change samsung dram config to support 8gb

In 12.0.3 only FS is the relevant change.

So add support for 12.0.3 emuMMC and NOGC

README.md

@@ -99,6 +99,15 @@ You can find a template [Here](./res/hekate_ipl_template.ini)
 | icon={SD path}         | Force Nyx to use the icon defined here. If this is not found, it will check for a bmp named as the boot entry ([Test 2] -> `bootloader/res/Test 2.bmp`). Otherwise default will be used. |
 
 
+**Note1**: When using the wildcard (`/*`) with `kip1` you can still use the normal `kip1` after that to load extra single kips.
+
+**Note2**: When using FSS0 it parses exosphere, warmboot and all core kips. You can override the first 2 by using `secmon`/`warmboot` after defining `fss0`.
+You can define `kip1` to load an extra kip or many via the wildcard (`/*`) usage.
+
+**Warning**: Careful when you define *fss0 core* kips when using `fss0` or the folder (when using `/*`) includes them.
+This is in case the kips are incompatible between them. If compatible, you can override `fss0` kips with no issues (useful for testing with intermediate kip changes).
+
+
 ### Boot entry key/value Exosphère combinations:
 
 | Config option          | Description                                                |
@@ -107,15 +116,13 @@ You can find a template [Here](./res/hekate_ipl_template.ini)
 | userpmu=1              | Enables user access to PMU when paired with Exosphère.     |
 | cal0blank=1            | Overrides Exosphère config `blank_prodinfo_{sys/emu}mmc`. If that key doesn't exist, `exosphere.ini` will be used. |
 | cal0writesys=1         | Overrides Exosphère config `allow_writing_to_cal_sysmmc`. If that key doesn't exist, `exosphere.ini` will be used. |
+| usb3force=1            | Overrides system settings mitm config `usb30_force_enabled`. If that key doesn't exist, `system_settings.ini` will be used. |
 
 
-**Note1**: When using the wildcard (`/*`) with `kip1` you can still use the normal `kip1` after that to load extra single kips.
+**Note**: `cal0blank`, `cal0writesys`, `usb3force`, as stated override the `exosphere.ini` or `system_settings.ini`. 0: Disable, 1: Enable, Key Missing: Use original value.
 
-**Note2**: When using FSS0 it parses exosphere, warmboot and all core kips. You can override the first 2 by using `secmon`/`warmboot` after defining `fss0`.
-You can define `kip1` to load an extra kip or many via the wildcard (`/*`) usage.
 
-**Warning**: Never define *fss0 core* kips when using `fss0` and make sure that the folder (when using `/*`), does not include them.
-This is in case the kips are incompatible between them. If compatible, you can override `fss0` kips with no issues (useful for testing with intermediate kip changes).
+**Note2**: `blank_prodinfo_{sys/emu}mmc`, `allow_writing_to_cal_sysmmc` and `usb30_force_enabled` in `exosphere.ini` and `system_settings.ini` respectively, are the only atmosphere config keys that can affect hekate booting configuration externally, **if** the equivalent keys in hekate config are missing.
 
 
 ### Payload storage:

Versions.inc

@@ -1,11 +1,11 @@
 # IPL Version.
 BLVERSION_MAJOR := 5
 BLVERSION_MINOR := 5
-BLVERSION_HOTFX := 6
+BLVERSION_HOTFX := 8
 BLVERSION_RSVD := 0
 
 # Nyx Version.
 NYXVERSION_MAJOR := 1
 NYXVERSION_MINOR := 0
-NYXVERSION_HOTFX := 3
+NYXVERSION_HOTFX := 5
 NYXVERSION_RSVD := 0

bdk/input/als.c

@@ -23,79 +23,117 @@
 #include <soc/pinmux.h>
 #include <utils/util.h>
 
-#define HOS_GAIN  BH1730_GAIN_64X
-#define HOS_ITIME 38
+#define BH1730_DEFAULT_GAIN        BH1730_GAIN_64X
+#define BH1730_DEFAULT_ICYCLE       38
 
-void set_als_cfg(als_table_t *als_val, u8 gain, u8 itime)
+#define BH1730_INTERNAL_CLOCK_NS   2800
+#define BH1730_ADC_CALC_DELAY_US   2000 /* BH1730_INTERNAL_CLOCK_MS * 714 */
+#define BH1730_ITIME_CYCLE_TO_US   2700 /* BH1730_INTERNAL_CLOCK_MS * 964 */
+
+#define BH1730_DEFAULT_ITIME_MS	   100
+
+#define BH1730_LUX_MULTIPLIER      3600
+#define BH1730_LUX_MULTIPLIER_AULA 1410
+
+#define BH1730_LUX_MAX            100000
+
+typedef struct _opt_win_cal_t
 {
-	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_GAIN_REG), gain);
-	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_TIMING_REG), (256 - itime));
+	u32 rc;
+	u32 cv;
+	u32 ci;
+} opt_win_cal_t;
 
-	als_val->gain = gain;
-	als_val->itime = itime;
+// Nintendo Switch Icosa/Iowa Optical Window calibration.
+const opt_win_cal_t opt_win_cal_default[] = {
+	{  500, 5002, 7502 },
+	{  754, 2250, 2000 },
+	{ 1029, 1999, 1667 },
+	{ 1373,  884,  583 },
+	{ 1879,  309,  165 }
+};
+
+// Nintendo Switch Aula Optical Window calibration.
+const opt_win_cal_t opt_win_cal_aula[] = {
+	{  231, 9697, 30300 },
+	{  993, 3333,  2778 },
+	{ 1478, 1621,  1053 },
+	{ 7500,   81,    10 }
+};
+
+const u32 als_gain_idx_tbl[4] = { 1, 2, 64, 128 };
+
+void set_als_cfg(als_ctxt_t *als_ctxt, u8 gain, u8 cycle)
+{
+	if (gain > BH1730_GAIN_128X)
+		gain = BH1730_GAIN_128X;
+
+	if (!cycle)
+		cycle = 1;
+	else if (cycle > 255)
+		cycle = 255;
+
+	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_GAIN_REG), gain);
+	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_TIMING_REG), (256 - cycle));
+
+	als_ctxt->gain = gain;
+	als_ctxt->cycle = cycle;
 }
 
-void get_als_lux(als_table_t *als_val)
+void get_als_lux(als_ctxt_t *als_ctxt)
 {
 	u32 data[2];
-	float pre_gain_lux;
-	float visible_light;
-	float ir_light;
-	float light_ratio;
+	u32 visible_light;
+	u32 ir_light;
+	u64 lux = 0;
+	u32 itime_us = BH1730_ITIME_CYCLE_TO_US * als_ctxt->cycle;
 
-	u8 adc_ready = 0;
-	u8 retries = 100;
-
-	const float als_gain_idx_tbl[4] = { 1.0, 2.0, 64.0, 128.0 };
-	const float als_norm_res = 100.0;
-	const float als_multiplier = 3.6;
-	const float als_tint = 2.7;
-
-	// Wait for ADC to prepare new data.
-	while (!(adc_ready & BH1730_CTL_ADC_VALID) && retries)
-	{
-		retries--;
-		adc_ready = i2c_recv_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_CONTROL_REG));
-	}
-
-	// Get visible and ir light raw data.
+	// Get visible and ir light raw data. Mode is continuous so waiting for new values doesn't matter.
 	data[0] = i2c_recv_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_DATA0LOW_REG)) +
 		(i2c_recv_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_DATA0HIGH_REG)) << 8);
 	data[1] = i2c_recv_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_DATA1LOW_REG)) +
 		(i2c_recv_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_DATA1HIGH_REG)) << 8);
 
-	als_val->over_limit = data[0] > 65534 || data[1] > 65534;
-	als_val->vi_light = data[0];
-	als_val->ir_light = data[1];
+	visible_light = data[0];
+	ir_light = data[1];
 
-	if (!data[0] || !retries)
+	als_ctxt->over_limit = visible_light > 65534 || ir_light > 65534;
+	als_ctxt->vi_light = visible_light;
+	als_ctxt->ir_light = ir_light;
+
+	if (!visible_light)
 	{
-		als_val->lux = 0.0;
+		als_ctxt->lux = 0;
 
 		return;
 	}
 
-	visible_light = (float)data[0];
-	ir_light = (float)data[1];
-	light_ratio = (float)data[1] / (float)data[0];
+	// Set calibration parameters.
+	u32 lux_multiplier = BH1730_LUX_MULTIPLIER;
+	u32 opt_win_cal_count = ARRAY_SIZE(opt_win_cal_default);
+	const opt_win_cal_t *opt_win_cal = opt_win_cal_default;
 
-	// The following are specific to the light filter Switch uses.
-	if (light_ratio < 0.5)
-		pre_gain_lux = visible_light * 5.002 - ir_light * 7.502;
-	else if (light_ratio < 0.754)
-		pre_gain_lux = visible_light * 2.250 - ir_light * 2.000;
-	else if (light_ratio < 1.029)
-		pre_gain_lux = visible_light * 1.999 - ir_light * 1.667;
-	else if (light_ratio < 1.373)
-		pre_gain_lux = visible_light * 0.884 - ir_light * 0.583;
-	else if (light_ratio < 1.879)
-		pre_gain_lux = visible_light * 0.309 - ir_light * 0.165;
-	else pre_gain_lux = 0.0;
+	// Apply optical window calibration coefficients.
+	for (u32 i = 0; i < opt_win_cal_count; i++)
+	{
+		if (1000 * ir_light / visible_light < opt_win_cal[i].rc)
+		{
+			lux = ((u64)opt_win_cal[i].cv * data[0]) - (opt_win_cal[i].ci * data[1]);
+			break;
+		}
+	}
 
-	als_val->lux = (pre_gain_lux / als_gain_idx_tbl[als_val->gain]) * (als_norm_res / ((float)als_val->itime * als_tint)) * als_multiplier;
+	lux *= BH1730_DEFAULT_ITIME_MS * lux_multiplier;
+	lux /= als_gain_idx_tbl[als_ctxt->gain] * itime_us;
+	lux /= 1000;
+
+	if (lux > BH1730_LUX_MAX)
+		lux = BH1730_LUX_MAX;
+
+	als_ctxt->lux = lux;
 }
 
-u8 als_init(als_table_t *als_val)
+u8 als_power_on(als_ctxt_t *als_ctxt)
 {
 	// Enable power to ALS IC.
 	max7762x_regulator_set_voltage(REGULATOR_LDO6, 2900000);
@@ -109,12 +147,10 @@ u8 als_init(als_table_t *als_val)
 	// Initialize ALS.
 	u8 id = i2c_recv_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(0x12));
 	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_SPEC(BH1730_SPECCMD_RESET), 0);
-	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_GAIN_REG), HOS_GAIN);
-	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_TIMING_REG), (256 - HOS_ITIME));
-	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_CONTROL_REG), BH1730_CTL_POWER_ON | BH1730_CTL_ADC_EN);
 
-	als_val->gain = HOS_GAIN;
-	als_val->itime = HOS_ITIME;
+	set_als_cfg(als_ctxt, BH1730_DEFAULT_GAIN, BH1730_DEFAULT_ICYCLE);
+
+	i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(BH1730_CONTROL_REG), BH1730_CTL_POWER_ON | BH1730_CTL_ADC_EN);
 
 	return id;
 }

bdk/input/als.h

@@ -48,18 +48,18 @@
 #define BH1730_ADDR(reg) (BH1730_CMD_MAGIC | BH1730_CMD_SETADDR | (reg))
 #define BH1730_SPEC(cmd) (BH1730_CMD_MAGIC | BH1730_CMD_SPECCMD | (cmd))
 
-typedef struct _als_table_t
+typedef struct _als_ctxt_t
 {
-	float lux;
+	u32  lux;
 	bool over_limit;
-	u32 vi_light;
-	u32 ir_light;
-	u8 gain;
-	u8 itime;
-} als_table_t;
+	u32  vi_light;
+	u32  ir_light;
+	u8   gain;
+	u8   cycle;
+} als_ctxt_t;
 
-void set_als_cfg(als_table_t *als_val, u8 gain, u8 itime);
-void get_als_lux(als_table_t *als_val);
-u8 als_init(als_table_t *als_val);
+void set_als_cfg(als_ctxt_t *als_ctxt, u8 gain, u8 cycle);
+void get_als_lux(als_ctxt_t *als_ctxt);
+u8   als_power_on(als_ctxt_t *als_ctxt);
 
 #endif /* __ALS_H_ */

bdk/mem/sdram_config.inl

@@ -491,8 +491,8 @@ static const sdram_params_t210_t _dram_cfg_0_samsung_4gb = {
 
 	/* DRAM size information */
 	.mc_emem_adr_cfg                                 = 0x00000001, // 2 Ranks.
-	.mc_emem_adr_cfg_dev0                            = 0x00070302, // Rank 0 Density 512MB.
-	.mc_emem_adr_cfg_dev1                            = 0x00070302, // Rank 1 Density 512MB.
+	.mc_emem_adr_cfg_dev0                            = 0x00080302, // Rank 0 Density 1024MB.
+	.mc_emem_adr_cfg_dev1                            = 0x00080302, // Rank 1 Density 1024MB.
 	.mc_emem_adr_cfg_channel_mask                    = 0xFFFF2400,
 	.mc_emem_adr_cfg_bank_mask0                      = 0x6E574400,
 	.mc_emem_adr_cfg_bank_mask1                      = 0x39722800,
@@ -501,7 +501,7 @@ static const sdram_params_t210_t _dram_cfg_0_samsung_4gb = {
 	 * Specifies the value for MC_EMEM_CFG which holds the external memory
 	 * size (in KBytes)
 	 */
-	.mc_emem_cfg                                     = 0x00001000, // 4GB total density.
+	.mc_emem_cfg                                     = 0x00002000, // 8GB total density.
 
 	/* MC arbitration configuration */
 	.mc_emem_arb_cfg                                 = 0x08000001,

bdk/power/regulator_5v.c

@@ -21,25 +21,25 @@
 #include <utils/types.h>
 
 static u8 reg_5v_dev = 0;
-static bool batt_src = false;
+static bool usb_src = false;
 
 void regulator_5v_enable(u8 dev)
 {
 	// The power supply selection from battery or USB is automatic.
 	if (!reg_5v_dev)
 	{
-		// Fan and Rail power from internal 5V regulator (battery).
+		// Fan and Rail power from battery 5V regulator.
 		PINMUX_AUX(PINMUX_AUX_SATA_LED_ACTIVE) = 1;
 		gpio_config(GPIO_PORT_A, GPIO_PIN_5, GPIO_MODE_GPIO);
 		gpio_output_enable(GPIO_PORT_A, GPIO_PIN_5, GPIO_OUTPUT_ENABLE);
 		gpio_write(GPIO_PORT_A, GPIO_PIN_5, GPIO_HIGH);
-		batt_src = true;
 
-		// Fan and Rail power from USB 5V VDD.
+		// Fan and Rail power from USB 5V VBUS.
 		PINMUX_AUX(PINMUX_AUX_USB_VBUS_EN0) = PINMUX_LPDR | 1;
 		gpio_config(GPIO_PORT_CC, GPIO_PIN_4, GPIO_MODE_GPIO);
 		gpio_output_enable(GPIO_PORT_CC, GPIO_PIN_4, GPIO_OUTPUT_ENABLE);
-		gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_HIGH);
+		gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_LOW);
+		usb_src = false;
 
 		// Make sure GPIO power is enabled.
 		PMC(APBDEV_PMC_NO_IOPOWER) &= ~PMC_NO_IOPOWER_GPIO_IO_EN;
@@ -55,18 +55,18 @@ void regulator_5v_disable(u8 dev)
 
 	if (!reg_5v_dev)
 	{
-		// Rail power from internal 5V regulator (battery).
+		// Rail power from battery 5V regulator.
 		gpio_write(GPIO_PORT_A, GPIO_PIN_5, GPIO_LOW);
 		gpio_output_enable(GPIO_PORT_A, GPIO_PIN_5, GPIO_OUTPUT_DISABLE);
 		gpio_config(GPIO_PORT_A, GPIO_PIN_5, GPIO_MODE_SPIO);
 		PINMUX_AUX(PINMUX_AUX_SATA_LED_ACTIVE) = PINMUX_PARKED | PINMUX_INPUT_ENABLE;
-		batt_src = false;
 
-		// Rail power from USB 5V VDD.
+		// Rail power from USB 5V VBUS.
 		gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_LOW);
 		gpio_output_enable(GPIO_PORT_CC, GPIO_PIN_4, GPIO_OUTPUT_DISABLE);
 		gpio_config(GPIO_PORT_CC, GPIO_PIN_4, GPIO_MODE_SPIO);
 		PINMUX_AUX(PINMUX_AUX_USB_VBUS_EN0) = PINMUX_IO_HV | PINMUX_LPDR | PINMUX_PARKED | PINMUX_INPUT_ENABLE;
+		usb_src = false;
 
 		// GPIO AO IO rails.
 		PMC(APBDEV_PMC_PWR_DET_VAL) |= PMC_PWR_DET_GPIO_IO_EN;
@@ -78,16 +78,16 @@ bool regulator_5v_get_dev_enabled(u8 dev)
 	return (reg_5v_dev & dev);
 }
 
-void regulator_5v_batt_src_enable(bool enable)
+void regulator_5v_usb_src_enable(bool enable)
 {
-	if (enable && !batt_src)
+	if (enable && !usb_src)
 	{
-		gpio_write(GPIO_PORT_A, GPIO_PIN_5, GPIO_HIGH);
-		batt_src = true;
+		gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_HIGH);
+		usb_src = true;
 	}
-	else if (!enable && batt_src)
+	else if (!enable && usb_src)
 	{
-		gpio_write(GPIO_PORT_A, GPIO_PIN_5, GPIO_LOW);
-		batt_src = false;
+		gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_LOW);
+		usb_src = false;
 	}
 }

bdk/power/regulator_5v.h

@@ -30,6 +30,6 @@ enum
 void regulator_5v_enable(u8 dev);
 void regulator_5v_disable(u8 dev);
 bool regulator_5v_get_dev_enabled(u8 dev);
-void regulator_5v_batt_src_enable(bool enable);
+void regulator_5v_usb_src_enable(bool enable);
 
 #endif

bdk/soc/fuse.c

@@ -121,18 +121,6 @@ u32 fuse_read_hw_type()
 	return FUSE_NX_HW_TYPE_ICOSA;
 }
 
-u8 fuse_count_burnt(u32 val)
-{
-	u8 burnt_fuses = 0;
-	for (u32 i = 0; i < 32; i++)
-	{
-		if ((val >> i) & 1)
-			burnt_fuses++;
-	}
-
-	return burnt_fuses;
-}
-
 void fuse_wait_idle()
 {
 	u32 ctrl;

bdk/soc/fuse.h

@@ -97,7 +97,6 @@ u32  fuse_read_odm_keygen_rev();
 u32  fuse_read_dramid(bool raw_id);
 u32  fuse_read_hw_state();
 u32  fuse_read_hw_type();
-u8   fuse_count_burnt(u32 val);
 void fuse_wait_idle();
 int  fuse_read_ipatch(void (*ipatch)(u32 offset, u32 value));
 int  fuse_read_evp_thunk(u32 *iram_evp_thunks, u32 *iram_evp_thunks_len);

bdk/storage/mmc.h

@@ -2,6 +2,7 @@
  * Header for MultiMediaCard (MMC)
  *
  * Copyright 2002 Hewlett-Packard Company
+ * Copyright 2018-2021 CTCaer
  *
  * Use consistent with the GNU GPL is permitted,
  * provided that this copyright notice is
@@ -21,8 +22,8 @@
  *          15 May 2002
  */
 
-#ifndef LINUX_MMC_MMC_H
-#define LINUX_MMC_MMC_H
+#ifndef MMC_H
+#define MMC_H
 
 /* Standard MMC commands (4.1)           type  argument     response */
 /* class 1 */
@@ -97,29 +98,29 @@
 #define MMC_CMDQ_TASK_MGMT       48   /* ac   [20:16] task id    R1b */
 
 /*
-* MMC_SWITCH argument format:
-*
-*	[31:26] Always 0
-*	[25:24] Access Mode
-*	[23:16] Location of target Byte in EXT_CSD
-*	[15:08] Value Byte
-*	[07:03] Always 0
-*	[02:00] Command Set
-*/
+ * MMC_SWITCH argument format:
+ *
+ *	[31:26] Always 0
+ *	[25:24] Access Mode
+ *	[23:16] Location of target Byte in EXT_CSD
+ *	[15:08] Value Byte
+ *	[07:03] Always 0
+ *	[02:00] Command Set
+ */
 
 /*
-MMC status in R1, for native mode (SPI bits are different)
-Type
-e : error bit
-s : status bit
-r : detected and set for the actual command response
-x : detected and set during command execution. the host must poll
-the card by sending status command in order to read these bits.
-Clear condition
-a : according to the card state
-b : always related to the previous command. Reception of
-a valid command will clear it (with a delay of one command)
-c : clear by read
+ * MMC status in R1, for native mode (SPI bits are different)
+ * Type
+ * e : error bit
+ * s : status bit
+ * r : detected and set for the actual command response
+ * x : detected and set during command execution. the host must poll
+ *     the card by sending status command in order to read these bits.
+ * Clear condition
+ * a : according to the card state
+ * b : always related to the previous command. Reception of a valid
+ *     command will clear it (with a delay of one command)
+ * c : clear by read
 */
 
 #define R1_OUT_OF_RANGE		(1 << 31)	/* er, c */
@@ -151,6 +152,7 @@ c : clear by read
 #define R1_AKE_SEQ_ERROR	(1 << 3)
 
 /* R1_CURRENT_STATE 12:9 */
+#define R1_STATE(x)     ((x) << 9)
 #define R1_STATE_IDLE	0
 #define R1_STATE_READY	1
 #define R1_STATE_IDENT	2
@@ -162,9 +164,9 @@ c : clear by read
 #define R1_STATE_DIS	8
 
 /*
-* MMC/SD in SPI mode reports R1 status always, and R2 for SEND_STATUS
-* R1 is the low order byte; R2 is the next highest byte, when present.
-*/
+ * MMC/SD in SPI mode reports R1 status always, and R2 for SEND_STATUS
+ * R1 is the low order byte; R2 is the next highest byte, when present.
+ */
 #define R1_SPI_IDLE		(1 << 0)
 #define R1_SPI_ERASE_RESET	(1 << 1)
 #define R1_SPI_ILLEGAL_COMMAND	(1 << 2)
@@ -185,16 +187,16 @@ c : clear by read
 #define R2_SPI_CSD_OVERWRITE	R2_SPI_OUT_OF_RANGE
 
 /*
-* OCR bits are mostly in host.h
-*/
+ * OCR bits are mostly in host.h
+ */
 #define MMC_CARD_VDD_18		(1 << 7)	/* Card VDD voltage 1.8 */
 #define MMC_CARD_VDD_27_34	(0x7F << 15)	/* Card VDD voltage 2.7 ~ 3.4 */
 #define MMC_CARD_CCS		(1 << 30)	/* Card Capacity status bit */
 #define MMC_CARD_BUSY		(1 << 31)	/* Card Power up status bit */
 
 /*
-* Card Command Classes (CCC)
-*/
+ * Card Command Classes (CCC)
+ */
 #define CCC_BASIC		(1<<0)	/* (0) Basic protocol functions */
 /* (CMD0,1,2,3,4,7,9,10,12,13,15) */
 /* (and for SPI, CMD58,59) */
@@ -222,8 +224,8 @@ c : clear by read
 /* (CMD?) */
 
 /*
-* CSD field definitions
-*/
+ * CSD field definitions
+ */
 
 #define CSD_STRUCT_VER_1_0  0           /* Valid for system specification 1.0 - 1.2 */
 #define CSD_STRUCT_VER_1_1  1           /* Valid for system specification 1.4 - 2.2 */
@@ -237,8 +239,8 @@ c : clear by read
 #define CSD_SPEC_VER_4      4           /* Implements system specification 4.0 - 4.1 */
 
 /*
-* EXT_CSD fields
-*/
+ * EXT_CSD fields
+ */
 
 #define EXT_CSD_CMDQ_MODE_EN		15	/* R/W */
 #define EXT_CSD_FLUSH_CACHE		32      /* W */
@@ -316,8 +318,8 @@ c : clear by read
 #define EXT_CSD_HPI_FEATURES		503	/* RO */
 
 /*
-* EXT_CSD field definitions
-*/
+ * EXT_CSD field definitions
+ */
 
 #define EXT_CSD_WR_REL_PARAM_EN		(1<<2)
 
@@ -393,8 +395,8 @@ c : clear by read
 #define EXT_CSD_PACKED_EVENT_EN	(1<<3)
 
 /*
-* EXCEPTION_EVENT_STATUS field
-*/
+ * EXCEPTION_EVENT_STATUS field
+ */
 #define EXT_CSD_URGENT_BKOPS		(1<<0)
 #define EXT_CSD_DYNCAP_NEEDED		(1<<1)
 #define EXT_CSD_SYSPOOL_EXHAUSTED	(1<<2)
@@ -404,34 +406,34 @@ c : clear by read
 #define EXT_CSD_PACKED_INDEXED_ERROR	(1<<1)
 
 /*
-* BKOPS status level
-*/
+ * BKOPS status level
+ */
 #define EXT_CSD_BKOPS_LEVEL_2		0x2
 
 /*
-* BKOPS modes
-*/
+ * BKOPS modes
+ */
 #define EXT_CSD_MANUAL_BKOPS_MASK	0x01
 #define EXT_CSD_AUTO_BKOPS_MASK		0x02
 
 /*
-* Command Queue
-*/
+ * Command Queue
+ */
 #define EXT_CSD_CMDQ_MODE_ENABLED	(1<<0)
 #define EXT_CSD_CMDQ_DEPTH_MASK		0x1F
 #define EXT_CSD_CMDQ_SUPPORTED		(1<<0)
 
 /*
-* MMC_SWITCH access modes
-*/
+ * MMC_SWITCH access modes
+ */
 #define MMC_SWITCH_MODE_CMD_SET		0x00	/* Change the command set */
 #define MMC_SWITCH_MODE_SET_BITS	0x01	/* Set bits which are 1 in value */
 #define MMC_SWITCH_MODE_CLEAR_BITS	0x02	/* Clear bits which are 1 in value */
 #define MMC_SWITCH_MODE_WRITE_BYTE	0x03	/* Set target to value */
 
 /*
-* Erase/trim/discard
-*/
+ * Erase/trim/discard
+ */
 #define MMC_ERASE_ARG			0x00000000
 #define MMC_SECURE_ERASE_ARG		0x80000000
 #define MMC_TRIM_ARG			0x00000001
@@ -441,4 +443,9 @@ c : clear by read
 #define MMC_SECURE_ARGS			0x80000000
 #define MMC_TRIM_ARGS			0x00008001
 
-#endif /* LINUX_MMC_MMC_H */
+/*
+ * Vendor definitions and structs
+ */
+#define MMC_SANDISK_HEALTH_REPORT 0x96C9D71C
+
+#endif /* MMC_H */

bdk/storage/sdmmc.c

@@ -139,6 +139,60 @@ static int _sdmmc_storage_check_status(sdmmc_storage_t *storage)
 	return _sdmmc_storage_get_status(storage, &tmp, 0);
 }
 
+int sdmmc_storage_execute_vendor_cmd(sdmmc_storage_t *storage, u32 arg)
+{
+	sdmmc_cmd_t cmdbuf;
+	sdmmc_init_cmd(&cmdbuf, MMC_VENDOR_62_CMD, arg, SDMMC_RSP_TYPE_1, 1);
+	if (!sdmmc_execute_cmd(storage->sdmmc, &cmdbuf, 0, 0))
+		return 0;
+
+	u32 resp;
+	sdmmc_get_rsp(storage->sdmmc, &resp, 4, SDMMC_RSP_TYPE_1);
+
+	resp = -1;
+	u32 timeout = get_tmr_ms() + 1500;
+	while (resp != (R1_READY_FOR_DATA | R1_STATE(R1_STATE_TRAN)))
+	{
+		_sdmmc_storage_get_status(storage, &resp, 0);
+
+		if (get_tmr_ms() > timeout)
+			break;
+	}
+
+	return _sdmmc_storage_check_card_status(resp);
+}
+
+int sdmmc_storage_vendor_sandisk_report(sdmmc_storage_t *storage, void *buf)
+{
+	// Request health report.
+	if (!sdmmc_storage_execute_vendor_cmd(storage, MMC_SANDISK_HEALTH_REPORT))
+		return 2;
+
+	u32 tmp = 0;
+	sdmmc_cmd_t cmdbuf;
+	sdmmc_req_t reqbuf;
+
+	sdmmc_init_cmd(&cmdbuf, MMC_VENDOR_63_CMD, 0, SDMMC_RSP_TYPE_1, 0); // similar to CMD17 with arg 0x0.
+
+	reqbuf.buf = buf;
+	reqbuf.num_sectors = 1;
+	reqbuf.blksize = 512;
+	reqbuf.is_write = 0;
+	reqbuf.is_multi_block = 0;
+	reqbuf.is_auto_stop_trn = 0;
+
+	u32 blkcnt_out;
+	if (!sdmmc_execute_cmd(storage->sdmmc, &cmdbuf, &reqbuf, &blkcnt_out))
+	{
+		sdmmc_stop_transmission(storage->sdmmc, &tmp);
+		_sdmmc_storage_get_status(storage, &tmp, 0);
+
+		return 0;
+	}
+
+	return 1;
+}
+
 static int _sdmmc_storage_readwrite_ex(sdmmc_storage_t *storage, u32 *blkcnt_out, u32 sector, u32 num_sectors, void *buf, u32 is_write)
 {
 	u32 tmp = 0;
@@ -1360,8 +1414,6 @@ DPRINTF("[SD] SD does not support wide bus width\n");
 		if (!_sd_storage_enable_uhs_low_volt(storage, type, buf))
 			return 0;
 DPRINTF("[SD] enabled UHS\n");
-
-		sdmmc_card_clock_powersave(sdmmc, SDMMC_POWER_SAVE_ENABLE);
 	}
 	else if (type != SDHCI_TIMING_SD_DS12 && storage->scr.sda_vsn) // Not default speed and not SD Version 1.0.
 	{
@@ -1387,6 +1439,8 @@ DPRINTF("[SD] enabled HS\n");
 DPRINTF("[SD] got sd status\n");
 	}
 
+	sdmmc_card_clock_powersave(sdmmc, SDMMC_POWER_SAVE_ENABLE);
+
 	storage->initialized = 1;
 
 	return 1;

bdk/storage/sdmmc.h

@@ -34,6 +34,81 @@ typedef enum _sdmmc_type
 	EMMC_RPMB  = 3
 } sdmmc_type;
 
+typedef struct _mmc_sandisk_advanced_report_t
+{
+	u32 power_inits;
+
+	u32 max_erase_cycles_sys;
+	u32 max_erase_cycles_slc;
+	u32 max_erase_cycles_mlc;
+
+	u32 min_erase_cycles_sys;
+	u32 min_erase_cycles_slc;
+	u32 min_erase_cycles_mlc;
+
+	u32 max_erase_cycles_euda;
+	u32 min_erase_cycles_euda;
+	u32 avg_erase_cycles_euda;
+	u32 read_reclaim_cnt_euda;
+	u32 bad_blocks_euda;
+
+	u32 pre_eol_euda;
+	u32 pre_eol_sys;
+	u32 pre_eol_mlc;
+
+	u32 uncorrectable_ecc;
+
+	u32 temperature_now;
+	u32 temperature_min;
+	u32 temperature_max;
+
+	u32 health_pct_euda;
+	u32 health_pct_sys;
+	u32 health_pct_mlc;
+
+	u32 unk0;
+	u32 unk1;
+	u32 unk2;
+
+	u32 reserved[78];
+} mmc_sandisk_advanced_report_t;
+
+typedef struct _mmc_sandisk_report_t
+{
+	u32 avg_erase_cycles_sys;
+	u32 avg_erase_cycles_slc;
+	u32 avg_erase_cycles_mlc;
+
+	u32 read_reclaim_cnt_sys;
+	u32 read_reclaim_cnt_slc;
+	u32 read_reclaim_cnt_mlc;
+
+	u32 bad_blocks_factory;
+	u32 bad_blocks_sys;
+	u32 bad_blocks_slc;
+	u32 bad_blocks_mlc;
+
+	u32 fw_updates_cnt;
+
+	u8  fw_update_date[12];
+	u8  fw_update_time[8];
+
+	u32 total_writes_100mb;
+	u32 vdrops;
+	u32 vdroops;
+
+	u32 vdrops_failed_data_rec;
+	u32 vdrops_data_rec_ops;
+
+	u32 total_writes_slc_100mb;
+	u32 total_writes_mlc_100mb;
+
+	u32 mlc_bigfile_mode_limit_exceeded;
+	u32 avg_erase_cycles_hybrid;
+
+	mmc_sandisk_advanced_report_t advanced;
+} mmc_sandisk_report_t;
+
 typedef struct _mmc_cid
 {
 	u32 manfid;
@@ -131,6 +206,9 @@ void sdmmc_storage_init_wait_sd();
 int  sdmmc_storage_init_sd(sdmmc_storage_t *storage, sdmmc_t *sdmmc, u32 bus_width, u32 type);
 int  sdmmc_storage_init_gc(sdmmc_storage_t *storage, sdmmc_t *sdmmc);
 
+int  sdmmc_storage_execute_vendor_cmd(sdmmc_storage_t *storage, u32 arg);
+int  sdmmc_storage_vendor_sandisk_report(sdmmc_storage_t *storage, void *buf);
+
 int  sd_storage_get_ssr(sdmmc_storage_t *storage, u8 *buf);
 u32  sd_storage_get_ssr_au(sdmmc_storage_t *storage);
 

bdk/utils/util.c

@@ -30,6 +30,27 @@
 
 extern volatile nyx_storage_t *nyx_str;
 
+u8 bit_count(u32 val)
+{
+	u8 cnt = 0;
+	for (u32 i = 0; i < 32; i++)
+	{
+		if ((val >> i) & 1)
+			cnt++;
+	}
+
+	return cnt;
+}
+
+u32 bit_count_mask(u8 bits)
+{
+	u32 val = 0;
+	for (u32 i = 0; i < bits; i++)
+		val |= 1 << i;
+
+	return val;
+}
+
 u32 get_tmr_s()
 {
 	return RTC(APBDEV_RTC_SECONDS);

bdk/utils/util.h

@@ -84,6 +84,9 @@ typedef struct _nyx_storage_t
 	emc_table_t mtc_table[10];
 } nyx_storage_t;
 
+u8   bit_count(u32 val);
+u32  bit_count_mask(u8 bits);
+
 void exec_cfg(u32 *base, const cfg_op_t *ops, u32 num_ops);
 u32  crc32_calc(u32 crc, const u8 *buf, u32 len);
 

bootloader/frontend/fe_info.c

@@ -61,7 +61,7 @@ void print_fuseinfo()
 		break;
 	}
 	gfx_printf("Sdram ID:    %d\n", fuse_read_dramid(true));
-	gfx_printf("Burnt fuses: %d / 64\n", fuse_count_burnt(fuse_read_odm(7)));
+	gfx_printf("Burnt fuses: %d / 64\n", bit_count(fuse_read_odm(7)));
 	gfx_printf("Secure key:  %08X%08X%08X%08X\n\n\n",
 		byte_swap_32(FUSE(FUSE_PRIVATE_KEY0)), byte_swap_32(FUSE(FUSE_PRIVATE_KEY1)),
 		byte_swap_32(FUSE(FUSE_PRIVATE_KEY2)), byte_swap_32(FUSE(FUSE_PRIVATE_KEY3)));

bootloader/hos/fss.c

@@ -159,25 +159,12 @@ int parse_fss(launch_ctxt_t *ctxt, const char *path, fss0_sept_t *sept_ctxt)
 	// Check if valid FSS0 and parse it.
 	if (fss_meta->magic == FSS0_MAGIC)
 	{
-		bool mariko_not_supported = false;
-		if (h_cfg.t210b01 && (fss_meta->version < FSS0_VERSION_0_17_0))
-		{
-			gfx_con.mute = false;
-			mariko_not_supported = true;
-		}
-
 		gfx_printf("Found FSS0, Atmosphere %d.%d.%d-%08x\n"
 			"Max HOS supported: %d.%d.%d\n"
 			"Unpacking and loading components..  ",
 			fss_meta->version >> 24, (fss_meta->version >> 16) & 0xFF, (fss_meta->version >> 8) & 0xFF, fss_meta->git_rev,
 			fss_meta->hos_ver >> 24, (fss_meta->hos_ver >> 16) & 0xFF, (fss_meta->hos_ver >> 8) & 0xFF);
 
-		if (mariko_not_supported)
-		{
-			EPRINTF("\nMariko not supported on < 0.17.0!");
-			goto fail;
-		}
-
 		if (!sept_ctxt)
 		{
 			ctxt->atmosphere = true;
@@ -279,7 +266,6 @@ out:
 		return (!sept_ctxt ? 1 : sept_used);
 	}
 
-fail:
 	f_close(&fp);
 	free(fss);
 

bootloader/hos/hos.c

@@ -125,6 +125,7 @@ static const u8 master_kekseed_t210b01[][SE_KEY_128_SIZE] = {
 	{ 0x5C, 0x24, 0xE3, 0xB8, 0xB4, 0xF7, 0x00, 0xC2, 0x3C, 0xFD, 0x0A, 0xCE, 0x13, 0xC3, 0xDC, 0x23 }, // 8.1.0.
 	{ 0x86, 0x69, 0xF0, 0x09, 0x87, 0xC8, 0x05, 0xAE, 0xB5, 0x7B, 0x48, 0x74, 0xDE, 0x62, 0xA6, 0x13 }, // 9.0.0.
 	{ 0x0E, 0x44, 0x0C, 0xED, 0xB4, 0x36, 0xC0, 0x3F, 0xAA, 0x1D, 0xAE, 0xBF, 0x62, 0xB1, 0x09, 0x82 }, // 9.1.0.
+	{ 0xE5, 0x41, 0xAC, 0xEC, 0xD1, 0xA7, 0xD1, 0xAB, 0xED, 0x03, 0x77, 0xF1, 0x27, 0xCA, 0xF8, 0xF1 }, // 12.1.0.
 };
 
 static const u8 console_keyseed[SE_KEY_128_SIZE] =
@@ -546,7 +547,7 @@ int hos_keygen(void *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt, launch_ctxt_t *hos
 		{
 			switch (kb)
 			{
-			case KB_FIRMWARE_VERSION_100_200:
+			case KB_FIRMWARE_VERSION_100:
 			case KB_FIRMWARE_VERSION_300:
 			case KB_FIRMWARE_VERSION_301:
 				se_aes_unwrap_key(13, 15, console_keyseed);
@@ -609,7 +610,7 @@ try_load:
 		// Try backup bootloader.
 		if (bootloader_offset != BOOTLOADER_BACKUP_OFFSET)
 		{
-			EPRINTF("Trying backup bootloader...");
+			EPRINTF("\nTrying backup bootloader...");
 			bootloader_offset = BOOTLOADER_BACKUP_OFFSET;
 			goto try_load;
 		}
@@ -788,8 +789,9 @@ int hos_launch(ini_sec_t *cfg)
 		goto error;
 	}
 
-	// Check if fuses lower than 4.0.0 or 9.0.0 or 11.0.0 and if yes apply NO Gamecard patch.
-	// Additionally check if running emuMMC and disable GC if v3/v4 fuses are burnt and HOS is <= 8.1.0 or != 11.0.0.
+	// If Auto NOGC is enabled, check if burnt fuses lower than installed HOS fuses and apply NOGC patch.
+	// For emuMMC, unconditionally enable NOGC when burnt fuses are higher than installed HOS fuses.
+	// Disable Auto NOGC in stock to prevent black screen (fatal error). Use kip1patch=nogc to force it.
 	if (!ctxt.stock)
 	{
 		u32 fuses = fuse_read_odm(7);
@@ -807,7 +809,7 @@ int hos_launch(ini_sec_t *cfg)
 				((fuses & 0x400)  && (ctxt.pkg1_id->fuses <= 10)) || // HOS  9.0.0+ fuses burnt.
 				((fuses & 0x2000) && (ctxt.pkg1_id->fuses <= 13)) || // HOS 11.0.0+ fuses burnt.
 				// Detection broken! Use kip1patch=nogc              // HOS 12.0.0+
-				((fuses & 0x4000) && (ctxt.pkg1_id->fuses <= 14))    // HOS 11.0.2+ fuses burnt.
+				((fuses & 0x4000) && (ctxt.pkg1_id->fuses <= 14))    // HOS 12.0.2+ fuses burnt.
 			  )
 			))
 			config_kip1patch(&ctxt, "nogc");
@@ -1057,7 +1059,7 @@ int hos_launch(ini_sec_t *cfg)
 	// Finalize per firmware key access. Skip access control if new exosphere.
 	switch (kb | (exo_new << 7))
 	{
-	case KB_FIRMWARE_VERSION_100_200:
+	case KB_FIRMWARE_VERSION_100:
 	case KB_FIRMWARE_VERSION_300:
 	case KB_FIRMWARE_VERSION_301:
 		se_key_acc_ctrl(12, SE_KEY_TBL_DIS_KEY_ACCESS_FLAG | SE_KEY_LOCK_FLAG);

bootloader/hos/hos.h

@@ -27,18 +27,19 @@
 
 #include <assert.h>
 
-#define KB_FIRMWARE_VERSION_100_200 0
-#define KB_FIRMWARE_VERSION_300 1
-#define KB_FIRMWARE_VERSION_301 2
-#define KB_FIRMWARE_VERSION_400 3
-#define KB_FIRMWARE_VERSION_500 4
-#define KB_FIRMWARE_VERSION_600 5
-#define KB_FIRMWARE_VERSION_620 6
-#define KB_FIRMWARE_VERSION_700 7
-#define KB_FIRMWARE_VERSION_810 8
-#define KB_FIRMWARE_VERSION_900 9
-#define KB_FIRMWARE_VERSION_910 10
-#define KB_FIRMWARE_VERSION_MAX KB_FIRMWARE_VERSION_910
+#define KB_FIRMWARE_VERSION_100  0
+#define KB_FIRMWARE_VERSION_300  1
+#define KB_FIRMWARE_VERSION_301  2
+#define KB_FIRMWARE_VERSION_400  3
+#define KB_FIRMWARE_VERSION_500  4
+#define KB_FIRMWARE_VERSION_600  5
+#define KB_FIRMWARE_VERSION_620  6
+#define KB_FIRMWARE_VERSION_700  7
+#define KB_FIRMWARE_VERSION_810  8
+#define KB_FIRMWARE_VERSION_900  9
+#define KB_FIRMWARE_VERSION_910  10
+#define KB_FIRMWARE_VERSION_1210 11
+#define KB_FIRMWARE_VERSION_MAX  KB_FIRMWARE_VERSION_1210
 
 #define HOS_PKG11_MAGIC 0x31314B50
 #define HOS_EKS_MAGIC   0x30534B45

bootloader/hos/pkg1.c

@@ -32,6 +32,7 @@
 #include <soc/t210.h>
 #include <storage/nx_sd.h>
 #include <utils/aarch64_util.h>
+#include <utils/util.h>
 
 extern hekate_config h_cfg;
 
@@ -168,7 +169,8 @@ static const pkg1_id_t _pkg1_ids[] = {
 	{ "20200303104606", 10, 13, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 10.0.0 - 10.2.0.
 	{ "20201030110855", 10, 14, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 11.0.0 - 11.0.1.
 	{ "20210129111626", 10, 14, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 12.0.0 - 12.0.1.
-	{ "20210422145837", 10, 15, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 12.0.2+
+	{ "20210422145837", 10, 15, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 12.0.2 - 12.0.3.
+	{ "20210607122020", 11, 15, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000, NULL }, // 12.1.0+
 };
 
 const pkg1_id_t *pkg1_get_latest()
@@ -355,7 +357,7 @@ int pkg1_warmboot_config(void *hos_ctxt, u32 warmboot_base)
 		u32 pa_id;
 		u32 fuses_max = 32; // Current ODM7 max.
 		u32 fuses_fw = ctxt->pkg1_id->fuses;
-		u8  burnt_fuses = fuse_count_burnt(fuse_read_odm(7));
+		u8  burnt_fuses = bit_count(fuse_read_odm(7));
 
 		// Save current warmboot in storage cache (MWS) and check if another one is needed.
 		if (!ctxt->warmboot)

bootloader/hos/pkg2.c

@@ -675,10 +675,12 @@ const char* pkg2_patch_kips(link_t *info, char* patchNames)
 
 static const u8 mkey_vector_8xx[][SE_KEY_128_SIZE] =
 {
-	// Master key 8 encrypted with 9.  (8.1.0 with 9.0.0)
+	// Master key 8  encrypted with 9.  (8.1.0 with 9.0.0)
 	{ 0x4D, 0xD9, 0x98, 0x42, 0x45, 0x0D, 0xB1, 0x3C, 0x52, 0x0C, 0x9A, 0x44, 0xBB, 0xAD, 0xAF, 0x80 },
-	// Master key 9 encrypted with 10. (9.0.0 with 9.1.0)
-	{ 0xB8, 0x96, 0x9E, 0x4A, 0x00, 0x0D, 0xD6, 0x28, 0xB3, 0xD1, 0xDB, 0x68, 0x5F, 0xFB, 0xE1, 0x2A }
+	// Master key 9  encrypted with 10. (9.0.0 with 9.1.0)
+	{ 0xB8, 0x96, 0x9E, 0x4A, 0x00, 0x0D, 0xD6, 0x28, 0xB3, 0xD1, 0xDB, 0x68, 0x5F, 0xFB, 0xE1, 0x2A },
+	// Master key 10 encrypted with 11. (9.1.0 with 12.1.0)
+	{ 0xC1, 0x8D, 0x16, 0xBB, 0x2A, 0xE4, 0x1D, 0xD4, 0xC2, 0xC1, 0xB6, 0x40, 0x94, 0x35, 0x63, 0x98 },
 };
 
 static bool _pkg2_key_unwrap_validate(pkg2_hdr_t *tmp_test, pkg2_hdr_t *hdr, u8 src_slot, u8 *mkey, const u8 *key_seed)

bootloader/hos/pkg2_patches.inl

@@ -684,6 +684,20 @@ static kip1_patchset_t _fs_patches_1200[] =
 	{ NULL, NULL }
 };
 
+static kip1_patch_t _fs_nogc_1203[] =
+{
+	{ KPS(KIP_TEXT) | 0x13EB34, 8, "\xFD\x7B\xBE\xA9\xF4\x4F\x01\xA9", "\xE0\x03\x1F\x2A\xC0\x03\x5F\xD6" },
+	{ KPS(KIP_TEXT) | 0x155478, 4, "\x14\x40\x80\x52", "\x14\x80\x80\x52" },
+	{ 0, 0, NULL, NULL }
+};
+
+static kip1_patchset_t _fs_patches_1203[] =
+{
+	{ "nogc",     _fs_nogc_1203 },
+	{ "emummc",   _fs_emummc },
+	{ NULL, NULL }
+};
+
 // SHA256 hashes.
 static kip1_id_t _kip_ids[] =
 {
@@ -727,4 +741,6 @@ static kip1_id_t _kip_ids[] =
 	{ "FS", "\x0B\xA1\x5B\xB3\x04\xB5\x05\x63", _fs_patches_1100 },      // FS 11.0.0 exfat
 	{ "FS", "\xDC\x2A\x08\x49\x96\xBB\x3C\x01", _fs_patches_1200 },      // FS 12.0.0
 	{ "FS", "\xD5\xA5\xBF\x36\x64\x0C\x49\xEA", _fs_patches_1200 },      // FS 12.0.0 exfat
+	{ "FS", "\xC8\x67\x62\xBE\x19\xA5\x1F\xA0", _fs_patches_1203 },      // FS 12.0.3
+	{ "FS", "\xE1\xE8\xD3\xD6\xA2\xFE\x0B\x10", _fs_patches_1203 },      // FS 12.0.3 exfat
 };

bootloader/main.c

@@ -1514,7 +1514,7 @@ ment_t ment_top[] = {
 	MDEF_END()
 };
 
-menu_t menu_top = { ment_top, "hekate v5.5.6", 0, 0 };
+menu_t menu_top = { ment_top, "hekate v5.5.8", 0, 0 };
 
 extern void pivot_stack(u32 stack_top);
 

nyx/nyx_gui/frontend/fe_emmc_tools.c

@@ -379,7 +379,7 @@ static int _dump_emmc_part(emmc_tool_gui_t *gui, char *sd_path, int active_part,
 		_get_valid_partition(&sector_start, &sector_size, &part_idx, true);
 		if (!part_idx || !sector_size)
 		{
-			s_printf(gui->txt_buf, "#FFDD00 Failed to find a partition...#\n");
+			s_printf(gui->txt_buf, "\n#FFDD00 Failed to find a partition...#\n");
 			lv_label_ins_text(gui->label_log, LV_LABEL_POS_LAST, gui->txt_buf);
 			manual_system_maintenance(true);
 
@@ -995,18 +995,30 @@ static int _restore_emmc_part(emmc_tool_gui_t *gui, char *sd_path, int active_pa
 
 					return 0;
 				}
-				else if (f_stat(outFilename, &fno) && !gui->raw_emummc)
+				else if (f_stat(outFilename, &fno))
 				{
-					s_printf(gui->txt_buf, "#FFDD00 Error (%d) file not found#\n#FFDD00 %s.#\n\n", res, outFilename);
-					lv_label_ins_text(gui->label_log, LV_LABEL_POS_LAST, gui->txt_buf);
-					manual_system_maintenance(true);
+					if (!gui->raw_emummc)
+					{
+						s_printf(gui->txt_buf, "#FFDD00 Error (%d) file not found#\n#FFDD00 %s.#\n\n", res, outFilename);
+						lv_label_ins_text(gui->label_log, LV_LABEL_POS_LAST, gui->txt_buf);
+						manual_system_maintenance(true);
 
-					// Attempt a smaller restore.
-					break;
-				}
-				else if (f_stat(outFilename, &fno) && gui->raw_emummc)
-				{
-					totalSectors = (u32)((u64)totalCheckFileSize >> (u64)9);
+						// Attempt a smaller restore.
+						if (numSplitParts)
+							break;
+					}
+					else
+						totalSectors = (u32)((u64)totalCheckFileSize >> (u64)9);
+
+					// Restore folder is empty.
+					if (!numSplitParts)
+					{
+						s_printf(gui->txt_buf, "#FFDD00 Restore folder is empty.#\n\n");
+						lv_label_ins_text(gui->label_log, LV_LABEL_POS_LAST, gui->txt_buf);
+						manual_system_maintenance(true);
+
+						return 0;
+					}
 				}
 				else
 				{

nyx/nyx_gui/frontend/gui.c

@@ -1262,14 +1262,9 @@ static void _update_status_bar(void *params)
 	else
 		strcat(label, "#FF3C28 "SYMBOL_BATTERY_EMPTY"#");
 
-	// Set charging symbol and regulator 5V source based on USB state.
+	// Set charging symbol.
 	if (charge_status)
-	{
 		strcat(label, " #FFDD00 "SYMBOL_CHARGE"#");
-		regulator_5v_batt_src_enable(false);
-	}
-	else
-		regulator_5v_batt_src_enable(true);
 
 	lv_label_set_text(status_bar.battery, label);
 	lv_obj_realign(status_bar.battery);

nyx/nyx_gui/frontend/gui_info.c

@@ -686,11 +686,17 @@ static lv_res_t _create_window_fuses_info_status(lv_obj_t *btn)
 	}
 
 	// Count burnt fuses.
-	u8 burnt_fuses_7 = fuse_count_burnt(fuse_read_odm(7));
-	u8 burnt_fuses_6 = fuse_count_burnt(fuse_read_odm(6));
+	u8 burnt_fuses_7 = bit_count(fuse_read_odm(7));
+	u8 burnt_fuses_6 = bit_count(fuse_read_odm(6));
 
-	switch (burnt_fuses_7)
+	// Check if overburnt.
+	u8 burnt_fuses_hos = (fuse_read_odm(7) & ~bit_count_mask(burnt_fuses_7)) ? 255 : burnt_fuses_7;
+
+	switch (burnt_fuses_hos)
 	{
+	case 0:
+		strcpy(fuses_hos_version, "#96FF00 Golden sample#");
+		break;
 	case 1:
 		strcpy(fuses_hos_version, "1.0.0");
 		break;
@@ -736,6 +742,9 @@ static lv_res_t _create_window_fuses_info_status(lv_obj_t *btn)
 	case 15:
 		strcpy(fuses_hos_version, "12.0.2+");
 		break;
+	case 255:
+		strcpy(fuses_hos_version, "#FFD000 Overburnt#");
+		break;
 	default:
 		strcpy(fuses_hos_version, "#FF8000 Unknown#");
 		break;
@@ -936,7 +945,7 @@ static lv_res_t _create_window_fuses_info_status(lv_obj_t *btn)
 		break;
 	}
 
-	s_printf(txt_buf + strlen(txt_buf), "\n#FF8000 ID:# [%02X] %02X [%02X]",
+	s_printf(txt_buf + strlen(txt_buf), "\n#FF8000 ID:# #96FF00 %02X# %02X #96FF00 %02X#",
 		nyx_str->info.disp_id & 0xFF, (nyx_str->info.disp_id >> 8) & 0xFF, (nyx_str->info.disp_id >> 16) & 0xFF);
 
 	touch_fw_info_t touch_fw;
@@ -971,36 +980,37 @@ static lv_res_t _create_window_fuses_info_status(lv_obj_t *btn)
 			if (touch_panel)
 				panel_ic_paired = touch_panel->idx == -1;
 			break;
+		case 0x00100200: // 4CD 1602.
 		case 0x00120100:
 		case 0x32000001:
 			strcat(txt_buf, "4CD 1801");
 			if (touch_panel)
-				panel_ic_paired = touch_panel->idx == 0;
+				panel_ic_paired = touch_panel->idx == 0; // NISSHA NFT-K12D.
 			break;
 		case 0x001A0300:
 		case 0x32000102:
 			strcat(txt_buf, "4CD 2602");
 			if (touch_panel)
-				panel_ic_paired = touch_panel->idx == 1;
+				panel_ic_paired = touch_panel->idx == 1; // GiS GGM6 B2X.
 			break;
 		case 0x00290100:
 		case 0x32000302:
 			strcat(txt_buf, "4CD 3801");
 			if (touch_panel)
-				panel_ic_paired = touch_panel->idx == 2;
+				panel_ic_paired = touch_panel->idx == 2; // NISSHA NBF-K9A.
 			break;
 		case 0x31051820:
 		case 0x32000402:
-			strcat(txt_buf, "4CD XXXX");
+			strcat(txt_buf, "4CD 4602"); // Assumed. Official is XXXX.
 			if (touch_panel)
-				panel_ic_paired = touch_panel->idx == 3;
+				panel_ic_paired = touch_panel->idx == 3; // GiS 5.5".
 			break;
 		case 0x32000501:
 		case 0x33000502:
 		case 0x33000503:
 			strcat(txt_buf, "4CD UNKN");
 			if (touch_panel)
-				panel_ic_paired = touch_panel->idx == 4;
+				panel_ic_paired = touch_panel->idx == 4; // Unknown Aula 6.2".
 			break;
 		default:
 			strcat(txt_buf, "#FF8000 Unknown#");
@@ -1230,6 +1240,197 @@ out:
 	return LV_RES_OK;
 }
 
+static lv_res_t _create_mbox_emmc_sandisk_report(lv_obj_t * btn)
+{
+	static lv_style_t h_style;
+	lv_style_copy(&h_style, &lv_style_transp);
+	h_style.body.padding.inner = 0;
+	h_style.body.padding.hor = LV_DPI - (LV_DPI / 4);
+	h_style.body.padding.ver = LV_DPI / 6;
+
+	lv_obj_t *dark_bg = lv_obj_create(lv_scr_act(), NULL);
+	lv_obj_set_style(dark_bg, &mbox_darken);
+	lv_obj_set_size(dark_bg, LV_HOR_RES, LV_VER_RES);
+
+	static const char * mbox_btn_map[] = { "\211", "\222Close", "\211", "" };
+	lv_obj_t * mbox = lv_mbox_create(dark_bg, NULL);
+	lv_mbox_set_recolor_text(mbox, true);
+	lv_obj_set_width(mbox, LV_HOR_RES / 9 * 8);
+
+	lv_mbox_set_text(mbox, "#C7EA46 Sandisk Device Report#");
+
+	u8 *buf = calloc(512, 1);
+	char *txt_buf = (char *)malloc(0x8000);
+	char *txt_buf2 = (char *)malloc(0x8000);
+	txt_buf[0] = 0;
+	txt_buf2[0] = 0;
+
+	// Create SoC Info container.
+	lv_obj_t *h1 = lv_cont_create(mbox, NULL);
+	lv_cont_set_style(h1, &h_style);
+	lv_cont_set_fit(h1, false, true);
+	lv_obj_set_width(h1, (LV_HOR_RES / 9) * 7);
+	lv_obj_set_click(h1, false);
+	lv_cont_set_layout(h1, LV_LAYOUT_OFF);
+
+	lv_obj_t * lb_desc = lv_label_create(h1, NULL);
+	lv_label_set_long_mode(lb_desc, LV_LABEL_LONG_BREAK);
+	lv_label_set_recolor(lb_desc, true);
+	lv_label_set_style(lb_desc, &monospace_text);
+	lv_obj_set_width(lb_desc, LV_HOR_RES / 9 * 4);
+
+	lv_obj_t * lb_desc2 = lv_label_create(h1, NULL);
+	lv_label_set_long_mode(lb_desc2, LV_LABEL_LONG_BREAK);
+	lv_label_set_recolor(lb_desc2, true);
+	lv_label_set_style(lb_desc2, &monospace_text);
+	lv_obj_set_width(lb_desc2, LV_HOR_RES / 9 * 3);
+	lv_obj_align(lb_desc2, lb_desc, LV_ALIGN_OUT_RIGHT_TOP, 0, 0);
+
+
+	if (!sdmmc_storage_init_mmc(&emmc_storage, &emmc_sdmmc, SDMMC_BUS_WIDTH_8, SDHCI_TIMING_MMC_HS400))
+	{
+		lv_label_set_text(lb_desc, "#FFDD00 Failed to init eMMC!#");
+
+		goto out;
+	}
+
+	int res = sdmmc_storage_vendor_sandisk_report(&emmc_storage, buf);
+	sdmmc_storage_end(&emmc_storage);
+
+	if (!res)
+	{
+		lv_label_set_text(lb_desc, "#FFDD00 Device Report not supported!#");
+		lv_label_set_text(lb_desc2, " ");
+
+		goto out;
+	}
+
+	mmc_sandisk_report_t *rpt = (mmc_sandisk_report_t *)buf;
+
+	u8  fw_update_date[13] = {0};
+	u8  fw_update_time[9] = {0};
+	memcpy(fw_update_date, rpt->fw_update_date, sizeof(rpt->fw_update_date));
+	memcpy(fw_update_time, rpt->fw_update_time, sizeof(rpt->fw_update_time));
+
+	s_printf(txt_buf,
+		"#00DDFF Device report#\n"
+		//"#FF8000 Average Erases SYS:#    %d\n"
+		"#FF8000 Average Erases SLC:#    %d\n"
+		"#FF8000 Average Erases MLC:#    %d\n"
+		//"#FF8000 Read Reclaims SYS:#     %d\n"
+		"#FF8000 Read Reclaims SLC:#     %d\n"
+		"#FF8000 Read Reclaims MLC:#     %d\n"
+		"#FF8000 Bad Blocks Factory:#    %d\n"
+		"#FF8000 Bad Blocks SYS:#        %d\n"
+		"#FF8000 Bad Blocks SLC:#        %d\n"
+		"#FF8000 Bad Blocks MLC:#        %d\n"
+		"#FF8000 FW Updates:#            %d\n"
+		"#FF8000 FW Buildtime:#          %s %s\n"
+		"#FF8000 Total Writes:#          %d MB\n"
+		//"#FF8000 Voltage Drops:#         %d\n"
+		//"#FF8000 Voltage Droops:#        %d\n"
+		//"#FF8000 VD Failed Recovers:#    %d\n"
+		//"#FF8000 VD Recover Operations:# %d\n"
+		"#FF8000 Total Writes SLC:#      %d MB\n"
+		"#FF8000 Total Writes MLC:#      %d MB\n"
+		"#FF8000 BigFile limit status:#  %d\n"
+		"#FF8000 Average Erases Hybrid:# %d",
+
+		//rpt->avg_erase_cycles_sys,
+		rpt->avg_erase_cycles_slc,
+		rpt->avg_erase_cycles_mlc,
+		//rpt->read_reclaim_cnt_sys,
+		rpt->read_reclaim_cnt_slc,
+		rpt->read_reclaim_cnt_mlc,
+		rpt->bad_blocks_factory,
+		rpt->bad_blocks_sys,
+		rpt->bad_blocks_slc,
+		rpt->bad_blocks_mlc,
+		rpt->fw_updates_cnt,
+		fw_update_date,
+		fw_update_time,
+		rpt->total_writes_100mb * 100,
+		//rpt->vdrops,
+		//rpt->vdroops,
+		//rpt->vdrops_failed_data_rec,
+		//rpt->vdrops_data_rec_ops,
+		rpt->total_writes_slc_100mb * 100,
+		rpt->total_writes_mlc_100mb * 100,
+		rpt->mlc_bigfile_mode_limit_exceeded,
+		rpt->avg_erase_cycles_hybrid);
+
+	u8 advanced_report = 0;
+	for (u32 i = 0; i < sizeof(mmc_sandisk_advanced_report_t); i++)
+		advanced_report |= *(u8 *)((u8 *)&rpt->advanced + i);
+
+	if (advanced_report)
+	{
+		s_printf(txt_buf2,
+			"#00DDFF Advanced Health Status#\n"
+			"#FF8000 Power ups:#             %d\n"
+			//"#FF8000 Maximum Erases SYS:#    %d\n"
+			"#FF8000 Maximum Erases SLC:#    %d\n"
+			"#FF8000 Maximum Erases MLC:#    %d\n"
+			//"#FF8000 Minimum Erases SYS:#    %d\n"
+			"#FF8000 Minimum Erases SLC:#    %d\n"
+			"#FF8000 Minimum Erases MLC:#    %d\n"
+			"#FF8000 Maximum Erases EUDA:#   %d\n"
+			"#FF8000 Minimum Erases EUDA:#   %d\n"
+			"#FF8000 Average Erases EUDA:#   %d\n"
+			"#FF8000 Read Reclaims EUDA:#    %d\n"
+			"#FF8000 Bad Blocks EUDA:#       %d\n"
+			//"#FF8000 Pre EOL State EUDA:#    %d\n"
+			//"#FF8000 Pre EOL State SYS:#     %d\n"
+			//"#FF8000 Pre EOL State MLC:#     %d\n"
+			"#FF8000 Uncorrectable ECC:#     %d\n"
+			"#FF8000 Temperature Now:#       %d oC\n"
+			//"#FF8000 Temperature Min:#       %d oC\n"
+			"#FF8000 Temperature Max:#       %d oC\n"
+			"#FF8000 Health Level EUDA:#     %d%%\n"
+			//"#FF8000 Health Level SYS:#      %d%%\n"
+			"#FF8000 Health Level MLC:#      %d%%",
+
+			rpt->advanced.power_inits,
+			//rpt->advanced.max_erase_cycles_sys,
+			rpt->advanced.max_erase_cycles_slc,
+			rpt->advanced.max_erase_cycles_mlc,
+			//rpt->advanced.min_erase_cycles_sys,
+			rpt->advanced.min_erase_cycles_slc,
+			rpt->advanced.min_erase_cycles_mlc,
+			rpt->advanced.max_erase_cycles_euda,
+			rpt->advanced.min_erase_cycles_euda,
+			rpt->advanced.avg_erase_cycles_euda,
+			rpt->advanced.read_reclaim_cnt_euda,
+			rpt->advanced.bad_blocks_euda,
+			//rpt->advanced.pre_eol_euda,
+			//rpt->advanced.pre_eol_sys,
+			//rpt->advanced.pre_eol_mlc,
+			rpt->advanced.uncorrectable_ecc,
+			rpt->advanced.temperature_now,
+			//rpt->advanced.temperature_min,
+			rpt->advanced.temperature_max,
+			rpt->advanced.health_pct_euda ? 101 - rpt->advanced.health_pct_euda : 0,
+			//rpt->advanced.health_pct_sys ? 101 - rpt->advanced.health_pct_sys : 0,
+			rpt->advanced.health_pct_mlc ? 101 - rpt->advanced.health_pct_mlc : 0);
+	}
+	else
+		strcpy(txt_buf2, "#00DDFF Device report#\n#FFDD00 Empty!#");
+
+	lv_label_set_text(lb_desc, txt_buf);
+	lv_label_set_text(lb_desc2, txt_buf2);
+
+out:
+	free(buf);
+	free (txt_buf);
+	free (txt_buf2);
+
+	lv_mbox_add_btns(mbox, mbox_btn_map, mbox_action); // Important. After set_text.
+	lv_obj_align(mbox, NULL, LV_ALIGN_CENTER, 0, 0);
+	lv_obj_set_top(mbox, true);
+
+	return LV_RES_OK;
+}
+
 static lv_res_t _create_mbox_benchmark(bool sd_bench)
 {
 	sdmmc_storage_t *storage;
@@ -1545,6 +1746,7 @@ static lv_res_t _create_window_emmc_info_status(lv_obj_t *btn)
 			break;
 		case 0x45: // Unofficial.
 			strcat(txt_buf, "SanDisk ");
+			lv_win_add_btn(win, NULL, SYMBOL_FILE_ALT" Device Report", _create_mbox_emmc_sandisk_report);
 			break;
 		case 0x90:
 			strcat(txt_buf, "SK Hynix ");

nyx/nyx_gui/hos/hos.c

@@ -95,6 +95,7 @@ static const u8 master_kekseed_t210b01[][SE_KEY_128_SIZE] = {
 	{ 0x5C, 0x24, 0xE3, 0xB8, 0xB4, 0xF7, 0x00, 0xC2, 0x3C, 0xFD, 0x0A, 0xCE, 0x13, 0xC3, 0xDC, 0x23 }, // 8.1.0.
 	{ 0x86, 0x69, 0xF0, 0x09, 0x87, 0xC8, 0x05, 0xAE, 0xB5, 0x7B, 0x48, 0x74, 0xDE, 0x62, 0xA6, 0x13 }, // 9.0.0.
 	{ 0x0E, 0x44, 0x0C, 0xED, 0xB4, 0x36, 0xC0, 0x3F, 0xAA, 0x1D, 0xAE, 0xBF, 0x62, 0xB1, 0x09, 0x82 }, // 9.1.0.
+	{ 0xE5, 0x41, 0xAC, 0xEC, 0xD1, 0xA7, 0xD1, 0xAB, 0xED, 0x03, 0x77, 0xF1, 0x27, 0xCA, 0xF8, 0xF1 }, // 12.1.0.
 };
 
 static const u8 console_keyseed[SE_KEY_128_SIZE] =
@@ -118,28 +119,31 @@ static const u8 mkey_vectors[KB_FIRMWARE_VERSION_MAX + 1][SE_KEY_128_SIZE] = {
 	{ 0xEA, 0x60, 0xB3, 0xEA, 0xCE, 0x8F, 0x24, 0x46, 0x7D, 0x33, 0x9C, 0xD1, 0xBC, 0x24, 0x98, 0x29 }, // Mkey 07 encrypted with mkey 08.
 	{ 0x4D, 0xD9, 0x98, 0x42, 0x45, 0x0D, 0xB1, 0x3C, 0x52, 0x0C, 0x9A, 0x44, 0xBB, 0xAD, 0xAF, 0x80 }, // Mkey 08 encrypted with mkey 09.
 	{ 0xB8, 0x96, 0x9E, 0x4A, 0x00, 0x0D, 0xD6, 0x28, 0xB3, 0xD1, 0xDB, 0x68, 0x5F, 0xFB, 0xE1, 0x2A }, // Mkey 09 encrypted with mkey 10.
+	{ 0xC1, 0x8D, 0x16, 0xBB, 0x2A, 0xE4, 0x1D, 0xD4, 0xC2, 0xC1, 0xB6, 0x40, 0x94, 0x35, 0x63, 0x98 }, // Mkey 10 encrypted with mkey 11.
 };
 
 static const u8 new_console_keyseed[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_400 + 1][SE_KEY_128_SIZE] = {
-	{ 0x8B, 0x4E, 0x1C, 0x22, 0x42, 0x07, 0xC8, 0x73, 0x56, 0x94, 0x08, 0x8B, 0xCC, 0x47, 0x0F, 0x5D }, // 4.x   New Device Key Source.
-	{ 0x6C, 0xEF, 0xC6, 0x27, 0x8B, 0xEC, 0x8A, 0x91, 0x99, 0xAB, 0x24, 0xAC, 0x4F, 0x1C, 0x8F, 0x1C }, // 5.x   New Device Key Source.
-	{ 0x70, 0x08, 0x1B, 0x97, 0x44, 0x64, 0xF8, 0x91, 0x54, 0x9D, 0xC6, 0x84, 0x8F, 0x1A, 0xB2, 0xE4 }, // 6.x   New Device Key Source.
-	{ 0x8E, 0x09, 0x1F, 0x7A, 0xBB, 0xCA, 0x6A, 0xFB, 0xB8, 0x9B, 0xD5, 0xC1, 0x25, 0x9C, 0xA9, 0x17 }, // 6.2.0 New Device Key Source.
-	{ 0x8F, 0x77, 0x5A, 0x96, 0xB0, 0x94, 0xFD, 0x8D, 0x28, 0xE4, 0x19, 0xC8, 0x16, 0x1C, 0xDB, 0x3D }, // 7.0.0 New Device Key Source.
-	{ 0x67, 0x62, 0xD4, 0x8E, 0x55, 0xCF, 0xFF, 0x41, 0x31, 0x15, 0x3B, 0x24, 0x0C, 0x7C, 0x07, 0xAE }, // 8.1.0 New Device Key Source.
-	{ 0x4A, 0xC3, 0x4E, 0x14, 0x8B, 0x96, 0x4A, 0xD5, 0xD4, 0x99, 0x73, 0xC4, 0x45, 0xAB, 0x8B, 0x49 }, // 9.0.0 New Device Key Source.
-	{ 0x14, 0xB8, 0x74, 0x12, 0xCB, 0xBD, 0x0B, 0x8F, 0x20, 0xFB, 0x30, 0xDA, 0x27, 0xE4, 0x58, 0x94 }, // 9.1.0 New Device Key Source.
+	{ 0x8B, 0x4E, 0x1C, 0x22, 0x42, 0x07, 0xC8, 0x73, 0x56, 0x94, 0x08, 0x8B, 0xCC, 0x47, 0x0F, 0x5D }, // 4.x    New Device Key Source.
+	{ 0x6C, 0xEF, 0xC6, 0x27, 0x8B, 0xEC, 0x8A, 0x91, 0x99, 0xAB, 0x24, 0xAC, 0x4F, 0x1C, 0x8F, 0x1C }, // 5.x    New Device Key Source.
+	{ 0x70, 0x08, 0x1B, 0x97, 0x44, 0x64, 0xF8, 0x91, 0x54, 0x9D, 0xC6, 0x84, 0x8F, 0x1A, 0xB2, 0xE4 }, // 6.x    New Device Key Source.
+	{ 0x8E, 0x09, 0x1F, 0x7A, 0xBB, 0xCA, 0x6A, 0xFB, 0xB8, 0x9B, 0xD5, 0xC1, 0x25, 0x9C, 0xA9, 0x17 }, // 6.2.0  New Device Key Source.
+	{ 0x8F, 0x77, 0x5A, 0x96, 0xB0, 0x94, 0xFD, 0x8D, 0x28, 0xE4, 0x19, 0xC8, 0x16, 0x1C, 0xDB, 0x3D }, // 7.0.0  New Device Key Source.
+	{ 0x67, 0x62, 0xD4, 0x8E, 0x55, 0xCF, 0xFF, 0x41, 0x31, 0x15, 0x3B, 0x24, 0x0C, 0x7C, 0x07, 0xAE }, // 8.1.0  New Device Key Source.
+	{ 0x4A, 0xC3, 0x4E, 0x14, 0x8B, 0x96, 0x4A, 0xD5, 0xD4, 0x99, 0x73, 0xC4, 0x45, 0xAB, 0x8B, 0x49 }, // 9.0.0  New Device Key Source.
+	{ 0x14, 0xB8, 0x74, 0x12, 0xCB, 0xBD, 0x0B, 0x8F, 0x20, 0xFB, 0x30, 0xDA, 0x27, 0xE4, 0x58, 0x94 }, // 9.1.0  New Device Key Source.
+	{ 0xAA, 0xFD, 0xBC, 0xBB, 0x25, 0xC3, 0xA4, 0xEF, 0xE3, 0xEE, 0x58, 0x53, 0xB7, 0xF8, 0xDD, 0xD6 }, // 12.1.0 New Device Key Source.
 };
 
 static const u8 new_console_kekseed[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_400 + 1][SE_KEY_128_SIZE] = {
-	{ 0x88, 0x62, 0x34, 0x6E, 0xFA, 0xF7, 0xD8, 0x3F, 0xE1, 0x30, 0x39, 0x50, 0xF0, 0xB7, 0x5D, 0x5D }, // 4.x   New Device Keygen Source.
-	{ 0x06, 0x1E, 0x7B, 0xE9, 0x6D, 0x47, 0x8C, 0x77, 0xC5, 0xC8, 0xE7, 0x94, 0x9A, 0xA8, 0x5F, 0x2E }, // 5.x   New Device Keygen Source.
-	{ 0x99, 0xFA, 0x98, 0xBD, 0x15, 0x1C, 0x72, 0xFD, 0x7D, 0x9A, 0xD5, 0x41, 0x00, 0xFD, 0xB2, 0xEF }, // 6.x   New Device Keygen Source.
-	{ 0x81, 0x3C, 0x6C, 0xBF, 0x5D, 0x21, 0xDE, 0x77, 0x20, 0xD9, 0x6C, 0xE3, 0x22, 0x06, 0xAE, 0xBB }, // 6.2.0 New Device Keygen Source.
-	{ 0x86, 0x61, 0xB0, 0x16, 0xFA, 0x7A, 0x9A, 0xEA, 0xF6, 0xF5, 0xBE, 0x1A, 0x13, 0x5B, 0x6D, 0x9E }, // 7.0.0 New Device Keygen Source.
-	{ 0xA6, 0x81, 0x71, 0xE7, 0xB5, 0x23, 0x74, 0xB0, 0x39, 0x8C, 0xB7, 0xFF, 0xA0, 0x62, 0x9F, 0x8D }, // 8.1.0 New Device Keygen Source.
-	{ 0x03, 0xE7, 0xEB, 0x43, 0x1B, 0xCF, 0x5F, 0xB5, 0xED, 0xDC, 0x97, 0xAE, 0x21, 0x8D, 0x19, 0xED }, // 9.0.0 New Device Keygen Source.
-	{ 0xCE, 0xFE, 0x41, 0x0F, 0x46, 0x9A, 0x30, 0xD6, 0xF2, 0xE9, 0x0C, 0x6B, 0xB7, 0x15, 0x91, 0x36 }, // 9.1.0 New Device Keygen Source.
+	{ 0x88, 0x62, 0x34, 0x6E, 0xFA, 0xF7, 0xD8, 0x3F, 0xE1, 0x30, 0x39, 0x50, 0xF0, 0xB7, 0x5D, 0x5D }, // 4.x    New Device Keygen Source.
+	{ 0x06, 0x1E, 0x7B, 0xE9, 0x6D, 0x47, 0x8C, 0x77, 0xC5, 0xC8, 0xE7, 0x94, 0x9A, 0xA8, 0x5F, 0x2E }, // 5.x    New Device Keygen Source.
+	{ 0x99, 0xFA, 0x98, 0xBD, 0x15, 0x1C, 0x72, 0xFD, 0x7D, 0x9A, 0xD5, 0x41, 0x00, 0xFD, 0xB2, 0xEF }, // 6.x    New Device Keygen Source.
+	{ 0x81, 0x3C, 0x6C, 0xBF, 0x5D, 0x21, 0xDE, 0x77, 0x20, 0xD9, 0x6C, 0xE3, 0x22, 0x06, 0xAE, 0xBB }, // 6.2.0  New Device Keygen Source.
+	{ 0x86, 0x61, 0xB0, 0x16, 0xFA, 0x7A, 0x9A, 0xEA, 0xF6, 0xF5, 0xBE, 0x1A, 0x13, 0x5B, 0x6D, 0x9E }, // 7.0.0  New Device Keygen Source.
+	{ 0xA6, 0x81, 0x71, 0xE7, 0xB5, 0x23, 0x74, 0xB0, 0x39, 0x8C, 0xB7, 0xFF, 0xA0, 0x62, 0x9F, 0x8D }, // 8.1.0  New Device Keygen Source.
+	{ 0x03, 0xE7, 0xEB, 0x43, 0x1B, 0xCF, 0x5F, 0xB5, 0xED, 0xDC, 0x97, 0xAE, 0x21, 0x8D, 0x19, 0xED }, // 9.0.0  New Device Keygen Source.
+	{ 0xCE, 0xFE, 0x41, 0x0F, 0x46, 0x9A, 0x30, 0xD6, 0xF2, 0xE9, 0x0C, 0x6B, 0xB7, 0x15, 0x91, 0x36 }, // 9.1.0  New Device Keygen Source.
+	{ 0xC2, 0x65, 0x34, 0x6E, 0xC7, 0xC6, 0x5D, 0x97, 0x3E, 0x34, 0x5C, 0x6B, 0xB3, 0x7E, 0xC6, 0xE3 }, // 12.1.0 New Device Keygen Source.
 };
 
 static const u8 gen_keyseed[SE_KEY_128_SIZE] =
@@ -566,7 +570,7 @@ int hos_keygen(void *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt)
 
 		switch (kb)
 		{
-		case KB_FIRMWARE_VERSION_100_200:
+		case KB_FIRMWARE_VERSION_100:
 		case KB_FIRMWARE_VERSION_300:
 		case KB_FIRMWARE_VERSION_301:
 			se_aes_unwrap_key(13, 15, console_keyseed);

nyx/nyx_gui/hos/hos.h

@@ -27,18 +27,19 @@
 
 #include <assert.h>
 
-#define KB_FIRMWARE_VERSION_100_200 0
-#define KB_FIRMWARE_VERSION_300 1
-#define KB_FIRMWARE_VERSION_301 2
-#define KB_FIRMWARE_VERSION_400 3
-#define KB_FIRMWARE_VERSION_500 4
-#define KB_FIRMWARE_VERSION_600 5
-#define KB_FIRMWARE_VERSION_620 6
-#define KB_FIRMWARE_VERSION_700 7
-#define KB_FIRMWARE_VERSION_810 8
-#define KB_FIRMWARE_VERSION_900 9
-#define KB_FIRMWARE_VERSION_910 10
-#define KB_FIRMWARE_VERSION_MAX KB_FIRMWARE_VERSION_910
+#define KB_FIRMWARE_VERSION_100  0
+#define KB_FIRMWARE_VERSION_300  1
+#define KB_FIRMWARE_VERSION_301  2
+#define KB_FIRMWARE_VERSION_400  3
+#define KB_FIRMWARE_VERSION_500  4
+#define KB_FIRMWARE_VERSION_600  5
+#define KB_FIRMWARE_VERSION_620  6
+#define KB_FIRMWARE_VERSION_700  7
+#define KB_FIRMWARE_VERSION_810  8
+#define KB_FIRMWARE_VERSION_900  9
+#define KB_FIRMWARE_VERSION_910  10
+#define KB_FIRMWARE_VERSION_1210 11
+#define KB_FIRMWARE_VERSION_MAX  KB_FIRMWARE_VERSION_1210
 
 #define HOS_PKG11_MAGIC 0x31314B50
 #define HOS_EKS_MAGIC   0x30534B45

nyx/nyx_gui/hos/pkg1.c

@@ -60,7 +60,8 @@ static const pkg1_id_t _pkg1_ids[] = {
 	{ "20200303104606", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 10.0.0 - 10.2.0.
 	{ "20201030110855", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 11.0.0 - 11.0.1.
 	{ "20210129111626", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 12.0.0 - 12.0.1.
-	{ "20210422145837", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 12.0.2+
+	{ "20210422145837", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 12.0.2 - 12.0.3.
+	{ "20210607122020", 11, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 12.1.0+
 };
 
 const pkg1_id_t *pkg1_identify(u8 *pkg1, char *build_date)
@@ -114,9 +115,9 @@ const u8 *pkg1_unpack(void *wm_dst, void *sm_dst, void *ldr_dst, const pkg1_id_t
 	//u32 sec_off[3] = { hdr->wb_off, hdr->ldr_off, hdr->sm_off };
 
 	// Get correct header mapping.
-	if (id->kb == KB_FIRMWARE_VERSION_100_200 && !strcmp(id->id, "20161121183008"))
+	if (id->kb == KB_FIRMWARE_VERSION_100 && !strcmp(id->id, "20161121183008"))
 		sec_map = sec_map_100;
-	else if (id->kb >= KB_FIRMWARE_VERSION_100_200 && id->kb <= KB_FIRMWARE_VERSION_301)
+	else if (id->kb >= KB_FIRMWARE_VERSION_100 && id->kb <= KB_FIRMWARE_VERSION_301)
 		sec_map = sec_map_2xx;
 	else
 		sec_map = sec_map_4xx;

nyx/nyx_gui/hos/pkg2.c

@@ -114,10 +114,12 @@ DPRINTF(" kip1 %d:%s @ %08X (%08X)\n", i, kip1->name, (u32)kip1, ki->size);
 
 static const u8 mkey_vector_8xx[][SE_KEY_128_SIZE] =
 {
-	// Master key 8 encrypted with 9.  (8.1.0 with 9.0.0)
+	// Master key 8  encrypted with 9.  (8.1.0 with 9.0.0)
 	{ 0x4D, 0xD9, 0x98, 0x42, 0x45, 0x0D, 0xB1, 0x3C, 0x52, 0x0C, 0x9A, 0x44, 0xBB, 0xAD, 0xAF, 0x80 },
-	// Master key 9 encrypted with 10. (9.0.0 with 9.1.0)
-	{ 0xB8, 0x96, 0x9E, 0x4A, 0x00, 0x0D, 0xD6, 0x28, 0xB3, 0xD1, 0xDB, 0x68, 0x5F, 0xFB, 0xE1, 0x2A }
+	// Master key 9  encrypted with 10. (9.0.0 with 9.1.0)
+	{ 0xB8, 0x96, 0x9E, 0x4A, 0x00, 0x0D, 0xD6, 0x28, 0xB3, 0xD1, 0xDB, 0x68, 0x5F, 0xFB, 0xE1, 0x2A },
+	// Master key 10 encrypted with 11. (9.1.0 with 12.1.0)
+	{ 0xC1, 0x8D, 0x16, 0xBB, 0x2A, 0xE4, 0x1D, 0xD4, 0xC2, 0xC1, 0xB6, 0x40, 0x94, 0x35, 0x63, 0x98 },
 };
 
 static bool _pkg2_key_unwrap_validate(pkg2_hdr_t *tmp_test, pkg2_hdr_t *hdr, u8 src_slot, u8 *mkey, const u8 *key_seed)