Bump version to v4.6

This fixes the issue with "More configs".

Makefile

@@ -6,7 +6,7 @@ include $(DEVKITARM)/base_rules
 
 TARGET := hekate
 BLVERSION_MAJOR := 4
-BLVERSION_MINOR := 5
+BLVERSION_MINOR := 6
 BUILD := build
 OUTPUT := output
 SOURCEDIR = bootloader
@@ -61,9 +61,12 @@ OBJS += $(addprefix $(BUILD)/$(TARGET)/, \
 	elfload.o elfreloc_arm.o \
 )
 
+CUSTOMDEFINES := -DBLVERSIONMJ=$(BLVERSION_MAJOR) -DBLVERSIONMN=$(BLVERSION_MINOR) -DMENU_LOGO_ENABLE
+#CUSTOMDEFINES += -DDEBUG
+# 0: UART_A, 1: UART_B.
+#CUSTOMDEFINES += -DDEBUG_UART_PORT=0
+
 ARCH := -march=armv4t -mtune=arm7tdmi -mthumb -mthumb-interwork
-CUSTOMDEFINES := -DBLVERSIONMJ=$(BLVERSION_MAJOR) -DBLVERSIONMN=$(BLVERSION_MINOR)
-CUSTOMDEFINES += -DMENU_LOGO_ENABLE #-DDEBUG
 CFLAGS = $(ARCH) -O2 -nostdlib -ffunction-sections -fdata-sections -fomit-frame-pointer -fno-inline -std=gnu11 -Wall $(CUSTOMDEFINES)
 LDFLAGS = $(ARCH) -nostartfiles -lgcc -Wl,--nmagic,--gc-sections
 

bootloader/config/config.c

@@ -46,7 +46,7 @@ void set_default_configuration()
 	h_cfg.se_keygen_done = 0;
 	h_cfg.sbar_time_keeping = 0;
 	h_cfg.backlight = 100;
-	h_cfg.autohosoff = 1;
+	h_cfg.autohosoff = 0;
 	h_cfg.errors = 0;
 }
 
@@ -156,7 +156,7 @@ int create_config_entry()
 	return 0;
 }
 
-void _config_autoboot_list()
+static void _config_autoboot_list(void *ent)
 {
 	gfx_clear_grey(&gfx_ctxt, 0x1B);
 	gfx_con_setpos(&gfx_con, 0, 0);
@@ -231,6 +231,9 @@ void _config_autoboot_list()
 				else
 					EPRINTF("\nConfiguration saving failed!");
 				gfx_puts(&gfx_con, "\nPress any key...");
+
+				ment_t *tmp = (ment_t *)ent;
+				tmp->data = NULL;
 			}
 			else
 				goto out2;
@@ -251,9 +254,6 @@ out2:;
 	ini_free(&ini_sections);
 
 	sd_unmount();
-
-	if (temp_autoboot == NULL)
-		return;
 }
 
 void config_autoboot()
@@ -291,13 +291,13 @@ void config_autoboot()
 				ments[2].caption = " Disable";
 			ments[2].data = &boot_values[0];
 
-			ments[3].type = MENT_HANDLER;
+			ments[3].type = MENT_HDLR_RE;
 			if (h_cfg.autoboot_list)
 				ments[3].caption = "*More configs...";
 			else
 				ments[3].caption = " More configs...";
 			ments[3].handler = _config_autoboot_list;
-			ments[3].data = NULL;
+			ments[3].data = (void *)0xCAFE;
 
 			ments[4].type = MENT_CHGLINE;
 

bootloader/config/ini.c

@@ -84,7 +84,7 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 			lblen = strlen(lbuf);
 
 			// Remove trailing newline.
-			if (lbuf[lblen - 1] == '\n')
+			if (lbuf[lblen - 1] == '\n' || lbuf[lblen - 1] == '\r')
 				lbuf[lblen - 1] = 0;
 
 			if (lblen > 2 && lbuf[0] == '[') // Create new section.
@@ -96,7 +96,7 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 				}
 
 				u32 i;
-				for (i = 0; i < lblen && lbuf[i] != '\n' && lbuf[i] != ']'; i++)
+				for (i = 0; i < lblen  && lbuf[i] != ']' && lbuf[i] != '\n' && lbuf[i] != '\r'; i++)
 					;
 				lbuf[i] = 0;
 
@@ -114,7 +114,7 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 				}
 
 				u32 i;
-				for (i = 0; i < lblen && lbuf[i] != '\n' && lbuf[i] != '}'; i++)
+				for (i = 0; i < lblen && lbuf[i] != '}' && lbuf[i] != '\n' && lbuf[i] != '\r'; i++)
 					;
 				lbuf[i] = 0;
 
@@ -132,7 +132,7 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 				}
 
 				u32 i;
-				for (i = 0; i < lblen && lbuf[i] != '\n'; i++)
+				for (i = 0; i < lblen && lbuf[i] != '\n' && lbuf[i] != '\r'; i++)
 					;
 				lbuf[i] = 0;
 
@@ -155,7 +155,7 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 			else if (csec && csec->type == INI_CHOICE) //Extract key/value.
 			{
 				u32 i;
-				for (i = 0; i < lblen && lbuf[i] != '\n' && lbuf[i] != '='; i++)
+				for (i = 0; i < lblen && lbuf[i] != '=' && lbuf[i] != '\n' && lbuf[i] != '\r'; i++)
 					;
 				lbuf[i] = 0;
 

bootloader/frontend/fe_emmc_tools.c

@@ -48,7 +48,7 @@ extern void emmcsn_path_impl(char *path, char *sub_dir, char *filename, sdmmc_st
 #define WPRINTF(text) gfx_printf(&gfx_con, "%k"text"%k\n", 0xFFFFDD00, 0xFFCCCCCC)
 #define WPRINTFARGS(text, args...) gfx_printf(&gfx_con, "%k"text"%k\n", 0xFFFFDD00, args, 0xFFCCCCCC)
 
-int _dump_emmc_verify(sdmmc_storage_t *storage, u32 lba_curr, char *outFilename, emmc_part_t *part)
+static int _dump_emmc_verify(sdmmc_storage_t *storage, u32 lba_curr, char *outFilename, emmc_part_t *part)
 {
 	FIL fp;
 	u32 btn = 0;
@@ -165,7 +165,7 @@ int _dump_emmc_verify(sdmmc_storage_t *storage, u32 lba_curr, char *outFilename,
 	}
 }
 
-int _dump_emmc_part(char *sd_path, sdmmc_storage_t *storage, emmc_part_t *part)
+static int _dump_emmc_part(char *sd_path, sdmmc_storage_t *storage, emmc_part_t *part)
 {
 	static const u32 FAT32_FILESIZE_LIMIT = 0xFFFFFFFF;
 	static const u32 SECTORS_TO_MIB_COEFF = 11;
@@ -635,7 +635,7 @@ void dump_emmc_user()    { _dump_emmc_selected(PART_USER); }
 void dump_emmc_boot()    { _dump_emmc_selected(PART_BOOT); }
 void dump_emmc_rawnand() { _dump_emmc_selected(PART_RAW); }
 
-int _restore_emmc_part(char *sd_path, sdmmc_storage_t *storage, emmc_part_t *part)
+static int _restore_emmc_part(char *sd_path, sdmmc_storage_t *storage, emmc_part_t *part)
 {
 	static const u32 SECTORS_TO_MIB_COEFF = 11;
 
@@ -652,7 +652,10 @@ int _restore_emmc_part(char *sd_path, sdmmc_storage_t *storage, emmc_part_t *par
 	res = f_open(&fp, outFilename, FA_READ);
 	if (res)
 	{
-		WPRINTFARGS("Error (%d) while opening backup. Continuing...\n", res);
+		if (res != FR_NO_FILE)
+			EPRINTFARGS("Error (%d) while opening backup. Continuing...\n", res);
+		else
+			WPRINTFARGS("Error (%d) file not found. Continuing...\n", res);
 		gfx_con.fntsz = 16;
 
 		return 0;

bootloader/frontend/fe_info.c

@@ -637,11 +637,11 @@ void _ipatch_process(u32 offset, u32 value)
 	u8 lo = value & 0xff;
 	switch (value >> 8)
 	{
-	case 0xdf:
-		gfx_printf(&gfx_con, "    svc #0x%02x", lo);
-		break;
 	case 0x20:
-		gfx_printf(&gfx_con, "    movs r0, #0x%02x", lo);
+		gfx_printf(&gfx_con, "    MOVS R0, #0x%02X", lo);
+		break;
+	case 0xDF:
+		gfx_printf(&gfx_con, "    SVC #0x%02X", lo);
 		break;
 	}
 	gfx_puts(&gfx_con, "\n");
@@ -657,7 +657,7 @@ void bootrom_ipatches_info()
 	u32 res = fuse_read_ipatch(_ipatch_process);
 	if (res != 0)
 		EPRINTFARGS("Failed to read ipatches. Error: %d", res);
-	
+
 	gfx_puts(&gfx_con, "\nPress POWER to dump them to SD Card.\nPress VOL to go to the menu.\n");
 	
 	u32 btn = btn_wait();
@@ -688,15 +688,15 @@ void bootrom_ipatches_info()
 			if (!sd_save_to_file((u8 *)BOOTROM_BASE, BOOTROM_SIZE, path))
 				gfx_puts(&gfx_con, "\nbootrom_patched.bin saved!\n");
 			
-			u8 ipatch_backup[13];
+			u32 ipatch_backup[14];
-			memcpy(ipatch_backup, (void *) IPATCH_BASE, 13);
+			memcpy(ipatch_backup, (void *)IPATCH_BASE, sizeof(ipatch_backup));
-			memset((void*)IPATCH_BASE, 0, 13);
+			memset((void*)IPATCH_BASE, 0, sizeof(ipatch_backup));
 			
 			emmcsn_path_impl(path, "/dumps", "bootrom_unpatched.bin", NULL);
 			if (!sd_save_to_file((u8 *)BOOTROM_BASE, BOOTROM_SIZE, path))
 				gfx_puts(&gfx_con, "\nbootrom_unpatched.bin saved!\n");
 			
-			memcpy((void*)IPATCH_BASE, ipatch_backup, 13);
+			memcpy((void*)IPATCH_BASE, ipatch_backup, sizeof(ipatch_backup));
 			
 			sd_unmount();
 		}

bootloader/frontend/fe_tools.c

@@ -322,6 +322,7 @@ void menu_autorcm()
 		ments[4].handler = _disable_autorcm;
 	}
 	ments[4].type = MENT_HDLR_RE;
+	ments[4].data = NULL;
 
 	memset(&ments[5], 0, sizeof(ment_t));
 	menu_t menu = {ments, "This corrupts your BOOT0!", 0, 0};
@@ -329,7 +330,7 @@ void menu_autorcm()
 	tui_do_menu(&gfx_con, &menu);
 }
 
-int _fix_attributes(char *path, u32 *total, u32 is_root, u32 check_first_run)
+int _fix_attributes(char *path, u32 *total, u32 hos_folder, u32 check_first_run)
 {
 	FRESULT res;
 	DIR dir;
@@ -369,8 +370,8 @@ int _fix_attributes(char *path, u32 *total, u32 is_root, u32 check_first_run)
 		if (res != FR_OK || fno.fname[0] == 0)
 			break;
 
-		// Skip official Nintendo dir.
+		// Skip official Nintendo dir if started from root.
-		if (is_root && !strcmp(fno.fname, "Nintendo"))
+		if (!hos_folder && !strcmp(fno.fname, "Nintendo"))
 			continue;
 
 		// Set new directory or file.
@@ -380,15 +381,21 @@ int _fix_attributes(char *path, u32 *total, u32 is_root, u32 check_first_run)
 		// Check if archive bit is set.
 		if (fno.fattrib & AM_ARC)
 		{
-			*(u32 *)total = *(u32 *)total + 1;
+			*total = *total + 1;
 			f_chmod(path, 0, AM_ARC);
 		}
 
 		// Is it a directory?
 		if (fno.fattrib & AM_DIR)
 		{
+			// Set archive bit to NCA folders.
+			if (hos_folder && !strcmp(fno.fname + strlen(fno.fname) - 4, ".nca"))
+			{
+				*total = *total + 1;
+				f_chmod(path, AM_ARC, AM_ARC);
+			}
 			// Enter the directory.
-			res = _fix_attributes(path, total, 0, 0);
+			res = _fix_attributes(path, total, hos_folder, 0);
 			if (res != FR_OK)
 				break;
 		}
@@ -405,7 +412,7 @@ void _fix_sd_attr(u32 type)
 	gfx_con_setpos(&gfx_con, 0, 0);
 
 	char path[256];
-	char label[14];
+	char label[16];
 
 	u32 total = 0;
 	if (sd_mount())
@@ -418,21 +425,21 @@ void _fix_sd_attr(u32 type)
 			break;
 		case 1:
 		default:
-			memcpy(path, "/switch", 8);
+			memcpy(path, "/Nintendo", 10);
-			memcpy(label, "switch folder", 14);
+			memcpy(label, "Nintendo folder", 16);
 			break;
 		}
 
 		gfx_printf(&gfx_con, "Traversing all %s files!\nThis may take some time, please wait...\n\n", label);
-		_fix_attributes(path, &total, !type, type);
+		_fix_attributes(path, &total, type, type);
 		gfx_printf(&gfx_con, "%kTotal archive bits cleared: %d!%k\n\nDone! Press any key...", 0xFF96FF00, total, 0xFFCCCCCC);
 		sd_unmount();
 	}
 	btn_wait();
 }
 
-void fix_sd_all_attr()    { _fix_sd_attr(0); }
+void fix_sd_all_attr() { _fix_sd_attr(0); }
-void fix_sd_switch_attr() { _fix_sd_attr(1); }
+void fix_sd_nin_attr() { _fix_sd_attr(1); }
 
 void fix_battery_desync()
 {

bootloader/frontend/fe_tools.h

@@ -20,7 +20,7 @@
 
 void dump_packages12();
 void fix_sd_all_attr();
-void fix_sd_switch_attr();
+void fix_sd_nin_attr();
 void fix_battery_desync();
 void menu_autorcm();
 

bootloader/gfx/tui.c

@@ -206,8 +206,10 @@ void *tui_do_menu(gfx_con_t *con, menu_t *menu)
 				return NULL;
 				break;
 			case MENT_HDLR_RE:
-				ent->handler(ent->data);
+				ent->handler(ent);
-				return NULL;
+				if (!ent->data)
+					return NULL;
+				break;
 			default:
 				break;
 			}

bootloader/hos/hos.c

@@ -96,7 +96,7 @@ static void _se_lock(bool lock_se)
 		SE(SE_SECURITY_0) &= 0xFFFFFFFB; // Make access lock regs secure only.
 	}
 
-	memset((void *)IPATCH_BASE, 0, 13);
+	memset((void *)IPATCH_BASE, 0, 14 * sizeof(u32));
 	SB(SB_CSR) = 0x10; // Protected IROM enable.
 
 	// This is useful for documenting the bits in the SE config registers, so we can keep it around.
@@ -184,8 +184,12 @@ int keygen(u8 *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt)
 		memset(tmp, 0x00, 0x20);
 		retries++;
 
-		if (retries > 3)
+		// We rely on racing conditions, make sure we cover even the unluckiest cases.
+		if (retries > 15)
+		{
+			gfx_printf(&gfx_con, "%k\nFailed to get TSEC keys. Please try again.%k\n\n", 0xFFFF0000, 0xFFCCCCCC);
 			return 0;
+		}
 	}
 
 	if (kb >= KB_FIRMWARE_VERSION_620)
@@ -281,10 +285,10 @@ static int _read_emmc_pkg1(launch_ctxt_t *ctxt)
 	ctxt->pkg1_id = pkg1_identify(ctxt->pkg1);
 	if (!ctxt->pkg1_id)
 	{
-		gfx_printf(&gfx_con, "%kUnknown package1,\nVersion (= '%s').%k\n", 0xFFFF0000, (char *)ctxt->pkg1 + 0x10, 0xFFCCCCCC);
+		gfx_printf(&gfx_con, "%kUnknown pkg1,\nVersion (= '%s').%k\n", 0xFFFF0000, (char *)ctxt->pkg1 + 0x10, 0xFFCCCCCC);
 		goto out;
 	}
-	gfx_printf(&gfx_con, "Identified package1 ('%s'),\nKeyblob version %d\n\n", (char *)(ctxt->pkg1 + 0x10), ctxt->pkg1_id->kb);
+	gfx_printf(&gfx_con, "Identified pkg1 ('%s'),\nKeyblob version %d\n\n", (char *)(ctxt->pkg1 + 0x10), ctxt->pkg1_id->kb);
 
 	// Read the correct keyblob.
 	ctxt->keyblob = (u8 *)calloc(NX_EMMC_BLOCKSIZE, 1);
@@ -376,7 +380,7 @@ int hos_launch(ini_sec_t *cfg)
 	if (!_read_emmc_pkg1(&ctxt))
 		return 0;
 
-	gfx_printf(&gfx_con, "Loaded package1 and keyblob\n");
+	gfx_printf(&gfx_con, "Loaded pkg1 and keyblob\n");
 
 	// Generate keys.
 	if (!h_cfg.se_keygen_done || ctxt.pkg1_id->kb >= KB_FIRMWARE_VERSION_620)
@@ -402,12 +406,20 @@ int hos_launch(ini_sec_t *cfg)
 
 		pkg1_unpack((void *)ctxt.pkg1_id->warmboot_base, (void *)ctxt.pkg1_id->secmon_base, NULL, ctxt.pkg1_id, ctxt.pkg1);
 
-		gfx_printf(&gfx_con, "Decrypted and unpacked package1\n");
+		gfx_printf(&gfx_con, "Decrypted and unpacked pkg1\n");
 	}
 
 	// Replace 'warmboot.bin' if requested.
 	if (ctxt.warmboot)
 		memcpy((void *)ctxt.pkg1_id->warmboot_base, ctxt.warmboot, ctxt.warmboot_size);
+	else
+	{
+		// Else we patch it to allow downgrading.
+		patch_t *warmboot_patchset = ctxt.pkg1_id->warmboot_patchset;
+		gfx_printf(&gfx_con, "%kPatching Warmboot%k\n", 0xFFFFBA00, 0xFFCCCCCC);
+		for (u32 i = 0; warmboot_patchset[i].off != 0xFFFFFFFF; i++)
+			*(vu32 *)(ctxt.pkg1_id->warmboot_base + warmboot_patchset[i].off) = warmboot_patchset[i].val;
+	}
 	// Set warmboot address in PMC if required.
 	if (ctxt.pkg1_id->set_warmboot)
 		PMC(APBDEV_PMC_SCRATCH1) = ctxt.pkg1_id->warmboot_base;
@@ -431,10 +443,15 @@ int hos_launch(ini_sec_t *cfg)
 	if (!bootConfigBuf)
 		return 0;
 
-	gfx_printf(&gfx_con, "Read package2\n");
+	gfx_printf(&gfx_con, "Read pkg2\n");
 
 	// Decrypt package2 and parse KIP1 blobs in INI1 section.
 	pkg2_hdr_t *pkg2_hdr = pkg2_decrypt(ctxt.pkg2);
+	if (!pkg2_hdr)
+	{
+		gfx_printf(&gfx_con, "Pkg2 decryption failed!\n");
+		return 0;
+	}
 
 	LIST_INIT(kip1_info);
 	pkg2_parse_kips(&kip1_info, pkg2_hdr);
@@ -492,7 +509,7 @@ int hos_launch(ini_sec_t *cfg)
 	// Rebuild and encrypt package2.
 	pkg2_build_encrypt((void *)0xA9800000, ctxt.kernel, ctxt.kernel_size, &kip1_info);
 
-	gfx_printf(&gfx_con, "Rebuilt and loaded package2\n");
+	gfx_printf(&gfx_con, "Rebuilt and loaded pkg2\n");
 
 	// Unmount SD card.
 	sd_unmount();

bootloader/hos/hos.h

@@ -32,6 +32,8 @@
 #define KB_FIRMWARE_VERSION_620 6
 #define KB_FIRMWARE_VERSION_MAX KB_FIRMWARE_VERSION_620
 
+#define HOS_PKG11_MAGIC 0x31314B50
+
 typedef struct _launch_ctxt_t
 {
 	void *keyblob;

bootloader/hos/pkg1.c

@@ -23,6 +23,8 @@
 #include "../utils/aarch64_util.h"
 #include "../sec/se.h"
 
+#define _NOPv7() 0xE320F000
+
 #define SM_100_ADR 0x4002B020
 PATCHSET_DEF(_secmon_1_patchset,
 	// Patch the relocator to be able to run from SM_100_ADR.
@@ -80,6 +82,39 @@ PATCHSET_DEF(_secmon_620_patchset,
 	{ 0xDC8 + 0xF10, _NOP() }  //Sections SHA2.
 );
 
+PATCHSET_DEF(_warmboot_1_patchset,
+	{ 0x4DC, _NOPv7() } // Fuse check.
+);
+
+PATCHSET_DEF(_warmboot_2_patchset,
+	{ 0x4DC, _NOPv7() } // Fuse check.
+);
+
+PATCHSET_DEF(_warmboot_3_patchset,
+	{ 0x4DC, _NOPv7() }, // Fuse check.
+	{ 0x4F0, _NOPv7() }  // Segment id check.
+);
+
+PATCHSET_DEF(_warmboot_4_patchset,
+	{ 0x544, _NOPv7() }, // Fuse check.
+	{ 0x558, _NOPv7() }  // Segment id check.
+);
+
+PATCHSET_DEF(_warmboot_5_patchset,
+	{ 0x544, _NOPv7() }, // Fuse check.
+	{ 0x558, _NOPv7() }  // Segment id check.
+);
+
+PATCHSET_DEF(_warmboot_6_patchset,
+	{ 0x544, _NOPv7() }, // Fuse check.
+	{ 0x558, _NOPv7() }  // Segment id check.
+);
+
+PATCHSET_DEF(_warmboot_620_patchset,
+	{ 0x544, _NOPv7() }, // Fuse check.
+	{ 0x558, _NOPv7() }  // Segment id check.
+);
+
 /*
  * package1.1 header: <wb, ldr, sm>
  * package1.1 layout:
@@ -94,14 +129,14 @@ PATCHSET_DEF(_secmon_620_patchset,
  */
 
 static const pkg1_id_t _pkg1_ids[] = {
-	{ "20161121183008", 0, 0x1900, 0x3FE0, { 2, 1, 0 }, SM_100_ADR, 0x8000D000, true,  _secmon_1_patchset },   //1.0.0 (Patched relocator)
+	{ "20161121183008", 0, 0x1900, 0x3FE0, { 2, 1, 0 }, SM_100_ADR, 0x8000D000, true,  _secmon_1_patchset, _warmboot_1_patchset },     //1.0.0 (Patched relocator)
-	{ "20170210155124", 0, 0x1900, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, true,  _secmon_2_patchset },   //2.0.0 - 2.3.0
+	{ "20170210155124", 0, 0x1900, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, true,  _secmon_2_patchset, _warmboot_2_patchset },     //2.0.0 - 2.3.0
-	{ "20170519101410", 1, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, true,  _secmon_3_patchset },   //3.0.0
+	{ "20170519101410", 1, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, true,  _secmon_3_patchset, _warmboot_3_patchset },     //3.0.0
-	{ "20170710161758", 2, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, true,  _secmon_3_patchset },   //3.0.1 - 3.0.2
+	{ "20170710161758", 2, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, true,  _secmon_3_patchset, _warmboot_3_patchset },     //3.0.1 - 3.0.2
-	{ "20170921172629", 3, 0x1800, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003B000, false, _secmon_4_patchset },   //4.0.0 - 4.1.0
+	{ "20170921172629", 3, 0x1800, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003B000, false, _secmon_4_patchset, _warmboot_4_patchset },     //4.0.0 - 4.1.0
-	{ "20180220163747", 4, 0x1900, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003B000, false, _secmon_5_patchset },   //5.0.0 - 5.1.0
+	{ "20180220163747", 4, 0x1900, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003B000, false, _secmon_5_patchset, _warmboot_5_patchset },     //5.0.0 - 5.1.0
-	{ "20180802162753", 5, 0x1900, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003D800, false, _secmon_6_patchset },   //6.0.0 - 6.1.0
+	{ "20180802162753", 5, 0x1900, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003D800, false, _secmon_6_patchset, _warmboot_6_patchset },     //6.0.0 - 6.1.0
-	{ "20181107105733", 6, 0x0E00, 0x6FE0, { 1, 2, 0 }, 0x4002B000, 0x4003D800, false, _secmon_620_patchset }, //6.2.0
+	{ "20181107105733", 6, 0x0E00, 0x6FE0, { 1, 2, 0 }, 0x4002B000, 0x4003D800, false, _secmon_620_patchset, _warmboot_620_patchset }, //6.2.0
 	{ NULL } //End.
 };
 

bootloader/hos/pkg1.h

@@ -42,6 +42,7 @@ typedef struct _pkg1_id_t
 	u32 warmboot_base;
 	bool set_warmboot;
 	patch_t *secmon_patchset;
+	patch_t *warmboot_patchset;
 } pkg1_id_t;
 
 typedef struct _pk11_hdr_t

bootloader/hos/secmon_exo.c

@@ -57,7 +57,7 @@ void config_exosphere(const char *id, u32 kb, bool debug)
 		exoFlags |= EXO_FLAG_620_KGN;
 
 	if (debug)
-		exoFlags |= EXO_FLAG_DBG_PRIV | EXO_FLAG_DBG_USER;
+		exoFlags |= EXO_FLAG_DBG_PRIV;
 
 	// Set mailbox values.
 	*mb_exo_magic = EXO_MAGIC_VAL;

bootloader/main.c

@@ -269,6 +269,7 @@ void check_power_off_from_hos()
 #define COREBOOT_ADDR      (0xD0000000 - 0x100000)
 
 void (*ext_payload_ptr)() = (void *)EXT_PAYLOAD_ADDR;
+void (*update_ptr)() = (void *)RCM_PAYLOAD_ADDR;
 
 void reloc_patcher(u32 payload_size)
 {
@@ -289,7 +290,7 @@ void reloc_patcher(u32 payload_size)
 	}
 }
 
-#define BOOTLOADER_UPDATED_MAGIC      0x424f4f54 // "BOOT".
+#define BOOTLOADER_UPDATED_MAGIC      0x424F4F54 // "BOOT".
 #define BOOTLOADER_UPDATED_MAGIC_ADDR 0x4003E000
 
 int launch_payload(char *path, bool update)
@@ -375,7 +376,10 @@ int launch_payload(char *path, bool update)
 		}
 
 		// Launch our payload.
-		(*ext_payload_ptr)();
+		if (!update)
+			(*ext_payload_ptr)();
+		else
+			(*update_ptr)();
 	}
 
 	return 1;
@@ -959,7 +963,6 @@ void auto_launch_firmware()
 #endif //MENU_LOGO_ENABLE
 
 out:
-	gfx_clear_grey(&gfx_ctxt, 0x1B);
 	ini_free(&ini_sections);
 	if (h_cfg.autoboot_list)
 		ini_free(&ini_list_sections);
@@ -1106,8 +1109,8 @@ ment_t ment_tools[] = {
 	MDEF_CAPTION("-------- Misc --------", 0xFF0AB9E6),
 	MDEF_HANDLER("Dump package1/2", dump_packages12),
 	MDEF_HANDLER("Fix battery de-sync", fix_battery_desync),
-	MDEF_HANDLER("Unset archive bit (switch folder)", fix_sd_switch_attr),
+	MDEF_HANDLER("Fix archive bit (except Nintendo folder)", fix_sd_all_attr),
-	MDEF_HANDLER("Unset archive bit (all sd files)", fix_sd_all_attr),
+	MDEF_HANDLER("Fix archive bit (Nintendo folder)", fix_sd_nin_attr),
 	//MDEF_HANDLER("Fix fuel gauge configuration", fix_fuel_gauge_configuration),
 	//MDEF_HANDLER("Reset all battery cfg", reset_pmic_fuel_gauge_charger_config),
 	//MDEF_HANDLER("Minerva", minerva), // Uncomment for testing Minerva Training Cell
@@ -1138,16 +1141,14 @@ ment_t ment_top[] = {
 };
 menu_t menu_top = {
 	ment_top,
-	"hekate - CTCaer mod v4.5", 0, 0
+	"hekate - CTCaer mod v4.6", 0, 0
 };
 
 extern void pivot_stack(u32 stack_top);
 
 void ipl_main()
 {
-	// Skip config if we just updated the bootloader.
+	config_hw();
-	if (*(vu32 *)BOOTLOADER_UPDATED_MAGIC_ADDR != BOOTLOADER_UPDATED_MAGIC)
-		config_hw();
 
 	//Pivot the stack so we have enough space.
 	pivot_stack(0x90010000);
@@ -1155,8 +1156,10 @@ void ipl_main()
 	//Tegra/Horizon configuration goes to 0x80000000+, package2 goes to 0xA9800000, we place our heap in between.
 	heap_init(0x90020000);
 
-	//uart_send(UART_C, (u8 *)0x40000000, 0x10000);
+#ifdef DEBUG_UART_PORT
-	//uart_wait_idle(UART_C, UART_TX_IDLE);
+	uart_send(DEBUG_UART_PORT, (u8 *)"Hekate: Hello!\r\n", 18);
+	uart_wait_idle(DEBUG_UART_PORT, UART_TX_IDLE);
+#endif
 
 	// Set bootloader's default configuration.
 	set_default_configuration();

bootloader/mem/sdram_config.inl

@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018 balika011
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -171,7 +172,7 @@ static const u8 _dram_cfg_0[1896] = {
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x46, 0x2C, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0xEC, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF0, 0xFF,
+	0x01, 0x77, 0x00, 0xFC, 0x00, 0x20, 0xCF, 0x22, 0x00, 0x00, 0xF0, 0xFF,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
 
@@ -332,7 +333,7 @@ static const u8 _dram_cfg_1[1896] = {
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x46, 0x2C, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0xEC, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF0, 0xFF,
+	0x01, 0x77, 0x00, 0xFC, 0x00, 0x20, 0xCF, 0x22, 0x00, 0x00, 0xF0, 0xFF,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
 
@@ -493,7 +494,7 @@ static const u8 _dram_cfg_2[1896] = {
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x46, 0x2C, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0xEC, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF0, 0xFF,
+	0x01, 0x77, 0x00, 0xFC, 0x00, 0x20, 0xCF, 0x22, 0x00, 0x00, 0xF0, 0xFF,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
 
@@ -654,7 +655,7 @@ static const u8 _dram_cfg_3[1896] = {
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x46, 0x2C, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0xEC, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF0, 0xFF,
+	0x01, 0x77, 0x00, 0xFC, 0x00, 0x20, 0xCF, 0x22, 0x00, 0x00, 0xF0, 0xFF,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
 
@@ -815,7 +816,7 @@ static const u8 _dram_cfg_4[1896] = {
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x46, 0x2C, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0xEC, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF0, 0xFF,
+	0x01, 0x77, 0x00, 0xFC, 0x00, 0x20, 0xCF, 0x22, 0x00, 0x00, 0xF0, 0xFF,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
 
@@ -976,7 +977,7 @@ static const u8 _dram_cfg_5[1896] = {
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x46, 0x2C, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0xEC, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF0, 0xFF,
+	0x01, 0x77, 0x00, 0xFC, 0x00, 0x20, 0xCF, 0x22, 0x00, 0x00, 0xF0, 0xFF,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
 
@@ -1137,7 +1138,7 @@ static const u8 _dram_cfg_6[1896] = {
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x46, 0x2C, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0xEC, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF0, 0xFF,
+	0x01, 0x77, 0x00, 0xFC, 0x00, 0x20, 0xCF, 0x22, 0x00, 0x00, 0xF0, 0xFF,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
 

bootloader/mem/sdram_config_lz.inl

@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
+ * Copyright (c) 2018 balika011
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -14,7 +15,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-static const u8 _dram_cfg_lz[1262] = {
+static const u8 _dram_cfg_lz[1270] = {
 	0x17, 0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x22, 0x00, 0x00,
 	0x00, 0x2C, 0x17, 0x04, 0x09, 0x00, 0x17, 0x04, 0x04, 0x17, 0x08, 0x08,
 	0x17, 0x10, 0x10, 0x00, 0x00, 0x68, 0xBC, 0x01, 0x70, 0x0A, 0x00, 0x00,
@@ -103,22 +104,22 @@ static const u8 _dram_cfg_lz[1262] = {
 	0x17, 0x17, 0x3A, 0x7E, 0x16, 0x40, 0x17, 0x0C, 0x8B, 0x1F, 0x17, 0x2A,
 	0x38, 0x1E, 0x17, 0x0A, 0x38, 0x17, 0x13, 0x81, 0x28, 0x00, 0xC0, 0x17,
 	0x17, 0x55, 0x46, 0x24, 0x17, 0x0A, 0x81, 0x28, 0x17, 0x14, 0x38, 0x17,
-	0x18, 0x81, 0x60, 0x46, 0x2C, 0x17, 0x06, 0x38, 0xEC, 0x17, 0x0D, 0x16,
+	0x18, 0x81, 0x60, 0x46, 0x2C, 0x17, 0x06, 0x38, 0xEC, 0x00, 0x00, 0x00,
-	0x17, 0x0E, 0x82, 0x3C, 0x17, 0x82, 0x0C, 0x8E, 0x68, 0x17, 0x04, 0x24,
+	0x01, 0x77, 0x00, 0xFC, 0x00, 0x20, 0xCF, 0x22, 0x17, 0x10, 0x82, 0x3C,
-	0x17, 0x5C, 0x8E, 0x68, 0x17, 0x07, 0x82, 0x5F, 0x80, 0x17, 0x87, 0x01,
+	0x17, 0x82, 0x0C, 0x8E, 0x68, 0x17, 0x04, 0x24, 0x17, 0x5C, 0x8E, 0x68,
-	0x8E, 0x68, 0x02, 0x17, 0x81, 0x4A, 0x8E, 0x68, 0x17, 0x0C, 0x87, 0x78,
+	0x17, 0x07, 0x82, 0x5F, 0x80, 0x17, 0x87, 0x01, 0x8E, 0x68, 0x02, 0x17,
-	0x17, 0x85, 0x28, 0x8E, 0x68, 0x17, 0x8E, 0x68, 0x9D, 0x50, 0x17, 0x81,
+	0x81, 0x4A, 0x8E, 0x68, 0x17, 0x0C, 0x87, 0x78, 0x17, 0x85, 0x28, 0x8E,
-	0x24, 0x8E, 0x68, 0x17, 0x04, 0x2C, 0x17, 0x28, 0x8E, 0x68, 0x17, 0x04,
+	0x68, 0x17, 0x8E, 0x68, 0x9D, 0x50, 0x17, 0x81, 0x24, 0x8E, 0x68, 0x17,
-	0x30, 0x17, 0x85, 0x3C, 0x8E, 0x68, 0x12, 0x17, 0x07, 0x85, 0x70, 0x17,
+	0x04, 0x2C, 0x17, 0x28, 0x8E, 0x68, 0x17, 0x04, 0x30, 0x17, 0x85, 0x3C,
-	0x88, 0x74, 0x8E, 0x68, 0x17, 0x87, 0x3E, 0x9D, 0x50, 0x0C, 0x17, 0x04,
+	0x8E, 0x68, 0x12, 0x17, 0x07, 0x85, 0x70, 0x17, 0x88, 0x74, 0x8E, 0x68,
-	0x04, 0x17, 0x12, 0x8E, 0x68, 0x18, 0x17, 0x87, 0x12, 0xBB, 0x20, 0x17,
+	0x17, 0x87, 0x3E, 0x9D, 0x50, 0x0C, 0x17, 0x04, 0x04, 0x17, 0x12, 0x8E,
-	0x83, 0x04, 0x9D, 0x50, 0x15, 0x17, 0x05, 0x8D, 0x76, 0x17, 0x0F, 0x8B,
+	0x68, 0x18, 0x17, 0x87, 0x12, 0xBB, 0x20, 0x17, 0x83, 0x04, 0x9D, 0x50,
-	0x49, 0x17, 0x0B, 0x18, 0x32, 0x00, 0x2F, 0x00, 0x32, 0x00, 0x31, 0x00,
+	0x15, 0x17, 0x05, 0x8D, 0x76, 0x17, 0x0F, 0x8B, 0x49, 0x17, 0x0B, 0x18,
-	0x34, 0x00, 0x36, 0x00, 0x2F, 0x00, 0x33, 0x17, 0x09, 0x84, 0x0C, 0x17,
+	0x32, 0x00, 0x2F, 0x00, 0x32, 0x00, 0x31, 0x00, 0x34, 0x00, 0x36, 0x00,
-	0x18, 0x18, 0x17, 0x20, 0x8E, 0x68, 0x15, 0x17, 0x07, 0x5A, 0x17, 0x06,
+	0x2F, 0x00, 0x33, 0x17, 0x09, 0x84, 0x0C, 0x17, 0x18, 0x18, 0x17, 0x20,
-	0x5E, 0x16, 0x00, 0x15, 0x17, 0x82, 0x40, 0x9D, 0x50, 0x17, 0x86, 0x5F,
+	0x8E, 0x68, 0x15, 0x17, 0x07, 0x5A, 0x17, 0x06, 0x5E, 0x16, 0x00, 0x15,
-	0xBB, 0x20, 0x3A, 0x00, 0x00, 0x00, 0x1D, 0x17, 0x81, 0x4F, 0xAC, 0x38,
+	0x17, 0x82, 0x40, 0x9D, 0x50, 0x17, 0x86, 0x5F, 0xBB, 0x20, 0x3A, 0x00,
-	0x3B, 0x17, 0x04, 0x04, 0x17, 0x86, 0x30, 0x8E, 0x68, 0x17, 0x81, 0x53,
+	0x00, 0x00, 0x1D, 0x17, 0x81, 0x4F, 0xAC, 0x38, 0x3B, 0x17, 0x04, 0x04,
-	0xAC, 0x38, 0x07, 0x17, 0x0D, 0x8E, 0x68, 0xA3, 0x72, 0x17, 0x83, 0x10,
+	0x17, 0x86, 0x30, 0x8E, 0x68, 0x17, 0x81, 0x53, 0xAC, 0x38, 0x07, 0x17,
-	0x8E, 0x68
+	0x0D, 0x8E, 0x68, 0xA3, 0x72, 0x17, 0x83, 0x10, 0x8E, 0x68
 };

bootloader/reloc.S

@@ -1,34 +0,0 @@
-/*
- * Copyright (c) 2018 naehrwert
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-/*
- * TODO: the placement of the relocator is a bit fragile atm, maybe we
- *       should include it in start.S and copy it to some known good
- *       place in IRAM instead. Basically we want it as far back atm
- *       as it might be overwritten during relocation.
- */
-
-.section .text.reloc
-.arm
-
-.globl _reloc_ipl
-.type _reloc_ipl, %function
-_reloc_ipl:
-	LDMIA R0!, {R4-R7}
-	STMIA R1!, {R4-R7}
-	SUBS R2, #0x10
-	BNE _reloc_ipl
-	BX R3

bootloader/sec/tsec.c

@@ -64,6 +64,7 @@ int tsec_query(u8 *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 	int res = 0;
 	u8 *fwbuf = NULL;
 	u32 *pdir, *car, *fuse, *pmc, *flowctrl, *se, *mc, *iram, *evec;
+	u32 *pkg11_magic_off;
 
 	//Enable clocks.
 	clock_enable_host1x();
@@ -161,6 +162,8 @@ int tsec_query(u8 *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 		// IRAM
 		iram = page_alloc(0x30);
 		memcpy(iram, tsec_ctxt->pkg1, 0x30000);
+		// PKG1.1 magic offset.
+		pkg11_magic_off = (u32 *)(iram + ((tsec_ctxt->pkg11_off + 0x20) / 4));
 		smmu_map(pdir, 0x40010000, (u32)iram, 0x30, _READABLE | _WRITABLE | _NONSECURE);
 
 		// Exception vectors
@@ -216,16 +219,17 @@ int tsec_query(u8 *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 		u32 key[16] = {0};
 		u32 kidx = 0;
 
-		while (memcmp((u8 *)(iram + ((tsec_ctxt->pkg11_off + 0x20) / 4)), "PK11", 4))
+		while (*pkg11_magic_off != HOS_PKG11_MAGIC)
 		{
 			smmu_flush_all();
+
 			if (k == se[SE_KEYTABLE_DATA0_REG_OFFSET / 4])
 				continue;
 			k = se[SE_KEYTABLE_DATA0_REG_OFFSET / 4];
 			key[kidx++] = k;
 
 			// Failsafe.
-			if ((u32)get_tmr_us() - start > 500000)
+			if ((u32)get_tmr_us() - start > 125000)
 				break;
 		}
 
@@ -237,6 +241,9 @@ int tsec_query(u8 *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 			goto out;
 		}
 
+		// Give some extra time to make sure PKG1.1 is decrypted.
+		msleep(50);
+
 		memcpy(tsec_keys, &key, 0x20);
 		memcpy(tsec_ctxt->pkg1, iram, 0x30000);
 		

bootloader/soc/fuse.c

@@ -222,7 +222,7 @@ int fuse_read_ipatch(void (*ipatch)(u32 offset, u32 value))
 		{
 			for (u32 i = 0; i < ipatch_count; i++)
 			{
-				u32 word = words[i];
+				u32 word = words[i + 1];
 				u32 addr = (word >> 16) * 2;
 				u32 data = word & 0xffff;
 		

bootloader/soc/hw_init.c

@@ -64,8 +64,12 @@ void _config_gpios()
 	PINMUX_AUX(PINMUX_AUX_GPIO_PE6) = PINMUX_INPUT_ENABLE;
 	PINMUX_AUX(PINMUX_AUX_GPIO_PH6) = PINMUX_INPUT_ENABLE;
 
+#if !defined (DEBUG_UART_PORT) || DEBUG_UART_PORT != UART_B
 	gpio_config(GPIO_PORT_G, GPIO_PIN_0, GPIO_MODE_GPIO);
+#endif
+#if !defined (DEBUG_UART_PORT) || DEBUG_UART_PORT != UART_C
 	gpio_config(GPIO_PORT_D, GPIO_PIN_1, GPIO_MODE_GPIO);
+#endif
 	gpio_config(GPIO_PORT_E, GPIO_PIN_6, GPIO_MODE_GPIO);
 	gpio_config(GPIO_PORT_H, GPIO_PIN_6, GPIO_MODE_GPIO);
 	gpio_output_enable(GPIO_PORT_G, GPIO_PIN_0, GPIO_OUTPUT_DISABLE);
@@ -187,8 +191,10 @@ void config_hw()
 	APB_MISC(APB_MISC_PP_PINMUX_GLOBAL) = 0;
 	_config_gpios();
 
-	//clock_enable_uart(UART_C);
+#ifdef DEBUG_UART_PORT
-	//uart_init(UART_C, 115200);
+	clock_enable_uart(DEBUG_UART_PORT);
+	uart_init(DEBUG_UART_PORT, 115200);
+#endif
 
 	clock_enable_cl_dvfs();
 
@@ -201,7 +207,7 @@ void config_hw()
 	i2c_init(I2C_5);
 
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_CNFGBBC, 0x40);
-	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_ONOFFCNFG1, 0x78);
+	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_ONOFFCNFG1, 0x78); // PWR delay for forced shutdown off.
 
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_FPS_CFG0, 0x38);
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_FPS_CFG1, 0x3A);
@@ -255,4 +261,4 @@ void reconfig_hw_workaround(bool extra_reconfig, u32 magic)
 
 		msleep(200);
 	}
-}
+}

bootloader/soc/pinmux.c

@@ -19,8 +19,8 @@
 
 void pinmux_config_uart(u32 idx)
 {
-	PINMUX_AUX(PINMUX_AUX_UARTX_RX(idx)) = 0;
+	PINMUX_AUX(PINMUX_AUX_UARTX_TX(idx)) = 0;
-	PINMUX_AUX(PINMUX_AUX_UARTX_TX(idx)) = PINMUX_INPUT_ENABLE | PINMUX_PULL_UP;
+	PINMUX_AUX(PINMUX_AUX_UARTX_RX(idx)) = PINMUX_INPUT_ENABLE | PINMUX_PULL_UP;
 	PINMUX_AUX(PINMUX_AUX_UARTX_RTS(idx)) = 0;
 	PINMUX_AUX(PINMUX_AUX_UARTX_CTS(idx)) = PINMUX_INPUT_ENABLE | PINMUX_PULL_DOWN;
 }

bootloader/soc/smmu.c

@@ -94,7 +94,7 @@ void smmu_enable()
 
 	cluster_boot_cpu0((u32)smmu_payload);
 	smmu_used = true;
-	msleep(100);
+	msleep(150);
 
 	smmu_flush_all();
 }

bootloader/soc/uart.c

@@ -25,32 +25,37 @@ void uart_init(u32 idx, u32 baud)
 {
 	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);
 
-	//Set baud rate.
+	// Make sure no data is being sent.
-	u32 rate = (8 * baud + 408000000) / (16 * baud);
+	uart_wait_idle(idx, UART_TX_IDLE);
-	uart->UART_LCR = 0x80; //Enable DLAB.
-	uart->UART_THR_DLAB = (u8)rate; //Divisor latch LSB.
-	uart->UART_IER_DLAB = (u8)(rate >> 8); //Divisor latch MSB.
-	uart->UART_LCR = 0; //Diable DLAB.
 
-	//Setup UART in fifo mode.
+	// Misc settings.
-	uart->UART_IER_DLAB = 0;
+	u32 rate = (8 * baud + 408000000) / (16 * baud);
-	uart->UART_IIR_FCR = 7; //Enable and clear TX and RX FIFOs.
+	uart->UART_IER_DLAB = 0; // Disable interrupts.
-	(void)uart->UART_LSR;
+	uart->UART_MCR = 0; // Disable hardware flow control.
+	uart->UART_LCR = UART_LCR_DLAB | UART_LCR_WORD_LENGTH_8; // Enable DLAB & set 8n1 mode.
+	uart->UART_THR_DLAB = (u8)rate; // Divisor latch LSB.
+	uart->UART_IER_DLAB = (u8)(rate >> 8); // Divisor latch MSB.
+	uart->UART_LCR = UART_LCR_WORD_LENGTH_8; // Diable DLAB.
+
+	// Setup and flush fifo.
+	uart->UART_IIR_FCR = UART_IIR_FCR_EN_FIFO | UART_IIR_FCR_RX_CLR | UART_IIR_FCR_TX_CLR;
 	usleep(3 * ((baud + 999999) / baud));
-	uart->UART_LCR = 3; //Set word length 8.
+	uart_wait_idle(idx, UART_TX_IDLE | UART_RX_IDLE);
-	uart->UART_MCR = 0;
-	uart->UART_MSR = 0;
-	uart->UART_IRDA_CSR = 0;
-	uart->UART_RX_FIFO_CFG = 1;
-	uart->UART_MIE = 0;
-	uart->UART_ASR = 0;
 }
 
 void uart_wait_idle(u32 idx, u32 which)
 {
 	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);
-	while (!(uart->UART_VENDOR_STATUS & which))
+	if (UART_TX_IDLE & which)
-		;
+	{
+		while (!(uart->UART_LSR & UART_LSR_TMTY))
+			;
+	}
+	if (UART_RX_IDLE & which)
+	{
+		while (uart->UART_LSR & UART_LSR_RDR)
+			;
+	}
 }
 
 void uart_send(u32 idx, u8 *buf, u32 len)
@@ -59,7 +64,7 @@ void uart_send(u32 idx, u8 *buf, u32 len)
 
 	for (u32 i = 0; i != len; i++)
 	{
-		while (uart->UART_LSR & UART_TX_FIFO_FULL)
+		while (!(uart->UART_LSR & UART_LSR_THRE))
 			;
 		uart->UART_THR_DLAB = buf[i];
 	};
@@ -71,7 +76,7 @@ void uart_recv(u32 idx, u8 *buf, u32 len)
 
 	for (u32 i = 0; i != len; i++)
 	{
-		while (uart->UART_LSR & UART_RX_FIFO_EMPTY)
+		while (!(uart->UART_LSR & UART_LSR_RDR))
 			;
 		buf[i] = uart->UART_THR_DLAB;
 	};

bootloader/soc/uart.h

@@ -28,11 +28,21 @@
 
 #define BAUD_115200 115200
 
-#define UART_TX_IDLE 0x00000001
+#define UART_TX_IDLE 0x1
-#define UART_RX_IDLE 0x00000002
+#define UART_RX_IDLE 0x2
+
 #define UART_TX_FIFO_FULL 0x100
 #define UART_RX_FIFO_EMPTY 0x200
 
+#define UART_LCR_DLAB 0x80
+#define UART_LCR_WORD_LENGTH_8 0x3
+#define UART_LSR_RDR 0x1
+#define UART_LSR_THRE 0x20
+#define UART_LSR_TMTY 0x40
+#define UART_IIR_FCR_TX_CLR 0x4
+#define UART_IIR_FCR_RX_CLR 0x2
+#define UART_IIR_FCR_EN_FIFO 0x1
+
 typedef struct _uart_t
 {
 	/* 0x00 */ vu32 UART_THR_DLAB;