Bump hekate to v5.6.5 and Nyx to v1.1.1

Additionally, do not alloc/free heap every time status bar update must run

Makefile

@@ -47,7 +47,7 @@ OBJS += $(addprefix $(BUILDDIR)/$(TARGET)/, \
 
 # Horizon.
 OBJS += $(addprefix $(BUILDDIR)/$(TARGET)/, \
-	hos.o hos_config.o pkg1.o pkg2.o pkg2_ini_kippatch.o fss.o secmon_exo.o sept.o \
+	hos.o hos_config.o pkg1.o pkg2.o pkg2_ini_kippatch.o fss.o secmon_exo.o \
 )
 
 # Libraries.
@@ -73,8 +73,11 @@ CUSTOMDEFINES += -DGFX_INC=$(GFX_INC) -DFFCFG_INC=$(FFCFG_INC)
 # DEBUG_UART_PORT - 0: UART_A, 1: UART_B, 2: UART_C.
 #CUSTOMDEFINES += -DDEBUG_UART_BAUDRATE=115200 -DDEBUG_UART_INVERT=0 -DDEBUG_UART_PORT=0
 
+#TODO: Considering reinstating some of these when pointer warnings have been fixed.
+WARNINGS := -Wall -Wno-array-bounds -Wno-stringop-overread -Wno-stringop-overflow
+
 ARCH := -march=armv4t -mtune=arm7tdmi -mthumb -mthumb-interwork
-CFLAGS = $(ARCH) -O2 -g -nostdlib -ffunction-sections -fdata-sections -fomit-frame-pointer -fno-inline -std=gnu11 -Wall $(CUSTOMDEFINES)
+CFLAGS = $(ARCH) -O2 -g -nostdlib -ffunction-sections -fdata-sections -fomit-frame-pointer -fno-inline -std=gnu11 $(WARNINGS) $(CUSTOMDEFINES)
 LDFLAGS = $(ARCH) -nostartfiles -lgcc -Wl,--nmagic,--gc-sections -Xlinker --defsym=IPL_LOAD_ADDR=$(IPL_LOAD_ADDR)
 
 MODULEDIRS := $(wildcard modules/*)

README.md

@@ -6,33 +6,61 @@
 Custom Graphical Nintendo Switch bootloader, firmware patcher, tools, and many more.
 
 
+
+- [Features](#features)
+- [Bootloader folders and files](#bootloader-folders-and-files)
+- [Bootloader configuration](#bootloader-configuration)
+  * [hekate global Configuration keys/values](#hekate-global-configuration-keysvalues-when-entry-is-config)
+  * [Boot entry key/value combinations](#boot-entry-keyvalue-combinations)
+  * [Boot entry key/value combinations for Exosphère](#boot-entry-keyvalue-combinations-for-exosphère)
+  * [Payload storage](#payload-storage)
+  * [Nyx Configuration keys/values](#nyx-configuration-keysvalues-nyxini)
+
+
+
+## Features
+
+- **Fully Configurable and Graphical** with Touchscreen and Joycon input support
+- **Launcher Style, Background and Color Themes**
+- **HOS (Switch OS) Bootloader** -- For CFW Sys/Emu, OFW Sys and Stock Sys
+- **Android & Linux Bootloader**
+- **Payload Launcher**
+- **eMMC/emuMMC Backup/Restore Tools**
+- **SD Card Partition Manager** -- Prepares and formats SD Card for any combo of HOS (Sys/emuMMC), Android and Linux
+- **emuMMC Creation & Manager** -- Can also migrate and fix existing emuMMC
+- **Switch Android & Linux flasher**
+- **USB Mass Storage (UMS) for SD/eMMC/emuMMC** -- Converts Switch into a SD Card Reader
+- **USB Gamepad** -- Converts Switch with Joycon into a USB HID Gamepad
+- **Hardware and Peripherals info** (SoC, Fuses, RAM, Display, Touch, eMMC, SD, Battery, PSU, Charger)
+- **Many other tools** like Archive Bit Fixer, Touch Calibration, SD/eMMC Benchmark, AutoRCM enabler and more
+
+
 ## Bootloader folders and files
 
 | Folder/File              | Description                                                           |
 | ------------------------ | --------------------------------------------------------------------- |
 | bootloader               | Main folder.                                                          |
-|  \|__ bootlogo.bmp       | It is used when custom is on and no logopath found. Can be skipped.   |
-|  \|__ hekate_ipl.ini     | Main bootloader configuration and boot entries.                       |
+|  \|__ bootlogo.bmp       | It is used if no `logopath` key is found. User provided. Can be skipped. |
+|  \|__ hekate_ipl.ini     | Main bootloader configuration and boot entries in `Launch` menu.      |
+|  \|__ nyx.ini            | Nyx GUI configuration                                                 |
 |  \|__ patches.ini        | Add external patches. Can be skipped. A template can be found [here](./res/patches_template.ini) |
-|  \|__ update.bin         | If newer, it is loaded at boot. For modchips. Auto updated. Can be skipped. |
-| bootloader/ini/          | For individual inis. 'More configs...' menu. Autoboot is supported.   |
+|  \|__ update.bin         | If newer, it is loaded at boot. Normally for modchips. Auto updated and created at first boot. |
+| bootloader/ini/          | For individual inis. `More configs` menu. Autoboot is supported.   |
 | bootloader/res/          | Nyx user resources. Icons and more.                                   |
-|  \|__ background.bmp     | Nyx - custom background.                                              |
+|  \|__ background.bmp     | Nyx - Custom background. User provided.                               |
 |  \|__ icon_switch.bmp    | Nyx - Default icon for CFWs.                                          |
 |  \|__ icon_payload.bmp   | Nyx - Default icon for Payloads.                                      |
-|  \|__ icon_lakka.bmp     | Nyx - Default icon for Lakka.                                         |
-| bootloader/sys/          | For system modules.                                                   |
-|  \|__ emummc.kipm        | emuMMC KIP1 module. Important!                                        |
+| bootloader/sys/          | hekate and Nyx system modules folder.                                 |
+|  \|__ emummc.kipm        | emuMMC KIP1 module. !Important!                                       |
 |  \|__ libsys_lp0.bso     | LP0 (sleep mode) module. Important!                                   |
-|  \|__ libsys_minerva.bso | Minerva Training Cell. Used for DRAM Frequency training. Important!   |
-|  \|__ nyx.bin            | Nyx - Our GUI. Important!                                             |
-|  \|__ res.pak            | Nyx resources package. Important!                                     |
+|  \|__ libsys_minerva.bso | Minerva Training Cell. Used for DRAM Frequency training. !Important!  |
+|  \|__ nyx.bin            | Nyx - hekate's GUI. !Important!                                       |
+|  \|__ res.pak            | Nyx resources package. !Important!                                    |
+|  \|__ thk.bin            | Atmosphère Tsec Hovi Keygen. !Important!                              |
 | bootloader/screenshots/  | Folder where Nyx screenshots are saved                                |
-| bootloader/payloads/     | For payloads. 'Payloads...' menu. Autoboot only supported by including them into an ini. All CFW bootloaders, tools, Linux payloads are supported. |
-| bootloader/libtools/     | Future reserved                                                       |
-| sept                     | Sept folder. This must always get updated via the Atmosphère release zip. Needed for tools and booting HOS on 7.0.0 and up. Unused for booting HOS if `fss0=` key is defined. |
+| bootloader/payloads/     | For the `Payloads` menu. All CFW bootloaders, tools, Linux payloads are supported. Autoboot only supported by including them into an ini. |
+| bootloader/libtools/     | Reserved                                                              |
 
-**Note**: Sept files for booting 7.0.0 and up are expected at /sept folder at root of sd card.
 
 
 ## Bootloader configuration
@@ -43,16 +71,16 @@ The bootloader can be configured via 'bootloader/hekate_ipl.ini' (if it is prese
 There are four possible type of entries. "**[ ]**": Boot entry, "**{ }**": Caption, "**#**": Comment, "*newline*": .ini cosmetic newline.
 
 
-You can find a template [Here](./res/hekate_ipl_template.ini)
+**You can find a template [Here](./res/hekate_ipl_template.ini)**
 
 
-### Global Configuration keys/values when boot entry is **config**:
+### hekate Global Configuration keys/values (when entry is *[config]*):
 
 | Config option      | Description                                                |
 | ------------------ | ---------------------------------------------------------- |
 | autoboot=0         | 0: Disable, #: Boot entry number to auto boot.             |
 | autoboot_list=0    | 0: Read `autoboot` boot entry from hekate_ipl.ini, 1: Read from ini folder (ini files are ASCII ordered). |
-| bootwait=3         | 0: Disable (It also disables bootlogo. Having **VOL-** pressed since injection goes to menu.), #: Time to wait for **VOL-** to enter menu. |
+| bootwait=3         | 0: Disable (It also disables bootlogo. Having **VOL-** pressed since injection goes to menu.), #: Time to wait for **VOL-** to enter menu. Max: 20s. |
 | autohosoff=1       | 0: Disable, 1: If woke up from HOS via an RTC alarm, shows logo, then powers off completely, 2: No logo, immediately powers off.|
 | autonogc=1         | 0: Disable, 1: Automatically applies nogc patch if unburnt fuses found and a >= 4.0.0 HOS is booted. |
 | bootprotect=0      | 0: Disable, 1: Protect bootloader folder from being corrupted by disallowing reading or editing in HOS. |
@@ -60,7 +88,81 @@ You can find a template [Here](./res/hekate_ipl_template.ini)
 | backlight=100      | Screen backlight level. 0-255.                             |
 
 
-### Nyx Global Configuration keys/values for (nyx.ini):
+### Boot entry key/value combinations:
+
+| Config option          | Description                                                |
+| ---------------------- | ---------------------------------------------------------- |
+| warmboot={FILE path}   | Replaces the warmboot binary                               |
+| secmon={FILE path}     | Replaces the security monitor binary                       |
+| kernel={FILE path}     | Replaces the kernel binary                                 |
+| kip1={FILE path}       | Replaces/Adds kernel initial process. Multiple can be set. |
+| kip1={FOLDER path}/*   | Loads every .kip/.kip1 inside a folder. Compatible with single kip1 keys. |
+| fss0={FILE path}       | Takes an Atmosphere `package3` binary (formerly fusee-secondary.bin) and `extracts` all needed parts from it. kips, exosphere, warmboot and mesophere if enabled. |
+| fss0experimental=1     | Enables loading of experimental content from a FSS0 storage |
+| exofatal={FILE path}   | Replaces the exosphere fatal binary for Mariko             |
+| ---------------------- | ---------------------------------------------------------- |
+| kip1patch=patchname    | Enables a kip1 patch. Specify with multiple lines and/or in one line with `,` as separator. If actual patch is not found, a warning will show up |
+| emupath={FOLDER path}  | Forces emuMMC to use the selected one. (=emuMMC/RAW1, =emuMMC/SD00, etc). emuMMC must be created by hekate because it uses the raw_based/file_based files. |
+| emummcforce=1          | Forces the use of emuMMC. If emummc.ini is disabled or not found, then it causes an error. |
+| emummc_force_disable=1 | Disables emuMMC, if it's enabled.                           |
+| stock=1                | Disables unneeded kernel patching and CFW kips when running stock or semi-stock. `If emuMMC is enabled, emummc_force_disable=1` is required. emuMMC is not supported on stock. If additional KIPs are needed other than OFW's, you can define them with `kip1` key. No kip should be used that relies on Atmosphère patching, because it will hang. If `NOGC` is needed, use `kip1patch=nogc`. |
+| fullsvcperm=1          | Disables SVC verification (full services permission). Doesn't work with Mesosphere as kernel. |
+| debugmode=1            | Enables Debug mode. Obsolete when used with exosphere as secmon. |
+| atmosphere=1           | Enables Atmosphère patching. Not needed when `fss0` is used. |
+| ---------------------- | ---------------------------------------------------------- |
+| payload={FILE path}    | Payload launching. Tools, Android/Linux, CFW bootloaders, etc. Any key above when used with that, doesn't get into account. |
+| ---------------------- | ---------------------------------------------------------- |
+| id=IDNAME              | Identifies boot entry for forced boot via id. Max 7 chars. |
+| logopath={FILE path}   | If it exists, it will load the specified bitmap. Otherwise `bootloader/bootlogo.bmp` will be used if exists |
+| icon={FILE path}       | Force Nyx to use the icon defined here. If this is not found, it will check for a bmp named as the boot entry ([Test 2] -> `bootloader/res/Test 2.bmp`). Otherwise defaults will be used. |
+
+
+**Note1**: When using the wildcard (`/*`) with `kip1` you can still use the normal `kip1` after that to load extra single kips.
+
+**Note2**: When using FSS0 it parses exosphere, warmboot and all core kips. You can override the first 2 by using `secmon`/`warmboot` after defining `fss0`.
+You can define `kip1` to load an extra kip or many via the wildcard (`/*`) usage.
+
+**Warning**: Careful when you define *fss0 core* kips when using `fss0` or the folder (when using `/*`) includes them.
+This is in case the kips are incompatible between them. If compatible, you can override `fss0` kips with no issues (useful for testing with intermediate kip changes). In such cases, the `kip1` line must be under `fss0` line.
+
+
+### Boot entry key/value combinations for Exosphère:
+
+| Config option          | Description                                                |
+| ---------------------- | ---------------------------------------------------------- |
+| nouserexceptions=1     | Disables usermode exception handlers when paired with Exosphère. |
+| userpmu=1              | Enables user access to PMU when paired with Exosphère.     |
+| cal0blank=1            | Overrides Exosphère config `blank_prodinfo_{sys/emu}mmc`. If that key doesn't exist, `exosphere.ini` will be used. |
+| cal0writesys=1         | Overrides Exosphère config `allow_writing_to_cal_sysmmc`. If that key doesn't exist, `exosphere.ini` will be used. |
+| usb3force=1            | Overrides system settings mitm config `usb30_force_enabled`. If that key doesn't exist, `system_settings.ini` will be used. |
+
+
+**Note**: `cal0blank`, `cal0writesys`, `usb3force`, as stated override the `exosphere.ini` or `system_settings.ini`. 0: Disable, 1: Enable, Key Missing: Use original value.
+
+
+**Note2**: `blank_prodinfo_{sys/emu}mmc`, `allow_writing_to_cal_sysmmc` and `usb30_force_enabled` in `exosphere.ini` and `system_settings.ini` respectively, are the only atmosphere config keys that can affect hekate booting configuration externally, **if** the equivalent keys in hekate config are missing.
+
+
+### Payload storage:
+
+hekate has a boot storage in the binary that helps it configure it outside of BPMP enviroment:
+
+| Offset / Name           | Description                                                       |
+| ----------------------- | ----------------------------------------------------------------- |
+| '0x94' boot_cfg         | bit0: `Force AutoBoot`, bit1: `Show launch log`, bit2: `Boot from ID`, bit3: `Boot to emuMMC`. |
+| '0x95' autoboot         | If `Force AutoBoot`, 0: Force go to menu, else boot that entry.   |
+| '0x96' autoboot_list    | If `Force AutoBoot` and `autoboot` then it boots from ini folder. |
+| '0x97' extra_cfg        | When menu is forced: bit5: `Run UMS`.                             |
+| '0x98' xt_str[128]      | Depends on the set cfg bits.                                      |
+| '0x98' ums[1]           | When `Run UMS` is set, it will launch the selected UMS. 0: SD, 1: eMMC BOOT0, 2: eMMC BOOT1, 3: eMMC GPP, 4: emuMMC BOOT0, 5: emuMMC BOOT1, 6: emuMMC GPP,  |
+| '0x98' id[8]            | When `Boot from ID` is set, it will search all inis automatically and find the boot entry with that id and boot it. Must be NULL terminated. |
+| '0xA0' emummc_path[120] | When `Boot to emuMMC` is set, it will override the current emuMMC (boot entry or emummc.ini). Must be NULL terminated. |
+
+
+If the main .ini is not found, it is created on the first hekate boot and only has the `[config]` entry.
+
+
+### Nyx Configuration keys/values (nyx.ini):
 
 | Config option      | Description                                                |
 | ------------------ | ---------------------------------------------------------- |
@@ -70,78 +172,14 @@ You can find a template [Here](./res/hekate_ipl_template.ini)
 | verification=1     | 0: Disable Backup/Restore verification, 1: Sparse (block based, fast and mostly reliable), 2: Full (sha256 based, slow and 100% reliable). |
 | umsemmcrw=0        | 1: eMMC/emuMMC UMS will be mounted as writable by default. |
 | jcdisable=0        | 1: Disables Joycon driver completely.                      |
-| newpowersave=1     | 0: Timer based, 1: DRAM frequency based (Better). Use 0 if Nyx hangs. |
-
-
-### Boot entry key/value combinations:
-
-| Config option          | Description                                                |
-| ---------------------- | ---------------------------------------------------------- |
-| warmboot={SD path}     | Replaces the warmboot binary                               |
-| secmon={SD path}       | Replaces the security monitor binary                       |
-| kernel={SD path}       | Replaces the kernel binary                                 |
-| kip1={SD path}         | Replaces/Adds kernel initial process. Multiple can be set. |
-| kip1={SD folder}/*     | Loads every .kip/.kip1 inside a folder. Compatible with single kip1 keys. |
-| fss0={SD path}         | Takes a fusee-secondary binary and `extracts` all needed parts from it. kips, exosphere, warmboot and sept. |
-| fss0experimental=1     | Enables loading of experimental content from a FSS0 storage |
-| exofatal={SD path}     | Replaces the exosphere fatal binary for Mariko             |
-| kip1patch=patchname    | Enables a kip1 patch. Specify with multiple lines and/or as CSV. If not found, an error will show up |
-| fullsvcperm=1          | Disables SVC verification (full services permission)       |
-| debugmode=1            | Enables Debug mode. Obsolete when used with exosphere as secmon. |
-| atmosphere=1           | Enables Atmosphère patching.                               |
-| emupath={SD folder}    | Forces emuMMC to use the selected one. (=emuMMC/RAW1, =emuMMC/SD00, etc). emuMMC must be created by hekate because it uses the raw_based/file_based files. |
-| emummcforce=1          | Forces the use of emuMMC. If emummc.ini is disabled or not found, then it causes an error. |
-| emummc_force_disable=1 | Disables emuMMC, if it's enabled.                           |
-| stock=1                | Disables unneeded kernel patching and CFW kips when running stock or semi-stock. `If emuMMC is enabled, emummc_force_disabled=1` is required. emuMMC is not supported on stock. If additional KIPs are needed other than OFW's, you can define them with `kip1` key. No kip should be used that relies on Atmosphère patching, because it will hang. If `NOGC` is needed, use `kip1patch=nogc`. |
-| id=idname              | Identifies boot entry for forced boot via id. Max 7 chars. |
-| payload={SD path}      | Payload launching. Tools, Linux, CFW bootloaders, etc.     |
-| logopath={SD path}     | If no logopath, `bootloader/bootlogo.bmp` will be used if exists. If logopath exists, it will load the specified bitmap. |
-| icon={SD path}         | Force Nyx to use the icon defined here. If this is not found, it will check for a bmp named as the boot entry ([Test 2] -> `bootloader/res/Test 2.bmp`). Otherwise default will be used. |
-
-
-### Boot entry key/value Exosphère combinations:
-
-| Config option          | Description                                                |
-| ---------------------- | ---------------------------------------------------------- |
-| nouserexceptions=1     | Disables usermode exception handlers when paired with Exosphère. |
-| userpmu=1              | Enables user access to PMU when paired with Exosphère.     |
-| cal0blank=1            | Overrides Exosphère config `blank_prodinfo_{sys/emu}mmc`. If that key doesn't exist, `exosphere.ini` will be used. |
-| cal0writesys=1         | Overrides Exosphère config `allow_writing_to_cal_sysmmc`. If that key doesn't exist, `exosphere.ini` will be used. |
-
-
-**Note1**: When using the wildcard (`/*`) with `kip1` you can still use the normal `kip1` after that to load extra single kips.
-
-**Note2**: When using FSS0 it parses exosphere, warmboot and all core kips. You can override the first 2 by using `secmon`/`warmboot` after defining `fss0`.
-You can define `kip1` to load an extra kip or many via the wildcard (`/*`) usage.
-
-**Warning**: Never define *fss0 core* kips when using `fss0` and make sure that the folder (when using `/*`), does not include them.
-This is in case the kips are incompatible between them. If compatible, you can override `fss0` kips with no issues (useful for testing with intermediate kip changes).
-
-
-### Payload storage:
-
-hekate has a boot storage in the binary that helps it configure it outside of BPMP enviroment:
-
-| Offset / Name           | Description                                                       |
-| ----------------------- | ----------------------------------------------------------------- |
-| '0x94' boot_cfg         | bit0: `Force AutoBoot`, bit1: `Show launch log`, bit2: `Boot from ID`, bit3: `Boot to emuMMC`, bit7: `sept run`. |
-| '0x95' autoboot         | If `Force AutoBoot`: 0: Force go to menu, else boot that entry.   |
-| '0x96' autoboot_list    | If `Force AutoBoot` and `autoboot` then it boots from ini folder. |
-| '0x97' extra_cfg        | When menu is forced: bit5: `Run UMS`, bit7: `Run Dump pkg1/2`.    |
-| '0x98' xt_str[128]      | Depends on the set cfg bits.                                      |
-| '0x98' ums[1]           | When `Run UMS` is set, it will launch the selected UMS. 0: SD, 1: eMMC BOOT0, 2: eMMC BOOT1, 3: eMMC GPP, 4: emuMMC BOOT0, 5: emuMMC BOOT1, 6: emuMMC GPP,  |
-| '0x98' id[8]            | When `Boot from ID` is set, it will search all inis automatically and find the boot entry with that id and boot it. Must be NULL terminated. |
-| '0xA0' emummc_path[120] | When `Boot to emuMMC` is set, it will override the current emuMMC (boot entry or emummc.ini). Must be NULL terminated. |
-
-
-If the main .ini is not found, it is created on the first hekate boot.
+| bpmpclock=1        | 0: Auto, 1: Faster, 2: Fast. Use 2 if Nyx hangs or some functions like UMS/Backup Verification fail. |
 
 
 ```
 hekate  (c) 2018,      naehrwert, st4rk.
-        (c) 2018-2020, CTCaer.
+        (c) 2018-2021, CTCaer.
 
-Nyx GUI (c) 2019-2020, CTCaer.
+Nyx GUI (c) 2019-2021, CTCaer.
 
 Thanks to: derrek, nedwill, plutoo, shuffle2, smea, thexyz, yellows8.
 Greetings to: fincs, hexkyz, SciresM, Shiny Quagsire, WinterMute.

README_BOOTLOGO.md

@@ -11,6 +11,7 @@ Lastly, the supported format is 32-bit (ARGB) BMP. Classic 24-bit (RGB) BMPs are
 
 ## How to configure
 
-If the custom logo option is enabled, it will try to load /bootlogo.bmp. If this is not found, the default hekate's logo will be used.
+If a boot entry specifies a custom logo path (`logopath=`), this is one will be loaded.
 
-If a boot entry specifies a custom logo path, this is one will be loaded. Again if this is not found, bootlogo.bmp will be loaded and if that fails, hekate's built-in will be used.
+If the above is not found or the format is not correct, it will try to load `bootloader/bootlogo.bmp`.
+If this is not found, the default hekate logo will be used.

Versions.inc

@@ -1,11 +1,11 @@
 # IPL Version.
 BLVERSION_MAJOR := 5
-BLVERSION_MINOR := 5
-BLVERSION_HOTFX := 4
+BLVERSION_MINOR := 6
+BLVERSION_HOTFX := 5
 BLVERSION_RSVD := 0
 
 # Nyx Version.
 NYXVERSION_MAJOR := 1
-NYXVERSION_MINOR := 0
+NYXVERSION_MINOR := 1
 NYXVERSION_HOTFX := 1
 NYXVERSION_RSVD := 0

bdk/display/di.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (c) 2018-2020 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -22,6 +22,7 @@
 #include <power/max7762x.h>
 #include <mem/heap.h>
 #include <soc/clock.h>
+#include <soc/fuse.h>
 #include <soc/gpio.h>
 #include <soc/hw_init.h>
 #include <soc/i2c.h>
@@ -35,6 +36,7 @@
 extern volatile nyx_storage_t *nyx_str;
 
 static u32 _display_id = 0;
+static bool nx_aula = false;
 
 static void _display_panel_and_hw_end(bool no_panel_deinit);
 
@@ -91,7 +93,7 @@ int display_dsi_read(u8 cmd, u32 len, void *data, bool video_enabled)
 
 		// Wait for vblank before starting the transfer.
 		DISPLAY_A(_DIREG(DC_CMD_INT_STATUS)) = DC_CMD_INT_FRAME_END_INT; // Clear interrupt.
-		while (DISPLAY_A(_DIREG(DC_CMD_INT_STATUS)) & DC_CMD_INT_FRAME_END_INT)
+		while (!(DISPLAY_A(_DIREG(DC_CMD_INT_STATUS)) & DC_CMD_INT_FRAME_END_INT))
 			;
 	}
 
@@ -134,19 +136,22 @@ int display_dsi_read(u8 cmd, u32 len, void *data, bool video_enabled)
 		case DCS_2_BYTE_SHORT_RD_RES:
 			memcpy(data, &fifo[2], 2);
 			break;
+
 		case ACK_ERROR_RES:
 		default:
 			res = 1;
 			break;
 		}
 	}
+	else
+		res = 1;
 
 	// Disable host cmd packets during video and restore host control.
 	if (video_enabled)
 	{
 		// Wait for vblank before reseting sync points.
 		DISPLAY_A(_DIREG(DC_CMD_INT_STATUS)) = DC_CMD_INT_FRAME_END_INT; // Clear interrupt.
-		while (DISPLAY_A(_DIREG(DC_CMD_INT_STATUS)) & DC_CMD_INT_FRAME_END_INT)
+		while (!(DISPLAY_A(_DIREG(DC_CMD_INT_STATUS)) & DC_CMD_INT_FRAME_END_INT))
 			;
 
 		// Reset all states of syncpt block.
@@ -181,7 +186,7 @@ void display_dsi_write(u8 cmd, u32 len, void *data, bool video_enabled)
 	host_control = DSI(_DSIREG(DSI_HOST_CONTROL));
 
 	// Enable host transfer trigger.
-	DSI(_DSIREG(DSI_HOST_CONTROL)) |= DSI_HOST_CONTROL_TX_TRIG_HOST;
+	DSI(_DSIREG(DSI_HOST_CONTROL)) = host_control | DSI_HOST_CONTROL_TX_TRIG_HOST;
 
 	switch (len)
 	{
@@ -216,8 +221,71 @@ void display_dsi_write(u8 cmd, u32 len, void *data, bool video_enabled)
 	DSI(_DSIREG(DSI_HOST_CONTROL)) = host_control;
 }
 
+void display_dsi_vblank_write(u8 cmd, u32 len, void *data)
+{
+	u8  *fifo8;
+	u32 *fifo32;
+
+	// Enable vblank interrupt.
+	DISPLAY_A(_DIREG(DC_CMD_INT_ENABLE)) = DC_CMD_INT_FRAME_END_INT;
+
+	// Use the 4th line to transmit the host cmd packet.
+	DSI(_DSIREG(DSI_VIDEO_MODE_CONTROL)) = DSI_CMD_PKT_VID_ENABLE | DSI_DSI_LINE_TYPE(4);
+
+	// Wait for vblank before starting the transfer.
+	DISPLAY_A(_DIREG(DC_CMD_INT_STATUS)) = DC_CMD_INT_FRAME_END_INT; // Clear interrupt.
+	while (!(DISPLAY_A(_DIREG(DC_CMD_INT_STATUS)) & DC_CMD_INT_FRAME_END_INT))
+		;
+
+	switch (len)
+	{
+	case 0:
+		DSI(_DSIREG(DSI_WR_DATA)) = (cmd << 8) | MIPI_DSI_DCS_SHORT_WRITE;
+		break;
+
+	case 1:
+		DSI(_DSIREG(DSI_WR_DATA)) = ((cmd | (*(u8 *)data << 8)) << 8) | MIPI_DSI_DCS_SHORT_WRITE_PARAM;
+		break;
+
+	default:
+		fifo32 = calloc(DSI_STATUS_RX_FIFO_SIZE * 8, 4);
+		fifo8 = (u8 *)fifo32;
+		fifo32[0] = (len << 8) | MIPI_DSI_DCS_LONG_WRITE;
+		fifo8[4] = cmd;
+		memcpy(&fifo8[5], data, len);
+		len += 4 + 1; // Increase length by CMD/length word and DCS CMD.
+		for (u32 i = 0; i < (ALIGN(len, 4) / 4); i++)
+			DSI(_DSIREG(DSI_WR_DATA)) = fifo32[i];
+		free(fifo32);
+		break;
+	}
+
+	// Wait for vblank before reseting sync points.
+	DISPLAY_A(_DIREG(DC_CMD_INT_STATUS)) = DC_CMD_INT_FRAME_END_INT; // Clear interrupt.
+	while (!(DISPLAY_A(_DIREG(DC_CMD_INT_STATUS)) & DC_CMD_INT_FRAME_END_INT))
+		;
+
+	// Reset all states of syncpt block.
+	DSI(_DSIREG(DSI_INCR_SYNCPT_CNTRL)) = DSI_INCR_SYNCPT_SOFT_RESET;
+	usleep(300); // Stabilization delay.
+
+	// Clear syncpt block reset.
+	DSI(_DSIREG(DSI_INCR_SYNCPT_CNTRL)) = 0;
+	usleep(300); // Stabilization delay.
+
+	// Restore video mode and host control.
+	DSI(_DSIREG(DSI_VIDEO_MODE_CONTROL)) = 0;
+
+	// Disable and clear vblank interrupt.
+	DISPLAY_A(_DIREG(DC_CMD_INT_ENABLE)) = 0;
+	DISPLAY_A(_DIREG(DC_CMD_INT_STATUS)) = DC_CMD_INT_FRAME_END_INT;
+}
+
 void display_init()
 {
+	// Get Hardware type, as it's used in various DI functions.
+	nx_aula = fuse_read_hw_type() == FUSE_NX_HW_TYPE_AULA;
+
 	// Check if display is already initialized.
 	if (CLOCK(CLK_RST_CONTROLLER_CLK_OUT_ENB_L) & BIT(CLK_L_DISP1))
 		_display_panel_and_hw_end(true);
@@ -270,22 +338,31 @@ void display_init()
 	PINMUX_AUX(PINMUX_AUX_LCD_BL_PWM) &= ~PINMUX_TRISTATE; // PULL_DOWN | 1
 	PINMUX_AUX(PINMUX_AUX_LCD_BL_EN)  &= ~PINMUX_TRISTATE; // PULL_DOWN
 
-	// Set LCD +-5V pins mode and direction
-	gpio_config(GPIO_PORT_I, GPIO_PIN_0 | GPIO_PIN_1, GPIO_MODE_GPIO);
-	gpio_output_enable(GPIO_PORT_I, GPIO_PIN_0 | GPIO_PIN_1, GPIO_OUTPUT_ENABLE);
+	if (nx_aula)
+	{
+		// Configure LCD RST pin.
+		gpio_config(GPIO_PORT_V, GPIO_PIN_2, GPIO_MODE_GPIO);
+		gpio_output_enable(GPIO_PORT_V, GPIO_PIN_2, GPIO_OUTPUT_ENABLE);
+	}
+	else
+	{
+		// Set LCD +-5V pins mode and direction
+		gpio_config(GPIO_PORT_I, GPIO_PIN_0 | GPIO_PIN_1, GPIO_MODE_GPIO);
+		gpio_output_enable(GPIO_PORT_I, GPIO_PIN_0 | GPIO_PIN_1, GPIO_OUTPUT_ENABLE);
 
-	// Enable LCD power.
-	gpio_write(GPIO_PORT_I, GPIO_PIN_0, GPIO_HIGH); // LCD +5V enable.
-	usleep(10000);
-	gpio_write(GPIO_PORT_I, GPIO_PIN_1, GPIO_HIGH); // LCD -5V enable.
-	usleep(10000);
+		// Enable LCD power.
+		gpio_write(GPIO_PORT_I, GPIO_PIN_0, GPIO_HIGH); // LCD +5V enable.
+		usleep(10000);
+		gpio_write(GPIO_PORT_I, GPIO_PIN_1, GPIO_HIGH); // LCD -5V enable.
+		usleep(10000);
 
-	// Configure Backlight PWM/EN and LCD RST pins (BL PWM, BL EN, LCD RST).
-	gpio_config(GPIO_PORT_V, GPIO_PIN_0 | GPIO_PIN_1 | GPIO_PIN_2, GPIO_MODE_GPIO);
-	gpio_output_enable(GPIO_PORT_V, GPIO_PIN_0 | GPIO_PIN_1 | GPIO_PIN_2, GPIO_OUTPUT_ENABLE);
+		// Configure Backlight PWM/EN and LCD RST pins (BL PWM, BL EN, LCD RST).
+		gpio_config(GPIO_PORT_V, GPIO_PIN_0 | GPIO_PIN_1 | GPIO_PIN_2, GPIO_MODE_GPIO);
+		gpio_output_enable(GPIO_PORT_V, GPIO_PIN_0 | GPIO_PIN_1 | GPIO_PIN_2, GPIO_OUTPUT_ENABLE);
 
-	 // Enable Backlight power.
-	gpio_write(GPIO_PORT_V, GPIO_PIN_1, GPIO_HIGH);
+		 // Enable Backlight power.
+		gpio_write(GPIO_PORT_V, GPIO_PIN_1, GPIO_HIGH);
+	}
 
 	// Power up supply regulator for display interface.
 	MIPI_CAL(_DSIREG(MIPI_CAL_MIPI_BIAS_PAD_CFG2)) = 0;
@@ -336,35 +413,18 @@ void display_init()
 	usleep(60000);
 
 	// Setup DSI device takeover timeout.
-	DSI(_DSIREG(DSI_BTA_TIMING)) = 0x50204;
+	DSI(_DSIREG(DSI_BTA_TIMING)) = nx_aula ? 0x40103 : 0x50204;
 
-#if 0
 	// Get Display ID.
-	_display_id = 0xCCCCCC; // Set initial value. 4th byte cleared.
-	display_dsi_read(MIPI_DCS_GET_DISPLAY_ID, 3, &_display_id, DSI_VIDEO_DISABLED);
-#else
-	// Drain RX FIFO.
-	_display_dsi_read_rx_fifo(NULL);
-
-	// Set reply size.
-	_display_dsi_send_cmd(MIPI_DSI_SET_MAXIMUM_RETURN_PACKET_SIZE, 3, 0);
-	_display_dsi_wait(250000, _DSIREG(DSI_TRIGGER), DSI_TRIGGER_HOST | DSI_TRIGGER_VIDEO);
-
-	// Request register read.
-	_display_dsi_send_cmd(MIPI_DSI_DCS_READ, MIPI_DCS_GET_DISPLAY_ID, 0);
-	_display_dsi_wait(250000, _DSIREG(DSI_TRIGGER), DSI_TRIGGER_HOST | DSI_TRIGGER_VIDEO);
-
-	// Transfer bus control to device for transmitting the reply.
-	DSI(_DSIREG(DSI_HOST_CONTROL)) = DSI_HOST_CONTROL_TX_TRIG_HOST | DSI_HOST_CONTROL_IMM_BTA | DSI_HOST_CONTROL_CS | DSI_HOST_CONTROL_ECC;
-	_display_dsi_wait(150000, _DSIREG(DSI_HOST_CONTROL), DSI_HOST_CONTROL_IMM_BTA);
-
-	// Wait a bit for the reply.
-	usleep(5000);
-
-	// MIPI_DCS_GET_DISPLAY_ID reply is a long read, size 3 x u32.
+	_display_id = 0xCCCCCC;
 	for (u32 i = 0; i < 3; i++)
-		_display_id = DSI(_DSIREG(DSI_RD_DATA)) & 0xFFFFFF; // Skip ack and msg type info and get the payload (display id).
-#endif
+	{
+		if (!display_dsi_read(MIPI_DCS_GET_DISPLAY_ID, 3, &_display_id, DSI_VIDEO_DISABLED))
+			break;
+
+		usleep(10000);
+	}
+
 	// Save raw Display ID to Nyx storage.
 	nyx_str->info.disp_id = _display_id;
 
@@ -374,9 +434,23 @@ void display_init()
 	if ((_display_id & 0xFF) == PANEL_JDI_XXX062M)
 		_display_id = PANEL_JDI_XXX062M;
 
+	// For Aula ensure that we have a compatible panel id.
+	if (nx_aula && _display_id == 0xCCCC)
+		_display_id = PANEL_SAM_AMS699VC01;
+
 	// Initialize display panel.
 	switch (_display_id)
 	{
+	case PANEL_SAM_AMS699VC01:
+		_display_dsi_send_cmd(MIPI_DSI_DCS_SHORT_WRITE, MIPI_DCS_EXIT_SLEEP_MODE, 180000);
+		_display_dsi_send_cmd(MIPI_DSI_DCS_SHORT_WRITE_PARAM, 0xA0, 0); // Write 0 to 0xA0.
+		_display_dsi_send_cmd(MIPI_DSI_DCS_SHORT_WRITE_PARAM, MIPI_DCS_SET_CONTROL_DISPLAY | (DCS_CONTROL_DISPLAY_BRIGHTNESS_CTRL << 8), 0); // Enable brightness control.
+		DSI(_DSIREG(DSI_WR_DATA)) = 0x339;    // MIPI_DSI_DCS_LONG_WRITE: 3 bytes.
+		DSI(_DSIREG(DSI_WR_DATA)) = 0x000051; // MIPI_DCS_SET_BRIGHTNESS 0000: 0%. FF07: 100%.
+		DSI(_DSIREG(DSI_TRIGGER)) = DSI_TRIGGER_HOST;
+		usleep(5000);
+		break;
+
 	case PANEL_JDI_XXX062M:
 		exec_cfg((u32 *)DSI_BASE, _display_init_config_jdi, 43);
 		_display_dsi_send_cmd(MIPI_DSI_DCS_SHORT_WRITE, MIPI_DCS_EXIT_SLEEP_MODE, 180000);
@@ -415,7 +489,7 @@ void display_init()
 	_display_dsi_send_cmd(MIPI_DSI_DCS_SHORT_WRITE, MIPI_DCS_SET_DISPLAY_ON, 20000);
 
 	// Configure PLLD for DISP1.
-	plld_div = (1 << 20) | (24 << 11) | 1; // DIVM: 1, DIVN: 24, DIVP: 1. PLLD_OUT: 768 MHz, PLLD_OUT0 (DSI): 234 MHz (offset).
+	plld_div = (1 << 20) | (24 << 11) | 1; // DIVM: 1, DIVN: 24, DIVP: 1. PLLD_OUT: 768 MHz, PLLD_OUT0 (DSI): 234 MHz (offset, it's ddr btw, so normally div2).
 	CLOCK(CLK_RST_CONTROLLER_PLLD_BASE) = PLLCX_BASE_ENABLE | PLLCX_BASE_LOCK | plld_div;
 
 	if (tegra_t210)
@@ -465,6 +539,9 @@ void display_init()
 
 void display_backlight_pwm_init()
 {
+	if (_display_id == PANEL_SAM_AMS699VC01)
+		return;
+
 	clock_enable_pwm();
 
 	PWM(PWM_CONTROLLER_PWM_CSR_0) = PWM_CSR_EN; // Enable PWM and set it to 25KHz PFM. 29.5KHz is stock.
@@ -478,20 +555,27 @@ void display_backlight(bool enable)
 	gpio_write(GPIO_PORT_V, GPIO_PIN_0, enable ? GPIO_HIGH : GPIO_LOW); // Backlight PWM GPIO.
 }
 
-void display_backlight_brightness(u32 brightness, u32 step_delay)
+void display_dsi_backlight_brightness(u32 brightness)
+{
+	// Normalize brightness value by 82% and a base of 45 duty.
+	if (brightness)
+		brightness = (brightness * PANEL_OLED_BL_COEFF / 100) + PANEL_OLED_BL_OFFSET;
+
+	u16 bl_ctrl = byte_swap_16((u16)(brightness * 8));
+	display_dsi_vblank_write(MIPI_DCS_SET_BRIGHTNESS, 2, &bl_ctrl);
+}
+
+void display_pwm_backlight_brightness(u32 brightness, u32 step_delay)
 {
 	u32 old_value = (PWM(PWM_CONTROLLER_PWM_CSR_0) >> 16) & 0xFF;
 	if (brightness == old_value)
 		return;
 
-	if (brightness > 255)
-		brightness = 255;
-
 	if (old_value < brightness)
 	{
 		for (u32 i = old_value; i < brightness + 1; i++)
 		{
-			PWM(PWM_CONTROLLER_PWM_CSR_0) = PWM_CSR_EN | (i << 16); // Enable PWM and set it to 25KHz PFM.
+			PWM(PWM_CONTROLLER_PWM_CSR_0) = PWM_CSR_EN | (i << 16);
 			usleep(step_delay);
 		}
 	}
@@ -499,7 +583,7 @@ void display_backlight_brightness(u32 brightness, u32 step_delay)
 	{
 		for (u32 i = old_value; i > brightness; i--)
 		{
-			PWM(PWM_CONTROLLER_PWM_CSR_0) = PWM_CSR_EN | (i << 16); // Enable PWM and set it to 25KHz PFM.
+			PWM(PWM_CONTROLLER_PWM_CSR_0) = PWM_CSR_EN | (i << 16);
 			usleep(step_delay);
 		}
 	}
@@ -507,6 +591,22 @@ void display_backlight_brightness(u32 brightness, u32 step_delay)
 		PWM(PWM_CONTROLLER_PWM_CSR_0) = 0;
 }
 
+void display_backlight_brightness(u32 brightness, u32 step_delay)
+{
+	if (brightness > 255)
+		brightness = 255;
+
+	if (_display_id != PANEL_SAM_AMS699VC01)
+		display_pwm_backlight_brightness(brightness, step_delay);
+	else
+		display_dsi_backlight_brightness(brightness);
+}
+
+u32 display_get_backlight_brightness()
+{
+	return ((PWM(PWM_CONTROLLER_PWM_CSR_0) >> 16) & 0xFF);
+}
+
 static void _display_panel_and_hw_end(bool no_panel_deinit)
 {
 	if (no_panel_deinit)
@@ -527,7 +627,9 @@ static void _display_panel_and_hw_end(bool no_panel_deinit)
 	// De-initialize video controller.
 	exec_cfg((u32 *)DISPLAY_A_BASE, _display_video_disp_controller_disable_config, 17);
 	exec_cfg((u32 *)DSI_BASE, _display_dsi_timing_deinit_config, 16);
-	usleep(10000);
+
+	if (_display_id != PANEL_SAM_AMS699VC01)
+		usleep(10000);
 
 	// De-initialize display panel.
 	switch (_display_id)
@@ -579,16 +681,23 @@ static void _display_panel_and_hw_end(bool no_panel_deinit)
 	}
 
 	// Blank - powerdown.
-	_display_dsi_send_cmd(MIPI_DSI_DCS_SHORT_WRITE, MIPI_DCS_ENTER_SLEEP_MODE, 50000);
+	_display_dsi_send_cmd(MIPI_DSI_DCS_SHORT_WRITE, MIPI_DCS_ENTER_SLEEP_MODE,
+		(_display_id == PANEL_SAM_AMS699VC01) ? 120000 : 50000);
 
 skip_panel_deinit:
 	// Disable LCD power pins.
-	gpio_write(GPIO_PORT_V, GPIO_PIN_2, GPIO_LOW); // LCD Reset disable.
-	usleep(10000);
-	gpio_write(GPIO_PORT_I, GPIO_PIN_1, GPIO_LOW); // LCD -5V disable.
-	usleep(10000);
-	gpio_write(GPIO_PORT_I, GPIO_PIN_0, GPIO_LOW); // LCD +5V disable.
-	usleep(10000);
+	gpio_write(GPIO_PORT_V, GPIO_PIN_2, GPIO_LOW);     // LCD Reset disable.
+
+	if (!nx_aula) // HOS uses panel id.
+	{
+		usleep(10000);
+		gpio_write(GPIO_PORT_I, GPIO_PIN_1, GPIO_LOW); // LCD -5V disable.
+		usleep(10000);
+		gpio_write(GPIO_PORT_I, GPIO_PIN_0, GPIO_LOW); // LCD +5V disable.
+		usleep(10000);
+	}
+	else
+		usleep(30000); // Aula Panel.
 
 	// Disable Display Interface specific clocks.
 	CLOCK(CLK_RST_CONTROLLER_RST_DEV_H_SET) = BIT(CLK_H_MIPI_CAL) | BIT(CLK_H_DSI);
@@ -601,9 +710,12 @@ skip_panel_deinit:
 	DSI(_DSIREG(DSI_POWER_CONTROL)) = 0;
 
 	// Switch LCD PWM backlight pin to special function mode and enable PWM0 mode.
-	gpio_config(GPIO_PORT_V, GPIO_PIN_0, GPIO_MODE_SPIO); // Backlight PWM.
-	PINMUX_AUX(PINMUX_AUX_LCD_BL_PWM) = (PINMUX_AUX(PINMUX_AUX_LCD_BL_PWM) & ~PINMUX_TRISTATE) | PINMUX_TRISTATE;
-	PINMUX_AUX(PINMUX_AUX_LCD_BL_PWM) = (PINMUX_AUX(PINMUX_AUX_LCD_BL_PWM) & ~PINMUX_FUNC_MASK) | 1; // Set PWM0 mode.
+	if (!nx_aula)
+	{
+		gpio_config(GPIO_PORT_V, GPIO_PIN_0, GPIO_MODE_SPIO); // Backlight PWM.
+		PINMUX_AUX(PINMUX_AUX_LCD_BL_PWM) = (PINMUX_AUX(PINMUX_AUX_LCD_BL_PWM) & ~PINMUX_TRISTATE) | PINMUX_TRISTATE;
+		PINMUX_AUX(PINMUX_AUX_LCD_BL_PWM) = (PINMUX_AUX(PINMUX_AUX_LCD_BL_PWM) & ~PINMUX_FUNC_MASK) | 1; // Set PWM0 mode.
+	}
 }
 
 void display_end() { _display_panel_and_hw_end(false); };
@@ -615,11 +727,18 @@ u16 display_get_decoded_panel_id()
 
 void display_set_decoded_panel_id(u32 id)
 {
+	// Get Hardware type, as it's used in various DI functions.
+	nx_aula = fuse_read_hw_type() == FUSE_NX_HW_TYPE_AULA;
+
 	// Decode Display ID.
 	_display_id = ((id >> 8) & 0xFF00) | (id & 0xFF);
 
 	if ((_display_id & 0xFF) == PANEL_JDI_XXX062M)
 		_display_id = PANEL_JDI_XXX062M;
+
+	// For Aula ensure that we have a compatible panel id.
+	if (nx_aula && _display_id == 0xCCCC)
+		_display_id = PANEL_SAM_AMS699VC01;
 }
 
 void display_color_screen(u32 color)
@@ -632,9 +751,12 @@ void display_color_screen(u32 color)
 	DISPLAY_A(_DIREG(DC_WIN_CD_WIN_OPTIONS)) = 0;
 	DISPLAY_A(_DIREG(DC_DISP_BLEND_BACKGROUND_COLOR)) = color;
 	DISPLAY_A(_DIREG(DC_CMD_STATE_CONTROL)) = (DISPLAY_A(_DIREG(DC_CMD_STATE_CONTROL)) & 0xFFFFFFFE) | GENERAL_ACT_REQ;
-	usleep(35000);
+	usleep(35000); // No need to wait on Aula.
 
-	display_backlight(true);
+	if (_display_id != PANEL_SAM_AMS699VC01)
+		display_backlight(true);
+	else
+		display_backlight_brightness(255, 0);
 }
 
 u32 *display_init_framebuffer_pitch()
@@ -644,7 +766,7 @@ u32 *display_init_framebuffer_pitch()
 
 	// This configures the framebuffer @ IPL_FB_ADDRESS with a resolution of 1280x720 (line stride 720).
 	exec_cfg((u32 *)DISPLAY_A_BASE, cfg_display_framebuffer_pitch, 32);
-	usleep(35000);
+	usleep(35000); // No need to wait on Aula.
 
 	return (u32 *)IPL_FB_ADDRESS;
 }
@@ -653,8 +775,7 @@ u32 *display_init_framebuffer_pitch_inv()
 {
 	// This configures the framebuffer @ NYX_FB_ADDRESS with a resolution of 1280x720 (line stride 720).
 	exec_cfg((u32 *)DISPLAY_A_BASE, cfg_display_framebuffer_pitch_inv, 34);
-
-	usleep(35000);
+	usleep(35000); // No need to wait on Aula.
 
 	return (u32 *)NYX_FB_ADDRESS;
 }
@@ -663,8 +784,7 @@ u32 *display_init_framebuffer_block()
 {
 	// This configures the framebuffer @ NYX_FB_ADDRESS with a resolution of 1280x720 (line stride 720).
 	exec_cfg((u32 *)DISPLAY_A_BASE, cfg_display_framebuffer_block, 34);
-
-	usleep(35000);
+	usleep(35000); // No need to wait on Aula.
 
 	return (u32 *)NYX_FB_ADDRESS;
 }

bdk/display/di.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (c) 2018-2020 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -547,17 +547,17 @@
 #define MIPI_DCS_GET_DISPLAY_ID1       0xDA // GET_DISPLAY_ID Byte0, Module Manufacturer ID.
 #define MIPI_DCS_GET_DISPLAY_ID2       0xDB // GET_DISPLAY_ID Byte1, Module/Driver Version ID.
 #define MIPI_DCS_GET_DISPLAY_ID3       0xDC // GET_DISPLAY_ID Byte2, Module/Driver ID.
-#define MIPI_DCS_GET_NUM_ERRORS        0x05
+#define MIPI_DCS_GET_NUM_ERRORS        0x05 // 1 byte.
 #define MIPI_DCS_GET_RED_CHANNEL       0x06
 #define MIPI_DCS_GET_GREEN_CHANNEL     0x07
 #define MIPI_DCS_GET_BLUE_CHANNEL      0x08
-#define MIPI_DCS_GET_DISPLAY_STATUS    0x09
-#define MIPI_DCS_GET_POWER_MODE	       0x0A
-#define MIPI_DCS_GET_ADDRESS_MODE      0x0B
-#define MIPI_DCS_GET_PIXEL_FORMAT      0x0C
-#define MIPI_DCS_GET_DISPLAY_MODE      0x0D
-#define MIPI_DCS_GET_SIGNAL_MODE       0x0E
-#define MIPI_DCS_GET_DIAGNOSTIC_RESULT 0x0F
+#define MIPI_DCS_GET_DISPLAY_STATUS    0x09 // 4 bytes.
+#define MIPI_DCS_GET_POWER_MODE	       0x0A // 1 byte. 2: DISON, 3: NORON, 4: SLPOUT, 7: BSTON.
+#define MIPI_DCS_GET_ADDRESS_MODE      0x0B // Display Access Control. 1 byte. 0: GS, 1: SS, 3: BGR.
+#define MIPI_DCS_GET_PIXEL_FORMAT      0x0C // 1 byte. 4-6: DPI.
+#define MIPI_DCS_GET_DISPLAY_MODE      0x0D // 1 byte. 0-2: GCS, 3: ALLPOFF, 4: ALLPON, 5: INVON.
+#define MIPI_DCS_GET_SIGNAL_MODE       0x0E // 1 byte. 0: EODSI, 2: DEON, 3: PCLKON, 4: VSON, 5: HSON, 7: TEON.
+#define MIPI_DCS_GET_DIAGNOSTIC_RESULT 0x0F // 1 byte. 6: FUNDT, 7: REGLD.
 #define MIPI_DCS_ENTER_SLEEP_MODE      0x10
 #define MIPI_DCS_EXIT_SLEEP_MODE       0x11
 #define MIPI_DCS_ENTER_PARTIAL_MODE    0x12
@@ -567,7 +567,7 @@
 #define MIPI_DCS_ALL_PIXELS_OFF        0x22
 #define MIPI_DCS_ALL_PIXELS_ON         0x23
 #define MIPI_DCS_SET_CONTRAST          0x25 // VCON in 40mV steps. 7-bit integer.
-#define MIPI_DCS_SET_GAMMA_CURVE       0x26
+#define MIPI_DCS_SET_GAMMA_CURVE       0x26 // 1 byte. 0-7: GC.
 #define MIPI_DCS_SET_DISPLAY_OFF       0x28
 #define MIPI_DCS_SET_DISPLAY_ON        0x29
 #define MIPI_DCS_SET_COLUMN_ADDRESS    0x2A
@@ -580,11 +580,11 @@
 #define MIPI_DCS_SET_SCROLL_AREA       0x33
 #define MIPI_DCS_SET_TEAR_OFF          0x34
 #define MIPI_DCS_SET_TEAR_ON           0x35
-#define MIPI_DCS_SET_ADDRESS_MODE      0x36
+#define MIPI_DCS_SET_ADDRESS_MODE      0x36 // Display Access Control. 1 byte. 0: GS, 1: SS, 3: BGR.
 #define MIPI_DCS_SET_SCROLL_START      0x37
 #define MIPI_DCS_EXIT_IDLE_MODE        0x38
 #define MIPI_DCS_ENTER_IDLE_MODE       0x39
-#define MIPI_DCS_SET_PIXEL_FORMAT      0x3A
+#define MIPI_DCS_SET_PIXEL_FORMAT      0x3A // 1 byte. 4-6: DPI.
 #define MIPI_DCS_WRITE_MEMORY_CONTINUE 0x3C
 #define MIPI_DCS_READ_MEMORY_CONTINUE  0x3E
 #define MIPI_DCS_GET_3D_CONTROL        0x3F
@@ -593,26 +593,34 @@
 #define MIPI_DCS_GET_SCANLINE          0x45
 #define MIPI_DCS_SET_TEAR_SCANLINE_WIDTH 0x46
 #define MIPI_DCS_GET_SCANLINE_WIDTH    0x47
-#define MIPI_DCS_SET_BRIGHTNESS        0x51 // DCS_CONTROL_DISPLAY_BRIGHTNESS_CTRL.
-#define MIPI_DCS_GET_BRIGHTNESS        0x52
-#define MIPI_DCS_SET_CONTROL_DISPLAY   0x53
-#define MIPI_DCS_GET_CONTROL_DISPLAY   0x54
-#define MIPI_DCS_SET_CABC_VALUE        0x55
-#define MIPI_DCS_GET_CABC_VALUE        0x56
-#define MIPI_DCS_SET_CABC_MIN_BRI      0x5E
-#define MIPI_DCS_GET_CABC_MIN_BRI      0x5F
+#define MIPI_DCS_SET_BRIGHTNESS        0x51 // DCS_CONTROL_DISPLAY_BRIGHTNESS_CTRL. 1 byte. 0-7: DBV.
+#define MIPI_DCS_GET_BRIGHTNESS        0x52 // 1 byte. 0-7: DBV.
+#define MIPI_DCS_SET_CONTROL_DISPLAY   0x53 // 1 byte. 2: BL, 3: DD, 5: BCTRL.
+#define MIPI_DCS_GET_CONTROL_DISPLAY   0x54 // 1 byte. 2: BL, 3: DD, 5: BCTRL.
+#define MIPI_DCS_SET_CABC_VALUE        0x55 // 1 byte. 0-32: C, 4-7: C.
+#define MIPI_DCS_GET_CABC_VALUE        0x56 // 1 byte. 0-32: C, 4-7: C.
+#define MIPI_DCS_SET_CABC_MIN_BRI      0x5E // 1 byte. 0-7: CMB.
+#define MIPI_DCS_GET_CABC_MIN_BRI      0x5F // 1 byte. 0-7: CMB.
+#define MIPI_DCS_GET_AUTO_BRI_DIAG_RES 0x68 // 1 byte. 6-7: D.
 #define MIPI_DCS_READ_DDB_START        0xA1
-#define MIPI_DCS_READ_DDB_CONTINUE     0xA8
+#define MIPI_DCS_READ_DDB_CONTINUE     0xA8 // 0x100 size.
 
 /*! MIPI DCS Panel Private CMDs. */
 #define MIPI_DCS_PRIV_UNK_A0            0xA0
 #define MIPI_DCS_PRIV_SET_POWER_CONTROL 0xB1
-#define MIPI_DCS_PRIV_SET_EXTC          0xB9
+#define MIPI_DCS_PRIV_SET_EXTC          0xB9 // Enable extended commands.
 #define MIPI_DCS_PRIV_UNK_BD            0xBD
 #define MIPI_DCS_PRIV_UNK_D5            0xD5
 #define MIPI_DCS_PRIV_UNK_D6            0xD6
 #define MIPI_DCS_PRIV_UNK_D8            0xD8
 #define MIPI_DCS_PRIV_UNK_D9            0xD9
+#define MIPI_DCS_PRIV_READ_EXTC_CMD_SPI 0xFE // Read EXTC Command In SPI. 1 byte. 0-6: EXT_SPI_CNT, 7:EXT_SP.
+#define MIPI_DCS_PRIV_SET_EXTC_CMD_REG  0xFF // EXTC Command Set enable register. 5 bytes. Pass: FF 98 06 04, PAGE.
+
+/*! MIPI DCS Panel Private CMDs PAGE 1. */
+#define MIPI_DCS_PRIV_GET_DISPLAY_ID4   0x00
+#define MIPI_DCS_PRIV_GET_DISPLAY_ID5   0x01
+#define MIPI_DCS_PRIV_GET_DISPLAY_ID6   0x02
 
 /*! MIPI DCS CMD Defines. */
 #define DCS_POWER_MODE_DISPLAY_ON           BIT(2)
@@ -644,21 +652,29 @@
 #define DCS_CONTROL_DISPLAY_DIMMING_CTRL    BIT(3)
 #define DCS_CONTROL_DISPLAY_BRIGHTNESS_CTRL BIT(5)
 
+#define PANEL_OLED_BL_COEFF  82 // 82%.
+#define PANEL_OLED_BL_OFFSET 45 // Least legible backlight duty.
+
 /* Switch Panels:
  *
  * 6.2" panels for Icosa and Iowa skus:
  * [10] 81 [26]: JDI LPM062M326A
  * [10] 96 [09]: JDI LAM062M109A
  * [20] 93 [0F]: InnoLux P062CCA-AZ1 (Rev A1)
- * [20] 95 [0F]: InnoLux P062CCA-AZ2
- * [20] 96 [0F]: InnoLux P062CCA-AZ3
+ * [20] 95 [0F]: InnoLux P062CCA-AZ2 (Rev B1)
+ * [20] 96 [0F]: InnoLux P062CCA-AZ3 [UNCONFIRMED MODEL REV]
+ * [20] 98 [0F]: InnoLux P062CCA-??? [UNCONFIRMED MODEL REV]
  * [30] 94 [0F]: AUO A062TAN01 (59.06A33.001)
  * [30] 95 [0F]: AUO A062TAN02 (59.06A33.002)
+ * [30] XX [0F]: AUO A062TAN03 (59.06A33.003) [UNCONFIRMED ID]
  *
  * 5.5" panels for Hoag skus:
  * [20] 94 [10]: InnoLux 2J055IA-27A (Rev B1)
- * [30] XX [10]: AUO A055TAN01 (59.05A30.001) [UNCONFIRMED ID]
+ * [30] 93 [10]: AUO A055TAN01 (59.05A30.001)
  * [40] XX [10]: Vendor 40 [UNCONFIRMED ID]
+ *
+ * 7.0" OLED panels for Aula skus:
+ * [50] 9B [20]: Samsung AMS699VC01-0 (Rev 2.5)
  */
 
 /* Display ID Decoding:
@@ -671,13 +687,13 @@
  * 10h: Japan Display Inc.
  * 20h: InnoLux Corporation
  * 30h: AU Optronics
- * 40h: Unknown1
- * 50h: Unknown2 (OLED? Samsung? LG?)
+ * 40h: Unknown0
+ * 50h: Samsung
  *
  * Boards, Panel Size:
  * 0Fh: Icosa/Iowa, 6.2"
  * 10h: Hoag,       5.5"
- * 20h: Unknown,    x.x"
+ * 20h: Aula,       7.0"
  */
 
 enum
@@ -689,7 +705,8 @@ enum
 	PANEL_AUO_A062TAN01   = 0x0F30,
 	PANEL_INL_2J055IA_27A = 0x1020,
 	PANEL_AUO_A055TAN01   = 0x1030,
-	PANEL_V40_55_UNK      = 0x1040
+	PANEL_V40_55_UNK      = 0x1040,
+	PANEL_SAM_AMS699VC01  = 0x2050
 };
 
 void display_init();
@@ -706,6 +723,7 @@ void display_color_screen(u32 color);
 /*! Switches screen backlight ON/OFF. */
 void display_backlight(bool enable);
 void display_backlight_brightness(u32 brightness, u32 step_delay);
+u32  display_get_backlight_brightness();
 
 /*! Init display in full 1280x720 resolution (B8G8R8A8, line stride 768, framebuffer size = 1280*768*4 bytes). */
 u32 *display_init_framebuffer_pitch();

bdk/display/di.inl

@@ -200,10 +200,10 @@ static const cfg_op_t _display_dsi_init_config_part6[14] = {
 
 //DSI panel config.
 static const cfg_op_t _display_init_config_jdi[43] = {
-	{DSI_WR_DATA, 0x439},      // MIPI_DSI_DCS_LONG_WRITE: 4 bytes.
+	{DSI_WR_DATA, 0x0439},     // MIPI_DSI_DCS_LONG_WRITE: 4 bytes.
 	{DSI_WR_DATA, 0x9483FFB9}, // MIPI_DCS_PRIV_SET_EXTC. (Pass: FF 83 94).
 	{DSI_TRIGGER, DSI_TRIGGER_HOST},
-	{DSI_WR_DATA, 0x00BD15},   // MIPI_DSI_DCS_SHORT_WRITE_PARAM: 0 to 0xBD.
+	{DSI_WR_DATA, 0xBD15},     // MIPI_DSI_DCS_SHORT_WRITE_PARAM: 0 to 0xBD.
 	{DSI_TRIGGER, DSI_TRIGGER_HOST},
 	{DSI_WR_DATA, 0x1939},     // MIPI_DSI_DCS_LONG_WRITE: 25 bytes.
 	{DSI_WR_DATA, 0xAAAAAAD8}, // Register: 0xD8.

bdk/ianos/ianos.c

@@ -21,6 +21,7 @@
 #include "elfload/elfload.h"
 #include <module.h>
 #include <mem/heap.h>
+#include <power/max7762x.h>
 #include <storage/nx_sd.h>
 #include <utils/types.h>
 
@@ -43,6 +44,10 @@ static void _ianos_call_ep(moduleEntrypoint_t entrypoint, void *moduleConfig)
 	bdkParameters->memset = (memset_t)&memset;
 	bdkParameters->sharedHeap = &_heap;
 
+	// Extra functions.
+	bdkParameters->extension_magic = IANOS_EXT0;
+	bdkParameters->reg_voltage_set = (reg_voltage_set_t)&max7762x_regulator_set_voltage;
+
 	entrypoint(moduleConfig, bdkParameters);
 }
 

bdk/input/als.c

@@ -23,79 +23,117 @@
 #include <soc/pinmux.h>
 #include <utils/util.h>
 
-#define HOS_GAIN  BH1730_GAIN_64X
-#define HOS_ITIME 38
+#define BH1730_DEFAULT_GAIN        BH1730_GAIN_64X
+#define BH1730_DEFAULT_ICYCLE       38
 
-void set_als_cfg(als_table_t *als_val, u8 gain, u8 itime)
+#define BH1730_INTERNAL_CLOCK_NS   2800
+#define BH1730_ADC_CALC_DELAY_US   2000 /* BH1730_INTERNAL_CLOCK_MS * 714 */
+#define BH1730_ITIME_CYCLE_TO_US   2700 /* BH1730_INTERNAL_CLOCK_MS * 964 */
+
+#define BH1730_DEFAULT_ITIME_MS	   100
+
+#define BH1730_LUX_MULTIPLIER      3600
+#define BH1730_LUX_MULTIPLIER_AULA 1410
+
+#define BH1730_LUX_MAX            100000
+
+typedef struct _opt_win_cal_t
 {
-	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_GAIN_REG), gain);
-	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_TIMING_REG), (256 - itime));
+	u32 rc;
+	u32 cv;
+	u32 ci;
+} opt_win_cal_t;
 
-	als_val->gain = gain;
-	als_val->itime = itime;
+// Nintendo Switch Icosa/Iowa Optical Window calibration.
+const opt_win_cal_t opt_win_cal_default[] = {
+	{  500, 5002, 7502 },
+	{  754, 2250, 2000 },
+	{ 1029, 1999, 1667 },
+	{ 1373,  884,  583 },
+	{ 1879,  309,  165 }
+};
+
+// Nintendo Switch Aula Optical Window calibration.
+const opt_win_cal_t opt_win_cal_aula[] = {
+	{  231, 9697, 30300 },
+	{  993, 3333,  2778 },
+	{ 1478, 1621,  1053 },
+	{ 7500,   81,    10 }
+};
+
+const u32 als_gain_idx_tbl[4] = { 1, 2, 64, 128 };
+
+void set_als_cfg(als_ctxt_t *als_ctxt, u8 gain, u8 cycle)
+{
+	if (gain > BH1730_GAIN_128X)
+		gain = BH1730_GAIN_128X;
+
+	if (!cycle)
+		cycle = 1;
+	else if (cycle > 255)
+		cycle = 255;
+
+	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_GAIN_REG), gain);
+	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_TIMING_REG), (256 - cycle));
+
+	als_ctxt->gain = gain;
+	als_ctxt->cycle = cycle;
 }
 
-void get_als_lux(als_table_t *als_val)
+void get_als_lux(als_ctxt_t *als_ctxt)
 {
 	u32 data[2];
-	float pre_gain_lux;
-	float visible_light;
-	float ir_light;
-	float light_ratio;
+	u32 visible_light;
+	u32 ir_light;
+	u64 lux = 0;
+	u32 itime_us = BH1730_ITIME_CYCLE_TO_US * als_ctxt->cycle;
 
-	u8 adc_ready = 0;
-	u8 retries = 100;
-
-	const float als_gain_idx_tbl[4] = { 1.0, 2.0, 64.0, 128.0 };
-	const float als_norm_res = 100.0;
-	const float als_multiplier = 3.6;
-	const float als_tint = 2.7;
-
-	// Wait for ADC to prepare new data.
-	while (!(adc_ready & BH1730_CTL_ADC_VALID) && retries)
-	{
-		retries--;
-		adc_ready = i2c_recv_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_CONTROL_REG));
-	}
-
-	// Get visible and ir light raw data.
+	// Get visible and ir light raw data. Mode is continuous so waiting for new values doesn't matter.
 	data[0] = i2c_recv_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_DATA0LOW_REG)) +
 		(i2c_recv_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_DATA0HIGH_REG)) << 8);
 	data[1] = i2c_recv_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_DATA1LOW_REG)) +
 		(i2c_recv_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_DATA1HIGH_REG)) << 8);
 
-	als_val->over_limit = data[0] > 65534 || data[1] > 65534;
-	als_val->vi_light = data[0];
-	als_val->ir_light = data[1];
+	visible_light = data[0];
+	ir_light = data[1];
 
-	if (!data[0] || !retries)
+	als_ctxt->over_limit = visible_light > 65534 || ir_light > 65534;
+	als_ctxt->vi_light = visible_light;
+	als_ctxt->ir_light = ir_light;
+
+	if (!visible_light)
 	{
-		als_val->lux = 0.0;
+		als_ctxt->lux = 0;
 
 		return;
 	}
 
-	visible_light = (float)data[0];
-	ir_light = (float)data[1];
-	light_ratio = (float)data[1] / (float)data[0];
+	// Set calibration parameters.
+	u32 lux_multiplier = BH1730_LUX_MULTIPLIER;
+	u32 opt_win_cal_count = ARRAY_SIZE(opt_win_cal_default);
+	const opt_win_cal_t *opt_win_cal = opt_win_cal_default;
 
-	// The following are specific to the light filter Switch uses.
-	if (light_ratio < 0.5)
-		pre_gain_lux = visible_light * 5.002 - ir_light * 7.502;
-	else if (light_ratio < 0.754)
-		pre_gain_lux = visible_light * 2.250 - ir_light * 2.000;
-	else if (light_ratio < 1.029)
-		pre_gain_lux = visible_light * 1.999 - ir_light * 1.667;
-	else if (light_ratio < 1.373)
-		pre_gain_lux = visible_light * 0.884 - ir_light * 0.583;
-	else if (light_ratio < 1.879)
-		pre_gain_lux = visible_light * 0.309 - ir_light * 0.165;
-	else pre_gain_lux = 0.0;
+	// Apply optical window calibration coefficients.
+	for (u32 i = 0; i < opt_win_cal_count; i++)
+	{
+		if (1000 * ir_light / visible_light < opt_win_cal[i].rc)
+		{
+			lux = ((u64)opt_win_cal[i].cv * data[0]) - (opt_win_cal[i].ci * data[1]);
+			break;
+		}
+	}
 
-	als_val->lux = (pre_gain_lux / als_gain_idx_tbl[als_val->gain]) * (als_norm_res / ((float)als_val->itime * als_tint)) * als_multiplier;
+	lux *= BH1730_DEFAULT_ITIME_MS * lux_multiplier;
+	lux /= als_gain_idx_tbl[als_ctxt->gain] * itime_us;
+	lux /= 1000;
+
+	if (lux > BH1730_LUX_MAX)
+		lux = BH1730_LUX_MAX;
+
+	als_ctxt->lux = lux;
 }
 
-u8 als_init(als_table_t *als_val)
+u8 als_power_on(als_ctxt_t *als_ctxt)
 {
 	// Enable power to ALS IC.
 	max7762x_regulator_set_voltage(REGULATOR_LDO6, 2900000);
@@ -109,12 +147,10 @@ u8 als_init(als_table_t *als_val)
 	// Initialize ALS.
 	u8 id = i2c_recv_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(0x12));
 	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_SPEC(BH1730_SPECCMD_RESET), 0);
-	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_GAIN_REG), HOS_GAIN);
-	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_TIMING_REG), (256 - HOS_ITIME));
-	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_CONTROL_REG), BH1730_CTL_POWER_ON | BH1730_CTL_ADC_EN);
 
-	als_val->gain = HOS_GAIN;
-	als_val->itime = HOS_ITIME;
+	set_als_cfg(als_ctxt, BH1730_DEFAULT_GAIN, BH1730_DEFAULT_ICYCLE);
+
+	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_CONTROL_REG), BH1730_CTL_POWER_ON | BH1730_CTL_ADC_EN);
 
 	return id;
 }

bdk/input/als.h

@@ -48,18 +48,18 @@
 #define BH1730_ADDR(reg) (BH1730_CMD_MAGIC | BH1730_CMD_SETADDR | (reg))
 #define BH1730_SPEC(cmd) (BH1730_CMD_MAGIC | BH1730_CMD_SPECCMD | (cmd))
 
-typedef struct _als_table_t
+typedef struct _als_ctxt_t
 {
-	float lux;
+	u32  lux;
 	bool over_limit;
-	u32 vi_light;
-	u32 ir_light;
-	u8 gain;
-	u8 itime;
-} als_table_t;
+	u32  vi_light;
+	u32  ir_light;
+	u8   gain;
+	u8   cycle;
+} als_ctxt_t;
 
-void set_als_cfg(als_table_t *als_val, u8 gain, u8 itime);
-void get_als_lux(als_table_t *als_val);
-u8 als_init(als_table_t *als_val);
+void set_als_cfg(als_ctxt_t *als_ctxt, u8 gain, u8 cycle);
+void get_als_lux(als_ctxt_t *als_ctxt);
+u8   als_power_on(als_ctxt_t *als_ctxt);
 
 #endif /* __ALS_H_ */

bdk/input/joycon.c

@@ -1,7 +1,7 @@
 /*
  * Joy-Con UART driver for Nintendo Switch
  *
- * Copyright (c) 2019 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -463,7 +463,7 @@ static void jc_rcv_pkt(joycon_ctxt_t *jc)
 
 	// Check if device stopped sending data.
 	u32 uart_irq = uart_get_IIR(jc->uart);
-	if ((uart_irq & 0x8) != 0x8)
+	if (uart_irq != UART_IIR_REDI)
 		return;
 
 	u32 len = uart_recv(jc->uart, (u8 *)jc->buf, 0x100);
@@ -715,6 +715,10 @@ void jc_deinit()
 		jc_send_hid_cmd(UART_C, JC_HID_SUBCMD_HCI_STATE, &data, 1);
 		jc_rcv_pkt(&jc_l);
 	}
+
+	// Disable UART B and C clocks.
+	clock_disable_uart(UART_B);
+	clock_disable_uart(UART_C);
 }
 
 static void jc_init_conn(joycon_ctxt_t *jc)
@@ -881,14 +885,14 @@ void jc_init_hw()
 	pinmux_config_uart(UART_C);
 
 	// Ease the stress to APB.
-	bpmp_clk_rate_set(BPMP_CLK_NORMAL);
+	bpmp_freq_t prev_fid = bpmp_clk_rate_set(BPMP_CLK_NORMAL);
 
 	// Enable UART B and C clocks.
 	clock_enable_uart(UART_B);
 	clock_enable_uart(UART_C);
 
 	// Restore OC.
-	bpmp_clk_rate_set(BPMP_CLK_DEFAULT_BOOST);
+	bpmp_clk_rate_set(prev_fid);
 
 	// Turn Joy-Con detect on.
 	gpio_config(GPIO_PORT_G, GPIO_PIN_0, GPIO_MODE_GPIO);

bdk/input/touch.c

@@ -39,7 +39,7 @@ static touch_panel_info_t _panels[] =
 	{  1,  0, 1, 1,  "GiS GGM6 B2X"    },
 	{  2,  0, 0, 0,  "NISSHA NBF-K9A"  },
 	{  3,  1, 0, 0,  "GiS 5.5\""       },
-	{  4,  0, 0, 1,  "Unknown"         },
+	{  4,  0, 0, 1,  "Samsung BH2109"  },
 	{ -1,  1, 0, 1,  "GiS VA 6.2\""    }
 };
 
@@ -206,6 +206,7 @@ touch_panel_info_t *touch_get_panel_vendor()
 {
 	u8 buf[5] = {0};
 	u8 cmd = STMFTS_VENDOR_GPIO_STATE;
+	static touch_panel_info_t panel_info = { -2,  0, 0, 0,  ""};
 
 	if (touch_command(STMFTS_VENDOR, &cmd, 1))
 		return NULL;
@@ -220,13 +221,20 @@ touch_panel_info_t *touch_get_panel_vendor()
 			return panel;
 	}
 
-	return NULL;
+	// Touch panel not found, return current gpios.
+	panel_info.gpio0 = buf[0];
+	panel_info.gpio1 = buf[1];
+	panel_info.gpio2 = buf[2];
+
+	return &panel_info;
 }
 
 int touch_get_fw_info(touch_fw_info_t *fw)
 {
 	u8 buf[8] = {0};
 
+	memset(fw, 0, sizeof(touch_fw_info_t));
+
 	// Get fw address info.
 	u8 cmd[3] = { STMFTS_RW_FRAMEBUFFER_REG, 0, 0x60 };
 	int res = touch_read_reg(cmd, 3, buf, 3);
@@ -318,7 +326,7 @@ int touch_get_fb_info(u8 *buf)
 	int res = 0;
 
 
-	for (u32 i = 0; i < 0x10000; i+=4)
+	for (u32 i = 0; i < 0x10000; i += 4)
 	{
 		if (!res)
 		{
@@ -392,11 +400,11 @@ static int touch_init()
 
 int touch_power_on()
 {
-	// Enable LDO6 for touchscreen VDD/AVDD supply.
+	// Enable LDO6 for touchscreen AVDD supply.
 	max7762x_regulator_set_voltage(REGULATOR_LDO6, 2900000);
 	max7762x_regulator_enable(REGULATOR_LDO6, true);
 
-	// Configure touchscreen GPIO.
+	// Configure touchscreen VDD GPIO.
 	PINMUX_AUX(PINMUX_AUX_DAP4_SCLK) = PINMUX_PULL_DOWN | 1;
 	gpio_config(GPIO_PORT_J, GPIO_PIN_7, GPIO_MODE_GPIO);
 	gpio_output_enable(GPIO_PORT_J, GPIO_PIN_7, GPIO_OUTPUT_ENABLE);
@@ -410,7 +418,7 @@ int touch_power_on()
 	// Configure Touscreen and GCAsic shared GPIO.
 	PINMUX_AUX(PINMUX_AUX_CAM_I2C_SDA) = PINMUX_LPDR | PINMUX_INPUT_ENABLE | PINMUX_TRISTATE | PINMUX_PULL_UP | 2;
 	PINMUX_AUX(PINMUX_AUX_CAM_I2C_SCL) = PINMUX_IO_HV | PINMUX_LPDR | PINMUX_TRISTATE | PINMUX_PULL_DOWN | 2;
-	gpio_config(GPIO_PORT_S, GPIO_PIN_3, GPIO_MODE_GPIO);
+	gpio_config(GPIO_PORT_S, GPIO_PIN_3, GPIO_MODE_GPIO); // GC detect.
 
 	// Initialize I2C3.
 	pinmux_config_i2c(I2C_3);

bdk/input/touch.h

@@ -53,6 +53,7 @@
 #define STMFTS_RW_FRAMEBUFFER_REG      0xD0
 #define STMFTS_SAVE_CX_TUNING          0xFC
 
+#define STMFTS_DETECTION_CONFIG        0xB0
 #define STMFTS_REQU_COMP_DATA          0xB8
 #define STMFTS_VENDOR                  0xCF
 #define STMFTS_FLASH_UNLOCK            0xF7

bdk/libs/compr/lz4.c

@@ -839,10 +839,12 @@ int LZ4_compress_fast_extState_fastReset(void* state, const char* src, char* dst
 int LZ4_compress_fast(const char* source, char* dest, int inputSize, int maxOutputSize, int acceleration)
 {
     int result;
-    LZ4_stream_t ctx;
-    LZ4_stream_t* const ctxPtr = &ctx;
+    LZ4_stream_t* ctx = (LZ4_stream_t*)ALLOC(sizeof(LZ4_stream_t));
+    LZ4_stream_t* const ctxPtr = ctx;
     result = LZ4_compress_fast_extState(ctxPtr, source, dest, inputSize, maxOutputSize, acceleration);
 
+    FREEMEM(ctx);
+
     return result;
 }
 
@@ -857,13 +859,18 @@ int LZ4_compress_default(const char* source, char* dest, int inputSize, int maxO
 /* strangely enough, gcc generates faster code when this function is uncommented, even if unused */
 int LZ4_compress_fast_force(const char* source, char* dest, int inputSize, int maxOutputSize, int acceleration)
 {
-    LZ4_stream_t ctx;
-    LZ4_resetStream(&ctx);
+    int result;
+    LZ4_stream_t* ctx = (LZ4_stream_t*)ALLOC(sizeof(LZ4_stream_t));
+    LZ4_resetStream(ctx);
 
     if (inputSize < LZ4_64Klimit)
-        return LZ4_compress_generic(&ctx.internal_donotuse, source, dest, inputSize, maxOutputSize, limitedOutput, byU16,                        noDict, noDictIssue, acceleration);
+        result = LZ4_compress_generic(&ctx->internal_donotuse, source, dest, inputSize, maxOutputSize, limitedOutput, byU16,                        noDict, noDictIssue, acceleration);
     else
-        return LZ4_compress_generic(&ctx.internal_donotuse, source, dest, inputSize, maxOutputSize, limitedOutput, sizeof(void*)==8 ? byU32 : byPtr, noDict, noDictIssue, acceleration);
+        result = LZ4_compress_generic(&ctx->internal_donotuse, source, dest, inputSize, maxOutputSize, limitedOutput, sizeof(void*)==8 ? byU32 : byPtr, noDict, noDictIssue, acceleration);
+
+    FREEMEM(ctx);
+
+    return result;
 }
 
 
@@ -1045,11 +1052,13 @@ static int LZ4_compress_destSize_extState (LZ4_stream_t* state, const char* src,
 
 int LZ4_compress_destSize(const char* src, char* dst, int* srcSizePtr, int targetDstSize)
 {
-    LZ4_stream_t ctxBody;
-    LZ4_stream_t* ctx = &ctxBody;
+    LZ4_stream_t* ctxBody = (LZ4_stream_t*)ALLOC(sizeof(LZ4_stream_t));;
+    LZ4_stream_t* ctx = ctxBody;
 
     int result = LZ4_compress_destSize_extState(ctx, src, dst, srcSizePtr, targetDstSize);
 
+    FREEMEM(ctxBody);
+
     return result;
 }
 

bdk/libs/fatfs/ff.c

@@ -3274,7 +3274,6 @@ static FRESULT find_volume (	/* FR_OK(0): successful, !=0: an error occurred */
 		stat = disk_status(fs->pdrv);
 		if (!(stat & STA_NOINIT)) {		/* and the physical drive is kept initialized */
 			if (!FF_FS_READONLY && mode && (stat & STA_PROTECT)) {	/* Check write protection if needed */
-				EFSPRINTF("WPEN1");
 				return FR_WRITE_PROTECTED;
 			}
 			return FR_OK;				/* The filesystem object is valid */
@@ -3289,11 +3288,9 @@ static FRESULT find_volume (	/* FR_OK(0): successful, !=0: an error occurred */
 	fs->pdrv = LD2PD(vol);				/* Bind the logical drive and a physical drive */
 	stat = disk_initialize(fs->pdrv);	/* Initialize the physical drive */
 	if (stat & STA_NOINIT) { 			/* Check if the initialization succeeded */
-		EFSPRINTF("MDNR");
 		return FR_NOT_READY;			/* Failed to initialize due to no medium or hard error */
 	}
 	if (!FF_FS_READONLY && mode && (stat & STA_PROTECT)) { /* Check disk write protection if needed */
-		EFSPRINTF("WPEN2");
 		return FR_WRITE_PROTECTED;
 	}
 #if FF_MAX_SS != FF_MIN_SS				/* Get sector size (multiple sector size cfg only) */
@@ -3323,11 +3320,13 @@ static FRESULT find_volume (	/* FR_OK(0): successful, !=0: an error occurred */
 #if FF_SIMPLE_GPT
 	if (fmt >= 2) {
 		/* If GPT Check the first partition */
-		gpt_t gpt;
-		if (disk_read(fs->pdrv, (BYTE *)&gpt, 1, sizeof(gpt_t) / SS(fs))) return FR_DISK_ERR;
-		if (!mem_cmp(&gpt.header.signature, "EFI PART", 8)) {
+		gpt_header_t *gpt_header = (gpt_header_t *)fs->win;
+		if (move_window(fs, 1) != FR_OK) return FR_DISK_ERR;
+		if (!mem_cmp(&gpt_header->signature, "EFI PART", 8)) {
+			if (move_window(fs, gpt_header->part_ent_lba) != FR_OK) return FR_DISK_ERR;
+			gpt_entry_t *gpt_entry = (gpt_entry_t *)fs->win;
 			fs->part_type = 1;
-			bsect = gpt.entries[0].lba_start;
+			bsect = gpt_entry->lba_start;
 			fmt = bsect ? check_fs(fs, bsect) : 3;	/* Check the partition */
 		}
 	}
@@ -4710,9 +4709,9 @@ DWORD *f_expand_cltbl (
 	}
 	if (f_lseek(fp, CREATE_LINKMAP)) {	/* Create cluster link table */
 		ff_memfree(fp->cltbl);
-		fp->cltbl = NULL;
+		fp->cltbl = (void *)0;
 		EFSPRINTF("CLTBLSZ");
-		return NULL;
+		return (void *)0;
 	}
 	f_lseek(fp, 0);
 
@@ -6735,6 +6734,8 @@ int f_puts (
 	putbuff pb;
 
 
+	if (str == (void *)0) return EOF; /* String is NULL */
+
 	putc_init(&pb, fp);
 	while (*str) putc_bfd(&pb, *str++);		/* Put the string */
 	return putc_flush(&pb);
@@ -6761,6 +6762,8 @@ int f_printf (
 	TCHAR c, d, str[32], *p;
 
 
+	if (fmt == (void *)0) return EOF; /* String is NULL */
+
 	putc_init(&pb, fp);
 
 	va_start(arp, fmt);

bdk/mem/mc.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (c) 2018-2020 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -15,6 +15,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <memory_map.h>
 #include <mem/mc.h>
 #include <soc/t210.h>
 #include <soc/clock.h>
@@ -124,13 +125,13 @@ void mc_config_carveout()
 	MC(MC_SECURITY_CARVEOUT5_CFG0) = 0x8F;
 }
 
-void mc_enable_ahb_redirect()
+void mc_enable_ahb_redirect(bool full_aperture)
 {
 	// Enable ARC_CLK_OVR_ON.
 	CLOCK(CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRD) = (CLOCK(CLK_RST_CONTROLLER_LVL2_CLK_GATE_OVRD) & 0xFFF7FFFF) | 0x80000;
 	//MC(MC_IRAM_REG_CTRL) &= 0xFFFFFFFE;
 	MC(MC_IRAM_BOM) = 0x40000000;
-	MC(MC_IRAM_TOM) = 0x4003F000;
+	MC(MC_IRAM_TOM) = full_aperture ? DRAM_START : 0x4003F000;
 }
 
 void mc_disable_ahb_redirect()

bdk/mem/mc.h

@@ -23,7 +23,7 @@
 void mc_config_tsec_carveout(u32 bom, u32 size1mb, bool lock);
 void mc_config_carveout();
 void mc_config_carveout_finalize();
-void mc_enable_ahb_redirect();
+void mc_enable_ahb_redirect(bool full_aperture);
 void mc_disable_ahb_redirect();
 void mc_enable();
 

bdk/mem/minerva.c

@@ -104,21 +104,21 @@ u32 minerva_init()
 	}
 
 	mtc_cfg->rate_from = mtc_cfg->mtc_table[curr_ram_idx].rate_khz;
-	mtc_cfg->rate_to = 204000;
+	mtc_cfg->rate_to = FREQ_204;
 	mtc_cfg->train_mode = OP_TRAIN;
 	minerva_cfg(mtc_cfg, NULL);
-	mtc_cfg->rate_to = 800000;
+	mtc_cfg->rate_to = FREQ_800;
 	minerva_cfg(mtc_cfg, NULL);
-	mtc_cfg->rate_to = 1600000;
+	mtc_cfg->rate_to = FREQ_1600;
 	minerva_cfg(mtc_cfg, NULL);
 
 	// FSP WAR.
 	mtc_cfg->train_mode = OP_SWITCH;
-	mtc_cfg->rate_to = 800000;
+	mtc_cfg->rate_to = FREQ_800;
 	minerva_cfg(mtc_cfg, NULL);
 
 	// Switch to max.
-	mtc_cfg->rate_to = 1600000;
+	mtc_cfg->rate_to = FREQ_1600;
 	minerva_cfg(mtc_cfg, NULL);
 
 	return 0;
@@ -139,6 +139,23 @@ void minerva_change_freq(minerva_freq_t freq)
 	}
 }
 
+void minerva_prep_boot_freq()
+{
+	if (!minerva_cfg)
+		return;
+
+	mtc_config_t *mtc_cfg = (mtc_config_t *)&nyx_str->mtc_cfg;
+
+	// Check if there's RAM OC. If not exit.
+	if (mtc_cfg->mtc_table[mtc_cfg->table_entries - 1].rate_khz == FREQ_1600)
+		return;
+
+	// FSP WAR.
+	minerva_change_freq(FREQ_204);
+	// Scale down to 800 MHz boot freq.
+	minerva_change_freq(FREQ_800);
+}
+
 void minerva_periodic_training()
 {
 	if (!minerva_cfg)

bdk/mem/minerva.h

@@ -27,8 +27,8 @@
 
 typedef struct
 {
-	s32 rate_to;
-	s32 rate_from;
+	u32 rate_to;
+	u32 rate_from;
 	emc_table_t *mtc_table;
 	u32 table_entries;
 	emc_table_t *current_emc_table;
@@ -60,6 +60,7 @@ typedef enum
 extern void (*minerva_cfg)(mtc_config_t *mtc_cfg, void *);
 u32  minerva_init();
 void minerva_change_freq(minerva_freq_t freq);
+void minerva_prep_boot_freq();
 void minerva_periodic_training();
 
 #endif

bdk/mem/sdram.c

@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2018 naehrwert
  * Copyright (c) 2018 balika011
- * Copyright (c) 2019-2020 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -36,22 +36,46 @@
 
 #define CONFIG_SDRAM_KEEP_ALIVE
 
-//#define CONFIG_SDRAM_COMPRESS_CFG
-
 typedef struct _sdram_vendor_patch_t
 {
 	u32 val;
-	u32 addr:10;
-	u32 dramid:22;
+	u32 offset:16;
+	u32 dramcf:16;
 } sdram_vendor_patch_t;
 
-#ifdef CONFIG_SDRAM_COMPRESS_CFG
-	#include <libs/compr/lz.h>
-	#include "sdram_config_lz.inl"
-#else
-	#include "sdram_config.inl"
-#endif
+static const u8 dram_encoding_t210b01[] = {
+	LPDDR4X_UNUSED,
+	LPDDR4X_UNUSED,
+	LPDDR4X_UNUSED,
+	LPDDR4X_4GB_HYNIX_1Y_A,
+	LPDDR4X_UNUSED,
+	LPDDR4X_4GB_HYNIX_1Y_A,
+	LPDDR4X_4GB_HYNIX_1Y_A,
+	LPDDR4X_4GB_SAMSUNG_X1X2,
+	LPDDR4X_NO_PATCH,
+	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ,
+	LPDDR4X_NO_PATCH,
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE,
+	LPDDR4X_NO_PATCH,
+	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ,
+	LPDDR4X_NO_PATCH,
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE,
+	LPDDR4X_4GB_SAMSUNG_Y,
+	LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL,
+	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL,
+	LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL,
+	LPDDR4X_4GB_SAMSUNG_1Y_Y,
+	LPDDR4X_8GB_SAMSUNG_1Y_Y,
+	LPDDR4X_UNUSED, // Removed.
+	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL,
+	LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL,
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF,
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF,
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF,
+	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL,
+};
 
+#include "sdram_config.inl"
 #include "sdram_config_t210b01.inl"
 
 static bool _sdram_wait_emc_status(u32 reg_offset, u32 bit_mask, bool updated_state, s32 emc_channel)
@@ -1350,57 +1374,21 @@ static void _sdram_config_t210b01(const sdram_params_t210b01_t *params)
 	SYSREG(AHB_ARBITRATION_XBAR_CTRL) = (SYSREG(AHB_ARBITRATION_XBAR_CTRL) & 0xFFFEFFFF) | (params->ahb_arbitration_xbar_ctrl_meminit_done << 16);
 }
 
-#ifndef CONFIG_SDRAM_COMPRESS_CFG
-static void _sdram_patch_model_params_t210(u32 dramid, u32 *params)
-{
-	for (u32 i = 0; i < ARRAY_SIZE(sdram_cfg_vendor_patches_t210); i++)
-		if (sdram_cfg_vendor_patches_t210[i].dramid & DRAM_ID(dramid))
-			params[sdram_cfg_vendor_patches_t210[i].addr] = sdram_cfg_vendor_patches_t210[i].val;
-}
-#endif
-
-static void _sdram_patch_model_params_t210b01(u32 dramid, u32 *params)
-{
-	for (u32 i = 0; i < ARRAY_SIZE(sdram_cfg_vendor_patches_t210b01); i++)
-		if (sdram_cfg_vendor_patches_t210b01[i].dramid & DRAM_ID2(dramid))
-			params[sdram_cfg_vendor_patches_t210b01[i].addr] = sdram_cfg_vendor_patches_t210b01[i].val;
-}
-
 static void *_sdram_get_params_t210()
 {
 	// Check if id is proper.
 	u32 dramid = fuse_read_dramid(false);
 
-#ifdef CONFIG_SDRAM_COMPRESS_CFG
+	// Copy base parameters.
+	u32 *params = (u32 *)SDRAM_PARAMS_ADDR;
+	memcpy(params, &_dram_cfg_0_samsung_4gb, sizeof(sdram_params_t210_t));
 
-	u8 *buf = (u8 *)SDRAM_PARAMS_ADDR;
-	LZ_Uncompress(_dram_cfg_lz, buf, sizeof(_dram_cfg_lz));
-	return (void *)&buf[sizeof(sdram_params_t210_t) * dramid];
+	// Patch parameters if needed.
+	for (u32 i = 0; i < ARRAY_SIZE(sdram_cfg_vendor_patches_t210); i++)
+		if (sdram_cfg_vendor_patches_t210[i].dramcf & DRAM_ID(dramid))
+			params[sdram_cfg_vendor_patches_t210[i].offset] = sdram_cfg_vendor_patches_t210[i].val;
 
-#else
-
-	u32 *buf = (u32 *)SDRAM_PARAMS_ADDR;
-	memcpy(buf, &_dram_cfg_0_samsung_4gb, sizeof(sdram_params_t210_t));
-
-	switch (dramid)
-	{
-	case LPDDR4_ICOSA_4GB_SAMSUNG_K4F6E304HB_MGCH:
-	case LPDDR4_ICOSA_4GB_MICRON_MT53B512M32D2NP_062_WT:
-		break;
-
-	case LPDDR4_ICOSA_4GB_HYNIX_H9HCNNNBPUMLHR_NLE:
-	case LPDDR4_ICOSA_6GB_SAMSUNG_K4FHE3D4HM_MGCH:
-#ifdef CONFIG_SDRAM_COPPER_SUPPORT
-	case LPDDR4_COPPER_4GB_SAMSUNG_K4F6E304HB_MGCH:
-	case LPDDR4_COPPER_4GB_HYNIX_H9HCNNNBPUMLHR_NLE:
-	case LPDDR4_COPPER_4GB_MICRON_MT53B512M32D2NP_062_WT:
-#endif
-		_sdram_patch_model_params_t210(dramid, (u32 *)buf);
-		break;
-	}
-	return (void *)buf;
-
-#endif
+	return (void *)params;
 }
 
 void *sdram_get_params_t210b01()
@@ -1408,38 +1396,20 @@ void *sdram_get_params_t210b01()
 	// Check if id is proper.
 	u32 dramid = fuse_read_dramid(false);
 
-	u32 *buf = (u32 *)SDRAM_PARAMS_ADDR;
-	memcpy(buf, &_dram_cfg_08_10_12_14_samsung_hynix_4gb, sizeof(sdram_params_t210b01_t));
+	// Copy base parameters.
+	u32 *params = (u32 *)SDRAM_PARAMS_ADDR;
+	memcpy(params, &_dram_cfg_08_10_12_14_samsung_hynix_4gb, sizeof(sdram_params_t210b01_t));
 
-	switch (dramid)
-	{
-	case LPDDR4X_IOWA_4GB_SAMSUNG_K4U6E3S4AM_MGCJ:
-	case LPDDR4X_IOWA_4GB_HYNIX_H9HCNNNBKMMLHR_NME:
-	case LPDDR4X_HOAG_4GB_SAMSUNG_K4U6E3S4AM_MGCJ:
-	case LPDDR4X_HOAG_4GB_HYNIX_H9HCNNNBKMMLHR_NME:
-		break;
+	// Patch parameters if needed.
+	u8 dram_code = dram_encoding_t210b01[dramid];
+	if (!dram_code)
+		return (void *)params;
 
-	case LPDDR4X_IOWA_4GB_SAMSUNG_X1X2:
-	case LPDDR4X_IOWA_8GB_SAMSUNG_K4UBE3D4AM_MGCJ:
-	case LPDDR4X_IOWA_4GB_MICRON_MT53E512M32D2NP_046_WT:
-	case LPDDR4X_HOAG_8GB_SAMSUNG_K4UBE3D4AM_MGCJ:
-	case LPDDR4X_HOAG_4GB_MICRON_MT53E512M32D2NP_046_WT:
-	case LPDDR4X_IOWA_4GB_SAMSUNG_Y:
-	case LPDDR4X_IOWA_4GB_SAMSUNG_1Y_X:
-	case LPDDR4X_IOWA_8GB_SAMSUNG_1Y_X:
-	case LPDDR4X_HOAG_4GB_SAMSUNG_1Y_X:
-	case LPDDR4X_IOWA_4GB_SAMSUNG_1Y_Y:
-	case LPDDR4X_IOWA_8GB_SAMSUNG_1Y_Y:
-	case LPDDR4X_AULA_4GB_SAMSUNG_1Y_A:
-	case LPDDR4X_AULA_8GB_SAMSUNG_1Y_X:
-	case LPDDR4X_AULA_4GB_SAMSUNG_1Y_X:
-	case LPDDR4X_IOWA_4GB_MICRON_1Y_A:
-	case LPDDR4X_HOAG_4GB_MICRON_1Y_A:
-	case LPDDR4X_AULA_4GB_MICRON_1Y_A:
-		_sdram_patch_model_params_t210b01(dramid, (u32 *)buf);
-		break;
-	}
-	return (void *)buf;
+	for (u32 i = 0; i < ARRAY_SIZE(sdram_cfg_vendor_patches_t210b01); i++)
+		if (sdram_cfg_vendor_patches_t210b01[i].dramcf == dram_code)
+			params[sdram_cfg_vendor_patches_t210b01[i].offset] = sdram_cfg_vendor_patches_t210b01[i].val;
+
+	return (void *)params;
 }
 
 /*
@@ -1485,7 +1455,7 @@ static void _sdram_init_t210()
 	const sdram_params_t210_t *params = (const sdram_params_t210_t *)_sdram_get_params_t210();
 
 	// Set DRAM voltage.
-	max7762x_regulator_set_voltage(REGULATOR_SD1, 1100000);
+	max7762x_regulator_set_voltage(REGULATOR_SD1, 1100000); // HOS uses 1.125V
 
 	// VDDP Select.
 	PMC(APBDEV_PMC_VDDP_SEL) = params->pmc_vddp_sel;

bdk/mem/sdram.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (c) 2020 CTCaer
+ * Copyright (c) 2020-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -23,20 +23,26 @@
 /*
  * Tegra X1/X1+ EMC/DRAM Bandwidth Chart:
  *
- *   40.8 MHz:  0.61 GiB/s
- *   68.0 MHz:  1.01 GiB/s
- *  102.0 MHz:  1.52 GiB/s
- *  204.0 MHz:  3.04 GiB/s <-- Tegra X1/X1+ Init/SC7 Frequency
- *  408.0 MHz:  6.08 GiB/s
- *  665.6 MHz:  9.92 GiB/s
- *  800.0 MHz: 11.92 GiB/s <-- Tegra X1/X1+ Nvidia OS Boot Frequency
- * 1065.6 MHz: 15.89 GiB/s
- * 1331.2 MHz: 19.84 GiB/s
- * 1600.0 MHz: 23.84 GiB/s <-- Tegra X1  Official Max Frequency
- * 1862.4 MHz: 27.75 GiB/s <-- Tegra X1+ Official Max Frequency
- * 2131.2 MHz: 31.76 GiB/s
+ * Note: BWbits T210    = Hz x ddr x bus width x channels = Hz x 2 x 32 x 2.
+ *       BWbits T210B01 = Hz x ddr x bus width x channels = Hz x 2 x 64 x 2.
+ *       Both assume that both sub-partitions are used and thus reaching max
+ *       bandwidth per channel. (T210: 2x16-bit, T210B01: 2x32-bit).
+ *       Retail Mariko use one sub-partition, in order to meet Erista perf.
+ *
+ *              T210   T210B01
+ *   40.8 MHz:  0.61   1.22 GiB/s
+ *   68.0 MHz:  1.01   2.02 GiB/s
+ *  102.0 MHz:  1.52   3.04 GiB/s
+ *  204.0 MHz:  3.04   6.08 GiB/s <-- Tegra X1/X1+ Init/SC7 Frequency
+ *  408.0 MHz:  6.08  12.16 GiB/s
+ *  665.6 MHz:  9.92  19.84 GiB/s
+ *  800.0 MHz: 11.92  23.84 GiB/s <-- Tegra X1/X1+ Nvidia OS Boot Frequency
+ * 1065.6 MHz: 15.89  31.78 GiB/s
+ * 1331.2 MHz: 19.84  39.68 GiB/s
+ * 1600.0 MHz: 23.84  47.68 GiB/s <-- Tegra X1/X1+ HOS Max Frequency
+ * 1862.4 MHz: 27.75  55.50 GiB/s <-- Tegra X1  Official Max Frequency
+ * 2131.2 MHz: 31.76  63.52 GiB/s <-- Tegra X1+ Official Max Frequency
  *
- * Note: BWbits = Hz x bus width x channels = Hz x 64 x 2.
  */
 
 enum sdram_ids_erista
@@ -44,46 +50,74 @@ enum sdram_ids_erista
 	// LPDDR4 3200Mbps.
 	LPDDR4_ICOSA_4GB_SAMSUNG_K4F6E304HB_MGCH        = 0,
 	LPDDR4_ICOSA_4GB_HYNIX_H9HCNNNBPUMLHR_NLE       = 1,
-	LPDDR4_ICOSA_4GB_MICRON_MT53B512M32D2NP_062_WT  = 2,
-	LPDDR4_COPPER_4GB_SAMSUNG_K4F6E304HB_MGCH       = 3, // Changed to AULA Hynix 4GB 1Y-A.
+	LPDDR4_ICOSA_4GB_MICRON_MT53B512M32D2NP_062_WT  = 2, // WT:C.
+	LPDDR4_COPPER_4GB_SAMSUNG_K4F6E304HB_MGCH       = 3, // Changed to Iowa Hynix 4GB 1Y-A.
 	LPDDR4_ICOSA_6GB_SAMSUNG_K4FHE3D4HM_MGCH        = 4,
-	LPDDR4_COPPER_4GB_HYNIX_H9HCNNNBPUMLHR_NLE      = 5,
-	LPDDR4_COPPER_4GB_MICRON_MT53B512M32D2NP_062_WT = 6,
+	LPDDR4_COPPER_4GB_HYNIX_H9HCNNNBPUMLHR_NLE      = 5, // Changed to Hoag Hynix 4GB 1Y-A.
+	LPDDR4_COPPER_4GB_MICRON_MT53B512M32D2NP_062_WT = 6, // Changed to Aula Hynix 4GB 1Y-A.
 };
 
 enum sdram_ids_mariko
 {
+	// LPDDR4X 4266Mbps.
+	LPDDR4X_IOWA_4GB_HYNIX_1Y_A                     = 3, // Replaced from Copper.
+	LPDDR4X_HOAG_4GB_HYNIX_1Y_A                     = 5, // Replaced from Copper.
+	LPDDR4X_AULA_4GB_HYNIX_1Y_A                     = 6, // Replaced from Copper.
+
 	// LPDDR4X 3733Mbps.
 	LPDDR4X_IOWA_4GB_SAMSUNG_X1X2                   = 7,
 
-	LPDDR4X_IOWA_4GB_SAMSUNG_K4U6E3S4AM_MGCJ        = 8,
-	LPDDR4X_IOWA_8GB_SAMSUNG_K4UBE3D4AM_MGCJ        = 9,
-	LPDDR4X_IOWA_4GB_HYNIX_H9HCNNNBKMMLHR_NME       = 10,
-	LPDDR4X_IOWA_4GB_MICRON_MT53E512M32D2NP_046_WT  = 11, // 4266Mbps.
+	LPDDR4X_IOWA_4GB_SAMSUNG_K4U6E3S4AM_MGCJ        = 8,  // Die-M.
+	LPDDR4X_IOWA_8GB_SAMSUNG_K4UBE3D4AM_MGCJ        = 9,  // Die-M.
+	LPDDR4X_IOWA_4GB_HYNIX_H9HCNNNBKMMLHR_NME       = 10, // Die-M.
+	LPDDR4X_IOWA_4GB_MICRON_MT53E512M32D2NP_046_WTE = 11, // 4266Mbps. Die-E.
 
-	LPDDR4X_HOAG_4GB_SAMSUNG_K4U6E3S4AM_MGCJ        = 12,
-	LPDDR4X_HOAG_8GB_SAMSUNG_K4UBE3D4AM_MGCJ        = 13,
-	LPDDR4X_HOAG_4GB_HYNIX_H9HCNNNBKMMLHR_NME       = 14,
-	LPDDR4X_HOAG_4GB_MICRON_MT53E512M32D2NP_046_WT  = 15, // 4266Mbps.
+	LPDDR4X_HOAG_4GB_SAMSUNG_K4U6E3S4AM_MGCJ        = 12, // Die-M.
+	LPDDR4X_HOAG_8GB_SAMSUNG_K4UBE3D4AM_MGCJ        = 13, // Die-M.
+	LPDDR4X_HOAG_4GB_HYNIX_H9HCNNNBKMMLHR_NME       = 14, // Die-M.
+	LPDDR4X_HOAG_4GB_MICRON_MT53E512M32D2NP_046_WTE = 15, // 4266Mbps. Die-E.
 
-	// LPDDR4X 4266Mbps?
+	// LPDDR4X 4266Mbps.
 	LPDDR4X_IOWA_4GB_SAMSUNG_Y                      = 16,
 
-	LPDDR4X_IOWA_4GB_SAMSUNG_1Y_X                   = 17,
-	LPDDR4X_IOWA_8GB_SAMSUNG_1Y_X                   = 18,
-	LPDDR4X_HOAG_4GB_SAMSUNG_1Y_X                   = 19,
+	LPDDR4X_IOWA_4GB_SAMSUNG_K4U6E3S4AA_MGCL        = 17, // Die-A.
+	LPDDR4X_IOWA_8GB_SAMSUNG_K4UBE3D4AA_MGCL        = 18, // Die-A.
+	LPDDR4X_HOAG_4GB_SAMSUNG_K4U6E3S4AA_MGCL        = 19, // Die-A.
 
 	LPDDR4X_IOWA_4GB_SAMSUNG_1Y_Y                   = 20,
 	LPDDR4X_IOWA_8GB_SAMSUNG_1Y_Y                   = 21,
 
-	LPDDR4X_AULA_4GB_SAMSUNG_1Y_A                   = 22,
+	// LPDDR4X_AULA_8GB_SAMSUNG_1Y_A                   = 22, // Unused.
 
-	LPDDR4X_AULA_8GB_SAMSUNG_1Y_X                   = 23,
-	LPDDR4X_AULA_4GB_SAMSUNG_1Y_X                   = 24,
+	LPDDR4X_HOAG_8GB_SAMSUNG_K4UBE3D4AA_MGCL        = 23, // Die-A.
+	LPDDR4X_AULA_4GB_SAMSUNG_K4U6E3S4AA_MGCL        = 24, // Die-A.
 
-	LPDDR4X_IOWA_4GB_MICRON_1Y_A                    = 25,
-	LPDDR4X_HOAG_4GB_MICRON_1Y_A                    = 26,
-	LPDDR4X_AULA_4GB_MICRON_1Y_A                    = 27
+	LPDDR4X_IOWA_4GB_MICRON_MT53E512M32D2NP_046_WTF = 25, // 4266Mbps. Die-F.
+	LPDDR4X_HOAG_4GB_MICRON_MT53E512M32D2NP_046_WTF = 26, // 4266Mbps. Die-F.
+	LPDDR4X_AULA_4GB_MICRON_MT53E512M32D2NP_046_WTF = 27, // 4266Mbps. Die-F.
+
+	LPDDR4X_AULA_8GB_SAMSUNG_K4UBE3D4AA_MGCL        = 28, // Die-A.
+};
+
+enum sdram_codes_mariko
+{
+	LPDDR4X_NO_PATCH                       = 0,
+	LPDDR4X_UNUSED                         = 0,
+
+	// LPDDR4X_4GB_SAMSUNG_K4U6E3S4AM_MGCJ          DRAM IDs: 08, 12.
+	// LPDDR4X_4GB_HYNIX_H9HCNNNBKMMLHR_NME         DRAM IDs: 10, 14.
+
+	LPDDR4X_4GB_SAMSUNG_X1X2                   = 1,  // DRAM IDs: 07.
+	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ        = 2,  // DRAM IDs: 09, 13.
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE = 3,  // DRAM IDs: 11, 15.
+	LPDDR4X_4GB_SAMSUNG_Y                      = 4,  // DRAM IDs: 16.
+	LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL        = 5,  // DRAM IDs: 17, 19, 24.
+	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL        = 6,  // DRAM IDs: 18, 23, 28.
+	LPDDR4X_4GB_SAMSUNG_1Y_Y                   = 7,  // DRAM IDs: 20.
+	LPDDR4X_8GB_SAMSUNG_1Y_Y                   = 8,  // DRAM IDs: 21.
+	//LPDDR4X_8GB_SAMSUNG_1Y_A                   = 9,  // DRAM IDs: 22. Unused.
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF = 10, // DRAM IDs: 25, 26, 27.
+	LPDDR4X_4GB_HYNIX_1Y_A                     = 11, // DRAM IDs: 03, 05, 06.
 };
 
 void sdram_init();

bdk/mem/sdram_config.inl

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (c) 2020 CTCaer
+ * Copyright (c) 2020-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -646,46 +646,51 @@ static const sdram_params_t210_t _dram_cfg_0_samsung_4gb = {
 
 static const sdram_vendor_patch_t sdram_cfg_vendor_patches_t210[] = {
 	// Hynix timing config.
-	{ 0x0000000D,  67, DRAM_ID(1) | DRAM_ID(5) }, // emc_r2w.
-	{ 0x00000001,  91, DRAM_ID(1) | DRAM_ID(5) }, // emc_puterm_extra.
-	{ 0x80000000,  92, DRAM_ID(1) | DRAM_ID(5) }, // emc_puterm_width.
-	{ 0x00000210, 317, DRAM_ID(1) | DRAM_ID(5) }, // emc_pmacro_data_rx_term_mode.
-	{ 0x00000005, 368, DRAM_ID(1) | DRAM_ID(5) }, // mc_emem_arb_timing_r2w.
+	{ 0x0000000D, 0x10C / 4, DRAM_ID(1) }, // emc_r2w.
+	{ 0x00000001, 0x16C / 4, DRAM_ID(1) }, // emc_puterm_extra.
+	{ 0x80000000, 0x170 / 4, DRAM_ID(1) }, // emc_puterm_width.
+	{ 0x00000210, 0x4F4 / 4, DRAM_ID(1) }, // emc_pmacro_data_rx_term_mode.
+	{ 0x00000005, 0x5C0 / 4, DRAM_ID(1) }, // mc_emem_arb_timing_r2w.
 
 	// Samsung 6GB density config.
-	{ 0x000C0302, 347, DRAM_ID(4) },              // mc_emem_adr_cfg_dev0. 768MB Rank 0 density.
-	{ 0x000C0302, 348, DRAM_ID(4) },              // mc_emem_adr_cfg_dev1. 768MB Rank 1 density.
-	{ 0x00001800, 353, DRAM_ID(4) },              // mc_emem_cfg. 6GB total density.
+	{ 0x000C0302, 0x56C / 4, DRAM_ID(4) }, // mc_emem_adr_cfg_dev0. 768MB Rank 0 density.
+	{ 0x000C0302, 0x570 / 4, DRAM_ID(4) }, // mc_emem_adr_cfg_dev1. 768MB Rank 1 density.
+	{ 0x00001800, 0x584 / 4, DRAM_ID(4) }, // mc_emem_cfg. 6GB total density.
 
 #ifdef CONFIG_SDRAM_COPPER_SUPPORT
 	// Copper prototype Samsung/Hynix/Micron timing configs.
-	{ 0x0000003A,  59, DRAM_ID(6) },              // emc_rfc. Auto refresh.
-	{ 0x0000001D,  60, DRAM_ID(6) },              // emc_rfc_pb. Bank Auto refresh.
-	{ 0x00000012, 108, DRAM_ID(3) | DRAM_ID(5) | DRAM_ID(6) }, // emc_rw2pden.
-	{ 0x0000003B, 112, DRAM_ID(6) },              // emc_txsr.
-	{ 0x0000003B, 113, DRAM_ID(6) },              // emc_txsr_dll.
-	{ 0x00000003, 119, DRAM_ID(3) | DRAM_ID(5) | DRAM_ID(6) }, // emc_tclkstable.
-	{ 0x00120015, 205, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dq_rank0_4.
-	{ 0x00160012, 206, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dq_rank0_5.
-	{ 0x00120015, 211, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dq_rank1_4.
-	{ 0x00160012, 212, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dq_rank1_5.
-	{ 0x002F0032, 213, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank0_0.
-	{ 0x00310032, 214, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank0_1.
-	{ 0x00360034, 215, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank0_2.
-	{ 0x0033002F, 216, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank0_3.
-	{ 0x00000006, 217, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank0_4.
-	{ 0x002F0032, 219, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank1_0.
-	{ 0x00310032, 220, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank1_1.
-	{ 0x00360034, 221, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank1_2.
-	{ 0x0033002F, 222, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank1_3.
-	{ 0x00000006, 223, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank1_4.
-	{ 0x00150015, 233, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ddll_long_cmd_0.
-	{ 0x00120012, 235, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ddll_long_cmd_2.
-	{ 0x00160016, 236, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ddll_long_cmd_3.
-	{ 0x00000015, 237, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ddll_long_cmd_4.
-	{ 0x00000012, 295, DRAM_ID(3) | DRAM_ID(5) | DRAM_ID(6) }, // emc_cmd_brlshft2.
-	{ 0x00000012, 296, DRAM_ID(3) | DRAM_ID(5) | DRAM_ID(6) }, // emc_cmd_brlshft3.
-	{ 0x00000007, 370, DRAM_ID(6) },              // mc_emem_arb_timing_rfcpb. Bank refresh.
-	{ 0x72A30504, 373, DRAM_ID(6) },              // mc_emem_arb_misc0.
+	{ 0x0000003A,  0xEC / 4, DRAM_ID(6) },              // emc_rfc. Auto refresh.
+	{ 0x0000001D,  0xF0 / 4, DRAM_ID(6) },              // emc_rfc_pb. Bank Auto refresh.
+	{ 0x0000000D, 0x10C / 4, DRAM_ID(5) },              // emc_r2w.
+	{ 0x00000001, 0x16C / 4, DRAM_ID(5) },              // emc_puterm_extra.
+	{ 0x80000000, 0x170 / 4, DRAM_ID(5) },              // emc_puterm_width.
+	{ 0x00000012, 0x1B0 / 4, DRAM_ID(3) | DRAM_ID(5) | DRAM_ID(6) }, // emc_rw2pden.
+	{ 0x0000003B, 0x1C0 / 4, DRAM_ID(6) },              // emc_txsr.
+	{ 0x0000003B, 0x1C4 / 4, DRAM_ID(6) },              // emc_txsr_dll.
+	{ 0x00000003, 0x1DC / 4, DRAM_ID(3) | DRAM_ID(5) | DRAM_ID(6) }, // emc_tclkstable.
+	{ 0x00120015, 0x334 / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dq_rank0_4.
+	{ 0x00160012, 0x338 / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dq_rank0_5.
+	{ 0x00120015, 0x34C / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dq_rank1_4.
+	{ 0x00160012, 0x350 / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dq_rank1_5.
+	{ 0x002F0032, 0x354 / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank0_0.
+	{ 0x00310032, 0x358 / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank0_1.
+	{ 0x00360034, 0x35C / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank0_2.
+	{ 0x0033002F, 0x360 / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank0_3.
+	{ 0x00000006, 0x364 / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank0_4.
+	{ 0x002F0032, 0x36C / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank1_0.
+	{ 0x00310032, 0x370 / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank1_1.
+	{ 0x00360034, 0x374 / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank1_2.
+	{ 0x0033002F, 0x378 / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank1_3.
+	{ 0x00000006, 0x37C / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ob_ddll_long_dqs_rank1_4.
+	{ 0x00150015, 0x3A4 / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ddll_long_cmd_0.
+	{ 0x00120012, 0x3AC / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ddll_long_cmd_2.
+	{ 0x00160016, 0x3B0 / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ddll_long_cmd_3.
+	{ 0x00000015, 0x3B4 / 4, DRAM_ID(5) | DRAM_ID(6) }, // emc_pmacro_ddll_long_cmd_4.
+	{ 0x00000012, 0x49C / 4, DRAM_ID(3) | DRAM_ID(5) | DRAM_ID(6) }, // emc_cmd_brlshft2.
+	{ 0x00000012, 0x4A0 / 4, DRAM_ID(3) | DRAM_ID(5) | DRAM_ID(6) }, // emc_cmd_brlshft3.
+	{ 0x00000210, 0x4F4 / 4, DRAM_ID(5) },              // emc_pmacro_data_rx_term_mode.
+	{ 0x00000005, 0x5C0 / 4, DRAM_ID(5) },              // mc_emem_arb_timing_r2w.
+	{ 0x00000007, 0x5C8 / 4, DRAM_ID(6) },              // mc_emem_arb_timing_rfcpb. Bank refresh.
+	{ 0x72A30504, 0x5D4 / 4, DRAM_ID(6) },              // mc_emem_arb_misc0.
 #endif
 };

bdk/mem/sdram_config_lz.inl

@@ -1,124 +0,0 @@
-/*
- * Copyright (c) 2018 naehrwert
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-static const u8 _dram_cfg_lz[1262] = {
-	0x17, 0x03, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x22, 0x00, 0x00,
-	0x00, 0x2C, 0x17, 0x04, 0x09, 0x00, 0x17, 0x04, 0x04, 0x17, 0x08, 0x08,
-	0x17, 0x10, 0x10, 0x00, 0x00, 0x68, 0xBC, 0x01, 0x70, 0x0A, 0x00, 0x00,
-	0x00, 0x04, 0xB4, 0x01, 0x70, 0x01, 0x32, 0x54, 0x76, 0xC8, 0xE6, 0x00,
-	0x70, 0x17, 0x10, 0x24, 0x34, 0x00, 0x00, 0x00, 0x02, 0x80, 0x18, 0x40,
-	0x00, 0x00, 0x00, 0x17, 0x04, 0x04, 0x17, 0x09, 0x18, 0xFF, 0xFF, 0x1F,
-	0x00, 0xD8, 0x51, 0x1A, 0xA0, 0x00, 0x00, 0x50, 0x05, 0x00, 0x00, 0x77,
-	0x00, 0x17, 0x04, 0x04, 0x17, 0x08, 0x08, 0x17, 0x08, 0x08, 0xA6, 0xA6,
-	0xAF, 0xB3, 0x3C, 0x9E, 0x00, 0x00, 0x03, 0x03, 0xE0, 0xC1, 0x04, 0x04,
-	0x04, 0x04, 0x17, 0x04, 0x04, 0x17, 0x04, 0x3C, 0x1F, 0x1F, 0x1F, 0x1F,
-	0x17, 0x04, 0x04, 0x17, 0x06, 0x06, 0x00, 0x00, 0x04, 0x08, 0x17, 0x06,
-	0x46, 0xA1, 0x01, 0x00, 0x00, 0x32, 0x17, 0x0B, 0x64, 0x01, 0x17, 0x04,
-	0x7C, 0x17, 0x07, 0x0C, 0x03, 0x17, 0x04, 0x04, 0x00, 0x00, 0x00, 0x1E,
-	0x00, 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x25, 0x00, 0x00, 0x00, 0x13,
-	0x17, 0x0B, 0x2C, 0x09, 0x00, 0x00, 0x00, 0x17, 0x05, 0x5D, 0x17, 0x07,
-	0x10, 0x0B, 0x17, 0x07, 0x28, 0x08, 0x17, 0x07, 0x0C, 0x17, 0x04, 0x1C,
-	0x20, 0x00, 0x00, 0x00, 0x06, 0x17, 0x04, 0x04, 0x17, 0x07, 0x08, 0x17,
-	0x04, 0x50, 0x17, 0x04, 0x2C, 0x17, 0x04, 0x1C, 0x17, 0x04, 0x10, 0x17,
-	0x08, 0x6C, 0x17, 0x04, 0x10, 0x17, 0x04, 0x38, 0x17, 0x04, 0x40, 0x05,
-	0x17, 0x07, 0x1C, 0x17, 0x08, 0x58, 0x17, 0x04, 0x24, 0x17, 0x04, 0x18,
-	0x17, 0x08, 0x64, 0x00, 0x00, 0x01, 0x00, 0x12, 0x00, 0x00, 0x00, 0x14,
-	0x00, 0x00, 0x00, 0x16, 0x00, 0x00, 0x17, 0x09, 0x0C, 0x17, 0x05, 0x82,
-	0x58, 0x17, 0x07, 0x61, 0xC1, 0x17, 0x07, 0x50, 0x17, 0x04, 0x04, 0x17,
-	0x08, 0x81, 0x48, 0x17, 0x04, 0x04, 0x17, 0x04, 0x28, 0x17, 0x04, 0x60,
-	0x17, 0x08, 0x54, 0x27, 0x17, 0x04, 0x04, 0x17, 0x07, 0x14, 0x17, 0x04,
-	0x04, 0x04, 0x17, 0x07, 0x81, 0x58, 0x17, 0x0C, 0x0C, 0x1C, 0x03, 0x00,
-	0x00, 0x0D, 0xA0, 0x60, 0x91, 0xBF, 0x3B, 0x17, 0x04, 0x5A, 0xF3, 0x0C,
-	0x04, 0x05, 0x1B, 0x06, 0x02, 0x03, 0x07, 0x1C, 0x23, 0x25, 0x25, 0x05,
-	0x08, 0x1D, 0x09, 0x0A, 0x24, 0x0B, 0x1E, 0x0D, 0x0C, 0x26, 0x26, 0x03,
-	0x02, 0x1B, 0x1C, 0x23, 0x03, 0x04, 0x07, 0x05, 0x06, 0x25, 0x25, 0x02,
-	0x0A, 0x0B, 0x1D, 0x0D, 0x08, 0x0C, 0x09, 0x1E, 0x24, 0x26, 0x26, 0x08,
-	0x24, 0x06, 0x07, 0x9A, 0x12, 0x17, 0x05, 0x83, 0x41, 0x00, 0xFF, 0x17,
-	0x10, 0x83, 0x6C, 0x04, 0x00, 0x01, 0x08, 0x00, 0x00, 0x02, 0x08, 0x00,
-	0x00, 0x0D, 0x08, 0x00, 0x00, 0x00, 0xC0, 0x71, 0x71, 0x03, 0x08, 0x00,
-	0x00, 0x0B, 0x08, 0x72, 0x72, 0x0E, 0x0C, 0x17, 0x04, 0x20, 0x08, 0x08,
-	0x0D, 0x0C, 0x00, 0x00, 0x0D, 0x0C, 0x14, 0x14, 0x16, 0x08, 0x17, 0x06,
-	0x2C, 0x11, 0x08, 0x17, 0x10, 0x84, 0x67, 0x15, 0x00, 0xCC, 0x00, 0x0A,
-	0x00, 0x33, 0x00, 0x00, 0x00, 0x20, 0xF3, 0x05, 0x08, 0x11, 0x00, 0xFF,
-	0x0F, 0xFF, 0x0F, 0x17, 0x08, 0x83, 0x4C, 0x01, 0x03, 0x00, 0x70, 0x00,
-	0x0C, 0x00, 0x01, 0x17, 0x04, 0x0C, 0x08, 0x44, 0x00, 0x10, 0x04, 0x04,
-	0x00, 0x06, 0x13, 0x07, 0x00, 0x80, 0x17, 0x04, 0x10, 0xA0, 0x00, 0x2C,
-	0x00, 0x01, 0x37, 0x00, 0x00, 0x00, 0x80, 0x17, 0x06, 0x48, 0x08, 0x00,
-	0x04, 0x00, 0x1F, 0x22, 0x20, 0x80, 0x0F, 0xF4, 0x20, 0x02, 0x28, 0x28,
-	0x28, 0x28, 0x17, 0x04, 0x04, 0x11, 0x11, 0x11, 0x11, 0x17, 0x04, 0x04,
-	0xBE, 0x00, 0x00, 0x17, 0x05, 0x58, 0x17, 0x08, 0x5C, 0x17, 0x22, 0x85,
-	0x6A, 0x17, 0x1A, 0x1A, 0x14, 0x00, 0x12, 0x00, 0x10, 0x17, 0x05, 0x83,
-	0x0A, 0x17, 0x16, 0x18, 0x30, 0x00, 0x2E, 0x00, 0x33, 0x00, 0x30, 0x00,
-	0x33, 0x00, 0x35, 0x00, 0x30, 0x00, 0x32, 0x17, 0x05, 0x83, 0x0C, 0x17,
-	0x04, 0x20, 0x17, 0x18, 0x18, 0x28, 0x00, 0x28, 0x17, 0x04, 0x04, 0x17,
-	0x08, 0x08, 0x17, 0x10, 0x10, 0x00, 0x14, 0x17, 0x05, 0x5A, 0x17, 0x04,
-	0x5C, 0x17, 0x04, 0x5E, 0x17, 0x04, 0x0E, 0x17, 0x0E, 0x78, 0x17, 0x09,
-	0x82, 0x50, 0x40, 0x06, 0x00, 0xCC, 0x00, 0x09, 0x00, 0x4F, 0x00, 0x51,
-	0x17, 0x08, 0x18, 0x80, 0x01, 0x00, 0x00, 0x40, 0x17, 0x04, 0x20, 0x03,
-	0x00, 0x00, 0x00, 0xAB, 0x00, 0x0A, 0x04, 0x11, 0x17, 0x08, 0x82, 0x58,
-	0x17, 0x0C, 0x38, 0x17, 0x1B, 0x81, 0x6C, 0x17, 0x08, 0x85, 0x60, 0x17,
-	0x08, 0x86, 0x50, 0x17, 0x08, 0x86, 0x60, 0x17, 0x06, 0x83, 0x21, 0x22,
-	0x04, 0xFF, 0xFF, 0xAF, 0x4F, 0x17, 0x0C, 0x86, 0x74, 0x17, 0x08, 0x2C,
-	0x8B, 0xFF, 0x07, 0x17, 0x06, 0x81, 0x04, 0x32, 0x54, 0x76, 0x10, 0x47,
-	0x32, 0x65, 0x10, 0x34, 0x76, 0x25, 0x01, 0x34, 0x67, 0x25, 0x01, 0x75,
-	0x64, 0x32, 0x01, 0x72, 0x56, 0x34, 0x10, 0x23, 0x74, 0x56, 0x01, 0x45,
-	0x32, 0x67, 0x17, 0x04, 0x24, 0x49, 0x92, 0x24, 0x17, 0x04, 0x04, 0x17,
-	0x11, 0x7C, 0x1B, 0x17, 0x04, 0x04, 0x17, 0x13, 0x81, 0x14, 0x2F, 0x41,
-	0x13, 0x1F, 0x14, 0x00, 0x01, 0x00, 0x17, 0x04, 0x7C, 0xFF, 0xFF, 0xFF,
-	0x7F, 0x0B, 0xD7, 0x06, 0x40, 0x00, 0x00, 0x02, 0x00, 0x08, 0x08, 0x03,
-	0x00, 0x00, 0x5C, 0x01, 0x00, 0x10, 0x10, 0x10, 0x17, 0x06, 0x86, 0x59,
-	0x17, 0x0F, 0x89, 0x14, 0x37, 0x17, 0x07, 0x82, 0x72, 0x10, 0x17, 0x06,
-	0x83, 0x0D, 0x00, 0x11, 0x01, 0x17, 0x05, 0x85, 0x39, 0x17, 0x04, 0x0E,
-	0x0A, 0x17, 0x07, 0x89, 0x29, 0x17, 0x04, 0x1B, 0x17, 0x08, 0x86, 0x77,
-	0x17, 0x09, 0x12, 0x20, 0x00, 0x00, 0x00, 0x81, 0x10, 0x09, 0x28, 0x93,
-	0x32, 0xA5, 0x44, 0x5B, 0x8A, 0x67, 0x76, 0x17, 0x18, 0x82, 0x2C, 0xFF,
-	0xEF, 0xFF, 0xEF, 0xC0, 0xC0, 0xC0, 0xC0, 0x17, 0x04, 0x04, 0xDC, 0xDC,
-	0xDC, 0xDC, 0x0A, 0x0A, 0x0A, 0x0A, 0x17, 0x04, 0x04, 0x17, 0x04, 0x04,
-	0x17, 0x05, 0x82, 0x24, 0x03, 0x07, 0x17, 0x04, 0x04, 0x00, 0x00, 0x24,
-	0xFF, 0xFF, 0x00, 0x44, 0x57, 0x6E, 0x00, 0x28, 0x72, 0x39, 0x00, 0x10,
-	0x9C, 0x4B, 0x17, 0x04, 0x64, 0x01, 0x00, 0x00, 0x08, 0x4C, 0x00, 0x00,
-	0x80, 0x20, 0x10, 0x0A, 0x00, 0x28, 0x10, 0x17, 0x06, 0x85, 0x60, 0x17,
-	0x10, 0x82, 0x74, 0x17, 0x08, 0x08, 0x17, 0x08, 0x88, 0x00, 0x17, 0x04,
-	0x10, 0x04, 0x17, 0x0B, 0x87, 0x6C, 0x01, 0x00, 0x02, 0x02, 0x01, 0x02,
-	0x03, 0x00, 0x04, 0x05, 0xC3, 0x71, 0x0F, 0x0F, 0x17, 0x08, 0x8B, 0x18,
-	0x1F, 0x17, 0x09, 0x81, 0x73, 0x00, 0xFF, 0x00, 0xFF, 0x17, 0x05, 0x86,
-	0x48, 0x17, 0x04, 0x0C, 0x17, 0x07, 0x86, 0x34, 0x00, 0x00, 0xF0, 0x17,
-	0x09, 0x87, 0x54, 0x43, 0xC3, 0xBA, 0xE4, 0xD3, 0x1E, 0x17, 0x0C, 0x81,
-	0x52, 0x17, 0x0A, 0x1C, 0x17, 0x10, 0x81, 0x6C, 0x17, 0x0A, 0x82, 0x21,
-	0x17, 0x07, 0x82, 0x4D, 0x17, 0x0A, 0x8A, 0x1B, 0x17, 0x11, 0x2C, 0x76,
-	0x0C, 0x17, 0x0A, 0x8A, 0x67, 0x17, 0x0F, 0x84, 0x28, 0x17, 0x06, 0x34,
-	0x17, 0x17, 0x3A, 0x7E, 0x16, 0x40, 0x17, 0x0C, 0x8B, 0x1F, 0x17, 0x2A,
-	0x38, 0x1E, 0x17, 0x0A, 0x38, 0x17, 0x13, 0x81, 0x28, 0x00, 0xC0, 0x17,
-	0x17, 0x55, 0x46, 0x24, 0x17, 0x0A, 0x81, 0x28, 0x17, 0x14, 0x38, 0x17,
-	0x18, 0x81, 0x60, 0x46, 0x2C, 0x17, 0x06, 0x38, 0xEC, 0x17, 0x0D, 0x16,
-	0x17, 0x0E, 0x82, 0x3C, 0x17, 0x82, 0x0C, 0x8E, 0x68, 0x17, 0x04, 0x24,
-	0x17, 0x5C, 0x8E, 0x68, 0x17, 0x07, 0x82, 0x5F, 0x80, 0x17, 0x87, 0x01,
-	0x8E, 0x68, 0x02, 0x17, 0x81, 0x4A, 0x8E, 0x68, 0x17, 0x0C, 0x87, 0x78,
-	0x17, 0x85, 0x28, 0x8E, 0x68, 0x17, 0x8E, 0x68, 0x9D, 0x50, 0x17, 0x81,
-	0x24, 0x8E, 0x68, 0x17, 0x04, 0x2C, 0x17, 0x28, 0x8E, 0x68, 0x17, 0x04,
-	0x30, 0x17, 0x85, 0x3C, 0x8E, 0x68, 0x12, 0x17, 0x07, 0x85, 0x70, 0x17,
-	0x88, 0x74, 0x8E, 0x68, 0x17, 0x87, 0x3E, 0x9D, 0x50, 0x0C, 0x17, 0x04,
-	0x04, 0x17, 0x12, 0x8E, 0x68, 0x18, 0x17, 0x87, 0x12, 0xBB, 0x20, 0x17,
-	0x83, 0x04, 0x9D, 0x50, 0x15, 0x17, 0x05, 0x8D, 0x76, 0x17, 0x0F, 0x8B,
-	0x49, 0x17, 0x0B, 0x18, 0x32, 0x00, 0x2F, 0x00, 0x32, 0x00, 0x31, 0x00,
-	0x34, 0x00, 0x36, 0x00, 0x2F, 0x00, 0x33, 0x17, 0x09, 0x84, 0x0C, 0x17,
-	0x18, 0x18, 0x17, 0x20, 0x8E, 0x68, 0x15, 0x17, 0x07, 0x5A, 0x17, 0x06,
-	0x5E, 0x16, 0x00, 0x15, 0x17, 0x82, 0x40, 0x9D, 0x50, 0x17, 0x86, 0x5F,
-	0xBB, 0x20, 0x3A, 0x00, 0x00, 0x00, 0x1D, 0x17, 0x81, 0x4F, 0xAC, 0x38,
-	0x3B, 0x17, 0x04, 0x04, 0x17, 0x86, 0x30, 0x8E, 0x68, 0x17, 0x81, 0x53,
-	0xAC, 0x38, 0x07, 0x17, 0x0D, 0x8E, 0x68, 0xA3, 0x72, 0x17, 0x83, 0x10,
-	0x8E, 0x68
-};

bdk/mem/sdram_config_t210b01.inl

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020 CTCaer
+ * Copyright (c) 2020-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -16,8 +16,6 @@
 
 #define DRAM_CFG_T210B01_SIZE 2104
 
-#define DRAM_ID2(x) BIT((x) - 7)
-
 static const sdram_params_t210b01_t _dram_cfg_08_10_12_14_samsung_hynix_4gb = {
 	/* Specifies the type of memory device */
 	.memory_type                                     = MEMORY_TYPE_LPDDR4,
@@ -109,7 +107,7 @@ static const sdram_params_t210b01_t _dram_cfg_08_10_12_14_samsung_hynix_4gb = {
 	.emc_pmacro_ca_tx_drive                          = 0x3F3F3F3F,
 	.emc_pmacro_cmd_tx_drive                         = 0x00001220,
 	.emc_pmacro_auto_cal_common                      = 0x00000804,
-	.emc_pmacro_zcrtl                                = 0x505050,
+	.emc_pmacro_zcrtl                                = 0x00505050,
 
 	/* Specifies the time for the calibration to stabilize (in microseconds) */
 	.emc_auto_cal_wait                               = 0x000001A1,
@@ -708,295 +706,287 @@ static const sdram_params_t210b01_t _dram_cfg_08_10_12_14_samsung_hynix_4gb = {
 static const sdram_vendor_patch_t sdram_cfg_vendor_patches_t210b01[] = {
 
 	// Samsung LPDDR4X 4GB X1X2 for prototype Iowa.
-	{ 0x000E0022, 0x3AC / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dq_rank0_4.
-	{ 0x001B0010, 0x3B0 / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dq_rank0_5.
-	{ 0x000E0022, 0x3C4 / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dq_rank1_4.
-	{ 0x001B0010, 0x3C8 / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dq_rank1_5.
-	{ 0x00490043, 0x3CC / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dqs_rank0_0.
-	{ 0x00420045, 0x3D0 / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dqs_rank0_1.
-	{ 0x00490047, 0x3D4 / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dqs_rank0_2.
-	{ 0x00460047, 0x3D8 / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dqs_rank0_3.
-	{ 0x00000016, 0x3DC / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dqs_rank0_4.
-	{ 0x00100000, 0x3E0 / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dqs_rank0_5.
-	{ 0x00490043, 0x3E4 / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dqs_rank1_0.
-	{ 0x00420045, 0x3E8 / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dqs_rank1_1.
-	{ 0x00490047, 0x3EC / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dqs_rank1_2.
-	{ 0x00460047, 0x3F0 / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dqs_rank1_3.
-	{ 0x00000016, 0x3F4 / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dqs_rank1_4.
-	{ 0x00100000, 0x3F8 / 4, DRAM_ID2(7) }, // emc_pmacro_ob_ddll_long_dqs_rank1_5.
-	{ 0x00220022, 0x41C / 4, DRAM_ID2(7) }, // emc_pmacro_ddll_long_cmd_0.
-	{ 0x000E000E, 0x420 / 4, DRAM_ID2(7) }, // emc_pmacro_ddll_long_cmd_1.
-	{ 0x00100010, 0x424 / 4, DRAM_ID2(7) }, // emc_pmacro_ddll_long_cmd_2.
-	{ 0x001B001B, 0x428 / 4, DRAM_ID2(7) }, // emc_pmacro_ddll_long_cmd_3.
-	{ 0x00000022, 0x42C / 4, DRAM_ID2(7) }, // emc_pmacro_ddll_long_cmd_4.
+	{ 0x000E0022, 0x3AC / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dq_rank0_4.
+	{ 0x001B0010, 0x3B0 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dq_rank0_5.
+	{ 0x000E0022, 0x3C4 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dq_rank1_4.
+	{ 0x001B0010, 0x3C8 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dq_rank1_5.
+	{ 0x00490043, 0x3CC / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dqs_rank0_0.
+	{ 0x00420045, 0x3D0 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dqs_rank0_1.
+	{ 0x00490047, 0x3D4 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dqs_rank0_2.
+	{ 0x00460047, 0x3D8 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dqs_rank0_3.
+	{ 0x00000016, 0x3DC / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dqs_rank0_4.
+	{ 0x00100000, 0x3E0 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dqs_rank0_5.
+	{ 0x00490043, 0x3E4 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dqs_rank1_0.
+	{ 0x00420045, 0x3E8 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dqs_rank1_1.
+	{ 0x00490047, 0x3EC / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dqs_rank1_2.
+	{ 0x00460047, 0x3F0 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dqs_rank1_3.
+	{ 0x00000016, 0x3F4 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dqs_rank1_4.
+	{ 0x00100000, 0x3F8 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ob_ddll_long_dqs_rank1_5.
+	{ 0x00220022, 0x41C / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ddll_long_cmd_0.
+	{ 0x000E000E, 0x420 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ddll_long_cmd_1.
+	{ 0x00100010, 0x424 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ddll_long_cmd_2.
+	{ 0x001B001B, 0x428 / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ddll_long_cmd_3.
+	{ 0x00000022, 0x42C / 4, LPDDR4X_4GB_SAMSUNG_X1X2 }, // emc_pmacro_ddll_long_cmd_4.
 
-	// Samsung LPDDR4X 8GB K4UBE3D4AM-MGCJ for SDEV Iowa and Hoag.
-	{ 0x05500000, 0x0D4 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_auto_cal_config2.
-	{ 0xC9AFBCBC, 0x0F4 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_auto_cal_vref_sel0.
-	{ 0x00000001, 0x134 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_adr_cfg. 2 Ranks.
-	{ 0x00000006, 0x1CC / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_quse.
-	{ 0x00000005, 0x1D0 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_quse_width.
-	{ 0x00000003, 0x1DC / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_einput.
-	{ 0x0000000C, 0x1E0 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_einput_duration.
-	{ 0x08010004, 0x2B8 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_mrw1.
-	{ 0x08020000, 0x2BC / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_mrw2.
-	{ 0x080D0000, 0x2C0 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_mrw3.
-	{ 0x08033131, 0x2C8 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_mrw6.
-	{ 0x080B0000, 0x2CC / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_mrw8.
-	{ 0x0C0E5D5D, 0x2D0 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_mrw9.
-	{ 0x080C5D5D, 0x2D4 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_mrw10.
-	{ 0x0C0D0808, 0x2D8 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_mrw12.
-	{ 0x0C0D0000, 0x2DC / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_mrw13.
-	{ 0x08161414, 0x2E0 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_mrw14.
-	{ 0x08010004, 0x2E4 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_mrw_extra.
-	{ 0x00000000, 0x340 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_dev_select. Both devices.
-	{ 0x35353535, 0x350 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_pmacro_ib_vref_dq_0.
-	{ 0x35353535, 0x354 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_pmacro_ib_vref_dq_1.
-	{ 0x00100010, 0x3FC / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_pmacro_ib_ddll_long_dqs_rank0_0.
-	{ 0x00100010, 0x400 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_pmacro_ib_ddll_long_dqs_rank0_1.
-	{ 0x00100010, 0x404 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_pmacro_ib_ddll_long_dqs_rank0_2.
-	{ 0x00100010, 0x408 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_pmacro_ib_ddll_long_dqs_rank0_3.
-	{ 0x00100010, 0x40C / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_pmacro_ib_ddll_long_dqs_rank1_0.
-	{ 0x00100010, 0x410 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_pmacro_ib_ddll_long_dqs_rank1_1.
-	{ 0x00100010, 0x414 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_pmacro_ib_ddll_long_dqs_rank1_2.
-	{ 0x00100010, 0x418 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_pmacro_ib_ddll_long_dqs_rank1_3.
-	{ 0x0051004F, 0x450 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_zcal_mrw_cmd.
-	{ 0x40000001, 0x45C / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_zcal_init_dev1.
-	{ 0x00000000, 0x594 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_pmacro_tx_pwrd4.
-	{ 0x00001000, 0x598 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // emc_pmacro_tx_pwrd5.
-	{ 0x00000001, 0x630 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // mc_emem_adr_cfg. 2 Ranks.
-	{ 0x00002000, 0x64C / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // mc_emem_cfg. 8GB total density.
-	{ 0x00000002, 0x680 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // mc_emem_arb_timing_r2r.
-	{ 0x02020001, 0x694 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // mc_emem_arb_da_turns.
-	{ 0x2A800000, 0x6DC / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // mc_video_protect_gpu_override0.
-	{ 0x00000002, 0x6E0 / 4, DRAM_ID2(9) | DRAM_ID2(13) }, // mc_video_protect_gpu_override1.
+	// Samsung LPDDR4X 8GB K4UBE3D4AM-MGCJ Die-M for SDEV Iowa and Hoag.
+	{ 0x05500000, 0x0D4 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_auto_cal_config2.
+	{ 0xC9AFBCBC, 0x0F4 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_auto_cal_vref_sel0.
+	{ 0x00000001, 0x134 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_adr_cfg. 2 Ranks.
+	{ 0x00000006, 0x1CC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_quse.
+	{ 0x00000005, 0x1D0 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_quse_width.
+	{ 0x00000003, 0x1DC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_einput.
+	{ 0x0000000C, 0x1E0 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_einput_duration.
+	{ 0x08010004, 0x2B8 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_mrw1.
+	{ 0x08020000, 0x2BC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_mrw2.
+	{ 0x080D0000, 0x2C0 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_mrw3.
+	{ 0x08033131, 0x2C8 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_mrw6.
+	{ 0x080B0000, 0x2CC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_mrw8.
+	{ 0x0C0E5D5D, 0x2D0 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_mrw9.
+	{ 0x080C5D5D, 0x2D4 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_mrw10.
+	{ 0x0C0D0808, 0x2D8 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_mrw12.
+	{ 0x0C0D0000, 0x2DC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_mrw13.
+	{ 0x08161414, 0x2E0 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_mrw14.
+	{ 0x08010004, 0x2E4 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_mrw_extra.
+	{ 0x00000000, 0x340 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_dev_select. Both devices.
+	{ 0x35353535, 0x350 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_pmacro_ib_vref_dq_0.
+	{ 0x35353535, 0x354 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_pmacro_ib_vref_dq_1.
+	{ 0x00100010, 0x3FC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_pmacro_ib_ddll_long_dqs_rank0_0.
+	{ 0x00100010, 0x400 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_pmacro_ib_ddll_long_dqs_rank0_1.
+	{ 0x00100010, 0x404 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_pmacro_ib_ddll_long_dqs_rank0_2.
+	{ 0x00100010, 0x408 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_pmacro_ib_ddll_long_dqs_rank0_3.
+	{ 0x00100010, 0x40C / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_pmacro_ib_ddll_long_dqs_rank1_0.
+	{ 0x00100010, 0x410 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_pmacro_ib_ddll_long_dqs_rank1_1.
+	{ 0x00100010, 0x414 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_pmacro_ib_ddll_long_dqs_rank1_2.
+	{ 0x00100010, 0x418 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_pmacro_ib_ddll_long_dqs_rank1_3.
+	{ 0x0051004F, 0x450 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_zcal_mrw_cmd.
+	{ 0x40000001, 0x45C / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_zcal_init_dev1.
+	{ 0x00000000, 0x594 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_pmacro_tx_pwrd4.
+	{ 0x00001000, 0x598 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // emc_pmacro_tx_pwrd5.
+	{ 0x00000001, 0x630 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // mc_emem_adr_cfg. 2 Ranks.
+	{ 0x00002000, 0x64C / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // mc_emem_cfg. 8GB total density.
+	{ 0x00000002, 0x680 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // mc_emem_arb_timing_r2r.
+	{ 0x02020001, 0x694 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // mc_emem_arb_da_turns.
+	{ 0x2A800000, 0x6DC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // mc_video_protect_gpu_override0.
+	{ 0x00000002, 0x6E0 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // mc_video_protect_gpu_override1.
 
-	// Micron LPDDR4X 4GB MT53D1024M32D1NP-053-WT for Iowa and Hoag.
-	{ 0x05500000, 0x0D4 / 4, DRAM_ID2(11) | DRAM_ID2(15) }, // emc_auto_cal_config2.
-	{ 0xC9AFBCBC, 0x0F4 / 4, DRAM_ID2(11) | DRAM_ID2(15) }, // emc_auto_cal_vref_sel0.
-	{ 0x88161414, 0x2E0 / 4, DRAM_ID2(11) | DRAM_ID2(15) }, // emc_mrw14.
-	{ 0x80000713, 0x32C / 4, DRAM_ID2(11) | DRAM_ID2(15) }, // emc_dyn_self_ref_control.
-	{ 0x2A800000, 0x6DC / 4, DRAM_ID2(11) | DRAM_ID2(15) }, // mc_video_protect_gpu_override0.
-	{ 0x00000002, 0x6E0 / 4, DRAM_ID2(11) | DRAM_ID2(15) }, // mc_video_protect_gpu_override1.
+	// Micron LPDDR4X 4GB MT53D1024M32D1NP-053-WT:E Die-E for retail Iowa and Hoag.
+	{ 0x05500000, 0x0D4 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE }, // emc_auto_cal_config2.
+	{ 0xC9AFBCBC, 0x0F4 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE }, // emc_auto_cal_vref_sel0.
+	{ 0x88161414, 0x2E0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE }, // emc_mrw14.
+	{ 0x80000713, 0x32C / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE }, // emc_dyn_self_ref_control.
+	{ 0x2A800000, 0x6DC / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE }, // mc_video_protect_gpu_override0.
+	{ 0x00000002, 0x6E0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE }, // mc_video_protect_gpu_override1.
 
-	// Samsung LPDDR4X 4GB Die-Y for Iowa.
-	{ 0x05500000, 0x0D4 / 4, DRAM_ID2(16) }, // emc_auto_cal_config2.
-	{ 0xC9AFBCBC, 0x0F4 / 4, DRAM_ID2(16) }, // emc_auto_cal_vref_sel0.
-	{ 0x88161414, 0x2E0 / 4, DRAM_ID2(16) }, // emc_mrw14.
-	{ 0x80000713, 0x32C / 4, DRAM_ID2(16) }, // emc_dyn_self_ref_control.
-	{ 0x32323232, 0x350 / 4, DRAM_ID2(16) }, // emc_pmacro_ib_vref_dq_0.
-	{ 0x32323232, 0x354 / 4, DRAM_ID2(16) }, // emc_pmacro_ib_vref_dq_1.
-	{ 0x000F0018, 0x3AC / 4, DRAM_ID2(16) }, // emc_pmacro_ob_ddll_long_dq_rank0_4.
-	{ 0x000F0018, 0x3C4 / 4, DRAM_ID2(16) }, // emc_pmacro_ob_ddll_long_dq_rank1_4.
-	{ 0x00440048, 0x3CC / 4, DRAM_ID2(16) }, // emc_pmacro_ob_ddll_long_dqs_rank0_0.
-	{ 0x00440045, 0x3D0 / 4, DRAM_ID2(16) }, // emc_pmacro_ob_ddll_long_dqs_rank0_1.
-	{ 0x00470047, 0x3D4 / 4, DRAM_ID2(16) }, // emc_pmacro_ob_ddll_long_dqs_rank0_2.
-	{ 0x0005000D, 0x3DC / 4, DRAM_ID2(16) }, // emc_pmacro_ob_ddll_long_dqs_rank0_4.
-	{ 0x00440048, 0x3E4 / 4, DRAM_ID2(16) }, // emc_pmacro_ob_ddll_long_dqs_rank1_0.
-	{ 0x00440045, 0x3E8 / 4, DRAM_ID2(16) }, // emc_pmacro_ob_ddll_long_dqs_rank1_1.
-	{ 0x00470047, 0x3EC / 4, DRAM_ID2(16) }, // emc_pmacro_ob_ddll_long_dqs_rank1_2.
-	{ 0x0005000D, 0x3F4 / 4, DRAM_ID2(16) }, // emc_pmacro_ob_ddll_long_dqs_rank1_4.
-	{ 0x00780078, 0x3FC / 4, DRAM_ID2(16) }, // emc_pmacro_ib_ddll_long_dqs_rank0_0.
-	{ 0x00780078, 0x400 / 4, DRAM_ID2(16) }, // emc_pmacro_ib_ddll_long_dqs_rank0_1.
-	{ 0x00780078, 0x404 / 4, DRAM_ID2(16) }, // emc_pmacro_ib_ddll_long_dqs_rank0_2.
-	{ 0x00780078, 0x408 / 4, DRAM_ID2(16) }, // emc_pmacro_ib_ddll_long_dqs_rank0_3.
-	{ 0x00780078, 0x40C / 4, DRAM_ID2(16) }, // emc_pmacro_ib_ddll_long_dqs_rank1_0.
-	{ 0x00780078, 0x410 / 4, DRAM_ID2(16) }, // emc_pmacro_ib_ddll_long_dqs_rank1_1.
-	{ 0x00780078, 0x414 / 4, DRAM_ID2(16) }, // emc_pmacro_ib_ddll_long_dqs_rank1_2.
-	{ 0x00780078, 0x418 / 4, DRAM_ID2(16) }, // emc_pmacro_ib_ddll_long_dqs_rank1_3.
-	{ 0x00180018, 0x41C / 4, DRAM_ID2(16) }, // emc_pmacro_ddll_long_cmd_0.
-	{ 0x000F000F, 0x420 / 4, DRAM_ID2(16) }, // emc_pmacro_ddll_long_cmd_1.
-	{ 0x00000018, 0x42C / 4, DRAM_ID2(16) }, // emc_pmacro_ddll_long_cmd_4.
-	{ 0x2A800000, 0x6DC / 4, DRAM_ID2(16) }, // mc_video_protect_gpu_override0.
-	{ 0x00000002, 0x6E0 / 4, DRAM_ID2(16) }, // mc_video_protect_gpu_override1.
+	// Samsung LPDDR4X 4GB (Y01) Die-? for Iowa.
+	{ 0x05500000, 0x0D4 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_auto_cal_config2.
+	{ 0xC9AFBCBC, 0x0F4 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_auto_cal_vref_sel0.
+	{ 0x88161414, 0x2E0 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_mrw14.
+	{ 0x80000713, 0x32C / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_dyn_self_ref_control.
+	{ 0x32323232, 0x350 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ib_vref_dq_0.
+	{ 0x32323232, 0x354 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ib_vref_dq_1.
+	{ 0x000F0018, 0x3AC / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ob_ddll_long_dq_rank0_4.
+	{ 0x000F0018, 0x3C4 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ob_ddll_long_dq_rank1_4.
+	{ 0x00440048, 0x3CC / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ob_ddll_long_dqs_rank0_0.
+	{ 0x00440045, 0x3D0 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ob_ddll_long_dqs_rank0_1.
+	{ 0x00470047, 0x3D4 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ob_ddll_long_dqs_rank0_2.
+	{ 0x0005000D, 0x3DC / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ob_ddll_long_dqs_rank0_4.
+	{ 0x00440048, 0x3E4 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ob_ddll_long_dqs_rank1_0.
+	{ 0x00440045, 0x3E8 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ob_ddll_long_dqs_rank1_1.
+	{ 0x00470047, 0x3EC / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ob_ddll_long_dqs_rank1_2.
+	{ 0x0005000D, 0x3F4 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ob_ddll_long_dqs_rank1_4.
+	{ 0x00780078, 0x3FC / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ib_ddll_long_dqs_rank0_0.
+	{ 0x00780078, 0x400 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ib_ddll_long_dqs_rank0_1.
+	{ 0x00780078, 0x404 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ib_ddll_long_dqs_rank0_2.
+	{ 0x00780078, 0x408 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ib_ddll_long_dqs_rank0_3.
+	{ 0x00780078, 0x40C / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ib_ddll_long_dqs_rank1_0.
+	{ 0x00780078, 0x410 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ib_ddll_long_dqs_rank1_1.
+	{ 0x00780078, 0x414 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ib_ddll_long_dqs_rank1_2.
+	{ 0x00780078, 0x418 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ib_ddll_long_dqs_rank1_3.
+	{ 0x00180018, 0x41C / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ddll_long_cmd_0.
+	{ 0x000F000F, 0x420 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ddll_long_cmd_1.
+	{ 0x00000018, 0x42C / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_pmacro_ddll_long_cmd_4.
+	{ 0x2A800000, 0x6DC / 4, LPDDR4X_4GB_SAMSUNG_Y }, // mc_video_protect_gpu_override0.
+	{ 0x00000002, 0x6E0 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // mc_video_protect_gpu_override1.
 
-	// Samsung LPDDR4X 4GB 10nm-class (1y) Die-X for Iowa, Hoag and Aula.
-	{ 0x05500000, 0x0D4 / 4, DRAM_ID2(17) | DRAM_ID2(19) | DRAM_ID2(24) }, // emc_auto_cal_config2.
-	{ 0xC9AFBCBC, 0x0F4 / 4, DRAM_ID2(17) | DRAM_ID2(19) | DRAM_ID2(24) }, // emc_auto_cal_vref_sel0.
-	{ 0x00000006, 0x1CC / 4, DRAM_ID2(17) | DRAM_ID2(19) | DRAM_ID2(24) }, // emc_quse.
-	{ 0x00000005, 0x1D0 / 4, DRAM_ID2(17) | DRAM_ID2(19) | DRAM_ID2(24) }, // emc_quse_width.
-	{ 0x00000003, 0x1DC / 4, DRAM_ID2(17) | DRAM_ID2(19) | DRAM_ID2(24) }, // emc_einput.
-	{ 0x0000000C, 0x1E0 / 4, DRAM_ID2(17) | DRAM_ID2(19) | DRAM_ID2(24) }, // emc_einput_duration.
-	{ 0x88161414, 0x2E0 / 4, DRAM_ID2(17) | DRAM_ID2(19) | DRAM_ID2(24) }, // emc_mrw14.
-	{ 0x80000713, 0x32C / 4, DRAM_ID2(17) | DRAM_ID2(19) | DRAM_ID2(24) }, // emc_dyn_self_ref_control.
-	{ 0x2A800000, 0x6DC / 4, DRAM_ID2(17) | DRAM_ID2(19) | DRAM_ID2(24) }, // mc_video_protect_gpu_override0.
-	{ 0x00000002, 0x6E0 / 4, DRAM_ID2(17) | DRAM_ID2(19) | DRAM_ID2(24) }, // mc_video_protect_gpu_override1.
+	// Samsung LPDDR4X 4GB K4U6E3S4AA-MGCL 10nm-class (1y-X03) Die-A for retail Iowa, Hoag and Aula.
+	{ 0x05500000, 0x0D4 / 4, LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL }, // emc_auto_cal_config2.
+	{ 0xC9AFBCBC, 0x0F4 / 4, LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL }, // emc_auto_cal_vref_sel0.
+	{ 0x00000006, 0x1CC / 4, LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL }, // emc_quse.
+	{ 0x00000005, 0x1D0 / 4, LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL }, // emc_quse_width.
+	{ 0x00000003, 0x1DC / 4, LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL }, // emc_einput.
+	{ 0x0000000C, 0x1E0 / 4, LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL }, // emc_einput_duration.
+	{ 0x88161414, 0x2E0 / 4, LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL }, // emc_mrw14.
+	{ 0x80000713, 0x32C / 4, LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL }, // emc_dyn_self_ref_control.
+	{ 0x2A800000, 0x6DC / 4, LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL }, // mc_video_protect_gpu_override0.
+	{ 0x00000002, 0x6E0 / 4, LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL }, // mc_video_protect_gpu_override1.
 
-	// Samsung LPDDR4X 8GB 10nm-class (1y) Die-X for SDEV Iowa and Aula.
-	{ 0x05500000, 0x0D4 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_auto_cal_config2.
-	{ 0xC9AFBCBC, 0x0F4 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_auto_cal_vref_sel0.
-	{ 0x00000001, 0x134 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_adr_cfg. 2 Ranks.
-	{ 0x00000006, 0x1CC / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_quse.
-	{ 0x00000005, 0x1D0 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_quse_width.
-	{ 0x00000003, 0x1DC / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_einput.
-	{ 0x0000000C, 0x1E0 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_einput_duration.
-	{ 0x00000008, 0x24C / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_tfaw.
-	{ 0x08010004, 0x2B8 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_mrw1.
-	{ 0x08020000, 0x2BC / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_mrw2.
-	{ 0x080D0000, 0x2C0 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_mrw3.
-	{ 0x08033131, 0x2C8 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_mrw6.
-	{ 0x080B0000, 0x2CC / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_mrw8.
-	{ 0x0C0E5D5D, 0x2D0 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_mrw9.
-	{ 0x080C5D5D, 0x2D4 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_mrw10.
-	{ 0x0C0D0808, 0x2D8 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_mrw12.
-	{ 0x0C0D0000, 0x2DC / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_mrw13.
-	{ 0x08161414, 0x2E0 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_mrw14.
-	{ 0x08010004, 0x2E4 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_mrw_extra.
-	{ 0x00000000, 0x340 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_dev_select. Both devices.
-	{ 0x0051004F, 0x450 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_zcal_mrw_cmd.
-	{ 0x40000001, 0x45C / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_zcal_init_dev1.
-	{ 0x00000000, 0x594 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_pmacro_tx_pwrd4.
-	{ 0x00001000, 0x598 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // emc_pmacro_tx_pwrd5.
-	{ 0x00000001, 0x630 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // mc_emem_adr_cfg. 2 Ranks.
-	{ 0x00002000, 0x64C / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // mc_emem_cfg. 8GB total density.
-	{ 0x00000001, 0x670 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // mc_emem_arb_timing_faw.
-	{ 0x00000002, 0x680 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // mc_emem_arb_timing_r2r.
-	{ 0x02020001, 0x694 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // mc_emem_arb_da_turns.
-	{ 0x2A800000, 0x6DC / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // mc_video_protect_gpu_override0.
-	{ 0x00000002, 0x6E0 / 4, DRAM_ID2(18) | DRAM_ID2(23) }, // mc_video_protect_gpu_override1.
+	// Samsung LPDDR4X 8GB K4UBE3D4AA-MGCL 10nm-class (1y-X03) Die-A for SDEV Iowa, Hoag and Aula.
+	{ 0x05500000, 0x0D4 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_auto_cal_config2.
+	{ 0xC9AFBCBC, 0x0F4 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_auto_cal_vref_sel0.
+	{ 0x00000001, 0x134 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_adr_cfg. 2 Ranks.
+	{ 0x00000006, 0x1CC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_quse.
+	{ 0x00000005, 0x1D0 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_quse_width.
+	{ 0x00000003, 0x1DC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_einput.
+	{ 0x0000000C, 0x1E0 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_einput_duration.
+	{ 0x00000008, 0x24C / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_tfaw.
+	{ 0x08010004, 0x2B8 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_mrw1.
+	{ 0x08020000, 0x2BC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_mrw2.
+	{ 0x080D0000, 0x2C0 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_mrw3.
+	{ 0x08033131, 0x2C8 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_mrw6.
+	{ 0x080B0000, 0x2CC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_mrw8.
+	{ 0x0C0E5D5D, 0x2D0 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_mrw9.
+	{ 0x080C5D5D, 0x2D4 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_mrw10.
+	{ 0x0C0D0808, 0x2D8 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_mrw12.
+	{ 0x0C0D0000, 0x2DC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_mrw13.
+	{ 0x08161414, 0x2E0 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_mrw14.
+	{ 0x08010004, 0x2E4 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_mrw_extra.
+	{ 0x00000000, 0x340 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_dev_select. Both devices.
+	{ 0x0051004F, 0x450 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_zcal_mrw_cmd.
+	{ 0x40000001, 0x45C / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_zcal_init_dev1.
+	{ 0x00000000, 0x594 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_pmacro_tx_pwrd4.
+	{ 0x00001000, 0x598 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // emc_pmacro_tx_pwrd5.
+	{ 0x00000001, 0x630 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // mc_emem_adr_cfg. 2 Ranks.
+	{ 0x00002000, 0x64C / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // mc_emem_cfg. 8GB total density.
+	{ 0x00000001, 0x670 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // mc_emem_arb_timing_faw.
+	{ 0x00000002, 0x680 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // mc_emem_arb_timing_r2r.
+	{ 0x02020001, 0x694 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // mc_emem_arb_da_turns.
+	{ 0x2A800000, 0x6DC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // mc_video_protect_gpu_override0.
+	{ 0x00000002, 0x6E0 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL }, // mc_video_protect_gpu_override1.
 
-	// Samsung LPDDR4X 4GB 10nm-class (1y) Die-Y for Iowa.
-	{ 0x05500000, 0x0D4 / 4, DRAM_ID2(20) }, // emc_auto_cal_config2.
-	{ 0xC9AFBCBC, 0x0F4 / 4, DRAM_ID2(20) }, // emc_auto_cal_vref_sel0.
-	{ 0x00000008, 0x24C / 4, DRAM_ID2(20) }, // emc_tfaw.
-	{ 0x88161414, 0x2E0 / 4, DRAM_ID2(20) }, // emc_mrw14.
-	{ 0x80000713, 0x32C / 4, DRAM_ID2(20) }, // emc_dyn_self_ref_control.
-	{ 0x000F0018, 0x3AC / 4, DRAM_ID2(20) }, // emc_pmacro_ob_ddll_long_dq_rank0_4.
-	{ 0x000F0018, 0x3C4 / 4, DRAM_ID2(20) }, // emc_pmacro_ob_ddll_long_dq_rank1_4.
-	{ 0x00440048, 0x3CC / 4, DRAM_ID2(20) }, // emc_pmacro_ob_ddll_long_dqs_rank0_0.
-	{ 0x00440045, 0x3D0 / 4, DRAM_ID2(20) }, // emc_pmacro_ob_ddll_long_dqs_rank0_1.
-	{ 0x00470047, 0x3D4 / 4, DRAM_ID2(20) }, // emc_pmacro_ob_ddll_long_dqs_rank0_2.
-	{ 0x0005000D, 0x3DC / 4, DRAM_ID2(20) }, // emc_pmacro_ob_ddll_long_dqs_rank0_4.
-	{ 0x00440048, 0x3E4 / 4, DRAM_ID2(20) }, // emc_pmacro_ob_ddll_long_dqs_rank1_0.
-	{ 0x00440045, 0x3E8 / 4, DRAM_ID2(20) }, // emc_pmacro_ob_ddll_long_dqs_rank1_1.
-	{ 0x00470047, 0x3EC / 4, DRAM_ID2(20) }, // emc_pmacro_ob_ddll_long_dqs_rank1_2.
-	{ 0x0005000D, 0x3F4 / 4, DRAM_ID2(20) }, // emc_pmacro_ob_ddll_long_dqs_rank1_4.
-	{ 0x00180018, 0x41C / 4, DRAM_ID2(20) }, // emc_pmacro_ddll_long_cmd_0.
-	{ 0x000F000F, 0x420 / 4, DRAM_ID2(20) }, // emc_pmacro_ddll_long_cmd_1.
-	{ 0x00000018, 0x42C / 4, DRAM_ID2(20) }, // emc_pmacro_ddll_long_cmd_4.
-	{ 0x00000001, 0x670 / 4, DRAM_ID2(20) }, // mc_emem_arb_timing_faw.
-	{ 0x2A800000, 0x6DC / 4, DRAM_ID2(20) }, // mc_video_protect_gpu_override0.
-	{ 0x00000002, 0x6E0 / 4, DRAM_ID2(20) }, // mc_video_protect_gpu_override1.
+	// Samsung LPDDR4X 4GB 10nm-class (1y-Y01) Die-? for Iowa.
+	{ 0x05500000, 0x0D4 / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_auto_cal_config2.
+	{ 0xC9AFBCBC, 0x0F4 / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_auto_cal_vref_sel0.
+	{ 0x00000008, 0x24C / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_tfaw.
+	{ 0x88161414, 0x2E0 / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_mrw14.
+	{ 0x80000713, 0x32C / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_dyn_self_ref_control.
+	{ 0x000F0018, 0x3AC / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dq_rank0_4.
+	{ 0x000F0018, 0x3C4 / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dq_rank1_4.
+	{ 0x00440048, 0x3CC / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank0_0.
+	{ 0x00440045, 0x3D0 / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank0_1.
+	{ 0x00470047, 0x3D4 / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank0_2.
+	{ 0x0005000D, 0x3DC / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank0_4.
+	{ 0x00440048, 0x3E4 / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank1_0.
+	{ 0x00440045, 0x3E8 / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank1_1.
+	{ 0x00470047, 0x3EC / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank1_2.
+	{ 0x0005000D, 0x3F4 / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank1_4.
+	{ 0x00180018, 0x41C / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_pmacro_ddll_long_cmd_0.
+	{ 0x000F000F, 0x420 / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_pmacro_ddll_long_cmd_1.
+	{ 0x00000018, 0x42C / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // emc_pmacro_ddll_long_cmd_4.
+	{ 0x00000001, 0x670 / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // mc_emem_arb_timing_faw.
+	{ 0x2A800000, 0x6DC / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // mc_video_protect_gpu_override0.
+	{ 0x00000002, 0x6E0 / 4, LPDDR4X_4GB_SAMSUNG_1Y_Y }, // mc_video_protect_gpu_override1.
 
-	// Samsung LPDDR4X 8GB 10nm-class (1y) Die-Y for SDEV Iowa.
-	{ 0x05500000, 0x0D4 / 4, DRAM_ID2(21) }, // emc_auto_cal_config2.
-	{ 0xC9AFBCBC, 0x0F4 / 4, DRAM_ID2(21) }, // emc_auto_cal_vref_sel0.
-	{ 0x00000001, 0x134 / 4, DRAM_ID2(21) }, // emc_adr_cfg. 2 Ranks.
-	{ 0x00000008, 0x24C / 4, DRAM_ID2(21) }, // emc_tfaw.
-	{ 0x08010004, 0x2B8 / 4, DRAM_ID2(21) }, // emc_mrw1.
-	{ 0x08020000, 0x2BC / 4, DRAM_ID2(21) }, // emc_mrw2.
-	{ 0x080D0000, 0x2C0 / 4, DRAM_ID2(21) }, // emc_mrw3.
-	{ 0x08033131, 0x2C8 / 4, DRAM_ID2(21) }, // emc_mrw6.
-	{ 0x080B0000, 0x2CC / 4, DRAM_ID2(21) }, // emc_mrw8.
-	{ 0x0C0E5D5D, 0x2D0 / 4, DRAM_ID2(21) }, // emc_mrw9.
-	{ 0x080C5D5D, 0x2D4 / 4, DRAM_ID2(21) }, // emc_mrw10.
-	{ 0x0C0D0808, 0x2D8 / 4, DRAM_ID2(21) }, // emc_mrw12.
-	{ 0x0C0D0000, 0x2DC / 4, DRAM_ID2(21) }, // emc_mrw13.
-	{ 0x08161414, 0x2E0 / 4, DRAM_ID2(21) }, // emc_mrw14.
-	{ 0x08010004, 0x2E4 / 4, DRAM_ID2(21) }, // emc_mrw_extra.
-	{ 0x00000000, 0x340 / 4, DRAM_ID2(21) }, // emc_dev_select. Both devices.
-	{ 0x32323232, 0x350 / 4, DRAM_ID2(21) }, // emc_pmacro_ib_vref_dq_0.
-	{ 0x32323232, 0x354 / 4, DRAM_ID2(21) }, // emc_pmacro_ib_vref_dq_1.
-	{ 0x000F0018, 0x3AC / 4, DRAM_ID2(21) }, // emc_pmacro_ob_ddll_long_dq_rank0_4.
-	{ 0x000F0018, 0x3C4 / 4, DRAM_ID2(21) }, // emc_pmacro_ob_ddll_long_dq_rank1_4.
-	{ 0x00440048, 0x3CC / 4, DRAM_ID2(21) }, // emc_pmacro_ob_ddll_long_dqs_rank0_0.
-	{ 0x00440045, 0x3D0 / 4, DRAM_ID2(21) }, // emc_pmacro_ob_ddll_long_dqs_rank0_1.
-	{ 0x00470047, 0x3D4 / 4, DRAM_ID2(21) }, // emc_pmacro_ob_ddll_long_dqs_rank0_2.
-	{ 0x0005000D, 0x3DC / 4, DRAM_ID2(21) }, // emc_pmacro_ob_ddll_long_dqs_rank0_4.
-	{ 0x00440048, 0x3E4 / 4, DRAM_ID2(21) }, // emc_pmacro_ob_ddll_long_dqs_rank1_0.
-	{ 0x00440045, 0x3E8 / 4, DRAM_ID2(21) }, // emc_pmacro_ob_ddll_long_dqs_rank1_1.
-	{ 0x00470047, 0x3EC / 4, DRAM_ID2(21) }, // emc_pmacro_ob_ddll_long_dqs_rank1_2.
-	{ 0x0005000D, 0x3F4 / 4, DRAM_ID2(21) }, // emc_pmacro_ob_ddll_long_dqs_rank1_4.
-	{ 0x00180018, 0x41C / 4, DRAM_ID2(21) }, // emc_pmacro_ddll_long_cmd_0.
-	{ 0x000F000F, 0x420 / 4, DRAM_ID2(21) }, // emc_pmacro_ddll_long_cmd_1.
-	{ 0x00000018, 0x42C / 4, DRAM_ID2(21) }, // emc_pmacro_ddll_long_cmd_4.
-	{ 0x0051004F, 0x450 / 4, DRAM_ID2(21) }, // emc_zcal_mrw_cmd.
-	{ 0x40000001, 0x45C / 4, DRAM_ID2(21) }, // emc_zcal_init_dev1.
-	{ 0x00000000, 0x594 / 4, DRAM_ID2(21) }, // emc_pmacro_tx_pwrd4.
-	{ 0x00001000, 0x598 / 4, DRAM_ID2(21) }, // emc_pmacro_tx_pwrd5.
-	{ 0x00000001, 0x630 / 4, DRAM_ID2(21) }, // mc_emem_adr_cfg. 2 Ranks.
-	{ 0x00002000, 0x64C / 4, DRAM_ID2(21) }, // mc_emem_cfg. 8GB total density.
-	{ 0x00000001, 0x670 / 4, DRAM_ID2(21) }, // mc_emem_arb_timing_faw.
-	{ 0x00000002, 0x680 / 4, DRAM_ID2(21) }, // mc_emem_arb_timing_r2r.
-	{ 0x02020001, 0x694 / 4, DRAM_ID2(21) }, // mc_emem_arb_da_turns.
-	{ 0x2A800000, 0x6DC / 4, DRAM_ID2(21) }, // mc_video_protect_gpu_override0.
-	{ 0x00000002, 0x6E0 / 4, DRAM_ID2(21) }, // mc_video_protect_gpu_override1.
+	// Samsung LPDDR4X 8GB 10nm-class (1y-Y01) Die-? for SDEV Iowa.
+	{ 0x05500000, 0x0D4 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_auto_cal_config2.
+	{ 0xC9AFBCBC, 0x0F4 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_auto_cal_vref_sel0.
+	{ 0x00000001, 0x134 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_adr_cfg. 2 Ranks.
+	{ 0x00000008, 0x24C / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_tfaw.
+	{ 0x08010004, 0x2B8 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_mrw1.
+	{ 0x08020000, 0x2BC / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_mrw2.
+	{ 0x080D0000, 0x2C0 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_mrw3.
+	{ 0x08033131, 0x2C8 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_mrw6.
+	{ 0x080B0000, 0x2CC / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_mrw8.
+	{ 0x0C0E5D5D, 0x2D0 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_mrw9.
+	{ 0x080C5D5D, 0x2D4 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_mrw10.
+	{ 0x0C0D0808, 0x2D8 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_mrw12.
+	{ 0x0C0D0000, 0x2DC / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_mrw13.
+	{ 0x08161414, 0x2E0 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_mrw14.
+	{ 0x08010004, 0x2E4 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_mrw_extra.
+	{ 0x00000000, 0x340 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_dev_select. Both devices.
+	{ 0x32323232, 0x350 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ib_vref_dq_0.
+	{ 0x32323232, 0x354 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ib_vref_dq_1.
+	{ 0x000F0018, 0x3AC / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dq_rank0_4.
+	{ 0x000F0018, 0x3C4 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dq_rank1_4.
+	{ 0x00440048, 0x3CC / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank0_0.
+	{ 0x00440045, 0x3D0 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank0_1.
+	{ 0x00470047, 0x3D4 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank0_2.
+	{ 0x0005000D, 0x3DC / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank0_4.
+	{ 0x00440048, 0x3E4 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank1_0.
+	{ 0x00440045, 0x3E8 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank1_1.
+	{ 0x00470047, 0x3EC / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank1_2.
+	{ 0x0005000D, 0x3F4 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ob_ddll_long_dqs_rank1_4.
+	{ 0x00180018, 0x41C / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ddll_long_cmd_0.
+	{ 0x000F000F, 0x420 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ddll_long_cmd_1.
+	{ 0x00000018, 0x42C / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_ddll_long_cmd_4.
+	{ 0x0051004F, 0x450 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_zcal_mrw_cmd.
+	{ 0x40000001, 0x45C / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_zcal_init_dev1.
+	{ 0x00000000, 0x594 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_tx_pwrd4.
+	{ 0x00001000, 0x598 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // emc_pmacro_tx_pwrd5.
+	{ 0x00000001, 0x630 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // mc_emem_adr_cfg. 2 Ranks.
+	{ 0x00002000, 0x64C / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // mc_emem_cfg. 8GB total density.
+	{ 0x00000001, 0x670 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // mc_emem_arb_timing_faw.
+	{ 0x00000002, 0x680 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // mc_emem_arb_timing_r2r.
+	{ 0x02020001, 0x694 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // mc_emem_arb_da_turns.
+	{ 0x2A800000, 0x6DC / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // mc_video_protect_gpu_override0.
+	{ 0x00000002, 0x6E0 / 4, LPDDR4X_8GB_SAMSUNG_1Y_Y }, // mc_video_protect_gpu_override1.
 
-	// Samsung LPDDR4X 4GB 10nm-class (1y) Die-A for Unknown Aula.
-	{ 0x05500000, 0x0D4 / 4, DRAM_ID2(22) }, // emc_auto_cal_config2.
-	{ 0xC9AFBCBC, 0x0F4 / 4, DRAM_ID2(22) }, // emc_auto_cal_vref_sel0.
-	{ 0x00000008, 0x24C / 4, DRAM_ID2(22) }, // emc_tfaw.
-	{ 0x1C041B06, 0x26C / 4, DRAM_ID2(22) }, // emc_cmd_mapping_cmd0_0.
-	{ 0x02050307, 0x270 / 4, DRAM_ID2(22) }, // emc_cmd_mapping_cmd0_1.
-	{ 0x03252500, 0x274 / 4, DRAM_ID2(22) }, // emc_cmd_mapping_cmd0_2.
-	{ 0x081D1E00, 0x278 / 4, DRAM_ID2(22) }, // emc_cmd_mapping_cmd1_0.
-	{ 0x090C0A0D, 0x27C / 4, DRAM_ID2(22) }, // emc_cmd_mapping_cmd1_1.
-	{ 0x0526260B, 0x280 / 4, DRAM_ID2(22) }, // emc_cmd_mapping_cmd1_2.
-	{ 0x05030402, 0x284 / 4, DRAM_ID2(22) }, // emc_cmd_mapping_cmd2_0.
-	{ 0x1B1C0600, 0x288 / 4, DRAM_ID2(22) }, // emc_cmd_mapping_cmd2_1.
-	{ 0x07252507, 0x28C / 4, DRAM_ID2(22) }, // emc_cmd_mapping_cmd2_2.
-	{ 0x0C1D0B0A, 0x290 / 4, DRAM_ID2(22) }, // emc_cmd_mapping_cmd3_0.
-	{ 0x0800090D, 0x294 / 4, DRAM_ID2(22) }, // emc_cmd_mapping_cmd3_1.
-	{ 0x0926261E, 0x298 / 4, DRAM_ID2(22) }, // emc_cmd_mapping_cmd3_2.
-	{ 0x2A080624, 0x29C / 4, DRAM_ID2(22) }, // emc_cmd_mapping_byte.
-	{ 0x88161414, 0x2E0 / 4, DRAM_ID2(22) }, // emc_mrw14.
-	{ 0x80000713, 0x32C / 4, DRAM_ID2(22) }, // emc_dyn_self_ref_control.
-	{ 0x00140010, 0x3AC / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dq_rank0_4.
-	{ 0x0013000B, 0x3B0 / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dq_rank0_5.
-	{ 0x00140010, 0x3C4 / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dq_rank1_4.
-	{ 0x0013000B, 0x3C8 / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dq_rank1_5.
-	{ 0x00450047, 0x3CC / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dqs_rank0_0.
-	{ 0x004D004F, 0x3D0 / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dqs_rank0_1.
-	{ 0x00460046, 0x3D4 / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dqs_rank0_2.
-	{ 0x00480048, 0x3D8 / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dqs_rank0_3.
-	{ 0x000C0008, 0x3DC / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dqs_rank0_4.
-	{ 0x000B000C, 0x3E0 / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dqs_rank0_5.
-	{ 0x00450047, 0x3E4 / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dqs_rank1_0.
-	{ 0x004D004F, 0x3E8 / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dqs_rank1_1.
-	{ 0x00460046, 0x3EC / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dqs_rank1_2.
-	{ 0x00480048, 0x3F0 / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dqs_rank1_3.
-	{ 0x000C0008, 0x3F4 / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dqs_rank1_4.
-	{ 0x000B000C, 0x3F8 / 4, DRAM_ID2(22) }, // emc_pmacro_ob_ddll_long_dqs_rank1_5.
-	{ 0x00100010, 0x41C / 4, DRAM_ID2(22) }, // emc_pmacro_ddll_long_cmd_0.
-	{ 0x00140014, 0x420 / 4, DRAM_ID2(22) }, // emc_pmacro_ddll_long_cmd_1.
-	{ 0x00130013, 0x428 / 4, DRAM_ID2(22) }, // emc_pmacro_ddll_long_cmd_3.
-	{ 0x00000010, 0x42C / 4, DRAM_ID2(22) }, // emc_pmacro_ddll_long_cmd_4.
-	{ 0x40280100, 0x4B4 / 4, DRAM_ID2(22) }, // pmc_ddr_cfg.
-	{ 0x4F9F9FFF, 0x4B8 / 4, DRAM_ID2(22) }, // pmc_io_dpd3_req.
-	{ 0x64032157, 0x4D8 / 4, DRAM_ID2(22) }, // emc_swizzle_rank0_byte0.
-	{ 0x51320467, 0x4DC / 4, DRAM_ID2(22) }, // emc_swizzle_rank0_byte1.
-	{ 0x04735621, 0x4E0 / 4, DRAM_ID2(22) }, // emc_swizzle_rank0_byte2.
-	{ 0x47356012, 0x4E4 / 4, DRAM_ID2(22) }, // emc_swizzle_rank0_byte3.
-	{ 0x12045673, 0x4E8 / 4, DRAM_ID2(22) }, // emc_swizzle_rank1_byte0.
-	{ 0x43657210, 0x4EC / 4, DRAM_ID2(22) }, // emc_swizzle_rank1_byte1.
-	{ 0x65402137, 0x4F0 / 4, DRAM_ID2(22) }, // emc_swizzle_rank1_byte2.
-	{ 0x57302164, 0x4F4 / 4, DRAM_ID2(22) }, // emc_swizzle_rank1_byte3.
-	{ 0x4F9F9FFF, 0x534 / 4, DRAM_ID2(22) }, // emc_pmc_scratch1.
-	{ 0x4033CF1F, 0x53C / 4, DRAM_ID2(22) }, // emc_pmc_scratch3.
-	{ 0x10000000, 0x590 / 4, DRAM_ID2(22) }, // emc_pmacro_tx_pwrd3.
-	{ 0x00030108, 0x594 / 4, DRAM_ID2(22) }, // emc_pmacro_tx_pwrd4.
-	{ 0x01400050, 0x598 / 4, DRAM_ID2(22) }, // emc_pmacro_tx_pwrd5.
-	{ 0x29081081, 0x5A0 / 4, DRAM_ID2(22) }, // emc_pmacro_brick_mapping0.
-	{ 0x54A59332, 0x5A4 / 4, DRAM_ID2(22) }, // emc_pmacro_brick_mapping1.
-	{ 0x87766B4A, 0x5A8 / 4, DRAM_ID2(22) }, // emc_pmacro_brick_mapping2.
-	{ 0x00000001, 0x670 / 4, DRAM_ID2(22) }, // mc_emem_arb_timing_faw.
-	{ 0xE4FACB43, 0x6D4 / 4, DRAM_ID2(22) }, // mc_video_protect_vpr_override. + TSEC, NVENC.
-	{ 0x0600FED3, 0x6D8 / 4, DRAM_ID2(22) }, // mc_video_protect_vpr_override1. + TSECB, TSEC1, TSECB1.
-	{ 0x2A800000, 0x6DC / 4, DRAM_ID2(22) }, // mc_video_protect_gpu_override0.
-	{ 0x00000002, 0x6E0 / 4, DRAM_ID2(22) }, // mc_video_protect_gpu_override1.
-	{ 0x0000009C, 0x814 / 4, DRAM_ID2(22) }, // swizzle_rank_byte_encode.
+/*
+	// Samsung LPDDR4X 8GB 10nm-class (1y-A01) Die-? for SDEV Aula?
+	{ 0x00000001, 0x134 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_adr_cfg. 2 Ranks.
+	{ 0x08010004, 0x2B8 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_mrw1.
+	{ 0x08020000, 0x2BC / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_mrw2.
+	{ 0x080D0000, 0x2C0 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_mrw3.
+	{ 0x08033131, 0x2C8 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_mrw6.
+	{ 0x080B0000, 0x2CC / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_mrw8.
+	{ 0x0C0E5D5D, 0x2D0 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_mrw9.
+	{ 0x080C5D5D, 0x2D4 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_mrw10.
+	{ 0x0C0D0808, 0x2D8 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_mrw12.
+	{ 0x0C0D0000, 0x2DC / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_mrw13.
+	{ 0x08161414, 0x2E0 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_mrw14.
+	{ 0x08010004, 0x2E4 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_mrw_extra.
+	{ 0x00000000, 0x340 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_dev_select. Both devices.
+	{ 0x35353535, 0x350 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_ib_vref_dq_0.
+	{ 0x35353535, 0x354 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_ib_vref_dq_1.
+	{ 0x35353535, 0x358 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_ib_vref_dqs_0.
+	{ 0x35353535, 0x35C / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_ib_vref_dqs_1.
+	{ 0x00480048, 0x3FC / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_ib_ddll_long_dqs_rank0_0.
+	{ 0x00480048, 0x400 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_ib_ddll_long_dqs_rank0_1.
+	{ 0x00480048, 0x404 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_ib_ddll_long_dqs_rank0_2.
+	{ 0x00480048, 0x408 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_ib_ddll_long_dqs_rank0_3.
+	{ 0x00480048, 0x40C / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_ib_ddll_long_dqs_rank1_0.
+	{ 0x00480048, 0x410 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_ib_ddll_long_dqs_rank1_1.
+	{ 0x00480048, 0x414 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_ib_ddll_long_dqs_rank1_2.
+	{ 0x00480048, 0x418 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_ib_ddll_long_dqs_rank1_3.
+	{ 0x0051004F, 0x450 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_zcal_mrw_cmd.
+	{ 0x40000001, 0x45C / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_zcal_init_dev1.
+	{ 0x00010100, 0x594 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_tx_pwrd4.
+	{ 0x00400010, 0x598 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // emc_pmacro_tx_pwrd5.
+	{ 0x00000001, 0x630 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // mc_emem_adr_cfg. 2 Ranks.
+	{ 0x00002000, 0x64C / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // mc_emem_cfg. 8GB total density.
+	{ 0x00000002, 0x670 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // mc_emem_arb_timing_faw.
+	{ 0x00000002, 0x680 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // mc_emem_arb_timing_r2r.
+	{ 0x02020001, 0x694 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // mc_emem_arb_da_turns.
+*/
 
-	// Micron LPDDR4X 4GB 10nm-class (1y) Die-A for Unknown Iowa/Hoag/Aula.
-	{ 0x05500000, 0x0D4 / 4, DRAM_ID2(25) | DRAM_ID2(26) | DRAM_ID2(27) }, // emc_auto_cal_config2.
-	{ 0xC9AFBCBC, 0x0F4 / 4, DRAM_ID2(25) | DRAM_ID2(26) | DRAM_ID2(27) }, // emc_auto_cal_vref_sel0.
-	{ 0x00000006, 0x1CC / 4, DRAM_ID2(25) | DRAM_ID2(26) | DRAM_ID2(27) }, // emc_quse.
-	{ 0x00000005, 0x1D0 / 4, DRAM_ID2(25) | DRAM_ID2(26) | DRAM_ID2(27) }, // emc_quse_width.
-	{ 0x00000003, 0x1DC / 4, DRAM_ID2(25) | DRAM_ID2(26) | DRAM_ID2(27) }, // emc_einput.
-	{ 0x0000000C, 0x1E0 / 4, DRAM_ID2(25) | DRAM_ID2(26) | DRAM_ID2(27) }, // emc_einput_duration.
-	{ 0x00000008, 0x24C / 4, DRAM_ID2(25) | DRAM_ID2(26) | DRAM_ID2(27) }, // emc_tfaw.
-	{ 0x88161414, 0x2E0 / 4, DRAM_ID2(25) | DRAM_ID2(26) | DRAM_ID2(27) }, // emc_mrw14.
-	{ 0x80000713, 0x32C / 4, DRAM_ID2(25) | DRAM_ID2(26) | DRAM_ID2(27) }, // emc_dyn_self_ref_control.
-	{ 0x00000001, 0x670 / 4, DRAM_ID2(25) | DRAM_ID2(26) | DRAM_ID2(27) }, // mc_emem_arb_timing_faw.
-	{ 0x2A800000, 0x6DC / 4, DRAM_ID2(25) | DRAM_ID2(26) | DRAM_ID2(27) }, // mc_video_protect_gpu_override0.
-	{ 0x00000002, 0x6E0 / 4, DRAM_ID2(25) | DRAM_ID2(26) | DRAM_ID2(27) }, // mc_video_protect_gpu_override1.
+	// Micron LPDDR4X 4GB MT53D1024M32D1NP-053-WT:F 10nm-class (1y-01) Die-F for Newer Iowa/Hoag/Aula.
+	{ 0x05500000, 0x0D4 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_auto_cal_config2.
+	{ 0xC9AFBCBC, 0x0F4 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_auto_cal_vref_sel0.
+	{ 0x00000006, 0x1CC / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_quse.
+	{ 0x00000005, 0x1D0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_quse_width.
+	{ 0x00000003, 0x1DC / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_einput.
+	{ 0x0000000C, 0x1E0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_einput_duration.
+	{ 0x00000008, 0x24C / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_tfaw.
+	{ 0x88161414, 0x2E0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_mrw14.
+	{ 0x80000713, 0x32C / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_dyn_self_ref_control.
+	{ 0x00000001, 0x670 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // mc_emem_arb_timing_faw.
+	{ 0x2A800000, 0x6DC / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // mc_video_protect_gpu_override0.
+	{ 0x00000002, 0x6E0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // mc_video_protect_gpu_override1.
+
+	// Hynix LPDDR4X 4GB 10nm-class (1y-01) Die-A for Unknown Iowa/Hoag/Aula.
+	{ 0x05500000, 0x0D4 / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // emc_auto_cal_config2.
+	{ 0xC9AFBCBC, 0x0F4 / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // emc_auto_cal_vref_sel0.
+	{ 0x00000006, 0x1CC / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // emc_quse.
+	{ 0x00000005, 0x1D0 / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // emc_quse_width.
+	{ 0x00000003, 0x1DC / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // emc_einput.
+	{ 0x0000000C, 0x1E0 / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // emc_einput_duration.
+	{ 0x00000008, 0x24C / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // emc_tfaw.
+	{ 0x88161414, 0x2E0 / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // emc_mrw14.
+	{ 0x80000713, 0x32C / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // emc_dyn_self_ref_control.
+	{ 0x00000001, 0x670 / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // mc_emem_arb_timing_faw.
+	{ 0xE4FACB43, 0x6D4 / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // mc_video_protect_vpr_override. + TSEC, NVENC.
+	{ 0x0600FED3, 0x6D8 / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // mc_video_protect_vpr_override1. + TSECB, TSEC1, TSECB1.
+	{ 0x2A800000, 0x6DC / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // mc_video_protect_gpu_override0.
+	{ 0x00000002, 0x6E0 / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // mc_video_protect_gpu_override1.
+
+	//!TODO: Too many duplicates.
 };

bdk/mem/sdram_lp0.c

@@ -1385,24 +1385,24 @@ static void _sdram_lp0_save_params_t210b01(const void *params)
 	s(emc_warm_boot_mrw_extra, 31:30, scratch6, 3:2);
 	s(emc_mrw_lpddr2zcal_warm_boot, 27:26, scratch6, 5:4);
 	s(emc_warm_boot_mrw_extra, 27:26, scratch6, 7:6);
-	s(EmcMrw6, 27:0, scratch8, 27:0);
-	s(EmcMrw6, 31:30, scratch8, 29:28);
-	s(EmcMrw8, 27:0, scratch9, 27:0);
-	s(EmcMrw8, 31:30, scratch9, 29:28);
-	s(EmcMrw9, 27:0, scratch10, 27:0);
-	s(EmcMrw9, 31:30, scratch10, 29:28);
-	s(EmcMrw10, 27:0, scratch11, 27:0);
-	s(EmcMrw10, 31:30, scratch11, 29:28);
-	s(EmcMrw12, 27:0, scratch12, 27:0);
-	s(EmcMrw12, 31:30, scratch12, 29:28);
-	s(EmcMrw13, 27:0, scratch13, 27:0);
-	s(EmcMrw13, 31:30, scratch13, 29:28);
-	s(EmcMrw14, 27:0, scratch14, 27:0);
-	s(EmcMrw14, 31:30, scratch14, 29:28);
-	s(EmcMrw1, 7:0, scratch15, 7:0);
-	s(EmcMrw1, 23:16, scratch15, 15:8);
-	s(EmcMrw1, 27:26, scratch15, 17:16);
-	s(EmcMrw1, 31:30, scratch15, 19:18);
+	s(emc_mrw6, 27:0, scratch8, 27:0);
+	s(emc_mrw6, 31:30, scratch8, 29:28);
+	s(emc_mrw8, 27:0, scratch9, 27:0);
+	s(emc_mrw8, 31:30, scratch9, 29:28);
+	s(emc_mrw9, 27:0, scratch10, 27:0);
+	s(emc_mrw9, 31:30, scratch10, 29:28);
+	s(emc_mrw10, 27:0, scratch11, 27:0);
+	s(emc_mrw10, 31:30, scratch11, 29:28);
+	s(emc_mrw12, 27:0, scratch12, 27:0);
+	s(emc_mrw12, 31:30, scratch12, 29:28);
+	s(emc_mrw13, 27:0, scratch13, 27:0);
+	s(emc_mrw13, 31:30, scratch13, 29:28);
+	s(emc_mrw14, 27:0, scratch14, 27:0);
+	s(emc_mrw14, 31:30, scratch14, 29:28);
+	s(emc_mrw1, 7:0, scratch15, 7:0);
+	s(emc_mrw1, 23:16, scratch15, 15:8);
+	s(emc_mrw1, 27:26, scratch15, 17:16);
+	s(emc_mrw1, 31:30, scratch15, 19:18);
 	s(emc_warm_boot_mrw_extra, 7:0, scratch16, 7:0);
 	s(emc_warm_boot_mrw_extra, 23:16, scratch16, 15:8);
 	s(emc_warm_boot_mrw_extra, 27:26, scratch16, 17:16);
@@ -1518,7 +1518,7 @@ static void _sdram_lp0_save_params_t210b01(const void *params)
 	s(pllm_kcp, 1:0, scratch3, 23:22);
 
 	c32(0, scratch36);
-	s(PllMSetupControl, 23:0, scratch36, 23:0);
+	s(pllm_setup_control, 23:0, scratch36, 23:0);
 
 	c32(0, scratch4);
 	s(pllm_stable_time, 9:0, scratch4, 9:0); // s32(pllm_stable_time, scratch4);, s(pllm_stable_time, 31:0, scratch4, 31:10);

bdk/mem/smmu.c

@@ -48,8 +48,8 @@ u8 smmu_payload[] __attribute__((aligned(16))) = {
 void *page_alloc(u32 num)
 {
 	u8 *res = _pageheap;
-	_pageheap += 0x1000 * num;
-	memset(res, 0, 0x1000 * num);
+	_pageheap += SZ_PAGE * num;
+	memset(res, 0, SZ_PAGE * num);
 	return res;
 }
 
@@ -150,8 +150,8 @@ void smmu_map(u32 *pdir, u32 addr, u32 page, int cnt, u32 attr)
 	{
 		u32 *pte = smmu_get_pte(pdir, addr);
 		*pte = SMMU_ADDR_TO_PFN(page) | attr;
-		addr += 0x1000;
-		page += 0x1000;
+		addr += SZ_PAGE;
+		page += SZ_PAGE;
 	}
 	smmu_flush_all();
 }

bdk/memory_map.h

@@ -23,7 +23,7 @@
 #define LDR_LOAD_ADDR     0x40007000
 
 #define IPL_LOAD_ADDR     0x40008000
-#define  IPL_SZ_MAX          0x20000 // 128KB.
+#define  IPL_SZ_MAX          SZ_128K
 
 /* --- XUSB EP context and TRB ring buffers --- */
 #define XUSB_RING_ADDR    0x40020000
@@ -35,16 +35,16 @@
 
 /* --- DRAM START --- */
 #define DRAM_START     0x80000000
-#define  HOS_RSVD       0x1000000 // Do not write anything in this area.
+#define  HOS_RSVD          SZ_16M // Do not write anything in this area.
 
 #define NYX_LOAD_ADDR  0x81000000
-#define  NYX_SZ_MAX     0x1000000 // 16MB
+#define  NYX_SZ_MAX        SZ_16M
 /* --- Gap: 0x82000000 - 0x82FFFFFF --- */
 
 /* Stack theoretical max: 33MB */
 #define IPL_STACK_TOP  0x83100000
 #define IPL_HEAP_START 0x84000000
-#define  IPL_HEAP_SZ   0x20000000 // 512MB.
+#define  IPL_HEAP_SZ      SZ_512M
 /* --- Gap: 1040MB 0xA4000000 - 0xE4FFFFFF --- */
 
 // Virtual disk / Chainloader buffers.
@@ -60,25 +60,25 @@
 
 // L4T Kernel Panic Storage (PSTORE).
 #define PSTORE_ADDR   0xB0000000
-#define  PSTORE_SZ      0x200000 // 2MB.
+#define  PSTORE_SZ         SZ_2M
 
 //#define DRAM_LIB_ADDR    0xE0000000
 /* --- Chnldr: 252MB 0xC03C0000 - 0xCFFFFFFF --- */ //! Only used when chainloading.
 
 // SDMMC DMA buffers 1
 #define SDMMC_UPPER_BUFFER 0xE5000000
-#define  SDMMC_UP_BUF_SZ    0x8000000 // 128MB.
+#define  SDMMC_UP_BUF_SZ      SZ_128M
 
 // Nyx buffers.
 #define NYX_STORAGE_ADDR 0xED000000
 #define NYX_RES_ADDR     0xEE000000
-#define  NYX_RES_SZ       0x1000000 // 16MB.
+#define  NYX_RES_SZ          SZ_16M
 
 // SDMMC DMA buffers 2
 #define SDXC_BUF_ALIGNED   0xEF000000
 #define MIXD_BUF_ALIGNED   0xF0000000
 #define EMMC_BUF_ALIGNED   MIXD_BUF_ALIGNED
-#define  SDMMC_DMA_BUF_SZ   0x1000000 // 16MB (4MB currently used).
+#define  SDMMC_DMA_BUF_SZ      SZ_16M // 4MB currently used.
 
 // Nyx LvGL buffers.
 #define NYX_LV_VDB_ADR   0xF1000000
@@ -106,7 +106,7 @@
 #define USB_EP_CONTROL_BUF_ADDR   0xFEF80000
 #define USB_EP_BULK_IN_BUF_ADDR   0xFF000000
 #define USB_EP_BULK_OUT_BUF_ADDR  0xFF800000
-#define  USB_EP_BULK_OUT_MAX_XFER   0x800000
+#define  USB_EP_BULK_OUT_MAX_XFER      SZ_8M
 
 // #define EXT_PAYLOAD_ADDR    0xC0000000
 // #define RCM_PAYLOAD_ADDR    (EXT_PAYLOAD_ADDR + ALIGN(PATCHED_RELOC_SZ, 0x10))

bdk/module.h

@@ -21,10 +21,13 @@
 #include <stddef.h>
 #include <mem/heap.h>
 
+#define IANOS_EXT0 0x304E4149
+
 // Module Callback
 typedef void (*cbMainModule_t)(const char *s);
 typedef void (*memcpy_t)(void *, void *, size_t);
 typedef void (*memset_t)(void *, int, size_t);
+typedef int  (*reg_voltage_set_t)(u32, u32);
 
 typedef struct _bdkParams_t
 {
@@ -33,6 +36,8 @@ typedef struct _bdkParams_t
 	heap_t *sharedHeap;
 	memcpy_t memcpy;
 	memset_t memset;
+	u32 extension_magic;
+	reg_voltage_set_t reg_voltage_set;
 } *bdkParams_t;
 
 // Module Entrypoint

bdk/power/max7762x.c

@@ -75,7 +75,7 @@ typedef struct _max77620_regulator_t
 
 static const max77620_regulator_t _pmic_regulators[] = {
 	{  "sd0",  12500, 600000,  625000, 1400000,  REGULATOR_SD,  MAX77620_REG_SD0,      MAX77620_REG_SD0_CFG,    MAX77620_SD0_VOLT_MASK,  {{ MAX77620_REG_FPS_SD0,  1, 7, 1 }} },
-	{  "sd1",  12500, 600000, 1125000, 1125000,  REGULATOR_SD,  MAX77620_REG_SD1,      MAX77620_REG_SD1_CFG,    MAX77620_SD1_VOLT_MASK,  {{ MAX77620_REG_FPS_SD1,  0, 1, 5 }} },
+	{  "sd1",  12500, 600000, 1125000, 1250000,  REGULATOR_SD,  MAX77620_REG_SD1,      MAX77620_REG_SD1_CFG,    MAX77620_SD1_VOLT_MASK,  {{ MAX77620_REG_FPS_SD1,  0, 1, 5 }} },
 	{  "sd2",  12500, 600000, 1325000, 1350000,  REGULATOR_SD,  MAX77620_REG_SD2,      MAX77620_REG_SD2_CFG,    MAX77620_SDX_VOLT_MASK,  {{ MAX77620_REG_FPS_SD2,  1, 5, 2 }} },
 	{  "sd3",  12500, 600000, 1800000, 1800000,  REGULATOR_SD,  MAX77620_REG_SD3,      MAX77620_REG_SD3_CFG,    MAX77620_SDX_VOLT_MASK,  {{ MAX77620_REG_FPS_SD3,  0, 3, 3 }} },
 	{ "ldo0",  25000, 800000, 1200000, 1200000,  REGULATOR_LDO, MAX77620_REG_LDO0_CFG, MAX77620_REG_LDO0_CFG2,  MAX77620_LDO_VOLT_MASK,  {{ MAX77620_REG_FPS_LDO0, 3, 7, 0 }} },
@@ -328,6 +328,7 @@ void max77620_config_default()
 	_max7762x_set_reg(MAX77620_I2C_ADDR, MAX77620_REG_SD_CFG2, MAX77620_SD_CNF2_ROVS_EN_SD0);
 }
 
+// Stock HOS: disabled.
 void max77620_low_battery_monitor_config(bool enable)
 {
 	_max7762x_set_reg(MAX77620_I2C_ADDR, MAX77620_REG_CNFGGLBL1,

bdk/power/max7762x.h

@@ -32,11 +32,11 @@
 *  ldo1 | XUSB, PCIE    | 25000   | 800000 | 1050000    | 1050000 | 1.05V  (pcv)
 *  ldo2 | SDMMC1        | 50000   | 800000 | 1800000    | 3300000 |
 *  ldo3 | GC ASIC       | 50000   | 800000 | 3100000    | 3100000 | 3.1V   (pcv)
-*  ldo4 | RTC           | 12500   | 800000 |  850000    |  850000 |
+*  ldo4 | RTC           | 12500   | 800000 |  850000    |  850000 | 0.85V  (AO, pcv)
 *  ldo5 | GC Card       | 50000   | 800000 | 1800000    | 1800000 | 1.8V   (pcv)
-*  ldo6 | Touch, ALS    | 50000   | 800000 | 2900000    | 2900000 | 2.9V
-*  ldo7 | XUSB          | 50000   | 800000 | 1050000    | 1050000 |
-*  ldo8 | XUSB, DC      | 50000   | 800000 | 1050000    | 1050000 |
+*  ldo6 | Touch, ALS    | 50000   | 800000 | 2900000    | 2900000 | 2.9V   (pcv)
+*  ldo7 | XUSB          | 50000   | 800000 | 1050000    | 1050000 | 1.05V  (pcv)
+*  ldo8 | XUSB, DP, MCU | 50000   | 800000 | 1050000    | 2800000 | 1.05V/2.8V (pcv)
 */
 
 /*
@@ -135,10 +135,10 @@
 #define MAX77621_CTRL_HOS_CFG 0
 #define MAX77621_CTRL_POR_CFG 1
 
-int max77620_regulator_get_status(u32 id);
-int max77620_regulator_config_fps(u32 id);
-int max7762x_regulator_set_voltage(u32 id, u32 mv);
-int max7762x_regulator_enable(u32 id, bool enable);
+int  max77620_regulator_get_status(u32 id);
+int  max77620_regulator_config_fps(u32 id);
+int  max7762x_regulator_set_voltage(u32 id, u32 mv);
+int  max7762x_regulator_enable(u32 id, bool enable);
 void max77620_config_gpio(u32 id, bool enable);
 void max77620_config_default();
 void max77620_low_battery_monitor_config(bool enable);

bdk/power/regulator_5v.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -14,37 +14,52 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <soc/fuse.h>
 #include <soc/gpio.h>
+#include <soc/hw_init.h>
 #include <soc/pinmux.h>
 #include <soc/pmc.h>
 #include <soc/t210.h>
 #include <utils/types.h>
 
 static u8 reg_5v_dev = 0;
-static bool batt_src = false;
+static bool usb_src = false;
 
 void regulator_5v_enable(u8 dev)
 {
 	// The power supply selection from battery or USB is automatic.
 	if (!reg_5v_dev)
 	{
-		// Fan and Rail power from internal 5V regulator (battery).
+		// Fan and Rail power from battery 5V regulator.
 		PINMUX_AUX(PINMUX_AUX_SATA_LED_ACTIVE) = 1;
 		gpio_config(GPIO_PORT_A, GPIO_PIN_5, GPIO_MODE_GPIO);
 		gpio_output_enable(GPIO_PORT_A, GPIO_PIN_5, GPIO_OUTPUT_ENABLE);
 		gpio_write(GPIO_PORT_A, GPIO_PIN_5, GPIO_HIGH);
-		batt_src = true;
 
-		// Fan and Rail power from USB 5V VDD.
-		PINMUX_AUX(PINMUX_AUX_USB_VBUS_EN0) = PINMUX_LPDR | 1;
-		gpio_config(GPIO_PORT_CC, GPIO_PIN_4, GPIO_MODE_GPIO);
-		gpio_output_enable(GPIO_PORT_CC, GPIO_PIN_4, GPIO_OUTPUT_ENABLE);
-		gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_HIGH);
+		// Only Icosa and Iowa have USB 5V VBUS rails. Skip on Hoag/Aula.
+		u32 hw_type = fuse_read_hw_type();
+		if (hw_type == FUSE_NX_HW_TYPE_ICOSA ||
+			hw_type == FUSE_NX_HW_TYPE_IOWA)
+		{
+			// Fan and Rail power from USB 5V VBUS.
+			PINMUX_AUX(PINMUX_AUX_USB_VBUS_EN0) = PINMUX_LPDR | 1;
+			gpio_config(GPIO_PORT_CC, GPIO_PIN_4, GPIO_MODE_GPIO);
+			gpio_output_enable(GPIO_PORT_CC, GPIO_PIN_4, GPIO_OUTPUT_ENABLE);
+			gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_LOW);
+		}
 
-		// Make sure GPIO power is enabled.
-		PMC(APBDEV_PMC_NO_IOPOWER) &= ~PMC_NO_IOPOWER_GPIO_IO_EN;
-		// Override power detect for GPIO AO IO rails.
-		PMC(APBDEV_PMC_PWR_DET_VAL) &= ~PMC_PWR_DET_GPIO_IO_EN;
+		// Enable GPIO AO IO rail for T210.
+		if (hw_get_chip_id() == GP_HIDREV_MAJOR_T210)
+		{
+			// Make sure GPIO power is enabled.
+			PMC(APBDEV_PMC_NO_IOPOWER) &= ~PMC_NO_IOPOWER_GPIO_IO_EN;
+			(void)PMC(APBDEV_PMC_NO_IOPOWER); // Commit write.
+
+			// Override power detect for GPIO AO IO rails.
+			PMC(APBDEV_PMC_PWR_DET_VAL) &= ~PMC_PWR_DET_GPIO_IO_EN;
+			(void)PMC(APBDEV_PMC_PWR_DET_VAL); // Commit write.
+		}
+		usb_src = false;
 	}
 	reg_5v_dev |= dev;
 }
@@ -55,21 +70,32 @@ void regulator_5v_disable(u8 dev)
 
 	if (!reg_5v_dev)
 	{
-		// Rail power from internal 5V regulator (battery).
+		// Rail power from battery 5V regulator.
 		gpio_write(GPIO_PORT_A, GPIO_PIN_5, GPIO_LOW);
 		gpio_output_enable(GPIO_PORT_A, GPIO_PIN_5, GPIO_OUTPUT_DISABLE);
 		gpio_config(GPIO_PORT_A, GPIO_PIN_5, GPIO_MODE_SPIO);
 		PINMUX_AUX(PINMUX_AUX_SATA_LED_ACTIVE) = PINMUX_PARKED | PINMUX_INPUT_ENABLE;
-		batt_src = false;
 
-		// Rail power from USB 5V VDD.
-		gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_LOW);
-		gpio_output_enable(GPIO_PORT_CC, GPIO_PIN_4, GPIO_OUTPUT_DISABLE);
-		gpio_config(GPIO_PORT_CC, GPIO_PIN_4, GPIO_MODE_SPIO);
-		PINMUX_AUX(PINMUX_AUX_USB_VBUS_EN0) = PINMUX_IO_HV | PINMUX_LPDR | PINMUX_PARKED | PINMUX_INPUT_ENABLE;
+		// Only Icosa and Iowa have USB 5V VBUS rails. Skip on Hoag/Aula.
+		u32 hw_type = fuse_read_hw_type();
+		if (hw_type == FUSE_NX_HW_TYPE_ICOSA ||
+			hw_type == FUSE_NX_HW_TYPE_IOWA)
+		{
+			// Rail power from USB 5V VBUS.
+			gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_LOW);
+			gpio_output_enable(GPIO_PORT_CC, GPIO_PIN_4, GPIO_OUTPUT_DISABLE);
+			gpio_config(GPIO_PORT_CC, GPIO_PIN_4, GPIO_MODE_SPIO);
+			PINMUX_AUX(PINMUX_AUX_USB_VBUS_EN0) = PINMUX_IO_HV | PINMUX_LPDR | PINMUX_PARKED | PINMUX_INPUT_ENABLE;
+			usb_src = false;
+
+		}
 
 		// GPIO AO IO rails.
-		PMC(APBDEV_PMC_PWR_DET_VAL) |= PMC_PWR_DET_GPIO_IO_EN;
+		if (hw_get_chip_id() == GP_HIDREV_MAJOR_T210)
+		{
+			PMC(APBDEV_PMC_PWR_DET_VAL) |= PMC_PWR_DET_GPIO_IO_EN;
+			(void)PMC(APBDEV_PMC_PWR_DET_VAL); // Commit write.
+		}
 	}
 }
 
@@ -78,10 +104,22 @@ bool regulator_5v_get_dev_enabled(u8 dev)
 	return (reg_5v_dev & dev);
 }
 
-void regulator_5v_batt_src_enable(bool enable)
+void regulator_5v_usb_src_enable(bool enable)
 {
-	if (enable && !batt_src)
-		gpio_write(GPIO_PORT_A, GPIO_PIN_5, GPIO_HIGH);
-	else if (!enable && batt_src)
-		gpio_write(GPIO_PORT_A, GPIO_PIN_5, GPIO_LOW);
+	// Only for Icosa/Iowa. Skip on Hoag/Aula.
+	u32 hw_type = fuse_read_hw_type();
+	if (hw_type != FUSE_NX_HW_TYPE_ICOSA &&
+		hw_type != FUSE_NX_HW_TYPE_IOWA)
+		return;
+
+	if (enable && !usb_src)
+	{
+		gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_HIGH);
+		usb_src = true;
+	}
+	else if (!enable && usb_src)
+	{
+		gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_LOW);
+		usb_src = false;
+	}
 }

bdk/power/regulator_5v.h

@@ -30,6 +30,6 @@ enum
 void regulator_5v_enable(u8 dev);
 void regulator_5v_disable(u8 dev);
 bool regulator_5v_get_dev_enabled(u8 dev);
-void regulator_5v_batt_src_enable(bool enable);
+void regulator_5v_usb_src_enable(bool enable);
 
 #endif

bdk/sec/se.c

@@ -335,7 +335,7 @@ int se_aes_xts_crypt_sec(u32 ks1, u32 ks2, u32 enc, u64 sec, void *dst, void *sr
 		tweak[i] = sec & 0xFF;
 		sec >>= 8;
 	}
-	if (!se_aes_crypt_block_ecb(ks1, 1, tweak, tweak))
+	if (!se_aes_crypt_block_ecb(ks1, ENCRYPT, tweak, tweak))
 		goto out;
 
 	// We are assuming a 0x10-aligned sector size in this implementation.
@@ -529,6 +529,6 @@ void se_get_aes_keys(u8 *buf, u8 *keys, u32 keysize)
 	// Decrypt context.
 	se_aes_key_clear(3);
 	se_aes_key_set(3, srk, SE_KEY_128_SIZE);
-	se_aes_crypt_cbc(3, 0, keys, SE_AES_KEYSLOT_COUNT * keysize, keys, SE_AES_KEYSLOT_COUNT * keysize);
+	se_aes_crypt_cbc(3, DECRYPT, keys, SE_AES_KEYSLOT_COUNT * keysize, keys, SE_AES_KEYSLOT_COUNT * keysize);
 	se_aes_key_clear(3);
 }

bdk/sec/se_t210.h

@@ -50,6 +50,9 @@
 #define SE_RSA1536_DIGEST_SIZE  192
 #define SE_RSA2048_DIGEST_SIZE  256
 
+#define  DECRYPT   0
+#define  ENCRYPT   1
+
 /* SE register definitions */
 #define SE_SE_SECURITY_REG 0x000
 #define  SE_HARD_SETTING   BIT(0)

bdk/sec/tsec.c

@@ -24,6 +24,7 @@
 #include <soc/bpmp.h>
 #include <soc/clock.h>
 #include <soc/kfuse.h>
+#include <soc/pmc.h>
 #include <soc/t210.h>
 #include <mem/heap.h>
 #include <mem/mc.h>
@@ -33,7 +34,8 @@
 // #include <gfx_utils.h>
 
 #define PKG11_MAGIC 0x31314B50
-#define KB_TSEC_FW_EMU_COMPAT 6 // KB ID for HOS 6.2.0.
+
+#define TSEC_HOS_KB_620 6
 
 static int _tsec_dma_wait_idle()
 {
@@ -62,15 +64,16 @@ static int _tsec_dma_pa_to_internal_100(int not_imem, int i_offset, int pa_offse
 	return _tsec_dma_wait_idle();
 }
 
-int tsec_query(void *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
+int tsec_query(void *tsec_keys, tsec_ctxt_t *tsec_ctxt)
 {
 	int res = 0;
 	u8 *fwbuf = NULL;
+	u32 type = tsec_ctxt->type;
 	u32 *pdir, *car, *fuse, *pmc, *flowctrl, *se, *mc, *iram, *evec;
 	u32 *pkg11_magic_off;
 
 	bpmp_mmu_disable();
-	bpmp_clk_rate_set(BPMP_CLK_NORMAL);
+	bpmp_freq_t prev_fid = bpmp_clk_rate_set(BPMP_CLK_NORMAL);
 
 	// Enable clocks.
 	clock_enable_host1x();
@@ -83,6 +86,18 @@ int tsec_query(void *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 
 	kfuse_wait_ready();
 
+	if (type == TSEC_FW_TYPE_NEW)
+	{
+		// Disable all CCPLEX core rails.
+		pmc_enable_partition(POWER_RAIL_CE0, DISABLE);
+		pmc_enable_partition(POWER_RAIL_CE1, DISABLE);
+		pmc_enable_partition(POWER_RAIL_CE2, DISABLE);
+		pmc_enable_partition(POWER_RAIL_CE3, DISABLE);
+
+		// Enable AHB aperture and set it to full mmio.
+		mc_enable_ahb_redirect(true);
+	}
+
 	// Configure Falcon.
 	TSEC(TSEC_DMACTL) = 0;
 	TSEC(TSEC_IRQMSET) =
@@ -106,11 +121,11 @@ int tsec_query(void *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 	}
 
 	// Load firmware or emulate memio environment for newer TSEC fw.
-	if (kb == KB_TSEC_FW_EMU_COMPAT)
+	if (type == TSEC_FW_TYPE_EMU)
 		TSEC(TSEC_DMATRFBASE) = (u32)tsec_ctxt->fw >> 8;
 	else
 	{
-		fwbuf = (u8 *)malloc(0x4000);
+		fwbuf = (u8 *)malloc(SZ_16K);
 		u8 *fwbuf_aligned = (u8 *)ALIGN((u32)fwbuf, 0x100);
 		memcpy(fwbuf_aligned, tsec_ctxt->fw, tsec_ctxt->size);
 		TSEC(TSEC_DMATRFBASE) = (u32)fwbuf_aligned >> 8;
@@ -125,7 +140,7 @@ int tsec_query(void *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 		}
 	}
 
-	if (kb == KB_TSEC_FW_EMU_COMPAT)
+	if (type == TSEC_FW_TYPE_EMU)
 	{
 		// Init SMMU translation for TSEC.
 		pdir = smmu_init_for_tsec();
@@ -136,16 +151,16 @@ int tsec_query(void *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 
 		// Clock reset controller.
 		car = page_alloc(1);
-		memcpy(car, (void *)CLOCK_BASE, 0x1000);
+		memcpy(car, (void *)CLOCK_BASE, SZ_PAGE);
 		car[CLK_RST_CONTROLLER_CLK_SOURCE_TSEC / 4] = 2;
 		smmu_map(pdir, CLOCK_BASE, (u32)car, 1, _WRITABLE | _READABLE | _NONSECURE);
 
 		// Fuse driver.
 		fuse = page_alloc(1);
-		memcpy((void *)&fuse[0x800/4], (void *)FUSE_BASE, 0x400);
+		memcpy((void *)&fuse[0x800/4], (void *)FUSE_BASE, SZ_1K);
 		fuse[0x82C / 4] = 0;
-		fuse[0x9E0 / 4] = (1 << (kb + 2)) - 1;
-		fuse[0x9E4 / 4] = (1 << (kb + 2)) - 1;
+		fuse[0x9E0 / 4] = (1 << (TSEC_HOS_KB_620 + 2)) - 1;
+		fuse[0x9E4 / 4] = (1 << (TSEC_HOS_KB_620 + 2)) - 1;
 		smmu_map(pdir, (FUSE_BASE - 0x800), (u32)fuse, 1, _READABLE | _NONSECURE);
 
 		// Power management controller.
@@ -158,12 +173,12 @@ int tsec_query(void *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 
 		// Security engine.
 		se = page_alloc(1);
-		memcpy(se, (void *)SE_BASE, 0x1000);
+		memcpy(se, (void *)SE_BASE, SZ_PAGE);
 		smmu_map(pdir, SE_BASE, (u32)se, 1, _READABLE | _WRITABLE | _NONSECURE);
 
 		// Memory controller.
 		mc = page_alloc(1);
-		memcpy(mc, (void *)MC_BASE, 0x1000);
+		memcpy(mc, (void *)MC_BASE, SZ_PAGE);
 		mc[MC_IRAM_BOM / 4] = 0;
 		mc[MC_IRAM_TOM / 4] = 0x80000000;
 		smmu_map(pdir, MC_BASE, (u32)mc, 1, _READABLE | _NONSECURE);
@@ -187,7 +202,7 @@ int tsec_query(void *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 	TSEC(TSEC_BOOTVEC) = 0;
 	TSEC(TSEC_CPUCTL) = TSEC_CPUCTL_STARTCPU;
 
-	if (kb == KB_TSEC_FW_EMU_COMPAT)
+	if (type == TSEC_FW_TYPE_EMU)
 	{
 		u32 start = get_tmr_us();
 		u32 k = se[SE_CRYPTO_KEYTABLE_DATA_REG / 4];
@@ -284,7 +299,11 @@ out:;
 	clock_disable_sor_safe();
 	clock_disable_tsec();
 	bpmp_mmu_enable();
-	bpmp_clk_rate_set(BPMP_CLK_DEFAULT_BOOST);
+	bpmp_clk_rate_set(prev_fid);
+
+	// Disable AHB aperture.
+	if (type == TSEC_FW_TYPE_NEW)
+		mc_disable_ahb_redirect();
 
 	return res;
 }

bdk/sec/tsec.h

@@ -1,6 +1,6 @@
 /*
 * Copyright (c) 2018 naehrwert
-* Copyright (c) 2018 CTCaer
+* Copyright (c) 2018-2021 CTCaer
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@@ -20,15 +20,24 @@
 
 #include <utils/types.h>
 
+enum tsec_fw_type
+{
+	// Retail Hovi Keygen.
+	TSEC_FW_TYPE_OLD = 0, // 1.0.0 - 6.1.0.
+	TSEC_FW_TYPE_EMU = 1, // 6.2.0 emulated enviroment.
+	TSEC_FW_TYPE_NEW = 2, // 7.0.0+.
+};
+
 typedef struct _tsec_ctxt_t
 {
 	void *fw;
 	u32 size;
+	u32 type;
 	void *pkg1;
 	u32 pkg11_off;
 	u32 secmon_base;
 } tsec_ctxt_t;
 
-int tsec_query(void *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt);
+int tsec_query(void *tsec_keys, tsec_ctxt_t *tsec_ctxt);
 
 #endif

bdk/soc/bpmp.c

@@ -1,7 +1,7 @@
 /*
  * BPMP-Lite Cache/MMU and Frequency driver for Tegra X1
  *
- * Copyright (c) 2019-2020 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -212,43 +212,45 @@ const u8 pll_divn[] = {
 	//95   // BPMP_CLK_DEV_BOOST: 608MHz 49% - 152MHz APB.
 };
 
-bpmp_freq_t bpmp_clock_set = BPMP_CLK_NORMAL;
+bpmp_freq_t bpmp_fid_current = BPMP_CLK_NORMAL;
 
 void bpmp_clk_rate_get()
 {
 	bool clk_src_is_pllp = ((CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) >> 4) & 7) == 3;
 
 	if (clk_src_is_pllp)
-		bpmp_clock_set = BPMP_CLK_NORMAL;
+		bpmp_fid_current = BPMP_CLK_NORMAL;
 	else
 	{
-		bpmp_clock_set = BPMP_CLK_HIGH_BOOST;
+		bpmp_fid_current = BPMP_CLK_HIGH_BOOST;
 
 		u8 pll_divn_curr = (CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) >> 10) & 0xFF;
 		for (u32 i = 1; i < sizeof(pll_divn); i++)
 		{
 			if (pll_divn[i] == pll_divn_curr)
 			{
-				bpmp_clock_set = i;
+				bpmp_fid_current = i;
 				break;
 			}
 		}
 	}
 }
 
-void bpmp_clk_rate_set(bpmp_freq_t fid)
+bpmp_freq_t bpmp_clk_rate_set(bpmp_freq_t fid)
 {
+	bpmp_freq_t prev_fid = bpmp_fid_current;
+
 	if (fid > (BPMP_CLK_MAX - 1))
 		fid = BPMP_CLK_MAX - 1;
 
-	if (bpmp_clock_set == fid)
-		return;
+	if (prev_fid == fid)
+		return prev_fid;
 
 	if (fid)
 	{
-		if (bpmp_clock_set)
+		if (prev_fid)
 		{
-			// Restore to PLLP source during PLLC4 configuration.
+			// Restore to PLLP source during PLLC configuration.
 			CLOCK(CLK_RST_CONTROLLER_SCLK_BURST_POLICY) = 0x20003333; // PLLP_OUT.
 			msleep(1); // Wait a bit for clock source change.
 		}
@@ -269,7 +271,10 @@ void bpmp_clk_rate_set(bpmp_freq_t fid)
 		// Disable PLLC to save power.
 		clock_disable_pllc();
 	}
-	bpmp_clock_set = fid;
+	bpmp_fid_current = fid;
+
+	// Return old fid in case of temporary swap.
+	return prev_fid;
 }
 
 // The following functions halt BPMP to reduce power while sleeping.

bdk/soc/bpmp.h

@@ -1,7 +1,7 @@
 /*
  * BPMP-Lite Cache/MMU and Frequency driver for Tegra X1
  *
- * Copyright (c) 2019-2020 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -53,6 +53,7 @@ typedef enum
 	BPMP_CLK_MAX
 } bpmp_freq_t;
 
+#define BPMP_CLK_LOWER_BOOST   BPMP_CLK_SUPER_BOOST
 #define BPMP_CLK_DEFAULT_BOOST BPMP_CLK_HYPER_BOOST
 
 void bpmp_mmu_maintenance(u32 op, bool force);
@@ -60,7 +61,7 @@ void bpmp_mmu_set_entry(int idx, bpmp_mmu_entry_t *entry, bool apply);
 void bpmp_mmu_enable();
 void bpmp_mmu_disable();
 void bpmp_clk_rate_get();
-void bpmp_clk_rate_set(bpmp_freq_t fid);
+bpmp_freq_t bpmp_clk_rate_set(bpmp_freq_t fid);
 void bpmp_usleep(u32 us);
 void bpmp_msleep(u32 ms);
 void bpmp_halt();

bdk/soc/ccplex.c

@@ -58,24 +58,7 @@ void ccplex_boot_cpu0(u32 entry)
 	else
 		_ccplex_enable_power_t210b01();
 
-	// Enable PLLX and set it to 300 MHz.
-	if (!(CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) & PLLX_BASE_ENABLE)) // PLLX_ENABLE.
-	{
-		CLOCK(CLK_RST_CONTROLLER_PLLX_MISC_3) &= 0xFFFFFFF7; // Disable IDDQ.
-		usleep(2);
-
-		// Bypass dividers.
-		CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) = PLLX_BASE_BYPASS | (4 << 20) | (78 << 8) | 2; // P div: 4 (5), N div: 78, M div: 2.
-		// Disable bypass
-		CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) = (4 << 20) | (78 << 8) | 2;
-		// Set PLLX_LOCK_ENABLE.
-		CLOCK(CLK_RST_CONTROLLER_PLLX_MISC) = (CLOCK(CLK_RST_CONTROLLER_PLLX_MISC) & 0xFFFBFFFF) | 0x40000;
-		// Enable PLLX.
-		CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) = PLLX_BASE_ENABLE | (4 << 20) | (78 << 8) | 2;
-	}
-	// Wait for PLL to stabilize.
-	while (!(CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) & PLLX_BASE_LOCK))
-		;
+	clock_enable_pllx();
 
 	// Configure MSELECT source and enable clock to 102MHz.
 	CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_MSELECT) = (CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_MSELECT) & 0x1FFFFF00) | 6;

bdk/soc/clock.c

@@ -279,6 +279,32 @@ void clock_disable_pwm()
 	clock_disable(&_clock_pwm);
 }
 
+void clock_enable_pllx()
+{
+	// Configure and enable PLLX if disabled.
+	if (!(CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) & PLLX_BASE_ENABLE)) // PLLX_ENABLE.
+	{
+		CLOCK(CLK_RST_CONTROLLER_PLLX_MISC_3) &= ~PLLX_MISC3_IDDQ; // Disable IDDQ.
+		usleep(2);
+
+		// Set div configuration.
+		const u32 pllx_div_cfg = (2 << 20) | (156 << 8) | 2; // P div: 2 (3), N div: 156, M div: 2. 998.4 MHz.
+
+		// Bypass dividers.
+		CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) = PLLX_BASE_BYPASS | pllx_div_cfg;
+		// Disable bypass
+		CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) = pllx_div_cfg;
+		// Set PLLX_LOCK_ENABLE.
+		CLOCK(CLK_RST_CONTROLLER_PLLX_MISC) |= PLLX_MISC_LOCK_EN;
+		// Enable PLLX.
+		CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) = PLLX_BASE_ENABLE | pllx_div_cfg;
+	}
+
+	// Wait for PLL to stabilize.
+	while (!(CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) & PLLX_BASE_LOCK))
+		;
+}
+
 void clock_enable_pllc(u32 divn)
 {
 	u8 pll_divn_curr = (CLOCK(CLK_RST_CONTROLLER_PLLC_BASE) >> 10) & 0xFF;
@@ -757,15 +783,25 @@ u32 clock_get_osc_freq()
 
 u32 clock_get_dev_freq(clock_pto_id_t id)
 {
-	u32 val = ((id & PTO_SRC_SEL_MASK) << PTO_SRC_SEL_SHIFT) | PTO_DIV_SEL_DIV1 | PTO_CLK_ENABLE | (16 - 1); // 16 periods of 32.76KHz window.
+	const u32 pto_win = 16;
+	const u32 pto_osc = 32768;
+
+	u32 val = ((id & PTO_SRC_SEL_MASK) << PTO_SRC_SEL_SHIFT) | PTO_DIV_SEL_DIV1 | PTO_CLK_ENABLE | (pto_win - 1);
 	CLOCK(CLK_RST_CONTROLLER_PTO_CLK_CNT_CNTL) = val;
+	(void)CLOCK(CLK_RST_CONTROLLER_PTO_CLK_CNT_CNTL);
 	usleep(2);
+
 	CLOCK(CLK_RST_CONTROLLER_PTO_CLK_CNT_CNTL) = val | PTO_CNT_RST;
+	(void)CLOCK(CLK_RST_CONTROLLER_PTO_CLK_CNT_CNTL);
 	usleep(2);
+
 	CLOCK(CLK_RST_CONTROLLER_PTO_CLK_CNT_CNTL) = val;
+	(void)CLOCK(CLK_RST_CONTROLLER_PTO_CLK_CNT_CNTL);
 	usleep(2);
+
 	CLOCK(CLK_RST_CONTROLLER_PTO_CLK_CNT_CNTL) = val | PTO_CNT_EN;
-	usleep(502);
+	(void)CLOCK(CLK_RST_CONTROLLER_PTO_CLK_CNT_CNTL);
+	usleep((1000000 * pto_win / pto_osc) + 12 + 2);
 
 	while (CLOCK(CLK_RST_CONTROLLER_PTO_CLK_CNT_STATUS) & PTO_CLK_CNT_BUSY)
 		;
@@ -773,9 +809,11 @@ u32 clock_get_dev_freq(clock_pto_id_t id)
 	u32 cnt = CLOCK(CLK_RST_CONTROLLER_PTO_CLK_CNT_STATUS) & PTO_CLK_CNT;
 
 	CLOCK(CLK_RST_CONTROLLER_PTO_CLK_CNT_CNTL) = 0;
+	(void)CLOCK(CLK_RST_CONTROLLER_PTO_CLK_CNT_CNTL);
+	usleep(2);
 
-	u32 freq = ((cnt << 8) | 0x3E) / 125;
+	u32 freq_khz = (u64)cnt * pto_osc / pto_win / 1000;
 
-	return freq;
+	return freq_khz;
 }
 

bdk/soc/clock.h

@@ -167,6 +167,8 @@
 #define PLLX_BASE_REF_DIS    BIT(29)
 #define PLLX_BASE_ENABLE     BIT(30)
 #define PLLX_BASE_BYPASS     BIT(31)
+#define PLLX_MISC_LOCK_EN    BIT(18)
+#define PLLX_MISC3_IDDQ      BIT(3)
 
 #define PLLCX_BASE_LOCK      BIT(27)
 #define PLLCX_BASE_REF_DIS   BIT(29)
@@ -215,7 +217,7 @@
 #define OSC_FREQ_DET_BUSY        BIT(31)
 #define OSC_FREQ_DET_CNT         0xFFFF
 
-/*! PLLs omitted as they need PTO enabled in MISC registers. Norm div is 2. */
+/*! PTO IDs. */
 typedef enum _clock_pto_id_t
 {
 	CLK_PTO_PCLK_SYS =          0x06,
@@ -239,6 +241,9 @@ typedef enum _clock_pto_id_t
 	CLK_PTO_SDMMC4 =            0x23,
 	CLK_PTO_EMC =               0x24,
 
+	CLK_PTO_CCLK_LP =           0x2B,
+	CLK_PTO_CCLK_LP_DIV2 =      0x2C,
+
 	CLK_PTO_MSELECT =           0x2F,
 
 	CLK_PTO_VIC =               0x36,
@@ -321,6 +326,32 @@ typedef enum _clock_pto_id_t
 	CLK_PTO_XUSB_SS_HOST_DEV =  0x137,
 	CLK_PTO_XUSB_CORE_HOST =    0x138,
 	CLK_PTO_XUSB_CORE_DEV =     0x139,
+
+	/*
+	 * PLL need PTO enabled in MISC registers.
+	 * Normal div is 2 so result is multiplied with it.
+	 */
+	CLK_PTO_PLLC_DIV2 =              0x01,
+	CLK_PTO_PLLM_DIV2 =              0x02,
+	CLK_PTO_PLLP_DIV2 =              0x03,
+	CLK_PTO_PLLA_DIV2 =              0x04,
+	CLK_PTO_PLLX_DIV2 =              0x05,
+
+	CLK_PTO_PLLMB_DIV2 =             0x25,
+
+	CLK_PTO_PLLC4_DIV2 =             0x51,
+
+	CLK_PTO_PLLA1_DIV2 =             0x55,
+	CLK_PTO_PLLC2_DIV2 =             0x58,
+	CLK_PTO_PLLC3_DIV2 =             0x5A,
+
+	CLK_PTO_PLLD_DIV2 =              0xCB,
+	CLK_PTO_PLLD2_DIV2 =             0xCD,
+	CLK_PTO_PLLDP_DIV2 =             0xCF,
+
+	CLK_PTO_PLLU_DIV2 =              0x10D,
+
+	CLK_PTO_PLLREFE_DIV2 =           0x10F,
 } clock_pto_id_t;
 
 /*
@@ -628,6 +659,7 @@ void clock_enable_coresight();
 void clock_disable_coresight();
 void clock_enable_pwm();
 void clock_disable_pwm();
+void clock_enable_pllx();
 void clock_enable_pllc(u32 divn);
 void clock_disable_pllc();
 void clock_enable_pllu();

bdk/soc/fuse.c

@@ -2,7 +2,7 @@
  * Copyright (c) 2018 naehrwert
  * Copyright (c) 2018 shuffle2
  * Copyright (c) 2018 balika011
- * Copyright (c) 2019-2020 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -19,6 +19,8 @@
 
 #include <string.h>
 
+#include <sec/se.h>
+#include <sec/se_t210.h>
 #include <soc/fuse.h>
 #include <soc/hw_init.h>
 #include <soc/t210.h>
@@ -90,7 +92,7 @@ u32 fuse_read_dramid(bool raw_id)
 	}
 	else
 	{
-		if (dramid > 27)
+		if (dramid > 28)
 			dramid = 8;
 	}
 
@@ -111,26 +113,41 @@ u32 fuse_read_hw_type()
 	{
 		switch ((fuse_read_odm(4) & 0xF0000) >> 16)
 		{
-		case 1:
-			return FUSE_NX_HW_TYPE_IOWA;
 		case 2:
 			return FUSE_NX_HW_TYPE_HOAG;
+		case 4:
+			return FUSE_NX_HW_TYPE_AULA;
+		case 1:
+		default:
+			return FUSE_NX_HW_TYPE_IOWA;
 		}
 	}
 
 	return FUSE_NX_HW_TYPE_ICOSA;
 }
 
-u8 fuse_count_burnt(u32 val)
+int fuse_set_sbk()
 {
-	u8 burnt_fuses = 0;
-	for (u32 i = 0; i < 32; i++)
+	if (FUSE(FUSE_PRIVATE_KEY0) != 0xFFFFFFFF)
 	{
-		if ((val >> i) & 1)
-			burnt_fuses++;
+		// Read SBK from fuses.
+		u32 sbk[4] = {
+			FUSE(FUSE_PRIVATE_KEY0),
+			FUSE(FUSE_PRIVATE_KEY1),
+			FUSE(FUSE_PRIVATE_KEY2),
+			FUSE(FUSE_PRIVATE_KEY3)
+		};
+
+		// Set SBK to slot 14.
+		se_aes_key_set(14, sbk, SE_KEY_128_SIZE);
+
+		// Lock SBK from being read.
+		se_key_acc_ctrl(14, SE_KEY_TBL_DIS_KEYREAD_FLAG);
+
+		return 1;
 	}
 
-	return burnt_fuses;
+	return 0;
 }
 
 void fuse_wait_idle()

bdk/soc/fuse.h

@@ -2,7 +2,7 @@
  * Copyright (c) 2018 naehrwert
  * Copyright (c) 2018 shuffle2
  * Copyright (c) 2018 balika011
- * Copyright (c) 2019-2020 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -82,7 +82,8 @@ enum
 {
 	FUSE_NX_HW_TYPE_ICOSA,
 	FUSE_NX_HW_TYPE_IOWA,
-	FUSE_NX_HW_TYPE_HOAG
+	FUSE_NX_HW_TYPE_HOAG,
+    FUSE_NX_HW_TYPE_AULA
 };
 
 enum
@@ -97,7 +98,7 @@ u32  fuse_read_odm_keygen_rev();
 u32  fuse_read_dramid(bool raw_id);
 u32  fuse_read_hw_state();
 u32  fuse_read_hw_type();
-u8   fuse_count_burnt(u32 val);
+int  fuse_set_sbk();
 void fuse_wait_idle();
 int  fuse_read_ipatch(void (*ipatch)(u32 offset, u32 value));
 int  fuse_read_evp_thunk(u32 *iram_evp_thunks, u32 *iram_evp_thunks_len);

bdk/soc/hw_init.c

@@ -48,14 +48,8 @@
 extern boot_cfg_t b_cfg;
 extern volatile nyx_storage_t *nyx_str;
 
-/*
- * CLK_OSC - 38.4 MHz crystal.
- * CLK_M   - 19.2 MHz (osc/2).
- * CLK_S   - 32.768 KHz (from PMIC).
- * SCLK    - 204MHz init (-> 408MHz -> OC).
- * HCLK    - 204MHz init (-> 408MHz -> OC).
- * PCLK    - 68MHz  init (-> 136MHz -> OC/4).
- */
+u32 hw_rst_status;
+u32 hw_rst_reason;
 
 u32 hw_get_chip_id()
 {
@@ -65,6 +59,15 @@ u32 hw_get_chip_id()
 		return GP_HIDREV_MAJOR_T210;
 }
 
+/*
+ * CLK_OSC - 38.4 MHz crystal.
+ * CLK_M   - 19.2 MHz (osc/2).
+ * CLK_S   - 32.768 KHz (from PMIC).
+ * SCLK    - 204MHz init (-> 408MHz -> OC).
+ * HCLK    - 204MHz init (-> 408MHz -> OC).
+ * PCLK    - 68MHz  init (-> 136MHz -> OC/4).
+ */
+
 static void _config_oscillators()
 {
 	CLOCK(CLK_RST_CONTROLLER_SPARE_REG0) = (CLOCK(CLK_RST_CONTROLLER_SPARE_REG0) & 0xFFFFFFF3) | 4; // Set CLK_M_DIVISOR to 2.
@@ -88,6 +91,7 @@ static void _config_oscillators()
 	CLOCK(CLK_RST_CONTROLLER_CLK_SYSTEM_RATE) = 2;             // Set HCLK div to 1 and PCLK div to 3.
 }
 
+// The uart is skipped for Copper, Hoag and Calcio. Used in Icosa, Iowa and Aula.
 static void _config_gpios(bool nx_hoag)
 {
 	// Clamp inputs when tristated.
@@ -249,36 +253,25 @@ static void _mbist_workaround()
 
 static void _config_se_brom()
 {
-	// Enable fuse clock.
+	// Enable Fuse visibility.
 	clock_enable_fuse(true);
 
-	// Skip SBK/SSK if sept was run.
-	bool sbk_skip = b_cfg.boot_cfg & BOOT_CFG_SEPT_RUN || FUSE(FUSE_PRIVATE_KEY0) == 0xFFFFFFFF;
-	if (!sbk_skip)
-	{
-		// Bootrom part we skipped.
-		u32 sbk[4] = {
-			FUSE(FUSE_PRIVATE_KEY0),
-			FUSE(FUSE_PRIVATE_KEY1),
-			FUSE(FUSE_PRIVATE_KEY2),
-			FUSE(FUSE_PRIVATE_KEY3)
-		};
-		// Set SBK to slot 14.
-		se_aes_key_set(14, sbk, SE_KEY_128_SIZE);
+	// Try to set SBK from fuses. If patched, skip.
+	fuse_set_sbk();
 
-		// Lock SBK from being read.
-		se_key_acc_ctrl(14, SE_KEY_TBL_DIS_KEYREAD_FLAG);
-
-		// Lock SSK (although it's not set and unused anyways).
-		se_key_acc_ctrl(15, SE_KEY_TBL_DIS_KEYREAD_FLAG);
-	}
+	// Lock SSK (although it's not set and unused anyways).
+	// se_key_acc_ctrl(15, SE_KEY_TBL_DIS_KEYREAD_FLAG);
 
 	// This memset needs to happen here, else TZRAM will behave weirdly later on.
-	memset((void *)TZRAM_BASE, 0, 0x10000);
+	memset((void *)TZRAM_BASE, 0, SZ_64K);
 	PMC(APBDEV_PMC_CRYPTO_OP) = PMC_CRYPTO_OP_SE_ENABLE;
 	SE(SE_INT_STATUS_REG) = 0x1F; // Clear all SE interrupts.
 
-	// Clear the boot reason to avoid problems later
+	// Save reset reason.
+	hw_rst_status = PMC(APBDEV_PMC_SCRATCH200);
+	hw_rst_reason = PMC(APBDEV_PMC_RST_STATUS) & PMC_RST_STATUS_MASK;
+
+	// Clear the boot reason to avoid problems later.
 	PMC(APBDEV_PMC_SCRATCH200) = 0x0;
 	PMC(APBDEV_PMC_RST_STATUS) = 0x0;
 	APB_MISC(APB_MISC_PP_STRAPPING_OPT_A) = (APB_MISC(APB_MISC_PP_STRAPPING_OPT_A) & 0xF0) | (7 << 10);
@@ -351,7 +344,7 @@ void hw_init()
 	// Enable Security Engine clock.
 	clock_enable_se();
 
-	// Enable Fuse clock.
+	// Enable Fuse visibility.
 	clock_enable_fuse(true);
 
 	// Disable Fuse programming.
@@ -420,7 +413,7 @@ void hw_init()
 	bpmp_mmu_enable();
 }
 
-void hw_reinit_workaround(bool coreboot, u32 magic)
+void hw_reinit_workaround(bool coreboot, u32 bl_magic)
 {
 	// Disable BPMP max clock.
 	bpmp_clk_rate_set(BPMP_CLK_NORMAL);
@@ -432,8 +425,6 @@ void hw_reinit_workaround(bool coreboot, u32 magic)
 	touch_power_off();
 	jc_deinit();
 	regulator_5v_disable(REGULATOR_5V_ALL);
-	clock_disable_uart(UART_B);
-	clock_disable_uart(UART_C);
 #endif
 
 	// Flush/disable MMU cache and set DRAM clock to 204MHz.
@@ -462,11 +453,22 @@ void hw_reinit_workaround(bool coreboot, u32 magic)
 		PMC(APBDEV_PMC_NO_IOPOWER) &= ~(PMC_NO_IOPOWER_SDMMC1_IO_EN);
 	}
 
-	// Power off display.
-	display_end();
+	// Seamless display or display power off.
+	switch (bl_magic)
+	{
+	case BL_MAGIC_CRBOOT_SLD:;
+		// Set pwm to 0%, switch to gpio mode and restore pwm duty.
+		u32 brightness = display_get_backlight_brightness();
+		display_backlight_brightness(0, 1000);
+		gpio_config(GPIO_PORT_V, GPIO_PIN_0, GPIO_MODE_GPIO);
+		display_backlight_brightness(brightness, 0);
+		break;
+	default:
+		display_end();
+	}
 
 	// Enable clock to USBD and init SDMMC1 to avoid hangs with bad hw inits.
-	if (magic == 0xBAADF00D)
+	if (bl_magic == BL_MAGIC_BROKEN_HWI)
 	{
 		CLOCK(CLK_RST_CONTROLLER_CLK_ENB_L_SET) = BIT(CLK_L_USBD);
 		sdmmc_init(&sd_sdmmc, SDMMC_1, SDMMC_POWER_3_3, SDMMC_BUS_WIDTH_1, SDHCI_TIMING_SD_ID, 0);

bdk/soc/hw_init.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (c) 2018 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -20,6 +20,12 @@
 
 #include <utils/types.h>
 
+#define BL_MAGIC_CRBOOT_SLD 0x30444C53 // SLD0, seamless display type 0.
+#define BL_MAGIC_BROKEN_HWI 0xBAADF00D // Broken hwinit.
+
+extern u32 hw_rst_status;
+extern u32 hw_rst_reason;
+
 void hw_init();
 void hw_reinit_workaround(bool coreboot, u32 magic);
 u32  hw_get_chip_id();

bdk/soc/pmc.h

@@ -60,6 +60,13 @@
 #define APBDEV_PMC_CLK_OUT_CNTRL 0x1A8
 #define  PMC_CLK_OUT_CNTRL_CLK1_FORCE_EN BIT(2)
 #define APBDEV_PMC_RST_STATUS 0x1B4
+#define  PMC_RST_STATUS_MASK 0x7
+#define  PMC_RST_STATUS_POR 0
+#define  PMC_RST_STATUS_WATCHDOG 1
+#define  PMC_RST_STATUS_SENSOR 2
+#define  PMC_RST_STATUS_SW_MAIN 3
+#define  PMC_RST_STATUS_LP0 4
+#define  PMC_RST_STATUS_AOTAG 5
 #define APBDEV_PMC_IO_DPD_REQ 0x1B8
 #define  PMC_IO_DPD_REQ_DPD_OFF BIT(30)
 #define APBDEV_PMC_IO_DPD2_REQ 0x1C0

bdk/soc/t210.h

@@ -281,7 +281,6 @@
 /*! Special registers. */
 #define EMC_SCRATCH0 0x324
 #define  EMC_HEKA_UPD BIT(30)
-#define  EMC_SEPT_RUN BIT(31)
 
 /*! Flow controller registers. */
 #define FLOW_CTLR_HALT_COP_EVENTS  0x4

bdk/soc/uart.c

@@ -122,7 +122,12 @@ u32 uart_get_IIR(u32 idx)
 {
 	uart_t *uart = (uart_t *)(UART_BASE + uart_baseoff[idx]);
 
-	return uart->UART_IIR_FCR;
+	u32 iir = uart->UART_IIR_FCR & UART_IIR_INT_MASK;
+
+	if (iir & UART_IIR_NO_INT)
+		return 0;
+	else
+		return ((iir >> 1) + 1); // Return encoded interrupt.
 }
 
 void uart_set_IIR(u32 idx)

bdk/soc/uart.h

@@ -54,6 +54,17 @@
 #define UART_IIR_FCR_RX_CLR 0x2
 #define UART_IIR_FCR_EN_FIFO 0x1
 
+#define UART_IIR_NO_INT BIT(0)
+#define UART_IIR_INT_MASK 0xF
+/* Custom returned interrupt results. Actual interrupts are -1 */
+#define UART_IIR_NOI   0 // No interrupt.
+#define UART_IIR_MSI   1 // Modem status interrupt.
+#define UART_IIR_THRI  2 // Transmitter holding register empty.
+#define UART_IIR_RDI   3 // Receiver data interrupt.
+#define UART_IIR_ERROR 4 // Overrun Error, Parity Error, Framing Error, Break.
+#define UART_IIR_REDI  5 // Receiver end of data interrupt.
+#define UART_IIR_RDTI  7 // Receiver data timeout interrupt.
+
 #define UART_MCR_RTS 0x2
 #define UART_MCR_DTR 0x1
 

bdk/storage/mmc.h

@@ -2,6 +2,7 @@
  * Header for MultiMediaCard (MMC)
  *
  * Copyright 2002 Hewlett-Packard Company
+ * Copyright 2018-2021 CTCaer
  *
  * Use consistent with the GNU GPL is permitted,
  * provided that this copyright notice is
@@ -21,8 +22,8 @@
  *          15 May 2002
  */
 
-#ifndef LINUX_MMC_MMC_H
-#define LINUX_MMC_MMC_H
+#ifndef MMC_H
+#define MMC_H
 
 /* Standard MMC commands (4.1)           type  argument     response */
 /* class 1 */
@@ -97,29 +98,29 @@
 #define MMC_CMDQ_TASK_MGMT       48   /* ac   [20:16] task id    R1b */
 
 /*
-* MMC_SWITCH argument format:
-*
-*	[31:26] Always 0
-*	[25:24] Access Mode
-*	[23:16] Location of target Byte in EXT_CSD
-*	[15:08] Value Byte
-*	[07:03] Always 0
-*	[02:00] Command Set
-*/
+ * MMC_SWITCH argument format:
+ *
+ *	[31:26] Always 0
+ *	[25:24] Access Mode
+ *	[23:16] Location of target Byte in EXT_CSD
+ *	[15:08] Value Byte
+ *	[07:03] Always 0
+ *	[02:00] Command Set
+ */
 
 /*
-MMC status in R1, for native mode (SPI bits are different)
-Type
-e : error bit
-s : status bit
-r : detected and set for the actual command response
-x : detected and set during command execution. the host must poll
-the card by sending status command in order to read these bits.
-Clear condition
-a : according to the card state
-b : always related to the previous command. Reception of
-a valid command will clear it (with a delay of one command)
-c : clear by read
+ * MMC status in R1, for native mode (SPI bits are different)
+ * Type
+ * e : error bit
+ * s : status bit
+ * r : detected and set for the actual command response
+ * x : detected and set during command execution. the host must poll
+ *     the card by sending status command in order to read these bits.
+ * Clear condition
+ * a : according to the card state
+ * b : always related to the previous command. Reception of a valid
+ *     command will clear it (with a delay of one command)
+ * c : clear by read
 */
 
 #define R1_OUT_OF_RANGE		(1 << 31)	/* er, c */
@@ -151,6 +152,7 @@ c : clear by read
 #define R1_AKE_SEQ_ERROR	(1 << 3)
 
 /* R1_CURRENT_STATE 12:9 */
+#define R1_STATE(x)     ((x) << 9)
 #define R1_STATE_IDLE	0
 #define R1_STATE_READY	1
 #define R1_STATE_IDENT	2
@@ -162,9 +164,9 @@ c : clear by read
 #define R1_STATE_DIS	8
 
 /*
-* MMC/SD in SPI mode reports R1 status always, and R2 for SEND_STATUS
-* R1 is the low order byte; R2 is the next highest byte, when present.
-*/
+ * MMC/SD in SPI mode reports R1 status always, and R2 for SEND_STATUS
+ * R1 is the low order byte; R2 is the next highest byte, when present.
+ */
 #define R1_SPI_IDLE		(1 << 0)
 #define R1_SPI_ERASE_RESET	(1 << 1)
 #define R1_SPI_ILLEGAL_COMMAND	(1 << 2)
@@ -185,16 +187,16 @@ c : clear by read
 #define R2_SPI_CSD_OVERWRITE	R2_SPI_OUT_OF_RANGE
 
 /*
-* OCR bits are mostly in host.h
-*/
+ * OCR bits are mostly in host.h
+ */
 #define MMC_CARD_VDD_18		(1 << 7)	/* Card VDD voltage 1.8 */
 #define MMC_CARD_VDD_27_34	(0x7F << 15)	/* Card VDD voltage 2.7 ~ 3.4 */
 #define MMC_CARD_CCS		(1 << 30)	/* Card Capacity status bit */
 #define MMC_CARD_BUSY		(1 << 31)	/* Card Power up status bit */
 
 /*
-* Card Command Classes (CCC)
-*/
+ * Card Command Classes (CCC)
+ */
 #define CCC_BASIC		(1<<0)	/* (0) Basic protocol functions */
 /* (CMD0,1,2,3,4,7,9,10,12,13,15) */
 /* (and for SPI, CMD58,59) */
@@ -222,8 +224,8 @@ c : clear by read
 /* (CMD?) */
 
 /*
-* CSD field definitions
-*/
+ * CSD field definitions
+ */
 
 #define CSD_STRUCT_VER_1_0  0           /* Valid for system specification 1.0 - 1.2 */
 #define CSD_STRUCT_VER_1_1  1           /* Valid for system specification 1.4 - 2.2 */
@@ -237,8 +239,8 @@ c : clear by read
 #define CSD_SPEC_VER_4      4           /* Implements system specification 4.0 - 4.1 */
 
 /*
-* EXT_CSD fields
-*/
+ * EXT_CSD fields
+ */
 
 #define EXT_CSD_CMDQ_MODE_EN		15	/* R/W */
 #define EXT_CSD_FLUSH_CACHE		32      /* W */
@@ -316,8 +318,8 @@ c : clear by read
 #define EXT_CSD_HPI_FEATURES		503	/* RO */
 
 /*
-* EXT_CSD field definitions
-*/
+ * EXT_CSD field definitions
+ */
 
 #define EXT_CSD_WR_REL_PARAM_EN		(1<<2)
 
@@ -393,8 +395,8 @@ c : clear by read
 #define EXT_CSD_PACKED_EVENT_EN	(1<<3)
 
 /*
-* EXCEPTION_EVENT_STATUS field
-*/
+ * EXCEPTION_EVENT_STATUS field
+ */
 #define EXT_CSD_URGENT_BKOPS		(1<<0)
 #define EXT_CSD_DYNCAP_NEEDED		(1<<1)
 #define EXT_CSD_SYSPOOL_EXHAUSTED	(1<<2)
@@ -404,34 +406,34 @@ c : clear by read
 #define EXT_CSD_PACKED_INDEXED_ERROR	(1<<1)
 
 /*
-* BKOPS status level
-*/
+ * BKOPS status level
+ */
 #define EXT_CSD_BKOPS_LEVEL_2		0x2
 
 /*
-* BKOPS modes
-*/
+ * BKOPS modes
+ */
 #define EXT_CSD_MANUAL_BKOPS_MASK	0x01
 #define EXT_CSD_AUTO_BKOPS_MASK		0x02
 
 /*
-* Command Queue
-*/
+ * Command Queue
+ */
 #define EXT_CSD_CMDQ_MODE_ENABLED	(1<<0)
 #define EXT_CSD_CMDQ_DEPTH_MASK		0x1F
 #define EXT_CSD_CMDQ_SUPPORTED		(1<<0)
 
 /*
-* MMC_SWITCH access modes
-*/
+ * MMC_SWITCH access modes
+ */
 #define MMC_SWITCH_MODE_CMD_SET		0x00	/* Change the command set */
 #define MMC_SWITCH_MODE_SET_BITS	0x01	/* Set bits which are 1 in value */
 #define MMC_SWITCH_MODE_CLEAR_BITS	0x02	/* Clear bits which are 1 in value */
 #define MMC_SWITCH_MODE_WRITE_BYTE	0x03	/* Set target to value */
 
 /*
-* Erase/trim/discard
-*/
+ * Erase/trim/discard
+ */
 #define MMC_ERASE_ARG			0x00000000
 #define MMC_SECURE_ERASE_ARG		0x80000000
 #define MMC_TRIM_ARG			0x00000001
@@ -441,4 +443,9 @@ c : clear by read
 #define MMC_SECURE_ARGS			0x80000000
 #define MMC_TRIM_ARGS			0x00008001
 
-#endif /* LINUX_MMC_MMC_H */
+/*
+ * Vendor definitions and structs
+ */
+#define MMC_SANDISK_HEALTH_REPORT 0x96C9D71C
+
+#endif /* MMC_H */

bdk/storage/nx_sd.h

@@ -46,6 +46,7 @@ void sd_error_count_increment(u8 type);
 u16 *sd_get_error_count();
 bool sd_get_card_removed();
 bool sd_get_card_initialized();
+bool sd_get_card_mounted();
 u32  sd_get_mode();
 int  sd_init_retry(bool power_cycle);
 bool sd_initialize(bool power_cycle);

bdk/storage/sdmmc.c

@@ -139,6 +139,60 @@ static int _sdmmc_storage_check_status(sdmmc_storage_t *storage)
 	return _sdmmc_storage_get_status(storage, &tmp, 0);
 }
 
+int sdmmc_storage_execute_vendor_cmd(sdmmc_storage_t *storage, u32 arg)
+{
+	sdmmc_cmd_t cmdbuf;
+	sdmmc_init_cmd(&cmdbuf, MMC_VENDOR_62_CMD, arg, SDMMC_RSP_TYPE_1, 1);
+	if (!sdmmc_execute_cmd(storage->sdmmc, &cmdbuf, 0, 0))
+		return 0;
+
+	u32 resp;
+	sdmmc_get_rsp(storage->sdmmc, &resp, 4, SDMMC_RSP_TYPE_1);
+
+	resp = -1;
+	u32 timeout = get_tmr_ms() + 1500;
+	while (resp != (R1_READY_FOR_DATA | R1_STATE(R1_STATE_TRAN)))
+	{
+		_sdmmc_storage_get_status(storage, &resp, 0);
+
+		if (get_tmr_ms() > timeout)
+			break;
+	}
+
+	return _sdmmc_storage_check_card_status(resp);
+}
+
+int sdmmc_storage_vendor_sandisk_report(sdmmc_storage_t *storage, void *buf)
+{
+	// Request health report.
+	if (!sdmmc_storage_execute_vendor_cmd(storage, MMC_SANDISK_HEALTH_REPORT))
+		return 2;
+
+	u32 tmp = 0;
+	sdmmc_cmd_t cmdbuf;
+	sdmmc_req_t reqbuf;
+
+	sdmmc_init_cmd(&cmdbuf, MMC_VENDOR_63_CMD, 0, SDMMC_RSP_TYPE_1, 0); // similar to CMD17 with arg 0x0.
+
+	reqbuf.buf = buf;
+	reqbuf.num_sectors = 1;
+	reqbuf.blksize = 512;
+	reqbuf.is_write = 0;
+	reqbuf.is_multi_block = 0;
+	reqbuf.is_auto_stop_trn = 0;
+
+	u32 blkcnt_out;
+	if (!sdmmc_execute_cmd(storage->sdmmc, &cmdbuf, &reqbuf, &blkcnt_out))
+	{
+		sdmmc_stop_transmission(storage->sdmmc, &tmp);
+		_sdmmc_storage_get_status(storage, &tmp, 0);
+
+		return 0;
+	}
+
+	return 1;
+}
+
 static int _sdmmc_storage_readwrite_ex(sdmmc_storage_t *storage, u32 *blkcnt_out, u32 sector, u32 num_sectors, void *buf, u32 is_write)
 {
 	u32 tmp = 0;
@@ -1360,8 +1414,6 @@ DPRINTF("[SD] SD does not support wide bus width\n");
 		if (!_sd_storage_enable_uhs_low_volt(storage, type, buf))
 			return 0;
 DPRINTF("[SD] enabled UHS\n");
-
-		sdmmc_card_clock_powersave(sdmmc, SDMMC_POWER_SAVE_ENABLE);
 	}
 	else if (type != SDHCI_TIMING_SD_DS12 && storage->scr.sda_vsn) // Not default speed and not SD Version 1.0.
 	{
@@ -1387,6 +1439,8 @@ DPRINTF("[SD] enabled HS\n");
 DPRINTF("[SD] got sd status\n");
 	}
 
+	sdmmc_card_clock_powersave(sdmmc, SDMMC_POWER_SAVE_ENABLE);
+
 	storage->initialized = 1;
 
 	return 1;

bdk/storage/sdmmc.h

@@ -34,6 +34,81 @@ typedef enum _sdmmc_type
 	EMMC_RPMB  = 3
 } sdmmc_type;
 
+typedef struct _mmc_sandisk_advanced_report_t
+{
+	u32 power_inits;
+
+	u32 max_erase_cycles_sys;
+	u32 max_erase_cycles_slc;
+	u32 max_erase_cycles_mlc;
+
+	u32 min_erase_cycles_sys;
+	u32 min_erase_cycles_slc;
+	u32 min_erase_cycles_mlc;
+
+	u32 max_erase_cycles_euda;
+	u32 min_erase_cycles_euda;
+	u32 avg_erase_cycles_euda;
+	u32 read_reclaim_cnt_euda;
+	u32 bad_blocks_euda;
+
+	u32 pre_eol_euda;
+	u32 pre_eol_sys;
+	u32 pre_eol_mlc;
+
+	u32 uncorrectable_ecc;
+
+	u32 temperature_now;
+	u32 temperature_min;
+	u32 temperature_max;
+
+	u32 health_pct_euda;
+	u32 health_pct_sys;
+	u32 health_pct_mlc;
+
+	u32 unk0;
+	u32 unk1;
+	u32 unk2;
+
+	u32 reserved[78];
+} mmc_sandisk_advanced_report_t;
+
+typedef struct _mmc_sandisk_report_t
+{
+	u32 avg_erase_cycles_sys;
+	u32 avg_erase_cycles_slc;
+	u32 avg_erase_cycles_mlc;
+
+	u32 read_reclaim_cnt_sys;
+	u32 read_reclaim_cnt_slc;
+	u32 read_reclaim_cnt_mlc;
+
+	u32 bad_blocks_factory;
+	u32 bad_blocks_sys;
+	u32 bad_blocks_slc;
+	u32 bad_blocks_mlc;
+
+	u32 fw_updates_cnt;
+
+	u8  fw_update_date[12];
+	u8  fw_update_time[8];
+
+	u32 total_writes_100mb;
+	u32 vdrops;
+	u32 vdroops;
+
+	u32 vdrops_failed_data_rec;
+	u32 vdrops_data_rec_ops;
+
+	u32 total_writes_slc_100mb;
+	u32 total_writes_mlc_100mb;
+
+	u32 mlc_bigfile_mode_limit_exceeded;
+	u32 avg_erase_cycles_hybrid;
+
+	mmc_sandisk_advanced_report_t advanced;
+} mmc_sandisk_report_t;
+
 typedef struct _mmc_cid
 {
 	u32 manfid;
@@ -131,6 +206,9 @@ void sdmmc_storage_init_wait_sd();
 int  sdmmc_storage_init_sd(sdmmc_storage_t *storage, sdmmc_t *sdmmc, u32 bus_width, u32 type);
 int  sdmmc_storage_init_gc(sdmmc_storage_t *storage, sdmmc_t *sdmmc);
 
+int  sdmmc_storage_execute_vendor_cmd(sdmmc_storage_t *storage, u32 arg);
+int  sdmmc_storage_vendor_sandisk_report(sdmmc_storage_t *storage, void *buf);
+
 int  sd_storage_get_ssr(sdmmc_storage_t *storage, u8 *buf);
 u32  sd_storage_get_ssr_au(sdmmc_storage_t *storage);
 

bdk/storage/sdmmc_driver.c

@@ -1033,12 +1033,10 @@ static int _sdmmc_execute_cmd_inner(sdmmc_t *sdmmc, sdmmc_cmd_t *cmd, sdmmc_req_
 	}
 
 	int result = _sdmmc_wait_response(sdmmc);
-	if (!result)
-	{
 #ifdef ERROR_EXTRA_PRINTING
+	if (!result)
 		EPRINTF("SDMMC: Transfer timeout!");
 #endif
-	}
 DPRINTF("rsp(%d): %08X, %08X, %08X, %08X\n", result,
 		sdmmc->regs->rspreg0, sdmmc->regs->rspreg1, sdmmc->regs->rspreg2, sdmmc->regs->rspreg3);
 	if (result)
@@ -1047,22 +1045,18 @@ DPRINTF("rsp(%d): %08X, %08X, %08X, %08X\n", result,
 		{
 			sdmmc->expected_rsp_type = cmd->rsp_type;
 			result = _sdmmc_cache_rsp(sdmmc, sdmmc->rsp, 0x10, cmd->rsp_type);
-			if (!result)
-			{
 #ifdef ERROR_EXTRA_PRINTING
+			if (!result)
 				EPRINTF("SDMMC: Unknown response type!");
 #endif
-			}
 		}
 		if (req && result)
 		{
 			result = _sdmmc_update_dma(sdmmc);
-			if (!result)
-			{
 #ifdef ERROR_EXTRA_PRINTING
+			if (!result)
 				EPRINTF("SDMMC: DMA Update failed!");
 #endif
-			}
 		}
 	}
 
@@ -1085,12 +1079,10 @@ DPRINTF("rsp(%d): %08X, %08X, %08X, %08X\n", result,
 		if (cmd->check_busy || req)
 		{
 			result = _sdmmc_wait_card_busy(sdmmc);
-			if (!result)
-			{
 #ifdef ERROR_EXTRA_PRINTING
+			if (!result)
 				EPRINTF("SDMMC: Busy timeout!");
 #endif
-			}
 			return result;
 		}
 	}

bdk/thermal/fan.c

@@ -1,7 +1,7 @@
 /*
  * Fan driver for Nintendo Switch
  *
- * Copyright (c) 2018-2020 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -18,6 +18,7 @@
 
 #include <thermal/fan.h>
 #include <power/regulator_5v.h>
+#include <soc/fuse.h>
 #include <soc/gpio.h>
 #include <soc/pinmux.h>
 #include <soc/t210.h>
@@ -26,11 +27,22 @@
 void set_fan_duty(u32 duty)
 {
 	static bool fan_init = false;
-	static u16 curr_duty = -1;
+	static u16  curr_duty = -1;
+
+	if (duty > 236)
+		duty = 236;
 
 	if (curr_duty == duty)
 		return;
 
+	curr_duty = duty;
+
+	//! TODO: Add HOAG/AULA support.
+	u32 hw_type = fuse_read_hw_type();
+	if (hw_type != FUSE_NX_HW_TYPE_ICOSA &&
+		hw_type != FUSE_NX_HW_TYPE_IOWA)
+		return;
+
 	if (!fan_init)
 	{
 		// Fan tachometer.
@@ -46,9 +58,6 @@ void set_fan_duty(u32 duty)
 		fan_init = true;
 	}
 
-	if (duty > 236)
-		duty = 236;
-
 	// Inverted polarity.
 	u32 inv_duty = 236 - duty;
 
@@ -71,23 +80,20 @@ void set_fan_duty(u32 duty)
 		// Enable fan.
 		PINMUX_AUX(PINMUX_AUX_LCD_GPIO2) = 1; // Set source to PWM1.
 	}
-
-	curr_duty = duty;
 }
 
 void get_fan_speed(u32 *duty, u32 *rpm)
 {
 	if (rpm)
 	{
-		u32  irq_count = 1;
+		u32  irq_count = 0;
 		bool should_read = true;
-		bool irq_val = 0;
 
-		// Poll irqs for 2 seconds.
-		int timer = get_tmr_us() + 1000000;
-		while (timer - get_tmr_us())
+		// Poll irqs for 2 seconds. (5 seconds for accurate count).
+		int  timer = get_tmr_us() + 2000000;
+		while ((timer - get_tmr_us()) > 0)
 		{
-			irq_val = gpio_read(GPIO_PORT_S, GPIO_PIN_7);
+			bool irq_val = gpio_read(GPIO_PORT_S, GPIO_PIN_7);
 			if (irq_val && should_read)
 			{
 				irq_count++;
@@ -97,8 +103,11 @@ void get_fan_speed(u32 *duty, u32 *rpm)
 				should_read = true;
 		}
 
+		// Halve the irq count.
+		irq_count /= 2;
+
 		// Calculate rpm based on triggered interrupts.
-		*rpm = 60000000 / ((1000000 * 2) / irq_count);
+		*rpm = irq_count * (60 / 2);
 	}
 
 	if (duty)

bdk/usb/usb_gadget_ums.c

@@ -4,7 +4,7 @@
  * Copyright (c) 2003-2008 Alan Stern
  * Copyright (c) 2009 Samsung Electronics
  *                    Author: Michal Nazarewicz <m.nazarewicz@samsung.com>
- * Copyright (c) 2019-2020 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -109,7 +109,7 @@
 #define SS_WRITE_ERROR                        0x30C02
 #define SS_WRITE_PROTECTED                    0x72700
 
-#define SK(x)   ((u8) ((x) >> 16)) /* Sense Key byte, etc. */
+#define SK(x)   ((u8) ((x) >> 16)) // Sense Key byte, etc.
 #define ASC(x)  ((u8) ((x) >> 8))
 #define ASCQ(x) ((u8) (x))
 
@@ -203,7 +203,7 @@ typedef struct _bulk_ctxt_t {
 typedef struct _usbd_gadget_ums_t {
 	bulk_ctxt_t bulk_ctxt;
 
-	int  cmnd_size;
+	u32  cmnd_size;
 	u8   cmnd[SCSI_MAX_CMD_SZ];
 
 	u32  lun_idx; // lun index
@@ -217,6 +217,7 @@ typedef struct _usbd_gadget_ums_t {
 	u32  tag;
 	u32  residue;
 	u32  usb_amount_left;
+	bool cbw_req_queued;
 
 	u32  phase_error;
 	u32  short_packet_received;
@@ -368,12 +369,12 @@ static void _ums_transfer_out_big_read(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk
 		bulk_ctxt->bulk_out_buf_state = BUF_STATE_FULL;
 }
 
-static void _ums_transfer_finish(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt, u32 ep)
+static void _ums_transfer_finish(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt, u32 ep, u32 sync_timeout)
 {
 	if (ep == bulk_ctxt->bulk_in)
 	{
 		bulk_ctxt->bulk_in_status = usb_ops.usb_device_ep1_in_writing_finish(
-			&bulk_ctxt->bulk_in_length_actual);
+			&bulk_ctxt->bulk_in_length_actual, sync_timeout);
 
 		if (bulk_ctxt->bulk_in_status == USB_ERROR_XFER_ERROR)
 		{
@@ -386,7 +387,7 @@ static void _ums_transfer_finish(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt,
 	else
 	{
 		bulk_ctxt->bulk_out_status = usb_ops.usb_device_ep1_out_reading_finish(
-			&bulk_ctxt->bulk_out_length_actual);
+			&bulk_ctxt->bulk_out_length_actual, sync_timeout);
 
 		if (bulk_ctxt->bulk_out_status == USB_ERROR_XFER_ERROR)
 		{
@@ -460,6 +461,7 @@ static int _scsi_read(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 	}
 	if (lba_offset >= ums->lun.num_sectors)
 	{
+		ums->set_text(ums->label, "#FF8000 Warn:# Read - Out of range! Host notified.");
 		ums->lun.sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
 
 		return UMS_RES_INVALID_ARG;
@@ -497,7 +499,7 @@ static int _scsi_read(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 
 		// Wait for the async USB transfer to finish.
 		if (!first_read)
-			_ums_transfer_finish(ums, bulk_ctxt, bulk_ctxt->bulk_in);
+			_ums_transfer_finish(ums, bulk_ctxt, bulk_ctxt->bulk_in, USB_XFER_SYNCED);
 
 		lba_offset   += amount;
 		amount_left  -= amount;
@@ -548,6 +550,7 @@ static int _scsi_write(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 
 	if (ums->lun.ro)
 	{
+		ums->set_text(ums->label, "#FF8000 Warn:# Write - Read only! Host notified.");
 		ums->lun.sense_data = SS_WRITE_PROTECTED;
 
 		return UMS_RES_INVALID_ARG;
@@ -571,34 +574,33 @@ static int _scsi_write(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 	// Check that starting LBA is not past the end sector offset.
 	if (lba_offset >= ums->lun.num_sectors)
 	{
+		ums->set_text(ums->label, "#FF8000 Warn:# Write - Out of range! Host notified.");
 		ums->lun.sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
 
 		return UMS_RES_INVALID_ARG;
 	}
 
-	/* Carry out the file writes */
+	// Carry out the file writes.
 	usb_lba_offset = lba_offset;
 	amount_left_to_req = ums->data_size_from_cmnd;
 	amount_left_to_write = ums->data_size_from_cmnd;
 
 	while (amount_left_to_write > 0)
 	{
-
-		/* Queue a request for more data from the host */
-		if (amount_left_to_req)
+		// Queue a request for more data from the host.
+		if (amount_left_to_req > 0)
 		{
 
 			// Limit write to max supported read from EP OUT.
 			amount = MIN(amount_left_to_req, UMS_EP_OUT_MAX_XFER);
 
-			if (usb_lba_offset >= ums->lun.num_sectors) //////////Check if it works with concurrency
+			if (usb_lba_offset >= ums->lun.num_sectors)
 			{
 				ums->set_text(ums->label, "#FFDD00 Error:# Write - Past last sector!");
-				amount_left_to_req = 0;
 				ums->lun.sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
 				ums->lun.sense_data_info = usb_lba_offset;
 				ums->lun.info_valid = 1;
-				continue;
+				break;
 			}
 
 			// Get the next buffer.
@@ -640,12 +642,12 @@ static int _scsi_write(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 			 */
 			amount = MIN(amount, bulk_ctxt->bulk_out_length);
 
-			/* Don't write a partial block */
+			// Don't write a partial block.
 			amount -= (amount & 511);
 			if (amount == 0)
 				goto empty_write;
 
-			/* Perform the write */
+			// Perform the write.
 			if (!sdmmc_storage_write(ums->lun.storage, ums->lun.offset + lba_offset,
 				amount >> UMS_DISK_LBA_SHIFT, (u8 *)bulk_ctxt->bulk_out_buf))
 				amount = 0;
@@ -656,7 +658,7 @@ DPRINTF("file write %X @ %X\n", amount, lba_offset);
 			amount_left_to_write -= amount;
 			ums->residue         -= amount;
 
-			/* If an error occurred, report it and its position */
+			// If an error occurred, report it and its position.
 			if (!amount)
 			{
 				ums->set_text(ums->label, "#FFDD00 Error:# SDMMC Write!");
@@ -686,6 +688,7 @@ static int _scsi_verify(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 	u32 lba_offset = get_array_be_to_le32(&ums->cmnd[2]);
 	if (lba_offset >= ums->lun.num_sectors)
 	{
+		ums->set_text(ums->label, "#FF8000 Warn:# Verif - Out of range! Host notified.");
 		ums->lun.sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
 
 		return UMS_RES_INVALID_ARG;
@@ -1007,7 +1010,7 @@ static int _scsi_mode_sense(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 		return UMS_RES_INVALID_ARG;
 	}
 
-	/*  Store the mode data length */
+	//  Store the mode data length.
 	if (ums->cmnd[0] == SC_MODE_SENSE_6)
 		buf0[0] = len - 1;
 	else
@@ -1089,8 +1092,7 @@ static int _scsi_prevent_allow_removal(usbd_gadget_ums_t *ums)
 
 	// Notify for possible unmounting?
 	// Normally we sync here but we do synced writes to SDMMC.
-	if (ums->lun.prevent_medium_removal && !prevent)
-		;
+	if (ums->lun.prevent_medium_removal && !prevent) { /* Do nothing */ }
 
 	ums->lun.prevent_medium_removal = prevent;
 
@@ -1114,7 +1116,7 @@ static int _scsi_read_format_capacities(usbd_gadget_ums_t *ums, bulk_ctxt_t *bul
 
 // Check whether the command is properly formed and whether its data size
 // and direction agree with the values we already have.
-static int _ums_check_scsi_cmd(usbd_gadget_ums_t *ums, int cmnd_size,
+static int _ums_check_scsi_cmd(usbd_gadget_ums_t *ums, u32 cmnd_size,
 	enum data_direction data_dir, u32 mask, int needs_medium)
 {
 //const char dirletter[4] = {'u', 'o', 'i', 'n'};
@@ -1540,12 +1542,12 @@ static int finish_reply(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 
 static int received_cbw(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 {
-	/* Was this a real packet?  Should it be ignored? */
+	// Was this a real packet?  Should it be ignored?
 	if (bulk_ctxt->bulk_out_status || bulk_ctxt->bulk_out_ignore || ums->lun.unmounted)
 	{
 		if (bulk_ctxt->bulk_out_status || ums->lun.unmounted)
 		{
-			DPRINTF("USB: EP timeout\n");
+			DPRINTF("USB: EP timeout (%d)\n", bulk_ctxt->bulk_out_status);
 			// In case we disconnected, exit UMS.
 			// Raise timeout if removable and didn't got a unit ready command inside 4s.
 			if (bulk_ctxt->bulk_out_status == USB2_ERROR_XFER_EP_DISABLED ||
@@ -1576,6 +1578,8 @@ static int received_cbw(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 			{
 				ums->set_text(ums->label, "#C7EA46 Status:# Medium unmounted");
 				ums->timeouts++;
+				if (!bulk_ctxt->bulk_out_status)
+					ums->timeouts += 3;
 			}
 
 			if (ums->timeouts > 20)
@@ -1586,29 +1590,34 @@ static int received_cbw(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 			return UMS_RES_INVALID_ARG;
 	}
 
-	/* Is the CBW valid? */
+	// Clear request flag to allow a new one to be queued.
+	ums->cbw_req_queued = false;
+
+	// Is the CBW valid?
 	bulk_recv_pkt_t *cbw = (bulk_recv_pkt_t *)bulk_ctxt->bulk_out_buf;
 	if (bulk_ctxt->bulk_out_length_actual != USB_BULK_CB_WRAP_LEN || cbw->Signature != USB_BULK_CB_SIG)
 	{
 		gfx_printf("USB: invalid CBW: len %X sig 0x%X\n", bulk_ctxt->bulk_out_length_actual, cbw->Signature);
 
-		 // The Bulk-only spec says we MUST stall the IN endpoint
-		 // (6.6.1), so it's unavoidable.  It also says we must
-		 // retain this state until the next reset, but there's
-		 // no way to tell the controller driver it should ignore
-		 // Clear-Feature(HALT) requests.
-		 //
-		 // We aren't required to halt the OUT endpoint; instead
-		 // we can simply accept and discard any data received
-		 // until the next reset.
+		/*
+		 * The Bulk-only spec says we MUST stall the IN endpoint
+		 * (6.6.1), so it's unavoidable.  It also says we must
+		 * retain this state until the next reset, but there's
+		 * no way to tell the controller driver it should ignore
+		 * Clear-Feature(HALT) requests.
+		 *
+		 * We aren't required to halt the OUT endpoint; instead
+		 * we can simply accept and discard any data received
+		 * until the next reset.
+		 */
 		ums_wedge_bulk_in_endpoint(ums);
 		bulk_ctxt->bulk_out_ignore = 1;
 		return UMS_RES_INVALID_ARG;
 	}
 
-	/* Is the CBW meaningful? */
+	// Is the CBW meaningful?
 	if (cbw->Lun >= UMS_MAX_LUN || cbw->Flags & ~USB_BULK_IN_FLAG ||
-			cbw->Length <= 0 || cbw->Length > SCSI_MAX_CMD_SZ)
+			cbw->Length == 0 || cbw->Length > SCSI_MAX_CMD_SZ)
 	{
 		gfx_printf("USB: non-meaningful CBW: lun = %X, flags = 0x%X, cmdlen %X\n",
 			cbw->Lun, cbw->Flags, cbw->Length);
@@ -1625,7 +1634,7 @@ static int received_cbw(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 		return UMS_RES_INVALID_ARG;
 	}
 
-	/* Save the command for later */
+	// Save the command for later.
 	ums->cmnd_size = cbw->Length;
 	memcpy(ums->cmnd, cbw->CDB, ums->cmnd_size);
 
@@ -1660,8 +1669,20 @@ static int get_next_command(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 
 	bulk_ctxt->bulk_out_length = USB_BULK_CB_WRAP_LEN;
 
-	/* Queue a request to read a Bulk-only CBW */
-	_ums_transfer_start(ums, bulk_ctxt, bulk_ctxt->bulk_out, USB_XFER_SYNCED_CMD);
+	// Queue a request to read a Bulk-only CBW.
+	if (!ums->cbw_req_queued)
+		_ums_transfer_start(ums, bulk_ctxt, bulk_ctxt->bulk_out, USB_XFER_SYNCED_CMD);
+	else
+		_ums_transfer_finish(ums, bulk_ctxt, bulk_ctxt->bulk_out, USB_XFER_SYNCED_CMD);
+
+	/*
+	 * On XUSB do not allow multiple requests for CBW to be done.
+	 * This avoids an issue with some XHCI controllers and OS combos (e.g. ASMedia and Linux/Mac OS)
+	 * which confuse that and concatenate an old CBW request with another write request (SCSI Write)
+	 * and create a babble error (transmit overflow).
+	 */
+	if (ums->xusb)
+		ums->cbw_req_queued = true;
 
 	/* We will drain the buffer in software, which means we
 	 * can reuse it for the next filling.  No need to advance
@@ -1698,7 +1719,7 @@ static void send_status(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 			SK(sd), ASC(sd), ASCQ(sd), ums->lun.sense_data_info);
 	}
 
-	/* Store and send the Bulk-only CSW */
+	// Store and send the Bulk-only CSW.
 	bulk_send_pkt_t *csw = (bulk_send_pkt_t *)bulk_ctxt->bulk_in_buf;
 
 	csw->Signature = USB_BULK_CS_SIG;
@@ -1714,7 +1735,7 @@ static void handle_exception(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 {
 	enum ums_state old_state;
 
-	/* Clear out the controller's fifos */
+	// Clear out the controller's fifos.
 	ums_flush_endpoint(bulk_ctxt->bulk_in);
 	ums_flush_endpoint(bulk_ctxt->bulk_out);
 
@@ -1737,7 +1758,7 @@ static void handle_exception(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 
 	ums->state = UMS_STATE_NORMAL;
 
-	/* Carry out any extra actions required for the exception */
+	// Carry out any extra actions required for the exception.
 	switch (old_state)
 	{
 	case UMS_STATE_NORMAL:
@@ -1759,7 +1780,7 @@ static void handle_exception(usbd_gadget_ums_t *ums, bulk_ctxt_t *bulk_ctxt)
 		break;
 
 	case UMS_STATE_EXIT:
-		ums->state = UMS_STATE_TERMINATED;	/* Stop the thread */
+		ums->state = UMS_STATE_TERMINATED;	// Stop the thread.
 		break;
 
 	default:
@@ -1837,6 +1858,7 @@ int usb_device_gadget_ums(usb_ctxt_t *usbs)
 	// Initialize sdmmc.
 	if (usbs->type == MMC_SD)
 	{
+		sd_end();
 		sd_mount();
 		sd_unmount();
 		ums.lun.sdmmc = &sd_sdmmc;
@@ -1907,7 +1929,10 @@ int usb_device_gadget_ums(usb_ctxt_t *usbs)
 		send_status(&ums, &ums.bulk_ctxt);
 	} while (ums.state != UMS_STATE_TERMINATED);
 
-	ums.set_text(ums.label, "#C7EA46 Status:# Disk ejected");
+	if (ums.lun.prevent_medium_removal)
+		ums.set_text(ums.label, "#FFDD00 Error:# Disk unsafely ejected");
+	else
+		ums.set_text(ums.label, "#C7EA46 Status:# Disk ejected");
 	goto exit;
 
 error:

bdk/usb/usb_t210.h

@@ -1,7 +1,7 @@
 /*
  * Enhanced & eXtensible USB device (EDCI & XDCI) driver for Tegra X1
  *
- * Copyright (c) 2019-2020 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -200,6 +200,8 @@ typedef struct _t210_usb2d_t
 #define  XHCI_ST_IP                      BIT(4)
 #define XUSB_DEV_XHCI_RT_IMOD            0x38
 #define XUSB_DEV_XHCI_PORTSC             0x3C
+#define  XHCI_PORTSC_CCS                 BIT(0)
+#define  XHCI_PORTSC_PED                 BIT(1)
 #define  XHCI_PORTSC_PR                  BIT(4)
 #define  XHCI_PORTSC_PLS_MASK            (0xF << 5)
 #define   XHCI_PORTSC_PLS_U0             (0 << 5)
@@ -226,11 +228,12 @@ typedef struct _t210_usb2d_t
 #define XUSB_DEV_XHCI_ECPLO              0x40
 #define XUSB_DEV_XHCI_ECPHI              0x44
 #define XUSB_DEV_XHCI_EP_HALT            0x50
-#define  XHCI_EP_HALT_DCI                BIT(0)
+#define  XHCI_EP_HALT_DCI_EP0_IN         BIT(0)
 #define XUSB_DEV_XHCI_EP_PAUSE           0x54
 #define XUSB_DEV_XHCI_EP_RELOAD          0x58
 #define XUSB_DEV_XHCI_EP_STCHG           0x5C
 #define XUSB_DEV_XHCI_PORTHALT           0x6C
+#define XUSB_DEV_XHCI_EP_STOPPED         0x78
 #define  XHCI_PORTHALT_HALT_LTSSM        BIT(0)
 #define  XHCI_PORTHALT_STCHG_REQ         BIT(20)
 #define XUSB_DEV_XHCI_CFG_DEV_FE         0x85C

bdk/usb/usbd.c

@@ -1,7 +1,7 @@
 /*
  * Enhanced USB Device (EDCI) driver for Tegra X1
  *
- * Copyright (c) 2019-2020 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -1455,7 +1455,7 @@ static int _usbd_get_ep1_out_bytes_read()
 		return (usbdaemon->ep_bytes_requested[USB_EP_BULK_OUT] - (usbdaemon->qhs[USB_EP_BULK_OUT].token >> 16));
 }
 
-int usb_device_ep1_out_reading_finish(u32 *pending_bytes)
+int usb_device_ep1_out_reading_finish(u32 *pending_bytes, u32 sync_timeout)
 {
 	usb_ep_status_t ep_status;
 	do
@@ -1504,7 +1504,7 @@ static int _usbd_get_ep1_in_bytes_written()
 		return (usbdaemon->ep_bytes_requested[USB_EP_BULK_IN] - (usbdaemon->qhs[USB_EP_BULK_IN].token >> 16));
 }
 
-int usb_device_ep1_in_writing_finish(u32 *pending_bytes)
+int usb_device_ep1_in_writing_finish(u32 *pending_bytes, u32 sync_timeout)
 {
 	usb_ep_status_t ep_status;
 	do

bdk/usb/usbd.h

@@ -1,7 +1,7 @@
 /*
  * Enhanced & eXtensible USB Device (EDCI & XDCI) driver for Tegra X1
  *
- * Copyright (c) 2019 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -148,6 +148,7 @@ typedef enum _usb_error_t
 	XUSB_ERROR_INVALID_EP           = USB_ERROR_XFER_ERROR,        // From 2.
 	XUSB_ERROR_XFER_BULK_IN_RESIDUE = 7,
 	XUSB_ERROR_INVALID_CYCLE        = USB2_ERROR_XFER_EP_DISABLED, // From 8.
+	XUSB_ERROR_BABBLE_DETECTED      = 50,
 	XUSB_ERROR_SEQ_NUM              = 51,
 	XUSB_ERROR_XFER_DIR             = 52,
 	XUSB_ERROR_PORT_CFG             = 54
@@ -175,9 +176,9 @@ typedef struct _usb_ops_t
 
 	int  (*usb_device_ep1_out_read)(u8 *, u32, u32 *, u32);
 	int  (*usb_device_ep1_out_read_big)(u8 *, u32, u32 *);
-	int  (*usb_device_ep1_out_reading_finish)(u32 *);
+	int  (*usb_device_ep1_out_reading_finish)(u32 *, u32);
 	int  (*usb_device_ep1_in_write)(u8 *, u32, u32 *, u32);
-	int  (*usb_device_ep1_in_writing_finish)(u32 *);
+	int  (*usb_device_ep1_in_writing_finish)(u32 *, u32);
 	bool (*usb_device_get_suspended)();
 	bool (*usb_device_get_port_in_sleep)();
 } usb_ops_t;

bdk/usb/xusbd.c

@@ -1,7 +1,7 @@
 /*
  * eXtensible USB Device driver (XDCI) for Tegra X1
  *
- * Copyright (c) 2020 CTCaer
+ * Copyright (c) 2020-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -368,7 +368,7 @@ typedef struct _xusbd_controller_t
 	event_trb_t *event_dequeue_ptr;
 	u32 event_ccs;
 	u32 device_state;
-	u32 bytes_remaining[2];
+	u32 tx_bytes[2];
 	u32 tx_count[2];
 	u32 ctrl_seq_num;
 	u32 config_num;
@@ -881,7 +881,7 @@ int xusb_device_init()
 	_xusbd_init_device_clocks();
 
 	// Enable AHB redirect for access to IRAM for Event/EP ring buffers.
-	mc_enable_ahb_redirect(); // Can be skipped if IRAM is not used.
+	mc_enable_ahb_redirect(false); // Can be skipped if IRAM is not used.
 
 	 // Enable XUSB device IPFS.
 	XUSB_DEV_DEV(XUSB_DEV_CONFIGURATION) |= DEV_CONFIGURATION_EN_FPCI;
@@ -927,7 +927,7 @@ int xusb_device_init()
 	return USB_RES_OK;
 }
 
-static int _xusb_queue_trb(int ep_idx, void *trb, bool ring_doorbell)
+static int _xusb_queue_trb(u32 ep_idx, void *trb, bool ring_doorbell)
 {
 	int res = USB_RES_OK;
 	data_trb_t *next_trb;
@@ -1073,7 +1073,7 @@ static int _xusb_issue_normal_trb(u8 *buf, u32 len, usb_dir_t direction)
 	normal_trb_t trb = {0};
 
 	_xusb_create_normal_trb(&trb, buf, len, direction);
-	int ep_idx = USB_EP_BULK_IN;
+	u32 ep_idx = USB_EP_BULK_IN;
 	if (direction == USB_DIR_OUT)
 		ep_idx = USB_EP_BULK_OUT;
 	int res = _xusb_queue_trb(ep_idx, &trb, EP_RING_DOORBELL);
@@ -1100,19 +1100,32 @@ static int _xusb_issue_data_trb(u8 *buf, u32 len, usb_dir_t direction)
 
 int xusb_set_ep_stall(u32 endpoint, int ep_stall)
 {
-	int ep_idx = BIT(endpoint);
+	u32 ep_mask = BIT(endpoint);
 	if (ep_stall)
-		XUSB_DEV_XHCI(XUSB_DEV_XHCI_EP_HALT) |= ep_idx;
+		XUSB_DEV_XHCI(XUSB_DEV_XHCI_EP_HALT) |= ep_mask;
 	else
-		XUSB_DEV_XHCI(XUSB_DEV_XHCI_EP_HALT) &= ~ep_idx;
+		XUSB_DEV_XHCI(XUSB_DEV_XHCI_EP_HALT) &= ~ep_mask;
 
 	// Wait for EP status to change.
-	int res = _xusb_xhci_mask_wait(XUSB_DEV_XHCI_EP_STCHG, ep_idx, ep_idx, 1000);
+	int res = _xusb_xhci_mask_wait(XUSB_DEV_XHCI_EP_STCHG, ep_mask, ep_mask, 1000);
 	if (res)
 		return res;
 
 	// Clear status change.
-	XUSB_DEV_XHCI(XUSB_DEV_XHCI_EP_STCHG) = ep_idx;
+	XUSB_DEV_XHCI(XUSB_DEV_XHCI_EP_STCHG) = ep_mask;
+
+	return USB_RES_OK;
+}
+
+static int _xusb_wait_ep_stopped(u32 endpoint)
+{
+	u32 ep_mask = BIT(endpoint);
+
+	// Wait for EP status to change.
+	_xusb_xhci_mask_wait(XUSB_DEV_XHCI_EP_STOPPED, ep_mask, ep_mask, 1000);
+
+	// Clear status change.
+	XUSB_DEV_XHCI(XUSB_DEV_XHCI_EP_STOPPED) = ep_mask;
 
 	return USB_RES_OK;
 }
@@ -1158,20 +1171,27 @@ static int _xusb_handle_transfer_event(transfer_event_trb_t *trb)
 				return _xusb_issue_status_trb(USB_DIR_OUT);
 			else if (usbd_xotg->wait_for_event_trb == XUSB_TRB_STATUS)
 			{
-				if (usbd_xotg->device_state == XUSB_ADDRESSED_STS_WAIT)
+				switch (usbd_xotg->device_state)
+				{
+				case XUSB_ADDRESSED_STS_WAIT:
 					usbd_xotg->device_state = XUSB_ADDRESSED;
-				else if (usbd_xotg->device_state == XUSB_CONFIGURED_STS_WAIT)
+					break;
+				case XUSB_CONFIGURED_STS_WAIT:
 					usbd_xotg->device_state = XUSB_CONFIGURED;
-				else if (usbd_xotg->device_state == XUSB_LUN_CONFIGURED_STS_WAIT)
+					break;
+				case XUSB_LUN_CONFIGURED_STS_WAIT:
 					usbd_xotg->device_state = XUSB_LUN_CONFIGURED;
-				else if (usbd_xotg->device_state == XUSB_HID_CONFIGURED_STS_WAIT)
+					break;
+				case XUSB_HID_CONFIGURED_STS_WAIT:
 					usbd_xotg->device_state = XUSB_HID_CONFIGURED;
+					break;
+				}
 			}
 			break;
 
 		case USB_EP_BULK_IN:
-			usbd_xotg->bytes_remaining[USB_DIR_IN] -= trb->trb_tx_len;
-			if (usbd_xotg->tx_count[USB_DIR_IN])///////////
+			usbd_xotg->tx_bytes[USB_DIR_IN] -= trb->trb_tx_len;
+			if (usbd_xotg->tx_count[USB_DIR_IN])
 				usbd_xotg->tx_count[USB_DIR_IN]--;
 
 			// If bytes remaining for a Bulk IN transfer, return error.
@@ -1181,8 +1201,8 @@ static int _xusb_handle_transfer_event(transfer_event_trb_t *trb)
 
 		case USB_EP_BULK_OUT:
 			// If short packet and Bulk OUT, it's not an error because we prime EP for 4KB.
-			usbd_xotg->bytes_remaining[USB_DIR_OUT] -= trb->trb_tx_len;
-			if (usbd_xotg->tx_count[USB_DIR_OUT])///////////
+			usbd_xotg->tx_bytes[USB_DIR_OUT] -= trb->trb_tx_len;
+			if (usbd_xotg->tx_count[USB_DIR_OUT])
 				usbd_xotg->tx_count[USB_DIR_OUT]--;
 			break;
 		}
@@ -1196,6 +1216,11 @@ static int _xusb_handle_transfer_event(transfer_event_trb_t *trb)
 		xusb_set_ep_stall(trb->ep_id, USB_EP_CFG_STALL);
 		return USB_RES_OK;
 */
+	case XUSB_COMP_BABBLE_DETECTED_ERROR:
+		_xusb_wait_ep_stopped(trb->ep_id);
+		xusb_set_ep_stall(trb->ep_id, USB_EP_CFG_STALL);
+		return XUSB_ERROR_BABBLE_DETECTED;
+
 	case XUSB_COMP_CTRL_DIR_ERROR:
 		return XUSB_ERROR_XFER_DIR;
 
@@ -1216,11 +1241,52 @@ static int _xusb_handle_transfer_event(transfer_event_trb_t *trb)
 
 static int _xusb_handle_port_change()
 {
-	u32 res = USB_RES_OK;
 	u32 status = XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC);
 	u32 halt = XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTHALT);
+	u32 clear_mask = XHCI_PORTSC_CEC | XHCI_PORTSC_PLC | XHCI_PORTSC_PRC | XHCI_PORTSC_WRC | XHCI_PORTSC_CSC;
 
-	// Connect status change (CSC).
+	// Port reset (PR).
+	if (status & XHCI_PORTSC_PR)
+	{
+		//! TODO:
+		// XHCI_PORTSC_PR: device_state = XUSB_RESET
+
+		//_disable_usb_wdt4();
+	}
+
+	// Port Reset Change (PRC).
+	if (status & XHCI_PORTSC_PRC)
+	{
+		// Clear PRC bit.
+		status &= ~clear_mask;
+		status |= XHCI_PORTSC_PRC;
+		XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC) = status;
+	}
+
+	// Warm Port Reset (WPR).
+	if (status & XHCI_PORTSC_WPR)
+	{
+		//_disable_usb_wdt4();
+
+		XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTHALT) &= ~XHCI_PORTHALT_HALT_LTSSM;
+		(void)XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTHALT);
+
+		//! TODO: XHCI_PORTSC_WPR: device_state = XUSB_RESET
+	}
+
+	// Warm Port Reset Change (WRC).
+	if (status & XHCI_PORTSC_WRC)
+	{
+		// Clear WRC bit.
+		status &= ~clear_mask;
+		status |= XHCI_PORTSC_WRC;
+		XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC) = status;
+	}
+
+	// Reread port status to handle more changes.
+	status = XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC);
+
+	// Connect Status Change (CSC).
 	if (status & XHCI_PORTSC_CSC)
 	{
 		//! TODO: Check CCS.
@@ -1238,90 +1304,64 @@ static int _xusb_handle_port_change()
 			volatile xusb_ep_ctx_t *ep_ctxt = &xusb_evtq->xusb_ep_ctxt[XUSB_EP_CTRL_IN];
 			ep_ctxt->avg_trb_len = 8;
 			ep_ctxt->max_packet_size = 64;
+			//! TODO: If super speed is supported, ep context reload, unpause and unhalt must happen.
 		}
 
 		// Clear CSC bit.
+		status &= ~clear_mask;
 		status |= XHCI_PORTSC_CSC;
 		XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC) = status;
 	}
 
-	// Port reset (PR), Port reset change (PRC).
-	if (status & XHCI_PORTSC_PR || status & XHCI_PORTSC_PRC)
-	{
-		//! TODO:
-		// XHCI_PORTSC_PR: device_state = XUSB_RESET
-
-		//_disable_usb_wdt4();
-
-		//res = _xusb_xhci_mask_wait(XUSB_DEV_XHCI_PORTSC, XHCI_PORTSC_PRC, XHCI_PORTSC_PRC, 50000); // unpatched0
-		//	if (res) return res;
-		_xusb_xhci_mask_wait(XUSB_DEV_XHCI_PORTSC, XHCI_PORTSC_PRC, XHCI_PORTSC_PRC, 50000); // patched0
-
-		// Clear PRC bit.
-		status = XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC) | XHCI_PORTSC_PRC;
-		XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC) |= XHCI_PORTSC_PRC;
-	}
-
-	// Warm Port Reset (WPR), Warm Port Reset Change (WRC).
-	if (status & XHCI_PORTSC_WPR || status & XHCI_PORTSC_WRC)
-	{
-		XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTHALT) &= ~XHCI_PORTHALT_HALT_LTSSM;
-		(void)XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC);
-		res = _xusb_xhci_mask_wait(XUSB_DEV_XHCI_PORTSC, XHCI_PORTSC_WRC, XHCI_PORTSC_WRC, 1000);
-
-		// Clear WRC bit.
-		status = XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC) | XHCI_PORTSC_WRC;
-		XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC) |= XHCI_PORTSC_WRC;
-
-		//! TODO: WPR: device_state = XUSB_RESET
-	}
-
 	// Handle Config Request (STCHG_REQ).
 	if (halt & XHCI_PORTHALT_STCHG_REQ)
 	{
-		// Clear Link Training Status.
-		status = XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTHALT) & ~XHCI_PORTHALT_HALT_LTSSM;
+		// Clear Link Training Status and pending request/reject.
 		XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTHALT) &= ~XHCI_PORTHALT_HALT_LTSSM;
+		(void)XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTHALT);
 	}
 
+	// Reread port status to handle more changes.
+	status = XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC);
+
 	// Port link state change (PLC).
 	if (status & XHCI_PORTSC_PLC)
 	{
-		//! WAR: Sometimes port speed changes without a CSC event. Set again.
-		usbd_xotg->port_speed = (status & XHCI_PORTSC_PS) >> 10;
-
-		// check PLS
-		// if U3
+		// check XHCI_PORTSC_PLS_MASK
+		// if XHCI_PORTSC_PLS_U3
 		//  device_state = XUSB_SUSPENDED
-		// else if U0 and XUSB_SUSPENDED
+		// else if XHCI_PORTSC_PLS_U0 and XUSB_SUSPENDED
 		//  val = XUSB_DEV_XHCI_EP_PAUSE
 		//  XUSB_DEV_XHCI_EP_PAUSE = 0
 		//  XUSB_DEV_XHCI_EP_STCHG = val;
 
 		// Clear PLC bit.
-		status = XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC) | XHCI_PORTSC_PLC;
-		XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC) |= XHCI_PORTSC_PLC;
+		status &= ~clear_mask;
+		status |= XHCI_PORTSC_PLC;
+		XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC) = status;
 	}
 
 	// Port configuration link error (CEC).
 	if (status & XHCI_PORTSC_CEC)
 	{
-		XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC) |= XHCI_PORTSC_CEC;
-		res = XUSB_ERROR_PORT_CFG;
+		status = XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC);
+		status &= ~clear_mask;
+		status |= XHCI_PORTSC_CEC;
+		XUSB_DEV_XHCI(XUSB_DEV_XHCI_PORTSC) = status;
+
+		return XUSB_ERROR_PORT_CFG;
 	}
 
-	return res;
+	return USB_RES_OK;
 }
 
-static int _xusb_handle_get_ep_status(usb_ctrl_setup_t *ctrl_setup)
+static int _xusb_handle_get_ep_status(u32 ep_idx)
 {
+	u32 ep_mask = BIT(ep_idx);
 	static u8 xusb_ep_status_descriptor[2] = {0};
 
-	// Get EP context pointer.
-	volatile xusb_ep_ctx_t *ep_ctxt = (volatile xusb_ep_ctx_t *)(XUSB_DEV_XHCI(XUSB_DEV_XHCI_ECPLO) & 0xFFFFFFF0);
-	ep_ctxt = &ep_ctxt[ctrl_setup->wIndex];
-
-	xusb_ep_status_descriptor[0] = (ep_ctxt->ep_state == EP_HALTED) ? USB_STATUS_EP_HALTED : USB_STATUS_EP_OK;
+	xusb_ep_status_descriptor[0] =
+		(XUSB_DEV_XHCI(XUSB_DEV_XHCI_EP_HALT) & ep_mask) ? USB_STATUS_EP_HALTED : USB_STATUS_EP_OK;
 	return _xusb_issue_data_trb(xusb_ep_status_descriptor, 2, USB_DIR_IN);
 }
 
@@ -1536,8 +1576,9 @@ static int _xusbd_handle_ep0_control_transfer(usb_ctrl_setup_t *ctrl_setup)
 
 	//gfx_printf("ctrl: %02X %02X %04X %04X %04X\n", _bmRequestType, _bRequest, _wValue, _wIndex, _wLength);
 
-	XUSB_DEV_XHCI(XUSB_DEV_XHCI_EP_HALT) &= ~XHCI_EP_HALT_DCI;
-	u32 res = _xusb_xhci_mask_wait(XUSB_DEV_XHCI_EP_HALT, XHCI_EP_HALT_DCI, 0, 1000);
+	// Unhalt EP0 IN.
+	XUSB_DEV_XHCI(XUSB_DEV_XHCI_EP_HALT) &= ~XHCI_EP_HALT_DCI_EP0_IN;
+	u32 res = _xusb_xhci_mask_wait(XUSB_DEV_XHCI_EP_HALT, XHCI_EP_HALT_DCI_EP0_IN, 0, 1000);
 	if (res)
 		return res;
 
@@ -1557,14 +1598,33 @@ static int _xusbd_handle_ep0_control_transfer(usb_ctrl_setup_t *ctrl_setup)
 	case (USB_SETUP_HOST_TO_DEVICE | USB_SETUP_TYPE_STANDARD | USB_SETUP_RECIPIENT_ENDPOINT):
 		if ((_wValue & 0xFF) == USB_FEATURE_ENDPOINT_HALT)
 		{
-			if (_bRequest == USB_REQUEST_CLEAR_FEATURE)
+			if (_bRequest == USB_REQUEST_CLEAR_FEATURE || _bRequest == USB_REQUEST_SET_FEATURE)
 			{
-				xusb_set_ep_stall(_wIndex, USB_EP_CFG_CLEAR);
-				return _xusb_issue_status_trb(USB_DIR_IN);
-			}
-			else if (_bRequest == USB_REQUEST_SET_FEATURE)
-			{
-				xusb_set_ep_stall(_wIndex, USB_EP_CFG_STALL);
+				u32 ep = 0;
+				switch (_wIndex) // endpoint
+				{
+				case USB_EP_ADDR_CTRL_OUT:
+					ep = XUSB_EP_CTRL_OUT;
+					break;
+				case USB_EP_ADDR_CTRL_IN:
+					ep = XUSB_EP_CTRL_IN;
+					break;
+				case USB_EP_ADDR_BULK_OUT:
+					ep = USB_EP_BULK_OUT;
+					break;
+				case USB_EP_ADDR_BULK_IN:
+					ep = USB_EP_BULK_IN;
+					break;
+				default:
+					xusb_set_ep_stall(XUSB_EP_CTRL_IN, USB_EP_CFG_STALL);
+					return USB_RES_OK;
+				}
+
+				if (_bRequest == USB_REQUEST_CLEAR_FEATURE)
+					xusb_set_ep_stall(ep, USB_EP_CFG_CLEAR);
+				else if (_bRequest == USB_REQUEST_SET_FEATURE)
+					xusb_set_ep_stall(ep, USB_EP_CFG_STALL);
+
 				return _xusb_issue_status_trb(USB_DIR_IN);
 			}
 		}
@@ -1631,7 +1691,28 @@ static int _xusbd_handle_ep0_control_transfer(usb_ctrl_setup_t *ctrl_setup)
 
 	case (USB_SETUP_DEVICE_TO_HOST | USB_SETUP_TYPE_STANDARD | USB_SETUP_RECIPIENT_ENDPOINT):
 		if (_bRequest == USB_REQUEST_GET_STATUS)
-			return _xusb_handle_get_ep_status(ctrl_setup);
+		{
+			u32 ep = 0;
+			switch (_wIndex) // endpoint
+			{
+			case USB_EP_ADDR_CTRL_OUT:
+				ep = XUSB_EP_CTRL_OUT;
+				break;
+			case USB_EP_ADDR_CTRL_IN:
+				ep = XUSB_EP_CTRL_IN;
+				break;
+			case USB_EP_ADDR_BULK_OUT:
+				ep = USB_EP_BULK_OUT;
+				break;
+			case USB_EP_ADDR_BULK_IN:
+				ep = USB_EP_BULK_IN;
+				break;
+			default:
+				xusb_set_ep_stall(XUSB_EP_CTRL_IN, USB_EP_CFG_STALL);
+				return USB_RES_OK;
+			}
+			return _xusb_handle_get_ep_status(ep);
+		}
 
 		ep_stall = true;
 		break;
@@ -1821,6 +1902,7 @@ int xusb_device_enumerate(usb_gadget_type gadget)
 	return USB_RES_OK;
 }
 
+//! TODO: Do a full deinit.
 void xusb_end(bool reset_ep, bool only_controller)
 {
 	CLOCK(CLK_RST_CONTROLLER_RST_DEV_W_SET) = BIT(CLK_W_XUSB_SS);
@@ -1855,7 +1937,7 @@ int xusb_device_ep1_out_read(u8 *buf, u32 len, u32 *bytes_read, u32 sync_tries)
 
 	int res = USB_RES_OK;
 	usbd_xotg->tx_count[USB_DIR_OUT] = 0;
-	usbd_xotg->bytes_remaining[USB_DIR_OUT] = len;
+	usbd_xotg->tx_bytes[USB_DIR_OUT] = len;
 	_xusb_issue_normal_trb(buf, len, USB_DIR_OUT);
 	usbd_xotg->tx_count[USB_DIR_OUT]++;
 
@@ -1865,7 +1947,7 @@ int xusb_device_ep1_out_read(u8 *buf, u32 len, u32 *bytes_read, u32 sync_tries)
 			res = _xusb_ep_operation(sync_tries);
 
 		if (bytes_read)
-			*bytes_read = res ? 0 : usbd_xotg->bytes_remaining[USB_DIR_OUT];
+			*bytes_read = res ? 0 : usbd_xotg->tx_bytes[USB_DIR_OUT];
 
 		bpmp_mmu_maintenance(BPMP_MMU_MAINT_CLN_INV_WAY, false);
 	}
@@ -1898,14 +1980,14 @@ int xusb_device_ep1_out_read_big(u8 *buf, u32 len, u32 *bytes_read)
 	return USB_RES_OK;
 }
 
-int xusb_device_ep1_out_reading_finish(u32 *pending_bytes)
+int xusb_device_ep1_out_reading_finish(u32 *pending_bytes, u32 sync_tries)
 {
 	int res = USB_RES_OK;
 	while (!res && usbd_xotg->tx_count[USB_DIR_OUT])
-		res = _xusb_ep_operation(USB_XFER_SYNCED); // Infinite retries.
+		res = _xusb_ep_operation(sync_tries); // Infinite retries.
 
 	if (pending_bytes)
-		*pending_bytes = res ? 0 : usbd_xotg->bytes_remaining[USB_DIR_OUT];
+		*pending_bytes = res ? 0 : usbd_xotg->tx_bytes[USB_DIR_OUT];
 
 	bpmp_mmu_maintenance(BPMP_MMU_MAINT_CLN_INV_WAY, false);
 
@@ -1921,7 +2003,7 @@ int xusb_device_ep1_in_write(u8 *buf, u32 len, u32 *bytes_written, u32 sync_trie
 
 	int res = USB_RES_OK;
 	usbd_xotg->tx_count[USB_DIR_IN] = 0;
-	usbd_xotg->bytes_remaining[USB_DIR_IN] = len;
+	usbd_xotg->tx_bytes[USB_DIR_IN] = len;
 	_xusb_issue_normal_trb(buf, len, USB_DIR_IN);
 	usbd_xotg->tx_count[USB_DIR_IN]++;
 
@@ -1931,7 +2013,7 @@ int xusb_device_ep1_in_write(u8 *buf, u32 len, u32 *bytes_written, u32 sync_trie
 			res = _xusb_ep_operation(sync_tries);
 
 		if (bytes_written)
-			*bytes_written = res ? 0 : usbd_xotg->bytes_remaining[USB_DIR_IN];
+			*bytes_written = res ? 0 : usbd_xotg->tx_bytes[USB_DIR_IN];
 	}
 	else
 	{
@@ -1947,14 +2029,14 @@ int xusb_device_ep1_in_write(u8 *buf, u32 len, u32 *bytes_written, u32 sync_trie
 	return res;
 }
 
-int xusb_device_ep1_in_writing_finish(u32 *pending_bytes)
+int xusb_device_ep1_in_writing_finish(u32 *pending_bytes, u32 sync_tries)
 {
 	int res = USB_RES_OK;
 	while (!res && usbd_xotg->tx_count[USB_DIR_IN])
-		res = _xusb_ep_operation(USB_XFER_SYNCED); // Infinite retries.
+		res = _xusb_ep_operation(sync_tries); // Infinite retries.
 
 	if (pending_bytes)
-		*pending_bytes = res ? 0 : usbd_xotg->bytes_remaining[USB_DIR_IN];
+		*pending_bytes = res ? 0 : usbd_xotg->tx_bytes[USB_DIR_IN];
 
 	return res;
 }
@@ -2010,7 +2092,7 @@ void xusb_device_get_ops(usb_ops_t *ops)
 	ops->usbd_flush_endpoint               = NULL;
 	ops->usbd_set_ep_stall                 = xusb_set_ep_stall;
 	ops->usbd_handle_ep0_ctrl_setup        = xusb_handle_ep0_ctrl_setup;
-	ops->usbd_end                          = xusb_end;//////////////////
+	ops->usbd_end                          = xusb_end;
 	ops->usb_device_init                   = xusb_device_init;
 	ops->usb_device_enumerate              = xusb_device_enumerate;
 	ops->usb_device_class_send_max_lun     = xusb_device_class_send_max_lun;

bdk/utils/dirlist.c

@@ -21,16 +21,16 @@
 #include <mem/heap.h>
 #include <utils/types.h>
 
+#define MAX_ENTRIES 64
+
 char *dirlist(const char *directory, const char *pattern, bool includeHiddenFiles, bool parse_dirs)
 {
-	u8 max_entries = 61;
-
 	int res = 0;
 	u32 i = 0, j = 0, k = 0;
 	DIR dir;
 	FILINFO fno;
 
-	char *dir_entries = (char *)calloc(max_entries, 256);
+	char *dir_entries = (char *)calloc(MAX_ENTRIES, 256);
 	char *temp = (char *)calloc(1, 256);
 
 	if (!pattern && !f_opendir(&dir, directory))
@@ -49,7 +49,7 @@ char *dirlist(const char *directory, const char *pattern, bool includeHiddenFile
 				{
 					strcpy(dir_entries + (k * 256), fno.fname);
 					k++;
-					if (k > (max_entries - 1))
+					if (k > (MAX_ENTRIES - 1))
 						break;
 				}
 			}
@@ -64,7 +64,7 @@ char *dirlist(const char *directory, const char *pattern, bool includeHiddenFile
 			{
 				strcpy(dir_entries + (k * 256), fno.fname);
 				k++;
-				if (k > (max_entries - 1))
+				if (k > (MAX_ENTRIES - 1))
 					break;
 			}
 			res = f_findnext(&dir, &fno);

bdk/utils/ini.c

@@ -66,14 +66,14 @@ ini_sec_t *_ini_create_section(link_t *dst, ini_sec_t *csec, char *name, u8 type
 
 int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 {
+	FIL fp;
 	u32 lblen;
 	u32 pathlen = strlen(ini_path);
 	u32 k = 0;
-	char lbuf[512];
-	char *filelist = NULL;
-	FIL fp;
 	ini_sec_t *csec = NULL;
 
+	char *lbuf = NULL;
+	char *filelist = NULL;
 	char *filename = (char *)malloc(256);
 
 	strcpy(filename, ini_path);
@@ -114,6 +114,8 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 			return 0;
 		}
 
+		lbuf = malloc(512);
+
 		do
 		{
 			// Fetch one line.
@@ -168,6 +170,7 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 		}
 	} while (is_dir);
 
+	free(lbuf);
 	free(filename);
 	free(filelist);
 

bdk/utils/types.h

@@ -18,26 +18,18 @@
 #ifndef _TYPES_H_
 #define _TYPES_H_
 
-#define NULL ((void *)0)
-
-#define ALIGN(x, a) (((x) + (a) - 1) & ~((a) - 1))
-#define ALIGN_DOWN(x, a) (((x) - ((a) - 1)) & ~((a) - 1))
-#define BIT(n) (1U << (n))
-#define MAX(a, b) ((a) > (b) ? (a) : (b))
-#define MIN(a, b) ((a) < (b) ? (a) : (b))
-
-#define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x)))
-
-#define OFFSET_OF(t, m) ((u32)&((t *)NULL)->m)
-#define CONTAINER_OF(mp, t, mn) ((t *)((u32)mp - OFFSET_OF(t, mn)))
+#include <assert.h>
 
+/* Types */
 typedef signed char s8;
 typedef short s16;
 typedef short SHORT;
 typedef int s32;
 typedef int INT;
+typedef int bool;
 typedef long LONG;
 typedef long long int s64;
+
 typedef unsigned char u8;
 typedef unsigned char BYTE;
 typedef unsigned short u16;
@@ -48,6 +40,7 @@ typedef unsigned int UINT;
 typedef unsigned long DWORD;
 typedef unsigned long long QWORD;
 typedef unsigned long long int u64;
+
 typedef volatile unsigned char vu8;
 typedef volatile unsigned short vu16;
 typedef volatile unsigned int vu32;
@@ -58,18 +51,63 @@ typedef u64 uptr;
 typedef u32 uptr;
 #endif
 
-typedef int bool;
-#define true  1
+/* Important */
 #define false 0
+#define true  1
 
+#define NULL ((void *)0)
+
+/* Misc */
 #define DISABLE 0
 #define ENABLE  1
 
+/* Sizes */
+#define SZ_1K   0x400
+#define SZ_2K   0x800
+#define SZ_4K   0x1000
+#define SZ_8K   0x2000
+#define SZ_16K  0x4000
+#define SZ_32K  0x8000
+#define SZ_64K  0x10000
+#define SZ_128K 0x20000
+#define SZ_256K 0x40000
+#define SZ_512K 0x80000
+#define SZ_1M   0x100000
+#define SZ_2M   0x200000
+#define SZ_4M   0x400000
+#define SZ_8M   0x800000
+#define SZ_16M  0x1000000
+#define SZ_32M  0x2000000
+#define SZ_64M  0x4000000
+#define SZ_128M 0x8000000
+#define SZ_256M 0x10000000
+#define SZ_512M 0x20000000
+#define SZ_1G   0x40000000
+#define SZ_2G   0x80000000
+#define SZ_PAGE SZ_4K
+
+/* Macros */
+#define ALIGN(x, a) (((x) + (a) - 1) & ~((a) - 1))
+#define ALIGN_DOWN(x, a) ((x) & ~((a) - 1))
+#define BIT(n) (1U << (n))
+#define MAX(a, b) ((a) > (b) ? (a) : (b))
+#define MIN(a, b) ((a) < (b) ? (a) : (b))
+
+#define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x)))
+
+#define OFFSET_OF(t, m) ((uptr)&((t *)NULL)->m)
+#define CONTAINER_OF(mp, t, mn) ((t *)((uptr)mp - OFFSET_OF(t, mn)))
+
+#define byte_swap_16(num) ((((num) >> 8) & 0xff) | (((num) << 8) & 0xff00))
+#define byte_swap_32(num) ((((num) >> 24) & 0xff) | (((num) << 8) & 0xff0000) | \
+						(((num) >> 8 )& 0xff00) | (((num) << 24) & 0xff000000))
+
+
+/* Bootloader/Nyx */
 #define BOOT_CFG_AUTOBOOT_EN BIT(0)
 #define BOOT_CFG_FROM_LAUNCH BIT(1)
 #define BOOT_CFG_FROM_ID     BIT(2)
 #define BOOT_CFG_TO_EMUMMC   BIT(3)
-#define BOOT_CFG_SEPT_RUN    BIT(7)
 
 #define EXTRA_CFG_KEYS    BIT(0)
 #define EXTRA_CFG_PAYLOAD BIT(1)
@@ -77,7 +115,6 @@ typedef int bool;
 
 #define EXTRA_CFG_NYX_UMS    BIT(5)
 #define EXTRA_CFG_NYX_RELOAD BIT(6)
-#define EXTRA_CFG_NYX_SEPT   BIT(7)
 
 typedef enum _nyx_ums_type
 {
@@ -90,13 +127,6 @@ typedef enum _nyx_ums_type
 	NYX_UMS_EMUMMC_GPP
 } nyx_ums_type;
 
-typedef enum _nyx_sept_type
-{
-	NYX_SEPT_DUMP = 0,
-	NYX_SEPT_CAL0,
-	NYX_SEPT_EMUF
-} nyx_sept_type;
-
 typedef struct __attribute__((__packed__)) _boot_cfg_t
 {
 	u8 boot_cfg;
@@ -110,12 +140,13 @@ typedef struct __attribute__((__packed__)) _boot_cfg_t
 			char id[8]; // 7 char ASCII null teminated.
 			char emummc_path[0x78]; // emuMMC/XXX, ASCII null teminated.
 		};
-		u8 ums;  // nyx_ums_type.
-		u8 sept; // nyx_sept_type.
+		u8 ums; // nyx_ums_type.
 		u8 xt_str[0x80];
 	};
 } boot_cfg_t;
 
+static_assert(sizeof(boot_cfg_t) == 0x84, "Boot cfg storage size is wrong!");
+
 typedef struct __attribute__((__packed__)) _ipl_ver_meta_t
 {
 	u32 magic;

bdk/utils/util.c

@@ -30,6 +30,27 @@
 
 extern volatile nyx_storage_t *nyx_str;
 
+u8 bit_count(u32 val)
+{
+	u8 cnt = 0;
+	for (u32 i = 0; i < 32; i++)
+	{
+		if ((val >> i) & 1)
+			cnt++;
+	}
+
+	return cnt;
+}
+
+u32 bit_count_mask(u8 bits)
+{
+	u32 val = 0;
+	for (u32 i = 0; i < bits; i++)
+		val |= 1 << i;
+
+	return val;
+}
+
 u32 get_tmr_s()
 {
 	return RTC(APBDEV_RTC_SECONDS);

bdk/utils/util.h

@@ -36,7 +36,6 @@ typedef enum
 typedef enum
 {
 	NYX_CFG_UMS  = BIT(6),
-	NYX_CFG_SEPT = BIT(7),
 
 	NYX_CFG_EXTRA = 0xFF << 24
 } nyx_cfg_t;
@@ -47,15 +46,11 @@ typedef enum
 	ERR_SYSOLD_NYX = BIT(1),
 	ERR_LIBSYS_MTC = BIT(2),
 	ERR_SD_BOOT_EN = BIT(3),
+	ERR_PANIC_CODE = BIT(4),
 	ERR_L4T_KERNEL = BIT(24),
 	ERR_EXCEPTION  = BIT(31),
 } hekate_errors_t;
 
-#define byte_swap_32(num) ((((num) >> 24) & 0xff) | (((num) << 8) & 0xff0000) | \
-						(((num) >> 8 )& 0xff00) | (((num) << 24) & 0xff000000))
-
-#define byte_swap_16(num) ((((num) >> 8) & 0xff) | (((num) << 8) & 0xff00))
-
 typedef struct _cfg_op_t
 {
 	u32 off;
@@ -78,12 +73,15 @@ typedef struct _nyx_storage_t
 	u32 cfg;
 	u8  irama[0x8000];
 	u8  hekate[0x30000];
-	u8  rsvd[0x800000 - sizeof(nyx_info_t)];
+	u8  rsvd[SZ_8M - sizeof(nyx_info_t)];
 	nyx_info_t info;
 	mtc_config_t mtc_cfg;
 	emc_table_t mtc_table[10];
 } nyx_storage_t;
 
+u8   bit_count(u32 val);
+u32  bit_count_mask(u8 bits);
+
 void exec_cfg(u32 *base, const cfg_op_t *ops, u32 num_ops);
 u32  crc32_calc(u32 crc, const u8 *buf, u32 len);
 

bootloader/config.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2020 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -38,7 +38,6 @@ void set_default_configuration()
 	h_cfg.autoboot = 0;
 	h_cfg.autoboot_list = 0;
 	h_cfg.bootwait = 3;
-	h_cfg.se_keygen_done = 0;
 	h_cfg.backlight = 100;
 	h_cfg.autohosoff = 0;
 	h_cfg.autonogc = 1;
@@ -46,8 +45,6 @@ void set_default_configuration()
 	h_cfg.bootprotect = 0;
 	h_cfg.errors = 0;
 	h_cfg.eks = NULL;
-	h_cfg.sept_run = EMC(EMC_SCRATCH0) & EMC_SEPT_RUN;
-	h_cfg.aes_slots_new = false;
 	h_cfg.rcm_patched = fuse_check_patched_rcm();
 	h_cfg.emummc_force_disable = false;
 	h_cfg.t210b01 = hw_get_chip_id() == GP_HIDREV_MAJOR_T210B01;
@@ -58,7 +55,7 @@ int create_config_entry()
 	if (!sd_mount())
 		return 1;
 
-	char lbuf[32];
+	char lbuf[64];
 	FIL fp;
 	bool mainIniFound = false;
 
@@ -86,28 +83,36 @@ int create_config_entry()
 
 	if (f_open(&fp, "bootloader/hekate_ipl.ini", FA_WRITE | FA_CREATE_ALWAYS) != FR_OK)
 		return 1;
+
 	// Add config entry.
 	f_puts("[config]\nautoboot=", &fp);
 	itoa(h_cfg.autoboot, lbuf, 10);
 	f_puts(lbuf, &fp);
+
 	f_puts("\nautoboot_list=", &fp);
 	itoa(h_cfg.autoboot_list, lbuf, 10);
 	f_puts(lbuf, &fp);
+
 	f_puts("\nbootwait=", &fp);
 	itoa(h_cfg.bootwait, lbuf, 10);
 	f_puts(lbuf, &fp);
+
 	f_puts("\nbacklight=", &fp);
 	itoa(h_cfg.backlight, lbuf, 10);
 	f_puts(lbuf, &fp);
+
 	f_puts("\nautohosoff=", &fp);
 	itoa(h_cfg.autohosoff, lbuf, 10);
 	f_puts(lbuf, &fp);
+
 	f_puts("\nautonogc=", &fp);
 	itoa(h_cfg.autonogc, lbuf, 10);
 	f_puts(lbuf, &fp);
+
 	f_puts("\nupdater2p=", &fp);
 	itoa(h_cfg.updater2p, lbuf, 10);
 	f_puts(lbuf, &fp);
+
 	f_puts("\nbootprotect=", &fp);
 	itoa(h_cfg.bootprotect, lbuf, 10);
 	f_puts(lbuf, &fp);
@@ -158,452 +163,3 @@ int create_config_entry()
 
 	return 0;
 }
-
-#pragma GCC push_options
-#pragma GCC optimize ("Os")
-
-static void _save_config()
-{
-	gfx_clear_grey(0x1B);
-	gfx_con_setpos(0, 0);
-
-	if (!create_config_entry())
-		gfx_puts("\nConfiguration was saved!\n");
-	else
-		EPRINTF("\nConfiguration saving failed!");
-	gfx_puts("\nPress any key...");
-}
-
-static void _config_autoboot_list(void *ent)
-{
-	gfx_clear_grey(0x1B);
-	gfx_con_setpos(0, 0);
-
-	u32 *temp_autoboot = NULL;
-
-	LIST_INIT(ini_sections);
-
-	u8 max_entries = 30;
-
-	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (max_entries + 3));
-	u32 *boot_values = (u32 *)malloc(sizeof(u32) * max_entries);
-	char *boot_text = (char *)malloc(512 * max_entries);
-
-	for (u32 j = 0; j < max_entries; j++)
-		boot_values[j] = j;
-
-	if (sd_mount())
-	{
-		if (ini_parse(&ini_sections, "bootloader/ini", true))
-		{
-			// Build configuration menu.
-			ments[0].type = MENT_BACK;
-			ments[0].caption = "Back";
-
-			ments[1].type = MENT_CHGLINE;
-
-			u32 i = 2;
-			LIST_FOREACH_ENTRY(ini_sec_t, ini_sec, &ini_sections, link)
-			{
-				// Skip other ini entries for autoboot.
-				if (ini_sec->type == INI_CHOICE)
-				{
-					if (!strcmp(ini_sec->name, "config"))
-						continue;
-
-					if (strlen(ini_sec->name) > 510)
-						ments[i].caption = ini_sec->name;
-					else
-					{
-						if (h_cfg.autoboot != (i - 1) || !h_cfg.autoboot_list)
-							boot_text[(i - 1) * 512] = ' ';
-
-						else
-							boot_text[(i - 1) * 512] = '*';
-						strcpy(boot_text + (i - 1) * 512 + 1, ini_sec->name);
-						ments[i].caption = &boot_text[(i - 1) * 512];
-					}
-					ments[i].type = ini_sec->type;
-					ments[i].data = &boot_values[i - 1];
-					i++;
-
-					if ((i - 1) > max_entries)
-						break;
-				}
-			}
-
-			memset(&ments[i], 0, sizeof(ment_t));
-			menu_t menu = {ments, "Select an entry to auto boot", 0, 0};
-			temp_autoboot = (u32 *)tui_do_menu(&menu);
-			if (temp_autoboot != NULL)
-			{
-				h_cfg.autoboot = *(u32 *)temp_autoboot;
-				h_cfg.autoboot_list = 1;
-				_save_config();
-
-				ment_t *tmp = (ment_t *)ent;
-				tmp->data = NULL;
-			}
-			else
-				goto out2;
-		}
-		else
-		{
-			EPRINTF("Could not open 'bootloader/hekate_ipl.ini'.\nMake sure it exists!.");
-			goto out;
-		}
-	}
-
-out:;
-	btn_wait();
-out2:;
-	free(ments);
-	free(boot_values);
-	free(boot_text);
-
-	sd_end();
-}
-
-void config_autoboot()
-{
-	gfx_clear_grey(0x1B);
-	gfx_con_setpos(0, 0);
-
-	u32 *temp_autoboot = NULL;
-
-	LIST_INIT(ini_sections);
-
-	u8 max_entries = 30;
-	u32 boot_text_size = 512;
-
-	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (max_entries + 5));
-	u32 *boot_values = (u32 *)malloc(sizeof(u32) * max_entries);
-	char *boot_text = (char *)malloc(boot_text_size * max_entries);
-
-	for (u32 j = 0; j < max_entries; j++)
-		boot_values[j] = j;
-
-	if (sd_mount())
-	{
-		if (ini_parse(&ini_sections, "bootloader/hekate_ipl.ini", false))
-		{
-			// Build configuration menu.
-			ments[0].type = MENT_BACK;
-			ments[0].caption = "Back";
-
-			ments[1].type = MENT_CHGLINE;
-
-			ments[2].type = MENT_DATA;
-			if (!h_cfg.autoboot)
-				ments[2].caption = "*Disable";
-			else
-				ments[2].caption = " Disable";
-			ments[2].data = &boot_values[0];
-
-			ments[3].type = MENT_HDLR_RE;
-			if (h_cfg.autoboot_list)
-				ments[3].caption = "*More configs...";
-			else
-				ments[3].caption = " More configs...";
-			ments[3].handler = _config_autoboot_list;
-			ments[3].data = (void *)0xCAFE;
-
-			ments[4].type = MENT_CHGLINE;
-
-			u32 i = 5;
-			LIST_FOREACH_ENTRY(ini_sec_t, ini_sec, &ini_sections, link)
-			{
-				// Skip other ini entries for autoboot.
-				if (ini_sec->type == INI_CHOICE)
-				{
-					if (!strcmp(ini_sec->name, "config"))
-						continue;
-
-					if (strlen(ini_sec->name) > 510)
-						ments[i].caption = ini_sec->name;
-					else
-					{
-						if (h_cfg.autoboot != (i - 4) || h_cfg.autoboot_list)
-							boot_text[(i - 4) * boot_text_size] = ' ';
-
-						else
-							boot_text[(i - 4) * boot_text_size] = '*';
-						strcpy(boot_text + (i - 4) * boot_text_size + 1, ini_sec->name);
-						ments[i].caption = &boot_text[(i - 4) * boot_text_size];
-					}
-					ments[i].type = ini_sec->type;
-					ments[i].data = &boot_values[i - 4];
-					i++;
-
-					if ((i - 4) > max_entries)
-						break;
-				}
-			}
-			if (i < 6 && !h_cfg.autoboot_list)
-			{
-				ments[i].type = MENT_CAPTION;
-				ments[i].caption = "No main configurations found...";
-				ments[i].color = 0xFFFFDD00;
-				i++;
-			}
-
-			memset(&ments[i], 0, sizeof(ment_t));
-			menu_t menu = {ments, "Disable or select entry to auto boot", 0, 0};
-			temp_autoboot = (u32 *)tui_do_menu(&menu);
-			if (temp_autoboot != NULL)
-			{
-				h_cfg.autoboot = *(u32 *)temp_autoboot;
-				h_cfg.autoboot_list = 0;
-				_save_config();
-			}
-			else
-				goto out2;
-		}
-		else
-		{
-			EPRINTF("Could not open 'bootloader/hekate_ipl.ini'.\nMake sure it exists!.");
-			goto out;
-		}
-	}
-
-out:;
-	btn_wait();
-out2:;
-	free(ments);
-	free(boot_values);
-	free(boot_text);
-
-	sd_end();
-
-	if (temp_autoboot == NULL)
-		return;
-}
-
-void config_bootdelay()
-{
-	gfx_clear_grey(0x1B);
-	gfx_con_setpos(0, 0);
-
-	u32 delay_entries = 6;
-	u32 delay_text_size = 32;
-
-	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (delay_entries + 3));
-	u32 *delay_values = (u32 *)malloc(sizeof(u32) * delay_entries);
-	char *delay_text = (char *)malloc(delay_text_size * delay_entries);
-
-	for (u32 j = 0; j < delay_entries; j++)
-		delay_values[j] = j;
-
-	ments[0].type = MENT_BACK;
-	ments[0].caption = "Back";
-
-	ments[1].type = MENT_CHGLINE;
-
-	ments[2].type = MENT_DATA;
-	if (h_cfg.bootwait)
-		ments[2].caption = " 0 seconds (Bootlogo disabled)";
-	else
-		ments[2].caption = "*0 seconds (Bootlogo disabled)";
-	ments[2].data = &delay_values[0];
-
-	u32 i = 0;
-	for (i = 1; i < delay_entries; i++)
-	{
-		if (h_cfg.bootwait != i)
-			delay_text[i * delay_text_size] = ' ';
-		else
-			delay_text[i * delay_text_size] = '*';
-		delay_text[i * delay_text_size + 1] = i + '0';
-		strcpy(delay_text + i * delay_text_size + 2, " seconds");
-
-		ments[i + 2].type = MENT_DATA;
-		ments[i + 2].caption = delay_text + (i * delay_text_size);
-		ments[i + 2].data = &delay_values[i];
-	}
-
-	memset(&ments[i + 2], 0, sizeof(ment_t));
-	menu_t menu = {ments, "Time delay for entering bootloader menu", 0, 0};
-
-	u32 *temp_bootwait = (u32 *)tui_do_menu(&menu);
-	if (temp_bootwait != NULL)
-	{
-		h_cfg.bootwait = *(u32 *)temp_bootwait;
-		_save_config();
-	}
-
-	free(ments);
-	free(delay_values);
-	free(delay_text);
-
-	if (temp_bootwait == NULL)
-		return;
-	btn_wait();
-}
-
-void config_backlight()
-{
-	gfx_clear_grey(0x1B);
-	gfx_con_setpos(0, 0);
-
-	u32 bri_text_size = 8;
-	u32 bri_entries = 11;
-
-	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (bri_entries + 3));
-	u32 *bri_values = (u32 *)malloc(sizeof(u32) * bri_entries);
-	char *bri_text = (char *)malloc(bri_text_size * bri_entries);
-
-	for (u32 j = 1; j < bri_entries; j++)
-		bri_values[j] = j * 10;
-
-	ments[0].type = MENT_BACK;
-	ments[0].caption = "Back";
-
-	ments[1].type = MENT_CHGLINE;
-
-	u32 i = 0;
-	for (i = 1; i < bri_entries; i++)
-	{
-		if ((h_cfg.backlight / 20) != i)
-			bri_text[i * bri_text_size] = ' ';
-		else
-			bri_text[i * bri_text_size] = '*';
-
-		if (i < 10)
-		{
-			bri_text[i * bri_text_size + 1] = i + '0';
-			strcpy(bri_text + i * bri_text_size + 2, "0%");
-		}
-		else
-			strcpy(bri_text + i * bri_text_size + 1, "100%");
-
-		ments[i + 1].type = MENT_DATA;
-		ments[i + 1].caption = bri_text + (i * bri_text_size);
-		ments[i + 1].data = &bri_values[i];
-	}
-
-	memset(&ments[i + 1], 0, sizeof(ment_t));
-	menu_t menu = {ments, "Backlight brightness", 0, 0};
-
-	u32 *temp_backlight = (u32 *)tui_do_menu(&menu);
-	if (temp_backlight != NULL)
-	{
-		h_cfg.backlight = (*(u32 *)temp_backlight) * 2;
-		_save_config();
-	}
-
-	free(ments);
-	free(bri_values);
-	free(bri_text);
-
-	if (temp_backlight == NULL)
-		return;
-	btn_wait();
-}
-
-void config_auto_hos_poweroff()
-{
-	gfx_clear_grey(0x1B);
-	gfx_con_setpos(0, 0);
-
-	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * 6);
-	u32 *hp_values = (u32 *)malloc(sizeof(u32) * 3);
-
-	for (u32 j = 0; j < 3; j++)
-	{
-		hp_values[j] = j;
-		ments[j + 2].type = MENT_DATA;
-		ments[j + 2].data = &hp_values[j];
-	}
-
-	ments[0].type = MENT_BACK;
-	ments[0].caption = "Back";
-
-	ments[1].type = MENT_CHGLINE;
-
-	if (h_cfg.autohosoff == 1)
-	{
-		ments[2].caption = " Disable";
-		ments[3].caption = "*Enable";
-		ments[4].caption = " Enable (No logo)";
-	}
-	else if (h_cfg.autohosoff >= 2)
-	{
-		ments[2].caption = " Disable";
-		ments[3].caption = " Enable";
-		ments[4].caption = "*Enable (No logo)";
-	}
-	else
-	{
-		ments[2].caption = "*Disable";
-		ments[3].caption = " Enable";
-		ments[4].caption = " Enable (No logo)";
-	}
-
-	memset(&ments[5], 0, sizeof(ment_t));
-	menu_t menu = {ments, "Power off if woke up from HOS", 0, 0};
-
-	u32 *temp_autohosoff = (u32 *)tui_do_menu(&menu);
-	if (temp_autohosoff != NULL)
-	{
-		h_cfg.autohosoff = *(u32 *)temp_autohosoff;
-		_save_config();
-	}
-
-	free(ments);
-	free(hp_values);
-
-	if (temp_autohosoff == NULL)
-		return;
-	btn_wait();
-}
-
-void config_nogc()
-{
-	gfx_clear_grey(0x1B);
-	gfx_con_setpos(0, 0);
-
-	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * 5);
-	u32 *cb_values = (u32 *)malloc(sizeof(u32) * 2);
-
-	for (u32 j = 0; j < 2; j++)
-	{
-		cb_values[j] = j;
-		ments[j + 2].type = MENT_DATA;
-		ments[j + 2].data = &cb_values[j];
-	}
-
-	ments[0].type = MENT_BACK;
-	ments[0].caption = "Back";
-
-	ments[1].type = MENT_CHGLINE;
-
-	if (h_cfg.autonogc)
-	{
-		ments[2].caption = " Disable";
-		ments[3].caption = "*Auto";
-	}
-	else
-	{
-		ments[2].caption = "*Disable";
-		ments[3].caption = " Auto";
-	}
-
-	memset(&ments[4], 0, sizeof(ment_t));
-	menu_t menu = {ments, "No Gamecard", 0, 0};
-
-	u32 *temp_nogc = (u32 *)tui_do_menu(&menu);
-	if (temp_nogc != NULL)
-	{
-		h_cfg.autonogc = *(u32 *)temp_nogc;
-		_save_config();
-	}
-
-	free(ments);
-	free(cb_values);
-
-	if (temp_nogc == NULL)
-		return;
-	btn_wait();
-}
-
-#pragma GCC pop_options

bootloader/config.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -33,9 +33,6 @@ typedef struct _hekate_config
 	u32 bootprotect;
 	// Global temporary config.
 	bool t210b01;
-	bool se_keygen_done;
-	bool sept_run;
-	bool aes_slots_new;
 	bool emummc_force_disable;
 	bool rcm_patched;
 	u32  errors;
@@ -44,10 +41,5 @@ typedef struct _hekate_config
 
 void set_default_configuration();
 int create_config_entry();
-void config_autoboot();
-void config_bootdelay();
-void config_backlight();
-void config_auto_hos_poweroff();
-void config_nogc();
 
 #endif /* _CONFIG_H_ */

bootloader/frontend/fe_info.c

@@ -19,6 +19,7 @@
 #include <string.h>
 
 #include "fe_info.h"
+#include "../config.h"
 #include <gfx_utils.h>
 #include "../hos/hos.h"
 #include "../hos/pkg1.h"
@@ -40,6 +41,7 @@
 #include <utils/btn.h>
 #include <utils/util.h>
 
+extern hekate_config h_cfg;
 extern void emmcsn_path_impl(char *path, char *sub_dir, char *filename, sdmmc_storage_t *storage);
 
 #pragma GCC push_options
@@ -47,6 +49,10 @@ extern void emmcsn_path_impl(char *path, char *sub_dir, char *filename, sdmmc_st
 
 void print_fuseinfo()
 {
+	u32 fuse_size = h_cfg.t210b01 ? 0x368 : 0x300;
+	u32 fuse_address = h_cfg.t210b01 ? 0x7000F898 : 0x7000F900;
+	u32 fuse_array_size = (h_cfg.t210b01 ? 256 : 192) * sizeof(u32);
+
 	gfx_clear_partial_grey(0x1B, 0, 1256);
 	gfx_con_setpos(0, 0);
 
@@ -61,13 +67,13 @@ void print_fuseinfo()
 		break;
 	}
 	gfx_printf("Sdram ID:    %d\n", fuse_read_dramid(true));
-	gfx_printf("Burnt fuses: %d / 64\n", fuse_count_burnt(fuse_read_odm(7)));
+	gfx_printf("Burnt fuses: %d / 64\n", bit_count(fuse_read_odm(7)));
 	gfx_printf("Secure key:  %08X%08X%08X%08X\n\n\n",
 		byte_swap_32(FUSE(FUSE_PRIVATE_KEY0)), byte_swap_32(FUSE(FUSE_PRIVATE_KEY1)),
 		byte_swap_32(FUSE(FUSE_PRIVATE_KEY2)), byte_swap_32(FUSE(FUSE_PRIVATE_KEY3)));
 
-	gfx_printf("%k(Unlocked) fuse cache:\n\n%k", 0xFF00DDFF, 0xFFCCCCCC);
-	gfx_hexdump(0x7000F900, (u8 *)0x7000F900, 0x300);
+	gfx_printf("%kFuse cache:\n\n%k", 0xFF00DDFF, 0xFFCCCCCC);
+	gfx_hexdump(fuse_address, (u8 *)fuse_address, fuse_size);
 
 	gfx_puts("\nPress POWER to dump them to SD Card.\nPress VOL to go to the menu.\n");
 
@@ -78,13 +84,13 @@ void print_fuseinfo()
 		{
 			char path[64];
 			emmcsn_path_impl(path, "/dumps", "fuse_cached.bin", NULL);
-			if (!sd_save_to_file((u8 *)0x7000F900, 0x300, path))
+			if (!sd_save_to_file((u8 *)fuse_address, fuse_size, path))
 				gfx_puts("\nfuse_cached.bin saved!\n");
 
-			u32 words[192];
+			u32 words[256];
 			fuse_read_array(words);
 			emmcsn_path_impl(path, "/dumps", "fuse_array_raw.bin", NULL);
-			if (!sd_save_to_file((u8 *)words, sizeof(words), path))
+			if (!sd_save_to_file((u8 *)words, fuse_array_size, path))
 				gfx_puts("\nfuse_array_raw.bin saved!\n");
 
 			sd_end();
@@ -326,113 +332,6 @@ void print_sdcard_info()
 	btn_wait();
 }
 
-void print_tsec_key()
-{
-	gfx_clear_partial_grey(0x1B, 0, 1256);
-	gfx_con_setpos(0, 0);
-
-	u32 retries = 0;
-
-	tsec_ctxt_t tsec_ctxt;
-
-	sdmmc_storage_init_mmc(&emmc_storage, &emmc_sdmmc, SDMMC_BUS_WIDTH_8, SDHCI_TIMING_MMC_HS400);
-
-	// Read package1.
-	u8 *pkg1 = (u8 *)malloc(0x40000);
-	sdmmc_storage_set_mmc_partition(&emmc_storage, EMMC_BOOT0);
-	sdmmc_storage_read(&emmc_storage, 0x100000 / NX_EMMC_BLOCKSIZE, 0x40000 / NX_EMMC_BLOCKSIZE, pkg1);
-	sdmmc_storage_end(&emmc_storage);
-	const pkg1_id_t *pkg1_id = pkg1_identify(pkg1);
-	if (!pkg1_id)
-	{
-		EPRINTF("Unknown pkg1 version.");
-		goto out_wait;
-	}
-
-	u8 keys[SE_KEY_128_SIZE * 2];
-	memset(keys, 0x00, 0x20);
-
-	tsec_ctxt.fw = (u8 *)pkg1 + pkg1_id->tsec_off;
-	tsec_ctxt.pkg1 = pkg1;
-	tsec_ctxt.pkg11_off = pkg1_id->pkg11_off;
-	tsec_ctxt.secmon_base = pkg1_id->secmon_base;
-
-	if (pkg1_id->kb <= KB_FIRMWARE_VERSION_600)
-		tsec_ctxt.size = 0xF00;
-	else if (pkg1_id->kb == KB_FIRMWARE_VERSION_620)
-		tsec_ctxt.size = 0x2900;
-	else if (pkg1_id->kb == KB_FIRMWARE_VERSION_700)
-	{
-		tsec_ctxt.size = 0x3000;
-		// Exit after TSEC key generation.
-		*((vu16 *)((u32)tsec_ctxt.fw + 0x2DB5)) = 0x02F8;
-	}
-	else
-		tsec_ctxt.size = 0x3300;
-
-	if (pkg1_id->kb == KB_FIRMWARE_VERSION_620)
-	{
-		u8 *tsec_paged = (u8 *)page_alloc(3);
-		memcpy(tsec_paged, (void *)tsec_ctxt.fw, tsec_ctxt.size);
-		tsec_ctxt.fw = tsec_paged;
-	}
-
-	int res = 0;
-
-	while (tsec_query(keys, pkg1_id->kb, &tsec_ctxt) < 0)
-	{
-		memset(keys, 0x00, 0x20);
-
-		retries++;
-
-		if (retries > 3)
-		{
-			res = -1;
-			break;
-		}
-	}
-
-	gfx_printf("%kTSEC key:  %k", 0xFF00DDFF, 0xFFCCCCCC);
-
-	if (res >= 0)
-	{
-		for (u32 j = 0; j < SE_KEY_128_SIZE; j++)
-			gfx_printf("%02X", keys[j]);
-
-		if (pkg1_id->kb == KB_FIRMWARE_VERSION_620)
-		{
-			gfx_printf("\n%kTSEC root: %k", 0xFF00DDFF, 0xFFCCCCCC);
-			for (u32 j = 0; j < SE_KEY_128_SIZE; j++)
-				gfx_printf("%02X", keys[SE_KEY_128_SIZE + j]);
-		}
-	}
-	else
-		EPRINTFARGS("ERROR %X\n", res);
-
-	gfx_puts("\n\nPress POWER to dump them to SD Card.\nPress VOL to go to the menu.\n");
-
-	u32 btn = btn_wait();
-	if (btn & BTN_POWER)
-	{
-		if (sd_mount())
-		{
-			char path[64];
-			emmcsn_path_impl(path, "/dumps", "tsec_keys.bin", NULL);
-			if (!sd_save_to_file(keys, SE_KEY_128_SIZE * 2, path))
-				gfx_puts("\nDone!\n");
-			sd_end();
-		}
-	}
-	else
-		goto out;
-
-out_wait:
-	btn_wait();
-
-out:
-	free(pkg1);
-}
-
 void print_fuel_gauge_info()
 {
 	int value = 0;

bootloader/frontend/fe_info.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (c) 2018 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
  * Copyright (c) 2018 balika011
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -23,7 +23,6 @@ void print_fuseinfo();
 void print_kfuseinfo();
 void print_mmc_info();
 void print_sdcard_info();
-void print_tsec_key();
 void print_fuel_gauge_info();
 void print_battery_charger_info();
 void print_battery_info();

bootloader/frontend/fe_tools.c

@@ -26,7 +26,6 @@
 #include "../hos/hos.h"
 #include "../hos/pkg1.h"
 #include "../hos/pkg2.h"
-#include "../hos/sept.h"
 #include <libs/fatfs/ff.h>
 #include <mem/heap.h>
 #include <power/max7762x.h>
@@ -54,10 +53,10 @@ void dump_packages12()
 
 	char path[64];
 
-	u8 *pkg1 = (u8 *)calloc(1, 0x40000);
-	u8 *warmboot = (u8 *)calloc(1, 0x40000);
-	u8 *secmon = (u8 *)calloc(1, 0x40000);
-	u8 *loader = (u8 *)calloc(1, 0x40000);
+	u8 *pkg1 = (u8 *)calloc(1, SZ_256K);
+	u8 *warmboot = (u8 *)calloc(1, SZ_256K);
+	u8 *secmon = (u8 *)calloc(1, SZ_256K);
+	u8 *loader = (u8 *)calloc(1, SZ_256K);
 	u8 *pkg2 = NULL;
 	u8 kb = 0;
 
@@ -74,14 +73,14 @@ void dump_packages12()
 	sdmmc_storage_set_mmc_partition(&emmc_storage, EMMC_BOOT0);
 
 	// Read package1.
-	sdmmc_storage_read(&emmc_storage, 0x100000 / NX_EMMC_BLOCKSIZE, 0x40000 / NX_EMMC_BLOCKSIZE, pkg1);
+	sdmmc_storage_read(&emmc_storage, 0x100000 / NX_EMMC_BLOCKSIZE, SZ_256K / NX_EMMC_BLOCKSIZE, pkg1);
 	const pkg1_id_t *pkg1_id = pkg1_identify(pkg1);
 	if (!pkg1_id)
 	{
 		EPRINTF("Unknown pkg1 version for reading\nTSEC firmware.");
 		// Dump package1.
 		emmcsn_path_impl(path, "/pkg1", "pkg1_enc.bin", &emmc_storage);
-		if (sd_save_to_file(pkg1, 0x40000, path))
+		if (sd_save_to_file(pkg1, SZ_256K, path))
 			goto out_free;
 		gfx_puts("\nEnc pkg1 dumped to pkg1_enc.bin\n");
 
@@ -90,38 +89,18 @@ void dump_packages12()
 
 	kb = pkg1_id->kb;
 
-	if (!h_cfg.se_keygen_done)
-	{
-		tsec_ctxt.fw = (void *)pkg1 + pkg1_id->tsec_off;
-		tsec_ctxt.pkg1 = (void *)pkg1;
-		tsec_ctxt.pkg11_off = pkg1_id->pkg11_off;
-		tsec_ctxt.secmon_base = pkg1_id->secmon_base;
+	tsec_ctxt.fw = (void *)pkg1 + pkg1_id->tsec_off;
+	tsec_ctxt.pkg1 = (void *)pkg1;
+	tsec_ctxt.pkg11_off = pkg1_id->pkg11_off;
+	tsec_ctxt.secmon_base = pkg1_id->secmon_base;
 
-		if (kb >= KB_FIRMWARE_VERSION_700 && !h_cfg.sept_run)
-		{
-			b_cfg.autoboot = 0;
-			b_cfg.autoboot_list = 0;
+	// Read keyblob.
+	u8 *keyblob = (u8 *)calloc(NX_EMMC_BLOCKSIZE, 1);
+	sdmmc_storage_read(&emmc_storage, 0x180000 / NX_EMMC_BLOCKSIZE + kb, 1, keyblob);
 
-			gfx_printf("sept will run to get the keys.\nThen rerun this option.");
-			btn_wait();
-
-			if (!reboot_to_sept((u8 *)tsec_ctxt.fw, kb, NULL))
-			{
-				gfx_printf("Failed to run sept\n");
-				goto out_free;
-			}
-		}
-
-		// Read keyblob.
-		u8 *keyblob = (u8 *)calloc(NX_EMMC_BLOCKSIZE, 1);
-		sdmmc_storage_read(&emmc_storage, 0x180000 / NX_EMMC_BLOCKSIZE + kb, 1, keyblob);
-
-		// Decrypt.
-		hos_keygen(keyblob, kb, &tsec_ctxt, NULL);
-		if (kb <= KB_FIRMWARE_VERSION_600)
-			h_cfg.se_keygen_done = 1;
-		free(keyblob);
-	}
+	// Decrypt.
+	hos_keygen(keyblob, kb, &tsec_ctxt, false, false);
+	free(keyblob);
 
 	if (kb <= KB_FIRMWARE_VERSION_600)
 		pkg1_decrypt(pkg1_id, pkg1);
@@ -155,7 +134,7 @@ void dump_packages12()
 
 		// Dump package1.1.
 		emmcsn_path_impl(path, "/pkg1", "pkg1_decr.bin", &emmc_storage);
-		if (sd_save_to_file(pkg1, 0x40000, path))
+		if (sd_save_to_file(pkg1, SZ_256K, path))
 			goto out_free;
 		gfx_puts("\npkg1 dumped to pkg1_decr.bin\n");
 
@@ -199,8 +178,16 @@ void dump_packages12()
 	pkg2 = malloc(pkg2_size_aligned);
 	nx_emmc_part_read(&emmc_storage, pkg2_part, 0x4000 / NX_EMMC_BLOCKSIZE,
 		pkg2_size_aligned / NX_EMMC_BLOCKSIZE, pkg2);
+
+#if 0
+	emmcsn_path_impl(path, "/pkg2", "pkg2_encr.bin", &emmc_storage);
+	if (sd_save_to_file(pkg2, pkg2_size_aligned, path))
+		goto out;
+	gfx_puts("\npkg2 dumped to pkg2_encr.bin\n");
+#endif
+
 	// Decrypt package2 and parse KIP1 blobs in INI1 section.
-	pkg2_hdr_t *pkg2_hdr = pkg2_decrypt(pkg2, kb);
+	pkg2_hdr_t *pkg2_hdr = pkg2_decrypt(pkg2, kb, false);
 	if (!pkg2_hdr)
 	{
 		gfx_printf("Pkg2 decryption failed!\n");
@@ -324,9 +311,7 @@ void menu_autorcm()
 
 	if (h_cfg.rcm_patched)
 	{
-		gfx_printf("%kThis device is RCM patched and\nAutoRCM function is disabled.\n\n"
-			"In case %kAutoRCM%k is enabled\nthis will %kBRICK%k the device PERMANENTLY!!%k",
-			0xFFFFDD00, 0xFFFF0000, 0xFFFFDD00, 0xFFFF0000, 0xFFFFDD00, 0xFFCCCCCC);
+		WPRINTF("This device is RCM patched and the\nfunction is disabled to avoid BRICKS!\n");
 		btn_wait();
 
 		return;
@@ -392,218 +377,4 @@ void menu_autorcm()
 	tui_do_menu(&menu);
 }
 
-int _fix_attributes(char *path, u32 *total, u32 hos_folder, u32 check_first_run)
-{
-	FRESULT res;
-	DIR dir;
-	u32 dirLength = 0;
-	static FILINFO fno;
-
-	if (check_first_run)
-	{
-		// Read file attributes.
-		res = f_stat(path, &fno);
-		if (res != FR_OK)
-			return res;
-
-		// Check if archive bit is set.
-		if (fno.fattrib & AM_ARC)
-		{
-			*(u32 *)total = *(u32 *)total + 1;
-			f_chmod(path, 0, AM_ARC);
-		}
-	}
-
-	// Open directory.
-	res = f_opendir(&dir, path);
-	if (res != FR_OK)
-		return res;
-
-	dirLength = strlen(path);
-	for (;;)
-	{
-		// Clear file or folder path.
-		path[dirLength] = 0;
-
-		// Read a directory item.
-		res = f_readdir(&dir, &fno);
-
-		// Break on error or end of dir.
-		if (res != FR_OK || fno.fname[0] == 0)
-			break;
-
-		// Skip official Nintendo dir if started from root.
-		if (!hos_folder && !strcmp(fno.fname, "Nintendo"))
-			continue;
-
-		// Set new directory or file.
-		memcpy(&path[dirLength], "/", 1);
-		memcpy(&path[dirLength + 1], fno.fname, strlen(fno.fname) + 1);
-
-		// Check if archive bit is set.
-		if (fno.fattrib & AM_ARC)
-		{
-			*total = *total + 1;
-			f_chmod(path, 0, AM_ARC);
-		}
-
-		// Is it a directory?
-		if (fno.fattrib & AM_DIR)
-		{
-			// Set archive bit to NCA folders.
-			if (hos_folder && !strcmp(fno.fname + strlen(fno.fname) - 4, ".nca"))
-			{
-				*total = *total + 1;
-				f_chmod(path, AM_ARC, AM_ARC);
-			}
-
-			// Update status bar.
-			tui_sbar(false);
-
-			// Enter the directory.
-			res = _fix_attributes(path, total, hos_folder, 0);
-			if (res != FR_OK)
-				break;
-		}
-	}
-
-	f_closedir(&dir);
-
-	return res;
-}
-
-void _fix_sd_attr(u32 type)
-{
-	gfx_clear_partial_grey(0x1B, 0, 1256);
-	gfx_con_setpos(0, 0);
-
-	char path[256];
-	char label[16];
-
-	u32 total = 0;
-	if (sd_mount())
-	{
-		switch (type)
-		{
-		case 0:
-			strcpy(path, "/");
-			strcpy(label, "SD Card");
-			break;
-		case 1:
-		default:
-			strcpy(path, "/Nintendo");
-			strcpy(label, "Nintendo folder");
-			break;
-		}
-
-		gfx_printf("Traversing all %s files!\nThis may take some time...\n\n", label);
-		_fix_attributes(path, &total, type, type);
-		gfx_printf("%kTotal archive bits cleared: %d!%k\n\nDone! Press any key...", 0xFF96FF00, total, 0xFFCCCCCC);
-		sd_end();
-	}
-	btn_wait();
-}
-
-void fix_sd_all_attr() { _fix_sd_attr(0); }
-void fix_sd_nin_attr() { _fix_sd_attr(1); }
-
-/* void fix_fuel_gauge_configuration()
-{
-	gfx_clear_partial_grey(0x1B, 0, 1256);
-	gfx_con_setpos(0, 0);
-
-	int battVoltage, avgCurrent;
-
-	max17050_get_property(MAX17050_VCELL, &battVoltage);
-	max17050_get_property(MAX17050_AvgCurrent, &avgCurrent);
-
-	// Check if still charging. If not, check if battery is >= 95% (4.1V).
-	if (avgCurrent < 0 && battVoltage > 4100)
-	{
-		if ((avgCurrent / 1000) < -10)
-			EPRINTF("You need to be connected to a wall adapter,\nto apply this fix!");
-		else
-		{
-			gfx_printf("%kAre you really sure?\nThis will reset your fuel gauge completely!\n", 0xFFFFDD00);
-			gfx_printf("Additionally this will power off your console.\n%k", 0xFFCCCCCC);
-
-			gfx_puts("\nPress POWER to Continue.\nPress VOL to go to the menu.\n\n\n");
-
-			u32 btn = btn_wait();
-			if (btn & BTN_POWER)
-			{
-				max17050_fix_configuration();
-				msleep(1000);
-				gfx_con_getpos(&gfx_con.savedx,  &gfx_con.savedy);
-				u16 value = 0;
-				gfx_printf("%kThe console will power off in 45 seconds.\n%k", 0xFFFFDD00, 0xFFCCCCCC);
-				while (value < 46)
-				{
-					gfx_con_setpos(gfx_con.savedx, gfx_con.savedy);
-					gfx_printf("%2ds elapsed", value);
-					msleep(1000);
-					value++;
-				}
-				msleep(2000);
-
-				power_off();
-			}
-			return;
-		}
-	}
-	else
-		EPRINTF("You need a fully charged battery\nand connected to a wall adapter,\nto apply this fix!");
-
-	msleep(500);
-	btn_wait();
-} */
-
-/*void reset_pmic_fuel_gauge_charger_config()
-{
-	int avgCurrent;
-
-	gfx_clear_partial_grey(0x1B, 0, 1256);
-	gfx_con_setpos(0, 0);
-
-	gfx_printf("%k\nThis will wipe your battery stats completely!\n"
-		"%kAnd it may not power on without physically\nremoving and re-inserting the battery.\n%k"
-		"\nAre you really sure?%k\n", 0xFFFFDD00, 0xFFFF0000, 0xFFFFDD00, 0xFFCCCCCC);
-
-	gfx_puts("\nPress POWER to Continue.\nPress VOL to go to the menu.\n\n\n");
-	u32 btn = btn_wait();
-	if (btn & BTN_POWER)
-	{
-		gfx_clear_partial_grey(0x1B, 0, 1256);
-		gfx_con_setpos(0, 0);
-		gfx_printf("%kKeep the USB cable connected!%k\n\n", 0xFFFFDD00, 0xFFCCCCCC);
-		gfx_con_getpos(&gfx_con.savedx,  &gfx_con.savedy);
-
-		u8 value = 30;
-		while (value > 0)
-		{
-			gfx_con_setpos(gfx_con.savedx, gfx_con.savedy);
-			gfx_printf("%kWait... (%ds)   %k", 0xFF888888, value, 0xFFCCCCCC);
-			msleep(1000);
-			value--;
-		}
-		gfx_con_setpos(gfx_con.savedx, gfx_con.savedy);
-
-		//Check if still connected.
-		max17050_get_property(MAX17050_AvgCurrent, &avgCurrent);
-		if ((avgCurrent / 1000) < -10)
-			EPRINTF("You need to be connected to a wall adapter\nor PC to apply this fix!");
-		else
-		{
-			// Apply fix.
-			bq24193_fake_battery_removal();
-			gfx_printf("Done!               \n"
-				"%k1. Remove the USB cable\n"
-				"2. Press POWER for 15s.\n"
-				"3. Reconnect the USB to power-on!%k\n", 0xFFFFDD00, 0xFFCCCCCC);
-		}
-		msleep(500);
-		btn_wait();
-	}
-}*/
-
 #pragma GCC pop_options

bootloader/frontend/fe_tools.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (c) 2018 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -19,9 +19,6 @@
 #define _FE_TOOLS_H_
 
 void dump_packages12();
-void fix_sd_all_attr();
-void fix_sd_nin_attr();
-void fix_battery_desync();
 void menu_autorcm();
 
 #endif

bootloader/gfx/tui.c

@@ -77,7 +77,7 @@ void tui_pbar(int x, int y, u32 val, u32 fgcol, u32 bgcol)
 
 	x += 7 * gfx_con.fntsz;
 
-	for (int i = 0; i < (gfx_con.fntsz >> 3) * 6; i++)
+	for (u32 i = 0; i < (gfx_con.fntsz >> 3) * 6; i++)
 	{
 		gfx_line(x, y + i + 1, x + 3 * val, y + i + 1, fgcol);
 		gfx_line(x + 3 * val, y + i + 1, x + 3 * 100, y + i + 1, bgcol);

bootloader/hos/fss.c

@@ -1,7 +1,7 @@
 /*
- * Atmosphère Fusée Secondary Storage parser.
+ * Atmosphère Fusée Secondary Storage (Package3) parser.
  *
- * Copyright (c) 2019-2020 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -51,6 +51,7 @@ extern bool is_ipl_updated(void *buf, char *path, bool force);
 #define CNT_TYPE_KLD 9  // Kernel Loader.
 #define CNT_TYPE_KRN 10 // Kernel.
 #define CNT_TYPE_EXF 11 // Exosphere Mariko fatal payload.
+#define CNT_TYPE_TKG 12 // Tsec Keygen.
 
 // FSS0 Content Flags.
 #define CNT_FLAG0_EXPERIMENTAL BIT(0)
@@ -81,15 +82,16 @@ typedef struct _fss_content_t
 	char name[0x10];
 } fss_content_t;
 
-static void _update_r2p(const char *path)
+static void _set_fss_path_and_update_r2p(launch_ctxt_t *ctxt, const char *path)
 {
 	char *r2p_path = malloc(256);
 	u32 path_len = strlen(path);
+
 	strcpy(r2p_path, path);
 
 	while(path_len)
 	{
-		if ((r2p_path[path_len - 1] == '/') || (r2p_path[path_len - 1] == 0x5C))
+		if ((r2p_path[path_len - 1] == '/') || (r2p_path[path_len - 1] == '\\'))
 		{
 			r2p_path[path_len] = 0;
 			strcat(r2p_path, "reboot_payload.bin");
@@ -98,7 +100,11 @@ static void _update_r2p(const char *path)
 			is_ipl_updated(r2p_payload, r2p_path, h_cfg.updater2p ? true : false);
 
 			free(r2p_payload);
-			break;
+
+			// Save FSS0 parent path.
+			r2p_path[path_len] = 0;
+			ctxt->fss0_main_path = r2p_path;
+			return;
 		}
 		path_len--;
 	}
@@ -106,40 +112,43 @@ static void _update_r2p(const char *path)
 	free(r2p_path);
 }
 
-int parse_fss(launch_ctxt_t *ctxt, const char *path, fss0_sept_t *sept_ctxt)
+int parse_fss(launch_ctxt_t *ctxt, const char *path)
 {
 	FIL fp;
 
 	bool stock = false;
-	int sept_used = 0;
+	bool experimental = false;
 
 	// Skip if stock and Exosphere and warmboot are not needed.
-	if (!sept_ctxt)
+	bool pkg1_old = ctxt->pkg1_id->kb <= KB_FIRMWARE_VERSION_620; // Should check if t210b01?
+	bool emummc_disabled = !emu_cfg.enabled || h_cfg.emummc_force_disable;
+
+	LIST_FOREACH_ENTRY(ini_kv_t, kv, &ctxt->cfg->kvs, link)
 	{
-		bool pkg1_old = ctxt->pkg1_id->kb <= KB_FIRMWARE_VERSION_620;
-		bool emummc_disabled = !emu_cfg.enabled || h_cfg.emummc_force_disable;
+		if (!strcmp("stock", kv->key))
+			if (kv->val[0] == '1')
+				stock = true;
 
-		LIST_FOREACH_ENTRY(ini_kv_t, kv, &ctxt->cfg->kvs, link)
-		{
-			if (!strcmp("stock", kv->key))
-				if (kv->val[0] == '1')
-					stock = true;
-		}
-
-#ifdef HOS_MARIKO_STOCK_SECMON
-		if (stock && emummc_disabled && (pkg1_old || h_cfg.t210b01))
-#else
-		if (stock && emummc_disabled && pkg1_old)
-#endif
-			return 1;
+		if (!strcmp("fss0experimental", kv->key))
+			if (kv->val[0] == '1')
+				experimental = true;
 	}
 
+#ifdef HOS_MARIKO_STOCK_SECMON
+	if (stock && emummc_disabled && (pkg1_old || h_cfg.t210b01))
+		return 1;
+#else
+	if (stock && emummc_disabled && pkg1_old)
+		return 1;
+#endif
+
+	// Try to open FSS0.
 	if (f_open(&fp, path, FA_READ) != FR_OK)
 		return 0;
 
 	void *fss = malloc(f_size(&fp));
 
-	// Read first 1024 bytes of the fss file.
+	// Read first 1024 bytes of the FSS0 file.
 	f_read(&fp, fss, 1024, NULL);
 
 	// Get FSS0 Meta header offset.
@@ -149,30 +158,14 @@ int parse_fss(launch_ctxt_t *ctxt, const char *path, fss0_sept_t *sept_ctxt)
 	// Check if valid FSS0 and parse it.
 	if (fss_meta->magic == FSS0_MAGIC)
 	{
-		bool mariko_not_supported = false;
-		if (h_cfg.t210b01 && (fss_meta->version < FSS0_VERSION_0_17_0))
-		{
-			gfx_con.mute = false;
-			mariko_not_supported = true;
-		}
-
-		gfx_printf("Found FSS0, Atmosphere %d.%d.%d-%08x\n"
-			"Max HOS supported: %d.%d.%d\n"
-			"Unpacking and loading components..  ",
+		gfx_printf("Found FSS/PK3, Atmosphere %d.%d.%d-%08x\n"
+			"Max HOS: %d.%d.%d\n"
+			"Unpacking..  ",
 			fss_meta->version >> 24, (fss_meta->version >> 16) & 0xFF, (fss_meta->version >> 8) & 0xFF, fss_meta->git_rev,
 			fss_meta->hos_ver >> 24, (fss_meta->hos_ver >> 16) & 0xFF, (fss_meta->hos_ver >> 8) & 0xFF);
 
-		if (mariko_not_supported)
-		{
-			EPRINTF("\nMariko not supported on < 0.17.0!");
-			goto fail;
-		}
-
-		if (!sept_ctxt)
-		{
-			ctxt->atmosphere = true;
-			ctxt->fss0_hosver = fss_meta->hos_ver;
-		}
+		ctxt->atmosphere = true;
+		ctxt->fss0_hosver = fss_meta->hos_ver;
 
 		// Parse FSS0 contents.
 		fss_content_t *curr_fss_cnt = (fss_content_t *)(fss + fss_meta->cnt_off);
@@ -185,104 +178,66 @@ int parse_fss(launch_ctxt_t *ctxt, const char *path, fss0_sept_t *sept_ctxt)
 			if ((curr_fss_cnt[i].offset + curr_fss_cnt[i].size) > fss_meta->size)
 				continue;
 
-			// If content is experimental and experimental flag is not enabled, skip it.
-			if ((curr_fss_cnt[i].flags0 & CNT_FLAG0_EXPERIMENTAL) && !ctxt->fss0_experimental)
+			// If content is experimental and experimental config is not enabled, skip it.
+			if ((curr_fss_cnt[i].flags0 & CNT_FLAG0_EXPERIMENTAL) && !experimental)
 				continue;
 
-			// Parse content.
-			if (!sept_ctxt)
+			// Prepare content.
+			switch (curr_fss_cnt[i].type)
 			{
-				// Prepare content context.
-				switch (curr_fss_cnt[i].type)
-				{
-				case CNT_TYPE_KIP:
-					if (stock)
-						continue;
-					merge_kip_t *mkip1 = (merge_kip_t *)malloc(sizeof(merge_kip_t));
-					mkip1->kip1 = content;
-					list_append(&ctxt->kip1_list, &mkip1->link);
-					DPRINTF("Loaded %s.kip1 from FSS0 (size %08X)\n", curr_fss_cnt[i].name, curr_fss_cnt[i].size);
-					break;
-
-				case CNT_TYPE_KRN:
-					if (stock)
-						continue;
-					ctxt->kernel_size = curr_fss_cnt[i].size;
-					ctxt->kernel = content;
-					break;
-
-				case CNT_TYPE_EXO:
-					ctxt->secmon_size = curr_fss_cnt[i].size;
-					ctxt->secmon = content;
-					break;
-
-				case CNT_TYPE_EXF:
-					ctxt->exofatal_size = curr_fss_cnt[i].size;
-					ctxt->exofatal = content;
-					break;
-
-				case CNT_TYPE_WBT:
-					if (h_cfg.t210b01)
-						continue;
-					ctxt->warmboot_size = curr_fss_cnt[i].size;
-					ctxt->warmboot = content;
-					break;
-
-				default:
+			case CNT_TYPE_KIP:
+				if (stock)
 					continue;
-				}
+				merge_kip_t *mkip1 = (merge_kip_t *)malloc(sizeof(merge_kip_t));
+				mkip1->kip1 = content;
+				list_append(&ctxt->kip1_list, &mkip1->link);
+				DPRINTF("Loaded %s.kip1 from FSS0 (size %08X)\n", curr_fss_cnt[i].name, curr_fss_cnt[i].size);
+				break;
 
-				// Load content to launch context.
-				f_lseek(&fp, curr_fss_cnt[i].offset);
-				f_read(&fp, content, curr_fss_cnt[i].size, NULL);
-			}
-			else
-			{
-				// Load sept content directly to launch context.
-				switch (curr_fss_cnt[i].type)
-				{
-				case CNT_TYPE_SP1:
-					f_lseek(&fp, curr_fss_cnt[i].offset);
-					f_read(&fp, sept_ctxt->sept_primary, curr_fss_cnt[i].size, NULL);
-					break;
-				case CNT_TYPE_SP2:
-					if (!memcmp(curr_fss_cnt[i].name, (sept_ctxt->kb < KB_FIRMWARE_VERSION_810) ? "septsecondary00" : "septsecondary01", 15))
-					{
-						f_lseek(&fp, curr_fss_cnt[i].offset);
-						f_read(&fp, sept_ctxt->sept_secondary, curr_fss_cnt[i].size, NULL);
-						sept_used = 1;
-						goto out;
-					}
-					break;
-				default:
-					break;
-				}
+			case CNT_TYPE_KRN:
+				if (stock)
+					continue;
+				ctxt->kernel_size = curr_fss_cnt[i].size;
+				ctxt->kernel = content;
+				break;
+
+			case CNT_TYPE_EXO:
+				ctxt->secmon_size = curr_fss_cnt[i].size;
+				ctxt->secmon = content;
+				break;
+
+			case CNT_TYPE_EXF:
+				ctxt->exofatal_size = curr_fss_cnt[i].size;
+				ctxt->exofatal = content;
+				break;
+
+			case CNT_TYPE_WBT:
+				if (h_cfg.t210b01)
+					continue;
+				ctxt->warmboot_size = curr_fss_cnt[i].size;
+				ctxt->warmboot = content;
+				break;
+
+			default:
+				continue;
 			}
+
+			// Load content to launch context.
+			f_lseek(&fp, curr_fss_cnt[i].offset);
+			f_read(&fp, content, curr_fss_cnt[i].size, NULL);
 		}
 
-out:
 		gfx_printf("Done!\n");
 		f_close(&fp);
 
-		_update_r2p(path);
+		// Set FSS0 path and update r2p if needed.
+		_set_fss_path_and_update_r2p(ctxt, path);
 
-		return (!sept_ctxt ? 1 : sept_used);
+		return 1;
 	}
 
-fail:
 	f_close(&fp);
 	free(fss);
 
 	return 0;
 }
-
-int load_sept_from_ffs0(fss0_sept_t *sept_ctxt)
-{
-	LIST_FOREACH_ENTRY(ini_kv_t, kv, &sept_ctxt->cfg_sec->kvs, link)
-	{
-		if (!strcmp("fss0", kv->key))
-			return parse_fss(NULL, kv->val, sept_ctxt);
-	}
-
-	return 0;
-}

bootloader/hos/fss.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -19,16 +19,6 @@
 
 #include "hos.h"
 
-typedef struct _fss0_sept_t
-{
-	u32 kb;
-	ini_sec_t *cfg_sec;
-	void *sept_primary;
-	void *sept_secondary;
-
-} fss0_sept_t;
-
-int parse_fss(launch_ctxt_t *ctxt, const char *path, fss0_sept_t *sept_ctxt);
-int load_sept_from_ffs0(fss0_sept_t *sept_ctxt);
+int parse_fss(launch_ctxt_t *ctxt, const char *path);
 
 #endif

bootloader/hos/hos.h

@@ -27,60 +27,52 @@
 
 #include <assert.h>
 
-#define KB_FIRMWARE_VERSION_100_200 0
-#define KB_FIRMWARE_VERSION_300 1
-#define KB_FIRMWARE_VERSION_301 2
-#define KB_FIRMWARE_VERSION_400 3
-#define KB_FIRMWARE_VERSION_500 4
-#define KB_FIRMWARE_VERSION_600 5
-#define KB_FIRMWARE_VERSION_620 6
-#define KB_FIRMWARE_VERSION_700 7
-#define KB_FIRMWARE_VERSION_810 8
-#define KB_FIRMWARE_VERSION_900 9
-#define KB_FIRMWARE_VERSION_910 10
-#define KB_FIRMWARE_VERSION_MAX KB_FIRMWARE_VERSION_910
+#define KB_FIRMWARE_VERSION_100  0
+#define KB_FIRMWARE_VERSION_300  1
+#define KB_FIRMWARE_VERSION_301  2
+#define KB_FIRMWARE_VERSION_400  3
+#define KB_FIRMWARE_VERSION_500  4
+#define KB_FIRMWARE_VERSION_600  5
+#define KB_FIRMWARE_VERSION_620  6
+#define KB_FIRMWARE_VERSION_700  7
+#define KB_FIRMWARE_VERSION_810  8
+#define KB_FIRMWARE_VERSION_900  9
+#define KB_FIRMWARE_VERSION_910  10
+#define KB_FIRMWARE_VERSION_1210 11
+#define KB_FIRMWARE_VERSION_1300 12
+#define KB_FIRMWARE_VERSION_MAX  KB_FIRMWARE_VERSION_1300 //!TODO: Update on mkey changes.
 
-#define HOS_PKG11_MAGIC 0x31314B50
-#define HOS_EKS_MAGIC   0x30534B45
+#define HOS_TSEC_VERSION 4 //! TODO: Update on TSEC Root Key changes.
 
-// Use official Mariko secmon when in stock.
+#define HOS_PKG11_MAGIC  0x31314B50
+#define HOS_EKS_MAGIC    0x31534B45 // EKS1.
+#define HOS_EKS_TSEC_VER (KB_FIRMWARE_VERSION_700 + HOS_TSEC_VERSION)
+
+// Use official Mariko secmon when in stock. Needs access to TZRAM.
 //#define HOS_MARIKO_STOCK_SECMON
 
 typedef struct _exo_ctxt_t
 {
-	bool fs_is_510;
+	u32  hos_revision;
 	bool no_user_exceptions;
 	bool user_pmu;
+	bool *usb3_force;
 	bool *cal0_blank;
 	bool *cal0_allow_writes_sys;
 } exo_ctxt_t;
 
-typedef struct _hos_eks_keys_t
-{
-	u8 mkk[SE_KEY_128_SIZE];
-	u8 fdk[SE_KEY_128_SIZE];
-} hos_eks_keys_t;
-
-typedef struct _hos_eks_bis_keys_t
-{
-	u8 crypt[SE_KEY_128_SIZE];
-	u8 tweak[SE_KEY_128_SIZE];
-} hos_eks_bis_keys_t;
-
 typedef struct _hos_eks_mbr_t
 {
 	u32 magic;
-	u8  enabled[5];
-	u8  enabled_bis;
-	u8  rsvd[2];
+	u32 enabled;
 	u32 lot0;
-	u8  dkg[SE_KEY_128_SIZE];
-	u8  dkk[SE_KEY_128_SIZE];
-	hos_eks_keys_t keys[5];
-	hos_eks_bis_keys_t bis_keys[3];
+	u32 rsvd;
+	u8  tsec[SE_KEY_128_SIZE];
+	u8  troot[SE_KEY_128_SIZE];
+	u8  troot_dev[SE_KEY_128_SIZE];
 } hos_eks_mbr_t;
 
-static_assert(sizeof(hos_eks_mbr_t) == 304, "HOS EKS size is wrong!");
+static_assert(sizeof(hos_eks_mbr_t) == 64, "HOS EKS size is wrong!");
 
 typedef struct _launch_ctxt_t
 {
@@ -107,14 +99,15 @@ typedef struct _launch_ctxt_t
 	link_t kip1_list;
 	char*  kip1_patches;
 
-	u32  fss0_hosver;
 	bool svcperm;
 	bool debugmode;
 	bool stock;
-	bool atmosphere;
-	bool fss0_experimental;
 	bool emummc_forced;
 
+	char *fss0_main_path;
+	u32   fss0_hosver;
+	bool  atmosphere;
+
 	exo_ctxt_t exo_ctx;
 
 	ini_sec_t *cfg;
@@ -126,10 +119,8 @@ typedef struct _merge_kip_t
 	link_t link;
 } merge_kip_t;
 
-void hos_eks_get();
-void hos_eks_save(u32 kb);
 void hos_eks_clear(u32 kb);
 int  hos_launch(ini_sec_t *cfg);
-int  hos_keygen(void *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt, launch_ctxt_t *hos_ctxt);
+int  hos_keygen(void *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt, bool stock, bool is_exo);
 
 #endif

bootloader/hos/hos_config.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (c) 2018-2020 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -220,6 +220,19 @@ static int _config_exo_user_pmu_access(launch_ctxt_t *ctxt, const char *value)
 	return 1;
 }
 
+static int _config_exo_usb3_force(launch_ctxt_t *ctxt, const char *value)
+{
+	// Override key found.
+	ctxt->exo_ctx.usb3_force = calloc(sizeof(bool), 1);
+
+	if (*value == '1')
+	{
+		DPRINTF("Enabled USB 3.0\n");
+		*ctxt->exo_ctx.usb3_force = true;
+	}
+	return 1;
+}
+
 static int _config_exo_cal0_blanking(launch_ctxt_t *ctxt, const char *value)
 {
 	// Override key found.
@@ -249,16 +262,7 @@ static int _config_exo_cal0_writes_enable(launch_ctxt_t *ctxt, const char *value
 
 static int _config_fss(launch_ctxt_t *ctxt, const char *value)
 {
-	LIST_FOREACH_ENTRY(ini_kv_t, kv, &ctxt->cfg->kvs, link)
-	{
-		if (!strcmp("fss0experimental", kv->key))
-		{
-			ctxt->fss0_experimental = *kv->val == '1';
-			break;
-		}
-	}
-
-	return parse_fss(ctxt, value, NULL);
+	return parse_fss(ctxt, value);
 }
 
 static int _config_exo_fatal_payload(launch_ctxt_t *ctxt, const char *value)
@@ -291,6 +295,7 @@ static const cfg_handler_t _config_handlers[] = {
 	{ "emummcforce", _config_emummc_forced },
 	{ "nouserexceptions", _config_dis_exo_user_exceptions },
 	{ "userpmu", _config_exo_user_pmu_access },
+	{ "usb3force", _config_exo_usb3_force },
 	{ "cal0blank", _config_exo_cal0_blanking },
 	{ "cal0writesys", _config_exo_cal0_writes_enable },
 	{ NULL, NULL },

bootloader/hos/pkg1.c

@@ -32,6 +32,7 @@
 #include <soc/t210.h>
 #include <storage/nx_sd.h>
 #include <utils/aarch64_util.h>
+#include <utils/util.h>
 
 extern hekate_config h_cfg;
 
@@ -127,10 +128,6 @@ PATCHSET_DEF(_warmboot_1_patchset,
 	{ 0x4DC, _NOPv7() } // Fuse check.
 );
 
-PATCHSET_DEF(_warmboot_2_patchset,
-	{ 0x4DC, _NOPv7() } // Fuse check.
-);
-
 PATCHSET_DEF(_warmboot_3_patchset,
 	{ 0x4DC, _NOPv7() }, // Fuse check.
 	{ 0x4F0, _NOPv7() }  // Segment id check.
@@ -155,52 +152,58 @@ static const u8 sec_map_4xx[3] = { PK11_SECTION_LD, PK11_SECTION_SM, PK11_SECTIO
 
     // ID (Timestamp), KB, Fuses, TSEC, PK11,   SECMON,     Warmboot.
 static const pkg1_id_t _pkg1_ids[] = {
-	{ "20161121183008",  0,  1, 0x1900, 0x3FE0, SM_100_ADR, 0x8000D000, _secmon_1_patchset,  _warmboot_1_patchset }, // 1.0.0 (Patched relocator).
-	{ "20170210155124",  0,  2, 0x1900, 0x3FE0, 0x4002D000, 0x8000D000, _secmon_2_patchset,  _warmboot_2_patchset }, // 2.0.0 - 2.3.0.
-	{ "20170519101410",  1,  3, 0x1A00, 0x3FE0, 0x4002D000, 0x8000D000, _secmon_3_patchset,  _warmboot_3_patchset }, // 3.0.0.
-	{ "20170710161758",  2,  4, 0x1A00, 0x3FE0, 0x4002D000, 0x8000D000, _secmon_3_patchset,  _warmboot_3_patchset }, // 3.0.1 - 3.0.2.
-	{ "20170921172629",  3,  5, 0x1800, 0x3FE0, 0x4002B000, 0x4003B000, _secmon_4_patchset,  _warmboot_4_patchset }, // 4.0.0 - 4.1.0.
-	{ "20180220163747",  4,  6, 0x1900, 0x3FE0, 0x4002B000, 0x4003B000, _secmon_5_patchset,  _warmboot_4_patchset }, // 5.0.0 - 5.1.0.
-	{ "20180802162753",  5,  7, 0x1900, 0x3FE0, 0x4002B000, 0x4003D800, _secmon_6_patchset,  _warmboot_4_patchset }, // 6.0.0 - 6.1.0.
-	{ "20181107105733",  6,  8, 0x0E00, 0x6FE0, 0x4002B000, 0x4003D800, _secmon_62_patchset, _warmboot_4_patchset }, // 6.2.0.
-	{ "20181218175730",  7,  9, 0x0F00, 0x6FE0, 0x40030000, 0x4003E000, NULL, NULL }, //  7.0.0.
-	{ "20190208150037",  7,  9, 0x0F00, 0x6FE0, 0x40030000, 0x4003E000, NULL, NULL }, //  7.0.1.
-	{ "20190314172056",  7,  9, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL, NULL }, //  8.0.0 - 8.0.1.
-	{ "20190531152432",  8, 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL, NULL }, //  8.1.0 - 8.1.1.
-	{ "20190809135709",  9, 11, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL, NULL }, //  9.0.0 - 9.0.1.
-	{ "20191021113848", 10, 12, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL, NULL }, //  9.1.0 - 9.2.0.
-	{ "20200303104606", 10, 13, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL, NULL }, // 10.0.0 - 10.2.0.
-	{ "20201030110855", 10, 14, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL, NULL }, // 11.0.0+
-	{ NULL } // End.
+	{ "20161121183008",  0,  1, 0x1900, 0x3FE0, SM_100_ADR, 0x8000D000, _secmon_1_patchset }, // 1.0.0 (Patched relocator).
+	{ "20170210155124",  0,  2, 0x1900, 0x3FE0, 0x4002D000, 0x8000D000, _secmon_2_patchset }, // 2.0.0 - 2.3.0.
+	{ "20170519101410",  1,  3, 0x1A00, 0x3FE0, 0x4002D000, 0x8000D000, _secmon_3_patchset }, // 3.0.0.
+	{ "20170710161758",  2,  4, 0x1A00, 0x3FE0, 0x4002D000, 0x8000D000, _secmon_3_patchset }, // 3.0.1 - 3.0.2.
+	{ "20170921172629",  3,  5, 0x1800, 0x3FE0, 0x4002B000, 0x4003B000, _secmon_4_patchset }, // 4.0.0 - 4.1.0.
+	{ "20180220163747",  4,  6, 0x1900, 0x3FE0, 0x4002B000, 0x4003B000, _secmon_5_patchset }, // 5.0.0 - 5.1.0.
+	{ "20180802162753",  5,  7, 0x1900, 0x3FE0, 0x4002B000, 0x4003D800, _secmon_6_patchset }, // 6.0.0 - 6.1.0.
+	{ "20181107105733",  6,  8, 0x0E00, 0x6FE0, 0x4002B000, 0x4003D800, _secmon_62_patchset}, // 6.2.0.
+	{ "20181218175730",  7,  9, 0x0F00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, //  7.0.0.
+	{ "20190208150037",  7,  9, 0x0F00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, //  7.0.1.
+	{ "20190314172056",  7,  9, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, //  8.0.0 - 8.0.1.
+	{ "20190531152432",  8, 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, //  8.1.0 - 8.1.1.
+	{ "20190809135709",  9, 11, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, //  9.0.0 - 9.0.1.
+	{ "20191021113848", 10, 12, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, //  9.1.0 - 9.2.0.
+	{ "20200303104606", 10, 13, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 10.0.0 - 10.2.0.
+	{ "20201030110855", 10, 14, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 11.0.0 - 11.0.1.
+	{ "20210129111626", 10, 14, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 12.0.0 - 12.0.1.
+	{ "20210422145837", 10, 15, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 12.0.2 - 12.0.3.
+	{ "20210607122020", 11, 15, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 12.1.0.
+	{ "20210805123738", 12, 15, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 13.0.0+
 };
 
 const pkg1_id_t *pkg1_get_latest()
 {
-	return &_pkg1_ids[ARRAY_SIZE(_pkg1_ids) - 2];
+	return &_pkg1_ids[ARRAY_SIZE(_pkg1_ids) - 1];
 }
 
 const pkg1_id_t *pkg1_identify(u8 *pkg1)
 {
 	char build_date[15];
-	memcpy(build_date, (char *)(pkg1 + 0x10), 14);
+	pk1_hdr_t *hdr = (pk1_hdr_t *)pkg1;
+
+	memcpy(build_date, hdr->timestamp, 14);
 	build_date[14] = 0;
 	gfx_printf("Found pkg1 ('%s').\n\n", build_date);
 
-	for (u32 i = 0; _pkg1_ids[i].id; i++)
-		if (!memcmp(pkg1 + 0x10, _pkg1_ids[i].id, 8))
+	for (int i = ARRAY_SIZE(_pkg1_ids) - 1; i >= 0; i--)
+		if (!memcmp(hdr->timestamp, _pkg1_ids[i].id, 8))
 			return &_pkg1_ids[i];
+
 	return NULL;
 }
 
 int pkg1_decrypt(const pkg1_id_t *id, u8 *pkg1)
 {
-	// Decrypt package1.
 	pk11_hdr_t *hdr;
-	u8 *pkg11 = pkg1 + id->pkg11_off;
-	u32 pkg11_size = *(u32 *)pkg11;
 
+	// Decrypt package1.
 	if (!h_cfg.t210b01)
 	{
+		u8 *pkg11 = pkg1 + id->pkg11_off;
+		u32 pkg11_size = *(u32 *)pkg11;
 		hdr = (pk11_hdr_t *)(pkg11 + 0x20);
 		se_aes_crypt_ctr(11, hdr, pkg11_size, hdr, pkg11_size, pkg11 + 0x10);
 	}
@@ -213,7 +216,7 @@ int pkg1_decrypt(const pkg1_id_t *id, u8 *pkg1)
 		// Use BEK for T210B01.
 		// Additionally, skip 0x20 bytes from decryption to maintain the header.
 		se_aes_iv_clear(13);
-		se_aes_crypt_cbc(13, 0, pkg1 + 0x20, oem_hdr->size - 0x20, pkg1 + 0x20, oem_hdr->size - 0x20);
+		se_aes_crypt_cbc(13, DECRYPT, pkg1 + 0x20, oem_hdr->size - 0x20, pkg1 + 0x20, oem_hdr->size - 0x20);
 	}
 
 	// Return if header is valid.
@@ -311,9 +314,21 @@ void pkg1_secmon_patch(void *hos_ctxt, u32 secmon_base, bool t210b01)
 void pkg1_warmboot_patch(void *hos_ctxt)
 {
 	launch_ctxt_t *ctxt = (launch_ctxt_t *)hos_ctxt;
+	patch_t *warmboot_patchset;
 
 	// Patch warmboot on T210 to allow downgrading.
-	patch_t *warmboot_patchset = ctxt->pkg1_id->warmboot_patchset;
+	switch (ctxt->pkg1_id->kb)
+	{
+	case 0:
+		warmboot_patchset = _warmboot_1_patchset;
+		break;
+	case 1 ... 2:
+		warmboot_patchset = _warmboot_3_patchset;
+		break;
+	default: // 4.0.0 - 6.2.0.
+		warmboot_patchset = _warmboot_4_patchset;
+		break;
+	}
 	gfx_printf("%kPatching Warmboot%k\n", 0xFFFFBA00, 0xFFCCCCCC);
 	for (u32 i = 0; warmboot_patchset[i].off != 0xFFFFFFFF; i++)
 		*(vu32 *)(ctxt->pkg1_id->warmboot_base + warmboot_patchset[i].off) = warmboot_patchset[i].val;
@@ -346,7 +361,7 @@ int pkg1_warmboot_config(void *hos_ctxt, u32 warmboot_base)
 		u32 pa_id;
 		u32 fuses_max = 32; // Current ODM7 max.
 		u32 fuses_fw = ctxt->pkg1_id->fuses;
-		u8  burnt_fuses = fuse_count_burnt(fuse_read_odm(7));
+		u8  burnt_fuses = bit_count(fuse_read_odm(7));
 
 		// Save current warmboot in storage cache (MWS) and check if another one is needed.
 		if (!ctxt->warmboot)

bootloader/hos/pkg1.h

@@ -25,6 +25,14 @@
 #define PK11_SECTION_LD 1
 #define PK11_SECTION_SM 2
 
+#define PKG1_BOOTLOADER_SIZE          SZ_256K
+#define PKG1_BOOTLOADER_MAIN_OFFSET   0x100000
+#define PKG1_BOOTLOADER_BACKUP_OFFSET 0x140000
+#define PKG1_HOS_KEYBLOBS_OFFSET      0x180000
+
+#define PKG1_ERISTA_ON_MARIKO_MAGIC 0xE59FD00C // For 4.0.0 Erista and up.
+#define PKG1_MARIKO_ON_ERISTA_MAGIC 0x40010040 // Mariko pkg1 entrypoint.
+
 typedef struct _patch_t
 {
 	u32 off;
@@ -39,17 +47,28 @@ typedef struct _patch_t
 
 typedef struct _bl_hdr_t210b01_t
 {
-	u8  aes_mac[0x10];
-	u8  rsa_sig[0x100];
-	u8  salt[0x20];
-	u8  sha256[0x20];
-	u32 version;
-	u32 size;
-	u32 load_addr;
-	u32 entrypoint;
-	u8  rsvd[0x10];
+/* 0x000 */	u8  aes_mac[0x10];
+/* 0x010 */	u8  rsa_sig[0x100];
+/* 0x110 */	u8  salt[0x20];
+/* 0x130 */	u8  sha256[0x20];
+/* 0x150 */	u32 version;
+/* 0x154 */	u32 size;
+/* 0x158 */	u32 load_addr;
+/* 0x15C */	u32 entrypoint;
+/* 0x160 */	u8  rsvd[0x10];
 } bl_hdr_t210b01_t;
 
+typedef struct _pk1_hdr_t
+{
+/* 0x00 */	u32 si_sha256; // Secure Init.
+/* 0x04 */	u32 sm_sha256; // Secure Monitor.
+/* 0x08 */	u32 sl_sha256; // Secure Loader.
+/* 0x0C */	u32 unk;       // what's this? It's not warmboot.
+/* 0x10 */	char timestamp[14];
+/* 0x1E */	u8 keygen;
+/* 0x1F */	u8 version;
+} pk1_hdr_t;
+
 typedef struct _pkg1_id_t
 {
 	const char *id;
@@ -60,7 +79,6 @@ typedef struct _pkg1_id_t
 	u32 secmon_base;
 	u32 warmboot_base;
 	patch_t *secmon_patchset;
-	patch_t *warmboot_patchset;
 } pkg1_id_t;
 
 typedef struct _pk11_hdr_t

bootloader/hos/pkg2.c

@@ -1,7 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
  * Copyright (c) 2018-2021 CTCaer
- * Copyright (c) 2018 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -49,403 +48,6 @@ u32 pkg2_newkern_ini1_end;
 	#define DPRINTF(...)
 #endif
 
-//TODO: Replace hardcoded AArch64 instructions with instruction macros.
-//TODO: Reduce hardcoded values without searching kernel for patterns?
-// The process ID send/receive kernel patches were taken from Atmosphère's kernel patches.
-// They should only be used when running Atmosphère.
-#define FREE_CODE_OFF_1ST_100  0x4797C
-#define FREE_CODE_OFF_1ST_200  0x6486C
-#define FREE_CODE_OFF_1ST_300  0x494A4
-#define FREE_CODE_OFF_1ST_302  0x494BC
-#define FREE_CODE_OFF_1ST_400  0x52890
-#define FREE_CODE_OFF_1ST_500  0x5C020
-#define FREE_CODE_OFF_1ST_600  0x5EE00
-#define FREE_CODE_OFF_1ST_700  0x5FEC0
-#define FREE_CODE_OFF_1ST_800  0x607F0
-#define FREE_CODE_OFF_1ST_900  0x65780
-#define FREE_CODE_OFF_1ST_1000 0x67790
-#define FREE_CODE_OFF_1ST_1100 0x49EE8
-
-#define ID_SND_OFF_100  0x23CC0
-#define ID_SND_OFF_200  0x3F134
-#define ID_SND_OFF_300  0x26080
-#define ID_SND_OFF_302  0x26080
-#define ID_SND_OFF_400  0x2AF64
-#define ID_SND_OFF_500  0x2AD34
-#define ID_SND_OFF_600  0x2BB8C
-#define ID_SND_OFF_700  0x2D044
-#define ID_SND_OFF_800  0x2F1FC
-#define ID_SND_OFF_900  0x329A0
-#define ID_SND_OFF_1000 0x34404
-#define ID_SND_OFF_1100 0x245B4
-#define ID_SND_OFF_1101 0x245B8
-
-#define ID_RCV_OFF_100  0x219F0
-#define ID_RCV_OFF_200  0x3D1A8
-#define ID_RCV_OFF_300  0x240F0
-#define ID_RCV_OFF_302  0x240F0
-#define ID_RCV_OFF_400  0x28F6C
-#define ID_RCV_OFF_500  0x28DAC
-#define ID_RCV_OFF_600  0x29B6C
-#define ID_RCV_OFF_700  0x2B23C
-#define ID_RCV_OFF_800  0x2D424
-#define ID_RCV_OFF_900  0x309B4
-#define ID_RCV_OFF_1000 0x322F8
-#define ID_RCV_OFF_1100 0x22B24
-#define ID_RCV_OFF_1101 0x22B28
-
-static u32 PRC_ID_SND_100[] =
-{
-	0xA9BF2FEA, 0x2A0E03EB, 0xD37EF56B, 0xF86B6B8B, 0x92FFFFE9, 0x8A090168, 0xD2FFFFE9, 0x8A09016B,
-	0xD2FFFFC9, 0xEB09017F, 0x54000040, 0xF9412948,	0xA8C12FEA
-};
-#define FREE_CODE_OFF_2ND_100 (FREE_CODE_OFF_1ST_100 + sizeof(PRC_ID_SND_100) + sizeof(u32))
-static u32 PRC_ID_RCV_100[] =
-{
-	0xA9BF2FEA, 0x2A1C03EA, 0xD37EF54A, 0xF86A69AA, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A,
-	0xD2FFFFC9, 0xEB09015F, 0x54000040, 0xF9412968, 0xA8C12FEA
-};
-
-static u32 PRC_ID_SND_200[] =
-{
-	0xA9BF2FEA, 0x2A1803EB, 0xD37EF56B, 0xF86B6B8B, 0x92FFFFE9, 0x8A090168, 0xD2FFFFE9, 0x8A09016B,
-	0xD2FFFFC9, 0xEB09017F, 0x54000040, 0xF9413148, 0xA8C12FEA
-};
-#define FREE_CODE_OFF_2ND_200 (FREE_CODE_OFF_1ST_200 + sizeof(PRC_ID_SND_200) + sizeof(u32))
-static u32 PRC_ID_RCV_200[] =
-{
-	0xA9BF2FEA, 0x2A0F03EA, 0xD37EF54A, 0xF9405FEB, 0xF86A696A, 0xF9407BEB, 0x92FFFFE9, 0x8A090148,
-	0xD2FFFFE9, 0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000040, 0xF9413168, 0xA8C12FEA
-};
-
-static u32 PRC_ID_SND_300[] =
-{
-	0xA9BF2FEA, 0x2A1803EB, 0xD37EF56B, 0xF86B6B8B, 0x92FFFFE9, 0x8A090168, 0xD2FFFFE9, 0x8A09016B,
-	0xD2FFFFC9, 0xEB09017F, 0x54000040, 0xF9415548, 0xA8C12FEA
-};
-#define FREE_CODE_OFF_2ND_300 (FREE_CODE_OFF_1ST_300 + sizeof(PRC_ID_SND_300) + sizeof(u32))
-static u32 PRC_ID_RCV_300[] =
-{
-	0xA9BF2FEA, 0x2A0F03EA, 0xD37EF54A, 0xF9405FEB, 0xF86A696A, 0xF9407BEB, 0x92FFFFE9, 0x8A090148,
-	0xD2FFFFE9, 0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000040, 0xF9415568, 0xA8C12FEA
-};
-
-#define FREE_CODE_OFF_2ND_302 (FREE_CODE_OFF_1ST_302 + sizeof(PRC_ID_SND_300) + sizeof(u32))
-
-static u32 PRC_ID_SND_400[] =
-{
-	0x2A1703EA, 0xD37EF54A, 0xF86A6B8A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A, 0xD2FFFFC9,
-	0xEB09015F, 0x54000060, 0xF94053EA, 0xF9415948, 0xF94053EA
-};
-#define FREE_CODE_OFF_2ND_400 (FREE_CODE_OFF_1ST_400 + sizeof(PRC_ID_SND_400) + sizeof(u32))
-static u32 PRC_ID_RCV_400[] =
-{
-	0xF9403BED, 0x2A0E03EA, 0xD37EF54A, 0xF86A69AA, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A,
-	0xD2FFFFC9, 0xEB09015F, 0x54000040, 0xF9415B28, 0xD503201F
-};
-
-static u32 PRC_ID_SND_500[] =
-{
-	0x2A1703EA, 0xD37EF54A, 0xF86A6B6A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A, 0xD2FFFFC9,
-	0xEB09015F, 0x54000060, 0xF94043EA, 0xF9415948, 0xF94043EA
-};
-#define FREE_CODE_OFF_2ND_500 (FREE_CODE_OFF_1ST_500 + sizeof(PRC_ID_SND_500) + sizeof(u32))
-static u32 PRC_ID_RCV_500[] =
-{
-	0xF9403BED, 0x2A1503EA, 0xD37EF54A, 0xF86A69AA, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A,
-	0xD2FFFFC9, 0xEB09015F, 0x54000040, 0xF9415B08, 0xF9406FEA
-};
-
-static u32 PRC_ID_SND_600[] =
-{
-	0xA9BF2FEA, 0xF94037EB, 0x2A1503EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
-	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400308, 0xF9401D08, 0xAA1803E0,
-	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
-};
-#define FREE_CODE_OFF_2ND_600 (FREE_CODE_OFF_1ST_600 + sizeof(PRC_ID_SND_600) + sizeof(u32))
-static u32 PRC_ID_RCV_600[] =
-{
-	0xA9BF2FEA, 0xF94043EB, 0x2A1503EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
-	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400308, 0xF9401D08, 0xAA1803E0,
-	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
-};
-
-static u32 PRC_ID_SND_700[] =
-{
-	0xA9BF2FEA, 0xF9403BEB, 0x2A1903EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
-	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF94002A8, 0xF9401D08, 0xAA1503E0,
-	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
-};
-#define FREE_CODE_OFF_2ND_700 (FREE_CODE_OFF_1ST_700 + sizeof(PRC_ID_SND_700) + sizeof(u32))
-static u32 PRC_ID_RCV_700[] =
-{
-	0xA9BF2FEA, 0xF9404FEB, 0x2A1603EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
-	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400368, 0xF9401D08, 0xAA1B03E0,
-	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
-};
-
-#define FREE_CODE_OFF_2ND_800 (FREE_CODE_OFF_1ST_800 + sizeof(PRC_ID_SND_700) + sizeof(u32))
-
-static u32 PRC_ID_SND_900[] =
-{
-	0xA9BF2FEA, 0xF94037EB, 0x2A1603EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
-	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF94002E8, 0xF9401D08, 0xAA1703E0,
-	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
-};
-#define FREE_CODE_OFF_2ND_900 (FREE_CODE_OFF_1ST_900 + sizeof(PRC_ID_SND_900) + sizeof(u32))
-static u32 PRC_ID_RCV_900[] =
-{
-	0xA9BF2FEA, 0xF9404BEB, 0x2A1703EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
-	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400368, 0xF9401D08, 0xAA1B03E0,
-	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
-};
-
-static u32 PRC_ID_SND_1000[] =
-{
-	0xA9BF2FEA, 0xF94063EB, 0x2A1603EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
-	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF94002E8, 0xF9401D08, 0xAA1703E0,
-	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
-};
-#define FREE_CODE_OFF_2ND_1000 (FREE_CODE_OFF_1ST_1000 + sizeof(PRC_ID_SND_1000) + sizeof(u32))
-static u32 PRC_ID_RCV_1000[] =
-{
-	0xA9BF2FEA, 0xF94067EB, 0x2A1A03EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
-	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400388, 0xF9401D08, 0xAA1C03E0,
-	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
-};
-
-static u32 PRC_ID_SND_1100[] =
-{
-	0xA9BF2FEA, 0xF94043EB, 0x5280006A, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
-	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF94002A8, 0xF9401D08, 0xAA1503E0,
-	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
-};
-#define FREE_CODE_OFF_2ND_1100 (FREE_CODE_OFF_1ST_1100 + sizeof(PRC_ID_SND_1100) + sizeof(u32))
-static u32 PRC_ID_RCV_1100[] =
-{
-	0xA9BF2FEA, 0xF94073EB, 0x5280006A, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
-	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400308, 0xF9401D08, 0xAA1803E0,
-	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
-};
-
-// Include kernel patches here, so we can utilize pkg1 id
-KERNEL_PATCHSET_DEF(_kernel_1_patchset,
-	{ SVC_VERIFY_DS, 0x3764C, _NOP(), NULL },          // Disable SVC verifications
-	{ DEBUG_MODE_EN, 0x44074, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
-	// Atmosphère kernel patches.
-	{ ATM_GEN_PATCH, ID_SND_OFF_100, _B(ID_SND_OFF_100, FREE_CODE_OFF_1ST_100), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_100, sizeof(PRC_ID_SND_100) >> 2, PRC_ID_SND_100}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_100 + sizeof(PRC_ID_SND_100),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_1ST_100 + sizeof(PRC_ID_SND_100), ID_SND_OFF_100 + sizeof(u32)), NULL},
-	{ ATM_GEN_PATCH, ID_RCV_OFF_100, _B(ID_RCV_OFF_100, FREE_CODE_OFF_2ND_100), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_100, sizeof(PRC_ID_RCV_100) >> 2, PRC_ID_RCV_100}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_100 + sizeof(PRC_ID_RCV_100),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_2ND_100 + sizeof(PRC_ID_RCV_100), ID_RCV_OFF_100 + sizeof(u32)), NULL}
-);
-
-KERNEL_PATCHSET_DEF(_kernel_2_patchset,
-	{ SVC_VERIFY_DS, 0x54834, _NOP(), NULL },          // Disable SVC verifications
-	{ DEBUG_MODE_EN, 0x6086C, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
-	// Atmosphère kernel patches.
-	{ ATM_GEN_PATCH, ID_SND_OFF_200, _B(ID_SND_OFF_200, FREE_CODE_OFF_1ST_200), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_200, sizeof(PRC_ID_SND_200) >> 2, PRC_ID_SND_200}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_200 + sizeof(PRC_ID_SND_200),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_1ST_200 + sizeof(PRC_ID_SND_200), ID_SND_OFF_200 + sizeof(u32)), NULL},
-	{ ATM_GEN_PATCH, ID_RCV_OFF_200, _B(ID_RCV_OFF_200, FREE_CODE_OFF_2ND_200), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_200, sizeof(PRC_ID_RCV_200) >> 2, PRC_ID_RCV_200}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_200 + sizeof(PRC_ID_RCV_200),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_2ND_200 + sizeof(PRC_ID_RCV_200), ID_RCV_OFF_200 + sizeof(u32)), NULL}
-);
-
-KERNEL_PATCHSET_DEF(_kernel_3_patchset,
-	{ SVC_VERIFY_DS, 0x3BD24, _NOP(), NULL },          // Disable SVC verifications
-	{ DEBUG_MODE_EN, 0x483FC, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
-	// Atmosphère kernel patches.
-	{ ATM_GEN_PATCH, ID_SND_OFF_300, _B(ID_SND_OFF_300, FREE_CODE_OFF_1ST_300), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_300, sizeof(PRC_ID_SND_300) >> 2, PRC_ID_SND_300}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_300 + sizeof(PRC_ID_SND_300),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_1ST_300 + sizeof(PRC_ID_SND_300), ID_SND_OFF_300 + sizeof(u32)), NULL},
-	{ ATM_GEN_PATCH, ID_RCV_OFF_300, _B(ID_RCV_OFF_300, FREE_CODE_OFF_2ND_300), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_300, sizeof(PRC_ID_RCV_300) >> 2, PRC_ID_RCV_300}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_300 + sizeof(PRC_ID_RCV_300),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_2ND_300 + sizeof(PRC_ID_RCV_300), ID_RCV_OFF_300 + sizeof(u32)), NULL}
-);
-
-KERNEL_PATCHSET_DEF(_kernel_302_patchset,
-	{ SVC_VERIFY_DS, 0x3BD24, _NOP(), NULL },          // Disable SVC verifications
-	{ DEBUG_MODE_EN, 0x48414, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
-	// Atmosphère kernel patches.
-	{ ATM_GEN_PATCH, ID_SND_OFF_302, _B(ID_SND_OFF_302, FREE_CODE_OFF_1ST_302), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_302, sizeof(PRC_ID_SND_300) >> 2, PRC_ID_SND_300}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_302 + sizeof(PRC_ID_SND_300),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_1ST_302 + sizeof(PRC_ID_SND_300), ID_SND_OFF_302 + sizeof(u32)), NULL},
-	{ ATM_GEN_PATCH, ID_RCV_OFF_302, _B(ID_RCV_OFF_302, FREE_CODE_OFF_2ND_302), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_302, sizeof(PRC_ID_RCV_300) >> 2, PRC_ID_RCV_300}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_302 + sizeof(PRC_ID_RCV_300),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_2ND_302 + sizeof(PRC_ID_RCV_300), ID_RCV_OFF_302 + sizeof(u32)), NULL}
-);
-
-KERNEL_PATCHSET_DEF(_kernel_4_patchset,
-	{ SVC_VERIFY_DS, 0x41EB4, _NOP(), NULL },          // Disable SVC verifications
-	{ DEBUG_MODE_EN, 0x4EBFC, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
-	// Atmosphère kernel patches.
-	{ ATM_GEN_PATCH, ID_SND_OFF_400, _B(ID_SND_OFF_400, FREE_CODE_OFF_1ST_400), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_400, sizeof(PRC_ID_SND_400) >> 2, PRC_ID_SND_400}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_400 + sizeof(PRC_ID_SND_400),                      // Branch back and skip 2 instructions.
-		_B(FREE_CODE_OFF_1ST_400 + sizeof(PRC_ID_SND_400), ID_SND_OFF_400 + sizeof(u32) * 2), NULL},
-	{ ATM_GEN_PATCH, ID_RCV_OFF_400, _B(ID_RCV_OFF_400, FREE_CODE_OFF_2ND_400), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_400, sizeof(PRC_ID_RCV_400) >> 2, PRC_ID_RCV_400}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_400 + sizeof(PRC_ID_RCV_400),                      // Branch back and skip 1 instruction.
-		_B(FREE_CODE_OFF_2ND_400 + sizeof(PRC_ID_RCV_400), ID_RCV_OFF_400 + sizeof(u32)), NULL}
-);
-
-KERNEL_PATCHSET_DEF(_kernel_5_patchset,
-	{ SVC_GENERIC,   0x38C2C, _NOP(), NULL },          // Allow same process on svcControlCodeMemory.
-	{ SVC_VERIFY_DS, 0x45E6C, _NOP(), NULL },          // Disable SVC verifications
-	{ DEBUG_MODE_EN, 0x5513C, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
-	// Atmosphère kernel patches.
-	{ ATM_SYSM_INCR, 0x54E30, _MOVZW(8, 0x1E00, LSL16), NULL }, // System memory pool increase.
-	{ ATM_GEN_PATCH, ID_SND_OFF_500, _B(ID_SND_OFF_500, FREE_CODE_OFF_1ST_500), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_500, sizeof(PRC_ID_SND_500) >> 2, PRC_ID_SND_500}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_500 + sizeof(PRC_ID_SND_500),                      // Branch back and skip 2 instructions.
-		_B(FREE_CODE_OFF_1ST_500 + sizeof(PRC_ID_SND_500), ID_SND_OFF_500 + sizeof(u32) * 2), NULL},
-	{ ATM_GEN_PATCH, ID_RCV_OFF_500, _B(ID_RCV_OFF_500, FREE_CODE_OFF_2ND_500), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_500, sizeof(PRC_ID_RCV_500) >> 2, PRC_ID_RCV_500}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_500 + sizeof(PRC_ID_RCV_500),                      // Branch back and skip 2 instructions.
-		_B(FREE_CODE_OFF_2ND_500 + sizeof(PRC_ID_RCV_500), ID_RCV_OFF_500 + sizeof(u32) * 2), NULL}
-);
-
-KERNEL_PATCHSET_DEF(_kernel_6_patchset,
-	{ SVC_GENERIC,   0x3A8CC, _NOP(), NULL },          // Allow same process on svcControlCodeMemory.
-	{ SVC_VERIFY_DS, 0x47EA0, _NOP(), NULL },          // Disable SVC verifications
-	{ DEBUG_MODE_EN, 0x57548, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
-	// Atmosphère kernel patches.
-	{ ATM_SYSM_INCR, 0x57330, _MOVZW(8, 0x1D80, LSL16), NULL }, // System memory pool increase.
-	{ ATM_GEN_PATCH, ID_SND_OFF_600, _B(ID_SND_OFF_600, FREE_CODE_OFF_1ST_600), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_600, sizeof(PRC_ID_SND_600) >> 2, PRC_ID_SND_600}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_600 + sizeof(PRC_ID_SND_600),                      // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_1ST_600 + sizeof(PRC_ID_SND_600), ID_SND_OFF_600 + sizeof(u32) * 4), NULL},
-	{ ATM_GEN_PATCH, ID_RCV_OFF_600, _B(ID_RCV_OFF_600, FREE_CODE_OFF_2ND_600), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_600, sizeof(PRC_ID_RCV_600) >> 2, PRC_ID_RCV_600}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_600 + sizeof(PRC_ID_RCV_600),                      // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_2ND_600 + sizeof(PRC_ID_RCV_600), ID_RCV_OFF_600 + sizeof(u32) * 4), NULL}
-);
-
-KERNEL_PATCHSET_DEF(_kernel_7_patchset,
-	{ SVC_GENERIC,   0x3C6E0, _NOP(), NULL },          // Allow same process on svcControlCodeMemory.
-	{ SVC_VERIFY_DS, 0x49E5C, _NOP(), NULL },          // Disable SVC verifications
-	{ DEBUG_MODE_EN, 0x581B0, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
-	// Atmosphère kernel patches.
-	{ ATM_SYSM_INCR, 0x57F98, _MOVZW(8, 0x1D80, LSL16), NULL }, // System memory pool increase.
-	{ ATM_GEN_PATCH, ID_SND_OFF_700, _B(ID_SND_OFF_700, FREE_CODE_OFF_1ST_700), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_700, sizeof(PRC_ID_SND_700) >> 2, PRC_ID_SND_700}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_700 + sizeof(PRC_ID_SND_700),                      // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_1ST_700 + sizeof(PRC_ID_SND_700), ID_SND_OFF_700 + sizeof(u32) * 4), NULL},
-	{ ATM_GEN_PATCH, ID_RCV_OFF_700, _B(ID_RCV_OFF_700, FREE_CODE_OFF_2ND_700), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_700, sizeof(PRC_ID_RCV_700) >> 2, PRC_ID_RCV_700}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_700 + sizeof(PRC_ID_RCV_700),                      // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_2ND_700 + sizeof(PRC_ID_RCV_700), ID_RCV_OFF_700 + sizeof(u32) * 4), NULL}
-);
-
-KERNEL_PATCHSET_DEF(_kernel_8_patchset,
-	{ SVC_GENERIC,   0x3FAD0, _NOP(), NULL },          // Allow same process on svcControlCodeMemory.
-	{ SVC_VERIFY_DS, 0x4D15C, _NOP(), NULL },          // Disable SVC verifications
-	{ DEBUG_MODE_EN, 0x5BFAC, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
-	// Atmosphère kernel patches.
-	{ ATM_SYSM_INCR, 0x5F9A4, _MOVZW(19, 0x1D80, LSL16), NULL }, // System memory pool increase.
-	{ ATM_GEN_PATCH, ID_SND_OFF_800, _B(ID_SND_OFF_800, FREE_CODE_OFF_1ST_800), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_800, sizeof(PRC_ID_SND_700) >> 2, PRC_ID_SND_700}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_800 + sizeof(PRC_ID_SND_700),                      // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_1ST_800 + sizeof(PRC_ID_SND_700), ID_SND_OFF_800 + sizeof(u32) * 4), NULL},
-	{ ATM_GEN_PATCH, ID_RCV_OFF_800, _B(ID_RCV_OFF_800, FREE_CODE_OFF_2ND_800), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_800, sizeof(PRC_ID_RCV_700) >> 2, PRC_ID_RCV_700}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_800 + sizeof(PRC_ID_RCV_700),                      // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_2ND_800 + sizeof(PRC_ID_RCV_700), ID_RCV_OFF_800 + sizeof(u32) * 4), NULL}
-);
-
-KERNEL_PATCHSET_DEF(_kernel_9_patchset,
-	{ SVC_GENERIC,   0x43DFC, _NOP(), NULL },          // Allow same process on svcControlCodeMemory.
-	{ SVC_VERIFY_DS, 0x50628, _NOP(), NULL },          // Disable SVC verifications
-	{ DEBUG_MODE_EN, 0x609E8, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
-	// Atmosphère kernel patches.
-	{ ATM_SYSM_INCR, 0x6493C, _MOVZW(19, 0x1D80, LSL16), NULL }, // System memory pool increase.
-	{ ATM_GEN_PATCH, ID_SND_OFF_900, _B(ID_SND_OFF_900, FREE_CODE_OFF_1ST_900), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_900, sizeof(PRC_ID_SND_900) >> 2, PRC_ID_SND_900}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_900 + sizeof(PRC_ID_SND_900),                      // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_1ST_900 + sizeof(PRC_ID_SND_900), ID_SND_OFF_900 + sizeof(u32) * 4), NULL},
-	{ ATM_GEN_PATCH, ID_RCV_OFF_900, _B(ID_RCV_OFF_900, FREE_CODE_OFF_2ND_900), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_900, sizeof(PRC_ID_RCV_900) >> 2, PRC_ID_RCV_900}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_900 + sizeof(PRC_ID_RCV_900),                      // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_2ND_900 + sizeof(PRC_ID_RCV_900), ID_RCV_OFF_900 + sizeof(u32) * 4), NULL}
-);
-
-KERNEL_PATCHSET_DEF(_kernel_10_patchset,
-	{ SVC_GENERIC,   0x45DAC, _NOP(), NULL },          // Allow same process on svcControlCodeMemory.
-	{ SVC_VERIFY_DS, 0x523E4, _NOP(), NULL },          // Disable SVC verifications.
-	{ DEBUG_MODE_EN, 0x62B14, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch.
-	// Atmosphère kernel patches.
-	{ ATM_SYSM_INCR, 0x66950, _MOVZW(19, 0x1D80, LSL16), NULL }, // System memory pool increase.
-	{ ATM_GEN_PATCH, ID_SND_OFF_1000, _B(ID_SND_OFF_1000, FREE_CODE_OFF_1ST_1000), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_1000, sizeof(PRC_ID_SND_1000) >> 2, PRC_ID_SND_1000}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_1000 + sizeof(PRC_ID_SND_1000),                       // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_1ST_1000 + sizeof(PRC_ID_SND_1000), ID_SND_OFF_1000 + sizeof(u32) * 4), NULL},
-	{ ATM_GEN_PATCH, ID_RCV_OFF_1000, _B(ID_RCV_OFF_1000, FREE_CODE_OFF_2ND_1000), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_1000, sizeof(PRC_ID_RCV_1000) >> 2, PRC_ID_RCV_1000}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_1000 + sizeof(PRC_ID_RCV_1000),                       // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_2ND_1000 + sizeof(PRC_ID_RCV_1000), ID_RCV_OFF_1000 + sizeof(u32) * 4), NULL}
-);
-
-KERNEL_PATCHSET_DEF(_kernel_11_patchset,
-	{ SVC_GENERIC,   0x2FCE0, _NOP(), NULL },          // Allow same process on svcControlCodeMemory.
-	{ SVC_VERIFY_DS, 0x39194, _NOP(), NULL },          // Disable SVC verifications.
-	{ DEBUG_MODE_EN, 0x460C0, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch.
-	// Atmosphère kernel patches.
-	{ ATM_SYSM_INCR, 0x490C4, _MOVZW(21, 0x1D80, LSL16), NULL }, // System memory pool increase.
-	{ ATM_GEN_PATCH, ID_SND_OFF_1100, _B(ID_SND_OFF_1100, FREE_CODE_OFF_1ST_1100), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_1100, sizeof(PRC_ID_SND_1100) >> 2, PRC_ID_SND_1100}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_1100 + sizeof(PRC_ID_SND_1100),                       // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_1ST_1100 + sizeof(PRC_ID_SND_1100), ID_SND_OFF_1100 + sizeof(u32) * 4), NULL},
-	{ ATM_GEN_PATCH, ID_RCV_OFF_1100, _B(ID_RCV_OFF_1100, FREE_CODE_OFF_2ND_1100), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_1100, sizeof(PRC_ID_RCV_1100) >> 2, PRC_ID_RCV_1100}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_1100 + sizeof(PRC_ID_RCV_1100),                       // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_2ND_1100 + sizeof(PRC_ID_RCV_1100), ID_RCV_OFF_1100 + sizeof(u32) * 4), NULL}
-);
-
-KERNEL_PATCHSET_DEF(_kernel_1101_patchset,
-	{ SVC_GENERIC,   0x2FD04, _NOP(), NULL },          // Allow same process on svcControlCodeMemory.
-	{ SVC_VERIFY_DS, 0x39194, _NOP(), NULL },          // Disable SVC verifications.
-	{ DEBUG_MODE_EN, 0x460C0, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch.
-	// Atmosphère kernel patches.
-	{ ATM_SYSM_INCR, 0x490C4, _MOVZW(21, 0x1D80, LSL16), NULL }, // System memory pool increase.
-	{ ATM_GEN_PATCH, ID_SND_OFF_1101, _B(ID_SND_OFF_1101, FREE_CODE_OFF_1ST_1100), NULL},    // Send process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_1ST_1100, sizeof(PRC_ID_SND_1100) >> 2, PRC_ID_SND_1100}, // Send process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_1ST_1100 + sizeof(PRC_ID_SND_1100),                       // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_1ST_1100 + sizeof(PRC_ID_SND_1100), ID_SND_OFF_1101 + sizeof(u32) * 4), NULL},
-	{ ATM_GEN_PATCH, ID_RCV_OFF_1101, _B(ID_RCV_OFF_1101, FREE_CODE_OFF_2ND_1100), NULL},    // Receive process id branch.
-	{ ATM_ARR_PATCH, FREE_CODE_OFF_2ND_1100, sizeof(PRC_ID_RCV_1100) >> 2, PRC_ID_RCV_1100}, // Receive process id code.
-	{ ATM_GEN_PATCH, FREE_CODE_OFF_2ND_1100 + sizeof(PRC_ID_RCV_1100),                       // Branch back and skip 4 instructions.
-		_B(FREE_CODE_OFF_2ND_1100 + sizeof(PRC_ID_RCV_1100), ID_RCV_OFF_1101 + sizeof(u32) * 4), NULL}
-);
-
-// Kernel sha256 hashes.
-static const pkg2_kernel_id_t _pkg2_kernel_ids[] =
-{
-	{ "\xb8\xc5\x0c\x68\x25\xa9\xb9\x5b", _kernel_1_patchset },   //  1.0.0
-	{ "\x64\x0b\x51\xff\x28\x01\xb8\x30", _kernel_2_patchset },   //  2.0.0 - 2.3.0
-	{ "\x50\x84\x23\xac\x6f\xa1\x5d\x3b", _kernel_3_patchset },   //  3.0.0 - 3.0.1
-	{ "\x81\x9d\x08\xbe\xe4\x5e\x1f\xbb", _kernel_302_patchset }, //  3.0.2
-	{ "\xe6\xc0\xb7\xe3\x2f\xf9\x44\x51", _kernel_4_patchset },   //  4.0.0 - 4.1.0
-	{ "\xb2\x38\x61\xa8\xe1\xe2\xe4\xe4", _kernel_5_patchset },   //  5.0.0 - 5.1.0
-	{ "\x85\x97\x40\xf6\xc0\x3e\x3d\x44", _kernel_6_patchset },   //  6.0.0 - 6.2.0
-	{ "\xa2\x5e\x47\x0c\x8e\x6d\x2f\xd7", _kernel_7_patchset },   //  7.0.0 - 7.0.1
-	{ "\xf1\x5e\xc8\x34\xfd\x68\xf0\xf0", _kernel_8_patchset },   //  8.0.0 - 8.1.0. Kernel only.
-	{ "\x69\x00\x39\xdf\x21\x56\x70\x6b", _kernel_9_patchset },   //  9.0.0 - 9.1.0. Kernel only.
-	{ "\xa2\xe3\xad\x1c\x98\xd8\x7a\x62", _kernel_9_patchset },   //  9.2.0. Kernel only.
-	{ "\x21\xc1\xd7\x24\x8e\xcd\xbd\xa8", _kernel_10_patchset },  // 10.0.0. Kernel only.
-	{ "\xD5\xD0\xBA\x5D\x52\xB9\x77\x85", _kernel_11_patchset },  // 11.0.0. Kernel only.
-	{ "\xF8\x1E\xE0\x30\x3C\x7A\x08\x04", _kernel_1101_patchset },// 11.0.1. Kernel only.
-};
-
 enum kip_offset_section
 {
 	KIP_TEXT    = 0,
@@ -463,272 +65,7 @@ enum kip_offset_section
 #define GET_KIP_PATCH_OFFSET(x)  ((x) & KIP_PATCH_OFFSET_MASK)
 #define KPS(x) ((u32)(x) << KIP_PATCH_SECTION_SHIFT)
 
-static kip1_patch_t _fs_emummc[] =
-{
-	{ KPS(KIP_TEXT) | 1, 0, "", "" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_100[] =
-{
-	{ "nogc",     NULL },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_40x[] =
-{
-	{ KPS(KIP_TEXT) | 0xA3458, 4, "\x14\x40\x80\x72", "\x14\x80\x80\x72" },
-	{ KPS(KIP_TEXT) | 0xAAB44, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_40x[] =
-{
-	{ "nogc",     _fs_nogc_40x },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_410[] =
-{
-	{ KPS(KIP_TEXT) | 0xA34BC, 4, "\x14\x40\x80\x72", "\x14\x80\x80\x72" },
-	{ KPS(KIP_TEXT) | 0xAABA8, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_410[] =
-{
-	{ "nogc",     _fs_nogc_410 },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_50x[] =
-{
-	{ KPS(KIP_TEXT) | 0xCF3C4, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
-	{ KPS(KIP_TEXT) | 0xD73A0, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_50x[] =
-{
-	{ "nogc",     _fs_nogc_50x },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_510[] =
-{
-	{ KPS(KIP_TEXT) | 0xCF794, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
-	{ KPS(KIP_TEXT) | 0xD7770, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_510[] =
-{
-	{ "nogc",     _fs_nogc_510 },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_600[] =
-{
-	{ KPS(KIP_TEXT) | 0x12CC20, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ KPS(KIP_TEXT) | 0x1538F4, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_600_exfat[] =
-{
-	{ KPS(KIP_TEXT) | 0x138320, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ KPS(KIP_TEXT) | 0x15EFF4, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_600[] =
-{
-	{ "nogc",     _fs_nogc_600 },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_600_exfat[] =
-{
-	{ "nogc",     _fs_nogc_600_exfat },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_700[] =
-{
-	{ KPS(KIP_TEXT) | 0x134160, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ KPS(KIP_TEXT) | 0x15BF04, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_700_exfat[] =
-{
-	{ KPS(KIP_TEXT) | 0x13F710, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ KPS(KIP_TEXT) | 0x1674B4, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_700[] =
-{
-	{ "nogc",     _fs_nogc_700 },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_700_exfat[] =
-{
-	{ "nogc",     _fs_nogc_700_exfat },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_800[] =
-{
-	{ KPS(KIP_TEXT) | 0x136800, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ KPS(KIP_TEXT) | 0x15EB94, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_800_exfat[] =
-{
-	{ KPS(KIP_TEXT) | 0x141DB0, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ KPS(KIP_TEXT) | 0x16A144, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_800[] =
-{
-	{ "nogc",     _fs_nogc_800 },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_800_exfat[] =
-{
-	{ "nogc",     _fs_nogc_800_exfat },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_900[] =
-{
-	{ KPS(KIP_TEXT) | 0x129420, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ KPS(KIP_TEXT) | 0x143268, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_900[] =
-{
-	{ "nogc",     _fs_nogc_900 },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_910[] =
-{
-	{ KPS(KIP_TEXT) | 0x129430, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ KPS(KIP_TEXT) | 0x143278, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_910[] =
-{
-	{ "nogc",     _fs_nogc_910 },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_1000[] =
-{
-	{ KPS(KIP_TEXT) | 0x13BE90, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ KPS(KIP_TEXT) | 0x14DE08, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_1000[] =
-{
-	{ "nogc",     _fs_nogc_1000 },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_1020[] =
-{
-	{ KPS(KIP_TEXT) | 0x13C2F0, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ KPS(KIP_TEXT) | 0x14E268, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_1020[] =
-{
-	{ "nogc",     _fs_nogc_1020 },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-static kip1_patch_t _fs_nogc_1100[] =
-{
-	{ KPS(KIP_TEXT) | 0x1398B4, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
-	{ KPS(KIP_TEXT) | 0x156EB8, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
-	{ 0, 0, NULL, NULL }
-};
-
-static kip1_patchset_t _fs_patches_1100[] =
-{
-	{ "nogc",     _fs_nogc_1100 },
-	{ "emummc",   _fs_emummc },
-	{ NULL, NULL }
-};
-
-
-// SHA256 hashes.
-static kip1_id_t _kip_ids[] =
-{
-	{ "FS", "\xde\x9f\xdd\xa4\x08\x5d\xd5\xfe", _fs_patches_100 },       // FS 1.0.0
-	{ "FS", "\xfc\x3e\x80\x99\x1d\xca\x17\x96", _fs_patches_100 },       // FS 1.0.0 exfat
-	{ "FS", "\xcd\x7b\xbe\x18\xd6\x13\x0b\x28", _fs_patches_100 },       // FS 2.0.0
-	{ "FS", "\xe7\x66\x92\xdf\xaa\x04\x20\xe9", _fs_patches_100 },       // FS 2.0.0 exfat
-	{ "FS", "\x0d\x70\x05\x62\x7b\x07\x76\x7c", _fs_patches_100 },       // FS 2.1.0
-	{ "FS", "\xdb\xd8\x5f\xca\xcc\x19\x3d\xa8", _fs_patches_100 },       // FS 2.1.0 exfat
-	{ "FS", "\xa8\x6d\xa5\xe8\x7e\xf1\x09\x7b", _fs_patches_100 },       // FS 3.0.0
-	{ "FS", "\x98\x1c\x57\xe7\xf0\x2f\x70\xf7", _fs_patches_100 },       // FS 3.0.0 exfat
-	{ "FS", "\x57\x39\x7c\x06\x3f\x10\xb6\x31", _fs_patches_100 },       // FS 3.0.1
-	{ "FS", "\x07\x30\x99\xd7\xc6\xad\x7d\x89", _fs_patches_100 },       // FS 3.0.1 exfat
-	{ "FS", "\x06\xe9\x07\x19\x59\x5a\x01\x0c", _fs_patches_40x },       // FS 4.0.1
-	{ "FS", "\x54\x9b\x0f\x8d\x6f\x72\xc4\xe9", _fs_patches_40x },       // FS 4.0.1 exfat
-	{ "FS", "\x80\x96\xaf\x7c\x6a\x35\xaa\x82", _fs_patches_410 },       // FS 4.1.0
-	{ "FS", "\x02\xd5\xab\xaa\xfd\x20\xc8\xb0", _fs_patches_410 },       // FS 4.1.0 exfat
-	{ "FS", "\xa6\xf2\x7a\xd9\xac\x7c\x73\xad", _fs_patches_50x },       // FS 5.0.0
-	{ "FS", "\xce\x3e\xcb\xa2\xf2\xf0\x62\xf5", _fs_patches_50x },       // FS 5.0.0 exfat
-	{ "FS", "\x76\xf8\x74\x02\xc9\x38\x7c\x0f", _fs_patches_510 },       // FS 5.1.0
-	{ "FS", "\x10\xb2\xd8\x16\x05\x48\x85\x99", _fs_patches_510 },       // FS 5.1.0 exfat
-	{ "FS", "\x1b\x82\xcb\x22\x18\x67\xcb\x52", _fs_patches_600 },       // FS 6.0.0-4.0
-	{ "FS", "\x96\x6a\xdd\x3d\x20\xb6\x27\x13", _fs_patches_600_exfat }, // FS 6.0.0-4.0 exfat
-	{ "FS", "\x3a\x57\x4d\x43\x61\x86\x19\x1d", _fs_patches_600 },       // FS 6.0.0-5.0
-	{ "FS", "\x33\x05\x53\xf6\xb5\xfb\x55\xc4", _fs_patches_600_exfat }, // FS 6.0.0-5.0 exfat
-	{ "FS", "\x2A\xDB\xE9\x7E\x9B\x5F\x41\x77", _fs_patches_700 },       // FS 7.0.0
-	{ "FS", "\x2C\xCE\x65\x9C\xEC\x53\x6A\x8E", _fs_patches_700_exfat }, // FS 7.0.0 exfat
-	{ "FS", "\xB2\xF5\x17\x6B\x35\x48\x36\x4D", _fs_patches_800 },       // FS 8.0.0
-	{ "FS", "\xDB\xD9\x41\xC0\xC5\x3C\x52\xCC", _fs_patches_800_exfat }, // FS 8.0.0 exfat
-	{ "FS", "\x6B\x09\xB6\x7B\x29\xC0\x20\x24", _fs_patches_800 },       // FS 8.1.0
-	{ "FS", "\xB4\xCA\xE1\xF2\x49\x65\xD9\x2E", _fs_patches_800_exfat }, // FS 8.1.0 exfat
-	{ "FS", "\x46\x87\x40\x76\x1E\x19\x3E\xB7", _fs_patches_900 },       // FS 9.0.0
-	{ "FS", "\x7C\x95\x13\x76\xE5\xC1\x2D\xF8", _fs_patches_900 },       // FS 9.0.0 exfat
-	{ "FS", "\xB5\xE7\xA6\x4C\x6F\x5C\x4F\xE3", _fs_patches_910 },       // FS 9.1.0
-	{ "FS", "\xF1\x96\xD1\x44\xD0\x44\x45\xB6", _fs_patches_910 },       // FS 9.1.0 exfat
-	{ "FS", "\x3E\xEB\xD9\xB7\xBC\xD1\xB5\xE0", _fs_patches_1000 },      // FS 10.0.0
-	{ "FS", "\x81\x7E\xA2\xB0\xB7\x02\xC1\xF3", _fs_patches_1000 },      // FS 10.0.0 exfat
-	{ "FS", "\xA9\x52\xB6\x57\xAD\xF9\xC2\xBA", _fs_patches_1020 },      // FS 10.2.0
-	{ "FS", "\x16\x0D\x3E\x10\x4E\xAD\x61\x76", _fs_patches_1020 },      // FS 10.2.0 exfat
-	{ "FS", "\xE3\x99\x15\x6E\x84\x4E\xB0\xAA", _fs_patches_1100 },      // FS 11.0.0
-	{ "FS", "\x0B\xA1\x5B\xB3\x04\xB5\x05\x63", _fs_patches_1100 },      // FS 11.0.0 exfat
-};
+#include "pkg2_patches.inl"
 
 static kip1_id_t *_kip_id_sets = _kip_ids;
 static u32 _kip_id_sets_cnt = ARRAY_SIZE(_kip_ids);
@@ -1133,7 +470,7 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 				if (numPatches >= MAX_NUM_PATCHES_REQUESTED)
 					return "too_many_patches";
 			}
-			else if (*p >= 'A' && *p <= 'Z')
+			else if (*p >= 'A' && *p <= 'Z') // Convert to lowercase.
 				*p += 0x20;
 		}
 	}
@@ -1258,15 +595,15 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 						emummc_patch_selected = true;
 						patchesApplied |= appliedMask;
 
-						break;
+						continue; // Patching is done later.
 					}
 
 					if (currPatchset->patches == NULL)
 					{
-						gfx_printf("Patch '%s' not necessary for %s KIP1\n", currPatchset->name, (const char*)ki->kip1->name);
+						DPRINTF("Patch '%s' not necessary for %s KIP1\n", currPatchset->name, (const char*)ki->kip1->name);
 						patchesApplied |= appliedMask;
 
-						break;
+						continue; // Continue in case it's double defined.
 					}
 
 					unsigned char* kipSectData = ki->kip1->data;
@@ -1288,7 +625,7 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 								}
 
 								u32 currOffset = GET_KIP_PATCH_OFFSET(currPatch->offset);
-								// If source is does not match and is not already patched, throw an error.
+								// If source does not match and is not already patched, throw an error.
 								if ((memcmp(&kipSectData[currOffset], currPatch->srcData, currPatch->length) != 0) &&
 									(memcmp(&kipSectData[currOffset], currPatch->dstData, currPatch->length) != 0))
 								{
@@ -1307,11 +644,12 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 					}
 
 					patchesApplied |= appliedMask;
-					break;
+					continue; // Continue in case it's double defined.
 				}
 				currPatchset++;
 			}
-			if (emummc_patch_selected && !strncmp(_kip_id_sets[currKipIdx].name, "FS", 2))
+
+			if (emummc_patch_selected && !strncmp(_kip_id_sets[currKipIdx].name, "FS", sizeof(ki->kip1->name)))
 			{
 				emummc_patch_selected = false;
 				emu_cfg.fs_ver = currKipIdx;
@@ -1320,7 +658,7 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 				if (currKipIdx > 17)
 					emu_cfg.fs_ver -= 2;
 
-				gfx_printf("Injecting emuMMC. FS ver: %d\n", emu_cfg.fs_ver);
+				gfx_printf("Injecting emuMMC. FS ID: %d\n", emu_cfg.fs_ver);
 				if (_kipm_inject("/bootloader/sys/emummc.kipm", "FS", ki))
 					return "emummc";
 			}
@@ -1336,36 +674,14 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 	return NULL;
 }
 
-static const u8 mkey_vector_8xx[][SE_KEY_128_SIZE] =
-{
-	// Master key 8 encrypted with 9.  (8.1.0 with 9.0.0)
-	{ 0x4D, 0xD9, 0x98, 0x42, 0x45, 0x0D, 0xB1, 0x3C, 0x52, 0x0C, 0x9A, 0x44, 0xBB, 0xAD, 0xAF, 0x80 },
-	// Master key 9 encrypted with 10. (9.0.0 with 9.1.0)
-	{ 0xB8, 0x96, 0x9E, 0x4A, 0x00, 0x0D, 0xD6, 0x28, 0xB3, 0xD1, 0xDB, 0x68, 0x5F, 0xFB, 0xE1, 0x2A }
-};
-
-static bool _pkg2_key_unwrap_validate(pkg2_hdr_t *tmp_test, pkg2_hdr_t *hdr, u8 src_slot, u8 *mkey, const u8 *key_seed)
-{
-	// Decrypt older encrypted mkey.
-	se_aes_crypt_ecb(src_slot, 0, mkey, SE_KEY_128_SIZE, key_seed, SE_KEY_128_SIZE);
-	// Set and unwrap pkg2 key.
-	se_aes_key_clear(9);
-	se_aes_key_set(9, mkey, SE_KEY_128_SIZE);
-	se_aes_unwrap_key(9, 9, package2_keyseed);
-
-	// Decrypt header.
-	se_aes_crypt_ctr(9, tmp_test, sizeof(pkg2_hdr_t), hdr, sizeof(pkg2_hdr_t), hdr);
-
-	// Return if header is valid.
-	return (tmp_test->magic == PKG2_MAGIC);
-}
+// Master key 7 encrypted with 8.  (7.0.0 with 8.1.0). AES-ECB
+static const u8 mkey_vector_7xx[SE_KEY_128_SIZE] =
+	{ 0xEA, 0x60, 0xB3, 0xEA, 0xCE, 0x8F, 0x24, 0x46, 0x7D, 0x33, 0x9C, 0xD1, 0xBC, 0x24, 0x98, 0x29 };
 
 u8 pkg2_keyslot;
-pkg2_hdr_t *pkg2_decrypt(void *data, u8 kb)
+pkg2_hdr_t *pkg2_decrypt(void *data, u8 kb, bool is_exo)
 {
-	pkg2_hdr_t mkey_test;
 	u8 *pdata = (u8 *)data;
-	pkg2_keyslot = 8;
 
 	// Skip signature.
 	pdata += 0x100;
@@ -1375,58 +691,24 @@ pkg2_hdr_t *pkg2_decrypt(void *data, u8 kb)
 	// Skip header.
 	pdata += sizeof(pkg2_hdr_t);
 
-	// Check if we need to decrypt with newer mkeys. Valid for sept for 8.1.0 and up.
-	se_aes_crypt_ctr(8, &mkey_test, sizeof(pkg2_hdr_t), hdr, sizeof(pkg2_hdr_t), hdr);
+	// Set pkg2 key slot to default. If 7.0.0 it will change to 9.
+	pkg2_keyslot = 8;
 
-	if (mkey_test.magic == PKG2_MAGIC)
-		goto key_found;
-
-	// Decrypt older pkg2 via new mkeys.
-	if ((kb >= KB_FIRMWARE_VERSION_810) && (kb < KB_FIRMWARE_VERSION_MAX))
+	// Decrypt 7.0.0 pkg2 via 8.1.0 mkey on Erista.
+	if (!h_cfg.t210b01 && kb == KB_FIRMWARE_VERSION_700)
 	{
 		u8 tmp_mkey[SE_KEY_128_SIZE];
-		u8 decr_slot = !h_cfg.t210b01 ? (!h_cfg.aes_slots_new ? 12 : 13) : 7; // Sept mkey or T210B01 mkey.
-		u8 mkey_seeds_cnt = sizeof(mkey_vector_8xx) / SE_KEY_128_SIZE;
-		u8 mkey_seeds_idx = mkey_seeds_cnt; // Real index + 1.
-		u8 mkey_seeds_min_idx = mkey_seeds_cnt - (KB_FIRMWARE_VERSION_MAX - kb);
 
-		while (mkey_seeds_cnt)
-		{
-			// Decrypt and validate mkey.
-			int res = _pkg2_key_unwrap_validate(&mkey_test, hdr, decr_slot,
-				tmp_mkey, mkey_vector_8xx[mkey_seeds_idx - 1]);
+		// Decrypt 7.0.0 encrypted mkey.
+		se_aes_crypt_ecb(!is_exo ? 7 : 13, DECRYPT, tmp_mkey, SE_KEY_128_SIZE, mkey_vector_7xx, SE_KEY_128_SIZE);
 
-			if (res)
-			{
-				pkg2_keyslot = 9;
-				goto key_found;
-			}
-			else
-			{
-				// Set current mkey in order to decrypt a lower mkey.
-				mkey_seeds_idx--;
-				se_aes_key_clear(9);
-				se_aes_key_set(9, tmp_mkey, SE_KEY_128_SIZE);
+		// Set and unwrap pkg2 key.
+		se_aes_key_set(9, tmp_mkey, SE_KEY_128_SIZE);
+		se_aes_unwrap_key(9, 9, package2_keyseed);
 
-				decr_slot = 9; // Temp key.
-
-				// Check if we tried last key for that pkg2 version.
-				// And start with a lower mkey in case sept is older.
-				if (mkey_seeds_idx == mkey_seeds_min_idx)
-				{
-					mkey_seeds_cnt--;
-					mkey_seeds_idx = mkey_seeds_cnt;
-					decr_slot = !h_cfg.aes_slots_new ? 12 : 13; // Sept mkey.
-				}
-
-				// Out of keys. pkg2 is latest or process failed.
-				if (!mkey_seeds_cnt)
-					se_aes_key_clear(9);
-			}
-		}
+		pkg2_keyslot = 9;
 	}
 
-key_found:
 	// Decrypt header.
 	se_aes_crypt_ctr(pkg2_keyslot, hdr, sizeof(pkg2_hdr_t), hdr, sizeof(pkg2_hdr_t), hdr);
 	//gfx_hexdump((u32)hdr, hdr, 0x100);
@@ -1434,6 +716,7 @@ key_found:
 	if (hdr->magic != PKG2_MAGIC)
 		return NULL;
 
+	// Decrypt sections.
 	for (u32 i = 0; i < 4; i++)
 	{
 DPRINTF("sec %d has size %08X\n", i, hdr->sec_size[i]);
@@ -1453,9 +736,13 @@ static u32 _pkg2_ini1_build(u8 *pdst, pkg2_hdr_t *hdr, link_t *kips_info, bool n
 {
 	u32 ini1_size = sizeof(pkg2_ini1_t);
 	pkg2_ini1_t *ini1 = (pkg2_ini1_t *)pdst;
+
+	// Set initial header and magic.
 	memset(ini1, 0, sizeof(pkg2_ini1_t));
 	ini1->magic = INI1_MAGIC;
 	pdst += sizeof(pkg2_ini1_t);
+
+	// Merge kips into INI1.
 	LIST_FOREACH_ENTRY(pkg2_kip1_info_t, ki, kips_info, link)
 	{
 DPRINTF("adding kip1 '%s' @ %08X (%08X)\n", ki->kip1->name, (u32)ki->kip1, ki->size);
@@ -1464,8 +751,12 @@ DPRINTF("adding kip1 '%s' @ %08X (%08X)\n", ki->kip1->name, (u32)ki->kip1, ki->s
 		ini1_size += ki->size;
 		ini1->num_procs++;
 	}
+
+	// Align size and set it.
 	ini1_size = ALIGN(ini1_size, 4);
 	ini1->size = ini1_size;
+
+	// Encrypt INI1 in its own section if old pkg2. Otherwise it gets embedded into Kernel.
 	if (!new_pkg2)
 	{
 		hdr->sec_size[PKG2_SEC_INI1] = ini1_size;
@@ -1487,11 +778,20 @@ void pkg2_build_encrypt(void *dst, void *hos_ctxt, link_t *kips_info)
 	launch_ctxt_t * ctxt = (launch_ctxt_t *)hos_ctxt;
 	u32 kernel_size = ctxt->kernel_size;
 	bool is_meso = *(u32 *)(ctxt->kernel + 4) == ATM_MESOSPHERE;
+	u8 kb = ctxt->pkg1_id->kb;
 
 	// Force new Package2 if Mesosphere.
 	if (is_meso)
 		ctxt->new_pkg2 = true;
 
+	// Set key version. For Erista 7.0.0, use 8.1.0 because of a bug in Exo2?
+	u8 key_ver = kb ? kb + 1 : 0;
+	if (pkg2_keyslot == 9)
+	{
+		key_ver = KB_FIRMWARE_VERSION_810 + 1;
+		pkg2_keyslot = 8;
+	}
+
 	// Signature.
 	memset(pdst, 0, 0x100);
 	pdst += 0x100;
@@ -1531,7 +831,7 @@ DPRINTF("%s @ %08X (%08X)\n", is_meso ? "Mesosphere": "kernel",(u32)ctxt->kernel
 	pdst += kernel_size;
 DPRINTF("kernel encrypted\n");
 
-	/// Build INI1 for old Package2.
+	// Build INI1 for old Package2.
 	u32 ini1_size = 0;
 	if (!ctxt->new_pkg2)
 		ini1_size = _pkg2_ini1_build(pdst, hdr, kips_info, false);
@@ -1545,15 +845,11 @@ DPRINTF("INI1 encrypted\n");
 	se_calc_sha256_oneshot(&hdr->sec_sha256[0x20 * PKG2_SEC_INI1],
 		(void *)pk2_hash_data, hdr->sec_size[PKG2_SEC_INI1]);
 
-	//Encrypt header.
-	u8 key_ver = ctxt->pkg1_id->kb ? ctxt->pkg1_id->kb + 1 : 0;
+	// Encrypt header.
 	*(u32 *)hdr->ctr = 0x100 + sizeof(pkg2_hdr_t) + kernel_size + ini1_size;
 	hdr->ctr[4] = key_ver;
 	se_aes_crypt_ctr(pkg2_keyslot, hdr, sizeof(pkg2_hdr_t), hdr, sizeof(pkg2_hdr_t), hdr);
 	memset(hdr->ctr, 0 , SE_AES_IV_SIZE);
 	*(u32 *)hdr->ctr = 0x100 + sizeof(pkg2_hdr_t) + kernel_size + ini1_size;
 	hdr->ctr[4] = key_ver;
-
-	if (pkg2_keyslot != 8)
-		se_aes_key_clear(9);
 }

bootloader/hos/pkg2.h

@@ -99,17 +99,17 @@ typedef struct _pkg2_kip1_sec_t
 
 typedef struct _pkg2_kip1_t
 {
-	u32 magic;
-	u8 name[12];
-	u64 tid;
-	u32 proc_cat;
-	u8 main_thrd_prio;
-	u8 def_cpu_core;
-	u8 res;
-	u8 flags;
-	pkg2_kip1_sec_t sections[KIP1_NUM_SECTIONS];
-	u32 caps[0x20];
-	u8 data[];
+/* 0x000 */	u32 magic;
+/* 0x004*/	u8 name[12]; 
+/* 0x010 */	u64 tid;
+/* 0x018 */	u32 proc_cat;
+/* 0x01C */	u8 main_thrd_prio;
+/* 0x01D */	u8 def_cpu_core;
+/* 0x01E */	u8 res;
+/* 0x01F */	u8 flags;
+/* 0x020 */	pkg2_kip1_sec_t sections[KIP1_NUM_SECTIONS];
+/* 0x080 */	u32 caps[0x20];
+/* 0x100 */	u8 data[];
 } pkg2_kip1_t;
 
 typedef struct _pkg2_kip1_info_t
@@ -156,7 +156,7 @@ void pkg2_get_ids(kip1_id_t **ids, u32 *entries);
 const char* pkg2_patch_kips(link_t *info, char* patchNames);
 
 const pkg2_kernel_id_t *pkg2_identify(u8 *hash);
-pkg2_hdr_t *pkg2_decrypt(void *data, u8 kb);
+pkg2_hdr_t *pkg2_decrypt(void *data, u8 kb, bool is_exo);
 void pkg2_build_encrypt(void *dst, void *hos_ctxt, link_t *kips_info);
 
 #endif

bootloader/hos/pkg2_ini_kippatch.c

@@ -86,9 +86,9 @@ static ini_kip_sec_t *_ini_create_kip_section(link_t *dst, ini_kip_sec_t *ksec,
 
 int ini_patch_parse(link_t *dst, char *ini_path)
 {
+	FIL fp;
 	u32 lblen;
 	char lbuf[512];
-	FIL fp;
 	ini_kip_sec_t *ksec = NULL;
 
 	// Open ini.

bootloader/hos/pkg2_patches.inl

@@ -0,0 +1,779 @@
+/*
+ * Copyright (c) 2018-2021 CTCaer
+ * Copyright (c) 2018 Atmosphère-NX
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+//TODO: Replace hardcoded AArch64 instructions with instruction macros.
+//TODO: Reduce hardcoded values without searching kernel for patterns?
+// The process ID send/receive kernel patches were taken from Atmosphère's kernel patches.
+// They should only be used when running Atmosphère.
+#define CODE_OFF_1ST_100  0x4797C
+#define CODE_OFF_1ST_200  0x6486C
+#define CODE_OFF_1ST_300  0x494A4
+#define CODE_OFF_1ST_302  0x494BC
+#define CODE_OFF_1ST_400  0x52890
+#define CODE_OFF_1ST_500  0x5C020
+#define CODE_OFF_1ST_600  0x5EE00
+#define CODE_OFF_1ST_700  0x5FEC0
+#define CODE_OFF_1ST_800  0x607F0
+#define CODE_OFF_1ST_900  0x65780
+#define CODE_OFF_1ST_1000 0x67790
+#define CODE_OFF_1ST_1100 0x49EE8
+#define CODE_OFF_1ST_1200 0x48810
+
+#define ID_SND_OFF_100  0x23CC0
+#define ID_SND_OFF_200  0x3F134
+#define ID_SND_OFF_300  0x26080
+#define ID_SND_OFF_302  0x26080
+#define ID_SND_OFF_400  0x2AF64
+#define ID_SND_OFF_500  0x2AD34
+#define ID_SND_OFF_600  0x2BB8C
+#define ID_SND_OFF_700  0x2D044
+#define ID_SND_OFF_800  0x2F1FC
+#define ID_SND_OFF_900  0x329A0
+#define ID_SND_OFF_1000 0x34404
+#define ID_SND_OFF_1100 0x245B4
+#define ID_SND_OFF_1101 0x245B8
+#define ID_SND_OFF_1200 0x24CF4
+
+#define ID_RCV_OFF_100  0x219F0
+#define ID_RCV_OFF_200  0x3D1A8
+#define ID_RCV_OFF_300  0x240F0
+#define ID_RCV_OFF_302  0x240F0
+#define ID_RCV_OFF_400  0x28F6C
+#define ID_RCV_OFF_500  0x28DAC
+#define ID_RCV_OFF_600  0x29B6C
+#define ID_RCV_OFF_700  0x2B23C
+#define ID_RCV_OFF_800  0x2D424
+#define ID_RCV_OFF_900  0x309B4
+#define ID_RCV_OFF_1000 0x322F8
+#define ID_RCV_OFF_1100 0x22B24
+#define ID_RCV_OFF_1101 0x22B28
+#define ID_RCV_OFF_1200 0x23424
+
+static u32 PRC_ID_SND_100[] =
+{
+	0xA9BF2FEA, 0x2A0E03EB, 0xD37EF56B, 0xF86B6B8B, 0x92FFFFE9, 0x8A090168, 0xD2FFFFE9, 0x8A09016B,
+	0xD2FFFFC9, 0xEB09017F, 0x54000040, 0xF9412948,	0xA8C12FEA
+};
+#define CODE_OFF_2ND_100 (CODE_OFF_1ST_100 + sizeof(PRC_ID_SND_100) + sizeof(u32))
+static u32 PRC_ID_RCV_100[] =
+{
+	0xA9BF2FEA, 0x2A1C03EA, 0xD37EF54A, 0xF86A69AA, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A,
+	0xD2FFFFC9, 0xEB09015F, 0x54000040, 0xF9412968, 0xA8C12FEA
+};
+
+static u32 PRC_ID_SND_200[] =
+{
+	0xA9BF2FEA, 0x2A1803EB, 0xD37EF56B, 0xF86B6B8B, 0x92FFFFE9, 0x8A090168, 0xD2FFFFE9, 0x8A09016B,
+	0xD2FFFFC9, 0xEB09017F, 0x54000040, 0xF9413148, 0xA8C12FEA
+};
+#define CODE_OFF_2ND_200 (CODE_OFF_1ST_200 + sizeof(PRC_ID_SND_200) + sizeof(u32))
+static u32 PRC_ID_RCV_200[] =
+{
+	0xA9BF2FEA, 0x2A0F03EA, 0xD37EF54A, 0xF9405FEB, 0xF86A696A, 0xF9407BEB, 0x92FFFFE9, 0x8A090148,
+	0xD2FFFFE9, 0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000040, 0xF9413168, 0xA8C12FEA
+};
+
+static u32 PRC_ID_SND_300[] =
+{
+	0xA9BF2FEA, 0x2A1803EB, 0xD37EF56B, 0xF86B6B8B, 0x92FFFFE9, 0x8A090168, 0xD2FFFFE9, 0x8A09016B,
+	0xD2FFFFC9, 0xEB09017F, 0x54000040, 0xF9415548, 0xA8C12FEA
+};
+#define CODE_OFF_2ND_300 (CODE_OFF_1ST_300 + sizeof(PRC_ID_SND_300) + sizeof(u32))
+static u32 PRC_ID_RCV_300[] =
+{
+	0xA9BF2FEA, 0x2A0F03EA, 0xD37EF54A, 0xF9405FEB, 0xF86A696A, 0xF9407BEB, 0x92FFFFE9, 0x8A090148,
+	0xD2FFFFE9, 0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000040, 0xF9415568, 0xA8C12FEA
+};
+
+#define CODE_OFF_2ND_302 (CODE_OFF_1ST_302 + sizeof(PRC_ID_SND_300) + sizeof(u32))
+
+static u32 PRC_ID_SND_400[] =
+{
+	0x2A1703EA, 0xD37EF54A, 0xF86A6B8A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A, 0xD2FFFFC9,
+	0xEB09015F, 0x54000060, 0xF94053EA, 0xF9415948, 0xF94053EA
+};
+#define CODE_OFF_2ND_400 (CODE_OFF_1ST_400 + sizeof(PRC_ID_SND_400) + sizeof(u32))
+static u32 PRC_ID_RCV_400[] =
+{
+	0xF9403BED, 0x2A0E03EA, 0xD37EF54A, 0xF86A69AA, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A,
+	0xD2FFFFC9, 0xEB09015F, 0x54000040, 0xF9415B28, 0xD503201F
+};
+
+static u32 PRC_ID_SND_500[] =
+{
+	0x2A1703EA, 0xD37EF54A, 0xF86A6B6A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A, 0xD2FFFFC9,
+	0xEB09015F, 0x54000060, 0xF94043EA, 0xF9415948, 0xF94043EA
+};
+#define CODE_OFF_2ND_500 (CODE_OFF_1ST_500 + sizeof(PRC_ID_SND_500) + sizeof(u32))
+static u32 PRC_ID_RCV_500[] =
+{
+	0xF9403BED, 0x2A1503EA, 0xD37EF54A, 0xF86A69AA, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9, 0x8A09014A,
+	0xD2FFFFC9, 0xEB09015F, 0x54000040, 0xF9415B08, 0xF9406FEA
+};
+
+static u32 PRC_ID_SND_600[] =
+{
+	0xA9BF2FEA, 0xF94037EB, 0x2A1503EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400308, 0xF9401D08, 0xAA1803E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+#define CODE_OFF_2ND_600 (CODE_OFF_1ST_600 + sizeof(PRC_ID_SND_600) + sizeof(u32))
+static u32 PRC_ID_RCV_600[] =
+{
+	0xA9BF2FEA, 0xF94043EB, 0x2A1503EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400308, 0xF9401D08, 0xAA1803E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+
+static u32 PRC_ID_SND_700[] =
+{
+	0xA9BF2FEA, 0xF9403BEB, 0x2A1903EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF94002A8, 0xF9401D08, 0xAA1503E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+#define CODE_OFF_2ND_700 (CODE_OFF_1ST_700 + sizeof(PRC_ID_SND_700) + sizeof(u32))
+static u32 PRC_ID_RCV_700[] =
+{
+	0xA9BF2FEA, 0xF9404FEB, 0x2A1603EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400368, 0xF9401D08, 0xAA1B03E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+
+#define CODE_OFF_2ND_800 (CODE_OFF_1ST_800 + sizeof(PRC_ID_SND_700) + sizeof(u32))
+
+static u32 PRC_ID_SND_900[] =
+{
+	0xA9BF2FEA, 0xF94037EB, 0x2A1603EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF94002E8, 0xF9401D08, 0xAA1703E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+#define CODE_OFF_2ND_900 (CODE_OFF_1ST_900 + sizeof(PRC_ID_SND_900) + sizeof(u32))
+static u32 PRC_ID_RCV_900[] =
+{
+	0xA9BF2FEA, 0xF9404BEB, 0x2A1703EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400368, 0xF9401D08, 0xAA1B03E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+
+static u32 PRC_ID_SND_1000[] =
+{
+	0xA9BF2FEA, 0xF94063EB, 0x2A1603EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF94002E8, 0xF9401D08, 0xAA1703E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+#define CODE_OFF_2ND_1000 (CODE_OFF_1ST_1000 + sizeof(PRC_ID_SND_1000) + sizeof(u32))
+static u32 PRC_ID_RCV_1000[] =
+{
+	0xA9BF2FEA, 0xF94067EB, 0x2A1A03EA, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400388, 0xF9401D08, 0xAA1C03E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+
+static u32 PRC_ID_SND_1100[] =
+{
+	0xA9BF2FEA, 0xF94043EB, 0x5280006A, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF94002A8, 0xF9401D08, 0xAA1503E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+#define CODE_OFF_2ND_1100 (CODE_OFF_1ST_1100 + sizeof(PRC_ID_SND_1100) + sizeof(u32))
+static u32 PRC_ID_RCV_1100[] =
+{
+	0xA9BF2FEA, 0xF94073EB, 0x5280006A, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400308, 0xF9401D08, 0xAA1803E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+
+static u32 PRC_ID_SND_1200[] =
+{
+	0xA9BF2FEA, 0xF9404FEB, 0x5280006A, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF94002C8, 0xF9401D08, 0xAA1603E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+#define CODE_OFF_2ND_1200 (CODE_OFF_1ST_1200 + sizeof(PRC_ID_SND_1200) + sizeof(u32))
+static u32 PRC_ID_RCV_1200[] =
+{
+	0xA9BF2FEA, 0xF94073EB, 0x5280006A, 0xD37EF54A, 0xF86A696A, 0x92FFFFE9, 0x8A090148, 0xD2FFFFE9,
+	0x8A09014A, 0xD2FFFFC9, 0xEB09015F, 0x54000100, 0xA9BF27E8, 0xF9400388, 0xF9401D08, 0xAA1C03E0,
+	0xD63F0100, 0xA8C127E8, 0xAA0003E8, 0xA8C12FEA, 0xAA0803E0
+};
+
+// Include kernel patches here, so we can utilize pkg1 id
+KERNEL_PATCHSET_DEF(_kernel_1_patchset,
+	{ SVC_VERIFY_DS, 0x3764C, _NOP(),          NULL }, // Disable SVC verifications
+	{ DEBUG_MODE_EN, 0x44074, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
+	// Atmosphère kernel patches.
+	{ ATM_GEN_PATCH, ID_SND_OFF_100,   _B(ID_SND_OFF_100, CODE_OFF_1ST_100), NULL },           // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_100, sizeof(PRC_ID_SND_100) >> 2,          PRC_ID_SND_100 }, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_100 + sizeof(PRC_ID_SND_100),                                // Branch back and skip 1 instruction.
+		_B(CODE_OFF_1ST_100 + sizeof(PRC_ID_SND_100), ID_SND_OFF_100 + 0x4), NULL },
+	{ ATM_GEN_PATCH, ID_RCV_OFF_100,   _B(ID_RCV_OFF_100, CODE_OFF_2ND_100), NULL },           // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_100, sizeof(PRC_ID_RCV_100) >> 2,          PRC_ID_RCV_100 }, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_100 + sizeof(PRC_ID_RCV_100),                                // Branch back and skip 1 instruction.
+		_B(CODE_OFF_2ND_100 + sizeof(PRC_ID_RCV_100), ID_RCV_OFF_100 + 0x4), NULL }
+);
+
+KERNEL_PATCHSET_DEF(_kernel_2_patchset,
+	{ SVC_VERIFY_DS, 0x54834, _NOP(),          NULL }, // Disable SVC verifications
+	{ DEBUG_MODE_EN, 0x6086C, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
+	// Atmosphère kernel patches.
+	{ ATM_GEN_PATCH, ID_SND_OFF_200, _B(ID_SND_OFF_200, CODE_OFF_1ST_200),   NULL },           // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_200, sizeof(PRC_ID_SND_200) >> 2,          PRC_ID_SND_200 }, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_200 + sizeof(PRC_ID_SND_200),                                // Branch back and skip 1 instruction.
+		_B(CODE_OFF_1ST_200 + sizeof(PRC_ID_SND_200), ID_SND_OFF_200 + 0x4), NULL },
+	{ ATM_GEN_PATCH, ID_RCV_OFF_200, _B(ID_RCV_OFF_200, CODE_OFF_2ND_200),   NULL },           // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_200, sizeof(PRC_ID_RCV_200) >> 2,          PRC_ID_RCV_200 }, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_200 + sizeof(PRC_ID_RCV_200),                                // Branch back and skip 1 instruction.
+		_B(CODE_OFF_2ND_200 + sizeof(PRC_ID_RCV_200), ID_RCV_OFF_200 + 0x4), NULL }
+);
+
+KERNEL_PATCHSET_DEF(_kernel_3_patchset,
+	{ SVC_VERIFY_DS, 0x3BD24, _NOP(),          NULL }, // Disable SVC verifications
+	{ DEBUG_MODE_EN, 0x483FC, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
+	// Atmosphère kernel patches.
+	{ ATM_GEN_PATCH, ID_SND_OFF_300, _B(ID_SND_OFF_300, CODE_OFF_1ST_300),   NULL },           // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_300, sizeof(PRC_ID_SND_300) >> 2,          PRC_ID_SND_300 }, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_300 + sizeof(PRC_ID_SND_300),                                // Branch back and skip 1 instruction.
+		_B(CODE_OFF_1ST_300 + sizeof(PRC_ID_SND_300), ID_SND_OFF_300 + 0x4), NULL },
+	{ ATM_GEN_PATCH, ID_RCV_OFF_300, _B(ID_RCV_OFF_300, CODE_OFF_2ND_300),   NULL },           // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_300, sizeof(PRC_ID_RCV_300) >> 2,          PRC_ID_RCV_300 }, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_300 + sizeof(PRC_ID_RCV_300),                                // Branch back and skip 1 instruction.
+		_B(CODE_OFF_2ND_300 + sizeof(PRC_ID_RCV_300), ID_RCV_OFF_300 + 0x4), NULL }
+);
+
+KERNEL_PATCHSET_DEF(_kernel_302_patchset,
+	{ SVC_VERIFY_DS, 0x3BD24, _NOP(),          NULL }, // Disable SVC verifications
+	{ DEBUG_MODE_EN, 0x48414, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
+	// Atmosphère kernel patches.
+	{ ATM_GEN_PATCH, ID_SND_OFF_302, _B(ID_SND_OFF_302, CODE_OFF_1ST_302),   NULL },           // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_302, sizeof(PRC_ID_SND_300) >> 2,          PRC_ID_SND_300 }, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_302 + sizeof(PRC_ID_SND_300),                                // Branch back and skip 1 instruction.
+		_B(CODE_OFF_1ST_302 + sizeof(PRC_ID_SND_300), ID_SND_OFF_302 + 0x4), NULL },
+	{ ATM_GEN_PATCH, ID_RCV_OFF_302, _B(ID_RCV_OFF_302, CODE_OFF_2ND_302),   NULL },           // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_302, sizeof(PRC_ID_RCV_300) >> 2,          PRC_ID_RCV_300 }, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_302 + sizeof(PRC_ID_RCV_300),                                // Branch back and skip 1 instruction.
+		_B(CODE_OFF_2ND_302 + sizeof(PRC_ID_RCV_300), ID_RCV_OFF_302 + 0x4), NULL }
+);
+
+KERNEL_PATCHSET_DEF(_kernel_4_patchset,
+	{ SVC_VERIFY_DS, 0x41EB4, _NOP(),          NULL }, // Disable SVC verifications
+	{ DEBUG_MODE_EN, 0x4EBFC, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
+	// Atmosphère kernel patches.
+	{ ATM_GEN_PATCH, ID_SND_OFF_400, _B(ID_SND_OFF_400, CODE_OFF_1ST_400),       NULL },           // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_400, sizeof(PRC_ID_SND_400) >> 2,              PRC_ID_SND_400 }, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_400 + sizeof(PRC_ID_SND_400),                                    // Branch back and skip 2 instructions.
+		_B(CODE_OFF_1ST_400 + sizeof(PRC_ID_SND_400), ID_SND_OFF_400 + 0x4 * 2), NULL },
+	{ ATM_GEN_PATCH, ID_RCV_OFF_400, _B(ID_RCV_OFF_400, CODE_OFF_2ND_400),       NULL },           // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_400, sizeof(PRC_ID_RCV_400) >> 2,              PRC_ID_RCV_400 }, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_400 + sizeof(PRC_ID_RCV_400),                                    // Branch back and skip 1 instruction.
+		_B(CODE_OFF_2ND_400 + sizeof(PRC_ID_RCV_400), ID_RCV_OFF_400 + 0x4),     NULL }
+);
+
+KERNEL_PATCHSET_DEF(_kernel_5_patchset,
+	{ SVC_GENERIC,   0x38C2C, _NOP(),          NULL }, // Allow same process on svcControlCodeMemory.
+	{ SVC_VERIFY_DS, 0x45E6C, _NOP(),          NULL }, // Disable SVC verifications
+	{ DEBUG_MODE_EN, 0x5513C, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
+	// Atmosphère kernel patches.
+	{ ATM_SYSM_INCR, 0x54E30, _MOVZW(8, 0x1E00, LSL16), NULL }, // System memory pool increase.
+	{ ATM_GEN_PATCH, ID_SND_OFF_500, _B(ID_SND_OFF_500, CODE_OFF_1ST_500),       NULL },           // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_500, sizeof(PRC_ID_SND_500) >> 2,              PRC_ID_SND_500 }, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_500 + sizeof(PRC_ID_SND_500),                                    // Branch back and skip 2 instructions.
+		_B(CODE_OFF_1ST_500 + sizeof(PRC_ID_SND_500), ID_SND_OFF_500 + 0x4 * 2), NULL },
+	{ ATM_GEN_PATCH, ID_RCV_OFF_500, _B(ID_RCV_OFF_500, CODE_OFF_2ND_500),       NULL },           // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_500, sizeof(PRC_ID_RCV_500) >> 2,              PRC_ID_RCV_500 }, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_500 + sizeof(PRC_ID_RCV_500),                                    // Branch back and skip 2 instructions.
+		_B(CODE_OFF_2ND_500 + sizeof(PRC_ID_RCV_500), ID_RCV_OFF_500 + 0x4 * 2), NULL }
+);
+
+KERNEL_PATCHSET_DEF(_kernel_6_patchset,
+	{ SVC_GENERIC,   0x3A8CC, _NOP(),          NULL }, // Allow same process on svcControlCodeMemory.
+	{ SVC_VERIFY_DS, 0x47EA0, _NOP(),          NULL }, // Disable SVC verifications
+	{ DEBUG_MODE_EN, 0x57548, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
+	// Atmosphère kernel patches.
+	{ ATM_SYSM_INCR, 0x57330, _MOVZW(8, 0x1D80, LSL16), NULL }, // System memory pool increase.
+	{ ATM_GEN_PATCH, ID_SND_OFF_600, _B(ID_SND_OFF_600, CODE_OFF_1ST_600),       NULL },           // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_600, sizeof(PRC_ID_SND_600) >> 2,              PRC_ID_SND_600 }, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_600 + sizeof(PRC_ID_SND_600),                                    // Branch back and skip 4 instructions.
+		_B(CODE_OFF_1ST_600 + sizeof(PRC_ID_SND_600), ID_SND_OFF_600 + 0x4 * 4), NULL },
+	{ ATM_GEN_PATCH, ID_RCV_OFF_600, _B(ID_RCV_OFF_600, CODE_OFF_2ND_600),       NULL },           // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_600, sizeof(PRC_ID_RCV_600) >> 2,              PRC_ID_RCV_600 }, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_600 + sizeof(PRC_ID_RCV_600),                                    // Branch back and skip 4 instructions.
+		_B(CODE_OFF_2ND_600 + sizeof(PRC_ID_RCV_600), ID_RCV_OFF_600 + 0x4 * 4), NULL }
+);
+
+KERNEL_PATCHSET_DEF(_kernel_7_patchset,
+	{ SVC_GENERIC,   0x3C6E0, _NOP(),          NULL }, // Allow same process on svcControlCodeMemory.
+	{ SVC_VERIFY_DS, 0x49E5C, _NOP(),          NULL }, // Disable SVC verifications
+	{ DEBUG_MODE_EN, 0x581B0, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
+	// Atmosphère kernel patches.
+	{ ATM_SYSM_INCR, 0x57F98, _MOVZW(8, 0x1D80, LSL16), NULL }, // System memory pool increase.
+	{ ATM_GEN_PATCH, ID_SND_OFF_700, _B(ID_SND_OFF_700, CODE_OFF_1ST_700),       NULL },           // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_700, sizeof(PRC_ID_SND_700) >> 2,              PRC_ID_SND_700 }, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_700 + sizeof(PRC_ID_SND_700),                                    // Branch back and skip 4 instructions.
+		_B(CODE_OFF_1ST_700 + sizeof(PRC_ID_SND_700), ID_SND_OFF_700 + 0x4 * 4), NULL },
+	{ ATM_GEN_PATCH, ID_RCV_OFF_700, _B(ID_RCV_OFF_700, CODE_OFF_2ND_700),       NULL },           // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_700, sizeof(PRC_ID_RCV_700) >> 2,              PRC_ID_RCV_700 }, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_700 + sizeof(PRC_ID_RCV_700),                                    // Branch back and skip 4 instructions.
+		_B(CODE_OFF_2ND_700 + sizeof(PRC_ID_RCV_700), ID_RCV_OFF_700 + 0x4 * 4), NULL }
+);
+
+KERNEL_PATCHSET_DEF(_kernel_8_patchset,
+	{ SVC_GENERIC,   0x3FAD0, _NOP(),          NULL }, // Allow same process on svcControlCodeMemory.
+	{ SVC_VERIFY_DS, 0x4D15C, _NOP(),          NULL }, // Disable SVC verifications
+	{ DEBUG_MODE_EN, 0x5BFAC, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
+	// Atmosphère kernel patches.
+	{ ATM_SYSM_INCR, 0x5F9A4, _MOVZW(19, 0x1D80, LSL16), NULL }, // System memory pool increase.
+	{ ATM_GEN_PATCH, ID_SND_OFF_800, _B(ID_SND_OFF_800, CODE_OFF_1ST_800),       NULL },           // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_800, sizeof(PRC_ID_SND_700) >> 2,              PRC_ID_SND_700 }, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_800 + sizeof(PRC_ID_SND_700),                                    // Branch back and skip 4 instructions.
+		_B(CODE_OFF_1ST_800 + sizeof(PRC_ID_SND_700), ID_SND_OFF_800 + 0x4 * 4), NULL },
+	{ ATM_GEN_PATCH, ID_RCV_OFF_800, _B(ID_RCV_OFF_800, CODE_OFF_2ND_800),       NULL },           // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_800, sizeof(PRC_ID_RCV_700) >> 2,              PRC_ID_RCV_700 }, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_800 + sizeof(PRC_ID_RCV_700),                                    // Branch back and skip 4 instructions.
+		_B(CODE_OFF_2ND_800 + sizeof(PRC_ID_RCV_700), ID_RCV_OFF_800 + 0x4 * 4), NULL }
+);
+
+KERNEL_PATCHSET_DEF(_kernel_9_patchset,
+	{ SVC_GENERIC,   0x43DFC, _NOP(),          NULL }, // Allow same process on svcControlCodeMemory.
+	{ SVC_VERIFY_DS, 0x50628, _NOP(),          NULL }, // Disable SVC verifications
+	{ DEBUG_MODE_EN, 0x609E8, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch
+	// Atmosphère kernel patches.
+	{ ATM_SYSM_INCR, 0x6493C, _MOVZW(19, 0x1D80, LSL16), NULL }, // System memory pool increase.
+	{ ATM_GEN_PATCH, ID_SND_OFF_900, _B(ID_SND_OFF_900, CODE_OFF_1ST_900),       NULL },           // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_900, sizeof(PRC_ID_SND_900) >> 2,              PRC_ID_SND_900 }, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_900 + sizeof(PRC_ID_SND_900),                                    // Branch back and skip 4 instructions.
+		_B(CODE_OFF_1ST_900 + sizeof(PRC_ID_SND_900), ID_SND_OFF_900 + 0x4 * 4), NULL },
+	{ ATM_GEN_PATCH, ID_RCV_OFF_900, _B(ID_RCV_OFF_900, CODE_OFF_2ND_900),       NULL },           // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_900, sizeof(PRC_ID_RCV_900) >> 2,              PRC_ID_RCV_900 }, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_900 + sizeof(PRC_ID_RCV_900),                                    // Branch back and skip 4 instructions.
+		_B(CODE_OFF_2ND_900 + sizeof(PRC_ID_RCV_900), ID_RCV_OFF_900 + 0x4 * 4), NULL }
+);
+
+KERNEL_PATCHSET_DEF(_kernel_10_patchset,
+	{ SVC_GENERIC,   0x45DAC, _NOP(),          NULL }, // Allow same process on svcControlCodeMemory.
+	{ SVC_VERIFY_DS, 0x523E4, _NOP(),          NULL }, // Disable SVC verifications.
+	{ DEBUG_MODE_EN, 0x62B14, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch.
+	// Atmosphère kernel patches.
+	{ ATM_SYSM_INCR, 0x66950, _MOVZW(19, 0x1D80, LSL16), NULL }, // System memory pool increase.
+	{ ATM_GEN_PATCH, ID_SND_OFF_1000, _B(ID_SND_OFF_1000, CODE_OFF_1ST_1000),       NULL },            // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_1000, sizeof(PRC_ID_SND_1000) >> 2,               PRC_ID_SND_1000 }, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_1000 + sizeof(PRC_ID_SND_1000),                                      // Branch back and skip 4 instructions.
+		_B(CODE_OFF_1ST_1000 + sizeof(PRC_ID_SND_1000), ID_SND_OFF_1000 + 0x4 * 4), NULL },
+	{ ATM_GEN_PATCH, ID_RCV_OFF_1000, _B(ID_RCV_OFF_1000, CODE_OFF_2ND_1000),       NULL },            // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_1000, sizeof(PRC_ID_RCV_1000) >> 2,               PRC_ID_RCV_1000 }, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_1000 + sizeof(PRC_ID_RCV_1000),                                      // Branch back and skip 4 instructions.
+		_B(CODE_OFF_2ND_1000 + sizeof(PRC_ID_RCV_1000), ID_RCV_OFF_1000 + 0x4 * 4), NULL }
+);
+
+KERNEL_PATCHSET_DEF(_kernel_11_patchset,
+	{ SVC_GENERIC,   0x2FCE0, _NOP(),          NULL }, // Allow same process on svcControlCodeMemory.
+	{ SVC_VERIFY_DS, 0x39194, _NOP(),          NULL }, // Disable SVC verifications.
+	{ DEBUG_MODE_EN, 0x460C0, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch.
+	// Atmosphère kernel patches.
+	{ ATM_SYSM_INCR, 0x490C4, _MOVZW(21, 0x1D80, LSL16), NULL }, // System memory pool increase.
+	{ ATM_GEN_PATCH, ID_SND_OFF_1100, _B(ID_SND_OFF_1100, CODE_OFF_1ST_1100),       NULL},            // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_1100, sizeof(PRC_ID_SND_1100) >> 2,               PRC_ID_SND_1100}, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_1100 + sizeof(PRC_ID_SND_1100),                                     // Branch back and skip 4 instructions.
+		_B(CODE_OFF_1ST_1100 + sizeof(PRC_ID_SND_1100), ID_SND_OFF_1100 + 0x4 * 4), NULL},
+	{ ATM_GEN_PATCH, ID_RCV_OFF_1100, _B(ID_RCV_OFF_1100, CODE_OFF_2ND_1100),       NULL},            // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_1100, sizeof(PRC_ID_RCV_1100) >> 2,               PRC_ID_RCV_1100}, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_1100 + sizeof(PRC_ID_RCV_1100),                                     // Branch back and skip 4 instructions.
+		_B(CODE_OFF_2ND_1100 + sizeof(PRC_ID_RCV_1100), ID_RCV_OFF_1100 + 0x4 * 4), NULL}
+);
+
+KERNEL_PATCHSET_DEF(_kernel_1101_patchset,
+	{ SVC_GENERIC,   0x2FD04, _NOP(),          NULL }, // Allow same process on svcControlCodeMemory.
+	{ SVC_VERIFY_DS, 0x39194, _NOP(),          NULL }, // Disable SVC verifications.
+	{ DEBUG_MODE_EN, 0x460C0, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch.
+	// Atmosphère kernel patches.
+	{ ATM_SYSM_INCR, 0x490C4, _MOVZW(21, 0x1D80, LSL16), NULL }, // System memory pool increase.
+	{ ATM_GEN_PATCH, ID_SND_OFF_1101, _B(ID_SND_OFF_1101, CODE_OFF_1ST_1100),       NULL},            // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_1100, sizeof(PRC_ID_SND_1100) >> 2,               PRC_ID_SND_1100}, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_1100 + sizeof(PRC_ID_SND_1100),                                     // Branch back and skip 4 instructions.
+		_B(CODE_OFF_1ST_1100 + sizeof(PRC_ID_SND_1100), ID_SND_OFF_1101 + 0x4 * 4), NULL},
+	{ ATM_GEN_PATCH, ID_RCV_OFF_1101, _B(ID_RCV_OFF_1101, CODE_OFF_2ND_1100),       NULL},            // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_1100, sizeof(PRC_ID_RCV_1100) >> 2,               PRC_ID_RCV_1100}, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_1100 + sizeof(PRC_ID_RCV_1100),                                     // Branch back and skip 4 instructions.
+		_B(CODE_OFF_2ND_1100 + sizeof(PRC_ID_RCV_1100), ID_RCV_OFF_1101 + 0x4 * 4), NULL}
+);
+
+KERNEL_PATCHSET_DEF(_kernel_12_patchset,
+	{ SVC_GENERIC,   0x2FCB4, _NOP(),          NULL }, // Allow same process on svcControlCodeMemory.
+	{ SVC_VERIFY_DS, 0x38440, _NOP(),          NULL }, // Disable SVC verifications.
+	{ DEBUG_MODE_EN, 0x45118, _MOVZX(8, 1, 0), NULL }, // Enable Debug Patch.
+	// Atmosphère kernel patches.
+	{ ATM_SYSM_INCR, 0x4809C, _MOVZW(21, 0x1D80, LSL16), NULL }, // System memory pool increase.
+	{ ATM_GEN_PATCH, ID_SND_OFF_1200, _B(ID_SND_OFF_1200, CODE_OFF_1ST_1200),       NULL},            // Send process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_1ST_1200, sizeof(PRC_ID_SND_1200) >> 2,               PRC_ID_SND_1200}, // Send process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_1ST_1200 + sizeof(PRC_ID_SND_1200),                                     // Branch back and skip 4 instructions.
+		_B(CODE_OFF_1ST_1200 + sizeof(PRC_ID_SND_1200), ID_SND_OFF_1200 + 0x4 * 4), NULL},
+	{ ATM_GEN_PATCH, ID_RCV_OFF_1200, _B(ID_RCV_OFF_1200, CODE_OFF_2ND_1200),       NULL},            // Receive process id branch.
+	{ ATM_ARR_PATCH, CODE_OFF_2ND_1200, sizeof(PRC_ID_RCV_1200) >> 2,               PRC_ID_RCV_1200}, // Receive process id code.
+	{ ATM_GEN_PATCH, CODE_OFF_2ND_1200 + sizeof(PRC_ID_RCV_1200),                                     // Branch back and skip 4 instructions.
+		_B(CODE_OFF_2ND_1200 + sizeof(PRC_ID_RCV_1200), ID_RCV_OFF_1200 + 0x4 * 4), NULL}
+);
+
+// Kernel sha256 hashes. Offset 0x800 up to INI1 start.
+static const pkg2_kernel_id_t _pkg2_kernel_ids[] =
+{
+	{ "\xb8\xc5\x0c\x68\x25\xa9\xb9\x5b", _kernel_1_patchset },   //  1.0.0
+	{ "\x64\x0b\x51\xff\x28\x01\xb8\x30", _kernel_2_patchset },   //  2.0.0 - 2.3.0
+	{ "\x50\x84\x23\xac\x6f\xa1\x5d\x3b", _kernel_3_patchset },   //  3.0.0 - 3.0.1
+	{ "\x81\x9d\x08\xbe\xe4\x5e\x1f\xbb", _kernel_302_patchset }, //  3.0.2
+	{ "\xe6\xc0\xb7\xe3\x2f\xf9\x44\x51", _kernel_4_patchset },   //  4.0.0 - 4.1.0
+	{ "\xb2\x38\x61\xa8\xe1\xe2\xe4\xe4", _kernel_5_patchset },   //  5.0.0 - 5.1.0
+	{ "\x85\x97\x40\xf6\xc0\x3e\x3d\x44", _kernel_6_patchset },   //  6.0.0 - 6.2.0
+	{ "\xa2\x5e\x47\x0c\x8e\x6d\x2f\xd7", _kernel_7_patchset },   //  7.0.0 - 7.0.1
+	{ "\xf1\x5e\xc8\x34\xfd\x68\xf0\xf0", _kernel_8_patchset },   //  8.0.0 - 8.1.0. Kernel only.
+	{ "\x69\x00\x39\xdf\x21\x56\x70\x6b", _kernel_9_patchset },   //  9.0.0 - 9.1.0. Kernel only.
+	{ "\xa2\xe3\xad\x1c\x98\xd8\x7a\x62", _kernel_9_patchset },   //  9.2.0. Kernel only.
+	{ "\x21\xc1\xd7\x24\x8e\xcd\xbd\xa8", _kernel_10_patchset },  // 10.0.0 - 10.2.0. Kernel only.
+	{ "\xD5\xD0\xBA\x5D\x52\xB9\x77\x85", _kernel_11_patchset },  // 11.0.0. Kernel only.
+	{ "\xF8\x1E\xE0\x30\x3C\x7A\x08\x04", _kernel_1101_patchset },// 11.0.1. Kernel only.
+	{ "\xA6\xD8\xFF\xF3\x67\x4A\x33\xFC", _kernel_12_patchset },  // 12.0.0 - 12.1.0. Kernel only.
+	//! TODO: Mesosphere is now mandatory. Missing patches: 13.0.0+
+};
+
+// All kip patch offsets are without the 0x100-sized header.
+static kip1_patch_t _fs_emummc[] =
+{
+	{ KPS(KIP_TEXT) | 1, 0, "", "" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_100[] =
+{
+	{ "nogc",     NULL },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_40x[] =
+{
+	{ KPS(KIP_TEXT) | 0xA3458, 4, "\x14\x40\x80\x72", "\x14\x80\x80\x72" },
+	{ KPS(KIP_TEXT) | 0xAAB44, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_40x[] =
+{
+	{ "nogc",     _fs_nogc_40x },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_410[] =
+{
+	{ KPS(KIP_TEXT) | 0xA34BC, 4, "\x14\x40\x80\x72", "\x14\x80\x80\x72" },
+	{ KPS(KIP_TEXT) | 0xAABA8, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_410[] =
+{
+	{ "nogc",     _fs_nogc_410 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_50x[] =
+{
+	{ KPS(KIP_TEXT) | 0xCF3C4, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ KPS(KIP_TEXT) | 0xD73A0, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_50x[] =
+{
+	{ "nogc",     _fs_nogc_50x },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_510[] =
+{
+	{ KPS(KIP_TEXT) | 0xCF794, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ KPS(KIP_TEXT) | 0xD7770, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_510[] =
+{
+	{ "nogc",     _fs_nogc_510 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_600[] =
+{
+	{ KPS(KIP_TEXT) | 0x12CC20, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x1538F4, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_600_exfat[] =
+{
+	{ KPS(KIP_TEXT) | 0x138320, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x15EFF4, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_600[] =
+{
+	{ "nogc",     _fs_nogc_600 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_600_exfat[] =
+{
+	{ "nogc",     _fs_nogc_600_exfat },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_700[] =
+{
+	{ KPS(KIP_TEXT) | 0x134160, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x15BF04, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_700_exfat[] =
+{
+	{ KPS(KIP_TEXT) | 0x13F710, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x1674B4, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_700[] =
+{
+	{ "nogc",     _fs_nogc_700 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_700_exfat[] =
+{
+	{ "nogc",     _fs_nogc_700_exfat },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_800[] =
+{
+	{ KPS(KIP_TEXT) | 0x136800, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x15EB94, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_800_exfat[] =
+{
+	{ KPS(KIP_TEXT) | 0x141DB0, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x16A144, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_800[] =
+{
+	{ "nogc",     _fs_nogc_800 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_800_exfat[] =
+{
+	{ "nogc",     _fs_nogc_800_exfat },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_900[] =
+{
+	{ KPS(KIP_TEXT) | 0x129420, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x143268, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_900[] =
+{
+	{ "nogc",     _fs_nogc_900 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_910[] =
+{
+	{ KPS(KIP_TEXT) | 0x129430, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x143278, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_910[] =
+{
+	{ "nogc",     _fs_nogc_910 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_1000[] =
+{
+	{ KPS(KIP_TEXT) | 0x13BE90, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x14DE08, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_1000[] =
+{
+	{ "nogc",     _fs_nogc_1000 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_1020[] =
+{
+	{ KPS(KIP_TEXT) | 0x13C2F0, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x14E268, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_1020[] =
+{
+	{ "nogc",     _fs_nogc_1020 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_1100[] =
+{
+	{ KPS(KIP_TEXT) | 0x1398B4, 8, "\xF4\x4F\xBE\xA9\xFD\x7B\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x156EB8, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_1100[] =
+{
+	{ "nogc",     _fs_nogc_1100 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_1200[] =
+{
+	{ KPS(KIP_TEXT) | 0x13EA24, 8, "\xFD\x7B\xBE\xA9\xF4\x4F\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x155368, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_1200[] =
+{
+	{ "nogc",     _fs_nogc_1200 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_1203[] =
+{
+	{ KPS(KIP_TEXT) | 0x13EB34, 8, "\xFD\x7B\xBE\xA9\xF4\x4F\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x155478, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_1203[] =
+{
+	{ "nogc",     _fs_nogc_1203 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_1300[] =
+{
+	{ KPS(KIP_TEXT) | 0x1425D0, 8, "\xFD\x7B\xBE\xA9\xF4\x4F\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x159018, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_1300[] =
+{
+	{ "nogc",     _fs_nogc_1300 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+static kip1_patch_t _fs_nogc_1310[] =
+{
+	{ KPS(KIP_TEXT) | 0x142570, 8, "\xFD\x7B\xBE\xA9\xF4\x4F\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x158FB8, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_1310[] =
+{
+	{ "nogc",     _fs_nogc_1310 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
+// SHA256 hashes.
+static kip1_id_t _kip_ids[] =
+{
+	{ "FS", "\xde\x9f\xdd\xa4\x08\x5d\xd5\xfe", _fs_patches_100 },       // FS 1.0.0
+	{ "FS", "\xfc\x3e\x80\x99\x1d\xca\x17\x96", _fs_patches_100 },       // FS 1.0.0 exFAT
+	{ "FS", "\xcd\x7b\xbe\x18\xd6\x13\x0b\x28", _fs_patches_100 },       // FS 2.0.0
+	{ "FS", "\xe7\x66\x92\xdf\xaa\x04\x20\xe9", _fs_patches_100 },       // FS 2.0.0 exFAT
+	{ "FS", "\x0d\x70\x05\x62\x7b\x07\x76\x7c", _fs_patches_100 },       // FS 2.1.0
+	{ "FS", "\xdb\xd8\x5f\xca\xcc\x19\x3d\xa8", _fs_patches_100 },       // FS 2.1.0 exFAT
+	{ "FS", "\xa8\x6d\xa5\xe8\x7e\xf1\x09\x7b", _fs_patches_100 },       // FS 3.0.0
+	{ "FS", "\x98\x1c\x57\xe7\xf0\x2f\x70\xf7", _fs_patches_100 },       // FS 3.0.0 exFAT
+	{ "FS", "\x57\x39\x7c\x06\x3f\x10\xb6\x31", _fs_patches_100 },       // FS 3.0.1
+	{ "FS", "\x07\x30\x99\xd7\xc6\xad\x7d\x89", _fs_patches_100 },       // FS 3.0.1 exFAT
+	{ "FS", "\x06\xe9\x07\x19\x59\x5a\x01\x0c", _fs_patches_40x },       // FS 4.0.1
+	{ "FS", "\x54\x9b\x0f\x8d\x6f\x72\xc4\xe9", _fs_patches_40x },       // FS 4.0.1 exFAT
+	{ "FS", "\x80\x96\xaf\x7c\x6a\x35\xaa\x82", _fs_patches_410 },       // FS 4.1.0
+	{ "FS", "\x02\xd5\xab\xaa\xfd\x20\xc8\xb0", _fs_patches_410 },       // FS 4.1.0 exFAT
+	{ "FS", "\xa6\xf2\x7a\xd9\xac\x7c\x73\xad", _fs_patches_50x },       // FS 5.0.0
+	{ "FS", "\xce\x3e\xcb\xa2\xf2\xf0\x62\xf5", _fs_patches_50x },       // FS 5.0.0 exFAT
+	{ "FS", "\x76\xf8\x74\x02\xc9\x38\x7c\x0f", _fs_patches_510 },       // FS 5.1.0
+	{ "FS", "\x10\xb2\xd8\x16\x05\x48\x85\x99", _fs_patches_510 },       // FS 5.1.0 exFAT
+	{ "FS", "\x1b\x82\xcb\x22\x18\x67\xcb\x52", _fs_patches_600 },       // FS 6.0.0-4.0
+	{ "FS", "\x96\x6a\xdd\x3d\x20\xb6\x27\x13", _fs_patches_600_exfat }, // FS 6.0.0-4.0 exFAT
+	{ "FS", "\x3a\x57\x4d\x43\x61\x86\x19\x1d", _fs_patches_600 },       // FS 6.0.0-5.0
+	{ "FS", "\x33\x05\x53\xf6\xb5\xfb\x55\xc4", _fs_patches_600_exfat }, // FS 6.0.0-5.0 exFAT
+	{ "FS", "\x2A\xDB\xE9\x7E\x9B\x5F\x41\x77", _fs_patches_700 },       // FS 7.0.0
+	{ "FS", "\x2C\xCE\x65\x9C\xEC\x53\x6A\x8E", _fs_patches_700_exfat }, // FS 7.0.0 exFAT
+	{ "FS", "\xB2\xF5\x17\x6B\x35\x48\x36\x4D", _fs_patches_800 },       // FS 8.0.0
+	{ "FS", "\xDB\xD9\x41\xC0\xC5\x3C\x52\xCC", _fs_patches_800_exfat }, // FS 8.0.0 exFAT
+	{ "FS", "\x6B\x09\xB6\x7B\x29\xC0\x20\x24", _fs_patches_800 },       // FS 8.1.0
+	{ "FS", "\xB4\xCA\xE1\xF2\x49\x65\xD9\x2E", _fs_patches_800_exfat }, // FS 8.1.0 exFAT
+	{ "FS", "\x46\x87\x40\x76\x1E\x19\x3E\xB7", _fs_patches_900 },       // FS 9.0.0
+	{ "FS", "\x7C\x95\x13\x76\xE5\xC1\x2D\xF8", _fs_patches_900 },       // FS 9.0.0 exFAT
+	{ "FS", "\xB5\xE7\xA6\x4C\x6F\x5C\x4F\xE3", _fs_patches_910 },       // FS 9.1.0
+	{ "FS", "\xF1\x96\xD1\x44\xD0\x44\x45\xB6", _fs_patches_910 },       // FS 9.1.0 exFAT
+	{ "FS", "\x3E\xEB\xD9\xB7\xBC\xD1\xB5\xE0", _fs_patches_1000 },      // FS 10.0.0
+	{ "FS", "\x81\x7E\xA2\xB0\xB7\x02\xC1\xF3", _fs_patches_1000 },      // FS 10.0.0 exFAT
+	{ "FS", "\xA9\x52\xB6\x57\xAD\xF9\xC2\xBA", _fs_patches_1020 },      // FS 10.2.0
+	{ "FS", "\x16\x0D\x3E\x10\x4E\xAD\x61\x76", _fs_patches_1020 },      // FS 10.2.0 exFAT
+	{ "FS", "\xE3\x99\x15\x6E\x84\x4E\xB0\xAA", _fs_patches_1100 },      // FS 11.0.0
+	{ "FS", "\x0B\xA1\x5B\xB3\x04\xB5\x05\x63", _fs_patches_1100 },      // FS 11.0.0 exFAT
+	{ "FS", "\xDC\x2A\x08\x49\x96\xBB\x3C\x01", _fs_patches_1200 },      // FS 12.0.0
+	{ "FS", "\xD5\xA5\xBF\x36\x64\x0C\x49\xEA", _fs_patches_1200 },      // FS 12.0.0 exFAT
+	{ "FS", "\xC8\x67\x62\xBE\x19\xA5\x1F\xA0", _fs_patches_1203 },      // FS 12.0.3
+	{ "FS", "\xE1\xE8\xD3\xD6\xA2\xFE\x0B\x10", _fs_patches_1203 },      // FS 12.0.3 exFAT
+	{ "FS", "\x7D\x20\x05\x47\x17\x8A\x83\x6A", _fs_patches_1300 },      // FS 13.0.0
+	{ "FS", "\x51\xEB\xFA\x9C\xCF\x66\xC0\x9E", _fs_patches_1300 },      // FS 13.0.0 exFAT
+	{ "FS", "\x91\xBA\x65\xA2\x1C\x1D\x50\xAE", _fs_patches_1310 },      // FS 13.1.0
+	{ "FS", "\x76\x38\x27\xEE\x9C\x20\x7E\x5B", _fs_patches_1310 },      // FS 13.1.0 exFAT
+};

bootloader/hos/secmon_exo.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2020 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
  * Copyright (c) 2019 Atmosphère-NX
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -131,7 +131,7 @@ typedef struct _atm_fatal_error_ctx
 #define  ATM_FATAL_MAGIC       0x30454641 // AFE0
 
 #define ATM_EXO_FATAL_ADDR     0x80020000
-#define  ATM_EXO_FATAL_SIZE    0x20000
+#define  ATM_EXO_FATAL_SIZE    SZ_128K
 
 #define ATM_WB_HEADER_OFF      0x244
 #define  ATM_WB_MAGIC          0x30544257 // WBT0
@@ -145,13 +145,15 @@ typedef struct _atm_fatal_error_ctx
 #define  EXO_FLAG_USER_PMU        BIT(4)
 #define  EXO_FLAG_CAL0_BLANKING   BIT(5)
 #define  EXO_FLAG_CAL0_WRITES_SYS BIT(6)
+#define  EXO_FLAG_ENABLE_USB3     BIT(7)
 
 #define EXO_FW_VER(mj, mn, rv) (((mj) << 24) | ((mn) << 16) | ((rv) << 8))
 
-void config_exosphere(launch_ctxt_t *ctxt, u32 warmboot_base, bool exo_new)
+void config_exosphere(launch_ctxt_t *ctxt, u32 warmboot_base)
 {
-	u32 exo_fw_no = 0;
+	u32 exo_fw_no;
 	u32 exo_flags = 0;
+	bool usb3_force = false;
 	bool user_debug = false;
 	bool cal0_blanking = false;
 	bool cal0_allow_writes_sys = false;
@@ -160,58 +162,49 @@ void config_exosphere(launch_ctxt_t *ctxt, u32 warmboot_base, bool exo_new)
 
 	volatile exo_cfg_t *exo_cfg = (exo_cfg_t *)EXO_CFG_ADDR;
 
-	// Old exosphere target versioning. Use fuses for a simpler encoding.
+	//! TODO: Replace current HOS version decoding (as it's bound to break in the future).
+
+	// Old exosphere target versioning. Use fuses for a simpler decoding.
 	if (ctxt->pkg1_id->fuses <= 3 || ctxt->pkg1_id->fuses >= 10) // 1.0.0 - 3.0.0, 8.1.0+.
 		exo_fw_no = ctxt->pkg1_id->fuses;
 	else
-		exo_fw_no = ctxt->pkg1_id->fuses - 1;                    // 3.0.1 - 7.0.1, 8.0.0 - 8.0.1.
+		exo_fw_no = ctxt->pkg1_id->fuses - 1;                    // 3.0.1 - 7.0.1, 8.0.x.
 
-	if (!memcmp(ctxt->pkg1_id->id, "20190314172056", 8))         // 8.0.0 - 8.0.1.
-	    exo_fw_no++;
+	// Handle versions that change API and do not burn new fuse.
+	if (!memcmp(ctxt->pkg1_id->id, "20190314172056", 8) || //  8.0.x, same fuses with  7.0.1.
+		!memcmp(ctxt->pkg1_id->id, "20210129111626", 8) || // 12.0.0, same fuses with 11.0.0.
+		!memcmp(ctxt->pkg1_id->id, "20210805123730", 8)    // 13.0.0, same fuses with 12.1.0.
+	   )
+		exo_fw_no++;
 
 	// Feed old exosphere target versioning to new.
-	if (exo_new)
+	switch (exo_fw_no)
 	{
-		switch (exo_fw_no)
-		{
-		case 1:
-		case 2:
-		case 3:
-		case 4:
-		case 6:
-			exo_fw_no = EXO_FW_VER(exo_fw_no, 0, 0);
-			break;
-		case 5:
-			if (!ctxt->exo_ctx.fs_is_510)
-				exo_fw_no = EXO_FW_VER(5, 0, 0);
-			else
-				exo_fw_no = EXO_FW_VER(5, 1, 0);
-			break;
-		case 7:
-			exo_fw_no = EXO_FW_VER(6, 2, 0);
-			break;
-		case 8:
-			exo_fw_no = EXO_FW_VER(7, 0, 0);
-			break;
-		case 9:
-			exo_fw_no = EXO_FW_VER(8, 0, 0);
-			break;
-		case 10:
-			exo_fw_no = EXO_FW_VER(8, 1, 0);
-			break;
-		case 11:
-			exo_fw_no = EXO_FW_VER(9, 0, 0);
-			break;
-		case 12:
-			exo_fw_no = EXO_FW_VER(9, 1, 0);
-			break;
-		case 13:
-			exo_fw_no = EXO_FW_VER(10, 0, 0);
-			break;
-		case 14:
-			exo_fw_no = EXO_FW_VER(11, 0, 0);
-			break;
-		}
+	case 1 ... 4:
+	case 6:
+		exo_fw_no = EXO_FW_VER(exo_fw_no, 0, 0);
+		break;
+	case 5:
+		exo_fw_no = EXO_FW_VER(5, ctxt->exo_ctx.hos_revision, 0);
+		break;
+	case 7:
+		exo_fw_no = EXO_FW_VER(6, 2, 0);
+		break;
+	case 8 ... 9:
+		exo_fw_no = EXO_FW_VER(exo_fw_no - 1, 0, 0);
+		break;
+	case 10:
+		exo_fw_no = EXO_FW_VER(8, 1, 0);
+		break;
+	case 11:
+		exo_fw_no = EXO_FW_VER(9, 0, 0);
+		break;
+	case 12:
+		exo_fw_no = EXO_FW_VER(9, 1, 0);
+		break;
+	case 13 ... 16: //!TODO: Update on API changes. 16: 13.0.0.
+		exo_fw_no = EXO_FW_VER(exo_fw_no - 3, ctxt->exo_ctx.hos_revision, 0);
+		break;
 	}
 
 	// Parse exosphere.ini.
@@ -252,6 +245,34 @@ void config_exosphere(launch_ctxt_t *ctxt, u32 warmboot_base, bool exo_new)
 				break;
 			}
 		}
+
+		// Parse usb mtim settings. Avoid parsing if it's overridden.
+		if (ctxt->fss0_main_path && !ctxt->exo_ctx.usb3_force)
+		{
+			char settings_path[256];
+			strcpy(settings_path, ctxt->fss0_main_path);
+			strcat(settings_path, "config/system_settings.ini");
+			LIST_INIT(sys_settings);
+			if (ini_parse(&ini_sections, settings_path, false))
+			{
+				LIST_FOREACH_ENTRY(ini_sec_t, ini_sec, &ini_sections, link)
+				{
+					// Only parse usb section.
+					if (!(ini_sec->type == INI_CHOICE) || strcmp(ini_sec->name, "usb"))
+						continue;
+
+					LIST_FOREACH_ENTRY(ini_kv_t, kv, &ini_sec->kvs, link)
+					{
+						if (!strcmp("usb30_force_enabled", kv->key))
+						{
+							usb3_force = !strcmp("u8!0x1", kv->val);
+							break; // Only parse usb30_force_enabled key.
+						}
+					}
+					break;
+				}
+			}
+		}
 	}
 
 	// To avoid problems, make private debug mode always on if not semi-stock.
@@ -270,6 +291,11 @@ void config_exosphere(launch_ctxt_t *ctxt, u32 warmboot_base, bool exo_new)
 	if (ctxt->exo_ctx.user_pmu)
 		exo_flags |= EXO_FLAG_USER_PMU;
 
+	// Enable USB 3.0. Check if system_settings ini value is overridden. If not, check if enabled in ini.
+	if ((ctxt->exo_ctx.usb3_force && *ctxt->exo_ctx.usb3_force)
+			|| (!ctxt->exo_ctx.usb3_force && usb3_force))
+		exo_flags |= EXO_FLAG_ENABLE_USB3;
+
 	// Enable prodinfo blanking. Check if exo ini value is overridden. If not, check if enabled in exo ini.
 	if ((ctxt->exo_ctx.cal0_blank && *ctxt->exo_ctx.cal0_blank)
 			|| (!ctxt->exo_ctx.cal0_blank && cal0_blanking))
@@ -393,6 +419,8 @@ static const char *get_error_desc(u32 error_desc)
 	}
 }
 
+#define HOS_PID_BOOT2 0x8
+
 void secmon_exo_check_panic()
 {
 	volatile atm_fatal_error_ctx *rpt = (atm_fatal_error_ctx *)ATM_FATAL_ERR_CTX_ADDR;
@@ -408,6 +436,10 @@ void secmon_exo_check_panic()
 	WPRINTFARGS("Title ID: %08X%08X", (u32)((u64)rpt->title_id >> 32), (u32)rpt->title_id);
 	WPRINTFARGS("Error:    %s (0x%x)\n", get_error_desc(rpt->error_desc), rpt->error_desc);
 
+	// Check if mixed atmosphere sysmodules.
+	if ((u32)rpt->title_id == HOS_PID_BOOT2)
+		WPRINTF("fss0 wrong path or mismatched atmo files\n");
+
 	// Save context to the SD card.
 	char filepath[0x40];
 	f_mkdir("atmosphere/fatal_errors");

bootloader/hos/secmon_exo.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -19,7 +19,7 @@
 
 #include <utils/types.h>
 
-void config_exosphere(launch_ctxt_t *ctxt, u32 warmboot_base, bool exo_new);
+void config_exosphere(launch_ctxt_t *ctxt, u32 warmboot_base);
 void secmon_exo_check_panic();
 
 #endif

bootloader/hos/sept.c

@@ -1,278 +0,0 @@
-/*
- * Copyright (c) 2019-2021 CTCaer
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#include <string.h>
-
-#include "hos.h"
-#include "fss.h"
-#include "sept.h"
-#include "../config.h"
-#include <display/di.h>
-#include <ianos/ianos.h>
-#include <libs/fatfs/ff.h>
-#include <mem/heap.h>
-#include <soc/hw_init.h>
-#include <soc/pmc.h>
-#include <soc/t210.h>
-#include "../storage/emummc.h"
-#include "../storage/nx_emmc.h"
-#include <storage/nx_sd.h>
-#include <storage/sdmmc.h>
-#include <utils/btn.h>
-#include <utils/types.h>
-#include <utils/util.h>
-
-#include <gfx_utils.h>
-
-#define RELOC_META_OFF   0x7C
-#define PATCHED_RELOC_SZ 0x94
-
-#define WB_RST_ADDR 0x40010ED0
-#define WB_RST_SIZE 0x30
-
-u8 warmboot_reboot[] = {
-	0x14, 0x00, 0x9F, 0xE5, // LDR R0, =0x7000E450
-	0x01, 0x10, 0xB0, 0xE3, // MOVS R1, #1
-	0x00, 0x10, 0x80, 0xE5, // STR R1, [R0]
-	0x0C, 0x00, 0x9F, 0xE5, // LDR R0, =0x7000E400
-	0x10, 0x10, 0xB0, 0xE3, // MOVS R1, #0x10
-	0x00, 0x10, 0x80, 0xE5, // STR R1, [R0]
-	0xFE, 0xFF, 0xFF, 0xEA, // LOOP
-	0x50, 0xE4, 0x00, 0x70, // #0x7000E450
-	0x00, 0xE4, 0x00, 0x70  // #0x7000E400
-};
-
-#define SEPT_PRI_ADDR   0x4003F000
-#define SEPT_PRI_ENTRY  0x40010340
-
-#define SEPT_PK1T_ADDR  0xC0400000
-#define SEPT_TCSZ_ADDR  (SEPT_PK1T_ADDR - 0x4)
-#define SEPT_STG1_ADDR  (SEPT_PK1T_ADDR + 0x2E100)
-#define SEPT_STG2_ADDR  (SEPT_PK1T_ADDR + 0x60E0)
-#define SEPT_PKG_SZ     (0x2F100 + WB_RST_SIZE)
-
-extern boot_cfg_t b_cfg;
-extern hekate_config h_cfg;
-extern const volatile ipl_ver_meta_t ipl_ver;
-
-extern bool is_ipl_updated(void *buf);
-extern void reloc_patcher(u32 payload_dst, u32 payload_src, u32 payload_size);
-
-void check_sept(ini_sec_t *cfg_sec)
-{
-	if (h_cfg.t210b01)
-	{
-		h_cfg.sept_run = true;
-		return;
-	}
-
-	hos_eks_get();
-
-	// Check if non-hekate payload is used for sept and restore it.
-	if (h_cfg.sept_run)
-	{
-		if (!f_stat("sept/payload.bak", NULL))
-		{
-			f_unlink("sept/payload.bin");
-			f_rename("sept/payload.bak", "sept/payload.bin");
-		}
-
-		return;
-	}
-
-	u8 *pkg1 = (u8 *)calloc(1, 0x40000);
-
-	int res = emummc_storage_init_mmc();
-	if (res)
-	{
-		if (res == 2)
-			EPRINTF("Failed to init eMMC.");
-		else
-			EPRINTF("Failed to init emuMMC.");
-
-		goto out_free;
-	}
-
-	emummc_storage_set_mmc_partition(EMMC_BOOT0);
-
-	// Read package1.
-	emummc_storage_read(0x100000 / NX_EMMC_BLOCKSIZE, 0x40000 / NX_EMMC_BLOCKSIZE, pkg1);
-	const pkg1_id_t *pkg1_id = pkg1_identify(pkg1);
-	if (!pkg1_id)
-	{
-		EPRINTF("Unknown pkg1 version.");
-		goto out_free;
-	}
-
-	if (pkg1_id->kb >= KB_FIRMWARE_VERSION_700 && !h_cfg.sept_run)
-	{
-		u32 key_idx = 0;
-		if (pkg1_id->kb >= KB_FIRMWARE_VERSION_810)
-			key_idx = 1;
-
-		if (h_cfg.eks && h_cfg.eks->enabled[key_idx] >= pkg1_id->kb)
-		{
-			h_cfg.sept_run = true;
-			goto out_free;
-		}
-
-		u8 *bct_bldr = (u8 *)calloc(1, 512);
-		sdmmc_storage_read(&emmc_storage, 0x2200 / NX_EMMC_BLOCKSIZE, 1, bct_bldr);
-		u32 bootloader_entrypoint = *(u32 *)&bct_bldr[0x144];
-		free(bct_bldr);
-		if (bootloader_entrypoint > SEPT_PRI_ENTRY)
-		{
-			gfx_con.mute = false;
-			EPRINTF("Failed to run sept\n""Main BCT is improper!\nRun sept with proper BCT at least once\nto cache keys.");
-			gfx_printf("\nPress any key...\n");
-			display_backlight_brightness(h_cfg.backlight, 1000);
-			msleep(500);
-			btn_wait();
-			goto out_free;
-		}
-
-		sdmmc_storage_end(&emmc_storage);
-		reboot_to_sept((u8 *)pkg1 + pkg1_id->tsec_off, pkg1_id->kb, cfg_sec);
-	}
-
-out_free:
-	free(pkg1);
-	sdmmc_storage_end(&emmc_storage);
-}
-
-int reboot_to_sept(const u8 *tsec_fw, u32 kb, ini_sec_t *cfg_sec)
-{
-	FIL fp;
-	bool fss0_sept_used = false;
-
-	// Copy warmboot reboot code and TSEC fw.
-	u32 tsec_fw_size = 0x3000;
-	if (kb > KB_FIRMWARE_VERSION_700)
-		tsec_fw_size = 0x3300;
-	memcpy((u8 *)(SEPT_PK1T_ADDR - WB_RST_SIZE), (u8 *)warmboot_reboot, sizeof(warmboot_reboot));
-	memcpy((void *)SEPT_PK1T_ADDR, tsec_fw, tsec_fw_size);
-	*(vu32 *)SEPT_TCSZ_ADDR = tsec_fw_size;
-
-	if (cfg_sec)
-	{
-		fss0_sept_t sept_ctxt;
-		sept_ctxt.kb = kb;
-		sept_ctxt.cfg_sec = cfg_sec;
-		sept_ctxt.sept_primary = (void *)SEPT_STG1_ADDR;
-		sept_ctxt.sept_secondary = (void *)SEPT_STG2_ADDR;
-
-		fss0_sept_used = load_sept_from_ffs0(&sept_ctxt);
-	}
-
-	if (!fss0_sept_used)
-	{
-		// Copy sept-primary.
-		if (f_open(&fp, "sept/sept-primary.bin", FA_READ))
-			goto error;
-
-		if (f_read(&fp, (u8 *)SEPT_STG1_ADDR, f_size(&fp), NULL))
-		{
-			f_close(&fp);
-			goto error;
-		}
-		f_close(&fp);
-
-		// Copy sept-secondary.
-		if (kb < KB_FIRMWARE_VERSION_810)
-		{
-			if (f_open(&fp, "sept/sept-secondary_00.enc", FA_READ))
-				goto error;
-		}
-		else
-		{
-			if (f_open(&fp, "sept/sept-secondary_01.enc", FA_READ))
-				goto error;
-		}
-
-		if (f_read(&fp, (u8 *)SEPT_STG2_ADDR, f_size(&fp), NULL))
-		{
-			f_close(&fp);
-			goto error;
-		}
-		f_close(&fp);
-	}
-
-	b_cfg.boot_cfg |= (BOOT_CFG_AUTOBOOT_EN | BOOT_CFG_SEPT_RUN);
-
-	bool update_sept_payload = true;
-	if (!f_open(&fp, "sept/payload.bin", FA_READ | FA_WRITE))
-	{
-		ipl_ver_meta_t tmp_ver;
-		f_lseek(&fp, PATCHED_RELOC_SZ + sizeof(boot_cfg_t));
-		f_read(&fp, &tmp_ver, sizeof(ipl_ver_meta_t), NULL);
-
-		if (tmp_ver.magic == ipl_ver.magic)
-		{
-			if (tmp_ver.version == ipl_ver.version)
-			{
-				// Save auto boot config to sept payload, if any.
-				boot_cfg_t *tmp_cfg = malloc(sizeof(boot_cfg_t));
-				memcpy(tmp_cfg, &b_cfg, sizeof(boot_cfg_t));
-				f_lseek(&fp, PATCHED_RELOC_SZ);
-				f_write(&fp, tmp_cfg, sizeof(boot_cfg_t), NULL);
-				update_sept_payload = false;
-			}
-
-			f_close(&fp);
-		}
-		else
-		{
-			f_close(&fp);
-			f_rename("sept/payload.bin", "sept/payload.bak"); // Backup foreign payload.
-		}
-	}
-
-	if (update_sept_payload)
-	{
-		volatile reloc_meta_t *reloc = (reloc_meta_t *)(IPL_LOAD_ADDR + RELOC_META_OFF);
-		f_mkdir("sept");
-		f_open(&fp, "sept/payload.bin", FA_WRITE | FA_CREATE_ALWAYS);
-		f_write(&fp, (u8 *)reloc->start, reloc->end - reloc->start, NULL);
-		f_close(&fp);
-	}
-
-	sd_end();
-
-	u32 pk1t_sept = SEPT_PK1T_ADDR - (ALIGN(PATCHED_RELOC_SZ, 0x10) + WB_RST_SIZE);
-
-	void (*sept)() = (void *)pk1t_sept;
-
-	reloc_patcher(WB_RST_ADDR, pk1t_sept, SEPT_PKG_SZ);
-
-	// Patch SDRAM init to perform an SVC immediately after second write.
-	PMC(APBDEV_PMC_SCRATCH45) = 0x2E38DFFF;
-	PMC(APBDEV_PMC_SCRATCH46) = 0x6001DC28;
-	// Set SVC handler to jump to sept-primary in IRAM.
-	PMC(APBDEV_PMC_SCRATCH33) = SEPT_PRI_ADDR;
-	PMC(APBDEV_PMC_SCRATCH40) = 0x6000F208;
-
-	hw_reinit_workaround(false, 0);
-
-	(*sept)();
-
-error:
-	gfx_con.mute = false;
-	EPRINTF("Failed to run sept\n");
-
-	btn_wait();
-
-	return 0;
-}

bootloader/hos/sept.h

@@ -1,25 +0,0 @@
-/*
- * Copyright (c) 2019 CTCaer
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#ifndef _SEPT_H_
-#define _SEPT_H_
-
-#include <utils/types.h>
-
-void check_sept(ini_sec_t *cfg_sec);
-int  reboot_to_sept(const u8 *tsec_fw, u32 kb, ini_sec_t *cfg_sec);
-
-#endif

bootloader/link.ld

@@ -5,8 +5,8 @@ SECTIONS {
 	. = __ipl_start;
 	.text : {
 		*(.text._start);
-		*(._boot_cfg);
-		*(._ipl_version);
+		KEEP(*(._boot_cfg));
+		KEEP(*(._ipl_version));
 		*(.text._irq_setup);
 		*(.text*);
 	}

bootloader/main.c

@@ -28,7 +28,6 @@
 #include "gfx/tui.h"
 #include "hos/hos.h"
 #include "hos/secmon_exo.h"
-#include "hos/sept.h"
 #include <ianos/ianos.h>
 #include <libs/compr/blz.h>
 #include <libs/fatfs/ff.h>
@@ -108,6 +107,15 @@ void emmcsn_path_impl(char *path, char *sub_dir, char *filename, sdmmc_storage_t
 		sdmmc_storage_end(&emmc_storage);
 }
 
+void render_default_bootlogo()
+{
+	gfx_clear_grey(0x1B);
+	u8 *BOOTLOGO = (void *)malloc(SZ_16K);
+	blz_uncompress_srcdest(BOOTLOGO_BLZ, SZ_BOOTLOGO_BLZ, BOOTLOGO, SZ_BOOTLOGO);
+	gfx_set_rect_grey(BOOTLOGO, X_BOOTLOGO, Y_BOOTLOGO, 326, 544);
+	free(BOOTLOGO);
+}
+
 void check_power_off_from_hos()
 {
 	// Power off on AutoRCM wakeup from HOS shutdown. For modchips/dongles.
@@ -121,10 +129,7 @@ void check_power_off_from_hos()
 
 		if (h_cfg.autohosoff == 1)
 		{
-			gfx_clear_grey(0x1B);
-			u8 *BOOTLOGO = (void *)malloc(0x4000);
-			blz_uncompress_srcdest(BOOTLOGO_BLZ, SZ_BOOTLOGO_BLZ, BOOTLOGO, SZ_BOOTLOGO);
-			gfx_set_rect_grey(BOOTLOGO, X_BOOTLOGO, Y_BOOTLOGO, 326, 544);
+			render_default_bootlogo();
 
 			display_backlight_brightness(10, 5000);
 			display_backlight_brightness(100, 25000);
@@ -143,6 +148,7 @@ void check_power_off_from_hos()
 #define EXT_PAYLOAD_ADDR    0xC0000000
 #define RCM_PAYLOAD_ADDR    (EXT_PAYLOAD_ADDR + ALIGN(PATCHED_RELOC_SZ, 0x10))
 #define COREBOOT_END_ADDR   0xD0000000
+#define COREBOOT_VER_OFF    0x41
 #define CBFS_DRAM_EN_ADDR   0x4003e000
 #define  CBFS_DRAM_MAGIC    0x4452414D // "DRAM"
 
@@ -204,9 +210,9 @@ bool is_ipl_updated(void *buf, char *path, bool force)
 	return true;
 }
 
-int launch_payload(char *path, bool update)
+int launch_payload(char *path, bool update, bool clear_screen)
 {
-	if (!update)
+	if (clear_screen)
 		gfx_clear_grey(0x1B);
 	gfx_con_setpos(0, 0);
 
@@ -215,7 +221,7 @@ int launch_payload(char *path, bool update)
 		FIL fp;
 		if (f_open(&fp, path, FA_READ))
 		{
-			gfx_con.mute = 0;
+			gfx_con.mute = false;
 			EPRINTFARGS("Payload file is missing!\n(%s)", path);
 
 			goto out;
@@ -235,7 +241,7 @@ int launch_payload(char *path, bool update)
 			{
 				f_close(&fp);
 
-				gfx_con.mute = 0;
+				gfx_con.mute = false;
 				EPRINTF("Coreboot not allowed on Mariko!");
 
 				goto out;
@@ -268,7 +274,12 @@ int launch_payload(char *path, bool update)
 		else
 		{
 			reloc_patcher(PATCHED_RELOC_ENTRY, EXT_PAYLOAD_ADDR, 0x7000);
-			hw_reinit_workaround(true, 0);
+
+			// Get coreboot seamless display magic.
+			u32 magic = 0;
+			char *magic_ptr = buf + COREBOOT_VER_OFF;
+			memcpy(&magic, magic_ptr + strlen(magic_ptr) - 4, 4);
+			hw_reinit_workaround(true, magic);
 		}
 
 		// Some cards (Sandisk U1), do not like a fast power cycle. Wait min 100ms.
@@ -282,6 +293,7 @@ int launch_payload(char *path, bool update)
 			(*ext_payload_ptr)();
 		else
 		{
+			// Set updated flag to skip check on launch.
 			EMC(EMC_SCRATCH0) |= EMC_HEKA_UPD;
 			(*update_ptr)();
 		}
@@ -296,13 +308,14 @@ out:
 
 void auto_launch_update()
 {
+	// Check if already chainloaded update and clear flag. Otherwise check for updates.
 	if (EMC(EMC_SCRATCH0) & EMC_HEKA_UPD)
 		EMC(EMC_SCRATCH0) &= ~EMC_HEKA_UPD;
 	else if (sd_mount())
 	{
 		// Check if update.bin exists and is newer and launch it. Otherwise create it.
 		if (!f_stat("bootloader/update.bin", NULL))
-			launch_payload("bootloader/update.bin", true);
+			launch_payload("bootloader/update.bin", true, false);
 		else
 		{
 			u8 *buf = calloc(0x200, 1);
@@ -387,7 +400,7 @@ void launch_tools()
 		memcpy(dir + strlen(dir), "/", 2);
 		memcpy(dir + strlen(dir), file_sec, strlen(file_sec) + 1);
 
-		launch_payload(dir, false);
+		launch_payload(dir, false, true);
 		EPRINTF("Failed to launch payload.");
 	}
 
@@ -448,7 +461,7 @@ void ini_list_launcher()
 				if (cfg_sec)
 				{
 					u32 non_cfg = 1;
-					for (int j = 2; j < i; j++)
+					for (u32 j = 2; j < i; j++)
 					{
 						if (ments[j].type != INI_CHOICE)
 							non_cfg++;
@@ -483,9 +496,6 @@ void ini_list_launcher()
 					goto wrong_emupath;
 				}
 
-				if (cfg_sec && !payload_path)
-					check_sept(cfg_sec);
-
 				if (!cfg_sec)
 				{
 					free(ments);
@@ -506,7 +516,7 @@ void ini_list_launcher()
 
 	if (payload_path)
 	{
-		launch_payload(payload_path, false);
+		launch_payload(payload_path, false, true);
 		EPRINTF("Failed to launch payload.");
 		free(payload_path);
 	}
@@ -517,7 +527,7 @@ wrong_emupath:
 		if (emummc_path)
 		{
 			sd_mount();
-			emummc_load_cfg();
+			emummc_load_cfg(); // Reload emuMMC config in case of emupath.
 		}
 	}
 
@@ -540,6 +550,9 @@ void launch_firmware()
 
 	if (sd_mount())
 	{
+		// Load emuMMC configuration.
+		emummc_load_cfg();
+
 		if (ini_parse(&ini_sections, "bootloader/hekate_ipl.ini", false))
 		{
 			// Build configuration menu.
@@ -590,7 +603,7 @@ void launch_firmware()
 			if (cfg_sec)
 			{
 				u8 non_cfg = 4;
-				for (int j = 5; j < i; j++)
+				for (u32 j = 5; j < i; j++)
 				{
 					if (ments[j].type != INI_CHOICE)
 						non_cfg++;
@@ -624,9 +637,6 @@ void launch_firmware()
 				goto wrong_emupath;
 			}
 
-			if (cfg_sec && !payload_path)
-				check_sept(cfg_sec);
-
 			if (!cfg_sec)
 			{
 				free(ments);
@@ -648,7 +658,7 @@ void launch_firmware()
 
 	if (payload_path)
 	{
-		launch_payload(payload_path, false);
+		launch_payload(payload_path, false, true);
 		EPRINTF("Failed to launch payload.");
 		free(payload_path);
 	}
@@ -659,7 +669,7 @@ wrong_emupath:
 		if (emummc_path)
 		{
 			sd_mount();
-			emummc_load_cfg();
+			emummc_load_cfg(); // Reload emuMMC config in case of emupath.
 		}
 	}
 
@@ -683,12 +693,7 @@ void nyx_load_run()
 
 	sd_end();
 
-	// Show loading logo.
-	gfx_clear_grey(0x1B);
-	u8 *BOOTLOGO = (void *)malloc(0x4000);
-	blz_uncompress_srcdest(BOOTLOGO_BLZ, SZ_BOOTLOGO_BLZ, BOOTLOGO, SZ_BOOTLOGO);
-	gfx_set_rect_grey(BOOTLOGO, X_BOOTLOGO, Y_BOOTLOGO, 326, 544);
-	free(BOOTLOGO);
+	render_default_bootlogo();
 	display_backlight_brightness(h_cfg.backlight, 1000);
 
 	// Check if Nyx version is old.
@@ -714,12 +719,6 @@ void nyx_load_run()
 	nyx_str->cfg = 0;
 	if (b_cfg.extra_cfg)
 	{
-		if (b_cfg.extra_cfg & EXTRA_CFG_NYX_SEPT)
-		{
-			b_cfg.extra_cfg &= ~(EXTRA_CFG_NYX_SEPT);
-			nyx_str->cfg |= NYX_CFG_SEPT;
-			nyx_str->cfg |= b_cfg.sept << 24;
-		}
 		if (b_cfg.extra_cfg & EXTRA_CFG_NYX_UMS)
 		{
 			b_cfg.extra_cfg &= ~(EXTRA_CFG_NYX_UMS);
@@ -798,24 +797,6 @@ static void _bootloader_corruption_protect()
 
 static void _auto_launch_firmware()
 {
-	if(b_cfg.extra_cfg & EXTRA_CFG_NYX_SEPT)
-	{
-		if (!h_cfg.sept_run)
-			EMC(EMC_SCRATCH0) |= EMC_HEKA_UPD;
-		check_sept(NULL);
-	}
-
-	if (!h_cfg.sept_run)
-		auto_launch_update();
-
-	u8 *BOOTLOGO = NULL;
-	char *payload_path = NULL;
-	char *emummc_path = NULL;
-	u32 btn = 0;
-	bool boot_from_id = (b_cfg.boot_cfg & BOOT_CFG_FROM_ID) && (b_cfg.boot_cfg & BOOT_CFG_AUTOBOOT_EN);
-	if (boot_from_id)
-		b_cfg.id[7] = 0;
-
 	struct _bmp_data
 	{
 		u32 size;
@@ -826,19 +807,27 @@ static void _auto_launch_firmware()
 		u32 pos_y;
 	};
 
-	struct _bmp_data bmpData;
-	bool bootlogoFound = false;
+	char *emummc_path = NULL;
 	char *bootlogoCustomEntry = NULL;
+	ini_sec_t *cfg_sec = NULL;
+
+	auto_launch_update();
+
+	bool boot_from_id = (b_cfg.boot_cfg & BOOT_CFG_FROM_ID) && (b_cfg.boot_cfg & BOOT_CFG_AUTOBOOT_EN);
+	if (boot_from_id)
+		b_cfg.id[7] = 0;
 
 	if (!(b_cfg.boot_cfg & BOOT_CFG_FROM_LAUNCH))
 		gfx_con.mute = true;
 
-	ini_sec_t *cfg_sec = NULL;
 	LIST_INIT(ini_sections);
 	LIST_INIT(ini_list_sections);
 
 	if (sd_mount())
 	{
+		// Load emuMMC configuration.
+		emummc_load_cfg();
+
 		if (f_stat("bootloader/hekate_ipl.ini", NULL))
 			create_config_entry();
 
@@ -863,7 +852,17 @@ static void _auto_launch_firmware()
 							else if (!strcmp("autoboot_list", kv->key))
 								h_cfg.autoboot_list = atoi(kv->val);
 							else if (!strcmp("bootwait", kv->key))
+							{
 								h_cfg.bootwait = atoi(kv->val);
+
+								/*
+								 * Clamp value to default if it exceeds 20s to protect against corruption.
+								 * Allow up to 20s though for use in cases where user needs lots of time.
+								 * For example dock-only use and r2p with enough time to reach dock and cancel it.
+								*/
+								if (h_cfg.bootwait > 20)
+									h_cfg.bootwait = 3;
+							}
 							else if (!strcmp("backlight", kv->key))
 								h_cfg.backlight = atoi(kv->val);
 							else if (!strcmp("autohosoff", kv->key))
@@ -877,17 +876,12 @@ static void _auto_launch_firmware()
 						}
 						boot_entry_id++;
 
-						// Override autoboot, otherwise save it for a possbile sept run.
+						// Override autoboot.
 						if (b_cfg.boot_cfg & BOOT_CFG_AUTOBOOT_EN)
 						{
 							h_cfg.autoboot = b_cfg.autoboot;
 							h_cfg.autoboot_list = b_cfg.autoboot_list;
 						}
-						else
-						{
-							b_cfg.autoboot = h_cfg.autoboot;
-							b_cfg.autoboot_list = h_cfg.autoboot_list;
-						}
 
 						// Apply bootloader protection against corruption.
 						_bootloader_corruption_protect();
@@ -977,9 +971,13 @@ skip_list:
 		goto out;
 
 	u8 *bitmap = NULL;
-	if (!(b_cfg.boot_cfg & BOOT_CFG_FROM_LAUNCH) && h_cfg.bootwait && !h_cfg.sept_run)
+	struct _bmp_data bmpData;
+	bool bootlogoFound = false;
+	if (!(b_cfg.boot_cfg & BOOT_CFG_FROM_LAUNCH) && h_cfg.bootwait)
 	{
 		u32 fsize;
+		u8 *BOOTLOGO = NULL;
+
 		if (bootlogoCustomEntry) // Check if user set custom logo path at the boot entry.
 			bitmap = (u8 *)sd_file_read(bootlogoCustomEntry, &fsize);
 
@@ -1004,10 +1002,10 @@ skip_list:
 				bmpData.size_x <= 720 &&
 				bmpData.size_y <= 1280)
 			{
-				if (bmpData.size <= fsize && ((bmpData.size - bmpData.offset) < 0x400000))
+				if (bmpData.size <= fsize && ((bmpData.size - bmpData.offset) < SZ_4M))
 				{
 					// Avoid unaligned access from BM 2-byte MAGIC and remove header.
-					BOOTLOGO = (u8 *)malloc(0x400000);
+					BOOTLOGO = (u8 *)malloc(SZ_4M);
 					memcpy(BOOTLOGO, bitmap + bmpData.offset, bmpData.size - bmpData.offset);
 					free(bitmap);
 					// Center logo if res < 720x1280.
@@ -1029,36 +1027,31 @@ skip_list:
 		{
 			gfx_render_bmp_argb((u32 *)BOOTLOGO, bmpData.size_x, bmpData.size_y,
 				bmpData.pos_x, bmpData.pos_y);
+			free(BOOTLOGO);
 		}
 		else
-		{
-			gfx_clear_grey(0x1B);
-			BOOTLOGO = (void *)malloc(0x4000);
-			blz_uncompress_srcdest(BOOTLOGO_BLZ, SZ_BOOTLOGO_BLZ, BOOTLOGO, SZ_BOOTLOGO);
-			gfx_set_rect_grey(BOOTLOGO, X_BOOTLOGO, Y_BOOTLOGO, 326, 544);
-		}
-		free(BOOTLOGO);
+			render_default_bootlogo();
 	}
 
 	if (b_cfg.boot_cfg & BOOT_CFG_FROM_LAUNCH)
 		display_backlight_brightness(h_cfg.backlight, 0);
-	else if (!h_cfg.sept_run && h_cfg.bootwait)
+	else if (h_cfg.bootwait)
 		display_backlight_brightness(h_cfg.backlight, 1000);
 
 	// Wait before booting. If VOL- is pressed go into bootloader menu.
-	if (!h_cfg.sept_run && !(b_cfg.boot_cfg & BOOT_CFG_FROM_LAUNCH))
+	if (!(b_cfg.boot_cfg & BOOT_CFG_FROM_LAUNCH))
 	{
-		btn = btn_wait_timeout_single(h_cfg.bootwait * 1000, BTN_VOL_DOWN | BTN_SINGLE);
+		u32 btn = btn_wait_timeout_single(h_cfg.bootwait * 1000, BTN_VOL_DOWN | BTN_SINGLE);
 
 		if (btn & BTN_VOL_DOWN)
 			goto out;
 	}
 
-	payload_path = ini_check_payload_section(cfg_sec);
+	char *payload_path = ini_check_payload_section(cfg_sec);
 
 	if (payload_path)
 	{
-		launch_payload(payload_path, false);
+		launch_payload(payload_path, false, false);
 		free(payload_path);
 		goto payload_error;
 	}
@@ -1073,7 +1066,6 @@ skip_list:
 			goto wrong_emupath;
 		}
 
-		check_sept(cfg_sec);
 		hos_launch(cfg_sec);
 
 wrong_emupath:
@@ -1082,11 +1074,11 @@ wrong_emupath:
 		if (emummc_path || b_cfg.boot_cfg & BOOT_CFG_TO_EMUMMC)
 		{
 			sd_mount();
-			emummc_load_cfg();
+			emummc_load_cfg(); // Reload emuMMC config in case of emupath.
 		}
 
 payload_error:
-		gfx_con.mute = 0;
+		gfx_con.mute = false;
 		gfx_printf("\nPress any key...\n");
 		display_backlight_brightness(h_cfg.backlight, 1000);
 		msleep(500);
@@ -1099,7 +1091,6 @@ out:
 	// Clear boot reasons from binary.
 	if (b_cfg.boot_cfg & (BOOT_CFG_FROM_ID | BOOT_CFG_TO_EMUMMC))
 		memset(b_cfg.xt_str, 0, sizeof(b_cfg.xt_str));
-	b_cfg.boot_cfg &= BOOT_CFG_SEPT_RUN;
 	h_cfg.emummc_force_disable = false;
 
 	// L4T: Clear custom boot mode flags from PMC_SCRATCH0.
@@ -1108,47 +1099,6 @@ out:
 	nyx_load_run();
 }
 
-static void _patched_rcm_protection()
-{
-	if (!h_cfg.rcm_patched || hw_get_chip_id() == GP_HIDREV_MAJOR_T210B01)
-		return;
-
-	// Check if AutoRCM is enabled and protect from a permanent brick.
-	if (!sdmmc_storage_init_mmc(&emmc_storage, &emmc_sdmmc, SDMMC_BUS_WIDTH_8, SDHCI_TIMING_MMC_HS400))
-		return;
-
-	u8 *buf = (u8 *)malloc(0x200);
-	sdmmc_storage_set_mmc_partition(&emmc_storage, EMMC_BOOT0);
-
-	u32 sector;
-	u8 corr_mod0, mod1;
-
-	// Get the correct RSA modulus byte masks.
-	nx_emmc_get_autorcm_masks(&corr_mod0, &mod1);
-
-	// Iterate BCTs.
-	for (u32 i = 0; i < 4; i++)
-	{
-		sector = 1 + (32 * i); // 0x4000 bct + 0x200 offset.
-		sdmmc_storage_read(&emmc_storage, sector, 1, buf);
-
-		// Check if 2nd byte of modulus is correct.
-		if (buf[0x11] != mod1)
-			continue;
-
-		// If AutoRCM is enabled, disable it.
-		if (buf[0x10] != corr_mod0)
-		{
-			buf[0x10] = corr_mod0;
-
-			sdmmc_storage_write(&emmc_storage, sector, 1, buf);
-		}
-	}
-
-	free(buf);
-	sdmmc_storage_end(&emmc_storage);
-}
-
 #define EXCP_EN_ADDR   0x4003FFFC
 #define  EXCP_MAGIC 0x30505645      // EVP0
 #define EXCP_TYPE_ADDR 0x4003FFF8
@@ -1163,17 +1113,26 @@ static void _show_errors()
 	u32 *excp_enabled = (u32 *)EXCP_EN_ADDR;
 	u32 *excp_type = (u32 *)EXCP_TYPE_ADDR;
 	u32 *excp_lr = (u32 *)EXCP_LR_ADDR;
+	u32 panic_status = hw_rst_status & 0xFFFFF;
 
 	if (*excp_enabled == EXCP_MAGIC)
 		h_cfg.errors |= ERR_EXCEPTION;
 
-	//! FIXME: Find a better way to identify if that scratch has proper data.
-	if (0 && PMC(APBDEV_PMC_SCRATCH37) & PMC_SCRATCH37_KERNEL_PANIC_FLAG)
+#if 0 //! FIXME: Find a better way to identify if that scratch has proper data.
+	if (PMC(APBDEV_PMC_SCRATCH37) & PMC_SCRATCH37_KERNEL_PANIC_FLAG)
 	{
 		// Set error and clear flag.
 		h_cfg.errors |= ERR_L4T_KERNEL;
 		PMC(APBDEV_PMC_SCRATCH37) &= ~PMC_SCRATCH37_KERNEL_PANIC_FLAG;
 	}
+#endif
+
+	if (hw_rst_reason == PMC_RST_STATUS_WATCHDOG &&
+		panic_status <= 0xFF && panic_status != 0x20 && panic_status != 0x21)
+		h_cfg.errors |= ERR_PANIC_CODE;
+
+	// Check if we had a panic while in CFW.
+	secmon_exo_check_panic();
 
 	if (h_cfg.errors)
 	{
@@ -1216,17 +1175,34 @@ static void _show_errors()
 			*excp_enabled = 0;
 		}
 
+#if 0 //! FIXME: Find a better way to identify if that scratch has proper data.
 		if (0 && h_cfg.errors & ERR_L4T_KERNEL)
 		{
-			WPRINTF("Panic occurred while running L4T.\n");
+			WPRINTF("A kernel panic occurred!\n");
 			if (!sd_save_to_file((void *)PSTORE_ADDR, PSTORE_SZ, "L4T_panic.bin"))
 				WPRINTF("PSTORE saved to L4T_panic.bin\n");
 		}
+#endif
+
+		if (h_cfg.errors & ERR_PANIC_CODE)
+		{
+			u32 r = (hw_rst_status >> 20) & 0xF;
+			u32 g = (hw_rst_status >> 24) & 0xF;
+			u32 b = (hw_rst_status >> 28) & 0xF;
+			r = (r << 16) | (r << 20);
+			g = (g << 8) | (g << 12);
+			b = (b << 0) | (b << 4);
+			u32 color = r | g | b;
+
+			WPRINTF("A panic error occurred!\n");
+			gfx_printf("Color: %k####%k, Code: %02X\n\n", color, 0xFFCCCCCC, panic_status);
+		}
 
 		WPRINTF("Press any key...");
 
-		msleep(1000);
+		msleep(1000); // Guard against injection VOL+.
 		btn_wait();
+		msleep(500);  // Guard against force menu VOL-.
 	}
 }
 
@@ -1248,7 +1224,7 @@ static void _check_low_battery()
 		goto out;
 
 	// Prepare battery icon resources.
-	u8 *battery_res = malloc(ALIGN(SZ_BATTERY_EMPTY, 0x1000));
+	u8 *battery_res = malloc(ALIGN(SZ_BATTERY_EMPTY, SZ_4K));
 	blz_uncompress_srcdest(BATTERY_EMPTY_BLZ, SZ_BATTERY_EMPTY_BLZ, battery_res, SZ_BATTERY_EMPTY);
 
 	u8 *battery_icon = malloc(0x95A);  // 21x38x3
@@ -1355,8 +1331,8 @@ void ipl_reload()
 static void _about()
 {
 	static const char credits[] =
-		"\nhekate     (c) 2018 naehrwert, st4rk\n\n"
-		"CTCaer mod (c) 2018 CTCaer\n"
+		"\nhekate   (c) 2018,      naehrwert, st4rk\n\n"
+		"         (c) 2018-2021, CTCaer\n\n"
 		" ___________________________________________\n\n"
 		"Thanks to: %kderrek, nedwill, plutoo,\n"
 		"           shuffle2, smea, thexyz, yellows8%k\n"
@@ -1365,15 +1341,15 @@ static void _about()
 		"              Shiny Quagsire, WinterMute\n"
 		" ___________________________________________\n\n"
 		"Open source and free packages used:\n\n"
-		" - FatFs R0.13b,\n"
-		"   Copyright (c) 2018, ChaN\n\n"
-		" - bcl-1.2.0,\n"
-		"   Copyright (c) 2003-2006, Marcus Geelnard\n\n"
-		" - Atmosphere (Exo st/types, prc id patches),\n"
-		"   Copyright (c) 2018-2019, Atmosphere-NX\n\n"
-		" - elfload,\n"
-		"   Copyright (c) 2014, Owen Shepherd\n"
-		"   Copyright (c) 2018, M4xw\n"
+		" - FatFs R0.13b\n"
+		"   (c) 2018, ChaN\n\n"
+		" - bcl-1.2.0\n"
+		"   (c) 2003-2006, Marcus Geelnard\n\n"
+		" - Atmosphere (Exo st/types, prc id patches)\n"
+		"   (c) 2018-2019, Atmosphere-NX\n\n"
+		" - elfload\n"
+		"   (c) 2014, Owen Shepherd\n"
+		"   (c) 2018, M4xw\n"
 		" ___________________________________________\n\n";
 	static const char octopus[] =
 		"                         %k___\n"
@@ -1405,19 +1381,6 @@ static void _about()
 	btn_wait();
 }
 
-ment_t ment_options[] = {
-	MDEF_BACK(),
-	MDEF_CHGLINE(),
-	MDEF_HANDLER("Auto boot", config_autoboot),
-	MDEF_HANDLER("Boot delay", config_bootdelay),
-	MDEF_HANDLER("Auto NoGC", config_nogc),
-	MDEF_HANDLER("Auto HOS power off", config_auto_hos_poweroff),
-	MDEF_HANDLER("Backlight", config_backlight),
-	MDEF_END()
-};
-
-menu_t menu_options = { ment_options, "Options", 0, 0 };
-
 ment_t ment_cinfo[] = {
 	MDEF_BACK(),
 	MDEF_CHGLINE(),
@@ -1425,7 +1388,6 @@ ment_t ment_cinfo[] = {
 	MDEF_HANDLER("Ipatches & bootrom", bootrom_ipatches_info),
 	MDEF_HANDLER("Fuses", print_fuseinfo),
 	//MDEF_HANDLER("Print kfuse info", print_kfuseinfo),
-	//MDEF_HANDLER("Print TSEC keys", print_tsec_key),
 	MDEF_CHGLINE(),
 	MDEF_CAPTION("-- Storage Info --", 0xFF0AB9E6),
 	MDEF_HANDLER("eMMC", print_mmc_info),
@@ -1476,10 +1438,6 @@ ment_t ment_tools[] = {
 	//MDEF_CHGLINE(),
 	//MDEF_CAPTION("-------- Misc --------", 0xFF0AB9E6),
 	//MDEF_HANDLER("Dump package1/2", dump_packages12),
-	//MDEF_HANDLER("Fix archive bit (except Nintendo)", fix_sd_all_attr),
-	//MDEF_HANDLER("Fix archive bit (Nintendo only)", fix_sd_nin_attr),
-	//MDEF_HANDLER("Fix fuel gauge configuration", fix_fuel_gauge_configuration),
-	//MDEF_HANDLER("Reset all battery cfg", reset_pmic_fuel_gauge_charger_config),
 	//MDEF_CHGLINE(),
 	MDEF_CAPTION("-------- Other -------", 0xFFFFDD00),
 	MDEF_HANDLER("AutoRCM", menu_autorcm),
@@ -1494,7 +1452,6 @@ power_state_t STATE_REBOOT_BYPASS_FUSES = REBOOT_BYPASS_FUSES;
 
 ment_t ment_top[] = {
 	MDEF_HANDLER("Launch", launch_firmware),
-	//MDEF_MENU("Options", &menu_options),
 	MDEF_CAPTION("---------------", 0xFF444444),
 	MDEF_MENU("Tools",        &menu_tools),
 	MDEF_MENU("Console info", &menu_cinfo),
@@ -1508,7 +1465,7 @@ ment_t ment_top[] = {
 	MDEF_END()
 };
 
-menu_t menu_top = { ment_top, "hekate - CTCaer mod v5.5.4", 0, 0 };
+menu_t menu_top = { ment_top, "hekate v5.6.5", 0, 0 };
 
 extern void pivot_stack(u32 stack_top);
 
@@ -1538,8 +1495,7 @@ void ipl_main()
 	h_cfg.errors |= !sd_mount() ? ERR_SD_BOOT_EN : 0;
 
 	// Save sdram lp0 config.
-	void *sdram_params =
-		hw_get_chip_id() == GP_HIDREV_MAJOR_T210 ? sdram_get_params_patched() : sdram_get_params_t210b01();
+	void *sdram_params = h_cfg.t210b01 ? sdram_get_params_t210b01() : sdram_get_params_patched();
 	if (!ianos_loader("bootloader/sys/libsys_lp0.bso", DRAM_LIB, sdram_params))
 		h_cfg.errors |= ERR_LIBSYS_LP0;
 
@@ -1558,18 +1514,9 @@ void ipl_main()
 	//display_backlight_brightness(h_cfg.backlight, 1000);
 
 	// Overclock BPMP.
-	bpmp_clk_rate_set(BPMP_CLK_DEFAULT_BOOST);
+	bpmp_clk_rate_set(h_cfg.t210b01 ? BPMP_CLK_DEFAULT_BOOST : BPMP_CLK_LOWER_BOOST);
 
-	// Check if we had a panic while in CFW.
-	secmon_exo_check_panic();
-
-	// Check if RCM is patched and protect from a possible brick.
-	_patched_rcm_protection();
-
-	// Load emuMMC configuration from SD.
-	emummc_load_cfg();
-
-	// Show exception, library errors and L4T kernel panics.
+	// Show exceptions, HOS errors, library errors and L4T kernel panics.
 	_show_errors();
 
 	// Load saved configuration and auto boot if enabled.

bootloader/storage/emummc.c

@@ -42,9 +42,9 @@ void emummc_load_cfg()
 	emu_cfg.active_part = 0;
 	emu_cfg.fs_ver = 0;
 	if (!emu_cfg.nintendo_path)
-		emu_cfg.nintendo_path = (char *)malloc(0x80);
+		emu_cfg.nintendo_path = (char *)malloc(0x200);
 	if (!emu_cfg.emummc_file_based_path)
-		emu_cfg.emummc_file_based_path = (char *)malloc(0x80);
+		emu_cfg.emummc_file_based_path = (char *)malloc(0x200);
 
 	emu_cfg.nintendo_path[0] = 0;
 	emu_cfg.emummc_file_based_path[0] = 0;
@@ -109,7 +109,14 @@ bool emummc_set_path(char *path)
 	if (found)
 	{
 		emu_cfg.enabled = 1;
-		emu_cfg.id = 0;
+
+		// Get ID from path.
+		u32 id_from_path = 0;
+		u32 path_size = strlen(path);
+		if (path_size >= 4)
+			memcpy(&id_from_path, path + path_size - 4, 4);
+		emu_cfg.id = id_from_path;
+
 		strcpy(emu_cfg.nintendo_path, path);
 		strcat(emu_cfg.nintendo_path, "/Nintendo");
 	}

bootloader/storage/emummc.h

@@ -37,7 +37,7 @@ typedef struct _emummc_cfg_t
 {
 	int   enabled;
 	u64   sector;
-	u16   id;
+	u32   id;
 	char *path;
 	char *nintendo_path;
 	// Internal.

bootloader/storage/nx_emmc.c

@@ -34,6 +34,10 @@ void nx_emmc_gpt_parse(link_t *gpt, sdmmc_storage_t *storage)
 
 	emummc_storage_read(NX_GPT_FIRST_LBA, NX_GPT_NUM_BLOCKS, gpt_buf);
 
+	// Check if no GPT or more than max allowed entries.
+	if (memcmp(&gpt_buf->header.signature, "EFI PART", 8) || gpt_buf->header.num_part_ents > 128)
+		goto out;
+
 	for (u32 i = 0; i < gpt_buf->header.num_part_ents; i++)
 	{
 		emmc_part_t *part = (emmc_part_t *)calloc(sizeof(emmc_part_t), 1);
@@ -54,6 +58,7 @@ void nx_emmc_gpt_parse(link_t *gpt, sdmmc_storage_t *storage)
 		list_append(gpt, &part->link);
 	}
 
+out:
 	free(gpt_buf);
 }
 

bootloader/storage/nx_sd.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (c) 2018-2019 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -59,6 +59,11 @@ bool sd_get_card_removed()
 	return false;
 }
 
+bool sd_get_card_mounted()
+{
+	return sd_mounted;
+}
+
 u32 sd_get_mode()
 {
 	return sd_mode;

loader/Makefile

@@ -29,8 +29,11 @@ OBJS = $(addprefix $(BUILDDIR)/$(TARGET)/, \
 CUSTOMDEFINES := -DBL_MAGIC=$(IPL_MAGIC)
 CUSTOMDEFINES += -DBL_VER_MJ=$(BLVERSION_MAJOR) -DBL_VER_MN=$(BLVERSION_MINOR) -DBL_VER_HF=$(BLVERSION_HOTFX) -DBL_RESERVED=$(BLVERSION_RSVD)
 
+#TODO: Considering reinstating some of these when pointer warnings have been fixed.
+WARNINGS := -Wall -Wno-array-bounds -Wno-stringop-overflow
+
 ARCH := -march=armv4t -mtune=arm7tdmi -mthumb-interwork
-CFLAGS = $(ARCH) -O2 -g -nostdlib -ffunction-sections -fdata-sections -fomit-frame-pointer -std=gnu11 -Wall $(CUSTOMDEFINES)
+CFLAGS = $(ARCH) -O2 -g -nostdlib -ffunction-sections -fdata-sections -fomit-frame-pointer -std=gnu11 $(WARNINGS) $(CUSTOMDEFINES)
 LDFLAGS = $(ARCH) -nostartfiles -lgcc -Wl,--nmagic,--gc-sections -Xlinker --defsym=LDR_LOAD_ADDR=$(LDR_LOAD_ADDR)
 
 ################################################################################

loader/link.ld

@@ -5,9 +5,9 @@ SECTIONS {
 	. = __ipl_start;
 	.text : {
 		*(.text._start);
-		*(._boot_cfg);
-		*(._ipl_version);
-		*(._octopus);
+		KEEP(*(._boot_cfg));
+		KEEP(*(._ipl_version));
+		KEEP(*(._octopus));
 		*(.text*);
 	}
 	.data : {

loader/loader.c

@@ -59,11 +59,6 @@ const volatile char __attribute__((section ("._octopus"))) octopus[] =
 
 void loader_main()
 {
-	// Preserve sections.
-	__asm__ ("" : : "" (b_cfg));
-	__asm__ ("" : : "" (ipl_ver));
-	__asm__ ("" : : "" (octopus[0]));
-
 	// Preliminary BPMP clocks init.
 	CLOCK(CLK_RST_CONTROLLER_CLK_SYSTEM_RATE) = 0x10;          // Set HCLK div to 2 and PCLK div to 1.
 	CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_SYS) = 0;              // Set SCLK div to 1.

modules/hekate_libsys_lp0/sdram_lp0_param_t210b01.h

@@ -10,7 +10,7 @@
  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  * more details.
  */
- 
+
 #ifndef __TEGRA210B01_SDRAM_PARAM_H__
 #define __TEGRA210B01_SDRAM_PARAM_H__
 
@@ -227,7 +227,6 @@ struct sdram_params_t210b01
 	u32 emc_r2p;
 	/* Specifies the value for EMC_W2P */
 	u32 emc_w2p;
-	/* Specifies the value for EMC_RD_RCD */
 
 	u32 emc_tppd;
 	u32 emc_trtm;
@@ -237,6 +236,7 @@ struct sdram_params_t210b01
 	u32 emc_tr2ref;
 	u32 emc_ccdmw;
 
+	/* Specifies the value for EMC_RD_RCD */
 	u32 emc_rd_rcd;
 	/* Specifies the value for EMC_WR_RCD */
 	u32 emc_wr_rcd;

modules/hekate_libsys_minerva/mtc.h

@@ -53,8 +53,8 @@
 
 typedef struct
 {
-	s32 rate_to;
-	s32 rate_from;
+	u32 rate_to;
+	u32 rate_from;
 	emc_table_t *mtc_table;
 	u32 table_entries;
 	emc_table_t *current_emc_table;
@@ -94,8 +94,8 @@ enum tree_update_mode_t
 
 enum emc_channels
 {
-	EMC_CH0 = 0,
-	EMC_CH1 = 1
+	EMC_CHANNEL0 = 0,
+	EMC_CHANNEL1 = 1
 };
 
 enum EMC_2X_CLK_SRC
@@ -140,7 +140,4 @@ void _minerva_do_over_temp_compensation(mtc_config_t *mtc_cfg);
 /* Over temp and periodic compensation, should not access EMC_MRR at the same time. */
 u32  _minerva_do_periodic_compensation(emc_table_t *mtc_table_entry);
 
-/* Main function used to access all Minerva functions. */
-void _minerva_init(mtc_config_t *mtc_cfg, void* bp);
-
 #endif

modules/hekate_libsys_minerva/mtc_mc_emc_regs.h

@@ -179,7 +179,8 @@
 #define  TIMING_UPDATE_STALLED  (1 << 23)
 #define  MRR_DIVLD              (1 << 20)
 #define  IN_SELF_REFRESH_MASK   (3 << 8)
-#define  IN_POWERDOWN_MASK      (3 << 4)
+#define  IN_POWERDOWN_BOTH_MASK (3 << 4)
+#define  IN_POWERDOWN_1DEV_MASK (1 << 4)
 #define  REQ_FIFO_EMPTY         (1 << 0)
 
 #define EMC_CFG_2                     0x2B8