Bump hekate to v5.1.2 and Nyx to v0.8.5

Additionally disable archive bit fix tool in hekate main to shave binary size. The archive bit fix in Nyx is the only maintained one and so the only one that should be used.
fan: Better thermal logic based on HOS patterns
2020-03-03 04:42:01 +02:00 · 2020-03-03 04:37:59 +02:00 · 2020-03-03 04:28:12 +02:00 · 2020-03-03 04:24:38 +02:00 · 2020-03-03 04:22:59 +02:00 · 2020-03-03 04:16:20 +02:00
61 changed files with 1147 additions and 351 deletions
--- a/README.md
+++ b/README.md
@@ -30,6 +30,7 @@ Custom Nintendo Switch bootloader, firmware patcher, and more.
 | bootloader/screenshots/  | Folder where Nyx screenshots are saved                                |
 | bootloader/payloads/     | For payloads. 'Payloads...' menu. Autoboot only supported by including them into an ini. All CFW bootloaders, tools, Linux payloads are supported. |
 | bootloader/libtools/     | Future reserved                                                       |
+| sept                     | Sept folder. This must be always get updated via the Atmosphère release zip. Needed for tools and booting HOS on 7.0.0 and up. Unused for booting HOS if `fss0=` key is defined. |

 **Note**: Sept files for booting 7.0.0 and up are expected at /sept folder at root of sd card.

@@ -68,7 +69,7 @@ You can find a template [Here](./res/hekate_ipl_template.ini)
 | kernel={SD path}       | Replaces the kernel binary                                 |
 | kip1={SD path}         | Replaces/Adds kernel initial process. Multiple can be set. |
 | kip1={SD folder}/*     | Loads every .kip/.kip1 inside a folder. Compatible with single kip1 keys. |
-| fss0={SD path}         | Takes a fusee-secondary binary and `extracts` all needed parts from it. |
+| fss0={SD path}         | Takes a fusee-secondary binary and `extracts` all needed parts from it. kips, exosphere, warmboot and sept. |
 | kip1patch=patchname    | Enables a kip1 patch. Specify with multiple lines and/or as CSV. If not found, an error will show up |
 | fullsvcperm=1          | Disables SVC verification (full services permission)       |
 | debugmode=1            | Enables Debug mode. Obsolete when used with exosphere as secmon. |
--- a/Versions.inc
+++ b/Versions.inc
@@ -1,11 +1,11 @@
 # IPL Version.
 BLVERSION_MAJOR := 5
 BLVERSION_MINOR := 1
-BLVERSION_HOTFX := 1
+BLVERSION_HOTFX := 2
 BLVERSION_RSVD := 0

 # Nyx Version.
 NYXVERSION_MAJOR := 0
 NYXVERSION_MINOR := 8
-NYXVERSION_HOTFX := 4
+NYXVERSION_HOTFX := 5
 NYXVERSION_RSVD := 0
--- a/bootloader/config/config.c
+++ b/bootloader/config/config.c
@@ -51,7 +51,7 @@ void set_default_configuration()
 	h_cfg.rcm_patched = true;
 	h_cfg.emummc_force_disable = false;

-	sd_power_cycle_time_start = 0xFFFFFFF;
+	sd_power_cycle_time_start = 0;
 }

 int create_config_entry()
@@ -285,10 +285,11 @@ void config_autoboot()
 	LIST_INIT(ini_sections);

 	u8 max_entries = 30;
+	u32 boot_text_size = 512;

 	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (max_entries + 5));
 	u32 *boot_values = (u32 *)malloc(sizeof(u32) * max_entries);
-	char *boot_text = (char *)malloc(512 * max_entries);
+	char *boot_text = (char *)malloc(boot_text_size * max_entries);

 	for (u32 j = 0; j < max_entries; j++)
 		boot_values[j] = j;
@@ -334,12 +335,12 @@ void config_autoboot()
 					else
 					{
 						if (h_cfg.autoboot != (i - 4) || h_cfg.autoboot_list)
-							boot_text[(i - 4) * 512] = ' ';
+							boot_text[(i - 4) * boot_text_size] = ' ';

 						else
-							boot_text[(i - 4) * 512] = '*';
-						strcpy(boot_text + (i - 4) * 512 + 1, ini_sec->name);
-						ments[i].caption = &boot_text[(i - 4) * 512];
+							boot_text[(i - 4) * boot_text_size] = '*';
+						strcpy(boot_text + (i - 4) * boot_text_size + 1, ini_sec->name);
+						ments[i].caption = &boot_text[(i - 4) * boot_text_size];
 					}
 					ments[i].type = ini_sec->type;
 					ments[i].data = &boot_values[i - 4];
@@ -395,10 +396,11 @@ void config_bootdelay()
 	gfx_con_setpos(0, 0);

 	u32 delay_entries = 6;
+	u32 delay_text_size = 32;

 	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (delay_entries + 3));
 	u32 *delay_values = (u32 *)malloc(sizeof(u32) * delay_entries);
-	char *delay_text = (char *)malloc(32 * delay_entries);
+	char *delay_text = (char *)malloc(delay_text_size * delay_entries);

 	for (u32 j = 0; j < delay_entries; j++)
 		delay_values[j] = j;
@@ -419,14 +421,14 @@ void config_bootdelay()
 	for (i = 1; i < delay_entries; i++)
 	{
 		if (h_cfg.bootwait != i)
-			delay_text[i * 32] = ' ';
+			delay_text[i * delay_text_size] = ' ';
 		else
-			delay_text[i * 32] = '*';
-		delay_text[i * 32 + 1] = i + '0';
-		strcpy(delay_text + i * 32 + 2, " seconds");
+			delay_text[i * delay_text_size] = '*';
+		delay_text[i * delay_text_size + 1] = i + '0';
+		strcpy(delay_text + i * delay_text_size + 2, " seconds");

 		ments[i + 2].type = MENT_DATA;
-		ments[i + 2].caption = delay_text + i * 32;
+		ments[i + 2].caption = delay_text + (i * delay_text_size);
 		ments[i + 2].data = &delay_values[i];
 	}

@@ -454,9 +456,11 @@ void config_verification()
 	gfx_clear_grey(0x1B);
 	gfx_con_setpos(0, 0);

+	u32 vr_text_size = 64;
+
 	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * 6);
 	u32 *vr_values = (u32 *)malloc(sizeof(u32) * 3);
-	char *vr_text = (char *)malloc(64 * 3);
+	char *vr_text = (char *)malloc(vr_text_size * 3);

 	for (u32 j = 0; j < 3; j++)
 	{
@@ -477,10 +481,10 @@ void config_verification()
 	for (u32 i = 0; i < 3; i++)
 	{
 		if (h_cfg.verification != i)
-			vr_text[64 * i] = ' ';
+			vr_text[vr_text_size * i] = ' ';
 		else
-			vr_text[64 * i] = '*';
-		ments[2 + i].caption = vr_text + (i * 64);
+			vr_text[vr_text_size * i] = '*';
+		ments[2 + i].caption = vr_text + (i * vr_text_size);
 	}

 	memset(&ments[5], 0, sizeof(ment_t));
@@ -507,11 +511,12 @@ void config_backlight()
 	gfx_clear_grey(0x1B);
 	gfx_con_setpos(0, 0);

+	u32 bri_text_size = 8;
 	u32 bri_entries = 11;

 	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (bri_entries + 3));
 	u32 *bri_values = (u32 *)malloc(sizeof(u32) * bri_entries);
-	char *bri_text = (char *)malloc(8 * bri_entries);
+	char *bri_text = (char *)malloc(bri_text_size * bri_entries);

 	for (u32 j = 1; j < bri_entries; j++)
 		bri_values[j] = j * 10;
@@ -525,20 +530,20 @@ void config_backlight()
 	for (i = 1; i < bri_entries; i++)
 	{
 		if ((h_cfg.backlight / 20) != i)
-			bri_text[i * 32] = ' ';
+			bri_text[i * bri_text_size] = ' ';
 		else
-			bri_text[i * 32] = '*';
+			bri_text[i * bri_text_size] = '*';

 		if (i < 10)
 		{
-			bri_text[i * 32 + 1] = i + '0';
-			strcpy(bri_text + i * 32 + 2, "0%");
+			bri_text[i * bri_text_size + 1] = i + '0';
+			strcpy(bri_text + i * bri_text_size + 2, "0%");
 		}
 		else
-			strcpy(bri_text + i * 32 + 1, "100%");
+			strcpy(bri_text + i * bri_text_size + 1, "100%");

 		ments[i + 1].type = MENT_DATA;
-		ments[i + 1].caption = bri_text + i * 32;
+		ments[i + 1].caption = bri_text + (i * bri_text_size);
 		ments[i + 1].data = &bri_values[i];
 	}

--- a/bootloader/config/ini.c
+++ b/bootloader/config/ini.c
@@ -44,7 +44,8 @@ static char *_strdup(char *str)
 u32 _find_section_name(char *lbuf, u32 lblen, char schar)
 {
 	u32 i;
-	for (i = 0; i < lblen  && lbuf[i] != schar && lbuf[i] != '\n' && lbuf[i] != '\r'; i++)
+	// Depends on 'FF_USE_STRFUNC 2' that removes \r.
+	for (i = 0; i < lblen  && lbuf[i] != schar && lbuf[i] != '\n'; i++)
 		;
 	lbuf[i] = 0;

@@ -123,8 +124,8 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 			f_gets(lbuf, 512, &fp);
 			lblen = strlen(lbuf);

-			// Remove trailing newline.
-			if (lbuf[lblen - 1] == '\n' || lbuf[lblen - 1] == '\r')
+			// Remove trailing newline. Depends on 'FF_USE_STRFUNC 2' that removes \r.
+			if (lblen && lbuf[lblen - 1] == '\n')
 				lbuf[lblen - 1] = 0;

 			if (lblen > 2 && lbuf[0] == '[') // Create new section.
@@ -134,24 +135,22 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 				csec = _ini_create_section(dst, csec, &lbuf[1], INI_CHOICE);
 				list_init(&csec->kvs);
 			}
-			else if (lblen > 2 && lbuf[0] == '{') //Create new caption.
+			else if (lblen > 1 && lbuf[0] == '{') // Create new caption. Support empty caption '{}'.
 			{
 				_find_section_name(lbuf, lblen, '}');

 				csec = _ini_create_section(dst, csec, &lbuf[1], INI_CAPTION);
 				csec->color = 0xFF0AB9E6;
 			}
-			else if (lblen > 2 && lbuf[0] == '#') //Create empty lines and comments.
+			else if (lblen > 2 && lbuf[0] == '#') // Create comment.
 			{
-				_find_section_name(lbuf, lblen, '\0');
-
 				csec = _ini_create_section(dst, csec, &lbuf[1], INI_COMMENT);
 			}
-			else if (lblen < 2)
+			else if (lblen < 2) // Create empty line.
 			{
 				csec = _ini_create_section(dst, csec, NULL, INI_NEWLINE);
 			}
-			else if (csec && csec->type == INI_CHOICE) //Extract key/value.
+			else if (csec && csec->type == INI_CHOICE) // Extract key/value.
 			{
 				u32 i = _find_section_name(lbuf, lblen, '=');

--- a/bootloader/frontend/fe_info.c
+++ b/bootloader/frontend/fe_info.c
@@ -293,8 +293,6 @@ void print_sdcard_info()

 	if (sd_mount())
 	{
-		u32 capacity;
-
 		gfx_printf("%kCard IDentification:%k\n", 0xFF00DDFF, 0xFFCCCCCC);
 		gfx_printf(
 			" Vendor ID:  %02x\n"
@@ -311,7 +309,6 @@ void print_sdcard_info()
 			sd_storage.cid.month, sd_storage.cid.year);

 		gfx_printf("%kCard-Specific Data V%d.0:%k\n", 0xFF00DDFF, sd_storage.csd.structure + 1, 0xFFCCCCCC);
-		capacity = sd_storage.csd.capacity >> (20 - sd_storage.csd.read_blkbits);
 		gfx_printf(
 			" Cmd Classes:    %02X\n"
 			" Capacity:       %d MiB\n"
@@ -322,7 +319,7 @@ void print_sdcard_info()
 			" Video Class:    V%d\n"
 			" App perf class: A%d\n"
 			" Write Protect:  %d\n\n",
-			sd_storage.csd.cmdclass, capacity,
+			sd_storage.csd.cmdclass, sd_storage.sec_cnt >> 11,
 			sd_storage.ssr.bus_width, sd_storage.csd.busspeed, sd_storage.csd.busspeed * 2,
 			sd_storage.ssr.speed_class, sd_storage.ssr.uhs_grade, sd_storage.ssr.video_class,
 			sd_storage.ssr.app_class, sd_storage.csd.write_protect);
--- a/bootloader/frontend/fe_tools.c
+++ b/bootloader/frontend/fe_tools.c
@@ -109,7 +109,7 @@ void dump_packages12()
 			gfx_printf("sept will run to get the keys.\nThen rerun this option.");
 			btn_wait();

-			if (!reboot_to_sept((u8 *)tsec_ctxt.fw, kb))
+			if (!reboot_to_sept((u8 *)tsec_ctxt.fw, kb, NULL))
 			{
 				gfx_printf("Failed to run sept\n");
 				goto out_free;
--- a/bootloader/gfx/gfx.c
+++ b/bootloader/gfx/gfx.c
@@ -187,7 +187,7 @@ void gfx_putc(char c)

 			for (u32 i = 0; i < 16; i += 2)
 			{
-				u8 v = *cbuf++;
+				u8 v = *cbuf;
 				for (u32 k = 0; k < 2; k++)
 				{
 					for (u32 j = 0; j < 8; j++)
@@ -212,6 +212,7 @@ void gfx_putc(char c)
 					fb += gfx_ctxt.stride - 16;
 					v = *cbuf;
 				}
+				cbuf++;
 			}
 			gfx_con.x += 16;
 		}
@@ -256,7 +257,7 @@ void gfx_putc(char c)
 	}
 }

-void gfx_puts(const char *s)
+void gfx_puts(char *s)
 {
 	if (!s || gfx_con.mute)
 		return;
--- a/bootloader/gfx/gfx.h
+++ b/bootloader/gfx/gfx.h
@@ -35,7 +35,7 @@ void gfx_con_setcol(u32 fgcol, int fillbg, u32 bgcol);
 void gfx_con_getpos(u32 *x, u32 *y);
 void gfx_con_setpos(u32 x, u32 y);
 void gfx_putc(char c);
-void gfx_puts(const char *s);
+void gfx_puts(char *s);
 void gfx_printf(const char *fmt, ...);
 void gfx_hexdump(u32 base, const u8 *buf, u32 len);

--- a/bootloader/hos/fss.c
+++ b/bootloader/hos/fss.c
@@ -90,27 +90,29 @@ static void _update_r2p(const char *path)
 	free(r2p_path);
 }

-int parse_fss(launch_ctxt_t *ctxt, const char *path)
+int parse_fss(launch_ctxt_t *ctxt, const char *path, fss0_sept_t *sept_ctxt)
 {
 	FIL fp;

 	bool stock = false;
+	int sept_used = 0;

-	LIST_FOREACH_ENTRY(ini_kv_t, kv, &ctxt->cfg->kvs, link)
+	if (!sept_ctxt)
 	{
-		if (!strcmp("stock", kv->key))
-			if (kv->val[0] == '1')
-				stock = true;
-	}
+		LIST_FOREACH_ENTRY(ini_kv_t, kv, &ctxt->cfg->kvs, link)
+		{
+			if (!strcmp("stock", kv->key))
+				if (kv->val[0] == '1')
+					stock = true;
+		}

-	if (stock && ctxt->pkg1_id->kb <= KB_FIRMWARE_VERSION_620 && (!emu_cfg.enabled || h_cfg.emummc_force_disable))
-		return 1;
+		if (ctxt->pkg1_id->kb <= KB_FIRMWARE_VERSION_620 && (!emu_cfg.enabled || h_cfg.emummc_force_disable))
+			return 1;
+	}

 	if (f_open(&fp, path, FA_READ) != FR_OK)
 		return 0;

-	ctxt->atmosphere = true;
-
 	void *fss = malloc(f_size(&fp));
 	// Read header.
 	f_read(&fp, fss, 0x400, NULL);
@@ -126,6 +128,12 @@ int parse_fss(launch_ctxt_t *ctxt, const char *path)
 			fss_meta->version >> 24, (fss_meta->version >> 16) & 0xFF, (fss_meta->version >> 8) & 0xFF, fss_meta->git_rev,
 			fss_meta->hos_ver >> 24, (fss_meta->hos_ver >> 16) & 0xFF, (fss_meta->hos_ver >> 8) & 0xFF);

+		if (!sept_ctxt)
+		{
+			ctxt->atmosphere = true;
+			ctxt->fss0_hosver = fss_meta->hos_ver;
+		}
+
 		fss_content_t *curr_fss_cnt = (fss_content_t *)(fss + fss_meta->cnt_off);
 		void *content;
 		for (u32 i = 0; i < fss_meta->cnt_count; i++)
@@ -135,45 +143,79 @@ int parse_fss(launch_ctxt_t *ctxt, const char *path)
 				continue;

 			// Load content to launch context.
-			switch (curr_fss_cnt[i].type)
+			if (!sept_ctxt)
 			{
-			case CNT_TYPE_KIP:
-				if (stock)
+				switch (curr_fss_cnt[i].type)
+				{
+				case CNT_TYPE_KIP:
+					if (stock)
+						continue;
+					merge_kip_t *mkip1 = (merge_kip_t *)malloc(sizeof(merge_kip_t));
+					mkip1->kip1 = content;
+					list_append(&ctxt->kip1_list, &mkip1->link);
+					DPRINTF("Loaded %s.kip1 from FSS0 (size %08X)\n", curr_fss_cnt[i].name, curr_fss_cnt[i].size);
+					break;
+				case CNT_TYPE_EXO:
+					ctxt->secmon_size = curr_fss_cnt[i].size;
+					ctxt->secmon = content;
+					break;
+				case CNT_TYPE_WBT:
+					ctxt->warmboot_size = curr_fss_cnt[i].size;
+					ctxt->warmboot = content;
+					break;
+				default:
 					continue;
-				merge_kip_t *mkip1 = (merge_kip_t *)malloc(sizeof(merge_kip_t));
-				mkip1->kip1 = content;
-				list_append(&ctxt->kip1_list, &mkip1->link);
-				DPRINTF("Loaded %s.kip1 from FSS0 (size %08X)\n", curr_fss_cnt[i].name, curr_fss_cnt[i].size);
-				break;
-			case CNT_TYPE_EXO:
-				ctxt->secmon_size = curr_fss_cnt[i].size;
-				ctxt->secmon = content;
-				break;
-			case CNT_TYPE_WBT:
-				ctxt->warmboot_size = curr_fss_cnt[i].size;
-				ctxt->warmboot = content;
-				break;
-			default:
-				continue;
-			// TODO: add more types?
-			// case CNT_TYPE_SP1:
-			// case CNT_TYPE_SP2:
+				}
+			}
+			else
+			{
+				// Load content to launch context.
+				switch (curr_fss_cnt[i].type)
+				{
+				case CNT_TYPE_SP1:
+					f_lseek(&fp, curr_fss_cnt[i].offset);
+					f_read(&fp, sept_ctxt->sept_primary, curr_fss_cnt[i].size, NULL);
+					continue;
+				case CNT_TYPE_SP2:
+					if (!memcmp(curr_fss_cnt[i].name, (sept_ctxt->kb < KB_FIRMWARE_VERSION_810) ? "septsecondary00" : "septsecondary01", 15))
+					{
+						f_lseek(&fp, curr_fss_cnt[i].offset);
+						f_read(&fp, sept_ctxt->sept_secondary, curr_fss_cnt[i].size, NULL);
+						sept_used = 1;
+						goto out;
+					}
+					continue;
+				default:
+					continue;
+				}
 			}

 			f_lseek(&fp, curr_fss_cnt[i].offset);
 			f_read(&fp, content, curr_fss_cnt[i].size, NULL);
 		}

+out:
 		gfx_printf("Done!\n");
 		f_close(&fp);

 		_update_r2p(path);

-		return 1;
+		return (!sept_ctxt ? 1 : sept_used);
 	}

 	f_close(&fp);
 	free(fss);

 	return 0;
-}
+}
+
+int load_sept_from_ffs0(fss0_sept_t *sept_ctxt)
+{
+	LIST_FOREACH_ENTRY(ini_kv_t, kv, &sept_ctxt->cfg_sec->kvs, link)
+	{
+		if (!strcmp("fss0", kv->key))
+			return parse_fss(NULL, kv->val, sept_ctxt);
+	}
+
+	return 0;
+}
--- a/bootloader/hos/fss.h
+++ b/bootloader/hos/fss.h
@@ -19,6 +19,16 @@

 #include "hos.h"

-int parse_fss(launch_ctxt_t *ctxt, const char *path);
+typedef struct _fss0_sept_t
+{
+	u32 kb;
+	ini_sec_t *cfg_sec;
+	void *sept_primary;
+	void *sept_secondary;
+
+} fss0_sept_t;
+
+int parse_fss(launch_ctxt_t *ctxt, const char *path, fss0_sept_t *sept_ctxt);
+int load_sept_from_ffs0(fss0_sept_t *sept_ctxt);

 #endif
--- a/bootloader/hos/hos.c
+++ b/bootloader/hos/hos.c
@@ -352,6 +352,8 @@ static int _read_emmc_pkg1(launch_ctxt_t *ctxt)
 	if (!ctxt->pkg1_id)
 	{
 		_hos_crit_error("Unknown pkg1 version.");
+		EHPRINTFARGS("%sNot yet supported HOS version!", 
+			(emu_cfg.enabled && !h_cfg.emummc_force_disable) ? "Is emuMMC corrupt?\nOr " : "");
 		goto out;
 	}
 	gfx_printf("Identified pkg1 and Keyblob %d\n\n", ctxt->pkg1_id->kb);
--- a/bootloader/hos/hos.h
+++ b/bootloader/hos/hos.h
@@ -53,13 +53,14 @@ typedef struct _launch_ctxt_t

 	void *pkg2;
 	u32   pkg2_size;
+	bool  new_pkg2;

-	bool   new_pkg2;
 	void  *kernel;
 	u32    kernel_size;
 	link_t kip1_list;
 	char*  kip1_patches;

+	u32  fss0_hosver;
 	bool svcperm;
 	bool debugmode;
 	bool stock;
--- a/bootloader/hos/hos_config.c
+++ b/bootloader/hos/hos_config.c
@@ -213,7 +213,7 @@ static int _config_exo_user_pmu_access(launch_ctxt_t *ctxt, const char *value)

 static int _config_fss(launch_ctxt_t *ctxt, const char *value)
 {
-	return parse_fss(ctxt, value);
+	return parse_fss(ctxt, value, NULL);
 }

 typedef struct _cfg_handler_t
--- a/bootloader/hos/pkg2.c
+++ b/bootloader/hos/pkg2.c
@@ -351,7 +351,8 @@ static const pkg2_kernel_id_t _pkg2_kernel_ids[] =
 	{ "\x85\x97\x40\xf6\xc0\x3e\x3d\x44", _kernel_6_patchset },   //6.0.0 - 6.2.0
 	{ "\xa2\x5e\x47\x0c\x8e\x6d\x2f\xd7", _kernel_7_patchset },   //7.0.0 - 7.0.1
 	{ "\xf1\x5e\xc8\x34\xfd\x68\xf0\xf0", _kernel_8_patchset },   //8.0.0 - 8.1.0. Kernel only.
-	{ "\x69\x00\x39\xdf\x21\x56\x70\x6b", _kernel_9_patchset }    //9.0.0 - 9.1.0. Kernel only.
+	{ "\x69\x00\x39\xdf\x21\x56\x70\x6b", _kernel_9_patchset },   //9.0.0 - 9.1.0. Kernel only.
+	{ "\xa2\xe3\xad\x1c\x98\xd8\x7a\x62", _kernel_9_patchset },   //9.2.0. Kernel only.
 };

 enum kip_offset_section
@@ -810,6 +811,7 @@ int pkg2_decompress_kip(pkg2_kip1_info_t* ki, u32 sectsToDecomp)
 		gfx_printf("Decomping %s KIP1 sect %d of size %d...\n", (const char*)hdr.name, sectIdx, compSize);
 		if (blz_uncompress_srcdest(srcDataPtr, compSize, dstDataPtr, outputSize) == 0)
 		{
+			gfx_con.mute = false;
 			gfx_printf("%kERROR decomping sect %d of %s KIP!%k\n", 0xFFFF0000, sectIdx, (char*)hdr.name, 0xFFCCCCCC);
 			free(newKip);

@@ -1074,6 +1076,7 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)

 								if (!currPatch->length)
 								{
+									gfx_con.mute = false;
 									gfx_printf("%kPatch is empty!%k\n", 0xFFFF0000, 0xFFCCCCCC);
 									return currPatchset->name; // MUST stop here as it's not probably intended.
 								}
@@ -1083,6 +1086,7 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 								if ((memcmp(&kipSectData[currOffset], currPatch->srcData, currPatch->length) != 0) &&
 									(memcmp(&kipSectData[currOffset], currPatch->dstData, currPatch->length) != 0))
 								{
+									gfx_con.mute = false;
 									gfx_printf("%kPatch data mismatch at 0x%x!%k\n", 0xFFFF0000, currOffset, 0xFFCCCCCC);
 									return currPatchset->name; // MUST stop here as kip is likely corrupt.
 								}
--- a/bootloader/hos/secmon_exo.c
+++ b/bootloader/hos/secmon_exo.c
@@ -271,21 +271,18 @@ void secmon_exo_check_panic()
 	WPRINTFARGS("Title ID:   %08X%08X", (u32)((u64)rpt->title_id >> 32), (u32)rpt->title_id);
 	WPRINTFARGS("Error Desc: %s (0x%x)\n", get_error_desc(rpt->error_desc), rpt->error_desc);

-	if (sd_mount())
-	{
-		// Save context to the SD card.
-		char filepath[0x40];
-		f_mkdir("atmosphere/fatal_errors");
-		strcpy(filepath, "/atmosphere/fatal_errors/report_");
-		itoa((u32)((u64)rpt->report_identifier >> 32), filepath + strlen(filepath), 16);
-		itoa((u32)(rpt->report_identifier), filepath + strlen(filepath), 16);
-		strcat(filepath, ".bin");
+	// Save context to the SD card.
+	char filepath[0x40];
+	f_mkdir("atmosphere/fatal_errors");
+	strcpy(filepath, "/atmosphere/fatal_errors/report_");
+	itoa((u32)((u64)rpt->report_identifier >> 32), filepath + strlen(filepath), 16);
+	itoa((u32)(rpt->report_identifier), filepath + strlen(filepath), 16);
+	strcat(filepath, ".bin");

-		sd_save_to_file((void *)rpt, sizeof(atm_fatal_error_ctx), filepath);
+	sd_save_to_file((void *)rpt, sizeof(atm_fatal_error_ctx), filepath);

-		gfx_con.fntsz = 8;
-		WPRINTFARGS("Report saved to %s\n", filepath);
-	}
+	gfx_con.fntsz = 8;
+	WPRINTFARGS("Report saved to %s\n", filepath);

 	// Change magic to invalid, to prevent double-display of error/bootlooping.
 	rpt->magic = 0x0;
--- a/bootloader/hos/sept.c
+++ b/bootloader/hos/sept.c
@@ -17,6 +17,7 @@
 #include <string.h>

 #include "hos.h"
+#include "fss.h"
 #include "sept.h"
 #include "../config/config.h"
 #include "../gfx/di.h"
@@ -73,7 +74,7 @@ extern void reloc_patcher(u32 payload_dst, u32 payload_src, u32 payload_size);
 extern sdmmc_t sd_sdmmc;
 extern sdmmc_storage_t sd_storage;

-void check_sept()
+void check_sept(ini_sec_t *cfg_sec)
 {
 	// Check if non-hekate payload is used for sept and restore it.
 	if (h_cfg.sept_run)
@@ -117,7 +118,7 @@ void check_sept()
 	if (pkg1_id->kb >= KB_FIRMWARE_VERSION_700 && !h_cfg.sept_run)
 	{
 		sdmmc_storage_end(&storage);
-		reboot_to_sept((u8 *)pkg1 + pkg1_id->tsec_off, pkg1_id->kb);
+		reboot_to_sept((u8 *)pkg1 + pkg1_id->tsec_off, pkg1_id->kb, cfg_sec);
 	}

 out_free:
@@ -125,9 +126,10 @@ out_free:
 	sdmmc_storage_end(&storage);
 }

-int reboot_to_sept(const u8 *tsec_fw, u32 kb)
+int reboot_to_sept(const u8 *tsec_fw, u32 kb, ini_sec_t *cfg_sec)
 {
 	FIL fp;
+	bool fss0_sept_used = false;

 	// Copy warmboot reboot code and TSEC fw.
 	u32 tsec_fw_size = 0x3000;
@@ -137,36 +139,50 @@ int reboot_to_sept(const u8 *tsec_fw, u32 kb)
 	memcpy((void *)SEPT_PK1T_ADDR, tsec_fw, tsec_fw_size);
 	*(vu32 *)SEPT_TCSZ_ADDR = tsec_fw_size;

-	// Copy sept-primary.
-	if (f_open(&fp, "sept/sept-primary.bin", FA_READ))
-		goto error;
+	if (cfg_sec)
+	{
+		fss0_sept_t sept_ctxt;
+		sept_ctxt.kb = kb;
+		sept_ctxt.cfg_sec = cfg_sec;
+		sept_ctxt.sept_primary = (void *)SEPT_STG1_ADDR;
+		sept_ctxt.sept_secondary = (void *)SEPT_STG2_ADDR;

-	if (f_read(&fp, (u8 *)SEPT_STG1_ADDR, f_size(&fp), NULL))
-	{
-		f_close(&fp);
-		goto error;
+		fss0_sept_used = load_sept_from_ffs0(&sept_ctxt);
 	}
-	f_close(&fp);

-	// Copy sept-secondary.
-	if (kb < KB_FIRMWARE_VERSION_810)
+	if (!fss0_sept_used)
 	{
-		if (f_open(&fp, "sept/sept-secondary_00.enc", FA_READ))
-			if (f_open(&fp, "sept/sept-secondary.enc", FA_READ)) // Try the deprecated version.
-				goto error;
-	}
-	else
-	{
-		if (f_open(&fp, "sept/sept-secondary_01.enc", FA_READ))
+		// Copy sept-primary.
+		if (f_open(&fp, "sept/sept-primary.bin", FA_READ))
 			goto error;
-	}

-	if (f_read(&fp, (u8 *)SEPT_STG2_ADDR, f_size(&fp), NULL))
-	{
+		if (f_read(&fp, (u8 *)SEPT_STG1_ADDR, f_size(&fp), NULL))
+		{
+			f_close(&fp);
+			goto error;
+		}
+		f_close(&fp);
+
+		// Copy sept-secondary.
+		if (kb < KB_FIRMWARE_VERSION_810)
+		{
+			if (f_open(&fp, "sept/sept-secondary_00.enc", FA_READ))
+				if (f_open(&fp, "sept/sept-secondary.enc", FA_READ)) // Try the deprecated version.
+					goto error;
+		}
+		else
+		{
+			if (f_open(&fp, "sept/sept-secondary_01.enc", FA_READ))
+				goto error;
+		}
+
+		if (f_read(&fp, (u8 *)SEPT_STG2_ADDR, f_size(&fp), NULL))
+		{
+			f_close(&fp);
+			goto error;
+		}
 		f_close(&fp);
-		goto error;
 	}
-	f_close(&fp);

 	b_cfg.boot_cfg |= (BOOT_CFG_AUTOBOOT_EN | BOOT_CFG_SEPT_RUN);

--- a/bootloader/hos/sept.h
+++ b/bootloader/hos/sept.h
@@ -19,7 +19,7 @@

 #include "../utils/types.h"

-void check_sept();
-int reboot_to_sept(const u8 *tsec_fw, u32 kb);
+void check_sept(ini_sec_t *cfg_sec);
+int reboot_to_sept(const u8 *tsec_fw, u32 kb, ini_sec_t *cfg_sec);

 #endif
--- a/bootloader/main.c
+++ b/bootloader/main.c
@@ -256,14 +256,17 @@ bool is_ipl_updated(void *buf, char *path, bool force)
 {
 	ipl_ver_meta_t *update_ft = (ipl_ver_meta_t *)(buf + PATCHED_RELOC_SZ + sizeof(boot_cfg_t));

+	bool magic_valid = update_ft->magic == ipl_ver.magic;
+	bool force_update = force && !magic_valid;
+	bool is_valid_old = magic_valid && (byte_swap_32(update_ft->version) < byte_swap_32(ipl_ver.version));
+
 	// Check if newer version.
-	if (!force && (update_ft->magic == ipl_ver.magic))
+	if (!force && magic_valid)
 		if (byte_swap_32(update_ft->version) > byte_swap_32(ipl_ver.version))
 			return false;

 	// Update if old or broken.
-	if ((force && (update_ft->magic != ipl_ver.magic)) ||
-		(byte_swap_32(update_ft->version) < byte_swap_32(ipl_ver.version)))
+	if (force_update || is_valid_old)
 	{
 		FIL fp;
 		volatile reloc_meta_t *reloc = (reloc_meta_t *)(IPL_LOAD_ADDR + RELOC_META_OFF);
@@ -529,7 +532,7 @@ void ini_list_launcher()
 				payload_path = ini_check_payload_section(cfg_sec);

 				if (cfg_sec && !payload_path)
-					check_sept();
+					check_sept(cfg_sec);

 				if (!cfg_sec)
 				{
@@ -656,7 +659,7 @@ void launch_firmware()
 			}

 			if (cfg_sec && !payload_path)
-				check_sept();
+				check_sept(cfg_sec);

 			if (!cfg_sec)
 			{
@@ -793,7 +796,7 @@ static void _auto_launch_firmware()
 	{
 		if (!h_cfg.sept_run)
 			EMC(EMC_SCRATCH0) |= EMC_HEKA_UPD;
-		check_sept();
+		check_sept(NULL);
 	}

 	if (!h_cfg.sept_run)
@@ -1055,7 +1058,7 @@ skip_list:
 	}
 	else
 	{
-		check_sept();
+		check_sept(cfg_sec);
 		hos_launch(cfg_sec);

 		EPRINTF("\nFailed to launch HOS!");
@@ -1266,8 +1269,8 @@ ment_t ment_tools[] = {
 	MDEF_CHGLINE(),
 	MDEF_CAPTION("-------- Misc --------", 0xFF0AB9E6),
 	MDEF_HANDLER("Dump package1/2", dump_packages12),
-	MDEF_HANDLER("Fix archive bit (except Nintendo)", fix_sd_all_attr),
-	MDEF_HANDLER("Fix archive bit (Nintendo only)", fix_sd_nin_attr),
+	//MDEF_HANDLER("Fix archive bit (except Nintendo)", fix_sd_all_attr),
+	//MDEF_HANDLER("Fix archive bit (Nintendo only)", fix_sd_nin_attr),
 	//MDEF_HANDLER("Fix fuel gauge configuration", fix_fuel_gauge_configuration),
 	//MDEF_HANDLER("Reset all battery cfg", reset_pmic_fuel_gauge_charger_config),
 	MDEF_CHGLINE(),
@@ -1293,7 +1296,7 @@ ment_t ment_top[] = {
 	MDEF_END()
 };

-menu_t menu_top = { ment_top, "hekate - CTCaer mod v5.1.1", 0, 0 };
+menu_t menu_top = { ment_top, "hekate - CTCaer mod v5.1.2", 0, 0 };

 extern void pivot_stack(u32 stack_top);

@@ -1302,10 +1305,10 @@ void ipl_main()
 	// Do initial HW configuration. This is compatible with consecutive reruns without a reset.
 	config_hw();

-	//Pivot the stack so we have enough space.
+	// Pivot the stack so we have enough space.
 	pivot_stack(IPL_STACK_TOP);

-	//Tegra/Horizon configuration goes to 0x80000000+, package2 goes to 0xA9800000, we place our heap in between.
+	// Tegra/Horizon configuration goes to 0x80000000+, package2 goes to 0xA9800000, we place our heap in between.
 	heap_init(IPL_HEAP_START);

 #ifdef DEBUG_UART_PORT
--- a/bootloader/mem/heap.c
+++ b/bootloader/mem/heap.c
@@ -29,7 +29,7 @@ static void _heap_create(heap_t *heap, u32 start)
 // Node info is before node address.
 static u32 _heap_alloc(heap_t *heap, u32 size)
 {
-	hnode_t *node, *new;
+	hnode_t *node, *new_node;

 	// Align to cache line size.
 	size = ALIGN(size, sizeof(hnode_t));
@@ -49,22 +49,29 @@ static u32 _heap_alloc(heap_t *heap, u32 size)
 	node = heap->first;
 	while (true)
 	{
+		// Check if there's available unused node.
 		if (!node->used && (size <= node->size))
 		{
+			// Size and offset of the new unused node.
 			u32 new_size = node->size - size;
-			new = (hnode_t *)((u32)node + sizeof(hnode_t) + size);
+			new_node = (hnode_t *)((u32)node + sizeof(hnode_t) + size);

-			// If there's aligned leftover space, create a new node.
+			// If there's aligned unused space from the old node,
+			// create a new one and set the leftover size.
 			if (new_size >= (sizeof(hnode_t) << 2))
 			{
-				new->size = new_size - sizeof(hnode_t);
-				new->used = 0;
-				new->next = node->next;
-				new->next->prev = new;
-				new->prev = node;
-				node->next = new;
+				new_node->size = new_size - sizeof(hnode_t);
+				new_node->used = 0;
+				new_node->next = node->next;
+
+				// Check that we are not on first node.
+				if (new_node->next)
+					new_node->next->prev = new_node;
+
+				new_node->prev = node;
+				node->next = new_node;
 			}
-			else
+			else // Unused node size is just enough.
 				size += new_size;

 			node->size = size;
@@ -72,20 +79,23 @@ static u32 _heap_alloc(heap_t *heap, u32 size)

 			return (u32)node + sizeof(hnode_t);
 		}
+
+		// No unused node found, try the next one.
 		if (node->next)
 			node = node->next;
 		else
 			break;
 	}

-	new = (hnode_t *)((u32)node + sizeof(hnode_t) + node->size);
-	new->used = 1;
-	new->size = size;
-	new->prev = node;
-	new->next = NULL;
-	node->next = new;
+	// No unused node found, create a new one.
+	new_node = (hnode_t *)((u32)node + sizeof(hnode_t) + node->size);
+	new_node->used = 1;
+	new_node->size = size;
+	new_node->prev = node;
+	new_node->next = NULL;
+	node->next = new_node;

-	return (u32)new + sizeof(hnode_t);
+	return (u32)new_node + sizeof(hnode_t);
 }

 static void _heap_free(heap_t *heap, u32 addr)
@@ -101,6 +111,7 @@ static void _heap_free(heap_t *heap, u32 addr)
 			{
 				node->prev->size += node->size + sizeof(hnode_t);
 				node->prev->next = node->next;
+
 				if (node->next)
 					node->next->prev = node->prev;
 			}
--- a/bootloader/mem/minerva.c
+++ b/bootloader/mem/minerva.c
@@ -32,6 +32,7 @@ u32 minerva_init()
 {
 	u32 curr_ram_idx = 0;

+	minerva_cfg = NULL;
 	mtc_config_t *mtc_cfg = (mtc_config_t *)&nyx_str->mtc_cfg;

 	// Set table to nyx storage.
--- a/bootloader/mem/sdram.c
+++ b/bootloader/mem/sdram.c
@@ -696,7 +696,6 @@ sdram_params_t *sdram_get_params_patched()

 void sdram_init()
 {
-	//TODO: sdram_id should be in [0,4].
 	const sdram_params_t *params = (const sdram_params_t *)sdram_get_params();

 	// Set DRAM voltage.
--- a/bootloader/power/max17050.h
+++ b/bootloader/power/max17050.h
@@ -96,14 +96,17 @@ enum MAX17050_reg {
 	MAX17050_K_empty0	= 0x3B,
 	MAX17050_TaskPeriod	= 0x3C,
 	MAX17050_FSTAT		= 0x3D,
-
+	MAX17050_TIMER		= 0x3E,
 	MAX17050_SHDNTIMER	= 0x3F,
+
 	MAX17050_QRTbl30	= 0x42,
+
 	MAX17050_dQacc		= 0x45,
 	MAX17050_dPacc		= 0x46,

 	MAX17050_VFSOC0		= 0x48,

+	Max17050_QH0		= 0x4C,
 	MAX17050_QH			= 0x4D,
 	MAX17050_QL			= 0x4E,

@@ -111,6 +114,8 @@ enum MAX17050_reg {
 	MAX17050_MaxVolt	= 0x51, // Custom ID. Not to be sent to i2c.

 	MAX17050_VFSOC0Enable	= 0x60,
+	MAX17050_MODELEnable1	= 0x62,
+	MAX17050_MODELEnable2	= 0x63,

 	MAX17050_MODELChrTbl	= 0x80,

--- a/bootloader/power/max7762x.c
+++ b/bootloader/power/max7762x.c
@@ -137,6 +137,7 @@ int max77620_regulator_enable(u32 id, int enable)
 	return 1;
 }

+// LDO only.
 int max77620_regulator_set_volt_and_flags(u32 id, u32 mv, u8 flags)
 {
 	if (id > REGULATOR_MAX)
--- a/bootloader/power/max7762x.h
+++ b/bootloader/power/max7762x.h
@@ -33,7 +33,7 @@
 *  ldo2 | SDMMC1        | 50000   | 800000 | 1800000    | 3300000 |
 *  ldo3 | GC ASIC       | 50000   | 800000 | 3100000    | 3100000 | 3.1V   (pcv)
 *  ldo4 | RTC           | 12500   | 800000 |  850000    |  850000 |
-*  ldo5 | GC ASIC       | 50000   | 800000 | 1800000    | 1800000 | 1.8V   (pcv)
+*  ldo5 | GC Card       | 50000   | 800000 | 1800000    | 1800000 | 1.8V   (pcv)
 *  ldo6 | Touch, ALS    | 50000   | 800000 | 2900000    | 2900000 | 2.9V
 *  ldo7 | XUSB          | 50000   | 800000 | 1050000    | 1050000 |
 *  ldo8 | XUSB, DC      | 50000   | 800000 | 1050000    | 1050000 |
--- a/bootloader/rtc/max77620-rtc.c
+++ b/bootloader/rtc/max77620-rtc.c
@@ -1,7 +1,8 @@
 /*
 * PMIC Real Time Clock driver for Nintendo Switch's MAX77620-RTC
 *
- * Copyright (c) 2018 CTCaer
+ * Copyright (c) 2018-2019 CTCaer
+ * Copyright (c) 2019 shchmue
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@@ -75,3 +76,94 @@ void max77620_rtc_stop_alarm()
 	// Update RTC clock from RTC regs.
 	i2c_send_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_RTC_UPDATE0_REG, MAX77620_RTC_WRITE_UPDATE);
 }
+
+void max77620_rtc_epoch_to_date(u32 epoch, rtc_time_t *time)
+{
+	u32 tmp, edays, year, month, day;
+
+	// Set time.
+	time->sec = epoch % 60;
+	epoch /= 60;
+	time->min = epoch % 60;
+	epoch /= 60;
+	time->hour = epoch % 24;
+	epoch /= 24;
+
+	// Calculate base date values.
+	tmp = (u32)(((u64)4 * epoch + 102032) / 146097 + 15);
+	tmp = (u32)((u64)epoch + 2442113 + tmp - (tmp >> 2));
+
+	year = (20 * tmp - 2442) / 7305;
+	edays = tmp - 365 * year - (year >> 2);
+	month = edays * 1000 / 30601;
+	day = edays - month * 30 - month * 601 / 1000;
+
+	// Month/Year offset.
+	if(month < 14)
+	{
+		year -= 4716;
+		month--;
+	}
+	else
+	{
+		year -= 4715;
+		month -= 13;
+	}
+
+	// Set date.
+	time->year = year;
+	time->month = month;
+	time->day = day;
+
+	// Set weekday.
+	time->weekday = 0; //! TODO.
+}
+
+u32 max77620_rtc_date_to_epoch(const rtc_time_t *time, bool hos_encoding)
+{
+	u32 year, month, epoch;
+
+	//Year
+	year = time->year;
+	//Month of year
+	month = time->month;
+
+	if (!hos_encoding)
+	{
+		// Month/Year offset.
+		if(month < 3)
+		{
+			month += 12;
+			year--;
+		}
+	}
+	else
+	{
+		year -= 2000;
+		month++;
+
+		// Month/Year offset.
+		if(month < 3)
+		{
+			month += 9;
+			year--;
+		}
+		else
+			month -= 3;
+	}
+
+	epoch = (365 * year) + (year >> 2) - (year / 100) + (year / 400); // Years to days.
+
+	if (!hos_encoding)
+	{
+		epoch += (30 * month) + (3 * (month + 1) / 5) + time->day; // Months to days.
+		epoch -= 719561; // Epoch time is 1/1/1970.
+	}
+	else
+		epoch += (30 * month) + ((3 * month + 2) / 5) + 59 + time->day; // Months to days.
+
+	epoch *= 86400; // Days to seconds.
+	epoch += (3600 * time->hour) + (60 * time->min) + time->sec; // Add hours, minutes and seconds.
+
+	return epoch;
+}
--- a/bootloader/rtc/max77620-rtc.h
+++ b/bootloader/rtc/max77620-rtc.h
@@ -71,5 +71,7 @@ typedef struct _rtc_time_t {

 void max77620_rtc_get_time(rtc_time_t *time);
 void max77620_rtc_stop_alarm();
+void max77620_rtc_epoch_to_date(u32 epoch, rtc_time_t *time);
+u32 max77620_rtc_date_to_epoch(const rtc_time_t *time, bool hos_encoding);

 #endif /* _MFD_MAX77620_RTC_H_ */
--- a/bootloader/soc/bpmp.c
+++ b/bootloader/soc/bpmp.c
@@ -22,56 +22,101 @@
 #include "../../common/memory_map.h"
 #include "../utils/util.h"

+#define BPMP_MMU_CACHE_LINE_SIZE        0x20
+
 #define BPMP_CACHE_CONFIG               0x0
-#define  CFG_ENABLE                     (1 << 0)
+#define  CFG_ENABLE_CACHE               (1 << 0)
+#define  CFG_ENABLE_SKEW_ASSOC          (1 << 1)
+#define  CFG_DISABLE_RANDOM_ALLOC       (1 << 2)
 #define  CFG_FORCE_WRITE_THROUGH        (1 << 3)
+#define  CFG_NEVER_ALLOCATE             (1 << 6)
+#define  CFG_ENABLE_INTERRUPT           (1 << 7)
+#define  CFG_MMU_TAG_MODE(x)            (x << 8)
+#define   TAG_MODE_PARALLEL             0
+#define   TAG_MODE_TAG_FIRST            1
+#define   TAG_MODE_MMU_FIRST            2
 #define  CFG_DISABLE_WRITE_BUFFER       (1 << 10)
 #define  CFG_DISABLE_READ_BUFFER        (1 << 11)
+#define  CFG_ENABLE_HANG_DETECT         (1 << 12)
 #define  CFG_FULL_LINE_DIRTY            (1 << 13)
 #define  CFG_TAG_CHK_ABRT_ON_ERR        (1 << 14)
+#define  CFG_TAG_CHK_CLR_ERR            (1 << 15)
+#define  CFG_DISABLE_SAMELINE           (1 << 16)
+#define  CFG_OBS_BUS_EN                 (1 << 31)
+
 #define BPMP_CACHE_LOCK                 0x4
+#define  LOCK_LINE(x)                   (1 << x)
+
 #define BPMP_CACHE_SIZE                 0xC
 #define BPMP_CACHE_LFSR                 0x10
+
 #define BPMP_CACHE_TAG_STATUS           0x14
+#define  TAG_STATUS_TAG_CHECK_ERROR     (1 << 0)
+#define  TAG_STATUS_CONFLICT_ADDR_MASK  0xFFFFFFE0
+
 #define BPMP_CACHE_CLKEN_OVERRIDE       0x18
+#define  CLKEN_OVERRIDE_WR_MCCIF_CLKEN  (1 << 0)
+#define  CLKEN_OVERRIDE_RD_MCCIF_CLKEN  (1 << 1)
+
 #define BPMP_CACHE_MAINT_ADDR           0x20
 #define BPMP_CACHE_MAINT_DATA           0x24
+
 #define BPMP_CACHE_MAINT_REQ            0x28
 #define  MAINT_REQ_WAY_BITMAP(x)        ((x) << 8)

 #define BPMP_CACHE_INT_MASK             0x40
 #define BPMP_CACHE_INT_CLEAR            0x44
-#define  INT_CLR_MAINT_DONE             (1 << 0)
-
 #define BPMP_CACHE_INT_RAW_EVENT        0x48
-#define  INT_RAW_EVENT_MAINT_DONE      (1 << 0)
 #define BPMP_CACHE_INT_STATUS           0x4C
+#define  INT_MAINT_DONE                 (1 << 0)
+#define  INT_MAINT_ERROR                (1 << 1)

 #define BPMP_CACHE_RB_CFG               0x80
 #define BPMP_CACHE_WB_CFG               0x84

 #define BPMP_CACHE_MMU_FALLBACK_ENTRY   0xA0
 #define BPMP_CACHE_MMU_SHADOW_COPY_MASK 0xA4
+
 #define BPMP_CACHE_MMU_CFG              0xAC
+#define  MMU_CFG_BLOCK_MAIN_ENTRY_WR    (1 << 0)
 #define  MMU_CFG_SEQ_EN                 (1 << 1)
 #define  MMU_CFG_TLB_EN                 (1 << 2)
+#define  MMU_CFG_SEG_CHECK_ALL_ENTRIES  (1 << 3)
 #define  MMU_CFG_ABORT_STORE_LAST       (1 << 4)
+#define  MMU_CFG_CLR_ABORT              (1 << 5)
+
 #define BPMP_CACHE_MMU_CMD              0xB0
 #define  MMU_CMD_NOP                    0
 #define  MMU_CMD_INIT                   1
 #define  MMU_CMD_COPY_SHADOW            2
+
 #define BPMP_CACHE_MMU_ABORT_STAT       0xB4
+#define  ABORT_STAT_UNIT_MASK           0x7
+#define  ABORT_STAT_UNIT_NONE           0
+#define  ABORT_STAT_UNIT_CACHE          1
+#define  ABORT_STAT_UNIT_SEQ            2
+#define  ABORT_STAT_UNIT_TLB            3
+#define  ABORT_STAT_UNIT_SEG            4
+#define  ABORT_STAT_UNIT_FALLBACK       5
+#define  ABORT_STAT_OVERLAP             (1 << 3)
+#define  ABORT_STAT_ENTRY               (0x1F << 4)
+#define  ABORT_STAT_TYPE_MASK           (3 << 16)
+#define  ABORT_STAT_TYPE_EXE            (0 << 16)
+#define  ABORT_STAT_TYPE_RD             (1 << 16)
+#define  ABORT_STAT_TYPE_WR             (2 << 16)
+#define  ABORT_STAT_SIZE                (3 << 18)
+#define  ABORT_STAT_SEQ                 (1 << 20)
+#define  ABORT_STAT_PROT                (1 << 21)
+
 #define BPMP_CACHE_MMU_ABORT_ADDR       0xB8
 #define BPMP_CACHE_MMU_ACTIVE_ENTRIES   0xBC

-#define BPMP_MMU_SHADOW_ENTRY_BASE     (BPMP_CACHE_BASE + 0x400)
-#define BPMP_MMU_MAIN_ENTRY_BASE       (BPMP_CACHE_BASE + 0x800)
-#define  MMU_ENTRY_ADDR_MASK           0xFFFFFFE0
-
-#define  MMU_EN_CACHED                (1 << 0)
-#define  MMU_EN_EXEC                  (1 << 1)
-#define  MMU_EN_READ                  (1 << 2)
-#define  MMU_EN_WRITE                 (1 << 3)
+#define BPMP_MMU_SHADOW_ENTRY_BASE      (BPMP_CACHE_BASE + 0x400)
+#define BPMP_MMU_MAIN_ENTRY_BASE        (BPMP_CACHE_BASE + 0x800)
+#define  MMU_EN_CACHED                  (1 << 0)
+#define  MMU_EN_EXEC                    (1 << 1)
+#define  MMU_EN_READ                    (1 << 2)
+#define  MMU_EN_WRITE                   (1 << 3)

 bpmp_mmu_entry_t mmu_entries[] =
 {
@@ -81,15 +126,15 @@ bpmp_mmu_entry_t mmu_entries[] =

 void bpmp_mmu_maintenance(u32 op, bool force)
 {
-	if (!force && !(BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE))
+	if (!force && !(BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE_CACHE))
 		return;

-	BPMP_CACHE_CTRL(BPMP_CACHE_INT_CLEAR) = INT_CLR_MAINT_DONE;
+	BPMP_CACHE_CTRL(BPMP_CACHE_INT_CLEAR) = INT_MAINT_DONE;

 	// This is a blocking operation.
 	BPMP_CACHE_CTRL(BPMP_CACHE_MAINT_REQ) = MAINT_REQ_WAY_BITMAP(0xF) | op;

-	while(!(BPMP_CACHE_CTRL(BPMP_CACHE_INT_RAW_EVENT) & INT_RAW_EVENT_MAINT_DONE))
+	while(!(BPMP_CACHE_CTRL(BPMP_CACHE_INT_RAW_EVENT) & INT_MAINT_DONE))
 		;

 	BPMP_CACHE_CTRL(BPMP_CACHE_INT_CLEAR) = BPMP_CACHE_CTRL(BPMP_CACHE_INT_RAW_EVENT);
@@ -104,8 +149,8 @@ void bpmp_mmu_set_entry(int idx, bpmp_mmu_entry_t *entry, bool apply)

 	if (entry->enable)
 	{
-		mmu_entry->min_addr = entry->min_addr & MMU_ENTRY_ADDR_MASK;
-		mmu_entry->max_addr = entry->max_addr & MMU_ENTRY_ADDR_MASK;
+		mmu_entry->start_addr = ALIGN(entry->start_addr, BPMP_MMU_CACHE_LINE_SIZE);
+		mmu_entry->end_addr = ALIGN_DOWN(entry->end_addr, BPMP_MMU_CACHE_LINE_SIZE);
 		mmu_entry->attr = entry->attr;

 		BPMP_CACHE_CTRL(BPMP_CACHE_MMU_SHADOW_COPY_MASK) |= (1 << idx);
@@ -117,7 +162,7 @@ void bpmp_mmu_set_entry(int idx, bpmp_mmu_entry_t *entry, bool apply)

 void bpmp_mmu_enable()
 {
-	if (BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE)
+	if (BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE_CACHE)
 		return;

 	// Init BPMP MMU.
@@ -136,7 +181,8 @@ void bpmp_mmu_enable()
 	bpmp_mmu_maintenance(BPMP_MMU_MAINT_INVALID_WAY, true);

 	// Enable cache.
-	BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) = CFG_ENABLE | CFG_FORCE_WRITE_THROUGH | CFG_TAG_CHK_ABRT_ON_ERR;
+	BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) = CFG_ENABLE_CACHE | CFG_FORCE_WRITE_THROUGH |
+		CFG_MMU_TAG_MODE(TAG_MODE_PARALLEL) | CFG_TAG_CHK_ABRT_ON_ERR;

 	// HW bug. Invalidate cache again.
 	bpmp_mmu_maintenance(BPMP_MMU_MAINT_INVALID_WAY, false);
@@ -144,7 +190,7 @@ void bpmp_mmu_enable()

 void bpmp_mmu_disable()
 {
-	if (!(BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE))
+	if (!(BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE_CACHE))
 		return;

 	// Clean and invalidate cache.
@@ -154,7 +200,10 @@ void bpmp_mmu_disable()
 	BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) = 0;
 }

-const u8 pllc4_divn[] = {
+// APB clock affects RTC, PWM, MEMFETCH, APE, USB, SOR PWM,
+// I2C host, DC/DSI/DISP. UART gives extra stress.
+// 92: 100% success ratio. 93-94: 595-602MHz has 99% success ratio. 95: 608MHz less.
+const u8 pll_divn[] = {
 	0,   // BPMP_CLK_NORMAL:      408MHz  0% - 136MHz APB.
 	85,  // BPMP_CLK_HIGH_BOOST:  544MHz 33% - 136MHz APB.
 	90,  // BPMP_CLK_SUPER_BOOST: 576MHz 41% - 144MHz APB.
@@ -165,6 +214,28 @@ const u8 pllc4_divn[] = {

 bpmp_freq_t bpmp_clock_set = BPMP_CLK_NORMAL;

+void bpmp_clk_rate_get()
+{
+	bool clk_src_is_pllp = ((CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) >> 4) & 7) == 3;
+
+	if (clk_src_is_pllp)
+		bpmp_clock_set = BPMP_CLK_NORMAL;
+	else
+	{
+		bpmp_clock_set = BPMP_CLK_HIGH_BOOST;
+
+		u8 pll_divn_curr = (CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) >> 10) & 0xFF;
+		for (u32 i = 1; i < sizeof(pll_divn); i++)
+		{
+			if (pll_divn[i] == pll_divn_curr)
+			{
+				bpmp_clock_set = i;
+				break;
+			}
+		}
+	}
+}
+
 void bpmp_clk_rate_set(bpmp_freq_t fid)
 {
 	if (fid > (BPMP_CLK_MAX - 1))
@@ -179,37 +250,26 @@ void bpmp_clk_rate_set(bpmp_freq_t fid)
 		{
 			// Restore to PLLP source during PLLC4 configuration.
 			CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) = 0x20003333; // PLLP_OUT.
-			// Wait a bit for clock source change.
-			msleep(10);
+			msleep(1); // Wait a bit for clock source change.
 		}

-		CLOCK(CLK_RST_CONTROLLER_PLLC4_MISC) = PLLC4_MISC_EN_LCKDET;
-		CLOCK(CLK_RST_CONTROLLER_PLLC4_BASE) = 4 | (pllc4_divn[fid] << 8) | PLL_BASE_ENABLE; // DIVM: 4, DIVP: 1.
+		// Configure and enable PLLC.
+		clock_enable_pllc(pll_divn[fid]);

-		while (!(CLOCK(CLK_RST_CONTROLLER_PLLC4_BASE) & PLLC4_BASE_LOCK))
-			;
-
-		CLOCK(CLK_RST_CONTROLLER_PLLC4_OUT) = (1 << 8) | PLLC4_OUT3_CLKEN; // 1.5 div.
-		CLOCK(CLK_RST_CONTROLLER_PLLC4_OUT) |= PLLC4_OUT3_RSTN_CLR; // Get divider out of reset.
-
-		// Wait a bit for PLLC4 to stabilize.
-		msleep(10);
-		CLOCK(CLK_RST_CONTROLLER_CLK_SYSTEM_RATE) = 3; // PCLK = HCLK / 4.
-		CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) = 0x20003323; // PLLC4_OUT3.
-
-		bpmp_clock_set = fid;
+		// Set SCLK / HCLK / PCLK.
+		CLOCK(CLK_RST_CONTROLLER_CLK_SYSTEM_RATE) = 3; // PCLK = HCLK / (3 + 1). HCLK == SCLK.
+		CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) = 0x20003310; // PLLC_OUT1 for active and CLKM for idle.
 	}
 	else
 	{
-		CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) = 0x20003333; // PLLP_OUT.
+		CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) = 0x20003330; // PLLP_OUT for active and CLKM for idle.
+		msleep(1); // Wait a bit for clock source change.
+		CLOCK(CLK_RST_CONTROLLER_CLK_SYSTEM_RATE) = 2; // PCLK = HCLK / (2 + 1). HCLK == SCLK.

-		// Wait a bit for clock source change.
-		msleep(10);
-
-		CLOCK(CLK_RST_CONTROLLER_CLK_SYSTEM_RATE) = 2; // PCLK = HCLK / 3.
-		CLOCK(CLK_RST_CONTROLLER_PLLC4_BASE) &= ~PLL_BASE_ENABLE;
-		bpmp_clock_set = BPMP_CLK_NORMAL;
+		// Disable PLLC to save power.
+		clock_disable_pllc();
 	}
+	bpmp_clock_set = fid;
 }

 // The following functions halt BPMP to reduce power while sleeping.
--- a/bootloader/soc/bpmp.h
+++ b/bootloader/soc/bpmp.h
@@ -21,14 +21,24 @@

 #include "../utils/types.h"

-#define BPMP_MMU_MAINT_CLEAN_WAY   17
-#define BPMP_MMU_MAINT_INVALID_WAY 18
-#define BPMP_MMU_MAINT_CLN_INV_WAY 19
+typedef enum
+{
+	BPMP_MMU_MAINT_NOP                =  0,
+	BPMP_MMU_MAINT_CLEAN_PHY          =  1,
+	BPMP_MMU_MAINT_INVALID_PHY        =  2,
+	BPMP_MMU_MAINT_CLEAN_INVALID_PHY  =  3,
+	BPMP_MMU_MAINT_CLEAN_LINE         =  9,
+	BPMP_MMU_MAINT_INVALID_LINE       = 10,
+	BPMP_MMU_MAINT_CLEAN_INVALID_LINE = 11,
+	BPMP_MMU_MAINT_CLEAN_WAY          = 17,
+	BPMP_MMU_MAINT_INVALID_WAY        = 18,
+	BPMP_MMU_MAINT_CLN_INV_WAY        = 19
+} bpmp_maintenance_t;

 typedef struct _bpmp_mmu_entry_t
 {
-	u32 min_addr;
-	u32 max_addr;
+	u32 start_addr;
+	u32 end_addr;
 	u32 attr;
 	u32 enable;
 } bpmp_mmu_entry_t;
@@ -49,6 +59,7 @@ void bpmp_mmu_maintenance(u32 op, bool force);
 void bpmp_mmu_set_entry(int idx, bpmp_mmu_entry_t *entry, bool apply);
 void bpmp_mmu_enable();
 void bpmp_mmu_disable();
+void bpmp_clk_rate_get();
 void bpmp_clk_rate_set(bpmp_freq_t fid);
 void bpmp_usleep(u32 us);
 void bpmp_msleep(u32 ms);
--- a/bootloader/soc/clock.c
+++ b/bootloader/soc/clock.c
@@ -19,6 +19,17 @@
 #include "../utils/util.h"
 #include "../storage/sdmmc.h"

+/*
+ * CLOCK Peripherals:
+ * L   0 -  31
+ * H  32 -  63
+ * U  64 -  95
+ * V  96 - 127
+ * W 128 - 159
+ * X 160 - 191
+ * Y 192 - 223
+ */
+
 /* clock_t: reset, enable, source, index, clk_src, clk_div */

 static const clock_t _clock_uart[] = {
@@ -29,7 +40,7 @@ static const clock_t _clock_uart[] = {
 /* UART E */ { CLK_RST_CONTROLLER_RST_DEVICES_Y, CLK_RST_CONTROLLER_CLK_OUT_ENB_Y, CLK_RST_CONTROLLER_CLK_SOURCE_UARTAPE, 20, 0, 2 }
 };

-//I2C default parameters - TLOW: 4, THIGH: 2, DEBOUNCE: 0 FM_DIV: 26.
+//I2C default parameters - TLOW: 4, THIGH: 2, DEBOUNCE: 0, FM_DIV: 26.
 static const clock_t _clock_i2c[] = {
 /* I2C1 */ { CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_I2C1, 12, 0, 19 }, //20.4MHz -> 100KHz
 /* I2C2 */ { CLK_RST_CONTROLLER_RST_DEVICES_H, CLK_RST_CONTROLLER_CLK_OUT_ENB_H, CLK_RST_CONTROLLER_CLK_SOURCE_I2C2, 22, 0, 4  }, //81.6MHz -> 400KHz
@@ -228,6 +239,51 @@ void clock_disable_pwm()
 	clock_disable(&_clock_pwm);
 }

+void clock_enable_pllc(u32 divn)
+{
+	u8 pll_divn_curr = (CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) >> 10) & 0xFF;
+
+	// Check if already enabled and configured.
+	if ((CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) & PLLCX_BASE_ENABLE) && (pll_divn_curr == divn))
+		return;
+
+	// Take PLLC out of reset and set basic misc parameters.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_MISC) = 
+		((CLOCK(CLK_RST_CONTROLLER_PLLC_MISC) & 0xFFF0000F) & ~PLLC_MISC_RESET) | (0x80000 << 4); // PLLC_EXT_FRU.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_MISC_2) |= 0xF0 << 8; // PLLC_FLL_LD_MEM.
+
+	// Disable PLL and IDDQ in case they are on.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) &= ~PLLCX_BASE_ENABLE;
+	CLOCK(CLK_RST_CONTROLLER_PLLC_MISC_1) &= ~PLLC_MISC1_IDDQ;
+	usleep(10);
+
+	// Set PLLC4 dividers.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) = (divn << 10) | 4; // DIVM: 4, DIVP: 1.
+
+	// Enable PLLC4 and wait for Phase and Frequency lock.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) |= PLLCX_BASE_ENABLE;
+	while (!(CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) & PLLCX_BASE_LOCK))
+		;
+
+	// Disable PLLC_OUT1, enable reset and set div to 1.5.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_OUT) = (1 << 8);
+
+	// Enable PLLC_OUT1 and bring it out of reset.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_OUT) |= (PLLC_OUT1_CLKEN | PLLC_OUT1_RSTN_CLR);
+	msleep(1); // Wait a bit for PLL to stabilize.
+}
+
+void clock_disable_pllc()
+{
+	// Disable PLLC and PLLC_OUT1.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_OUT) &= ~(PLLC_OUT1_CLKEN | PLLC_OUT1_RSTN_CLR);
+	CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) &= ~PLLCX_BASE_ENABLE;
+	CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) |= PLLCX_BASE_REF_DIS;
+	CLOCK(CLK_RST_CONTROLLER_PLLC_MISC_1) |= PLLC_MISC1_IDDQ;
+	CLOCK(CLK_RST_CONTROLLER_PLLC_MISC) |= PLLC_MISC_RESET;
+	usleep(10);
+}
+
 #define L_SWR_SDMMC1_RST (1 << 14)
 #define L_SWR_SDMMC2_RST (1 << 9)
 #define L_SWR_SDMMC4_RST (1 << 15)
--- a/bootloader/soc/clock.h
+++ b/bootloader/soc/clock.h
@@ -35,7 +35,9 @@
 #define CLK_RST_CONTROLLER_MISC_CLK_ENB 0x48
 #define CLK_RST_CONTROLLER_OSC_CTRL 0x50
 #define CLK_RST_CONTROLLER_PLLC_BASE 0x80
+#define CLK_RST_CONTROLLER_PLLC_OUT 0x84
 #define CLK_RST_CONTROLLER_PLLC_MISC 0x88
+#define CLK_RST_CONTROLLER_PLLC_MISC_1 0x8C
 #define CLK_RST_CONTROLLER_PLLM_BASE 0x90
 #define CLK_RST_CONTROLLER_PLLM_MISC1 0x98
 #define CLK_RST_CONTROLLER_PLLM_MISC2 0x9C
@@ -119,6 +121,7 @@
 #define CLK_RST_CONTROLLER_SPARE_REG0 0x55C
 #define CLK_RST_CONTROLLER_PLLC4_BASE 0x5A4
 #define CLK_RST_CONTROLLER_PLLC4_MISC 0x5A8
+#define CLK_RST_CONTROLLER_PLLC_MISC_2 0x5D0
 #define CLK_RST_CONTROLLER_PLLC4_OUT 0x5E4
 #define CLK_RST_CONTROLLER_PLLMB_BASE 0x5E8
 #define CLK_RST_CONTROLLER_CLK_SOURCE_DSIA_LP 0x620
@@ -133,10 +136,16 @@
 #define CLK_NO_SOURCE 0x0

 /*! PLL control and status bits */
-#define PLL_BASE_ENABLE      (1 << 30)
+#define PLLCX_BASE_ENABLE    (1 << 30)
+#define PLLCX_BASE_REF_DIS   (1 << 29)
+#define PLLCX_BASE_LOCK      (1 << 27)
+
+#define PLLC_MISC_RESET      (1 << 30)
+#define PLLC_MISC1_IDDQ      (1 << 27)
+#define PLLC_OUT1_CLKEN      (1 << 1)
+#define PLLC_OUT1_RSTN_CLR   (1 << 0)

 #define PLLC4_MISC_EN_LCKDET (1 << 30)
-#define PLLC4_BASE_LOCK      (1 << 27)
 #define PLLC4_BASE_IDDQ      (1 << 18)
 #define PLLC4_OUT3_CLKEN     (1 << 1)
 #define PLLC4_OUT3_RSTN_CLR  (1 << 0)
@@ -181,9 +190,11 @@ void clock_enable_coresight();
 void clock_disable_coresight();
 void clock_enable_pwm();
 void clock_disable_pwm();
+void clock_enable_pllc(u32 divn);
+void clock_disable_pllc();
 void clock_sdmmc_config_clock_source(u32 *pout, u32 id, u32 val);
 void clock_sdmmc_get_card_clock_div(u32 *pout, u16 *pdivisor, u32 type);
-int clock_sdmmc_is_not_reset_and_enabled(u32 id);
+int  clock_sdmmc_is_not_reset_and_enabled(u32 id);
 void clock_sdmmc_enable(u32 id, u32 val);
 void clock_sdmmc_disable(u32 id);

--- a/bootloader/soc/hw_init.c
+++ b/bootloader/soc/hw_init.c
@@ -40,6 +40,7 @@

 extern sdmmc_t sd_sdmmc;
 extern boot_cfg_t b_cfg;
+extern volatile nyx_storage_t *nyx_str;

 /*
 * CLK_OSC - 38.4 MHz crystal.
@@ -79,8 +80,8 @@ void _config_gpios()
 	PINMUX_AUX(PINMUX_AUX_UART3_TX) = 0;

 	// Set Joy-Con IsAttached direction.
-	PINMUX_AUX(PINMUX_AUX_GPIO_PE6) = PINMUX_INPUT_ENABLE;
-	PINMUX_AUX(PINMUX_AUX_GPIO_PH6) = PINMUX_INPUT_ENABLE;
+	PINMUX_AUX(PINMUX_AUX_GPIO_PE6) = PINMUX_INPUT_ENABLE | PINMUX_TRISTATE;
+	PINMUX_AUX(PINMUX_AUX_GPIO_PH6) = PINMUX_INPUT_ENABLE | PINMUX_TRISTATE;

 	// Set pin mode for Joy-Con IsAttached and UARTB/C TX pins.
 #if !defined (DEBUG_UART_PORT) || DEBUG_UART_PORT != UART_B
@@ -110,7 +111,7 @@ void _config_gpios()
 	gpio_output_enable(GPIO_PORT_X, GPIO_PIN_7, GPIO_OUTPUT_DISABLE);

 	// Configure HOME as inputs.
-	// PINMUX_AUX(PINMUX_AUX_BUTTON_HOME) = PINMUX_PULL_UP | PINMUX_INPUT_ENABLE;
+	// PINMUX_AUX(PINMUX_AUX_BUTTON_HOME) = PINMUX_INPUT_ENABLE | PINMUX_TRISTATE;
 	// gpio_config(GPIO_PORT_Y, GPIO_PIN_1, GPIO_MODE_GPIO);
 }

@@ -161,7 +162,7 @@ void _mbist_workaround()
 	// Enable specific clocks and disable all others.
 	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_H) = 0xC0;       // Enable clock PMC, FUSE.
 	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_L) = 0x80000130; // Enable clock RTC, TMR, GPIO, BPMP_CACHE.
-	//CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_L) = 0x80400130; // Keep USB data ON.
+	//CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_L) = 0x80400130; // Keep USBD ON.
 	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_U) = 0x1F00200;  // Enable clock CSITE, IRAMA, IRAMB, IRAMC, IRAMD, BPMP_CACHE_RAM.
 	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_V) = 0x80400808; // Enable clock MSELECT, APB2APE, SPDIF_DOUBLER, SE.
 	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_W) = 0x402000FC; // Enable clock PCIERX0, PCIERX1, PCIERX2, PCIERX3, PCIERX4, PCIERX5, ENTROPY, MC1.
@@ -222,6 +223,7 @@ void _config_regulators()
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_ONOFFCNFG1,
 		(1 << 6) | (3 << MAX77620_ONOFFCNFG1_MRT_SHIFT)); // PWR delay for forced shutdown off.

+	// Configure all Flexible Power Sequencers.
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_FPS_CFG0,
 		(7 << MAX77620_FPS_TIME_PERIOD_SHIFT));
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_FPS_CFG1,
@@ -237,10 +239,10 @@ void _config_regulators()
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_FPS_GPIO3,
 		(4 << MAX77620_FPS_TIME_PERIOD_SHIFT) | (2 << MAX77620_FPS_PD_PERIOD_SHIFT)); // 3.x+

-	// Set vdd_core voltage to 1.125V
+	// Set vdd_core voltage to 1.125V.
 	max77620_regulator_set_voltage(REGULATOR_SD0, 1125000);

-	// Fix CPU/GPU after a Linux warmboot.
+	// Fix CPU/GPU after a L4T warmboot.
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_GPIO5, 2);
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_GPIO6, 2);

@@ -317,6 +319,7 @@ void reconfig_hw_workaround(bool extra_reconfig, u32 magic)
 	bpmp_mmu_disable();
 	bpmp_clk_rate_set(BPMP_CLK_NORMAL);
 	minerva_change_freq(FREQ_204);
+	nyx_str->mtc_cfg.init_done = 0;

 	// Re-enable clocks to Audio Processing Engine as a workaround to hanging.
 	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_V) |= (1 << 10); // Enable AHUB clock.
--- a/bootloader/soc/uart.c
+++ b/bootloader/soc/uart.c
@@ -31,14 +31,21 @@ void uart_init(u32 idx, u32 baud)
 	// Misc settings.
 	u32 rate = (8 * baud + 408000000) / (16 * baud);
 	uart->UART_IER_DLAB = 0; // Disable interrupts.
-	uart->UART_MCR = 0; // Disable hardware flow control.
 	uart->UART_LCR = UART_LCR_DLAB | UART_LCR_WORD_LENGTH_8; // Enable DLAB & set 8n1 mode.
 	uart->UART_THR_DLAB = (u8)rate; // Divisor latch LSB.
 	uart->UART_IER_DLAB = (u8)(rate >> 8); // Divisor latch MSB.
 	uart->UART_LCR = UART_LCR_WORD_LENGTH_8; // Disable DLAB.
+	(void)uart->UART_SPR;

 	// Setup and flush fifo.
-	uart->UART_IIR_FCR = UART_IIR_FCR_EN_FIFO | UART_IIR_FCR_RX_CLR | UART_IIR_FCR_TX_CLR;
+	uart->UART_IIR_FCR = UART_IIR_FCR_EN_FIFO;
+	(void)uart->UART_SPR;
+	usleep(20);
+	uart->UART_MCR = 0; // Disable hardware flow control.
+	usleep(96);
+	uart->UART_IIR_FCR = UART_IIR_FCR_EN_FIFO | UART_IIR_FCR_TX_CLR | UART_IIR_FCR_RX_CLR;
+
+	// Wait 3 symbols for baudrate change.
 	usleep(3 * ((baud + 999999) / baud));
 	uart_wait_idle(idx, UART_TX_IDLE | UART_RX_IDLE);
 }
@@ -58,7 +65,7 @@ void uart_wait_idle(u32 idx, u32 which)
 	}
 }

-void uart_send(u32 idx, u8 *buf, u32 len)
+void uart_send(u32 idx, const u8 *buf, u32 len)
 {
 	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);

@@ -70,14 +77,91 @@ void uart_send(u32 idx, u8 *buf, u32 len)
 	};
 }

-void uart_recv(u32 idx, u8 *buf, u32 len)
+u32 uart_recv(u32 idx, u8 *buf, u32 len)
+{
+	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);
+	u32 timeout = get_tmr_us() + 1000;
+	u32 i;
+
+	for (i = 0; ; i++)
+	{
+		while (!(uart->UART_LSR & UART_LSR_RDR))
+		{
+			if (!len)
+			{
+				if (timeout < get_tmr_us())
+					break;
+			}
+			else if (len < i)
+				break;
+		}
+		if (timeout < get_tmr_us())
+			break;
+
+		buf[i] = uart->UART_THR_DLAB;
+		timeout = get_tmr_us() + 1000;
+	};
+
+	return i ? (len ? (i - 1) : i) : 0;
+}
+
+void uart_invert(u32 idx, bool enable, u32 invert_mask)
 {
 	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);

-	for (u32 i = 0; i != len; i++)
-	{
-		while (!(uart->UART_LSR & UART_LSR_RDR))
-			;
-		buf[i] = uart->UART_THR_DLAB;
-	};
+	if (enable)
+		uart->UART_IRDA_CSR |= invert_mask;
+	else
+		uart->UART_IRDA_CSR &= ~invert_mask;
+	(void)uart->UART_SPR;
+}
+
+u32 uart_get_IIR(u32 idx)
+{
+	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);
+
+	return uart->UART_IIR_FCR;
+}
+
+void uart_set_IIR(u32 idx)
+{
+	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);
+
+	uart->UART_IER_DLAB &= ~UART_IER_DLAB_IE_EORD;
+	(void)uart->UART_SPR;
+	uart->UART_IER_DLAB |= UART_IER_DLAB_IE_EORD;
+	(void)uart->UART_SPR;
+}
+
+void uart_empty_fifo(u32 idx, u32 which)
+{
+	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);
+
+	uart->UART_MCR = 0;
+	(void)uart->UART_SPR;
+	usleep(96);
+
+	uart->UART_IIR_FCR = UART_IIR_FCR_EN_FIFO | UART_IIR_FCR_TX_CLR | UART_IIR_FCR_RX_CLR;
+	(void)uart->UART_SPR;
+	usleep(18);
+	u32 tries = 0;
+
+	if (UART_IIR_FCR_TX_CLR & which)
+	{
+		while (tries < 10 && uart->UART_LSR & UART_LSR_TMTY)
+		{
+			tries++;
+			usleep(100);
+		}
+		tries = 0;
+	}
+
+	if (UART_IIR_FCR_RX_CLR & which)
+	{
+		while (tries < 10 && !uart->UART_LSR & UART_LSR_RDR)
+		{
+			tries++;
+			usleep(100);
+		}
+	}
 }
--- a/bootloader/soc/uart.h
+++ b/bootloader/soc/uart.h
@@ -76,7 +76,11 @@ typedef struct _uart_t

 void uart_init(u32 idx, u32 baud);
 void uart_wait_idle(u32 idx, u32 which);
-void uart_send(u32 idx, u8 *buf, u32 len);
-void uart_recv(u32 idx, u8 *buf, u32 len);
+void uart_send(u32 idx, const u8 *buf, u32 len);
+u32  uart_recv(u32 idx, u8 *buf, u32 len);
+void uart_invert(u32 idx, bool enable, u32 invert_mask);
+u32  uart_get_IIR(u32 idx);
+void uart_set_IIR(u32 idx);
+void uart_empty_fifo(u32 idx, u32 which);

 #endif
--- a/bootloader/utils/list.h
+++ b/bootloader/utils/list.h
@@ -33,9 +33,10 @@
 #define LIST_FOREACH_SAFE(iter, list) \
 	for(link_t *iter = (list)->next, *safe = iter->next; iter != (list); iter = safe, safe = iter->next)

-/*! Iterate over all list members. */
+/*! Iterate over all list members and make sure that the list has at least one entry. */
 #define LIST_FOREACH_ENTRY(etype, iter, list, mn) \
-	for(etype *iter = CONTAINER_OF((list)->next, etype, mn); &iter->mn != (list); iter = CONTAINER_OF(iter->mn.next, etype, mn))
+	if ((list)->next != (list)) \
+		for(etype *iter = CONTAINER_OF((list)->next, etype, mn); &iter->mn != (list); iter = CONTAINER_OF(iter->mn.next, etype, mn))

 typedef struct _link_t
 {
--- a/nyx/nyx_gui/config/config.c
+++ b/nyx/nyx_gui/config/config.c
@@ -51,7 +51,7 @@ void set_default_configuration()
 	h_cfg.rcm_patched = fuse_check_patched_rcm();
 	h_cfg.emummc_force_disable = false;

-	sd_power_cycle_time_start = 0xFFFFFFF;
+	sd_power_cycle_time_start = 0;
 }

 int create_config_entry()
--- a/nyx/nyx_gui/config/ini.c
+++ b/nyx/nyx_gui/config/ini.c
@@ -44,7 +44,8 @@ static char *_strdup(char *str)
 u32 _find_section_name(char *lbuf, u32 lblen, char schar)
 {
 	u32 i;
-	for (i = 0; i < lblen  && lbuf[i] != schar && lbuf[i] != '\n' && lbuf[i] != '\r'; i++)
+	// Depends on 'FF_USE_STRFUNC 2' that removes \r.
+	for (i = 0; i < lblen  && lbuf[i] != schar && lbuf[i] != '\n'; i++)
 		;
 	lbuf[i] = 0;

@@ -123,8 +124,8 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 			f_gets(lbuf, 512, &fp);
 			lblen = strlen(lbuf);

-			// Remove trailing newline.
-			if (lbuf[lblen - 1] == '\n' || lbuf[lblen - 1] == '\r')
+			// Remove trailing newline. Depends on 'FF_USE_STRFUNC 2' that removes \r.
+			if (lblen && lbuf[lblen - 1] == '\n')
 				lbuf[lblen - 1] = 0;

 			if (lblen > 2 && lbuf[0] == '[') // Create new section.
@@ -134,24 +135,22 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 				csec = _ini_create_section(dst, csec, &lbuf[1], INI_CHOICE);
 				list_init(&csec->kvs);
 			}
-			else if (lblen > 2 && lbuf[0] == '{') //Create new caption.
+			else if (lblen > 1 && lbuf[0] == '{') // Create new caption. Support empty caption '{}'.
 			{
 				_find_section_name(lbuf, lblen, '}');

 				csec = _ini_create_section(dst, csec, &lbuf[1], INI_CAPTION);
 				csec->color = 0xFF0AB9E6;
 			}
-			else if (lblen > 2 && lbuf[0] == '#') //Create empty lines and comments.
+			else if (lblen > 2 && lbuf[0] == '#') // Create comment.
 			{
-				_find_section_name(lbuf, lblen, '\0');
-
 				csec = _ini_create_section(dst, csec, &lbuf[1], INI_COMMENT);
 			}
-			else if (lblen < 2)
+			else if (lblen < 2) // Create empty line.
 			{
 				csec = _ini_create_section(dst, csec, NULL, INI_NEWLINE);
 			}
-			else if (csec && csec->type == INI_CHOICE) //Extract key/value.
+			else if (csec && csec->type == INI_CHOICE) // Extract key/value.
 			{
 				u32 i = _find_section_name(lbuf, lblen, '=');

--- a/nyx/nyx_gui/frontend/fe_emmc_tools.c
+++ b/nyx/nyx_gui/frontend/fe_emmc_tools.c
@@ -1205,7 +1205,7 @@ static int _restore_emmc_part(emmc_tool_gui_t *gui, char *sd_path, int active_pa
 		}
 		pct = (u64)((u64)(lba_curr - part->lba_start) * 100u) / (u64)(part->lba_end - part->lba_start);
 		if (pct != prevPct)
-		{;
+		{
 			lv_bar_set_value(gui->bar, pct);
 			s_printf(gui->txt_buf, " "SYMBOL_DOT" %d%%", pct);
 			lv_label_set_array_text(gui->label_pct, gui->txt_buf, 32);
--- a/nyx/nyx_gui/frontend/gui.c
+++ b/nyx/nyx_gui/frontend/gui.c
@@ -782,13 +782,13 @@ static void _update_status_bar(void *params)
 	max17050_get_property(MAX17050_VCELL, &batt_volt);
 	max17050_get_property(MAX17050_Current, &batt_curr);

+	// Enable fan if more than 46 oC.
 	u32 soc_temp_dec = (soc_temp >> 8);
-	// Enable fan if more than 44 oC.
-	if (soc_temp_dec > 50)
-		set_fan_duty(100);
-	else if (soc_temp_dec > 44)
-		set_fan_duty(53);
-	else
+	if (soc_temp_dec > 51)
+		set_fan_duty(102);
+	else if (soc_temp_dec > 46)
+		set_fan_duty(51);
+	else if (soc_temp_dec < 40)
 		set_fan_duty(0);

 	//! TODO: Parse time and use offset.
@@ -830,7 +830,7 @@ static void _update_status_bar(void *params)

 	bool voltage_empty = batt_volt < 3200;
 	s_printf(label + strlen(label), " mA# (%s%d mV%s)",
-		voltage_empty ? "FFF8000" : "", batt_volt,  voltage_empty ? "#" : "");
+		voltage_empty ? "#FF8000 " : "", batt_volt,  voltage_empty ? " "SYMBOL_WARNING"#" : "");

 	lv_label_set_array_text(status_bar.battery_more, label, 64);
 	lv_obj_realign(status_bar.battery_more);
--- a/nyx/nyx_gui/frontend/gui_emummc_tools.c
+++ b/nyx/nyx_gui/frontend/gui_emummc_tools.c
@@ -857,7 +857,6 @@ out0:;
 	lv_line_set_style(line_sep, lv_theme_get_current()->line.decor);
 	lv_obj_align(line_sep, label_txt, LV_ALIGN_OUT_BOTTOM_LEFT, -(LV_DPI / 4), LV_DPI / 8);

-
 	lv_obj_t *btn = NULL;
 	lv_btn_ext_t *ext;
 	lv_obj_t *btn_label = NULL;
--- a/nyx/nyx_gui/frontend/gui_info.c
+++ b/nyx/nyx_gui/frontend/gui_info.c
@@ -88,6 +88,12 @@ static lv_res_t _battery_dump_window_action(lv_obj_t * btn)
 		char path[64];
 		u8 *buf = (u8 *)malloc(0x100 * 2);

+		// Unlock model table.
+		u16 unlock = 0x59;
+		i2c_send_buf_small(I2C_1, MAXIM17050_I2C_ADDR, MAX17050_MODELEnable1, (u8 *)&unlock, 2);
+		unlock = 0xC4;
+		i2c_send_buf_small(I2C_1, MAXIM17050_I2C_ADDR, MAX17050_MODELEnable2, (u8 *)&unlock, 2);
+
 		// Dump all battery fuel gauge registers.
 		for (int i = 0; i < 0x200; i += 2)
 		{
@@ -95,6 +101,11 @@ static lv_res_t _battery_dump_window_action(lv_obj_t * btn)
 			msleep(1);
 		}

+		// Lock model table.
+		unlock = 0;
+		i2c_send_buf_small(I2C_1, MAXIM17050_I2C_ADDR, MAX17050_MODELEnable1, (u8 *)&unlock, 2);
+		i2c_send_buf_small(I2C_1, MAXIM17050_I2C_ADDR, MAX17050_MODELEnable2, (u8 *)&unlock, 2);
+
 		emmcsn_path_impl(path, "/dumps", "fuel_gauge.bin", NULL);
 		error = sd_save_to_file((u8 *)buf, 0x200, path);

@@ -758,10 +769,11 @@ static lv_res_t _create_window_sdcard_info_status(lv_obj_t *btn)
 		lv_obj_t * lb_val2 = lv_label_create(val2, lb_desc);


-		u32 capacity = sd_storage.csd.capacity >> (20 - sd_storage.csd.read_blkbits);
-		s_printf(txt_buf, "#00DDFF v%d.0#\n%02X\n%d MiB\n%d\n%d MB/s (%d MHz)\n%d\nU%d\nV%d\nA%d\n%d",
-			sd_storage.csd.structure + 1, sd_storage.csd.cmdclass, capacity,
-			sd_storage.ssr.bus_width, sd_storage.csd.busspeed, sd_storage.csd.busspeed * 2,
+		s_printf(txt_buf,
+			"#00DDFF v%d.0#\n%02X\n%d MiB\n%d\n%d MB/s (%d MHz)\n%d\nU%d\nV%d\nA%d\n%d",
+			sd_storage.csd.structure + 1, sd_storage.csd.cmdclass, sd_storage.sec_cnt >> 11,
+			sd_storage.ssr.bus_width, sd_storage.csd.busspeed,
+			(sd_storage.csd.busspeed > 10) ? (sd_storage.csd.busspeed * 2) : 50,
 			sd_storage.ssr.speed_class, sd_storage.ssr.uhs_grade, sd_storage.ssr.video_class,
 			sd_storage.ssr.app_class, sd_storage.csd.write_protect);

@@ -888,7 +900,7 @@ static lv_res_t _create_window_battery_status(lv_obj_t *btn)
 	max17050_get_property(MAX17050_VCELL, &value);
 	bool voltage_empty = value < 3200;
 	s_printf(txt_buf + strlen(txt_buf), "%s%d mV%s\n",
-		voltage_empty ? "FFF8000" : "", value,  voltage_empty ? " (Empty!)#" : "");
+		voltage_empty ? "#FF8000 " : "", value,  voltage_empty ? " "SYMBOL_WARNING"#" : "");

 	max17050_get_property(MAX17050_OCVInternal, &value);
 	s_printf(txt_buf + strlen(txt_buf), "%d mV\n", value);
--- a/nyx/nyx_gui/frontend/gui_tools.c
+++ b/nyx/nyx_gui/frontend/gui_tools.c
@@ -394,7 +394,7 @@ static lv_res_t _create_window_dump_pk12_tool(lv_obj_t *btn)

 	if (!h_cfg.se_keygen_done)
 	{
-		tsec_ctxt.fw = (void *)pkg1 + pkg1_id->tsec_off;
+		tsec_ctxt.fw = (void *)(pkg1 + pkg1_id->tsec_off);
 		tsec_ctxt.pkg1 = (void *)pkg1;
 		tsec_ctxt.pkg11_off = pkg1_id->pkg11_off;
 		tsec_ctxt.secmon_base = pkg1_id->secmon_base;
--- a/nyx/nyx_gui/gfx/gfx.c
+++ b/nyx/nyx_gui/gfx/gfx.c
@@ -187,7 +187,7 @@ void gfx_putc(char c)

 			for (u32 i = 0; i < 16; i += 2)
 			{
-				u8 v = *cbuf++;
+				u8 v = *cbuf;
 				for (u32 k = 0; k < 2; k++)
 				{
 					for (u32 j = 0; j < 8; j++)
@@ -212,6 +212,7 @@ void gfx_putc(char c)
 					fb += gfx_ctxt.stride - 16;
 					v = *cbuf;
 				}
+				cbuf++;
 			}
 			gfx_con.x += 16;
 		}
--- a/nyx/nyx_gui/input/touch.c
+++ b/nyx/nyx_gui/input/touch.c
@@ -44,6 +44,28 @@ static int touch_command(u8 cmd)
 	return 0;
 }

+#define X_REAL_MAX 1264
+#define Y_REAL_MAX 704
+#define EDGE_OFFSET 15
+
+static void _touch_compensate_limits(touch_event *event, bool touching)
+{
+	event->x = MAX(event->x, EDGE_OFFSET);
+	event->x = MIN(event->x, X_REAL_MAX);
+	event->x -= EDGE_OFFSET;
+	u32 x_adj = (1280 * 1000) / (X_REAL_MAX - EDGE_OFFSET);
+	event->x = ((u32)event->x * x_adj) / 1000;
+
+	if (touching)
+	{
+		event->y = MAX(event->y, EDGE_OFFSET);
+		event->y = MIN(event->y, Y_REAL_MAX);
+		event->y -= EDGE_OFFSET;
+		u32 y_adj = (720 * 1000) / (Y_REAL_MAX - EDGE_OFFSET);
+		event->y = ((u32)event->y * y_adj) / 1000;
+	}
+}
+
 static void _touch_process_contact_event(touch_event *event, bool touching)
 {
 	event->x = (event->raw[2] << 4) | ((event->raw[4] & STMFTS_MASK_Y_LSB) >> 4);
@@ -58,6 +80,8 @@ static void _touch_process_contact_event(touch_event *event, bool touching)
 	}
 	else
 		event->fingers = 0;
+
+	_touch_compensate_limits(event, touching);
 }

 static void _touch_parse_event(touch_event *event)
@@ -186,6 +210,9 @@ int touch_power_on()
 	if (touch_command(STMFTS_SS_HOVER_SENSE_OFF))
 		return 0;

+	if (touch_command(STMFTS_MS_KEY_SENSE_OFF))
+		return 0;
+
 	return 1;
 }

--- a/nyx/nyx_gui/libs/lv_conf.h
+++ b/nyx/nyx_gui/libs/lv_conf.h
@@ -365,12 +365,5 @@
 /*Switch (dependencies: lv_slider)*/
 #define USE_LV_SW        1

-/*************************
- * Non-user section
- *************************/
-#ifdef _MSC_VER                               /* Disable warnings for Visual Studio*/
-#define _CRT_SECURE_NO_WARNINGS
-#endif
-
 #endif /*LV_CONF_H*/

--- a/nyx/nyx_gui/mem/heap.c
+++ b/nyx/nyx_gui/mem/heap.c
@@ -29,7 +29,7 @@ static void _heap_create(heap_t *heap, u32 start)
 // Node info is before node address.
 static u32 _heap_alloc(heap_t *heap, u32 size)
 {
-	hnode_t *node, *new;
+	hnode_t *node, *new_node;

 	// Align to cache line size.
 	size = ALIGN(size, sizeof(hnode_t));
@@ -49,22 +49,29 @@ static u32 _heap_alloc(heap_t *heap, u32 size)
 	node = heap->first;
 	while (true)
 	{
+		// Check if there's available unused node.
 		if (!node->used && (size <= node->size))
 		{
+			// Size and offset of the new unused node.
 			u32 new_size = node->size - size;
-			new = (hnode_t *)((u32)node + sizeof(hnode_t) + size);
+			new_node = (hnode_t *)((u32)node + sizeof(hnode_t) + size);

-			// If there's aligned leftover space, create a new node.
+			// If there's aligned unused space from the old node,
+			// create a new one and set the leftover size.
 			if (new_size >= (sizeof(hnode_t) << 2))
 			{
-				new->size = new_size - sizeof(hnode_t);
-				new->used = 0;
-				new->next = node->next;
-				new->next->prev = new;
-				new->prev = node;
-				node->next = new;
+				new_node->size = new_size - sizeof(hnode_t);
+				new_node->used = 0;
+				new_node->next = node->next;
+
+				// Check that we are not on first node.
+				if (new_node->next)
+					new_node->next->prev = new_node;
+
+				new_node->prev = node;
+				node->next = new_node;
 			}
-			else
+			else // Unused node size is just enough.
 				size += new_size;

 			node->size = size;
@@ -72,20 +79,23 @@ static u32 _heap_alloc(heap_t *heap, u32 size)

 			return (u32)node + sizeof(hnode_t);
 		}
+
+		// No unused node found, try the next one.
 		if (node->next)
 			node = node->next;
 		else
 			break;
 	}

-	new = (hnode_t *)((u32)node + sizeof(hnode_t) + node->size);
-	new->used = 1;
-	new->size = size;
-	new->prev = node;
-	new->next = NULL;
-	node->next = new;
+	// No unused node found, create a new one.
+	new_node = (hnode_t *)((u32)node + sizeof(hnode_t) + node->size);
+	new_node->used = 1;
+	new_node->size = size;
+	new_node->prev = node;
+	new_node->next = NULL;
+	node->next = new_node;

-	return (u32)new + sizeof(hnode_t);
+	return (u32)new_node + sizeof(hnode_t);
 }

 static void _heap_free(heap_t *heap, u32 addr)
@@ -101,6 +111,7 @@ static void _heap_free(heap_t *heap, u32 addr)
 			{
 				node->prev->size += node->size + sizeof(hnode_t);
 				node->prev->next = node->next;
+
 				if (node->next)
 					node->next->prev = node->prev;
 			}
--- a/nyx/nyx_gui/mem/minerva.c
+++ b/nyx/nyx_gui/mem/minerva.c
@@ -32,6 +32,7 @@ u32 minerva_init()
 {
 	u32 curr_ram_idx = 0;

+	minerva_cfg = NULL;
 	mtc_config_t *mtc_cfg = (mtc_config_t *)&nyx_str->mtc_cfg;

 	// Set table to nyx storage.
--- a/nyx/nyx_gui/mem/sdram.c
+++ b/nyx/nyx_gui/mem/sdram.c
@@ -690,7 +690,6 @@ sdram_params_t *sdram_get_params_patched()

 void sdram_init()
 {
-	//TODO: sdram_id should be in [0,4].
 	const sdram_params_t *params = (const sdram_params_t *)sdram_get_params();

 	// Set DRAM voltage.
--- a/nyx/nyx_gui/power/max17050.h
+++ b/nyx/nyx_gui/power/max17050.h
@@ -96,14 +96,17 @@ enum MAX17050_reg {
 	MAX17050_K_empty0	= 0x3B,
 	MAX17050_TaskPeriod	= 0x3C,
 	MAX17050_FSTAT		= 0x3D,
-
+	MAX17050_TIMER		= 0x3E,
 	MAX17050_SHDNTIMER	= 0x3F,
+
 	MAX17050_QRTbl30	= 0x42,
+
 	MAX17050_dQacc		= 0x45,
 	MAX17050_dPacc		= 0x46,

 	MAX17050_VFSOC0		= 0x48,

+	Max17050_QH0		= 0x4C,
 	MAX17050_QH			= 0x4D,
 	MAX17050_QL			= 0x4E,

@@ -111,6 +114,8 @@ enum MAX17050_reg {
 	MAX17050_MaxVolt	= 0x51, // Custom ID. Not to be sent to i2c.

 	MAX17050_VFSOC0Enable	= 0x60,
+	MAX17050_MODELEnable1	= 0x62,
+	MAX17050_MODELEnable2	= 0x63,

 	MAX17050_MODELChrTbl	= 0x80,

--- a/nyx/nyx_gui/rtc/max77620-rtc.c
+++ b/nyx/nyx_gui/rtc/max77620-rtc.c
@@ -1,7 +1,8 @@
 /*
 * PMIC Real Time Clock driver for Nintendo Switch's MAX77620-RTC
 *
- * Copyright (c) 2018 CTCaer
+ * Copyright (c) 2018-2019 CTCaer
+ * Copyright (c) 2019 shchmue
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@@ -75,3 +76,94 @@ void max77620_rtc_stop_alarm()
 	// Update RTC clock from RTC regs.
 	i2c_send_byte(I2C_5, MAX77620_RTC_I2C_ADDR, MAX77620_RTC_UPDATE0_REG, MAX77620_RTC_WRITE_UPDATE);
 }
+
+void max77620_rtc_epoch_to_date(u32 epoch, rtc_time_t *time)
+{
+	u32 tmp, edays, year, month, day;
+
+	// Set time.
+	time->sec = epoch % 60;
+	epoch /= 60;
+	time->min = epoch % 60;
+	epoch /= 60;
+	time->hour = epoch % 24;
+	epoch /= 24;
+
+	// Calculate base date values.
+	tmp = (u32)(((u64)4 * epoch + 102032) / 146097 + 15);
+	tmp = (u32)((u64)epoch + 2442113 + tmp - (tmp >> 2));
+
+	year = (20 * tmp - 2442) / 7305;
+	edays = tmp - 365 * year - (year >> 2);
+	month = edays * 1000 / 30601;
+	day = edays - month * 30 - month * 601 / 1000;
+
+	// Month/Year offset.
+	if(month < 14)
+	{
+		year -= 4716;
+		month--;
+	}
+	else
+	{
+		year -= 4715;
+		month -= 13;
+	}
+
+	// Set date.
+	time->year = year;
+	time->month = month;
+	time->day = day;
+
+	// Set weekday.
+	time->weekday = 0; //! TODO.
+}
+
+u32 max77620_rtc_date_to_epoch(const rtc_time_t *time, bool hos_encoding)
+{
+	u32 year, month, epoch;
+
+	//Year
+	year = time->year;
+	//Month of year
+	month = time->month;
+
+	if (!hos_encoding)
+	{
+		// Month/Year offset.
+		if(month < 3)
+		{
+			month += 12;
+			year--;
+		}
+	}
+	else
+	{
+		year -= 2000;
+		month++;
+
+		// Month/Year offset.
+		if(month < 3)
+		{
+			month += 9;
+			year--;
+		}
+		else
+			month -= 3;
+	}
+
+	epoch = (365 * year) + (year >> 2) - (year / 100) + (year / 400); // Years to days.
+
+	if (!hos_encoding)
+	{
+		epoch += (30 * month) + (3 * (month + 1) / 5) + time->day; // Months to days.
+		epoch -= 719561; // Epoch time is 1/1/1970.
+	}
+	else
+		epoch += (30 * month) + ((3 * month + 2) / 5) + 59 + time->day; // Months to days.
+
+	epoch *= 86400; // Days to seconds.
+	epoch += (3600 * time->hour) + (60 * time->min) + time->sec; // Add hours, minutes and seconds.
+
+	return epoch;
+}
--- a/nyx/nyx_gui/rtc/max77620-rtc.h
+++ b/nyx/nyx_gui/rtc/max77620-rtc.h
@@ -71,5 +71,7 @@ typedef struct _rtc_time_t {

 void max77620_rtc_get_time(rtc_time_t *time);
 void max77620_rtc_stop_alarm();
+void max77620_rtc_epoch_to_date(u32 epoch, rtc_time_t *time);
+u32 max77620_rtc_date_to_epoch(const rtc_time_t *time, bool hos_encoding);

 #endif /* _MFD_MAX77620_RTC_H_ */
--- a/nyx/nyx_gui/soc/bpmp.c
+++ b/nyx/nyx_gui/soc/bpmp.c
@@ -22,56 +22,101 @@
 #include "../../../common/memory_map.h"
 #include "../utils/util.h"

+#define BPMP_MMU_CACHE_LINE_SIZE        0x20
+
 #define BPMP_CACHE_CONFIG               0x0
-#define  CFG_ENABLE                     (1 << 0)
+#define  CFG_ENABLE_CACHE               (1 << 0)
+#define  CFG_ENABLE_SKEW_ASSOC          (1 << 1)
+#define  CFG_DISABLE_RANDOM_ALLOC       (1 << 2)
 #define  CFG_FORCE_WRITE_THROUGH        (1 << 3)
+#define  CFG_NEVER_ALLOCATE             (1 << 6)
+#define  CFG_ENABLE_INTERRUPT           (1 << 7)
+#define  CFG_MMU_TAG_MODE(x)            (x << 8)
+#define   TAG_MODE_PARALLEL             0
+#define   TAG_MODE_TAG_FIRST            1
+#define   TAG_MODE_MMU_FIRST            2
 #define  CFG_DISABLE_WRITE_BUFFER       (1 << 10)
 #define  CFG_DISABLE_READ_BUFFER        (1 << 11)
+#define  CFG_ENABLE_HANG_DETECT         (1 << 12)
 #define  CFG_FULL_LINE_DIRTY            (1 << 13)
 #define  CFG_TAG_CHK_ABRT_ON_ERR        (1 << 14)
+#define  CFG_TAG_CHK_CLR_ERR            (1 << 15)
+#define  CFG_DISABLE_SAMELINE           (1 << 16)
+#define  CFG_OBS_BUS_EN                 (1 << 31)
+
 #define BPMP_CACHE_LOCK                 0x4
+#define  LOCK_LINE(x)                   (1 << x)
+
 #define BPMP_CACHE_SIZE                 0xC
 #define BPMP_CACHE_LFSR                 0x10
+
 #define BPMP_CACHE_TAG_STATUS           0x14
+#define  TAG_STATUS_TAG_CHECK_ERROR     (1 << 0)
+#define  TAG_STATUS_CONFLICT_ADDR_MASK  0xFFFFFFE0
+
 #define BPMP_CACHE_CLKEN_OVERRIDE       0x18
+#define  CLKEN_OVERRIDE_WR_MCCIF_CLKEN  (1 << 0)
+#define  CLKEN_OVERRIDE_RD_MCCIF_CLKEN  (1 << 1)
+
 #define BPMP_CACHE_MAINT_ADDR           0x20
 #define BPMP_CACHE_MAINT_DATA           0x24
+
 #define BPMP_CACHE_MAINT_REQ            0x28
 #define  MAINT_REQ_WAY_BITMAP(x)        ((x) << 8)

 #define BPMP_CACHE_INT_MASK             0x40
 #define BPMP_CACHE_INT_CLEAR            0x44
-#define  INT_CLR_MAINT_DONE             (1 << 0)
-
 #define BPMP_CACHE_INT_RAW_EVENT        0x48
-#define  INT_RAW_EVENT_MAINT_DONE      (1 << 0)
 #define BPMP_CACHE_INT_STATUS           0x4C
+#define  INT_MAINT_DONE                 (1 << 0)
+#define  INT_MAINT_ERROR                (1 << 1)

 #define BPMP_CACHE_RB_CFG               0x80
 #define BPMP_CACHE_WB_CFG               0x84

 #define BPMP_CACHE_MMU_FALLBACK_ENTRY   0xA0
 #define BPMP_CACHE_MMU_SHADOW_COPY_MASK 0xA4
+
 #define BPMP_CACHE_MMU_CFG              0xAC
+#define  MMU_CFG_BLOCK_MAIN_ENTRY_WR    (1 << 0)
 #define  MMU_CFG_SEQ_EN                 (1 << 1)
 #define  MMU_CFG_TLB_EN                 (1 << 2)
+#define  MMU_CFG_SEG_CHECK_ALL_ENTRIES  (1 << 3)
 #define  MMU_CFG_ABORT_STORE_LAST       (1 << 4)
+#define  MMU_CFG_CLR_ABORT              (1 << 5)
+
 #define BPMP_CACHE_MMU_CMD              0xB0
 #define  MMU_CMD_NOP                    0
 #define  MMU_CMD_INIT                   1
 #define  MMU_CMD_COPY_SHADOW            2
+
 #define BPMP_CACHE_MMU_ABORT_STAT       0xB4
+#define  ABORT_STAT_UNIT_MASK           0x7
+#define  ABORT_STAT_UNIT_NONE           0
+#define  ABORT_STAT_UNIT_CACHE          1
+#define  ABORT_STAT_UNIT_SEQ            2
+#define  ABORT_STAT_UNIT_TLB            3
+#define  ABORT_STAT_UNIT_SEG            4
+#define  ABORT_STAT_UNIT_FALLBACK       5
+#define  ABORT_STAT_OVERLAP             (1 << 3)
+#define  ABORT_STAT_ENTRY               (0x1F << 4)
+#define  ABORT_STAT_TYPE_MASK           (3 << 16)
+#define  ABORT_STAT_TYPE_EXE            (0 << 16)
+#define  ABORT_STAT_TYPE_RD             (1 << 16)
+#define  ABORT_STAT_TYPE_WR             (2 << 16)
+#define  ABORT_STAT_SIZE                (3 << 18)
+#define  ABORT_STAT_SEQ                 (1 << 20)
+#define  ABORT_STAT_PROT                (1 << 21)
+
 #define BPMP_CACHE_MMU_ABORT_ADDR       0xB8
 #define BPMP_CACHE_MMU_ACTIVE_ENTRIES   0xBC

-#define BPMP_MMU_SHADOW_ENTRY_BASE     (BPMP_CACHE_BASE + 0x400)
-#define BPMP_MMU_MAIN_ENTRY_BASE       (BPMP_CACHE_BASE + 0x800)
-#define  MMU_ENTRY_ADDR_MASK           0xFFFFFFE0
-
-#define  MMU_EN_CACHED                (1 << 0)
-#define  MMU_EN_EXEC                  (1 << 1)
-#define  MMU_EN_READ                  (1 << 2)
-#define  MMU_EN_WRITE                 (1 << 3)
+#define BPMP_MMU_SHADOW_ENTRY_BASE      (BPMP_CACHE_BASE + 0x400)
+#define BPMP_MMU_MAIN_ENTRY_BASE        (BPMP_CACHE_BASE + 0x800)
+#define  MMU_EN_CACHED                  (1 << 0)
+#define  MMU_EN_EXEC                    (1 << 1)
+#define  MMU_EN_READ                    (1 << 2)
+#define  MMU_EN_WRITE                   (1 << 3)

 bpmp_mmu_entry_t mmu_entries[] =
 {
@@ -81,15 +126,15 @@ bpmp_mmu_entry_t mmu_entries[] =

 void bpmp_mmu_maintenance(u32 op, bool force)
 {
-	if (!force && !(BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE))
+	if (!force && !(BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE_CACHE))
 		return;

-	BPMP_CACHE_CTRL(BPMP_CACHE_INT_CLEAR) = INT_CLR_MAINT_DONE;
+	BPMP_CACHE_CTRL(BPMP_CACHE_INT_CLEAR) = INT_MAINT_DONE;

 	// This is a blocking operation.
 	BPMP_CACHE_CTRL(BPMP_CACHE_MAINT_REQ) = MAINT_REQ_WAY_BITMAP(0xF) | op;

-	while(!(BPMP_CACHE_CTRL(BPMP_CACHE_INT_RAW_EVENT) & INT_RAW_EVENT_MAINT_DONE))
+	while(!(BPMP_CACHE_CTRL(BPMP_CACHE_INT_RAW_EVENT) & INT_MAINT_DONE))
 		;

 	BPMP_CACHE_CTRL(BPMP_CACHE_INT_CLEAR) = BPMP_CACHE_CTRL(BPMP_CACHE_INT_RAW_EVENT);
@@ -104,8 +149,8 @@ void bpmp_mmu_set_entry(int idx, bpmp_mmu_entry_t *entry, bool apply)

 	if (entry->enable)
 	{
-		mmu_entry->min_addr = entry->min_addr & MMU_ENTRY_ADDR_MASK;
-		mmu_entry->max_addr = entry->max_addr & MMU_ENTRY_ADDR_MASK;
+		mmu_entry->start_addr = ALIGN(entry->start_addr, BPMP_MMU_CACHE_LINE_SIZE);
+		mmu_entry->end_addr = ALIGN_DOWN(entry->end_addr, BPMP_MMU_CACHE_LINE_SIZE);
 		mmu_entry->attr = entry->attr;

 		BPMP_CACHE_CTRL(BPMP_CACHE_MMU_SHADOW_COPY_MASK) |= (1 << idx);
@@ -117,7 +162,7 @@ void bpmp_mmu_set_entry(int idx, bpmp_mmu_entry_t *entry, bool apply)

 void bpmp_mmu_enable()
 {
-	if (BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE)
+	if (BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE_CACHE)
 		return;

 	// Init BPMP MMU.
@@ -136,7 +181,8 @@ void bpmp_mmu_enable()
 	bpmp_mmu_maintenance(BPMP_MMU_MAINT_INVALID_WAY, true);

 	// Enable cache.
-	BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) = CFG_ENABLE | CFG_FORCE_WRITE_THROUGH | CFG_TAG_CHK_ABRT_ON_ERR;
+	BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) = CFG_ENABLE_CACHE | CFG_FORCE_WRITE_THROUGH |
+		CFG_MMU_TAG_MODE(TAG_MODE_PARALLEL) | CFG_TAG_CHK_ABRT_ON_ERR;

 	// HW bug. Invalidate cache again.
 	bpmp_mmu_maintenance(BPMP_MMU_MAINT_INVALID_WAY, false);
@@ -144,7 +190,7 @@ void bpmp_mmu_enable()

 void bpmp_mmu_disable()
 {
-	if (!(BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE))
+	if (!(BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE_CACHE))
 		return;

 	// Clean and invalidate cache.
@@ -154,7 +200,10 @@ void bpmp_mmu_disable()
 	BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) = 0;
 }

-const u8 pllc4_divn[] = {
+// APB clock affects RTC, PWM, MEMFETCH, APE, USB, SOR PWM,
+// I2C host, DC/DSI/DISP. UART gives extra stress.
+// 92: 100% success ratio. 93-94: 595-602MHz has 99% success ratio. 95: 608MHz less.
+const u8 pll_divn[] = {
 	0,   // BPMP_CLK_NORMAL:      408MHz  0% - 136MHz APB.
 	85,  // BPMP_CLK_HIGH_BOOST:  544MHz 33% - 136MHz APB.
 	90,  // BPMP_CLK_SUPER_BOOST: 576MHz 41% - 144MHz APB.
@@ -165,6 +214,28 @@ const u8 pllc4_divn[] = {

 bpmp_freq_t bpmp_clock_set = BPMP_CLK_NORMAL;

+void bpmp_clk_rate_get()
+{
+	bool clk_src_is_pllp = ((CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) >> 4) & 7) == 3;
+
+	if (clk_src_is_pllp)
+		bpmp_clock_set = BPMP_CLK_NORMAL;
+	else
+	{
+		bpmp_clock_set = BPMP_CLK_HIGH_BOOST;
+
+		u8 pll_divn_curr = (CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) >> 10) & 0xFF;
+		for (u32 i = 1; i < sizeof(pll_divn); i++)
+		{
+			if (pll_divn[i] == pll_divn_curr)
+			{
+				bpmp_clock_set = i;
+				break;
+			}
+		}
+	}
+}
+
 void bpmp_clk_rate_set(bpmp_freq_t fid)
 {
 	if (fid > (BPMP_CLK_MAX - 1))
@@ -179,37 +250,26 @@ void bpmp_clk_rate_set(bpmp_freq_t fid)
 		{
 			// Restore to PLLP source during PLLC4 configuration.
 			CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) = 0x20003333; // PLLP_OUT.
-			// Wait a bit for clock source change.
-			msleep(10);
+			msleep(1); // Wait a bit for clock source change.
 		}

-		CLOCK(CLK_RST_CONTROLLER_PLLC4_MISC) = PLLC4_MISC_EN_LCKDET;
-		CLOCK(CLK_RST_CONTROLLER_PLLC4_BASE) = 4 | (pllc4_divn[fid] << 8) | PLL_BASE_ENABLE; // DIVM: 4, DIVP: 1.
+		// Configure and enable PLLC.
+		clock_enable_pllc(pll_divn[fid]);

-		while (!(CLOCK(CLK_RST_CONTROLLER_PLLC4_BASE) & PLLC4_BASE_LOCK))
-			;
-
-		CLOCK(CLK_RST_CONTROLLER_PLLC4_OUT) = (1 << 8) | PLLC4_OUT3_CLKEN; // 1.5 div.
-		CLOCK(CLK_RST_CONTROLLER_PLLC4_OUT) |= PLLC4_OUT3_RSTN_CLR; // Get divider out of reset.
-
-		// Wait a bit for PLLC4 to stabilize.
-		msleep(10);
-		CLOCK(CLK_RST_CONTROLLER_CLK_SYSTEM_RATE) = 3; // PCLK = HCLK / 4.
-		CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) = 0x20003323; // PLLC4_OUT3.
-
-		bpmp_clock_set = fid;
+		// Set SCLK / HCLK / PCLK.
+		CLOCK(CLK_RST_CONTROLLER_CLK_SYSTEM_RATE) = 3; // PCLK = HCLK / (3 + 1). HCLK == SCLK.
+		CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) = 0x20003310; // PLLC_OUT1 for active and CLKM for idle.
 	}
 	else
 	{
-		CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) = 0x20003333; // PLLP_OUT.
+		CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) = 0x20003330; // PLLP_OUT for active and CLKM for idle.
+		msleep(1); // Wait a bit for clock source change.
+		CLOCK(CLK_RST_CONTROLLER_CLK_SYSTEM_RATE) = 2; // PCLK = HCLK / (2 + 1). HCLK == SCLK.

-		// Wait a bit for clock source change.
-		msleep(10);
-
-		CLOCK(CLK_RST_CONTROLLER_CLK_SYSTEM_RATE) = 2; // PCLK = HCLK / 3.
-		CLOCK(CLK_RST_CONTROLLER_PLLC4_BASE) &= ~PLL_BASE_ENABLE;
-		bpmp_clock_set = BPMP_CLK_NORMAL;
+		// Disable PLLC to save power.
+		clock_disable_pllc();
 	}
+	bpmp_clock_set = fid;
 }

 // The following functions halt BPMP to reduce power while sleeping.
--- a/nyx/nyx_gui/soc/bpmp.h
+++ b/nyx/nyx_gui/soc/bpmp.h
@@ -21,14 +21,24 @@

 #include "../utils/types.h"

-#define BPMP_MMU_MAINT_CLEAN_WAY   17
-#define BPMP_MMU_MAINT_INVALID_WAY 18
-#define BPMP_MMU_MAINT_CLN_INV_WAY 19
+typedef enum
+{
+	BPMP_MMU_MAINT_NOP                =  0,
+	BPMP_MMU_MAINT_CLEAN_PHY          =  1,
+	BPMP_MMU_MAINT_INVALID_PHY        =  2,
+	BPMP_MMU_MAINT_CLEAN_INVALID_PHY  =  3,
+	BPMP_MMU_MAINT_CLEAN_LINE         =  9,
+	BPMP_MMU_MAINT_INVALID_LINE       = 10,
+	BPMP_MMU_MAINT_CLEAN_INVALID_LINE = 11,
+	BPMP_MMU_MAINT_CLEAN_WAY          = 17,
+	BPMP_MMU_MAINT_INVALID_WAY        = 18,
+	BPMP_MMU_MAINT_CLN_INV_WAY        = 19
+} bpmp_maintenance_t;

 typedef struct _bpmp_mmu_entry_t
 {
-	u32 min_addr;
-	u32 max_addr;
+	u32 start_addr;
+	u32 end_addr;
 	u32 attr;
 	u32 enable;
 } bpmp_mmu_entry_t;
@@ -49,6 +59,7 @@ void bpmp_mmu_maintenance(u32 op, bool force);
 void bpmp_mmu_set_entry(int idx, bpmp_mmu_entry_t *entry, bool apply);
 void bpmp_mmu_enable();
 void bpmp_mmu_disable();
+void bpmp_clk_rate_get();
 void bpmp_clk_rate_set(bpmp_freq_t fid);
 void bpmp_usleep(u32 us);
 void bpmp_msleep(u32 ms);
--- a/nyx/nyx_gui/soc/clock.c
+++ b/nyx/nyx_gui/soc/clock.c
@@ -19,6 +19,17 @@
 #include "../utils/util.h"
 #include "../storage/sdmmc.h"

+/*
+ * CLOCK Peripherals:
+ * L   0 -  31
+ * H  32 -  63
+ * U  64 -  95
+ * V  96 - 127
+ * W 128 - 159
+ * X 160 - 191
+ * Y 192 - 223
+ */
+
 /* clock_t: reset, enable, source, index, clk_src, clk_div */

 static const clock_t _clock_uart[] = {
@@ -29,7 +40,7 @@ static const clock_t _clock_uart[] = {
 /* UART E */ { CLK_RST_CONTROLLER_RST_DEVICES_Y, CLK_RST_CONTROLLER_CLK_OUT_ENB_Y, CLK_RST_CONTROLLER_CLK_SOURCE_UARTAPE, 20, 0, 2 }
 };

-//I2C default parameters - TLOW: 4, THIGH: 2, DEBOUNCE: 0 FM_DIV: 26.
+//I2C default parameters - TLOW: 4, THIGH: 2, DEBOUNCE: 0, FM_DIV: 26.
 static const clock_t _clock_i2c[] = {
 /* I2C1 */ { CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_I2C1, 12, 0, 19 }, //20.4MHz -> 100KHz
 /* I2C2 */ { CLK_RST_CONTROLLER_RST_DEVICES_H, CLK_RST_CONTROLLER_CLK_OUT_ENB_H, CLK_RST_CONTROLLER_CLK_SOURCE_I2C2, 22, 0, 4  }, //81.6MHz -> 400KHz
@@ -228,6 +239,51 @@ void clock_disable_pwm()
 	clock_disable(&_clock_pwm);
 }

+void clock_enable_pllc(u32 divn)
+{
+	u8 pll_divn_curr = (CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) >> 10) & 0xFF;
+
+	// Check if already enabled and configured.
+	if ((CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) & PLLCX_BASE_ENABLE) && (pll_divn_curr == divn))
+		return;
+
+	// Take PLLC out of reset and set basic misc parameters.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_MISC) = 
+		((CLOCK(CLK_RST_CONTROLLER_PLLC_MISC) & 0xFFF0000F) & ~PLLC_MISC_RESET) | (0x80000 << 4); // PLLC_EXT_FRU.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_MISC_2) |= 0xF0 << 8; // PLLC_FLL_LD_MEM.
+
+	// Disable PLL and IDDQ in case they are on.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) &= ~PLLCX_BASE_ENABLE;
+	CLOCK(CLK_RST_CONTROLLER_PLLC_MISC_1) &= ~PLLC_MISC1_IDDQ;
+	usleep(10);
+
+	// Set PLLC4 dividers.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) = (divn << 10) | 4; // DIVM: 4, DIVP: 1.
+
+	// Enable PLLC4 and wait for Phase and Frequency lock.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) |= PLLCX_BASE_ENABLE;
+	while (!(CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) & PLLCX_BASE_LOCK))
+		;
+
+	// Disable PLLC_OUT1, enable reset and set div to 1.5.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_OUT) = (1 << 8);
+
+	// Enable PLLC_OUT1 and bring it out of reset.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_OUT) |= (PLLC_OUT1_CLKEN | PLLC_OUT1_RSTN_CLR);
+	msleep(1); // Wait a bit for PLL to stabilize.
+}
+
+void clock_disable_pllc()
+{
+	// Disable PLLC and PLLC_OUT1.
+	CLOCK(CLK_RST_CONTROLLER_PLLC_OUT) &= ~(PLLC_OUT1_CLKEN | PLLC_OUT1_RSTN_CLR);
+	CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) &= ~PLLCX_BASE_ENABLE;
+	CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) |= PLLCX_BASE_REF_DIS;
+	CLOCK(CLK_RST_CONTROLLER_PLLC_MISC_1) |= PLLC_MISC1_IDDQ;
+	CLOCK(CLK_RST_CONTROLLER_PLLC_MISC) |= PLLC_MISC_RESET;
+	usleep(10);
+}
+
 #define L_SWR_SDMMC1_RST (1 << 14)
 #define L_SWR_SDMMC2_RST (1 << 9)
 #define L_SWR_SDMMC4_RST (1 << 15)
--- a/nyx/nyx_gui/soc/clock.h
+++ b/nyx/nyx_gui/soc/clock.h
@@ -35,7 +35,9 @@
 #define CLK_RST_CONTROLLER_MISC_CLK_ENB 0x48
 #define CLK_RST_CONTROLLER_OSC_CTRL 0x50
 #define CLK_RST_CONTROLLER_PLLC_BASE 0x80
+#define CLK_RST_CONTROLLER_PLLC_OUT 0x84
 #define CLK_RST_CONTROLLER_PLLC_MISC 0x88
+#define CLK_RST_CONTROLLER_PLLC_MISC_1 0x8C
 #define CLK_RST_CONTROLLER_PLLM_BASE 0x90
 #define CLK_RST_CONTROLLER_PLLM_MISC1 0x98
 #define CLK_RST_CONTROLLER_PLLM_MISC2 0x9C
@@ -119,6 +121,7 @@
 #define CLK_RST_CONTROLLER_SPARE_REG0 0x55C
 #define CLK_RST_CONTROLLER_PLLC4_BASE 0x5A4
 #define CLK_RST_CONTROLLER_PLLC4_MISC 0x5A8
+#define CLK_RST_CONTROLLER_PLLC_MISC_2 0x5D0
 #define CLK_RST_CONTROLLER_PLLC4_OUT 0x5E4
 #define CLK_RST_CONTROLLER_PLLMB_BASE 0x5E8
 #define CLK_RST_CONTROLLER_CLK_SOURCE_DSIA_LP 0x620
@@ -133,10 +136,16 @@
 #define CLK_NO_SOURCE 0x0

 /*! PLL control and status bits */
-#define PLL_BASE_ENABLE      (1 << 30)
+#define PLLCX_BASE_ENABLE    (1 << 30)
+#define PLLCX_BASE_REF_DIS   (1 << 29)
+#define PLLCX_BASE_LOCK      (1 << 27)
+
+#define PLLC_MISC_RESET      (1 << 30)
+#define PLLC_MISC1_IDDQ      (1 << 27)
+#define PLLC_OUT1_CLKEN      (1 << 1)
+#define PLLC_OUT1_RSTN_CLR   (1 << 0)

 #define PLLC4_MISC_EN_LCKDET (1 << 30)
-#define PLLC4_BASE_LOCK      (1 << 27)
 #define PLLC4_BASE_IDDQ      (1 << 18)
 #define PLLC4_OUT3_CLKEN     (1 << 1)
 #define PLLC4_OUT3_RSTN_CLR  (1 << 0)
@@ -181,9 +190,11 @@ void clock_enable_coresight();
 void clock_disable_coresight();
 void clock_enable_pwm();
 void clock_disable_pwm();
+void clock_enable_pllc(u32 divn);
+void clock_disable_pllc();
 void clock_sdmmc_config_clock_source(u32 *pout, u32 id, u32 val);
 void clock_sdmmc_get_card_clock_div(u32 *pout, u16 *pdivisor, u32 type);
-int clock_sdmmc_is_not_reset_and_enabled(u32 id);
+int  clock_sdmmc_is_not_reset_and_enabled(u32 id);
 void clock_sdmmc_enable(u32 id, u32 val);
 void clock_sdmmc_disable(u32 id);

--- a/nyx/nyx_gui/soc/hw_init.c
+++ b/nyx/nyx_gui/soc/hw_init.c
@@ -31,6 +31,7 @@
 #include "../utils/util.h"

 extern sdmmc_t sd_sdmmc;
+extern volatile nyx_storage_t *nyx_str;

 void reconfig_hw_workaround(bool extra_reconfig, u32 magic)
 {
@@ -45,6 +46,7 @@ void reconfig_hw_workaround(bool extra_reconfig, u32 magic)
 	// Flush/disable MMU cache and set DRAM clock to 204MHz.
 	bpmp_mmu_disable();
 	minerva_change_freq(FREQ_204);
+	nyx_str->mtc_cfg.init_done = 0;

 	// Re-enable clocks to Audio Processing Engine as a workaround to hanging.
 	CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_V) |= (1 << 10); // Enable AHUB clock.
--- a/nyx/nyx_gui/soc/uart.c
+++ b/nyx/nyx_gui/soc/uart.c
@@ -31,14 +31,21 @@ void uart_init(u32 idx, u32 baud)
 	// Misc settings.
 	u32 rate = (8 * baud + 408000000) / (16 * baud);
 	uart->UART_IER_DLAB = 0; // Disable interrupts.
-	uart->UART_MCR = 0; // Disable hardware flow control.
 	uart->UART_LCR = UART_LCR_DLAB | UART_LCR_WORD_LENGTH_8; // Enable DLAB & set 8n1 mode.
 	uart->UART_THR_DLAB = (u8)rate; // Divisor latch LSB.
 	uart->UART_IER_DLAB = (u8)(rate >> 8); // Divisor latch MSB.
 	uart->UART_LCR = UART_LCR_WORD_LENGTH_8; // Disable DLAB.
+	(void)uart->UART_SPR;

 	// Setup and flush fifo.
-	uart->UART_IIR_FCR = UART_IIR_FCR_EN_FIFO | UART_IIR_FCR_RX_CLR | UART_IIR_FCR_TX_CLR;
+	uart->UART_IIR_FCR = UART_IIR_FCR_EN_FIFO;
+	(void)uart->UART_SPR;
+	usleep(20);
+	uart->UART_MCR = 0; // Disable hardware flow control.
+	usleep(96);
+	uart->UART_IIR_FCR = UART_IIR_FCR_EN_FIFO | UART_IIR_FCR_TX_CLR | UART_IIR_FCR_RX_CLR;
+
+	// Wait 3 symbols for baudrate change.
 	usleep(3 * ((baud + 999999) / baud));
 	uart_wait_idle(idx, UART_TX_IDLE | UART_RX_IDLE);
 }
@@ -58,7 +65,7 @@ void uart_wait_idle(u32 idx, u32 which)
 	}
 }

-void uart_send(u32 idx, u8 *buf, u32 len)
+void uart_send(u32 idx, const u8 *buf, u32 len)
 {
 	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);

@@ -70,14 +77,91 @@ void uart_send(u32 idx, u8 *buf, u32 len)
 	};
 }

-void uart_recv(u32 idx, u8 *buf, u32 len)
+u32 uart_recv(u32 idx, u8 *buf, u32 len)
+{
+	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);
+	u32 timeout = get_tmr_us() + 1000;
+	u32 i;
+
+	for (i = 0; ; i++)
+	{
+		while (!(uart->UART_LSR & UART_LSR_RDR))
+		{
+			if (!len)
+			{
+				if (timeout < get_tmr_us())
+					break;
+			}
+			else if (len < i)
+				break;
+		}
+		if (timeout < get_tmr_us())
+			break;
+
+		buf[i] = uart->UART_THR_DLAB;
+		timeout = get_tmr_us() + 1000;
+	};
+
+	return i ? (len ? (i - 1) : i) : 0;
+}
+
+void uart_invert(u32 idx, bool enable, u32 invert_mask)
 {
 	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);

-	for (u32 i = 0; i != len; i++)
-	{
-		while (!(uart->UART_LSR & UART_LSR_RDR))
-			;
-		buf[i] = uart->UART_THR_DLAB;
-	};
+	if (enable)
+		uart->UART_IRDA_CSR |= invert_mask;
+	else
+		uart->UART_IRDA_CSR &= ~invert_mask;
+	(void)uart->UART_SPR;
+}
+
+u32 uart_get_IIR(u32 idx)
+{
+	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);
+
+	return uart->UART_IIR_FCR;
+}
+
+void uart_set_IIR(u32 idx)
+{
+	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);
+
+	uart->UART_IER_DLAB &= ~UART_IER_DLAB_IE_EORD;
+	(void)uart->UART_SPR;
+	uart->UART_IER_DLAB |= UART_IER_DLAB_IE_EORD;
+	(void)uart->UART_SPR;
+}
+
+void uart_empty_fifo(u32 idx, u32 which)
+{
+	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);
+
+	uart->UART_MCR = 0;
+	(void)uart->UART_SPR;
+	usleep(96);
+
+	uart->UART_IIR_FCR = UART_IIR_FCR_EN_FIFO | UART_IIR_FCR_TX_CLR | UART_IIR_FCR_RX_CLR;
+	(void)uart->UART_SPR;
+	usleep(18);
+	u32 tries = 0;
+
+	if (UART_IIR_FCR_TX_CLR & which)
+	{
+		while (tries < 10 && uart->UART_LSR & UART_LSR_TMTY)
+		{
+			tries++;
+			usleep(100);
+		}
+		tries = 0;
+	}
+
+	if (UART_IIR_FCR_RX_CLR & which)
+	{
+		while (tries < 10 && !uart->UART_LSR & UART_LSR_RDR)
+		{
+			tries++;
+			usleep(100);
+		}
+	}
 }
--- a/nyx/nyx_gui/soc/uart.h
+++ b/nyx/nyx_gui/soc/uart.h
@@ -76,7 +76,11 @@ typedef struct _uart_t

 void uart_init(u32 idx, u32 baud);
 void uart_wait_idle(u32 idx, u32 which);
-void uart_send(u32 idx, u8 *buf, u32 len);
-void uart_recv(u32 idx, u8 *buf, u32 len);
+void uart_send(u32 idx, const u8 *buf, u32 len);
+u32  uart_recv(u32 idx, u8 *buf, u32 len);
+void uart_invert(u32 idx, bool enable, u32 invert_mask);
+u32  uart_get_IIR(u32 idx);
+void uart_set_IIR(u32 idx);
+void uart_empty_fifo(u32 idx, u32 which);

 #endif
--- a/nyx/nyx_gui/thermal/fan.c
+++ b/nyx/nyx_gui/thermal/fan.c
@@ -23,14 +23,18 @@
 #include "../soc/t210.h"
 #include "../utils/util.h"

-bool fan_init = false;
-
 void set_fan_duty(u32 duty)
 {
+	static bool fan_init = false;
+	static u16 curr_duty = -1;
+
+	if (curr_duty == duty)
+		return;
+
 	if (!fan_init)
 	{
 		// Fan tachometer.
-		PINMUX_AUX(PINMUX_AUX_CAM1_PWDN) = PINMUX_PULL_UP | PINMUX_TRISTATE | PINMUX_INPUT_ENABLE | 1;
+		PINMUX_AUX(PINMUX_AUX_CAM1_PWDN) = PINMUX_TRISTATE | PINMUX_INPUT_ENABLE | PINMUX_PULL_UP | 1;
 		gpio_config(GPIO_PORT_S, GPIO_PIN_7, GPIO_MODE_GPIO);
 		gpio_output_enable(GPIO_PORT_S, GPIO_PIN_7, GPIO_OUTPUT_DISABLE);
 		gpio_write(GPIO_PORT_S, GPIO_PIN_7, GPIO_LOW);
@@ -52,7 +56,7 @@ void set_fan_duty(u32 duty)
 	// If disabled send a 0 duty.
 	if (inv_duty == 236)
 	{
-		PWM(PWM_CONTROLLER_PWM_CSR_1) = PWM_CSR_EN | (1 << 24);
+		PWM(PWM_CONTROLLER_PWM_CSR_1) = PWM_CSR_EN | (1 << 24); // Bit 24 is absolute 0%.
 		regulator_disable_5v(REGULATOR_5V_FAN);
 	}
 	else // Set PWM duty.
@@ -61,6 +65,8 @@ void set_fan_duty(u32 duty)
 		regulator_enable_5v(REGULATOR_5V_FAN);
 		PWM(PWM_CONTROLLER_PWM_CSR_1) = PWM_CSR_EN | (inv_duty << 16);
 	}
+
+	curr_duty = duty;
 }

 void get_fan_speed(u32 *duty, u32 *rpm)
--- a/nyx/nyx_gui/utils/list.h
+++ b/nyx/nyx_gui/utils/list.h
@@ -33,9 +33,10 @@
 #define LIST_FOREACH_SAFE(iter, list) \
 	for(link_t *iter = (list)->next, *safe = iter->next; iter != (list); iter = safe, safe = iter->next)

-/*! Iterate over all list members. */
+/*! Iterate over all list members and make sure that the list has at least one entry. */
 #define LIST_FOREACH_ENTRY(etype, iter, list, mn) \
-	for(etype *iter = CONTAINER_OF((list)->next, etype, mn); &iter->mn != (list); iter = CONTAINER_OF(iter->mn.next, etype, mn))
+	if ((list)->next != (list)) \
+		for(etype *iter = CONTAINER_OF((list)->next, etype, mn); &iter->mn != (list); iter = CONTAINER_OF(iter->mn.next, etype, mn))

 typedef struct _link_t
 {
--- a/nyx/nyx_gui/utils/sprintf.c
+++ b/nyx/nyx_gui/utils/sprintf.c
@@ -28,7 +28,7 @@ static void _s_putc(char c)
 	*sout_buf += 1;
 }

-static void _s_puts(const char *s)
+static void _s_puts(char *s)
 {
 	for (; *s; s++)
 		_s_putc(*s);
--- a/tools/fix_regs.py
+++ b/tools/fix_regs.py
@@ -1,4 +1,5 @@
 import re
+import sys

 def parse_defs(fname):
 	f = open(fname, "r")
Author	SHA1	Message	Date
CTCaer	3f10cc774b	Bump hekate to v5.1.2 and Nyx to v0.8.5 Additionally disable archive bit fix tool in hekate main to shave binary size. The archive bit fix in Nyx is the only maintained one and so the only one that should be used.	2020-03-03 04:42:01 +02:00
CTCaer	ac92ca220f	fan: Better thermal logic based on HOS patterns	2020-03-03 04:37:59 +02:00
CTCaer	ab8801d0de	touch: Add edge compensation Switch touch panels have a 10-15px offset around the edges. (10-1269, 10-709) / (15-1264, 15-704) This allows touch driver to report a max of 0-1279, 0-719.	2020-03-03 04:28:12 +02:00
CTCaer	f3802ec464	lists: Fix list member iteration with no entries	2020-03-03 04:24:38 +02:00
CTCaer	bc7a7bcfa0	info: Allow dumping of battery characterization table	2020-03-03 04:22:59 +02:00
CTCaer	6a52d44da6	heap: Fix edge case of reusing first node There is an edge case fixed where the whole would be freed and this would make use of a nullptr. Additionally, remove usage of reserved names for vars and add comments on how it works.	2020-03-03 04:16:20 +02:00
CTCaer	03a8a11933	Small fixes and changes - Allow printing of more log on HOS boot when LOGS are OFF. - A small name refactoring - Add battery warning symbol when battery < 3200mV	2020-03-03 04:11:13 +02:00
CTCaer	c474e35732	hos: 9.2.0 support	2020-03-03 03:32:45 +02:00
CTCaer	4c1f67d022	Fix build errors	2020-01-19 15:22:59 +02:00
CTCaer	91759aba95	r2p/update: Fix check for the 'if not forced' case This fixes the following case: When force is 0 and the payload is not hekate, the function jumps to the 'is old' check. This skips the is magic value check and only does the version check. In case the foreign payload has a low value on that offset, it causes an overwrite which is unneeded.	2020-01-17 09:35:16 +02:00
CTCaer	5a9bbaf900	fss0: Fix parsing Sept from fusee-secondary	2020-01-17 09:27:53 +02:00
CTCaer	01a767cbfa	fss0: Fix heap corruption when sept is loaded from fss	2020-01-17 09:26:13 +02:00
CTCaer	8552a7282c	ini: Fix heap corruption caused by backlight option Additionally, name all text size values so it doesn't happen again in the future.	2020-01-17 09:22:28 +02:00
CTCaer	2a161b572b	sdmmc: Set power cycle wait to 0 at boot	2020-01-17 09:19:58 +02:00
CTCaer	422852795f	ini: Remove \r stripping as is done by FatFS	2020-01-17 09:18:31 +02:00
CTCaer	4d53f21387	mtc: Clear init magic on chainload Fixes a hang caused when rebooting 2 payload from L4T with old hekate in vendor partition. L4T does not overwrite the nyx storage where the Minerva configuration is stored. This makes new Minerva parse the wrong tables from old hekate and eventually hang the RAM, which causes an exception on BPMP.	2020-01-14 23:41:15 +02:00
CTCaer	9263e2192f	nyx: Fix low battery voltage color	2020-01-07 06:50:33 +02:00
CTCaer	c99a87dd09	clock: Move PLLC config from bpmp.c to clock.c	2020-01-07 06:46:22 +02:00
CTCaer	009db77426	bpmp: Switch to PLLC for SCLK/BPMP clock source	2020-01-07 06:26:29 +02:00
CTCaer	4e5ded7cb3	Merge pull request #340 from cclauss/patch-1 Fix compatibility with python 3	2020-01-07 06:14:51 +02:00
Christian Clauss	50f31cad14	import sys for lines 17 and 34	2020-01-04 18:05:42 +01:00
CTCaer	2f43145131	uart: Add invert, get/set IIR and fifo empty functions	2019-12-16 22:16:40 +02:00
CTCaer	e3fca2bce5	uart: Add timeout and len report to uart receive	2019-12-16 22:15:21 +02:00
CTCaer	da112a0ae9	uart: Proper uart init	2019-12-16 22:12:09 +02:00
CTCaer	90060d1d83	mtc: Don't rely on clean BSS for Minerva lib	2019-12-16 22:06:13 +02:00
CTCaer	1ccce5f1a2	gfx: Fix off-by-one in right half of 16px rendering	2019-12-16 21:49:54 +02:00
CTCaer	8584493c7f	sept: Add support for loading sept from fss0 If `fss0=` key is detected, sept will be loaded from fusee-secondary.bin instead of `sept/sept_*`. This will negate missing sept and failed to decrypt pkg2 errors, when booting HOS, for users that forget to update sept folder.	2019-12-16 00:53:22 +02:00
CTCaer	9b2d906648	hos: Add message for possible cause of unk pkg1	2019-12-14 22:43:00 +02:00
CTCaer	2aaa0331ac	rtc: Add epoch convertion functions Thanks @shchmue for the HOS conversion	2019-12-14 22:27:07 +02:00
CTCaer	7604239237	bpmp: Update driver to latest	2019-12-14 22:21:42 +02:00