utils/btn.h"
+#include "../utils/util.h"
+
+#define EMMC_BUF_ALIGNED 0xB5000000
+#define SDXC_BUF_ALIGNED 0xB6000000
+#define MIXD_BUF_ALIGNED 0xB7000000
+
+#define NUM_SECTORS_PER_ITER 8192 // 4MB Cache.
+
+extern sdmmc_t sd_sdmmc;
+extern sdmmc_storage_t sd_storage;
+extern FATFS sd_fs;
+extern hekate_config h_cfg;
+
+extern bool sd_mount();
+extern void sd_unmount();
+extern void emmcsn_path_impl(char *path, char *sub_dir, char *filename, sdmmc_storage_t *storage);
+
+static int _dump_emmc_verify(sdmmc_storage_t *storage, u32 lba_curr, char *outFilename, emmc_part_t *part)
+{
+	FIL fp;
+	u8 sparseShouldVerify = 4;
+	u32 btn = 0;
+	u32 prevPct = 200;
+	u32 sdFileSector = 0;
+	int res = 0;
+
+	u8 hashEm[0x20];
+	u8 hashSd[0x20];
+
+	if (f_open(&fp, outFilename, FA_READ) == FR_OK)
+	{
+		u32 totalSectorsVer = (u32)((u64)f_size(&fp) >> (u64)9);
+
+		u8 *bufEm = (u8 *)EMMC_BUF_ALIGNED;
+		u8 *bufSd = (u8 *)SDXC_BUF_ALIGNED;
+
+		u32 pct = (u64)((u64)(lba_curr - part->lba_start) * 100u) / (u64)(part->lba_end - part->lba_start);
+		tui_pbar(0, gfx_con.y, pct, 0xFF96FF00, 0xFF155500);
+
+		u32 num = 0;
+		while (totalSectorsVer > 0)
+		{
+			num = MIN(totalSectorsVer, NUM_SECTORS_PER_ITER);
+			
+			// Check every time or every 4.
+			// Every 4 protects from fake sd, sector corruption and frequent I/O corruption.
+			// Full provides all that, plus protection from extremely rare I/O corruption.
+			if ((h_cfg.verification & 2) || !(sparseShouldVerify % 4))
+			{
+				if (!sdmmc_storage_read(storage, lba_curr, num, bufEm))
+				{
+					gfx_con.fntsz = 16;
+					EPRINTFARGS("\nFailed to read %d blocks (@LBA %08X),\nfrom eMMC!\n\nVerification failed..\n",
+						num, lba_curr);
+	
+					f_close(&fp);
+					return 1;
+				}
+				f_lseek(&fp, (u64)sdFileSector << (u64)9);
+				if (f_read(&fp, bufSd, num << 9, NULL))
+				{
+					gfx_con.fntsz = 16;
+					EPRINTFARGS("\nFailed to read %d blocks (@LBA %08X),\nfrom sd card!\n\nVerification failed..\n", num, lba_curr);
+	
+					f_close(&fp);
+					return 1;
+				}
+
+				se_calc_sha256(hashEm, bufEm, num << 9);
+				se_calc_sha256(hashSd, bufSd, num << 9);
+				res = memcmp(hashEm, hashSd, 0x10);
+
+				if (res)
+				{
+					gfx_con.fntsz = 16;
+					EPRINTFARGS("\nSD and eMMC data (@LBA %08X),\ndo not match!\n\nVerification failed..\n", lba_curr);
+	
+					f_close(&fp);
+					return 1;
+				}
+			}
+
+			pct = (u64)((u64)(lba_curr - part->lba_start) * 100u) / (u64)(part->lba_end - part->lba_start);
+			if (pct != prevPct)
+			{
+				tui_pbar(0, gfx_con.y, pct, 0xFF96FF00, 0xFF155500);
+				prevPct = pct;
+			}
+
+			lba_curr += num;
+			totalSectorsVer -= num;
+			sdFileSector += num;
+			sparseShouldVerify++;
+
+			btn = btn_wait_timeout(0, BTN_VOL_DOWN | BTN_VOL_UP);
+			if ((btn & BTN_VOL_DOWN) && (btn & BTN_VOL_UP))
+			{
+				gfx_con.fntsz = 16;
+				WPRINTF("\n\nVerification was cancelled!");
+				gfx_con.fntsz = 8;
+				msleep(1000);
+
+				f_close(&fp);
+
+				return 0;
+			}
+		}
+		f_close(&fp);
+
+		tui_pbar(0, gfx_con.y, pct, 0xFFCCCCCC, 0xFF555555);
+
+		return 0;
+	}
+	else
+	{
+		gfx_con.fntsz = 16;
+		EPRINTF("\nFile not found or could not be loaded.\n\nVerification failed..\n");
+		return 1;
+	}
+}
+
+void _update_filename(char *outFilename, u32 sdPathLen, u32 numSplitParts, u32 currPartIdx)
+{
+	if (numSplitParts >= 10 && currPartIdx < 10)
+	{
+		outFilename[sdPathLen] = '0';
+		itoa(currPartIdx, &outFilename[sdPathLen + 1], 10);
+	}
+	else
+		itoa(currPartIdx, &outFilename[sdPathLen], 10);
+}
+
+static int _dump_emmc_part(char *sd_path, sdmmc_storage_t *storage, emmc_part_t *part)
+{
+	static const u32 FAT32_FILESIZE_LIMIT = 0xFFFFFFFF;
+	static const u32 SECTORS_TO_MIB_COEFF = 11;
+
+	u32 multipartSplitSize = (1u << 31);
+	u32 totalSectors = part->lba_end - part->lba_start + 1;
+	u32 currPartIdx = 0;
+	u32 numSplitParts = 0;
+	u32 maxSplitParts = 0;
+	u32 btn = 0;
+	bool isSmallSdCard = false;
+	bool partialDumpInProgress = false;
+	int res = 0;
+	char *outFilename = sd_path;
+	u32 sdPathLen = strlen(sd_path);
+
+	FIL partialIdxFp;
+	char partialIdxFilename[12];
+	memcpy(partialIdxFilename, "partial.idx", 12);
+
+	gfx_con.fntsz = 8;
+	gfx_printf("\nSD Card free space: %d MiB, Total backup size %d MiB\n\n",
+		sd_fs.free_clst * sd_fs.csize >> SECTORS_TO_MIB_COEFF,
+		totalSectors >> SECTORS_TO_MIB_COEFF);
+
+	// 1GB parts for sd cards 8GB and less.
+	if ((sd_storage.csd.capacity >> (20 - sd_storage.csd.read_blkbits)) <= 8192)
+		multipartSplitSize = (1u << 30);
+	// Maximum parts fitting the free space available.
+	maxSplitParts = (sd_fs.free_clst * sd_fs.csize) / (multipartSplitSize / NX_EMMC_BLOCKSIZE);
+
+	// Check if the USER partition or the RAW eMMC fits the sd card free space.
+	if (totalSectors > (sd_fs.free_clst * sd_fs.csize))
+	{
+		isSmallSdCard = true;
+
+		gfx_printf("%k\nSD card free space is smaller than total backup size.%k\n", 0xFFFFBA00, 0xFFCCCCCC);
+
+		if (!maxSplitParts)
+		{
+			gfx_con.fntsz = 16;
+			EPRINTF("Not enough free space for Partial Backup.");
+
+			return 0;
+		}
+	}
+	// Check if we are continuing a previous raw eMMC or USER partition backup in progress.
+	if (f_open(&partialIdxFp, partialIdxFilename, FA_READ) == FR_OK && totalSectors > (FAT32_FILESIZE_LIMIT / NX_EMMC_BLOCKSIZE))
+	{
+		gfx_printf("%kFound Partial Backup in progress. Continuing...%k\n\n", 0xFFAEFD14, 0xFFCCCCCC);
+
+		partialDumpInProgress = true;
+		// Force partial dumping, even if the card is larger.
+		isSmallSdCard = true;
+
+		f_read(&partialIdxFp, &currPartIdx, 4, NULL);
+		f_close(&partialIdxFp);
+
+		if (!maxSplitParts)
+		{
+			gfx_con.fntsz = 16;
+			EPRINTF("Not enough free space for Partial Backup.");
+
+			return 0;
+		}
+
+		// Increase maxSplitParts to accommodate previously backed up parts.
+		maxSplitParts += currPartIdx;
+	}
+	else if (isSmallSdCard)
+		gfx_printf("%kPartial Backup enabled (with %d MiB parts)...%k\n\n", 0xFFFFBA00, multipartSplitSize >> 20, 0xFFCCCCCC);
+
+	// Check if filesystem is FAT32 or the free space is smaller and backup in parts.
+	if (((sd_fs.fs_type != FS_EXFAT) && totalSectors > (FAT32_FILESIZE_LIMIT / NX_EMMC_BLOCKSIZE)) | isSmallSdCard)
+	{
+		u32 multipartSplitSectors = multipartSplitSize / NX_EMMC_BLOCKSIZE;
+		numSplitParts = (totalSectors + multipartSplitSectors - 1) / multipartSplitSectors;
+
+		outFilename[sdPathLen++] = '.';
+
+		// Continue from where we left, if Partial Backup in progress.
+		_update_filename(outFilename, sdPathLen, numSplitParts, partialDumpInProgress ? currPartIdx : 0);
+	}
+
+	FIL fp;
+	gfx_con_getpos(&gfx_con.savedx, &gfx_con.savedy);
+	if (!f_open(&fp, outFilename, FA_READ))
+	{
+		f_close(&fp);
+		gfx_con.fntsz = 16;
+
+		WPRINTF("An existing backup has been detected!");
+		WPRINTF("Press POWER to Continue.\nPress VOL to go to the menu.\n");
+		msleep(500);
+
+		if (!(btn_wait() & BTN_POWER))
+			return 0;
+		gfx_con.fntsz = 8;
+		gfx_clear_partial_grey(0x1B, gfx_con.savedy, 48);
+	}
+	gfx_con_setpos(gfx_con.savedx, gfx_con.savedy);
+	gfx_printf("Filename: %s\n\n", outFilename);
+	res = f_open(&fp, outFilename, FA_CREATE_ALWAYS | FA_WRITE);
+	if (res)
+	{
+		gfx_con.fntsz = 16;
+		EPRINTFARGS("Error (%d) creating file %s.\n", res, outFilename);
+
+		return 0;
+	}
+
+	u8 *buf = (u8 *)MIXD_BUF_ALIGNED;
+
+	u32 lba_curr = part->lba_start;
+	u32 lbaStartPart = part->lba_start;
+	u32 bytesWritten = 0;
+	u32 prevPct = 200;
+	int retryCount = 0;
+
+	// Continue from where we left, if Partial Backup in progress.
+	if (partialDumpInProgress)
+	{
+		lba_curr += currPartIdx * (multipartSplitSize / NX_EMMC_BLOCKSIZE);
+		totalSectors -= currPartIdx * (multipartSplitSize / NX_EMMC_BLOCKSIZE);
+		lbaStartPart = lba_curr; // Update the start LBA for verification.
+	}
+	u64 totalSize = (u64)((u64)totalSectors << 9);
+	if (!isSmallSdCard && (sd_fs.fs_type == FS_EXFAT || totalSize <= FAT32_FILESIZE_LIMIT))
+		f_lseek(&fp, totalSize);
+	else
+		f_lseek(&fp, MIN(totalSize, multipartSplitSize));
+	f_lseek(&fp, 0);
+
+	u32 num = 0;
+	u32 pct = 0;
+	while (totalSectors > 0)
+	{
+		if (numSplitParts != 0 && bytesWritten >= multipartSplitSize)
+		{
+			f_close(&fp);
+			memset(&fp, 0, sizeof(fp));
+			currPartIdx++;
+
+			if (h_cfg.verification)
+			{
+				// Verify part.
+				if (_dump_emmc_verify(storage, lbaStartPart, outFilename, part))
+				{
+					EPRINTF("\nPress any key and try again...\n");
+
+					return 0;
+				}
+			}
+
+			_update_filename(outFilename, sdPathLen, numSplitParts, currPartIdx);
+
+			// Always create partial.idx before next part, in case a fatal error occurs.
+			if (isSmallSdCard)
+			{
+				// Create partial backup index file.
+				if (f_open(&partialIdxFp, partialIdxFilename, FA_CREATE_ALWAYS | FA_WRITE) == FR_OK)
+				{
+					f_write(&partialIdxFp, &currPartIdx, 4, NULL);
+					f_close(&partialIdxFp);
+				}
+				else
+				{
+					gfx_con.fntsz = 16;
+					EPRINTF("\nError creating partial.idx file.\n");
+
+					return 0;
+				}
+
+				// More parts to backup that do not currently fit the sd card free space or fatal error.
+				if (currPartIdx >= maxSplitParts)
+				{
+					gfx_puts("\n\n1. Press any key to unmount SD Card.\n\
+						2. Remove SD Card and move files to free space.\n\
+						   Don\'t move the partial.idx file!\n\
+						3. Re-insert SD Card.\n\
+						4. Select the SAME option again to continue.\n");
+					gfx_con.fntsz = 16;
+
+					return 1;
+				}
+			}
+
+			// Create next part.
+			gfx_con_setpos(gfx_con.savedx, gfx_con.savedy);
+			gfx_printf("Filename: %s\n\n", outFilename);
+			lbaStartPart = lba_curr;
+			res = f_open(&fp, outFilename, FA_CREATE_ALWAYS | FA_WRITE);
+			if (res)
+			{
+				gfx_con.fntsz = 16;
+				EPRINTFARGS("Error (%d) creating file %s.\n", res, outFilename);
+
+				return 0;
+			}
+			bytesWritten = 0;
+
+			totalSize = (u64)((u64)totalSectors << 9);
+			f_lseek(&fp, MIN(totalSize, multipartSplitSize));
+			f_lseek(&fp, 0);
+		}
+
+		retryCount = 0;
+		num = MIN(totalSectors, NUM_SECTORS_PER_ITER);
+		while (!sdmmc_storage_read(storage, lba_curr, num, buf))
+		{
+			EPRINTFARGS("Error reading %d blocks @ LBA %08X,\nfrom eMMC (try %d), retrying...",
+				num, lba_curr, ++retryCount);
+
+			msleep(150);
+			if (retryCount >= 3)
+			{
+				gfx_con.fntsz = 16;
+				EPRINTFARGS("\nFailed to read %d blocks @ LBA %08X\nfrom eMMC. Aborting..\n",
+					num, lba_curr);
+				EPRINTF("\nPress any key and try again...\n");
+
+				f_close(&fp);
+				f_unlink(outFilename);
+
+				return 0;
+			}
+		}
+		res = f_write(&fp, buf, NX_EMMC_BLOCKSIZE * num, NULL);
+		if (res)
+		{
+			gfx_con.fntsz = 16;
+			EPRINTFARGS("\nFatal error (%d) when writing to SD Card", res);
+			EPRINTF("\nPress any key and try again...\n");
+
+			f_close(&fp);
+			f_unlink(outFilename);
+
+			return 0;
+		}
+		pct = (u64)((u64)(lba_curr - part->lba_start) * 100u) / (u64)(part->lba_end - part->lba_start);
+		if (pct != prevPct)
+		{
+			tui_pbar(0, gfx_con.y, pct, 0xFFCCCCCC, 0xFF555555);
+			prevPct = pct;
+		}
+
+		lba_curr += num;
+		totalSectors -= num;
+		bytesWritten += num * NX_EMMC_BLOCKSIZE;
+
+		// Force a flush after a lot of data if not splitting.
+		if (numSplitParts == 0 && bytesWritten >= multipartSplitSize)
+		{
+			f_sync(&fp);
+			bytesWritten = 0;
+		}
+
+		btn = btn_wait_timeout(0, BTN_VOL_DOWN | BTN_VOL_UP);
+		if ((btn & BTN_VOL_DOWN) && (btn & BTN_VOL_UP))
+		{
+			gfx_con.fntsz = 16;
+			WPRINTF("\n\nThe backup was cancelled!");
+			EPRINTF("\nPress any key...\n");
+			msleep(1500);
+
+			f_close(&fp);
+			f_unlink(outFilename);
+
+			return 0;
+		}
+	}
+	tui_pbar(0, gfx_con.y, 100, 0xFFCCCCCC, 0xFF555555);
+
+	// Backup operation ended successfully.
+	f_close(&fp);
+
+	if (h_cfg.verification)
+	{
+		// Verify last part or single file backup.
+		if (_dump_emmc_verify(storage, lbaStartPart, outFilename, part))
+		{
+			EPRINTF("\nPress any key and try again...\n");
+
+			return 0;
+		}
+		else
+			tui_pbar(0, gfx_con.y, 100, 0xFF96FF00, 0xFF155500);
+	}
+
+	gfx_con.fntsz = 16;
+	// Remove partial backup index file if no fatal errors occurred.
+	if (isSmallSdCard)
+	{
+		f_unlink(partialIdxFilename);
+		gfx_printf("%k\n\nYou can now join the files\nand get the complete eMMC RAW GPP backup.", 0xFFCCCCCC);
+	}
+	gfx_puts("\n\n");
+
+	return 1;
+}
+
+typedef enum
+{
+	PART_BOOT =   (1 << 0),
+	PART_SYSTEM = (1 << 1),
+	PART_USER =   (1 << 2),
+	PART_RAW =    (1 << 3),
+	PART_GP_ALL = (1 << 7)
+} emmcPartType_t;
+
+static void _dump_emmc_selected(emmcPartType_t dumpType)
+{
+	int res = 0;
+	u32 timer = 0;
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	tui_sbar(true);
+	gfx_con_setpos(0, 0);
+
+	if (!sd_mount())
+		goto out;
+
+	gfx_puts("Checking for available free space...\n\n");
+	// Get SD Card free space for Partial Backup.
+	f_getfree("", &sd_fs.free_clst, NULL);
+
+	sdmmc_storage_t storage;
+	sdmmc_t sdmmc;
+	if (!sdmmc_storage_init_mmc(&storage, &sdmmc, SDMMC_4, SDMMC_BUS_WIDTH_8, 4))
+	{
+		EPRINTF("Failed to init eMMC.");
+		goto out;
+	}
+
+	int i = 0;
+	char sdPath[80];
+	// Create Restore folders, if they do not exist.
+	emmcsn_path_impl(sdPath, "/restore", "", &storage);
+	emmcsn_path_impl(sdPath, "/restore/partitions", "", &storage);
+
+	timer = get_tmr_s();
+	if (dumpType & PART_BOOT)
+	{
+		const u32 BOOT_PART_SIZE = storage.ext_csd.boot_mult << 17;
+
+		emmc_part_t bootPart;
+		memset(&bootPart, 0, sizeof(bootPart));
+		bootPart.lba_start = 0;
+		bootPart.lba_end = (BOOT_PART_SIZE / NX_EMMC_BLOCKSIZE) - 1;
+		for (i = 0; i < 2; i++)
+		{
+			memcpy(bootPart.name, "BOOT", 5);
+			bootPart.name[4] = (u8)('0' + i);
+			bootPart.name[5] = 0;
+
+			gfx_printf("%k%02d: %s (%07X-%07X)%k\n", 0xFF00DDFF, i,
+				bootPart.name, bootPart.lba_start, bootPart.lba_end, 0xFFCCCCCC);
+
+			sdmmc_storage_set_mmc_partition(&storage, i + 1);
+
+			emmcsn_path_impl(sdPath, "", bootPart.name, &storage);
+			res = _dump_emmc_part(sdPath, &storage, &bootPart);
+		}
+	}
+
+	if ((dumpType & PART_SYSTEM) || (dumpType & PART_USER) || (dumpType & PART_RAW))
+	{
+		sdmmc_storage_set_mmc_partition(&storage, 0);
+
+		if ((dumpType & PART_SYSTEM) || (dumpType & PART_USER))
+		{
+			LIST_INIT(gpt);
+			nx_emmc_gpt_parse(&gpt, &storage);
+			LIST_FOREACH_ENTRY(emmc_part_t, part, &gpt, link)
+			{
+				if ((dumpType & PART_USER) == 0 && !strcmp(part->name, "USER"))
+					continue;
+				if ((dumpType & PART_SYSTEM) == 0 && strcmp(part->name, "USER"))
+					continue;
+
+				gfx_printf("%k%02d: %s (%07X-%07X)%k\n", 0xFF00DDFF, i++,
+					part->name, part->lba_start, part->lba_end, 0xFFCCCCCC);
+
+				emmcsn_path_impl(sdPath, "/partitions", part->name, &storage);
+				res = _dump_emmc_part(sdPath, &storage, part);
+				// If a part failed, don't continue.
+				if (!res)
+					break;
+			}
+			nx_emmc_gpt_free(&gpt);
+		}
+
+		if (dumpType & PART_RAW)
+		{
+			// Get GP partition size dynamically.
+			const u32 RAW_AREA_NUM_SECTORS = storage.sec_cnt;
+
+			emmc_part_t rawPart;
+			memset(&rawPart, 0, sizeof(rawPart));
+			rawPart.lba_start = 0;
+			rawPart.lba_end = RAW_AREA_NUM_SECTORS - 1;
+			strcpy(rawPart.name, "rawnand.bin");
+			{
+				gfx_printf("%k%02d: %s (%07X-%07X)%k\n", 0xFF00DDFF, i++,
+					rawPart.name, rawPart.lba_start, rawPart.lba_end, 0xFFCCCCCC);
+
+				emmcsn_path_impl(sdPath, "", rawPart.name, &storage);
+				res = _dump_emmc_part(sdPath, &storage, &rawPart);
+			}
+		}
+	}
+
+	gfx_putc('\n');
+	timer = get_tmr_s() - timer;
+	gfx_printf("Time taken: %dm %ds.\n", timer / 60, timer % 60);
+	sdmmc_storage_end(&storage);
+	if (res && h_cfg.verification)
+		gfx_printf("\n%kFinished and verified!%k\nPress any key...\n", 0xFF96FF00, 0xFFCCCCCC);
+	else if (res)
+		gfx_printf("\nFinished! Press any key...\n");
+
+out:
+	sd_unmount();
+	btn_wait();
+}
+
+void dump_emmc_system()  { _dump_emmc_selected(PART_SYSTEM); }
+void dump_emmc_user()    { _dump_emmc_selected(PART_USER); }
+void dump_emmc_boot()    { _dump_emmc_selected(PART_BOOT); }
+void dump_emmc_rawnand() { _dump_emmc_selected(PART_RAW); }
+
+static int _restore_emmc_part(char *sd_path, sdmmc_storage_t *storage, emmc_part_t *part, bool allow_multi_part)
+{
+	static const u32 SECTORS_TO_MIB_COEFF = 11;
+
+	u32 totalSectors = part->lba_end - part->lba_start + 1;
+	u32 currPartIdx = 0;
+	u32 numSplitParts = 0;
+	u32 lbaStartPart = part->lba_start;
+	int res = 0;
+	char *outFilename = sd_path;
+	u32 sdPathLen = strlen(sd_path);
+	u64 fileSize = 0;
+	u64 totalCheckFileSize = 0;
+	gfx_con.fntsz = 8;
+
+	FIL fp;
+	FILINFO fno;
+
+	gfx_con_getpos(&gfx_con.savedx, &gfx_con.savedy);
+
+	bool use_multipart = false;
+
+	if (allow_multi_part)
+	{
+		// Check to see if there is a combined file and if so then use that.
+		if (f_stat(outFilename, &fno))
+		{
+			// If not, check if there are partial files and the total size matches.
+			gfx_printf("No single file, checking for part files...\n");
+
+			outFilename[sdPathLen++] = '.';
+
+			// Stat total size of the part files.
+			while ((u32)((u64)totalCheckFileSize >> (u64)9) != totalSectors)
+			{
+				_update_filename(outFilename, sdPathLen, 99, numSplitParts);
+
+				gfx_con_setpos(gfx_con.savedx, gfx_con.savedy);
+				gfx_printf("\nFilename: %s\n", outFilename);
+
+				if (f_stat(outFilename, &fno))
+				{
+					WPRINTFARGS("Error (%d) file not found '%s'. Aborting...\n", res, outFilename);
+					return 0;
+				}
+				else
+					totalCheckFileSize += (u64)fno.fsize;
+
+				numSplitParts++;
+			}
+
+			gfx_printf("\n%X sectors total.\n", (u32)((u64)totalCheckFileSize >> (u64)9));
+
+			if ((u32)((u64)totalCheckFileSize >> (u64)9) != totalSectors)
+			{
+				gfx_con.fntsz = 16;
+				EPRINTF("Size of SD Card split backups does not match,\neMMC's selected part size.\n");
+
+				return 0;
+			}
+			else
+			{
+				use_multipart = true;
+				_update_filename(outFilename, sdPathLen, numSplitParts, 0);
+			}
+		}
+	}
+
+	res = f_open(&fp, outFilename, FA_READ);
+	gfx_con_setpos(gfx_con.savedx, gfx_con.savedy);
+	gfx_printf("\nFilename: %s\n", outFilename);
+	if (res)
+	{
+		if (res != FR_NO_FILE)
+			EPRINTFARGS("Error (%d) while opening backup. Continuing...\n", res);
+		else
+			WPRINTFARGS("Error (%d) file not found. Continuing...\n", res);
+		gfx_con.fntsz = 16;
+
+		return 0;
+	}
+	else if (!use_multipart && (((u32)((u64)f_size(&fp) >> (u64)9)) != totalSectors)) // Check total restore size vs emmc size.
+	{
+		gfx_con.fntsz = 16;
+		EPRINTF("Size of the SD Card backup does not match,\neMMC's selected part size.\n");
+		f_close(&fp);
+
+		return 0;
+	}
+	else
+	{
+		fileSize = (u64)f_size(&fp);
+		gfx_printf("\nTotal restore size: %d MiB.\n\n",
+			(u32)((use_multipart ? (u64)totalCheckFileSize : fileSize) >> (u64)9) >> SECTORS_TO_MIB_COEFF);
+	}
+
+	u8 *buf = (u8 *)MIXD_BUF_ALIGNED;
+
+	u32 lba_curr = part->lba_start;
+	u32 bytesWritten = 0;
+	u32 prevPct = 200;
+	int retryCount = 0;
+
+	u32 num = 0;
+	u32 pct = 0;
+
+	gfx_con_getpos(&gfx_con.savedx, &gfx_con.savedy);
+
+	while (totalSectors > 0)
+	{
+		// If we have more than one part, check the size for the split parts and make sure that the bytes written is not more than that.
+		if (numSplitParts != 0 && bytesWritten >= fileSize)
+		{
+			// If we have more bytes written then close the file pointer and increase the part index we are using
+			f_close(&fp);
+			memset(&fp, 0, sizeof(fp));
+			currPartIdx++;
+
+			if (h_cfg.verification)
+			{
+				// Verify part.
+				if (_dump_emmc_verify(storage, lbaStartPart, outFilename, part))
+				{
+					EPRINTF("\nPress any key and try again...\n");
+
+					return 0;
+				}
+			}
+
+			_update_filename(outFilename, sdPathLen, numSplitParts, currPartIdx);
+
+			// Read from next part.
+			gfx_con_setpos(gfx_con.savedx, gfx_con.savedy);
+			gfx_printf("Filename: %s\n\n", outFilename);
+
+			lbaStartPart = lba_curr;
+
+			// Try to open the next file part
+			res = f_open(&fp, outFilename, FA_READ);
+			if (res)
+			{
+				gfx_con.fntsz = 16;
+				EPRINTFARGS("Error (%d) opening file %s.\n", res, outFilename);
+
+				return 0;
+			}
+			fileSize = (u64)f_size(&fp);
+			bytesWritten = 0;
+		}
+
+		retryCount = 0;
+		num = MIN(totalSectors, NUM_SECTORS_PER_ITER);
+
+		res = f_read(&fp, buf, NX_EMMC_BLOCKSIZE * num, NULL);
+		if (res)
+		{
+			gfx_con.fntsz = 16;
+			EPRINTFARGS("\nFatal error (%d) when reading from SD Card", res);
+			EPRINTF("\nYour device may be in an inoperative state!\n\nPress any key and try again now...\n");
+
+			f_close(&fp);
+			return 0;
+		}
+		while (!sdmmc_storage_write(storage, lba_curr, num, buf))
+		{
+			EPRINTFARGS("Error writing %d blocks @ LBA %08X\nto eMMC (try %d), retrying...",
+				num, lba_curr, ++retryCount);
+
+			msleep(150);
+			if (retryCount >= 3)
+			{
+				gfx_con.fntsz = 16;
+				EPRINTFARGS("\nFailed to write %d blocks @ LBA %08X\nfrom eMMC. Aborting..\n",
+					num, lba_curr);
+				EPRINTF("\nYour device may be in an inoperative state!\n\nPress any key and try again...\n");
+
+				f_close(&fp);
+				return 0;
+			}
+		}
+		pct = (u64)((u64)(lba_curr - part->lba_start) * 100u) / (u64)(part->lba_end - part->lba_start);
+		if (pct != prevPct)
+		{
+			tui_pbar(0, gfx_con.y, pct, 0xFFCCCCCC, 0xFF555555);
+			prevPct = pct;
+		}
+
+		lba_curr += num;
+		totalSectors -= num;
+		bytesWritten += num * NX_EMMC_BLOCKSIZE;
+	}
+	tui_pbar(0, gfx_con.y, 100, 0xFFCCCCCC, 0xFF555555);
+
+	// Restore operation ended successfully.
+	f_close(&fp);
+
+	if (h_cfg.verification)
+	{
+		// Verify restored data.
+		if (_dump_emmc_verify(storage, lbaStartPart, outFilename, part))
+		{
+			EPRINTF("\nPress any key and try again...\n");
+
+			return 0;
+		}
+		else
+			tui_pbar(0, gfx_con.y, 100, 0xFF96FF00, 0xFF155500);
+	}
+
+	gfx_con.fntsz = 16;
+	gfx_puts("\n\n");
+
+	return 1;
+}
+
+static void _restore_emmc_selected(emmcPartType_t restoreType)
+{
+	int res = 0;
+	u32 timer = 0;
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	tui_sbar(true);
+	gfx_con_setpos(0, 0);
+
+	gfx_printf("%kThis may render your device inoperative!\n\n", 0xFFFFDD00);
+	gfx_printf("Are you really sure?\n\n%k", 0xFFCCCCCC);
+	if ((restoreType & PART_BOOT) || (restoreType & PART_GP_ALL))
+	{
+		gfx_puts("The mode you selected will only restore\nthe ");
+		if (restoreType & PART_BOOT)
+			gfx_puts("boot ");
+		gfx_puts("partitions that it can find.\n");
+		gfx_puts("If it is not found, it will be skipped\nand continue with the next.\n\n");
+	}
+	gfx_con_getpos(&gfx_con.savedx, &gfx_con.savedy);
+
+	u8 failsafe_wait = 10;
+	while (failsafe_wait > 0)
+	{
+		gfx_con_setpos(gfx_con.savedx, gfx_con.savedy);
+		gfx_printf("%kWait... (%ds)    %k", 0xFF888888, failsafe_wait, 0xFFCCCCCC);
+		msleep(1000);
+		failsafe_wait--;
+	}
+	gfx_con_setpos(gfx_con.savedx, gfx_con.savedy);
+
+	gfx_puts("Press POWER to Continue.\nPress VOL to go to the menu.\n\n\n");
+
+	u32 btn = btn_wait();
+	if (!(btn & BTN_POWER))
+		goto out;
+
+	if (!sd_mount())
+		goto out;
+
+	sdmmc_storage_t storage;
+	sdmmc_t sdmmc;
+	if (!sdmmc_storage_init_mmc(&storage, &sdmmc, SDMMC_4, SDMMC_BUS_WIDTH_8, 4))
+	{
+		EPRINTF("Failed to init eMMC.");
+		goto out;
+	}
+
+	int i = 0;
+	char sdPath[80];
+
+	timer = get_tmr_s();
+	if (restoreType & PART_BOOT)
+	{
+		const u32 BOOT_PART_SIZE = storage.ext_csd.boot_mult << 17;
+
+		emmc_part_t bootPart;
+		memset(&bootPart, 0, sizeof(bootPart));
+		bootPart.lba_start = 0;
+		bootPart.lba_end = (BOOT_PART_SIZE / NX_EMMC_BLOCKSIZE) - 1;
+		for (i = 0; i < 2; i++)
+		{
+			memcpy(bootPart.name, "BOOT", 4);
+			bootPart.name[4] = (u8)('0' + i);
+			bootPart.name[5] = 0;
+
+			gfx_printf("%k%02d: %s (%07X-%07X)%k\n", 0xFF00DDFF, i,
+				bootPart.name, bootPart.lba_start, bootPart.lba_end, 0xFFCCCCCC);
+
+			sdmmc_storage_set_mmc_partition(&storage, i + 1);
+
+			emmcsn_path_impl(sdPath, "/restore", bootPart.name, &storage);
+			res = _restore_emmc_part(sdPath, &storage, &bootPart, false);
+		}
+	}
+
+	if (restoreType & PART_GP_ALL)
+	{
+		sdmmc_storage_set_mmc_partition(&storage, 0);
+
+		LIST_INIT(gpt);
+		nx_emmc_gpt_parse(&gpt, &storage);
+		LIST_FOREACH_ENTRY(emmc_part_t, part, &gpt, link)
+		{
+			gfx_printf("%k%02d: %s (%07X-%07X)%k\n", 0xFF00DDFF, i++,
+				part->name, part->lba_start, part->lba_end, 0xFFCCCCCC);
+
+			emmcsn_path_impl(sdPath, "/restore/partitions/", part->name, &storage);
+			res = _restore_emmc_part(sdPath, &storage, part, false);
+		}
+		nx_emmc_gpt_free(&gpt);
+	}
+
+	if (restoreType & PART_RAW)
+	{
+		// Get GP partition size dynamically.
+		const u32 RAW_AREA_NUM_SECTORS = storage.sec_cnt;
+
+		emmc_part_t rawPart;
+		memset(&rawPart, 0, sizeof(rawPart));
+		rawPart.lba_start = 0;
+		rawPart.lba_end = RAW_AREA_NUM_SECTORS - 1;
+		strcpy(rawPart.name, "rawnand.bin");
+		{
+			gfx_printf("%k%02d: %s (%07X-%07X)%k\n", 0xFF00DDFF, i++,
+				rawPart.name, rawPart.lba_start, rawPart.lba_end, 0xFFCCCCCC);
+
+			emmcsn_path_impl(sdPath, "/restore", rawPart.name, &storage);
+			res = _restore_emmc_part(sdPath, &storage, &rawPart, true);
+		}
+	}
+
+	gfx_putc('\n');
+	timer = get_tmr_s() - timer;
+	gfx_printf("Time taken: %dm %ds.\n", timer / 60, timer % 60);
+	sdmmc_storage_end(&storage);
+	if (res && h_cfg.verification)
+		gfx_printf("\n%kFinished and verified!%k\nPress any key...\n", 0xFF96FF00, 0xFFCCCCCC);
+	else if (res)
+		gfx_printf("\nFinished! Press any key...\n");
+
+out:
+	sd_unmount();
+	btn_wait();
+}
+
+void restore_emmc_boot()      { _restore_emmc_selected(PART_BOOT); }
+void restore_emmc_rawnand()   { _restore_emmc_selected(PART_RAW); }
+void restore_emmc_gpp_parts() { _restore_emmc_selected(PART_GP_ALL); }

bootloader/frontend/fe_emmc_tools.h

@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2018 Rajko Stojadinovic
+ * Copyright (c) 2018 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _FE_EMMC_TOOLS_H_
+#define _FE_EMMC_TOOLS_H_
+
+void dump_emmc_system();
+void dump_emmc_user();
+void dump_emmc_boot();
+void dump_emmc_rawnand();
+
+void restore_emmc_boot();
+void restore_emmc_rawnand();
+void restore_emmc_gpp_parts();
+
+#endif

bootloader/frontend/fe_info.c

@@ -0,0 +1,679 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018-2019 CTCaer
+ * Copyright (c) 2018 balika011
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <string.h>
+
+#include "fe_info.h"
+#include "../gfx/gfx.h"
+#include "../hos/hos.h"
+#include "../hos/pkg1.h"
+#include "../libs/fatfs/ff.h"
+#include "../mem/heap.h"
+#include "../power/bq24193.h"
+#include "../power/max17050.h"
+#include "../sec/tsec.h"
+#include "../soc/fuse.h"
+#include "../soc/i2c.h"
+#include "../soc/kfuse.h"
+#include "../soc/smmu.h"
+#include "../soc/t210.h"
+#include "../storage/mmc.h"
+#include "../storage/nx_emmc.h"
+#include "../storage/sdmmc.h"
+#include "../utils/btn.h"
+#include "../utils/util.h"
+
+extern sdmmc_storage_t sd_storage;
+extern FATFS sd_fs;
+
+extern bool sd_mount();
+extern void sd_unmount();
+extern int  sd_save_to_file(void *buf, u32 size, const char *filename);
+extern void emmcsn_path_impl(char *path, char *sub_dir, char *filename, sdmmc_storage_t *storage);
+
+void print_fuseinfo()
+{
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	gfx_con_setpos(0, 0);
+
+	u32 burntFuses = 0;
+	for (u32 i = 0; i < 32; i++)
+	{
+		if ((fuse_read_odm(7) >> i) & 1)
+			burntFuses++;
+	}
+
+	gfx_printf("\nSKU:         %X - ", FUSE(FUSE_SKU_INFO));
+	switch (fuse_read_odm(4) & 3)
+	{
+	case 0:
+		gfx_printf("Retail\n");
+		break;
+	case 3:
+		gfx_printf("Dev\n");
+		break;
+	}
+	gfx_printf("Sdram ID:    %d\n", (fuse_read_odm(4) >> 3) & 0x1F);
+	gfx_printf("Burnt fuses: %d / 64\n", burntFuses);
+	gfx_printf("Secure key:  %08X%08X%08X%08X\n\n\n",
+		byte_swap_32(FUSE(FUSE_PRIVATE_KEY0)), byte_swap_32(FUSE(FUSE_PRIVATE_KEY1)),
+		byte_swap_32(FUSE(FUSE_PRIVATE_KEY2)), byte_swap_32(FUSE(FUSE_PRIVATE_KEY3)));
+
+	gfx_printf("%k(Unlocked) fuse cache:\n\n%k", 0xFF00DDFF, 0xFFCCCCCC);
+	gfx_hexdump(0x7000F900, (u8 *)0x7000F900, 0x2FC);
+
+	gfx_puts("\nPress POWER to dump them to SD Card.\nPress VOL to go to the menu.\n");
+
+	u32 btn = btn_wait();
+	if (btn & BTN_POWER)
+	{
+		if (sd_mount())
+		{
+			char path[64];
+			emmcsn_path_impl(path, "/dumps", "fuses.bin", NULL);
+			if (!sd_save_to_file((u8 *)0x7000F900, 0x2FC, path))
+				gfx_puts("\nDone!\n");
+			sd_unmount();
+		}
+
+		btn_wait();
+	}
+}
+
+void print_kfuseinfo()
+{
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	gfx_con_setpos(0, 0);
+
+	gfx_printf("%kKFuse contents:\n\n%k", 0xFF00DDFF, 0xFFCCCCCC);
+	u32 buf[KFUSE_NUM_WORDS];
+	if (!kfuse_read(buf))
+		EPRINTF("CRC fail.");
+	else
+		gfx_hexdump(0, (u8 *)buf, KFUSE_NUM_WORDS * 4);
+
+	gfx_puts("\nPress POWER to dump them to SD Card.\nPress VOL to go to the menu.\n");
+
+	u32 btn = btn_wait();
+	if (btn & BTN_POWER)
+	{
+		if (sd_mount())
+		{
+			char path[64];
+			emmcsn_path_impl(path, "/dumps", "kfuses.bin", NULL);
+			if (!sd_save_to_file((u8 *)buf, KFUSE_NUM_WORDS * 4, path))
+				gfx_puts("\nDone!\n");
+			sd_unmount();
+		}
+
+		btn_wait();
+	}
+}
+
+void print_mmc_info()
+{
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	gfx_con_setpos(0, 0);
+
+	static const u32 SECTORS_TO_MIB_COEFF = 11;
+
+	sdmmc_storage_t storage;
+	sdmmc_t sdmmc;
+
+	if (!sdmmc_storage_init_mmc(&storage, &sdmmc, SDMMC_4, SDMMC_BUS_WIDTH_8, 4))
+	{
+		EPRINTF("Failed to init eMMC.");
+		goto out;
+	}
+	else
+	{
+		u16 card_type;
+		u32 speed = 0;
+
+		gfx_printf("%kCID:%k\n", 0xFF00DDFF, 0xFFCCCCCC);
+		switch (storage.csd.mmca_vsn)
+		{
+		case 0: /* MMC v1.0 - v1.2 */
+		case 1: /* MMC v1.4 */
+			gfx_printf(
+				" Vendor ID:  %03X\n"
+				" Model:      %c%c%c%c%c%c%c\n"
+				" HW rev:     %X\n"
+				" FW rev:     %X\n"
+				" S/N:        %03X\n"
+				" Month/Year: %02d/%04d\n\n",
+				storage.cid.manfid,
+				storage.cid.prod_name[0], storage.cid.prod_name[1],	storage.cid.prod_name[2],
+				storage.cid.prod_name[3], storage.cid.prod_name[4],	storage.cid.prod_name[5],
+				storage.cid.prod_name[6], storage.cid.hwrev, storage.cid.fwrev,
+				storage.cid.serial, storage.cid.month, storage.cid.year);
+			break;
+		case 2: /* MMC v2.0 - v2.2 */
+		case 3: /* MMC v3.1 - v3.3 */
+		case 4: /* MMC v4 */
+			gfx_printf(
+				" Vendor ID:  %X\n"
+				" Card/BGA:   %X\n"
+				" OEM ID:     %02X\n"
+				" Model:      %c%c%c%c%c%c\n"
+				" Prd Rev:    %X\n"
+				" S/N:        %04X\n"
+				" Month/Year: %02d/%04d\n\n",
+				storage.cid.manfid, storage.cid.card_bga, storage.cid.oemid,
+				storage.cid.prod_name[0], storage.cid.prod_name[1], storage.cid.prod_name[2],
+				storage.cid.prod_name[3], storage.cid.prod_name[4],	storage.cid.prod_name[5],
+				storage.cid.prv, storage.cid.serial, storage.cid.month, storage.cid.year);
+			break;
+		default:
+			EPRINTFARGS("eMMC has unknown MMCA version %d", storage.csd.mmca_vsn);
+			break;
+		}
+
+		if (storage.csd.structure == 0)
+			EPRINTF("Unknown CSD structure.");
+		else
+		{
+			gfx_printf("%kExtended CSD V1.%d:%k\n",
+				0xFF00DDFF, storage.ext_csd.ext_struct, 0xFFCCCCCC);
+			card_type = storage.ext_csd.card_type;
+			u8 card_type_support[96];
+			u8 pos_type = 0;
+			card_type_support[0] = 0;
+			if (card_type & EXT_CSD_CARD_TYPE_HS_26)
+			{
+				memcpy(card_type_support, "HS26", 4);
+				speed = (26 << 16) | 26;
+				pos_type += 4;
+			}
+			if (card_type & EXT_CSD_CARD_TYPE_HS_52)
+			{
+				memcpy(card_type_support + pos_type, ", HS52", 6);
+				speed = (52 << 16) | 52;
+				pos_type += 6;
+			}
+			if (card_type & EXT_CSD_CARD_TYPE_DDR_1_8V)
+			{
+				memcpy(card_type_support + pos_type, ", DDR52_1.8V", 12);
+				speed = (52 << 16) | 104;
+				pos_type += 12;
+			}
+			if (card_type & EXT_CSD_CARD_TYPE_HS200_1_8V)
+			{
+				memcpy(card_type_support + pos_type, ", HS200_1.8V", 12);
+				speed = (200 << 16) | 200;
+				pos_type += 12;
+			}
+			if (card_type & EXT_CSD_CARD_TYPE_HS400_1_8V)
+			{
+				memcpy(card_type_support + pos_type, ", HS400_1.8V", 12);
+				speed = (200 << 16) | 400;
+				pos_type += 12;
+			}
+			card_type_support[pos_type] = 0;
+
+			gfx_printf(
+				" Spec Version:  %02X\n"
+				" Extended Rev:  1.%d\n"
+				" Dev Version:   %d\n"
+				" Cmd Classes:   %02X\n"
+				" Capacity:      %s\n"
+				" Max Rate:      %d MB/s (%d MHz)\n"
+				" Current Rate:  %d MB/s\n"
+				" Type Support:  ",
+				storage.csd.mmca_vsn, storage.ext_csd.rev, storage.ext_csd.dev_version, storage.csd.cmdclass,
+				storage.csd.capacity == (4096 * 512) ? "High" : "Low", speed & 0xFFFF, (speed >> 16) & 0xFFFF,
+				storage.csd.busspeed);
+			gfx_con.fntsz = 8;
+			gfx_printf("%s", card_type_support);
+			gfx_con.fntsz = 16;
+			gfx_printf("\n\n", card_type_support);
+
+			u32 boot_size = storage.ext_csd.boot_mult << 17;
+			u32 rpmb_size = storage.ext_csd.rpmb_mult << 17;
+			gfx_printf("%keMMC Partitions:%k\n", 0xFF00DDFF, 0xFFCCCCCC);
+			gfx_printf(" 1: %kBOOT0      %k\n    Size: %5d KiB (LBA Sectors: 0x%07X)\n", 0xFF96FF00, 0xFFCCCCCC,
+				boot_size / 1024, boot_size / 1024 / 512);
+			gfx_put_small_sep();
+			gfx_printf(" 2: %kBOOT1      %k\n    Size: %5d KiB (LBA Sectors: 0x%07X)\n", 0xFF96FF00, 0xFFCCCCCC,
+				boot_size / 1024, boot_size / 1024 / 512);
+			gfx_put_small_sep();
+			gfx_printf(" 3: %kRPMB       %k\n    Size: %5d KiB (LBA Sectors: 0x%07X)\n", 0xFF96FF00, 0xFFCCCCCC,
+				rpmb_size / 1024, rpmb_size / 1024 / 512);
+			gfx_put_small_sep();
+			gfx_printf(" 0: %kGPP (USER) %k\n    Size: %5d MiB (LBA Sectors: 0x%07X)\n\n", 0xFF96FF00, 0xFFCCCCCC,
+				storage.sec_cnt >> SECTORS_TO_MIB_COEFF, storage.sec_cnt);
+			gfx_put_small_sep();
+			gfx_printf("%kGPP (eMMC USER) partition table:%k\n", 0xFF00DDFF, 0xFFCCCCCC);
+
+			sdmmc_storage_set_mmc_partition(&storage, 0);
+			LIST_INIT(gpt);
+			nx_emmc_gpt_parse(&gpt, &storage);
+			int gpp_idx = 0;
+			LIST_FOREACH_ENTRY(emmc_part_t, part, &gpt, link)
+			{
+				gfx_printf(" %02d: %k%s%k\n     Size: % 5d MiB (LBA Sectors 0x%07X)\n     LBA Range: %08X-%08X\n",
+					gpp_idx++, 0xFFAEFD14, part->name, 0xFFCCCCCC, (part->lba_end - part->lba_start + 1) >> SECTORS_TO_MIB_COEFF,
+					part->lba_end - part->lba_start + 1, part->lba_start, part->lba_end);
+				gfx_put_small_sep();
+			}
+			nx_emmc_gpt_free(&gpt);
+		}
+	}
+
+out:
+	sdmmc_storage_end(&storage);
+
+	btn_wait();
+}
+
+void print_sdcard_info()
+{
+	static const u32 SECTORS_TO_MIB_COEFF = 11;
+
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	gfx_con_setpos(0, 0);
+
+	if (sd_mount())
+	{
+		u32 capacity;
+
+		gfx_printf("%kCard IDentification:%k\n", 0xFF00DDFF, 0xFFCCCCCC);
+		gfx_printf(
+			" Vendor ID:  %02x\n"
+			" OEM ID:     %c%c\n"
+			" Model:      %c%c%c%c%c\n"
+			" HW rev:     %X\n"
+			" FW rev:     %X\n"
+			" S/N:        %08x\n"
+			" Month/Year: %02d/%04d\n\n",
+			sd_storage.cid.manfid, (sd_storage.cid.oemid >> 8) & 0xFF, sd_storage.cid.oemid & 0xFF,
+			sd_storage.cid.prod_name[0], sd_storage.cid.prod_name[1], sd_storage.cid.prod_name[2],
+			sd_storage.cid.prod_name[3], sd_storage.cid.prod_name[4],
+			sd_storage.cid.hwrev, sd_storage.cid.fwrev, sd_storage.cid.serial,
+			sd_storage.cid.month, sd_storage.cid.year);
+
+		gfx_printf("%kCard-Specific Data V%d.0:%k\n", 0xFF00DDFF, sd_storage.csd.structure + 1, 0xFFCCCCCC);
+		capacity = sd_storage.csd.capacity >> (20 - sd_storage.csd.read_blkbits);
+		gfx_printf(
+			" Cmd Classes:    %02X\n"
+			" Capacity:       %d MiB\n"
+			" Bus Width:      %d\n"
+			" Current Rate:   %d MB/s (%d MHz)\n"
+			" Speed Class:    %d\n"
+			" UHS Grade:      U%d\n"
+			" Video Class:    V%d\n"
+			" App perf class: A%d\n"
+			" Write Protect:  %d\n\n",
+			sd_storage.csd.cmdclass, capacity,
+			sd_storage.ssr.bus_width, sd_storage.csd.busspeed, sd_storage.csd.busspeed * 2,
+			sd_storage.ssr.speed_class, sd_storage.ssr.uhs_grade, sd_storage.ssr.video_class,
+			sd_storage.ssr.app_class, sd_storage.csd.write_protect);
+
+		gfx_puts("Acquiring FAT volume info...\n\n");
+		f_getfree("", &sd_fs.free_clst, NULL);
+		gfx_printf("%kFound %s volume:%k\n Free:    %d MiB\n Cluster: %d KiB\n",
+				0xFF00DDFF, sd_fs.fs_type == FS_EXFAT ? "exFAT" : "FAT32", 0xFFCCCCCC,
+				sd_fs.free_clst * sd_fs.csize >> SECTORS_TO_MIB_COEFF, (sd_fs.csize > 1) ? (sd_fs.csize >> 1) : 512);
+		sd_unmount();
+	}
+
+	btn_wait();
+}
+
+void print_tsec_key()
+{
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	gfx_con_setpos(0, 0);
+
+	u32 retries = 0;
+
+	tsec_ctxt_t tsec_ctxt;
+	sdmmc_storage_t storage;
+	sdmmc_t sdmmc;
+
+	sdmmc_storage_init_mmc(&storage, &sdmmc, SDMMC_4, SDMMC_BUS_WIDTH_8, 4);
+
+	// Read package1.
+	u8 *pkg1 = (u8 *)malloc(0x40000);
+	sdmmc_storage_set_mmc_partition(&storage, 1);
+	sdmmc_storage_read(&storage, 0x100000 / NX_EMMC_BLOCKSIZE, 0x40000 / NX_EMMC_BLOCKSIZE, pkg1);
+	sdmmc_storage_end(&storage);
+	const pkg1_id_t *pkg1_id = pkg1_identify(pkg1);
+	if (!pkg1_id)
+	{
+		EPRINTF("Unknown pkg1 version for reading\nTSEC firmware.");
+		goto out_wait;
+	}
+
+	u8 keys[0x10 * 2];
+	memset(keys, 0x00, 0x20);
+
+	tsec_ctxt.fw = (u8 *)pkg1 + pkg1_id->tsec_off;
+	tsec_ctxt.pkg1 = pkg1;
+	tsec_ctxt.pkg11_off = pkg1_id->pkg11_off;
+	tsec_ctxt.secmon_base = pkg1_id->secmon_base;
+
+	if (pkg1_id->kb <= KB_FIRMWARE_VERSION_600)
+		tsec_ctxt.size = 0xF00;
+	else if (pkg1_id->kb == KB_FIRMWARE_VERSION_620)
+		tsec_ctxt.size = 0x2900;
+	else
+	{
+		tsec_ctxt.size = 0x3000;
+		// Exit after TSEC key generation.
+		*((vu16 *)((u32)tsec_ctxt.fw + 0x2DB5)) = 0x02F8;
+	}
+
+	if (pkg1_id->kb == KB_FIRMWARE_VERSION_620)
+	{
+		u8 *tsec_paged = (u8 *)page_alloc(3);
+		memcpy(tsec_paged, (void *)tsec_ctxt.fw, tsec_ctxt.size);
+		tsec_ctxt.fw = tsec_paged;
+	}
+
+	int res = 0;
+
+	while (tsec_query(keys, pkg1_id->kb, &tsec_ctxt) < 0)
+	{
+		memset(keys, 0x00, 0x20);
+
+		retries++;
+
+		if (retries > 3)
+		{
+			res = -1;
+			break;
+		}
+	}
+
+	gfx_printf("%kTSEC key:  %k", 0xFF00DDFF, 0xFFCCCCCC);
+
+	if (res >= 0)
+	{
+		for (u32 j = 0; j < 0x10; j++)
+			gfx_printf("%02X", keys[j]);
+		
+
+		if (pkg1_id->kb == KB_FIRMWARE_VERSION_620)
+		{
+			gfx_printf("\n%kTSEC root: %k", 0xFF00DDFF, 0xFFCCCCCC);
+			for (u32 j = 0; j < 0x10; j++)
+				gfx_printf("%02X", keys[0x10 + j]);
+		}
+	}
+	else
+		EPRINTFARGS("ERROR %X\n", res);
+
+	gfx_puts("\n\nPress POWER to dump them to SD Card.\nPress VOL to go to the menu.\n");
+
+	u32 btn = btn_wait();
+	if (btn & BTN_POWER)
+	{
+		if (sd_mount())
+		{
+			char path[64];
+			emmcsn_path_impl(path, "/dumps", "tsec_keys.bin", NULL);
+			if (!sd_save_to_file(keys, 0x10 * 2, path))
+				gfx_puts("\nDone!\n");
+			sd_unmount();
+		}
+	}
+	else
+		goto out;
+
+out_wait:
+	btn_wait();
+
+out:
+	free(pkg1);
+}
+
+void print_fuel_gauge_info()
+{
+	int value = 0;
+
+	gfx_printf("%kFuel Gauge IC Info:\n%k", 0xFF00DDFF, 0xFFCCCCCC);
+
+	max17050_get_property(MAX17050_RepSOC, &value);
+	gfx_printf("Capacity now:           %3d%\n", value >> 8);
+
+	max17050_get_property(MAX17050_RepCap, &value);
+	gfx_printf("Capacity now:           %4d mAh\n", value);
+
+	max17050_get_property(MAX17050_FullCAP, &value);
+	gfx_printf("Capacity full:          %4d mAh\n", value);
+
+	max17050_get_property(MAX17050_DesignCap, &value);
+	gfx_printf("Capacity (design):      %4d mAh\n", value);
+
+	max17050_get_property(MAX17050_Current, &value);
+	if (value >= 0)
+		gfx_printf("Current now:            %d mA\n", value / 1000);
+	else
+		gfx_printf("Current now:            -%d mA\n", ~value / 1000);
+
+	max17050_get_property(MAX17050_AvgCurrent, &value);
+	if (value >= 0)
+		gfx_printf("Current average:        %d mA\n", value / 1000);
+	else
+		gfx_printf("Current average:        -%d mA\n", ~value / 1000);
+
+	max17050_get_property(MAX17050_VCELL, &value);
+	gfx_printf("Voltage now:            %4d mV\n", value);
+
+	max17050_get_property(MAX17050_OCVInternal, &value);
+	gfx_printf("Voltage open-circuit:   %4d mV\n", value);
+
+	max17050_get_property(MAX17050_MinVolt, &value);
+	gfx_printf("Min voltage reached:    %4d mV\n", value);
+
+	max17050_get_property(MAX17050_MaxVolt, &value);
+	gfx_printf("Max voltage reached:    %4d mV\n", value);
+
+	max17050_get_property(MAX17050_V_empty, &value);
+	gfx_printf("Empty voltage (design): %4d mV\n", value);
+
+	max17050_get_property(MAX17050_TEMP, &value);
+	if (value >= 0)
+		gfx_printf("Battery temperature:    %d.%d oC\n", value / 10, value % 10);
+	else
+		gfx_printf("Battery temperature:    -%d.%d oC\n", ~value / 10, (~value) % 10);
+}
+
+void print_battery_charger_info()
+{
+	int value = 0;
+
+	gfx_printf("%k\n\nBattery Charger IC Info:\n%k", 0xFF00DDFF, 0xFFCCCCCC);
+
+	bq24193_get_property(BQ24193_InputVoltageLimit, &value);
+	gfx_printf("Input voltage limit:       %4d mV\n", value);
+
+	bq24193_get_property(BQ24193_InputCurrentLimit, &value);
+	gfx_printf("Input current limit:       %4d mA\n", value);
+
+	bq24193_get_property(BQ24193_SystemMinimumVoltage, &value);
+	gfx_printf("Min voltage limit:         %4d mV\n", value);
+
+	bq24193_get_property(BQ24193_FastChargeCurrentLimit, &value);
+	gfx_printf("Fast charge current limit: %4d mA\n", value);
+
+	bq24193_get_property(BQ24193_ChargeVoltageLimit, &value);
+	gfx_printf("Charge voltage limit:      %4d mV\n", value);
+
+	bq24193_get_property(BQ24193_ChargeStatus, &value);
+	gfx_printf("Charge status:             ");
+	switch (value)
+	{
+	case 0:
+		gfx_printf("Not charging\n");
+		break;
+	case 1:
+		gfx_printf("Pre-charging\n");
+		break;
+	case 2:
+		gfx_printf("Fast charging\n");
+		break;
+	case 3:
+		gfx_printf("Charge terminated\n");
+		break;
+	default:
+		gfx_printf("Unknown (%d)\n", value);
+		break;
+	}
+	bq24193_get_property(BQ24193_TempStatus, &value);
+	gfx_printf("Temperature status:        ");
+	switch (value)
+	{
+	case 0:
+		gfx_printf("Normal\n");
+		break;
+	case 2:
+		gfx_printf("Warm\n");
+		break;
+	case 3:
+		gfx_printf("Cool\n");
+		break;
+	case 5:
+		gfx_printf("Cold\n");
+		break;
+	case 6:
+		gfx_printf("Hot\n");
+		break;
+	default:
+		gfx_printf("Unknown (%d)\n", value);
+		break;
+	}
+}
+
+void print_battery_info()
+{
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	gfx_con_setpos(0, 0);
+
+	print_fuel_gauge_info();
+
+	print_battery_charger_info();
+
+	u8 *buf = (u8 *)malloc(0x100 * 2);
+
+	gfx_printf("%k\n\nBattery Fuel Gauge Registers:\n%k", 0xFF00DDFF, 0xFFCCCCCC);
+
+	for (int i = 0; i < 0x200; i += 2)
+	{
+		i2c_recv_buf_small(buf + i, 2, I2C_1, 0x36, i >> 1);
+		usleep(2500);
+	}
+
+	gfx_hexdump(0, (u8 *)buf, 0x200);
+
+	gfx_puts("\nPress POWER to dump them to SD Card.\nPress VOL to go to the menu.\n");
+
+	u32 btn = btn_wait();
+
+	if (btn & BTN_POWER)
+	{
+		if (sd_mount())
+		{
+			char path[64];
+			emmcsn_path_impl(path, "/dumps", "fuel_gauge.bin", NULL);
+			if (sd_save_to_file((u8 *)buf, 0x200, path))
+				EPRINTF("\nError creating fuel.bin file.");
+			else
+				gfx_puts("\nDone!\n");
+			sd_unmount();
+		}
+
+		btn_wait();
+	}
+	free(buf);
+}
+
+void _ipatch_process(u32 offset, u32 value)
+{
+	gfx_printf("%8x %8x", BOOTROM_BASE + offset, value);
+	u8 lo = value & 0xff;
+	switch (value >> 8)
+	{
+	case 0x20:
+		gfx_printf("    MOVS R0, #0x%02X", lo);
+		break;
+	case 0xDF:
+		gfx_printf("    SVC #0x%02X", lo);
+		break;
+	}
+	gfx_puts("\n");
+}
+
+void bootrom_ipatches_info()
+{
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	gfx_con_setpos(0, 0);
+
+	static const u32 BOOTROM_SIZE = 0x18000;
+	
+	u32 res = fuse_read_ipatch(_ipatch_process);
+	if (res != 0)
+		EPRINTFARGS("Failed to read ipatches. Error: %d", res);
+
+	gfx_puts("\nPress POWER to dump them to SD Card.\nPress VOL to go to the menu.\n");
+	
+	u32 btn = btn_wait();
+	if (btn & BTN_POWER)
+	{
+		if (sd_mount())
+		{
+			char path[64];
+			u32 iram_evp_thunks[0x200];
+			u32 iram_evp_thunks_len = sizeof(iram_evp_thunks);
+			res = fuse_read_evp_thunk(iram_evp_thunks, &iram_evp_thunks_len);
+			if (res == 0)
+			{
+				emmcsn_path_impl(path, "/dumps", "evp_thunks.bin", NULL);
+				if (!sd_save_to_file((u8 *)iram_evp_thunks, iram_evp_thunks_len, path))
+					gfx_puts("\nevp_thunks.bin saved!\n");
+			}
+			else
+				EPRINTFARGS("Failed to read evp_thunks. Error: %d", res);
+			
+			u32 words[192];
+			fuse_read_array(words);
+			emmcsn_path_impl(path, "/dumps", "raw_fuses.bin", NULL);
+			if (!sd_save_to_file((u8 *)words, sizeof(words), path))
+				gfx_puts("\nipatches.bin saved!\n");
+			
+			emmcsn_path_impl(path, "/dumps", "bootrom_patched.bin", NULL);
+			if (!sd_save_to_file((u8 *)BOOTROM_BASE, BOOTROM_SIZE, path))
+				gfx_puts("\nbootrom_patched.bin saved!\n");
+			
+			u32 ipatch_backup[14];
+			memcpy(ipatch_backup, (void *)IPATCH_BASE, sizeof(ipatch_backup));
+			memset((void*)IPATCH_BASE, 0, sizeof(ipatch_backup));
+			
+			emmcsn_path_impl(path, "/dumps", "bootrom_unpatched.bin", NULL);
+			if (!sd_save_to_file((u8 *)BOOTROM_BASE, BOOTROM_SIZE, path))
+				gfx_puts("\nbootrom_unpatched.bin saved!\n");
+			
+			memcpy((void*)IPATCH_BASE, ipatch_backup, sizeof(ipatch_backup));
+			
+			sd_unmount();
+		}
+
+		btn_wait();
+	}
+}

bootloader/frontend/fe_info.h

@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018 CTCaer
+ * Copyright (c) 2018 balika011
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -14,21 +16,17 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/*
- * TODO: the placement of the relocator is a bit fragile atm, maybe we
- *       should include it in start.S and copy it to some known good
- *       place in IRAM instead. Basically we want it as far back atm
- *       as it might be overwritten during relocation.
- */
+#ifndef _FE_INFO_H_
+#define _FE_INFO_H_
 
-.section .text.reloc
-.arm
+void print_fuseinfo();
+void print_kfuseinfo();
+void print_mmc_info();
+void print_sdcard_info();
+void print_tsec_key();
+void print_fuel_gauge_info();
+void print_battery_charger_info();
+void print_battery_info();
+void bootrom_ipatches_info();
 
-.globl _reloc_ipl
-.type _reloc_ipl, %function
-_reloc_ipl:
-	LDMIA R0!, {R4-R7}
-	STMIA R1!, {R4-R7}
-	SUBS R2, #0x10
-	BNE _reloc_ipl
-	BX R3
+#endif

bootloader/frontend/fe_tools.c

@@ -0,0 +1,653 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018-2019 CTCaer
+ * Copyright (c) 2018 Reisyukaku
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <string.h>
+#include <stdlib.h>
+
+#include "fe_tools.h"
+#include "../config/config.h"
+#include "../gfx/gfx.h"
+#include "../gfx/tui.h"
+#include "../hos/hos.h"
+#include "../hos/pkg1.h"
+#include "../hos/pkg2.h"
+#include "../hos/sept.h"
+#include "../libs/fatfs/ff.h"
+#include "../mem/heap.h"
+#include "../power/max7762x.h"
+#include "../sec/se.h"
+#include "../storage/nx_emmc.h"
+#include "../storage/sdmmc.h"
+#include "../soc/fuse.h"
+#include "../utils/btn.h"
+#include "../utils/util.h"
+
+extern boot_cfg_t b_cfg;
+extern hekate_config h_cfg;
+
+extern bool sd_mount();
+extern void sd_unmount();
+extern int  sd_save_to_file(void *buf, u32 size, const char *filename);
+extern void emmcsn_path_impl(char *path, char *sub_dir, char *filename, sdmmc_storage_t *storage);
+
+void dump_packages12()
+{
+	if (!sd_mount())
+		return;
+
+	char path[64];
+
+	u8 *pkg1 = (u8 *)calloc(1, 0x40000);
+	u8 *warmboot = (u8 *)calloc(1, 0x40000);
+	u8 *secmon = (u8 *)calloc(1, 0x40000);
+	u8 *loader = (u8 *)calloc(1, 0x40000);
+	u8 *pkg2 = NULL;
+	u8 kb = 0;
+
+	tsec_ctxt_t tsec_ctxt;
+
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	gfx_con_setpos(0, 0);
+
+	sdmmc_storage_t storage;
+	sdmmc_t sdmmc;
+	if (!sdmmc_storage_init_mmc(&storage, &sdmmc, SDMMC_4, SDMMC_BUS_WIDTH_8, 4))
+	{
+		EPRINTF("Failed to init eMMC.");
+		goto out_free;
+	}
+	sdmmc_storage_set_mmc_partition(&storage, 1);
+
+	// Read package1.
+	sdmmc_storage_read(&storage, 0x100000 / NX_EMMC_BLOCKSIZE, 0x40000 / NX_EMMC_BLOCKSIZE, pkg1);
+	const pkg1_id_t *pkg1_id = pkg1_identify(pkg1);
+	if (!pkg1_id)
+	{
+		EPRINTF("Unknown pkg1 version for reading\nTSEC firmware.");
+		// Dump package1.
+		emmcsn_path_impl(path, "/pkg1", "pkg1_enc.bin", &storage);
+		if (sd_save_to_file(pkg1, 0x40000, path))
+			goto out_free;
+		gfx_puts("\nEnc pkg1 dumped to pkg1_enc.bin\n");
+
+		goto out_free;
+	}
+	const pk11_hdr_t *hdr = (pk11_hdr_t *)(pkg1 + pkg1_id->pkg11_off + 0x20);
+
+	kb = pkg1_id->kb;
+
+	if (!h_cfg.se_keygen_done || kb == KB_FIRMWARE_VERSION_620)
+	{
+		tsec_ctxt.fw = (void *)pkg1 + pkg1_id->tsec_off;
+		tsec_ctxt.pkg1 = (void *)pkg1;
+		tsec_ctxt.pkg11_off = pkg1_id->pkg11_off;
+		tsec_ctxt.secmon_base = pkg1_id->secmon_base;
+
+		if (kb >= KB_FIRMWARE_VERSION_700 && !h_cfg.sept_run)
+		{
+			b_cfg.autoboot = 0;
+			b_cfg.autoboot_list = 0;
+
+			gfx_printf("sept will run to get the keys.\nThen rerun this option.");
+			btn_wait();
+
+			if (!reboot_to_sept((u8 *)tsec_ctxt.fw))
+			{
+				gfx_printf("Failed to run sept\n");
+				goto out_free;
+			}
+		}
+
+		// Read keyblob.
+		u8 *keyblob = (u8 *)calloc(NX_EMMC_BLOCKSIZE, 1);
+		sdmmc_storage_read(&storage, 0x180000 / NX_EMMC_BLOCKSIZE + kb, 1, keyblob);
+
+		// Decrypt.
+		keygen(keyblob, kb, &tsec_ctxt);
+
+		h_cfg.se_keygen_done = 1;
+		free(keyblob);
+	}
+
+	if (kb <= KB_FIRMWARE_VERSION_600)
+		pkg1_decrypt(pkg1_id, pkg1);
+
+	if (kb <= KB_FIRMWARE_VERSION_620)
+	{
+		pkg1_unpack(warmboot, secmon, loader, pkg1_id, pkg1);
+	
+		// Display info.
+		gfx_printf("%kNX Bootloader size:  %k0x%05X\n\n", 0xFFC7EA46, 0xFFCCCCCC, hdr->ldr_size);
+	
+		gfx_printf("%kSecure monitor addr: %k0x%05X\n", 0xFFC7EA46, 0xFFCCCCCC, pkg1_id->secmon_base);
+		gfx_printf("%kSecure monitor size: %k0x%05X\n\n", 0xFFC7EA46, 0xFFCCCCCC, hdr->sm_size);
+	
+		gfx_printf("%kWarmboot addr:       %k0x%05X\n", 0xFFC7EA46, 0xFFCCCCCC, pkg1_id->warmboot_base);
+		gfx_printf("%kWarmboot size:       %k0x%05X\n\n", 0xFFC7EA46, 0xFFCCCCCC, hdr->wb_size);
+
+		// Dump package1.1.
+		emmcsn_path_impl(path, "/pkg1", "pkg1_decr.bin", &storage);
+		if (sd_save_to_file(pkg1, 0x40000, path))
+			goto out_free;
+		gfx_puts("\npkg1 dumped to pkg1_decr.bin\n");
+	
+		// Dump nxbootloader.
+		emmcsn_path_impl(path, "/pkg1", "nxloader.bin", &storage);
+		if (sd_save_to_file(loader, hdr->ldr_size, path))
+			goto out_free;
+		gfx_puts("NX Bootloader dumped to nxloader.bin\n");
+	
+		// Dump secmon.
+		emmcsn_path_impl(path, "/pkg1", "secmon.bin", &storage);
+		if (sd_save_to_file(secmon, hdr->sm_size, path))
+			goto out_free;
+		gfx_puts("Secure Monitor dumped to secmon.bin\n");
+	
+		// Dump warmboot.
+		emmcsn_path_impl(path, "/pkg1", "warmboot.bin", &storage);
+		if (sd_save_to_file(warmboot, hdr->wb_size, path))
+			goto out_free;
+		gfx_puts("Warmboot dumped to warmboot.bin\n\n\n");
+	}
+
+	// Dump package2.1.
+	sdmmc_storage_set_mmc_partition(&storage, 0);
+	// Parse eMMC GPT.
+	LIST_INIT(gpt);
+	nx_emmc_gpt_parse(&gpt, &storage);
+	// Find package2 partition.
+	emmc_part_t *pkg2_part = nx_emmc_part_find(&gpt, "BCPKG2-1-Normal-Main");
+	if (!pkg2_part)
+		goto out;
+
+	// Read in package2 header and get package2 real size.
+	u8 *tmp = (u8 *)malloc(NX_EMMC_BLOCKSIZE);
+	nx_emmc_part_read(&storage, pkg2_part, 0x4000 / NX_EMMC_BLOCKSIZE, 1, tmp);
+	u32 *hdr_pkg2_raw = (u32 *)(tmp + 0x100);
+	u32 pkg2_size = hdr_pkg2_raw[0] ^ hdr_pkg2_raw[2] ^ hdr_pkg2_raw[3];
+	free(tmp);
+	// Read in package2.
+	u32 pkg2_size_aligned = ALIGN(pkg2_size, NX_EMMC_BLOCKSIZE);
+	pkg2 = malloc(pkg2_size_aligned);
+	nx_emmc_part_read(&storage, pkg2_part, 0x4000 / NX_EMMC_BLOCKSIZE, 
+		pkg2_size_aligned / NX_EMMC_BLOCKSIZE, pkg2);
+	// Decrypt package2 and parse KIP1 blobs in INI1 section.
+	pkg2_hdr_t *pkg2_hdr = pkg2_decrypt(pkg2);
+
+	// Display info.
+	u32 kernel_crc32 = crc32c(pkg2_hdr->data, pkg2_hdr->sec_size[PKG2_SEC_KERNEL]);
+	gfx_printf("\n%kKernel CRC32C: %k0x%08X\n\n", 0xFFC7EA46, 0xFFCCCCCC, kernel_crc32);
+	gfx_printf("%kKernel size:   %k0x%05X\n\n", 0xFFC7EA46, 0xFFCCCCCC, pkg2_hdr->sec_size[PKG2_SEC_KERNEL]);
+	gfx_printf("%kINI1 size:     %k0x%05X\n\n", 0xFFC7EA46, 0xFFCCCCCC, pkg2_hdr->sec_size[PKG2_SEC_INI1]);
+
+	// Dump pkg2.1.
+	emmcsn_path_impl(path, "/pkg2", "pkg2_decr.bin", &storage);
+	if (sd_save_to_file(pkg2, pkg2_hdr->sec_size[PKG2_SEC_KERNEL] + pkg2_hdr->sec_size[PKG2_SEC_INI1], path))
+		goto out;
+	gfx_puts("\npkg2 dumped to pkg2_decr.bin\n");
+
+	// Dump kernel.
+	emmcsn_path_impl(path, "/pkg2", "kernel.bin", &storage);
+	if (sd_save_to_file(pkg2_hdr->data, pkg2_hdr->sec_size[PKG2_SEC_KERNEL], path))
+		goto out;
+	gfx_puts("Kernel dumped to kernel.bin\n");
+
+	// Dump INI1.
+	emmcsn_path_impl(path, "/pkg2", "ini1.bin", &storage);
+	u32 ini1_off = pkg2_hdr->sec_size[PKG2_SEC_KERNEL];
+	u32 ini1_size = pkg2_hdr->sec_size[PKG2_SEC_INI1];
+	if (!ini1_size)
+	{
+		ini1_off = *(u32 *)(pkg2_hdr->data + PKG2_NEWKERN_INI1_START);
+		ini1_size = *(u32 *)(pkg2_hdr->data + PKG2_NEWKERN_INI1_END) - *(u32 *)(pkg2_hdr->data + PKG2_NEWKERN_INI1_START);
+	}
+	if (sd_save_to_file(pkg2_hdr->data + ini1_off, ini1_size, path))
+		goto out;
+	gfx_puts("INI1 dumped to ini1.bin\n");
+
+	gfx_puts("\nDone. Press any key...\n");
+
+out:
+	nx_emmc_gpt_free(&gpt);
+out_free:
+	free(pkg1);
+	free(secmon);
+	free(warmboot);
+	free(loader);
+	free(pkg2);
+	sdmmc_storage_end(&storage);
+	sd_unmount();
+
+	if (kb >= KB_FIRMWARE_VERSION_620)
+		se_aes_key_clear(8);
+
+	btn_wait();
+}
+
+void _toggle_autorcm(bool enable)
+{
+	sdmmc_storage_t storage;
+	sdmmc_t sdmmc;
+
+	u8 randomXor = 0;
+
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	gfx_con_setpos(0, 0);
+
+	if (!sdmmc_storage_init_mmc(&storage, &sdmmc, SDMMC_4, SDMMC_BUS_WIDTH_8, 4))
+	{
+		EPRINTF("Failed to init eMMC.");
+		goto out;
+	}
+
+	u8 *tempbuf = (u8 *)malloc(0x200);
+	sdmmc_storage_set_mmc_partition(&storage, 1);
+
+	int i, sect = 0;
+	u8 corr_mod_byte0;
+	if ((fuse_read_odm(4) & 3) != 3)
+		corr_mod_byte0 = 0xF7;
+	else
+		corr_mod_byte0 = 0x37;
+
+	for (i = 0; i < 4; i++)
+	{
+		sect = (0x200 + (0x4000 * i)) / NX_EMMC_BLOCKSIZE;
+		sdmmc_storage_read(&storage, sect, 1, tempbuf);
+
+		if (enable)
+		{
+			do
+			{
+				randomXor = get_tmr_us() & 0xFF; // Bricmii style of bricking.
+			} while (!randomXor); // Avoid the lottery.
+
+			tempbuf[0x10] ^= randomXor;
+		}
+		else
+			tempbuf[0x10] = corr_mod_byte0;
+		sdmmc_storage_write(&storage, sect, 1, tempbuf);
+	}
+
+	free(tempbuf);
+	sdmmc_storage_end(&storage);
+
+	if (enable)
+		gfx_printf("%kAutoRCM mode enabled!%k", 0xFFFFBA00, 0xFFCCCCCC);
+	else
+		gfx_printf("%kAutoRCM mode disabled!%k", 0xFF96FF00, 0xFFCCCCCC);
+	gfx_printf("\n\nPress any key...\n");
+
+out:
+	btn_wait();
+}
+
+void _enable_autorcm()  { _toggle_autorcm(true); }
+void _disable_autorcm() { _toggle_autorcm(false); }
+
+void menu_autorcm()
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	if (h_cfg.rcm_patched)
+	{
+		gfx_printf("%kThis device is RCM patched and\nAutoRCM function is disabled.\n\n"
+			"In case %kAutoRCM%k is enabled\nthis will %kBRICK%k your device PERMANENTLY!!%k",
+			0xFFFFDD00, 0xFFFF0000, 0xFFFFDD00, 0xFFFF0000, 0xFFFFDD00, 0xFFCCCCCC);
+		btn_wait();
+
+		return;
+	}
+
+	// Do a simple check on the main BCT.
+	sdmmc_storage_t storage;
+	sdmmc_t sdmmc;
+	bool disabled = true;
+
+	if (!sdmmc_storage_init_mmc(&storage, &sdmmc, SDMMC_4, SDMMC_BUS_WIDTH_8, 4))
+	{
+		EPRINTF("Failed to init eMMC.");
+		btn_wait();
+
+		return;
+	}
+
+	u8 *tempbuf = (u8 *)malloc(0x200);
+	sdmmc_storage_set_mmc_partition(&storage, 1);
+	sdmmc_storage_read(&storage, 0x200 / NX_EMMC_BLOCKSIZE, 1, tempbuf);
+
+	if ((fuse_read_odm(4) & 3) != 3)
+	{
+		if (tempbuf[0x10] != 0xF7)
+			disabled = false;
+	}
+	else
+	{
+		if (tempbuf[0x10] != 0x37)
+			disabled = false;
+	}
+
+	free(tempbuf);
+	sdmmc_storage_end(&storage);
+
+	// Create AutoRCM menu.
+	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * 6);
+
+	ments[0].type = MENT_BACK;
+	ments[0].caption = "Back";
+
+	ments[1].type = MENT_CHGLINE;
+
+	ments[2].type = MENT_CAPTION;
+	ments[3].type = MENT_CHGLINE;
+	if (disabled)
+	{
+		ments[2].caption = "Status: Disabled!";
+		ments[2].color = 0xFF96FF00;
+		ments[4].caption = "Enable AutoRCM";
+		ments[4].handler = _enable_autorcm;
+	}
+	else
+	{
+		ments[2].caption = "Status: Enabled!";
+		ments[2].color = 0xFFFFBA00;
+		ments[4].caption = "Disable AutoRCM";
+		ments[4].handler = _disable_autorcm;
+	}
+	ments[4].type = MENT_HDLR_RE;
+	ments[4].data = NULL;
+
+	memset(&ments[5], 0, sizeof(ment_t));
+	menu_t menu = {ments, "This corrupts your BOOT0!", 0, 0};
+
+	tui_do_menu(&menu);
+}
+
+int _fix_attributes(char *path, u32 *total, u32 hos_folder, u32 check_first_run)
+{
+	FRESULT res;
+	DIR dir;
+	u32 dirLength = 0;
+	static FILINFO fno;
+
+	if (check_first_run)
+	{
+		// Read file attributes.
+		res = f_stat(path, &fno);
+		if (res != FR_OK)
+			return res;
+
+		// Check if archive bit is set.
+		if (fno.fattrib & AM_ARC)
+		{
+			*(u32 *)total = *(u32 *)total + 1;
+			f_chmod(path, 0, AM_ARC);
+		}
+	}
+
+	// Open directory.
+	res = f_opendir(&dir, path);
+	if (res != FR_OK)
+		return res;
+
+	dirLength = strlen(path);
+	for (;;)
+	{
+		// Clear file or folder path.
+		path[dirLength] = 0;
+
+		// Read a directory item.
+		res = f_readdir(&dir, &fno);
+
+		// Break on error or end of dir.
+		if (res != FR_OK || fno.fname[0] == 0)
+			break;
+
+		// Skip official Nintendo dir if started from root.
+		if (!hos_folder && !strcmp(fno.fname, "Nintendo"))
+			continue;
+
+		// Set new directory or file.
+		memcpy(&path[dirLength], "/", 1);
+		memcpy(&path[dirLength + 1], fno.fname, strlen(fno.fname) + 1);
+
+		// Check if archive bit is set.
+		if (fno.fattrib & AM_ARC)
+		{
+			*total = *total + 1;
+			f_chmod(path, 0, AM_ARC);
+		}
+
+		// Is it a directory?
+		if (fno.fattrib & AM_DIR)
+		{
+			// Set archive bit to NCA folders.
+			if (hos_folder && !strcmp(fno.fname + strlen(fno.fname) - 4, ".nca"))
+			{
+				*total = *total + 1;
+				f_chmod(path, AM_ARC, AM_ARC);
+			}
+
+			// Update status bar.
+			tui_sbar(false);
+
+			// Enter the directory.
+			res = _fix_attributes(path, total, hos_folder, 0);
+			if (res != FR_OK)
+				break;
+		}
+	}
+
+	f_closedir(&dir);
+
+	return res;
+}
+
+void _fix_sd_attr(u32 type)
+{
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	gfx_con_setpos(0, 0);
+
+	char path[256];
+	char label[16];
+
+	u32 total = 0;
+	if (sd_mount())
+	{
+		switch (type)
+		{
+		case 0:
+			memcpy(path, "/", 2);
+			memcpy(label, "SD Card", 8);
+			break;
+		case 1:
+		default:
+			memcpy(path, "/Nintendo", 10);
+			memcpy(label, "Nintendo folder", 16);
+			break;
+		}
+
+		gfx_printf("Traversing all %s files!\nThis may take some time...\n\n", label);
+		_fix_attributes(path, &total, type, type);
+		gfx_printf("%kTotal archive bits cleared: %d!%k\n\nDone! Press any key...", 0xFF96FF00, total, 0xFFCCCCCC);
+		sd_unmount();
+	}
+	btn_wait();
+}
+
+void fix_sd_all_attr() { _fix_sd_attr(0); }
+void fix_sd_nin_attr() { _fix_sd_attr(1); }
+
+/* void fix_fuel_gauge_configuration()
+{
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	gfx_con_setpos(0, 0);
+
+	int battVoltage, avgCurrent;
+
+	max17050_get_property(MAX17050_VCELL, &battVoltage);
+	max17050_get_property(MAX17050_AvgCurrent, &avgCurrent);
+
+	// Check if still charging. If not, check if battery is >= 95% (4.1V).
+	if (avgCurrent < 0 && battVoltage > 4100)
+	{
+		if ((avgCurrent / 1000) < -10)
+			EPRINTF("You need to be connected to a wall adapter,\nto apply this fix!");
+		else
+		{
+			gfx_printf("%kAre you really sure?\nThis will reset your fuel gauge completely!\n", 0xFFFFDD00);
+			gfx_printf("Additionally this will power off your console.\n%k", 0xFFCCCCCC);
+
+			gfx_puts("\nPress POWER to Continue.\nPress VOL to go to the menu.\n\n\n");
+
+			u32 btn = btn_wait();
+			if (btn & BTN_POWER)
+			{
+				max17050_fix_configuration();
+				msleep(1000);
+				gfx_con_getpos(&gfx_con.savedx,  &gfx_con.savedy);
+				u16 value = 0;
+				gfx_printf("%kThe console will power off in 45 seconds.\n%k", 0xFFFFDD00, 0xFFCCCCCC);
+				while (value < 46)
+				{
+					gfx_con_setpos(gfx_con.savedx, gfx_con.savedy);
+					gfx_printf("%2ds elapsed", value);
+					msleep(1000);
+					value++;
+				}
+				msleep(2000);
+
+				power_off();
+			}
+			return;
+		}
+	}
+	else
+		EPRINTF("You need a fully charged battery\nand connected to a wall adapter,\nto apply this fix!");
+
+	msleep(500);
+	btn_wait();
+} */
+
+/*void reset_pmic_fuel_gauge_charger_config()
+{
+	int avgCurrent;
+
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	gfx_con_setpos(0, 0);
+
+	gfx_printf("%k\nThis will wipe your battery stats completely!\n"
+		"%kAnd it may not power on without physically\nremoving and re-inserting the battery.\n%k"
+		"\nAre you really sure?%k\n", 0xFFFFDD00, 0xFFFF0000, 0xFFFFDD00, 0xFFCCCCCC);
+
+	gfx_puts("\nPress POWER to Continue.\nPress VOL to go to the menu.\n\n\n");
+	u32 btn = btn_wait();
+	if (btn & BTN_POWER)
+	{
+		gfx_clear_partial_grey(0x1B, 0, 1256);
+		gfx_con_setpos(0, 0);
+		gfx_printf("%kKeep the USB cable connected!%k\n\n", 0xFFFFDD00, 0xFFCCCCCC);
+		gfx_con_getpos(&gfx_con.savedx,  &gfx_con.savedy);
+
+		u8 value = 30;
+		while (value > 0)
+		{
+			gfx_con_setpos(gfx_con.savedx, gfx_con.savedy);
+			gfx_printf("%kWait... (%ds)   %k", 0xFF888888, value, 0xFFCCCCCC);
+			msleep(1000);
+			value--;
+		}
+		gfx_con_setpos(gfx_con.savedx, gfx_con.savedy);
+
+		//Check if still connected.
+		max17050_get_property(MAX17050_AvgCurrent, &avgCurrent);
+		if ((avgCurrent / 1000) < -10)
+			EPRINTF("You need to be connected to a wall adapter\nor PC to apply this fix!");
+		else
+		{
+			// Apply fix.
+			bq24193_fake_battery_removal();
+			gfx_printf("Done!               \n"
+				"%k1. Remove the USB cable\n"
+				"2. Press POWER for 15s.\n"
+				"3. Reconnect the USB to power-on!%k\n", 0xFFFFDD00, 0xFFCCCCCC);
+		}
+		msleep(500);
+		btn_wait();
+	}
+}*/
+
+/*
+#include "../../modules/hekate_libsys_minerva/mtc.h"
+#include "../ianos/ianos.h"
+#include "../soc/fuse.h"
+#include "../soc/clock.h"
+
+mtc_config_t mtc_cfg;
+void minerva()
+{
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	gfx_con_setpos(0, 0);
+
+	u32 curr_ram_idx = 0;
+
+	if (!sd_mount())
+		return;
+
+	gfx_printf("-- Minerva Training Cell --\n\n");
+
+	// Set table to ram.
+	mtc_cfg.mtc_table = NULL;
+	mtc_cfg.sdram_id = (fuse_read_odm(4) >> 3) & 0x1F;
+	ianos_loader(false, "bootloader/sys/libsys_minerva.bso", DRAM_LIB, (void *)&mtc_cfg);
+
+	gfx_printf("\nStarting training process..\n\n");
+
+	// Get current frequency
+	for (curr_ram_idx = 0; curr_ram_idx < 10; curr_ram_idx++)
+	{
+		if (CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_EMC) == mtc_cfg.mtc_table[curr_ram_idx].clk_src_emc)
+			break;
+	}
+
+	// Change DRAM voltage.
+	//i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_SD1, 42); //40 = (1000 * 1100 - 600000) / 12500 -> 1.1V
+
+	mtc_cfg.rate_from = mtc_cfg.mtc_table[curr_ram_idx].rate_khz;
+	mtc_cfg.rate_to = 800000;
+	mtc_cfg.train_mode = OP_TRAIN_SWITCH;
+	gfx_printf("Training and switching %7d -> %7d\n\n", mtc_cfg.mtc_table[curr_ram_idx].rate_khz, 800000);
+	ianos_loader(false, "bootloader/sys/libsys_minerva.bso", DRAM_LIB, (void *)&mtc_cfg);
+	
+	// Thefollowing frequency needs periodic training every 100ms.
+	//msleep(200);
+
+	//mtc_cfg.rate_to = 1600000;
+	//gfx_printf("Training and switching  %7d -> %7d\n\n", mtc_cfg.current_emc_table->rate_khz, 1600000);
+	//ianos_loader(false, "bootloader/sys/libsys_minerva.bso", DRAM_LIB, (void *)&mtc_cfg);
+
+	//mtc_cfg.train_mode = OP_PERIODIC_TRAIN;
+	
+	sd_unmount();
+	
+	gfx_printf("Finished!");
+
+	btn_wait();
+}
+*/

bootloader/frontend/fe_tools.h

@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _FE_TOOLS_H_
+#define _FE_TOOLS_H_
+
+void dump_packages12();
+void fix_sd_all_attr();
+void fix_sd_nin_attr();
+void fix_battery_desync();
+void menu_autorcm();
+//void minerva();
+
+#endif

bootloader/gfx/di.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (c) 2018 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -23,6 +23,7 @@
 #include "../soc/i2c.h"
 #include "../soc/pmc.h"
 #include "../power/max77620.h"
+#include "../power/max7762x.h"
 #include "../soc/gpio.h"
 #include "../soc/pinmux.h"
 #include "../soc/clock.h"
@@ -42,8 +43,8 @@ static void _display_dsi_wait(u32 timeout, u32 off, u32 mask)
 void display_init()
 {
 	// Power on.
-	i2c_send_byte(I2C_5, 0x3C, MAX77620_REG_LDO0_CFG, 0xD0); // Configure to 1.2V.
-	i2c_send_byte(I2C_5, 0x3C, MAX77620_REG_GPIO7, 0x09);
+	max77620_regulator_set_volt_and_flags(REGULATOR_LDO0, 1200000, MAX77620_POWER_MODE_NORMAL); // Configure to 1.2V.
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_GPIO7, MAX77620_CNFG_GPIO_OUTPUT_VAL_HIGH | MAX77620_CNFG_GPIO_DRV_PUSHPULL);
 
 	// Enable MIPI CAL, DSI, DISP1, HOST1X, UART_FST_MIPI_CAL, DSIA LP clocks.
 	CLOCK(CLK_RST_CONTROLLER_RST_DEV_H_CLR) = 0x1010000;
@@ -81,11 +82,11 @@ void display_init()
 	gpio_write(GPIO_PORT_V, GPIO_PIN_1, GPIO_HIGH); // Backlight Enable enable.
 
 	// Config display interface and display.
-	MIPI_CAL(0x60) = 0;
+	MIPI_CAL(MIPI_CAL_MIPI_BIAS_PAD_CFG2) = 0;
 
 	exec_cfg((u32 *)CLOCK_BASE, _display_config_1, 4);
 	exec_cfg((u32 *)DISPLAY_A_BASE, _display_config_2, 94);
-	exec_cfg((u32 *)DSI_BASE, _display_config_3, 60);
+	exec_cfg((u32 *)DSI_BASE, _display_config_3, 61);
 
 	usleep(10000);
 
@@ -94,11 +95,11 @@ void display_init()
 	usleep(60000);
 
 	DSI(_DSIREG(DSI_BTA_TIMING)) = 0x50204;
-	DSI(_DSIREG(DSI_WR_DATA)) = 0x337;
+	DSI(_DSIREG(DSI_WR_DATA)) = 0x337; // MIPI_DSI_SET_MAXIMUM_RETURN_PACKET_SIZE
 	DSI(_DSIREG(DSI_TRIGGER)) = DSI_TRIGGER_HOST;
 	_display_dsi_wait(250000, _DSIREG(DSI_TRIGGER), DSI_TRIGGER_HOST | DSI_TRIGGER_VIDEO);
 
-	DSI(_DSIREG(DSI_WR_DATA)) = 0x406;
+	DSI(_DSIREG(DSI_WR_DATA)) = 0x406; // MIPI_DCS_GET_DISPLAY_ID
 	DSI(_DSIREG(DSI_TRIGGER)) = DSI_TRIGGER_HOST;
 	_display_dsi_wait(250000, _DSIREG(DSI_TRIGGER), DSI_TRIGGER_HOST | DSI_TRIGGER_VIDEO);
 
@@ -111,18 +112,18 @@ void display_init()
 	if (_display_ver == 0x10)
 		exec_cfg((u32 *)DSI_BASE, _display_config_4, 43);
 
-	DSI(_DSIREG(DSI_WR_DATA)) = 0x1105;
+	DSI(_DSIREG(DSI_WR_DATA)) = 0x1105; // MIPI_DCS_EXIT_SLEEP_MODE
 	DSI(_DSIREG(DSI_TRIGGER)) = DSI_TRIGGER_HOST;
 
 	usleep(180000);
 
-	DSI(_DSIREG(DSI_WR_DATA)) = 0x2905;
+	DSI(_DSIREG(DSI_WR_DATA)) = 0x2905; // MIPI_DCS_SET_DISPLAY_ON
 	DSI(_DSIREG(DSI_TRIGGER)) = DSI_TRIGGER_HOST;
 
 	usleep(20000);
 
-	exec_cfg((u32 *)DSI_BASE, _display_config_5, 21);
 	exec_cfg((u32 *)CLOCK_BASE, _display_config_6, 3);
+	exec_cfg((u32 *)DSI_BASE, _display_config_5, 21);
 	DISPLAY_A(_DIREG(DC_DISP_DISP_CLOCK_CONTROL)) = 4;
 	exec_cfg((u32 *)DSI_BASE, _display_config_7, 10);
 
@@ -137,17 +138,57 @@ void display_init()
 	exec_cfg((u32 *)DISPLAY_A_BASE, _display_config_11, 113);
 }
 
+void display_backlight_pwm_init()
+{
+	clock_enable_pwm();
+
+	PWM(PWM_CONTROLLER_PWM_CSR_0) = (1 << 31); // Enable PWM
+
+	PINMUX_AUX(PINMUX_AUX_LCD_BL_PWM) = (PINMUX_AUX(PINMUX_AUX_LCD_BL_PWM) >> 2) << 2 | 1; // PWM clock source.
+	gpio_config(GPIO_PORT_V, GPIO_PIN_0, GPIO_MODE_SPIO); // Backlight power mode.
+	
+}
+
 void display_backlight(bool enable)
 {
-	gpio_write(GPIO_PORT_V, GPIO_PIN_0, enable ? GPIO_HIGH : GPIO_LOW); // Backlight PWM.
+	gpio_write(GPIO_PORT_V, GPIO_PIN_0, enable ? GPIO_HIGH : GPIO_LOW); // Backlight PWM GPIO.
+}
+
+void display_backlight_brightness(u32 brightness, u32 step_delay)
+{
+	u32 old_value = (PWM(PWM_CONTROLLER_PWM_CSR_0) >> 16) & 0xFF;
+	if (brightness == old_value)
+		return;
+
+	if (brightness > 255)
+		brightness = 255;
+
+	if (old_value < brightness)
+	{
+		for (u32 i = old_value; i < brightness + 1; i++)
+		{
+			PWM(PWM_CONTROLLER_PWM_CSR_0) = (1 << 31) | (i << 16); // Enable PWM
+			usleep(step_delay);
+		}
+	}
+	else
+	{
+		for (u32 i = old_value; i > brightness; i--)
+		{
+			PWM(PWM_CONTROLLER_PWM_CSR_0) = (1 << 31) | (i << 16); // Enable PWM
+			usleep(step_delay);
+		}
+	}
+	if (!brightness)
+		PWM(PWM_CONTROLLER_PWM_CSR_0) = 0;
 }
 
 void display_end()
 {
-	display_backlight(false);
+	display_backlight_brightness(0, 1000);
 
 	DSI(_DSIREG(DSI_VIDEO_MODE_CONTROL)) = 1;
-	DSI(_DSIREG(DSI_WR_DATA)) = 0x2805;
+	DSI(_DSIREG(DSI_WR_DATA)) = 0x2805; // MIPI_DCS_SET_DISPLAY_OFF
 
 	DISPLAY_A(_DIREG(DC_CMD_STATE_ACCESS)) = READ_MUX | WRITE_MUX;
 	DSI(_DSIREG(DSI_VIDEO_MODE_CONTROL)) = 0;
@@ -160,7 +201,7 @@ void display_end()
 	if (_display_ver == 0x10)
 		exec_cfg((u32 *)DSI_BASE, _display_config_14, 22);
 
-	DSI(_DSIREG(DSI_WR_DATA)) = 0x1005;
+	DSI(_DSIREG(DSI_WR_DATA)) = 0x1005; // MIPI_DCS_ENTER_SLEEP_MODE
 	DSI(_DSIREG(DSI_TRIGGER)) = DSI_TRIGGER_HOST;
 
 	usleep(50000);

bootloader/gfx/di.h

@@ -161,6 +161,8 @@
 #define  DE_CONTROL_ACTIVE_BLANK (4 << 2)
 
 #define DC_DISP_DC_MCCIF_FIFOCTRL 0x480
+#define DC_DISP_SD_BL_PARAMETERS 0x4D7
+#define DC_DISP_SD_BL_CONTROL 0x4DC
 #define DC_DISP_BLEND_BACKGROUND_COLOR 0x4E4
 
 #define DC_WIN_CSC_YOF 0x611
@@ -179,6 +181,7 @@
 #define DC_WIN_WIN_OPTIONS 0x700
 #define  H_DIRECTION  (1 <<  0)
 #define  V_DIRECTION  (1 <<  2)
+#define  SCAN_COLUMN  (1 <<  4)
 #define  COLOR_EXPAND (1 <<  6)
 #define  CSC_ENABLE   (1 << 18)
 #define  WIN_ENABLE   (1 << 30)
@@ -226,6 +229,8 @@
 #define  V_DDA_INC(x) (((x) & 0xffff) << 16)
 
 #define DC_WIN_LINE_STRIDE 0x70A
+#define  LINE_STRIDE(x)	   (x)
+#define  UV_LINE_STRIDE(x) (((x) & 0xffff) << 16)
 #define DC_WIN_DV_CONTROL 0x70E
 
 // The following registers are A/B/C shadows of the 0xBC0/0xDC0/0xFC0 registers (see DISPLAY_WINDOW_HEADER).
@@ -233,6 +238,10 @@
 #define DC_WINBUF_ADDR_H_OFFSET 0x806
 #define DC_WINBUF_ADDR_V_OFFSET 0x808
 #define DC_WINBUF_SURFACE_KIND 0x80B
+#define  PITCH	(0 << 0)
+#define  TILED	(1 << 0)
+#define  BLOCK	(2 << 0)
+#define  BLOCK_HEIGHT(x) (((x) & 0x7) << 4)
 
 /*! Display serial interface registers. */
 #define _DSIREG(reg) ((reg) * 4)
@@ -337,8 +346,12 @@
 #define  DSI_PAD_PREEMP_PU(x)     (((x) & 0x3) << 0)
 
 #define DSI_PAD_CONTROL_4 0x52
+#define DSI_INIT_SEQ_DATA_15 0x5F
+
+#define MIPI_CAL_MIPI_BIAS_PAD_CFG2 0x60
 
 void display_init();
+void display_backlight_pwm_init();
 void display_end();
 
 /*! Show one single color on the display. */
@@ -346,6 +359,7 @@ void display_color_screen(u32 color);
 
 /*! Switches screen backlight ON/OFF. */
 void display_backlight(bool enable);
+void display_backlight_brightness(u32 brightness, u32 step_delay);
 
 /*! Init display in full 1280x720 resolution (B8G8R8A8, line stride 768, framebuffer size = 1280*768*4 bytes). */
 u32 *display_init_framebuffer();

bootloader/gfx/di.inl

@@ -128,7 +128,7 @@ static const cfg_op_t _display_config_2[94] = {
 };
 
 //DSI Init config.
-static const cfg_op_t _display_config_3[60] = { 
+static const cfg_op_t _display_config_3[61] = { 
 	{DSI_WR_DATA, 0},
 	{DSI_INT_ENABLE, 0},
 	{DSI_INT_STATUS, 0},
@@ -137,6 +137,7 @@ static const cfg_op_t _display_config_3[60] = {
 	{DSI_INIT_SEQ_DATA_1, 0},
 	{DSI_INIT_SEQ_DATA_2, 0},
 	{DSI_INIT_SEQ_DATA_3, 0},
+	{DSI_INIT_SEQ_DATA_15, 0},
 	{DSI_DCS_CMDS, 0},
 	{DSI_PKT_SEQ_0_LO, 0},
 	{DSI_PKT_SEQ_1_LO, 0},
@@ -286,12 +287,12 @@ static const cfg_op_t _display_config_7[10] = {
 
 //MIPI CAL config.
 static const cfg_op_t _display_config_8[6] = {
-	{0x18, 0},
-	{2, 0xF3F10000},
-	{0x16, 1},
-	{0x18, 0},
-	{0x18, 0x10010},
-	{0x17, 0x300}
+	{0x18, 0},          // MIPI_CAL_MIPI_BIAS_PAD_CFG2
+	{0x02, 0xF3F10000}, // MIPI_CAL_CIL_MIPI_CAL_STATUS
+	{0x16, 0},          // MIPI_CAL_MIPI_BIAS_PAD_CFG0
+	{0x18, 0},          // MIPI_CAL_MIPI_BIAS_PAD_CFG2
+	{0x18, 0x10010},    // MIPI_CAL_MIPI_BIAS_PAD_CFG2
+	{0x17, 0x300}       // MIPI_CAL_MIPI_BIAS_PAD_CFG1
 };
 
 //DSI config.
@@ -304,22 +305,22 @@ static const cfg_op_t _display_config_9[4] = {
 
 //MIPI CAL config.
 static const cfg_op_t _display_config_10[16] = {
-	{0xE, 0x200200},
-	{0xF, 0x200200},
-	{0x19, 0x200002},
-	{0x1A, 0x200002},
-	{5, 0},
-	{6, 0},
-	{7, 0},
-	{8, 0},
-	{9, 0},
-	{0xA, 0},
-	{0x10, 0},
-	{0x11, 0},
-	{0x1A, 0},
-	{0x1C, 0},
-	{0x1D, 0},
-	{0, 0x2A000001}
+	{0x0E, 0x200200}, // MIPI_CAL_DSIA_MIPI_CAL_CONFIG
+	{0x0F, 0x200200}, // MIPI_CAL_DSIB_MIPI_CAL_CONFIG
+	{0x19, 0x200002}, // MIPI_CAL_DSIA_MIPI_CAL_CONFIG_2
+	{0x1A, 0x200002}, // MIPI_CAL_DSIB_MIPI_CAL_CONFIG_2
+	{0x05, 0},        // MIPI_CAL_CILA_MIPI_CAL_CONFIG
+	{0x06, 0},        // MIPI_CAL_CILB_MIPI_CAL_CONFIG
+	{0x07, 0},        // MIPI_CAL_CILC_MIPI_CAL_CONFIG
+	{0x08, 0},        // MIPI_CAL_CILD_MIPI_CAL_CONFIG
+	{0x09, 0},        // MIPI_CAL_CILE_MIPI_CAL_CONFIG
+	{0x0A, 0},        // MIPI_CAL_CILF_MIPI_CAL_CONFIG
+	{0x10, 0},        // MIPI_CAL_DSIC_MIPI_CAL_CONFIG
+	{0x11, 0},        // MIPI_CAL_DSID_MIPI_CAL_CONFIG
+	{0x1A, 0},        // MIPI_CAL_DSIB_MIPI_CAL_CONFIG_2
+	{0x1C, 0},        // MIPI_CAL_DSIC_MIPI_CAL_CONFIG_2
+	{0x1D, 0},        // MIPI_CAL_DSID_MIPI_CAL_CONFIG_2
+	{0, 0x2A000001}   // MIPI_CAL_DSIA_MIPI_CAL_CONFIG
 };
 
 //Display A config.
@@ -474,10 +475,10 @@ static const cfg_op_t _display_config_13[16] = {
 	{DSI_PAD_CONTROL_1, 0},
 	{DSI_PHY_TIMING_0, 0x6070601},
 	{DSI_PHY_TIMING_1, 0x40A0E05},
-	{DSI_PHY_TIMING_2, 0x30109},
+	{DSI_PHY_TIMING_2, 0x30118},
 	{DSI_BTA_TIMING, 0x190A14},
 	{DSI_TIMEOUT_0, DSI_TIMEOUT_LRX(0x2000) | DSI_TIMEOUT_HTX(0xFFFF) },
-	{DSI_TIMEOUT_1, DSI_TIMEOUT_PR(0x765) | DSI_TIMEOUT_TA(0x2000)},
+	{DSI_TIMEOUT_1, DSI_TIMEOUT_PR(0x1343) | DSI_TIMEOUT_TA(0x2000)},
 	{DSI_TO_TALLY, 0},
 	{DSI_HOST_CONTROL, DSI_HOST_CONTROL_CRC_RESET | DSI_HOST_CONTROL_TX_TRIG_HOST | DSI_HOST_CONTROL_CS | DSI_HOST_CONTROL_ECC},
 	{DSI_CONTROL, DSI_CONTROL_LANES(3) | DSI_CONTROL_HOST_ENABLE},
@@ -544,7 +545,7 @@ static const cfg_op_t cfg_display_framebuffer[32] = {
 	{DC_WIN_PRESCALED_SIZE, V_PRESCALED_SIZE(1280) | H_PRESCALED_SIZE(2880)}, //Pre-scaled size: 1280x2880 bytes.
 	{DC_WIN_DDA_INC, V_DDA_INC(0x1000) | H_DDA_INC(0x1000)},
 	{DC_WIN_SIZE, V_SIZE(1280) | H_SIZE(720)}, //Window size: 1280 vertical lines x 720 horizontal pixels.
-	{DC_WIN_LINE_STRIDE, 0x6000C00}, //768*2x768*4 (= 0x600 x 0xC00) bytes, see TRM for alignment requirements.
+	{DC_WIN_LINE_STRIDE, UV_LINE_STRIDE(720 * 2) | LINE_STRIDE(720 * 4)}, //768*2x768*4 (= 0x600 x 0xC00) bytes, see TRM for alignment requirements.
 	{DC_WIN_BUFFER_CONTROL, 0},
 	{DC_WINBUF_SURFACE_KIND, 0}, //Regular surface.
 	{DC_WINBUF_START_ADDR, 0xC0000000}, //Framebuffer address.

bootloader/gfx/gfx.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (C) 2018-2019 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -117,73 +117,73 @@ static const u8 _gfx_font[] = {
 	0x00, 0x00, 0x00, 0x4C, 0x32, 0x00, 0x00, 0x00  // Char 126 (~)
 };
 
-void gfx_init_ctxt(gfx_ctxt_t *ctxt, u32 *fb, u32 width, u32 height, u32 stride)
+void gfx_init_ctxt(u32 *fb, u32 width, u32 height, u32 stride)
 {
-	ctxt->fb = fb;
-	ctxt->width = width;
-	ctxt->height = height;
-	ctxt->stride = stride;
+	gfx_ctxt.fb = fb;
+	gfx_ctxt.width = width;
+	gfx_ctxt.height = height;
+	gfx_ctxt.stride = stride;
 }
 
-void gfx_clear_grey(gfx_ctxt_t *ctxt, u8 color)
+void gfx_clear_grey(u8 color)
 {
-	memset(ctxt->fb, color, 0x3C0000);
+	memset(gfx_ctxt.fb, color, 0x3C0000);
 }
 
-void gfx_clear_color(gfx_ctxt_t *ctxt, u32 color)
+void gfx_clear_color(u32 color)
 {
-	for (u32 i = 0; i < ctxt->height * ctxt->stride; i++)
-		ctxt->fb[i] = color;
+	for (u32 i = 0; i < gfx_ctxt.height * gfx_ctxt.stride; i++)
+		gfx_ctxt.fb[i] = color;
 }
 
-void gfx_clear_partial_grey(gfx_ctxt_t *ctxt, u8 color, u32 pos_x, u32 height)
+void gfx_clear_partial_grey(u8 color, u32 pos_x, u32 height)
 {
-	memset(ctxt->fb + pos_x * ctxt->stride, color, height * 4 * ctxt->stride);
+	memset(gfx_ctxt.fb + pos_x * gfx_ctxt.stride, color, height * 4 * gfx_ctxt.stride);
 }
 
-void gfx_con_init(gfx_con_t *con, gfx_ctxt_t *ctxt)
+void gfx_con_init()
 {
-	con->gfx_ctxt = ctxt;
-	con->fntsz = 16;
-	con->x = 0;
-	con->y = 0;
-	con->savedx = 0;
-	con->savedy = 0;
-	con->fgcol = 0xFFCCCCCC;
-	con->fillbg = 0;
-	con->bgcol = 0xFF1B1B1B;
-	con->mute = 0;
+	gfx_con.gfx_ctxt = &gfx_ctxt;
+	gfx_con.fntsz = 16;
+	gfx_con.x = 0;
+	gfx_con.y = 0;
+	gfx_con.savedx = 0;
+	gfx_con.savedy = 0;
+	gfx_con.fgcol = 0xFFCCCCCC;
+	gfx_con.fillbg = 1;
+	gfx_con.bgcol = 0xFF1B1B1B;
+	gfx_con.mute = 0;
 }
 
-void gfx_con_setcol(gfx_con_t *con, u32 fgcol, int fillbg, u32 bgcol)
+void gfx_con_setcol(u32 fgcol, int fillbg, u32 bgcol)
 {
-	con->fgcol = fgcol;
-	con->fillbg = fillbg;
-	con->bgcol = bgcol;
+	gfx_con.fgcol = fgcol;
+	gfx_con.fillbg = fillbg;
+	gfx_con.bgcol = bgcol;
 }
 
-void gfx_con_getpos(gfx_con_t *con, u32 *x, u32 *y)
+void gfx_con_getpos(u32 *x, u32 *y)
 {
-	*x = con->x;
-	*y = con->y;
+	*x = gfx_con.x;
+	*y = gfx_con.y;
 }
 
-void gfx_con_setpos(gfx_con_t *con, u32 x, u32 y)
+void gfx_con_setpos(u32 x, u32 y)
 {
-	con->x = x;
-	con->y = y;
+	gfx_con.x = x;
+	gfx_con.y = y;
 }
 
-void gfx_putc(gfx_con_t *con, char c)
+void gfx_putc(char c)
 {
 	// Duplicate code for performance reasons.
-	switch (con->fntsz)
+	switch (gfx_con.fntsz)
 	{
 	case 16:
 		if (c >= 32 && c <= 126)
 		{
 			u8 *cbuf = (u8 *)&_gfx_font[8 * (c - 32)];
-			u32 *fb = con->gfx_ctxt->fb + con->x + con->y * con->gfx_ctxt->stride;
+			u32 *fb = gfx_ctxt.fb + gfx_con.x + gfx_con.y * gfx_ctxt.stride;
 
 			for (u32 i = 0; i < 16; i+=2)
 			{
@@ -194,33 +194,33 @@ void gfx_putc(gfx_con_t *con, char c)
 					{
 						if (v & 1)
 						{
-							*fb = con->fgcol;
+							*fb = gfx_con.fgcol;
 							fb++;
-							*fb = con->fgcol;
+							*fb = gfx_con.fgcol;
 						}
-						else if (con->fillbg)
+						else if (gfx_con.fillbg)
 						{
-							*fb = con->bgcol;
+							*fb = gfx_con.bgcol;
 							fb++;
-							*fb = con->bgcol;
+							*fb = gfx_con.bgcol;
 						}
 						else
 							fb++;
 						v >>= 1;
 						fb++;
 					}
-					fb += con->gfx_ctxt->stride - 16;
+					fb += gfx_ctxt.stride - 16;
 					v = *cbuf;
 				}
 			}
-			con->x += 16;
+			gfx_con.x += 16;
 		}
 		else if (c == '\n')
 		{
-			con->x = 0;
-			con->y +=16;
-			if (con->y > con->gfx_ctxt->height - 16)
-				con->y = 0;
+			gfx_con.x = 0;
+			gfx_con.y +=16;
+			if (gfx_con.y > gfx_ctxt.height - 16)
+				gfx_con.y = 0;
 		}
 		break;
 	case 8:
@@ -228,45 +228,45 @@ void gfx_putc(gfx_con_t *con, char c)
 		if (c >= 32 && c <= 126)
 		{
 			u8 *cbuf = (u8 *)&_gfx_font[8 * (c - 32)];
-			u32 *fb = con->gfx_ctxt->fb + con->x + con->y * con->gfx_ctxt->stride;
+			u32 *fb = gfx_ctxt.fb + gfx_con.x + gfx_con.y * gfx_ctxt.stride;
 			for (u32 i = 0; i < 8; i++)
 			{
 				u8 v = *cbuf++;
 				for (u32 j = 0; j < 8; j++)
 				{
 					if (v & 1)
-						*fb = con->fgcol;
-					else if (con->fillbg)
-						*fb = con->bgcol;
+						*fb = gfx_con.fgcol;
+					else if (gfx_con.fillbg)
+						*fb = gfx_con.bgcol;
 					v >>= 1;
 					fb++;
 				}
-				fb += con->gfx_ctxt->stride - 8;
+				fb += gfx_ctxt.stride - 8;
 			}
-			con->x += 8;
+			gfx_con.x += 8;
 		}
 		else if (c == '\n')
 		{
-			con->x = 0;
-			con->y += 8;
-			if (con->y > con->gfx_ctxt->height - 8)
-				con->y = 0;
+			gfx_con.x = 0;
+			gfx_con.y += 8;
+			if (gfx_con.y > gfx_ctxt.height - 8)
+				gfx_con.y = 0;
 		}
 		break;
 	}
 	
 }
 
-void gfx_puts(gfx_con_t *con, const char *s)
+void gfx_puts(const char *s)
 {
-	if (!s || con->mute)
+	if (!s || gfx_con.mute)
 		return;
 
 	for (; *s; s++)
-		gfx_putc(con, *s);
+		gfx_putc(*s);
 }
 
-static void _gfx_putn(gfx_con_t *con, u32 v, int base, char fill, int fcnt)
+static void _gfx_putn(u32 v, int base, char fill, int fcnt)
 {
 	char buf[65];
 	static const char digits[] = "0123456789ABCDEFghijklmnopqrstuvwxyz";
@@ -294,28 +294,28 @@ static void _gfx_putn(gfx_con_t *con, u32 v, int base, char fill, int fcnt)
 		}
 	}
 
-	gfx_puts(con, p);
+	gfx_puts(p);
 }
 
-void gfx_put_small_sep(gfx_con_t *con)
+void gfx_put_small_sep()
 {
-	u8 prevFontSize = con->fntsz;
-	con->fntsz = 8;
-	gfx_putc(con, '\n');
-	con->fntsz = prevFontSize;
+	u8 prevFontSize = gfx_con.fntsz;
+	gfx_con.fntsz = 8;
+	gfx_putc('\n');
+	gfx_con.fntsz = prevFontSize;
 }
 
-void gfx_put_big_sep(gfx_con_t *con)
+void gfx_put_big_sep()
 {
-	u8 prevFontSize = con->fntsz;
-	con->fntsz = 16;
-	gfx_putc(con, '\n');
-	con->fntsz = prevFontSize;
+	u8 prevFontSize = gfx_con.fntsz;
+	gfx_con.fntsz = 16;
+	gfx_putc('\n');
+	gfx_con.fntsz = prevFontSize;
 }
 
-void gfx_printf(gfx_con_t *con, const char *fmt, ...)
+void gfx_printf(const char *fmt, ...)
 {
-	if (con->mute)
+	if (gfx_con.mute)
 		return;
 
 	va_list ap;
@@ -348,40 +348,40 @@ void gfx_printf(gfx_con_t *con, const char *fmt, ...)
 			switch(*fmt)
 			{
 			case 'c':
-				gfx_putc(con, va_arg(ap, u32));
+				gfx_putc(va_arg(ap, u32));
 				break;
 			case 's':
-				gfx_puts(con, va_arg(ap, char *));
+				gfx_puts(va_arg(ap, char *));
 				break;
 			case 'd':
-				_gfx_putn(con, va_arg(ap, u32), 10, fill, fcnt);
+				_gfx_putn(va_arg(ap, u32), 10, fill, fcnt);
 				break;
 			case 'p':
 			case 'P':
 			case 'x':
 			case 'X':
-				_gfx_putn(con, va_arg(ap, u32), 16, fill, fcnt);
+				_gfx_putn(va_arg(ap, u32), 16, fill, fcnt);
 				break;
 			case 'k':
-				con->fgcol = va_arg(ap, u32);
+				gfx_con.fgcol = va_arg(ap, u32);
 				break;
 			case 'K':
-				con->bgcol = va_arg(ap, u32);
-				con->fillbg = 1;
+				gfx_con.bgcol = va_arg(ap, u32);
+				gfx_con.fillbg = 1;
 				break;
 			case '%':
-				gfx_putc(con, '%');
+				gfx_putc('%');
 				break;
 			case '\0':
 				goto out;
 			default:
-				gfx_putc(con, '%');
-				gfx_putc(con, *fmt);
+				gfx_putc('%');
+				gfx_putc(*fmt);
 				break;
 			}
 		}
 		else
-			gfx_putc(con, *fmt);
+			gfx_putc(*fmt);
 		fmt++;
 	}
 
@@ -389,33 +389,33 @@ void gfx_printf(gfx_con_t *con, const char *fmt, ...)
 	va_end(ap);
 }
 
-void gfx_hexdump(gfx_con_t *con, u32 base, const u8 *buf, u32 len)
+void gfx_hexdump(u32 base, const u8 *buf, u32 len)
 {
-	if (con->mute)
+	if (gfx_con.mute)
 		return;
 
-	u8 prevFontSize = con->fntsz;
-	con->fntsz = 8;
+	u8 prevFontSize = gfx_con.fntsz;
+	gfx_con.fntsz = 8;
 	for(u32 i = 0; i < len; i++)
 	{
 		if(i % 0x10 == 0)
 		{
 			if(i != 0)
 			{
-				gfx_puts(con, "| ");
+				gfx_puts("| ");
 				for(u32 j = 0; j < 0x10; j++)
 				{
 					u8 c = buf[i - 0x10 + j];
 					if(c >= 32 && c <= 126)
-						gfx_putc(con, c);
+						gfx_putc(c);
 					else
-						gfx_putc(con, '.');
+						gfx_putc('.');
 				}
-				gfx_putc(con, '\n');
+				gfx_putc('\n');
 			}
-			gfx_printf(con, "%08x: ", base + i);
+			gfx_printf("%08x: ", base + i);
 		}
-		gfx_printf(con, "%02x ", buf[i]);
+		gfx_printf("%02x ", buf[i]);
 		if (i == len - 1)
 		{
 			int ln = len % 0x10 != 0;
@@ -424,22 +424,22 @@ void gfx_hexdump(gfx_con_t *con, u32 base, const u8 *buf, u32 len)
 			{
 				k = (len & 0xF) - 1;
 				for (u32 j = 0; j < 0x10 - k; j++)
-					gfx_puts(con, "   ");
+					gfx_puts("   ");
 			}
-			gfx_puts(con, "| ");
+			gfx_puts("| ");
 			for(u32 j = 0; j < (ln ? k : k + 1); j++)
 			{
 				u8 c = buf[i - k + j];
 				if(c >= 32 && c <= 126)
-					gfx_putc(con, c);
+					gfx_putc(c);
 				else
-					gfx_putc(con, '.');
+					gfx_putc('.');
 			}
-			gfx_putc(con, '\n');
+			gfx_putc('\n');
 		}
 	}
-	gfx_putc(con, '\n');
-	con->fntsz = prevFontSize;
+	gfx_putc('\n');
+	gfx_con.fntsz = prevFontSize;
 }
 
 static int abs(int x)
@@ -449,12 +449,12 @@ static int abs(int x)
 	return x;
 }
 
-void gfx_set_pixel(gfx_ctxt_t *ctxt, u32 x, u32 y, u32 color)
+void gfx_set_pixel(u32 x, u32 y, u32 color)
 {
-	ctxt->fb[x + y * ctxt->stride] = color;
+	gfx_ctxt.fb[x + y * gfx_ctxt.stride] = color;
 }
 
-void gfx_line(gfx_ctxt_t *ctxt, int x0, int y0, int x1, int y1, u32 color)
+void gfx_line(int x0, int y0, int x1, int y1, u32 color)
 {
 	int dx = abs(x1 - x0), sx = x0 < x1 ? 1 : -1;
 	int dy = abs(y1 - y0), sy = y0 < y1 ? 1 : -1;
@@ -462,7 +462,7 @@ void gfx_line(gfx_ctxt_t *ctxt, int x0, int y0, int x1, int y1, u32 color)
 
 	while (1)
 	{
-		gfx_set_pixel(ctxt, x0, y0, color);
+		gfx_set_pixel(x0, y0, color);
 		if (x0 == x1 && y0 == y1)
 			break;
 		e2 = err;
@@ -479,51 +479,46 @@ void gfx_line(gfx_ctxt_t *ctxt, int x0, int y0, int x1, int y1, u32 color)
 	}
 }
 
-void gfx_set_rect_grey(gfx_ctxt_t *ctxt, const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y)
+void gfx_set_rect_grey(const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y)
 {
 	u32 pos = 0;
 	for (u32 y = pos_y; y < (pos_y + size_y); y++)
 	{
 		for (u32 x = pos_x; x < (pos_x + size_x); x++)
 		{
-			memset(&ctxt->fb[x + y*ctxt->stride], buf[pos], 4);
+			memset(&gfx_ctxt.fb[x + y*gfx_ctxt.stride], buf[pos], 4);
 			pos++;
 		}
 	}
 }
 
 
-void gfx_set_rect_rgb(gfx_ctxt_t *ctxt, const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y)
+void gfx_set_rect_rgb(const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y)
 {
 	u32 pos = 0;
 	for (u32 y = pos_y; y < (pos_y + size_y); y++)
 	{
 		for (u32 x = pos_x; x < (pos_x + size_x); x++)
 		{
-			ctxt->fb[x + y*ctxt->stride] = buf[pos + 2] | (buf[pos + 1] << 8) | (buf[pos] << 16);
+			gfx_ctxt.fb[x + y * gfx_ctxt.stride] = buf[pos + 2] | (buf[pos + 1] << 8) | (buf[pos] << 16);
 			pos+=3;
 		}
 	}
 }
 
-void gfx_set_rect_argb(gfx_ctxt_t *ctxt, const u32 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y)
+void gfx_set_rect_argb(const u32 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y)
 {
-	u32 pos = 0;
+	u32 *ptr = (u32 *)buf;
 	for (u32 y = pos_y; y < (pos_y + size_y); y++)
-	{
 		for (u32 x = pos_x; x < (pos_x + size_x); x++)
-		{
-			ctxt->fb[x + y*ctxt->stride] = buf[pos];
-			pos+=1;
-		}
-	}
+			gfx_ctxt.fb[x + y * gfx_ctxt.stride] = *ptr++;
 }
 
-void gfx_render_bmp_argb(gfx_ctxt_t *ctxt, const u32 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y)
+void gfx_render_bmp_argb(const u32 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y)
 {
 	for (u32 y = pos_y; y < (pos_y + size_y); y++)
 	{
 		for (u32 x = pos_x; x < (pos_x + size_x); x++)
-			ctxt->fb[x + y*ctxt->stride]  = buf[(size_y + pos_y - 1 - y ) * size_x + x - pos_x];
+			gfx_ctxt.fb[x + y * gfx_ctxt.stride] = buf[(size_y + pos_y - 1 - y ) * size_x + x - pos_x];
 	}
 }

bootloader/gfx/gfx.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (C) 2018-2019 CTCaer
  * Copyright (C) 2018 M4xw
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -21,26 +21,35 @@
 
 #include "../../common/common_gfx.h"
 
-void gfx_init_ctxt(gfx_ctxt_t *ctxt, u32 *fb, u32 width, u32 height, u32 stride);
-void gfx_clear_grey(gfx_ctxt_t *ctxt, u8 color);
-void gfx_clear_partial_grey(gfx_ctxt_t *ctxt, u8 color, u32 pos_x, u32 height);
-void gfx_clear_color(gfx_ctxt_t *ctxt, u32 color);
-void gfx_con_init(gfx_con_t *con, gfx_ctxt_t *ctxt);
-void gfx_con_setcol(gfx_con_t *con, u32 fgcol, int fillbg, u32 bgcol);
-void gfx_con_getpos(gfx_con_t *con, u32 *x, u32 *y);
-void gfx_con_setpos(gfx_con_t *con, u32 x, u32 y);
-void gfx_putc(gfx_con_t *con, char c);
-void gfx_puts(gfx_con_t *con, const char *s);
-void gfx_printf(gfx_con_t *con, const char *fmt, ...);
-void gfx_hexdump(gfx_con_t *con, u32 base, const u8 *buf, u32 len);
+#define EPRINTF(text) gfx_printf("%k"text"%k\n", 0xFFFF0000, 0xFFCCCCCC)
+#define EPRINTFARGS(text, args...) gfx_printf("%k"text"%k\n", 0xFFFF0000, args, 0xFFCCCCCC)
+#define WPRINTF(text) gfx_printf("%k"text"%k\n", 0xFFFFDD00, 0xFFCCCCCC)
+#define WPRINTFARGS(text, args...) gfx_printf("%k"text"%k\n", 0xFFFFDD00, args, 0xFFCCCCCC)
 
-void gfx_set_pixel(gfx_ctxt_t *ctxt, u32 x, u32 y, u32 color);
-void gfx_line(gfx_ctxt_t *ctxt, int x0, int y0, int x1, int y1, u32 color);
-void gfx_put_small_sep(gfx_con_t *con);
-void gfx_put_big_sep(gfx_con_t *con);
-void gfx_set_rect_grey(gfx_ctxt_t *ctxt, const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
-void gfx_set_rect_rgb(gfx_ctxt_t *ctxt, const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
-void gfx_set_rect_argb(gfx_ctxt_t *ctxt, const u32 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
-void gfx_render_bmp_argb(gfx_ctxt_t *ctxt, const u32 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
+void gfx_init_ctxt(u32 *fb, u32 width, u32 height, u32 stride);
+void gfx_clear_grey(u8 color);
+void gfx_clear_partial_grey(u8 color, u32 pos_x, u32 height);
+void gfx_clear_color(u32 color);
+void gfx_con_init();
+void gfx_con_setcol(u32 fgcol, int fillbg, u32 bgcol);
+void gfx_con_getpos(u32 *x, u32 *y);
+void gfx_con_setpos(u32 x, u32 y);
+void gfx_putc(char c);
+void gfx_puts(const char *s);
+void gfx_printf(const char *fmt, ...);
+void gfx_hexdump(u32 base, const u8 *buf, u32 len);
+
+void gfx_set_pixel(u32 x, u32 y, u32 color);
+void gfx_line(int x0, int y0, int x1, int y1, u32 color);
+void gfx_put_small_sep();
+void gfx_put_big_sep();
+void gfx_set_rect_grey(const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
+void gfx_set_rect_rgb(const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
+void gfx_set_rect_argb(const u32 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
+void gfx_render_bmp_argb(const u32 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
+
+// Global gfx console and context.
+gfx_ctxt_t gfx_ctxt;
+gfx_con_t gfx_con;
 
 #endif

bootloader/gfx/tui.c

@@ -15,6 +15,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include "di.h"
 #include "tui.h"
 #include "../utils/btn.h"
 #include "../config/config.h"
@@ -31,7 +32,7 @@ extern u8 *Kc_MENU_LOGO;
 
 extern hekate_config h_cfg;
 
-void tui_sbar(gfx_con_t *con, bool force_update)
+void tui_sbar(bool force_update)
 {
 	u32 cx, cy;
 
@@ -40,78 +41,78 @@ void tui_sbar(gfx_con_t *con, bool force_update)
 		if (timePassed < 5)
 			return;
 
-	u8 prevFontSize = con->fntsz;
-	con->fntsz = 16;
+	u8 prevFontSize = gfx_con.fntsz;
+	gfx_con.fntsz = 16;
 	h_cfg.sbar_time_keeping = get_tmr_s();
 
 	u32 battPercent = 0;
 	int battVoltCurr = 0;
 
-	gfx_con_getpos(con, &cx, &cy);
-	gfx_con_setpos(con, 0,  1260);
+	gfx_con_getpos(&cx, &cy);
+	gfx_con_setpos(0,  1260);
 
 	max17050_get_property(MAX17050_RepSOC, (int *)&battPercent);
 	max17050_get_property(MAX17050_VCELL, &battVoltCurr);
 
-	gfx_clear_partial_grey(con->gfx_ctxt, 0x30, 1256, 24);
-	gfx_printf(con, "%K%k Battery: %d.%d%% (%d mV) - Charge:", 0xFF303030, 0xFF888888,
+	gfx_clear_partial_grey(0x30, 1256, 24);
+	gfx_printf("%K%k Battery: %d.%d%% (%d mV) - Charge:", 0xFF303030, 0xFF888888,
 		(battPercent >> 8) & 0xFF, (battPercent & 0xFF) / 26, battVoltCurr);
 
-	max17050_get_property(MAX17050_AvgCurrent, &battVoltCurr);
+	max17050_get_property(MAX17050_Current, &battVoltCurr);
 
 	if (battVoltCurr >= 0)
-		gfx_printf(con, " %k+%d mA     %k%K\n",
+		gfx_printf(" %k+%d mA%k%K\n",
 			0xFF008800, battVoltCurr / 1000, 0xFFCCCCCC, 0xFF1B1B1B);
 	else
-		gfx_printf(con, " %k-%d mA     %k%K\n",
+		gfx_printf(" %k-%d mA%k%K\n",
 			0xFF880000, (~battVoltCurr) / 1000, 0xFFCCCCCC, 0xFF1B1B1B);
-	con->fntsz = prevFontSize;
-	gfx_con_setpos(con, cx, cy);
+	gfx_con.fntsz = prevFontSize;
+	gfx_con_setpos(cx, cy);
 }
 
-void tui_pbar(gfx_con_t *con, int x, int y, u32 val, u32 fgcol, u32 bgcol)
+void tui_pbar(int x, int y, u32 val, u32 fgcol, u32 bgcol)
 {
 	u32 cx, cy;
 	if (val > 200)
 		val = 200;
 
-	gfx_con_getpos(con, &cx, &cy);
+	gfx_con_getpos(&cx, &cy);
 
-	gfx_con_setpos(con, x, y);
+	gfx_con_setpos(x, y);
 
-	gfx_printf(con, "%k[%3d%%]%k", fgcol, val, 0xFFCCCCCC);
+	gfx_printf("%k[%3d%%]%k", fgcol, val, 0xFFCCCCCC);
 
-	x += 7 * con->fntsz;
+	x += 7 * gfx_con.fntsz;
 	
-	for (int i = 0; i < (con->fntsz >> 3) * 6; i++)
+	for (int i = 0; i < (gfx_con.fntsz >> 3) * 6; i++)
 	{
-		gfx_line(con->gfx_ctxt, x, y + i + 1, x + 3 * val, y + i + 1, fgcol);
-		gfx_line(con->gfx_ctxt, x + 3 * val, y + i + 1, x + 3 * 100, y + i + 1, bgcol);
+		gfx_line(x, y + i + 1, x + 3 * val, y + i + 1, fgcol);
+		gfx_line(x + 3 * val, y + i + 1, x + 3 * 100, y + i + 1, bgcol);
 	}
 
-	gfx_con_setpos(con, cx, cy);
+	gfx_con_setpos(cx, cy);
 
 	// Update status bar.
-	tui_sbar(con, false);
+	tui_sbar(false);
 }
 
-void *tui_do_menu(gfx_con_t *con, menu_t *menu)
+void *tui_do_menu(menu_t *menu)
 {
 	int idx = 0, prev_idx = 0, cnt = 0x7FFFFFFF;
 
-	gfx_clear_partial_grey(con->gfx_ctxt, 0x1B, 0, 1256);
-	tui_sbar(con, true);
+	gfx_clear_partial_grey(0x1B, 0, 1256);
+	tui_sbar(true);
 
 #ifdef MENU_LOGO_ENABLE
-	gfx_set_rect_rgb(con->gfx_ctxt, Kc_MENU_LOGO,
+	gfx_set_rect_rgb(Kc_MENU_LOGO,
 		X_MENU_LOGO, Y_MENU_LOGO, X_POS_MENU_LOGO, Y_POS_MENU_LOGO);
 #endif //MENU_LOGO_ENABLE
 
-	while (1)
+	while (true)
 	{
-		gfx_con_setcol(con, 0xFFCCCCCC, 1, 0xFF1B1B1B);
-		gfx_con_setpos(con, menu->x, menu->y);
-		gfx_printf(con, "[%s]\n\n", menu->caption);
+		gfx_con_setcol(0xFFCCCCCC, 1, 0xFF1B1B1B);
+		gfx_con_setpos(menu->x, menu->y);
+		gfx_printf("[%s]\n\n", menu->caption);
 
 		// Skip caption or seperator lines selection.
 		while (menu->ents[idx].type == MENT_CAPTION ||
@@ -142,24 +143,32 @@ void *tui_do_menu(gfx_con_t *con, menu_t *menu)
 		for (cnt = 0; menu->ents[cnt].type != MENT_END; cnt++)
 		{
 			if (cnt == idx)
-				gfx_con_setcol(con, 0xFF1B1B1B, 1, 0xFFCCCCCC);
+				gfx_con_setcol(0xFF1B1B1B, 1, 0xFFCCCCCC);
 			else
-				gfx_con_setcol(con, 0xFFCCCCCC, 1, 0xFF1B1B1B);
+				gfx_con_setcol(0xFFCCCCCC, 1, 0xFF1B1B1B);
 			if (menu->ents[cnt].type == MENT_CAPTION)
-				gfx_printf(con, "%k %s", menu->ents[cnt].color, menu->ents[cnt].caption);
+				gfx_printf("%k %s", menu->ents[cnt].color, menu->ents[cnt].caption);
 			else if (menu->ents[cnt].type != MENT_CHGLINE)
-				gfx_printf(con, " %s", menu->ents[cnt].caption);
+				gfx_printf(" %s", menu->ents[cnt].caption);
 			if(menu->ents[cnt].type == MENT_MENU)
-				gfx_printf(con, "%k...", 0xFF0099EE);
-			gfx_printf(con, " \n");
+				gfx_printf("%k...", 0xFF0099EE);
+			gfx_printf(" \n");
 		}
-		gfx_con_setcol(con, 0xFFCCCCCC, 1, 0xFF1B1B1B);
-		gfx_putc(con, '\n');
+		gfx_con_setcol(0xFFCCCCCC, 1, 0xFF1B1B1B);
+		gfx_putc('\n');
 
 		// Print help and battery status.
-		gfx_con_getpos(con, &con->savedx,  &con->savedy);
-		gfx_con_setpos(con, 0,  1191);
-		gfx_printf(con, "%k VOL: Move up/down\n PWR: Select option%k", 0xFF555555, 0xFFCCCCCC);
+		gfx_con_setpos(0,  1127);
+		if (h_cfg.errors)
+		{
+			gfx_printf("%k Warning: %k", 0xFF800000, 0xFF555555);
+			if (h_cfg.errors & ERR_LIBSYS_LP0)
+				gfx_printf("Sleep mode library is missing!\n");
+		}
+		gfx_con_setpos(0,  1191);
+		gfx_printf("%k VOL: Move up/down\n PWR: Select option%k", 0xFF555555, 0xFFCCCCCC);
+
+		display_backlight_brightness(h_cfg.backlight, 1000);
 
 		// Wait for user command.
 		u32 btn = btn_wait();
@@ -167,11 +176,17 @@ void *tui_do_menu(gfx_con_t *con, menu_t *menu)
 		if (btn & BTN_VOL_DOWN && idx < (cnt - 1))
 			idx++;
 		else if (btn & BTN_VOL_DOWN && idx == (cnt - 1))
+		{
 			idx = 0;
+			prev_idx = -1;
+		}
 		if (btn & BTN_VOL_UP && idx > 0)
 			idx--;
 		else if (btn & BTN_VOL_UP && idx == 0)
+		{
 			idx = cnt - 1;
+			prev_idx = cnt;
+		}
 		if (btn & BTN_POWER)
 		{
 			ment_t *ent = &menu->ents[idx];
@@ -181,28 +196,30 @@ void *tui_do_menu(gfx_con_t *con, menu_t *menu)
 				ent->handler(ent->data);
 				break;
 			case MENT_MENU:
-				return tui_do_menu(con, ent->menu);
+				return tui_do_menu(ent->menu);
 				break;
-			case MENT_CHOICE:
+			case MENT_DATA:
 				return ent->data;
 				break;
 			case MENT_BACK:
 				return NULL;
 				break;
 			case MENT_HDLR_RE:
-				ent->handler(ent->data);
-				return NULL;
+				ent->handler(ent);
+				if (!ent->data)
+					return NULL;
+				break;
 			default:
 				break;
 			}
-			con->fntsz = 16;
-			gfx_clear_partial_grey(con->gfx_ctxt, 0x1B, 0, 1256);
+			gfx_con.fntsz = 16;
+			gfx_clear_partial_grey(0x1B, 0, 1256);
 #ifdef MENU_LOGO_ENABLE
-			gfx_set_rect_rgb(con->gfx_ctxt, Kc_MENU_LOGO,
+			gfx_set_rect_rgb(Kc_MENU_LOGO,
 				X_MENU_LOGO, Y_MENU_LOGO, X_POS_MENU_LOGO, Y_POS_MENU_LOGO);
 #endif //MENU_LOGO_ENABLE
 		}
-		tui_sbar(con, false);
+		tui_sbar(false);
 	}
 
 	return NULL;

bootloader/gfx/tui.h

@@ -24,7 +24,7 @@
 #define MENT_END     0
 #define MENT_HANDLER 1
 #define MENT_MENU    2
-#define MENT_CHOICE  3
+#define MENT_DATA    3
 #define MENT_BACK    4
 #define MENT_CAPTION 5
 #define MENT_CHGLINE 6
@@ -59,8 +59,8 @@ typedef struct _menu_t
 #define MDEF_CAPTION(caption, color) { MENT_CAPTION, caption, color }
 #define MDEF_CHGLINE() {MENT_CHGLINE}
 
-void tui_sbar(gfx_con_t *con, bool force_update);
-void tui_pbar(gfx_con_t *con, int x, int y, u32 val, u32 fgcol, u32 bgcol);
-void *tui_do_menu(gfx_con_t *con, menu_t *menu);
+void tui_sbar(bool force_update);
+void tui_pbar(int x, int y, u32 val, u32 fgcol, u32 bgcol);
+void *tui_do_menu(menu_t *menu);
 
 #endif

bootloader/hos/fss.c

@@ -0,0 +1,144 @@
+/*
+ * Atmosphère Fusée Secondary Storage parser.
+ *
+ * Copyright (c) 2019 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <string.h>
+
+#include "fss.h"
+#include "hos.h"
+#include "../libs/fatfs/ff.h"
+#include "../mem/heap.h"
+
+#include "../gfx/gfx.h"
+#define DPRINTF(...)
+
+#define FSS0_MAGIC 0x30535346
+#define CNT_TYPE_FSP 0
+#define CNT_TYPE_EXO 1
+#define CNT_TYPE_WBT 2
+#define CNT_TYPE_RBT 3
+#define CNT_TYPE_SP1 4
+#define CNT_TYPE_SP2 5
+#define CNT_TYPE_KIP 6
+#define CNT_TYPE_BMP 7
+
+typedef struct _fss_t
+{
+	u32 magic;
+	u32 size;
+	u32 crt0_off;
+	u32 cnt_off;
+	u32 cnt_count;
+	u32 hos_ver;
+	u32 version;
+	u32 git_rev;
+} fss_t;
+
+typedef struct _fss_content_t
+{
+	u32 offset;
+	u32 size;
+	u32 type;
+	u32 rsvd1;
+	char name[0x10];
+} fss_content_t;
+
+int parse_fss(launch_ctxt_t *ctxt, const char *value)
+{
+	FIL fp;
+
+	bool stock = false;
+
+	LIST_FOREACH_ENTRY(ini_kv_t, kv, &ctxt->cfg->kvs, link)
+	{
+		if (!strcmp("stock", kv->key))
+			if (kv->val[0] == '1')
+				stock = true;
+	}
+
+	if (stock && ctxt->pkg1_id->kb <= KB_FIRMWARE_VERSION_620)
+		return 1;
+
+	if (f_open(&fp, value, FA_READ) != FR_OK)
+		return 0;
+
+	ctxt->atmosphere = true;
+
+	void *fss = malloc(f_size(&fp));
+	// Read header.
+	f_read(&fp, fss, 0x400, NULL);
+
+	u32 fss_entry = *(u32 *)(fss + 4);
+	fss_t *fss_meta = (fss_t *)(fss + fss_entry);
+
+	if (fss_meta->magic == FSS0_MAGIC)
+	{
+		gfx_printf("Found FSS0, Atmosphere %d.%d.%d-%08x\n"
+			"Max HOS supported: %d.%d.%d\n"
+			"Unpacking and loading components..  ",
+			fss_meta->version >> 24, (fss_meta->version >> 16) & 0xFF, (fss_meta->version >> 8) & 0xFF, fss_meta->git_rev,
+			fss_meta->hos_ver >> 24, (fss_meta->hos_ver >> 16) & 0xFF, (fss_meta->hos_ver >> 8) & 0xFF);
+
+		fss_content_t *curr_fss_cnt = (fss_content_t *)(fss + fss_meta->cnt_off);
+		void *content;
+		for (int i = 0; i < fss_meta->cnt_count; i++)
+		{
+			content = (void *)(fss + curr_fss_cnt[i].offset);
+			if ((curr_fss_cnt[i].offset + curr_fss_cnt[i].size) > fss_meta->size)
+				continue;
+
+			// Load content to launch context.
+			switch (curr_fss_cnt[i].type)
+			{
+			case CNT_TYPE_KIP:
+				if (stock)
+					continue;
+				merge_kip_t *mkip1 = (merge_kip_t *)malloc(sizeof(merge_kip_t));
+				mkip1->kip1 = content;
+				list_append(&ctxt->kip1_list, &mkip1->link);
+				DPRINTF("Loaded %s.kip1 from FSS0 (size %08X)\n", curr_fss_cnt[i].name, curr_fss_cnt[i].size);
+				break;
+			case CNT_TYPE_EXO:
+				ctxt->secmon_size = curr_fss_cnt[i].size;
+				ctxt->secmon = content;
+				break;
+			case CNT_TYPE_WBT:
+				ctxt->warmboot_size = curr_fss_cnt[i].size;
+				ctxt->warmboot = content;
+				break;
+			default:
+				continue;
+			// TODO: add more types?
+			// case CNT_TYPE_SP1:
+			// case CNT_TYPE_SP2:
+			}
+
+			f_lseek(&fp, curr_fss_cnt[i].offset);
+			f_read(&fp, content, curr_fss_cnt[i].size, NULL);
+		}
+
+		gfx_printf("Done!\n");
+		f_close(&fp);
+
+		return 1;
+	}
+
+	f_close(&fp);
+	free(fss);
+
+	return 0;
+}

bootloader/hos/fss.h

@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2019 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _FSS_H_
+#define _FSS_H_
+
+#include "hos.h"
+
+int parse_fss(launch_ctxt_t *ctxt, const char *value);
+
+#endif

bootloader/hos/hos.h

@@ -17,10 +17,61 @@
 #ifndef _HOS_H_
 #define _HOS_H_
 
+#include "pkg1.h"
+#include "pkg2.h"
 #include "../utils/types.h"
 #include "../config/ini.h"
+#include "../sec/tsec.h"
+
+#define KB_FIRMWARE_VERSION_100_200 0
+#define KB_FIRMWARE_VERSION_300 1
+#define KB_FIRMWARE_VERSION_301 2
+#define KB_FIRMWARE_VERSION_400 3
+#define KB_FIRMWARE_VERSION_500 4
+#define KB_FIRMWARE_VERSION_600 5
+#define KB_FIRMWARE_VERSION_620 6
+#define KB_FIRMWARE_VERSION_700 7
+#define KB_FIRMWARE_VERSION_MAX KB_FIRMWARE_VERSION_700
+
+#define HOS_PKG11_MAGIC 0x31314B50
+
+typedef struct _launch_ctxt_t
+{
+	void *keyblob;
+
+	void *pkg1;
+	const pkg1_id_t *pkg1_id;
+	const pkg2_kernel_id_t *pkg2_kernel_id;
+
+	void *warmboot;
+	u32   warmboot_size;
+	void *secmon;
+	u32   secmon_size;
+
+	void *pkg2;
+	u32   pkg2_size;
+
+	bool   new_pkg2;
+	void  *kernel;
+	u32    kernel_size;
+	link_t kip1_list;
+	char*  kip1_patches;
+
+	bool svcperm;
+	bool debugmode;
+	bool stock;
+	bool atmosphere;
+
+	ini_sec_t *cfg;
+} launch_ctxt_t;
+
+typedef struct _merge_kip_t
+{
+	void *kip1;
+	link_t link;
+} merge_kip_t;
 
 int hos_launch(ini_sec_t *cfg);
-int keygen(u8 *keyblob, u32 kb, void *tsec_fw);
+int keygen(u8 *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt);
 
 #endif

bootloader/hos/hos_config.c

@@ -0,0 +1,235 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018-2019 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <string.h>
+
+#include "hos.h"
+#include "hos_config.h"
+#include "fss.h"
+#include "../libs/fatfs/ff.h"
+#include "../mem/heap.h"
+#include "../utils/dirlist.h"
+
+#include "../gfx/gfx.h"
+
+//#define DPRINTF(...) gfx_printf(__VA_ARGS__)
+#define DPRINTF(...)
+
+extern void *sd_file_read(const char *path, u32 *fsize);
+
+static int _config_warmboot(launch_ctxt_t *ctxt, const char *value)
+{
+	ctxt->warmboot = sd_file_read(value, &ctxt->warmboot_size);
+	if (!ctxt->warmboot)
+		return 0;
+	
+	return 1;
+}
+
+static int _config_secmon(launch_ctxt_t *ctxt, const char *value)
+{
+	ctxt->secmon = sd_file_read(value, &ctxt->secmon_size);
+	if (!ctxt->secmon)
+		return 0;
+
+	return 1;
+}
+
+static int _config_kernel(launch_ctxt_t *ctxt, const char *value)
+{
+	ctxt->kernel = sd_file_read(value, &ctxt->kernel_size);
+	if (!ctxt->kernel)
+		return 0;
+
+	return 1;
+}
+
+static int _config_kip1(launch_ctxt_t *ctxt, const char *value)
+{
+	u32 size;
+
+	if (!memcmp(value + strlen(value) - 1, "*", 1))
+	{
+		char *dir = (char *)malloc(256);
+		memcpy(dir, value, strlen(value) + 1);
+
+		u32 dirlen = 0;
+		dir[strlen(dir) - 2] = 0;
+		char *filelist = dirlist(dir, "*.kip*", false);
+
+		memcpy(dir + strlen(dir), "/", 2);
+		dirlen = strlen(dir);
+
+		u32 i = 0;
+		if (filelist)
+		{
+			while (true)
+			{
+				if (!filelist[i * 256])
+					break;
+
+				memcpy(dir + dirlen, &filelist[i * 256], strlen(&filelist[i * 256]) + 1);
+
+				merge_kip_t *mkip1 = (merge_kip_t *)malloc(sizeof(merge_kip_t));
+				mkip1->kip1 = sd_file_read(dir, &size);
+				if (!mkip1->kip1)
+				{
+					free(mkip1);
+					free(dir);
+					free(filelist);
+
+					return 0;
+				}
+				DPRINTF("Loaded kip1 from SD (size %08X)\n", size);
+				list_append(&ctxt->kip1_list, &mkip1->link);
+
+				i++;
+			}
+		}
+
+		free(dir);
+		free(filelist);
+	}
+	else
+	{
+		merge_kip_t *mkip1 = (merge_kip_t *)malloc(sizeof(merge_kip_t));
+		mkip1->kip1 = sd_file_read(value, &size);
+		if (!mkip1->kip1)
+		{
+			free(mkip1);
+
+			return 0;
+		}
+		DPRINTF("Loaded kip1 from SD (size %08X)\n", size);
+		list_append(&ctxt->kip1_list, &mkip1->link);
+	}
+
+	return 1;
+}
+
+int config_kip1patch(launch_ctxt_t *ctxt, const char *value)
+{
+	if (value == NULL)
+		return 0;
+
+	int valueLen = strlen(value);
+	if (!valueLen)
+		return 0;
+
+	if (ctxt->kip1_patches == NULL)
+	{
+		ctxt->kip1_patches = malloc(valueLen + 1);
+		memcpy(ctxt->kip1_patches, value, valueLen);
+		ctxt->kip1_patches[valueLen] = 0;
+	}
+	else
+	{
+		char *oldAlloc = ctxt->kip1_patches;
+		int oldSize = strlen(oldAlloc);
+		ctxt->kip1_patches = malloc(oldSize + 1 + valueLen + 1);
+		memcpy(ctxt->kip1_patches, oldAlloc, oldSize);
+		free(oldAlloc);
+		oldAlloc = NULL;
+		ctxt->kip1_patches[oldSize++] = ',';
+		memcpy(&ctxt->kip1_patches[oldSize], value, valueLen);
+		ctxt->kip1_patches[oldSize + valueLen] = 0;
+	}
+	return 1;
+}
+
+static int _config_svcperm(launch_ctxt_t *ctxt, const char *value)
+{
+	if (*value == '1')
+	{
+		DPRINTF("Disabled SVC verification\n");
+		ctxt->svcperm = true;
+	}
+	return 1;
+}
+
+static int _config_debugmode(launch_ctxt_t *ctxt, const char *value)
+{
+	if (*value == '1')
+	{
+		DPRINTF("Enabled Debug mode\n");
+		ctxt->debugmode = true;
+	}
+	return 1;
+}
+
+static int _config_stock(launch_ctxt_t *ctxt, const char *value)
+{
+	if (*value == '1')
+	{
+		DPRINTF("Disabled all patching\n");
+		ctxt->stock = true;
+	}
+	return 1;
+}
+
+static int _config_atmosphere(launch_ctxt_t *ctxt, const char *value)
+{
+	if (*value == '1')
+	{
+		DPRINTF("Enabled atmosphere patching\n");
+		ctxt->atmosphere = true;
+	}
+	return 1;
+}
+
+static int _config_fss(launch_ctxt_t *ctxt, const char *value)
+{
+	return parse_fss(ctxt, value);
+}
+
+typedef struct _cfg_handler_t
+{
+	const char *key;
+	int (*handler)(launch_ctxt_t *ctxt, const char *value);
+} cfg_handler_t;
+
+static const cfg_handler_t _config_handlers[] = {
+	{ "warmboot", _config_warmboot },
+	{ "secmon", _config_secmon },
+	{ "kernel", _config_kernel },
+	{ "kip1", _config_kip1 },
+	{ "kip1patch", config_kip1patch },
+	{ "fullsvcperm", _config_svcperm },
+	{ "debugmode", _config_debugmode },
+	{ "stock", _config_stock },
+	{ "atmosphere", _config_atmosphere },
+	{ "fss0", _config_fss },
+	{ NULL, NULL },
+};
+
+int parse_boot_config(launch_ctxt_t *ctxt)
+{
+	LIST_FOREACH_ENTRY(ini_kv_t, kv, &ctxt->cfg->kvs, link)
+	{
+		for(u32 i = 0; _config_handlers[i].key; i++)
+		{
+			if (!strcmp(_config_handlers[i].key, kv->key))
+				if (!_config_handlers[i].handler(ctxt, kv->val))
+				{
+					EPRINTFARGS("Error while loading %s:\n%s", kv->key, kv->val);
+					return 0;
+				}
+		}
+	}
+
+	return 1;
+}

bootloader/hos/hos_config.h

@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _HOS_CONFIG_H_
+#define _HOS_CONFIG_H_
+
+#include "hos.h"
+
+int parse_boot_config(launch_ctxt_t *ctxt);
+int config_kip1patch(launch_ctxt_t *ctxt, const char *value);
+
+#endif
+

bootloader/hos/pkg1.c

@@ -1,7 +1,8 @@
 /*
  * Copyright (c) 2018 naehrwert
  * Copyright (c) 2018 st4rk
- * Copyright (c) 2018 CTCaer
+ * Copyright (c) 2018-2019 CTCaer
+ * Copyright (c) 2018 balika011
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -19,8 +20,11 @@
 #include <string.h>
 
 #include "pkg1.h"
-#include "../utils/aarch64_util.h"
+#include "../gfx/gfx.h"
 #include "../sec/se.h"
+#include "../utils/aarch64_util.h"
+
+#define _NOPv7() 0xE320F000
 
 #define SM_100_ADR 0x4002B020
 PATCHSET_DEF(_secmon_1_patchset,
@@ -57,12 +61,63 @@ PATCHSET_DEF(_secmon_4_patchset,
 
 PATCHSET_DEF(_secmon_5_patchset,
 	// Patch package2 decryption and signature/hash checks.
-	{ 0xDA8 + 0x9D8 , _NOP() }, //package2 structure.
-	{ 0xDA8 + 0x9E4 , _NOP() }, //Version.
-	{ 0xDA8 + 0xC9C , _NOP() }, //Header signature.
-	{ 0xDA8 + 0x1038 , _NOP() } //Sections SHA2.
+	{ 0xDA8 + 0x9D8, _NOP() }, //package2 structure.
+	{ 0xDA8 + 0x9E4, _NOP() }, //Version.
+	{ 0xDA8 + 0xC9C, _NOP() }, //Header signature.
+	{ 0xDA8 + 0x1038, _NOP() } //Sections SHA2.
 );
 
+PATCHSET_DEF(_secmon_6_patchset,
+	// Patch package2 decryption and signature/hash checks.
+	{ 0xDC8 + 0x820, _NOP() },  //package2 structure.
+	{ 0xDC8 + 0x82C, _NOP() },  //Version.
+	{ 0xDC8 + 0xE90, _NOP() },  //Header signature.
+	{ 0xDC8 + 0x112C, _NOP() }, //Sections SHA2.
+	// Fix sleep mode for debug.
+	{ 0x1A68 + 0x3854, 0x94000E45 }, //gpio_config_for_uart.
+	{ 0x1A68 + 0x3858, 0x97FFFC0F }, //clkrst_reboot_uarta.
+	{ 0x1A68 + 0x385C, 0x52A00021 }, //MOV W1, #0x10000 ; baudrate.
+	{ 0x1A68 + 0x3860, 0x2A1F03E0 }, //MOV W0, WZR ; uart_port -> A.
+	{ 0x1A68 + 0x3864, 0x72984001 }, //MOVK W1, #0xC200 ; baudrate.
+	{ 0x1A68 + 0x3868, 0x94000C8C }, //uart_configure.
+	{ 0x1A68 + 0x3A6C, _NOP() }      // warmboot UARTA cfg.
+);
+
+PATCHSET_DEF(_secmon_620_patchset,
+	// Patch package2 decryption and signature/hash checks.
+	{ 0xDC8 + 0x604, _NOP() }, //package2 structure.
+	{ 0xDC8 + 0x610, _NOP() }, //Version.
+	{ 0xDC8 + 0xC74, _NOP() }, //Header signature.
+	{ 0xDC8 + 0xF10, _NOP() }, //Sections SHA2.
+	// Fix sleep mode for debug.
+	{ 0x2AC8 + 0x3854, 0x94000F42 }, //gpio_config_for_uart.
+	{ 0x2AC8 + 0x3858, 0x97FFFC0F }, //clkrst_reboot_uarta.
+	{ 0x2AC8 + 0x385C, 0x52A00021 }, //MOV W1, #0x10000 ; baudrate.
+	{ 0x2AC8 + 0x3860, 0x2A1F03E0 }, //MOV W0, WZR ; uart_port -> A.
+	{ 0x2AC8 + 0x3864, 0x72984001 }, //MOVK W1, #0xC200 ; baudrate.
+	{ 0x2AC8 + 0x3868, 0x94000D89 }, //uart_configure.
+	{ 0x2AC8 + 0x3A6C, _NOP() }      // warmboot UARTA cfg.
+);
+
+PATCHSET_DEF(_warmboot_1_patchset,
+	{ 0x4DC, _NOPv7() } // Fuse check.
+);
+
+PATCHSET_DEF(_warmboot_2_patchset,
+	{ 0x4DC, _NOPv7() } // Fuse check.
+);
+
+PATCHSET_DEF(_warmboot_3_patchset,
+	{ 0x4DC, _NOPv7() }, // Fuse check.
+	{ 0x4F0, _NOPv7() }  // Segment id check.
+);
+
+PATCHSET_DEF(_warmboot_4_patchset,
+	{ 0x544, _NOPv7() }, // Fuse check.
+	{ 0x558, _NOPv7() }  // Segment id check.
+);
+
+
 /*
  * package1.1 header: <wb, ldr, sm>
  * package1.1 layout:
@@ -72,21 +127,33 @@ PATCHSET_DEF(_secmon_5_patchset,
  * 3.1: {wb, ldr, sm} { 0, 1, 2 }
  * 4.0: {ldr, sm, wb} { 1, 2, 0 }
  * 5.0: {ldr, sm, wb} { 1, 2, 0 }
+ * 6.0: {ldr, sm, wb} { 1, 2, 0 }
+ * 6.2: {ldr, sm, wb} { 1, 2, 0 }
+ * 7.0: {ldr, sm, wb} { 1, 2, 0 }
  */
 
 static const pkg1_id_t _pkg1_ids[] = {
-	{ "20161121183008", 0, 0x1900, 0x3FE0, { 2, 1, 0 }, SM_100_ADR, 0x8000D000, true, _secmon_1_patchset }, //1.0.0 (Patched relocator)
-	{ "20170210155124", 0, 0x1900, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, true, _secmon_2_patchset }, //2.0.0 - 2.3.0
-	{ "20170519101410", 1, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, true, _secmon_3_patchset }, //3.0.0
-	{ "20170710161758", 2, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, true, _secmon_3_patchset }, //3.0.1 - 3.0.2
-	{ "20170921172629", 3, 0x1800, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003B000, false, _secmon_4_patchset }, //4.0.0 - 4.1.0
-	{ "20180220163747", 4, 0x1900, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003B000, false, _secmon_5_patchset }, //5.0.0 - 5.1.0
+	{ "20161121183008", 0, 0x1900, 0x3FE0, { 2, 1, 0 }, SM_100_ADR, 0x8000D000, true,  _secmon_1_patchset, _warmboot_1_patchset },   //1.0.0 (Patched relocator)
+	{ "20170210155124", 0, 0x1900, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, true,  _secmon_2_patchset, _warmboot_2_patchset },   //2.0.0 - 2.3.0
+	{ "20170519101410", 1, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, true,  _secmon_3_patchset, _warmboot_3_patchset },   //3.0.0
+	{ "20170710161758", 2, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, true,  _secmon_3_patchset, _warmboot_3_patchset },   //3.0.1 - 3.0.2
+	{ "20170921172629", 3, 0x1800, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003B000, false, _secmon_4_patchset, _warmboot_4_patchset },   //4.0.0 - 4.1.0
+	{ "20180220163747", 4, 0x1900, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003B000, false, _secmon_5_patchset, _warmboot_4_patchset },   //5.0.0 - 5.1.0
+	{ "20180802162753", 5, 0x1900, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003D800, false, _secmon_6_patchset, _warmboot_4_patchset },   //6.0.0 - 6.1.0
+	{ "20181107105733", 6, 0x0E00, 0x6FE0, { 1, 2, 0 }, 0x4002B000, 0x4003D800, false, _secmon_620_patchset, _warmboot_4_patchset }, //6.2.0
+	{ "20181218175730", 7, 0x0F00, 0x6FE0, { 1, 2, 0 }, 0x40030000, 0x4003E000, false, NULL, _warmboot_4_patchset },                 //7.0.0
+	{ "20190208150037", 7, 0x0F00, 0x6FE0, { 1, 2, 0 }, 0x40030000, 0x4003E000, false, NULL, _warmboot_4_patchset },                 //7.0.1
+	{ "20190314172056", 7, 0x0E00, 0x6FE0, { 1, 2, 0 }, 0x40030000, 0x4003E000, false, NULL, _warmboot_4_patchset },                 //8.0.0
 	{ NULL } //End.
 };
 
-
 const pkg1_id_t *pkg1_identify(u8 *pkg1)
 {
+	char build_date[15];
+	memcpy(build_date, (char *)(pkg1 + 0x10), 14);
+	build_date[14] = 0;
+	gfx_printf("Found pkg1 ('%s').\n\n", build_date);
+
 	for (u32 i = 0; _pkg1_ids[i].id; i++)
 		if (!memcmp(pkg1 + 0x10, _pkg1_ids[i].id, 12))
 			return &_pkg1_ids[i];

bootloader/hos/pkg1.h

@@ -42,6 +42,7 @@ typedef struct _pkg1_id_t
 	u32 warmboot_base;
 	bool set_warmboot;
 	patch_t *secmon_patchset;
+	patch_t *warmboot_patchset;
 } pkg1_id_t;
 
 typedef struct _pk11_hdr_t

bootloader/hos/pkg2.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (c) 2018 CTCaer
+ * Copyright (c) 2018-2019 CTCaer
  * Copyright (c) 2018 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -26,10 +26,8 @@
 
 #include "../gfx/gfx.h"
 
-extern gfx_con_t gfx_con;
-
 /*#include "util.h"
-#define DPRINTF(...) gfx_printf(&gfx_con, __VA_ARGS__)
+#define DPRINTF(...) gfx_printf(__VA_ARGS__)
 #define DEBUG_PRINTING*/
 #define DPRINTF(...)
 
@@ -43,6 +41,9 @@ extern gfx_con_t gfx_con;
 #define FREE_CODE_OFF_1ST_302 0x494BC
 #define FREE_CODE_OFF_1ST_400 0x52890
 #define FREE_CODE_OFF_1ST_500 0x5C020
+#define FREE_CODE_OFF_1ST_600 0x5EE00
+#define FREE_CODE_OFF_1ST_700 0x5FEC0
+#define FREE_CODE_OFF_1ST_800 0x607F0
 
 #define ID_SND_OFF_100 0x23CC0
 #define ID_SND_OFF_200 0x3F134
@@ -50,6 +51,9 @@ extern gfx_con_t gfx_con;
 #define ID_SND_OFF_302 0x26080
 #define ID_SND_OFF_400 0x2AF64
 #define ID_SND_OFF_500 0x2AD34
+#define ID_SND_OFF_600 0x2BB8C
+#define ID_SND_OFF_700 0x2D044
+#define ID_SND_OFF_800 0x2F1FC
 
 #define ID_RCV_OFF_100 0x219F0
 #define ID_RCV_OFF_200 0x3D1A8
@@ -57,13 +61,16 @@ extern gfx_con_t gfx_con;
 #define ID_RCV_OFF_302 0x240F0
 #define ID_RCV_OFF_400 0x28F6C
 #define ID_RCV_OFF_500 0x28DAC
+#define ID_RCV_OFF_600 0x29B6C
+#define ID_RCV_OFF_700 0x2B23C
+#define ID_RCV_OFF_800 0x2D424
 
 static u32 PRC_ID_SND_100[] =
 {
 	0xA9BF2FEA, 0x2A0E03EB, 0xD37EF56B, 0xF86B6B8B, 0x92FFFFE9, 0x8A090168, 0xD2FFFFE9, 0x8A09016B,
 	0xD2FFFFC9, 0xEB09017F, 0x54000040, 0xF9412948,	0xA8C12FEA
 };
-#define FREE_CODE_OFF_2ND_100 (FREE_CODE_OFF_1ST_100 + sizeof(PRC_ID_SND_100) + 4)
+#define FREE_CODE_OFF_2ND_100 (FREE_CODE_OFF_1ST_100 + sizeof(PRC_ID_SND_100) + sizeof(u32))
 static u32 PRC_ID_RCV_100[] =
 {
 	0xA9BF2FEA, 0x2A1C03EA, 0xD37EF54A, 0xF86A69AA, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A,
@@ -75,7 +82,7 @@ static u32 PRC_ID_SND_200[] =
 	0xA9BF2FEA, 0x2A1803EB, 0xD37EF56B, 0xF86B6B8B, 0x92FFFFE9, 0x8A090168, 0xD2FFFFE9, 0x8A09016B,
 	0xD2FFFFC9, 0xEB09017F, 0x54000040, 0xF9413148, 0xA8C12FEA
 };
-#define FREE_CODE_OFF_2ND_200 (FREE_CODE_OFF_1ST_200 + sizeof(PRC_ID_SND_200) + 4)
+#define FREE_CODE_OFF_2ND_200 (FREE_CODE_OFF_1ST_200 + sizeof(PRC_ID_SND_200) + sizeof(u32))
 static u32 PRC_ID_RCV_200[] =
 {
 	0xA9BF2FEA, 0x2A0F03EA, 0xD37EF54A, 0xF9405FEB, 0xF86A696A, 0xF9407BEB, 0x92FFFFE9, 0x8A090148,
@@ -87,31 +94,21 @@ static u32 PRC_ID_SND_300[] =
 	0xA9BF2FEA, 0x2A1803EB, 0xD37EF56B, 0xF86B6B8B, 0x92FFFFE9, 0x8A090168, 0xD2FFFFE9, 0x8A09016B,
 	0xD2FFFFC9, 0xEB09017F, 0x54000040, 0xF9415548, 0xA8C12FEA
 };
-#define FREE_CODE_OFF_2ND_300 (FREE_CODE_OFF_1ST_300 + sizeof(PRC_ID_SND_300) + 4)
+#define FREE_CODE_OFF_2ND_300 (FREE_CODE_OFF_1ST_300 + sizeof(PRC_ID_SND_300) + sizeof(u32))
 static u32 PRC_ID_RCV_300[] =
 {
 	0xA9BF2FEA, 0x2A0F03EA, 0xD37EF54A, 0xF9405FEB, 0xF86A696A, 0xF9407BEB, 0x92FFFFE9, 0x8A090148,
 	0xD2FFFFE9, 0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000040, 0xF9415568, 0xA8C12FEA
 };
 
-static u32 PRC_ID_SND_302[] =
-{
-	0xA9BF2FEA, 0x2A1803EB, 0xD37EF56B, 0xF86B6B8B, 0x92FFFFE9, 0x8A090168, 0xD2FFFFE9, 0x8A09016B,
-	0xD2FFFFC9, 0xEB09017F, 0x54000040, 0xF9415548, 0xA8C12FEA
-};
-#define FREE_CODE_OFF_2ND_302 (FREE_CODE_OFF_1ST_302 + sizeof(PRC_ID_SND_302) + 4)
-static u32 PRC_ID_RCV_302[] =
-{
-	0xA9BF2FEA, 0x2A0F03EA, 0xD37EF54A, 0xF9405FEB, 0xF86A696A, 0xF9407BEB, 0x92FFFFE9, 0x8A090148,
-	0xD2FFFFE9, 0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000040, 0xF9415568, 0xA8C12FEA
-};
+#define FREE_CODE_OFF_2ND_302 (FREE_CODE_OFF_1ST_302 + sizeof(PRC_ID_SND_300) + sizeof(u32))
 
 static u32 PRC_ID_SND_400[] =
 {
 	0x2A1703EA, 0xD37EF54A, 0xF86A6B8A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A, 0xD2FFFFC9,
 	0xEB09015F, 0x54000060, 0xF94053EA, 0xF9415948, 0xF94053EA
 };
-#define FREE_CODE_OFF_2ND_400 (FREE_CODE_OFF_1ST_400 + sizeof(PRC_ID_SND_400) + 4)
+#define FREE_CODE_OFF_2ND_400 (FREE_CODE_OFF_1ST_400 + sizeof(PRC_ID_SND_400) + sizeof(u32))
 static u32 PRC_ID_RCV_400[] =
 {
 	0xF9403BED, 0x2A0E03EA, 0xD37EF54A, 0xF86A69AA, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A,
@@ -123,13 +120,43 @@ static u32 PRC_ID_SND_500[] =
 	0x2A1703EA, 0xD37EF54A, 0xF86A6B6A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A, 0xD2FFFFC9,
 	0xEB09015F, 0x54000060, 0xF94043EA, 0xF9415948, 0xF94043EA
 };
-#define FREE_CODE_OFF_2ND_500 (FREE_CODE_OFF_1ST_500 + sizeof(PRC_ID_SND_500) + 4)
+#define FREE_CODE_OFF_2ND_500 (FREE_CODE_OFF_1ST_500 + sizeof(PRC_ID_SND_500) + sizeof(u32))
 static u32 PRC_ID_RCV_500[] =
 {
 	0xF9403BED, 0x2A1503EA, 0xD37EF54A, 0xF86A69AA, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A,
 	0xD2FFFFC9, 0xEB09015F, 0x54000040, 0xF9415B08, 0xF9406FEA
 };
 
+static u32 PRC_ID_SND_600[] =
+{
+	0xA9BF2FEA, 0xF94037EB, 0x2A1503EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400308, 0xF9401D08, 0xAA1803E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+#define FREE_CODE_OFF_2ND_600 (FREE_CODE_OFF_1ST_600 + sizeof(PRC_ID_SND_600) + sizeof(u32))
+static u32 PRC_ID_RCV_600[] =
+{
+	0xA9BF2FEA, 0xF94043EB, 0x2A1503EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400308, 0xF9401D08, 0xAA1803E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+
+static u32 PRC_ID_SND_700[] =
+{
+	0xA9BF2FEA, 0xF9403BEB, 0x2A1903EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF94002A8, 0xF9401D08, 0xAA1503E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+#define FREE_CODE_OFF_2ND_700 (FREE_CODE_OFF_1ST_700 + sizeof(PRC_ID_SND_700) + sizeof(u32))
+static u32 PRC_ID_RCV_700[] =
+{
+	0xA9BF2FEA, 0xF9404FEB, 0x2A1603EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400368, 0xF9401D08, 0xAA1B03E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+
+#define FREE_CODE_OFF_2ND_800 (FREE_CODE_OFF_1ST_800 + sizeof(PRC_ID_SND_700) + sizeof(u32))
+
 // Include kernel patches here, so we can utilize pkg1 id
 KERNEL_PATCHSET_DEF(_kernel_1_patchset,
 	{ SVC_VERIFY_DS, 0x3764C, _NOP(), NULL },          // Disable SVC verifications
@@ -138,11 +165,11 @@ KERNEL_PATCHSET_DEF(_kernel_1_patchset,
 	{ ATM_GEN_PATCH, ID_SND_OFF_100, _B(ID_SND_OFF_100, FREE_CODE_OFF_1ST_100), NULL},    // Send process id branch.
 	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_100, sizeof(PRC_ID_SND_100) >> 2, PRC_ID_SND_100}, // Send process id code.
 	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_100 + sizeof(PRC_ID_SND_100),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_1ST_100 + sizeof(PRC_ID_SND_100), ID_SND_OFF_100 + 4), NULL},
+		_B(FREE_CODE_OFF_1ST_100 + sizeof(PRC_ID_SND_100), ID_SND_OFF_100 + sizeof(u32)), NULL},
 	{ ATM_GEN_PATCH, ID_RCV_OFF_100, _B(ID_RCV_OFF_100, FREE_CODE_OFF_2ND_100), NULL},    // Receive process id branch.
 	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_100, sizeof(PRC_ID_RCV_100) >> 2, PRC_ID_RCV_100}, // Receive process id code.
 	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_100 + sizeof(PRC_ID_RCV_100),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_2ND_100 + sizeof(PRC_ID_RCV_100), ID_RCV_OFF_100 + 4), NULL}
+		_B(FREE_CODE_OFF_2ND_100 + sizeof(PRC_ID_RCV_100), ID_RCV_OFF_100 + sizeof(u32)), NULL}
 );
 
 KERNEL_PATCHSET_DEF(_kernel_2_patchset,
@@ -152,11 +179,11 @@ KERNEL_PATCHSET_DEF(_kernel_2_patchset,
 	{ ATM_GEN_PATCH, ID_SND_OFF_200, _B(ID_SND_OFF_200, FREE_CODE_OFF_1ST_200), NULL},    // Send process id branch.
 	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_200, sizeof(PRC_ID_SND_200) >> 2, PRC_ID_SND_200}, // Send process id code.
 	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_200 + sizeof(PRC_ID_SND_200),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_1ST_200 + sizeof(PRC_ID_SND_200), ID_SND_OFF_200 + 4), NULL},
+		_B(FREE_CODE_OFF_1ST_200 + sizeof(PRC_ID_SND_200), ID_SND_OFF_200 + sizeof(u32)), NULL},
 	{ ATM_GEN_PATCH, ID_RCV_OFF_200, _B(ID_RCV_OFF_200, FREE_CODE_OFF_2ND_200), NULL},    // Receive process id branch.
 	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_200, sizeof(PRC_ID_RCV_200) >> 2, PRC_ID_RCV_200}, // Receive process id code.
 	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_200 + sizeof(PRC_ID_RCV_200),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_2ND_200 + sizeof(PRC_ID_RCV_200), ID_RCV_OFF_200 + 4), NULL}
+		_B(FREE_CODE_OFF_2ND_200 + sizeof(PRC_ID_RCV_200), ID_RCV_OFF_200 + sizeof(u32)), NULL}
 );
 
 KERNEL_PATCHSET_DEF(_kernel_3_patchset,
@@ -166,11 +193,11 @@ KERNEL_PATCHSET_DEF(_kernel_3_patchset,
 	{ ATM_GEN_PATCH, ID_SND_OFF_300, _B(ID_SND_OFF_300, FREE_CODE_OFF_1ST_300), NULL},    // Send process id branch.
 	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_300, sizeof(PRC_ID_SND_300) >> 2, PRC_ID_SND_300}, // Send process id code.
 	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_300 + sizeof(PRC_ID_SND_300),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_1ST_300 + sizeof(PRC_ID_SND_300), ID_SND_OFF_300 + 4), NULL},
+		_B(FREE_CODE_OFF_1ST_300 + sizeof(PRC_ID_SND_300), ID_SND_OFF_300 + sizeof(u32)), NULL},
 	{ ATM_GEN_PATCH, ID_RCV_OFF_300, _B(ID_RCV_OFF_300, FREE_CODE_OFF_2ND_300), NULL},    // Receive process id branch.
 	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_300, sizeof(PRC_ID_RCV_300) >> 2, PRC_ID_RCV_300}, // Receive process id code.
 	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_300 + sizeof(PRC_ID_RCV_300),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_2ND_300 + sizeof(PRC_ID_RCV_300), ID_RCV_OFF_300 + 4), NULL}
+		_B(FREE_CODE_OFF_2ND_300 + sizeof(PRC_ID_RCV_300), ID_RCV_OFF_300 + sizeof(u32)), NULL}
 );
 
 KERNEL_PATCHSET_DEF(_kernel_302_patchset,
@@ -178,13 +205,13 @@ KERNEL_PATCHSET_DEF(_kernel_302_patchset,
 	{ DEBUG_MODE_EN, 0x48414, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
 	// Atmosphère kernel patches.
 	{ ATM_GEN_PATCH, ID_SND_OFF_302, _B(ID_SND_OFF_302, FREE_CODE_OFF_1ST_302), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_302, sizeof(PRC_ID_SND_302) >> 2, PRC_ID_SND_302}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_302 + sizeof(PRC_ID_SND_302),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_1ST_302 + sizeof(PRC_ID_SND_302), ID_SND_OFF_302 + 4), NULL},
+	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_302, sizeof(PRC_ID_SND_300) >> 2, PRC_ID_SND_300}, // Send process id code.
+	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_302 + sizeof(PRC_ID_SND_300),                      // Branch back and skip 1 instruction.
+		_B(FREE_CODE_OFF_1ST_302 + sizeof(PRC_ID_SND_300), ID_SND_OFF_302 + sizeof(u32)), NULL},
 	{ ATM_GEN_PATCH, ID_RCV_OFF_302, _B(ID_RCV_OFF_302, FREE_CODE_OFF_2ND_302), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_302, sizeof(PRC_ID_RCV_302) >> 2, PRC_ID_RCV_302}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_302 + sizeof(PRC_ID_RCV_302),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_2ND_302 + sizeof(PRC_ID_RCV_302), ID_RCV_OFF_302 + 4), NULL}
+	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_302, sizeof(PRC_ID_RCV_300) >> 2, PRC_ID_RCV_300}, // Receive process id code.
+	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_302 + sizeof(PRC_ID_RCV_300),                      // Branch back and skip 1 instruction.
+		_B(FREE_CODE_OFF_2ND_302 + sizeof(PRC_ID_RCV_300), ID_RCV_OFF_302 + sizeof(u32)), NULL}
 );
 
 KERNEL_PATCHSET_DEF(_kernel_4_patchset,
@@ -194,25 +221,71 @@ KERNEL_PATCHSET_DEF(_kernel_4_patchset,
 	{ ATM_GEN_PATCH, ID_SND_OFF_400, _B(ID_SND_OFF_400, FREE_CODE_OFF_1ST_400), NULL},    // Send process id branch.
 	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_400, sizeof(PRC_ID_SND_400) >> 2, PRC_ID_SND_400}, // Send process id code.
 	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_400 + sizeof(PRC_ID_SND_400),                      // Branch back and skip 2 instructions.
-		_B(FREE_CODE_OFF_1ST_400 + sizeof(PRC_ID_SND_400), ID_SND_OFF_400 + 8), NULL},
+		_B(FREE_CODE_OFF_1ST_400 + sizeof(PRC_ID_SND_400), ID_SND_OFF_400 + sizeof(u32) * 2), NULL},
 	{ ATM_GEN_PATCH, ID_RCV_OFF_400, _B(ID_RCV_OFF_400, FREE_CODE_OFF_2ND_400), NULL},    // Receive process id branch.
 	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_400, sizeof(PRC_ID_RCV_400) >> 2, PRC_ID_RCV_400}, // Receive process id code.
 	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_400 + sizeof(PRC_ID_RCV_400),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_2ND_400 + sizeof(PRC_ID_RCV_400), ID_RCV_OFF_400 + 4), NULL}
+		_B(FREE_CODE_OFF_2ND_400 + sizeof(PRC_ID_RCV_400), ID_RCV_OFF_400 + sizeof(u32)), NULL}
 );
 
 KERNEL_PATCHSET_DEF(_kernel_5_patchset,
+	{ SVC_GENERIC,   0x38C2C, _NOP(), NULL },          // Allow same process on svcControlCodeMemory.
 	{ SVC_VERIFY_DS, 0x45E6C, _NOP(), NULL },          // Disable SVC verifications
 	{ DEBUG_MODE_EN, 0x5513C, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
 	// Atmosphère kernel patches.
 	{ ATM_GEN_PATCH, ID_SND_OFF_500, _B(ID_SND_OFF_500, FREE_CODE_OFF_1ST_500), NULL},    // Send process id branch.
 	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_500, sizeof(PRC_ID_SND_500) >> 2, PRC_ID_SND_500}, // Send process id code.
 	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_500 + sizeof(PRC_ID_SND_500),                      // Branch back and skip 2 instructions.
-		_B(FREE_CODE_OFF_1ST_500 + sizeof(PRC_ID_SND_500), ID_SND_OFF_500 + 8), NULL},
+		_B(FREE_CODE_OFF_1ST_500 + sizeof(PRC_ID_SND_500), ID_SND_OFF_500 + sizeof(u32) * 2), NULL},
 	{ ATM_GEN_PATCH, ID_RCV_OFF_500, _B(ID_RCV_OFF_500, FREE_CODE_OFF_2ND_500), NULL},    // Receive process id branch.
 	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_500, sizeof(PRC_ID_RCV_500) >> 2, PRC_ID_RCV_500}, // Receive process id code.
 	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_500 + sizeof(PRC_ID_RCV_500),                      // Branch back and skip 2 instructions.
-		_B(FREE_CODE_OFF_2ND_500 + sizeof(PRC_ID_RCV_500), ID_RCV_OFF_500 + 8), NULL}
+		_B(FREE_CODE_OFF_2ND_500 + sizeof(PRC_ID_RCV_500), ID_RCV_OFF_500 + sizeof(u32) * 2), NULL}
+);
+
+KERNEL_PATCHSET_DEF(_kernel_6_patchset,
+	{ SVC_GENERIC,   0x3A8CC, _NOP(), NULL },          // Allow same process on svcControlCodeMemory.
+	{ SVC_VERIFY_DS, 0x47EA0, _NOP(), NULL },          // Disable SVC verifications
+	{ DEBUG_MODE_EN, 0x57548, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
+	// Atmosphère kernel patches.
+	{ ATM_GEN_PATCH, ID_SND_OFF_600, _B(ID_SND_OFF_600, FREE_CODE_OFF_1ST_600), NULL},    // Send process id branch.
+	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_600, sizeof(PRC_ID_SND_600) >> 2, PRC_ID_SND_600}, // Send process id code.
+	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_600 + sizeof(PRC_ID_SND_600),                      // Branch back and skip 4 instructions.
+		_B(FREE_CODE_OFF_1ST_600 + sizeof(PRC_ID_SND_600), ID_SND_OFF_600 + sizeof(u32) * 4), NULL},
+	{ ATM_GEN_PATCH, ID_RCV_OFF_600, _B(ID_RCV_OFF_600, FREE_CODE_OFF_2ND_600), NULL},    // Receive process id branch.
+	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_600, sizeof(PRC_ID_RCV_600) >> 2, PRC_ID_RCV_600}, // Receive process id code.
+	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_600 + sizeof(PRC_ID_RCV_600),                      // Branch back and skip 4 instructions.
+		_B(FREE_CODE_OFF_2ND_600 + sizeof(PRC_ID_RCV_600), ID_RCV_OFF_600 + sizeof(u32) * 4), NULL}
+);
+
+KERNEL_PATCHSET_DEF(_kernel_7_patchset,
+	{ SVC_GENERIC,   0x3C6E0, _NOP(), NULL },          // Allow same process on svcControlCodeMemory.
+	{ SVC_VERIFY_DS, 0x49E5C, _NOP(), NULL },          // Disable SVC verifications
+	{ DEBUG_MODE_EN, 0x581B0, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
+	// Atmosphère kernel patches.
+	{ ATM_GEN_PATCH, ID_SND_OFF_700, _B(ID_SND_OFF_700, FREE_CODE_OFF_1ST_700), NULL},    // Send process id branch.
+	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_700, sizeof(PRC_ID_SND_700) >> 2, PRC_ID_SND_700}, // Send process id code.
+	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_700 + sizeof(PRC_ID_SND_700),                      // Branch back and skip 4 instructions.
+		_B(FREE_CODE_OFF_1ST_700 + sizeof(PRC_ID_SND_700), ID_SND_OFF_700 + sizeof(u32) * 4), NULL},
+	{ ATM_GEN_PATCH, ID_RCV_OFF_700, _B(ID_RCV_OFF_700, FREE_CODE_OFF_2ND_700), NULL},    // Receive process id branch.
+	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_700, sizeof(PRC_ID_RCV_700) >> 2, PRC_ID_RCV_700}, // Receive process id code.
+	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_700 + sizeof(PRC_ID_RCV_700),                      // Branch back and skip 4 instructions.
+		_B(FREE_CODE_OFF_2ND_700 + sizeof(PRC_ID_RCV_700), ID_RCV_OFF_700 + sizeof(u32) * 4), NULL}
+);
+
+KERNEL_PATCHSET_DEF(_kernel_8_patchset,
+	{ SVC_GENERIC,   0x3FAD0, _NOP(), NULL },          // Allow same process on svcControlCodeMemory.
+	{ SVC_VERIFY_DS, 0x4D15C, _NOP(), NULL },          // Disable SVC verifications
+	{ DEBUG_MODE_EN, 0x5BFAC, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
+	// Atmosphère kernel patches.
+	{ ATM_GEN_PATCH, ID_SND_OFF_800, _B(ID_SND_OFF_800, FREE_CODE_OFF_1ST_800), NULL},    // Send process id branch.
+	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_800, sizeof(PRC_ID_RCV_700) >> 2, PRC_ID_RCV_700}, // Send process id code.
+	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_800 + sizeof(PRC_ID_RCV_700),                      // Branch back and skip 4 instructions.
+		_B(FREE_CODE_OFF_1ST_800 + sizeof(PRC_ID_RCV_700), ID_SND_OFF_800 + sizeof(u32) * 4), NULL},
+	{ ATM_GEN_PATCH, ID_RCV_OFF_800, _B(ID_RCV_OFF_800, FREE_CODE_OFF_2ND_800), NULL},    // Receive process id branch.
+	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_800, sizeof(PRC_ID_RCV_700) >> 2, PRC_ID_RCV_700}, // Receive process id code.
+	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_800 + sizeof(PRC_ID_RCV_700),                      // Branch back and skip 4 instructions.
+		_B(FREE_CODE_OFF_2ND_800 + sizeof(PRC_ID_RCV_700), ID_RCV_OFF_800 + sizeof(u32) * 4), NULL}
 );
 
 static const pkg2_kernel_id_t _pkg2_kernel_ids[] =
@@ -223,6 +296,9 @@ static const pkg2_kernel_id_t _pkg2_kernel_ids[] =
 	{ 0xe0e8cdc4, _kernel_302_patchset }, //3.0.2
 	{ 0x485d0157, _kernel_4_patchset },   //4.0.0 - 4.1.0
 	{ 0xf3c363f2, _kernel_5_patchset },   //5.0.0 - 5.1.0
+	{ 0x64ce1a44, _kernel_6_patchset },   //6.0.0 - 6.2.0
+	{ 0x908175e1, _kernel_7_patchset },   //7.0.0
+	{ 0x22832de4, _kernel_8_patchset },   //8.0.0. Kernel only.
 	{ 0, 0 }                              //End.
 };
 
@@ -243,173 +319,308 @@ enum kip_offset_section
 #define GET_KIP_PATCH_OFFSET(x) (x & KIP_PATCH_OFFSET_MASK)
 #define KPS(x) ((u32)(x) << KIP_PATCH_SECTION_SHIFT)
 
-static kip1_patch_t _fs_nosigchk_100[] = 
+static kip1_patch_t _fs_nosigchk_100[] =
 {
 	{ KPS(KIP_TEXT) | 0x194A0, 4, "\xBA\x09\x00\x94", "\xE0\x03\x1F\x2A" },
 	{ KPS(KIP_TEXT) | 0x3A79C, 4, "\xE0\x06\x00\x36", "\x1F\x20\x03\xD5" },
 	{ 0, 0, NULL, NULL }
 };
 
-static kip1_patchset_t _fs_patches_100[] = 
+static kip1_patchset_t _fs_patches_100[] =
 {
 	{ "nosigchk", _fs_nosigchk_100 },
 	{ "nogc",     NULL },
 	{ NULL, NULL }
 };
 
-static kip1_patch_t _fs_nosigchk_200[] = 
+static kip1_patch_t _fs_nosigchk_200[] =
 {
 	{ KPS(KIP_TEXT) | 0x15DF4, 4, "\xBC\x0A\x00\x94", "\xE0\x03\x1F\x2A" },
 	{ KPS(KIP_TEXT) | 0x3F720, 4, "\x00\x06\x00\x36", "\x1F\x20\x03\xD5" },
 	{ 0, 0, NULL, NULL }
 };
 
-static kip1_patchset_t _fs_patches_200[] = 
+static kip1_patchset_t _fs_patches_200[] =
 {
 	{ "nosigchk", _fs_nosigchk_200 },
 	{ "nogc",     NULL },
 	{ NULL, NULL }
 };
 
-static kip1_patch_t _fs_nosigchk_210[] = 
+static kip1_patch_t _fs_nosigchk_210[] =
 {
 	{ KPS(KIP_TEXT) | 0x15F64, 4, "\xDF\x0A\x00\x94", "\xE0\x03\x1F\x2A" },
 	{ KPS(KIP_TEXT) | 0x3FAF8, 4, "\x00\x06\x00\x36", "\x1F\x20\x03\xD5" },
 	{ 0, 0, NULL, NULL }
 };
 
-static kip1_patchset_t _fs_patches_210[] = 
+static kip1_patchset_t _fs_patches_210[] =
 {
 	{ "nosigchk", _fs_nosigchk_210 },
 	{ "nogc",     NULL },
 	{ NULL, NULL }
 };
 
-static kip1_patch_t _fs_nosigchk_300[] = 
+static kip1_patch_t _fs_nosigchk_300[] =
 {
 	{ KPS(KIP_TEXT) | 0x18E24, 4, "\x52\x0C\x00\x94", "\xE0\x03\x1F\x2A" },
 	{ KPS(KIP_TEXT) | 0x49EC8, 4, "\x40\x04\x00\x36", "\x1F\x20\x03\xD5" },
 	{ 0, 0, NULL, NULL }
 };
 
-static kip1_patchset_t _fs_patches_300[] = 
+static kip1_patchset_t _fs_patches_300[] =
 {
 	{ "nosigchk", _fs_nosigchk_300 },
 	{ "nogc",     NULL },
 	{ NULL, NULL }
 };
 
-static kip1_patch_t _fs_nosigchk_30x[] = 
+static kip1_patch_t _fs_nosigchk_30x[] =
 {
 	{ KPS(KIP_TEXT) | 0x18E90, 4, "\x52\x0C\x00\x94", "\xE0\x03\x1F\x2A" },
 	{ KPS(KIP_TEXT) | 0x49F34, 4, "\xE0\x03\x00\x36", "\x1F\x20\x03\xD5" },
 	{ 0, 0, NULL, NULL }
 };
 
-static kip1_patchset_t _fs_patches_30x[] = 
+static kip1_patchset_t _fs_patches_30x[] =
 {
 	{ "nosigchk", _fs_nosigchk_30x },
 	{ "nogc",     NULL },
 	{ NULL, NULL }
 };
 
-static kip1_patch_t _fs_nosigchk_4xx[] = 
+static kip1_patch_t _fs_nosigchk_4xx[] =
 {
 	{ KPS(KIP_TEXT) | 0x1C4FC, 4, "\x3C\x2F\x00\x94", "\xE0\x03\x1F\x2A" },
 	{ KPS(KIP_TEXT) | 0x57934, 4, "\xE0\x02\x00\x36", "\x1F\x20\x03\xD5" },
 	{ 0, 0, NULL, NULL }
 };
 
-static kip1_patch_t _fs_nogc_40x[] = 
+static kip1_patch_t _fs_nogc_40x[] =
 {
 	{ KPS(KIP_TEXT) | 0xA3458, 4, "\x14\x40\x80\x72", "\x14\x80\x80\x72" },
 	{ KPS(KIP_TEXT) | 0xAAB44, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
 	{ 0, 0, NULL, NULL }
 };
 
-static kip1_patchset_t _fs_patches_40x[] = 
+static kip1_patchset_t _fs_patches_40x[] =
 {
 	{ "nosigchk", _fs_nosigchk_4xx },
 	{ "nogc",     _fs_nogc_40x },
 	{ NULL, NULL }
 };
 
-static kip1_patch_t _fs_nogc_410[] = 
+static kip1_patch_t _fs_nogc_410[] =
 {
 	{ KPS(KIP_TEXT) | 0xA34BC, 4, "\x14\x40\x80\x72", "\x14\x80\x80\x72" },
 	{ KPS(KIP_TEXT) | 0xAABA8, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
 	{ 0, 0, NULL, NULL }
 };
 
-static kip1_patchset_t _fs_patches_410[] = 
+static kip1_patchset_t _fs_patches_410[] =
 {
 	{ "nosigchk", _fs_nosigchk_4xx },
 	{ "nogc",     _fs_nogc_410 },
 	{ NULL, NULL }
 };
 
-static kip1_patch_t _fs_nosigchk_50x[] = 
+static kip1_patch_t _fs_nosigchk_50x[] =
 {
 	{ KPS(KIP_TEXT) | 0x22DDC, 4, "\x7D\x3E\x00\x94", "\xE0\x03\x1F\x2A" },
 	{ KPS(KIP_TEXT) | 0x7D490, 4, "\x40\x03\x00\x36", "\x1F\x20\x03\xD5" },
 	{ 0, 0, NULL, NULL }
 };
 
-static kip1_patch_t _fs_nogc_50x[] = 
+static kip1_patch_t _fs_nogc_50x[] =
 {
 	{ KPS(KIP_TEXT) | 0xCF3C4, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
 	{ KPS(KIP_TEXT) | 0xD73A0, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
 	{ 0, 0, NULL, NULL }
 };
 
-static kip1_patchset_t _fs_patches_50x[] = 
+static kip1_patchset_t _fs_patches_50x[] =
 {
 	{ "nosigchk", _fs_nosigchk_50x },
 	{ "nogc",     _fs_nogc_50x },
 	{ NULL, NULL }
 };
 
-static kip1_patch_t _fs_nosigchk_510[] = 
+static kip1_patch_t _fs_nosigchk_510[] =
 {
 	{ KPS(KIP_TEXT) | 0x22E0C, 4, "\x85\x3E\x00\x94", "\xE0\x03\x1F\x2A" },
 	{ KPS(KIP_TEXT) | 0x7D860, 4, "\x40\x03\x00\x36", "\x1F\x20\x03\xD5" },
 	{ 0, 0, NULL, NULL }
 };
 
-static kip1_patch_t _fs_nogc_510[] = 
+static kip1_patch_t _fs_nogc_510[] =
 {
 	{ KPS(KIP_TEXT) | 0xCF794, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
 	{ KPS(KIP_TEXT) | 0xD7770, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
 	{ 0, 0, NULL, NULL }
 };
 
-static kip1_patchset_t _fs_patches_510[] = 
+static kip1_patchset_t _fs_patches_510[] =
 {
 	{ "nosigchk", _fs_nosigchk_510 },
 	{ "nogc",     _fs_nogc_510 },
 	{ NULL, NULL }
 };
 
+static kip1_patch_t _fs_nosigchk_600[] =
+{
+	{ KPS(KIP_TEXT) | 0x712A8, 4, "\x8E\x3E\x00\x94", "\xE0\x03\x1F\x2A" },
+	{ KPS(KIP_TEXT) | 0xEB08C, 4, "\xC0\x03\x00\x36", "\x1F\x20\x03\xD5" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patch_t _fs_nosigchk_600_exfat[] =
+{
+	{ KPS(KIP_TEXT) | 0x7C9A8, 4, "\x8E\x3E\x00\x94", "\xE0\x03\x1F\x2A" },
+	{ KPS(KIP_TEXT) | 0xF678C, 4, "\xC0\x03\x00\x36", "\x1F\x20\x03\xD5" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_600[] =
+{
+	{ KPS(KIP_TEXT) | 0x12CC20, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x1538F4, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_600_exfat[] =
+{
+	{ KPS(KIP_TEXT) | 0x138320, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x15EFF4, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_600[] =
+{
+	{ "nosigchk", _fs_nosigchk_600 },
+	{ "nogc",     _fs_nogc_600 },
+	{ NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_600_exfat[] =
+{
+	{ "nosigchk", _fs_nosigchk_600_exfat },
+	{ "nogc",     _fs_nogc_600_exfat },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nosigchk_700[] =
+{
+	{ KPS(KIP_TEXT) | 0x74A2C, 4, "\x31\x43\x00\x94", "\xE0\x03\x1F\x2A" },
+	{ KPS(KIP_TEXT) | 0xF25E4, 4, "\xC0\x03\x00\x36", "\x1F\x20\x03\xD5" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patch_t _fs_nosigchk_700_exfat[] =
+{
+	{ KPS(KIP_TEXT) | 0x7FFDC, 4, "\x31\x43\x00\x94", "\xE0\x03\x1F\x2A" },
+	{ KPS(KIP_TEXT) | 0xFDB94, 4, "\xC0\x03\x00\x36", "\x1F\x20\x03\xD5" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_700[] =
+{
+	{ KPS(KIP_TEXT) | 0x134160, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x15BF04, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_700_exfat[] =
+{
+	{ KPS(KIP_TEXT) | 0x13F710, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x1674B4, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_700[] =
+{
+	{ "nosigchk", _fs_nosigchk_700 },
+	{ "nogc",     _fs_nogc_700 },
+	{ NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_700_exfat[] =
+{
+	{ "nosigchk", _fs_nosigchk_700_exfat },
+	{ "nogc",     _fs_nogc_700_exfat },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nosigchk_800[] =
+{
+	{ KPS(KIP_TEXT) | 0x7630C, 4, "\x51\x44\x00\x94", "\xE0\x03\x1F\x2A" },
+	{ KPS(KIP_TEXT) | 0xF49A4, 4, "\xC0\x03\x00\x36", "\x1F\x20\x03\xD5" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patch_t _fs_nosigchk_800_exfat[] =
+{
+	{ KPS(KIP_TEXT) | 0x818BC, 4, "\x51\x44\x00\x94", "\xE0\x03\x1F\x2A" },
+	{ KPS(KIP_TEXT) | 0xFFF54, 4, "\xC0\x03\x00\x36", "\x1F\x20\x03\xD5" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_800[] =
+{
+	{ KPS(KIP_TEXT) | 0x136800, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x15EB94, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_800_exfat[] =
+{
+	{ KPS(KIP_TEXT) | 0x141DB0, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x16A144, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_800[] =
+{
+	{ "nosigchk", _fs_nosigchk_800 },
+	{ "nogc",     _fs_nogc_800 },
+	{ NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_800_exfat[] =
+{
+	{ "nosigchk", _fs_nosigchk_800_exfat },
+	{ "nogc",     _fs_nogc_800_exfat },
+	{ NULL, NULL }
+};
+
+// SHA256 hashes.
 static kip1_id_t _kip_ids[] = 
 {
-	{ "FS", "\xde\x9f\xdd\xa4\x08\x5d\xd5\xfe\x68\xdc\xb2\x0b\x41\x09\x5b\xb4", _fs_patches_100 }, // FS 1.0.0
-	{ "FS", "\xfc\x3e\x80\x99\x1d\xca\x17\x96\x4a\x12\x1f\x04\xb6\x1b\x17\x5e", _fs_patches_100 }, // FS 1.0.0 "exfat"
-	{ "FS", "\xcd\x7b\xbe\x18\xd6\x13\x0b\x28\xf6\x2f\x19\xfa\x79\x45\x53\x5b", _fs_patches_200 }, // FS 2.0.0
-	{ "FS", "\xe7\x66\x92\xdf\xaa\x04\x20\xe9\xfd\xd6\x8e\x43\x63\x16\x18\x18", _fs_patches_200 }, // FS 2.0.0 exfat
-	{ "FS", "\x0d\x70\x05\x62\x7b\x07\x76\x7c\x0b\x96\x3f\x9a\xff\xdd\xe5\x66", _fs_patches_210 }, // FS 2.1.0
-	{ "FS", "\xdb\xd8\x5f\xca\xcc\x19\x3d\xa8\x30\x51\xc6\x64\xe6\x45\x2d\x32", _fs_patches_210 }, // FS 2.1.0 exfat
-	{ "FS", "\xa8\x6d\xa5\xe8\x7e\xf1\x09\x7b\x23\xda\xb5\xb4\xdb\xba\xef\xe7", _fs_patches_300 }, // FS 3.0.0
-	{ "FS", "\x98\x1c\x57\xe7\xf0\x2f\x70\xf7\xbc\xde\x75\x31\x81\xd9\x01\xa6", _fs_patches_300 }, // FS 3.0.0 exfat
-	{ "FS", "\x57\x39\x7c\x06\x3f\x10\xb6\x31\x3f\x4d\x83\x76\x53\xcc\xc3\x71", _fs_patches_30x }, // FS 3.0.1
-	{ "FS", "\x07\x30\x99\xd7\xc6\xad\x7d\x89\x83\xbc\x7a\xdd\x93\x2b\xe3\xd1", _fs_patches_30x }, // FS 3.0.1 exfat
-	{ "FS", "\x06\xe9\x07\x19\x59\x5a\x01\x0c\x62\x46\xff\x70\x94\x6f\x10\xfb", _fs_patches_40x }, // FS 4.0.1
-	{ "FS", "\x54\x9b\x0f\x8d\x6f\x72\xc4\xe9\xf3\xfd\x1f\x19\xea\xce\x4a\x5a", _fs_patches_40x }, // FS 4.0.1 exfat
-	{ "FS", "\x80\x96\xaf\x7c\x6a\x35\xaa\x82\x71\xf3\x91\x69\x95\x41\x3b\x0b", _fs_patches_410 }, // FS 4.1.0
-	{ "FS", "\x02\xd5\xab\xaa\xfd\x20\xc8\xb0\x63\x3a\xa0\xdb\xae\xe0\x37\x7e", _fs_patches_410 }, // FS 4.1.0 exfat
-	{ "FS", "\xa6\xf2\x7a\xd9\xac\x7c\x73\xad\x41\x9b\x63\xb2\x3e\x78\x5a\x0c", _fs_patches_50x }, // FS 5.0.0
-	{ "FS", "\xce\x3e\xcb\xa2\xf2\xf0\x62\xf5\x75\xf8\xf3\x60\x84\x2b\x32\xb4", _fs_patches_50x }, // FS 5.0.0 exfat
-	{ "FS", "\x76\xf8\x74\x02\xc9\x38\x7c\x0f\x0a\x2f\xab\x1b\x45\xce\xbb\x93", _fs_patches_510 }, // FS 5.1.0
-	{ "FS", "\x10\xb2\xd8\x16\x05\x48\x85\x99\xdf\x22\x42\xcb\x6b\xac\x2d\xf1", _fs_patches_510 }, // FS 5.1.0 exfat
+	{ "FS", "\xde\x9f\xdd\xa4\x08\x5d\xd5\xfe\x68\xdc\xb2\x0b\x41\x09\x5b\xb4", _fs_patches_100 },       // FS 1.0.0
+	{ "FS", "\xfc\x3e\x80\x99\x1d\xca\x17\x96\x4a\x12\x1f\x04\xb6\x1b\x17\x5e", _fs_patches_100 },       // FS 1.0.0 exfat
+	{ "FS", "\xcd\x7b\xbe\x18\xd6\x13\x0b\x28\xf6\x2f\x19\xfa\x79\x45\x53\x5b", _fs_patches_200 },       // FS 2.0.0
+	{ "FS", "\xe7\x66\x92\xdf\xaa\x04\x20\xe9\xfd\xd6\x8e\x43\x63\x16\x18\x18", _fs_patches_200 },       // FS 2.0.0 exfat
+	{ "FS", "\x0d\x70\x05\x62\x7b\x07\x76\x7c\x0b\x96\x3f\x9a\xff\xdd\xe5\x66", _fs_patches_210 },       // FS 2.1.0
+	{ "FS", "\xdb\xd8\x5f\xca\xcc\x19\x3d\xa8\x30\x51\xc6\x64\xe6\x45\x2d\x32", _fs_patches_210 },       // FS 2.1.0 exfat
+	{ "FS", "\xa8\x6d\xa5\xe8\x7e\xf1\x09\x7b\x23\xda\xb5\xb4\xdb\xba\xef\xe7", _fs_patches_300 },       // FS 3.0.0
+	{ "FS", "\x98\x1c\x57\xe7\xf0\x2f\x70\xf7\xbc\xde\x75\x31\x81\xd9\x01\xa6", _fs_patches_300 },       // FS 3.0.0 exfat
+	{ "FS", "\x57\x39\x7c\x06\x3f\x10\xb6\x31\x3f\x4d\x83\x76\x53\xcc\xc3\x71", _fs_patches_30x },       // FS 3.0.1
+	{ "FS", "\x07\x30\x99\xd7\xc6\xad\x7d\x89\x83\xbc\x7a\xdd\x93\x2b\xe3\xd1", _fs_patches_30x },       // FS 3.0.1 exfat
+	{ "FS", "\x06\xe9\x07\x19\x59\x5a\x01\x0c\x62\x46\xff\x70\x94\x6f\x10\xfb", _fs_patches_40x },       // FS 4.0.1
+	{ "FS", "\x54\x9b\x0f\x8d\x6f\x72\xc4\xe9\xf3\xfd\x1f\x19\xea\xce\x4a\x5a", _fs_patches_40x },       // FS 4.0.1 exfat
+	{ "FS", "\x80\x96\xaf\x7c\x6a\x35\xaa\x82\x71\xf3\x91\x69\x95\x41\x3b\x0b", _fs_patches_410 },       // FS 4.1.0
+	{ "FS", "\x02\xd5\xab\xaa\xfd\x20\xc8\xb0\x63\x3a\xa0\xdb\xae\xe0\x37\x7e", _fs_patches_410 },       // FS 4.1.0 exfat
+	{ "FS", "\xa6\xf2\x7a\xd9\xac\x7c\x73\xad\x41\x9b\x63\xb2\x3e\x78\x5a\x0c", _fs_patches_50x },       // FS 5.0.0
+	{ "FS", "\xce\x3e\xcb\xa2\xf2\xf0\x62\xf5\x75\xf8\xf3\x60\x84\x2b\x32\xb4", _fs_patches_50x },       // FS 5.0.0 exfat
+	{ "FS", "\x76\xf8\x74\x02\xc9\x38\x7c\x0f\x0a\x2f\xab\x1b\x45\xce\xbb\x93", _fs_patches_510 },       // FS 5.1.0
+	{ "FS", "\x10\xb2\xd8\x16\x05\x48\x85\x99\xdf\x22\x42\xcb\x6b\xac\x2d\xf1", _fs_patches_510 },       // FS 5.1.0 exfat
+	{ "FS", "\x1b\x82\xcb\x22\x18\x67\xcb\x52\xc4\x4a\x86\x9e\xa9\x1a\x1a\xdd", _fs_patches_600 }, 		 // FS 6.0.0-4.0
+	{ "FS", "\x96\x6a\xdd\x3d\x20\xb6\x27\x13\x2c\x5a\x8d\xa4\x9a\xc9\xd8\xdd", _fs_patches_600_exfat }, // FS 6.0.0-4.0 exfat
+	{ "FS", "\x3a\x57\x4d\x43\x61\x86\x19\x1d\x17\x88\xeb\x2c\x0f\x07\x6b\x11", _fs_patches_600 }, 		 // FS 6.0.0-5.0
+	{ "FS", "\x33\x05\x53\xf6\xb5\xfb\x55\xc4\xc2\xd7\xb7\x36\x24\x02\x76\xb3", _fs_patches_600_exfat }, // FS 6.0.0-5.0 exfat
+	{ "FS", "\x2A\xDB\xE9\x7E\x9B\x5F\x41\x77\x9E\xC9\x5F\xFE\x26\x99\xC9\x33", _fs_patches_700 }, 		 // FS 7.0.0
+	{ "FS", "\x2C\xCE\x65\x9C\xEC\x53\x6A\x8E\x4D\x91\xF3\xBE\x4B\x74\xBE\xD3", _fs_patches_700_exfat }, // FS 7.0.0 exfat
+	{ "FS", "\xB2\xF5\x17\x6B\x35\x48\x36\x4D\x07\x9A\x29\xB1\x41\xA2\x3B\x06", _fs_patches_800 }, 		 // FS 8.0.0
+	{ "FS", "\xDB\xD9\x41\xC0\xC5\x3C\x52\xCC\xF7\x20\x2C\x84\xD8\xE0\xF7\x80", _fs_patches_800_exfat }  // FS 8.0.0 exfat
 };
 
 const pkg2_kernel_id_t *pkg2_identify(u32 id)
@@ -430,7 +641,16 @@ static u32 _pkg2_calc_kip1_size(pkg2_kip1_t *kip1)
 
 void pkg2_parse_kips(link_t *info, pkg2_hdr_t *pkg2)
 {
-	u8 *ptr = pkg2->data + pkg2->sec_size[PKG2_SEC_KERNEL];
+	u8 *ptr;
+	// Check for new pkg2
+	if (!pkg2->sec_size[PKG2_SEC_INI1])
+	{
+		u32 kernel_ini1_off = *(u32 *)(pkg2->data + PKG2_NEWKERN_INI1_START);
+		ptr = pkg2->data + kernel_ini1_off;
+	}
+	else
+		ptr = pkg2->data + pkg2->sec_size[PKG2_SEC_KERNEL];
+
 	pkg2_ini1_t *ini1 = (pkg2_ini1_t *)ptr;
 	ptr += sizeof(pkg2_ini1_t);
 
@@ -493,7 +713,7 @@ int pkg2_decompress_kip(pkg2_kip1_info_t* ki, u32 sectsToDecomp)
 	memcpy(&hdr, ki->kip1, sizeof(hdr));
 	
 	unsigned int newKipSize = sizeof(hdr);
-	for (u32 sectIdx=0; sectIdx<KIP1_NUM_SECTIONS; sectIdx++)
+	for (u32 sectIdx = 0; sectIdx < KIP1_NUM_SECTIONS; sectIdx++)
 	{
 		u32 sectCompBit = 1u << sectIdx;
 		// For compressed, cant get actual decompressed size without doing it, so use safe "output size".
@@ -506,7 +726,7 @@ int pkg2_decompress_kip(pkg2_kip1_info_t* ki, u32 sectsToDecomp)
 	pkg2_kip1_t* newKip = malloc(newKipSize);	
 	unsigned char* dstDataPtr = newKip->data;
 	const unsigned char* srcDataPtr = ki->kip1->data;
-	for (u32 sectIdx=0; sectIdx<KIP1_NUM_SECTIONS; sectIdx++)
+	for (u32 sectIdx = 0; sectIdx < KIP1_NUM_SECTIONS; sectIdx++)
 	{
 		u32 sectCompBit = 1u << sectIdx;
 		// Easy copy path for uncompressed or ones we dont want to uncompress.
@@ -524,10 +744,10 @@ int pkg2_decompress_kip(pkg2_kip1_info_t* ki, u32 sectsToDecomp)
 
 		unsigned int compSize = hdr.sections[sectIdx].size_comp;
 		unsigned int outputSize = hdr.sections[sectIdx].size_decomp;
-		gfx_printf(&gfx_con, "Decomping %s KIP1 sect %d of size %d...\n", (const char*)hdr.name, sectIdx, compSize);
+		gfx_printf("Decomping %s KIP1 sect %d of size %d...\n", (const char*)hdr.name, sectIdx, compSize);
 		if (blz_uncompress_srcdest(srcDataPtr, compSize, dstDataPtr, outputSize) == 0)
 		{
-			gfx_printf(&gfx_con, "%kERROR decomping sect %d of %s KIP!%k\n", 0xFFFF0000, sectIdx, (char*)hdr.name, 0xFFCCCCCC);			
+			gfx_printf("%kERROR decomping sect %d of %s KIP!%k\n", 0xFFFF0000, sectIdx, (char*)hdr.name, 0xFFCCCCCC);			
 			free(newKip);
 
 			return 1;
@@ -560,7 +780,7 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 	static const u32 MAX_NUM_PATCHES_REQUESTED = sizeof(u32)*8;
 	char* patches[MAX_NUM_PATCHES_REQUESTED];
 
-	u32 numPatches=1;
+	u32 numPatches = 1;
 	patches[0] = patchNames;
 	{
 		for (char* p = patchNames; *p != 0; p++)
@@ -568,7 +788,7 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 			if (*p == ',')
 			{
 				*p = 0;
-				patches[numPatches++] = p+1;
+				patches[numPatches++] = p + 1;
 				if (numPatches >= MAX_NUM_PATCHES_REQUESTED)
 					return "too_many_patches";
 			}
@@ -578,10 +798,10 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 	}
 
 	u32 patchesApplied = 0; // Bitset over patches.
-	for (u32 i=0; i<numPatches; i++)
+	for (u32 i = 0; i < numPatches; i++)
 	{
 		// Eliminate leading spaces.
-		for (const char* p=patches[i]; *p!=0; p++)
+		for (const char* p = patches[i]; *p != 0; p++)
 		{
 			if (*p == ' ' || *p == '\t' || *p == '\r' || *p == '\n')
 				patches[i]++;
@@ -593,7 +813,7 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 			continue;
 
 		// Eliminate trailing spaces.
-		for (int chIdx=valueLen-1; chIdx>=0; chIdx--)
+		for (int chIdx=valueLen - 1; chIdx >= 0; chIdx--)
 		{
 			const char* p = patches[i] + chIdx;
 			if (*p == ' ' || *p == '\t' || *p == '\r' || *p == '\n')
@@ -606,11 +826,11 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 		DPRINTF("Requested patch: '%s'\n", patches[i]);
 	}
 
-	u32 shaBuf[32/sizeof(u32)];
+	u32 shaBuf[32 / sizeof(u32)];
 	LIST_FOREACH_ENTRY(pkg2_kip1_info_t, ki, info, link)
 	{
 		shaBuf[0] = 0; // sha256 for this kip not yet calculated.
-		for (u32 currKipIdx=0; currKipIdx<(sizeof(_kip_ids)/sizeof(_kip_ids[0])); currKipIdx++)
+		for (u32 currKipIdx = 0; currKipIdx < (sizeof(_kip_ids) / sizeof(_kip_ids[0])); currKipIdx++)
 		{
 			if (strncmp((const char*)ki->kip1->name, _kip_ids[currKipIdx].name, sizeof(ki->kip1->name)) != 0)
 				continue;
@@ -619,7 +839,7 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 			kip1_patchset_t* currPatchset = _kip_ids[currKipIdx].patchset;
 			while (currPatchset != NULL && currPatchset->name != NULL)
 			{
-				for (u32 i=0; i<numPatches; i++)
+				for (u32 i = 0; i < numPatches; i++)
 				{
 					if (strcmp(currPatchset->name, patches[i]) != 0)
 					{
@@ -650,7 +870,7 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 			{
 				if (currPatchset->patches != NULL)
 				{
-					for (u32 currEnabIdx=0; currEnabIdx<numPatches; currEnabIdx++)
+					for (u32 currEnabIdx = 0; currEnabIdx < numPatches; currEnabIdx++)
 					{
 						if (strcmp(currPatchset->name, patches[currEnabIdx]))
 							continue;
@@ -674,13 +894,13 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 			if (!se_calc_sha256(shaBuf, ki->kip1, ki->size))
 				memset(shaBuf, 0, sizeof(shaBuf));
 
-			DPRINTF("%dms %s KIP1 size %d hash %08X\n", (postDecompTime-preDecompTime)/1000, ki->kip1->name, (int)ki->size, __builtin_bswap32(shaBuf[0]));
+			DPRINTF("%dms %s KIP1 size %d hash %08X\n", (postDecompTime-preDecompTime) / 1000, ki->kip1->name, (int)ki->size, __builtin_bswap32(shaBuf[0]));
 #endif
 
 			currPatchset = _kip_ids[currKipIdx].patchset;
 			while (currPatchset != NULL && currPatchset->name != NULL)
 			{
-				for (u32 currEnabIdx=0; currEnabIdx<numPatches; currEnabIdx++)
+				for (u32 currEnabIdx = 0; currEnabIdx < numPatches; currEnabIdx++)
 				{
 					if (strcmp(currPatchset->name, patches[currEnabIdx]))
 						continue;
@@ -688,17 +908,17 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 					u32 appliedMask = 1u << currEnabIdx;
 					if (currPatchset->patches == NULL)
 					{
-						gfx_printf(&gfx_con, "Patch '%s' not necessary for %s KIP1\n", currPatchset->name, (const char*)ki->kip1->name);
+						gfx_printf("Patch '%s' not necessary for %s KIP1\n", currPatchset->name, (const char*)ki->kip1->name);
 						patchesApplied |= appliedMask;
 						break;
 					}
 
 					unsigned char* kipSectData = ki->kip1->data;
-					for (u32 currSectIdx=0; currSectIdx<KIP1_NUM_SECTIONS; currSectIdx++)
+					for (u32 currSectIdx = 0; currSectIdx < KIP1_NUM_SECTIONS; currSectIdx++)
 					{
 						if (bitsAffected & (1u << currSectIdx))
 						{
-							gfx_printf(&gfx_con, "Applying patch '%s' on %s KIP1 sect %d\n", currPatchset->name, (const char*)ki->kip1->name, currSectIdx);
+							gfx_printf("Applying patch '%s' on %s KIP1 sect %d\n", currPatchset->name, (const char*)ki->kip1->name, currSectIdx);
 							for (const kip1_patch_t* currPatch=currPatchset->patches;currPatch != NULL && currPatch->length != 0; currPatch++)
 							{
 								if (GET_KIP_PATCH_SECTION(currPatch->offset) != currSectIdx)
@@ -707,7 +927,7 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 								u32 currOffset = GET_KIP_PATCH_OFFSET(currPatch->offset);
 								if (memcmp(&kipSectData[currOffset], currPatch->srcData, currPatch->length) != 0)
 								{
-									gfx_printf(&gfx_con, "%kDATA MISMATCH FOR PATCH AT OFFSET 0x%x!!!%k\n", 0xFFFF0000, currOffset, 0xFFCCCCCC);
+									gfx_printf("%kDATA MISMATCH FOR PATCH AT OFFSET 0x%x!!!%k\n", 0xFFFF0000, currOffset, 0xFFCCCCCC);
 									return currPatchset->name; // MUST stop here as kip is likely corrupt.
 								}
 								else
@@ -728,7 +948,7 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 		}
 	}
 
-	for (u32 i=0; i<numPatches; i++)
+	for (u32 i = 0; i < numPatches; i++)
 	{
 		if ((patchesApplied & (1u << i)) == 0)
 			return patches[i];
@@ -751,7 +971,7 @@ pkg2_hdr_t *pkg2_decrypt(void *data)
 
 	// Decrypt header.
 	se_aes_crypt_ctr(8, hdr, sizeof(pkg2_hdr_t), hdr, sizeof(pkg2_hdr_t), hdr);
-	//gfx_hexdump(&gfx_con, (u32)hdr, hdr, 0x100);
+	//gfx_hexdump((u32)hdr, hdr, 0x100);
 
 	if (hdr->magic != PKG2_MAGIC)
 		return NULL;
@@ -763,7 +983,7 @@ DPRINTF("sec %d has size %08X\n", i, hdr->sec_size[i]);
 			continue;
 
 		se_aes_crypt_ctr(8, pdata, hdr->sec_size[i], pdata, hdr->sec_size[i], &hdr->sec_ctr[i * 0x10]);
-		//gfx_hexdump(&gfx_con, (u32)pdata, pdata, 0x100);
+		//gfx_hexdump((u32)pdata, pdata, 0x100);
 
 		pdata += hdr->sec_size[i];
 	}
@@ -771,31 +991,8 @@ DPRINTF("sec %d has size %08X\n", i, hdr->sec_size[i]);
 	return hdr;
 }
 
-void pkg2_build_encrypt(void *dst, void *kernel, u32 kernel_size, link_t *kips_info)
+static u32 _pkg2_ini1_build(u8 *pdst, pkg2_hdr_t *hdr, link_t *kips_info, bool new_pkg2)
 {
-	u8 *pdst = (u8 *)dst;
-
-	// Signature.
-	memset(pdst, 0, 0x100);
-	pdst += 0x100;
-
-	// Header.
-	pkg2_hdr_t *hdr = (pkg2_hdr_t *)pdst;
-	memset(hdr, 0, sizeof(pkg2_hdr_t));
-	pdst += sizeof(pkg2_hdr_t);
-	hdr->magic = PKG2_MAGIC;
-	hdr->base = 0x10000000;
-DPRINTF("kernel @ %08X (%08X)\n", (u32)kernel, kernel_size);
-
-	// Kernel.
-	memcpy(pdst, kernel, kernel_size);
-	hdr->sec_size[PKG2_SEC_KERNEL] = kernel_size;
-	hdr->sec_off[PKG2_SEC_KERNEL] = 0x10000000;
-	se_aes_crypt_ctr(8, pdst, kernel_size, pdst, kernel_size, &hdr->sec_ctr[PKG2_SEC_KERNEL * 0x10]);
-	pdst += kernel_size;
-DPRINTF("kernel encrypted\n");
-
-	// INI1.
 	u32 ini1_size = sizeof(pkg2_ini1_t);
 	pkg2_ini1_t *ini1 = (pkg2_ini1_t *)pdst;
 	memset(ini1, 0, sizeof(pkg2_ini1_t));
@@ -810,9 +1007,60 @@ DPRINTF("adding kip1 '%s' @ %08X (%08X)\n", ki->kip1->name, (u32)ki->kip1, ki->s
 		ini1->num_procs++;
 	}
 	ini1->size = ini1_size;
-	hdr->sec_size[PKG2_SEC_INI1] = ini1_size;
-	hdr->sec_off[PKG2_SEC_INI1] = 0x14080000;
-	se_aes_crypt_ctr(8, ini1, ini1_size, ini1, ini1_size, &hdr->sec_ctr[PKG2_SEC_INI1 * 0x10]);
+	if (!new_pkg2)
+	{
+		hdr->sec_size[PKG2_SEC_INI1] = ini1_size;
+		hdr->sec_off[PKG2_SEC_INI1] = 0x14080000;
+		se_aes_crypt_ctr(8, ini1, ini1_size, ini1, ini1_size, &hdr->sec_ctr[PKG2_SEC_INI1 * 0x10]);
+	}
+	else
+	{
+		hdr->sec_size[PKG2_SEC_INI1] = 0;
+		hdr->sec_off[PKG2_SEC_INI1] = 0;
+	}
+
+	return ini1_size;
+}
+
+void pkg2_build_encrypt(void *dst, void *kernel, u32 kernel_size, link_t *kips_info, bool new_pkg2)
+{
+	u8 *pdst = (u8 *)dst;
+
+	// Signature.
+	memset(pdst, 0, 0x100);
+	pdst += 0x100;
+
+	// Header.
+	pkg2_hdr_t *hdr = (pkg2_hdr_t *)pdst;
+	memset(hdr, 0, sizeof(pkg2_hdr_t));
+	pdst += sizeof(pkg2_hdr_t);
+	hdr->magic = PKG2_MAGIC;
+	if (!new_pkg2)
+		hdr->base = 0x10000000;
+	else
+		hdr->base = 0x60000;
+DPRINTF("kernel @ %08X (%08X)\n", (u32)kernel, kernel_size);
+
+	// Kernel.
+	memcpy(pdst, kernel, kernel_size);
+	if (!new_pkg2)
+		hdr->sec_off[PKG2_SEC_KERNEL] = 0x10000000;
+	else
+	{
+		// Set new INI1 offset to kernel.
+		*(u32 *)(pdst + PKG2_NEWKERN_INI1_START) = kernel_size;
+		kernel_size += _pkg2_ini1_build(pdst + kernel_size, hdr, kips_info, new_pkg2);
+		hdr->sec_off[PKG2_SEC_KERNEL] = 0x60000;
+	}
+	hdr->sec_size[PKG2_SEC_KERNEL] = kernel_size;
+	se_aes_crypt_ctr(8, pdst, kernel_size, pdst, kernel_size, &hdr->sec_ctr[PKG2_SEC_KERNEL * 0x10]);
+	pdst += kernel_size;
+DPRINTF("kernel encrypted\n");
+
+	// INI1.
+	u32 ini1_size = 0;
+	if (!new_pkg2)
+		ini1_size = _pkg2_ini1_build(pdst, hdr, kips_info, new_pkg2);
 DPRINTF("INI1 encrypted\n");
 
 	//Encrypt header.
@@ -821,4 +1069,3 @@ DPRINTF("INI1 encrypted\n");
 	memset(hdr->ctr, 0 , 0x10);
 	*(u32 *)hdr->ctr = 0x100 + sizeof(pkg2_hdr_t) + kernel_size + ini1_size;
 }
-

bootloader/hos/pkg2.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (C) 2018-2019 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -27,6 +27,9 @@
 #define PKG2_SEC_INI1 1
 
 #define INI1_MAGIC 0x31494E49
+#define PKG2_NEWKERN_INI1_START 0x168
+#define PKG2_NEWKERN_INI1_END   0x170
+#define PKG2_NEWKERN_START      0x800
 
 typedef struct _kernel_patch_t
 {
@@ -44,8 +47,10 @@ typedef struct _kernel_patch_t
 
 enum
 {
-	// Generic instruction patches
-	SVC_VERIFY_DS = 0x10, // 0x0-0xF are RESERVED.
+	// Always applied.
+	SVC_GENERIC   = 0,
+	// Generic instruction patches.
+	SVC_VERIFY_DS = 0x10,
 	DEBUG_MODE_EN,
 	ATM_GEN_PATCH,
 	// >4 bytes patches. Value is a pointer of a u32 array.
@@ -115,16 +120,16 @@ typedef struct _pkg2_kernel_id_t
 
 typedef struct _kip1_patch_t
 {
-	u32 offset; //section+offset of patch to apply
-	u32 length; //in bytes, 0 means last patch
-	const char* srcData; //that must match
-	const char* dstData; //that it gets replaced by
+	u32 offset; // section+offset of patch to apply.
+	u32 length; // In bytes, 0 means last patch.
+	const char* srcData; // That must match.
+	const char* dstData; // That it gets replaced by.
 } kip1_patch_t;
 
 typedef struct _kip1_patchset_t
 {
-	const char* name; //NULL means end
-	kip1_patch_t* patches; //NULL means not necessary
+	const char* name; // NULL means end.
+	kip1_patch_t* patches; // NULL means not necessary.
 } kip1_patchset_t;
 
 typedef struct _kip1_id_t
@@ -143,6 +148,6 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames);
 
 const pkg2_kernel_id_t *pkg2_identify(u32 id);
 pkg2_hdr_t *pkg2_decrypt(void *data);
-void pkg2_build_encrypt(void *dst, void *kernel, u32 kernel_size, link_t *kips_info);
+void pkg2_build_encrypt(void *dst, void *kernel, u32 kernel_size, link_t *kips_info, bool new_pkg2);
 
 #endif

bootloader/hos/secmon_exo.c

@@ -0,0 +1,230 @@
+/*
+ * Copyright (c) 2018-2019 CTCaer
+ * Copyright (c) 2019 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <string.h>
+#include <stdlib.h>
+
+#include "hos.h"
+#include "../gfx/di.h"
+#include "../gfx/gfx.h"
+#include "../libs/fatfs/ff.h"
+#include "../mem/heap.h"
+#include "../soc/fuse.h"
+#include "../storage/sdmmc.h"
+#include "../utils/btn.h"
+#include "../utils/util.h"
+#include "../utils/types.h"
+
+extern bool sd_mount();
+extern int sd_save_to_file(void *buf, u32 size, const char *filename);
+
+typedef struct _exo_cfg_t
+{
+	vu32 magic;
+	vu32 fwno;
+	vu32 flags;
+	vu32 rsvd;
+} exo_cfg_t;
+
+typedef struct _atm_meta_t
+{
+	uint32_t magic;
+	uint32_t fwno;
+} wb_cfg_t;
+
+// Atmosphère reboot-to-fatal-error.
+typedef struct _atm_fatal_error_ctx
+{
+	u32 magic;
+	u32 error_desc;
+	u64 title_id;
+	union
+	{
+		u64 gprs[32];
+		struct
+		{
+			u64 _gprs[29];
+			u64 fp;
+			u64 lr;
+			u64 sp;
+		};
+	};
+	u64 pc;
+	u64 padding;
+	u32 pstate;
+	u32 afsr0;
+	u32 afsr1;
+	u32 esr;
+	u64 far;
+	u64 report_identifier; // Normally just system tick.
+} atm_fatal_error_ctx;
+
+#define ATM_FATAL_ERR_CTX_ADDR 0x4003E000
+#define  ATM_FATAL_MAGIC 0x30454641 // AFE0
+
+#define ATM_WB_HEADER_OFF 0x244
+#define  ATM_WB_MAGIC 0x30544257
+
+// Exosphère mailbox defines.
+#define EXO_CFG_DEPR_ADDR 0x40002E40 // Deprecated.
+#define EXO_CFG_ADDR      0x8000F000
+#define  EXO_MAGIC_DEPR_VAL 0x31434258
+#define  EXO_MAGIC_VAL      0x304F5845
+#define  EXO_FLAG_620_KGN   (1 << 0)
+#define  EXO_FLAG_DBG_PRIV  (1 << 1)
+#define  EXO_FLAG_DBG_USER  (1 << 2)
+
+void config_exosphere(const char *id, u32 kb, void *warmboot, bool stock)
+{
+	u32 exoFwNo = 0;
+	u32 exoFlags = 0;
+
+	volatile exo_cfg_t *exo_cfg_depr = (exo_cfg_t *)EXO_CFG_DEPR_ADDR;
+	volatile exo_cfg_t *exo_cfg = (exo_cfg_t *)EXO_CFG_ADDR;
+
+	switch (kb)
+	{
+	case KB_FIRMWARE_VERSION_100_200:
+		if (!strcmp(id, "20161121183008"))
+			exoFwNo = 1;
+		else
+			exoFwNo = 2;
+		break;
+	case KB_FIRMWARE_VERSION_300:
+		exoFwNo = 3;
+		break;
+	default:
+		exoFwNo = kb + 1;
+		if (!strcmp(id, "20190314172056"))
+			exoFwNo++; // ATM_TARGET_FW_800.
+		break;
+	}
+
+	if (kb == KB_FIRMWARE_VERSION_620)
+		exoFlags |= EXO_FLAG_620_KGN;
+
+	// To avoid problems, make private debug mode always on if not semi-stock.
+	if (!stock)
+		exoFlags |= EXO_FLAG_DBG_PRIV;
+
+	// Set mailbox values.
+	exo_cfg_depr->magic = EXO_MAGIC_VAL;
+	exo_cfg->magic = EXO_MAGIC_VAL;
+
+	exo_cfg_depr->fwno = exoFwNo;
+	exo_cfg->fwno = exoFwNo;
+
+	exo_cfg_depr->flags = exoFlags;
+	exo_cfg->flags = exoFlags;
+
+	// If warmboot is lp0fw, add in RSA modulus.
+	volatile wb_cfg_t *wb_cfg = (wb_cfg_t *)(warmboot + ATM_WB_HEADER_OFF);
+
+	if (wb_cfg->magic == ATM_WB_MAGIC)
+	{
+		wb_cfg->fwno = exoFwNo;
+
+		sdmmc_storage_t storage;
+		sdmmc_t sdmmc;
+
+		// Set warmboot binary rsa modulus.
+		u8 *rsa_mod = (u8 *)malloc(512);
+
+		sdmmc_storage_init_mmc(&storage, &sdmmc, SDMMC_4, SDMMC_BUS_WIDTH_8, 4);
+		sdmmc_storage_set_mmc_partition(&storage, 1);
+		sdmmc_storage_read(&storage, 1, 1, rsa_mod);
+		sdmmc_storage_end(&storage);
+
+		// Patch AutoRCM out.
+		if ((fuse_read_odm(4) & 3) != 3)
+			rsa_mod[0x10] = 0xF7;
+		else
+			rsa_mod[0x10] = 0x37;
+
+		memcpy(warmboot + 0x10, rsa_mod + 0x10, 0x100);
+	}
+}
+
+static const char *get_error_desc(u32 error_desc)
+{
+	switch (error_desc)
+	{
+	case 0x100:
+		return "Instruction Abort";
+	case 0x101:
+		return "Data Abort";
+	case 0x102:
+		return "PC Misalignment";
+	case 0x103:
+		return "SP Misalignment";
+	case 0x104:
+		return "Trap";
+	case 0x106:
+		return "SError";
+	case 0x301:
+		return "Bad SVC";
+	default:
+		return "Unknown";
+	}
+}
+
+void secmon_exo_check_panic()
+{
+	volatile atm_fatal_error_ctx *rpt = (atm_fatal_error_ctx *)ATM_FATAL_ERR_CTX_ADDR;
+
+	if (rpt->magic != ATM_FATAL_MAGIC)
+		return;
+
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	WPRINTF("Panic occurred while running Atmosphere.\n\n");
+	WPRINTFARGS("Title ID:   %08X%08X", (u32)((u64)rpt->title_id >> 32), (u32)rpt->title_id);
+	WPRINTFARGS("Error Desc: %s (0x%x)\n", get_error_desc(rpt->error_desc), rpt->error_desc);
+
+	if (sd_mount())
+	{
+		// Save context to the SD card.
+		char filepath[0x40];
+		f_mkdir("atmosphere/fatal_errors");
+		memcpy(filepath, "/atmosphere/fatal_errors/report_", 33);
+		itoa((u32)((u64)rpt->report_identifier >> 32), filepath + strlen(filepath), 16);
+		itoa((u32)(rpt->report_identifier), filepath + strlen(filepath), 16);
+		memcpy(filepath + strlen(filepath), ".bin", 5);
+
+		sd_save_to_file((void *)rpt, sizeof(atm_fatal_error_ctx), filepath);
+
+		gfx_con.fntsz = 8;
+		WPRINTFARGS("Report saved to %s\n", filepath);
+	}
+
+	// Change magic to invalid, to prevent double-display of error/bootlooping.
+	rpt->magic = 0x0;
+
+	gfx_con.fntsz = 16;
+	gfx_printf("\n\nPress POWER to continue.\n");
+
+	display_backlight_brightness(100, 1000);
+	msleep(1000);
+
+	u32 btn = btn_wait();
+	while (!(btn & BTN_POWER))
+		btn = btn_wait();
+
+	display_backlight_brightness(0, 1000);
+	gfx_con_setpos(0, 0);
+}

bootloader/hos/secmon_exo.h

@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2018-2019 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _SECMON_EXO_H_
+#define _SECMON_EXO_H_
+
+#include "../utils/types.h"
+
+void config_exosphere(const char *id, u32 kb, void *warmboot, bool stock);
+void secmon_exo_check_panic();
+
+#endif

bootloader/hos/sept.c

@@ -0,0 +1,206 @@
+/*
+ * Copyright (c) 2019 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <string.h>
+
+#include "hos.h"
+#include "sept.h"
+#include "../config/config.h"
+#include "../gfx/di.h"
+#include "../ianos/ianos.h"
+#include "../libs/fatfs/ff.h"
+#include "../mem/heap.h"
+#include "../soc/pmc.h"
+#include "../soc/t210.h"
+#include "../storage/nx_emmc.h"
+#include "../storage/sdmmc.h"
+#include "../utils/btn.h"
+#include "../utils/types.h"
+
+#include "../gfx/gfx.h"
+
+#define RELOC_META_OFF   0x7C
+#define PATCHED_RELOC_SZ 0x94
+
+#define WB_RST_ADDR 0x40010ED0
+#define WB_RST_SIZE 0x30
+
+u8 warmboot_reboot[] = {
+	0x14, 0x00, 0x9F, 0xE5, // LDR R0, =0x7000E450
+	0x01, 0x10, 0xB0, 0xE3, // MOVS R1, #1
+	0x00, 0x10, 0x80, 0xE5, // STR R1, [R0]
+	0x0C, 0x00, 0x9F, 0xE5, // LDR R0, =0x7000E400 
+	0x10, 0x10, 0xB0, 0xE3, // MOVS R1, #0x10
+	0x00, 0x10, 0x80, 0xE5, // STR R1, [R0]
+	0xFE, 0xFF, 0xFF, 0xEA, // LOOP
+	0x50, 0xE4, 0x00, 0x70, // #0x7000E450
+	0x00, 0xE4, 0x00, 0x70  // #0x7000E400
+};
+
+#define SEPT_PRI_ADDR   0x4003F000
+
+#define SEPT_PK1T_ADDR  0xC0400000
+#define SEPT_TCSZ_ADDR  (SEPT_PK1T_ADDR - 0x4)
+#define SEPT_STG1_ADDR  (SEPT_PK1T_ADDR + 0x2E100)
+#define SEPT_STG2_ADDR  (SEPT_PK1T_ADDR + 0x60E0)
+#define SEPT_PKG_SZ     (0x2F100 + WB_RST_SIZE)
+
+extern boot_cfg_t b_cfg;
+extern hekate_config h_cfg;
+extern const volatile ipl_ver_meta_t ipl_ver;
+
+extern void *sd_file_read(char *path);
+extern void sd_mount();
+extern void sd_unmount();
+extern bool is_ipl_updated(void *buf);
+extern void reloc_patcher(u32 payload_dst, u32 payload_src, u32 payload_size);
+
+void check_sept()
+{
+	// Check if non-hekate payload is used for sept and restore it.
+	if (h_cfg.sept_run && !f_stat("sept/payload.bak", NULL))
+	{
+		f_unlink("sept/payload.bin");
+		f_rename("sept/payload.bak", "sept/payload.bin");
+		return;
+	}
+
+	u8 *pkg1 = (u8 *)calloc(1, 0x40000);
+
+	sdmmc_storage_t storage;
+	sdmmc_t sdmmc;
+	if (!sdmmc_storage_init_mmc(&storage, &sdmmc, SDMMC_4, SDMMC_BUS_WIDTH_8, 4))
+	{
+		EPRINTF("Failed to init eMMC.");
+		goto out_free;
+	}
+	sdmmc_storage_set_mmc_partition(&storage, 1);
+
+	// Read package1.
+	sdmmc_storage_read(&storage, 0x100000 / NX_EMMC_BLOCKSIZE, 0x40000 / NX_EMMC_BLOCKSIZE, pkg1);
+	const pkg1_id_t *pkg1_id = pkg1_identify(pkg1);
+	if (!pkg1_id)
+	{
+		gfx_con.fntsz = 16;
+		EPRINTF("Unknown pkg1 version.");
+		goto out_free;
+	}
+
+	if (pkg1_id->kb >= KB_FIRMWARE_VERSION_700 && !h_cfg.sept_run)
+	{
+		sdmmc_storage_end(&storage);
+		reboot_to_sept((u8 *)pkg1 + pkg1_id->tsec_off);
+	}
+
+out_free:
+	free(pkg1);
+	sdmmc_storage_end(&storage);
+}
+
+int reboot_to_sept(const u8 *tsec_fw)
+{
+	FIL fp;
+
+	// Copy warmboot reboot code and TSEC fw.
+	memcpy((u8 *)(SEPT_PK1T_ADDR - WB_RST_SIZE), (u8 *)warmboot_reboot, sizeof(warmboot_reboot));
+	memcpy((void *)SEPT_PK1T_ADDR, tsec_fw, 0x3000);
+	*(vu32 *)SEPT_TCSZ_ADDR = 0x3000;
+	
+	// Copy sept-primary.
+	if (f_open(&fp, "sept/sept-primary.bin", FA_READ))
+		goto error;
+
+	if (f_read(&fp, (u8 *)SEPT_STG1_ADDR, f_size(&fp), NULL))
+	{
+		f_close(&fp);
+		goto error;
+	}
+	f_close(&fp);
+
+	// Copy sept-secondary.
+	if (f_open(&fp, "sept/sept-secondary.enc", FA_READ))
+		goto error;
+
+	if (f_read(&fp, (u8 *)SEPT_STG2_ADDR, f_size(&fp), NULL))
+	{
+		f_close(&fp);
+		goto error;
+	}
+	f_close(&fp);
+
+	b_cfg.boot_cfg |= (BOOT_CFG_AUTOBOOT_EN | BOOT_CFG_SEPT_RUN);
+
+	bool update_sept_payload = true;
+	if (!f_open(&fp, "sept/payload.bin", FA_READ | FA_WRITE))
+	{
+		ipl_ver_meta_t tmp_ver;
+		f_lseek(&fp, PATCHED_RELOC_SZ + sizeof(boot_cfg_t));
+		f_read(&fp, &tmp_ver, sizeof(ipl_ver_meta_t), NULL);
+
+		if (tmp_ver.magic == ipl_ver.magic)
+		{
+			if (tmp_ver.version == ipl_ver.version)
+			{
+				// Save auto boot config to sept payload, if any.
+				boot_cfg_t *tmp_cfg = malloc(sizeof(boot_cfg_t));
+				memcpy(tmp_cfg, &b_cfg, sizeof(boot_cfg_t));
+				f_lseek(&fp, PATCHED_RELOC_SZ);
+				f_write(&fp, tmp_cfg, sizeof(boot_cfg_t), NULL);
+				f_close(&fp);
+				update_sept_payload = false;
+			}
+		}
+		else
+			f_rename("sept/payload.bin", "sept/payload.bak"); // Backup foreign payload.
+
+		f_close(&fp);
+	}
+
+	if (update_sept_payload)
+	{
+		volatile reloc_meta_t *reloc = (reloc_meta_t *)(IPL_LOAD_ADDR + RELOC_META_OFF);
+		f_open(&fp, "sept/payload.bin", FA_WRITE | FA_CREATE_ALWAYS);
+		f_write(&fp, (u8 *)reloc->start, reloc->end - reloc->start, NULL);
+		f_close(&fp);
+	}
+
+	sd_unmount();
+
+	u32 pk1t_sept = SEPT_PK1T_ADDR - (ALIGN(PATCHED_RELOC_SZ, 0x10) + WB_RST_SIZE);
+
+	void (*sept)() = (void *)pk1t_sept;
+
+	reloc_patcher(WB_RST_ADDR, pk1t_sept, SEPT_PKG_SZ);
+
+	// Patch SDRAM init to perform an SVC immediately after second write.
+	PMC(APBDEV_PMC_SCRATCH45) = 0x2E38DFFF;
+	PMC(APBDEV_PMC_SCRATCH46) = 0x6001DC28;
+	// Set SVC handler to jump to sept-primary in IRAM.
+	PMC(APBDEV_PMC_SCRATCH33) = SEPT_PRI_ADDR;
+	PMC(APBDEV_PMC_SCRATCH40) = 0x6000F208;
+
+	display_end();
+
+	(*sept)();
+
+error:
+	EPRINTF("Failed to run sept\n");
+	display_backlight_brightness(h_cfg.backlight, 1000);
+
+	btn_wait();
+
+	return 0;
+}

bootloader/hos/sept.h

@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2019 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _SEPT_H_
+#define _SEPT_H_
+
+#include "../utils/types.h"
+
+void check_sept();
+int reboot_to_sept(const u8 *tsec_fw);
+
+#endif

bootloader/ianos/ianos.c

@@ -27,11 +27,9 @@
 #define IRAM_LIB_ADDR 0x4002B000
 #define DRAM_LIB_ADDR 0xE0000000
 
-extern gfx_ctxt_t gfx_ctxt;
-extern gfx_con_t gfx_con;
 extern heap_t _heap;
 
-extern void *sd_file_read(char *path);
+extern void *sd_file_read(const char *path, u32 *fsize);
 extern bool sd_mount();
 extern void sd_unmount();
 
@@ -72,19 +70,19 @@ void ianos_print_error(int errorno)
 	switch (errorno)
 	{
 	case 1:
-		gfx_printf(&gfx_con, "Can't find library!\n");
+		gfx_printf("Can't find library!\n");
 		break;
 	case 2:
-		gfx_printf(&gfx_con, "Cant init ELF context!\n");
+		gfx_printf("Cant init ELF context!\n");
 		break;
 	case 3:
-		gfx_printf(&gfx_con, "Cant alloc memory!\n");
+		gfx_printf("Cant alloc memory!\n");
 		break;
 	case 4:
-		gfx_printf(&gfx_con, "Error loading ELF!\n");
+		gfx_printf("Error loading ELF!\n");
 		break;
 	case 5:
-		gfx_printf(&gfx_con, "Error relcating ELF!\n");
+		gfx_printf("Error relocating ELF!\n");
 		break;
 	}
 }
@@ -95,10 +93,15 @@ int ianos_loader(bool sdmount, char *path, elfType_t type, void *moduleConfig)
 	int res = 0;
 
 	if (sdmount)
+	{
 		if (!sd_mount())
-			goto elfLoadFinalOut;	
+		{
+			res = 0xFFFF;
+			goto elfLoadFinalOut;
+		}
+	}
 
-	fileBuf = sd_file_read(path);
+	fileBuf = sd_file_read(path, NULL);
 
 	if (sdmount)
 		sd_unmount();

bootloader/libs/elfload/elfload.h

@@ -26,9 +26,8 @@
 
 #ifdef DEBUG
 #include "../../gfx/gfx.h"
-extern gfx_con_t gfx_con;
 #define EL_DEBUG(format, ...) \
-	gfx_printf(&gfx_con, format __VA_OPT__(, ) __VA_ARGS__)
+	gfx_printf(format __VA_OPT__(, ) __VA_ARGS__)
 #else
 #define EL_DEBUG(...) \
 	do                \

bootloader/libs/fatfs/diskio.c

@@ -11,8 +11,14 @@
 #include "diskio.h"		/* FatFs lower layer API */
 #include "../../storage/sdmmc.h"
 
+#define SDMMC_UPPER_BUFFER 0xB8000000
+#define DRAM_START         0x80000000
+
 extern sdmmc_storage_t sd_storage;
 
+/*-----------------------------------------------------------------------*/
+/* Get Drive Status                                                      */
+/*-----------------------------------------------------------------------*/
 DSTATUS disk_status (
 	BYTE pdrv		/* Physical drive nmuber to identify the drive */
 )
@@ -20,6 +26,9 @@ DSTATUS disk_status (
 	return 0;
 }
 
+/*-----------------------------------------------------------------------*/
+/* Inidialize a Drive                                                    */
+/*-----------------------------------------------------------------------*/
 DSTATUS disk_initialize (
 	BYTE pdrv				/* Physical drive nmuber to identify the drive */
 )
@@ -27,6 +36,9 @@ DSTATUS disk_initialize (
 	return 0;
 }
 
+/*-----------------------------------------------------------------------*/
+/* Read Sector(s)                                                        */
+/*-----------------------------------------------------------------------*/
 DRESULT disk_read (
 	BYTE pdrv,		/* Physical drive nmuber to identify the drive */
 	BYTE *buff,		/* Data buffer to store read data */
@@ -34,9 +46,9 @@ DRESULT disk_read (
 	UINT count		/* Number of sectors to read */
 )
 {
-	if ((u32)buff >= 0x90000000)
+	if ((u32)buff >= DRAM_START)
 		return sdmmc_storage_read(&sd_storage, sector, count, buff) ? RES_OK : RES_ERROR;
-	u8 *buf = (u8 *)0x98000000; //TODO: define this somewhere.
+	u8 *buf = (u8 *)SDMMC_UPPER_BUFFER;
 	if (sdmmc_storage_read(&sd_storage, sector, count, buf))
 	{
 		memcpy(buff, buf, 512 * count);
@@ -45,6 +57,9 @@ DRESULT disk_read (
 	return RES_ERROR;
 }
 
+/*-----------------------------------------------------------------------*/
+/* Write Sector(s)                                                       */
+/*-----------------------------------------------------------------------*/
 DRESULT disk_write (
 	BYTE pdrv,			/* Physical drive nmuber to identify the drive */
 	const BYTE *buff,	/* Data to be written */
@@ -52,15 +67,18 @@ DRESULT disk_write (
 	UINT count			/* Number of sectors to write */
 )
 {
-	if ((u32)buff >= 0x90000000)
+	if ((u32)buff >= DRAM_START)
 		return sdmmc_storage_write(&sd_storage, sector, count, (void *)buff) ? RES_OK : RES_ERROR;
-	u8 *buf = (u8 *)0x98000000; //TODO: define this somewhere.
+	u8 *buf = (u8 *)SDMMC_UPPER_BUFFER; //TODO: define this somewhere.
 	memcpy(buf, buff, 512 * count);
 	if (sdmmc_storage_write(&sd_storage, sector, count, buf))
 		return RES_OK;
 	return RES_ERROR;
 }
 
+/*-----------------------------------------------------------------------*/
+/* Miscellaneous Functions                                               */
+/*-----------------------------------------------------------------------*/
 DRESULT disk_ioctl (
 	BYTE pdrv,		/* Physical drive nmuber (0..) */
 	BYTE cmd,		/* Control code */

bootloader/libs/fatfs/diskio.h

@@ -11,7 +11,6 @@ extern "C" {
 
 #include "../../utils/types.h"
 
-
 /* Status of Disk Functions */
 typedef BYTE	DSTATUS;
 
@@ -46,11 +45,11 @@ DRESULT disk_ioctl (BYTE pdrv, BYTE cmd, void* buff);
 /* Command code for disk_ioctrl fucntion */
 
 /* Generic command (Used by FatFs) */
-#define CTRL_SYNC			0	/* Complete pending write process (needed at _FS_READONLY == 0) */
-#define GET_SECTOR_COUNT	1	/* Get media size (needed at _USE_MKFS == 1) */
-#define GET_SECTOR_SIZE		2	/* Get sector size (needed at _MAX_SS != _MIN_SS) */
-#define GET_BLOCK_SIZE		3	/* Get erase block size (needed at _USE_MKFS == 1) */
-#define CTRL_TRIM			4	/* Inform device that the data on the block of sectors is no longer used (needed at _USE_TRIM == 1) */
+#define CTRL_SYNC			0	/* Complete pending write process (needed at FF_FS_READONLY == 0) */
+#define GET_SECTOR_COUNT	1	/* Get media size (needed at FF_USE_MKFS == 1) */
+#define GET_SECTOR_SIZE		2	/* Get sector size (needed at FF_MAX_SS != FF_MIN_SS) */
+#define GET_BLOCK_SIZE		3	/* Get erase block size (needed at FF_USE_MKFS == 1) */
+#define CTRL_TRIM			4	/* Inform device that the data on the block of sectors is no longer used (needed at FF_USE_TRIM == 1) */
 
 /* Generic command (Not used by FatFs) */
 #define CTRL_POWER			5	/* Get/Set power status */

bootloader/libs/fatfs/ff.c

@@ -1,10 +1,10 @@
 /*----------------------------------------------------------------------------/
-/  FatFs - Generic FAT Filesystem Module  R0.13b                              /
+/  FatFs - Generic FAT Filesystem Module  R0.13c (p3)                         /
 /-----------------------------------------------------------------------------/
 /
 / Copyright (C) 2018, ChaN, all right reserved.
 / Copyright (c) 2018 naehrwert
-/ Copyright (C) 2018 CTCaer
+/ Copyright (C) 2018-2019 CTCaer
 /
 / FatFs module is an open source software. Redistribution and use of FatFs in
 / source and binary forms, with or without modification, are permitted provided
@@ -23,11 +23,9 @@
 
 #include "ff.h"			/* Declarations of FatFs API */
 #include "diskio.h"		/* Declarations of device I/O functions */
-
 #include "../../gfx/gfx.h"
-extern gfx_ctxt_t gfx_ctxt;
-extern gfx_con_t gfx_con;
-#define EFSPRINTF(text, ...) print_error(); gfx_printf(&gfx_con, "%k"text"%k\n", 0xFFFFFF00, 0xFFFFFFFF);
+
+#define EFSPRINTF(text, ...) print_error(); gfx_printf("%k"text"%k\n", 0xFFFFFF00, 0xFFFFFFFF);
 //#define EFSPRINTF(...)
 
 /*--------------------------------------------------------------------------
@@ -36,11 +34,20 @@ extern gfx_con_t gfx_con;
 
 ---------------------------------------------------------------------------*/
 
-#if FF_DEFINED != 63463	/* Revision ID */
+#if FF_DEFINED != 86604	/* Revision ID */
 #error Wrong include file (ff.h).
 #endif
 
 
+/* Limits and boundaries */
+#define MAX_DIR		0x200000		/* Max size of FAT directory */
+#define MAX_DIR_EX	0x10000000		/* Max size of exFAT directory */
+#define MAX_FAT12	0xFF5			/* Max FAT12 clusters (differs from specs, but right for real DOS/Windows behavior) */
+#define MAX_FAT16	0xFFF5			/* Max FAT16 clusters (differs from specs, but right for real DOS/Windows behavior) */
+#define MAX_FAT32	0x0FFFFFF5		/* Max FAT32 clusters (not specified, practical limit) */
+#define MAX_EXFAT	0x7FFFFFFD		/* Max exFAT clusters (differs from specs, implementation limit) */
+
+
 /* Character code support macros */
 #define IsUpper(c)		((c) >= 'A' && (c) <= 'Z')
 #define IsLower(c)		((c) >= 'a' && (c) <= 'z')
@@ -50,18 +57,18 @@ extern gfx_con_t gfx_con;
 #define IsSurrogateL(c)	((c) >= 0xDC00 && (c) <= 0xDFFF)
 
 
-/* Additional file attribute bits for internal use */
-#define AM_VOL		0x08	/* Volume label */
-#define AM_LFN		0x0F	/* LFN entry */
-#define AM_MASK		0x3F	/* Mask of defined bits */
-
-
 /* Additional file access control and file status flags for internal use */
 #define FA_SEEKEND	0x20	/* Seek to end of the file on file open */
 #define FA_MODIFIED	0x40	/* File has been modified */
 #define FA_DIRTY	0x80	/* FIL.buf[] needs to be written-back */
 
 
+/* Additional file attribute bits for internal use */
+#define AM_VOL		0x08	/* Volume label */
+#define AM_LFN		0x0F	/* LFN entry */
+#define AM_MASK		0x3F	/* Mask of defined bits */
+
+
 /* Name status flags in fn[11] */
 #define NSFLAG		11		/* Index of the name status byte */
 #define NS_LOSS		0x01	/* Out of 8.3 format */
@@ -74,13 +81,13 @@ extern gfx_con_t gfx_con;
 #define NS_NONAME	0x80	/* Not followed */
 
 
-/* Limits and boundaries */
-#define MAX_DIR		0x200000		/* Max size of FAT directory */
-#define MAX_DIR_EX	0x10000000		/* Max size of exFAT directory */
-#define MAX_FAT12	0xFF5			/* Max FAT12 clusters (differs from specs, but right for real DOS/Windows behavior) */
-#define MAX_FAT16	0xFFF5			/* Max FAT16 clusters (differs from specs, but right for real DOS/Windows behavior) */
-#define MAX_FAT32	0x0FFFFFF5		/* Max FAT32 clusters (not specified, practical limit) */
-#define MAX_EXFAT	0x7FFFFFFD		/* Max exFAT clusters (differs from specs, implementation limit) */
+/* exFAT directory entry types */
+#define	ET_BITMAP	0x81	/* Allocation bitmap */
+#define	ET_UPCASE	0x82	/* Up-case table */
+#define	ET_VLABEL	0x83	/* Volume label */
+#define	ET_FILEDIR	0x85	/* File and directory */
+#define	ET_STREAM	0xC0	/* Stream extension */
+#define	ET_FILENAME	0xC1	/* Name extension */
 
 
 /* FatFs refers the FAT structure as simple byte array instead of structure member
@@ -528,6 +535,7 @@ static WCHAR LfnBuf[FF_MAX_LFN + 1];		/* LFN working buffer */
 #define CODEPAGE CodePage
 static WORD CodePage;	/* Current code page */
 static const BYTE *ExCvt, *DbcTbl;	/* Pointer to current SBCS up-case table and DBCS code range table below */
+
 static const BYTE Ct437[] = TBL_CT437;
 static const BYTE Ct720[] = TBL_CT720;
 static const BYTE Ct737[] = TBL_CT737;
@@ -575,7 +583,7 @@ static const BYTE DbcTbl[] = MKCVTBL(TBL_DC, FF_CODE_PAGE);
 
 void print_error()
 {
-	gfx_printf(&gfx_con, "\n\n\n%k[FatFS] Error: %k", 0xFFFFFF00, 0xFFFFFFFF);
+	gfx_printf("\n\n\n%k[FatFS] Error: %k", 0xFFFFFF00, 0xFFFFFFFF);
 }
 
 
@@ -1109,7 +1117,7 @@ static FRESULT sync_fs (	/* Returns FR_OK or FR_DISK_ERR */
 	if (res == FR_OK) {
 		if (fs->fs_type == FS_FAT32 && fs->fsi_flag == 1) {	/* FAT32: Update FSInfo sector if needed */
 			/* Create FSInfo structure */
-			mem_set(fs->win, 0, SS(fs));
+			mem_set(fs->win, 0, sizeof fs->win);
 			st_word(fs->win + BS_55AA, 0xAA55);
 			st_dword(fs->win + FSI_LeadSig, 0x41615252);
 			st_dword(fs->win + FSI_StrucSig, 0x61417272);
@@ -1309,7 +1317,7 @@ static DWORD find_bitmap (	/* 0:Not found, 2..:Cluster block found, 0xFFFFFFFF:D
 	if (clst >= fs->n_fatent - 2) clst = 0;
 	scl = val = clst; ctr = 0;
 	for (;;) {
-		if (move_window(fs, fs->database + val / 8 / SS(fs)) != FR_OK) return 0xFFFFFFFF;	/* (assuming bitmap is located top of the cluster heap) */
+		if (move_window(fs, fs->bitbase + val / 8 / SS(fs)) != FR_OK) return 0xFFFFFFFF;
 		i = val / 8 % SS(fs); bm = 1 << (val % 8);
 		do {
 			do {
@@ -1347,9 +1355,9 @@ static FRESULT change_bitmap (
 
 
 	clst -= 2;	/* The first bit corresponds to cluster #2 */
-	sect = fs->database + clst / 8 / SS(fs);	/* Sector address (assuming bitmap is located top of the cluster heap) */
-	i = clst / 8 % SS(fs);						/* Byte offset in the sector */
-	bm = 1 << (clst % 8);						/* Bit mask in the byte */
+	sect = fs->bitbase + clst / 8 / SS(fs);	/* Sector address */
+	i = clst / 8 % SS(fs);					/* Byte offset in the sector */
+	bm = 1 << (clst % 8);					/* Bit mask in the byte */
 	for (;;) {
 		if (move_window(fs, sect++) != FR_OK) return FR_DISK_ERR;
 		do {
@@ -1422,7 +1430,7 @@ static FRESULT fill_last_frag (
 static FRESULT remove_chain (	/* FR_OK(0):succeeded, !=0:error */
 	FFOBJID* obj,		/* Corresponding object */
 	DWORD clst,			/* Cluster to remove a chain from */
-	DWORD pclst			/* Previous cluster of clst (0:entire chain) */
+	DWORD pclst			/* Previous cluster of clst (0 if entire chain) */
 )
 {
 	FRESULT res = FR_OK;
@@ -1660,7 +1668,7 @@ static FRESULT dir_clear (	/* Returns FR_OK or FR_DISK_ERR */
 	if (sync_window(fs) != FR_OK) return FR_DISK_ERR;	/* Flush disk access window */
 	sect = clst2sect(fs, clst);		/* Top of the cluster */
 	fs->winsect = sect;				/* Set window to top of the cluster */
-	mem_set(fs->win, 0, SS(fs));	/* Clear window buffer */
+	mem_set(fs->win, 0, sizeof fs->win);	/* Clear window buffer */
 #if FF_USE_LFN == 3		/* Quick table clear by using multi-secter write */
 	/* Allocate a temporary buffer */
 	for (szb = ((DWORD)fs->csize * SS(fs) >= MAX_MALLOC) ? MAX_MALLOC : fs->csize * SS(fs), ibuf = 0; szb > SS(fs) && (ibuf = ff_memalloc(szb)) == 0; szb /= 2) ;
@@ -1890,7 +1898,7 @@ static int cmp_lfn (		/* 1:matched, 0:not matched */
 	for (wc = 1, s = 0; s < 13; s++) {		/* Process all characters in the entry */
 		uc = ld_word(dir + LfnOfs[s]);		/* Pick an LFN character */
 		if (wc != 0) {
-			if (i >= FF_MAX_LFN || ff_wtoupper(uc) != ff_wtoupper(lfnbuf[i++])) {	/* Compare it */
+			if (i >= FF_MAX_LFN + 1 || ff_wtoupper(uc) != ff_wtoupper(lfnbuf[i++])) {	/* Compare it */
 				return 0;					/* Not matched */
 			}
 			wc = uc;
@@ -1926,15 +1934,15 @@ static int pick_lfn (	/* 1:succeeded, 0:buffer overflow or invalid LFN entry */
 	for (wc = 1, s = 0; s < 13; s++) {		/* Process all characters in the entry */
 		uc = ld_word(dir + LfnOfs[s]);		/* Pick an LFN character */
 		if (wc != 0) {
-			if (i >= FF_MAX_LFN) return 0;	/* Buffer overflow? */
+			if (i >= FF_MAX_LFN + 1) return 0;	/* Buffer overflow? */
 			lfnbuf[i++] = wc = uc;			/* Store it */
 		} else {
 			if (uc != 0xFFFF) return 0;		/* Check filler */
 		}
 	}
 
-	if (dir[LDIR_Ord] & LLEF) {				/* Put terminator if it is the last LFN part */
-		if (i >= FF_MAX_LFN) return 0;		/* Buffer overflow? */
+	if (dir[LDIR_Ord] & LLEF && wc != 0) {	/* Put terminator if it is the last LFN part and not terminated */
+		if (i >= FF_MAX_LFN + 1) return 0;	/* Buffer overflow? */
 		lfnbuf[i] = 0;
 	}
 
@@ -2170,33 +2178,33 @@ static FRESULT load_xdir (	/* FR_INT_ERR: invalid entry block */
 	BYTE* dirb = dp->obj.fs->dirbuf;	/* Pointer to the on-memory direcotry entry block 85+C0+C1s */
 
 
-	/* Load 85 entry */
+	/* Load file-directory entry */
 	res = move_window(dp->obj.fs, dp->sect);
 	if (res != FR_OK) return res;
-	if (dp->dir[XDIR_Type] != 0x85) return FR_INT_ERR;	/* Invalid order */
+	if (dp->dir[XDIR_Type] != ET_FILEDIR) return FR_INT_ERR;	/* Invalid order */
 	mem_cpy(dirb + 0 * SZDIRE, dp->dir, SZDIRE);
 	sz_ent = (dirb[XDIR_NumSec] + 1) * SZDIRE;
 	if (sz_ent < 3 * SZDIRE || sz_ent > 19 * SZDIRE) return FR_INT_ERR;
 
-	/* Load C0 entry */
+	/* Load stream-extension entry */
 	res = dir_next(dp, 0);
 	if (res == FR_NO_FILE) res = FR_INT_ERR;	/* It cannot be */
 	if (res != FR_OK) return res;
 	res = move_window(dp->obj.fs, dp->sect);
 	if (res != FR_OK) return res;
-	if (dp->dir[XDIR_Type] != 0xC0) return FR_INT_ERR;	/* Invalid order */
+	if (dp->dir[XDIR_Type] != ET_STREAM) return FR_INT_ERR;	/* Invalid order */
 	mem_cpy(dirb + 1 * SZDIRE, dp->dir, SZDIRE);
 	if (MAXDIRB(dirb[XDIR_NumName]) > sz_ent) return FR_INT_ERR;
 
-	/* Load C1 entries */
-	i = 2 * SZDIRE;	/* C1 offset to load */
+	/* Load file-name entries */
+	i = 2 * SZDIRE;	/* Name offset to load */
 	do {
 		res = dir_next(dp, 0);
 		if (res == FR_NO_FILE) res = FR_INT_ERR;	/* It cannot be */
 		if (res != FR_OK) return res;
 		res = move_window(dp->obj.fs, dp->sect);
 		if (res != FR_OK) return res;
-		if (dp->dir[XDIR_Type] != 0xC1) return FR_INT_ERR;	/* Invalid order */
+		if (dp->dir[XDIR_Type] != ET_FILENAME) return FR_INT_ERR;	/* Invalid order */
 		if (i < MAXDIRB(FF_MAX_LFN)) mem_cpy(dirb + i, dp->dir, SZDIRE);
 	} while ((i += SZDIRE) < sz_ent);
 
@@ -2301,16 +2309,16 @@ static void create_xdir (
 	WCHAR wc;
 
 
-	/* Create 85,C0 entry */
+	/* Create file-directory and stream-extension entry */
 	mem_set(dirb, 0, 2 * SZDIRE);
-	dirb[0 * SZDIRE + XDIR_Type] = 0x85;	/* 85 entry */
-	dirb[1 * SZDIRE + XDIR_Type] = 0xC0;	/* C0 entry */
+	dirb[0 * SZDIRE + XDIR_Type] = ET_FILEDIR;
+	dirb[1 * SZDIRE + XDIR_Type] = ET_STREAM;
 
-	/* Create C1 entries */
-	i = SZDIRE * 2;	/* Top of C1 entries */
+	/* Create file-name entries */
+	i = SZDIRE * 2;	/* Top of file_name entries */
 	nlen = nc1 = 0; wc = 1;
 	do {
-		dirb[i++] = 0xC1; dirb[i++] = 0;	/* Entry type C1 */
+		dirb[i++] = ET_FILENAME; dirb[i++] = 0;
 		do {	/* Fill name field */
 			if (wc != 0 && (wc = lfn[nlen]) != 0) nlen++;	/* Get a character if exist */
 			st_word(dirb + i, wc); 		/* Store it */
@@ -2334,8 +2342,8 @@ static void create_xdir (
 /* Read an object from the directory                                     */
 /*-----------------------------------------------------------------------*/
 
-#define dir_read_file(dp) dir_read(dp, 0)
-#define dir_read_label(dp) dir_read(dp, 1)
+#define DIR_READ_FILE(dp) dir_read(dp, 0)
+#define DIR_READ_LABEL(dp) dir_read(dp, 1)
 
 static FRESULT dir_read (
 	DIR* dp,		/* Pointer to the directory object */
@@ -2344,7 +2352,7 @@ static FRESULT dir_read (
 {
 	FRESULT res = FR_NO_FILE;
 	FATFS *fs = dp->obj.fs;
-	BYTE a, c;
+	BYTE attr, b;
 #if FF_USE_LFN
 	BYTE ord = 0xFF, sum = 0xFF;
 #endif
@@ -2352,16 +2360,16 @@ static FRESULT dir_read (
 	while (dp->sect) {
 		res = move_window(fs, dp->sect);
 		if (res != FR_OK) break;
-		c = dp->dir[DIR_Name];	/* Test for the entry type */
-		if (c == 0) {
+		b = dp->dir[DIR_Name];	/* Test for the entry type */
+		if (b == 0) {
 			res = FR_NO_FILE; break; /* Reached to end of the directory */
 		}
 #if FF_FS_EXFAT
 		if (fs->fs_type == FS_EXFAT) {	/* On the exFAT volume */
 			if (FF_USE_LABEL && vol) {
-				if (c == 0x83) break;	/* Volume label entry? */
+				if (b == ET_VLABEL) break;	/* Volume label entry? */
 			} else {
-				if (c == 0x85) {		/* Start of the file entry block? */
+				if (b == ET_FILEDIR) {		/* Start of the file entry block? */
 					dp->blk_ofs = dp->dptr;	/* Get location of the block */
 					res = load_xdir(dp);	/* Load the entry block */
 					if (res == FR_OK) {
@@ -2373,19 +2381,19 @@ static FRESULT dir_read (
 		} else
 #endif
 		{	/* On the FAT/FAT32 volume */
-			dp->obj.attr = a = dp->dir[DIR_Attr] & AM_MASK;	/* Get attribute */
+			dp->obj.attr = attr = dp->dir[DIR_Attr] & AM_MASK;	/* Get attribute */
 #if FF_USE_LFN		/* LFN configuration */
-			if (c == DDEM || c == '.' || (int)((a & ~AM_ARC) == AM_VOL) != vol) {	/* An entry without valid data */
+			if (b == DDEM || b == '.' || (int)((attr & ~AM_ARC) == AM_VOL) != vol) {	/* An entry without valid data */
 				ord = 0xFF;
 			} else {
-				if (a == AM_LFN) {			/* An LFN entry is found */
-					if (c & LLEF) {			/* Is it start of an LFN sequence? */
+				if (attr == AM_LFN) {			/* An LFN entry is found */
+					if (b & LLEF) {			/* Is it start of an LFN sequence? */
 						sum = dp->dir[LDIR_Chksum];
-						c &= (BYTE)~LLEF; ord = c;
+						b &= (BYTE)~LLEF; ord = b;
 						dp->blk_ofs = dp->dptr;
 					}
 					/* Check LFN validity and capture it */
-					ord = (c == ord && sum == dp->dir[LDIR_Chksum] && pick_lfn(fs->lfnbuf, dp->dir)) ? ord - 1 : 0xFF;
+					ord = (b == ord && sum == dp->dir[LDIR_Chksum] && pick_lfn(fs->lfnbuf, dp->dir)) ? ord - 1 : 0xFF;
 				} else {					/* An SFN entry is found */
 					if (ord != 0 || sum != sum_sfn(dp->dir)) {	/* Is there a valid LFN? */
 						dp->blk_ofs = 0xFFFFFFFF;			/* It has no LFN. */
@@ -2394,7 +2402,7 @@ static FRESULT dir_read (
 				}
 			}
 #else		/* Non LFN configuration */
-			if (c != DDEM && c != '.' && a != AM_LFN && (int)((a & ~AM_ARC) == AM_VOL) == vol) {	/* Is it a valid entry? */
+			if (b != DDEM && b != '.' && attr != AM_LFN && (int)((attr & ~AM_ARC) == AM_VOL) == vol) {	/* Is it a valid entry? */
 				break;
 			}
 #endif
@@ -2434,7 +2442,7 @@ static FRESULT dir_find (	/* FR_OK(0):succeeded, !=0:error */
 		UINT di, ni;
 		WORD hash = xname_sum(fs->lfnbuf);		/* Hash value of the name to find */
 
-		while ((res = dir_read_file(dp)) == FR_OK) {	/* Read an item */
+		while ((res = DIR_READ_FILE(dp)) == FR_OK) {	/* Read an item */
 #if FF_MAX_LFN < 255
 			if (fs->dirbuf[XDIR_NumName] > FF_MAX_LFN) continue;			/* Skip comparison if inaccessible object name */
 #endif
@@ -2513,17 +2521,17 @@ static FRESULT dir_register (	/* FR_OK:succeeded, FR_DENIED:no free entry or too
 #if FF_FS_EXFAT
 	if (fs->fs_type == FS_EXFAT) {	/* On the exFAT volume */
 		nent = (nlen + 14) / 15 + 2;	/* Number of entries to allocate (85+C0+C1s) */
-		res = dir_alloc(dp, nent);		/* Allocate entries */
+		res = dir_alloc(dp, nent);		/* Allocate directory entries */
 		if (res != FR_OK) return res;
 		dp->blk_ofs = dp->dptr - SZDIRE * (nent - 1);	/* Set the allocated entry block offset */
 
-		if (dp->obj.stat & 4) {			/* Has the directory been stretched? */
+		if (dp->obj.stat & 4) {			/* Has the directory been stretched by new allocation? */
 			dp->obj.stat &= ~4;
 			res = fill_first_frag(&dp->obj);	/* Fill the first fragment on the FAT if needed */
 			if (res != FR_OK) return res;
 			res = fill_last_frag(&dp->obj, dp->clust, 0xFFFFFFFF);	/* Fill the last fragment on the FAT if needed */
 			if (res != FR_OK) return res;
-			if (dp->obj.sclust != 0) {		/* Is it a sub directory? */
+			if (dp->obj.sclust != 0) {		/* Is it a sub-directory? */
 				DIR dj;
 
 				res = load_obj_xdir(&dj, &dp->obj);	/* Load the object status */
@@ -2655,6 +2663,7 @@ static void get_fileinfo (
 {
 	UINT si, di;
 #if FF_USE_LFN
+	BYTE lcf;
 	WCHAR wc, hs;
 	FATFS *fs = dp->obj.fs;
 #else
@@ -2715,9 +2724,10 @@ static void get_fileinfo (
 		if (di == 0) {	/* If LFN and SFN both are invalid, this object is inaccesible */
 			fno->fname[di++] = '?';
 		} else {
-			for (si = di = 0; fno->altname[si]; si++, di++) {	/* Copy altname[] to fname[] with case information */
+			for (si = di = 0, lcf = NS_BODY; fno->altname[si]; si++, di++) {	/* Copy altname[] to fname[] with case information */
 				wc = (WCHAR)fno->altname[si];
-				if (IsUpper(wc) && (dp->dir[DIR_NTres] & ((si >= 9) ? NS_EXT : NS_BODY))) wc += 0x20;
+				if (wc == '.') lcf = NS_EXT;
+				if (IsUpper(wc) && (dp->dir[DIR_NTres] & lcf)) wc += 0x20;
 				fno->fname[di] = (TCHAR)wc;
 			}
 		}
@@ -3274,7 +3284,7 @@ static FRESULT find_volume (	/* FR_OK(0): successful, !=0: an error occurred */
 	if (SS(fs) > FF_MAX_SS || SS(fs) < FF_MIN_SS || (SS(fs) & (SS(fs) - 1))) return FR_DISK_ERR;
 #endif
 
-	/* Find an FAT partition on the drive. Supports only generic partitioning rules, FDISK and SFD. */
+	/* Find an FAT partition on the drive. Supports only generic partitioning rules, FDISK (MBR) and SFD (w/o partition). */
 	bsect = 0;
 	fmt = check_fs(fs, bsect);			/* Load sector 0 and check if it is an FAT-VBR as SFD */
 	if (fmt == 2 || (fmt < 2 && LD2PT(vol) != 0)) {	/* Not an FAT-VBR or forced partition number */
@@ -3303,13 +3313,12 @@ static FRESULT find_volume (	/* FR_OK(0): successful, !=0: an error occurred */
 #if FF_FS_EXFAT
 	if (fmt == 1) {
 		QWORD maxlba;
+		DWORD so, cv, bcl;
 
 		for (i = BPB_ZeroedEx; i < BPB_ZeroedEx + 53 && fs->win[i] == 0; i++) ;	/* Check zero filler */
-		if (i < BPB_ZeroedEx + 53)
-			return FR_NO_FILESYSTEM;
+		if (i < BPB_ZeroedEx + 53) return FR_NO_FILESYSTEM;
 
-		if (ld_word(fs->win + BPB_FSVerEx) != 0x100)
-			return FR_NO_FILESYSTEM;	/* Check exFAT version (must be version 1.0) */
+		if (ld_word(fs->win + BPB_FSVerEx) != 0x100) return FR_NO_FILESYSTEM;	/* Check exFAT version (must be version 1.0) */
 
 		if (1 << fs->win[BPB_BytsPerSecEx] != SS(fs)) {	/* (BPB_BytsPerSecEx must be equal to the physical sector size) */
 			EFSPRINTF("EXSPS");
@@ -3317,8 +3326,7 @@ static FRESULT find_volume (	/* FR_OK(0): successful, !=0: an error occurred */
 		}
 
 		maxlba = ld_qword(fs->win + BPB_TotSecEx) + bsect;	/* Last LBA + 1 of the volume */
-		if (maxlba >= 0x100000000)
-			return FR_NO_FILESYSTEM;	/* (It cannot be handled in 32-bit LBA) */
+		if (maxlba >= 0x100000000) return FR_NO_FILESYSTEM;	/* (It cannot be handled in 32-bit LBA) */
 
 		fs->fsize = ld_dword(fs->win + BPB_FatSzEx);	/* Number of sectors per FAT */
 
@@ -3329,35 +3337,49 @@ static FRESULT find_volume (	/* FR_OK(0): successful, !=0: an error occurred */
 		}
 
 		fs->csize = 1 << fs->win[BPB_SecPerClusEx];		/* Cluster size */
-		if (fs->csize == 0)	{
-			return FR_NO_FILESYSTEM;	/* (Must be 1..32768) */
-		}
+		if (fs->csize == 0)	return FR_NO_FILESYSTEM;	/* (Must be 1..32768) */
 
 		nclst = ld_dword(fs->win + BPB_NumClusEx);		/* Number of clusters */
-		if (nclst > MAX_EXFAT)
-			return FR_NO_FILESYSTEM;	/* (Too many clusters) */
+		if (nclst > MAX_EXFAT) return FR_NO_FILESYSTEM;	/* (Too many clusters) */
 		fs->n_fatent = nclst + 2;
 
 		/* Boundaries and Limits */
 		fs->volbase = bsect;
 		fs->database = bsect + ld_dword(fs->win + BPB_DataOfsEx);
 		fs->fatbase = bsect + ld_dword(fs->win + BPB_FatOfsEx);
-		if (maxlba < (QWORD)fs->database + nclst * fs->csize)
-			return FR_NO_FILESYSTEM;	/* (Volume size must not be smaller than the size required) */
+		if (maxlba < (QWORD)fs->database + nclst * fs->csize) return FR_NO_FILESYSTEM;	/* (Volume size must not be smaller than the size requiered) */
 		fs->dirbase = ld_dword(fs->win + BPB_RootClusEx);
 
-		/* Check if bitmap location is in assumption (at the first cluster) */
-		if (move_window(fs, clst2sect(fs, fs->dirbase)) != FR_OK) {
-			EFSPRINTF("EXBM1C");
-			return FR_DISK_ERR;
+		/* Get bitmap location and check if it is contiguous (implementation assumption) */
+		so = i = 0;
+		for (;;) {	/* Find the bitmap entry in the root directory (in only first cluster) */
+			if (i == 0) {
+				if (so >= fs->csize) return FR_NO_FILESYSTEM;	/* Not found? */
+				if (move_window(fs, clst2sect(fs, fs->dirbase) + so) != FR_OK) {
+					EFSPRINTF("EXBM1C");
+					return FR_DISK_ERR;
+				}
+				so++;
+			}
+			if (fs->win[i] == ET_BITMAP) break;				/* Is it a bitmap entry? */
+			i = (i + SZDIRE) % SS(fs);	/* Next entry */
 		}
-		for (i = 0; i < SS(fs); i += SZDIRE) {
-			if (fs->win[i] == 0x81 && ld_dword(fs->win + i + 20) == 2) break;	/* 81 entry with cluster #2? */
-		}
-		if (i == SS(fs)) {
+		bcl = ld_dword(fs->win + i + 20);					/* Bitmap cluster */
+		if (bcl < 2 || bcl >= fs->n_fatent) {
 			EFSPRINTF("EXBMM");
 			return FR_NO_FILESYSTEM;
 		}
+		fs->bitbase = fs->database + fs->csize * (bcl - 2);	/* Bitmap sector */
+		for (;;) {	/* Check if bitmap is contiguous */
+			if (move_window(fs, fs->fatbase + bcl / (SS(fs) / 4)) != FR_OK) return FR_DISK_ERR;
+			cv = ld_dword(fs->win + bcl % (SS(fs) / 4) * 4);
+			if (cv == 0xFFFFFFFF) break;				/* Last link? */
+			if (cv != ++bcl) {
+				EFSPRINTF("EXBMM");
+				return FR_NO_FILESYSTEM;	/* Fragmented? */
+			}
+		}
+
 #if !FF_FS_READONLY
 		fs->last_clst = fs->free_clst = 0xFFFFFFFF;		/* Initialize cluster allocation information */
 #endif
@@ -3375,38 +3397,31 @@ static FRESULT find_volume (	/* FR_OK(0): successful, !=0: an error occurred */
 		fs->fsize = fasize;
 
 		fs->n_fats = fs->win[BPB_NumFATs];				/* Number of FATs */
-		if (fs->n_fats != 1 && fs->n_fats != 2)
-			return FR_NO_FILESYSTEM;	/* (Must be 1 or 2) */
+		if (fs->n_fats != 1 && fs->n_fats != 2) return FR_NO_FILESYSTEM;	/* (Must be 1 or 2) */
 		fasize *= fs->n_fats;							/* Number of sectors for FAT area */
 
 		fs->csize = fs->win[BPB_SecPerClus];			/* Cluster size */
-		if (fs->csize == 0 || (fs->csize & (fs->csize - 1)))
-			return FR_NO_FILESYSTEM;	/* (Must be power of 2) */
+		if (fs->csize == 0 || (fs->csize & (fs->csize - 1))) return FR_NO_FILESYSTEM;	/* (Must be power of 2) */
 
 		fs->n_rootdir = ld_word(fs->win + BPB_RootEntCnt);	/* Number of root directory entries */
-		if (fs->n_rootdir % (SS(fs) / SZDIRE))
-			return FR_NO_FILESYSTEM;	/* (Must be sector aligned) */
+		if (fs->n_rootdir % (SS(fs) / SZDIRE)) return FR_NO_FILESYSTEM;	/* (Must be sector aligned) */
 
 		tsect = ld_word(fs->win + BPB_TotSec16);		/* Number of sectors on the volume */
 		if (tsect == 0) tsect = ld_dword(fs->win + BPB_TotSec32);
 
 		nrsv = ld_word(fs->win + BPB_RsvdSecCnt);		/* Number of reserved sectors */
-		if (nrsv == 0)
-			return FR_NO_FILESYSTEM;			/* (Must not be 0) */
+		if (nrsv == 0) return FR_NO_FILESYSTEM;			/* (Must not be 0) */
 
 		/* Determine the FAT sub type */
 		sysect = nrsv + fasize + fs->n_rootdir / (SS(fs) / SZDIRE);	/* RSV + FAT + DIR */
-		if (tsect < sysect)
-			return FR_NO_FILESYSTEM;	/* (Invalid volume size) */
+		if (tsect < sysect) return FR_NO_FILESYSTEM;	/* (Invalid volume size) */
 		nclst = (tsect - sysect) / fs->csize;			/* Number of clusters */
-		if (nclst == 0)
-			return FR_NO_FILESYSTEM;		/* (Invalid volume size) */
+		if (nclst == 0) return FR_NO_FILESYSTEM;		/* (Invalid volume size) */
 		fmt = 0;
 		if (nclst <= MAX_FAT32) fmt = FS_FAT32;
 		if (nclst <= MAX_FAT16) fmt = FS_FAT16;
 		if (nclst <= MAX_FAT12) fmt = FS_FAT12;
-		if (fmt == 0)
-			return FR_NO_FILESYSTEM;
+		if (fmt == 0) return FR_NO_FILESYSTEM;
 
 		/* Boundaries and Limits */
 		fs->n_fatent = nclst + 2;						/* Number of FAT entries */
@@ -3414,21 +3429,17 @@ static FRESULT find_volume (	/* FR_OK(0): successful, !=0: an error occurred */
 		fs->fatbase = bsect + nrsv; 					/* FAT start sector */
 		fs->database = bsect + sysect;					/* Data start sector */
 		if (fmt == FS_FAT32) {
-			if (ld_word(fs->win + BPB_FSVer32) != 0)
-				return FR_NO_FILESYSTEM;	/* (Must be FAT32 revision 0.0) */
-			if (fs->n_rootdir != 0)
-				return FR_NO_FILESYSTEM;	/* (BPB_RootEntCnt must be 0) */
+			if (ld_word(fs->win + BPB_FSVer32) != 0) return FR_NO_FILESYSTEM;	/* (Must be FAT32 revision 0.0) */
+			if (fs->n_rootdir != 0) return FR_NO_FILESYSTEM;	/* (BPB_RootEntCnt must be 0) */
 			fs->dirbase = ld_dword(fs->win + BPB_RootClus32);	/* Root directory start cluster */
 			szbfat = fs->n_fatent * 4;					/* (Needed FAT size) */
 		} else {
-			if (fs->n_rootdir == 0)
-				return FR_NO_FILESYSTEM;	/* (BPB_RootEntCnt must not be 0) */
+			if (fs->n_rootdir == 0)	return FR_NO_FILESYSTEM;	/* (BPB_RootEntCnt must not be 0) */
 			fs->dirbase = fs->fatbase + fasize;			/* Root directory start sector */
 			szbfat = (fmt == FS_FAT16) ?				/* (Needed FAT size) */
 				fs->n_fatent * 2 : fs->n_fatent * 3 / 2 + (fs->n_fatent & 1);
 		}
-		if (fs->fsize < (szbfat + (SS(fs) - 1)) / SS(fs))
-			return FR_NO_FILESYSTEM;	/* (BPB_FATSz must not be less than the size needed) */
+		if (fs->fsize < (szbfat + (SS(fs) - 1)) / SS(fs)) return FR_NO_FILESYSTEM;	/* (BPB_FATSz must not be less than the size needed) */
 
 #if !FF_FS_READONLY
 		/* Get FSInfo if available */
@@ -3461,7 +3472,7 @@ static FRESULT find_volume (	/* FR_OK(0): successful, !=0: an error occurred */
 #if FF_USE_LFN == 1
 	fs->lfnbuf = LfnBuf;	/* Static LFN working buffer */
 #if FF_FS_EXFAT
-	fs->dirbuf = DirBuf;	/* Static directory block scratchpad buffer */
+	fs->dirbuf = DirBuf;	/* Static directory block scratchpad buuffer */
 #endif
 #endif
 #if FF_FS_RPATH != 0
@@ -3724,7 +3735,7 @@ FRESULT f_open (
 			fp->fptr = 0;			/* Set file pointer top of the file */
 #if !FF_FS_READONLY
 #if !FF_FS_TINY
-			mem_set(fp->buf, 0, FF_MAX_SS);	/* Clear sector buffer */
+			mem_set(fp->buf, 0, sizeof fp->buf);	/* Clear sector buffer */
 #endif
 			if ((mode & FA_SEEKEND) && fp->obj.objsize > 0) {	/* Seek to end of file if FA_OPEN_APPEND is specified */
 				fp->fptr = fp->obj.objsize;			/* Offset to seek */
@@ -3779,17 +3790,16 @@ FRESULT f_read (
 	UINT rcnt, cc, csect;
 	BYTE *rbuff = (BYTE*)buff;
 
-
+	UINT br_tmp;
+	if (!br)
+		br = &br_tmp;
 	*br = 0;	/* Clear read byte counter */
 	res = validate(&fp->obj, &fs);				/* Check validity of the file object */
 	if (res != FR_OK || (res = (FRESULT)fp->err) != FR_OK) {
 		EFSPRINTF("FOV");
 		LEAVE_FF(fs, res);	/* Check validity */
 	}
-	if (!(fp->flag & FA_READ)) {
-		EFSPRINTF("NOACCESS");
-		LEAVE_FF(fs, FR_DENIED);	/* Check access mode */
-	}
+	if (!(fp->flag & FA_READ)) LEAVE_FF(fs, FR_DENIED); /* Check access mode */
 	remain = fp->obj.objsize - fp->fptr;
 	if (btr > remain) btr = (UINT)remain;		/* Truncate btr by remaining bytes */
 
@@ -3821,9 +3831,7 @@ FRESULT f_read (
 				fp->clust = clst;				/* Update current cluster */
 			}
 			sect = clst2sect(fs, fp->clust);	/* Get current sector */
-			if (sect == 0) {
-				ABORT(fs, FR_INT_ERR);
-			}
+			if (sect == 0) ABORT(fs, FR_INT_ERR);
 			sect += csect;
 			cc = btr / SS(fs);					/* When remaining bytes >= sector size, */
 			if (cc > 0) {						/* Read maximum contiguous sectors directly */
@@ -3901,17 +3909,16 @@ FRESULT f_write (
 	UINT wcnt, cc, csect;
 	const BYTE *wbuff = (const BYTE*)buff;
 
-
+	UINT bw_tmp;
+	if (!bw)
+		bw = &bw_tmp;
 	*bw = 0;	/* Clear write byte counter */
 	res = validate(&fp->obj, &fs);			/* Check validity of the file object */
 	if (res != FR_OK || (res = (FRESULT)fp->err) != FR_OK) {
 		EFSPRINTF("FOV");
 		LEAVE_FF(fs, res);	/* Check validity */
 	}
-	if (!(fp->flag & FA_WRITE)) {
-		EFSPRINTF("NOACCESS");
-		LEAVE_FF(fs, FR_DENIED);	/* Check access mode */
-	}
+	if (!(fp->flag & FA_WRITE)) LEAVE_FF(fs, FR_DENIED);	/* Check access mode */
 
 	/* Check fptr wrap-around (file size cannot reach 4 GiB at FAT volume) */
 	if ((!FF_FS_EXFAT || fs->fs_type != FS_EXFAT) && (DWORD)(fp->fptr + btw) < (DWORD)fp->fptr) {
@@ -3957,15 +3964,12 @@ FRESULT f_write (
 			if (fs->winsect == fp->sect && sync_window(fs) != FR_OK) ABORT(fs, FR_DISK_ERR);	/* Write-back sector cache */
 #else
 			if (fp->flag & FA_DIRTY) {		/* Write-back sector cache */
-				if (disk_write(fs->pdrv, fp->buf, fp->sect, 1) != RES_OK)
-					ABORT(fs, FR_DISK_ERR);
+				if (disk_write(fs->pdrv, fp->buf, fp->sect, 1) != RES_OK) ABORT(fs, FR_DISK_ERR);
 				fp->flag &= (BYTE)~FA_DIRTY;
 			}
 #endif
 			sect = clst2sect(fs, fp->clust);	/* Get current sector */
-			if (sect == 0) {
-				ABORT(fs, FR_INT_ERR);
-			}
+			if (sect == 0) ABORT(fs, FR_INT_ERR);
 			sect += csect;
 			cc = btw / SS(fs);				/* When remaining bytes >= sector size, */
 			if (cc > 0) {					/* Write maximum contiguous sectors directly */
@@ -4000,8 +4004,9 @@ FRESULT f_write (
 #else
 			if (fp->sect != sect && 		/* Fill sector cache with file data */
 				fp->fptr < fp->obj.objsize &&
-				disk_read(fs->pdrv, fp->buf, sect, 1) != RES_OK)
+				disk_read(fs->pdrv, fp->buf, sect, 1) != RES_OK) {
 					ABORT(fs, FR_DISK_ERR);
+			}
 #endif
 			fp->sect = sect;
 		}
@@ -4247,6 +4252,7 @@ FRESULT f_getcwd (
 
 
 	/* Get logical drive */
+	buff[0] = 0;	/* Set null string to get current volume */
 	res = find_volume((const TCHAR**)&buff, &fs, 0);	/* Get current volume */
 	if (res == FR_OK) {
 		dj.obj.fs = fs;
@@ -4265,7 +4271,7 @@ FRESULT f_getcwd (
 				res = dir_sdi(&dj, 0);
 				if (res != FR_OK) break;
 				do {							/* Find the entry links to the child directory */
-					res = dir_read_file(&dj);
+					res = DIR_READ_FILE(&dj);
 					if (res != FR_OK) break;
 					if (ccl == ld_clust(fs, dj.dir)) break;	/* Found the entry */
 					res = dir_next(&dj, 0);
@@ -4597,7 +4603,7 @@ FRESULT f_readdir (
 			res = dir_sdi(dp, 0);			/* Rewind the directory object */
 		} else {
 			INIT_NAMBUF(fs);
-			res = dir_read_file(dp);		/* Read an item */
+			res = DIR_READ_FILE(dp);		/* Read an item */
 			if (res == FR_NO_FILE) res = FR_OK;	/* Ignore end of directory */
 			if (res == FR_OK) {				/* A valid entry is found */
 				get_fileinfo(dp, fno);		/* Get the object information */
@@ -4742,7 +4748,7 @@ FRESULT f_getfree (
 					UINT b;
 
 					clst = fs->n_fatent - 2;	/* Number of clusters */
-					sect = fs->database;		/* Assuming bitmap starts at cluster 2 */
+					sect = fs->bitbase;			/* Bitmap sector */
 					i = 0;						/* Offset in the sector */
 					do {	/* Counts numbuer of bits with zero in the bitmap */
 						if (i == 0) {
@@ -4905,7 +4911,7 @@ FRESULT f_unlink (
 #endif
 						res = dir_sdi(&sdj, 0);
 						if (res == FR_OK) {
-							res = dir_read_file(&sdj);			/* Test if the directory is empty */
+							res = DIR_READ_FILE(&sdj);			/* Test if the directory is empty */
 							if (res == FR_OK) res = FR_DENIED;	/* Not empty? */
 							if (res == FR_NO_FILE) res = FR_OK;	/* Empty? */
 						}
@@ -4945,47 +4951,43 @@ FRESULT f_mkdir (
 	DIR dj;
 	FFOBJID sobj;
 	FATFS *fs;
-	BYTE *dir;
 	DWORD dcl, pcl, tm;
 	DEF_NAMBUF
 
 
-	/* Get logical drive */
-	res = find_volume(&path, &fs, FA_WRITE);
+	res = find_volume(&path, &fs, FA_WRITE);	/* Get logical drive */
 	if (res == FR_OK) {
 		dj.obj.fs = fs;
 		INIT_NAMBUF(fs);
 		res = follow_path(&dj, path);			/* Follow the file path */
-		if (res == FR_OK) res = FR_EXIST;		/* Any object with same name is already existing */
-		if (FF_FS_RPATH && res == FR_NO_FILE && (dj.fn[NSFLAG] & NS_DOT)) {
+		if (res == FR_OK) res = FR_EXIST;		/* Name collision? */
+		if (FF_FS_RPATH && res == FR_NO_FILE && (dj.fn[NSFLAG] & NS_DOT)) {	/* Invalid name? */
 			res = FR_INVALID_NAME;
 		}
-		if (res == FR_NO_FILE) {				/* Can create a new directory */
+		if (res == FR_NO_FILE) {				/* It is clear to create a new directory */
 			sobj.fs = fs;						/* New object id to create a new chain */
 			dcl = create_chain(&sobj, 0);		/* Allocate a cluster for the new directory */
 			res = FR_OK;
-			if (dcl == 0) res = FR_DENIED;		/* No space to allocate a new cluster */
-			if (dcl == 1) res = FR_INT_ERR;
-			if (dcl == 0xFFFFFFFF) res = FR_DISK_ERR;
-			if (res == FR_OK) res = sync_window(fs);	/* Flush FAT */
+			if (dcl == 0) res = FR_DENIED;		/* No space to allocate a new cluster? */
+			if (dcl == 1) res = FR_INT_ERR;		/* Any insanity? */
+			if (dcl == 0xFFFFFFFF) res = FR_DISK_ERR;	/* Disk error? */
 			tm = GET_FATTIME();
-			if (res == FR_OK) {					/* Initialize the new directory table */
-				res = dir_clear(fs, dcl);		/* Clean up the new table */
-				if (res == FR_OK && (!FF_FS_EXFAT || fs->fs_type != FS_EXFAT)) {	/* Create dot entries (FAT only) */
-					dir = fs->win;
-					mem_set(dir + DIR_Name, ' ', 11);	/* Create "." entry */
-					dir[DIR_Name] = '.';
-					dir[DIR_Attr] = AM_DIR;
-					st_dword(dir + DIR_ModTime, tm);
-					st_clust(fs, dir, dcl);
-					mem_cpy(dir + SZDIRE, dir, SZDIRE); /* Create ".." entry */
-					dir[SZDIRE + 1] = '.'; pcl = dj.obj.sclust;
-					st_clust(fs, dir + SZDIRE, pcl);
-					fs->wflag = 1;
-				}
-			}
 			if (res == FR_OK) {
-				res = dir_register(&dj);	/* Register the object to the directoy */
+				res = dir_clear(fs, dcl);		/* Clean up the new table */
+				if (res == FR_OK) {
+					if (!FF_FS_EXFAT || fs->fs_type != FS_EXFAT) {	/* Create dot entries (FAT only) */
+						mem_set(fs->win + DIR_Name, ' ', 11);	/* Create "." entry */
+						fs->win[DIR_Name] = '.';
+						fs->win[DIR_Attr] = AM_DIR;
+						st_dword(fs->win + DIR_ModTime, tm);
+						st_clust(fs, fs->win, dcl);
+						mem_cpy(fs->win + SZDIRE, fs->win, SZDIRE); /* Create ".." entry */
+						fs->win[SZDIRE + 1] = '.'; pcl = dj.obj.sclust;
+						st_clust(fs, fs->win + SZDIRE, pcl);
+						fs->wflag = 1;
+					}
+					res = dir_register(&dj);	/* Register the object to the parent directoy */
+				}
 			}
 			if (res == FR_OK) {
 #if FF_FS_EXFAT
@@ -5000,17 +5002,16 @@ FRESULT f_mkdir (
 				} else
 #endif
 				{
-					dir = dj.dir;
-					st_dword(dir + DIR_ModTime, tm);	/* Created time */
-					st_clust(fs, dir, dcl);				/* Table start cluster */
-					dir[DIR_Attr] = AM_DIR;				/* Attribute */
+					st_dword(dj.dir + DIR_ModTime, tm);	/* Created time */
+					st_clust(fs, dj.dir, dcl);			/* Table start cluster */
+					dj.dir[DIR_Attr] = AM_DIR;			/* Attribute */
 					fs->wflag = 1;
 				}
 				if (res == FR_OK) {
 					res = sync_fs(fs);
 				}
 			} else {
-				remove_chain(&dj.obj, dcl, 0);		/* Could not register, remove cluster chain */
+				remove_chain(&sobj, dcl, 0);		/* Could not register, remove the allocated cluster */
 			}
 		}
 		FREE_NAMBUF();
@@ -5250,7 +5251,7 @@ FRESULT f_getlabel (
 		dj.obj.fs = fs; dj.obj.sclust = 0;	/* Open root directory */
 		res = dir_sdi(&dj, 0);
 		if (res == FR_OK) {
-		 	res = dir_read_label(&dj);		/* Find a volume label entry */
+		 	res = DIR_READ_LABEL(&dj);		/* Find a volume label entry */
 		 	if (res == FR_OK) {
 #if FF_FS_EXFAT
 				if (fs->fs_type == FS_EXFAT) {
@@ -5395,7 +5396,7 @@ FRESULT f_setlabel (
 	dj.obj.fs = fs; dj.obj.sclust = 0;	/* Open root directory */
 	res = dir_sdi(&dj, 0);
 	if (res == FR_OK) {
-		res = dir_read_label(&dj);	/* Get volume label entry */
+		res = DIR_READ_LABEL(&dj);	/* Get volume label entry */
 		if (res == FR_OK) {
 			if (FF_FS_EXFAT && fs->fs_type == FS_EXFAT) {
 				dj.dir[XDIR_NumLabel] = (BYTE)di;	/* Change the volume label */
@@ -5417,7 +5418,7 @@ FRESULT f_setlabel (
 					if (res == FR_OK) {
 						mem_set(dj.dir, 0, SZDIRE);	/* Clean the entry */
 						if (FF_FS_EXFAT && fs->fs_type == FS_EXFAT) {
-							dj.dir[XDIR_Type] = 0x83;		/* Create 83 entry */
+							dj.dir[XDIR_Type] = ET_VLABEL;	/* Create volume label entry */
 							dj.dir[XDIR_NumLabel] = (BYTE)di;
 							mem_cpy(dj.dir + XDIR_Label, dirvn, 22);
 						} else {
@@ -5722,7 +5723,7 @@ FRESULT f_mkfs (
 		b_fat = b_vol + 32;										/* FAT start at offset 32 */
 		sz_fat = ((sz_vol / au + 2) * 4 + ss - 1) / ss;			/* Number of FAT sectors */
 		b_data = (b_fat + sz_fat + sz_blk - 1) & ~(sz_blk - 1);	/* Align data area to the erase block boundary */
-		if (b_data >= sz_vol / 2) LEAVE_MKFS(FR_MKFS_ABORTED);	/* Too small volume? */
+		if (b_data - b_vol >= sz_vol / 2) LEAVE_MKFS(FR_MKFS_ABORTED);	/* Too small volume? */
 		n_clst = (sz_vol - (b_data - b_vol)) / au;				/* Number of clusters */
 		if (n_clst <16) LEAVE_MKFS(FR_MKFS_ABORTED);			/* Too few clusters? */
 		if (n_clst > MAX_EXFAT) LEAVE_MKFS(FR_MKFS_ABORTED);	/* Too many clusters? */
@@ -5803,11 +5804,11 @@ FRESULT f_mkfs (
 
 		/* Initialize the root directory */
 		mem_set(buf, 0, szb_buf);
-		buf[SZDIRE * 0 + 0] = 0x83;		/* 83 entry (volume label) */
-		buf[SZDIRE * 1 + 0] = 0x81;		/* 81 entry (allocation bitmap) */
+		buf[SZDIRE * 0 + 0] = ET_VLABEL;		/* Volume label entry */
+		buf[SZDIRE * 1 + 0] = ET_BITMAP;		/* Bitmap entry */
 		st_dword(buf + SZDIRE * 1 + 20, 2);				/* cluster */
 		st_dword(buf + SZDIRE * 1 + 24, szb_bit);		/* size */
-		buf[SZDIRE * 2 + 0] = 0x82;		/* 82 entry (up-case table) */
+		buf[SZDIRE * 2 + 0] = ET_UPCASE;		/* Up-case table entry */
 		st_dword(buf + SZDIRE * 2 + 4, sum);			/* sum */
 		st_dword(buf + SZDIRE * 2 + 20, 2 + tbl[0]);	/* cluster */
 		st_dword(buf + SZDIRE * 2 + 24, szb_case);		/* size */
@@ -6295,8 +6296,7 @@ typedef struct {	/* Putchar output buffer and work area */
 } putbuff;
 
 
-static
-void putc_bfd (		/* Buffered write with code conversion */
+static void putc_bfd (		/* Buffered write with code conversion */
 	putbuff* pb,
 	TCHAR c
 )
@@ -6407,7 +6407,7 @@ void putc_bfd (		/* Buffered write with code conversion */
 #else						/* Write it in ANSI/OEM */
 	if (hs != 0) return;
 	wc = ff_uni2oem(wc, CODEPAGE);	/* UTF-16 ==> ANSI/OEM */
-	if (wc == 0) return;;
+	if (wc == 0) return;
 	if (wc >= 0x100) {
 		pb->buf[i++] = (BYTE)(wc >> 8); nc++;
 	}
@@ -6427,8 +6427,7 @@ void putc_bfd (		/* Buffered write with code conversion */
 }
 
 
-static
-int putc_flush (		/* Flush left characters in the buffer */
+static int putc_flush (		/* Flush left characters in the buffer */
 	putbuff* pb
 )
 {
@@ -6441,8 +6440,7 @@ int putc_flush (		/* Flush left characters in the buffer */
 }
 
 
-static
-void putc_init (		/* Initialize write buffer */
+static void putc_init (		/* Initialize write buffer */
 	putbuff* pb,
 	FIL* fp
 )

bootloader/libs/fatfs/ff.h

@@ -1,5 +1,5 @@
 /*----------------------------------------------------------------------------/
-/  FatFs - Generic FAT Filesystem module  R0.13b                              /
+/  FatFs - Generic FAT Filesystem module  R0.13c                              /
 /-----------------------------------------------------------------------------/
 /
 / Copyright (C) 2018, ChaN, all right reserved.
@@ -20,7 +20,7 @@
 
 
 #ifndef FF_DEFINED
-#define FF_DEFINED	63463	/* Revision ID */
+#define FF_DEFINED	86604	/* Revision ID */
 
 #ifdef __cplusplus
 extern "C" {
@@ -95,8 +95,8 @@ typedef DWORD FSIZE_t;
 /* Filesystem object structure (FATFS) */
 
 typedef struct {
-	BYTE	fs_type;		/* Filesystem type (0:N/A) */
-	BYTE	pdrv;			/* Physical drive number */
+	BYTE	fs_type;		/* Filesystem type (0:not mounted) */
+	BYTE	pdrv;			/* Associated physical drive */
 	BYTE	n_fats;			/* Number of FATs (1 or 2) */
 	BYTE	wflag;			/* win[] flag (b0:dirty) */
 	BYTE	fsi_flag;		/* FSINFO flags (b7:disabled, b0:dirty) */
@@ -133,6 +133,9 @@ typedef struct {
 	DWORD	fatbase;		/* FAT base sector */
 	DWORD	dirbase;		/* Root directory base sector/cluster */
 	DWORD	database;		/* Data base sector */
+#if FF_FS_EXFAT
+	DWORD	bitbase;		/* Allocation bitmap base sector */
+#endif
 	DWORD	winsect;		/* Current sector appearing in the win[] */
 	BYTE	win[FF_MAX_SS];	/* Disk access window for Directory, FAT (and file data at tiny cfg) */
 } FATFS;
@@ -145,7 +148,7 @@ typedef struct {
 	FATFS*	fs;				/* Pointer to the hosting volume of this object */
 	WORD	id;				/* Hosting volume mount ID */
 	BYTE	attr;			/* Object attribute */
-	BYTE	stat;			/* Object chain status (b1-0: =0:not contiguous, =2:contiguous, =3:flagmented in this session, b2:sub-directory stretched) */
+	BYTE	stat;			/* Object chain status (b1-0: =0:not contiguous, =2:contiguous, =3:fragmented in this session, b2:sub-directory stretched) */
 	DWORD	sclust;			/* Object data start cluster (0:no cluster or root directory) */
 	FSIZE_t	objsize;		/* Object size (valid when sclust != 0) */
 #if FF_FS_EXFAT
@@ -175,12 +178,12 @@ typedef struct {
 	DWORD	dir_sect;		/* Sector number containing the directory entry (not used at exFAT) */
 	BYTE*	dir_ptr;		/* Pointer to the directory entry in the win[] (not used at exFAT) */
 #endif
-#if FF_USE_FASTSEEK
-	DWORD*	cltbl;			/* Pointer to the cluster link map table (nulled on open, set by application) */
-#endif
 #if !FF_FS_TINY
 	BYTE	buf[FF_MAX_SS];	/* File private data read/write window */
 #endif
+#if FF_USE_FASTSEEK
+	DWORD*	cltbl;			/* Pointer to the cluster link map table (nulled on open, set by application) */
+#endif
 } FIL;
 
 

bootloader/libs/fatfs/ffconf.h

@@ -1,8 +1,8 @@
 /*---------------------------------------------------------------------------/
-/  FatFs - Configuration file
+/  FatFs Functional Configurations
 /---------------------------------------------------------------------------*/
 
-#define FFCONF_DEF 63463	/* Revision ID */
+#define FFCONF_DEF	86604	/* Revision ID */
 
 /*---------------------------------------------------------------------------/
 / Function Configurations
@@ -33,7 +33,7 @@
 /  2: Enable with LF-CRLF conversion. */
 
 
-#define FF_USE_FIND		0
+#define FF_USE_FIND		1
 /* This option switches filtered directory read functions, f_findfirst() and
 /  f_findnext(). (0:Disable, 1:Enable 2:Enable with matching altname[] too) */
 
@@ -232,14 +232,14 @@
 
 #define FF_FS_EXFAT		1
 /* This option switches support for exFAT filesystem. (0:Disable or 1:Enable)
-/  To enable exFAT, also LFN needs to be enabled.
+/  To enable exFAT, also LFN needs to be enabled. (FF_USE_LFN >= 1)
 /  Note that enabling exFAT discards ANSI C (C89) compatibility. */
 
 
 #define FF_FS_NORTC		1
 #define FF_NORTC_MON	1
 #define FF_NORTC_MDAY	1
-#define FF_NORTC_YEAR	2018
+#define FF_NORTC_YEAR	2019
 /* The option FF_FS_NORTC switches timestamp function. If the system does not have
 /  any RTC function or valid timestamp is not needed, set FF_FS_NORTC = 1 to disable
 /  the timestamp function. Every object modified by FatFs will have a fixed timestamp
@@ -262,6 +262,7 @@
 /      lock control is independent of re-entrancy. */
 
 
+/* #include <somertos.h>	// O/S definitions */
 #define FF_FS_REENTRANT	0
 #define FF_FS_TIMEOUT	1000
 #define FF_SYNC_t		HANDLE
@@ -282,8 +283,6 @@
 /  SemaphoreHandle_t and etc. A header file for O/S definitions needs to be
 /  included somewhere in the scope of ff.h. */
 
-/* #include <windows.h>	// O/S definitions  */
-
 
 
 /*--- End of configuration options ---*/

bootloader/libs/fatfs/ffsystem.c

@@ -1,6 +1,6 @@
 /*------------------------------------------------------------------------*/
 /* Sample Code of OS Dependent Functions for FatFs                        */
-/* (C) ChaN, 2017                                                         */
+/* (C) ChaN, 2018                                                          */
 /* (C) CTCaer, 2018                                                       */
 /*------------------------------------------------------------------------*/
 
@@ -16,7 +16,7 @@
 /* Allocate a memory block                                                */
 /*------------------------------------------------------------------------*/
 
-void* ff_memalloc (	/* Returns pointer to the allocated memory block (null on not enough core) */
+void* ff_memalloc (	/* Returns pointer to the allocated memory block (null if not enough core) */
 	UINT msize		/* Number of bytes to allocate */
 )
 {
@@ -29,7 +29,7 @@ void* ff_memalloc (	/* Returns pointer to the allocated memory block (null on no
 /*------------------------------------------------------------------------*/
 
 void ff_memfree (
-	void* mblock	/* Pointer to the memory block to free (nothing to do for null) */
+	void* mblock	/* Pointer to the memory block to free (nothing to do if null) */
 )
 {
 	free(mblock);	/* Free the memory block with POSIX API */

bootloader/libs/fatfs/ffunicode.c

@@ -1,5 +1,5 @@
 /*------------------------------------------------------------------------*/
-/* Unicode handling functions for FatFs R0.13a                            */
+/* Unicode handling functions for FatFs R0.13c                            */
 /*------------------------------------------------------------------------*/
 /* This module will occupy a huge memory in the .const section when the    /
 /  FatFs is configured for LFN with DBCS. If the system has any Unicode    /
@@ -7,7 +7,7 @@
 /  that function to avoid silly memory consumption.                        /
 /-------------------------------------------------------------------------*/
 /*
-/ Copyright (C) 2017, ChaN, all right reserved.
+/ Copyright (C) 2018, ChaN, all right reserved.
 /
 / FatFs module is an open source software. Redistribution and use of FatFs in
 / source and binary forms, with or without modification, are permitted provided
@@ -25,9 +25,9 @@
 
 #include "ff.h"
 
-#if FF_USE_LFN	/* This module is blanked when non-LFN configuration */
+#if FF_USE_LFN	/* This module will be blanked at non-LFN configuration */
 
-#if FF_DEFINED != 63463	/* Revision ID */
+#if FF_DEFINED != 86604	/* Revision ID */
 #error Wrong include file (ff.h).
 #endif
 

bootloader/link.ld

@@ -1,9 +1,12 @@
 ENTRY(_start)
 
 SECTIONS {
-	PROVIDE(__ipl_start = 0x40008000);
+	PROVIDE(__ipl_start = IPL_LOAD_ADDR);
 	. = __ipl_start;
 	.text : {
+		*(.text._start);
+		*(._boot_cfg);
+		*(._ipl_version);
 		*(.text*);
 	}
 	.data : {

bootloader/mem/heap.c

@@ -124,6 +124,6 @@ void *calloc(u32 num, u32 size)
 
 void free(void *buf)
 {
-	if (buf != NULL)
+	if ((u32)buf >= _heap.start)
 		_heap_free(&_heap, (u32)buf);
 }

bootloader/mem/mc.c

@@ -28,6 +28,7 @@ void mc_config_carveout()
 	MC(MC_MTS_CARVEOUT_SIZE_MB) = 0;
 	MC(MC_MTS_CARVEOUT_ADR_HI) = 0;
 	MC(MC_MTS_CARVEOUT_REG_CTRL) = 1;
+
 	MC(MC_SECURITY_CARVEOUT1_BOM) = 0;
 	MC(MC_SECURITY_CARVEOUT1_BOM_HI) = 0;
 	MC(MC_SECURITY_CARVEOUT1_SIZE_128KB) = 0;
@@ -43,6 +44,21 @@ void mc_config_carveout()
 	MC(MC_SECURITY_CARVEOUT1_CLIENT_FORCE_INTERNAL_ACCESS4) = 0;
 	MC(MC_SECURITY_CARVEOUT1_CFG0) = 0x4000006;
 
+	MC(MC_SECURITY_CARVEOUT2_BOM) = 0x80020000;
+	MC(MC_SECURITY_CARVEOUT2_BOM_HI) = 0;
+	MC(MC_SECURITY_CARVEOUT2_SIZE_128KB) = 2;
+	MC(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS0) = 0;
+	MC(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS1) = 0;
+	MC(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS2) = 0x3100000;
+	MC(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS3) = 0;
+	MC(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS4) = 0x300;
+	MC(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS0) = 0;
+	MC(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS1) = 0;
+	MC(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS2) = 0;
+	MC(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS3) = 0;
+	MC(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS4) = 0;
+	MC(MC_SECURITY_CARVEOUT2_CFG0) = 0x440167E;
+
 	MC(MC_SECURITY_CARVEOUT3_BOM) = 0;
 	MC(MC_SECURITY_CARVEOUT3_BOM_HI) = 0;
 	MC(MC_SECURITY_CARVEOUT3_SIZE_128KB) = 0;
@@ -57,6 +73,7 @@ void mc_config_carveout()
 	MC(MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS3) = 0;
 	MC(MC_SECURITY_CARVEOUT3_CLIENT_FORCE_INTERNAL_ACCESS4) = 0;
 	MC(MC_SECURITY_CARVEOUT3_CFG0) = 0x4401E7E;
+
 	MC(MC_SECURITY_CARVEOUT4_BOM) = 0;
 	MC(MC_SECURITY_CARVEOUT4_BOM_HI) = 0;
 	MC(MC_SECURITY_CARVEOUT4_SIZE_128KB) = 0;
@@ -71,6 +88,7 @@ void mc_config_carveout()
 	MC(MC_SECURITY_CARVEOUT4_CLIENT_FORCE_INTERNAL_ACCESS3) = 0;
 	MC(MC_SECURITY_CARVEOUT4_CLIENT_FORCE_INTERNAL_ACCESS4) = 0;
 	MC(MC_SECURITY_CARVEOUT4_CFG0) = 0x8F;
+
 	MC(MC_SECURITY_CARVEOUT5_BOM) = 0;
 	MC(MC_SECURITY_CARVEOUT5_BOM_HI) = 0;
 	MC(MC_SECURITY_CARVEOUT5_SIZE_128KB) = 0;
@@ -87,26 +105,9 @@ void mc_config_carveout()
 	MC(MC_SECURITY_CARVEOUT5_CFG0) = 0x8F;
 }
 
-void mc_config_carveout_finalize()
-{
-	MC(MC_SECURITY_CARVEOUT2_BOM) = 0x80020000;
-	MC(MC_SECURITY_CARVEOUT2_BOM_HI) = 0;
-	MC(MC_SECURITY_CARVEOUT2_SIZE_128KB) = 2;
-	MC(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS0) = 0;
-	MC(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS1) = 0;
-	MC(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS2) = 0x3000000;
-	MC(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS3) = 0;
-	MC(MC_SECURITY_CARVEOUT2_CLIENT_ACCESS4) = 0x300;
-	MC(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS0) = 0;
-	MC(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS1) = 0;
-	MC(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS2) = 0;
-	MC(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS3) = 0;
-	MC(MC_SECURITY_CARVEOUT2_CLIENT_FORCE_INTERNAL_ACCESS4) = 0;
-	MC(MC_SECURITY_CARVEOUT2_CFG0) = 0x440167E;
-}
-
 void mc_enable_ahb_redirect()
 {
+	// Enable ARC_CLK_OVR_ON.
 	CLOCK(CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRD) = (CLOCK(CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRD) & 0xFFF7FFFF) | 0x80000;
 	//MC(MC_IRAM_REG_CTRL) &= 0xFFFFFFFE;
 	MC(MC_IRAM_BOM) = 0x40000000;
@@ -119,7 +120,8 @@ void mc_disable_ahb_redirect()
 	MC(MC_IRAM_TOM) = 0;
 	// Disable IRAM_CFG_WRITE_ACCESS (sticky).
 	//MC(MC_IRAM_REG_CTRL) = MC(MC_IRAM_REG_CTRL) & 0xFFFFFFFE | 1;
-	CLOCK(0x3A4) &= 0xFFF7FFFF;
+	// Disable ARC_CLK_OVR_ON.
+	CLOCK(CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRD) &= 0xFFF7FFFF;
 }
 
 void mc_enable()
@@ -131,7 +133,7 @@ void mc_enable()
 	CLOCK(CLK_RST_CONTROLLER_CLK_ENB_H_SET) = (CLOCK(CLK_RST_CONTROLLER_CLK_ENB_H_SET) & 0xFFFFFFFE) | 1;
 	// Enable EMC DLL clock.
 	CLOCK(CLK_RST_CONTROLLER_CLK_ENB_X_SET) = (CLOCK(CLK_RST_CONTROLLER_CLK_ENB_X_SET) & 0xFFFFBFFF) | 0x4000;
-	CLOCK(CLK_RST_CONTROLLER_RST_DEV_H_SET) = 0x2000001; //Clear EMC and MC reset.
+	CLOCK(CLK_RST_CONTROLLER_RST_DEV_H_CLR) = 0x2000001; //Clear EMC and MC reset.
 	usleep(5);
 
 	//#ifdef CONFIG_ENABLE_AHB_REDIRECT

bootloader/mem/sdram.c

@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018 balika011
+ * Copyright (c) 2019 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -18,11 +20,12 @@
 #include "../soc/t210.h"
 #include "mc.h"
 #include "emc.h"
+#include "sdram_param_t210.h"
 #include "../soc/pmc.h"
 #include "../utils/util.h"
 #include "../soc/fuse.h"
 #include "../power/max77620.h"
-#include "../mem/sdram_param_t210.h"
+#include "../power/max7762x.h"
 #include "../soc/clock.h"
 
 #define CONFIG_SDRAM_COMPRESS_CFG
@@ -41,7 +44,7 @@ static u32 _get_sdram_id()
 
 static void _sdram_config(const sdram_params_t *params)
 {
-	PMC(0x45C) = (((4 * params->emc_pmc_scratch1 >> 2) + 0x80000000) ^ 0xFFFF) & 0xC000FFFF;
+	PMC(APBDEV_PMC_IO_DPD3_REQ) = (((4 * params->emc_pmc_scratch1 >> 2) + 0x80000000) ^ 0xFFFF) & 0xC000FFFF;
 	usleep(params->pmc_io_dpd3_req_wait);
 
 	u32 req = (4 * params->emc_pmc_scratch2 >> 2) + 0x80000000;
@@ -388,12 +391,12 @@ break_nosleep:
 	EMC(EMC_ACPD_CONTROL) = params->emc_acpd_control;
 	EMC(EMC_TXDSRVTTGEN) = params->emc_txdsrvttgen;
 	EMC(EMC_CFG) = (params->emc_cfg & 0xE) | 0x3C00000;
-	if (params->boot_rom_patch_control & 0x80000000)
+	if (params->boot_rom_patch_control & (1 << 31))
 	{
-		*(vu32 *)(4 * (params->boot_rom_patch_control + 0x1C000000)) = params->boot_rom_patch_data;
+		*(vu32 *)(APB_MISC_BASE + params->boot_rom_patch_control * 4) = params->boot_rom_patch_data;
 		MC(MC_TIMING_CONTROL) = 1;
 	}
-	PMC(0x45C) = ((4 * params->emc_pmc_scratch1 >> 2) + 0x40000000) & 0xCFFF0000;
+	PMC(APBDEV_PMC_IO_DPD3_REQ) = ((4 * params->emc_pmc_scratch1 >> 2) + 0x40000000) & 0xCFFF0000;
 	usleep(params->pmc_io_dpd3_req_wait);
 	if (!params->emc_auto_cal_interval)
 		EMC(EMC_AUTO_CAL_CONFIG) = params->emc_auto_cal_config | 0x200;
@@ -410,7 +413,7 @@ break_nosleep:
 	}
 	EMC(EMC_TIMING_CONTROL) = 1;
 	usleep(params->emc_timing_control_wait);
-	PMC(0x4E4) &= 0xFFF8007F;
+	PMC(APBDEV_PMC_DDR_CNTRL) &= 0xFFF8007F;
 	usleep(params->pmc_ddr_ctrl_wait);
 	if (params->memory_type == 2)
 	{
@@ -459,7 +462,7 @@ break_nosleep:
 			}
 		}
 	}
-	PMC(0x1D0) = params->pmc_ddr_cfg;
+	PMC(APBDEV_PMC_DDR_CFG) = params->pmc_ddr_cfg;
 	if (params->memory_type - 1 <= 2)
 	{
 		EMC(EMC_ZCAL_INTERVAL) = params->emc_zcal_interval;
@@ -486,29 +489,57 @@ break_nosleep:
 	MC(MC_VIDEO_PROTECT_REG_CTRL) = params->mc_video_protect_write_access;
 	MC(MC_SEC_CARVEOUT_REG_CTRL) = params->mc_sec_carveout_protect_write_access;
 	MC(MC_MTS_CARVEOUT_REG_CTRL) = params->mc_mts_carveout_reg_ctrl;
-	MC(MC_EMEM_CFG_ACCESS_CTRL) = 1; //Disable write access to a bunch of MC registers.
+	MC(MC_EMEM_CFG_ACCESS_CTRL) = 1; //Disable write access to a bunch of EMC registers.
 }
 
-const void *sdram_get_params()
+sdram_params_t *sdram_get_params()
 {
 	//TODO: sdram_id should be in [0, 7].
 
 #ifdef CONFIG_SDRAM_COMPRESS_CFG
 	u8 *buf = (u8 *)0x40030000;
 	LZ_Uncompress(_dram_cfg_lz, buf, sizeof(_dram_cfg_lz));
-	return (const void *)&buf[sizeof(sdram_params_t) * _get_sdram_id()];
+	return (sdram_params_t *)&buf[sizeof(sdram_params_t) * _get_sdram_id()];
 #else
 	return _dram_cfgs[_get_sdram_id()];
 #endif
 }
 
+/*
+ * Function: sdram_get_params_patched
+ *
+ * This code implements a warmboot exploit. Warmboot, that is actually so hot, it burns Nvidia once again.
+ * If the boot_rom_patch_control's MSB is set, it uses it as an index to
+ * APB_MISC_BASE (u32 array) and sets it to the value of boot_rom_patch_data.
+ * (The MSB falls out when it gets multiplied by sizeof(u32)).
+ * Because the bootrom does not do any boundary checks, it lets us write anywhere and anything.
+ * Ipatch hardware let us apply 12 changes to the bootrom and can be changed any time.
+ * The first patch is not needed any more when the exploit is triggered, so we overwrite that.
+ * 0x10459E is the address where it returns an error when the signature is not valid.
+ * We change that to MOV R0, #0, so we pass the check.
+ *
+ * Note: The modulus in the header must match and validated.
+ */
+
+sdram_params_t *sdram_get_params_patched()
+{
+	#define IPATCH_CONFIG(addr, data) (((addr - 0x100000) / 2) << 16 | (data & 0xffff))
+	sdram_params_t *sdram_params = sdram_get_params();
+
+	// Disable Warmboot signature check.
+	sdram_params->boot_rom_patch_control = (1 << 31) | (((IPATCH_BASE + 4) - APB_MISC_BASE) / 4);
+	sdram_params->boot_rom_patch_data = IPATCH_CONFIG(0x10459E, 0x2000);
+
+	return sdram_params;
+}
+
 void sdram_init()
 {
 	//TODO: sdram_id should be in [0,4].
 	const sdram_params_t *params = (const sdram_params_t *)sdram_get_params();
 
-	i2c_send_byte(I2C_5, 0x3C, MAX77620_REG_SD_CFG2, 0x05);
-	i2c_send_byte(I2C_5, 0x3C, MAX77620_REG_SD1, 40); //40 = (1000 * 1100 - 600000) / 12500 -> 1.1V
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_SD_CFG2, 0x05);
+	max77620_regulator_set_voltage(REGULATOR_SD1, 1100000);
 
 	PMC(APBDEV_PMC_VDDP_SEL) = params->pmc_vddp_sel;
 	usleep(params->pmc_vddp_sel_wait);

bootloader/mem/sdram.h

@@ -17,8 +17,11 @@
 #ifndef _SDRAM_H_
 #define _SDRAM_H_
 
+#include "sdram_param_t210.h"
+
 void sdram_init();
-const void *sdram_get_params();
+sdram_params_t *sdram_get_params();
+sdram_params_t *sdram_get_params_patched();
 void sdram_lp0_save_params(const void *params);
 
 #endif

bootloader/mem/sdram_lp0.c

@@ -1,8 +1,8 @@
 /*
  * Copyright (c) 2013, NVIDIA CORPORATION.  All rights reserved.
  * Copyright 2014 Google Inc.
- * Copyright (C) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

bootloader/power/bq24193.c

@@ -148,7 +148,7 @@ int bq24193_get_property(enum BQ24193_reg_prop prop, int *value)
 
 void bq24193_fake_battery_removal()
 {
-	u8  value;
+	u8 value;
 
 	// Disable watchdog to keep BATFET disabled.
 	value = i2c_recv_byte(I2C_1, BQ24193_I2C_ADDR, BQ24193_ChrgTermTimer);

bootloader/power/max77620.h

@@ -2,6 +2,7 @@
  * Defining registers address and its bit definitions of MAX77620 and MAX20024
  *
  * Copyright (C) 2016 NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2019 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -11,276 +12,280 @@
 #ifndef _MFD_MAX77620_H_
 #define _MFD_MAX77620_H_
 
+#define MAX77620_I2C_ADDR 0x3C
+
 /* GLOBAL, PMIC, GPIO, FPS, ONOFFC, CID Registers */
-#define MAX77620_REG_CNFGGLBL1			0x00
-#define MAX77620_REG_CNFGGLBL2			0x01
-#define MAX77620_REG_CNFGGLBL3			0x02
-#define MAX77620_REG_CNFG1_32K			0x03
-#define MAX77620_REG_CNFGBBC			0x04
-#define MAX77620_REG_IRQTOP			0x05
-#define MAX77620_REG_INTLBT			0x06
-#define MAX77620_REG_IRQSD			0x07
-#define MAX77620_REG_IRQ_LVL2_L0_7		0x08
-#define MAX77620_REG_IRQ_LVL2_L8		0x09
-#define MAX77620_REG_IRQ_LVL2_GPIO		0x0A
-#define MAX77620_REG_ONOFFIRQ			0x0B
-#define MAX77620_REG_NVERC			0x0C
-#define MAX77620_REG_IRQTOPM			0x0D
-#define MAX77620_REG_INTENLBT			0x0E
-#define MAX77620_REG_IRQMASKSD			0x0F
-#define MAX77620_REG_IRQ_MSK_L0_7		0x10
-#define MAX77620_REG_IRQ_MSK_L8			0x11
-#define MAX77620_REG_ONOFFIRQM			0x12
-#define MAX77620_REG_STATLBT			0x13
-#define MAX77620_REG_STATSD			0x14
-#define MAX77620_REG_ONOFFSTAT			0x15
+#define MAX77620_REG_CNFGGLBL1      0x00
+#define  MAX77620_CNFGGLBL1_LBDAC_EN          (1 << 7)
+#define  MAX77620_CNFGGLBL1_MPPLD             (1 << 6)
+#define  MAX77620_CNFGGLBL1_LBHYST            ((1 << 5) | (1 << 4))
+#define  MAX77620_CNFGGLBL1_LBHYST_N          (1 << 4)
+#define  MAX77620_CNFGGLBL1_LBDAC             0x0E
+#define  MAX77620_CNFGGLBL1_LBDAC_N           (1 << 1)
+#define  MAX77620_CNFGGLBL1_LBRSTEN           (1 << 0)
+
+#define MAX77620_REG_CNFGGLBL2      0x01
+#define MAX77620_REG_CNFGGLBL3      0x02
+#define  MAX77620_WDTC_MASK                   0x3
+#define  MAX77620_WDTOFFC                     (1 << 4)
+#define  MAX77620_WDTSLPC                     (1 << 3)
+#define  MAX77620_WDTEN                       (1 << 2)
+#define  MAX77620_TWD_MASK                    0x3
+#define  MAX77620_TWD_2s                      0x0
+#define  MAX77620_TWD_16s                     0x1
+#define  MAX77620_TWD_64s                     0x2
+#define  MAX77620_TWD_128s                    0x3
+
+#define MAX77620_REG_CNFG1_32K      0x03
+#define  MAX77620_CNFG1_32K_OUT0_EN           (1 << 2)
+
+#define MAX77620_REG_CNFGBBC        0x04
+#define  MAX77620_CNFGBBC_ENABLE              (1 << 0)
+#define  MAX77620_CNFGBBC_CURRENT_MASK        0x06
+#define  MAX77620_CNFGBBC_CURRENT_SHIFT       1
+#define  MAX77620_CNFGBBC_VOLTAGE_MASK        0x18
+#define  MAX77620_CNFGBBC_VOLTAGE_SHIFT       3
+#define  MAX77620_CNFGBBC_LOW_CURRENT_DISABLE (1 << 5)
+#define  MAX77620_CNFGBBC_RESISTOR_MASK       0xC0
+#define  MAX77620_CNFGBBC_RESISTOR_SHIFT      6
+#define  MAX77620_CNFGBBC_RESISTOR_100        (0 << MAX77620_CNFGBBC_RESISTOR_SHIFT)
+#define  MAX77620_CNFGBBC_RESISTOR_1K         (1 << MAX77620_CNFGBBC_RESISTOR_SHIFT)
+#define  MAX77620_CNFGBBC_RESISTOR_3K         (2 << MAX77620_CNFGBBC_RESISTOR_SHIFT)
+#define  MAX77620_CNFGBBC_RESISTOR_6K         (3 << MAX77620_CNFGBBC_RESISTOR_SHIFT)
+
+#define MAX77620_REG_IRQTOP         0x05
+#define  MAX77620_IRQ_TOP_GLBL_MASK           (1 << 7)
+#define  MAX77620_IRQ_TOP_SD_MASK             (1 << 6)
+#define  MAX77620_IRQ_TOP_LDO_MASK            (1 << 5)
+#define  MAX77620_IRQ_TOP_GPIO_MASK           (1 << 4)
+#define  MAX77620_IRQ_TOP_RTC_MASK            (1 << 3)
+#define  MAX77620_IRQ_TOP_32K_MASK            (1 << 2)
+#define  MAX77620_IRQ_TOP_ONOFF_MASK          (1 << 1)
+
+#define MAX77620_REG_INTLBT         0x06
+#define MAX77620_REG_IRQTOPM        0x0D
+#define  MAX77620_IRQ_LBM_MASK                (1 << 3)
+#define  MAX77620_IRQ_TJALRM1_MASK            (1 << 2)
+#define  MAX77620_IRQ_TJALRM2_MASK            (1 << 1)
+
+#define MAX77620_REG_IRQSD          0x07
+#define MAX77620_REG_IRQ_LVL2_L0_7  0x08
+#define MAX77620_REG_IRQ_LVL2_L8    0x09
+#define MAX77620_REG_IRQ_LVL2_GPIO  0x0A
+#define MAX77620_REG_ONOFFIRQ       0x0B
+#define MAX77620_REG_NVERC          0x0C
+
+#define MAX77620_REG_INTENLBT       0x0E
+#define  MAX77620_GLBLM_MASK                  (1 << 0)
+
+#define MAX77620_REG_IRQMASKSD      0x0F
+#define MAX77620_REG_IRQ_MSK_L0_7   0x10
+#define MAX77620_REG_IRQ_MSK_L8     0x11
+#define MAX77620_REG_ONOFFIRQM      0x12
+#define MAX77620_REG_STATLBT        0x13
+#define MAX77620_REG_STATSD         0x14
+#define MAX77620_REG_ONOFFSTAT      0x15
 
 /* SD and LDO Registers */
-#define MAX77620_REG_SD0			0x16
-#define MAX77620_REG_SD1			0x17
-#define MAX77620_REG_SD2			0x18
-#define MAX77620_REG_SD3			0x19
-#define MAX77620_REG_SD4			0x1A
-#define MAX77620_REG_DVSSD0			0x1B
-#define MAX77620_REG_DVSSD1			0x1C
-#define MAX77620_REG_SD0_CFG			0x1D
-#define MAX77620_REG_SD1_CFG			0x1E
-#define MAX77620_REG_SD2_CFG			0x1F
-#define MAX77620_REG_SD3_CFG			0x20
-#define MAX77620_REG_SD4_CFG			0x21
-#define MAX77620_REG_SD_CFG2			0x22
-#define MAX77620_REG_LDO0_CFG			0x23
-#define MAX77620_REG_LDO0_CFG2			0x24
-#define MAX77620_REG_LDO1_CFG			0x25
-#define MAX77620_REG_LDO1_CFG2			0x26
-#define MAX77620_REG_LDO2_CFG			0x27
-#define MAX77620_REG_LDO2_CFG2			0x28
-#define MAX77620_REG_LDO3_CFG			0x29
-#define MAX77620_REG_LDO3_CFG2			0x2A
-#define MAX77620_REG_LDO4_CFG			0x2B
-#define MAX77620_REG_LDO4_CFG2			0x2C
-#define MAX77620_REG_LDO5_CFG			0x2D
-#define MAX77620_REG_LDO5_CFG2			0x2E
-#define MAX77620_REG_LDO6_CFG			0x2F
-#define MAX77620_REG_LDO6_CFG2			0x30
-#define MAX77620_REG_LDO7_CFG			0x31
-#define MAX77620_REG_LDO7_CFG2			0x32
-#define MAX77620_REG_LDO8_CFG			0x33
-#define MAX77620_REG_LDO8_CFG2			0x34
-#define MAX77620_REG_LDO_CFG3			0x35
+#define MAX77620_REG_SD0            0x16
+#define MAX77620_REG_SD1            0x17
+#define MAX77620_REG_SD2            0x18
+#define MAX77620_REG_SD3            0x19
+#define MAX77620_REG_SD4            0x1A
+#define  MAX77620_SDX_VOLT_MASK               0xFF
+#define  MAX77620_SD0_VOLT_MASK               0x3F
+#define  MAX77620_SD1_VOLT_MASK               0x7F
+#define  MAX77620_LDO_VOLT_MASK               0x3F
+#define MAX77620_REG_DVSSD0         0x1B
+#define MAX77620_REG_DVSSD1         0x1C
+#define MAX77620_REG_SD0_CFG        0x1D
+#define MAX77620_REG_SD1_CFG        0x1E
+#define MAX77620_REG_SD2_CFG        0x1F
+#define MAX77620_REG_SD3_CFG        0x20
+#define MAX77620_REG_SD4_CFG        0x21
+#define MAX77620_REG_SD_CFG2        0x22
+#define MAX77620_REG_LDO0_CFG       0x23
+#define MAX77620_REG_LDO0_CFG2      0x24
+#define MAX77620_REG_LDO1_CFG       0x25
+#define MAX77620_REG_LDO1_CFG2      0x26
+#define MAX77620_REG_LDO2_CFG       0x27
+#define MAX77620_REG_LDO2_CFG2      0x28
+#define MAX77620_REG_LDO3_CFG       0x29
+#define MAX77620_REG_LDO3_CFG2      0x2A
+#define MAX77620_REG_LDO4_CFG       0x2B
+#define MAX77620_REG_LDO4_CFG2      0x2C
+#define MAX77620_REG_LDO5_CFG       0x2D
+#define MAX77620_REG_LDO5_CFG2      0x2E
+#define MAX77620_REG_LDO6_CFG       0x2F
+#define MAX77620_REG_LDO6_CFG2      0x30
+#define MAX77620_REG_LDO7_CFG       0x31
+#define MAX77620_REG_LDO7_CFG2      0x32
+#define MAX77620_REG_LDO8_CFG       0x33
+#define MAX77620_REG_LDO8_CFG2      0x34
+#define  MAX77620_LDO_POWER_MODE_MASK         0xC0
+#define  MAX77620_LDO_POWER_MODE_SHIFT        6
+#define  MAX77620_POWER_MODE_NORMAL	          3
+#define  MAX77620_POWER_MODE_LPM              2
+#define  MAX77620_POWER_MODE_GLPM             1
+#define  MAX77620_POWER_MODE_DISABLE          0
+#define  MAX20024_LDO_CFG2_MPOK_MASK          (1 << 2)
+#define  MAX77620_LDO_CFG2_ADE_MASK           (1 << 1)
+#define  MAX77620_LDO_CFG2_ADE_DISABLE        0
+#define  MAX77620_LDO_CFG2_ADE_ENABLE         (1 << 1)
+#define  MAX77620_LDO_CFG2_SS_MASK            (1 << 0)
+#define  MAX77620_LDO_CFG2_SS_FAST            (1 << 0)
+#define  MAX77620_LDO_CFG2_SS_SLOW            0
 
-#define MAX77620_LDO_SLEW_RATE_MASK		0x1
+#define MAX77620_REG_LDO_CFG3       0x35
+#define  MAX77620_TRACK4_MASK                 (1 << 5)
+#define  MAX77620_TRACK4_SHIFT                5
 
-/* LDO Configuration 3 */
-#define MAX77620_TRACK4_MASK			(1 << 5)
-#define MAX77620_TRACK4_SHIFT			5
+#define MAX77620_LDO_SLEW_RATE_MASK 0x1
 
-/* Voltage */
-#define MAX77620_SDX_VOLT_MASK			0xFF
-#define MAX77620_SD0_VOLT_MASK			0x3F
-#define MAX77620_SD1_VOLT_MASK			0x7F
-#define MAX77620_LDO_VOLT_MASK			0x3F
+#define MAX77620_REG_GPIO0          0x36
+#define MAX77620_REG_GPIO1          0x37
+#define MAX77620_REG_GPIO2          0x38
+#define MAX77620_REG_GPIO3          0x39
+#define MAX77620_REG_GPIO4          0x3A
+#define MAX77620_REG_GPIO5          0x3B
+#define MAX77620_REG_GPIO6          0x3C
+#define MAX77620_REG_GPIO7          0x3D
+#define MAX77620_REG_PUE_GPIO       0x3E
+#define MAX77620_REG_PDE_GPIO       0x3F
+#define MAX77620_REG_AME_GPIO       0x40
 
-#define MAX77620_REG_GPIO0			0x36
-#define MAX77620_REG_GPIO1			0x37
-#define MAX77620_REG_GPIO2			0x38
-#define MAX77620_REG_GPIO3			0x39
-#define MAX77620_REG_GPIO4			0x3A
-#define MAX77620_REG_GPIO5			0x3B
-#define MAX77620_REG_GPIO6			0x3C
-#define MAX77620_REG_GPIO7			0x3D
-#define MAX77620_REG_PUE_GPIO			0x3E
-#define MAX77620_REG_PDE_GPIO			0x3F
-#define MAX77620_REG_AME_GPIO			0x40
-#define MAX77620_REG_ONOFFCNFG1			0x41
-#define MAX77620_REG_ONOFFCNFG2			0x42
+#define MAX77620_REG_ONOFFCNFG1     0x41
+#define  MAX77620_ONOFFCNFG1_SFT_RST          (1 << 7)
+#define  MAX77620_ONOFFCNFG1_MRT_MASK         0x38
+#define  MAX77620_ONOFFCNFG1_MRT_SHIFT        0x3
+#define  MAX77620_ONOFFCNFG1_SLPEN            (1 << 2)
+#define  MAX77620_ONOFFCNFG1_PWR_OFF          (1 << 1)
+#define  MAX20024_ONOFFCNFG1_CLRSE            0x18
+
+#define MAX77620_REG_ONOFFCNFG2     0x42
+#define  MAX77620_ONOFFCNFG2_SFT_RST_WK       (1 << 7)
+#define  MAX77620_ONOFFCNFG2_WD_RST_WK        (1 << 6)
+#define  MAX77620_ONOFFCNFG2_SLP_LPM_MSK      (1 << 5)
+#define  MAX77620_ONOFFCNFG2_WK_ALARM1        (1 << 2)
+#define  MAX77620_ONOFFCNFG2_WK_EN0           (1 << 0)
 
 /* FPS Registers */
-#define MAX77620_REG_FPS_CFG0			0x43
-#define MAX77620_REG_FPS_CFG1			0x44
-#define MAX77620_REG_FPS_CFG2			0x45
-#define MAX77620_REG_FPS_LDO0			0x46
-#define MAX77620_REG_FPS_LDO1			0x47
-#define MAX77620_REG_FPS_LDO2			0x48
-#define MAX77620_REG_FPS_LDO3			0x49
-#define MAX77620_REG_FPS_LDO4			0x4A
-#define MAX77620_REG_FPS_LDO5			0x4B
-#define MAX77620_REG_FPS_LDO6			0x4C
-#define MAX77620_REG_FPS_LDO7			0x4D
-#define MAX77620_REG_FPS_LDO8			0x4E
-#define MAX77620_REG_FPS_SD0			0x4F
-#define MAX77620_REG_FPS_SD1			0x50
-#define MAX77620_REG_FPS_SD2			0x51
-#define MAX77620_REG_FPS_SD3			0x52
-#define MAX77620_REG_FPS_SD4			0x53
-#define MAX77620_REG_FPS_NONE			0
-
-#define MAX77620_FPS_SRC_MASK			0xC0
-#define MAX77620_FPS_SRC_SHIFT			6
-#define MAX77620_FPS_PU_PERIOD_MASK		0x38
-#define MAX77620_FPS_PU_PERIOD_SHIFT		3
-#define MAX77620_FPS_PD_PERIOD_MASK		0x07
-#define MAX77620_FPS_PD_PERIOD_SHIFT		0
-#define MAX77620_FPS_TIME_PERIOD_MASK		0x38
-#define MAX77620_FPS_TIME_PERIOD_SHIFT		3
-#define MAX77620_FPS_EN_SRC_MASK		0x06
-#define MAX77620_FPS_EN_SRC_SHIFT		1
-#define MAX77620_FPS_ENFPS_SW_MASK		0x01
-#define MAX77620_FPS_ENFPS_SW			0x01
+#define MAX77620_REG_FPS_CFG0       0x43
+#define MAX77620_REG_FPS_CFG1       0x44
+#define MAX77620_REG_FPS_CFG2       0x45
+#define MAX77620_REG_FPS_LDO0       0x46
+#define MAX77620_REG_FPS_LDO1       0x47
+#define MAX77620_REG_FPS_LDO2       0x48
+#define MAX77620_REG_FPS_LDO3       0x49
+#define MAX77620_REG_FPS_LDO4       0x4A
+#define MAX77620_REG_FPS_LDO5       0x4B
+#define MAX77620_REG_FPS_LDO6       0x4C
+#define MAX77620_REG_FPS_LDO7       0x4D
+#define MAX77620_REG_FPS_LDO8       0x4E
+#define MAX77620_REG_FPS_SD0        0x4F
+#define MAX77620_REG_FPS_SD1        0x50
+#define MAX77620_REG_FPS_SD2        0x51
+#define MAX77620_REG_FPS_SD3        0x52
+#define MAX77620_REG_FPS_SD4        0x53
+#define MAX77620_REG_FPS_NONE       0
+#define  MAX77620_FPS_SRC_MASK                0xC0
+#define  MAX77620_FPS_SRC_SHIFT               6
+#define  MAX77620_FPS_PU_PERIOD_MASK          0x38
+#define  MAX77620_FPS_PU_PERIOD_SHIFT         3
+#define  MAX77620_FPS_PD_PERIOD_MASK          0x07
+#define  MAX77620_FPS_PD_PERIOD_SHIFT         0
 
 /* Minimum and maximum FPS period time (in microseconds) are
  * different for MAX77620 and Max20024.
  */
-#define MAX77620_FPS_PERIOD_MIN_US		40
-#define MAX20024_FPS_PERIOD_MIN_US		20
+#define MAX77620_FPS_COUNT 3
 
-#define MAX77620_FPS_PERIOD_MAX_US		2560
-#define MAX20024_FPS_PERIOD_MAX_US		5120
+#define MAX77620_FPS_PERIOD_MIN_US 40
+#define MAX20024_FPS_PERIOD_MIN_US 20
 
-#define MAX77620_REG_FPS_GPIO1			0x54
-#define MAX77620_REG_FPS_GPIO2			0x55
-#define MAX77620_REG_FPS_GPIO3			0x56
-#define MAX77620_REG_FPS_RSO			0x57
-#define MAX77620_REG_CID0			0x58
-#define MAX77620_REG_CID1			0x59
-#define MAX77620_REG_CID2			0x5A
-#define MAX77620_REG_CID3			0x5B
-#define MAX77620_REG_CID4			0x5C
-#define MAX77620_REG_CID5			0x5D
+#define MAX77620_FPS_PERIOD_MAX_US 2560
+#define MAX20024_FPS_PERIOD_MAX_US 5120
 
-#define MAX77620_REG_DVSSD4			0x5E
-#define MAX20024_REG_MAX_ADD			0x70
+#define MAX77620_REG_FPS_GPIO1      0x54
+#define MAX77620_REG_FPS_GPIO2      0x55
+#define MAX77620_REG_FPS_GPIO3      0x56
+#define  MAX77620_FPS_TIME_PERIOD_MASK        0x38
+#define  MAX77620_FPS_TIME_PERIOD_SHIFT       3
+#define  MAX77620_FPS_EN_SRC_MASK             0x06
+#define  MAX77620_FPS_EN_SRC_SHIFT            1
+#define  MAX77620_FPS_ENFPS_SW_MASK           0x01
+#define  MAX77620_FPS_ENFPS_SW                0x01
 
-#define MAX77620_CID_DIDM_MASK			0xF0
-#define MAX77620_CID_DIDM_SHIFT			4
+#define MAX77620_REG_FPS_RSO        0x57
+#define MAX77620_REG_CID0           0x58
+#define MAX77620_REG_CID1           0x59
+#define MAX77620_REG_CID2           0x5A
+#define MAX77620_REG_CID3           0x5B
+#define MAX77620_REG_CID4           0x5C
+#define MAX77620_REG_CID5           0x5D
+
+#define MAX77620_REG_DVSSD4         0x5E
+#define MAX20024_REG_MAX_ADD        0x70
+
+#define MAX77620_CID_DIDM_MASK                0xF0
+#define MAX77620_CID_DIDM_SHIFT               4
 
 /* CNCG2SD */
-#define MAX77620_SD_CNF2_ROVS_EN_SD1		(1 << 1)
-#define MAX77620_SD_CNF2_ROVS_EN_SD0		(1 << 2)
+#define MAX77620_SD_CNF2_ROVS_EN_SD1          (1 << 1)
+#define MAX77620_SD_CNF2_ROVS_EN_SD0          (1 << 2)
 
 /* Device Identification Metal */
-#define MAX77620_CID5_DIDM(n)			(((n) >> 4) & 0xF)
+#define MAX77620_CID5_DIDM(n) (((n) >> 4) & 0xF)
 /* Device Indentification OTP */
-#define MAX77620_CID5_DIDO(n)			((n) & 0xF)
+#define MAX77620_CID5_DIDO(n) ((n) & 0xF)
 
 /* SD CNFG1 */
-#define MAX77620_SD_SR_MASK			0xC0
-#define MAX77620_SD_SR_SHIFT			6
-#define MAX77620_SD_POWER_MODE_MASK		0x30
-#define MAX77620_SD_POWER_MODE_SHIFT		4
-#define MAX77620_SD_CFG1_ADE_MASK		(1 << 3)
-#define MAX77620_SD_CFG1_ADE_DISABLE		0
-#define MAX77620_SD_CFG1_ADE_ENABLE		(1 << 3)
-#define MAX77620_SD_FPWM_MASK			0x04
-#define MAX77620_SD_FPWM_SHIFT			2
-#define MAX77620_SD_FSRADE_MASK			0x01
-#define MAX77620_SD_FSRADE_SHIFT		0
-#define MAX77620_SD_CFG1_FPWM_SD_MASK		(1 << 2)
-#define MAX77620_SD_CFG1_FPWM_SD_SKIP		0
-#define MAX77620_SD_CFG1_FPWM_SD_FPWM		(1 << 2)
-#define MAX20024_SD_CFG1_MPOK_MASK		(1 << 1)
-#define MAX77620_SD_CFG1_FSRADE_SD_MASK		(1 << 0)
-#define MAX77620_SD_CFG1_FSRADE_SD_DISABLE	0
-#define MAX77620_SD_CFG1_FSRADE_SD_ENABLE	(1 << 0)
+#define MAX77620_SD_SR_MASK                   0xC0
+#define MAX77620_SD_SR_SHIFT                  6
+#define MAX77620_SD_POWER_MODE_MASK           0x30
+#define MAX77620_SD_POWER_MODE_SHIFT          4
+#define MAX77620_SD_CFG1_ADE_MASK             (1 << 3)
+#define MAX77620_SD_CFG1_ADE_DISABLE          0
+#define MAX77620_SD_CFG1_ADE_ENABLE           (1 << 3)
+#define MAX77620_SD_FPWM_MASK                 0x04
+#define MAX77620_SD_FPWM_SHIFT                2
+#define MAX77620_SD_FSRADE_MASK               0x01
+#define MAX77620_SD_FSRADE_SHIFT              0
+#define MAX77620_SD_CFG1_FPWM_SD_MASK         (1 << 2)
+#define MAX77620_SD_CFG1_FPWM_SD_SKIP         0
+#define MAX77620_SD_CFG1_FPWM_SD_FPWM         (1 << 2)
+#define MAX20024_SD_CFG1_MPOK_MASK            (1 << 1)
+#define MAX77620_SD_CFG1_FSRADE_SD_MASK       (1 << 0)
+#define MAX77620_SD_CFG1_FSRADE_SD_DISABLE    0
+#define MAX77620_SD_CFG1_FSRADE_SD_ENABLE     (1 << 0)
 
-/* LDO_CNFG2 */
-#define MAX77620_LDO_POWER_MODE_MASK		0xC0
-#define MAX77620_LDO_POWER_MODE_SHIFT		6
-#define MAX20024_LDO_CFG2_MPOK_MASK		(1 << 2)
-#define MAX77620_LDO_CFG2_ADE_MASK		(1 << 1)
-#define MAX77620_LDO_CFG2_ADE_DISABLE		0
-#define MAX77620_LDO_CFG2_ADE_ENABLE		(1 << 1)
-#define MAX77620_LDO_CFG2_SS_MASK		(1 << 0)
-#define MAX77620_LDO_CFG2_SS_FAST		(1 << 0)
-#define MAX77620_LDO_CFG2_SS_SLOW		0
+#define MAX77620_CNFG_GPIO_DRV_MASK           (1 << 0)
+#define MAX77620_CNFG_GPIO_DRV_PUSHPULL       (1 << 0)
+#define MAX77620_CNFG_GPIO_DRV_OPENDRAIN      0
+#define MAX77620_CNFG_GPIO_DIR_MASK           (1 << 1)
+#define MAX77620_CNFG_GPIO_DIR_INPUT          (1 << 1)
+#define MAX77620_CNFG_GPIO_DIR_OUTPUT         0
+#define MAX77620_CNFG_GPIO_INPUT_VAL_MASK     (1 << 2)
+#define MAX77620_CNFG_GPIO_OUTPUT_VAL_MASK    (1 << 3)
+#define MAX77620_CNFG_GPIO_OUTPUT_VAL_HIGH    (1 << 3)
+#define MAX77620_CNFG_GPIO_OUTPUT_VAL_LOW     0
+#define MAX77620_CNFG_GPIO_INT_MASK           (0x3 << 4)
+#define MAX77620_CNFG_GPIO_INT_FALLING        (1 << 4)
+#define MAX77620_CNFG_GPIO_INT_RISING         (1 << 5)
+#define MAX77620_CNFG_GPIO_DBNC_MASK          (0x3 << 6)
+#define MAX77620_CNFG_GPIO_DBNC_None          (0x0 << 6)
+#define MAX77620_CNFG_GPIO_DBNC_8ms           (0x1 << 6)
+#define MAX77620_CNFG_GPIO_DBNC_16ms          (0x2 << 6)
+#define MAX77620_CNFG_GPIO_DBNC_32ms          (0x3 << 6)
 
-#define MAX77620_IRQ_TOP_GLBL_MASK		(1 << 7)
-#define MAX77620_IRQ_TOP_SD_MASK		(1 << 6)
-#define MAX77620_IRQ_TOP_LDO_MASK		(1 << 5)
-#define MAX77620_IRQ_TOP_GPIO_MASK		(1 << 4)
-#define MAX77620_IRQ_TOP_RTC_MASK		(1 << 3)
-#define MAX77620_IRQ_TOP_32K_MASK		(1 << 2)
-#define MAX77620_IRQ_TOP_ONOFF_MASK		(1 << 1)
-
-#define MAX77620_IRQ_LBM_MASK			(1 << 3)
-#define MAX77620_IRQ_TJALRM1_MASK		(1 << 2)
-#define MAX77620_IRQ_TJALRM2_MASK		(1 << 1)
-
-#define MAX77620_CNFG_GPIO_DRV_MASK		(1 << 0)
-#define MAX77620_CNFG_GPIO_DRV_PUSHPULL		(1 << 0)
-#define MAX77620_CNFG_GPIO_DRV_OPENDRAIN	0
-#define MAX77620_CNFG_GPIO_DIR_MASK		(1 << 1)
-#define MAX77620_CNFG_GPIO_DIR_INPUT		(1 << 1)
-#define MAX77620_CNFG_GPIO_DIR_OUTPUT		0
-#define MAX77620_CNFG_GPIO_INPUT_VAL_MASK	(1 << 2)
-#define MAX77620_CNFG_GPIO_OUTPUT_VAL_MASK	(1 << 3)
-#define MAX77620_CNFG_GPIO_OUTPUT_VAL_HIGH	(1 << 3)
-#define MAX77620_CNFG_GPIO_OUTPUT_VAL_LOW	0
-#define MAX77620_CNFG_GPIO_INT_MASK		(0x3 << 4)
-#define MAX77620_CNFG_GPIO_INT_FALLING		(1 << 4)
-#define MAX77620_CNFG_GPIO_INT_RISING		(1 << 5)
-#define MAX77620_CNFG_GPIO_DBNC_MASK		(0x3 << 6)
-#define MAX77620_CNFG_GPIO_DBNC_None		(0x0 << 6)
-#define MAX77620_CNFG_GPIO_DBNC_8ms		(0x1 << 6)
-#define MAX77620_CNFG_GPIO_DBNC_16ms		(0x2 << 6)
-#define MAX77620_CNFG_GPIO_DBNC_32ms		(0x3 << 6)
-
-#define MAX77620_IRQ_LVL2_GPIO_EDGE0		(1 << 0)
-#define MAX77620_IRQ_LVL2_GPIO_EDGE1		(1 << 1)
-#define MAX77620_IRQ_LVL2_GPIO_EDGE2		(1 << 2)
-#define MAX77620_IRQ_LVL2_GPIO_EDGE3		(1 << 3)
-#define MAX77620_IRQ_LVL2_GPIO_EDGE4		(1 << 4)
-#define MAX77620_IRQ_LVL2_GPIO_EDGE5		(1 << 5)
-#define MAX77620_IRQ_LVL2_GPIO_EDGE6		(1 << 6)
-#define MAX77620_IRQ_LVL2_GPIO_EDGE7		(1 << 7)
-
-#define MAX77620_CNFG1_32K_OUT0_EN		(1 << 2)
-
-#define MAX77620_ONOFFCNFG1_SFT_RST		(1 << 7)
-#define MAX77620_ONOFFCNFG1_MRT_MASK		0x38
-#define MAX77620_ONOFFCNFG1_MRT_SHIFT		0x3
-#define MAX77620_ONOFFCNFG1_SLPEN		(1 << 2)
-#define MAX77620_ONOFFCNFG1_PWR_OFF		(1 << 1)
-#define MAX20024_ONOFFCNFG1_CLRSE		0x18
-
-#define MAX77620_ONOFFCNFG2_SFT_RST_WK		(1 << 7)
-#define MAX77620_ONOFFCNFG2_WD_RST_WK		(1 << 6)
-#define MAX77620_ONOFFCNFG2_SLP_LPM_MSK		(1 << 5)
-#define MAX77620_ONOFFCNFG2_WK_ALARM1		(1 << 2)
-#define MAX77620_ONOFFCNFG2_WK_EN0		(1 << 0)
-
-#define MAX77620_GLBLM_MASK			(1 << 0)
-
-#define MAX77620_WDTC_MASK			0x3
-#define MAX77620_WDTOFFC			(1 << 4)
-#define MAX77620_WDTSLPC			(1 << 3)
-#define MAX77620_WDTEN				(1 << 2)
-
-#define MAX77620_TWD_MASK			0x3
-#define MAX77620_TWD_2s				0x0
-#define MAX77620_TWD_16s			0x1
-#define MAX77620_TWD_64s			0x2
-#define MAX77620_TWD_128s			0x3
-
-#define MAX77620_CNFGGLBL1_LBDAC_EN		(1 << 7)
-#define MAX77620_CNFGGLBL1_MPPLD		(1 << 6)
-#define MAX77620_CNFGGLBL1_LBHYST		((1 << 5) | (1 << 4))
-#define MAX77620_CNFGGLBL1_LBHYST_N		(1 << 4)
-#define MAX77620_CNFGGLBL1_LBDAC		0x0E
-#define MAX77620_CNFGGLBL1_LBDAC_N		(1 << 1)
-#define MAX77620_CNFGGLBL1_LBRSTEN		(1 << 0)
-
-/* CNFG BBC registers */
-#define MAX77620_CNFGBBC_ENABLE			(1 << 0)
-#define MAX77620_CNFGBBC_CURRENT_MASK		0x06
-#define MAX77620_CNFGBBC_CURRENT_SHIFT		1
-#define MAX77620_CNFGBBC_VOLTAGE_MASK		0x18
-#define MAX77620_CNFGBBC_VOLTAGE_SHIFT		3
-#define MAX77620_CNFGBBC_LOW_CURRENT_DISABLE	(1 << 5)
-#define MAX77620_CNFGBBC_RESISTOR_MASK		0xC0
-#define MAX77620_CNFGBBC_RESISTOR_SHIFT		6
-
-#define MAX77620_FPS_COUNT			3
+#define MAX77620_IRQ_LVL2_GPIO_EDGE0          (1 << 0)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE1          (1 << 1)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE2          (1 << 2)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE3          (1 << 3)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE4          (1 << 4)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE5          (1 << 5)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE6          (1 << 6)
+#define MAX77620_IRQ_LVL2_GPIO_EDGE7          (1 << 7)
 
 /* Interrupts */
 enum {

bootloader/power/max7762x.c

@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2019 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -27,12 +28,15 @@ typedef struct _max77620_regulator_t
 	u8 type;
 	const char *name;
 	u8 reg_sd;
+
 	u32 mv_step;
 	u32 mv_min;
 	u32 mv_default;
 	u32 mv_max;
+
 	u8 volt_addr;
 	u8 cfg_addr;
+
 	u8 volt_mask;
 	u8 enable_mask;
 	u8 enable_shift;
@@ -45,19 +49,19 @@ typedef struct _max77620_regulator_t
 } max77620_regulator_t;
 
 static const max77620_regulator_t _pmic_regulators[] = {
-	{  REGULATOR_SD,  "sd0", 0x16, 12500, 600000,  625000, 1400000,      MAX77620_REG_SD0,   MAX77620_REG_SD0_CFG, 0x3F, 0x30, 4, 0x80, 0x4F, 1, 7, 1 },
-	{  REGULATOR_SD,  "sd1", 0x17, 12500, 600000, 1125000, 1125000,      MAX77620_REG_SD1,   MAX77620_REG_SD1_CFG, 0x3F, 0x30, 4, 0x40, 0x50, 0, 1, 5 },
-	{  REGULATOR_SD,  "sd2", 0x18, 12500, 600000, 1325000, 1350000,      MAX77620_REG_SD2,   MAX77620_REG_SD2_CFG, 0xFF, 0x30, 4, 0x20, 0x51, 1, 5, 2 },
-	{  REGULATOR_SD,  "sd3", 0x19, 12500, 600000, 1800000, 1800000,      MAX77620_REG_SD3,   MAX77620_REG_SD3_CFG, 0xFF, 0x30, 4, 0x10, 0x52, 0, 3, 3 },
-	{ REGULATOR_LDO, "ldo0", 0x00, 25000, 800000, 1200000, 1200000, MAX77620_REG_LDO0_CFG, MAX77620_REG_LDO0_CFG2, 0x3F, 0xC0, 6, 0x00, 0x46, 3, 7, 0 },
-	{ REGULATOR_LDO, "ldo1", 0x00, 25000, 800000, 1050000, 1050000, MAX77620_REG_LDO1_CFG, MAX77620_REG_LDO1_CFG2, 0x3F, 0xC0, 6, 0x00, 0x47, 3, 7, 0 },
-	{ REGULATOR_LDO, "ldo2", 0x00, 50000, 800000, 1800000, 3300000, MAX77620_REG_LDO2_CFG, MAX77620_REG_LDO2_CFG2, 0x3F, 0xC0, 6, 0x00, 0x48, 3, 7, 0 },
-	{ REGULATOR_LDO, "ldo3", 0x00, 50000, 800000, 3100000, 3100000, MAX77620_REG_LDO3_CFG, MAX77620_REG_LDO3_CFG2, 0x3F, 0xC0, 6, 0x00, 0x49, 3, 7, 0 },
-	{ REGULATOR_LDO, "ldo4", 0x00, 12500, 800000,  850000,  850000, MAX77620_REG_LDO4_CFG, MAX77620_REG_LDO4_CFG2, 0x3F, 0xC0, 6, 0x00, 0x4A, 0, 7, 1 },
-	{ REGULATOR_LDO, "ldo5", 0x00, 50000, 800000, 1800000, 1800000, MAX77620_REG_LDO5_CFG, MAX77620_REG_LDO5_CFG2, 0x3F, 0xC0, 6, 0x00, 0x4B, 3, 7, 0 },
-	{ REGULATOR_LDO, "ldo6", 0x00, 50000, 800000, 2900000, 2900000, MAX77620_REG_LDO6_CFG, MAX77620_REG_LDO6_CFG2, 0x3F, 0xC0, 6, 0x00, 0x4C, 3, 7, 0 },
-	{ REGULATOR_LDO, "ldo7", 0x00, 50000, 800000, 1050000, 1050000, MAX77620_REG_LDO7_CFG, MAX77620_REG_LDO7_CFG2, 0x3F, 0xC0, 6, 0x00, 0x4D, 1, 4, 3 },
-	{ REGULATOR_LDO, "ldo8", 0x00, 50000, 800000, 1050000, 1050000, MAX77620_REG_LDO8_CFG, MAX77620_REG_LDO8_CFG2, 0x3F, 0xC0, 6, 0x00, 0x4E, 3, 7, 0 }
+	{  REGULATOR_SD,  "sd0", 0x16,  12500, 600000,  625000, 1400000,      MAX77620_REG_SD0,   MAX77620_REG_SD0_CFG, MAX77620_SD0_VOLT_MASK, MAX77620_SD_POWER_MODE_MASK,  MAX77620_SD_POWER_MODE_SHIFT,  0x80,  MAX77620_REG_FPS_SD0,  1, 7, 1 },
+	{  REGULATOR_SD,  "sd1", 0x17,  12500, 600000, 1125000, 1125000,      MAX77620_REG_SD1,   MAX77620_REG_SD1_CFG, MAX77620_SD1_VOLT_MASK, MAX77620_SD_POWER_MODE_MASK,  MAX77620_SD_POWER_MODE_SHIFT,  0x40,  MAX77620_REG_FPS_SD1,  0, 1, 5 },
+	{  REGULATOR_SD,  "sd2", 0x18,  12500, 600000, 1325000, 1350000,      MAX77620_REG_SD2,   MAX77620_REG_SD2_CFG, MAX77620_SDX_VOLT_MASK, MAX77620_SD_POWER_MODE_MASK,  MAX77620_SD_POWER_MODE_SHIFT,  0x20,  MAX77620_REG_FPS_SD2,  1, 5, 2 },
+	{  REGULATOR_SD,  "sd3", 0x19,  12500, 600000, 1800000, 1800000,      MAX77620_REG_SD3,   MAX77620_REG_SD3_CFG, MAX77620_SDX_VOLT_MASK, MAX77620_SD_POWER_MODE_MASK,  MAX77620_SD_POWER_MODE_SHIFT,  0x10,  MAX77620_REG_FPS_SD3,  0, 3, 3 },
+	{ REGULATOR_LDO, "ldo0", 0x00,  25000, 800000, 1200000, 1200000, MAX77620_REG_LDO0_CFG, MAX77620_REG_LDO0_CFG2, MAX77620_LDO_VOLT_MASK, MAX77620_LDO_POWER_MODE_MASK, MAX77620_LDO_POWER_MODE_SHIFT, 0x00,  MAX77620_REG_FPS_LDO0, 3, 7, 0 },
+	{ REGULATOR_LDO, "ldo1", 0x00,  25000, 800000, 1050000, 1050000, MAX77620_REG_LDO1_CFG, MAX77620_REG_LDO1_CFG2, MAX77620_LDO_VOLT_MASK, MAX77620_LDO_POWER_MODE_MASK, MAX77620_LDO_POWER_MODE_SHIFT, 0x00,  MAX77620_REG_FPS_LDO1, 3, 7, 0 },
+	{ REGULATOR_LDO, "ldo2", 0x00,  50000, 800000, 1800000, 3300000, MAX77620_REG_LDO2_CFG, MAX77620_REG_LDO2_CFG2, MAX77620_LDO_VOLT_MASK, MAX77620_LDO_POWER_MODE_MASK, MAX77620_LDO_POWER_MODE_SHIFT, 0x00,  MAX77620_REG_FPS_LDO2, 3, 7, 0 },
+	{ REGULATOR_LDO, "ldo3", 0x00,  50000, 800000, 3100000, 3100000, MAX77620_REG_LDO3_CFG, MAX77620_REG_LDO3_CFG2, MAX77620_LDO_VOLT_MASK, MAX77620_LDO_POWER_MODE_MASK, MAX77620_LDO_POWER_MODE_SHIFT, 0x00,  MAX77620_REG_FPS_LDO3, 3, 7, 0 },
+	{ REGULATOR_LDO, "ldo4", 0x00,  12500, 800000,  850000,  850000, MAX77620_REG_LDO4_CFG, MAX77620_REG_LDO4_CFG2, MAX77620_LDO_VOLT_MASK, MAX77620_LDO_POWER_MODE_MASK, MAX77620_LDO_POWER_MODE_SHIFT, 0x00,  MAX77620_REG_FPS_LDO4, 0, 7, 1 },
+	{ REGULATOR_LDO, "ldo5", 0x00,  50000, 800000, 1800000, 1800000, MAX77620_REG_LDO5_CFG, MAX77620_REG_LDO5_CFG2, MAX77620_LDO_VOLT_MASK, MAX77620_LDO_POWER_MODE_MASK, MAX77620_LDO_POWER_MODE_SHIFT, 0x00,  MAX77620_REG_FPS_LDO5, 3, 7, 0 },
+	{ REGULATOR_LDO, "ldo6", 0x00,  50000, 800000, 2900000, 2900000, MAX77620_REG_LDO6_CFG, MAX77620_REG_LDO6_CFG2, MAX77620_LDO_VOLT_MASK, MAX77620_LDO_POWER_MODE_MASK, MAX77620_LDO_POWER_MODE_SHIFT, 0x00,  MAX77620_REG_FPS_LDO6, 3, 7, 0 },
+	{ REGULATOR_LDO, "ldo7", 0x00,  50000, 800000, 1050000, 1050000, MAX77620_REG_LDO7_CFG, MAX77620_REG_LDO7_CFG2, MAX77620_LDO_VOLT_MASK, MAX77620_LDO_POWER_MODE_MASK, MAX77620_LDO_POWER_MODE_SHIFT, 0x00,  MAX77620_REG_FPS_LDO7, 1, 4, 3 },
+	{ REGULATOR_LDO, "ldo8", 0x00,  50000, 800000, 1050000, 1050000, MAX77620_REG_LDO8_CFG, MAX77620_REG_LDO8_CFG2, MAX77620_LDO_VOLT_MASK, MAX77620_LDO_POWER_MODE_MASK, MAX77620_LDO_POWER_MODE_SHIFT, 0x00,  MAX77620_REG_FPS_LDO8, 3, 7, 0 }
 };
 
 int max77620_regulator_get_status(u32 id)
@@ -68,8 +72,8 @@ int max77620_regulator_get_status(u32 id)
 	const max77620_regulator_t *reg = &_pmic_regulators[id];
 
 	if (reg->type == REGULATOR_SD)
-		return (i2c_recv_byte(I2C_5, 0x3C, MAX77620_REG_STATSD) & reg->status_mask) ? 0 : 1;
-	return (i2c_recv_byte(I2C_5, 0x3C, reg->cfg_addr) & 8) ? 1 : 0;
+		return (i2c_recv_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_STATSD) & reg->status_mask) ? 0 : 1;
+	return (i2c_recv_byte(I2C_5, MAX77620_I2C_ADDR, reg->cfg_addr) & 8) ? 1 : 0;
 }
 
 int max77620_regulator_config_fps(u32 id)
@@ -79,7 +83,8 @@ int max77620_regulator_config_fps(u32 id)
 
 	const max77620_regulator_t *reg = &_pmic_regulators[id];
 
-	i2c_send_byte(I2C_5, 0x3C, reg->fps_addr, (reg->fps_src << 6) | (reg->pu_period << 3) | (reg->pd_period));
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, reg->fps_addr,
+		(reg->fps_src << MAX77620_FPS_SRC_SHIFT) | (reg->pu_period << MAX77620_FPS_PU_PERIOD_SHIFT) | (reg->pd_period));
 
 	return 1;
 }
@@ -91,13 +96,13 @@ int max77620_regulator_set_voltage(u32 id, u32 mv)
 
 	const max77620_regulator_t *reg = &_pmic_regulators[id];
 
-	if (mv < reg->mv_default || mv > reg->mv_max)
+	if (mv < reg->mv_min || mv > reg->mv_max)
 		return 0;
 
 	u32 mult = (mv + reg->mv_step - 1 - reg->mv_min) / reg->mv_step;
-	u8 val = i2c_recv_byte(I2C_5, 0x3C, reg->volt_addr);
+	u8 val = i2c_recv_byte(I2C_5, MAX77620_I2C_ADDR, reg->volt_addr);
 	val = (val & ~reg->volt_mask) | (mult & reg->volt_mask);
-	i2c_send_byte(I2C_5, 0x3C, reg->volt_addr, val);
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, reg->volt_addr, val);
 	usleep(1000);
 
 	return 1;
@@ -111,12 +116,30 @@ int max77620_regulator_enable(u32 id, int enable)
 	const max77620_regulator_t *reg = &_pmic_regulators[id];
 
 	u32 addr = reg->type == REGULATOR_SD ? reg->cfg_addr : reg->volt_addr;
-	u8 val = i2c_recv_byte(I2C_5, 0x3C, addr);
+	u8 val = i2c_recv_byte(I2C_5, MAX77620_I2C_ADDR, addr);
 	if (enable)
-		val = (val & ~reg->enable_mask) | ((3 << reg->enable_shift) & reg->enable_mask);
+		val = (val & ~reg->enable_mask) | ((MAX77620_POWER_MODE_NORMAL << reg->enable_shift) & reg->enable_mask);
 	else
 		val &= ~reg->enable_mask;
-	i2c_send_byte(I2C_5, 0x3C, addr, val);
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, addr, val);
+	usleep(1000);
+
+	return 1;
+}
+
+int max77620_regulator_set_volt_and_flags(u32 id, u32 mv, u8 flags)
+{
+	if (id > REGULATOR_MAX)
+		return 0;
+
+	const max77620_regulator_t *reg = &_pmic_regulators[id];
+
+	if (mv < reg->mv_min || mv > reg->mv_max)
+		return 0;
+
+	u32 mult = (mv + reg->mv_step - 1 - reg->mv_min) / reg->mv_step;
+	u8 val = ((flags << reg->enable_shift) & ~reg->volt_mask) | (mult & reg->volt_mask);
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, reg->volt_addr, val);
 	usleep(1000);
 
 	return 1;
@@ -126,16 +149,17 @@ void max77620_config_default()
 {
 	for (u32 i = 1; i <= REGULATOR_MAX; i++)
 	{
-		i2c_recv_byte(I2C_5, 0x3C, MAX77620_REG_CID4);
+		i2c_recv_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_CID4);
 		max77620_regulator_config_fps(i);
 		max77620_regulator_set_voltage(i, _pmic_regulators[i].mv_default);
 		if (_pmic_regulators[i].fps_src != MAX77620_FPS_SRC_NONE)
 			max77620_regulator_enable(i, 1);
 	}
-	i2c_send_byte(I2C_5, 0x3C, MAX77620_REG_SD_CFG2, 4);
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_SD_CFG2, 4);
 }
 
 void max77620_low_battery_monitor_config()
 {
-	i2c_send_byte(I2C_5, 0x3C, MAX77620_REG_CNFGGLBL1, MAX77620_CNFGGLBL1_LBDAC_EN | MAX77620_CNFGGLBL1_LBHYST_N | MAX77620_CNFGGLBL1_LBDAC_N);
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_CNFGGLBL1,
+		MAX77620_CNFGGLBL1_LBDAC_EN | MAX77620_CNFGGLBL1_LBHYST_N | MAX77620_CNFGGLBL1_LBDAC_N);
 }

bootloader/power/max7762x.h

@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2019 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -30,10 +31,10 @@
 *  ldo0 | Display Panel | 25000   | 800000 | 1200000    | 1200000 | 1.2V   (pkg1.1)
 *  ldo1 | XUSB, PCIE    | 25000   | 800000 | 1050000    | 1050000 | 1.05V  (pcv)
 *  ldo2 | SDMMC1        | 50000   | 800000 | 1800000    | 3300000 |
-*  ldo3 |               | 50000   | 800000 | 3100000    | 3100000 |
+*  ldo3 | GC ASIC       | 50000   | 800000 | 3100000    | 3100000 | 3.1V  (pcv)
 *  ldo4 | RTC           | 12500   | 800000 |  850000    |  850000 |
-*  ldo5 |               | 50000   | 800000 | 1800000    | 1800000 |
-*  ldo6 |               | 50000   | 800000 | 2900000    | 2900000 |
+*  ldo5 | GC ASIC       | 50000   | 800000 | 1800000    | 1800000 | 1.8V  (pcv)
+*  ldo6 | Touch, ALS    | 50000   | 800000 | 2900000    | 2900000 | 2.9V
 *  ldo7 | XUSB          | 50000   | 800000 | 1050000    | 1050000 |
 *  ldo8 | XUSB, DC      | 50000   | 800000 | 1050000    | 1050000 |
 */
@@ -59,10 +60,56 @@
 #define REGULATOR_LDO8 12
 #define REGULATOR_MAX 12
 
+#define MAX77621_CPU_I2C_ADDR 0x1B
+#define MAX77621_GPU_I2C_ADDR 0x1C
+
+#define MAX77621_VOUT_REG 0
+#define MAX77621_VOUT_DVC_REG 1
+#define MAX77621_CONTROL1_REG 2
+#define MAX77621_CONTROL2_REG 3
+
+/* MAX77621_VOUT */
+#define MAX77621_VOUT_ENABLE  (1 << 7)
+#define MAX77621_VOUT_MASK    0x7F
+
+/* MAX77621_VOUT_DVC_DVS */
+#define MAX77621_DVS_VOUT_MASK 0x7F
+
+/* MAX77621_CONTROL1 */
+#define MAX77621_SNS_ENABLE        (1 << 7)
+#define MAX77621_FPWM_EN_M         (1 << 6)
+#define MAX77621_NFSR_ENABLE       (1 << 5)
+#define MAX77621_AD_ENABLE         (1 << 4)
+#define MAX77621_BIAS_ENABLE       (1 << 3)
+#define MAX77621_FREQSHIFT_9PER    (1 << 2)
+
+#define MAX77621_RAMP_12mV_PER_US  0x0
+#define MAX77621_RAMP_25mV_PER_US  0x1
+#define MAX77621_RAMP_50mV_PER_US  0x2
+#define MAX77621_RAMP_200mV_PER_US 0x3
+#define MAX77621_RAMP_MASK         0x3
+
+/* MAX77621_CONTROL2 */
+#define MAX77621_WDTMR_ENABLE    (1 << 6)
+#define MAX77621_DISCH_ENBABLE   (1 << 5)
+#define MAX77621_FT_ENABLE		 (1 << 4)
+#define MAX77621_T_JUNCTION_120	 (1 << 7)
+
+#define MAX77621_CKKADV_TRIP_DISABLE              0xC
+#define MAX77621_CKKADV_TRIP_75mV_PER_US          0x0
+#define MAX77621_CKKADV_TRIP_150mV_PER_US         0x4
+#define MAX77621_CKKADV_TRIP_75mV_PER_US_HIST_DIS 0x8
+
+#define MAX77621_INDUCTOR_MIN_30_PER  0x0
+#define MAX77621_INDUCTOR_NOMINAL     0x1
+#define MAX77621_INDUCTOR_PLUS_30_PER 0x2
+#define MAX77621_INDUCTOR_PLUS_60_PER 0x3
+
 int max77620_regulator_get_status(u32 id);
 int max77620_regulator_config_fps(u32 id);
 int max77620_regulator_set_voltage(u32 id, u32 mv);
 int max77620_regulator_enable(u32 id, int enable);
+int max77620_regulator_set_volt_and_flags(u32 id, u32 mv, u8 flags);
 void max77620_config_default();
 void max77620_low_battery_monitor_config();
 

bootloader/rtc/max77620-rtc.c

@@ -0,0 +1,77 @@
+/*
+ * PMIC Real Time Clock driver for Nintendo Switch's MAX77620-RTC
+ *
+ * Copyright (c) 2018 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "max77620-rtc.h"
+#include "../soc/i2c.h"
+#include "../utils/util.h"
+
+void max77620_rtc_get_time(rtc_time_t *time)
+{
+	u8 val = 0;
+
+	// Update RTC regs from RTC clock.
+	i2c_send_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_RTC_UPDATE0_REG, MAX77620_RTC_READ_UPDATE);
+
+	// Get control reg config.
+	val = i2c_recv_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_RTC_CONTROL_REG);
+	// TODO: Check for binary format also?
+
+	// Get time.
+	time->sec  = i2c_recv_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_RTC_SEC_REG) & 0x7F;
+	time->min  = i2c_recv_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_RTC_MIN_REG) & 0x7F;
+
+	time->hour = i2c_recv_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_RTC_HOUR_REG) & 0x1F;
+	
+	if (!(val & MAX77620_RTC_24H) && time->hour & MAX77620_RTC_HOUR_PM_MASK)
+		time->hour = (time->hour & 0xF) + 12;
+
+	// Get day of week. 1: Monday to 7: Sunday.
+	time->weekday = 0;
+	val = i2c_recv_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_RTC_WEEKDAY_REG);
+	for (int i = 0; i < 8; i++)
+	{
+		time->weekday++;
+		if (val & 1)
+			break;
+		val >>= 1;
+	}
+
+	// Get date.
+	time->date  = i2c_recv_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_RTC_DATE_REG) & 0x1f;
+	time->month = (i2c_recv_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_RTC_MONTH_REG) & 0xF) - 1;
+	time->year  = (i2c_recv_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_RTC_YEAR_REG) & 0x7F) + 2000;
+}
+
+void max77620_rtc_stop_alarm()
+{
+	u8 val = 0;
+
+	// Update RTC regs from RTC clock.
+	i2c_send_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_RTC_UPDATE0_REG, MAX77620_RTC_READ_UPDATE);
+
+	// Stop alarm for both ALARM1 and ALARM2. Horizon uses ALARM2.
+	for (int i = 0; i < (MAX77620_RTC_NR_TIME_REGS * 2); i++)
+	{
+		val = i2c_recv_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_ALARM1_SEC_REG + i);
+		val &= ~MAX77620_RTC_ALARM_EN_MASK;
+		i2c_send_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_ALARM1_SEC_REG + i, val);
+	}
+
+	// Update RTC clock from RTC regs.
+	i2c_send_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_RTC_UPDATE0_REG, MAX77620_RTC_WRITE_UPDATE);
+}

bootloader/rtc/max77620-rtc.h

@@ -0,0 +1,75 @@
+/*
+ * PMIC Real Time Clock driver for Nintendo Switch's MAX77620-RTC
+ *
+ * Copyright (c) 2018 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _MFD_MAX77620_RTC_H_
+#define _MFD_MAX77620_RTC_H_
+
+#include "../utils/types.h"
+
+#define MAX77620_RTC_I2C_ADDR       0x68
+
+#define MAX77620_RTC_NR_TIME_REGS   7
+
+#define MAX77620_RTC_CONTROLM_REG   0x02
+#define MAX77620_RTC_CONTROL_REG    0x03
+#define  MAX77620_RTC_BIN_FORMAT (1 << 0)
+#define  MAX77620_RTC_24H        (1 << 1)
+
+#define MAX77620_RTC_UPDATE0_REG    0x04
+#define  MAX77620_RTC_WRITE_UPDATE  (1 << 0)
+#define  MAX77620_RTC_READ_UPDATE   (1 << 4)
+
+#define MAX77620_RTC_SEC_REG        0x07
+#define MAX77620_RTC_MIN_REG        0x08
+#define MAX77620_RTC_HOUR_REG       0x09
+#define  MAX77620_RTC_HOUR_PM_MASK  (1 << 6)
+#define MAX77620_RTC_WEEKDAY_REG    0x0A
+#define MAX77620_RTC_MONTH_REG      0x0B
+#define MAX77620_RTC_YEAR_REG       0x0C
+#define MAX77620_RTC_DATE_REG       0x0D
+
+#define MAX77620_ALARM1_SEC_REG     0x0E
+#define MAX77620_ALARM1_MIN_REG     0x0F
+#define MAX77620_ALARM1_HOUR_REG    0x10
+#define MAX77620_ALARM1_WEEKDAY_REG 0x11
+#define MAX77620_ALARM1_MONTH_REG   0x12
+#define MAX77620_ALARM1_YEAR_REG    0x13
+#define MAX77620_ALARM1_DATE_REG    0x14
+#define MAX77620_ALARM2_SEC_REG     0x15
+#define MAX77620_ALARM2_MIN_REG     0x16
+#define MAX77620_ALARM2_HOUR_REG    0x17
+#define MAX77620_ALARM2_WEEKDAY_REG 0x18
+#define MAX77620_ALARM2_MONTH_REG   0x19
+#define MAX77620_ALARM2_YEAR_REG    0x1A
+#define MAX77620_ALARM2_DATE_REG    0x1B
+#define  MAX77620_RTC_ALARM_EN_MASK	(1 << 7)
+
+typedef struct _rtc_time_t {
+	u8  weekday;
+	u8  sec;
+	u8  min;
+	u8  hour;
+	u8  date;
+	u8  month;
+	u16 year;
+} rtc_time_t;
+
+void max77620_rtc_get_time(rtc_time_t *time);
+void max77620_rtc_stop_alarm();
+
+#endif /* _MFD_MAX77620_RTC_H_ */

bootloader/sec/se.c

@@ -36,7 +36,7 @@ static void _gf256_mul_x(void *block)
 	u8 *pdata = (u8 *)block;
 	u32 carry = 0;
 
-	for (u32 i = 0xF; i >= 0; i--)
+	for (int i = 0xF; i >= 0; i--)
 	{
 		u8 b = pdata[i];
 		pdata[i] = (b << 1) | carry;
@@ -167,7 +167,9 @@ int se_aes_unwrap_key(u32 ks_dst, u32 ks_src, const void *input)
 {
 	SE(SE_CONFIG_REG_OFFSET) = SE_CONFIG_DEC_ALG(ALG_AES_DEC) | SE_CONFIG_DST(DST_KEYTAB);
 	SE(SE_CRYPTO_REG_OFFSET) = SE_CRYPTO_KEY_INDEX(ks_src) | SE_CRYPTO_CORE_SEL(CORE_DECRYPT);
+	SE(SE_BLOCK_COUNT_REG_OFFSET) = 0;
 	SE(SE_CRYPTO_KEYTABLE_DST_REG_OFFSET) = SE_CRYPTO_KEYTABLE_DST_KEY_INDEX(ks_dst);
+
 	return _se_execute(OP_START, NULL, 0, input, 0x10);
 }
 
@@ -268,15 +270,15 @@ int se_calc_sha256(void *dst, const void *src, u32 src_size)
 	int res;
 	// Setup config for SHA256, size = BITS(src_size).
 	SE(SE_CONFIG_REG_OFFSET) = SE_CONFIG_ENC_MODE(MODE_SHA256) | SE_CONFIG_ENC_ALG(ALG_SHA) | SE_CONFIG_DST(DST_HASHREG);
-	SE(SE_SHA_CONFIG_REG_OFFSET) = 1;
+	SE(SE_SHA_CONFIG_REG_OFFSET) = SHA_ENABLE;
 	SE(SE_SHA_MSG_LENGTH_REG_OFFSET) = (u32)(src_size << 3);
-	SE(0x208) = 0;
-	SE(0x20C) = 0;
-	SE(0x210) = 0;
+	SE(SE_SHA_MSG_LENGTH_REG_OFFSET + 4 * 1) = 0;
+	SE(SE_SHA_MSG_LENGTH_REG_OFFSET + 4 * 2) = 0;
+	SE(SE_SHA_MSG_LENGTH_REG_OFFSET + 4 * 3) = 0;
 	SE(SE_SHA_MSG_LEFT_REG_OFFSET) = (u32)(src_size << 3);
-	SE(0x218) = 0;
-   	SE(0x21C) = 0;
-	SE(0x220) = 0;
+	SE(SE_SHA_MSG_LEFT_REG_OFFSET + 4 * 1) = 0;
+	SE(SE_SHA_MSG_LEFT_REG_OFFSET + 4 * 2) = 0;
+	SE(SE_SHA_MSG_LEFT_REG_OFFSET + 4 * 3) = 0;
 
 	// Trigger the operation.
 	res = _se_execute(OP_START, NULL, 0, src, src_size);

bootloader/sec/tsec.c

@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018-2019 CTCaer
+ * Copyright (c) 2018 balika011
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -17,16 +19,23 @@
 #include <string.h>
 
 #include "../sec/tsec.h"
+#include "../sec/tsec_t210.h"
+#include "../sec/se_t210.h"
 #include "../soc/clock.h"
+#include "../soc/smmu.h"
 #include "../soc/t210.h"
 #include "../mem/heap.h"
+#include "../mem/mc.h"
 #include "../utils/util.h"
+#include "../hos/hos.h"
+
+// #include "../gfx/gfx.h"
 
 static int _tsec_dma_wait_idle()
 {
 	u32 timeout = get_tmr_ms() + 10000;
 
-	while (!(TSEC(0x1118) & 2))
+	while (!(TSEC(TSEC_DMATRFCMD) & TSEC_DMATRFCMD_IDLE))
 		if (get_tmr_ms() > timeout)
 			return 0;
 
@@ -38,20 +47,23 @@ static int _tsec_dma_pa_to_internal_100(int not_imem, int i_offset, int pa_offse
 	u32 cmd;
 
 	if (not_imem)
-		cmd = 0x600; // DMA 0x100 bytes
+		cmd = TSEC_DMATRFCMD_SIZE_256B; // DMA 256 bytes
 	else
-		cmd = 0x10; // dma imem
+		cmd = TSEC_DMATRFCMD_IMEM;      // DMA IMEM (Instruction memmory)
 
-	TSEC(0x1114) = i_offset; // tsec_dmatrfmoffs_r
-	TSEC(0x111C) = pa_offset; // tsec_dmatrffboffs_r
-	TSEC(0x1118) = cmd; // tsec_dmatrfcmd_r
+	TSEC(TSEC_DMATRFMOFFS) = i_offset;
+	TSEC(TSEC_DMATRFFBOFFS) = pa_offset;
+	TSEC(TSEC_DMATRFCMD) = cmd;
 
 	return _tsec_dma_wait_idle();
 }
 
-int tsec_query(u8 *dst, u32 rev, void *fw)
+int tsec_query(u8 *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 {
 	int res = 0;
+	u8 *fwbuf = NULL;
+	u32 *pdir, *car, *fuse, *pmc, *flowctrl, *se, *mc, *iram, *evec;
+	u32 *pkg11_magic_off;
 
 	//Enable clocks.
 	clock_enable_host1x();
@@ -62,64 +74,193 @@ int tsec_query(u8 *dst, u32 rev, void *fw)
 	clock_enable_kfuse();
 
 	//Configure Falcon.
-	TSEC(0x110C) = 0; // tsec_dmactl_r
-	TSEC(0x1010) = 0xFFF2; // tsec_irqmset_r
-	TSEC(0x101C) = 0xFFF0; // tsec_irqdest_r
-	TSEC(0x1048) = 3; // tsec_itfen_r
+	TSEC(TSEC_DMACTL) = 0;
+	TSEC(TSEC_IRQMSET) =
+		TSEC_IRQMSET_EXT(0xFF) |
+		TSEC_IRQMSET_WDTMR |
+		TSEC_IRQMSET_HALT |
+		TSEC_IRQMSET_EXTERR |
+		TSEC_IRQMSET_SWGEN0 |
+		TSEC_IRQMSET_SWGEN1;
+	TSEC(TSEC_IRQDEST) =
+		TSEC_IRQDEST_EXT(0xFF) |
+		TSEC_IRQDEST_HALT |
+		TSEC_IRQDEST_EXTERR |
+		TSEC_IRQDEST_SWGEN0 |
+		TSEC_IRQDEST_SWGEN1;
+	TSEC(TSEC_ITFEN) = TSEC_ITFEN_CTXEN | TSEC_ITFEN_MTHDEN;
 	if (!_tsec_dma_wait_idle())
 	{
 		res = -1;
 		goto out;
 	}
 
-	//Load firmware.
-	u8 *fwbuf = (u8 *)malloc(0x2000);
-	u8 *fwbuf_aligned = (u8 *)ALIGN((u32)fwbuf + 0x1000, 0x100);
-	memcpy(fwbuf_aligned, fw, 0xF00);
-	TSEC(0x1110) = (u32)fwbuf_aligned >> 8;// tsec_dmatrfbase_r
-	for (u32 addr = 0; addr < 0xF00; addr += 0x100)
-		if (!_tsec_dma_pa_to_internal_100(0, addr, addr))
+	//Load firmware or emulate memio environment for newer TSEC fw.
+	if (kb == KB_FIRMWARE_VERSION_620)
+		TSEC(TSEC_DMATRFBASE) = (u32)tsec_ctxt->fw >> 8;
+	else
+	{
+		fwbuf = (u8 *)malloc(0x4000);
+		u8 *fwbuf_aligned = (u8 *)ALIGN((u32)fwbuf, 0x100);
+		memcpy(fwbuf_aligned, tsec_ctxt->fw, tsec_ctxt->size);
+		TSEC(TSEC_DMATRFBASE) = (u32)fwbuf_aligned >> 8;
+	}
+
+	for (u32 addr = 0; addr < tsec_ctxt->size; addr += 0x100)
+	{
+		if (!_tsec_dma_pa_to_internal_100(false, addr, addr))
 		{
 			res = -2;
 			goto out_free;
 		}
+	}
+
+	if (kb == KB_FIRMWARE_VERSION_620)
+	{
+		// Init SMMU translation for TSEC.
+		pdir = smmu_init_for_tsec();
+		smmu_init(tsec_ctxt->secmon_base);
+		// Enable SMMU
+		if (!smmu_is_used())
+			smmu_enable();
+
+		// Clock reset controller.
+		car = page_alloc(1);
+		memcpy(car, (void *)CLOCK_BASE, 0x1000);
+		car[CLK_RST_CONTROLLER_CLK_SOURCE_TSEC / 4] = 2;
+		smmu_map(pdir, CLOCK_BASE, (u32)car, 1, _WRITABLE | _READABLE | _NONSECURE);
+
+		// Fuse driver.
+		fuse = page_alloc(1);
+		memcpy((void *)&fuse[0x800/4], (void *)FUSE_BASE, 0x400);
+		fuse[0x82C / 4] = 0;
+		fuse[0x9E0 / 4] = (1 << (kb + 2)) - 1;
+		fuse[0x9E4 / 4] = (1 << (kb + 2)) - 1;
+		smmu_map(pdir, (FUSE_BASE - 0x800), (u32)fuse, 1, _READABLE | _NONSECURE);
+
+		// Power management controller.
+		pmc = page_alloc(1);
+		smmu_map(pdir, RTC_BASE, (u32)pmc, 1, _READABLE | _NONSECURE);
+
+		// Flow control.
+		flowctrl = page_alloc(1);
+		smmu_map(pdir, FLOW_CTLR_BASE, (u32)flowctrl, 1, _WRITABLE | _NONSECURE);
+
+		// Security engine.
+		se = page_alloc(1);
+		memcpy(se, (void *)SE_BASE, 0x1000);
+		smmu_map(pdir, SE_BASE, (u32)se, 1, _READABLE | _WRITABLE | _NONSECURE);
+		
+		// Memory controller.
+		mc = page_alloc(1);
+		memcpy(mc, (void *)MC_BASE, 0x1000);
+		mc[MC_IRAM_BOM / 4] = 0;
+		mc[MC_IRAM_TOM / 4] = 0x80000000;
+		smmu_map(pdir, MC_BASE, (u32)mc, 1, _READABLE | _NONSECURE);
+
+		// IRAM
+		iram = page_alloc(0x30);
+		memcpy(iram, tsec_ctxt->pkg1, 0x30000);
+		// PKG1.1 magic offset.
+		pkg11_magic_off = (u32 *)(iram + ((tsec_ctxt->pkg11_off + 0x20) / 4));
+		smmu_map(pdir, 0x40010000, (u32)iram, 0x30, _READABLE | _WRITABLE | _NONSECURE);
+
+		// Exception vectors
+		evec = page_alloc(1);
+		smmu_map(pdir, EXCP_VEC_BASE, (u32)evec, 1, _READABLE | _WRITABLE | _NONSECURE);
+	}
 
 	//Execute firmware.
 	HOST1X(0x3300) = 0x34C2E1DA;
-	TSEC(0x1044) = 0;
-	TSEC(0x1040) = rev;
-	TSEC(0x1104) = 0; // tsec_bootvec_r
-	TSEC(0x1100) = 2; // tsec_cpuctl_r
-	if (!_tsec_dma_wait_idle())
+	TSEC(TSEC_STATUS) = 0;
+	TSEC(TSEC_BOOTKEYVER) = 1; // HOS uses key version 1.
+	TSEC(TSEC_BOOTVEC) = 0;
+	TSEC(TSEC_CPUCTL) = TSEC_CPUCTL_STARTCPU;
+
+	if (kb == KB_FIRMWARE_VERSION_620)
 	{
-		res = -3;
-		goto out_free;
-	}
-	u32 timeout = get_tmr_ms() + 2000;
-	while (!TSEC(0x1044))
-		if (get_tmr_ms() > timeout)
+		u32 start = get_tmr_us();
+		u32 k = se[SE_KEYTABLE_DATA0_REG_OFFSET / 4];
+		u32 key[16] = {0};
+		u32 kidx = 0;
+
+		while (*pkg11_magic_off != HOS_PKG11_MAGIC)
 		{
-			res = -4;
+			smmu_flush_all();
+
+			if (k != se[SE_KEYTABLE_DATA0_REG_OFFSET / 4])
+			{
+				k = se[SE_KEYTABLE_DATA0_REG_OFFSET / 4];
+				key[kidx++] = k;
+			}
+
+			// Failsafe.
+			if ((u32)get_tmr_us() - start > 125000)
+				break;
+		}
+
+		if (kidx != 8)
+		{
+			res = -6;
+			smmu_deinit_for_tsec();
+
+			goto out;
+		}
+
+		// Give some extra time to make sure PKG1.1 is decrypted.
+		msleep(50);
+
+		memcpy(tsec_keys, &key, 0x20);
+		memcpy(tsec_ctxt->pkg1, iram, 0x30000);
+		
+		smmu_deinit_for_tsec();
+
+		// for (int i = 0; i < kidx; i++)
+		// 	gfx_printf("key %08X\n", key[i]);
+
+		// gfx_printf("cpuctl (%08X) mbox (%08X)\n", TSEC(TSEC_CPUCTL), TSEC(TSEC_STATUS));
+
+		// u32 errst = MC(MC_ERR_STATUS);
+		// gfx_printf(" MC %08X %08X %08X\n", MC(MC_INTSTATUS), errst, MC(MC_ERR_ADR));
+		// gfx_printf(" type: %02X\n", errst >> 28);
+		// gfx_printf(" smmu: %02X\n", (errst >> 25) & 3);
+		// gfx_printf(" dir:  %s\n", (errst >> 16) & 1 ? "W" : "R");
+		// gfx_printf(" cid:  %02x\n", errst & 0xFF);
+	}
+	else
+	{
+		if (!_tsec_dma_wait_idle())
+		{
+			res = -3;
+			goto out_free;
+		}
+		u32 timeout = get_tmr_ms() + 2000;
+		while (!TSEC(TSEC_STATUS))
+			if (get_tmr_ms() > timeout)
+			{
+				res = -4;
+				goto out_free;
+			}
+		if (TSEC(TSEC_STATUS) != 0xB0B0B0B0)
+		{
+			res = -5;
 			goto out_free;
 		}
-	if (TSEC(0x1044) != 0xB0B0B0B0)
-	{
-		res = -5;
-		goto out_free;
-	}
 
-	//Fetch result.
-	HOST1X(0x3300) = 0;
-	u32 buf[4];
-	buf[0] = SOR1(0x1E8);
-	buf[1] = SOR1(0x21C);
-	buf[2] = SOR1(0x208);
-	buf[3] = SOR1(0x20C);
-	SOR1(0x1E8) = 0;
-	SOR1(0x21C) = 0;
-	SOR1(0x208) = 0;
-	SOR1(0x20C) = 0;
-	memcpy(dst, &buf, 0x10);
+		//Fetch result.
+		HOST1X(0x3300) = 0;
+		u32 buf[4];
+		buf[0] = SOR1(SOR_NV_PDISP_SOR_DP_HDCP_BKSV_LSB);
+		buf[1] = SOR1(SOR_NV_PDISP_SOR_TMDS_HDCP_BKSV_LSB);
+		buf[2] = SOR1(SOR_NV_PDISP_SOR_TMDS_HDCP_CN_MSB);
+		buf[3] = SOR1(SOR_NV_PDISP_SOR_TMDS_HDCP_CN_LSB);
+		SOR1(SOR_NV_PDISP_SOR_DP_HDCP_BKSV_LSB) = 0;
+		SOR1(SOR_NV_PDISP_SOR_TMDS_HDCP_BKSV_LSB) = 0;
+		SOR1(SOR_NV_PDISP_SOR_TMDS_HDCP_CN_MSB) = 0;
+		SOR1(SOR_NV_PDISP_SOR_TMDS_HDCP_CN_LSB) = 0;
+
+		memcpy(tsec_keys, &buf, 0x10);
+	}
 
 out_free:;
 	free(fwbuf);

bootloader/sec/tsec.h

@@ -1,5 +1,6 @@
 /*
 * Copyright (c) 2018 naehrwert
+* Copyright (c) 2018 CTCaer
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@@ -19,6 +20,15 @@
 
 #include "../utils/types.h"
 
-int tsec_query(u8 *dst, u32 rev, void *fw);
+typedef struct _tsec_ctxt_t
+{
+	void *fw;
+	u32 size;
+	void *pkg1;
+	u32 pkg11_off;
+	u32 secmon_base;
+} tsec_ctxt_t;
+
+int tsec_query(u8 *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt);
 
 #endif

bootloader/sec/tsec_t210.h

@@ -0,0 +1,50 @@
+/*
+* Copyright (c) 2018 CTCaer
+*
+* This program is free software; you can redistribute it and/or modify it
+* under the terms and conditions of the GNU General Public License,
+* version 2, as published by the Free Software Foundation.
+*
+* This program is distributed in the hope it will be useful, but WITHOUT
+* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+* FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+* more details.
+*
+* You should have received a copy of the GNU General Public License
+* along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _TSEC_T210_H_
+#define _TSEC_T210_H_
+
+#define TSEC_BOOTKEYVER    0x1040
+#define TSEC_STATUS        0x1044
+#define TSEC_ITFEN         0x1048
+#define  TSEC_ITFEN_CTXEN         (1 << 0)
+#define  TSEC_ITFEN_MTHDEN        (1 << 1)
+#define TSEC_IRQMSET       0x1010
+#define  TSEC_IRQMSET_WDTMR       (1 << 1)
+#define  TSEC_IRQMSET_HALT        (1 << 4)
+#define  TSEC_IRQMSET_EXTERR      (1 << 5)
+#define  TSEC_IRQMSET_SWGEN0      (1 << 6)
+#define  TSEC_IRQMSET_SWGEN1      (1 << 7)
+#define  TSEC_IRQMSET_EXT(val)    (((val) & 0xFF) << 8)
+#define TSEC_IRQDEST       0x101C
+#define  TSEC_IRQDEST_HALT        (1 << 4)
+#define  TSEC_IRQDEST_EXTERR      (1 << 5)
+#define  TSEC_IRQDEST_SWGEN0      (1 << 6)
+#define  TSEC_IRQDEST_SWGEN1      (1 << 7)
+#define  TSEC_IRQDEST_EXT(val)    (((val) & 0xFF) << 8)
+#define TSEC_CPUCTL       0x1100
+#define  TSEC_CPUCTL_STARTCPU     (1 << 1)
+#define TSEC_BOOTVEC      0x1104
+#define TSEC_DMACTL       0x110C
+#define TSEC_DMATRFBASE   0x1110
+#define TSEC_DMATRFMOFFS  0x1114
+#define TSEC_DMATRFCMD    0x1118
+#define  TSEC_DMATRFCMD_IDLE      (1 << 1)
+#define  TSEC_DMATRFCMD_IMEM      (1 << 4)
+#define  TSEC_DMATRFCMD_SIZE_256B (6 << 8)
+#define TSEC_DMATRFFBOFFS 0x111C
+
+#endif

bootloader/soc/clock.c

@@ -19,34 +19,61 @@
 #include "../utils/util.h"
 #include "../storage/sdmmc.h"
 
+/* clock_t: reset, enable, source, index, clk_src, clk_div */
+
 static const clock_t _clock_uart[] = {
-	/* UART A */ { CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_UARTA, 6, 0, 0 },
-	/* UART B */ { CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_UARTB, 7, 0, 0 },
-	/* UART C */ { CLK_RST_CONTROLLER_RST_DEVICES_H, CLK_RST_CONTROLLER_CLK_OUT_ENB_H, CLK_RST_CONTROLLER_CLK_SOURCE_UARTC, 0x17, 0, 0 },
-	/* UART D */ { 0 },
-	/* UART E */ { 0 }
+/* UART A */ { CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_UARTA, 6,    0, 0 },
+/* UART B */ { CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_UARTB, 7,    0, 0 },
+/* UART C */ { CLK_RST_CONTROLLER_RST_DEVICES_H, CLK_RST_CONTROLLER_CLK_OUT_ENB_H, CLK_RST_CONTROLLER_CLK_SOURCE_UARTC, 0x17, 0, 0 },
+/* UART D */ { 0 },
+/* UART E */ { 0 }
 };
 
 static const clock_t _clock_i2c[] = {
-	/* I2C1 */ { CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_I2C1, 0xC, 6, 0 },
-	/* I2C2 */ { 0 },
-	/* I2C3 */ { 0 },
-	/* I2C4 */ { 0 },
-	/* I2C5 */ { CLK_RST_CONTROLLER_RST_DEVICES_H, CLK_RST_CONTROLLER_CLK_OUT_ENB_H, CLK_RST_CONTROLLER_CLK_SOURCE_I2C5, 0xF, 6, 0 },
-	/* I2C6 */ { 0 }
+/* I2C1 */ { CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_I2C1, 0xC, 6, 0 },
+/* I2C2 */ { 0 },
+/* I2C3 */ { 0 },
+/* I2C4 */ { 0 },
+/* I2C5 */ { CLK_RST_CONTROLLER_RST_DEVICES_H, CLK_RST_CONTROLLER_CLK_OUT_ENB_H, CLK_RST_CONTROLLER_CLK_SOURCE_I2C5, 0xF, 6, 0 },
+/* I2C6 */ { 0 }
 };
 
-static clock_t _clock_se = { CLK_RST_CONTROLLER_RST_DEVICES_V, CLK_RST_CONTROLLER_CLK_OUT_ENB_V, 0x42C, 0x1F, 0, 0 };
+static clock_t _clock_se = {
+	CLK_RST_CONTROLLER_RST_DEVICES_V, CLK_RST_CONTROLLER_CLK_OUT_ENB_V, CLK_RST_CONTROLLER_CLK_SOURCE_SE,     0x1F, 0, 0
+};
+static clock_t _clock_unk2 = {
+	CLK_RST_CONTROLLER_RST_DEVICES_V, CLK_RST_CONTROLLER_CLK_OUT_ENB_V, CLK_NO_SOURCE,                        0x1E, 0, 0
+};
 
-static clock_t _clock_host1x = { CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_HOST1X, 0x1C, 4, 3 };
-static clock_t _clock_tsec = { CLK_RST_CONTROLLER_RST_DEVICES_U, CLK_RST_CONTROLLER_CLK_OUT_ENB_U, CLK_RST_CONTROLLER_CLK_SOURCE_TSEC, 0x13, 0, 2 };
-static clock_t _clock_sor_safe = { CLK_RST_CONTROLLER_RST_DEVICES_Y, CLK_RST_CONTROLLER_CLK_OUT_ENB_Y, CLK_RST_CONTROLLER_RST_SOURCE, 0x1E, 0, 0 };
-static clock_t _clock_sor0 = { CLK_RST_CONTROLLER_RST_DEVICES_X, CLK_RST_CONTROLLER_CLK_OUT_ENB_X, CLK_RST_CONTROLLER_RST_SOURCE, 0x16, 0, 0 };
-static clock_t _clock_sor1 = { CLK_RST_CONTROLLER_RST_DEVICES_X, CLK_RST_CONTROLLER_CLK_OUT_ENB_X, CLK_RST_CONTROLLER_CLK_SOURCE_SOR1, 0x17, 0, 2 };
-static clock_t _clock_kfuse = { CLK_RST_CONTROLLER_RST_DEVICES_H, CLK_RST_CONTROLLER_CLK_OUT_ENB_H, CLK_RST_CONTROLLER_RST_SOURCE, 8, 0, 0 };
+static clock_t _clock_host1x = {
+	CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_HOST1X, 0x1C, 4, 3
+};
+static clock_t _clock_tsec = {
+	CLK_RST_CONTROLLER_RST_DEVICES_U, CLK_RST_CONTROLLER_CLK_OUT_ENB_U, CLK_RST_CONTROLLER_CLK_SOURCE_TSEC,   0x13, 0, 2
+};
+static clock_t _clock_sor_safe = {
+	CLK_RST_CONTROLLER_RST_DEVICES_Y, CLK_RST_CONTROLLER_CLK_OUT_ENB_Y, CLK_NO_SOURCE,                        0x1E, 0, 0
+};
+static clock_t _clock_sor0 = {
+	CLK_RST_CONTROLLER_RST_DEVICES_X, CLK_RST_CONTROLLER_CLK_OUT_ENB_X, CLK_NO_SOURCE,                        0x16, 0, 0
+};
+static clock_t _clock_sor1 = {
+	CLK_RST_CONTROLLER_RST_DEVICES_X, CLK_RST_CONTROLLER_CLK_OUT_ENB_X, CLK_RST_CONTROLLER_CLK_SOURCE_SOR1,   0x17, 0, 2
+};
+static clock_t _clock_kfuse = {
+	CLK_RST_CONTROLLER_RST_DEVICES_H, CLK_RST_CONTROLLER_CLK_OUT_ENB_H, CLK_NO_SOURCE,                        8,    0, 0
+};
 
-static clock_t _clock_cl_dvfs = { CLK_RST_CONTROLLER_RST_DEVICES_W, CLK_RST_CONTROLLER_CLK_OUT_ENB_W, CLK_RST_CONTROLLER_RST_SOURCE, 0x1B, 0, 0 };
-static clock_t _clock_coresight = { CLK_RST_CONTROLLER_RST_DEVICES_U, CLK_RST_CONTROLLER_CLK_OUT_ENB_U, CLK_RST_CONTROLLER_CLK_SOURCE_CSITE, 9, 0, 4};
+static clock_t _clock_cl_dvfs =	{
+	CLK_RST_CONTROLLER_RST_DEVICES_W, CLK_RST_CONTROLLER_CLK_OUT_ENB_W, CLK_NO_SOURCE,                        0x1B, 0, 0
+};
+static clock_t _clock_coresight = {
+	CLK_RST_CONTROLLER_RST_DEVICES_U, CLK_RST_CONTROLLER_CLK_OUT_ENB_U, CLK_RST_CONTROLLER_CLK_SOURCE_CSITE,     9, 0, 4
+};
+
+static clock_t _clock_pwm = {
+	CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_PWM,    0x11, 6, 4
+};
 
 void clock_enable(const clock_t *clk)
 {
@@ -71,7 +98,7 @@ void clock_disable(const clock_t *clk)
 	CLOCK(clk->enable) &= ~(1 << clk->index);
 }
 
-void clock_enable_fuse(u32 enable)
+void clock_enable_fuse(bool enable)
 {
 	CLOCK(CLK_RST_CONTROLLER_MISC_CLK_ENB) = (CLOCK(CLK_RST_CONTROLLER_MISC_CLK_ENB) & 0xEFFFFFFF) | ((enable & 1) << 28);
 }
@@ -86,11 +113,21 @@ void clock_enable_i2c(u32 idx)
 	clock_enable(&_clock_i2c[idx]);
 }
 
+void clock_disable_i2c(u32 idx)
+{
+	clock_disable(&_clock_i2c[idx]);
+}
+
 void clock_enable_se()
 {
 	clock_enable(&_clock_se);
 }
 
+void clock_enable_unk2()
+{
+	clock_enable(&_clock_unk2);
+}
+
 void clock_enable_host1x()
 {
 	clock_enable(&_clock_host1x);
@@ -144,11 +181,11 @@ void clock_disable_sor1()
 void clock_enable_kfuse()
 {
 	//clock_enable(&_clock_kfuse);
-	CLOCK(0x8) = (CLOCK(0x8) & 0xFFFFFEFF) | 0x100;
-	CLOCK(0x14) &= 0xFFFFFEFF;
-	CLOCK(0x14) = (CLOCK(0x14) & 0xFFFFFEFF) | 0x100;
+	CLOCK(CLK_RST_CONTROLLER_RST_DEVICES_H) = (CLOCK(CLK_RST_CONTROLLER_RST_DEVICES_H) & 0xFFFFFEFF) | 0x100;
+	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_H) &= 0xFFFFFEFF;
+	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_H) = (CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_H) & 0xFFFFFEFF) | 0x100;
 	usleep(10);
-	CLOCK(0x8) &= 0xFFFFFEFF;
+	CLOCK(CLK_RST_CONTROLLER_RST_DEVICES_H) &= 0xFFFFFEFF;
 	usleep(20);
 }
 
@@ -172,6 +209,21 @@ void clock_enable_coresight()
 	clock_enable(&_clock_coresight);
 }
 
+void clock_disable_coresight()
+{
+	clock_disable(&_clock_coresight);
+}
+
+void clock_enable_pwm()
+{
+	clock_enable(&_clock_pwm);
+}
+
+void clock_disable_pwm()
+{
+	clock_disable(&_clock_pwm);
+}
+
 #define L_SWR_SDMMC1_RST (1 << 14)
 #define L_SWR_SDMMC2_RST (1 << 9)
 #define L_SWR_SDMMC4_RST (1 << 15)
@@ -224,12 +276,16 @@ static void _clock_sdmmc_set_reset(u32 id)
 	{
 	case SDMMC_1:
 		CLOCK(CLK_RST_CONTROLLER_RST_DEV_L_SET) = L_SET_SDMMC1_RST;
+		break;
 	case SDMMC_2:
 		CLOCK(CLK_RST_CONTROLLER_RST_DEV_L_SET) = L_SET_SDMMC2_RST;
+		break;
 	case SDMMC_3:
 		CLOCK(CLK_RST_CONTROLLER_RST_DEV_U_SET) = U_SET_SDMMC3_RST;
+		break;
 	case SDMMC_4:
 		CLOCK(CLK_RST_CONTROLLER_RST_DEV_L_SET) = L_SET_SDMMC4_RST;
+		break;
 	}
 }
 
@@ -239,12 +295,16 @@ static void _clock_sdmmc_clear_reset(u32 id)
 	{
 	case SDMMC_1:
 		CLOCK(CLK_RST_CONTROLLER_RST_DEV_L_CLR) = L_CLR_SDMMC1_RST;
+		break;
 	case SDMMC_2:
 		CLOCK(CLK_RST_CONTROLLER_RST_DEV_L_CLR) = L_CLR_SDMMC2_RST;
+		break;
 	case SDMMC_3:
 		CLOCK(CLK_RST_CONTROLLER_RST_DEV_U_CLR) = U_CLR_SDMMC3_RST;
+		break;
 	case SDMMC_4:
 		CLOCK(CLK_RST_CONTROLLER_RST_DEV_L_CLR) = L_CLR_SDMMC4_RST;
+		break;
 	}
 }
 
@@ -270,12 +330,16 @@ static void _clock_sdmmc_set_enable(u32 id)
 	{
 	case SDMMC_1:
 		CLOCK(CLK_RST_CONTROLLER_CLK_ENB_L_SET) = L_SET_CLK_ENB_SDMMC1;
+		break;
 	case SDMMC_2:
 		CLOCK(CLK_RST_CONTROLLER_CLK_ENB_L_SET) = L_SET_CLK_ENB_SDMMC2;
+		break;
 	case SDMMC_3:
 		CLOCK(CLK_RST_CONTROLLER_CLK_ENB_U_SET) = U_SET_CLK_ENB_SDMMC3;
+		break;
 	case SDMMC_4:
 		CLOCK(CLK_RST_CONTROLLER_CLK_ENB_L_SET) = L_SET_CLK_ENB_SDMMC4;
+		break;
 	}
 }
 
@@ -285,12 +349,16 @@ static void _clock_sdmmc_clear_enable(u32 id)
 	{
 	case SDMMC_1:
 		CLOCK(CLK_RST_CONTROLLER_CLK_ENB_L_CLR) = L_CLR_CLK_ENB_SDMMC1;
+		break;
 	case SDMMC_2:
 		CLOCK(CLK_RST_CONTROLLER_CLK_ENB_L_CLR) = L_CLR_CLK_ENB_SDMMC2;
+		break;
 	case SDMMC_3:
 		CLOCK(CLK_RST_CONTROLLER_CLK_ENB_U_CLR) = U_CLR_CLK_ENB_SDMMC3;
+		break;
 	case SDMMC_4:
 		CLOCK(CLK_RST_CONTROLLER_CLK_ENB_L_CLR) = L_CLR_CLK_ENB_SDMMC4;
+		break;
 	}
 }
 
@@ -399,12 +467,13 @@ void clock_sdmmc_get_params(u32 *pout, u16 *pdivisor, u32 type)
 	case 3:
 	case 4:
 	case 11:
-		*pout = 200000;
+		*pout = 208000;
 		*pdivisor = 1;
 		break;
 	case 5:
 		*pout = 25000;
 		*pdivisor = 64;
+		break;
 	case 6:
 	case 8:
 		*pout = 25000;
@@ -413,9 +482,11 @@ void clock_sdmmc_get_params(u32 *pout, u16 *pdivisor, u32 type)
 	case 7:
 		*pout = 50000;
 		*pdivisor = 1;
+		break;
 	case 10:
 		*pout = 100000;
 		*pdivisor = 1;
+		break;
 	case 13:
 		*pout = 40800;
 		*pdivisor = 1;

bootloader/soc/clock.h

@@ -47,6 +47,7 @@
 #define CLK_RST_CONTROLLER_PLLE_MISC 0xEC
 #define CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRA 0xF8
 #define CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRB 0xFC
+#define CLK_RST_CONTROLLER_CLK_SOURCE_PWM 0x110
 #define CLK_RST_CONTROLLER_CLK_SOURCE_I2C1 0x124
 #define CLK_RST_CONTROLLER_CLK_SOURCE_I2C5 0x128
 #define CLK_RST_CONTROLLER_CLK_SOURCE_VI 0x148
@@ -57,6 +58,7 @@
 #define CLK_RST_CONTROLLER_CLK_SOURCE_UARTB 0x17C
 #define CLK_RST_CONTROLLER_CLK_SOURCE_HOST1X 0x180
 #define CLK_RST_CONTROLLER_CLK_SOURCE_UARTC 0x1A0
+#define CLK_RST_CONTROLLER_CLK_SOURCE_I2C3 0x1B8
 #define CLK_RST_CONTROLLER_CLK_SOURCE_SDMMC3 0x1BC
 #define CLK_RST_CONTROLLER_CLK_SOURCE_CSITE 0x1D4
 #define CLK_RST_CONTROLLER_CLK_SOURCE_EMC 0x19C
@@ -94,9 +96,11 @@
 #define CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRD 0x3A4
 #define CLK_RST_CONTROLLER_CLK_SOURCE_MSELECT 0x3B4
 #define CLK_RST_CONTROLLER_CLK_SOURCE_SOR1 0x410
+#define CLK_RST_CONTROLLER_CLK_SOURCE_SE 0x42C
 #define CLK_RST_CONTROLLER_CLK_ENB_V_SET 0x440
 #define CLK_RST_CONTROLLER_CLK_ENB_W_SET 0x448
 #define CLK_RST_CONTROLLER_CLK_ENB_W_CLR 0x44C
+#define CLK_RST_CONTROLLER_RST_CPUG_CMPLX_SET 0x450
 #define CLK_RST_CONTROLLER_RST_CPUG_CMPLX_CLR 0x454
 #define CLK_RST_CONTROLLER_UTMIP_PLL_CFG2 0x488
 #define CLK_RST_CONTROLLER_PLLE_AUX 0x48C
@@ -112,6 +116,8 @@
 #define CLK_RST_CONTROLLER_CLK_SOURCE_NVENC 0x6A0
 #define CLK_RST_CONTROLLER_SE_SUPER_CLK_DIVIDER 0x704
 
+#define CLK_NO_SOURCE 0x0
+
 /*! Generic clock descriptor. */
 typedef struct _clock_t
 {
@@ -128,10 +134,12 @@ void clock_enable(const clock_t *clk);
 void clock_disable(const clock_t *clk);
 
 /*! Clock control for specific hardware portions. */
-void clock_enable_fuse(u32 enable);
+void clock_enable_fuse(bool enable);
 void clock_enable_uart(u32 idx);
 void clock_enable_i2c(u32 idx);
+void clock_disable_i2c(u32 idx);
 void clock_enable_se();
+void clock_enable_unk2();
 void clock_enable_host1x();
 void clock_disable_host1x();
 void clock_enable_tsec();
@@ -147,6 +155,9 @@ void clock_disable_kfuse();
 void clock_enable_cl_dvfs();
 void clock_disable_cl_dvfs();
 void clock_enable_coresight();
+void clock_disable_coresight();
+void clock_enable_pwm();
+void clock_disable_pwm();
 void clock_sdmmc_config_clock_source(u32 *pout, u32 id, u32 val);
 void clock_sdmmc_get_params(u32 *pout, u16 *pdivisor, u32 type);
 int clock_sdmmc_is_not_reset_and_enabled(u32 id);

bootloader/soc/cluster.c

@@ -21,24 +21,29 @@
 #include "../soc/pmc.h"
 #include "../soc/t210.h"
 #include "../power/max77620.h"
+#include "../power/max7762x.h"
 
 void _cluster_enable_power()
 {
-	u8 tmp = i2c_recv_byte(I2C_5, 0x3C, MAX77620_REG_AME_GPIO);
-	i2c_send_byte(I2C_5, 0x3C, MAX77620_REG_AME_GPIO, tmp & 0xDF);
-	i2c_send_byte(I2C_5, 0x3C, MAX77620_REG_GPIO5, 0x09);
+	u8 tmp = i2c_recv_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_AME_GPIO); // Get current pinmuxing
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_AME_GPIO, tmp & ~(1 << 5)); // Disable GPIO5 pinmuxing.
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_GPIO5, MAX77620_CNFG_GPIO_DRV_PUSHPULL | MAX77620_CNFG_GPIO_OUTPUT_VAL_HIGH);
 
 	// Enable cores power.
-	i2c_send_byte(I2C_5, 0x1B, 0x2, 0x20);
-	i2c_send_byte(I2C_5, 0x1B, 0x3, 0x8D);
-	i2c_send_byte(I2C_5, 0x1B, 0x0, 0xB7);
-	i2c_send_byte(I2C_5, 0x1B, 0x1, 0xB7);
+	// 1-3.x: MAX77621_NFSR_ENABLE.
+	i2c_send_byte(I2C_5, MAX77621_CPU_I2C_ADDR, MAX77621_CONTROL1_REG,
+		MAX77621_AD_ENABLE | MAX77621_NFSR_ENABLE | MAX77621_SNS_ENABLE);
+	// 1.0.0-3.x: MAX77621_T_JUNCTION_120 | MAX77621_CKKADV_TRIP_DISABLE | MAX77621_INDUCTOR_NOMINAL.
+	i2c_send_byte(I2C_5, MAX77621_CPU_I2C_ADDR, MAX77621_CONTROL2_REG,
+		MAX77621_T_JUNCTION_120 | MAX77621_WDTMR_ENABLE | MAX77621_CKKADV_TRIP_75mV_PER_US| MAX77621_INDUCTOR_NOMINAL);
+	i2c_send_byte(I2C_5, MAX77621_CPU_I2C_ADDR, MAX77621_VOUT_REG, MAX77621_VOUT_ENABLE | 0x37);
+	i2c_send_byte(I2C_5, MAX77621_CPU_I2C_ADDR, MAX77621_VOUT_DVC_REG, MAX77621_VOUT_ENABLE | 0x37);
 }
 
-int _cluster_pmc_enable_partition(u32 part, u32 toggle)
+int _cluster_pmc_enable_partition(u32 part, u32 toggle, bool enable)
 {
 	// Check if the partition has already been turned on.
-	if (PMC(APBDEV_PMC_PWRGATE_STATUS) & part)
+	if (enable && PMC(APBDEV_PMC_PWRGATE_STATUS) & part)
 		return 1;
 
 	u32 i = 5001;
@@ -50,7 +55,7 @@ int _cluster_pmc_enable_partition(u32 part, u32 toggle)
 			return 0;
 	}
 
-	PMC(APBDEV_PMC_PWRGATE_TOGGLE) = toggle | 0x100;
+	PMC(APBDEV_PMC_PWRGATE_TOGGLE) = toggle | (enable ? 0x100 : 0);
 
 	i = 5001;
 	while (i > 0)
@@ -98,18 +103,18 @@ void cluster_boot_cpu0(u32 entry)
 	CLOCK(CLK_RST_CONTROLLER_CPU_SOFTRST_CTRL2) &= 0xFFFFF000;
 
 	// Enable CPU rail.
-	_cluster_pmc_enable_partition(1, 0);
-	//Enable cluster 0 non-CPU.
-	_cluster_pmc_enable_partition(0x8000, 15);
+	_cluster_pmc_enable_partition(1, 0, true);
+	// Enable cluster 0 non-CPU.
+	_cluster_pmc_enable_partition(0x8000, 15, true);
 	// Enable CE0.
-	_cluster_pmc_enable_partition(0x4000, 14);
+	_cluster_pmc_enable_partition(0x4000, 14, true);
 
 	// Request and wait for RAM repair.
 	FLOW_CTLR(FLOW_CTLR_RAM_REPAIR) = 1;
 	while (!(FLOW_CTLR(FLOW_CTLR_RAM_REPAIR) & 2))
 		;
 
-	EXCP_VEC(0x100) = 0;
+	EXCP_VEC(EVP_CPU_RESET_VECTOR) = 0;
 
 	// Set reset vector.
 	SB(SB_AA64_RESET_LOW) = entry | 1;
@@ -122,6 +127,7 @@ void cluster_boot_cpu0(u32 entry)
 	CLOCK(CLK_RST_CONTROLLER_RST_DEVICES_V) &= 0xFFFFFFF7;
 	// Clear NONCPU reset.
 	CLOCK(CLK_RST_CONTROLLER_RST_CPUG_CMPLX_CLR) = 0x20000000;
-	// Clear CPU{0,1,2,3} POR and CORE, CX0, L2, and DBG reset.
-	CLOCK(CLK_RST_CONTROLLER_RST_CPUG_CMPLX_CLR) = 0x411F000F;
+	// Clear CPU0 reset.
+	// < 5.x: 0x411F000F, Clear CPU{0,1,2,3} POR and CORE, CX0, L2, and DBG reset.
+	CLOCK(CLK_RST_CONTROLLER_RST_CPUG_CMPLX_CLR) = 0x41010001;
 }

bootloader/soc/cluster.h

@@ -20,7 +20,15 @@
 #include "../utils/types.h"
 
 /*! Flow controller registers. */
+#define FLOW_CTLR_HALT_CPU0_EVENTS 0x0
+#define FLOW_CTLR_HALT_CPU1_EVENTS 0x14
+#define FLOW_CTLR_HALT_CPU2_EVENTS 0x1C
+#define FLOW_CTLR_HALT_CPU3_EVENTS 0x24
 #define FLOW_CTLR_HALT_COP_EVENTS 0x4
+#define FLOW_CTLR_CPU0_CSR 0x8
+#define FLOW_CTLR_CPU1_CSR 0x18
+#define FLOW_CTLR_CPU2_CSR 0x20
+#define FLOW_CTLR_CPU3_CSR 0x28
 #define FLOW_CTLR_RAM_REPAIR 0x40
 #define FLOW_CTLR_BPMP_CLUSTER_CONTROL 0x98
 

bootloader/soc/fuse.c

@@ -1,5 +1,8 @@
 /*
  * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018 shuffle2
+ * Copyright (c) 2018 balika011
+ * Copyright (c) 2019 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -14,9 +17,39 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <string.h>
+
 #include "../soc/fuse.h"
 #include "../soc/t210.h"
 
+#define ARRAYSIZE(x) (sizeof(x) / sizeof(*x))
+
+static const u32 evp_thunk_template[] = {
+	0xe92d0007, //   STMFD   SP!, {R0-R2}
+	0xe1a0200e, //   MOV     R2, LR
+	0xe2422002, //   SUB     R2, R2, #2
+	0xe5922000, //   LDR     R2, [R2]
+	0xe20220ff, //   AND     R2, R2, #0xFF
+	0xe1a02082, //   MOV     R2, R2,LSL#1
+	0xe59f001c, //   LDR     R0, =evp_thunk_template
+	0xe59f101c, //   LDR     R1, =thunk_end
+	0xe0411000, //   SUB     R1, R1, R0
+	0xe59f0018, //   LDR     R0, =iram_evp_thunks
+	0xe0800001, //   ADD     R0, R0, R1
+	0xe0822000, //   ADD     R2, R2, R0
+	0xe3822001, //   ORR     R2, R2, #1
+	0xe8bd0003, //   LDMFD   SP!, {R0,R1}
+	0xe12fff12, //   BX      R2
+	0x001007b0, // off_1007EC DCD evp_thunk_template
+	0x001007f8, // off_1007F0 DCD thunk_end
+	0x40004c30, // off_1007F4 DCD iram_evp_thunks
+	// thunk_end is here
+};
+static const u32 evp_thunk_template_len = sizeof(evp_thunk_template);
+
+// treated as 12bit values
+static const u32 hash_vals[] = {1, 2, 4, 8, 0, 3, 5, 6, 7, 9, 10, 11};
+
 void fuse_disable_program()
 {
 	FUSE(FUSE_DISABLEREGPROGRAM) = 1;
@@ -26,3 +59,291 @@ u32 fuse_read_odm(u32 idx)
 {
 	return FUSE(FUSE_RESERVED_ODMX(idx));
 }
+
+void fuse_wait_idle()
+{
+	u32 ctrl;
+	do
+	{
+		ctrl = FUSE(FUSE_CTRL);
+	} while (((ctrl >> 16) & 0x1f) != 4);
+}
+
+u32 fuse_read(u32 addr)
+{
+	FUSE(FUSE_ADDR) = addr;
+	FUSE(FUSE_CTRL) = (FUSE(FUSE_ADDR) & ~FUSE_CMD_MASK) | FUSE_READ;
+	fuse_wait_idle();
+	return FUSE(FUSE_RDATA);
+}
+
+void fuse_read_array(u32 *words)
+{
+	for (u32 i = 0; i < 192; i++)
+		words[i] = fuse_read(i);
+}
+
+static u32 _parity32_even(u32 *words, u32 count)
+{
+	u32 acc = words[0];
+	for (u32 i = 1; i < count; i++)
+	{
+		acc ^= words[i];
+	}
+	u32 lo = ((acc & 0xffff) ^ (acc >> 16)) & 0xff;
+	u32 hi = ((acc & 0xffff) ^ (acc >> 16)) >> 8;
+	u32 x = hi ^ lo;
+	lo = ((x & 0xf) ^ (x >> 4)) & 3;
+	hi = ((x & 0xf) ^ (x >> 4)) >> 2;
+	x = hi ^ lo;
+ 
+	return (x & 1) ^ (x >> 1);
+}
+
+static int _patch_hash_one(u32 *word)
+{
+	u32 bits20_31 = *word & 0xfff00000;
+	u32 parity_bit = _parity32_even(&bits20_31, 1);
+	u32 hash = 0;
+	for (u32 i = 0; i < 12; i++)
+	{
+		if (*word & (1 << (20 + i)))
+		{
+			hash ^= hash_vals[i];
+		}
+	}
+	if (hash == 0)
+	{
+		if (parity_bit == 0)
+		{
+			return 0;
+		}
+		*word ^= 1 << 24;
+		return 1;
+	}
+	if (parity_bit == 0)
+	{
+		return 3;
+	}
+	for (u32 i = 0; i < ARRAYSIZE(hash_vals); i++)
+	{
+		if (hash_vals[i] == hash)
+		{
+			*word ^= 1 << (20 + i);
+			return 1;
+		}
+	}
+	return 2;
+}
+
+static int _patch_hash_multi(u32 *words, u32 count)
+{
+	u32 parity_bit = _parity32_even(words, count);
+	u32 bits0_14 = words[0] & 0x7fff;
+	u32 bit15 = words[0] & 0x8000;
+	u32 bits16_19 = words[0] & 0xf0000;
+
+	u32 hash = 0;
+	words[0] = bits16_19;
+	for (u32 i = 0; i < count; i++)
+	{
+		u32 w = words[i];
+		if (w)
+		{
+			for (u32 bitpos = 0; bitpos < 32; bitpos++)
+			{
+				if ((w >> bitpos) & 1)
+				{
+					hash ^= 0x4000 + i * 32 + bitpos;
+				}
+			}
+		}
+	}
+	hash ^= bits0_14;
+	// stupid but this is what original code does.
+	// equivalent to original words[0] &= 0xfff00000
+	words[0] = bits16_19 ^ bit15 ^ bits0_14;
+
+	if (hash == 0)
+	{
+		if (parity_bit == 0)
+		{
+			return 0;
+		}
+		words[0] ^= 0x8000;
+		return 1;
+	}
+	if (parity_bit == 0)
+	{
+		return 3;
+	}
+	u32 bitcount = hash - 0x4000;
+	if (bitcount < 16 || bitcount >= count * 32)
+	{
+		u32 num_set = 0;
+		for (u32 bitpos = 0; bitpos < 15; bitpos++)
+		{
+			if ((hash >> bitpos) & 1)
+			{
+				num_set++;
+			}
+		}
+		if (num_set != 1)
+		{
+			return 2;
+		}
+		words[0] ^= hash;
+		return 1;
+	}
+	words[bitcount / 32] ^= 1 << (hash & 0x1f);
+	return 1;
+}
+
+int fuse_read_ipatch(void (*ipatch)(u32 offset, u32 value))
+{
+	u32 words[80];
+	u32 word_count;
+	u32 word_addr;
+	u32 word0 = 0;
+	u32 total_read = 0;
+
+	word_count = FUSE(FUSE_FIRST_BOOTROM_PATCH_SIZE);
+	word_count &= 0x7F;
+	word_addr = 191;
+
+	while (word_count)
+	{
+		total_read += word_count;
+		if (total_read >= ARRAYSIZE(words))
+		{
+			break;
+		}
+		
+		for (u32 i = 0; i < word_count; i++)
+			words[i] = fuse_read(word_addr--);
+		
+		word0 = words[0];
+		if (_patch_hash_multi(words, word_count) >= 2)
+		{
+			return 1;
+		}
+		u32 ipatch_count = (words[0] >> 16) & 0xF;
+		if (ipatch_count)
+		{
+			for (u32 i = 0; i < ipatch_count; i++)
+			{
+				u32 word = words[i + 1];
+				u32 addr = (word >> 16) * 2;
+				u32 data = word & 0xFFFF;
+		
+				ipatch(addr, data);
+			}
+		}
+		words[0] = word0;
+		if ((word0 >> 25) == 0)
+			break;
+		if (_patch_hash_one(&word0) >= 2)
+		{
+			return 3;
+		}
+		word_count = word0 >> 25;
+	}
+	
+	return 0;
+}
+
+int fuse_read_evp_thunk(u32 *iram_evp_thunks, u32 *iram_evp_thunks_len)
+{
+	u32 words[80];
+	u32 word_count;
+	u32 word_addr;
+	u32 word0 = 0;
+	u32 total_read = 0;
+	int evp_thunk_written = 0;
+	void *evp_thunk_dst_addr = 0;
+
+	memset(iram_evp_thunks, 0, *iram_evp_thunks_len);
+
+	word_count = FUSE(FUSE_FIRST_BOOTROM_PATCH_SIZE);
+	word_count &= 0x7F;
+	word_addr = 191;
+
+	while (word_count)
+	{
+		total_read += word_count;
+		if (total_read >= ARRAYSIZE(words))
+		{
+			break;
+		}
+		
+		for (u32 i = 0; i < word_count; i++)
+			words[i] = fuse_read(word_addr--);
+		
+		word0 = words[0];
+		if (_patch_hash_multi(words, word_count) >= 2)
+		{
+			return 1;
+		}
+		u32 ipatch_count = (words[0] >> 16) & 0xF;
+		u32 insn_count = word_count - ipatch_count - 1;
+		if (insn_count)
+		{
+			if (!evp_thunk_written)
+			{
+				evp_thunk_dst_addr = (void *)iram_evp_thunks;
+
+				memcpy(evp_thunk_dst_addr, (void *)evp_thunk_template, evp_thunk_template_len);
+				evp_thunk_dst_addr += evp_thunk_template_len;
+				evp_thunk_written = 1;
+				*iram_evp_thunks_len = evp_thunk_template_len;
+
+				//write32(TEGRA_EXCEPTION_VECTORS_BASE + 0x208, iram_evp_thunks);
+			}
+
+			u32 thunk_patch_len = insn_count * sizeof(u32);
+			memcpy(evp_thunk_dst_addr, &words[ipatch_count + 1], thunk_patch_len);
+			evp_thunk_dst_addr += thunk_patch_len;
+			*iram_evp_thunks_len += thunk_patch_len;
+		}
+		words[0] = word0;
+		if ((word0 >> 25) == 0)
+			break;
+		if (_patch_hash_one(&word0) >= 2)
+		{
+			return 3;
+		}
+		word_count = word0 >> 25;
+	}
+	
+	return 0;
+}
+
+bool fuse_check_patched_rcm()
+{
+	// Check if XUSB in use.
+	if (FUSE(FUSE_RESERVED_SW) & (1<<7))
+		return true;
+
+	// Check if RCM is ipatched.
+	u32 word_count = FUSE(FUSE_FIRST_BOOTROM_PATCH_SIZE) & 0x7F;
+	u32 word_addr = 191;
+
+	while (word_count)
+	{
+		u32 word0 = fuse_read(word_addr);
+		u32 ipatch_count = (word0 >> 16) & 0xF;        
+
+		for (u32 i = 0; i < ipatch_count; i++)
+		{
+			u32 word = fuse_read(word_addr - (i + 1));
+			u32 addr = (word >> 16) * 2;
+			if (addr == 0x769A)
+				return true;
+		}
+
+		word_addr -= word_count;
+		word_count = word0 >> 25;
+	}
+
+	return false;
+}

bootloader/soc/fuse.h

@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018 shuffle2
+ * Copyright (c) 2018 balika011
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -34,11 +36,29 @@
 #define FUSE_DISABLEREGPROGRAM 0x2C
 #define FUSE_WRITE_ACCESS_SW 0x30
 #define FUSE_PWR_GOOD_SW 0x34
+#define FUSE_SKU_INFO 0x110
+#define FUSE_FIRST_BOOTROM_PATCH_SIZE 0x19c
+#define FUSE_PRIVATE_KEY0 0x1A4
+#define FUSE_PRIVATE_KEY1 0x1A8
+#define FUSE_PRIVATE_KEY2 0x1AC
+#define FUSE_PRIVATE_KEY3 0x1B0
+#define FUSE_RESERVED_SW 0x1C0
+
+/*! Fuse commands. */
+#define FUSE_READ 0x1
+#define FUSE_WRITE 0x2
+#define FUSE_SENSE 0x3
+#define FUSE_CMD_MASK 0x3
 
 /*! Fuse cache registers. */
 #define FUSE_RESERVED_ODMX(x) (0x1C8 + 4 * (x))
 
 void fuse_disable_program();
 u32 fuse_read_odm(u32 idx);
+void fuse_wait_idle();
+int fuse_read_ipatch(void (*ipatch)(u32 offset, u32 value));
+int fuse_read_evp_thunk(u32 *iram_evp_thunks, u32 *iram_evp_thunks_len);
+void fuse_read_array(u32 *words);
+bool fuse_check_patched_rcm();
 
 #endif

bootloader/soc/hw_init.c

@@ -0,0 +1,284 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018-2019 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <string.h>
+
+#include "hw_init.h"
+#include "clock.h"
+#include "fuse.h"
+#include "gpio.h"
+#include "i2c.h"
+#include "pinmux.h"
+#include "pmc.h"
+#include "t210.h"
+#include "uart.h"
+#include "../gfx/di.h"
+#include "../mem/mc.h"
+#include "../mem/sdram.h"
+#include "../power/max77620.h"
+#include "../power/max7762x.h"
+#include "../sec/se.h"
+#include "../sec/se_t210.h"
+#include "../storage/sdmmc.h"
+#include "../utils/util.h"
+
+extern sdmmc_t sd_sdmmc;
+extern boot_cfg_t b_cfg;
+
+void _config_oscillators()
+{
+	CLOCK(CLK_RST_CONTROLLER_SPARE_REG0) = (CLOCK(CLK_RST_CONTROLLER_SPARE_REG0) & 0xFFFFFFF3) | 4;
+	SYSCTR0(SYSCTR0_CNTFID0) = 19200000;
+	TMR(TIMERUS_USEC_CFG) = 0x45F; // For 19.2MHz clk_m.
+	CLOCK(CLK_RST_CONTROLLER_OSC_CTRL) = 0x50000071;
+	PMC(APBDEV_PMC_OSC_EDPD_OVER) = (PMC(APBDEV_PMC_OSC_EDPD_OVER) & 0xFFFFFF81) | 0xE;
+	PMC(APBDEV_PMC_OSC_EDPD_OVER) = (PMC(APBDEV_PMC_OSC_EDPD_OVER) & 0xFFBFFFFF) | 0x400000;
+	PMC(APBDEV_PMC_CNTRL2) = (PMC(APBDEV_PMC_CNTRL2) & 0xFFFFEFFF) | 0x1000;
+	PMC(APBDEV_PMC_SCRATCH188) = (PMC(APBDEV_PMC_SCRATCH188) & 0xFCFFFFFF) | 0x2000000;
+	CLOCK(CLK_RST_CONTROLLER_CLK_SYSTEM_RATE) = 0x10;
+	CLOCK(CLK_RST_CONTROLLER_PLLMB_BASE) &= 0xBFFFFFFF;
+	PMC(APBDEV_PMC_TSC_MULT) = (PMC(APBDEV_PMC_TSC_MULT) & 0xFFFF0000) | 0x249F; //0x249F = 19200000 * (16 / 32.768 kHz)
+	CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) = 0x20004444;
+	CLOCK(CLK_RST_CONTROLLER_SUPER_SCLK_DIVIDER) = 0x80000000;
+	CLOCK(CLK_RST_CONTROLLER_CLK_SYSTEM_RATE) = 2;
+}
+
+void _config_gpios()
+{
+	PINMUX_AUX(PINMUX_AUX_UART2_TX) = 0;
+	PINMUX_AUX(PINMUX_AUX_UART3_TX) = 0;
+
+	PINMUX_AUX(PINMUX_AUX_GPIO_PE6) = PINMUX_INPUT_ENABLE;
+	PINMUX_AUX(PINMUX_AUX_GPIO_PH6) = PINMUX_INPUT_ENABLE;
+
+#if !defined (DEBUG_UART_PORT) || DEBUG_UART_PORT != UART_B
+	gpio_config(GPIO_PORT_G, GPIO_PIN_0, GPIO_MODE_GPIO);
+#endif
+#if !defined (DEBUG_UART_PORT) || DEBUG_UART_PORT != UART_C
+	gpio_config(GPIO_PORT_D, GPIO_PIN_1, GPIO_MODE_GPIO);
+#endif
+	gpio_config(GPIO_PORT_E, GPIO_PIN_6, GPIO_MODE_GPIO);
+	gpio_config(GPIO_PORT_H, GPIO_PIN_6, GPIO_MODE_GPIO);
+	gpio_output_enable(GPIO_PORT_G, GPIO_PIN_0, GPIO_OUTPUT_DISABLE);
+	gpio_output_enable(GPIO_PORT_D, GPIO_PIN_1, GPIO_OUTPUT_DISABLE);
+	gpio_output_enable(GPIO_PORT_E, GPIO_PIN_6, GPIO_OUTPUT_DISABLE);
+	gpio_output_enable(GPIO_PORT_H, GPIO_PIN_6, GPIO_OUTPUT_DISABLE);
+
+	pinmux_config_i2c(I2C_1);
+	pinmux_config_i2c(I2C_5);
+	pinmux_config_uart(UART_A);
+
+	// Configure volume up/down as inputs.
+	gpio_config(GPIO_PORT_X, GPIO_PIN_6, GPIO_MODE_GPIO);
+	gpio_config(GPIO_PORT_X, GPIO_PIN_7, GPIO_MODE_GPIO);
+	gpio_output_enable(GPIO_PORT_X, GPIO_PIN_6, GPIO_OUTPUT_DISABLE);
+	gpio_output_enable(GPIO_PORT_X, GPIO_PIN_7, GPIO_OUTPUT_DISABLE);
+}
+
+void _config_pmc_scratch()
+{
+	PMC(APBDEV_PMC_SCRATCH20) &= 0xFFF3FFFF;
+	PMC(APBDEV_PMC_SCRATCH190) &= 0xFFFFFFFE;
+	PMC(APBDEV_PMC_SECURE_SCRATCH21) |= 0x10;
+}
+
+void _mbist_workaround()
+{
+	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_V) |= (1 << 10); // Enable AHUB clock.
+	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_Y) |= (1 <<  6);  // Enable APE clock.
+
+	CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_SOR1) = (CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_SOR1) | 0x8000) & 0xFFFFBFFF;
+	CLOCK(CLK_RST_CONTROLLER_PLLD_BASE) |= 0x40800000u;
+	CLOCK(CLK_RST_CONTROLLER_RST_DEV_Y_CLR) = 0x40;
+	CLOCK(CLK_RST_CONTROLLER_RST_DEV_X_CLR) = 0x40000;
+	CLOCK(CLK_RST_CONTROLLER_RST_DEV_L_CLR) = 0x18000000;
+	usleep(2);
+
+	I2S(I2S1_CTRL) |= I2S_CTRL_MASTER_EN;
+	I2S(I2S1_CG)   &= ~I2S_CG_SLCG_ENABLE;
+	I2S(I2S2_CTRL) |= I2S_CTRL_MASTER_EN;
+	I2S(I2S2_CG)   &= ~I2S_CG_SLCG_ENABLE;
+	I2S(I2S3_CTRL) |= I2S_CTRL_MASTER_EN;
+	I2S(I2S3_CG)   &= ~I2S_CG_SLCG_ENABLE;
+	I2S(I2S4_CTRL) |= I2S_CTRL_MASTER_EN;
+	I2S(I2S4_CG)   &= ~I2S_CG_SLCG_ENABLE;
+	I2S(I2S5_CTRL) |= I2S_CTRL_MASTER_EN;
+	I2S(I2S5_CG)   &= ~I2S_CG_SLCG_ENABLE;
+	DISPLAY_A(_DIREG(DC_COM_DSC_TOP_CTL)) |= 4;
+	VIC(0x8C) = 0xFFFFFFFF;
+	usleep(2);
+
+	CLOCK(CLK_RST_CONTROLLER_RST_DEV_Y_SET) = 0x40;
+	CLOCK(CLK_RST_CONTROLLER_RST_DEV_L_SET) = 0x18000000;
+	CLOCK(CLK_RST_CONTROLLER_RST_DEV_X_SET) = 0x40000;
+	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_H) = 0xC0;
+	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_L) = 0x80000130;
+	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_U) = 0x1F00200;
+	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_V) = 0x80400808;
+	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_W) = 0x402000FC;
+	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_X) = 0x23000780;
+	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_Y) = 0x300;
+	CLOCK(CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRA) = 0;
+	CLOCK(CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRB) = 0;
+	CLOCK(CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRC) = 0;
+	CLOCK(CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRD) = 0;
+	CLOCK(CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRE) = 0;
+	CLOCK(CLK_RST_CONTROLLER_PLLD_BASE) &= 0x1F7FFFFF;
+	CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_SOR1) &= 0xFFFF3FFF;
+	CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_VI) = (CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_VI) & 0x1FFFFFFF) | 0x80000000;
+	CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_HOST1X) = (CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_HOST1X) & 0x1FFFFFFF) | 0x80000000;
+	CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_NVENC) = (CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_NVENC) & 0x1FFFFFFF) | 0x80000000;
+}
+
+void _config_se_brom()
+{
+	// Skip SBK/SSK if sept was run.
+	if (!(b_cfg.boot_cfg & BOOT_CFG_SEPT_RUN))
+	{
+		// Bootrom part we skipped.
+		u32 sbk[4] = { 
+			FUSE(FUSE_PRIVATE_KEY0),
+			FUSE(FUSE_PRIVATE_KEY1),
+			FUSE(FUSE_PRIVATE_KEY2),
+			FUSE(FUSE_PRIVATE_KEY3)
+		};
+		// Set SBK to slot 14.
+		se_aes_key_set(14, sbk, 0x10);
+
+		// Lock SBK from being read.
+		SE(SE_KEY_TABLE_ACCESS_REG_OFFSET + 14 * 4) = 0x7E;
+
+		// Lock SSK (although it's not set and unused anyways).
+		SE(SE_KEY_TABLE_ACCESS_REG_OFFSET + 15 * 4) = 0x7E;
+	}
+
+	// This memset needs to happen here, else TZRAM will behave weirdly later on.
+	memset((void *)TZRAM_BASE, 0, 0x10000);
+	PMC(APBDEV_PMC_CRYPTO_OP) = PMC_CRYPTO_OP_SE_ENABLE;
+	SE(SE_INT_STATUS_REG_OFFSET) = 0x1F;
+
+	// Clear the boot reason to avoid problems later
+	PMC(APBDEV_PMC_SCRATCH200) = 0x0;
+	PMC(APBDEV_PMC_RST_STATUS) = 0x0;
+	APB_MISC(APB_MISC_PP_STRAPPING_OPT_A) = (APB_MISC(APB_MISC_PP_STRAPPING_OPT_A) & 0xF0) | (7 << 10);
+}
+
+void config_hw()
+{
+	// Bootrom stuff we skipped by going through rcm.
+	_config_se_brom();
+	//FUSE(FUSE_PRIVATEKEYDISABLE) = 0x11;
+	SYSREG(AHB_AHB_SPARE_REG) &= 0xFFFFFF9F;
+	PMC(APBDEV_PMC_SCRATCH49) = ((PMC(APBDEV_PMC_SCRATCH49) >> 1) << 1) & 0xFFFFFFFD;
+
+	_mbist_workaround();
+	clock_enable_se();
+
+	// Enable fuse clock.
+	clock_enable_fuse(true);
+	// Disable fuse programming.
+	fuse_disable_program();
+
+	mc_enable();
+
+	_config_oscillators();
+	APB_MISC(APB_MISC_PP_PINMUX_GLOBAL) = 0;
+	_config_gpios();
+
+#ifdef DEBUG_UART_PORT
+	clock_enable_uart(DEBUG_UART_PORT);
+	uart_init(DEBUG_UART_PORT, 115200);
+#endif
+
+	clock_enable_cl_dvfs();
+
+	clock_enable_i2c(I2C_1);
+	clock_enable_i2c(I2C_5);
+
+	clock_enable_unk2();
+
+	i2c_init(I2C_1);
+	i2c_init(I2C_5);
+
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_CNFGBBC, MAX77620_CNFGBBC_RESISTOR_1K);
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_ONOFFCNFG1,
+		(1 << 6) | (3 << MAX77620_ONOFFCNFG1_MRT_SHIFT)); // PWR delay for forced shutdown off.
+
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_FPS_CFG0,
+		(7 << MAX77620_FPS_TIME_PERIOD_SHIFT));
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_FPS_CFG1,
+		(7 << MAX77620_FPS_TIME_PERIOD_SHIFT) | (1 << MAX77620_FPS_EN_SRC_SHIFT));
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_FPS_CFG2,
+		(7 << MAX77620_FPS_TIME_PERIOD_SHIFT));
+	max77620_regulator_config_fps(REGULATOR_LDO4);
+	max77620_regulator_config_fps(REGULATOR_LDO8);
+	max77620_regulator_config_fps(REGULATOR_SD0);
+	max77620_regulator_config_fps(REGULATOR_SD1);
+	max77620_regulator_config_fps(REGULATOR_SD3);
+
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_FPS_GPIO3,
+		(4 << MAX77620_FPS_TIME_PERIOD_SHIFT) | (2 << MAX77620_FPS_PD_PERIOD_SHIFT)); // 3.x+
+
+	max77620_regulator_set_voltage(REGULATOR_SD0, 1125000);
+
+	// Fix GPU after warmboot for Linux.
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_GPIO5, 2);
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_GPIO6, 2);
+
+	// Disable low battery shutdown monitor.
+	max77620_low_battery_monitor_config();
+
+	_config_pmc_scratch(); // Missing from 4.x+
+
+	CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) = (CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) & 0xFFFF8888) | 0x3333;
+
+	sdram_init();
+}
+
+void reconfig_hw_workaround(bool extra_reconfig, u32 magic)
+{
+	// Re-enable clocks to Audio Processing Engine as a workaround to hanging.
+	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_V) |= (1 << 10); // Enable AHUB clock.
+	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_Y) |= (1 <<  6);  // Enable APE clock.
+
+	if (extra_reconfig)
+	{
+		msleep(10);
+		PMC(APBDEV_PMC_PWR_DET_VAL) |= PMC_PWR_DET_SDMMC1_IO_EN;
+
+		clock_disable_cl_dvfs();
+
+		// Disable Joy-con GPIOs.
+		gpio_config(GPIO_PORT_G, GPIO_PIN_0, GPIO_MODE_SPIO);
+		gpio_config(GPIO_PORT_D, GPIO_PIN_1, GPIO_MODE_SPIO);
+		gpio_config(GPIO_PORT_E, GPIO_PIN_6, GPIO_MODE_SPIO);
+		gpio_config(GPIO_PORT_H, GPIO_PIN_6, GPIO_MODE_SPIO);
+	}
+
+	// Power off display.
+	display_end();
+
+	// Enable clock to USBD and init SDMMC1 to avoid hangs with bad hw inits.
+	if (magic == 0xBAADF00D)
+	{
+		CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_L) |= (1 << 22);
+		sdmmc_init(&sd_sdmmc, SDMMC_1, SDMMC_POWER_3_3, SDMMC_BUS_WIDTH_1, 5, 0);
+		clock_disable_cl_dvfs();
+
+		msleep(200);
+	}
+}

bootloader/soc/hw_init.h

@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _HW_INIT_H_
+#define _HW_INIT_H_
+
+#include "../utils/types.h"
+
+void config_hw();
+void reconfig_hw_workaround(bool extra_reconfig, u32 magic);
+
+#endif

bootloader/soc/i2c.c

@@ -26,11 +26,11 @@ static u32 i2c_addrs[] = {
 
 static void _i2c_wait(vu32 *base)
 {
-	base[0x23] = 0x25;
+	base[I2C_CONFIG_LOAD] = 0x25;
 	for (u32 i = 0; i < 20; i++)
 	{
 		usleep(1);
-		if (!(base[0x23] & 1))
+		if (!(base[I2C_CONFIG_LOAD] & 1))
 			break;
 	}
 }
@@ -44,16 +44,16 @@ static int _i2c_send_pkt(u32 idx, u32 x, u8 *buf, u32 size)
 	memcpy(&tmp, buf, size);
 
 	vu32 *base = (vu32 *)i2c_addrs[idx];
-	base[1] = x << 1; //Set x (send mode).
-	base[3] = tmp;    //Set value.
-	base[0] = (2 * size - 2) | 0x2800; //Set size and send mode.
+	base[I2C_CMD_ADDR0] = x << 1; //Set x (send mode).
+	base[I2C_CMD_DATA1] = tmp;    //Set value.
+	base[I2C_CNFG] = (2 * size - 2) | 0x2800; //Set size and send mode.
 	_i2c_wait(base);  //Kick transaction.
 
-	base[0] = (base[0] & 0xFFFFFDFF) | 0x200;
-	while (base[7] & 0x100)
+	base[I2C_CNFG] = (base[I2C_CNFG] & 0xFFFFFDFF) | 0x200;
+	while (base[I2C_STATUS] & 0x100)
 		;
 
-	if (base[7] << 28)
+	if (base[I2C_STATUS] << 28)
 		return 0;
 
 	return 1;
@@ -61,23 +61,30 @@ static int _i2c_send_pkt(u32 idx, u32 x, u8 *buf, u32 size)
 
 static int _i2c_recv_pkt(u32 idx, u8 *buf, u32 size, u32 x)
 {
-	if (size > 4)
+	if (size > 8)
 		return 0;
 
 	vu32 *base = (vu32 *)i2c_addrs[idx];
-	base[1] = (x << 1) | 1; // Set x (recv mode).
-	base[0] = (2 * size - 2) | 0x2840; // Set size and recv mode.
+	base[I2C_CMD_ADDR0] = (x << 1) | 1; // Set x (recv mode).
+	base[I2C_CNFG] = (size - 1) << 1 | 0x2840; // Set size and recv mode.
 	_i2c_wait(base);        // Kick transaction.
 
-	base[0] = (base[0] & 0xFFFFFDFF) | 0x200;
-	while (base[7] & 0x100)
+	base[I2C_CNFG] = (base[I2C_CNFG] & 0xFFFFFDFF) | 0x200;
+	while (base[I2C_STATUS] & 0x100)
 		;
 
-	if (base[7] << 28)
+	if (base[I2C_STATUS] << 28)
 		return 0;
 
-	u32 tmp = base[3]; // Get value.
-	memcpy(buf, &tmp, size);
+	u32 tmp = base[I2C_CMD_DATA1]; // Get LS value.
+	if (size > 4)
+	{
+		memcpy(buf, &tmp, 4);
+		tmp = base[I2C_CMD_DATA2]; // Get MS value.
+		memcpy(buf + 4, &tmp, size - 4);
+	}
+	else
+		memcpy(buf, &tmp, size);
 
 	return 1;
 }
@@ -86,19 +93,19 @@ void i2c_init(u32 idx)
 {
 	vu32 *base = (vu32 *)i2c_addrs[idx];
 
-	base[0x1B] = 0x50001;
-	base[0x21] = 0x90003;
+	base[I2C_CLK_DIVISOR_REGISTER] = 0x50001;
+	base[I2C_BUS_CLEAR_CONFIG] = 0x90003;
 	_i2c_wait(base);
 
 	for (u32 i = 0; i < 10; i++)
 	{
 		usleep(20000);
-		if (base[0x1A] & 0x800)
+		if (base[INTERRUPT_STATUS_REGISTER] & 0x800)
 			break;
 	}
 
-	(vu32)base[0x22];
-	base[0x1A] = base[0x1A];
+	(vu32)base[I2C_BUS_CLEAR_STATUS];
+	base[INTERRUPT_STATUS_REGISTER] = base[INTERRUPT_STATUS_REGISTER];
 }
 
 int i2c_send_buf_small(u32 idx, u32 x, u32 y, u8 *buf, u32 size)

bootloader/soc/i2c.h

@@ -26,6 +26,17 @@
 #define I2C_5 4
 #define I2C_6 5
 
+#define I2C_CNFG        0x00
+#define I2C_CMD_ADDR0   0x01
+#define I2C_CMD_DATA1   0x03
+#define I2C_CMD_DATA2   0x04
+#define I2C_STATUS 0x07
+#define INTERRUPT_STATUS_REGISTER 0x1A
+#define I2C_CLK_DIVISOR_REGISTER 0x1B
+#define I2C_BUS_CLEAR_CONFIG 0x21
+#define I2C_BUS_CLEAR_STATUS 0x22
+#define I2C_CONFIG_LOAD 0x23
+
 void i2c_init(u32 idx);
 int i2c_send_buf_small(u32 idx, u32 x, u32 y, u8 *buf, u32 size);
 int i2c_recv_buf_small(u8 *buf, u32 size, u32 idx, u32 x, u32 y);

bootloader/soc/pinmux.c

@@ -19,8 +19,8 @@
 
 void pinmux_config_uart(u32 idx)
 {
-	PINMUX_AUX(PINMUX_AUX_UARTX_RX(idx)) = 0;
-	PINMUX_AUX(PINMUX_AUX_UARTX_TX(idx)) = PINMUX_INPUT_ENABLE | PINMUX_PULL_UP;
+	PINMUX_AUX(PINMUX_AUX_UARTX_TX(idx)) = 0;
+	PINMUX_AUX(PINMUX_AUX_UARTX_RX(idx)) = PINMUX_INPUT_ENABLE | PINMUX_PULL_UP;
 	PINMUX_AUX(PINMUX_AUX_UARTX_RTS(idx)) = 0;
 	PINMUX_AUX(PINMUX_AUX_UARTX_CTS(idx)) = PINMUX_INPUT_ENABLE | PINMUX_PULL_DOWN;
 }

bootloader/soc/pmc.h

@@ -19,6 +19,9 @@
 #define _PMC_H_
 
 /*! PMC registers. */
+#define APBDEV_PMC_CNTRL 0x0
+#define  PMC_CNTRL_MAIN_RST (1 << 4)
+#define APBDEV_PMC_SEC_DISABLE 0x4
 #define APBDEV_PMC_PWRGATE_TOGGLE 0x30
 #define APBDEV_PMC_PWRGATE_STATUS 0x38
 #define APBDEV_PMC_NO_IOPOWER 0x44
@@ -26,25 +29,41 @@
 #define APBDEV_PMC_SCRATCH1 0x54
 #define APBDEV_PMC_SCRATCH20 0xA0
 #define APBDEV_PMC_PWR_DET_VAL 0xE4
+#define  PMC_PWR_DET_SDMMC1_IO_EN (1 << 12)
 #define APBDEV_PMC_DDR_PWR 0xE8
 #define APBDEV_PMC_CRYPTO_OP 0xF4
+#define  PMC_CRYPTO_OP_SE_ENABLE  0
+#define  PMC_CRYPTO_OP_SE_DISABLE 1
+#define APBDEV_PMC_SCRATCH33 0x120
+#define APBDEV_PMC_SCRATCH40 0x13C
 #define APBDEV_PMC_OSC_EDPD_OVER 0x1A4
 #define APBDEV_PMC_RST_STATUS 0x1B4
 #define APBDEV_PMC_IO_DPD_REQ 0x1B8
 #define APBDEV_PMC_IO_DPD2_REQ 0x1C0
 #define APBDEV_PMC_VDDP_SEL 0x1CC
+#define APBDEV_PMC_DDR_CFG 0x1D0
+#define APBDEV_PMC_SCRATCH45 0x234
+#define APBDEV_PMC_SCRATCH46 0x238
 #define APBDEV_PMC_SCRATCH49 0x244
 #define APBDEV_PMC_TSC_MULT 0x2B4
-#define APBDEV_PMC_REG_SHORT 0x2CC
+#define APBDEV_PMC_SEC_DISABLE2 0x2C4
 #define APBDEV_PMC_WEAK_BIAS 0x2C8
+#define APBDEV_PMC_REG_SHORT 0x2CC
+#define APBDEV_PMC_SEC_DISABLE3 0x2D8
 #define APBDEV_PMC_SECURE_SCRATCH21 0x334
 #define APBDEV_PMC_SECURE_SCRATCH32 0x360
 #define APBDEV_PMC_SECURE_SCRATCH49 0x3A4
 #define APBDEV_PMC_CNTRL2 0x440
+#define APBDEV_PMC_IO_DPD3_REQ 0x45C
 #define APBDEV_PMC_IO_DPD4_REQ 0x464
 #define APBDEV_PMC_UTMIP_PAD_CFG1 0x4C4
 #define APBDEV_PMC_UTMIP_PAD_CFG3 0x4CC
 #define APBDEV_PMC_DDR_CNTRL 0x4E4
+#define APBDEV_PMC_SEC_DISABLE4 0x5B0
+#define APBDEV_PMC_SEC_DISABLE5 0x5B4
+#define APBDEV_PMC_SEC_DISABLE6 0x5B8
+#define APBDEV_PMC_SEC_DISABLE7 0x5BC
+#define APBDEV_PMC_SEC_DISABLE8 0x5C0
 #define APBDEV_PMC_SCRATCH188 0x810
 #define APBDEV_PMC_SCRATCH190 0x818
 #define APBDEV_PMC_SCRATCH200 0x840

bootloader/soc/smmu.c

@@ -0,0 +1,171 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018 balika011
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <string.h>
+
+#include "smmu.h"
+#include "../soc/cluster.h"
+#include "../soc/t210.h"
+#include "../mem/mc_t210.h"
+#include "../utils/util.h"
+#include "../utils/aarch64_util.h"
+
+bool smmu_used = false;
+u8 *_pageheap = (u8 *)SMMU_HEAP_ADDR;
+
+//Enabling SMMU requires a TZ secure write: MC(MC_SMMU_CONFIG) = 1;
+u8 smmu_payload[] __attribute__((aligned(16))) = {
+	0x41, 0x01, 0x00, 0x58, // 0x00: LDR  X1, =0x70019010
+	0x20, 0x00, 0x80, 0xD2, // 0x04: MOV  X0, #0x1
+	0x20, 0x00, 0x00, 0xB9, // 0x08: STR  W0, [X1]
+	0x1F, 0x71, 0x08, 0xD5, // 0x0C: IC   IALLUIS
+	0x9F, 0x3B, 0x03, 0xD5, // 0x10: DSB  ISH
+	0xFE, 0xFF, 0xFF, 0x17, // 0x14: B    loop
+	0x00, 0x00, 0x80, 0xD2, // 0x18: MOV  X0, #0x0
+	0x20, 0x00, 0x00, 0xB9, // 0x1C: STR  W0, [X1]
+	0x80, 0x00, 0x00, 0x58, // 0x20: LDR  X0, =0x4002B000
+	0x00, 0x00, 0x1F, 0xD6, // 0x28: BR   X0
+	0x10, 0x90, 0x01, 0x70, // 0x28: MC_SMMU_CONFIG
+	0x00, 0x00, 0x00, 0x00, // 0x2C:
+	0x00, 0x00, 0x00, 0x00, // 0x30: secmon address
+	0x00, 0x00, 0x00, 0x00  // 0x34:
+};
+
+void *page_alloc(u32 num)
+{
+	u8 *res = _pageheap;
+	_pageheap += 0x1000 * num;
+	memset(res, 0, 0x1000 * num);
+	return res;
+}
+
+u32 *smmu_alloc_pdir()
+{
+	u32 *pdir = (u32 *)page_alloc(1);
+	for (int pdn = 0; pdn < SMMU_PDIR_COUNT; pdn++)
+		pdir[pdn] = _PDE_VACANT(pdn);
+	return pdir;
+}
+
+void smmu_flush_regs()
+{
+	(void)MC(MC_SMMU_PTB_DATA);
+}
+
+void smmu_flush_all()
+{
+	MC(MC_SMMU_PTC_FLUSH) = 0;
+	smmu_flush_regs();
+	MC(MC_SMMU_TLB_FLUSH) = 0;
+	smmu_flush_regs();
+}
+
+void smmu_init(u32 secmon_base)
+{
+	MC(MC_SMMU_PTB_ASID) = 0;
+	MC(MC_SMMU_PTB_DATA) = 0;
+	MC(MC_SMMU_TLB_CONFIG) = 0x30000030;
+	MC(MC_SMMU_PTC_CONFIG) = 0x28000F3F;
+	MC(MC_SMMU_PTC_FLUSH) = 0;
+	MC(MC_SMMU_TLB_FLUSH) = 0;
+
+	// Set the secmon address
+	*(u32 *)(smmu_payload + 0x30) = secmon_base;
+}
+
+void smmu_enable()
+{
+	if (smmu_used)
+		return;
+
+	cluster_boot_cpu0((u32)smmu_payload);
+	smmu_used = true;
+	msleep(150);
+
+	smmu_flush_all();
+}
+
+bool smmu_is_used()
+{
+	return smmu_used;
+}
+
+void smmu_exit()
+{
+	*(uint32_t *)(smmu_payload + 0x14) = _NOP();
+}
+
+u32 *smmu_init_domain4(u32 dev_base, u32 asid)
+{
+	u32 *pdir = smmu_alloc_pdir();
+
+	MC(MC_SMMU_PTB_ASID) = asid;
+	MC(MC_SMMU_PTB_DATA) = SMMU_MK_PDIR((u32)pdir, _PDIR_ATTR);
+	smmu_flush_regs();
+
+	MC(dev_base) = 0x80000000 | (asid << 24) | (asid << 16) | (asid << 8) | (asid);
+	smmu_flush_regs();
+
+	return pdir;
+}
+
+u32 *smmu_get_pte(u32 *pdir, u32 iova)
+{
+	u32 ptn = SMMU_ADDR_TO_PFN(iova);
+	u32 pdn = SMMU_ADDR_TO_PDN(iova);
+	u32 *ptbl;
+
+	if (pdir[pdn] != _PDE_VACANT(pdn))
+		ptbl = (u32 *)((pdir[pdn] & SMMU_PFN_MASK) << SMMU_PDIR_SHIFT);
+	else
+	{
+		ptbl = (u32 *)page_alloc(1);
+		u32 addr = SMMU_PDN_TO_ADDR(pdn);
+		for (int pn = 0; pn < SMMU_PTBL_COUNT; pn++, addr += SMMU_PAGE_SIZE)
+			ptbl[pn] = _PTE_VACANT(addr);
+		pdir[pdn] = SMMU_MK_PDE((u32)ptbl, _PDE_ATTR | _PDE_NEXT);
+		smmu_flush_all();
+	}
+
+	return &ptbl[ptn % SMMU_PTBL_COUNT];
+}
+
+void smmu_map(u32 *pdir, u32 addr, u32 page, int cnt, u32 attr)
+{
+	for (int i = 0; i < cnt; i++)
+	{
+		u32 *pte = smmu_get_pte(pdir, addr);
+		*pte = SMMU_ADDR_TO_PFN(page) | attr;
+		addr += 0x1000;
+		page += 0x1000;
+	}
+	smmu_flush_all();
+}
+
+u32 *smmu_init_for_tsec()
+{
+	return smmu_init_domain4(MC_SMMU_TSEC_ASID, 1);
+}
+
+void smmu_deinit_for_tsec()
+{
+	MC(MC_SMMU_PTB_ASID) = 1;
+	MC(MC_SMMU_PTB_DATA) = 0;
+	MC(MC_SMMU_TSEC_ASID) = 0;
+	smmu_flush_regs();
+}
+

bootloader/soc/smmu.h

@@ -0,0 +1,82 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "../utils/types.h"
+
+#define SMMU_HEAP_ADDR 0xA0000000
+
+#define MC_INTSTATUS                 0x0
+#define MC_INTMASK                   0x4
+#define MC_ERR_STATUS                0x8
+#define MC_ERR_ADR                   0xc
+#define MC_SMMU_CONFIG               0x10
+#define MC_SMMU_TLB_CONFIG           0x14
+#define MC_SMMU_PTC_CONFIG           0x18
+#define MC_SMMU_PTB_ASID             0x1c
+#define MC_SMMU_PTB_DATA             0x20
+#define MC_SMMU_TLB_FLUSH            0x30
+#define MC_SMMU_PTC_FLUSH            0x34
+#define MC_SMMU_ASID_SECURITY        0x38
+#define MC_SMMU_TSEC_ASID            0x294
+#define MC_SMMU_TRANSLATION_ENABLE_0 0x228
+#define MC_SMMU_TRANSLATION_ENABLE_1 0x22c
+#define MC_SMMU_TRANSLATION_ENABLE_2 0x230
+#define MC_SMMU_TRANSLATION_ENABLE_3 0x234
+#define MC_SMMU_TRANSLATION_ENABLE_4 0xb98
+
+#define SMMU_PDE_NEXT_SHIFT 28
+#define MC_SMMU_PTB_DATA_0_ASID_NONSECURE_SHIFT 29
+#define MC_SMMU_PTB_DATA_0_ASID_WRITABLE_SHIFT  30
+#define MC_SMMU_PTB_DATA_0_ASID_READABLE_SHIFT  31
+#define SMMU_PAGE_SHIFT 12
+#define SMMU_PAGE_SIZE  (1 << SMMU_PAGE_SHIFT)
+#define SMMU_PDIR_COUNT 1024
+#define SMMU_PDIR_SIZE  (sizeof(u32) * SMMU_PDIR_COUNT)
+#define SMMU_PTBL_COUNT 1024
+#define SMMU_PTBL_SIZE  (sizeof(u32) * SMMU_PTBL_COUNT)
+#define SMMU_PDIR_SHIFT 12
+#define SMMU_PDE_SHIFT  12
+#define SMMU_PTE_SHIFT  12
+#define SMMU_PFN_MASK   0x000FFFFF
+#define SMMU_ADDR_TO_PFN(addr) ((addr) >> 12)
+#define SMMU_ADDR_TO_PDN(addr) ((addr) >> 22)
+#define SMMU_PDN_TO_ADDR(addr) ((pdn) << 22)
+#define _READABLE  (1 << MC_SMMU_PTB_DATA_0_ASID_READABLE_SHIFT)
+#define _WRITABLE  (1 << MC_SMMU_PTB_DATA_0_ASID_WRITABLE_SHIFT)
+#define _NONSECURE (1 << MC_SMMU_PTB_DATA_0_ASID_NONSECURE_SHIFT)
+#define _PDE_NEXT  (1 << SMMU_PDE_NEXT_SHIFT)
+#define _MASK_ATTR (_READABLE | _WRITABLE | _NONSECURE)
+#define _PDIR_ATTR (_READABLE | _WRITABLE | _NONSECURE)
+#define _PDE_ATTR  (_READABLE | _WRITABLE | _NONSECURE)
+#define _PDE_VACANT(pdn) (((pdn) << 10) | _PDE_ATTR)
+#define _PTE_ATTR  (_READABLE | _WRITABLE | _NONSECURE)
+#define _PTE_VACANT(addr) (((addr) >> SMMU_PAGE_SHIFT) | _PTE_ATTR)
+#define SMMU_MK_PDIR(page, attr) (((page) >> SMMU_PDIR_SHIFT) | (attr))
+#define SMMU_MK_PDE(page, attr)  (((page) >> SMMU_PDE_SHIFT) | (attr))
+
+void *page_alloc(u32 num);
+u32 *smmu_alloc_pdir();
+void smmu_flush_regs();
+void smmu_flush_all();
+void smmu_init(u32 secmon_base);
+void smmu_enable();
+bool smmu_is_used();
+void smmu_exit();
+u32 *smmu_init_domain4(u32 dev_base, u32 asid);
+u32 *smmu_get_pte(u32 *pdir, u32 iova);
+void smmu_map(u32 *pdir, u32 addr, u32 page, int cnt, u32 attr);
+u32 *smmu_init_for_tsec();
+void smmu_deinit_for_tsec();

bootloader/soc/t210.h

@@ -19,6 +19,7 @@
 
 #include "../utils/types.h"
 
+#define BOOTROM_BASE 0x100000
 #define HOST1X_BASE 0x50000000
 #define BPMP_CACHE_BASE 0x50040000
 #define DISPLAY_A_BASE 0x54200000
@@ -41,19 +42,23 @@
 #define GPIO_7_BASE (GPIO_BASE + 0x600)
 #define GPIO_8_BASE (GPIO_BASE + 0x700)
 #define EXCP_VEC_BASE 0x6000F000
+#define IPATCH_BASE 0x6001DC00
 #define APB_MISC_BASE 0x70000000
 #define PINMUX_AUX_BASE 0x70003000
 #define UART_BASE 0x70006000
+#define PWM_BASE 0x7000A000
 #define RTC_BASE 0x7000E000
 #define PMC_BASE 0x7000E400
-#define SYSCTR0_BASE 0x7000F000
+#define SYSCTR0_BASE 0x700F0000
 #define FUSE_BASE 0x7000F800
 #define KFUSE_BASE 0x7000FC00
 #define SE_BASE 0x70012000
 #define MC_BASE 0x70019000
 #define EMC_BASE 0x7001B000
 #define MIPI_CAL_BASE 0x700E3000
+#define CL_DVFS_BASE 0x70110000
 #define I2S_BASE 0x702D1000
+#define TZRAM_BASE 0x7C010000
 
 #define _REG(base, off) *(vu32 *)((base) + (off))
 
@@ -81,6 +86,7 @@
 #define EXCP_VEC(off) _REG(EXCP_VEC_BASE, off)
 #define APB_MISC(off) _REG(APB_MISC_BASE, off)
 #define PINMUX_AUX(off) _REG(PINMUX_AUX_BASE, off)
+#define PWM(off) _REG(PWM_BASE, off)
 #define RTC(off) _REG(RTC_BASE, off)
 #define PMC(off) _REG(PMC_BASE, off)
 #define SYSCTR0(off) _REG(SYSCTR0_BASE, off)
@@ -91,9 +97,18 @@
 #define EMC(off) _REG(EMC_BASE, off)
 #define MIPI_CAL(off) _REG(MIPI_CAL_BASE, off)
 #define I2S(off) _REG(I2S_BASE, off)
+#define CL_DVFS(off) _REG(CL_DVFS_BASE, off)
+#define TEST_REG(off) _REG(0x0, off)
+
+/*! EVP registers. */
+#define EVP_CPU_RESET_VECTOR 0x100
 
 /*! Misc registers. */
+#define APB_MISC_PP_STRAPPING_OPT_A 0x08
 #define APB_MISC_PP_PINMUX_GLOBAL 0x40
+#define APB_MISC_GP_LCD_BL_PWM_CFGPADCTRL 0xA34
+#define APB_MISC_GP_SDMMC1_PAD_CFGPADCTRL 0xA98
+#define APB_MISC_GP_EMMC4_PAD_CFGPADCTRL 0xAB4
 #define APB_MISC_GP_WIFI_EN_CFGPADCTRL 0xB64
 #define APB_MISC_GP_WIFI_RST_CFGPADCTRL 0xB68
 
@@ -103,10 +118,74 @@
 
 /*! Secure boot registers. */
 #define SB_CSR 0x0
-#define SB_AA64_RESET_LOW 0x30
+#define SB_AA64_RESET_LOW  0x30
 #define SB_AA64_RESET_HIGH 0x34
 
+/*! SOR registers. */
+#define SOR_NV_PDISP_SOR_DP_HDCP_BKSV_LSB   0x1E8
+#define SOR_NV_PDISP_SOR_TMDS_HDCP_BKSV_LSB 0x21C
+#define SOR_NV_PDISP_SOR_TMDS_HDCP_CN_MSB   0x208
+#define SOR_NV_PDISP_SOR_TMDS_HDCP_CN_LSB   0x20C
+
+/*! RTC registers. */
+#define APBDEV_RTC_SECONDS        0x8
+#define APBDEV_RTC_SHADOW_SECONDS 0xC
+#define APBDEV_RTC_MILLI_SECONDS  0x10
+
 /*! SYSCTR0 registers. */
-#define SYSCTR0_CNTFID0 0x20
+#define SYSCTR0_CNTFID0     0x20
+#define SYSCTR0_CNTCR       0x00
+#define SYSCTR0_COUNTERID0  0xFE0
+#define SYSCTR0_COUNTERID1  0xFE4
+#define SYSCTR0_COUNTERID2  0xFE8
+#define SYSCTR0_COUNTERID3  0xFEC
+#define SYSCTR0_COUNTERID4  0xFD0
+#define SYSCTR0_COUNTERID5  0xFD4
+#define SYSCTR0_COUNTERID6  0xFD8
+#define SYSCTR0_COUNTERID7  0xFDC
+#define SYSCTR0_COUNTERID8  0xFF0
+#define SYSCTR0_COUNTERID9  0xFF4
+#define SYSCTR0_COUNTERID10 0xFF8 
+#define SYSCTR0_COUNTERID11 0xFFC
+
+/*! TMR registers. */
+#define TIMERUS_CNTR_1US          (0x10 + 0x0)
+#define TIMERUS_USEC_CFG          (0x10 + 0x4)
+#define TIMER_TMR9_TMR_PTV        0x80
+#define  TIMER_EN     (1 << 31)
+#define  TIMER_PER_EN (1 << 30)
+#define TIMER_WDT4_CONFIG         (0x100 + 0x80)
+#define  TIMER_SRC(TMR) (TMR & 0xF)
+#define  TIMER_PER(PER) ((PER & 0xFF) << 4)
+#define  TIMER_SYSRESET_EN (1 << 14)
+#define  TIMER_PMCRESET_EN (1 << 15)
+#define TIMER_WDT4_COMMAND        (0x108 + 0x80)
+#define  TIMER_START_CNT   (1 << 0)
+#define  TIMER_CNT_DISABLE (1 << 1)
+#define TIMER_WDT4_UNLOCK_PATTERN (0x10C + 0x80)
+#define  TIMER_MAGIC_PTRN 0xC45A
+
+/*! I2S registers. */
+#define I2S1_CG   0x88
+#define I2S1_CTRL 0xA0
+#define I2S2_CG   0x188
+#define I2S2_CTRL 0x1A0
+#define I2S3_CG   0x288
+#define I2S3_CTRL 0x2A0
+#define I2S4_CG   0x388
+#define I2S4_CTRL 0x3A0
+#define I2S5_CG   0x488
+#define I2S5_CTRL 0x4A0
+#define  I2S_CG_SLCG_ENABLE (1 << 0)
+#define  I2S_CTRL_MASTER_EN (1 << 10)
+
+/*! PWM registers. */
+#define PWM_CONTROLLER_PWM_CSR_0 0x00
+#define PWM_CONTROLLER_PWM_CSR_1 0x10
+
+/*! Special registers. */
+#define EMC_SCRATCH0 0x324
+#define  EMC_HEKA_UPD (1 << 30)
+#define  EMC_SEPT_RUN (1 << 31)
 
 #endif

bootloader/soc/uart.c

@@ -25,32 +25,37 @@ void uart_init(u32 idx, u32 baud)
 {
 	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);
 
-	//Set baud rate.
-	u32 rate = (8 * baud + 408000000) / (16 * baud);
-	uart->UART_LCR = 0x80; //Enable DLAB.
-	uart->UART_THR_DLAB = (u8)rate; //Divisor latch LSB.
-	uart->UART_IER_DLAB = (u8)(rate >> 8); //Divisor latch MSB.
-	uart->UART_LCR = 0; //Diable DLAB.
+	// Make sure no data is being sent.
+	uart_wait_idle(idx, UART_TX_IDLE);
 
-	//Setup UART in fifo mode.
-	uart->UART_IER_DLAB = 0;
-	uart->UART_IIR_FCR = 7; //Enable and clear TX and RX FIFOs.
-	(void)uart->UART_LSR;
+	// Misc settings.
+	u32 rate = (8 * baud + 408000000) / (16 * baud);
+	uart->UART_IER_DLAB = 0; // Disable interrupts.
+	uart->UART_MCR = 0; // Disable hardware flow control.
+	uart->UART_LCR = UART_LCR_DLAB | UART_LCR_WORD_LENGTH_8; // Enable DLAB & set 8n1 mode.
+	uart->UART_THR_DLAB = (u8)rate; // Divisor latch LSB.
+	uart->UART_IER_DLAB = (u8)(rate >> 8); // Divisor latch MSB.
+	uart->UART_LCR = UART_LCR_WORD_LENGTH_8; // Diable DLAB.
+
+	// Setup and flush fifo.
+	uart->UART_IIR_FCR = UART_IIR_FCR_EN_FIFO | UART_IIR_FCR_RX_CLR | UART_IIR_FCR_TX_CLR;
 	usleep(3 * ((baud + 999999) / baud));
-	uart->UART_LCR = 3; //Set word length 8.
-	uart->UART_MCR = 0;
-	uart->UART_MSR = 0;
-	uart->UART_IRDA_CSR = 0;
-	uart->UART_RX_FIFO_CFG = 1;
-	uart->UART_MIE = 0;
-	uart->UART_ASR = 0;
+	uart_wait_idle(idx, UART_TX_IDLE | UART_RX_IDLE);
 }
 
 void uart_wait_idle(u32 idx, u32 which)
 {
 	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);
-	while (!(uart->UART_VENDOR_STATUS & which))
-		;
+	if (UART_TX_IDLE & which)
+	{
+		while (!(uart->UART_LSR & UART_LSR_TMTY))
+			;
+	}
+	if (UART_RX_IDLE & which)
+	{
+		while (uart->UART_LSR & UART_LSR_RDR)
+			;
+	}
 }
 
 void uart_send(u32 idx, u8 *buf, u32 len)
@@ -59,7 +64,7 @@ void uart_send(u32 idx, u8 *buf, u32 len)
 
 	for (u32 i = 0; i != len; i++)
 	{
-		while (uart->UART_LSR & UART_TX_FIFO_FULL)
+		while (!(uart->UART_LSR & UART_LSR_THRE))
 			;
 		uart->UART_THR_DLAB = buf[i];
 	};
@@ -71,7 +76,7 @@ void uart_recv(u32 idx, u8 *buf, u32 len)
 
 	for (u32 i = 0; i != len; i++)
 	{
-		while (uart->UART_LSR & UART_RX_FIFO_EMPTY)
+		while (!(uart->UART_LSR & UART_LSR_RDR))
 			;
 		buf[i] = uart->UART_THR_DLAB;
 	};

bootloader/soc/uart.h

@@ -28,11 +28,21 @@
 
 #define BAUD_115200 115200
 
-#define UART_TX_IDLE 0x00000001
-#define UART_RX_IDLE 0x00000002
+#define UART_TX_IDLE 0x1
+#define UART_RX_IDLE 0x2
+
 #define UART_TX_FIFO_FULL 0x100
 #define UART_RX_FIFO_EMPTY 0x200
 
+#define UART_LCR_DLAB 0x80
+#define UART_LCR_WORD_LENGTH_8 0x3
+#define UART_LSR_RDR 0x1
+#define UART_LSR_THRE 0x20
+#define UART_LSR_TMTY 0x40
+#define UART_IIR_FCR_TX_CLR 0x4
+#define UART_IIR_FCR_RX_CLR 0x2
+#define UART_IIR_FCR_EN_FIFO 0x1
+
 typedef struct _uart_t
 {
 	/* 0x00 */ vu32 UART_THR_DLAB;

bootloader/storage/nx_emmc.h

@@ -59,7 +59,7 @@ typedef struct _emmc_part_t
 	u32 lba_start;
 	u32 lba_end;
 	u64 attrs;
-	s8 name[37];
+	char name[37];
 	link_t link;
 } emmc_part_t;
 

bootloader/storage/sdmmc.c

@@ -19,13 +19,11 @@
 #include "sdmmc.h"
 #include "mmc.h"
 #include "sd.h"
-#include "../utils/util.h"
+#include "../gfx/gfx.h"
 #include "../mem/heap.h"
+#include "../utils/util.h"
 
-/*#include "gfx.h"
-extern gfx_ctxt_t gfx_ctxt;
-extern gfx_con_t gfx_con;
-#define DPRINTF(...) gfx_printf(&gfx_con, __VA_ARGS__)*/
+//#define DPRINTF(...) gfx_printf(__VA_ARGS__)
 #define DPRINTF(...)
 
 static inline u32 unstuff_bits(u32 *resp, u32 start, u32 size)
@@ -427,7 +425,7 @@ static int _mmc_storage_enable_HS400(sdmmc_storage_t *storage)
 static int _mmc_storage_enable_highspeed(sdmmc_storage_t *storage, u32 card_type, u32 type)
 {
 	//TODO: this should be a config item.
-	//---v
+	// --v
 	if (!1 || sdmmc_get_voltage(storage->sdmmc) != SDMMC_POWER_1_8)
 		goto out;
 
@@ -521,7 +519,7 @@ int sdmmc_storage_init_mmc(sdmmc_storage_t *storage, sdmmc_t *sdmmc, u32 id, u32
 	free(ext_csd);
 	DPRINTF("[MMC] got ext_csd\n");
 	_mmc_storage_parse_cid(storage); //This needs to be after csd and ext_csd
-	//gfx_hexdump(&gfx_con, 0, ext_csd, 512);
+	//gfx_hexdump(0, ext_csd, 512);
 
 	/* When auto BKOPS is enabled the mmc device should be powered all the time until we disable this and check status.
 	   Disable it for now until BKOPS disable added to power down sequence at sdmmc_storage_end().
@@ -532,7 +530,9 @@ int sdmmc_storage_init_mmc(sdmmc_storage_t *storage, sdmmc_t *sdmmc, u32 id, u32
 		DPRINTF("[MMC] BKOPS enabled\n");
 	}
 	else
+	{
 		DPRINTF("[MMC] BKOPS disabled\n");
+	}
 
 	if (!_mmc_storage_enable_highspeed(storage, storage->ext_csd.card_type, type))
 		return 0;
@@ -706,7 +706,7 @@ int _sd_storage_get_scr(sdmmc_storage_t *storage, u8 *buf)
 
 	u32 tmp = 0;
 	sdmmc_get_rsp(storage->sdmmc, &tmp, 4, SDMMC_RSP_TYPE_1);
-    //Prepare buffer for unstuff_bits
+	//Prepare buffer for unstuff_bits
 	for (int i = 0; i < 8; i+=4)
 	{
 		storage->raw_scr[i + 3] = buf[i];
@@ -715,7 +715,7 @@ int _sd_storage_get_scr(sdmmc_storage_t *storage, u8 *buf)
 		storage->raw_scr[i]     = buf[i + 3];
 	}
 	_sd_storage_parse_scr(storage);
-	//gfx_hexdump(&gfx_con, 0, storage->raw_scr, 8);
+	//gfx_hexdump(0, storage->raw_scr, 8);
 
 	return _sdmmc_storage_check_result(tmp);
 }
@@ -827,7 +827,7 @@ int _sd_storage_enable_highspeed_low_volt(sdmmc_storage_t *storage, u32 type, u8
 
 	if (!_sd_storage_switch_get(storage, buf))
 		return 0;
-	//gfx_hexdump(&gfx_con, 0, (u8 *)buf, 64);
+	//gfx_hexdump(0, (u8 *)buf, 64);
 
 	u32 hs_type = 0;
 	switch (type)
@@ -877,7 +877,7 @@ int _sd_storage_enable_highspeed_high_volt(sdmmc_storage_t *storage, u8 *buf)
 {
 	if (!_sd_storage_switch_get(storage, buf))
 		return 0;
-	//gfx_hexdump(&gfx_con, 0, (u8 *)buf, 64);
+	//gfx_hexdump(0, (u8 *)buf, 64);
 	if (!(buf[13] & 2))
 		return 1;
 
@@ -965,7 +965,7 @@ static int _sd_storage_get_ssr(sdmmc_storage_t *storage, u8 *buf)
 		storage->raw_ssr[i]     = buf[i + 3];
 	}
 	_sd_storage_parse_ssr(storage);
-	//gfx_hexdump(&gfx_con, 0, storage->raw_ssr, 64);
+	//gfx_hexdump(0, storage->raw_ssr, 64);
 
 	return _sdmmc_storage_check_result(tmp);
 }
@@ -1090,7 +1090,7 @@ int sdmmc_storage_init_sd(sdmmc_storage_t *storage, sdmmc_t *sdmmc, u32 id, u32
 		return 0;
 	}
 		
-	//gfx_hexdump(&gfx_con, 0, storage->raw_scr, 8);
+	//gfx_hexdump(0, storage->raw_scr, 8);
 	DPRINTF("[SD] got scr\n");
 
 	// Check if card supports a wider bus and if it's not SD Version 1.X
@@ -1105,7 +1105,9 @@ int sdmmc_storage_init_sd(sdmmc_storage_t *storage, sdmmc_t *sdmmc, u32 id, u32
 		DPRINTF("[SD] switched to wide bus width\n");
 	}
 	else
+	{
 		DPRINTF("[SD] SD does not support wide bus width\n");
+	}
 
 	if (storage->is_low_voltage)
 	{
@@ -1131,7 +1133,9 @@ int sdmmc_storage_init_sd(sdmmc_storage_t *storage, sdmmc_t *sdmmc, u32 id, u32
 
 	// Parse additional card info from sd status.
 	if (_sd_storage_get_ssr(storage, buf))
+	{
 		DPRINTF("[SD] got sd status\n");
+	}
 
 	free(buf);
 	return 1;

bootloader/storage/sdmmc.h

@@ -47,7 +47,7 @@ typedef struct _mmc_csd
 	u32 read_blkbits;
 	u32 write_blkbits;
 	u32 capacity;
-	u8  write_protect;  
+	u8  write_protect;
 	u16 busspeed;
 } mmc_csd_t;
 

bootloader/storage/sdmmc_driver.c

@@ -17,20 +17,18 @@
 
 #include <string.h>
 
-#include "sdmmc.h"
-#include "../utils/util.h"
-#include "../soc/clock.h"
 #include "mmc.h"
+#include "sdmmc.h"
+#include "../gfx/gfx.h"
 #include "../power/max7762x.h"
-#include "../soc/t210.h"
-#include "../soc/pmc.h"
-#include "../soc/pinmux.h"
+#include "../soc/clock.h"
 #include "../soc/gpio.h"
+#include "../soc/pinmux.h"
+#include "../soc/pmc.h"
+#include "../soc/t210.h"
+#include "../utils/util.h"
 
-/*#include "gfx.h"
-extern gfx_ctxt_t gfx_ctxt;
-extern gfx_con_t gfx_con;
-#define DPRINTF(...) gfx_printf(&gfx_con, __VA_ARGS__)*/
+//#define DPRINTF(...) gfx_printf(__VA_ARGS__)
 #define DPRINTF(...)
 
 /*! SCMMC controller base addresses. */
@@ -143,8 +141,20 @@ static int _sdmmc_get_clkcon(sdmmc_t *sdmmc)
 static void _sdmmc_pad_config_fallback(sdmmc_t *sdmmc, u32 power)
 {
 	_sdmmc_get_clkcon(sdmmc);
-	if (sdmmc->id == SDMMC_4)
-		*(vu32 *)0x70000AB4 = ((*(vu32 *)0x70000AB4) & 0x3FFC) | 0x1040;
+	switch (sdmmc->id)
+	{
+	case SDMMC_1:
+		if (power == SDMMC_POWER_OFF)
+			break;
+		if (power == SDMMC_POWER_1_8)
+			APB_MISC(APB_MISC_GP_SDMMC1_PAD_CFGPADCTRL) = 0x304; // Up: 3, Dn: 4.
+		else if (power == SDMMC_POWER_3_3)
+			APB_MISC(APB_MISC_GP_SDMMC1_PAD_CFGPADCTRL) = 0x808; // Up: 8, Dn: 8.
+		break;
+	case SDMMC_4:
+		APB_MISC(APB_MISC_GP_EMMC4_PAD_CFGPADCTRL) = (APB_MISC(APB_MISC_GP_EMMC4_PAD_CFGPADCTRL) & 0x3FFC) | 0x1040;
+		break;
+	}
 	//TODO: load standard values for other controllers, can depend on power.
 }
 
@@ -1026,6 +1036,7 @@ void sdmmc_end(sdmmc_t *sdmmc)
 		if (sdmmc->id == SDMMC_1)
 		{
 			gpio_output_enable(GPIO_PORT_E, GPIO_PIN_4, GPIO_OUTPUT_DISABLE);
+			max77620_regulator_enable(REGULATOR_LDO2, 0);
 			msleep(1); // To power cycle min 1ms without power is needed.
 		}
 

bootloader/utils/btn.c

@@ -20,22 +20,23 @@
 #include "../soc/gpio.h"
 #include "../soc/t210.h"
 #include "util.h"
+#include "../power/max77620.h"
 
-u32 btn_read()
+u8 btn_read()
 {
-	u32 res = 0;
+	u8 res = 0;
 	if (!gpio_read(GPIO_PORT_X, GPIO_PIN_7))
 		res |= BTN_VOL_DOWN;
 	if (!gpio_read(GPIO_PORT_X, GPIO_PIN_6))
 		res |= BTN_VOL_UP;
-	if (i2c_recv_byte(4, 0x3C, 0x15) & 0x4)
+	if (i2c_recv_byte(4, MAX77620_I2C_ADDR, 0x15) & 0x4)
 		res |= BTN_POWER;
 	return res;
 }
 
-u32 btn_wait()
+u8 btn_wait()
 {
-	u32 res = 0, btn = btn_read();
+	u8 res = 0, btn = btn_read();
 	bool pwr = false;
 
 	//Power button down, raise a filter.
@@ -58,16 +59,18 @@ u32 btn_wait()
 	return res;
 }
 
-u32 btn_wait_timeout(u32 time_ms, u32 mask)
+u8 btn_wait_timeout(u32 time_ms, u8 mask)
 {
 	u32 timeout = get_tmr_ms() + time_ms;
-	u32 res = btn_read() & mask;
+	u8 res = btn_read() & mask;
 
-	do
+	while (get_tmr_ms() < timeout)
 	{
-		if (!(res & mask))
+		if (res == mask)
+			break;
+		else
 			res = btn_read() & mask;
-	} while (get_tmr_ms() < timeout);
+	};
 
 	return res;
 }

bootloader/utils/btn.h

@@ -20,12 +20,12 @@
 
 #include "types.h"
 
-#define BTN_POWER 0x1
-#define BTN_VOL_DOWN 0x2
-#define BTN_VOL_UP 0x4
+#define BTN_POWER    (1 << 0)
+#define BTN_VOL_DOWN (1 << 1)
+#define BTN_VOL_UP   (1 << 2)
 
-u32 btn_read();
-u32 btn_wait();
-u32 btn_wait_timeout(u32 time_ms, u32 mask);
+u8 btn_read();
+u8 btn_wait();
+u8 btn_wait_timeout(u32 time_ms, u8 mask);
 
 #endif

bootloader/utils/dirlist.c

@@ -21,7 +21,7 @@
 #include "../mem/heap.h"
 #include "../utils/types.h"
 
-char *dirlist(char *directory)
+char *dirlist(const char *directory, const char *pattern, bool includeHiddenFiles)
 {
 	u8 max_entries = 61;
 
@@ -33,32 +33,48 @@ char *dirlist(char *directory)
 	char *dir_entries = (char *)calloc(max_entries, 256);
 	char *temp = (char *)calloc(1, 256);
 
-	if (!f_opendir(&dir, directory))
+	if (!pattern && !f_opendir(&dir, directory))
 	{
 		for (;;)
 		{
 			res = f_readdir(&dir, &fno);
 			if (res || !fno.fname[0])
 				break;
-			if (!(fno.fattrib & AM_DIR))
+			if (!(fno.fattrib & AM_DIR) && (fno.fname[0] != '.') && (includeHiddenFiles || !(fno.fattrib & AM_HID)))
 			{
 				memcpy(dir_entries + (k * 256), fno.fname, strlen(fno.fname) + 1);
 				k++;
 				if (k > (max_entries - 1))
 					break;
 			}
-			else
-				continue;
 		}
 		f_closedir(&dir);
 	}
-	else
+	else if (pattern && !f_findfirst(&dir, &fno, directory, pattern) && fno.fname[0])
+	{
+		do
+		{
+			if (!(fno.fattrib & AM_DIR) && (fno.fname[0] != '.') && (includeHiddenFiles || !(fno.fattrib & AM_HID)))
+			{
+				memcpy(dir_entries + (k * 256), fno.fname, strlen(fno.fname) + 1);
+				k++;
+				if (k > (max_entries - 1))
+					break;
+			}
+			res = f_findnext(&dir, &fno);
+		} while (fno.fname[0] && !res);
+		f_closedir(&dir);
+	}
+
+	if (!k)
 	{
 		free(temp);
 		free(dir_entries);
+
 		return NULL;
 	}
 
+	// Reorder ini files by ASCII ordering.
 	for (i = 0; i < k - 1 ; i++)
 	{
 		for (j = i + 1; j < k; j++)

bootloader/utils/dirlist.h

@@ -16,4 +16,4 @@
 
 #include "../utils/types.h"
 
-char *dirlist(char *directory);
+char *dirlist(const char *directory, const char *pattern, bool includeHiddenFiles);

bootloader/utils/types.h

@@ -26,7 +26,7 @@
 #define OFFSET_OF(t, m) ((u32)&((t *)NULL)->m)
 #define CONTAINER_OF(mp, t, mn) ((t *)((u32)mp - OFFSET_OF(t, mn)))
 
-typedef char s8;
+typedef signed char s8;
 typedef short s16;
 typedef short SHORT;
 typedef int s32;
@@ -51,4 +51,37 @@ typedef int bool;
 #define true  1
 #define false 0
 
+#define BOOT_CFG_AUTOBOOT_EN (1 << 0)
+#define BOOT_CFG_FROM_LAUNCH (1 << 1)
+#define BOOT_CFG_SEPT_RUN    (1 << 7)
+
+#define EXTRA_CFG_KEYS    (1 << 0)
+#define EXTRA_CFG_PAYLOAD (1 << 1)
+#define EXTRA_CFG_MODULE  (1 << 2)
+
+typedef struct __attribute__((__packed__)) _boot_cfg_t
+{
+	u8  boot_cfg;
+	u8  autoboot;
+	u8  autoboot_list;
+	u8  extra_cfg;
+	u8  rsvd[128];
+} boot_cfg_t;
+
+typedef struct __attribute__((__packed__)) _ipl_ver_meta_t
+{
+	u32 magic;
+	u32 version;
+	u16 rsvd0;
+	u16 rsvd1;
+} ipl_ver_meta_t;
+
+typedef struct __attribute__((__packed__)) _reloc_meta_t
+{
+	u32 start;
+	u32 stack;
+	u32 end;
+	u32 ep;
+} reloc_meta_t;
+
 #endif

bootloader/utils/util.c

@@ -16,36 +16,44 @@
 */
 
 #include "util.h"
+#include "../gfx/di.h"
+#include "../power/max77620.h"
+#include "../rtc/max77620-rtc.h"
+#include "../soc/i2c.h"
+#include "../soc/pmc.h"
 #include "../soc/t210.h"
 
+extern void sd_unmount();
+
 u32 get_tmr_s()
 {
-	return RTC(0x8); //RTC_SECONDS
+	return RTC(APBDEV_RTC_SECONDS);
 }
 
 u32 get_tmr_ms()
 {
 	// The registers must be read with the following order:
-	// -> RTC_MILLI_SECONDS (0x10) -> RTC_SHADOW_SECONDS (0xC)
-	return (RTC(0x10) | (RTC(0xC)<< 10));
+	// RTC_MILLI_SECONDS (0x10) -> RTC_SHADOW_SECONDS (0xC)
+	return (RTC(APBDEV_RTC_MILLI_SECONDS) | (RTC(APBDEV_RTC_SHADOW_SECONDS) << 10));
 }
 
 u32 get_tmr_us()
 {
-	return TMR(0x10); //TIMERUS_CNTR_1US
+	return TMR(TIMERUS_CNTR_1US); //TIMERUS_CNTR_1US
 }
 
 void msleep(u32 milliseconds)
 {
-	u32 start = RTC(0x10) | (RTC(0xC)<< 10);
-	while (((RTC(0x10) | (RTC(0xC)<< 10)) - start) <= milliseconds)
+	u32 start = RTC(APBDEV_RTC_MILLI_SECONDS) | (RTC(APBDEV_RTC_SHADOW_SECONDS) << 10);
+	while (((RTC(APBDEV_RTC_MILLI_SECONDS) | (RTC(APBDEV_RTC_SHADOW_SECONDS) << 10)) - start) <= milliseconds)
 		;
 }
 
 void usleep(u32 microseconds)
 {
-	u32 start = TMR(0x10);
-	while ((TMR(0x10) - start) <= microseconds)
+	u32 start = TMR(TIMERUS_CNTR_1US);
+	// Casting to u32 is important!
+	while ((u32)(TMR(TIMERUS_CNTR_1US) - start) <= microseconds)
 		;
 }
 
@@ -55,6 +63,50 @@ void exec_cfg(u32 *base, const cfg_op_t *ops, u32 num_ops)
 		base[ops[i].off] = ops[i].val;
 }
 
+void panic(u32 val)
+{
+	// Set panic code.
+	PMC(APBDEV_PMC_SCRATCH200) = val;
+	//PMC(APBDEV_PMC_CRYPTO_OP) = PMC_CRYPTO_OP_SE_DISABLE;
+	TMR(TIMER_WDT4_UNLOCK_PATTERN) = TIMER_MAGIC_PTRN;
+	TMR(TIMER_TMR9_TMR_PTV) = TIMER_EN | TIMER_PER_EN;
+	TMR(TIMER_WDT4_CONFIG)  = TIMER_SRC(9) | TIMER_PER(1) | TIMER_PMCRESET_EN;
+	TMR(TIMER_WDT4_COMMAND) = TIMER_START_CNT;
+	while (1)
+		;
+}
+
+void reboot_normal()
+{
+	sd_unmount();
+	display_end();
+
+	panic(0x21); // Bypass fuse programming in package1.
+}
+
+void reboot_rcm()
+{
+	sd_unmount();
+	display_end();
+
+	PMC(APBDEV_PMC_SCRATCH0) = 2; // Reboot into rcm.
+	PMC(APBDEV_PMC_CNTRL) |= PMC_CNTRL_MAIN_RST;
+
+	while (true)
+		usleep(1);
+}
+
+void power_off()
+{
+	sd_unmount();
+
+	// Stop the alarm, in case we injected and powered off too fast.
+	max77620_rtc_stop_alarm();
+
+	//TODO: we should probably make sure all regulators are powered off properly.
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_ONOFFCNFG1, MAX77620_ONOFFCNFG1_PWR_OFF);
+}
+
 #define CRC32C_POLY 0x82F63B78
 u32 crc32c(const void *buf, u32 len)
 {
@@ -68,31 +120,3 @@ u32 crc32c(const void *buf, u32 len)
 	}
 	return ~crc;
 }
-
-u32 memcmp32sparse(const u32 *buf1, const u32 *buf2, u32 len)
-{
-	u32 len32 = len / 4;
-
-	if (!(len32 % 32))
-	{
-		while (len32)
-		{
-			len32 -= 32;
-			if(buf1[len32] != buf2[len32])
-				return 1;
-		}
-	}
-	else
-	{
-		while (len32)
-		{
-			len32 -= 32;
-			if(buf1[len32] != buf2[len32])
-				return 1;
-			if (len32 < 32)
-				return 0;
-		}
-	}
-
-	return 0;
-}

bootloader/utils/util.h

@@ -20,8 +20,8 @@
 
 #include "types.h"
 
-#define byte_swap_32(num) ((num >> 24) & 0xff) | ((num << 8) & 0xff0000) | \
-						((num >> 8 )& 0xff00) | ((num << 24) & 0xff000000)
+#define byte_swap_32(num) (((num >> 24) & 0xff) | ((num << 8) & 0xff0000) | \
+						((num >> 8 )& 0xff00) | ((num << 24) & 0xff000000))
 
 typedef struct _cfg_op_t
 {
@@ -34,11 +34,11 @@ u32 get_tmr_ms();
 u32 get_tmr_s();
 void usleep(u32 ticks);
 void msleep(u32 milliseconds);
+void panic(u32 val);
+void reboot_normal();
+void reboot_rcm();
+void power_off();
 void exec_cfg(u32 *base, const cfg_op_t *ops, u32 num_ops);
 u32 crc32c(const void *buf, u32 len);
 
-/* This is a faster implementation of memcmp that checks two u32 values */
-/* every 128 Bytes block. Intented only for Backup and Restore          */
-u32 memcmp32sparse(const u32 *buf1, const u32 *buf2, u32 len);
-
 #endif

modules/hekate_libsys_minerva/Makefile

@@ -0,0 +1,32 @@
+ifeq ($(strip $(DEVKITARM)),)
+$(error "Please set DEVKITARM in your environment. export DEVKITARM=<path to>devkitARM")
+endif
+
+include $(DEVKITARM)/base_rules
+
+TARGET := libsys_minerva
+BUILD := ../../build/$(TARGET)
+OUTPUT := ../../output
+VPATH = $(dir $(wildcard ./*/)) $(dir $(wildcard ./*/*/))
+
+OBJS = $(addprefix $(BUILD)/,\
+	sys_sdrammtc.o \
+)
+
+ARCH := -march=armv4t -mtune=arm7tdmi -mthumb-interwork
+CFLAGS = $(ARCH) -O2 -nostdlib -fpie -ffunction-sections -fdata-sections -fomit-frame-pointer -fno-inline -std=gnu11 -Wall $(CUSTOMDEFINES)
+LDFLAGS = $(ARCH) -fpie -pie -nostartfiles -lgcc
+
+.PHONY: clean all
+
+all: $(TARGET).bso
+$(BUILD)/%.o: ./%.c
+	@mkdir -p "$(BUILD)"
+	$(CC) $(CFLAGS) -c $< -o $@
+	
+$(TARGET).bso: $(OBJS)
+	$(CC) $(LDFLAGS) -e _minerva_init $^ -o $(OUTPUT)/$(TARGET).bso
+	$(STRIP) -g $(OUTPUT)/$(TARGET).bso
+
+clean:
+	@rm -rf $(OUTPUT)/$(TARGET).bso

modules/hekate_libsys_minerva/README.md

@@ -0,0 +1,13 @@
+# Minerva Training Cell
+
+### Custom Nvidia Tegra X1 DRAM trainer.
+
+For more, check [Here](https://github.com/CTCaer/minerva_tc).
+
+
+
+```
+Minerva Training Cell (C) 2018 CTCaer.
+
+/* Pain... And suffering. */
+```

modules/hekate_libsys_minerva/mtc.h

@@ -0,0 +1,142 @@
+/*
+ * Minerva Training Cell
+ * DRAM Training for Tegra X1 SoC. Supports DDR2/3 and LPDDR3/4.
+ *
+ * Copyright (c) 2018 CTCaer  <ctcaer@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _MTC_H_
+#define _MTC_H_
+
+#include "mtc_table.h"
+#include "types.h"
+
+/* Address bases and access macros - Change these for mapped access */
+#define TMR_BASE   0x60005000
+#define CLOCK_BASE 0x60006000
+#define MC_BASE    0x70019000
+#define EMC_BASE   0x7001B000
+#define EMC0_BASE  0x7001E000
+#define EMC1_BASE  0x7001F000
+#define MTC_TABLE  0x8F000000
+
+#define _REG(base, off) *(vu32 *)((base) + (off))
+
+#define TMR(off) _REG(TMR_BASE, off)
+#define CLOCK(off) _REG(CLOCK_BASE, off)
+#define MC(off) _REG(MC_BASE, off)
+#define EMC(off) _REG(EMC_BASE, off)
+#define EMC_CH0(off) _REG(EMC0_BASE, off)
+#define EMC_CH1(off) _REG(EMC1_BASE, off)
+/* End of addresses and access macros */
+
+#define EMC_TABLE_SIZE_R7         49280
+#define EMC_TABLE_ENTRY_SIZE_R7   4928
+#define EMC_STATUS_UPDATE_TIMEOUT 1000
+#define EMC_PERIODIC_TRAIN_MS     100
+#define EMC_TEMP_COMP_MS          1000
+
+typedef struct
+{
+	s32 rate_to;
+	s32 rate_from;
+	emc_table_t *mtc_table;
+	u32 table_entries;
+	emc_table_t *current_emc_table;
+	u32 train_mode;
+	u32 sdram_id;
+	u32 prev_temp;
+	bool emc_2X_clk_src_is_pllmb;
+	bool fsp_for_src_freq;
+	bool train_ram_patterns;
+} mtc_config_t;
+
+enum train_mode_t
+{
+	OP_SWITCH         = 0,
+	OP_TRAIN          = 1,
+	OP_TRAIN_SWITCH   = 2,
+	OP_PERIODIC_TRAIN = 3,
+	OP_TEMP_COMP      = 4
+};
+
+enum comp_seq_t
+{
+	DVFS_SEQUENCE              = 1,
+	WRITE_TRAINING_SEQUENCE    = 2,
+	PERIODIC_TRAINING_SEQUENCE = 3
+};
+
+enum tree_update_mode_t
+{
+	DVFS_PT1                 = 10,
+	DVFS_UPDATE              = 11,
+	TRAINING_PT1             = 12,
+	TRAINING_UPDATE          = 13,
+	PERIODIC_TRAINING_UPDATE = 14
+};
+
+enum emc_channels
+{
+	EMC_CH0 = 0,
+	EMC_CH1 = 1
+};
+
+enum EMC_2X_CLK_SRC
+{
+	PLLM_OUT0  = 0x0,
+	PLLC_OUT0  = 0x1,
+	PLLP_OUT0  = 0x2,
+	CLK_M      = 0x3,
+	PLLM_UD    = 0x4,
+	PLLMB_UD   = 0x5,
+	PLLMB_OUT0 = 0x6,
+	PLLP_UD    = 0x7
+};
+
+enum DRAM_TYPE
+{
+	DRAM_TYPE_DDR3   = 0,
+	DRAM_TYPE_LPDDR4 = 1,
+	DRAM_TYPE_LPDDR2 = 2,
+	DRAM_TYPE_DDR2   = 3
+};
+
+enum DRAM_DEV_NO
+{
+	ONE_RANK = 1,
+	TWO_RANK = 2
+};
+
+enum DRAM_OVER_TEMP_REF
+{
+	REFRESH_X2 = 1,
+	REFRESH_X4 = 2
+};
+
+/* Timers for the below two compensation functions should be paused when changing timings. */
+
+/* Change refresh rate based on dram temps. Run every 1000ms. */
+/* Timer should be run only when another component reports over temperature. */
+void _minerva_do_over_temp_compensation(mtc_config_t *mtc_cfg);
+
+/* Periodic compensation only for tight timings that need it. Run every 100ms. */
+/* Over temp and periodic compensation, should not access EMC_MRR at the same time. */
+u32  _minerva_do_periodic_compensation(emc_table_t *mtc_table_entry);
+
+/* Main function used to access all Minerva functions. */
+void _minerva_init(mtc_config_t *mtc_cfg, void* bp);
+
+#endif

modules/hekate_libsys_minerva/mtc_mc_emc_regs.h

@@ -0,0 +1,626 @@
+/*
+ * Minerva Training Cell
+ * DRAM Training for Tegra X1 SoC. Supports DDR2/3 and LPDDR3/4.
+ *
+ * Copyright (c) 2018 CTCaer  <ctcaer@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _MTC_MC_EMC_REGS_H_
+#define _MTC_MC_EMC_REGS_H_
+
+/* Clock controller registers */
+#define CLK_RST_CONTROLLER_PLLM_BASE           0x90
+#define CLK_RST_CONTROLLER_PLLM_MISC2          0x9C
+#define  PLLM_ENABLE (1 << 30)
+#define  PLLM_LOCK   (1 << 27)
+
+#define CLK_RST_CONTROLLER_CLK_SOURCE_EMC      0x19C
+#define  EMC_2X_CLK_SRC_SHIFT 29
+
+#define CLK_RST_CONTROLLER_CLK_OUT_ENB_X       0x280
+#define CLK_RST_CONTROLLER_CLK_ENB_X_SET       0x284
+#define CLK_RST_CONTROLLER_CLK_ENB_X_CLR       0x288
+#define CLK_RST_CONTROLLER_PLLMB_BASE          0x5E8
+#define CLK_RST_CONTROLLER_CLK_SOURCE_EMC_DLL  0x664
+#define CLK_RST_CONTROLLER_CLK_SOURCE_EMC_SAFE 0x724
+
+/* Memory controller registers */
+#define MC_EMEM_ADR_CFG               0x54
+#define MC_EMEM_ARB_CFG               0x90
+#define MC_EMEM_ARB_OUTSTANDING_REQ   0x94
+#define MC_EMEM_ARB_TIMING_RCD        0x98
+#define MC_EMEM_ARB_TIMING_RP         0x9C
+#define MC_EMEM_ARB_TIMING_RC         0xA0
+#define MC_EMEM_ARB_TIMING_RAS        0xA4
+#define MC_EMEM_ARB_TIMING_FAW        0xA8
+#define MC_EMEM_ARB_TIMING_RRD        0xAC
+#define MC_EMEM_ARB_TIMING_RAP2PRE    0xB0
+#define MC_EMEM_ARB_TIMING_WAP2PRE    0xB4
+#define MC_EMEM_ARB_TIMING_R2R        0xB8
+#define MC_EMEM_ARB_TIMING_W2W        0xBC
+#define MC_EMEM_ARB_TIMING_R2W        0xC0
+#define MC_EMEM_ARB_TIMING_W2R        0xC4
+#define MC_EMEM_ARB_MISC2             0xC8
+#define MC_EMEM_ARB_DA_TURNS          0xD0
+#define MC_EMEM_ARB_DA_COVERS         0xD4
+#define MC_EMEM_ARB_MISC0             0xD8
+#define MC_EMEM_ARB_MISC1             0xDC
+#define MC_EMEM_ARB_RING1_THROTTLE    0xE0
+
+#define MC_LATENCY_ALLOWANCE_AVPC_0    0x2E4
+#define MC_LATENCY_ALLOWANCE_HC_0      0x310
+#define MC_LATENCY_ALLOWANCE_HC_1      0x314
+#define MC_LATENCY_ALLOWANCE_MPCORE_0  0x320
+#define MC_LATENCY_ALLOWANCE_NVENC_0   0x328
+#define MC_LATENCY_ALLOWANCE_PPCS_0    0x344
+#define MC_LATENCY_ALLOWANCE_PPCS_1    0x348
+#define MC_LATENCY_ALLOWANCE_ISP2_0    0x370
+#define MC_LATENCY_ALLOWANCE_ISP2_1    0x374
+#define MC_LATENCY_ALLOWANCE_XUSB_0    0x37C
+#define MC_LATENCY_ALLOWANCE_XUSB_1    0x380
+#define MC_LATENCY_ALLOWANCE_TSEC_0    0x390
+#define MC_LATENCY_ALLOWANCE_VIC_0     0x394
+#define MC_LATENCY_ALLOWANCE_VI2_0     0x398
+#define MC_LATENCY_ALLOWANCE_GPU_0     0x3AC
+#define MC_LATENCY_ALLOWANCE_SDMMCA_0  0x3B8
+#define MC_LATENCY_ALLOWANCE_SDMMCAA_0 0x3BC
+#define MC_LATENCY_ALLOWANCE_SDMMC_0   0x3C0
+#define MC_LATENCY_ALLOWANCE_SDMMCAB_0 0x3C4
+#define MC_LATENCY_ALLOWANCE_NVDEC_0   0x3D8
+#define MC_LATENCY_ALLOWANCE_GPU2_0    0x3E8
+
+#define MC_MLL_MPCORER_PTSA_RATE  0x44C
+#define MC_FTOP_PTSA_RATE         0x50C
+
+#define MC_EMEM_ARB_TIMING_RFCPB      0x6C0
+#define MC_EMEM_ARB_TIMING_CCDMW      0x6C4
+#define MC_EMEM_ARB_REFPB_HP_CTRL     0x6F0
+#define MC_EMEM_ARB_REFPB_BANK_CTRL   0x6F4
+
+#define MC_PTSA_GRANT_DECREMENT       0x960
+
+#define MC_EMEM_ARB_DHYST_CTRL           0xBCC
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_0 0xBD0
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_1 0xBD4
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_2 0xBD8
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_3 0xBDC
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_4 0xBE0
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_5 0xBE4
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_6 0xBE8
+#define MC_EMEM_ARB_DHYST_TIMEOUT_UTIL_7 0xBEC
+
+/* External Memory controller registers */
+#define EMC_INTSTATUS                 0x0
+#define  CLKCHANGE_COMPLETE_INT (1 << 4)
+
+#define EMC_DBG                       0x8
+#define EMC_CFG                       0xC
+#define EMC_PIN                       0x24
+#define EMC_TIMING_CONTROL            0x28
+#define EMC_RC                        0x2C
+#define EMC_RFC                       0x30
+#define EMC_RAS                       0x34
+#define EMC_RP                        0x38
+#define EMC_R2W                       0x3C
+#define EMC_W2R                       0x40
+#define EMC_R2P                       0x44
+#define EMC_W2P                       0x48
+#define EMC_RD_RCD                    0x4C
+#define EMC_WR_RCD                    0x50
+#define EMC_RRD                       0x54
+#define EMC_REXT                      0x58
+#define EMC_WDV                       0x5C
+#define EMC_QUSE                      0x60
+#define EMC_QRST                      0x64
+#define EMC_QSAFE                     0x68
+#define EMC_RDV                       0x6C
+#define EMC_REFRESH                   0x70
+#define EMC_BURST_REFRESH_NUM         0x74
+#define EMC_PDEX2WR                   0x78
+#define EMC_PDEX2RD                   0x7C
+#define EMC_PCHG2PDEN                 0x80
+#define EMC_ACT2PDEN                  0x84
+#define EMC_AR2PDEN                   0x88
+#define EMC_RW2PDEN                   0x8C
+#define EMC_TXSR                      0x90
+#define EMC_TCKE                      0x94
+#define EMC_TFAW                      0x98
+#define EMC_TRPAB                     0x9C
+#define EMC_TCLKSTABLE                0xA0
+#define EMC_TCLKSTOP                  0xA4
+#define EMC_TREFBW                    0xA8
+#define EMC_TPPD                      0xAC
+#define EMC_ODT_WRITE                 0xB0
+#define EMC_PDEX2MRR                  0xB4
+#define EMC_WEXT                      0xB8
+#define EMC_RFC_SLR                   0xC0
+#define EMC_MRS_WAIT_CNT2             0xC4
+#define EMC_MRS_WAIT_CNT              0xC8
+#define EMC_MRS                       0xCC
+#define EMC_EMRS                      0xD0
+#define EMC_REF                       0xD4
+#define EMC_MRW                       0xE8
+#define EMC_SELF_REF                  0xE0
+#define EMC_MRR                       0xEC
+#define EMC_FBIO_SPARE                0x100
+#define EMC_FBIO_CFG5                 0x104
+#define EMC_PDEX2CKE                  0x118
+#define EMC_CKE2PDEN                  0x11C
+#define EMC_MPC                       0x128
+#define EMC_EMRS2                     0x12C
+#define EMC_MRW2                      0x134
+#define EMC_MRW3                      0x138
+#define EMC_MRW4                      0x13C
+#define EMC_R2R                       0x144
+#define EMC_EINPUT                    0x14C
+#define EMC_EINPUT_DURATION           0x150
+#define EMC_PUTERM_EXTRA              0x154
+#define EMC_TCKESR                    0x158
+#define EMC_TPD                       0x15C
+#define EMC_AUTO_CAL_CONFIG           0x2A4
+
+#define EMC_EMC_STATUS                0x2B4
+#define  TIMING_UPDATE_STALLED  (1 << 23)
+#define  MRR_DIVLD              (1 << 20)
+#define  IN_SELF_REFRESH_MASK   (3 << 8)
+#define  IN_POWERDOWN_MASK      (3 << 4)
+#define  REQ_FIFO_EMPTY         (1 << 0)
+
+#define EMC_CFG_2                     0x2B8
+#define EMC_CFG_DIG_DLL               0x2BC
+#define EMC_CFG_DIG_DLL_PERIOD        0x2C0
+#define EMC_DIG_DLL_STATUS            0x2C4
+#define EMC_RDV_MASK                  0x2CC
+#define EMC_WDV_MASK                  0x2D0
+#define EMC_RDV_EARLY_MASK            0x2D4
+#define EMC_RDV_EARLY                 0x2D8
+#define EMC_AUTO_CAL_CONFIG8          0x2DC
+#define EMC_ZCAL_INTERVAL             0x2E0
+#define EMC_ZCAL_WAIT_CNT             0x2E4
+#define EMC_ZQ_CAL                    0x2EC
+#define EMC_FDPD_CTRL_DQ              0x310
+#define EMC_FDPD_CTRL_CMD             0x314
+#define EMC_PMACRO_CMD_BRICK_CTRL_FDPD     0x318
+#define EMC_PMACRO_DATA_BRICK_CTRL_FDPD    0x31C
+#define EMC_SCRATCH0                  0x324
+#define EMC_PMACRO_BRICK_CTRL_RFU1    0x330
+#define EMC_PMACRO_BRICK_CTRL_RFU2    0x334
+#define EMC_TR_TIMING_0               0x3B4
+#define EMC_TR_CTRL_0                 0x3B8
+#define EMC_TR_CTRL_1                 0x3BC
+#define EMC_SWITCH_BACK_CTRL          0x3C0
+#define EMC_TR_RDV                    0x3C4
+#define EMC_STALL_THEN_EXE_AFTER_CLKCHANGE 0x3CC
+#define EMC_SEL_DPD_CTRL              0x3D8
+#define EMC_PRE_REFRESH_REQ_CNT       0x3DC
+#define EMC_DYN_SELF_REF_CONTROL      0x3E0
+#define EMC_TXSRDLL                   0x3E4
+#define EMC_CCFIFO_ADDR               0x3E8
+#define EMC_CCFIFO_DATA               0x3EC
+#define EMC_CCFIFO_STATUS             0x3F0
+#define EMC_TR_QPOP                   0x3F4
+#define EMC_TR_RDV_MASK               0x3F8
+#define EMC_TR_QSAFE                  0x3FC
+#define EMC_TR_QRST                   0x400
+#define EMC_AUTO_CAL_CONFIG2          0x458
+#define EMC_AUTO_CAL_CONFIG3          0x45C
+#define EMC_TR_DVFS                   0x460
+#define EMC_AUTO_CAL_CHANNEL          0x464
+#define EMC_IBDLY                     0x468
+#define EMC_OBDLY                     0x46c
+#define EMC_TXDSRVTTGEN               0x480
+#define EMC_WE_DURATION               0x48C
+#define EMC_WS_DURATION               0x490
+#define EMC_WEV                       0x494
+#define EMC_WSV                       0x498
+#define EMC_CFG_3                     0x49C
+#define EMC_MRW6                      0x4A4
+#define EMC_MRW7                      0x4A8
+#define EMC_MRW8                      0x4AC
+#define EMC_MRW14                     0x4C4
+#define EMC_MRW15                     0x4D0
+#define EMC_CFG_SYNC                  0x4D4
+#define EMC_FDPD_CTRL_CMD_NO_RAMP     0x4D8
+#define EMC_WDV_CHK                   0x4E0
+#define EMC_CFG_PIPE_2                0x554
+#define EMC_CFG_PIPE_CLK              0x558
+#define EMC_CFG_PIPE_1                0x55C
+#define EMC_CFG_PIPE                  0x560
+#define EMC_QPOP                      0x564
+#define EMC_QUSE_WIDTH                0x568
+#define EMC_PUTERM_WIDTH              0x56C
+#define EMC_AUTO_CAL_CONFIG7          0x574
+#define EMC_REFCTRL2                  0x580
+#define EMC_FBIO_CFG7                 0x584
+
+#define EMC_DATA_BRLSHFT_0            0x588
+#define  EMC_DATA_BRLSHFT_0_RANK0_BYTE0_DATA_BRLSHFT_SHIFT 0
+#define  EMC_DATA_BRLSHFT_0_RANK0_BYTE1_DATA_BRLSHFT_SHIFT 3
+#define  EMC_DATA_BRLSHFT_0_RANK0_BYTE2_DATA_BRLSHFT_SHIFT 6
+#define  EMC_DATA_BRLSHFT_0_RANK0_BYTE3_DATA_BRLSHFT_SHIFT 9
+#define  EMC_DATA_BRLSHFT_0_RANK0_BYTE4_DATA_BRLSHFT_SHIFT 12
+#define  EMC_DATA_BRLSHFT_0_RANK0_BYTE5_DATA_BRLSHFT_SHIFT 15
+#define  EMC_DATA_BRLSHFT_0_RANK0_BYTE6_DATA_BRLSHFT_SHIFT 18
+#define  EMC_DATA_BRLSHFT_0_RANK0_BYTE7_DATA_BRLSHFT_SHIFT 21
+
+#define EMC_DATA_BRLSHFT_1            0x58C
+#define  EMC_DATA_BRLSHFT_1_RANK1_BYTE0_DATA_BRLSHFT_SHIFT 0
+#define  EMC_DATA_BRLSHFT_1_RANK1_BYTE1_DATA_BRLSHFT_SHIFT 3
+#define  EMC_DATA_BRLSHFT_1_RANK1_BYTE2_DATA_BRLSHFT_SHIFT 6
+#define  EMC_DATA_BRLSHFT_1_RANK1_BYTE3_DATA_BRLSHFT_SHIFT 9
+#define  EMC_DATA_BRLSHFT_1_RANK1_BYTE4_DATA_BRLSHFT_SHIFT 12
+#define  EMC_DATA_BRLSHFT_1_RANK1_BYTE5_DATA_BRLSHFT_SHIFT 15
+#define  EMC_DATA_BRLSHFT_1_RANK1_BYTE6_DATA_BRLSHFT_SHIFT 18
+#define  EMC_DATA_BRLSHFT_1_RANK1_BYTE7_DATA_BRLSHFT_SHIFT 21
+
+#define EMC_RFCPB                     0x590
+#define EMC_DQS_BRLSHFT_0             0x594
+#define EMC_DQS_BRLSHFT_1             0x598
+#define EMC_CMD_BRLSHFT_0             0x59C
+#define EMC_CMD_BRLSHFT_1             0x5A0
+#define EMC_CMD_BRLSHFT_2             0x5A4
+#define EMC_CMD_BRLSHFT_3             0x5A8
+#define EMC_QUSE_BRLSHFT_0            0x5AC
+#define EMC_AUTO_CAL_CONFIG4          0x5B0
+#define EMC_AUTO_CAL_CONFIG5          0x5B4
+#define EMC_QUSE_BRLSHFT_1            0x5B8
+#define EMC_QUSE_BRLSHFT_2            0x5BC
+#define EMC_CCDMW                     0x5C0
+#define EMC_QUSE_BRLSHFT_3            0x5C4
+#define EMC_AUTO_CAL_CONFIG6          0x5CC
+#define EMC_DLL_CFG_0                 0x5E4
+#define EMC_DLL_CFG_1                 0x5E8
+#define EMC_CONFIG_SAMPLE_DELAY       0x5F0
+#define EMC_CFG_UPDATE                0x5F4
+
+#define EMC_PMACRO_QUSE_DDLL_RANK0_0 0x600
+#define EMC_PMACRO_QUSE_DDLL_RANK0_1 0x604
+#define EMC_PMACRO_QUSE_DDLL_RANK0_2 0x608
+#define EMC_PMACRO_QUSE_DDLL_RANK0_3 0x60C
+#define EMC_PMACRO_QUSE_DDLL_RANK0_4 0x610
+#define EMC_PMACRO_QUSE_DDLL_RANK0_5 0x614
+#define EMC_PMACRO_QUSE_DDLL_RANK1_4 0x630
+#define EMC_PMACRO_QUSE_DDLL_RANK1_5 0x634
+#define EMC_PMACRO_QUSE_DDLL_RANK1_0 0x620
+#define EMC_PMACRO_QUSE_DDLL_RANK1_1 0x624
+#define EMC_PMACRO_QUSE_DDLL_RANK1_2 0x628
+#define EMC_PMACRO_QUSE_DDLL_RANK1_3 0x62C
+
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_RANK0_0 0x640
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_RANK0_1 0x644
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_RANK0_2 0x648
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_RANK0_3 0x64C
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_RANK0_4 0x650
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_RANK0_5 0x654
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_RANK1_0 0x660
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_RANK1_1 0x664
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_RANK1_2 0x668
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_RANK1_3 0x66C
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_RANK1_4 0x670
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_RANK1_5 0x674
+
+#define EMC_PMACRO_OB_DDLL_LONG_DQS_RANK0_0 0x680
+#define EMC_PMACRO_OB_DDLL_LONG_DQS_RANK0_1 0x684
+#define EMC_PMACRO_OB_DDLL_LONG_DQS_RANK0_2 0x688
+#define EMC_PMACRO_OB_DDLL_LONG_DQS_RANK0_3 0x68C
+#define EMC_PMACRO_OB_DDLL_LONG_DQS_RANK0_4 0x690
+#define EMC_PMACRO_OB_DDLL_LONG_DQS_RANK0_5 0x694
+#define EMC_PMACRO_OB_DDLL_LONG_DQS_RANK1_0 0x6A0
+#define EMC_PMACRO_OB_DDLL_LONG_DQS_RANK1_1 0x6A4
+#define EMC_PMACRO_OB_DDLL_LONG_DQS_RANK1_2 0x6A8
+#define EMC_PMACRO_OB_DDLL_LONG_DQS_RANK1_3 0x6AC
+#define EMC_PMACRO_OB_DDLL_LONG_DQS_RANK1_4 0x6B0
+#define EMC_PMACRO_OB_DDLL_LONG_DQS_RANK1_5 0x6B4
+
+#define EMC_PMACRO_IB_DDLL_LONG_DQS_RANK0_0 0x6C0
+#define EMC_PMACRO_IB_DDLL_LONG_DQS_RANK0_1 0x6C4
+#define EMC_PMACRO_IB_DDLL_LONG_DQS_RANK0_2 0x6C8
+#define EMC_PMACRO_IB_DDLL_LONG_DQS_RANK0_3 0x6CC
+#define EMC_PMACRO_IB_DDLL_LONG_DQS_RANK1_0 0x6E0
+#define EMC_PMACRO_IB_DDLL_LONG_DQS_RANK1_1 0x6E4
+#define EMC_PMACRO_IB_DDLL_LONG_DQS_RANK1_2 0x6E8
+#define EMC_PMACRO_IB_DDLL_LONG_DQS_RANK1_3 0x6EC
+
+#define EMC_PMACRO_TX_PWRD_0 0x720
+#define EMC_PMACRO_TX_PWRD_1 0x724
+#define EMC_PMACRO_TX_PWRD_2 0x728
+#define EMC_PMACRO_TX_PWRD_3 0x72C
+#define EMC_PMACRO_TX_PWRD_4 0x730
+#define EMC_PMACRO_TX_PWRD_5 0x734
+
+#define EMC_PMACRO_TX_SEL_CLK_SRC_0 0x740
+#define EMC_PMACRO_TX_SEL_CLK_SRC_1 0x744
+#define EMC_PMACRO_TX_SEL_CLK_SRC_3 0x74C
+#define EMC_PMACRO_TX_SEL_CLK_SRC_2 0x748
+#define EMC_PMACRO_TX_SEL_CLK_SRC_4 0x750
+#define EMC_PMACRO_TX_SEL_CLK_SRC_5 0x754
+
+#define EMC_PMACRO_DDLL_BYPASS 0x760
+#define EMC_PMACRO_DDLL_PWRD_0 0x770
+#define EMC_PMACRO_DDLL_PWRD_1 0x774
+#define EMC_PMACRO_DDLL_PWRD_2 0x778
+
+#define EMC_PMACRO_CMD_CTRL_0 0x780
+#define EMC_PMACRO_CMD_CTRL_1 0x784
+#define EMC_PMACRO_CMD_CTRL_2 0x788
+
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE0_0 0x800
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE0_1 0x804
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE0_2 0x808
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE0_3 0x80C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE1_0 0x810
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE1_1 0x814
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE1_2 0x818
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE1_3 0x81C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE2_0 0x820
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE2_1 0x824
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE2_2 0x828
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE2_3 0x82C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE3_0 0x830
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE3_1 0x834
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE3_2 0x838
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE3_3 0x83C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE4_0 0x840
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE4_1 0x844
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE4_2 0x848
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE4_3 0x84C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE5_0 0x850
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE5_1 0x854
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE5_2 0x858
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE5_3 0x85C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE6_0 0x860
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE6_1 0x864
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE6_2 0x868
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE6_3 0x86C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE7_0 0x870
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE7_1 0x874
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE7_2 0x878
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_BYTE7_3 0x87C
+
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD0_0 0x880
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD0_1 0x884
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD0_2 0x888
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD0_3 0x88C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD1_0 0x890
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD1_1 0x894
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD1_2 0x898
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD1_3 0x89C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD2_0 0x8A0
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD2_1 0x8A4
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD2_2 0x8A8
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD2_3 0x8AC
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD3_0 0x8B0
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD3_1 0x8B4
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD3_2 0x8B8
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK0_CMD3_3 0x8BC
+
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE0_0 0x900
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE0_1 0x904
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE0_2 0x908
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE0_3 0x90C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE1_0 0x910
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE1_1 0x914
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE1_2 0x918
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE1_3 0x91C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE2_0 0x920
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE2_1 0x924
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE2_2 0x928
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE2_3 0x92C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE3_0 0x930
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE3_1 0x934
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE3_2 0x938
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE3_3 0x93C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE4_0 0x940
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE4_1 0x944
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE4_2 0x948
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE4_3 0x94C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE5_0 0x950
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE5_1 0x954
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE5_2 0x958
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE5_3 0x95C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE6_0 0x960
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE6_1 0x964
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE6_2 0x968
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE6_3 0x96C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE7_0 0x970
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE7_1 0x974
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE7_2 0x978
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_BYTE7_3 0x97C
+
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD0_0 0x980
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD0_1 0x984
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD0_2 0x988
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD0_3 0x98C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD1_0 0x990
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD1_1 0x994
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD1_2 0x998
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD1_3 0x99C
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD2_0 0x9A0
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD2_1 0x9A4
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD2_2 0x9A8
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD2_3 0x9AC
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD3_0 0x9B0
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD3_1 0x9B4
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD3_2 0x9B8
+#define EMC_PMACRO_OB_DDLL_SHORT_DQ_RANK1_CMD3_3 0x9BC
+
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE0_0 0xA00
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE0_1 0xA04
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE0_2 0xA08
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE1_0 0xA10
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE1_1 0xA14
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE1_2 0xA18
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE2_0 0xA20
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE2_1 0xA24
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE2_2 0xA28
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE3_0 0xA30
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE3_1 0xA34
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE3_2 0xA38
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE4_0 0xA40
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE4_1 0xA44
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE4_2 0xA48
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE5_0 0xA50
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE5_1 0xA54
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE5_2 0xA58
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE6_0 0xA60
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE6_1 0xA64
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE6_2 0xA68
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE7_0 0xA70
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE7_1 0xA74
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK0_BYTE7_2 0xA78
+
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE0_0 0xB00
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE0_1 0xB04
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE0_2 0xB08
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE1_0 0xB10
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE1_1 0xB14
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE1_2 0xB18
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE2_0 0xB20
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE2_1 0xB24
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE2_2 0xB28
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE3_0 0xB30
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE3_1 0xB34
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE3_2 0xB38
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE4_0 0xB40
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE4_1 0xB44
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE4_2 0xB48
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE5_0 0xB50
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE5_1 0xB54
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE5_2 0xB58
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE6_0 0xB60
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE6_1 0xB64
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE6_2 0xB68
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE7_0 0xB70
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE7_1 0xB74
+#define EMC_PMACRO_IB_DDLL_SHORT_DQ_RANK1_BYTE7_2 0xB78
+
+#define EMC_PMACRO_IB_VREF_DQ_0  0xBE0
+#define EMC_PMACRO_IB_VREF_DQ_1  0xBE4
+#define EMC_PMACRO_IB_VREF_DQS_0 0xBF0
+#define EMC_PMACRO_IB_VREF_DQS_1 0xBF4
+
+#define EMC_PMACRO_DDLL_LONG_CMD_0 0xC00
+#define EMC_PMACRO_DDLL_LONG_CMD_1 0xC04
+#define EMC_PMACRO_DDLL_LONG_CMD_2 0xC08
+#define EMC_PMACRO_DDLL_LONG_CMD_3 0xC0C
+#define EMC_PMACRO_DDLL_LONG_CMD_4 0xC10
+
+#define EMC_PMACRO_DDLL_SHORT_CMD_0 0xC20
+#define EMC_PMACRO_DDLL_SHORT_CMD_1 0xC24
+#define EMC_PMACRO_DDLL_SHORT_CMD_2 0xC28
+
+#define EMC_PMACRO_CFG_PM_GLOBAL_0    0xC30
+#define EMC_PMACRO_VTTGEN_CTRL_0      0xC34
+#define EMC_PMACRO_VTTGEN_CTRL_1      0xC38
+#define EMC_PMACRO_BG_BIAS_CTRL_0     0xC3C
+#define EMC_PMACRO_PAD_CFG_CTRL       0xC40
+#define EMC_PMACRO_ZCTRL              0xC44
+#define EMC_PMACRO_CMD_PAD_RX_CTRL    0xC50
+#define EMC_PMACRO_DATA_PAD_RX_CTRL   0xC54
+#define EMC_PMACRO_CMD_RX_TERM_MODE   0xC58
+#define EMC_PMACRO_DATA_RX_TERM_MODE  0xC5C
+#define EMC_PMACRO_CMD_PAD_TX_CTRL    0xC60
+#define EMC_PMACRO_DATA_PAD_TX_CTRL   0xC64
+#define EMC_PMACRO_COMMON_PAD_TX_CTRL 0xC68
+#define EMC_PMACRO_AUTOCAL_CFG_COMMON 0xC78
+#define EMC_PMACRO_VTTGEN_CTRL_2      0xCF0
+#define EMC_PMACRO_IB_RXRT            0xCF4
+#define EMC_PMACRO_TRAINING_CTRL_0    0xCF8
+#define  CH0_TRAINING_E_WRPTR (1 << 3)
+#define EMC_PMACRO_TRAINING_CTRL_1    0xCFC
+
+#define EMC_TRAINING_CMD              0xE00
+#define EMC_TRAINING_CTRL             0xE04
+#define EMC_TRAINING_STATUS           0xE08
+#define EMC_TRAINING_QUSE_CORS_CTRL   0xE0C
+#define EMC_TRAINING_QUSE_FINE_CTRL   0xE10
+#define EMC_TRAINING_QUSE_CTRL_MISC   0xE14
+#define EMC_TRAINING_WRITE_FINE_CTRL  0xE18
+#define EMC_TRAINING_WRITE_CTRL_MISC  0xE1C
+#define EMC_TRAINING_WRITE_VREF_CTRL  0xE20
+#define EMC_TRAINING_READ_FINE_CTRL   0xE24
+#define EMC_TRAINING_READ_CTRL_MISC   0xE28
+#define EMC_TRAINING_READ_VREF_CTRL   0xE2C
+#define EMC_TRAINING_CA_FINE_CTRL     0xE30
+#define EMC_TRAINING_CA_CTRL_MISC     0xE34
+#define EMC_TRAINING_CA_CTRL_MISC1    0xE38
+#define EMC_TRAINING_CA_VREF_CTRL     0xE3C
+#define EMC_TRAINING_SETTLE           0xE44
+#define EMC_TRAINING_MPC              0xE5C
+#define EMC_TRAINING_PATRAM_CTRL      0xE60
+#define EMC_TRAINING_PATRAM_DQ        0xE64
+#define EMC_TRAINING_PATRAM_DMI       0xE68
+#define EMC_TRAINING_VREF_SETTLE      0xE6C
+#define EMC_TRAINING_OPT_CA_VREF      0xEC0
+#define EMC_TRAINING_OPT_DQ_OB_VREF   0xEC4
+#define EMC_TRAINING_QUSE_VREF_CTRL   0xED0
+#define EMC_TRAINING_OPT_DQS_IB_VREF_RANK0 0xED4
+#define EMC_TRAINING_OPT_DQS_IB_VREF_RANK1 0xED8
+
+/* Per channel registers offsets. Should be used with EMC_BASE */
+#define EMC0_MRW10 0x34B4
+#define EMC0_MRW11 0x34B8
+#define EMC0_MRW12 0x34BC
+#define EMC0_MRW13 0x34C0
+#define EMC0_DATA_BRLSHFT_0 0x3588
+#define EMC0_DATA_BRLSHFT_1 0x358C
+#define EMC0_CMD_BRLSHFT_0  0x359C
+#define EMC0_QUSE_BRLSHFT_0 0x35AC
+#define EMC0_QUSE_BRLSHFT_2 0x35BC
+#define EMC0_TRAINING_RW_OFFSET_IB_BYTE0 0x3E98
+#define EMC0_TRAINING_RW_OFFSET_IB_BYTE1 0x3E9C
+#define EMC0_TRAINING_RW_OFFSET_IB_BYTE2 0x3EA0
+#define EMC0_TRAINING_RW_OFFSET_IB_BYTE3 0x3EA4
+#define EMC0_TRAINING_RW_OFFSET_IB_MISC  0x3EA8
+#define EMC0_TRAINING_RW_OFFSET_OB_BYTE0 0x3EAC
+#define EMC0_TRAINING_RW_OFFSET_OB_BYTE1 0x3EB0
+#define EMC0_TRAINING_RW_OFFSET_OB_BYTE2 0x3EB4
+#define EMC0_TRAINING_RW_OFFSET_OB_BYTE3 0x3EB8
+#define EMC0_TRAINING_RW_OFFSET_OB_MISC  0x3EBC
+#define EMC0_TRAINING_OPT_DQS_IB_VREF_RANK0 0x3ED4
+#define EMC0_TRAINING_OPT_DQS_IB_VREF_RANK1 0x3ED8
+
+#define EMC1_MRW10 0x44B4
+#define EMC1_MRW11 0x44B8
+#define EMC1_MRW12 0x44BC
+#define EMC1_MRW13 0x44C0
+#define EMC1_DATA_BRLSHFT_0 0x4588
+#define EMC1_DATA_BRLSHFT_1 0x458C
+#define EMC1_CMD_BRLSHFT_1  0x45A0
+#define EMC1_QUSE_BRLSHFT_1 0x45B8
+#define EMC1_QUSE_BRLSHFT_3 0x45C4
+#define EMC1_TRAINING_RW_OFFSET_IB_BYTE0 0x4E98
+#define EMC1_TRAINING_RW_OFFSET_IB_BYTE1 0x4E9C
+#define EMC1_TRAINING_RW_OFFSET_IB_BYTE2 0x4EA0
+#define EMC1_TRAINING_RW_OFFSET_IB_BYTE3 0x4EA4
+#define EMC1_TRAINING_RW_OFFSET_IB_MISC  0x4EA8
+#define EMC1_TRAINING_RW_OFFSET_OB_BYTE0 0x4EAC
+#define EMC1_TRAINING_RW_OFFSET_OB_BYTE1 0x4EB0
+#define EMC1_TRAINING_RW_OFFSET_OB_BYTE2 0x4EB4
+#define EMC1_TRAINING_RW_OFFSET_OB_BYTE3 0x4EB8
+#define EMC1_TRAINING_RW_OFFSET_OB_MISC  0x4EBC
+#define EMC1_TRAINING_OPT_DQS_IB_VREF_RANK0 0x4ED4
+#define EMC1_TRAINING_OPT_DQS_IB_VREF_RANK1 0x4ED8
+
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_BYTE0_SHIFT 0
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_BYTE1_SHIFT 16
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_BYTE2_SHIFT 0
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_BYTE3_SHIFT 16
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_BYTE4_SHIFT 0
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_BYTE5_SHIFT 16
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_BYTE6_SHIFT 0
+#define EMC_PMACRO_OB_DDLL_LONG_DQ_BYTE7_SHIFT 16
+
+#endif

modules/hekate_libsys_minerva/mtc_table.h

@@ -0,0 +1,560 @@
+/*
+ * Minerva Training Cell
+ * DRAM Training for Tegra X1 SoC. Supports DDR2/3 and LPDDR3/4.
+ *
+ * Copyright (c) 2018 CTCaer  <ctcaer@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _MTC_TABLE_H_
+#define _MTC_TABLE_H_
+
+#include "types.h"
+
+typedef struct 
+{
+	s32 pll_osc_in;
+	s32 pll_out;
+	u32 pll_feedback_div;
+	u32 pll_input_div;
+	u32 pll_post_div;
+} pllm_clk_config_t;
+
+typedef struct
+{
+	u32 emc_rc_idx;
+	u32 emc_rfc_idx;
+	u32 emc_rfcpb_idx;
+	u32 emc_refctrl2_idx;
+	u32 emc_rfc_slr_idx;
+	u32 emc_ras_idx;
+	u32 emc_rp_idx;
+	u32 emc_r2w_idx;
+	u32 emc_w2r_idx;
+	u32 emc_r2p_idx;
+	u32 emc_w2p_idx;
+	u32 emc_r2r_idx;
+	u32 emc_tppd_idx;
+	u32 emc_ccdmw_idx;
+	u32 emc_rd_rcd_idx;
+	u32 emc_wr_rcd_idx;
+	u32 emc_rrd_idx;
+	u32 emc_rext_idx;
+	u32 emc_wext_idx;
+	u32 emc_wdv_chk_idx;
+	u32 emc_wdv_idx;
+	u32 emc_wsv_idx;
+	u32 emc_wev_idx;
+	u32 emc_wdv_mask_idx;
+	u32 emc_ws_duration_idx;
+	u32 emc_we_duration_idx;
+	u32 emc_quse_idx;
+	u32 emc_quse_width_idx;
+	u32 emc_ibdly_idx;
+	u32 emc_obdly_idx;
+	u32 emc_einput_idx;
+	u32 emc_mrw6_idx;
+	u32 emc_einput_duration_idx;
+	u32 emc_puterm_extra_idx;
+	u32 emc_puterm_width_idx;
+	u32 emc_qrst_idx;
+	u32 emc_qsafe_idx;
+	u32 emc_rdv_idx;
+	u32 emc_rdv_mask_idx;
+	u32 emc_rdv_early_idx;
+	u32 emc_rdv_early_mask_idx;
+	u32 emc_refresh_idx;
+	u32 emc_burst_refresh_num_idx;
+	u32 emc_pre_refresh_req_cnt_idx;
+	u32 emc_pdex2wr_idx;
+	u32 emc_pdex2rd_idx;
+	u32 emc_pchg2pden_idx;
+	u32 emc_act2pden_idx;
+	u32 emc_ar2pden_idx;
+	u32 emc_rw2pden_idx;
+	u32 emc_cke2pden_idx;
+	u32 emc_pdex2cke_idx;
+	u32 emc_pdex2mrr_idx;
+	u32 emc_txsr_idx;
+	u32 emc_txsrdll_idx;
+	u32 emc_tcke_idx;
+	u32 emc_tckesr_idx;
+	u32 emc_tpd_idx;
+	u32 emc_tfaw_idx;
+	u32 emc_trpab_idx;
+	u32 emc_tclkstable_idx;
+	u32 emc_tclkstop_idx;
+	u32 emc_mrw7_idx;
+	u32 emc_trefbw_idx;
+	u32 emc_odt_write_idx;
+	u32 emc_fbio_cfg5_idx;
+	u32 emc_fbio_cfg7_idx;
+	u32 emc_cfg_dig_dll_idx;
+	u32 emc_cfg_dig_dll_period_idx;
+	u32 emc_pmacro_ib_rxrt_idx;
+	u32 emc_cfg_pipe_1_idx;
+	u32 emc_cfg_pipe_2_idx;
+	u32 emc_pmacro_quse_ddll_rank0_4_idx;
+	u32 emc_pmacro_quse_ddll_rank0_5_idx;
+	u32 emc_pmacro_quse_ddll_rank1_4_idx;
+	u32 emc_pmacro_quse_ddll_rank1_5_idx;
+	u32 emc_mrw8_idx;
+	u32 emc_pmacro_ob_ddll_long_dq_rank1_4_idx;
+	u32 emc_pmacro_ob_ddll_long_dq_rank1_5_idx;
+	u32 emc_pmacro_ob_ddll_long_dqs_rank0_0_idx;
+	u32 emc_pmacro_ob_ddll_long_dqs_rank0_1_idx;
+	u32 emc_pmacro_ob_ddll_long_dqs_rank0_2_idx;
+	u32 emc_pmacro_ob_ddll_long_dqs_rank0_3_idx;
+	u32 emc_pmacro_ob_ddll_long_dqs_rank0_4_idx;
+	u32 emc_pmacro_ob_ddll_long_dqs_rank0_5_idx;
+	u32 emc_pmacro_ob_ddll_long_dqs_rank1_0_idx;
+	u32 emc_pmacro_ob_ddll_long_dqs_rank1_1_idx;
+	u32 emc_pmacro_ob_ddll_long_dqs_rank1_2_idx;
+	u32 emc_pmacro_ob_ddll_long_dqs_rank1_3_idx;
+	u32 emc_pmacro_ob_ddll_long_dqs_rank1_4_idx;
+	u32 emc_pmacro_ob_ddll_long_dqs_rank1_5_idx;
+	u32 emc_pmacro_ddll_long_cmd_0_idx;
+	u32 emc_pmacro_ddll_long_cmd_1_idx;
+	u32 emc_pmacro_ddll_long_cmd_2_idx;
+	u32 emc_pmacro_ddll_long_cmd_3_idx;
+	u32 emc_pmacro_ddll_long_cmd_4_idx;
+	u32 emc_pmacro_ddll_short_cmd_0_idx;
+	u32 emc_pmacro_ddll_short_cmd_1_idx;
+	u32 emc_pmacro_ddll_short_cmd_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte0_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte1_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte2_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte3_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte4_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte5_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte6_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte7_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd0_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd1_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd2_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd3_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte0_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte1_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte2_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte3_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte4_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte5_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte6_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte7_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd0_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd0_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd0_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd0_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd1_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd1_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd1_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd1_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd2_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd2_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd2_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd2_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd3_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd3_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd3_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_cmd3_3_idx;
+	u32 emc_txdsrvttgen_idx;
+	u32 emc_fdpd_ctrl_dq_idx;
+	u32 emc_fdpd_ctrl_cmd_idx;
+	u32 emc_fbio_spare_idx;
+	u32 emc_zcal_interval_idx;
+	u32 emc_zcal_wait_cnt_idx;
+	u32 emc_mrs_wait_cnt_idx;
+	u32 emc_mrs_wait_cnt2_idx;
+	u32 emc_auto_cal_channel_idx;
+	u32 emc_dll_cfg_0_idx;
+	u32 emc_dll_cfg_1_idx;
+	u32 emc_pmacro_autocal_cfg_common_idx;
+	u32 emc_pmacro_zctrl_idx;
+	u32 emc_cfg_idx;
+	u32 emc_cfg_pipe_idx;
+	u32 emc_dyn_self_ref_control_idx;
+	u32 emc_qpop_idx;
+	u32 emc_dqs_brlshft_0_idx;
+	u32 emc_dqs_brlshft_1_idx;
+	u32 emc_cmd_brlshft_2_idx;
+	u32 emc_cmd_brlshft_3_idx;
+	u32 emc_pmacro_pad_cfg_ctrl_idx;
+	u32 emc_pmacro_data_pad_rx_ctrl_idx;
+	u32 emc_pmacro_cmd_pad_rx_ctrl_idx;
+	u32 emc_pmacro_data_rx_term_mode_idx;
+	u32 emc_pmacro_cmd_rx_term_mode_idx;
+	u32 emc_pmacro_cmd_pad_tx_ctrl_idx;
+	u32 emc_pmacro_data_pad_tx_ctrl_idx;
+	u32 emc_pmacro_common_pad_tx_ctrl_idx;
+	u32 emc_pmacro_vttgen_ctrl_0_idx;
+	u32 emc_pmacro_vttgen_ctrl_1_idx;
+	u32 emc_pmacro_vttgen_ctrl_2_idx;
+	u32 emc_pmacro_brick_ctrl_rfu1_idx;
+	u32 emc_pmacro_cmd_brick_ctrl_fdpd_idx;
+	u32 emc_pmacro_brick_ctrl_rfu2_idx;
+	u32 emc_pmacro_data_brick_ctrl_fdpd_idx;
+	u32 emc_pmacro_bg_bias_ctrl_0_idx;
+	u32 emc_cfg_3_idx;
+	u32 emc_pmacro_tx_pwrd_0_idx;
+	u32 emc_pmacro_tx_pwrd_1_idx;
+	u32 emc_pmacro_tx_pwrd_2_idx;
+	u32 emc_pmacro_tx_pwrd_3_idx;
+	u32 emc_pmacro_tx_pwrd_4_idx;
+	u32 emc_pmacro_tx_pwrd_5_idx;
+	u32 emc_config_sample_delay_idx;
+	u32 emc_pmacro_tx_sel_clk_src_0_idx;
+	u32 emc_pmacro_tx_sel_clk_src_1_idx;
+	u32 emc_pmacro_tx_sel_clk_src_2_idx;
+	u32 emc_pmacro_tx_sel_clk_src_3_idx;
+	u32 emc_pmacro_tx_sel_clk_src_4_idx;
+	u32 emc_pmacro_tx_sel_clk_src_5_idx;
+	u32 emc_pmacro_ddll_bypass_idx;
+	u32 emc_pmacro_ddll_pwrd_0_idx;
+	u32 emc_pmacro_ddll_pwrd_1_idx;
+	u32 emc_pmacro_ddll_pwrd_2_idx;
+	u32 emc_pmacro_cmd_ctrl_0_idx;
+	u32 emc_pmacro_cmd_ctrl_1_idx;
+	u32 emc_pmacro_cmd_ctrl_2_idx;
+	u32 emc_tr_timing_0_idx;
+	u32 emc_tr_dvfs_idx;
+	u32 emc_tr_ctrl_1_idx;
+	u32 emc_tr_rdv_idx;
+	u32 emc_tr_qpop_idx;
+	u32 emc_tr_rdv_mask_idx;
+	u32 emc_mrw14_idx;
+	u32 emc_tr_qsafe_idx;
+	u32 emc_tr_qrst_idx;
+	u32 emc_training_ctrl_idx;
+	u32 emc_training_settle_idx;
+	u32 emc_training_vref_settle_idx;
+	u32 emc_training_ca_fine_ctrl_idx;
+	u32 emc_training_ca_ctrl_misc_idx;
+	u32 emc_training_ca_ctrl_misc1_idx;
+	u32 emc_training_ca_vref_ctrl_idx;
+	u32 emc_training_quse_cors_ctrl_idx;
+	u32 emc_training_quse_fine_ctrl_idx;
+	u32 emc_training_quse_ctrl_misc_idx;
+	u32 emc_training_quse_vref_ctrl_idx;
+	u32 emc_training_read_fine_ctrl_idx;
+	u32 emc_training_read_ctrl_misc_idx;
+	u32 emc_training_read_vref_ctrl_idx;
+	u32 emc_training_write_fine_ctrl_idx;
+	u32 emc_training_write_ctrl_misc_idx;
+	u32 emc_training_write_vref_ctrl_idx;
+	u32 emc_training_mpc_idx;
+	u32 emc_mrw15_idx;
+} burst_regs_t;
+
+
+typedef struct 
+{
+	u32 burst_regs[221];
+	u32 burst_reg_per_ch[8];
+	u32 shadow_regs_ca_train[221];
+	u32 shadow_regs_quse_train[221];
+	u32 shadow_regs_rdwr_train[221];
+} burst_regs_table_t;
+
+typedef struct 
+{
+	u32 ptfv_dqsosc_movavg_c0d0u0_idx;
+	u32 ptfv_dqsosc_movavg_c0d0u1_idx;
+	u32 ptfv_dqsosc_movavg_c0d1u0_idx;
+	u32 ptfv_dqsosc_movavg_c0d1u1_idx;
+	u32 ptfv_dqsosc_movavg_c1d0u0_idx;
+	u32 ptfv_dqsosc_movavg_c1d0u1_idx;
+	u32 ptfv_dqsosc_movavg_c1d1u0_idx;
+	u32 ptfv_dqsosc_movavg_c1d1u1_idx;
+	u32 ptfv_write_samples_idx;
+	u32 ptfv_dvfs_samples_idx;
+	u32 ptfv_movavg_weight_idx;
+	u32 ptfv_config_ctrl_idx;
+} ptfv_list_table_t;
+
+typedef struct
+{
+	u32 emc0_mrw10_idx;
+	u32 emc1_mrw10_idx;
+	u32 emc0_mrw11_idx;
+	u32 emc1_mrw11_idx;
+	u32 emc0_mrw12_idx;
+	u32 emc1_mrw12_idx;
+	u32 emc0_mrw13_idx;
+	u32 emc1_mrw13_idx;
+} burst_reg_per_ch_t;
+
+typedef struct
+{
+	u32 emc_pmacro_ib_ddll_long_dqs_rank0_0_idx;
+	u32 emc_pmacro_ib_ddll_long_dqs_rank0_1_idx;
+	u32 emc_pmacro_ib_ddll_long_dqs_rank0_2_idx;
+	u32 emc_pmacro_ib_ddll_long_dqs_rank0_3_idx;
+	u32 emc_pmacro_ib_ddll_long_dqs_rank1_0_idx;
+	u32 emc_pmacro_ib_ddll_long_dqs_rank1_1_idx;
+	u32 emc_pmacro_ib_ddll_long_dqs_rank1_2_idx;
+	u32 emc_pmacro_ib_ddll_long_dqs_rank1_3_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte0_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte0_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte0_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte1_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte1_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte1_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte2_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte2_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte2_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte3_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte3_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte3_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte4_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte4_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte4_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte5_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte5_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte5_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte6_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte6_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte6_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte7_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte7_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank0_byte7_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte0_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte0_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte0_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte1_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte1_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte1_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte2_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte2_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte2_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte3_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte3_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte3_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte4_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte4_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte4_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte5_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte5_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte5_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte6_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte6_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte6_2_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte7_0_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte7_1_idx;
+	u32 emc_pmacro_ib_ddll_short_dq_rank1_byte7_2_idx;
+	u32 emc_pmacro_ib_vref_dqs_0_idx;
+	u32 emc_pmacro_ib_vref_dqs_1_idx;
+	u32 emc_pmacro_ib_vref_dq_0_idx;
+	u32 emc_pmacro_ib_vref_dq_1_idx;
+	u32 emc_pmacro_ob_ddll_long_dq_rank0_0_idx;
+	u32 emc_pmacro_ob_ddll_long_dq_rank0_1_idx;
+	u32 emc_pmacro_ob_ddll_long_dq_rank0_2_idx;
+	u32 emc_pmacro_ob_ddll_long_dq_rank0_3_idx;
+	u32 emc_pmacro_ob_ddll_long_dq_rank0_4_idx;
+	u32 emc_pmacro_ob_ddll_long_dq_rank0_5_idx;
+	u32 emc_pmacro_ob_ddll_long_dq_rank1_0_idx;
+	u32 emc_pmacro_ob_ddll_long_dq_rank1_1_idx;
+	u32 emc_pmacro_ob_ddll_long_dq_rank1_2_idx;
+	u32 emc_pmacro_ob_ddll_long_dq_rank1_3_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte0_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte0_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte0_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte1_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte1_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte1_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte2_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte2_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte2_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte3_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte3_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte3_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte4_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte4_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte4_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte5_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte5_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte5_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte6_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte6_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte6_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte7_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte7_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_byte7_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd0_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd0_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd0_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd1_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd1_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd1_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd2_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd2_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd2_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd3_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd3_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank0_cmd3_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte0_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte0_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte0_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte1_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte1_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte1_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte2_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte2_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte2_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte3_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte3_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte3_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte4_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte4_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte4_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte5_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte5_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte5_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte6_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte6_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte6_2_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte7_0_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte7_1_idx;
+	u32 emc_pmacro_ob_ddll_short_dq_rank1_byte7_2_idx;
+	u32 emc_pmacro_quse_ddll_rank0_0_idx;
+	u32 emc_pmacro_quse_ddll_rank0_1_idx;
+	u32 emc_pmacro_quse_ddll_rank0_2_idx;
+	u32 emc_pmacro_quse_ddll_rank0_3_idx;
+	u32 emc_pmacro_quse_ddll_rank1_0_idx;
+	u32 emc_pmacro_quse_ddll_rank1_1_idx;
+	u32 emc_pmacro_quse_ddll_rank1_2_idx;
+	u32 emc_pmacro_quse_ddll_rank1_3_idx;
+} trim_regs_t;
+
+typedef struct
+{
+	u32 emc_cmd_brlshft_0_idx;
+	u32 emc_cmd_brlshft_1_idx;
+	u32 emc0_data_brlshft_0_idx;
+	u32 emc1_data_brlshft_0_idx;
+	u32 emc0_data_brlshft_1_idx;
+	u32 emc1_data_brlshft_1_idx;
+	u32 emc_quse_brlshft_0_idx;
+	u32 emc_quse_brlshft_1_idx;
+	u32 emc_quse_brlshft_2_idx;
+	u32 emc_quse_brlshft_3_idx;
+} trim_perch_regs_t;
+
+typedef struct
+{
+	u32 t_rp;
+	u32 t_fc_lpddr4;
+	u32 t_rfc;
+	u32 t_pdex;
+	u32 rl;
+} dram_timings_t;
+
+typedef struct
+{
+	u32 emc0_training_opt_dqs_ib_vref_rank0_idx;
+	u32 emc1_training_opt_dqs_ib_vref_rank0_idx;
+	u32 emc0_training_opt_dqs_ib_vref_rank1_idx;
+	u32 emc1_training_opt_dqs_ib_vref_rank1_idx;
+} vref_perch_regs_t;
+
+typedef struct
+{
+	u32 trim_regs[138];
+	u32 trim_perch_regs[10];
+	u32 vref_perch_regs[4];
+} trim_regs_table_t;
+
+typedef struct
+{
+	u32 rev;
+	char dvfs_ver[60];
+	u32 rate_khz;
+	u32 min_volt;
+	u32 gpu_min_volt;
+	char clock_src[32];
+	u32 clk_src_emc;
+	u32 needs_training;
+	u32 training_pattern;
+	u32 trained;
+	u32 periodic_training;
+	u32 trained_dram_clktree_c0d0u0;
+	u32 trained_dram_clktree_c0d0u1;
+	u32 trained_dram_clktree_c0d1u0;
+	u32 trained_dram_clktree_c0d1u1;
+	u32 trained_dram_clktree_c1d0u0;
+	u32 trained_dram_clktree_c1d0u1;
+	u32 trained_dram_clktree_c1d1u0;
+	u32 trained_dram_clktree_c1d1u1;
+	u32 current_dram_clktree_c0d0u0;
+	u32 current_dram_clktree_c0d0u1;
+	u32 current_dram_clktree_c0d1u0;
+	u32 current_dram_clktree_c0d1u1;
+	u32 current_dram_clktree_c1d0u0;
+	u32 current_dram_clktree_c1d0u1;
+	u32 current_dram_clktree_c1d1u0;
+	u32 current_dram_clktree_c1d1u1;
+	u32 run_clocks;
+	u32 tree_margin;
+	u32 num_burst;
+	u32 num_burst_per_ch;
+	u32 num_trim;
+	u32 num_trim_per_ch;
+	u32 num_mc_regs;
+	u32 num_up_down;
+	u32 vref_num;
+	u32 training_mod_num;
+	u32 dram_timing_num;
+
+	ptfv_list_table_t ptfv_list;
+
+	burst_regs_t burst_regs;
+	burst_reg_per_ch_t burst_reg_per_ch;
+	burst_regs_t shadow_regs_ca_train;
+	burst_regs_t shadow_regs_quse_train;
+	burst_regs_t shadow_regs_rdwr_train;
+	trim_regs_t trim_regs;
+	trim_perch_regs_t trim_perch_regs;
+	vref_perch_regs_t vref_perch_regs;
+	dram_timings_t dram_timings;
+
+	u32 training_mod_regs[20];
+	u32 save_restore_mod_regs[12];
+	u32 burst_mc_regs[33];
+	u32 la_scale_regs[24];
+
+	u32 min_mrs_wait;
+	u32 emc_mrw;
+	u32 emc_mrw2;
+	u32 emc_mrw3;
+	u32 emc_mrw4;
+	u32 emc_mrw9;
+	u32 emc_mrs;
+	u32 emc_emrs;
+	u32 emc_emrs2;
+	u32 emc_auto_cal_config;
+	u32 emc_auto_cal_config2;
+	u32 emc_auto_cal_config3;
+	u32 emc_auto_cal_config4;
+	u32 emc_auto_cal_config5;
+	u32 emc_auto_cal_config6;
+	u32 emc_auto_cal_config7;
+	u32 emc_auto_cal_config8;
+	u32 emc_cfg_2;
+	u32 emc_sel_dpd_ctrl;
+	u32 emc_fdpd_ctrl_cmd_no_ramp;
+	u32 dll_clk_src;
+	u32 clk_out_enb_x_0_clk_enb_emc_dll;
+	u32 latency;
+} emc_table_t;
+
+#endif

modules/hekate_libsys_minerva/types.h

@@ -0,0 +1,54 @@
+/*
+* Copyright (c) 2018 naehrwert
+*
+* This program is free software; you can redistribute it and/or modify it
+* under the terms and conditions of the GNU General Public License,
+* version 2, as published by the Free Software Foundation.
+*
+* This program is distributed in the hope it will be useful, but WITHOUT
+* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+* FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+* more details.
+*
+* You should have received a copy of the GNU General Public License
+* along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _TYPES_H_
+#define _TYPES_H_
+
+#define NULL ((void *)0)
+
+#define ALIGN(x, a) (((x) + (a) - 1) & ~((a) - 1))
+#define MAX(a, b) ((a) > (b) ? (a) : (b))
+#define MIN(a, b) ((a) < (b) ? (a) : (b))
+
+#define OFFSET_OF(t, m) ((u32)&((t *)NULL)->m)
+#define CONTAINER_OF(mp, t, mn) ((t *)((u32)mp - OFFSET_OF(t, mn)))
+
+typedef char s8;
+typedef short s16;
+typedef short SHORT;
+typedef int s32;
+typedef int INT;
+typedef long LONG;
+typedef long long int s64;
+typedef unsigned char u8;
+typedef unsigned char BYTE;
+typedef unsigned short u16;
+typedef unsigned short WORD;
+typedef unsigned short WCHAR;
+typedef unsigned int u32;
+typedef unsigned int UINT;
+typedef unsigned long DWORD;
+typedef unsigned long long QWORD;
+typedef unsigned long long int u64;
+typedef volatile unsigned char vu8;
+typedef volatile unsigned short vu16;
+typedef volatile unsigned int vu32;
+
+typedef int bool;
+#define true  1
+#define false 0
+
+#endif

modules/simple_sample/gfx/gfx.c

@@ -0,0 +1,529 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ * Copyright (C) 2018 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <stdarg.h>
+#include <string.h>
+#include "gfx.h"
+
+static const u8 _gfx_font[] = {
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Char 032 ( )
+	0x00, 0x30, 0x30, 0x18, 0x18, 0x00, 0x0C, 0x00, // Char 033 (!)
+	0x00, 0x22, 0x22, 0x22, 0x00, 0x00, 0x00, 0x00, // Char 034 (")
+	0x00, 0x66, 0x66, 0xFF, 0x66, 0xFF, 0x66, 0x66, // Char 035 (#)
+	0x00, 0x18, 0x7C, 0x06, 0x3C, 0x60, 0x3E, 0x18, // Char 036 ($)
+	0x00, 0x46, 0x66, 0x30, 0x18, 0x0C, 0x66, 0x62, // Char 037 (%)
+	0x00, 0x3C, 0x66, 0x3C, 0x1C, 0xE6, 0x66, 0xFC, // Char 038 (&)
+	0x00, 0x18, 0x0C, 0x06, 0x00, 0x00, 0x00, 0x00, // Char 039 (')
+	0x00, 0x30, 0x18, 0x0C, 0x0C, 0x18, 0x30, 0x00, // Char 040 (()
+	0x00, 0x0C, 0x18, 0x30, 0x30, 0x18, 0x0C, 0x00, // Char 041 ())
+	0x00, 0x66, 0x3C, 0xFF, 0x3C, 0x66, 0x00, 0x00, // Char 042 (*)
+	0x00, 0x18, 0x18, 0x7E, 0x18, 0x18, 0x00, 0x00, // Char 043 (+)
+	0x00, 0x00, 0x00, 0x00, 0x18, 0x18, 0x0C, 0x00, // Char 044 (,)
+	0x00, 0x00, 0x00, 0x3E, 0x00, 0x00, 0x00, 0x00, // Char 045 (-)
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x18, 0x00, // Char 046 (.)
+	0x00, 0x40, 0x60, 0x30, 0x18, 0x0C, 0x06, 0x00, // Char 047 (/)
+	0x00, 0x3C, 0x66, 0x76, 0x6E, 0x66, 0x3C, 0x00, // Char 048 (0)
+	0x00, 0x18, 0x1C, 0x18, 0x18, 0x18, 0x7E, 0x00, // Char 049 (1)
+	0x00, 0x3C, 0x62, 0x30, 0x0C, 0x06, 0x7E, 0x00, // Char 050 (2)
+	0x00, 0x3C, 0x62, 0x38, 0x60, 0x66, 0x3C, 0x00, // Char 051 (3)
+	0x00, 0x6C, 0x6C, 0x66, 0xFE, 0x60, 0x60, 0x00, // Char 052 (4)
+	0x00, 0x7E, 0x06, 0x7E, 0x60, 0x66, 0x3C, 0x00, // Char 053 (5)
+	0x00, 0x3C, 0x06, 0x3E, 0x66, 0x66, 0x3C, 0x00, // Char 054 (6)
+	0x00, 0x7E, 0x30, 0x30, 0x18, 0x18, 0x18, 0x00, // Char 055 (7)
+	0x00, 0x3C, 0x66, 0x3C, 0x66, 0x66, 0x3C, 0x00, // Char 056 (8)
+	0x00, 0x3C, 0x66, 0x7C, 0x60, 0x66, 0x3C, 0x00, // Char 057 (9)
+	0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x18, 0x00, // Char 058 (:)
+	0x00, 0x00, 0x18, 0x00, 0x18, 0x18, 0x0C, 0x00, // Char 059 (;)
+	0x00, 0x70, 0x1C, 0x06, 0x06, 0x1C, 0x70, 0x00, // Char 060 (<)
+	0x00, 0x00, 0x3E, 0x00, 0x3E, 0x00, 0x00, 0x00, // Char 061 (=)
+	0x00, 0x0E, 0x38, 0x60, 0x60, 0x38, 0x0E, 0x00, // Char 062 (>)
+	0x00, 0x3C, 0x66, 0x30, 0x18, 0x00, 0x18, 0x00, // Char 063 (?)
+	0x00, 0x3C, 0x66, 0x76, 0x76, 0x06, 0x46, 0x3C, // Char 064 (@)
+	0x00, 0x3C, 0x66, 0x7E, 0x66, 0x66, 0x66, 0x00, // Char 065 (A)
+	0x00, 0x3E, 0x66, 0x3E, 0x66, 0x66, 0x3E, 0x00, // Char 066 (B)
+	0x00, 0x3C, 0x66, 0x06, 0x06, 0x66, 0x3C, 0x00, // Char 067 (C)
+	0x00, 0x1E, 0x36, 0x66, 0x66, 0x36, 0x1E, 0x00, // Char 068 (D)
+	0x00, 0x7E, 0x06, 0x1E, 0x06, 0x06, 0x7E, 0x00, // Char 069 (E)
+	0x00, 0x3E, 0x06, 0x1E, 0x06, 0x06, 0x06, 0x00, // Char 070 (F)
+	0x00, 0x3C, 0x66, 0x06, 0x76, 0x66, 0x3C, 0x00, // Char 071 (G)
+	0x00, 0x66, 0x66, 0x7E, 0x66, 0x66, 0x66, 0x00, // Char 072 (H)
+	0x00, 0x3C, 0x18, 0x18, 0x18, 0x18, 0x3C, 0x00, // Char 073 (I)
+	0x00, 0x78, 0x30, 0x30, 0x30, 0x36, 0x1C, 0x00, // Char 074 (J)
+	0x00, 0x66, 0x36, 0x1E, 0x1E, 0x36, 0x66, 0x00, // Char 075 (K)
+	0x00, 0x06, 0x06, 0x06, 0x06, 0x06, 0x7E, 0x00, // Char 076 (L)
+	0x00, 0x46, 0x6E, 0x7E, 0x56, 0x46, 0x46, 0x00, // Char 077 (M)
+	0x00, 0x66, 0x6E, 0x7E, 0x76, 0x66, 0x66, 0x00, // Char 078 (N)
+	0x00, 0x3C, 0x66, 0x66, 0x66, 0x66, 0x3C, 0x00, // Char 079 (O)
+	0x00, 0x3E, 0x66, 0x3E, 0x06, 0x06, 0x06, 0x00, // Char 080 (P)
+	0x00, 0x3C, 0x66, 0x66, 0x66, 0x3C, 0x70, 0x00, // Char 081 (Q)
+	0x00, 0x3E, 0x66, 0x3E, 0x1E, 0x36, 0x66, 0x00, // Char 082 (R)
+	0x00, 0x3C, 0x66, 0x0C, 0x30, 0x66, 0x3C, 0x00, // Char 083 (S)
+	0x00, 0x7E, 0x18, 0x18, 0x18, 0x18, 0x18, 0x00, // Char 084 (T)
+	0x00, 0x66, 0x66, 0x66, 0x66, 0x66, 0x3C, 0x00, // Char 085 (U)
+	0x00, 0x66, 0x66, 0x66, 0x66, 0x3C, 0x18, 0x00, // Char 086 (V)
+	0x00, 0x46, 0x46, 0x56, 0x7E, 0x6E, 0x46, 0x00, // Char 087 (W)
+	0x00, 0x66, 0x3C, 0x18, 0x3C, 0x66, 0x66, 0x00, // Char 088 (X)
+	0x00, 0x66, 0x66, 0x3C, 0x18, 0x18, 0x18, 0x00, // Char 089 (Y)
+	0x00, 0x7E, 0x30, 0x18, 0x0C, 0x06, 0x7E, 0x00, // Char 090 (Z)
+	0x00, 0x3C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x3C, // Char 091 ([)
+	0x00, 0x06, 0x0C, 0x18, 0x30, 0x60, 0x40, 0x00, // Char 092 (\)
+	0x00, 0x3C, 0x30, 0x30, 0x30, 0x30, 0x30, 0x3C, // Char 093 (])
+	0x00, 0x18, 0x3C, 0x66, 0x00, 0x00, 0x00, 0x00, // Char 094 (^)
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, // Char 095 (_)
+	0x00, 0x0C, 0x18, 0x30, 0x00, 0x00, 0x00, 0x00, // Char 096 (`)
+	0x00, 0x00, 0x3C, 0x60, 0x7C, 0x66, 0x7C, 0x00, // Char 097 (a)
+	0x00, 0x06, 0x06, 0x3E, 0x66, 0x66, 0x3E, 0x00, // Char 098 (b)
+	0x00, 0x00, 0x3C, 0x06, 0x06, 0x06, 0x3C, 0x00, // Char 099 (c)
+	0x00, 0x60, 0x60, 0x7C, 0x66, 0x66, 0x7C, 0x00, // Char 100 (d)
+	0x00, 0x00, 0x3C, 0x66, 0x7E, 0x06, 0x3C, 0x00, // Char 101 (e)
+	0x00, 0x38, 0x0C, 0x3E, 0x0C, 0x0C, 0x0C, 0x00, // Char 102 (f)
+	0x00, 0x00, 0x7C, 0x66, 0x7C, 0x40, 0x3C, 0x00, // Char 103 (g)
+	0x00, 0x06, 0x06, 0x3E, 0x66, 0x66, 0x66, 0x00, // Char 104 (h)
+	0x00, 0x18, 0x00, 0x1C, 0x18, 0x18, 0x3C, 0x00, // Char 105 (i)
+	0x00, 0x30, 0x00, 0x30, 0x30, 0x30, 0x1E, 0x00, // Char 106 (j)
+	0x00, 0x06, 0x06, 0x36, 0x1E, 0x36, 0x66, 0x00, // Char 107 (k)
+	0x00, 0x1C, 0x18, 0x18, 0x18, 0x18, 0x3C, 0x00, // Char 108 (l)
+	0x00, 0x00, 0x66, 0xFE, 0xFE, 0xD6, 0xC6, 0x00, // Char 109 (m)
+	0x00, 0x00, 0x3E, 0x66, 0x66, 0x66, 0x66, 0x00, // Char 110 (n)
+	0x00, 0x00, 0x3C, 0x66, 0x66, 0x66, 0x3C, 0x00, // Char 111 (o)
+	0x00, 0x00, 0x3E, 0x66, 0x66, 0x3E, 0x06, 0x00, // Char 112 (p)
+	0x00, 0x00, 0x7C, 0x66, 0x66, 0x7C, 0x60, 0x00, // Char 113 (q)
+	0x00, 0x00, 0x3E, 0x66, 0x06, 0x06, 0x06, 0x00, // Char 114 (r)
+	0x00, 0x00, 0x7C, 0x06, 0x3C, 0x60, 0x3E, 0x00, // Char 115 (s)
+	0x00, 0x18, 0x7E, 0x18, 0x18, 0x18, 0x70, 0x00, // Char 116 (t)
+	0x00, 0x00, 0x66, 0x66, 0x66, 0x66, 0x7C, 0x00, // Char 117 (u)
+	0x00, 0x00, 0x66, 0x66, 0x66, 0x3C, 0x18, 0x00, // Char 118 (v)
+	0x00, 0x00, 0xC6, 0xD6, 0xFE, 0x7C, 0x6C, 0x00, // Char 119 (w)
+	0x00, 0x00, 0x66, 0x3C, 0x18, 0x3C, 0x66, 0x00, // Char 120 (x)
+	0x00, 0x00, 0x66, 0x66, 0x7C, 0x60, 0x3C, 0x00, // Char 121 (y)
+	0x00, 0x00, 0x7E, 0x30, 0x18, 0x0C, 0x7E, 0x00, // Char 122 (z)
+	0x00, 0x18, 0x08, 0x08, 0x04, 0x08, 0x08, 0x18, // Char 123 ({)
+	0x00, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, // Char 124 (|)
+	0x00, 0x0C, 0x08, 0x08, 0x10, 0x08, 0x08, 0x0C, // Char 125 (})
+	0x00, 0x00, 0x00, 0x4C, 0x32, 0x00, 0x00, 0x00  // Char 126 (~)
+};
+
+void gfx_init_ctxt(gfx_ctxt_t *ctxt, u32 *fb, u32 width, u32 height, u32 stride)
+{
+	ctxt->fb = fb;
+	ctxt->width = width;
+	ctxt->height = height;
+	ctxt->stride = stride;
+}
+
+void gfx_clear_grey(gfx_ctxt_t *ctxt, u8 color)
+{
+	memset(ctxt->fb, color, 0x3C0000);
+}
+
+void gfx_clear_color(gfx_ctxt_t *ctxt, u32 color)
+{
+	for (u32 i = 0; i < ctxt->height * ctxt->stride; i++)
+		ctxt->fb[i] = color;
+}
+
+void gfx_clear_partial_grey(gfx_ctxt_t *ctxt, u8 color, u32 pos_x, u32 height)
+{
+	memset(ctxt->fb + pos_x * ctxt->stride, color, height * 4 * ctxt->stride);
+}
+
+void gfx_con_init(gfx_con_t *con, gfx_ctxt_t *ctxt)
+{
+	con->gfx_ctxt = ctxt;
+	con->fntsz = 16;
+	con->x = 0;
+	con->y = 0;
+	con->savedx = 0;
+	con->savedy = 0;
+	con->fgcol = 0xFFCCCCCC;
+	con->fillbg = 0;
+	con->bgcol = 0xFF1B1B1B;
+	con->mute = 0;
+}
+
+void gfx_con_setcol(gfx_con_t *con, u32 fgcol, int fillbg, u32 bgcol)
+{
+	con->fgcol = fgcol;
+	con->fillbg = fillbg;
+	con->bgcol = bgcol;
+}
+
+void gfx_con_getpos(gfx_con_t *con, u32 *x, u32 *y)
+{
+	*x = con->x;
+	*y = con->y;
+}
+
+void gfx_con_setpos(gfx_con_t *con, u32 x, u32 y)
+{
+	con->x = x;
+	con->y = y;
+}
+
+void gfx_putc(gfx_con_t *con, char c)
+{
+	// Duplicate code for performance reasons.
+	switch (con->fntsz)
+	{
+	case 16:
+		if (c >= 32 && c <= 126)
+		{
+			u8 *cbuf = (u8 *)&_gfx_font[8 * (c - 32)];
+			u32 *fb = con->gfx_ctxt->fb + con->x + con->y * con->gfx_ctxt->stride;
+
+			for (u32 i = 0; i < 16; i+=2)
+			{
+				u8 v = *cbuf++;
+				for (u32 k = 0; k < 2; k++)
+				{
+					for (u32 j = 0; j < 8; j++)
+					{
+						if (v & 1)
+						{
+							*fb = con->fgcol;
+							fb++;
+							*fb = con->fgcol;
+						}
+						else if (con->fillbg)
+						{
+							*fb = con->bgcol;
+							fb++;
+							*fb = con->bgcol;
+						}
+						else
+							fb++;
+						v >>= 1;
+						fb++;
+					}
+					fb += con->gfx_ctxt->stride - 16;
+					v = *cbuf;
+				}
+			}
+			con->x += 16;
+		}
+		else if (c == '\n')
+		{
+			con->x = 0;
+			con->y +=16;
+			if (con->y > con->gfx_ctxt->height - 16)
+				con->y = 0;
+		}
+		break;
+	case 8:
+	default:
+		if (c >= 32 && c <= 126)
+		{
+			u8 *cbuf = (u8 *)&_gfx_font[8 * (c - 32)];
+			u32 *fb = con->gfx_ctxt->fb + con->x + con->y * con->gfx_ctxt->stride;
+			for (u32 i = 0; i < 8; i++)
+			{
+				u8 v = *cbuf++;
+				for (u32 j = 0; j < 8; j++)
+				{
+					if (v & 1)
+						*fb = con->fgcol;
+					else if (con->fillbg)
+						*fb = con->bgcol;
+					v >>= 1;
+					fb++;
+				}
+				fb += con->gfx_ctxt->stride - 8;
+			}
+			con->x += 8;
+		}
+		else if (c == '\n')
+		{
+			con->x = 0;
+			con->y += 8;
+			if (con->y > con->gfx_ctxt->height - 8)
+				con->y = 0;
+		}
+		break;
+	}
+	
+}
+
+void gfx_puts(gfx_con_t *con, const char *s)
+{
+	if (!s || con->mute)
+		return;
+
+	for (; *s; s++)
+		gfx_putc(con, *s);
+}
+
+static void _gfx_putn(gfx_con_t *con, u32 v, int base, char fill, int fcnt)
+{
+	char buf[65];
+	static const char digits[] = "0123456789ABCDEFghijklmnopqrstuvwxyz";
+	char *p;
+	int c = fcnt;
+
+	if (base > 36)
+		return;
+
+	p = buf + 64;
+	*p = 0;
+	do
+	{
+		c--;
+		*--p = digits[v % base];
+		v /= base;
+	} while (v);
+
+	if (fill != 0)
+	{
+		while (c > 0)
+		{
+			*--p = fill;
+			c--;
+		}
+	}
+
+	gfx_puts(con, p);
+}
+
+void gfx_put_small_sep(gfx_con_t *con)
+{
+	u8 prevFontSize = con->fntsz;
+	con->fntsz = 8;
+	gfx_putc(con, '\n');
+	con->fntsz = prevFontSize;
+}
+
+void gfx_put_big_sep(gfx_con_t *con)
+{
+	u8 prevFontSize = con->fntsz;
+	con->fntsz = 16;
+	gfx_putc(con, '\n');
+	con->fntsz = prevFontSize;
+}
+
+void gfx_printf(gfx_con_t *con, const char *fmt, ...)
+{
+	if (con->mute)
+		return;
+
+	va_list ap;
+	int fill, fcnt;
+
+	va_start(ap, fmt);
+	while(*fmt)
+	{
+		if(*fmt == '%')
+		{
+			fmt++;
+			fill = 0;
+			fcnt = 0;
+			if ((*fmt >= '0' && *fmt <= '9') || *fmt == ' ')
+			{
+				fcnt = *fmt;
+				fmt++;
+				if (*fmt >= '0' && *fmt <= '9')
+				{
+					fill = fcnt;
+					fcnt = *fmt - '0';
+					fmt++;
+				}
+				else
+				{
+					fill = ' ';
+					fcnt -= '0';
+				}
+			}
+			switch(*fmt)
+			{
+			case 'c':
+				gfx_putc(con, va_arg(ap, u32));
+				break;
+			case 's':
+				gfx_puts(con, va_arg(ap, char *));
+				break;
+			case 'd':
+				_gfx_putn(con, va_arg(ap, u32), 10, fill, fcnt);
+				break;
+			case 'p':
+			case 'P':
+			case 'x':
+			case 'X':
+				_gfx_putn(con, va_arg(ap, u32), 16, fill, fcnt);
+				break;
+			case 'k':
+				con->fgcol = va_arg(ap, u32);
+				break;
+			case 'K':
+				con->bgcol = va_arg(ap, u32);
+				con->fillbg = 1;
+				break;
+			case '%':
+				gfx_putc(con, '%');
+				break;
+			case '\0':
+				goto out;
+			default:
+				gfx_putc(con, '%');
+				gfx_putc(con, *fmt);
+				break;
+			}
+		}
+		else
+			gfx_putc(con, *fmt);
+		fmt++;
+	}
+
+	out:
+	va_end(ap);
+}
+
+void gfx_hexdump(gfx_con_t *con, u32 base, const u8 *buf, u32 len)
+{
+	if (con->mute)
+		return;
+
+	u8 prevFontSize = con->fntsz;
+	con->fntsz = 8;
+	for(u32 i = 0; i < len; i++)
+	{
+		if(i % 0x10 == 0)
+		{
+			if(i != 0)
+			{
+				gfx_puts(con, "| ");
+				for(u32 j = 0; j < 0x10; j++)
+				{
+					u8 c = buf[i - 0x10 + j];
+					if(c >= 32 && c <= 126)
+						gfx_putc(con, c);
+					else
+						gfx_putc(con, '.');
+				}
+				gfx_putc(con, '\n');
+			}
+			gfx_printf(con, "%08x: ", base + i);
+		}
+		gfx_printf(con, "%02x ", buf[i]);
+		if (i == len - 1)
+		{
+			int ln = len % 0x10 != 0;
+			u32 k = 0x10 - 1;
+			if (ln)
+			{
+				k = (len & 0xF) - 1;
+				for (u32 j = 0; j < 0x10 - k; j++)
+					gfx_puts(con, "   ");
+			}
+			gfx_puts(con, "| ");
+			for(u32 j = 0; j < (ln ? k : k + 1); j++)
+			{
+				u8 c = buf[i - k + j];
+				if(c >= 32 && c <= 126)
+					gfx_putc(con, c);
+				else
+					gfx_putc(con, '.');
+			}
+			gfx_putc(con, '\n');
+		}
+	}
+	gfx_putc(con, '\n');
+	con->fntsz = prevFontSize;
+}
+
+static int abs(int x)
+{
+	if (x < 0)
+		return -x;
+	return x;
+}
+
+void gfx_set_pixel(gfx_ctxt_t *ctxt, u32 x, u32 y, u32 color)
+{
+	ctxt->fb[x + y * ctxt->stride] = color;
+}
+
+void gfx_line(gfx_ctxt_t *ctxt, int x0, int y0, int x1, int y1, u32 color)
+{
+	int dx = abs(x1 - x0), sx = x0 < x1 ? 1 : -1;
+	int dy = abs(y1 - y0), sy = y0 < y1 ? 1 : -1;
+	int err = (dx > dy ? dx : -dy) / 2, e2;
+
+	while (1)
+	{
+		gfx_set_pixel(ctxt, x0, y0, color);
+		if (x0 == x1 && y0 == y1)
+			break;
+		e2 = err;
+		if (e2 >-dx)
+		{
+			err -= dy;
+			x0 += sx;
+		}
+		if (e2 < dy)
+		{
+			err += dx;
+			y0 += sy;
+		}
+	}
+}
+
+void gfx_set_rect_grey(gfx_ctxt_t *ctxt, const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y)
+{
+	u32 pos = 0;
+	for (u32 y = pos_y; y < (pos_y + size_y); y++)
+	{
+		for (u32 x = pos_x; x < (pos_x + size_x); x++)
+		{
+			memset(&ctxt->fb[x + y*ctxt->stride], buf[pos], 4);
+			pos++;
+		}
+	}
+}
+
+
+void gfx_set_rect_rgb(gfx_ctxt_t *ctxt, const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y)
+{
+	u32 pos = 0;
+	for (u32 y = pos_y; y < (pos_y + size_y); y++)
+	{
+		for (u32 x = pos_x; x < (pos_x + size_x); x++)
+		{
+			ctxt->fb[x + y*ctxt->stride] = buf[pos + 2] | (buf[pos + 1] << 8) | (buf[pos] << 16);
+			pos+=3;
+		}
+	}
+}
+
+void gfx_set_rect_argb(gfx_ctxt_t *ctxt, const u32 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y)
+{
+	u32 pos = 0;
+	for (u32 y = pos_y; y < (pos_y + size_y); y++)
+	{
+		for (u32 x = pos_x; x < (pos_x + size_x); x++)
+		{
+			ctxt->fb[x + y*ctxt->stride] = buf[pos];
+			pos+=1;
+		}
+	}
+}
+
+void gfx_render_bmp_argb(gfx_ctxt_t *ctxt, const u32 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y)
+{
+	for (u32 y = pos_y; y < (pos_y + size_y); y++)
+	{
+		for (u32 x = pos_x; x < (pos_x + size_x); x++)
+			ctxt->fb[x + y*ctxt->stride]  = buf[(size_y + pos_y - 1 - y ) * size_x + x - pos_x];
+	}
+}

modules/simple_sample/gfx/gfx.h

@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ * Copyright (C) 2018 CTCaer
+ * Copyright (C) 2018 M4xw
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _GFX_H_
+#define _GFX_H_
+
+#include "../../../common/common_gfx.h"
+
+void gfx_init_ctxt(gfx_ctxt_t *ctxt, u32 *fb, u32 width, u32 height, u32 stride);
+void gfx_clear_grey(gfx_ctxt_t *ctxt, u8 color);
+void gfx_clear_partial_grey(gfx_ctxt_t *ctxt, u8 color, u32 pos_x, u32 height);
+void gfx_clear_color(gfx_ctxt_t *ctxt, u32 color);
+void gfx_con_init(gfx_con_t *con, gfx_ctxt_t *ctxt);
+void gfx_con_setcol(gfx_con_t *con, u32 fgcol, int fillbg, u32 bgcol);
+void gfx_con_getpos(gfx_con_t *con, u32 *x, u32 *y);
+void gfx_con_setpos(gfx_con_t *con, u32 x, u32 y);
+void gfx_putc(gfx_con_t *con, char c);
+void gfx_puts(gfx_con_t *con, const char *s);
+void gfx_printf(gfx_con_t *con, const char *fmt, ...);
+void gfx_hexdump(gfx_con_t *con, u32 base, const u8 *buf, u32 len);
+
+void gfx_set_pixel(gfx_ctxt_t *ctxt, u32 x, u32 y, u32 color);
+void gfx_line(gfx_ctxt_t *ctxt, int x0, int y0, int x1, int y1, u32 color);
+void gfx_put_small_sep(gfx_con_t *con);
+void gfx_put_big_sep(gfx_con_t *con);
+void gfx_set_rect_grey(gfx_ctxt_t *ctxt, const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
+void gfx_set_rect_rgb(gfx_ctxt_t *ctxt, const u8 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
+void gfx_set_rect_argb(gfx_ctxt_t *ctxt, const u32 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
+void gfx_render_bmp_argb(gfx_ctxt_t *ctxt, const u32 *buf, u32 size_x, u32 size_y, u32 pos_x, u32 pos_y);
+
+#endif

res/hekate_ipl_template.ini

@@ -1,46 +1,59 @@
 [config]
-autoboot=5
+autoboot=4
+autoboot_list=0
 bootwait=3
-customlogo=1
-verification=2
+verification=1
+backlight=100
+autohosoff=0
+autonogc=1
 
 {-------- Stock -------}
-[Stock]
+[Stock 6.2.0 and lower]
+stock=1
 
-[Stock (SVC perms)]
-fullsvcperm=1
-debugmode=1
-
-[Stock (Prevent GC access)]
-kip1patch=nogc
-
-[Stock (Allow unsigned NCA)]
-kip1patch=nosigchk
+[Stock All FW]
+fss0=atmosphere/fusee-secondary.bin
+stock=1
 { }
+# Both above disable kernel patching
+# Stock All FW, includes exosphere and warmboot, ONLY when >= 7.0.0.
 
 {-- Custom Firmwares --}
-[AtmoHB]
-kip1=cfw/loader.kip1
-kip1=cfw/sm.kip1
+[Atmo FSS0 Vanilla]
+fss0=atmosphere/fusee-secondary.bin
+logopath=cfw/atmo.bmp
 
-[AtmoHB (SVC Perms)]
-kip1=cfw/loader.kip1
-kip1=cfw/sm.kip1
-fullsvcperm=1
+[CFW FSS0 extra kips]
+fss0=atmosphere/fusee-secondary.bin
+kip1=cfw/mods/mods_extra/*
+kip1=cfw/mods/mods_extra/single/extra.kip
+logopath=cfw/cfw.bmp
+# Both options for kip1 can be used. Wildcard and single.
 
-[Atmosphere Full]
-secmon=cfw/atmo/exosphere.bin
-kip1=cfw/atmo/loader.kip
-kip1=cfw/atmo/sm.kip
-kip1=cfw/atmo/fs_mitm.kip
-logopath=cfw/atmo/atmo.bmp
+[Atmo Vanilla]
+secmon=cfw/mods/exosphere.bin
+warmboot=cfw/mods/lp0fw.bin
+kip1=cfw/mods/loader.kip
+kip1=cfw/mods/sm.kip
+kip1=cfw/mods/pm.kip
+kip1=cfw/mods/ams_mitm.kip
+logopath=cfw/atmo.bmp
 atmosphere=1
-# kip1=cfw/atmo/pm.kip
+# All kips defined.
+
+[CFW Extra kips]
+secmon=cfw/mods/exosphere.bin
+warmboot=cfw/mods/lp0fw.bin
+kip1=cfw/mods/*
+kip1=cfw/mods/extra/extra.kip
+logopath=cfw/cfw.bmp
+atmosphere=1
+# All kips parsed from a directory and extra added.
 { }
 
 {------- Tools -------}
-[Clear Error Logs]
-kip1=cfw/nx-dreport.kip
+[memloader]
+payload=bootloader/payloads/memloader.bin
 
 
-# hekate - CTCaer mod v3.0 .ini template
+# hekate - CTCaer mod v4.9.1 .ini template

tools/smmu_payload.py

@@ -0,0 +1,38 @@
+'''
+Copyright (c) 2018 balika011
+
+This program is free software; you can redistribute it and/or modify it
+under the terms and conditions of the GNU General Public License,
+version 2, as published by the Free Software Foundation.
+
+This program is distributed in the hope it will be useful, but WITHOUT
+ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+more details.
+
+You should have received a copy of the GNU General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.
+'''
+
+from keystone import *
+
+CODE = b'''
+	LDR	X1, =0x70019010
+	MOV X0, #0x1
+	STR W0, [X1]
+
+loop:
+	IC	IALLUIS
+	DSB ISH
+	B loop
+	MOV X0, #0x0
+	STR W0, [X1]
+	LDR	X0, =0x4002B000
+	BR	X0
+'''
+try:
+	ks = Ks(KS_ARCH_ARM64, KS_MODE_LITTLE_ENDIAN)
+	encoding, count = ks.asm(CODE, 0x0)
+	print("%s = %s (number of statements: %u)" %(CODE, ', '.join([('0x%02x' % (x)) for x in encoding]), count))
+except KsError as e:
+	print("ERROR: %s" %e)