Bump version to v1.8.0

Minor heap fragmentation was not worth preventing

Makefile

@@ -10,8 +10,8 @@ include $(DEVKITARM)/base_rules
 
 IPL_LOAD_ADDR := 0x40003000
 LPVERSION_MAJOR := 1
-LPVERSION_MINOR := 6
-LPVERSION_BUGFX := 2
+LPVERSION_MINOR := 8
+LPVERSION_BUGFX := 0
 
 ################################################################################
 
@@ -29,7 +29,7 @@ OBJS =	$(patsubst $(SOURCEDIR)/%.S, $(BUILDDIR)/$(TARGET)/%.o, \
 CUSTOMDEFINES := -DIPL_LOAD_ADDR=$(IPL_LOAD_ADDR)
 CUSTOMDEFINES += -DLP_VER_MJ=$(LPVERSION_MAJOR) -DLP_VER_MN=$(LPVERSION_MINOR) -DLP_VER_BF=$(LPVERSION_BUGFX)
 
-ARCH := -march=armv4t -mtune=arm7tdmi -mthumb-interwork
+ARCH := -march=armv4t -mtune=arm7tdmi -mthumb -mthumb-interwork
 CFLAGS = $(ARCH) -O2 -nostdlib -ffunction-sections -fdata-sections -fomit-frame-pointer -std=gnu11 -Wall $(CUSTOMDEFINES)
 LDFLAGS = $(ARCH) -nostartfiles -lgcc -Wl,--nmagic,--gc-sections -Xlinker --defsym=IPL_LOAD_ADDR=$(IPL_LOAD_ADDR)
 

common/common_heap.h

@@ -25,6 +25,7 @@ typedef struct _hnode
 	u32 size;
 	struct _hnode *prev;
 	struct _hnode *next;
+	u32 align[4]; // Align to arch cache line size.
 } hnode_t;
 
 typedef struct _heap
@@ -32,3 +33,9 @@ typedef struct _heap
 	u32 start;
 	hnode_t *first;
 } heap_t;
+
+typedef struct
+{
+    u32 total;
+    u32 used;
+} heap_monitor_t;

common/memory_map.h

@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2019 CTCaer
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _MEMORY_MAP_H_
+#define _MEMORY_MAP_H_
+
+//#define IPL_STACK_TOP  0x4003FF00
+/* --- BIT/BCT: 0x40000000 - 0x40003000 --- */
+/* ---     IPL: 0x40003000 - 0x40028000 --- */
+#define IPL_LOAD_ADDR     0x40003000
+#define  IPL_SZ_MAX          0x20000 // 128KB.
+//#define IRAM_LIB_ADDR     0x4002B000
+#define SDRAM_PARAMS_ADDR 0x40030000 // SDRAM extraction buffer during sdram init.
+#define CBFS_DRAM_EN_ADDR 0x4003e000 // u32.
+
+/* --- DRAM START --- */
+#define DRAM_START     0x80000000
+/* Do not write anything in this area */
+#define NYX_LOAD_ADDR  0x81000000
+#define  NYX_SZ_MAX     0x1000000
+/* Stack theoretical max: 220MB */
+#define IPL_STACK_TOP  0x90010000
+#define IPL_HEAP_START 0x90020000
+#define  IPL_HEAP_SZ   0x24FE0000 // 592MB.
+/* --- Gap: 0xB5000000 - 0xB5FFFFFF --- */
+
+// SDMMC DMA buffers
+#define SDXC_BUF_ALIGNED   0xB6000000
+#define MIXD_BUF_ALIGNED   0xB7000000
+#define EMMC_BUF_ALIGNED   MIXD_BUF_ALIGNED
+#define  SDMMC_DMA_BUF_SZ   0x1000000 // 16MB (4MB currently used).
+#define SDMMC_UPPER_BUFFER 0xB8000000
+#define  SDMMC_UP_BUF_SZ    0x8000000 // 128MB.
+
+// Virtual disk / Chainloader buffers.
+#define RAM_DISK_ADDR     0xC1000000
+#define  RAM_DISK_SZ      0x20000000
+//#define DRAM_LIB_ADDR    0xE0000000
+/* --- Chnldr: 252MB 0xC03C0000 - 0xCFFFFFFF --- */ //! Only used when chainloading.
+/* ---    Gap: 464MB 0xD0000000 - 0xECFFFFFF --- */
+
+// Nyx buffers.
+#define NYX_STORAGE_ADDR 0xED000000
+#define NYX_RES_ADDR     0xEE000000
+
+// Framebuffer addresses.
+#define IPL_FB_ADDRESS   0xF0000000
+#define  IPL_FB_SZ         0x384000 // 720 x 1280 x 4.
+#define LOG_FB_ADDRESS   0xF0400000
+#define  LOG_FB_SZ         0x334000 // 1280 x 656 x 4.
+#define NYX_FB_ADDRESS   0xF0800000
+#define  NYX_FB_SZ         0x384000 // 1280 x 720 x 4.
+
+// Nyx LvGL buffers.
+#define NYX_LV_VDB_ADR   0xF0C00000
+#define  NYX_FB_SZ         0x384000 // 1280 x 720 x 4.
+#define NYX_LV_MEM_ADR   0xF1000000
+#define  NYX_LV_MEM_SZ    0x8000000
+
+// NX BIS driver sector cache.
+#define NX_BIS_CACHE_ADDR 0xF9000000
+#define  NX_BIS_CACHE_SZ      0x8800
+/* --- Gap: 111MB 0xF9008800 - 0xFFFFFFFF --- */
+
+// #define EXT_PAYLOAD_ADDR    0xC03C0000
+// #define RCM_PAYLOAD_ADDR    (EXT_PAYLOAD_ADDR + ALIGN(PATCHED_RELOC_SZ, 0x10))
+// #define COREBOOT_ADDR       (0xD0000000 - 0x100000)
+
+// NYX
+// #define EXT_PAYLOAD_ADDR    0xC0000000
+// #define RCM_PAYLOAD_ADDR    (EXT_PAYLOAD_ADDR + ALIGN(PATCHED_RELOC_SZ, 0x10))
+// #define COREBOOT_ADDR       (0xD0000000 - 0x100000)
+
+#endif

source/config/config.c

@@ -20,6 +20,7 @@
 #include "config.h"
 #include "ini.h"
 #include "../gfx/gfx.h"
+#include "../gfx/tui.h"
 #include "../libs/fatfs/ff.h"
 #include "../soc/t210.h"
 #include "../storage/sdmmc.h"
@@ -52,3 +53,614 @@ void set_default_configuration()
 	sd_power_cycle_time_start = 0xFFFFFFF;
 }
 
+int create_config_entry()
+{
+	if (!sd_mount())
+		return 1;
+
+	char lbuf[32];
+	FIL fp;
+	bool mainIniFound = false;
+
+	LIST_INIT(ini_sections);
+
+	if (ini_parse(&ini_sections, "bootloader/hekate_ipl.ini", false))
+		mainIniFound = true;
+	else
+	{
+		u8 res = f_open(&fp, "bootloader/hekate_ipl.ini", FA_READ);
+		if (res == FR_NO_FILE || res == FR_NO_PATH)
+		{
+			f_mkdir("bootloader");
+			f_mkdir("bootloader/ini");
+			f_mkdir("bootloader/payloads");
+			f_mkdir("bootloader/sys");
+		}
+		else
+		{
+			if (!res)
+				f_close(&fp);
+			return 1;
+		}
+	}
+
+	if (f_open(&fp, "bootloader/hekate_ipl.ini", FA_WRITE | FA_CREATE_ALWAYS) != FR_OK)
+		return 1;
+	// Add config entry.
+	f_puts("[config]\nautoboot=", &fp);
+	itoa(h_cfg.autoboot, lbuf, 10);
+	f_puts(lbuf, &fp);
+	f_puts("\nautoboot_list=", &fp);
+	itoa(h_cfg.autoboot_list, lbuf, 10);
+	f_puts(lbuf, &fp);
+	f_puts("\nbootwait=", &fp);
+	itoa(h_cfg.bootwait, lbuf, 10);
+	f_puts(lbuf, &fp);
+	f_puts("\nverification=", &fp);
+	itoa(h_cfg.verification, lbuf, 10);
+	f_puts(lbuf, &fp);
+	f_puts("\nbacklight=", &fp);
+	itoa(h_cfg.backlight, lbuf, 10);
+	f_puts(lbuf, &fp);
+	f_puts("\nautohosoff=", &fp);
+	itoa(h_cfg.autohosoff, lbuf, 10);
+	f_puts(lbuf, &fp);
+	f_puts("\nautonogc=", &fp);
+	itoa(h_cfg.autonogc, lbuf, 10);
+	f_puts(lbuf, &fp);
+	if (h_cfg.brand)
+	{
+		f_puts("\nbrand=", &fp);
+		f_puts(h_cfg.brand, &fp);
+	}
+	if (h_cfg.tagline)
+	{
+		f_puts("\ntagline=", &fp);
+		f_puts(h_cfg.tagline, &fp);
+	}
+	f_puts("\n", &fp);
+
+	if (mainIniFound)
+	{
+		// Re-construct existing entries.
+		LIST_FOREACH_ENTRY(ini_sec_t, ini_sec, &ini_sections, link)
+		{
+			if (!strcmp(ini_sec->name, "config"))
+				continue;
+
+			switch (ini_sec->type)
+			{
+			case INI_CHOICE: // Re-construct Boot entry [ ].
+				f_puts("[", &fp);
+				f_puts(ini_sec->name, &fp);
+				f_puts("]\n", &fp);
+				// Re-construct boot entry's config.
+				LIST_FOREACH_ENTRY(ini_kv_t, kv, &ini_sec->kvs, link)
+				{
+					f_puts(kv->key, &fp);
+					f_puts("=", &fp);
+					f_puts(kv->val, &fp);
+					f_puts("\n", &fp);
+				}
+				break;
+			case INI_CAPTION: // Re-construct caption entry { }.
+				f_puts("{", &fp);
+				f_puts(ini_sec->name, &fp);
+				f_puts("}\n", &fp);
+				break;
+			case INI_NEWLINE: // Re-construct cosmetic newline \n.
+				f_puts("\n", &fp);
+				break;
+			case INI_COMMENT: // Re-construct comment entry #.
+				f_puts("#", &fp);
+				f_puts(ini_sec->name, &fp);
+				f_puts("\n", &fp);
+				break;
+			}
+		}
+	}
+
+	f_close(&fp);
+	sd_unmount();
+
+	return 0;
+}
+
+#pragma GCC push_options
+#pragma GCC optimize ("Os")
+
+static void _save_config()
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	if (!create_config_entry())
+		gfx_puts("\nConfiguration was saved!\n");
+	else
+		EPRINTF("\nConfiguration saving failed!");
+	gfx_puts("\nPress any key...");
+}
+
+static void _config_autoboot_list(void *ent)
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	u32 *temp_autoboot = NULL;
+
+	LIST_INIT(ini_sections);
+
+	u8 max_entries = 30;
+
+	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (max_entries + 3));
+	u32 *boot_values = (u32 *)malloc(sizeof(u32) * max_entries);
+	char *boot_text = (char *)malloc(512 * max_entries);
+
+	for (u32 j = 0; j < max_entries; j++)
+		boot_values[j] = j;
+
+	if (sd_mount())
+	{
+		if (ini_parse(&ini_sections, "bootloader/ini", true))
+		{
+			// Build configuration menu.
+			ments[0].type = MENT_BACK;
+			ments[0].caption = "Back";
+
+			ments[1].type = MENT_CHGLINE;
+
+			u32 i = 2;
+			LIST_FOREACH_ENTRY(ini_sec_t, ini_sec, &ini_sections, link)
+			{
+				// Skip other ini entries for autoboot.
+				if (ini_sec->type == INI_CHOICE)
+				{
+					if (!strcmp(ini_sec->name, "config"))
+						continue;
+
+					if (strlen(ini_sec->name) > 510)
+						ments[i].caption = ini_sec->name;
+					else
+					{
+						if (h_cfg.autoboot != (i - 1) || !h_cfg.autoboot_list)
+							boot_text[(i - 1) * 512] = ' ';
+
+						else
+							boot_text[(i - 1) * 512] = '*';
+						strcpy(boot_text + (i - 1) * 512 + 1, ini_sec->name);
+						ments[i].caption = &boot_text[(i - 1) * 512];
+					}
+					ments[i].type = ini_sec->type;
+					ments[i].data = &boot_values[i - 1];
+					i++;
+
+					if ((i - 1) > max_entries)
+						break;
+				}
+			}
+
+			memset(&ments[i], 0, sizeof(ment_t));
+			menu_t menu = {ments, "Select an entry to auto boot", 0, 0};
+			temp_autoboot = (u32 *)tui_do_menu(&menu);
+			if (temp_autoboot != NULL)
+			{
+				h_cfg.autoboot = *(u32 *)temp_autoboot;
+				h_cfg.autoboot_list = 1;
+				_save_config();
+
+				ment_t *tmp = (ment_t *)ent;
+				tmp->data = NULL;
+			}
+			else
+				goto out2;
+		}
+		else
+		{
+			EPRINTF("Could not open 'bootloader/hekate_ipl.ini'.\nMake sure it exists!.");
+			goto out;
+		}
+	}
+
+out:;
+	btn_wait();
+out2:;
+	free(ments);
+	free(boot_values);
+	free(boot_text);
+
+	sd_unmount();
+}
+
+void config_autoboot()
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	u32 *temp_autoboot = NULL;
+
+	LIST_INIT(ini_sections);
+
+	u8 max_entries = 30;
+
+	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (max_entries + 5));
+	u32 *boot_values = (u32 *)malloc(sizeof(u32) * max_entries);
+	char *boot_text = (char *)malloc(512 * max_entries);
+
+	for (u32 j = 0; j < max_entries; j++)
+		boot_values[j] = j;
+
+	if (sd_mount())
+	{
+		if (ini_parse(&ini_sections, "bootloader/hekate_ipl.ini", false))
+		{
+			// Build configuration menu.
+			ments[0].type = MENT_BACK;
+			ments[0].caption = "Back";
+
+			ments[1].type = MENT_CHGLINE;
+
+			ments[2].type = MENT_DATA;
+			if (!h_cfg.autoboot)
+				ments[2].caption = "*Disable";
+			else
+				ments[2].caption = " Disable";
+			ments[2].data = &boot_values[0];
+
+			ments[3].type = MENT_HDLR_RE;
+			if (h_cfg.autoboot_list)
+				ments[3].caption = "*More configs...";
+			else
+				ments[3].caption = " More configs...";
+			ments[3].handler = _config_autoboot_list;
+			ments[3].data = (void *)0xCAFE;
+
+			ments[4].type = MENT_CHGLINE;
+
+			u32 i = 5;
+			LIST_FOREACH_ENTRY(ini_sec_t, ini_sec, &ini_sections, link)
+			{
+				// Skip other ini entries for autoboot.
+				if (ini_sec->type == INI_CHOICE)
+				{
+					if (!strcmp(ini_sec->name, "config"))
+						continue;
+
+					if (strlen(ini_sec->name) > 510)
+						ments[i].caption = ini_sec->name;
+					else
+					{
+						if (h_cfg.autoboot != (i - 4) || h_cfg.autoboot_list)
+							boot_text[(i - 4) * 512] = ' ';
+
+						else
+							boot_text[(i - 4) * 512] = '*';
+						strcpy(boot_text + (i - 4) * 512 + 1, ini_sec->name);
+						ments[i].caption = &boot_text[(i - 4) * 512];
+					}
+					ments[i].type = ini_sec->type;
+					ments[i].data = &boot_values[i - 4];
+					i++;
+
+					if ((i - 4) > max_entries)
+						break;
+				}
+			}
+			if (i < 6 && !h_cfg.autoboot_list)
+			{
+				ments[i].type = MENT_CAPTION;
+				ments[i].caption = "No main configurations found...";
+				ments[i].color = 0xFFFFDD00;
+				i++;
+			}
+
+			memset(&ments[i], 0, sizeof(ment_t));
+			menu_t menu = {ments, "Disable or select entry to auto boot", 0, 0};
+			temp_autoboot = (u32 *)tui_do_menu(&menu);
+			if (temp_autoboot != NULL)
+			{
+				h_cfg.autoboot = *(u32 *)temp_autoboot;
+				h_cfg.autoboot_list = 0;
+				_save_config();
+			}
+			else
+				goto out2;
+		}
+		else
+		{
+			EPRINTF("Could not open 'bootloader/hekate_ipl.ini'.\nMake sure it exists!.");
+			goto out;
+		}
+	}
+
+out:;
+	btn_wait();
+out2:;
+	free(ments);
+	free(boot_values);
+	free(boot_text);
+
+	sd_unmount();
+
+	if (temp_autoboot == NULL)
+		return;
+}
+
+void config_bootdelay()
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	u32 delay_entries = 6;
+
+	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (delay_entries + 3));
+	u32 *delay_values = (u32 *)malloc(sizeof(u32) * delay_entries);
+	char *delay_text = (char *)malloc(32 * delay_entries);
+
+	for (u32 j = 0; j < delay_entries; j++)
+		delay_values[j] = j;
+
+	ments[0].type = MENT_BACK;
+	ments[0].caption = "Back";
+
+	ments[1].type = MENT_CHGLINE;
+
+	ments[2].type = MENT_DATA;
+	if (h_cfg.bootwait)
+		ments[2].caption = " 0 seconds (Bootlogo disabled)";
+	else
+		ments[2].caption = "*0 seconds (Bootlogo disabled)";
+	ments[2].data = &delay_values[0];
+
+	u32 i = 0;
+	for (i = 1; i < delay_entries; i++)
+	{
+		if (h_cfg.bootwait != i)
+			delay_text[i * 32] = ' ';
+		else
+			delay_text[i * 32] = '*';
+		delay_text[i * 32 + 1] = i + '0';
+		strcpy(delay_text + i * 32 + 2, " seconds");
+
+		ments[i + 2].type = MENT_DATA;
+		ments[i + 2].caption = delay_text + i * 32;
+		ments[i + 2].data = &delay_values[i];
+	}
+
+	memset(&ments[i + 2], 0, sizeof(ment_t));
+	menu_t menu = {ments, "Time delay for entering bootloader menu", 0, 0};
+
+	u32 *temp_bootwait = (u32 *)tui_do_menu(&menu);
+	if (temp_bootwait != NULL)
+	{
+		h_cfg.bootwait = *(u32 *)temp_bootwait;
+		_save_config();
+	}
+
+	free(ments);
+	free(delay_values);
+	free(delay_text);
+
+	if (temp_bootwait == NULL)
+		return;
+	btn_wait();
+}
+
+void config_verification()
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * 6);
+	u32 *vr_values = (u32 *)malloc(sizeof(u32) * 3);
+	char *vr_text = (char *)malloc(64 * 3);
+
+	for (u32 j = 0; j < 3; j++)
+	{
+		vr_values[j] = j;
+		ments[j + 2].type = MENT_DATA;
+		ments[j + 2].data = &vr_values[j];
+	}
+
+	ments[0].type = MENT_BACK;
+	ments[0].caption = "Back";
+
+	ments[1].type = MENT_CHGLINE;
+
+	strcpy(vr_text,       " Disable (Fastest - Unsafe)");
+	strcpy(vr_text + 64,  " Sparse  (Fast - Safe)");
+	strcpy(vr_text + 128, " Full    (Slow - Safe)");
+
+	for (u32 i = 0; i < 3; i++)
+	{
+		if (h_cfg.verification != i)
+			vr_text[64 * i] = ' ';
+		else
+			vr_text[64 * i] = '*';
+		ments[2 + i].caption = vr_text + (i * 64);
+	}
+
+	memset(&ments[5], 0, sizeof(ment_t));
+	menu_t menu = {ments, "Backup & Restore verification", 0, 0};
+
+	u32 *temp_verification = (u32 *)tui_do_menu(&menu);
+	if (temp_verification != NULL)
+	{
+		h_cfg.verification = *(u32 *)temp_verification;
+		_save_config();
+	}
+
+	free(ments);
+	free(vr_values);
+	free(vr_text);
+
+	if (temp_verification == NULL)
+		return;
+	btn_wait();
+}
+
+void config_backlight()
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	u32 bri_entries = 11;
+
+	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (bri_entries + 3));
+	u32 *bri_values = (u32 *)malloc(sizeof(u32) * bri_entries);
+	char *bri_text = (char *)malloc(8 * bri_entries);
+
+	for (u32 j = 1; j < bri_entries; j++)
+		bri_values[j] = j * 10;
+
+	ments[0].type = MENT_BACK;
+	ments[0].caption = "Back";
+
+	ments[1].type = MENT_CHGLINE;
+
+	u32 i = 0;
+	for (i = 1; i < bri_entries; i++)
+	{
+		if ((h_cfg.backlight / 20) != i)
+			bri_text[i * 32] = ' ';
+		else
+			bri_text[i * 32] = '*';
+
+		if (i < 10)
+		{
+			bri_text[i * 32 + 1] = i + '0';
+			strcpy(bri_text + i * 32 + 2, "0%");
+		}
+		else
+			strcpy(bri_text + i * 32 + 1, "100%");
+
+		ments[i + 1].type = MENT_DATA;
+		ments[i + 1].caption = bri_text + i * 32;
+		ments[i + 1].data = &bri_values[i];
+	}
+
+	memset(&ments[i + 1], 0, sizeof(ment_t));
+	menu_t menu = {ments, "Backlight brightness", 0, 0};
+
+	u32 *temp_backlight = (u32 *)tui_do_menu(&menu);
+	if (temp_backlight != NULL)
+	{
+		h_cfg.backlight = (*(u32 *)temp_backlight) * 2;
+		_save_config();
+	}
+
+	free(ments);
+	free(bri_values);
+	free(bri_text);
+
+	if (temp_backlight == NULL)
+		return;
+	btn_wait();
+}
+
+void config_auto_hos_poweroff()
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * 6);
+	u32 *hp_values = (u32 *)malloc(sizeof(u32) * 3);
+
+	for (u32 j = 0; j < 3; j++)
+	{
+		hp_values[j] = j;
+		ments[j + 2].type = MENT_DATA;
+		ments[j + 2].data = &hp_values[j];
+	}
+
+	ments[0].type = MENT_BACK;
+	ments[0].caption = "Back";
+
+	ments[1].type = MENT_CHGLINE;
+
+	if (h_cfg.autohosoff == 1)
+	{
+		ments[2].caption = " Disable";
+		ments[3].caption = "*Enable";
+		ments[4].caption = " Enable (No logo)";
+	}
+	else if (h_cfg.autohosoff >= 2)
+	{
+		ments[2].caption = " Disable";
+		ments[3].caption = " Enable";
+		ments[4].caption = "*Enable (No logo)";
+	}
+	else
+	{
+		ments[2].caption = "*Disable";
+		ments[3].caption = " Enable";
+		ments[4].caption = " Enable (No logo)";
+	}
+
+	memset(&ments[5], 0, sizeof(ment_t));
+	menu_t menu = {ments, "Power off if woke up from HOS", 0, 0};
+
+	u32 *temp_autohosoff = (u32 *)tui_do_menu(&menu);
+	if (temp_autohosoff != NULL)
+	{
+		h_cfg.autohosoff = *(u32 *)temp_autohosoff;
+		_save_config();
+	}
+
+	free(ments);
+	free(hp_values);
+
+	if (temp_autohosoff == NULL)
+		return;
+	btn_wait();
+}
+
+void config_nogc()
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * 5);
+	u32 *cb_values = (u32 *)malloc(sizeof(u32) * 2);
+
+	for (u32 j = 0; j < 2; j++)
+	{
+		cb_values[j] = j;
+		ments[j + 2].type = MENT_DATA;
+		ments[j + 2].data = &cb_values[j];
+	}
+
+	ments[0].type = MENT_BACK;
+	ments[0].caption = "Back";
+
+	ments[1].type = MENT_CHGLINE;
+
+	if (h_cfg.autonogc)
+	{
+		ments[2].caption = " Disable";
+		ments[3].caption = "*Auto";
+	}
+	else
+	{
+		ments[2].caption = "*Disable";
+		ments[3].caption = " Auto";
+	}
+
+	memset(&ments[4], 0, sizeof(ment_t));
+	menu_t menu = {ments, "No Gamecard", 0, 0};
+
+	u32 *temp_nogc = (u32 *)tui_do_menu(&menu);
+	if (temp_nogc != NULL)
+	{
+		h_cfg.autonogc = *(u32 *)temp_nogc;
+		_save_config();
+	}
+
+	free(ments);
+	free(cb_values);
+
+	if (temp_nogc == NULL)
+		return;
+	btn_wait();
+}
+
+#pragma GCC pop_options

source/config/config.h

@@ -46,5 +46,12 @@ typedef enum
 } hsysmodule_t;
 
 void set_default_configuration();
+int create_config_entry();
+void config_autoboot();
+void config_bootdelay();
+void config_verification();
+void config_backlight();
+void config_auto_hos_poweroff();
+void config_nogc();
 
 #endif /* _CONFIG_H_ */

source/config/ini.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018-2019 CTCaer
+ * Copyright (c) 2018-2019 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -78,7 +78,7 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 
 	char *filename = (char *)malloc(256);
 
-	memcpy(filename, ini_path, pathlen + 1);
+	strcpy(filename, ini_path);
 
 	// Get all ini filenames.
 	if (is_dir)
@@ -89,7 +89,7 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 			free(filename);
 			return 0;
 		}
-		memcpy(filename + pathlen, "/", 2);
+		strcpy(filename + pathlen, "/");
 		pathlen++;
 	}
 
@@ -100,7 +100,7 @@ int ini_parse(link_t *dst, char *ini_path, bool is_dir)
 		{
 			if (filelist[k * 256])
 			{
-				memcpy(filename + pathlen, &filelist[k * 256], strlen(&filelist[k * 256]) + 1);
+				strcpy(filename + pathlen, &filelist[k * 256]);
 				k++;
 			}
 			else

source/config/ini.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (c) 2018 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

source/gfx/di.c

@@ -262,11 +262,12 @@ void display_color_screen(u32 color)
 u32 *display_init_framebuffer()
 {
 	// Sanitize framebuffer area.
-	memset((u32 *)FB_ADDRESS, 0, 0x3C0000);
+	memset((u32 *)IPL_FB_ADDRESS, 0, 0x3C0000);
+
 	// This configures the framebuffer @ IPL_FB_ADDRESS with a resolution of 1280x720 (line stride 720).
 	exec_cfg((u32 *)DISPLAY_A_BASE, cfg_display_framebuffer, 32);
 	usleep(35000);
 
-	return (u32 *)FB_ADDRESS;
+	return (u32 *)IPL_FB_ADDRESS;
 }
 

source/gfx/di.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (c) 2018 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -18,10 +18,9 @@
 #ifndef _DI_H_
 #define _DI_H_
 
+#include "../../common/memory_map.h"
 #include "../utils/types.h"
 
-#define FB_ADDRESS 0xC0000000
-
 /*! Display registers. */
 #define _DIREG(reg) ((reg) * 4)
 

source/gfx/di.inl

@@ -1,6 +1,6 @@
 /*
 * Copyright (c) 2018 naehrwert
-* Copyright (C) 2018 CTCaer
+* Copyright (c) 2018 CTCaer
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@@ -128,7 +128,7 @@ static const cfg_op_t _display_config_2[94] = {
 };
 
 //DSI Init config.
-static const cfg_op_t _display_config_3[61] = {
+static const cfg_op_t _display_config_3[61] = { 
 	{DSI_WR_DATA, 0},
 	{DSI_INT_ENABLE, 0},
 	{DSI_INT_STATUS, 0},
@@ -415,7 +415,7 @@ static const cfg_op_t _display_config_11[113] = {
 	{DC_DISP_SYNC_WIDTH,  0x10048},
 	{DC_DISP_BACK_PORCH,  0x90048},
 	{DC_DISP_ACTIVE,      0x50002D0},
-	{DC_DISP_FRONT_PORCH, 0xA0088}, // Sources say that this should be above the DC_DISP_ACTIVE cmd.
+	{DC_DISP_FRONT_PORCH, 0xA0088},   // Sources say that this should be above the DC_DISP_ACTIVE cmd.
 	/* End of Display timings */
 	{DC_DISP_SHIFT_CLOCK_OPTIONS, SC1_H_QUALIFIER_NONE | SC0_H_QUALIFIER_NONE},
 	{DC_COM_PIN_OUTPUT_ENABLE(1), 0},
@@ -548,7 +548,7 @@ static const cfg_op_t cfg_display_framebuffer[32] = {
 	{DC_WIN_LINE_STRIDE, UV_LINE_STRIDE(720 * 2) | LINE_STRIDE(720 * 4)}, //768*2x768*4 (= 0x600 x 0xC00) bytes, see TRM for alignment requirements.
 	{DC_WIN_BUFFER_CONTROL, 0},
 	{DC_WINBUF_SURFACE_KIND, 0}, //Regular surface.
-	{DC_WINBUF_START_ADDR, FB_ADDRESS}, //Framebuffer address.
+	{DC_WINBUF_START_ADDR, IPL_FB_ADDRESS}, // Framebuffer address.
 	{DC_WINBUF_ADDR_H_OFFSET, 0},
 	{DC_WINBUF_ADDR_V_OFFSET, 0},
 	{DC_WIN_WIN_OPTIONS, 0},

source/hos/pkg1.c

@@ -22,20 +22,26 @@
 #include "pkg1.h"
 #include "../sec/se.h"
 
+#define HASH_ORDER_100_100 {2, 3, 4, 0, 5, 6, 1}
+#define HASH_ORDER_200_510 {2, 3, 4, 0, 5, 7, 10, 12, 11, 6, 8, 1}
+#define HASH_ORDER_600_620 {6, 5, 10, 7, 8, 2, 3, 4, 0, 12, 11, 1}
+#define HASH_ORDER_700_9xx {6, 5, 10, 7, 8, 2, 3, 4, 0, 12, 11, 9, 1}
+
 static const pkg1_id_t _pkg1_ids[] = {
-	{ "20161121183008", 0 }, //1.0.0
-	{ "20170210155124", 0 }, //2.0.0 - 2.3.0
-	{ "20170519101410", 1 }, //3.0.0
-	{ "20170710161758", 2 }, //3.0.1 - 3.0.2
-	{ "20170921172629", 3 }, //4.0.0 - 4.1.0
-	{ "20180220163747", 4 }, //5.0.0 - 5.1.0
-	{ "20180802162753", 5 }, //6.0.0 - 6.1.0
-	{ "20181107105733", 6 }, //6.2.0
-	{ "20181218175730", 7 }, //7.0.0
-	{ "20190208150037", 7 }, //7.0.1
-	{ "20190314172056", 7 }, //8.0.0 - 8.0.1
-	{ "20190531152432", 8 }, //8.1.0
-	{ "20190809135709", 9 }, //9.0.0 - 9.0.1
+	{ "20161121183008", 0, {0x1b517, 0x125bc2, 1, 16,  6, HASH_ORDER_100_100,      0, 0x449dc} }, //1.0.0
+	{ "20170210155124", 0, {0x1d226,   0x26fe, 0, 16, 11, HASH_ORDER_200_510, 0x557b, 0x3d41a} }, //2.0.0 - 2.3.0
+	{ "20170519101410", 1, {0x1ffa6,   0x298b, 0, 16, 11, HASH_ORDER_200_510, 0x552d, 0x3cb81} }, //3.0.0
+	{ "20170710161758", 2, {0x20026,   0x29ab, 0, 16, 11, HASH_ORDER_200_510, 0x552d, 0x3cb81} }, //3.0.1 - 3.0.2
+	{ "20170921172629", 3, {0x1c64c,   0x37eb, 0, 16, 11, HASH_ORDER_200_510, 0x5382, 0x3711c} }, //4.0.0 - 4.1.0
+	{ "20180220163747", 4, {0x1f3b4,   0x465b, 0, 16, 11, HASH_ORDER_200_510, 0x5a63, 0x37901} }, //5.0.0 - 5.1.0
+	{ "20180802162753", 5, {0x27350,  0x17ff5, 1,  8, 11, HASH_ORDER_600_620, 0x5674, 0x1d5be} }, //6.0.0 - 6.1.0
+	{ "20181107105733", 6, {0x27350,  0x17ff5, 1,  8, 11, HASH_ORDER_600_620, 0x5674, 0x1d5be} }, //6.2.0
+	{ "20181218175730", 7, {0x29c50,   0x6a73, 0,  8, 12, HASH_ORDER_700_9xx, 0x5563, 0x1d437} }, //7.0.0
+	{ "20190208150037", 7, {0x29c50,   0x6a73, 0,  8, 12, HASH_ORDER_700_9xx, 0x5563, 0x1d437} }, //7.0.1
+	{ "20190314172056", 7, {0x29c50,   0x6a73, 0,  8, 12, HASH_ORDER_700_9xx, 0x5563, 0x1d437} }, //8.0.0 - 8.0.1
+	{ "20190531152432", 8, {0x29c50,   0x6a73, 0,  8, 12, HASH_ORDER_700_9xx, 0x5563, 0x1d437} }, //8.1.0
+	{ "20190809135709", 9, {0x2ec10,   0x5573, 0,  1, 12, HASH_ORDER_700_9xx, 0x6495, 0x1d807} }, //9.0.0 - 9.0.1
+	{ "20191021113848", 10,{0x2ec10,   0x5573, 0,  1, 12, HASH_ORDER_700_9xx, 0x6495, 0x1d807} }, //9.1.0
 	{ NULL } //End.
 };
 

source/hos/pkg1.h

@@ -19,10 +19,23 @@
 
 #include "../utils/types.h"
 
+typedef struct _key_info_t
+{
+	u32 start_offset;
+	u32 hks_offset;
+	bool hks_offset_is_from_end;
+	u32 alignment;
+	u32 hash_max;
+	u8 hash_order[13];
+	u32 es_offset;
+	u32 ssl_offset;
+} key_info_t;
+
 typedef struct _pkg1_id_t
 {
 	const char *id;
 	u32 kb;
+	key_info_t key_info;
 } pkg1_id_t;
 
 const pkg1_id_t *pkg1_identify(u8 *pkg1);

source/hos/sept.c

@@ -107,8 +107,10 @@ int reboot_to_sept(const u8 *tsec_fw, const u32 tsec_size, const u32 kb)
 
 	tmp_cfg->boot_cfg |= BOOT_CFG_SEPT_RUN;
 
-	if (f_open(&fp, "sd:/sept/payload.bin", FA_READ | FA_WRITE))
+	if (f_open(&fp, "sd:/sept/payload.bin", FA_READ | FA_WRITE)) {
+		free(tmp_cfg);
 		goto error;
+	}
 
 	f_lseek(&fp, PATCHED_RELOC_SZ);
 	f_write(&fp, tmp_cfg, sizeof(boot_cfg_t), NULL);
@@ -117,7 +119,6 @@ int reboot_to_sept(const u8 *tsec_fw, const u32 tsec_size, const u32 kb)
 
 	sd_unmount();
 	gfx_printf("\n%kPress Power or Vol +/-\n   to Reboot to Sept...", colors[(color_idx++) % 6]);
-	btn_wait();
 
 	u32 pk1t_sept = SEPT_PK1T_ADDR - (ALIGN(PATCHED_RELOC_SZ, 0x10) + WB_RST_SIZE);
 

source/keys/key_sources.inl

@@ -30,6 +30,7 @@ static const u8 master_kek_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION
     {0x9A, 0x3E, 0xA9, 0xAB, 0xFD, 0x56, 0x46, 0x1C, 0x9B, 0xF6, 0x48, 0x7F, 0x5C, 0xFA, 0x09, 0x5C}, //7.0.0
     {0xDE, 0xDC, 0xE3, 0x39, 0x30, 0x88, 0x16, 0xF8, 0xAE, 0x97, 0xAD, 0xEC, 0x64, 0x2D, 0x41, 0x41}, //8.1.0
     {0x1A, 0xEC, 0x11, 0x82, 0x2B, 0x32, 0x38, 0x7A, 0x2B, 0xED, 0xBA, 0x01, 0x47, 0x7E, 0x3B, 0x67}, //9.0.0
+    {0x30, 0x3F, 0x02, 0x7E, 0xD8, 0x38, 0xEC, 0xD7, 0x93, 0x25, 0x34, 0xB5, 0x30, 0xEB, 0xCA, 0x7A}, //9.1.0
 };
 
 static const u8 mkey_vectors[KB_FIRMWARE_VERSION_MAX+1][0x10] =
@@ -44,6 +45,7 @@ static const u8 mkey_vectors[KB_FIRMWARE_VERSION_MAX+1][0x10] =
     {0xA4, 0xD4, 0x52, 0x6F, 0xD1, 0xE4, 0x36, 0xAA, 0x9F, 0xCB, 0x61, 0x27, 0x1C, 0x67, 0x65, 0x1F}, /* Master key 06 encrypted with Master key 07. */
     {0xEA, 0x60, 0xB3, 0xEA, 0xCE, 0x8F, 0x24, 0x46, 0x7D, 0x33, 0x9C, 0xD1, 0xBC, 0x24, 0x98, 0x29}, /* Master key 07 encrypted with Master key 08. */
     {0x4D, 0xD9, 0x98, 0x42, 0x45, 0x0D, 0xB1, 0x3C, 0x52, 0x0C, 0x9A, 0x44, 0xBB, 0xAD, 0xAF, 0x80}, /* Master key 08 encrypted with Master key 09. */
+    {0xB8, 0x96, 0x9E, 0x4A, 0x00, 0x0D, 0xD6, 0x28, 0xB3, 0xD1, 0xDB, 0x68, 0x5F, 0xFB, 0xE1, 0x2A}, /* Master key 09 encrypted with Master key 0A. */
 };
 
 //======================================Keys======================================//
@@ -79,6 +81,7 @@ static const u8 new_device_key_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VER
     {0x8F, 0x77, 0x5A, 0x96, 0xB0, 0x94, 0xFD, 0x8D, 0x28, 0xE4, 0x19, 0xC8, 0x16, 0x1C, 0xDB, 0x3D}, /* 7.0.0 New Device Key Source. */
     {0x67, 0x62, 0xD4, 0x8E, 0x55, 0xCF, 0xFF, 0x41, 0x31, 0x15, 0x3B, 0x24, 0x0C, 0x7C, 0x07, 0xAE}, /* 8.1.0 New Device Key Source. */
     {0x4A, 0xC3, 0x4E, 0x14, 0x8B, 0x96, 0x4A, 0xD5, 0xD4, 0x99, 0x73, 0xC4, 0x45, 0xAB, 0x8B, 0x49}, /* 9.0.0 New Device Key Source. */
+    {0x14, 0xB8, 0x74, 0x12, 0xCB, 0xBD, 0x0B, 0x8F, 0x20, 0xFB, 0x30, 0xDA, 0x27, 0xE4, 0x58, 0x94}, /* 9.1.0 New Device Key Source. */
 };
 
 static const u8 new_device_keygen_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_400 + 1][0x10] = {
@@ -88,7 +91,8 @@ static const u8 new_device_keygen_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_
     {0x81, 0x3C, 0x6C, 0xBF, 0x5D, 0x21, 0xDE, 0x77, 0x20, 0xD9, 0x6C, 0xE3, 0x22, 0x06, 0xAE, 0xBB}, /* 6.2.0 New Device Keygen Source. */
     {0x86, 0x61, 0xB0, 0x16, 0xFA, 0x7A, 0x9A, 0xEA, 0xF6, 0xF5, 0xBE, 0x1A, 0x13, 0x5B, 0x6D, 0x9E}, /* 7.0.0 New Device Keygen Source. */
     {0xA6, 0x81, 0x71, 0xE7, 0xB5, 0x23, 0x74, 0xB0, 0x39, 0x8C, 0xB7, 0xFF, 0xA0, 0x62, 0x9F, 0x8D}, /* 8.1.0 New Device Keygen Source. */
-    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* TODO: 9.0.0 New Device Keygen Source to be added on next change-of-keys. */
+    {0x03, 0xE7, 0xEB, 0x43, 0x1B, 0xCF, 0x5F, 0xB5, 0xED, 0xDC, 0x97, 0xAE, 0x21, 0x8D, 0x19, 0xED}, /* 9.0.0 New Device Keygen Source. */
+    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* TODO: 9.1.0 New Device Keygen Source to be added on next change-of-keys. */
 };
 
 // from SPL

source/keys/keys.c

@@ -43,6 +43,7 @@
 #include "../utils/util.h"
 
 #include "key_sources.inl"
+#include "save.h"
 
 #include <string.h>
 
@@ -115,6 +116,8 @@ void dump_keys() {
         package2_key[KB_FIRMWARE_VERSION_MAX+1][0x10] = {0},
         titlekek[KB_FIRMWARE_VERSION_MAX+1][0x10] = {0};
 
+    sd_mount();
+
     display_backlight_brightness(h_cfg.backlight, 1000);
     gfx_clear_partial_grey(0x1B, 0, 1256);
     gfx_con_setpos(0, 0);
@@ -135,7 +138,10 @@ void dump_keys() {
     tsec_ctxt_t tsec_ctxt;
     sdmmc_t sdmmc;
 
-    emummc_storage_init_mmc(&storage, &sdmmc);
+    if (!emummc_storage_init_mmc(&storage, &sdmmc)) {
+        EPRINTF("Unable to init MMC.");
+        goto out_wait;
+    }
     TPRINTFARGS("%kMMC init...     ", colors[(color_idx++) % 6]);
 
     // Read package1.
@@ -144,7 +150,7 @@ void dump_keys() {
     emummc_storage_read(&storage, 0x100000 / NX_EMMC_BLOCKSIZE, 0x40000 / NX_EMMC_BLOCKSIZE, pkg1);
     const pkg1_id_t *pkg1_id = pkg1_identify(pkg1);
     if (!pkg1_id) {
-        EPRINTF("Unknown pkg1 version.");
+        EPRINTF("Unknown pkg1 version.\n Make sure you have the latest Lockpick_RCM.\n If a new firmware version just came out,\n Lockpick_RCM must be updated.\n Check Github for new release.");
         goto out_wait;
     }
 
@@ -447,101 +453,40 @@ get_tsec: ;
     pkg2_decompress_kip(ki, 2 | 4); // we only need .rodata and .data
     TPRINTFARGS("%kDecompress FS...", colors[(color_idx++) % 6]);
 
-    u8  hash_index = 0, hash_max = 11, hash_order[13],
-        key_lengths[13] = {0x10, 0x20, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x20, 0x10, 0x20, 0x20};
-    u32 start_offset = 0, hks_offset_from_end = ki->kip1->sections[2].size_decomp, alignment = 0x10;
+    u8 hash_index = 0;
+    const u8 key_lengths[13] = {0x10, 0x20, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x20, 0x10, 0x20, 0x20};
 
-    // the FS keys appear in different orders
     if (!memcmp(pkg1_id->id, "2016", 4)) {
-        // 1.0.0 doesn't have SD keys at all
-        hash_max = 6;
-        // the first key isn't aligned with the rest
+        // 1.0.0 doesn't have SD keys at all and the first key isn't aligned with the rest
         memcpy(fs_keys[2], ki->kip1->data + ki->kip1->sections[0].size_comp + 0x1ae0e, 0x10);
         hash_index = 1;
-        start_offset = 0x1b517;
-        hks_offset_from_end = 0x125bc2;
-        u8 temp[7] = {2, 3, 4, 0, 5, 6, 1};
-        memcpy(hash_order, temp, 7);
-    } else {
-        // 2.0.0 - 8.0.0
-        switch (pkg1_id->kb) {
-        case KB_FIRMWARE_VERSION_100_200:
-            start_offset = 0x1d226;
-            hks_offset_from_end -= 0x26fe;
-            break;
-        case KB_FIRMWARE_VERSION_300:
-            start_offset = 0x1ffa6;
-            hks_offset_from_end -= 0x298b;
-            break;
-        case KB_FIRMWARE_VERSION_301:
-            start_offset = 0x20026;
-            hks_offset_from_end -= 0x29ab;
-            break;
-        case KB_FIRMWARE_VERSION_400:
-            start_offset = 0x1c64c;
-            hks_offset_from_end -= 0x37eb;
-            break;
-        case KB_FIRMWARE_VERSION_500:
-            start_offset = 0x1f3b4;
-            hks_offset_from_end -= 0x465b;
-            break;
-        case KB_FIRMWARE_VERSION_600:
-        case KB_FIRMWARE_VERSION_620:
-            start_offset = 0x27350;
-            hks_offset_from_end = 0x17ff5;
-            alignment = 8;
-            break;
-        case KB_FIRMWARE_VERSION_700:
-        case KB_FIRMWARE_VERSION_810:
-            start_offset = 0x29c50;
-            hks_offset_from_end -= 0x6a73;
-            alignment = 8;
-            break;
-        case KB_FIRMWARE_VERSION_900:
-            start_offset = 0x2ec10;
-            hks_offset_from_end -= 0x5573;
-            alignment = 1; // RIP
-            break;
-        }
-
-        if (pkg1_id->kb <= KB_FIRMWARE_VERSION_500) {
-            u8 temp[12] = {2, 3, 4, 0, 5, 7, 10, 12, 11, 6, 8, 1};
-            memcpy(hash_order, temp, 12);
-        } else if (pkg1_id->kb <= KB_FIRMWARE_VERSION_620) {
-            u8 temp[12] = {6, 5, 10, 7, 8, 2, 3, 4, 0, 12, 11, 1};
-            memcpy(hash_order, temp, 12);
-        } else {
-            u8 temp[13] = {6, 5, 10, 7, 8, 2, 3, 4, 0, 12, 11, 9, 1};
-            memcpy(hash_order, temp, 13);
-            hash_max = 12;
-        }
     }
 
     u8 temp_hash[0x20];
-    for (u32 i = ki->kip1->sections[0].size_comp + start_offset; i < ki->size - 0x20; ) {
+    for (u32 i = ki->kip1->sections[0].size_comp + pkg1_id->key_info.start_offset; i < ki->size - 0x20; ) {
         minerva_periodic_training();
-        se_calc_sha256(temp_hash, ki->kip1->data + i, key_lengths[hash_order[hash_index]]);
-        if (!memcmp(temp_hash, fs_hashes_sha256[hash_order[hash_index]], 0x20)) {
-            memcpy(fs_keys[hash_order[hash_index]], ki->kip1->data + i, key_lengths[hash_order[hash_index]]);
-            /*if (hash_index == hash_max) {
-                TPRINTFARGS("%d: %x    end -%x", hash_index, (*(ki->kip1->data + i)), ki->size - i);
-            } else {
-                TPRINTFARGS("%d: %x rodata +%x", hash_index, (*(ki->kip1->data + i)), i - ki->kip1->sections[0].size_comp);
-            }*/
-            i += key_lengths[hash_order[hash_index]];
-            if (hash_index == hash_max - 1) {
-                i = ki->size - hks_offset_from_end;
-            } else if (hash_index == hash_max) {
+        se_calc_sha256(temp_hash, ki->kip1->data + i, key_lengths[pkg1_id->key_info.hash_order[hash_index]]);
+        if (!memcmp(temp_hash, fs_hashes_sha256[pkg1_id->key_info.hash_order[hash_index]], 0x20)) {
+            memcpy(fs_keys[pkg1_id->key_info.hash_order[hash_index]], ki->kip1->data + i, key_lengths[pkg1_id->key_info.hash_order[hash_index]]);
+            i += key_lengths[pkg1_id->key_info.hash_order[hash_index]];
+            if (hash_index == pkg1_id->key_info.hash_max - 1) {
+                if (pkg1_id->key_info.hks_offset_is_from_end)
+                    i = ki->size - pkg1_id->key_info.hks_offset;
+                else
+                    i = ki->size - (ki->kip1->sections[2].size_decomp - pkg1_id->key_info.hks_offset);
+            } else if (hash_index == pkg1_id->key_info.hash_max) {
                 break;
             }
             hash_index++;
         } else {
-            i += alignment;
+            i += pkg1_id->key_info.alignment;
         }
     }
 pkg2_done:
+    if (ki) {
+        free(ki);
+    }
     free(pkg2);
-    free(ki);
 
     u8 *rights_ids = NULL, *titlekeys = NULL;
 
@@ -600,6 +545,8 @@ pkg2_done:
     DIR dir;
     FILINFO fno;
     FIL fp;
+    save_ctx_t *save_ctx = NULL;
+
     // sysmodule NCAs only ever have one section (exefs) so 0x600 is sufficient
     u8 *dec_header = (u8*)malloc(0x600);
     char path[100] = "emmc:/Contents/registered";
@@ -623,7 +570,6 @@ pkg2_done:
     }
 
     path[25] = '/';
-    start_offset = 0;
     while (!f_readdir(&dir, &fno) && fno.fname[0] && titles_found < title_limit) {
         minerva_periodic_training();
         memcpy(path + 26, fno.fname, 36);
@@ -638,44 +584,14 @@ pkg2_done:
         se_aes_xts_crypt(5, 4, 0, 1, dec_header + 0x200, dec_header, 32, 1);
         // es doesn't contain es key sources on 1.0.0
         if (memcmp(pkg1_id->id, "2016", 4) && *(u32*)(dec_header + 0x210) == 0x33 && dec_header[0x205] == 0) {
-            // es (offset 0x210 is lower half of titleid, 0x205 == 0 means it's program nca, not meta)
-            switch (pkg1_id->kb) {
-            case KB_FIRMWARE_VERSION_100_200:
-                start_offset = 0x557b;
-                break;
-            case KB_FIRMWARE_VERSION_300:
-            case KB_FIRMWARE_VERSION_301:
-                start_offset = 0x552d;
-                break;
-            case KB_FIRMWARE_VERSION_400:
-                start_offset = 0x5382;
-                break;
-            case KB_FIRMWARE_VERSION_500:
-                start_offset = 0x5a63;
-                break;
-            case KB_FIRMWARE_VERSION_600:
-            case KB_FIRMWARE_VERSION_620:
-                start_offset = 0x5674;
-                break;
-            case KB_FIRMWARE_VERSION_700:
-            case KB_FIRMWARE_VERSION_810:
-                start_offset = 0x5563;
-                break;
-            case KB_FIRMWARE_VERSION_900:
-                start_offset = 0x6495;
-                break;
-            }
-            hash_order[2] = 2;
-            if (pkg1_id->kb < KB_FIRMWARE_VERSION_500) {
-                hash_order[0] = 0;
-                hash_order[1] = 1;
-            } else {
+            u8 hash_order[3] = {0, 1, 2};
+            if (pkg1_id->kb >= KB_FIRMWARE_VERSION_500) {
                 hash_order[0] = 1;
                 hash_order[1] = 0;
             }
             hash_index = 0;
             // decrypt only what is needed to locate needed keys
-            temp_file = (u8*)_nca_process(5, 4, &fp, start_offset, 0xc0, key_area_key);
+            temp_file = (u8*)_nca_process(5, 4, &fp, pkg1_id->key_info.es_offset, 0xc0, key_area_key);
             for (u32 i = 0; i <= 0xb0; ) {
                 se_calc_sha256(temp_hash, temp_file + i, 0x10);
                 if (!memcmp(temp_hash, es_hashes_sha256[hash_order[hash_index]], 0x10)) {
@@ -692,36 +608,7 @@ pkg2_done:
             temp_file = NULL;
             titles_found++;
         } else if (*(u32*)(dec_header + 0x210) == 0x24 && dec_header[0x205] == 0) {
-            // ssl
-            switch (pkg1_id->kb) {
-            case KB_FIRMWARE_VERSION_100_200:
-                start_offset = 0x3d41a;
-                break;
-            case KB_FIRMWARE_VERSION_300:
-            case KB_FIRMWARE_VERSION_301:
-                start_offset = 0x3cb81;
-                break;
-            case KB_FIRMWARE_VERSION_400:
-                start_offset = 0x3711c;
-                break;
-            case KB_FIRMWARE_VERSION_500:
-                start_offset = 0x37901;
-                break;
-            case KB_FIRMWARE_VERSION_600:
-            case KB_FIRMWARE_VERSION_620:
-                start_offset = 0x1d5be;
-                break;
-            case KB_FIRMWARE_VERSION_700:
-            case KB_FIRMWARE_VERSION_810:
-                start_offset = 0x1d437;
-                break;
-            case KB_FIRMWARE_VERSION_900:
-                start_offset = 0x1d807;
-                break;
-            }
-            if (!memcmp(pkg1_id->id, "2016", 4))
-                start_offset = 0x449dc;
-            temp_file = (u8*)_nca_process(5, 4, &fp, start_offset, 0x70, key_area_key);
+            temp_file = (u8*)_nca_process(5, 4, &fp, pkg1_id->key_info.ssl_offset, 0x70, key_area_key);
             for (u32 i = 0; i <= 0x60; i++) {
                 se_calc_sha256(temp_hash, temp_file + i, 0x10);
                 if (!memcmp(temp_hash, ssl_hashes_sha256[1], 0x10)) {
@@ -766,7 +653,14 @@ pkg2_done:
         TPRINTFARGS("%kSSL keys...     ", colors[(color_idx++) % 6]);
     }
 
-    if (f_open(&fp, "sd:/Nintendo/Contents/private", FA_READ | FA_OPEN_EXISTING)) {
+    char private_path[200] = "sd:/";
+    if (emu_cfg.nintendo_path && (emu_cfg.enabled || !h_cfg.emummc_force_disable)) {
+        strcat(private_path, emu_cfg.nintendo_path);
+    } else {
+        strcat(private_path, "Nintendo");
+    }
+    strcat(private_path, "/Contents/private");
+    if (f_open(&fp, private_path, FA_READ | FA_OPEN_EXISTING)) {
         EPRINTF("Unable to open SD seed vector. Skipping.");
         goto get_titlekeys;
     }
@@ -778,6 +672,7 @@ pkg2_done:
     }
     f_close(&fp);
 
+    // this file is so small that parsing the savedata properly would take longer
     if (f_open(&fp, "emmc:/save/8000000000000043", FA_READ | FA_OPEN_EXISTING)) {
         EPRINTF("Unable to open ns_appman save.\nSkipping SD seed.");
         goto get_titlekeys;
@@ -800,13 +695,9 @@ get_titlekeys:
     if (!_key_exists(eticket_rsa_kek))
         goto dismount;
 
-    if (!minerva_cfg) {
-        gfx_printf("%k Minerva not found!\n This may take up to a minute...\n", colors[(color_idx++) % 6]);
-        gfx_printf(" For better performance, download Hekate\n and put bootloader/sys/libsys_minerva.bso\n on SD.\n");
-    }
-    gfx_printf("%kTitlekeys...     ", colors[color_idx % 6]);
+    gfx_printf("%kTitlekeys...     ", colors[(color_idx++) % 6]);
     u32 save_x = gfx_con.x, save_y = gfx_con.y;
-    gfx_printf("\n");
+    gfx_printf("\n%kCommon...       ", colors[color_idx % 6]);
 
     u8 null_hash[0x20] = {
         0xE3, 0xB0, 0xC4, 0x42, 0x98, 0xFC, 0x1C, 0x14, 0x9A, 0xFB, 0xF4, 0xC8, 0x99, 0x6F, 0xB9, 0x24,
@@ -815,7 +706,7 @@ get_titlekeys:
     se_aes_key_set(8, bis_key[0] + 0x00, 0x10);
     se_aes_key_set(9, bis_key[0] + 0x10, 0x10);
 
-    u32 buf_size = 0x80000;
+    u32 buf_size = 0x4000;
     u8 *buffer = (u8 *)malloc(buf_size);
 
     u8 keypair[0x230] = {0};
@@ -853,63 +744,83 @@ get_titlekeys:
 
     se_rsa_key_set(0, N, 0x100, D, 0x100);
 
-    if (f_stat("emmc:/save/80000000000000E1", &fno)) {
-        EPRINTF("Unable to stat ES save 1. Skipping.");
-        free(buffer);
-        goto dismount;
-    }
-    u64 total_size = fno.fsize;
-    if (f_stat("emmc:/save/80000000000000E2", &fno)) {
-        EPRINTF("Unable to stat ES save 2. Skipping.");
-        free(buffer);
-        goto dismount;
-    }
-    total_size += fno.fsize;
-    u32 br;
+    u32 br = buf_size;
+    u32 file_tkey_count = 0;
     u64 total_br = 0;
-    rights_ids = (u8 *)malloc(0x400000);
-    titlekeys = (u8 *)malloc(0x400000);
+    rights_ids = (u8 *)malloc(0x40000);
+    titlekeys = (u8 *)malloc(0x40000);
+    save_ctx = calloc(1, sizeof(save_ctx_t));
     u8 M[0x100];
     if (f_open(&fp, "emmc:/save/80000000000000E1", FA_READ | FA_OPEN_EXISTING)) {
         EPRINTF("Unable to open ES save 1. Skipping.");
         free(buffer);
         goto dismount;
     }
-    f_lseek(&fp, 0x8000);
+
     u32 pct = 0, last_pct = 0;
     tui_pbar(save_x, save_y, pct, COLOR_GREEN, 0xFF155500);
 
-    while (!f_read(&fp, buffer, buf_size, &br)) {
+    save_ctx->file = &fp;
+    save_ctx->tool_ctx.action = 0;
+    memcpy(save_ctx->save_mac_key, save_mac_key, 0x10);
+    save_process(save_ctx);
+
+    char ticket_bin_path[SAVE_FS_LIST_MAX_NAME_LENGTH] = "/ticket.bin";
+    char ticket_list_bin_path[SAVE_FS_LIST_MAX_NAME_LENGTH] = "/ticket_list.bin";
+    allocation_table_storage_ctx_t fat_storage;
+    save_fs_list_entry_t entry = {0, "", {0}, 0};
+    if (!save_hierarchical_file_table_get_file_entry_by_path(&save_ctx->save_filesystem_core.file_table, ticket_list_bin_path, &entry)) {
+        EPRINTF("Unable to locate ticket_list.bin in e1.");
+        goto dismount;
+    }
+    save_open_fat_storage(&save_ctx->save_filesystem_core, &fat_storage, entry.value.save_file_info.start_block);
+    while (br == buf_size && total_br < entry.value.save_file_info.length) {
+        br = save_allocation_table_storage_read(&fat_storage, buffer, total_br, buf_size);
+        if (buffer[0] == 0) break;
         total_br += br;
-        for (u32 i = 0; i < br; i += 0x4000) {
-            pct = (u32)((total_br + i) * 100 / total_size);
+        minerva_periodic_training();
+        for (u32 j = 0; j < buf_size; j += 0x20) {
+            if (buffer[j] == 0xff && buffer[j+1] == 0xff && buffer[j+2] == 0xff && buffer[j+3] == 0xff) break;
+            file_tkey_count++;
+        }
+    }
+    if (!save_hierarchical_file_table_get_file_entry_by_path(&save_ctx->save_filesystem_core.file_table, ticket_bin_path, &entry)) {
+        EPRINTF("Unable to locate ticket.bin in e1.");
+        goto dismount;
+    }
+    save_open_fat_storage(&save_ctx->save_filesystem_core, &fat_storage, entry.value.save_file_info.start_block);
+    total_br = 0;
+    while (br == buf_size && total_br < entry.value.save_file_info.length) {
+        br = save_allocation_table_storage_read(&fat_storage, buffer, total_br, buf_size);
+        if (buffer[0] == 0) break;
+        total_br += br;
+        for (u32 j = 0; j < buf_size; j += 0x400) {
+            pct = _titlekey_count * 100 / file_tkey_count;
             if (pct > last_pct && pct <= 100) {
                 last_pct = pct;
                 tui_pbar(save_x, save_y, pct, COLOR_GREEN, 0xFF155500);
             }
-            for (u32 j = i; j < i + 0x4000; j += 0x400) {
-                minerva_periodic_training();
-                if (buffer[j] == 4 && buffer[j+1] == 0 && buffer[j+2] == 1 && buffer[j+3] == 0) {
-                    u32 k = 0;
-                    bool titlekey_found = false;
-                    for (; k < _titlekey_count; k++) {
-                        if (!memcmp(rights_ids + 0x10 * k, buffer + j + 0x2a0, 0x10)) {
-                            titlekey_found = true;
-                            break;
-                        }
-                    }
-                    if (titlekey_found)
-                        continue;
-                    memcpy(rights_ids + 0x10 * _titlekey_count, buffer + j + 0x2a0, 0x10);
-                    memcpy(titlekeys + 0x10 * _titlekey_count, buffer + j + 0x180, 0x10);
-                    _titlekey_count++;
-                } else {
-                    break;
-                }
+            minerva_periodic_training();
+            if (buffer[j] == 4 && buffer[j+1] == 0 && buffer[j+2] == 1 && buffer[j+3] == 0) {
+                memcpy(rights_ids + 0x10 * _titlekey_count, buffer + j + 0x2a0, 0x10);
+                memcpy(titlekeys + 0x10 * _titlekey_count, buffer + j + 0x180, 0x10);
+                _titlekey_count++;
+            } else {
+                break;
             }
         }
-        if (br < buf_size) break;
     }
+    tui_pbar(save_x, save_y, 100, COLOR_GREEN, 0xFF155500);
+    f_close(&fp);
+    save_free_contexts(save_ctx);
+    memset(save_ctx, 0, sizeof(save_ctx_t));
+    memset(&fat_storage, 0, sizeof(allocation_table_storage_ctx_t));
+
+    gfx_con_setpos(0, save_y);
+    TPRINTFARGS("\n%kCommon...       ", colors[(color_idx++) % 6]);
+    save_x = gfx_con.x + 16 * 17;
+    save_y = gfx_con.y;
+    gfx_printf("\n%kPersonalized... ", colors[color_idx % 6]);
 
     u32 common_titlekey_count = _titlekey_count;
     if (f_open(&fp, "emmc:/save/80000000000000E2", FA_READ | FA_OPEN_EXISTING)) {
@@ -917,62 +828,94 @@ get_titlekeys:
         free(buffer);
         goto dismount;
     }
-    f_lseek(&fp, 0x8000);
-    while (!f_read(&fp, buffer, buf_size, &br)) {
+
+    save_ctx->file = &fp;
+    save_ctx->tool_ctx.action = 0;
+    memcpy(save_ctx->save_mac_key, save_mac_key, 0x10);
+    save_process(save_ctx);
+
+    if (!save_hierarchical_file_table_get_file_entry_by_path(&save_ctx->save_filesystem_core.file_table, ticket_list_bin_path, &entry)) {
+        EPRINTF("Unable to locate ticket_list.bin in e2.");
+        goto dismount;
+    }
+    save_open_fat_storage(&save_ctx->save_filesystem_core, &fat_storage, entry.value.save_file_info.start_block);
+
+    total_br = 0;
+    file_tkey_count = 0;
+    while (br == buf_size && total_br < entry.value.save_file_info.length) {
+        br = save_allocation_table_storage_read(&fat_storage, buffer, total_br, buf_size);
+        if (buffer[0] == 0) break;
         total_br += br;
-        for (u32 i = 0; i < br; i += 0x4000) {
-            pct = (u32)((total_br + i) * 100 / total_size);
+        minerva_periodic_training();
+        for (u32 j = 0; j < buf_size; j += 0x20) {
+            if (buffer[j] == 0xff && buffer[j+1] == 0xff && buffer[j+2] == 0xff && buffer[j+3] == 0xff) break;
+            file_tkey_count++;
+        }
+    }
+    if (!save_hierarchical_file_table_get_file_entry_by_path(&save_ctx->save_filesystem_core.file_table, ticket_bin_path, &entry)) {
+        EPRINTF("Unable to locate ticket.bin in e2.");
+        goto dismount;
+    }
+
+    save_open_fat_storage(&save_ctx->save_filesystem_core, &fat_storage, entry.value.save_file_info.start_block);
+
+    total_br = 0;
+    pct = 0;
+    last_pct = 0;
+    while (br == buf_size && total_br < entry.value.save_file_info.length) {
+        br = save_allocation_table_storage_read(&fat_storage, buffer, total_br, buf_size);
+        if (buffer[0] == 0) break;
+        total_br += br;
+        for (u32 j = 0; j < buf_size; j += 0x400) {
+            pct = (_titlekey_count - common_titlekey_count) * 100 / file_tkey_count;
             if (pct > last_pct && pct <= 100) {
                 last_pct = pct;
                 tui_pbar(save_x, save_y, pct, COLOR_GREEN, 0xFF155500);
             }
-            for (u32 j = i; j < i + 0x4000; j += 0x400) {
-                minerva_periodic_training();
-                if (buffer[j] == 4 && buffer[j+1] == 0 && buffer[j+2] == 1 && buffer[j+3] == 0) {
-                    u32 k = common_titlekey_count;
-                    bool titlekey_found = false;
-                    for (; k < _titlekey_count; k++) {
-                        if (!memcmp(rights_ids + 0x10 * k, buffer + j + 0x2a0, 0x10)) {
-                            titlekey_found = true;
-                            break;
-                        }
-                    }
-                    if (titlekey_found)
-                        continue;
-                    memcpy(rights_ids + 0x10 * _titlekey_count, buffer + j + 0x2a0, 0x10);
+            minerva_periodic_training();
+            if (buffer[j] == 4 && buffer[j+1] == 0 && buffer[j+2] == 1 && buffer[j+3] == 0) {
+                memcpy(rights_ids + 0x10 * _titlekey_count, buffer + j + 0x2a0, 0x10);
 
-                    u8 *titlekey_block = buffer + j + 0x180;
-                    se_rsa_exp_mod(0, M, 0x100, titlekey_block, 0x100);
-                    u8 *salt = M + 1;
-                    u8 *db = M + 0x21;
-                    _mgf1_xor(salt, 0x20, db, 0xdf);
-                    _mgf1_xor(db, 0xdf, salt, 0x20);
-                    if (memcmp(db, null_hash, 0x20))
-                        continue;
-                    memcpy(titlekeys + 0x10 * _titlekey_count, db + 0xcf, 0x10);
-                    _titlekey_count++;
-                } else {
-                    break;
-                }
+                u8 *titlekey_block = buffer + j + 0x180;
+                se_rsa_exp_mod(0, M, 0x100, titlekey_block, 0x100);
+                u8 *salt = M + 1;
+                u8 *db = M + 0x21;
+                _mgf1_xor(salt, 0x20, db, 0xdf);
+                _mgf1_xor(db, 0xdf, salt, 0x20);
+                if (memcmp(db, null_hash, 0x20))
+                    continue;
+                memcpy(titlekeys + 0x10 * _titlekey_count, db + 0xcf, 0x10);
+                _titlekey_count++;
+            } else {
+                break;
             }
         }
-        if (br < buf_size) break;
     }
+    tui_pbar(save_x, save_y, 100, COLOR_GREEN, 0xFF155500);
     free(buffer);
     f_close(&fp);
 
     gfx_con_setpos(0, save_y);
-    TPRINTFARGS("\n%k                ", colors[(color_idx++) % 6]);
+    TPRINTFARGS("\n%kPersonalized... ", colors[(color_idx++) % 6]);
     gfx_printf("\n%k  Found %d titlekeys.\n", colors[(color_idx++) % 6], _titlekey_count);
 
-dismount:
+dismount:;
+    if (save_ctx) {
+        save_free_contexts(save_ctx);
+        free(save_ctx);
+    }
     f_mount(NULL, "emmc:", 1);
     clear_sector_cache = true;
     nx_emmc_gpt_free(&gpt);
 
 key_output: ;
+    char *text_buffer = NULL;
+    if (!sd_mount()) {
+        EPRINTF("Unable to mount SD.");
+        goto free_buffers;
+    }
     u32 text_buffer_size = _titlekey_count * 68 < 0x3000 ? 0x3000 : _titlekey_count * 68 + 1;
-    char *text_buffer = (char *)calloc(1, text_buffer_size);
+    text_buffer = (char *)calloc(1, text_buffer_size);
 
     SAVE_KEY("aes_kek_generation_source", aes_kek_generation_source, 0x10);
     SAVE_KEY("aes_key_generation_source", aes_key_generation_source, 0x10);
@@ -1039,16 +982,13 @@ key_output: ;
     gfx_printf("%kLockpick totally done in %d us\n\n", colors[(color_idx++) % 6], end_time - begin_time);
     gfx_printf("%kFound through master_key_%02x.\n\n", colors[(color_idx++) % 6], MAX_KEY - 1);
 
-    if (f_mkdir("sd:/switch")) {
-        EPRINTF("Unable to create /switch folder on SD.\nNo keyfiles written.");
-        goto free_buffers;
-    }
+    f_mkdir("sd:/switch");
     char keyfile_path[30] = "sd:/switch/";
     if (!(fuse_read_odm(4) & 3))
         sprintf(&keyfile_path[11], "prod.keys");
     else
         sprintf(&keyfile_path[11], "dev.keys");
-    if (sd_mount() && !sd_save_to_file(text_buffer, strlen(text_buffer), keyfile_path) && !f_stat(keyfile_path, &fno)) {
+    if (!sd_save_to_file(text_buffer, strlen(text_buffer), keyfile_path) && !f_stat(keyfile_path, &fno)) {
         gfx_printf("%kWrote %d bytes to %s\n", colors[(color_idx++) % 6], (u32)fno.fsize, keyfile_path);
     } else
         EPRINTF("Unable to save keys to SD.");
@@ -1065,7 +1005,7 @@ key_output: ;
         sprintf(&text_buffer[i * 68 + 0x43], "\n");
     }
     sprintf(&keyfile_path[11], "title.keys");
-    if (sd_mount() && !sd_save_to_file(text_buffer, strlen(text_buffer), keyfile_path) && !f_stat(keyfile_path, &fno)) {
+    if (!sd_save_to_file(text_buffer, strlen(text_buffer), keyfile_path) && !f_stat(keyfile_path, &fno)) {
         gfx_printf("%kWrote %d bytes to %s\n", colors[(color_idx++) % 6], (u32)fno.fsize, keyfile_path);
     } else
         EPRINTF("Unable to save titlekeys to SD.");
@@ -1095,8 +1035,8 @@ static void _save_key(const char *name, const void *data, u32 len, char *outbuf)
 
 static void _save_key_family(const char *name, const void *data, u32 start_key, u32 num_keys, u32 len, char *outbuf) {
     char temp_name[0x40] = {0};
-    for (u32 i = start_key; i < num_keys + start_key; i++) {
-        sprintf(temp_name, "%s_%02x", name, i);
+    for (u32 i = 0; i < num_keys; i++) {
+        sprintf(temp_name, "%s_%02x", name, i + start_key);
         _save_key(temp_name, data + i * len, len, outbuf);
     }
 }
@@ -1124,8 +1064,10 @@ static void *_nca_process(u32 hk_ks1, u32 hk_ks2, FIL *fp, u32 key_offset, u32 l
 
     u8 *temp_file = (u8*)malloc(0x400),
         ctr[0x10] = {0};
-    if (f_lseek(fp, 0x200) || f_read(fp, temp_file, 0x400, &read_bytes) || read_bytes != 0x400)
+    if (f_lseek(fp, 0x200) || f_read(fp, temp_file, 0x400, &read_bytes) || read_bytes != 0x400) {
+        free(temp_file);
         return NULL;
+    }
     se_aes_xts_crypt(hk_ks1, hk_ks2, 0, 1, temp_file, temp_file, 0x200, 2);
     // both 1.x and 2.x use master_key_00
     temp_file[0x20] -= temp_file[0x20] ? 1 : 0;

source/keys/save.c

@@ -0,0 +1,821 @@
+#include <string.h>
+#include "save.h"
+
+#include "../gfx/gfx.h"
+#include "../mem/heap.h"
+#include "../sec/se.h"
+#include "../utils/types.h"
+#include "../utils/util.h"
+
+#define REMAP_ENTRY_LENGTH 0x20
+
+static inline void save_bitmap_set_bit(void *buffer, size_t bit_offset) {
+    *((uint8_t *)buffer + (bit_offset >> 3)) |= 1 << (bit_offset & 7);
+}
+
+static inline void save_bitmap_clear_bit(void *buffer, size_t bit_offset) {
+    *((uint8_t *)buffer + (bit_offset >> 3)) &= ~(uint8_t)(1 << (bit_offset & 7));
+}
+
+static inline uint8_t save_bitmap_check_bit(const void *buffer, size_t bit_offset) {
+    return *((uint8_t *)buffer + (bit_offset >> 3)) & (1 << (bit_offset & 7));
+}
+
+void save_duplex_storage_init(duplex_storage_ctx_t *ctx, duplex_fs_layer_info_t *layer, void *bitmap, uint64_t bitmap_size) {
+    ctx->data_a = layer->data_a;
+    ctx->data_b = layer->data_b;
+    ctx->bitmap_storage = (uint8_t *)bitmap;
+    ctx->block_size = 1 << layer->info.block_size_power;
+
+    ctx->bitmap.data = ctx->bitmap_storage;
+    ctx->bitmap.bitmap = malloc(bitmap_size >> 3);
+
+    uint32_t bits_remaining = bitmap_size;
+    uint32_t bitmap_pos = 0;
+    uint32_t *buffer_pos = (uint32_t *)bitmap;
+    while (bits_remaining) {
+        uint32_t bits_to_read = bits_remaining < 32 ? bits_remaining : 32;
+        uint32_t val = *buffer_pos;
+        for (uint32_t i = 0; i < bits_to_read; i++) {
+            if (val & 0x80000000)
+                save_bitmap_set_bit(ctx->bitmap.bitmap, bitmap_pos);
+            else
+                save_bitmap_clear_bit(ctx->bitmap.bitmap, bitmap_pos);
+            bitmap_pos++;
+            bits_remaining--;
+            val <<= 1;
+        }
+        buffer_pos++;
+    }
+}
+
+uint32_t save_duplex_storage_read(duplex_storage_ctx_t *ctx, void *buffer, uint64_t offset, size_t count) {
+    uint64_t in_pos = offset;
+    uint32_t out_pos = 0;
+    uint32_t remaining = count;
+
+    while (remaining) {
+        uint32_t block_num = (uint32_t)(in_pos / ctx->block_size);
+        uint32_t block_pos = (uint32_t)(in_pos % ctx->block_size);
+        uint32_t bytes_to_read = ctx->block_size - block_pos < remaining ? ctx->block_size - block_pos : remaining;
+
+        uint8_t *data = save_bitmap_check_bit(ctx->bitmap.bitmap, block_num) ? ctx->data_b : ctx->data_a;
+        memcpy((uint8_t *)buffer + out_pos, data + in_pos, bytes_to_read);
+
+        out_pos += bytes_to_read;
+        in_pos += bytes_to_read;
+        remaining -= bytes_to_read;
+    }
+    return out_pos;
+}
+
+remap_segment_ctx_t *save_remap_init_segments(remap_header_t *header, remap_entry_ctx_t *map_entries, uint32_t num_map_entries) {
+    remap_segment_ctx_t *segments =  malloc(sizeof(remap_segment_ctx_t) * header->map_segment_count);
+    unsigned int entry_idx = 0;
+
+    for (unsigned int i = 0; i < header->map_segment_count; i++) {
+        remap_segment_ctx_t *seg = &segments[i];
+        seg->entries = malloc(sizeof(remap_entry_ctx_t));
+        memcpy(seg->entries, &map_entries[entry_idx], sizeof(remap_entry_ctx_t));
+        seg->offset = map_entries[entry_idx].virtual_offset;
+        map_entries[entry_idx].segment = seg;
+        seg->entry_count = 1;
+        entry_idx++;
+
+        while (entry_idx < num_map_entries && map_entries[entry_idx - 1].virtual_offset_end == map_entries[entry_idx].virtual_offset) {
+            map_entries[entry_idx].segment = seg;
+            map_entries[entry_idx - 1].next = &map_entries[entry_idx];
+            seg->entries = malloc(sizeof(remap_entry_ctx_t));
+            memcpy(seg->entries, &map_entries[entry_idx], sizeof(remap_entry_ctx_t));
+            seg->entry_count++;
+            entry_idx++;
+        }
+        seg->length = seg->entries[seg->entry_count - 1].virtual_offset_end - seg->entries[0].virtual_offset;
+    }
+    return segments;
+}
+
+remap_entry_ctx_t *save_remap_get_map_entry(remap_storage_ctx_t *ctx, uint64_t offset) {
+    uint32_t segment_idx = (uint32_t)(offset >> (64 - ctx->header->segment_bits));
+    if (segment_idx < ctx->header->map_segment_count) {
+        for (unsigned int i = 0; i < ctx->segments[segment_idx].entry_count; i++)
+            if (ctx->segments[segment_idx].entries[i].virtual_offset_end > offset)
+                return &ctx->segments[segment_idx].entries[i];
+    }
+    return NULL;
+}
+
+uint32_t save_remap_read(remap_storage_ctx_t *ctx, void *buffer, uint64_t offset, size_t count) {
+    remap_entry_ctx_t *entry = save_remap_get_map_entry(ctx, offset);
+    uint64_t in_pos = offset;
+    uint32_t out_pos = 0;
+    uint32_t remaining = count;
+
+    while (remaining) {
+        uint64_t entry_pos = in_pos - entry->virtual_offset;
+        uint32_t bytes_to_read = entry->virtual_offset_end - in_pos < remaining ? (uint32_t)(entry->virtual_offset_end - in_pos) : remaining;
+
+        switch (ctx->type) {
+            case STORAGE_BYTES:
+                f_lseek(ctx->file, ctx->base_storage_offset + entry->physical_offset + entry_pos);
+                f_read(ctx->file, (uint8_t *)buffer + out_pos, bytes_to_read, NULL);
+                break;
+            case STORAGE_DUPLEX:
+                save_duplex_storage_read(ctx->duplex, (uint8_t *)buffer + out_pos, ctx->base_storage_offset + entry->physical_offset + entry_pos, bytes_to_read);
+                break;
+            default:
+                break;
+        }
+
+        out_pos += bytes_to_read;
+        in_pos += bytes_to_read;
+        remaining -= bytes_to_read;
+
+        if (in_pos >= entry->virtual_offset_end)
+            entry = entry->next;
+    }
+    return out_pos;
+}
+
+uint32_t save_journal_storage_read(journal_storage_ctx_t *ctx, remap_storage_ctx_t *remap, void *buffer, uint64_t offset, size_t count) {
+    uint64_t in_pos = offset;
+    uint32_t out_pos = 0;
+    uint32_t remaining = count;
+
+    while (remaining) {
+        uint32_t block_num = (uint32_t)(in_pos / ctx->block_size);
+        uint32_t block_pos = (uint32_t)(in_pos % ctx->block_size);
+        uint64_t physical_offset = ctx->map.entries[block_num].physical_index * ctx->block_size + block_pos;
+        uint32_t bytes_to_read = ctx->block_size - block_pos < remaining ? ctx->block_size - block_pos : remaining;
+
+        save_remap_read(remap, (uint8_t *)buffer + out_pos, ctx->journal_data_offset + physical_offset, bytes_to_read);
+
+        out_pos += bytes_to_read;
+        in_pos += bytes_to_read;
+        remaining -= bytes_to_read;
+    }
+    return out_pos;
+}
+
+void save_ivfc_storage_init(hierarchical_integrity_verification_storage_ctx_t *ctx, uint64_t master_hash_offset, ivfc_save_hdr_t *ivfc) {
+    ivfc_level_save_ctx_t *levels = ctx->levels;
+    levels[0].type = STORAGE_BYTES;
+    levels[0].hash_offset = master_hash_offset;
+    for (unsigned int i = 1; i < 4; i++) {
+        ivfc_level_hdr_t *level = &ivfc->level_headers[i - 1];
+        levels[i].type = STORAGE_REMAP;
+        levels[i].data_offset = level->logical_offset;
+        levels[i].data_size = level->hash_data_size;
+    }
+    if (ivfc->num_levels == 5) {
+        ivfc_level_hdr_t *data_level = &ivfc->level_headers[ivfc->num_levels - 2];
+        levels[ivfc->num_levels - 1].type = STORAGE_JOURNAL;
+        levels[ivfc->num_levels - 1].data_offset = data_level->logical_offset;
+        levels[ivfc->num_levels - 1].data_size = data_level->hash_data_size;
+    }
+
+    struct salt_source_t {
+        char string[50];
+        uint32_t length;
+    };
+
+    static struct salt_source_t salt_sources[6] = {
+        {"HierarchicalIntegrityVerificationStorage::Master", 48},
+        {"HierarchicalIntegrityVerificationStorage::L1", 44},
+        {"HierarchicalIntegrityVerificationStorage::L2", 44},
+        {"HierarchicalIntegrityVerificationStorage::L3", 44},
+        {"HierarchicalIntegrityVerificationStorage::L4", 44},
+        {"HierarchicalIntegrityVerificationStorage::L5", 44}
+    };
+    integrity_verification_info_ctx_t init_info[ivfc->num_levels];
+
+    init_info[0].data = &levels[0];
+    init_info[0].block_size = 0;
+    for (unsigned int i = 1; i < ivfc->num_levels; i++) {
+        init_info[i].data = &levels[i];
+        init_info[i].block_size = 1 << ivfc->level_headers[i - 1].block_size;
+        se_calc_hmac_sha256(init_info[i].salt, ivfc->salt_source, 0x20, salt_sources[i - 1].string, salt_sources[i - 1].length);
+    }
+
+    ctx->integrity_storages[0].next_level = NULL;
+    ctx->level_validities = malloc(sizeof(validity_t *) * (ivfc->num_levels - 1));
+    for (unsigned int i = 1; i < ivfc->num_levels; i++) {
+        integrity_verification_storage_ctx_t *level_data = &ctx->integrity_storages[i - 1];
+        level_data->hash_storage = &levels[i - 1];
+        level_data->base_storage = &levels[i];
+        level_data->sector_size = init_info[i].block_size;
+        level_data->_length = init_info[i].data->data_size;
+        level_data->sector_count = (level_data->_length + level_data->sector_size - 1) / level_data->sector_size;
+        memcpy(level_data->salt, init_info[i].salt, 0x20);
+        level_data->block_validities = calloc(1, sizeof(validity_t) * level_data->sector_count);
+        ctx->level_validities[i - 1] = level_data->block_validities;
+        if (i > 1) {
+            level_data->next_level = &ctx->integrity_storages[i - 2];
+        }
+    }
+    ctx->data_level = &levels[ivfc->num_levels - 1];
+    ctx->_length = ctx->integrity_storages[ivfc->num_levels - 2]._length;
+}
+
+size_t save_ivfc_level_fread(ivfc_level_save_ctx_t *ctx, void *buffer, uint64_t offset, size_t count) {
+    switch (ctx->type) {
+        case STORAGE_BYTES:
+            f_lseek(ctx->save_ctx->file, ctx->hash_offset + offset);
+            UINT br = 0;
+            f_read(ctx->save_ctx->file, buffer, count, &br);
+            return br;
+        case STORAGE_REMAP:
+            save_remap_read(&ctx->save_ctx->meta_remap_storage, buffer, ctx->data_offset + offset, count);
+            return count;
+        case STORAGE_JOURNAL:
+            save_journal_storage_read(&ctx->save_ctx->journal_storage, &ctx->save_ctx->data_remap_storage, buffer, ctx->data_offset + offset, count);
+            return count;
+        default:
+            return 0;
+    }
+}
+
+void save_ivfc_storage_read(integrity_verification_storage_ctx_t *ctx, void *buffer, uint64_t offset, size_t count, uint32_t verify) {
+    if (count > ctx->sector_size) {
+        EPRINTF("IVFC read exceeds sector size!\n");
+    }
+
+    uint64_t block_index = offset / ctx->sector_size;
+
+    if (ctx->block_validities[block_index] == VALIDITY_INVALID && verify) {
+        EPRINTFARGS("Hash error from previous check\n found at offset %x count %x!\n", (u32)offset, count);
+    }
+
+    uint8_t hash_buffer[0x20] = {0};
+    uint8_t zeroes[0x20] = {0};
+    uint64_t hash_pos = block_index * 0x20;
+    if (ctx->next_level) {
+        save_ivfc_storage_read(ctx->next_level, hash_buffer, hash_pos, 0x20, verify);
+    } else {
+        save_ivfc_level_fread(ctx->hash_storage, hash_buffer, hash_pos, 0x20);
+    }
+
+    if (!memcmp(hash_buffer, zeroes, 0x20)) {
+        memset(buffer, 0, count);
+        ctx->block_validities[block_index] = VALIDITY_VALID;
+        return;
+    }
+
+    save_ivfc_level_fread(ctx->base_storage, buffer, offset, count);
+
+    if (!(verify && ctx->block_validities[block_index] == VALIDITY_UNCHECKED)) {
+        return;
+    }
+
+    uint8_t hash[0x20] = {0};
+    uint8_t *data_buffer = calloc(1, ctx->sector_size + 0x20);
+    memcpy(data_buffer, ctx->salt, 0x20);
+    memcpy(data_buffer + 0x20, buffer, count);
+
+    se_calc_sha256(hash, data_buffer, ctx->sector_size + 0x20);
+    hash[0x1F] |= 0x80;
+
+    free(data_buffer);
+    if (memcmp(hash_buffer, hash, 0x20)) {
+        ctx->block_validities[block_index] = VALIDITY_INVALID;
+    } else {
+        ctx->block_validities[block_index] = VALIDITY_VALID;
+    }
+
+    if (ctx->block_validities[block_index] == VALIDITY_INVALID && verify) {
+        EPRINTFARGS("Hash error from current check\n found at offset %x count %x!\n", (u32)offset, count);
+    }
+}
+
+uint32_t save_allocation_table_read_entry_with_length(allocation_table_ctx_t *ctx, allocation_table_entry_t *entry) {
+    uint32_t length = 1;
+    uint32_t entry_index = allocation_table_block_to_entry_index(entry->next);
+
+    allocation_table_entry_t *entries = (allocation_table_entry_t *)((uint8_t *)(ctx->base_storage) + entry_index * SAVE_FAT_ENTRY_SIZE);
+    if ((entries[0].next & 0x80000000) == 0) {
+        if (entries[0].prev & 0x80000000 && entries[0].prev != 0x80000000) {
+            EPRINTF("Invalid range entry in allocation table!\n");
+        }
+    } else {
+        length = entries[1].next - entry_index + 1;
+    }
+
+    if (allocation_table_is_list_end(&entries[0])) {
+        entry->next = 0xFFFFFFFF;
+    } else {
+        entry->next = allocation_table_entry_index_to_block(allocation_table_get_next(&entries[0]));
+    }
+
+    if (allocation_table_is_list_start(&entries[0])) {
+        entry->prev = 0xFFFFFFFF;
+    } else {
+        entry->prev = allocation_table_entry_index_to_block(allocation_table_get_prev(&entries[0]));
+    }
+
+    return length;
+}
+
+uint32_t save_allocation_table_get_list_length(allocation_table_ctx_t *ctx, uint32_t block_index) {
+    allocation_table_entry_t entry;
+    entry.next = block_index;
+    uint32_t total_length = 0;
+    uint32_t table_size = ctx->header->allocation_table_block_count;
+    uint32_t nodes_iterated = 0;
+
+    while (entry.next != 0xFFFFFFFF) {
+        total_length += save_allocation_table_read_entry_with_length(ctx, &entry);
+        nodes_iterated++;
+        if (nodes_iterated > table_size) {
+            EPRINTF("Cycle detected in allocation table!\n");
+            return 0;
+        }
+    }
+    return total_length;
+}
+
+uint64_t save_allocation_table_get_free_space_size(save_filesystem_ctx_t *ctx) {
+    uint32_t free_list_start = save_allocation_table_get_free_list_block_index(&ctx->allocation_table);
+
+    if (free_list_start == 0xFFFFFFFF) return 0;
+
+    return ctx->header->block_size * save_allocation_table_get_list_length(&ctx->allocation_table, free_list_start);
+}
+
+void save_allocation_table_iterator_begin(allocation_table_iterator_ctx_t *ctx, allocation_table_ctx_t *table, uint32_t initial_block) {
+    ctx->fat = table;
+    ctx->physical_block = initial_block;
+    ctx->virtual_block = 0;
+
+    allocation_table_entry_t entry;
+    entry.next = initial_block;
+    ctx->current_segment_size = save_allocation_table_read_entry_with_length(ctx->fat, &entry);
+    ctx->next_block = entry.next;
+    ctx->prev_block = entry.prev;
+
+    if (ctx->prev_block != 0xFFFFFFFF) {
+        EPRINTFARGS("Attempted to start FAT iteration from\n invalid block %x!\n", initial_block);
+    }
+}
+
+int save_allocation_table_iterator_move_next(allocation_table_iterator_ctx_t *ctx) {
+    if (ctx->next_block == 0xFFFFFFFF) return 0;
+
+    ctx->virtual_block += ctx->current_segment_size;
+    ctx->physical_block = ctx->next_block;
+
+    allocation_table_entry_t entry;
+    entry.next = ctx->next_block;
+    ctx->current_segment_size = save_allocation_table_read_entry_with_length(ctx->fat, &entry);
+    ctx->next_block = entry.next;
+    ctx->prev_block = entry.prev;
+
+    return 1;
+}
+
+int save_allocation_table_iterator_move_prev(allocation_table_iterator_ctx_t *ctx) {
+    if (ctx->prev_block == 0xFFFFFFFF) return 0;
+
+    ctx->physical_block = ctx->prev_block;
+
+    allocation_table_entry_t entry;
+    entry.next = ctx->prev_block;
+    ctx->current_segment_size = save_allocation_table_read_entry_with_length(ctx->fat, &entry);
+    ctx->next_block = entry.next;
+    ctx->prev_block = entry.prev;
+
+    ctx->virtual_block -= ctx->current_segment_size;
+
+    return 1;
+}
+
+int save_allocation_table_iterator_seek(allocation_table_iterator_ctx_t *ctx, uint32_t block) {
+    while (1) {
+        if (block < ctx->virtual_block) {
+            if (!save_allocation_table_iterator_move_prev(ctx)) return 0;
+        } else if (block >= ctx->virtual_block + ctx->current_segment_size) {
+            if (!save_allocation_table_iterator_move_next(ctx)) return 0;
+        } else {
+            return 1;
+        }
+
+    }
+}
+
+uint32_t save_allocation_table_storage_read(allocation_table_storage_ctx_t *ctx, void *buffer, uint64_t offset, size_t count) {
+    allocation_table_iterator_ctx_t iterator;
+    save_allocation_table_iterator_begin(&iterator, ctx->fat, ctx->initial_block);
+    uint64_t in_pos = offset;
+    uint32_t out_pos = 0;
+    uint32_t remaining = count;
+
+    while (remaining) {
+        uint32_t block_num = (uint32_t)(in_pos / ctx->block_size);
+        save_allocation_table_iterator_seek(&iterator, block_num);
+
+        uint32_t segment_pos = (uint32_t)(in_pos - (uint64_t)iterator.virtual_block * ctx->block_size);
+        uint64_t physical_offset = iterator.physical_block * ctx->block_size + segment_pos;
+
+        uint32_t remaining_in_segment = iterator.current_segment_size * ctx->block_size - segment_pos;
+        uint32_t bytes_to_read = remaining < remaining_in_segment ? remaining : remaining_in_segment;
+
+        uint32_t sector_size = ctx->base_storage->integrity_storages[3].sector_size;
+        uint32_t chunk_remaining = bytes_to_read;
+        for (unsigned int i = 0; i < bytes_to_read; i += sector_size) {
+            uint32_t bytes_to_request = chunk_remaining < sector_size ? chunk_remaining : sector_size;
+            save_ivfc_storage_read(&ctx->base_storage->integrity_storages[3], (uint8_t *)buffer + out_pos + i, physical_offset + i, bytes_to_request, ctx->base_storage->data_level->save_ctx->tool_ctx.action & ACTION_VERIFY);
+            chunk_remaining -= bytes_to_request;
+        }
+
+        out_pos += bytes_to_read;
+        in_pos += bytes_to_read;
+        remaining -= bytes_to_read;
+    }
+    return out_pos;
+}
+
+uint32_t save_fs_list_get_capacity(save_filesystem_list_ctx_t *ctx) {
+    if (!ctx->capacity)
+        save_allocation_table_storage_read(&ctx->storage, &ctx->capacity, 4, 4);
+    return ctx->capacity;
+}
+
+uint32_t save_fs_list_read_entry(save_filesystem_list_ctx_t *ctx, uint32_t index, save_fs_list_entry_t *entry) {
+    return save_allocation_table_storage_read(&ctx->storage, entry, index * SAVE_FS_LIST_ENTRY_SIZE, SAVE_FS_LIST_ENTRY_SIZE);
+}
+
+int save_fs_list_get_value(save_filesystem_list_ctx_t *ctx, uint32_t index, save_fs_list_entry_t *value) {
+    if (index >= save_fs_list_get_capacity(ctx)) {
+        return 0;
+    }
+    save_fs_list_read_entry(ctx, index, value);
+    return 1;
+}
+
+uint32_t save_fs_get_index_from_key(save_filesystem_list_ctx_t *ctx, save_entry_key_t *key, uint32_t *prev_index) {
+    save_fs_list_entry_t entry;
+    uint32_t capacity = save_fs_list_get_capacity(ctx);
+    save_fs_list_read_entry(ctx, ctx->used_list_head_index, &entry);
+    uint32_t prev;
+    if (!prev_index) {
+        prev_index = &prev;
+    }
+    *prev_index = ctx->used_list_head_index;
+    uint32_t index = entry.next;
+    while (index) {
+        if (index > capacity) {
+            EPRINTFARGS("Save entry index %d out of range!", index);
+        }
+        save_fs_list_read_entry(ctx, index, &entry);
+        if (entry.parent == key->parent && !strcmp(entry.name, key->name)) {
+            return index;
+        }
+        *prev_index = index;
+        index = entry.next;
+    }
+    *prev_index = 0xFFFFFFFF;
+    return 0xFFFFFFFF;
+}
+
+int save_hierarchical_file_table_find_path_recursive(hierarchical_save_file_table_ctx_t *ctx, save_entry_key_t *key, char *path) {
+    key->parent = 0;
+    char *pos = strchr(path, '/');
+    while (pos) {
+        memset(key->name, 0, SAVE_FS_LIST_MAX_NAME_LENGTH);
+        char *tmp = strchr(pos, '/');
+        if (!tmp) {
+            memcpy(key->name, pos, strlen(pos));
+            break;
+        }
+        memcpy(key->name, pos, tmp - pos);
+        key->parent = save_fs_get_index_from_key(&ctx->directory_table, key, NULL);
+        if (key->parent == 0xFFFFFFFF)
+            return 0;
+        pos = tmp + 1;
+    }
+    return 1;
+}
+
+int save_hierarchical_file_table_find_next_file(hierarchical_save_file_table_ctx_t *ctx, save_find_position_t *position, save_file_info_t *info, char *name) {
+    if (position->next_file == 0) {
+        return 0;
+    }
+    save_fs_list_entry_t entry;
+    if(!save_fs_list_get_value(&ctx->file_table, position->next_file, &entry)) {
+        return 0;
+    }
+    position->next_file = entry.value.next_sibling;
+    memcpy(name, &entry.name, SAVE_FS_LIST_MAX_NAME_LENGTH);
+    memcpy(info, &entry.value.save_file_info, sizeof(save_file_info_t));
+    return 1;
+}
+
+int save_hierarchical_file_table_find_next_directory(hierarchical_save_file_table_ctx_t *ctx, save_find_position_t *position, char *name) {
+    if (position->next_directory == 0) {
+        return 0;
+    }
+    save_fs_list_entry_t entry;
+    if(!save_fs_list_get_value(&ctx->directory_table, position->next_directory, &entry)) {
+        return 0;
+    }
+    position->next_directory = entry.value.next_sibling;
+    memcpy(name, &entry.name, SAVE_FS_LIST_MAX_NAME_LENGTH);
+    return 1;
+}
+
+int save_hierarchical_file_table_get_file_entry_by_path(hierarchical_save_file_table_ctx_t *ctx, char *path, save_fs_list_entry_t *entry) {
+    save_entry_key_t key;
+    if (!save_hierarchical_file_table_find_path_recursive(ctx, &key, path)) {
+        EPRINTF("Unable to locate file.");
+        return 0;
+    }
+    u32 index = save_fs_get_index_from_key(&ctx->file_table, &key, NULL);
+    if (index == 0xFFFFFFFF) {
+        EPRINTF("Unable to get table index for file.");
+        return 0;
+    }
+    if (!save_fs_list_get_value(&ctx->file_table, index, entry)) {
+        EPRINTF("Unable to get file entry from index.");
+        return 0;
+    }
+    return 1;
+}
+
+void save_open_fat_storage(save_filesystem_ctx_t *ctx, allocation_table_storage_ctx_t *storage_ctx, uint32_t block_index) {
+    storage_ctx->base_storage = ctx->base_storage;
+    storage_ctx->fat = &ctx->allocation_table;
+    storage_ctx->block_size = (uint32_t)ctx->header->block_size;
+    storage_ctx->initial_block = block_index;
+    storage_ctx->_length = block_index == 0xFFFFFFFF ? 0 : save_allocation_table_get_list_length(storage_ctx->fat, block_index) * storage_ctx->block_size;
+}
+
+void save_filesystem_init(save_filesystem_ctx_t *ctx, void *fat, save_fs_header_t *save_fs_header, fat_header_t *fat_header) {
+    ctx->allocation_table.base_storage = fat;
+    ctx->allocation_table.header = fat_header;
+    ctx->allocation_table.free_list_entry_index = 0;
+    ctx->header = save_fs_header;
+
+    save_open_fat_storage(ctx, &ctx->file_table.directory_table.storage, fat_header->directory_table_block);
+    save_open_fat_storage(ctx, &ctx->file_table.file_table.storage, fat_header->file_table_block);
+    ctx->file_table.file_table.free_list_head_index = 0;
+    ctx->file_table.file_table.used_list_head_index = 1;
+    ctx->file_table.directory_table.free_list_head_index = 0;
+    ctx->file_table.directory_table.used_list_head_index = 1;
+}
+
+validity_t save_ivfc_validate(hierarchical_integrity_verification_storage_ctx_t *ctx, ivfc_save_hdr_t *ivfc) {
+    validity_t result = VALIDITY_VALID;
+    for (unsigned int i = 0; i < ivfc->num_levels - 1 && result != VALIDITY_INVALID; i++) {
+        integrity_verification_storage_ctx_t *storage = &ctx->integrity_storages[i];
+
+        uint64_t block_size = storage->sector_size;
+        uint32_t block_count = (uint32_t)((storage->_length + block_size - 1) / block_size);
+
+        uint8_t *buffer = malloc(block_size);
+
+        for (unsigned int j = 0; j < block_count; j++) {
+            if (ctx->level_validities[ivfc->num_levels - 2][j] == VALIDITY_UNCHECKED) {
+                uint32_t to_read = storage->_length - block_size * j < block_size ? storage->_length - block_size * j : block_size;
+                save_ivfc_storage_read(storage, buffer, block_size * j, to_read, 1);
+            }
+            if (ctx->level_validities[ivfc->num_levels - 2][j] == VALIDITY_INVALID) {
+                result = VALIDITY_INVALID;
+                break;
+            }
+        }
+        free(buffer);
+    }
+
+    return result;
+}
+
+void save_ivfc_set_level_validities(hierarchical_integrity_verification_storage_ctx_t *ctx, ivfc_save_hdr_t *ivfc) {
+    for (unsigned int i = 0; i < ivfc->num_levels - 1; i++) {
+        validity_t level_validity = VALIDITY_VALID;
+        for (unsigned int j = 0; j < ctx->integrity_storages[i].sector_count; j++) {
+            if (ctx->level_validities[i][j] == VALIDITY_INVALID) {
+                level_validity = VALIDITY_INVALID;
+                break;
+            }
+            if (ctx->level_validities[i][j] == VALIDITY_UNCHECKED && level_validity != VALIDITY_INVALID) {
+                level_validity = VALIDITY_UNCHECKED;
+            }
+        }
+        ctx->levels[i].hash_validity = level_validity;
+    }
+}
+
+validity_t save_filesystem_verify(save_ctx_t *ctx) {
+    validity_t journal_validity = save_ivfc_validate(&ctx->core_data_ivfc_storage, &ctx->header.data_ivfc_header);
+    save_ivfc_set_level_validities(&ctx->core_data_ivfc_storage, &ctx->header.data_ivfc_header);
+
+    if (!ctx->fat_ivfc_storage.levels[0].save_ctx) return journal_validity;
+
+    validity_t fat_validity = save_ivfc_validate(&ctx->fat_ivfc_storage, &ctx->header.fat_ivfc_header);
+    save_ivfc_set_level_validities(&ctx->fat_ivfc_storage, &ctx->header.fat_ivfc_header);
+
+    if (journal_validity != VALIDITY_VALID) return journal_validity;
+    if (fat_validity != VALIDITY_VALID) return fat_validity;
+
+    return journal_validity;
+}
+
+void save_process(save_ctx_t *ctx) {
+    /* Try to parse Header A. */
+    f_lseek(ctx->file, 0);
+    if (f_read(ctx->file, &ctx->header, sizeof(ctx->header), NULL)) {
+        EPRINTF("Failed to read save header!\n");
+    }
+
+    save_process_header(ctx);
+
+    if (ctx->header_hash_validity == VALIDITY_INVALID) {
+        /* Try to parse Header B. */
+        f_lseek(ctx->file, 0x4000);
+        if (f_read(ctx->file, &ctx->header, sizeof(ctx->header), NULL)) {
+            EPRINTF("Failed to read save header!\n");
+        }
+
+        save_process_header(ctx);
+
+        if (ctx->header_hash_validity == VALIDITY_INVALID) {
+            EPRINTF("Error: Save header is invalid!\n");
+        }
+    }
+
+    unsigned char cmac[0x10];
+    memset(cmac, 0, 0x10);
+    se_aes_key_set(3, ctx->save_mac_key, 0x10);
+    se_aes_cmac(3, cmac, 0x10, &ctx->header.layout, sizeof(ctx->header.layout));
+    if (memcmp(cmac, &ctx->header.cmac, 0x10) == 0) {
+        ctx->header_cmac_validity = VALIDITY_VALID;
+    } else {
+        ctx->header_cmac_validity = VALIDITY_INVALID;
+    }
+
+    /* Initialize remap storages. */
+    ctx->data_remap_storage.type = STORAGE_BYTES;
+    ctx->data_remap_storage.base_storage_offset = ctx->header.layout.file_map_data_offset;
+    ctx->data_remap_storage.header = &ctx->header.main_remap_header;
+    ctx->data_remap_storage.map_entries = malloc(sizeof(remap_entry_ctx_t) * ctx->data_remap_storage.header->map_entry_count);
+    ctx->data_remap_storage.file = ctx->file;
+    f_lseek(ctx->file, ctx->header.layout.file_map_entry_offset);
+    for (unsigned int i = 0; i < ctx->data_remap_storage.header->map_entry_count; i++) {
+        f_read(ctx->file, &ctx->data_remap_storage.map_entries[i], 0x20, NULL);
+        ctx->data_remap_storage.map_entries[i].physical_offset_end = ctx->data_remap_storage.map_entries[i].physical_offset + ctx->data_remap_storage.map_entries[i].size;
+        ctx->data_remap_storage.map_entries[i].virtual_offset_end = ctx->data_remap_storage.map_entries[i].virtual_offset + ctx->data_remap_storage.map_entries[i].size;
+    }
+
+    /* Initialize data remap storage. */
+    ctx->data_remap_storage.segments = save_remap_init_segments(ctx->data_remap_storage.header, ctx->data_remap_storage.map_entries, ctx->data_remap_storage.header->map_entry_count);
+
+    /* Initialize duplex storage. */
+    ctx->duplex_layers[0].data_a = (uint8_t *)&ctx->header + ctx->header.layout.duplex_master_offset_a;
+    ctx->duplex_layers[0].data_b = (uint8_t *)&ctx->header + ctx->header.layout.duplex_master_offset_b;
+    memcpy(&ctx->duplex_layers[0].info, &ctx->header.duplex_header.layers[0], sizeof(duplex_info_t));
+
+    ctx->duplex_layers[1].data_a = malloc(ctx->header.layout.duplex_l1_size);
+    save_remap_read(&ctx->data_remap_storage, ctx->duplex_layers[1].data_a, ctx->header.layout.duplex_l1_offset_a, ctx->header.layout.duplex_l1_size);
+    ctx->duplex_layers[1].data_b = malloc(ctx->header.layout.duplex_l1_size);
+    save_remap_read(&ctx->data_remap_storage, ctx->duplex_layers[1].data_b, ctx->header.layout.duplex_l1_offset_b, ctx->header.layout.duplex_l1_size);
+    memcpy(&ctx->duplex_layers[1].info, &ctx->header.duplex_header.layers[1], sizeof(duplex_info_t));
+
+    ctx->duplex_layers[2].data_a = malloc(ctx->header.layout.duplex_data_size);
+    save_remap_read(&ctx->data_remap_storage, ctx->duplex_layers[2].data_a, ctx->header.layout.duplex_data_offset_a, ctx->header.layout.duplex_data_size);
+    ctx->duplex_layers[2].data_b = malloc(ctx->header.layout.duplex_data_size);
+    save_remap_read(&ctx->data_remap_storage, ctx->duplex_layers[2].data_b, ctx->header.layout.duplex_data_offset_b, ctx->header.layout.duplex_data_size);
+    memcpy(&ctx->duplex_layers[2].info, &ctx->header.duplex_header.layers[2], sizeof(duplex_info_t));
+
+    /* Initialize hierarchical duplex storage. */
+    uint8_t *bitmap = ctx->header.layout.duplex_index == 1 ? ctx->duplex_layers[0].data_b : ctx->duplex_layers[0].data_a;
+    save_duplex_storage_init(&ctx->duplex_storage.layers[0], &ctx->duplex_layers[1], bitmap, ctx->header.layout.duplex_master_size);
+    ctx->duplex_storage.layers[0]._length = ctx->header.layout.duplex_l1_size;
+
+    bitmap = malloc(ctx->duplex_storage.layers[0]._length);
+    save_duplex_storage_read(&ctx->duplex_storage.layers[0], bitmap, 0, ctx->duplex_storage.layers[0]._length);
+    save_duplex_storage_init(&ctx->duplex_storage.layers[1], &ctx->duplex_layers[2], bitmap, ctx->duplex_storage.layers[0]._length);
+    ctx->duplex_storage.layers[1]._length = ctx->header.layout.duplex_data_size;
+
+    ctx->duplex_storage.data_layer = ctx->duplex_storage.layers[1];
+
+    /* Initialize meta remap storage. */
+    ctx->meta_remap_storage.type = STORAGE_DUPLEX;
+    ctx->meta_remap_storage.duplex = &ctx->duplex_storage.data_layer;
+    ctx->meta_remap_storage.header = &ctx->header.meta_remap_header;
+    ctx->meta_remap_storage.map_entries = malloc(sizeof(remap_entry_ctx_t) * ctx->meta_remap_storage.header->map_entry_count);
+    ctx->meta_remap_storage.file = ctx->file;
+    f_lseek(ctx->file, ctx->header.layout.meta_map_entry_offset);
+    for (unsigned int i = 0; i < ctx->meta_remap_storage.header->map_entry_count; i++) {
+        f_read(ctx->file, &ctx->meta_remap_storage.map_entries[i], 0x20, NULL);
+        ctx->meta_remap_storage.map_entries[i].physical_offset_end = ctx->meta_remap_storage.map_entries[i].physical_offset + ctx->meta_remap_storage.map_entries[i].size;
+        ctx->meta_remap_storage.map_entries[i].virtual_offset_end = ctx->meta_remap_storage.map_entries[i].virtual_offset + ctx->meta_remap_storage.map_entries[i].size;
+    }
+
+    ctx->meta_remap_storage.segments = save_remap_init_segments(ctx->meta_remap_storage.header, ctx->meta_remap_storage.map_entries, ctx->meta_remap_storage.header->map_entry_count);
+
+   /* Initialize journal map. */
+    ctx->journal_map_info.map_storage = malloc(ctx->header.layout.journal_map_table_size);
+    save_remap_read(&ctx->meta_remap_storage, ctx->journal_map_info.map_storage, ctx->header.layout.journal_map_table_offset, ctx->header.layout.journal_map_table_size);
+
+    /* Initialize journal storage. */
+    ctx->journal_storage.header = &ctx->header.journal_header;
+    ctx->journal_storage.journal_data_offset = ctx->header.layout.journal_data_offset;
+    ctx->journal_storage._length = ctx->journal_storage.header->total_size - ctx->journal_storage.header->journal_size;
+    ctx->journal_storage.file = ctx->file;
+    ctx->journal_storage.map.header = &ctx->header.map_header;
+    ctx->journal_storage.map.map_storage = ctx->journal_map_info.map_storage;
+    ctx->journal_storage.map.entries = malloc(sizeof(journal_map_entry_t) * ctx->journal_storage.map.header->main_data_block_count);
+    uint32_t *pos = (uint32_t *)ctx->journal_storage.map.map_storage;
+    for (unsigned int i = 0; i < ctx->journal_storage.map.header->main_data_block_count; i++) {
+        ctx->journal_storage.map.entries[i].virtual_index = i;
+        ctx->journal_storage.map.entries[i].physical_index = *pos & 0x7FFFFFFF;
+        pos += 2;
+    }
+    ctx->journal_storage.block_size = ctx->journal_storage.header->block_size;
+    ctx->journal_storage._length = ctx->journal_storage.header->total_size - ctx->journal_storage.header->journal_size;
+
+    /* Initialize core IVFC storage. */
+    for (unsigned int i = 0; i < 5; i++) {
+        ctx->core_data_ivfc_storage.levels[i].save_ctx = ctx;
+    }
+    save_ivfc_storage_init(&ctx->core_data_ivfc_storage, ctx->header.layout.ivfc_master_hash_offset_a, &ctx->header.data_ivfc_header);
+
+    /* Initialize FAT storage. */
+    if (ctx->header.layout.version < 0x50000) {
+        ctx->fat_storage = malloc(ctx->header.layout.fat_size);
+        save_remap_read(&ctx->meta_remap_storage, ctx->fat_storage, ctx->header.layout.fat_offset, ctx->header.layout.fat_size);
+    } else {
+        for (unsigned int i = 0; i < 5; i++) {
+            ctx->fat_ivfc_storage.levels[i].save_ctx = ctx;
+        }
+        save_ivfc_storage_init(&ctx->fat_ivfc_storage, ctx->header.layout.fat_ivfc_master_hash_a, &ctx->header.fat_ivfc_header);
+        ctx->fat_storage = malloc(ctx->fat_ivfc_storage._length);
+        save_remap_read(&ctx->meta_remap_storage, ctx->fat_storage, ctx->header.fat_ivfc_header.level_headers[ctx->header.fat_ivfc_header.num_levels - 2].logical_offset, ctx->fat_ivfc_storage._length);
+    }
+
+    if (ctx->tool_ctx.action & ACTION_VERIFY) {
+        save_filesystem_verify(ctx);
+    }
+
+    /* Initialize core save filesystem. */
+    ctx->save_filesystem_core.base_storage = &ctx->core_data_ivfc_storage;
+    save_filesystem_init(&ctx->save_filesystem_core, ctx->fat_storage, &ctx->header.save_header, &ctx->header.fat_header);
+}
+
+void save_process_header(save_ctx_t *ctx) {
+    if (ctx->header.layout.magic != MAGIC_DISF || ctx->header.duplex_header.magic != MAGIC_DPFS ||
+        ctx->header.data_ivfc_header.magic != MAGIC_IVFC || ctx->header.journal_header.magic != MAGIC_JNGL ||
+        ctx->header.save_header.magic != MAGIC_SAVE || ctx->header.main_remap_header.magic != MAGIC_RMAP ||
+        ctx->header.meta_remap_header.magic != MAGIC_RMAP) {
+        EPRINTF("Error: Save header is corrupt!\n");
+    }
+
+    ctx->data_ivfc_master = (uint8_t *)&ctx->header + ctx->header.layout.ivfc_master_hash_offset_a;
+    ctx->fat_ivfc_master = (uint8_t *)&ctx->header + ctx->header.layout.fat_ivfc_master_hash_a;
+
+    uint8_t hash[0x20];
+    se_calc_sha256(hash, &ctx->header.duplex_header, 0x3D00);
+    ctx->header_hash_validity = memcmp(hash, ctx->header.layout.hash, 0x20) == 0 ? VALIDITY_VALID : VALIDITY_INVALID;
+
+    ctx->header.data_ivfc_header.num_levels = 5;
+
+    if (ctx->header.layout.version >= 0x50000) {
+        ctx->header.fat_ivfc_header.num_levels = 4;
+    }
+}
+
+void save_free_contexts(save_ctx_t *ctx) {
+    for (unsigned int i = 0; i < ctx->data_remap_storage.header->map_segment_count; i++) {
+        for (unsigned int j = 0; j < ctx->data_remap_storage.segments[i].entry_count; j++) {
+            free(&ctx->data_remap_storage.segments[i].entries[j]);
+        }
+    }
+    free(ctx->data_remap_storage.segments);
+    for (unsigned int i = 0; i < ctx->meta_remap_storage.header->map_segment_count; i++) {
+        for (unsigned int j = 0; j < ctx->meta_remap_storage.segments[i].entry_count; j++) {
+            free(&ctx->meta_remap_storage.segments[i].entries[j]);
+        }
+    }
+    free(ctx->meta_remap_storage.segments);
+    free(ctx->data_remap_storage.map_entries);
+    free(ctx->meta_remap_storage.map_entries);
+    free(ctx->duplex_storage.layers[0].bitmap.bitmap);
+    free(ctx->duplex_storage.layers[1].bitmap.bitmap);
+    free(ctx->duplex_storage.layers[1].bitmap_storage);
+    for (unsigned int i = 1; i < 3; i++) {
+        free(ctx->duplex_layers[i].data_a);
+        free(ctx->duplex_layers[i].data_b);
+    }
+    free(ctx->journal_map_info.map_storage);
+    free(ctx->journal_storage.map.entries);
+    for (unsigned int i = 0; i < ctx->header.data_ivfc_header.num_levels - 1; i++) {
+        free(ctx->core_data_ivfc_storage.integrity_storages[i].block_validities);
+    }
+    free(ctx->core_data_ivfc_storage.level_validities);
+    if (ctx->header.layout.version >= 0x50000) {
+        for (unsigned int i = 0; i < ctx->header.fat_ivfc_header.num_levels - 1; i++) {
+            free(ctx->fat_ivfc_storage.integrity_storages[i].block_validities);
+        }
+    }
+    free(ctx->fat_ivfc_storage.level_validities);
+    free(ctx->fat_storage);
+}

source/keys/save.h

@@ -0,0 +1,489 @@
+#ifndef _SAVE_H
+#define _SAVE_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "../libs/fatfs/ff.h"
+
+#define SAVE_HEADER_SIZE 0x4000
+#define SAVE_FAT_ENTRY_SIZE 8
+#define SAVE_FS_LIST_MAX_NAME_LENGTH 0x40
+#define SAVE_FS_LIST_ENTRY_SIZE 0x60
+
+#define IVFC_MAX_LEVEL 6
+
+#define MAGIC_DISF 0x46534944
+#define MAGIC_DPFS 0x53465044
+#define MAGIC_JNGL 0x4C474E4A
+#define MAGIC_SAVE 0x45564153
+#define MAGIC_RMAP 0x50414D52
+#define MAGIC_IVFC 0x43465649
+
+typedef enum {
+    VALIDITY_UNCHECKED = 0,
+    VALIDITY_INVALID,
+    VALIDITY_VALID
+} validity_t;
+
+typedef struct save_ctx_t save_ctx_t;
+
+typedef struct {
+    uint32_t magic; /* DISF */
+    uint32_t version;
+    uint8_t hash[0x20];
+    uint64_t file_map_entry_offset;
+    uint64_t file_map_entry_size;
+    uint64_t meta_map_entry_offset;
+    uint64_t meta_map_entry_size;
+    uint64_t file_map_data_offset;
+    uint64_t file_map_data_size;
+    uint64_t duplex_l1_offset_a;
+    uint64_t duplex_l1_offset_b;
+    uint64_t duplex_l1_size;
+    uint64_t duplex_data_offset_a;
+    uint64_t duplex_data_offset_b;
+    uint64_t duplex_data_size;
+    uint64_t journal_data_offset;
+    uint64_t journal_data_size_a;
+    uint64_t journal_data_size_b;
+    uint64_t journal_size;
+    uint64_t duplex_master_offset_a;
+    uint64_t duplex_master_offset_b;
+    uint64_t duplex_master_size;
+    uint64_t ivfc_master_hash_offset_a;
+    uint64_t ivfc_master_hash_offset_b;
+    uint64_t ivfc_master_hash_size;
+    uint64_t journal_map_table_offset;
+    uint64_t journal_map_table_size;
+    uint64_t journal_physical_bitmap_offset;
+    uint64_t journal_physical_bitmap_size;
+    uint64_t journal_virtual_bitmap_offset;
+    uint64_t journal_virtual_bitmap_size;
+    uint64_t journal_free_bitmap_offset;
+    uint64_t journal_free_bitmap_size;
+    uint64_t ivfc_l1_offset;
+    uint64_t ivfc_l1_size;
+    uint64_t ivfc_l2_offset;
+    uint64_t ivfc_l2_size;
+    uint64_t ivfc_l3_offset;
+    uint64_t ivfc_l3_size;
+    uint64_t fat_offset;
+    uint64_t fat_size;
+    uint64_t duplex_index;
+    uint64_t fat_ivfc_master_hash_a;
+    uint64_t fat_ivfc_master_hash_b;
+    uint64_t fat_ivfc_l1_offset;
+    uint64_t fat_ivfc_l1_size;
+    uint64_t fat_ivfc_l2_offset;
+    uint64_t fat_ivfc_l2_size;
+    uint8_t _0x190[0x70];
+} fs_layout_t;
+
+#pragma pack(push, 1)
+typedef struct {
+    uint64_t offset;
+    uint64_t length;
+    uint32_t block_size_power;
+} duplex_info_t;
+#pragma pack(pop)
+
+typedef struct {
+    uint32_t magic; /* DPFS */
+    uint32_t version;
+    duplex_info_t layers[3];
+} duplex_header_t;
+
+typedef struct {
+    uint32_t version;
+    uint32_t main_data_block_count;
+    uint32_t journal_block_count;
+    uint32_t _0x0C;
+} journal_map_header_t;
+
+typedef struct {
+    uint32_t magic; /* JNGL */
+    uint32_t version;
+    uint64_t total_size;
+    uint64_t journal_size;
+    uint64_t block_size;
+} journal_header_t;
+
+typedef struct {
+    uint32_t magic; /* SAVE */
+    uint32_t version;
+    uint64_t block_count;
+    uint64_t block_size;
+} save_fs_header_t;
+
+typedef struct {
+    uint64_t block_size;
+    uint64_t allocation_table_offset;
+    uint32_t allocation_table_block_count;
+    uint32_t _0x14;
+    uint64_t data_offset;
+    uint32_t data_block_count;
+    uint32_t _0x24;
+    uint32_t directory_table_block;
+    uint32_t file_table_block;
+} fat_header_t;
+
+typedef struct {
+    uint32_t magic; /* RMAP */
+    uint32_t version;
+    uint32_t map_entry_count;
+    uint32_t map_segment_count;
+    uint32_t segment_bits;
+    uint8_t _0x14[0x2C];
+} remap_header_t;
+
+typedef struct remap_segment_ctx_t remap_segment_ctx_t;
+typedef struct remap_entry_ctx_t remap_entry_ctx_t;
+
+#pragma pack(push, 1)
+struct remap_entry_ctx_t {
+    uint64_t virtual_offset;
+    uint64_t physical_offset;
+    uint64_t size;
+    uint32_t alignment;
+    uint32_t _0x1C;
+    uint64_t virtual_offset_end;
+    uint64_t physical_offset_end;
+    remap_segment_ctx_t *segment;
+    remap_entry_ctx_t *next;
+};
+#pragma pack(pop)
+
+struct remap_segment_ctx_t{
+    uint64_t offset;
+    uint64_t length;
+    remap_entry_ctx_t *entries;
+    uint64_t entry_count;
+};
+
+typedef struct {
+    uint8_t *data;
+    uint8_t *bitmap;
+} duplex_bitmap_t;
+
+typedef struct {
+    uint32_t block_size;
+    uint8_t *bitmap_storage;
+    uint8_t *data_a;
+    uint8_t *data_b;
+    duplex_bitmap_t bitmap;
+    uint64_t _length;
+} duplex_storage_ctx_t;
+
+enum base_storage_type {
+    STORAGE_BYTES = 0,
+    STORAGE_DUPLEX = 1,
+    STORAGE_REMAP = 2,
+    STORAGE_JOURNAL = 3
+};
+
+typedef struct {
+    remap_header_t *header;
+    remap_entry_ctx_t *map_entries;
+    remap_segment_ctx_t *segments;
+    enum base_storage_type type;
+    uint64_t base_storage_offset;
+    duplex_storage_ctx_t *duplex;
+    FIL *file;
+} remap_storage_ctx_t;
+
+typedef struct {
+    uint64_t title_id;
+    uint8_t user_id[0x10];
+    uint64_t save_id;
+    uint8_t save_data_type;
+    uint8_t _0x21[0x1F];
+    uint64_t save_owner_id;
+    uint64_t timestamp;
+    uint64_t _0x50;
+    uint64_t data_size;
+    uint64_t journal_size;
+    uint64_t commit_id;
+} extra_data_t;
+
+typedef struct {
+    uint64_t logical_offset;
+    uint64_t hash_data_size;
+    uint32_t block_size;
+    uint32_t reserved;
+} ivfc_level_hdr_t;
+
+typedef struct {
+    uint32_t magic;
+    uint32_t id;
+    uint32_t master_hash_size;
+    uint32_t num_levels;
+    ivfc_level_hdr_t level_headers[IVFC_MAX_LEVEL];
+    uint8_t salt_source[0x20];
+} ivfc_save_hdr_t;
+
+#pragma pack(push, 1)
+typedef struct {
+    uint8_t cmac[0x10];
+    uint8_t _0x10[0xF0];
+    fs_layout_t layout;
+    duplex_header_t duplex_header;
+    ivfc_save_hdr_t data_ivfc_header;
+    uint32_t _0x404;
+    journal_header_t journal_header;
+    journal_map_header_t map_header;
+    uint8_t _0x438[0x1D0];
+    save_fs_header_t save_header;
+    fat_header_t fat_header;
+    remap_header_t main_remap_header, meta_remap_header;
+    uint64_t _0x6D0;
+    extra_data_t extra_data;
+    uint8_t _0x748[0x390];
+    ivfc_save_hdr_t fat_ivfc_header;
+    uint8_t _0xB98[0x3468];
+} save_header_t;
+#pragma pack(pop)
+
+typedef struct {
+    duplex_storage_ctx_t layers[2];
+    duplex_storage_ctx_t data_layer;
+    uint64_t _length;
+} hierarchical_duplex_storage_ctx_t;
+
+typedef struct {
+    uint8_t *data_a;
+    uint8_t *data_b;
+    duplex_info_t info;
+} duplex_fs_layer_info_t;
+
+typedef struct {
+    uint8_t *map_storage;
+    uint8_t *physical_block_bitmap;
+    uint8_t *virtual_block_bitmap;
+    uint8_t *free_block_bitmap;
+} journal_map_params_t;
+
+typedef struct {
+    uint32_t physical_index;
+    uint32_t virtual_index;
+} journal_map_entry_t;
+
+
+typedef struct {
+    journal_map_header_t *header;
+    journal_map_entry_t *entries;
+    uint8_t *map_storage;
+} journal_map_ctx_t;
+
+typedef struct {
+    journal_map_ctx_t map;
+    journal_header_t *header;
+    uint32_t block_size;
+    uint64_t journal_data_offset;
+    uint64_t _length;
+    FIL *file;
+} journal_storage_ctx_t;
+
+typedef struct {
+    uint64_t data_offset;
+    uint64_t data_size;
+    uint64_t hash_offset;
+    uint32_t hash_block_size;
+    validity_t hash_validity;
+    enum base_storage_type type;
+    save_ctx_t *save_ctx;
+} ivfc_level_save_ctx_t;
+
+typedef struct {
+    ivfc_level_save_ctx_t *data;
+    uint32_t block_size;
+    uint8_t salt[0x20];
+} integrity_verification_info_ctx_t;
+
+
+typedef struct integrity_verification_storage_ctx_t integrity_verification_storage_ctx_t;
+
+struct integrity_verification_storage_ctx_t {
+    ivfc_level_save_ctx_t *hash_storage;
+    ivfc_level_save_ctx_t *base_storage;
+    validity_t *block_validities;
+    uint8_t salt[0x20];
+    uint32_t sector_size;
+    uint32_t sector_count;
+    uint64_t _length;
+    integrity_verification_storage_ctx_t *next_level;
+};
+
+typedef struct {
+    ivfc_level_save_ctx_t levels[5];
+    ivfc_level_save_ctx_t *data_level;
+    validity_t **level_validities;
+    uint64_t _length;
+    integrity_verification_storage_ctx_t integrity_storages[4];
+} hierarchical_integrity_verification_storage_ctx_t;
+
+typedef struct {
+    uint32_t prev;
+    uint32_t next;
+} allocation_table_entry_t;
+
+typedef struct {
+    uint32_t free_list_entry_index;
+    void *base_storage;
+    fat_header_t *header;
+} allocation_table_ctx_t;
+
+typedef struct {
+    hierarchical_integrity_verification_storage_ctx_t *base_storage;
+    uint32_t block_size;
+    uint32_t initial_block;
+    allocation_table_ctx_t *fat;
+    uint64_t _length;
+} allocation_table_storage_ctx_t;
+
+typedef struct {
+    allocation_table_ctx_t *fat;
+    uint32_t virtual_block;
+    uint32_t physical_block;
+    uint32_t current_segment_size;
+    uint32_t next_block;
+    uint32_t prev_block;
+} allocation_table_iterator_ctx_t;
+
+typedef struct {
+    char name[SAVE_FS_LIST_MAX_NAME_LENGTH];
+    uint32_t parent;
+} save_entry_key_t;
+
+#pragma pack(push, 1)
+typedef struct {
+    uint32_t start_block;
+    uint64_t length;
+    uint32_t _0xC[2];
+} save_file_info_t;
+#pragma pack(pop)
+
+#pragma pack(push, 1)
+typedef struct {
+    uint32_t next_directory;
+    uint32_t next_file;
+    uint32_t _0x8[3];
+} save_find_position_t;
+#pragma pack(pop)
+
+#pragma pack(push, 1)
+typedef struct {
+    uint32_t next_sibling;
+    union { /* Save table entry type. Size = 0x14. */
+        save_file_info_t save_file_info;
+        save_find_position_t save_find_position;
+    };
+} save_table_entry_t;
+#pragma pack(pop)
+
+#pragma pack(push, 1)
+typedef struct {
+    uint32_t parent;
+    char name[SAVE_FS_LIST_MAX_NAME_LENGTH];
+    save_table_entry_t value;
+    uint32_t next;
+} save_fs_list_entry_t;
+#pragma pack(pop)
+
+typedef struct {
+    uint32_t free_list_head_index;
+    uint32_t used_list_head_index;
+    allocation_table_storage_ctx_t storage;
+    uint32_t capacity;
+} save_filesystem_list_ctx_t;
+
+typedef struct {
+    save_filesystem_list_ctx_t file_table;
+    save_filesystem_list_ctx_t directory_table;
+} hierarchical_save_file_table_ctx_t;
+
+typedef struct {
+    hierarchical_integrity_verification_storage_ctx_t *base_storage;
+    allocation_table_ctx_t allocation_table;
+    save_fs_header_t *header;
+    hierarchical_save_file_table_ctx_t file_table;
+} save_filesystem_ctx_t;
+
+#define ACTION_VERIFY (1<<2)
+
+struct save_ctx_t {
+    save_header_t header;
+    FIL *file;
+    struct {
+        FIL *file;
+        uint32_t action;
+    } tool_ctx;
+    validity_t header_cmac_validity;
+    validity_t header_hash_validity;
+    uint8_t *data_ivfc_master;
+    uint8_t *fat_ivfc_master;
+    remap_storage_ctx_t data_remap_storage;
+    remap_storage_ctx_t meta_remap_storage;
+    duplex_fs_layer_info_t duplex_layers[3];
+    hierarchical_duplex_storage_ctx_t duplex_storage;
+    journal_storage_ctx_t journal_storage;
+    journal_map_params_t journal_map_info;
+    hierarchical_integrity_verification_storage_ctx_t core_data_ivfc_storage;
+    hierarchical_integrity_verification_storage_ctx_t fat_ivfc_storage;
+    uint8_t *fat_storage;
+    save_filesystem_ctx_t save_filesystem_core;
+    uint8_t save_mac_key[0x10];
+};
+
+static inline uint32_t allocation_table_entry_index_to_block(uint32_t entry_index) {
+    return entry_index - 1;
+}
+
+static inline uint32_t allocation_table_block_to_entry_index(uint32_t block_index) {
+    return block_index + 1;
+}
+
+static inline int allocation_table_is_list_end(allocation_table_entry_t *entry) {
+    return (entry->next & 0x7FFFFFFF) == 0;
+}
+
+static inline int allocation_table_is_list_start(allocation_table_entry_t *entry) {
+    return entry->prev == 0x80000000;
+}
+
+
+static inline int allocation_table_get_next(allocation_table_entry_t *entry) {
+    return entry->next & 0x7FFFFFFF;
+}
+
+static inline int allocation_table_get_prev(allocation_table_entry_t *entry) {
+    return entry->prev & 0x7FFFFFFF;
+}
+
+static inline allocation_table_entry_t *save_allocation_table_read_entry(allocation_table_ctx_t *ctx, uint32_t entry_index) {
+    return (allocation_table_entry_t *)((uint8_t *)ctx->base_storage + entry_index * SAVE_FAT_ENTRY_SIZE);
+}
+
+static inline uint32_t save_allocation_table_get_free_list_entry_index(allocation_table_ctx_t *ctx) {
+    return allocation_table_get_next(save_allocation_table_read_entry(ctx, ctx->free_list_entry_index));
+}
+
+static inline uint32_t save_allocation_table_get_free_list_block_index(allocation_table_ctx_t *ctx) {
+    return allocation_table_entry_index_to_block(save_allocation_table_get_free_list_entry_index(ctx));
+}
+
+void save_process(save_ctx_t *ctx);
+void save_process_header(save_ctx_t *ctx);
+void save_save(save_ctx_t *ctx);
+void save_print(save_ctx_t *ctx);
+
+void save_free_contexts(save_ctx_t *ctx);
+
+void save_open_fat_storage(save_filesystem_ctx_t *ctx, allocation_table_storage_ctx_t *storage_ctx, uint32_t block_index);
+uint32_t save_allocation_table_storage_read(allocation_table_storage_ctx_t *ctx, void *buffer, uint64_t offset, size_t count);
+int save_fs_list_get_value(save_filesystem_list_ctx_t *ctx, uint32_t index, save_fs_list_entry_t *value);
+uint32_t save_fs_get_index_from_key(save_filesystem_list_ctx_t *ctx, save_entry_key_t *key, uint32_t *prev_index);
+int save_hierarchical_file_table_find_path_recursive(hierarchical_save_file_table_ctx_t *ctx, save_entry_key_t *key, char *path);
+int save_hierarchical_file_table_get_file_entry_by_path(hierarchical_save_file_table_ctx_t *ctx, char *path, save_fs_list_entry_t *entry);
+
+#endif

source/libs/fatfs/diskio.c

@@ -24,15 +24,15 @@
 /*-----------------------------------------------------------------------*/
 
 #include <string.h>
+
+#include "../../../common/memory_map.h"
+
 #include "diskio.h"		/* FatFs lower layer API */
 #include "../../mem/heap.h"
 #include "../../sec/se.h"
 #include "../../storage/nx_emmc.h"
 #include "../../storage/sdmmc.h"
 
-#define SDMMC_UPPER_BUFFER 0xB8000000
-#define DRAM_START         0x80000000
-
 extern sdmmc_storage_t sd_storage;
 extern sdmmc_storage_t storage;
 extern emmc_part_t *system_part;
@@ -107,7 +107,7 @@ static inline int _emmc_xts(u32 ks1, u32 ks2, u32 enc, u8 *tweak, bool regen_twe
         pdst += 0x10;
     }
 
-    se_aes_crypt_ecb(ks2, 0, dst, secsize, src, secsize);
+    se_aes_crypt_ecb(ks2, enc, dst, secsize, src, secsize);
 
     pdst = (u8 *)dst;
 
@@ -150,12 +150,11 @@ DRESULT disk_read (
         __attribute__ ((aligned (16))) static u8 tweak[0x10];
         __attribute__ ((aligned (16))) static u64 prev_cluster = -1;
         __attribute__ ((aligned (16))) static u32 prev_sector = 0;
-        u32 tweak_exp = 0;
-        bool regen_tweak = true, cache_sector = false;
+        bool needs_cache_sector = false;
 
         if (secindex == 0 || clear_sector_cache) {
-            free(sector_cache);
-            sector_cache = (sector_cache_t *)malloc(sizeof(sector_cache_t) * MAX_SEC_CACHE_ENTRIES);
+            if (!sector_cache)
+                sector_cache = (sector_cache_t *)malloc(sizeof(sector_cache_t) * MAX_SEC_CACHE_ENTRIES);
             clear_sector_cache = false;
             secindex = 0;
         }
@@ -176,12 +175,14 @@ DRESULT disk_read (
             if (s == secindex && s < MAX_SEC_CACHE_ENTRIES) {
                 sector_cache[s].sector = sector;
                 sector_cache[s].visit_count++;
-                cache_sector = true;
+                needs_cache_sector = true;
                 secindex++;
             }
         }
 
         if (nx_emmc_part_read(&storage, system_part, sector, count, buff)) {
+            u32 tweak_exp = 0;
+            bool regen_tweak = true;
             if (prev_cluster != sector / 0x20) { // sector in different cluster than last read
                 prev_cluster = sector / 0x20;
                 tweak_exp = sector % 0x20;
@@ -194,7 +195,7 @@ DRESULT disk_read (
 
             // fatfs will never pull more than a cluster
             _emmc_xts(9, 8, 0, tweak, regen_tweak, tweak_exp, prev_cluster, buff, buff, count * 0x200);
-            if (cache_sector) {
+            if (needs_cache_sector) {
                 memcpy(sector_cache[s].cached_sector, buff, 0x200);
                 memcpy(sector_cache[s].tweak, tweak, 0x10);
             }

source/libs/fatfs/ff.c

@@ -40,9 +40,6 @@
 #include "diskio.h"		/* Declarations of device I/O functions */
 #include "../../gfx/gfx.h"
 
-#pragma GCC push_options
-#pragma GCC target ("thumb")
-
 #define EFSPRINTF(text, ...) print_error(); gfx_printf("%k"text"%k\n", 0xFFFFFF00, 0xFFFFFFFF);
 //#define EFSPRINTF(...)
 
@@ -6650,5 +6647,3 @@ FRESULT f_setcp (
 	return FR_OK;
 }
 #endif	/* FF_CODE_PAGE == 0 */
-
-#pragma GCC pop_options

source/libs/fatfs/ffconf.h

@@ -97,7 +97,7 @@
 */
 
 
-#define FF_USE_LFN		1
+#define FF_USE_LFN		3
 #define FF_MAX_LFN		255
 /* The FF_USE_LFN switches the support for LFN (long file name).
 /

source/main.c

@@ -19,6 +19,7 @@
 #include <string.h>
 
 #include "config/config.h"
+#include "config/ini.h"
 #include "gfx/di.h"
 #include "gfx/gfx.h"
 #include "gfx/tui.h"
@@ -33,6 +34,8 @@
 #include "storage/emummc.h"
 #include "storage/nx_emmc.h"
 #include "storage/sdmmc.h"
+#include "utils/btn.h"
+#include "utils/dirlist.h"
 #include "utils/sprintf.h"
 #include "utils/util.h"
 
@@ -46,168 +49,352 @@ static bool sd_mounted;
 hekate_config h_cfg;
 boot_cfg_t __attribute__((section ("._boot_cfg"))) b_cfg;
 
+volatile nyx_storage_t *nyx_str = (nyx_storage_t *)NYX_STORAGE_ADDR;
+
 bool sd_mount()
 {
-    if (sd_mounted)
-        return true;
+	if (sd_mounted)
+		return true;
 
-    if (!sdmmc_storage_init_sd(&sd_storage, &sd_sdmmc, SDMMC_1, SDMMC_BUS_WIDTH_4, 11))
-    {
-        EPRINTF("Failed to init SD card.\nMake sure that it is inserted.\nOr that SD reader is properly seated!");
-    }
-    else
-    {
-        int res = 0;
-        res = f_mount(&sd_fs, "sd:", 1);
-        if (res == FR_OK)
-        {
-            sd_mounted = 1;
-            return true;
-        }
-        else
-        {
-            EPRINTFARGS("Failed to mount SD card (FatFS Error %d).\nMake sure that a FAT partition exists..", res);
-        }
-    }
+	if (!sdmmc_storage_init_sd(&sd_storage, &sd_sdmmc, SDMMC_1, SDMMC_BUS_WIDTH_4, 11))
+	{
+		EPRINTF("Failed to init SD card.\nMake sure that it is inserted.\nOr that SD reader is properly seated!");
+	}
+	else
+	{
+		int res = 0;
+		res = f_mount(&sd_fs, "sd:", 1);
+		if (res == FR_OK)
+		{
+			sd_mounted = 1;
+			return true;
+		}
+		else
+		{
+			EPRINTFARGS("Failed to mount SD card (FatFS Error %d).\nMake sure that a FAT partition exists..", res);
+		}
+	}
 
-    return false;
+	return false;
 }
 
 void sd_unmount()
 {
-    if (sd_mounted)
-    {
-        f_mount(NULL, "sd:", 1);
-        sdmmc_storage_end(&sd_storage);
-        sd_mounted = false;
-    }
+	if (sd_mounted)
+	{
+		f_mount(NULL, "sd:", 1);
+		sdmmc_storage_end(&sd_storage);
+		sd_mounted = false;
+	}
 }
 
 void *sd_file_read(const char *path, u32 *fsize)
 {
-    FIL fp;
-    if (f_open(&fp, path, FA_READ) != FR_OK)
-        return NULL;
+	FIL fp;
+	if (f_open(&fp, path, FA_READ) != FR_OK)
+		return NULL;
 
-    u32 size = f_size(&fp);
-    if (fsize)
-        *fsize = size;
+	u32 size = f_size(&fp);
+	if (fsize)
+		*fsize = size;
 
-    void *buf = malloc(size);
+	void *buf = malloc(size);
 
-    if (f_read(&fp, buf, size, NULL) != FR_OK)
-    {
-        free(buf);
-        f_close(&fp);
+	if (f_read(&fp, buf, size, NULL) != FR_OK)
+	{
+		free(buf);
+		f_close(&fp);
 
-        return NULL;
-    }
+		return NULL;
+	}
 
-    f_close(&fp);
+	f_close(&fp);
 
-    return buf;
+	return buf;
 }
 
 int sd_save_to_file(void *buf, u32 size, const char *filename)
 {
-    FIL fp;
-    u32 res = 0;
-    res = f_open(&fp, filename, FA_CREATE_ALWAYS | FA_WRITE);
-    if (res)
-    {
-        EPRINTFARGS("Error (%d) creating file\n%s.\n", res, filename);
-        return res;
-    }
+	FIL fp;
+	u32 res = 0;
+	res = f_open(&fp, filename, FA_CREATE_ALWAYS | FA_WRITE);
+	if (res)
+	{
+		EPRINTFARGS("Error (%d) creating file\n%s.\n", res, filename);
+		return res;
+	}
 
-    f_write(&fp, buf, size, NULL);
-    f_close(&fp);
+	f_write(&fp, buf, size, NULL);
+	f_close(&fp);
 
-    return 0;
+	return 0;
 }
 
 // This is a safe and unused DRAM region for our payloads.
 #define RELOC_META_OFF      0x7C
 #define PATCHED_RELOC_SZ    0x94
 #define PATCHED_RELOC_STACK 0x40007000
+#define PATCHED_RELOC_ENTRY 0x40010000
+#define EXT_PAYLOAD_ADDR    0xC03C0000
+#define RCM_PAYLOAD_ADDR    (EXT_PAYLOAD_ADDR + ALIGN(PATCHED_RELOC_SZ, 0x10))
 #define COREBOOT_ADDR       (0xD0000000 - 0x100000)
 #define CBFS_DRAM_EN_ADDR   0x4003e000
 #define  CBFS_DRAM_MAGIC    0x4452414D // "DRAM"
 
 void reloc_patcher(u32 payload_dst, u32 payload_src, u32 payload_size)
 {
-    memcpy((u8 *)payload_src, (u8 *)IPL_LOAD_ADDR, PATCHED_RELOC_SZ);
+	memcpy((u8 *)payload_src, (u8 *)IPL_LOAD_ADDR, PATCHED_RELOC_SZ);
 
-    volatile reloc_meta_t *relocator = (reloc_meta_t *)(payload_src + RELOC_META_OFF);
+	volatile reloc_meta_t *relocator = (reloc_meta_t *)(payload_src + RELOC_META_OFF);
 
-    relocator->start = payload_dst - ALIGN(PATCHED_RELOC_SZ, 0x10);
-    relocator->stack = PATCHED_RELOC_STACK;
-    relocator->end   = payload_dst + payload_size;
-    relocator->ep    = payload_dst;
+	relocator->start = payload_dst - ALIGN(PATCHED_RELOC_SZ, 0x10);
+	relocator->stack = PATCHED_RELOC_STACK;
+	relocator->end   = payload_dst + payload_size;
+	relocator->ep    = payload_dst;
 
-    if (payload_size == 0x7000)
-    {
-        memcpy((u8 *)(payload_src + ALIGN(PATCHED_RELOC_SZ, 0x10)), (u8 *)COREBOOT_ADDR, 0x7000); //Bootblock
-        *(vu32 *)CBFS_DRAM_EN_ADDR = CBFS_DRAM_MAGIC;
-    }
+	if (payload_size == 0x7000)
+	{
+		memcpy((u8 *)(payload_src + ALIGN(PATCHED_RELOC_SZ, 0x10)), (u8 *)COREBOOT_ADDR, 0x7000); //Bootblock
+		*(vu32 *)CBFS_DRAM_EN_ADDR = CBFS_DRAM_MAGIC;
+	}
+}
+
+int launch_payload(char *path)
+{
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+	if (!path)
+		return 1;
+
+	if (sd_mount())
+	{
+		FIL fp;
+		if (f_open(&fp, path, FA_READ))
+		{
+			EPRINTFARGS("Payload file is missing!\n(%s)", path);
+			sd_unmount();
+
+			return 1;
+		}
+
+		// Read and copy the payload to our chosen address
+		void *buf;
+		u32 size = f_size(&fp);
+
+		if (size < 0x30000)
+			buf = (void *)RCM_PAYLOAD_ADDR;
+		else
+			buf = (void *)COREBOOT_ADDR;
+
+		if (f_read(&fp, buf, size, NULL))
+		{
+			f_close(&fp);
+			sd_unmount();
+
+			return 1;
+		}
+
+		f_close(&fp);
+
+		sd_unmount();
+
+		if (size < 0x30000)
+		{
+			reloc_patcher(PATCHED_RELOC_ENTRY, EXT_PAYLOAD_ADDR, ALIGN(size, 0x10));
+
+			reconfig_hw_workaround(false, byte_swap_32(*(u32 *)(buf + size - sizeof(u32))));
+		}
+		else
+		{
+			reloc_patcher(PATCHED_RELOC_ENTRY, EXT_PAYLOAD_ADDR, 0x7000);
+			reconfig_hw_workaround(true, 0);
+		}
+
+		// Some cards (Sandisk U1), do not like a fast power cycle. Wait min 100ms.
+		sdmmc_storage_init_wait_sd();
+
+		void (*ext_payload_ptr)() = (void *)EXT_PAYLOAD_ADDR;
+
+		// Launch our payload.
+		(*ext_payload_ptr)();
+	}
+
+	return 1;
+}
+
+void launch_tools()
+{
+	u8 max_entries = 61;
+	char *filelist = NULL;
+	char *file_sec = NULL;
+	char *dir = NULL;
+
+	ment_t *ments = (ment_t *)malloc(sizeof(ment_t) * (max_entries + 3));
+
+	gfx_clear_grey(0x1B);
+	gfx_con_setpos(0, 0);
+
+	if (sd_mount())
+	{
+		dir = (char *)malloc(256);
+
+		memcpy(dir, "sd:/bootloader/payloads", 24);
+
+		filelist = dirlist(dir, NULL, false);
+
+		u32 i = 0;
+		u32 i_off = 2;
+
+		if (filelist)
+		{
+			// Build configuration menu.
+			u32 color_idx = 0;
+
+			ments[0].type = MENT_BACK;
+			ments[0].caption = "Back";
+			ments[0].color = colors[(color_idx++) % 6];
+			ments[1].type = MENT_CHGLINE;
+			ments[1].color = colors[(color_idx++) % 6];
+			if (!f_stat("sd:/atmosphere/reboot_payload.bin", NULL))
+			{
+				ments[i_off].type = INI_CHOICE;
+				ments[i_off].caption = "reboot_payload.bin";
+				ments[i_off].color = colors[(color_idx++) % 6];
+				ments[i_off].data = "sd:/atmosphere/reboot_payload.bin";
+				i_off++;
+			}
+			if (!f_stat("sd:/ReiNX.bin", NULL))
+			{
+				ments[i_off].type = INI_CHOICE;
+				ments[i_off].caption = "ReiNX.bin";
+				ments[i_off].color = colors[(color_idx++) % 6];
+				ments[i_off].data = "sd:/ReiNX.bin";
+				i_off++;
+			}
+
+			while (true)
+			{
+				if (i > max_entries || !filelist[i * 256])
+					break;
+				ments[i + i_off].type = INI_CHOICE;
+				ments[i + i_off].caption = &filelist[i * 256];
+				ments[i + i_off].color = colors[(color_idx++) % 6];
+				ments[i + i_off].data = &filelist[i * 256];
+
+				i++;
+			}
+		}
+
+		if (i > 0)
+		{
+			memset(&ments[i + i_off], 0, sizeof(ment_t));
+			menu_t menu = { ments, "Choose a file to launch", 0, 0 };
+
+			file_sec = (char *)tui_do_menu(&menu);
+
+			if (!file_sec)
+			{
+				free(ments);
+				free(dir);
+				free(filelist);
+				sd_unmount();
+				return;
+			}
+		}
+		else
+			EPRINTF("No payloads or modules found.");
+
+		free(ments);
+		free(filelist);
+	}
+	else
+	{
+		free(ments);
+		goto out;
+	}
+
+	if (file_sec)
+	{
+		if (memcmp("sd:/", file_sec, 4)) {
+			memcpy(dir + strlen(dir), "/", 2);
+			memcpy(dir + strlen(dir), file_sec, strlen(file_sec) + 1);
+		}
+		else
+			memcpy(dir, file_sec, strlen(file_sec) + 1);
+
+		if (launch_payload(dir))
+		{
+			EPRINTF("Failed to launch payload.");
+			free(dir);
+		}
+	}
+
+out:
+	sd_unmount();
+	free(dir);
+
+	btn_wait();
 }
 
 void dump_sysnand()
 {
-    h_cfg.emummc_force_disable = true;
-    b_cfg.extra_cfg &= ~EXTRA_CFG_DUMP_EMUMMC;
-    dump_keys();
+	h_cfg.emummc_force_disable = true;
+	b_cfg.extra_cfg &= ~EXTRA_CFG_DUMP_EMUMMC;
+	dump_keys();
 }
 
 void dump_emunand()
 {
-    if (h_cfg.emummc_force_disable)
-        return;
-    emu_cfg.enabled = 1;
-    b_cfg.extra_cfg |= EXTRA_CFG_DUMP_EMUMMC;
-    dump_keys();
+	if (h_cfg.emummc_force_disable)
+		return;
+	emu_cfg.enabled = 1;
+	b_cfg.extra_cfg |= EXTRA_CFG_DUMP_EMUMMC;
+	dump_keys();
 }
 
 ment_t ment_top[] = {
-    MDEF_HANDLER("Dump from SysNAND | Key generation: unk", dump_sysnand, COLOR_RED),
-    MDEF_HANDLER("Dump from EmuNAND | Key generation: unk", dump_emunand, COLOR_ORANGE),
-    MDEF_CAPTION("---------------", COLOR_YELLOW),
-    MDEF_HANDLER("Reboot (Normal)", reboot_normal, COLOR_GREEN),
-    MDEF_HANDLER("Reboot (RCM)", reboot_rcm, COLOR_BLUE),
-    MDEF_HANDLER("Power off", power_off, COLOR_VIOLET),
-    MDEF_END()
+	MDEF_HANDLER("Dump from SysNAND | Key generation: unk", dump_sysnand, COLOR_RED),
+	MDEF_HANDLER("Dump from EmuNAND | Key generation: unk", dump_emunand, COLOR_ORANGE),
+	MDEF_CAPTION("---------------", COLOR_YELLOW),
+	MDEF_HANDLER("Payloads...", launch_tools, COLOR_GREEN),
+	MDEF_CAPTION("---------------", COLOR_BLUE),
+	MDEF_HANDLER("Reboot (Normal)", reboot_normal, COLOR_VIOLET),
+	MDEF_HANDLER("Reboot (RCM)", reboot_rcm, COLOR_RED),
+	MDEF_HANDLER("Power off", power_off, COLOR_ORANGE),
+	MDEF_END()
 };
 
 menu_t menu_top = { ment_top, NULL, 0, 0 };
 
 void _get_key_generations(char *sysnand_label, char *emunand_label) {
-    sdmmc_t sdmmc;
-    sdmmc_storage_t storage;
-    sdmmc_storage_init_mmc(&storage, &sdmmc, SDMMC_4, SDMMC_BUS_WIDTH_8, 4);
-    u8 *pkg1 = (u8 *)malloc(NX_EMMC_BLOCKSIZE);
-    sdmmc_storage_set_mmc_partition(&storage, 1);
-    sdmmc_storage_read(&storage, 0x100000 / NX_EMMC_BLOCKSIZE, 1, pkg1);
-    const pkg1_id_t *pkg1_id = pkg1_identify(pkg1);
-    sdmmc_storage_end(&storage);
+	sdmmc_t sdmmc;
+	sdmmc_storage_t storage;
+	sdmmc_storage_init_mmc(&storage, &sdmmc, SDMMC_4, SDMMC_BUS_WIDTH_8, 4);
+	u8 *pkg1 = (u8 *)malloc(NX_EMMC_BLOCKSIZE);
+	sdmmc_storage_set_mmc_partition(&storage, 1);
+	sdmmc_storage_read(&storage, 0x100000 / NX_EMMC_BLOCKSIZE, 1, pkg1);
+	const pkg1_id_t *pkg1_id = pkg1_identify(pkg1);
+	sdmmc_storage_end(&storage);
 
-    if (pkg1_id)
-        sprintf(sysnand_label + 36, "% 3d", pkg1_id->kb);
-    ment_top[0].caption = sysnand_label;
-    if (h_cfg.emummc_force_disable) {
-        free(pkg1);
-        return;
-    }
+	if (pkg1_id)
+		sprintf(sysnand_label + 36, "% 3d", pkg1_id->kb);
+	ment_top[0].caption = sysnand_label;
+	if (h_cfg.emummc_force_disable) {
+		free(pkg1);
+		return;
+	}
 
-    emummc_storage_init_mmc(&storage, &sdmmc);
-    memset(pkg1, 0, NX_EMMC_BLOCKSIZE);
-    emummc_storage_set_mmc_partition(&storage, 1);
-    emummc_storage_read(&storage, 0x100000 / NX_EMMC_BLOCKSIZE, 1, pkg1);
-    pkg1_id = pkg1_identify(pkg1);
-    emummc_storage_end(&storage);
+	emummc_storage_init_mmc(&storage, &sdmmc);
+	memset(pkg1, 0, NX_EMMC_BLOCKSIZE);
+	emummc_storage_set_mmc_partition(&storage, 1);
+	emummc_storage_read(&storage, 0x100000 / NX_EMMC_BLOCKSIZE, 1, pkg1);
+	pkg1_id = pkg1_identify(pkg1);
+	emummc_storage_end(&storage);
 
-    if (pkg1_id)
-        sprintf(emunand_label + 36, "% 3d", pkg1_id->kb);
-    free(pkg1);
-    ment_top[1].caption = emunand_label;
+	if (pkg1_id)
+		sprintf(emunand_label + 36, "% 3d", pkg1_id->kb);
+	free(pkg1);
+	ment_top[1].caption = emunand_label;
 }
 
 #define IPL_STACK_TOP  0x90010000
@@ -215,47 +402,49 @@ void _get_key_generations(char *sysnand_label, char *emunand_label) {
 
 extern void pivot_stack(u32 stack_top);
 
+// todo: chainload to reboot payload or payloads folder option?
+
 void ipl_main()
 {
-    config_hw();
-    pivot_stack(IPL_STACK_TOP);
-    heap_init(IPL_HEAP_START);
+	config_hw();
+	pivot_stack(IPL_STACK_TOP);
+	heap_init(IPL_HEAP_START);
 
-    set_default_configuration();
+	set_default_configuration();
 
-    sd_mount();
-    minerva_init();
-    minerva_change_freq(FREQ_1600);
+	sd_mount();
+	minerva_init();
+	minerva_change_freq(FREQ_1600);
 
-    display_init();
-    u32 *fb = display_init_framebuffer();
-    gfx_init_ctxt(fb, 720, 1280, 720);
-    gfx_con_init();
-    display_backlight_pwm_init();
+	display_init();
+	u32 *fb = display_init_framebuffer();
+	gfx_init_ctxt(fb, 720, 1280, 720);
+	gfx_con_init();
+	display_backlight_pwm_init();
 
-    bpmp_clk_rate_set(BPMP_CLK_SUPER_BOOST);
+	bpmp_clk_rate_set(BPMP_CLK_DEFAULT_BOOST);
 
-    h_cfg.emummc_force_disable = emummc_load_cfg();
+	h_cfg.emummc_force_disable = emummc_load_cfg();
 
-    if (b_cfg.boot_cfg & BOOT_CFG_SEPT_RUN)
-    {
-        if (!(b_cfg.extra_cfg & EXTRA_CFG_DUMP_EMUMMC))
-            h_cfg.emummc_force_disable = true;
-        dump_keys();
-    }
+	if (b_cfg.boot_cfg & BOOT_CFG_SEPT_RUN)
+	{
+		if (!(b_cfg.extra_cfg & EXTRA_CFG_DUMP_EMUMMC))
+			h_cfg.emummc_force_disable = true;
+		dump_keys();
+	}
 
-    if (h_cfg.emummc_force_disable)
-    {
-        ment_top[1].type = MENT_CAPTION;
-        ment_top[1].color = 0xFF555555;
-        ment_top[1].handler = NULL;
-    }
+	if (h_cfg.emummc_force_disable)
+	{
+		ment_top[1].type = MENT_CAPTION;
+		ment_top[1].color = 0xFF555555;
+		ment_top[1].handler = NULL;
+	}
 
-    _get_key_generations((char *)ment_top[0].caption, (char *)ment_top[1].caption);
+	_get_key_generations((char *)ment_top[0].caption, (char *)ment_top[1].caption);
 
-    while (true)
-        tui_do_menu(&menu_top);
+	while (true)
+		tui_do_menu(&menu_top);
 
-    while (true)
-        bpmp_halt();
+	while (true)
+		bpmp_halt();
 }

source/mem/heap.c

@@ -17,6 +17,7 @@
 
 #include <string.h>
 #include "heap.h"
+#include "../gfx/gfx.h"
 #include "../../common/common_heap.h"
 
 static void _heap_create(heap_t *heap, u32 start)
@@ -25,12 +26,13 @@ static void _heap_create(heap_t *heap, u32 start)
 	heap->first = NULL;
 }
 
-static u32 _heap_alloc(heap_t *heap, u32 size, u32 alignment)
+// Node info is before node address.
+static u32 _heap_alloc(heap_t *heap, u32 size)
 {
 	hnode_t *node, *new;
-	int search = 1;
 
-	size = ALIGN(size, alignment);
+	// Align to cache line size.
+	size = ALIGN(size, sizeof(hnode_t));
 
 	if (!heap->first)
 	{
@@ -45,26 +47,35 @@ static u32 _heap_alloc(heap_t *heap, u32 size, u32 alignment)
 	}
 
 	node = heap->first;
-	while (search)
+	while (true)
 	{
-		if (!node->used && size + sizeof(hnode_t) < node->size)
+		if (!node->used && (size <= node->size))
 		{
+			u32 new_size = node->size - size;
 			new = (hnode_t *)((u32)node + sizeof(hnode_t) + size);
 
-			new->size = node->size - sizeof(hnode_t) - size;
+			// If there's aligned leftover space, create a new node.
+			if (new_size >= (sizeof(hnode_t) << 2))
+			{
+				new->size = new_size - sizeof(hnode_t);
+				new->used = 0;
+				new->next = node->next;
+				new->next->prev = new;
+				new->prev = node;
+				node->next = new;
+			}
+			else
+				size += new_size;
+
 			node->size = size;
 			node->used = 1;
-			new->used = 0;
-			new->next = node->next;
-			new->prev = node;
-			node->next = new;
 
 			return (u32)node + sizeof(hnode_t);
 		}
 		if (node->next)
 			node = node->next;
 		else
-			search = 0;
+			break;
 	}
 
 	new = (hnode_t *)((u32)node + sizeof(hnode_t) + node->size);
@@ -107,12 +118,12 @@ void heap_init(u32 base)
 
 void *malloc(u32 size)
 {
-	return (void *)_heap_alloc(&_heap, size, sizeof(hnode_t));
+	return (void *)_heap_alloc(&_heap, size);
 }
 
 void *calloc(u32 num, u32 size)
 {
-	void *res = (void *)_heap_alloc(&_heap, num * size, sizeof(hnode_t));
+	void *res = (void *)_heap_alloc(&_heap, num * size);
 	memset(res, 0, num * size);
 	return res;
 }
@@ -122,3 +133,30 @@ void free(void *buf)
 	if ((u32)buf >= _heap.start)
 		_heap_free(&_heap, (u32)buf);
 }
+
+void heap_monitor(heap_monitor_t *mon, bool print_node_stats)
+{
+	u32 count = 0;
+	memset(mon, 0, sizeof(heap_monitor_t));
+
+	hnode_t *node = _heap.first;
+	while (true)
+	{
+		if (node->used)
+			mon->used += node->size + sizeof(hnode_t);
+		else
+			mon->total += node->size + sizeof(hnode_t);
+
+		if (print_node_stats)
+			gfx_printf("%3d - %d, addr: 0x%08X, size: 0x%X\n",
+				count, node->used, (u32)node + sizeof(hnode_t), node->size);
+
+		count++;
+		
+		if (node->next)
+			node = node->next;
+		else
+			break;
+	}
+	mon->total += mon->used;
+}

source/mem/heap.h

@@ -18,10 +18,12 @@
 #define _HEAP_H_
 
 #include "../utils/types.h"
+#include "../../common/common_heap.h"
 
 void heap_init(u32 base);
 void *malloc(u32 size);
 void *calloc(u32 num, u32 size);
 void free(void *buf);
+void heap_monitor(heap_monitor_t *mon, bool print_node_stats);
 
 #endif

source/mem/minerva.c

@@ -26,22 +26,28 @@
 #include "../soc/fuse.h"
 #include "../soc/t210.h"
 
-volatile nyx_storage_t *nyx_str = (nyx_storage_t *)0xED000000;
+extern volatile nyx_storage_t *nyx_str;
 
-void minerva_init()
+u32 minerva_init()
 {
 	u32 curr_ram_idx = 0;
 
 	mtc_config_t *mtc_cfg = (mtc_config_t *)&nyx_str->mtc_cfg;
 
-	// Set table to ram.
-	mtc_cfg->mtc_table = NULL;
+	// Set table to nyx storage.
+	mtc_cfg->mtc_table = (emc_table_t *)&nyx_str->mtc_table;
+
 	mtc_cfg->sdram_id = (fuse_read_odm(4) >> 3) & 0x1F;
+	mtc_cfg->init_done = MTC_NEW_MAGIC; // Initialize mtc table.
+	
 	u32 ep_addr = ianos_loader(false, "bootloader/sys/libsys_minerva.bso", DRAM_LIB, (void *)mtc_cfg);
-	minerva_cfg = (void *)ep_addr;
+
+	// Ensure that Minerva is new.
+	if (mtc_cfg->init_done == MTC_INIT_MAGIC)
+		minerva_cfg = (void *)ep_addr;
 
 	if (!minerva_cfg)
-		return;
+		return 1;
 
 	// Get current frequency
 	for (curr_ram_idx = 0; curr_ram_idx < 10; curr_ram_idx++)
@@ -58,6 +64,17 @@ void minerva_init()
 	minerva_cfg(mtc_cfg, NULL);
 	mtc_cfg->rate_to = 1600000;
 	minerva_cfg(mtc_cfg, NULL);
+
+	// FSP WAR.
+	mtc_cfg->train_mode = OP_SWITCH;
+	mtc_cfg->rate_to = 800000;
+	minerva_cfg(mtc_cfg, NULL);
+
+	// Switch to max.
+	mtc_cfg->rate_to = 1600000;
+	minerva_cfg(mtc_cfg, NULL);
+
+	return 0;
 }
 
 void minerva_change_freq(minerva_freq_t freq)
@@ -66,7 +83,7 @@ void minerva_change_freq(minerva_freq_t freq)
 		return;
 
 	mtc_config_t *mtc_cfg = (mtc_config_t *)&nyx_str->mtc_cfg;
-	if (minerva_cfg && (mtc_cfg->rate_from != freq))
+	if (mtc_cfg->rate_from != freq)
 	{
 		mtc_cfg->rate_to = freq;
 		mtc_cfg->train_mode = OP_SWITCH;
@@ -80,7 +97,7 @@ void minerva_periodic_training()
 		return;
 
 	mtc_config_t *mtc_cfg = (mtc_config_t *)&nyx_str->mtc_cfg;
-	if (minerva_cfg && mtc_cfg->rate_from == FREQ_1600)
+	if (mtc_cfg->rate_from == FREQ_1600)
 	{
 		mtc_cfg->train_mode = OP_PERIODIC_TRAIN;
 		minerva_cfg(mtc_cfg, NULL);

source/mem/minerva.h

@@ -20,7 +20,10 @@
 #include "mtc_table.h"
 #include "../utils/types.h"
 
-#define EMC_PERIODIC_TRAIN_MS 100
+#define MTC_INIT_MAGIC 0x3043544D
+#define MTC_NEW_MAGIC  0x5243544D
+
+#define EMC_PERIODIC_TRAIN_MS 250
 
 typedef struct
 {
@@ -35,6 +38,7 @@ typedef struct
 	bool emc_2X_clk_src_is_pllmb;
 	bool fsp_for_src_freq;
 	bool train_ram_patterns;
+	bool init_done;
 } mtc_config_t;
 
 enum train_mode_t
@@ -54,7 +58,7 @@ typedef enum
 } minerva_freq_t;
 
 void (*minerva_cfg)(mtc_config_t *mtc_cfg, void *);
-void minerva_init();
+u32  minerva_init();
 void minerva_change_freq(minerva_freq_t freq);
 void minerva_periodic_training();
 

source/mem/sdram.c

@@ -16,17 +16,18 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#include "../soc/i2c.h"
-#include "../soc/t210.h"
 #include "mc.h"
 #include "emc.h"
 #include "sdram_param_t210.h"
-#include "../soc/pmc.h"
-#include "../utils/util.h"
-#include "../soc/fuse.h"
+#include "../../common/memory_map.h"
 #include "../power/max77620.h"
 #include "../power/max7762x.h"
 #include "../soc/clock.h"
+#include "../soc/fuse.h"
+#include "../soc/i2c.h"
+#include "../soc/pmc.h"
+#include "../soc/t210.h"
+#include "../utils/util.h"
 
 #define CONFIG_SDRAM_COMPRESS_CFG
 
@@ -50,19 +51,31 @@ static u32 _get_sdram_id()
 
 static void _sdram_config(const sdram_params_t *params)
 {
-	PMC(APBDEV_PMC_IO_DPD3_REQ) = (((4 * params->emc_pmc_scratch1 >> 2) + 0x80000000) ^ 0xFFFF) & 0xC000FFFF;
+	// Program DPD3/DPD4 regs (coldboot path).
+	// Enable sel_dpd on unused pins.
+	u32 dpd_req = (params->emc_pmc_scratch1 & 0x3FFFFFFF) | 0x80000000;
+	PMC(APBDEV_PMC_IO_DPD3_REQ) = (dpd_req ^ 0xFFFF) & 0xC000FFFF;
 	usleep(params->pmc_io_dpd3_req_wait);
 
-	u32 req = (4 * params->emc_pmc_scratch2 >> 2) + 0x80000000;
-	PMC(APBDEV_PMC_IO_DPD4_REQ) = (req >> 16 << 16) ^ 0x3FFF0000;
+	// Disable e_dpd_vttgen.
+	dpd_req = (params->emc_pmc_scratch2 & 0x3FFFFFFF) | 0x80000000;
+	PMC(APBDEV_PMC_IO_DPD4_REQ) = (dpd_req & 0xFFFF0000) ^ 0x3FFF0000;
 	usleep(params->pmc_io_dpd4_req_wait);
-	PMC(APBDEV_PMC_IO_DPD4_REQ) = (req ^ 0xFFFF) & 0xC000FFFF;
+
+	// Disable e_dpd_bg.
+	PMC(APBDEV_PMC_IO_DPD4_REQ) = (dpd_req ^ 0xFFFF) & 0xC000FFFF;
 	usleep(params->pmc_io_dpd4_req_wait);
+
 	PMC(APBDEV_PMC_WEAK_BIAS) = 0;
 	usleep(1);
 
+	// Start clocks.
 	CLOCK(CLK_RST_CONTROLLER_PLLM_MISC1) = params->pllm_setup_control;
 	CLOCK(CLK_RST_CONTROLLER_PLLM_MISC2) = 0;
+
+	// u32 tmp = (params->pllm_feedback_divider << 8) | params->pllm_input_divider | ((params->pllm_post_divider & 0xFFFF) << 20);
+	// CLOCK(CLK_RST_CONTROLLER_PLLM_BASE) = tmp;
+	// CLOCK(CLK_RST_CONTROLLER_PLLM_BASE) = tmp | 0x40000000;
 	CLOCK(CLK_RST_CONTROLLER_PLLM_BASE) = (params->pllm_feedback_divider << 8) | params->pllm_input_divider | 0x40000000 | ((params->pllm_post_divider & 0xFFFF) << 20);
 
 	u32 wait_end = get_tmr_us() + 300;
@@ -72,24 +85,35 @@ static void _sdram_config(const sdram_params_t *params)
 			goto break_nosleep;
 	}
 	usleep(10);
-break_nosleep:
 
+break_nosleep:
 	CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_EMC) = ((params->mc_emem_arb_misc0 >> 11) & 0x10000) | (params->emc_clock_source & 0xFFFEFFFF);
 	if (params->emc_clock_source_dll)
 		CLOCK(CLK_RST_CONTROLLER_CLK_SOURCE_EMC_DLL) = params->emc_clock_source_dll;
 	if (params->clear_clock2_mc1)
 		CLOCK(CLK_RST_CONTROLLER_CLK_ENB_W_CLR) = 0x40000000;
-	CLOCK(CLK_RST_CONTROLLER_CLK_ENB_H_SET) = 0x2000001;
-	CLOCK(CLK_RST_CONTROLLER_CLK_ENB_X_SET) = 0x4000;
-	CLOCK(CLK_RST_CONTROLLER_RST_DEV_H_CLR) = 0x2000001;
+
+	CLOCK(CLK_RST_CONTROLLER_CLK_ENB_H_SET) = 0x2000001; // Enable EMC and MEM clocks.
+	CLOCK(CLK_RST_CONTROLLER_CLK_ENB_X_SET) = 0x4000;    // Enable EMC_DLL clock.
+	CLOCK(CLK_RST_CONTROLLER_RST_DEV_H_CLR) = 0x2000001; // Clear EMC and MEM resets.
+
+	// Set pad macros.
 	EMC(EMC_PMACRO_VTTGEN_CTRL_0) = params->emc_pmacro_vttgen_ctrl0;
 	EMC(EMC_PMACRO_VTTGEN_CTRL_1) = params->emc_pmacro_vttgen_ctrl1;
 	EMC(EMC_PMACRO_VTTGEN_CTRL_2) = params->emc_pmacro_vttgen_ctrl2;
-	EMC(EMC_TIMING_CONTROL) = 1;
-	usleep(1);
+
+	EMC(EMC_TIMING_CONTROL) = 1; // Trigger timing update so above writes take place.
+	usleep(10); // Ensure the regulators settle.
+
+	// Select EMC write mux.
 	EMC(EMC_DBG) = (params->emc_dbg_write_mux << 1) | params->emc_dbg;
+
+	// Patch 2 using BCT spare variables.
 	if (params->emc_bct_spare2)
 		*(vu32 *)params->emc_bct_spare2 = params->emc_bct_spare3;
+
+	// Program CMD mapping. Required before brick mapping, else
+	// we can't guarantee CK will be differential at all times.
 	EMC(EMC_FBIO_CFG7) = params->emc_fbio_cfg7;
 	EMC(EMC_CMD_MAPPING_CMD0_0) = params->emc_cmd_mapping_cmd0_0;
 	EMC(EMC_CMD_MAPPING_CMD0_1) = params->emc_cmd_mapping_cmd0_1;
@@ -104,25 +128,40 @@ break_nosleep:
 	EMC(EMC_CMD_MAPPING_CMD3_1) = params->emc_cmd_mapping_cmd3_1;
 	EMC(EMC_CMD_MAPPING_CMD3_2) = params->emc_cmd_mapping_cmd3_2;
 	EMC(EMC_CMD_MAPPING_BYTE) = params->emc_cmd_mapping_byte;
+
+	// Program brick mapping.
 	EMC(EMC_PMACRO_BRICK_MAPPING_0) = params->emc_pmacro_brick_mapping0;
 	EMC(EMC_PMACRO_BRICK_MAPPING_1) = params->emc_pmacro_brick_mapping1;
 	EMC(EMC_PMACRO_BRICK_MAPPING_2) = params->emc_pmacro_brick_mapping2;
+
 	EMC(EMC_PMACRO_BRICK_CTRL_RFU1) = (params->emc_pmacro_brick_ctrl_rfu1 & 0x1120112) | 0x1EED1EED;
+
+	// This is required to do any reads from the pad macros.
 	EMC(EMC_CONFIG_SAMPLE_DELAY) = params->emc_config_sample_delay;
+
 	EMC(EMC_FBIO_CFG8) = params->emc_fbio_cfg8;
+
+	// Set swizzle for Rank 0.
 	EMC(EMC_SWIZZLE_RANK0_BYTE0) = params->emc_swizzle_rank0_byte0;
 	EMC(EMC_SWIZZLE_RANK0_BYTE1) = params->emc_swizzle_rank0_byte1;
 	EMC(EMC_SWIZZLE_RANK0_BYTE2) = params->emc_swizzle_rank0_byte2;
 	EMC(EMC_SWIZZLE_RANK0_BYTE3) = params->emc_swizzle_rank0_byte3;
+	// Set swizzle for Rank 1.
 	EMC(EMC_SWIZZLE_RANK1_BYTE0) = params->emc_swizzle_rank1_byte0;
 	EMC(EMC_SWIZZLE_RANK1_BYTE1) = params->emc_swizzle_rank1_byte1;
 	EMC(EMC_SWIZZLE_RANK1_BYTE2) = params->emc_swizzle_rank1_byte2;
 	EMC(EMC_SWIZZLE_RANK1_BYTE3) = params->emc_swizzle_rank1_byte3;
+
+	// Patch 4 using BCT spare variables.
 	if (params->emc_bct_spare6)
 		*(vu32 *)params->emc_bct_spare6 = params->emc_bct_spare7;
+
+	// Set pad controls.
 	EMC(EMC_XM2COMPPADCTRL) = params->emc_xm2_comp_pad_ctrl;
 	EMC(EMC_XM2COMPPADCTRL2) = params->emc_xm2_comp_pad_ctrl2;
 	EMC(EMC_XM2COMPPADCTRL3) = params->emc_xm2_comp_pad_ctrl3;
+
+	// Program Autocal controls with shadowed register fields.
 	EMC(EMC_AUTO_CAL_CONFIG2) = params->emc_auto_cal_config2;
 	EMC(EMC_AUTO_CAL_CONFIG3) = params->emc_auto_cal_config3;
 	EMC(EMC_AUTO_CAL_CONFIG4) = params->emc_auto_cal_config4;
@@ -130,6 +169,7 @@ break_nosleep:
 	EMC(EMC_AUTO_CAL_CONFIG6) = params->emc_auto_cal_config6;
 	EMC(EMC_AUTO_CAL_CONFIG7) = params->emc_auto_cal_config7;
 	EMC(EMC_AUTO_CAL_CONFIG8) = params->emc_auto_cal_config8;
+
 	EMC(EMC_PMACRO_RX_TERM) = params->emc_pmacro_rx_term;
 	EMC(EMC_PMACRO_DQ_TX_DRV) = params->emc_pmacro_dq_tx_drive;
 	EMC(EMC_PMACRO_CA_TX_DRV) = params->emc_pmacro_ca_tx_drive;
@@ -137,9 +177,11 @@ break_nosleep:
 	EMC(EMC_PMACRO_AUTOCAL_CFG_COMMON) = params->emc_pmacro_auto_cal_common;
 	EMC(EMC_AUTO_CAL_CHANNEL) = params->emc_auto_cal_channel;
 	EMC(EMC_PMACRO_ZCTRL) = params->emc_pmacro_zcrtl;
+
 	EMC(EMC_DLL_CFG_0) = params->emc_dll_cfg0;
 	EMC(EMC_DLL_CFG_1) = params->emc_dll_cfg1;
 	EMC(EMC_CFG_DIG_DLL_1) = params->emc_cfg_dig_dll_1;
+
 	EMC(EMC_DATA_BRLSHFT_0) = params->emc_data_brlshft0;
 	EMC(EMC_DATA_BRLSHFT_1) = params->emc_data_brlshft1;
 	EMC(EMC_DQS_BRLSHFT_0) = params->emc_dqs_brlshft0;
@@ -152,8 +194,10 @@ break_nosleep:
 	EMC(EMC_QUSE_BRLSHFT_1) = params->emc_quse_brlshft1;
 	EMC(EMC_QUSE_BRLSHFT_2) = params->emc_quse_brlshft2;
 	EMC(EMC_QUSE_BRLSHFT_3) = params->emc_quse_brlshft3;
+
 	EMC(EMC_PMACRO_BRICK_CTRL_RFU1) = (params->emc_pmacro_brick_ctrl_rfu1 & 0x1BF01BF) | 0x1E401E40;
 	EMC(EMC_PMACRO_PAD_CFG_CTRL) = params->emc_pmacro_pad_cfg_ctrl;
+
 	EMC(EMC_PMACRO_CMD_BRICK_CTRL_FDPD) = params->emc_pmacro_cmd_brick_ctrl_fdpd;
 	EMC(EMC_PMACRO_BRICK_CTRL_RFU2) = params->emc_pmacro_brick_ctrl_rfu2 & 0xFF7FFF7F;
 	EMC(EMC_PMACRO_DATA_BRICK_CTRL_FDPD) = params->emc_pmacro_data_brick_ctrl_fdpd;
@@ -164,6 +208,7 @@ break_nosleep:
 	EMC(EMC_PMACRO_DATA_RX_TERM_MODE) = params->emc_pmacro_data_rx_term_mode;
 	EMC(EMC_PMACRO_CMD_RX_TERM_MODE) = params->emc_pmacro_cmd_rx_term_mode;
 	EMC(EMC_PMACRO_CMD_PAD_TX_CTRL) = params->emc_pmacro_cmd_pad_tx_ctrl;
+
 	EMC(EMC_CFG_3) = params->emc_cfg3;
 	EMC(EMC_PMACRO_TX_PWRD_0) = params->emc_pmacro_tx_pwrd0;
 	EMC(EMC_PMACRO_TX_PWRD_1) = params->emc_pmacro_tx_pwrd1;
@@ -189,6 +234,7 @@ break_nosleep:
 	EMC(EMC_PMACRO_IB_VREF_DQS_0) = params->emc_pmacro_ib_vref_dqs_0;
 	EMC(EMC_PMACRO_IB_VREF_DQS_1) = params->emc_pmacro_ib_vref_dqs_1;
 	EMC(EMC_PMACRO_IB_RXRT) = params->emc_pmacro_ib_rxrt;
+
 	EMC(EMC_PMACRO_QUSE_DDLL_RANK0_0) = params->emc_pmacro_quse_ddll_rank0_0;
 	EMC(EMC_PMACRO_QUSE_DDLL_RANK0_1) = params->emc_pmacro_quse_ddll_rank0_1;
 	EMC(EMC_PMACRO_QUSE_DDLL_RANK0_2) = params->emc_pmacro_quse_ddll_rank0_2;
@@ -202,6 +248,7 @@ break_nosleep:
 	EMC(EMC_PMACRO_QUSE_DDLL_RANK1_4) = params->emc_pmacro_quse_ddll_rank1_4;
 	EMC(EMC_PMACRO_QUSE_DDLL_RANK1_5) = params->emc_pmacro_quse_ddll_rank1_5;
 	EMC(EMC_PMACRO_BRICK_CTRL_RFU1) = params->emc_pmacro_brick_ctrl_rfu1;
+
 	EMC(EMC_PMACRO_OB_DDLL_LONG_DQ_RANK0_0) = params->emc_pmacro_ob_ddll_long_dq_rank0_0;
 	EMC(EMC_PMACRO_OB_DDLL_LONG_DQ_RANK0_1) = params->emc_pmacro_ob_ddll_long_dq_rank0_1;
 	EMC(EMC_PMACRO_OB_DDLL_LONG_DQ_RANK0_2) = params->emc_pmacro_ob_ddll_long_dq_rank0_2;
@@ -214,6 +261,7 @@ break_nosleep:
 	EMC(EMC_PMACRO_OB_DDLL_LONG_DQ_RANK1_3) = params->emc_pmacro_ob_ddll_long_dq_rank1_3;
 	EMC(EMC_PMACRO_OB_DDLL_LONG_DQ_RANK1_4) = params->emc_pmacro_ob_ddll_long_dq_rank1_4;
 	EMC(EMC_PMACRO_OB_DDLL_LONG_DQ_RANK1_5) = params->emc_pmacro_ob_ddll_long_dq_rank1_5;
+
 	EMC(EMC_PMACRO_OB_DDLL_LONG_DQS_RANK0_0) = params->emc_pmacro_ob_ddll_long_dqs_rank0_0;
 	EMC(EMC_PMACRO_OB_DDLL_LONG_DQS_RANK0_1) = params->emc_pmacro_ob_ddll_long_dqs_rank0_1;
 	EMC(EMC_PMACRO_OB_DDLL_LONG_DQS_RANK0_2) = params->emc_pmacro_ob_ddll_long_dqs_rank0_2;
@@ -234,6 +282,7 @@ break_nosleep:
 	EMC(EMC_PMACRO_IB_DDLL_LONG_DQS_RANK1_1) = params->emc_pmacro_ib_ddll_long_dqs_rank1_1;
 	EMC(EMC_PMACRO_IB_DDLL_LONG_DQS_RANK1_2) = params->emc_pmacro_ib_ddll_long_dqs_rank1_2;
 	EMC(EMC_PMACRO_IB_DDLL_LONG_DQS_RANK1_3) = params->emc_pmacro_ib_ddll_long_dqs_rank1_3;
+
 	EMC(EMC_PMACRO_DDLL_LONG_CMD_0) = params->emc_pmacro_ddll_long_cmd_0;
 	EMC(EMC_PMACRO_DDLL_LONG_CMD_1) = params->emc_pmacro_ddll_long_cmd_1;
 	EMC(EMC_PMACRO_DDLL_LONG_CMD_2) = params->emc_pmacro_ddll_long_cmd_2;
@@ -242,10 +291,17 @@ break_nosleep:
 	EMC(EMC_PMACRO_DDLL_SHORT_CMD_0) = params->emc_pmacro_ddll_short_cmd_0;
 	EMC(EMC_PMACRO_DDLL_SHORT_CMD_1) = params->emc_pmacro_ddll_short_cmd_1;
 	EMC(EMC_PMACRO_DDLL_SHORT_CMD_2) = params->emc_pmacro_ddll_short_cmd_2;
+
+	// Common pad macro (cpm).
 	EMC(EMC_PMACRO_COMMON_PAD_TX_CTRL) = (params->emc_pmacro_common_pad_tx_ctrl & 1) | 0xE;
+
+	// Patch 3 using BCT spare variables.
 	if (params->emc_bct_spare4)
 		*(vu32 *)params->emc_bct_spare4 = params->emc_bct_spare5;
-	EMC(EMC_TIMING_CONTROL) = 1;
+
+	EMC(EMC_TIMING_CONTROL) = 1; // Trigger timing update so above writes take place.
+
+	// Initialize MC VPR settings.
 	MC(MC_VIDEO_PROTECT_BOM) = params->mc_video_protect_bom;
 	MC(MC_VIDEO_PROTECT_BOM_ADR_HI) = params->mc_video_protect_bom_adr_hi;
 	MC(MC_VIDEO_PROTECT_SIZE_MB) = params->mc_video_protect_size_mb;
@@ -253,20 +309,32 @@ break_nosleep:
 	MC(MC_VIDEO_PROTECT_VPR_OVERRIDE1) = params->mc_video_protect_vpr_override1;
 	MC(MC_VIDEO_PROTECT_GPU_OVERRIDE_0) = params->mc_video_protect_gpu_override0;
 	MC(MC_VIDEO_PROTECT_GPU_OVERRIDE_1) = params->mc_video_protect_gpu_override1;
+
+	// Program SDRAM geometry parameters.
 	MC(MC_EMEM_ADR_CFG) = params->mc_emem_adr_cfg;
 	MC(MC_EMEM_ADR_CFG_DEV0) = params->mc_emem_adr_cfg_dev0;
 	MC(MC_EMEM_ADR_CFG_DEV1) = params->mc_emem_adr_cfg_dev1;
 	MC(MC_EMEM_ADR_CFG_CHANNEL_MASK) = params->mc_emem_adr_cfg_channel_mask;
+
+	// Program bank swizzling.
 	MC(MC_EMEM_ADR_CFG_BANK_MASK_0) = params->mc_emem_adr_cfg_bank_mask0;
 	MC(MC_EMEM_ADR_CFG_BANK_MASK_1) = params->mc_emem_adr_cfg_bank_mask1;
 	MC(MC_EMEM_ADR_CFG_BANK_MASK_2) = params->mc_emem_adr_cfg_bank_mask2;
+
+	// Program external memory aperture (base and size).
 	MC(MC_EMEM_CFG) = params->mc_emem_cfg;
+
+	// Program SEC carveout (base and size).
 	MC(MC_SEC_CARVEOUT_BOM) = params->mc_sec_carveout_bom;
 	MC(MC_SEC_CARVEOUT_ADR_HI) = params->mc_sec_carveout_adr_hi;
 	MC(MC_SEC_CARVEOUT_SIZE_MB) = params->mc_sec_carveout_size_mb;
+
+	// Program MTS carveout (base and size).
 	MC(MC_MTS_CARVEOUT_BOM) = params->mc_mts_carveout_bom;
 	MC(MC_MTS_CARVEOUT_ADR_HI) = params->mc_mts_carveout_adr_hi;
 	MC(MC_MTS_CARVEOUT_SIZE_MB) = params->mc_mts_carveout_size_mb;
+
+	// Program the memory arbiter.
 	MC(MC_EMEM_ARB_CFG) = params->mc_emem_arb_cfg;
 	MC(MC_EMEM_ARB_OUTSTANDING_REQ) = params->mc_emem_arb_outstanding_req;
 	MC(MC_EMEM_ARB_REFPB_HP_CTRL) = params->emc_emem_arb_refpb_hp_ctrl;
@@ -295,21 +363,38 @@ break_nosleep:
 	MC(MC_EMEM_ARB_OVERRIDE_1) = params->mc_emem_arb_override1;
 	MC(MC_EMEM_ARB_RSV) = params->mc_emem_arb_rsv;
 	MC(MC_DA_CONFIG0) = params->mc_da_cfg0;
-	MC(MC_TIMING_CONTROL) = 1;
+
+	MC(MC_TIMING_CONTROL) = 1; // Trigger MC timing update.
+
+	// Program second-level clock enable overrides.
 	MC(MC_CLKEN_OVERRIDE) = params->mc_clken_override;
+
+	// Program statistics gathering.
 	MC(MC_STAT_CONTROL) = params->mc_stat_control;
+
+	// Program SDRAM geometry parameters.
 	EMC(EMC_ADR_CFG) = params->emc_adr_cfg;
+
+	// Program second-level clock enable overrides.
 	EMC(EMC_CLKEN_OVERRIDE) = params->emc_clken_override;
+
+	// Program EMC pad auto calibration.
 	EMC(EMC_PMACRO_AUTOCAL_CFG_0) = params->emc_pmacro_auto_cal_cfg0;
 	EMC(EMC_PMACRO_AUTOCAL_CFG_1) = params->emc_pmacro_auto_cal_cfg1;
 	EMC(EMC_PMACRO_AUTOCAL_CFG_2) = params->emc_pmacro_auto_cal_cfg2;
+
 	EMC(EMC_AUTO_CAL_VREF_SEL_0) = params->emc_auto_cal_vref_sel0;
 	EMC(EMC_AUTO_CAL_VREF_SEL_1) = params->emc_auto_cal_vref_sel1;
+
 	EMC(EMC_AUTO_CAL_INTERVAL) = params->emc_auto_cal_interval;
 	EMC(EMC_AUTO_CAL_CONFIG) = params->emc_auto_cal_config;
 	usleep(params->emc_auto_cal_wait);
+
+	// Patch 5 using BCT spare variables.
 	if (params->emc_bct_spare8)
 		*(vu32 *)params->emc_bct_spare8 = params->emc_bct_spare9;
+
+	// Program EMC timing configuration.
 	EMC(EMC_CFG_2) = params->emc_cfg2;
 	EMC(EMC_CFG_PIPE) = params->emc_cfg_pipe;
 	EMC(EMC_CFG_PIPE_1) = params->emc_cfg_pipe1;
@@ -354,9 +439,11 @@ break_nosleep:
 	EMC(EMC_EINPUT_DURATION) = params->emc_einput_duration;
 	EMC(EMC_PUTERM_EXTRA) = params->emc_puterm_extra;
 	EMC(EMC_PUTERM_WIDTH) = params->emc_puterm_width;
+
 	EMC(EMC_PMACRO_COMMON_PAD_TX_CTRL) = params->emc_pmacro_common_pad_tx_ctrl;
 	EMC(EMC_DBG) = params->emc_dbg;
 	EMC(EMC_QRST) = params->emc_qrst;
+	EMC(EMC_ISSUE_QRST) = 1;
 	EMC(EMC_ISSUE_QRST) = 0;
 	EMC(EMC_QSAFE) = params->emc_qsafe;
 	EMC(EMC_RDV) = params->emc_rdv;
@@ -389,6 +476,8 @@ break_nosleep:
 	EMC(EMC_ODT_WRITE) = params->emc_odt_write;
 	EMC(EMC_CFG_DIG_DLL) = params->emc_cfg_dig_dll;
 	EMC(EMC_CFG_DIG_DLL_PERIOD) = params->emc_cfg_dig_dll_period;
+
+	// Don't write CFG_ADR_EN (bit 1) here - lock bit written later.
 	EMC(EMC_FBIO_SPARE) = params->emc_fbio_spare & 0xFFFFFFFD;
 	EMC(EMC_CFG_RSV) = params->emc_cfg_rsv;
 	EMC(EMC_PMC_SCRATCH1) = params->emc_pmc_scratch1;
@@ -396,70 +485,104 @@ break_nosleep:
 	EMC(EMC_PMC_SCRATCH3) = params->emc_pmc_scratch3;
 	EMC(EMC_ACPD_CONTROL) = params->emc_acpd_control;
 	EMC(EMC_TXDSRVTTGEN) = params->emc_txdsrvttgen;
+
+	// Set pipe bypass enable bits before sending any DRAM commands.
 	EMC(EMC_CFG) = (params->emc_cfg & 0xE) | 0x3C00000;
+
+	// Patch BootROM.
 	if (params->boot_rom_patch_control & (1 << 31))
 	{
 		*(vu32 *)(APB_MISC_BASE + params->boot_rom_patch_control * 4) = params->boot_rom_patch_data;
-		MC(MC_TIMING_CONTROL) = 1;
+		MC(MC_TIMING_CONTROL) = 1; // Trigger MC timing update.
 	}
-	PMC(APBDEV_PMC_IO_DPD3_REQ) = ((4 * params->emc_pmc_scratch1 >> 2) + 0x40000000) & 0xCFFF0000;
+
+	// Release SEL_DPD_CMD.
+	PMC(APBDEV_PMC_IO_DPD3_REQ) = ((params->emc_pmc_scratch1 & 0x3FFFFFFF) | 0x40000000) & 0xCFFF0000;
 	usleep(params->pmc_io_dpd3_req_wait);
+
+	// Set autocal interval if not configured.
 	if (!params->emc_auto_cal_interval)
 		EMC(EMC_AUTO_CAL_CONFIG) = params->emc_auto_cal_config | 0x200;
+
 	EMC(EMC_PMACRO_BRICK_CTRL_RFU2) = params->emc_pmacro_brick_ctrl_rfu2;
+
+	// ZQ CAL setup (not actually issuing ZQ CAL now).
 	if (params->emc_zcal_warm_cold_boot_enables & 1)
 	{
 		if (params->memory_type == 2)
-			EMC(EMC_ZCAL_WAIT_CNT) = 8 * params->emc_zcal_wait_cnt;
+			EMC(EMC_ZCAL_WAIT_CNT) = params->emc_zcal_wait_cnt << 3;
 		if (params->memory_type == 3)
 		{
 			EMC(EMC_ZCAL_WAIT_CNT) = params->emc_zcal_wait_cnt;
 			EMC(EMC_ZCAL_MRW_CMD) = params->emc_zcal_mrw_cmd;
 		}
 	}
-	EMC(EMC_TIMING_CONTROL) = 1;
+
+	EMC(EMC_TIMING_CONTROL) = 1; // Trigger timing update so above writes take place.
 	usleep(params->emc_timing_control_wait);
+
+	// Deassert HOLD_CKE_LOW.
 	PMC(APBDEV_PMC_DDR_CNTRL) &= 0xFFF8007F;
 	usleep(params->pmc_ddr_ctrl_wait);
-	if (params->memory_type == 2)
+
+	// Set clock enable signal.
+	u32 pin_gpio_cfg = (params->emc_pin_gpio_enable << 16) | (params->emc_pin_gpio << 12);
+	if (params->memory_type == 2 || params->memory_type == 3)
 	{
-		EMC(EMC_PIN) = (params->emc_pin_gpio_enable << 16) | (params->emc_pin_gpio << 12);
+		EMC(EMC_PIN) = pin_gpio_cfg;
+		(void)EMC(EMC_PIN);
 		usleep(params->emc_pin_extra_wait + 200);
-		EMC(EMC_PIN) = ((params->emc_pin_gpio_enable << 16) | (params->emc_pin_gpio << 12)) + 256;
-		usleep(params->emc_pin_extra_wait + 500);
+		EMC(EMC_PIN) = pin_gpio_cfg | 0x100;
+		(void)EMC(EMC_PIN);
 	}
+
 	if (params->memory_type == 3)
-	{
-		EMC(EMC_PIN) = (params->emc_pin_gpio_enable << 16) | (params->emc_pin_gpio << 12);
-		usleep(params->emc_pin_extra_wait + 200);
-		EMC(EMC_PIN) = ((params->emc_pin_gpio_enable << 16) | (params->emc_pin_gpio << 12)) + 256;
 		usleep(params->emc_pin_extra_wait + 2000);
-	}
-	EMC(EMC_PIN) = ((params->emc_pin_gpio_enable << 16) | (params->emc_pin_gpio << 12)) + 0x101;
+	else if (params->memory_type == 2)
+		usleep(params->emc_pin_extra_wait + 500);
+
+	// Enable clock enable signal.
+	EMC(EMC_PIN) = pin_gpio_cfg | 0x101;
+	(void)EMC(EMC_PIN);
 	usleep(params->emc_pin_program_wait);
+
+	// Send NOP (trigger just needs to be non-zero).
 	if (params->memory_type != 3)
 		EMC(EMC_NOP) = (params->emc_dev_select << 30) + 1;
+
+	// On coldboot w/LPDDR2/3, wait 200 uSec after asserting CKE high.
 	if (params->memory_type == 1)
 		usleep(params->emc_pin_extra_wait + 200);
+
+	// Init zq calibration,
 	if (params->memory_type == 3)
 	{
+		// Patch 6 using BCT spare variables.
 		if (params->emc_bct_spare10)
 			*(vu32 *)params->emc_bct_spare10 = params->emc_bct_spare11;
+
+		// Write mode registers.
 		EMC(EMC_MRW2) = params->emc_mrw2;
 		EMC(EMC_MRW) = params->emc_mrw1;
 		EMC(EMC_MRW3) = params->emc_mrw3;
 		EMC(EMC_MRW4) = params->emc_mrw4;
 		EMC(EMC_MRW6) = params->emc_mrw6;
 		EMC(EMC_MRW14) = params->emc_mrw14;
+
 		EMC(EMC_MRW8) = params->emc_mrw8;
 		EMC(EMC_MRW12) = params->emc_mrw12;
 		EMC(EMC_MRW9) = params->emc_mrw9;
 		EMC(EMC_MRW13) = params->emc_mrw13;
+
 		if (params->emc_zcal_warm_cold_boot_enables & 1)
 		{
+			// Issue ZQCAL start, device 0.
 			EMC(EMC_ZQ_CAL) = params->emc_zcal_init_dev0;
 			usleep(params->emc_zcal_init_wait);
+
+			// Issue ZQCAL latch.
 			EMC(EMC_ZQ_CAL) = params->emc_zcal_init_dev0 ^ 3;
+			// Same for device 1.
 			if (!(params->emc_dev_select & 2))
 			{
 				EMC(EMC_ZQ_CAL) = params->emc_zcal_init_dev1;
@@ -468,42 +591,64 @@ break_nosleep:
 			}
 		}
 	}
+
+	// Set package and DPD pad control.
 	PMC(APBDEV_PMC_DDR_CFG) = params->pmc_ddr_cfg;
+
+	// Start periodic ZQ calibration (LPDDRx only).
 	if (params->memory_type - 1 <= 2)
 	{
 		EMC(EMC_ZCAL_INTERVAL) = params->emc_zcal_interval;
 		EMC(EMC_ZCAL_WAIT_CNT) = params->emc_zcal_wait_cnt;
 		EMC(EMC_ZCAL_MRW_CMD) = params->emc_zcal_mrw_cmd;
 	}
+
+	// Patch 7 using BCT spare variables.
 	if (params->emc_bct_spare12)
 		*(vu32 *)params->emc_bct_spare12 = params->emc_bct_spare13;
-	EMC(EMC_TIMING_CONTROL) = 1;
+
+	EMC(EMC_TIMING_CONTROL) = 1; // Trigger timing update so above writes take place.
+
 	if (params->emc_extra_refresh_num)
-		EMC(EMC_REF) = ((1 << params->emc_extra_refresh_num << 8) - 0xFD) | (params->emc_pin_gpio << 30);
+		EMC(EMC_REF) = (((1 << params->emc_extra_refresh_num) - 1) << 8) | (params->emc_dev_select << 30) | 3;
+
+	// Enable refresh.
 	EMC(EMC_REFCTRL) = params->emc_dev_select | 0x80000000;
+
 	EMC(EMC_DYN_SELF_REF_CONTROL) = params->emc_dyn_self_ref_control;
 	EMC(EMC_CFG_UPDATE) = params->emc_cfg_update;
 	EMC(EMC_CFG) = params->emc_cfg;
 	EMC(EMC_FDPD_CTRL_DQ) = params->emc_fdpd_ctrl_dq;
 	EMC(EMC_FDPD_CTRL_CMD) = params->emc_fdpd_ctrl_cmd;
 	EMC(EMC_SEL_DPD_CTRL) = params->emc_sel_dpd_ctrl;
+
+	// Write addr swizzle lock bit.
 	EMC(EMC_FBIO_SPARE) = params->emc_fbio_spare | 2;
-	EMC(EMC_TIMING_CONTROL) = 1;
+
+	EMC(EMC_TIMING_CONTROL) = 1; // Re-trigger timing to latch power saving functions.
+
+	// Enable EMC pipe clock gating.
 	EMC(EMC_CFG_PIPE_CLK) = params->emc_cfg_pipe_clk;
+
+	// Depending on freqency, enable CMD/CLK fdpd.
 	EMC(EMC_FDPD_CTRL_CMD_NO_RAMP) = params->emc_fdpd_ctrl_cmd_no_ramp;
-	SYSREG(AHB_ARBITRATION_XBAR_CTRL) = (SYSREG(AHB_ARBITRATION_XBAR_CTRL) & 0xFFFEFFFF) | ((params->ahb_arbitration_xbar_ctrl_meminit_done & 0xFFFF) << 16);
+
+	// Enable arbiter.
+	SYSREG(AHB_ARBITRATION_XBAR_CTRL) = (SYSREG(AHB_ARBITRATION_XBAR_CTRL) & 0xFFFEFFFF) | (params->ahb_arbitration_xbar_ctrl_meminit_done << 16);
+
+	// Lock carveouts per BCT cfg.
 	MC(MC_VIDEO_PROTECT_REG_CTRL) = params->mc_video_protect_write_access;
 	MC(MC_SEC_CARVEOUT_REG_CTRL) = params->mc_sec_carveout_protect_write_access;
 	MC(MC_MTS_CARVEOUT_REG_CTRL) = params->mc_mts_carveout_reg_ctrl;
-	MC(MC_EMEM_CFG_ACCESS_CTRL) = 1; //Disable write access to a bunch of EMC registers.
+
+	//Disable write access to a bunch of EMC registers.
+	MC(MC_EMEM_CFG_ACCESS_CTRL) = 1;
 }
 
 sdram_params_t *sdram_get_params()
 {
-	//TODO: sdram_id should be in [0, 7].
-
 #ifdef CONFIG_SDRAM_COMPRESS_CFG
-	u8 *buf = (u8 *)0x40030000;
+	u8 *buf = (u8 *)SDRAM_PARAMS_ADDR;
 	LZ_Uncompress(_dram_cfg_lz, buf, sizeof(_dram_cfg_lz));
 	return (sdram_params_t *)&buf[sizeof(sdram_params_t) * _get_sdram_id()];
 #else
@@ -535,7 +680,17 @@ sdram_params_t *sdram_get_params_patched()
 	// Disable Warmboot signature check.
 	sdram_params->boot_rom_patch_control = (1 << 31) | (((IPATCH_BASE + 4) - APB_MISC_BASE) / 4);
 	sdram_params->boot_rom_patch_data = IPATCH_CONFIG(0x10459E, 0x2000);
+/*
+	// Disable SBK lock.
+	sdram_params->emc_bct_spare8 = (IPATCH_BASE + 7 * 4);
+	sdram_params->emc_bct_spare9 = IPATCH_CONFIG(0x10210E, 0x2000);
 
+	// Disable bootrom read lock.
+	sdram_params->emc_bct_spare10 = (IPATCH_BASE + 10 * 4);
+	sdram_params->emc_bct_spare11 = IPATCH_CONFIG(0x100FDC, 0xF000);
+	sdram_params->emc_bct_spare12 = (IPATCH_BASE + 11 * 4);
+	sdram_params->emc_bct_spare13 = IPATCH_CONFIG(0x100FDE, 0xE320);
+*/
 	return sdram_params;
 }
 
@@ -544,16 +699,24 @@ void sdram_init()
 	//TODO: sdram_id should be in [0,4].
 	const sdram_params_t *params = (const sdram_params_t *)sdram_get_params();
 
+	// Set DRAM voltage.
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_SD_CFG2, 0x05);
-	max77620_regulator_set_voltage(REGULATOR_SD1, 1100000); // Set DRAM voltage.
+	max77620_regulator_set_voltage(REGULATOR_SD1, 1100000);
 
+	// VDDP Select.
 	PMC(APBDEV_PMC_VDDP_SEL) = params->pmc_vddp_sel;
 	usleep(params->pmc_vddp_sel_wait);
+
+	// Set DDR pad voltage.
 	PMC(APBDEV_PMC_DDR_PWR) = PMC(APBDEV_PMC_DDR_PWR);
+
+	// Turn on MEM IO Power.
 	PMC(APBDEV_PMC_NO_IOPOWER) = params->pmc_no_io_power;
 	PMC(APBDEV_PMC_REG_SHORT) = params->pmc_reg_short;
+
 	PMC(APBDEV_PMC_DDR_CNTRL) = params->pmc_ddr_ctrl;
 
+	// Patch 1 using BCT spare variables
 	if (params->emc_bct_spare0)
 		*(vu32 *)params->emc_bct_spare0 = params->emc_bct_spare1;
 

source/mem/sdram_lp0_param_t210.h

@@ -1,7 +1,7 @@
 /*
  * Copyright (c) 2013-2015, NVIDIA CORPORATION.  All rights reserved.
  * Copyright 2014 Google Inc.
- * Copyright (C) 2018 CTCaer
+ * Copyright (c) 2018 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

source/power/max17050.c

@@ -1,9 +1,9 @@
 /*
  * Fuel gauge driver for Nintendo Switch's Maxim 17050
  *
- * Copyright (C) 2011 Samsung Electronics
+ * Copyright (c) 2011 Samsung Electronics
  * MyungJoo Ham <myungjoo.ham@samsung.com>
- * Copyright (C) 2018 CTCaer
+ * Copyright (c) 2018 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

source/power/max17050.h

@@ -2,9 +2,9 @@
  * Fuel gauge driver for Nintendo Switch's Maxim 17050
  *  Note that Maxim 8966 and 8997 are mfd and this is its subdevice.
  *
- * Copyright (C) 2011 Samsung Electronics
+ * Copyright (c) 2011 Samsung Electronics
  * MyungJoo Ham <myungjoo.ham@samsung.com>
- * Copyright (C) 2018 CTCaer
+ * Copyright (c) 2018 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

source/power/max77620.h

@@ -1,7 +1,7 @@
 /*
  * Defining registers address and its bit definitions of MAX77620 and MAX20024
  *
- * Copyright (C) 2016 NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2016 NVIDIA CORPORATION. All rights reserved.
  * Copyright (c) 2019 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -19,9 +19,19 @@
 #define  MAX77620_CNFGGLBL1_LBDAC_EN          (1 << 7)
 #define  MAX77620_CNFGGLBL1_MPPLD             (1 << 6)
 #define  MAX77620_CNFGGLBL1_LBHYST            ((1 << 5) | (1 << 4))
-#define  MAX77620_CNFGGLBL1_LBHYST_N          (1 << 4)
-#define  MAX77620_CNFGGLBL1_LBDAC             0x0E
-#define  MAX77620_CNFGGLBL1_LBDAC_N           (1 << 1)
+#define  MAX77620_CNFGGLBL1_LBHYST_100        (0 << 4)
+#define  MAX77620_CNFGGLBL1_LBHYST_200        (1 << 4)
+#define  MAX77620_CNFGGLBL1_LBHYST_300        (2 << 4)
+#define  MAX77620_CNFGGLBL1_LBHYST_400        (3 << 4)
+#define  MAX77620_CNFGGLBL1_LBDAC_MASK        0x0E
+#define  MAX77620_CNFGGLBL1_LBDAC_2700        (0 << 1)
+#define  MAX77620_CNFGGLBL1_LBDAC_2800        (1 << 1)
+#define  MAX77620_CNFGGLBL1_LBDAC_2900        (2 << 1)
+#define  MAX77620_CNFGGLBL1_LBDAC_3000        (3 << 1)
+#define  MAX77620_CNFGGLBL1_LBDAC_3100        (4 << 1)
+#define  MAX77620_CNFGGLBL1_LBDAC_3200        (5 << 1)
+#define  MAX77620_CNFGGLBL1_LBDAC_3300        (6 << 1)
+#define  MAX77620_CNFGGLBL1_LBDAC_3400        (7 << 1)
 #define  MAX77620_CNFGGLBL1_LBRSTEN           (1 << 0)
 
 #define MAX77620_REG_CNFGGLBL2      0x01

source/power/max7762x.c

@@ -64,6 +64,16 @@ static const max77620_regulator_t _pmic_regulators[] = {
 	{ REGULATOR_LDO, "ldo8", 0x00,  50000, 800000, 1050000, 1050000, MAX77620_REG_LDO8_CFG, MAX77620_REG_LDO8_CFG2, MAX77620_LDO_VOLT_MASK, MAX77620_LDO_POWER_MODE_MASK, MAX77620_LDO_POWER_MODE_SHIFT, 0x00,  MAX77620_REG_FPS_LDO8, 3, 7, 0 }
 };
 
+static void _max77620_try_set_reg(u8 reg, u8 val)
+{
+	u8 tmp;
+	do
+	{
+		i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, reg, val);
+		tmp = i2c_recv_byte(I2C_5, MAX77620_I2C_ADDR, reg);
+	} while (val != tmp);
+}
+
 int max77620_regulator_get_status(u32 id)
 {
 	if (id > REGULATOR_MAX)
@@ -83,7 +93,7 @@ int max77620_regulator_config_fps(u32 id)
 
 	const max77620_regulator_t *reg = &_pmic_regulators[id];
 
-	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, reg->fps_addr,
+	_max77620_try_set_reg(reg->fps_addr,
 		(reg->fps_src << MAX77620_FPS_SRC_SHIFT) | (reg->pu_period << MAX77620_FPS_PU_PERIOD_SHIFT) | (reg->pd_period));
 
 	return 1;
@@ -102,7 +112,7 @@ int max77620_regulator_set_voltage(u32 id, u32 mv)
 	u32 mult = (mv + reg->mv_step - 1 - reg->mv_min) / reg->mv_step;
 	u8 val = i2c_recv_byte(I2C_5, MAX77620_I2C_ADDR, reg->volt_addr);
 	val = (val & ~reg->volt_mask) | (mult & reg->volt_mask);
-	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, reg->volt_addr, val);
+	_max77620_try_set_reg(reg->volt_addr, val);
 	usleep(1000);
 
 	return 1;
@@ -121,7 +131,7 @@ int max77620_regulator_enable(u32 id, int enable)
 		val = (val & ~reg->enable_mask) | ((MAX77620_POWER_MODE_NORMAL << reg->enable_shift) & reg->enable_mask);
 	else
 		val &= ~reg->enable_mask;
-	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, addr, val);
+	_max77620_try_set_reg(addr, val);
 	usleep(1000);
 
 	return 1;
@@ -139,7 +149,7 @@ int max77620_regulator_set_volt_and_flags(u32 id, u32 mv, u8 flags)
 
 	u32 mult = (mv + reg->mv_step - 1 - reg->mv_min) / reg->mv_step;
 	u8 val = ((flags << reg->enable_shift) & ~reg->volt_mask) | (mult & reg->volt_mask);
-	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, reg->volt_addr, val);
+	_max77620_try_set_reg(reg->volt_addr, val);
 	usleep(1000);
 
 	return 1;
@@ -155,11 +165,12 @@ void max77620_config_default()
 		if (_pmic_regulators[i].fps_src != MAX77620_FPS_SRC_NONE)
 			max77620_regulator_enable(i, 1);
 	}
-	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_SD_CFG2, 4);
+	_max77620_try_set_reg(MAX77620_REG_SD_CFG2, 4);
 }
 
 void max77620_low_battery_monitor_config()
 {
-	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_CNFGGLBL1,
-		MAX77620_CNFGGLBL1_LBDAC_EN | MAX77620_CNFGGLBL1_LBHYST_N | MAX77620_CNFGGLBL1_LBDAC_N);
+	_max77620_try_set_reg(MAX77620_REG_CNFGGLBL1,
+		MAX77620_CNFGGLBL1_LBDAC_EN | MAX77620_CNFGGLBL1_MPPLD |
+		MAX77620_CNFGGLBL1_LBHYST_200 | MAX77620_CNFGGLBL1_LBDAC_2800);
 }

source/sec/se.c

@@ -86,25 +86,23 @@ static int _se_wait()
 	while (!(SE(SE_INT_STATUS_REG_OFFSET) & SE_INT_OP_DONE(INT_SET)))
 		;
 	if (SE(SE_INT_STATUS_REG_OFFSET) & SE_INT_ERROR(INT_SET) ||
-		SE(SE_STATUS_0) & 3 ||
-		SE(SE_ERR_STATUS_0) != 0)
+		SE(SE_STATUS_0) & SE_STATUS_0_STATE_WAIT_IN ||
+		SE(SE_ERR_STATUS_0) != SE_ERR_STATUS_0_SE_NS_ACCESS_CLEAR)
 		return 0;
 	return 1;
 }
 
 static int _se_execute(u32 op, void *dst, u32 dst_size, const void *src, u32 src_size)
 {
-	se_ll_t *ll_dst = NULL, *ll_src = NULL;
+	se_ll_t *ll_dst = (se_ll_t *)0xECFFFFE0, *ll_src = (se_ll_t *)0xECFFFFF0;
 
 	if (dst)
 	{
-		ll_dst = (se_ll_t *)malloc(sizeof(se_ll_t));
 		_se_ll_init(ll_dst, (u32)dst, dst_size);
 	}
 
 	if (src)
 	{
-		ll_src = (se_ll_t *)malloc(sizeof(se_ll_t));
 		_se_ll_init(ll_src, (u32)src, src_size);
 	}
 
@@ -113,17 +111,12 @@ static int _se_execute(u32 op, void *dst, u32 dst_size, const void *src, u32 src
 	SE(SE_ERR_STATUS_0) = SE(SE_ERR_STATUS_0);
 	SE(SE_INT_STATUS_REG_OFFSET) = SE(SE_INT_STATUS_REG_OFFSET);
 
-	bpmp_mmu_maintenance(BPMP_MMU_MAINT_CLN_INV_WAY);
+	bpmp_mmu_maintenance(BPMP_MMU_MAINT_CLN_INV_WAY, false);
 
 	SE(SE_OPERATION_REG_OFFSET) = SE_OPERATION(op);
 	int res = _se_wait();
 
-	bpmp_mmu_maintenance(BPMP_MMU_MAINT_CLN_INV_WAY);
-
-	if (src)
-		free(ll_src);
-	if (dst)
-		free(ll_dst);
+	bpmp_mmu_maintenance(BPMP_MMU_MAINT_CLN_INV_WAY, false);
 
 	return res;
 }
@@ -155,9 +148,11 @@ static void _se_aes_ctr_set(void *ctr)
 
 void se_rsa_acc_ctrl(u32 rs, u32 flags)
 {
-	if (flags & 0x7F)
-		SE(SE_RSA_KEYTABLE_ACCESS_REG_OFFSET + 4 * rs) = (((flags >> 4) & 4) | (flags & 3)) ^ 7;
-	if (flags & 0x80)
+	if (flags & SE_RSA_KEY_TBL_DIS_KEY_ALL_FLAG)
+		SE(SE_RSA_KEYTABLE_ACCESS_REG_OFFSET + 4 * rs) =
+			((flags >> SE_RSA_KEY_TBL_DIS_KEYUSE_FLAG_SHIFT) & SE_RSA_KEY_TBL_DIS_KEYUSE_FLAG) |
+			((flags & SE_RSA_KEY_TBL_DIS_KEY_READ_UPDATE_FLAG) ^ SE_RSA_KEY_TBL_DIS_KEY_ALL_COMMON_FLAG);
+	if (flags & SE_RSA_KEY_TBL_DIS_KEY_LOCK_FLAG)
 		SE(SE_RSA_KEYTABLE_ACCESS_LOCK_OFFSET) &= ~(1 << rs);
 }
 
@@ -223,9 +218,9 @@ int se_rsa_exp_mod(u32 ks, void *dst, u32 dst_size, const void *src, u32 src_siz
 
 void se_key_acc_ctrl(u32 ks, u32 flags)
 {
-	if (flags & 0x7F)
+	if (flags & SE_KEY_TBL_DIS_KEY_ACCESS_FLAG)
 		SE(SE_KEY_TABLE_ACCESS_REG_OFFSET + 4 * ks) = ~flags;
-	if (flags & 0x80)
+	if (flags & SE_KEY_TBL_DIS_KEY_LOCK_FLAG)
 		SE(SE_KEY_TABLE_ACCESS_LOCK_OFFSET) &= ~(1 << ks);
 }
 
@@ -303,7 +298,8 @@ int se_aes_crypt_ctr(u32 ks, void *dst, u32 dst_size, const void *src, u32 src_s
 	SE(SE_SPARE_0_REG_OFFSET) = 1;
 	SE(SE_CONFIG_REG_OFFSET) = SE_CONFIG_ENC_ALG(ALG_AES_ENC) | SE_CONFIG_DST(DST_MEMORY);
 	SE(SE_CRYPTO_REG_OFFSET) = SE_CRYPTO_KEY_INDEX(ks) | SE_CRYPTO_CORE_SEL(CORE_ENCRYPT) |
-		SE_CRYPTO_XOR_POS(XOR_BOTTOM) | SE_CRYPTO_INPUT_SEL(INPUT_LNR_CTR) | SE_CRYPTO_CTR_VAL(1);
+		SE_CRYPTO_XOR_POS(XOR_BOTTOM) | SE_CRYPTO_INPUT_SEL(INPUT_LNR_CTR) | SE_CRYPTO_CTR_VAL(1) |
+		SE_CRYPTO_VCTRAM_SEL(VCTRAM_AHB);
 	_se_aes_ctr_set(ctr);
 
 	u32 src_size_aligned = src_size & 0xFFFFFFF0;
@@ -388,7 +384,9 @@ int se_aes_cmac(u32 ks, void *dst, u32 dst_size, const void *src, u32 src_size)
 		_gf256_mul_x(key);
 
 	SE(SE_CONFIG_REG_OFFSET) = SE_CONFIG_ENC_ALG(ALG_AES_ENC) | SE_CONFIG_DST(DST_HASHREG);
-	SE(SE_CRYPTO_REG_OFFSET) = SE_CRYPTO_KEY_INDEX(ks) | 0x145;
+	SE(SE_CRYPTO_REG_OFFSET) = SE_CRYPTO_KEY_INDEX(ks) | SE_CRYPTO_INPUT_SEL(INPUT_AHB) |
+		SE_CRYPTO_XOR_POS(XOR_TOP) | SE_CRYPTO_VCTRAM_SEL(VCTRAM_AESOUT) | SE_CRYPTO_HASH(HASH_ENABLE) |
+		SE_CRYPTO_CORE_SEL(CORE_ENCRYPT);
 	se_aes_key_iv_clear(ks);
 
 	u32 num_blocks = (src_size + 0xf) >> 4;
@@ -428,15 +426,15 @@ int se_calc_sha256(void *dst, const void *src, u32 src_size)
 	int res;
 	// Setup config for SHA256, size = BITS(src_size).
 	SE(SE_CONFIG_REG_OFFSET) = SE_CONFIG_ENC_MODE(MODE_SHA256) | SE_CONFIG_ENC_ALG(ALG_SHA) | SE_CONFIG_DST(DST_HASHREG);
-	SE(SE_SHA_CONFIG_REG_OFFSET) = SHA_ENABLE;
-	SE(SE_SHA_MSG_LENGTH_REG_OFFSET) = (u32)(src_size << 3);
-	SE(SE_SHA_MSG_LENGTH_REG_OFFSET + 4 * 1) = 0;
-	SE(SE_SHA_MSG_LENGTH_REG_OFFSET + 4 * 2) = 0;
-	SE(SE_SHA_MSG_LENGTH_REG_OFFSET + 4 * 3) = 0;
-	SE(SE_SHA_MSG_LEFT_REG_OFFSET) = (u32)(src_size << 3);
-	SE(SE_SHA_MSG_LEFT_REG_OFFSET + 4 * 1) = 0;
-	SE(SE_SHA_MSG_LEFT_REG_OFFSET + 4 * 2) = 0;
-	SE(SE_SHA_MSG_LEFT_REG_OFFSET + 4 * 3) = 0;
+	SE(SE_SHA_CONFIG_REG_OFFSET) = SHA_INIT_HASH;
+	SE(SE_SHA_MSG_LENGTH_0_REG_OFFSET) = (u32)(src_size << 3);
+	SE(SE_SHA_MSG_LENGTH_1_REG_OFFSET) = 0;
+	SE(SE_SHA_MSG_LENGTH_2_REG_OFFSET) = 0;
+	SE(SE_SHA_MSG_LENGTH_3_REG_OFFSET) = 0;
+	SE(SE_SHA_MSG_LEFT_0_REG_OFFSET) = (u32)(src_size << 3);
+	SE(SE_SHA_MSG_LEFT_1_REG_OFFSET) = 0;
+	SE(SE_SHA_MSG_LEFT_2_REG_OFFSET) = 0;
+	SE(SE_SHA_MSG_LEFT_3_REG_OFFSET) = 0;
 
 	// Trigger the operation.
 	res = _se_execute(OP_START, NULL, 0, src, src_size);
@@ -448,3 +446,46 @@ int se_calc_sha256(void *dst, const void *src, u32 src_size)
 
 	return res;
 }
+
+int se_calc_hmac_sha256(void *dst, const void *src, u32 src_size, const void *key, u32 key_size) {
+	int res = 0;
+	u8 *secret = (u8 *)malloc(0x40);
+	u8 *ipad = (u8 *)malloc(0x40 + src_size);
+	u8 *opad = (u8 *)malloc(0x60);
+
+	if (key_size > 0x40)
+	{
+		if (!se_calc_sha256(secret, key, key_size))
+			goto out;
+		memset(secret + 0x20, 0, 0x20);
+	}
+	else
+	{
+		memcpy(secret, key, key_size);
+		memset(secret + key_size, 0, 0x40 - key_size);
+	}
+
+	u32 *secret32 = (u32 *)secret;
+	u32 *ipad32 = (u32 *)ipad;
+	u32 *opad32 = (u32 *)opad;
+	for (u32 i = 0; i < 0x10; i++)
+	{
+		ipad32[i] = secret32[i] ^ 0x36363636;
+		opad32[i] = secret32[i] ^ 0x5C5C5C5C;
+	}
+
+	memcpy(ipad + 0x40, src, src_size);
+	if (!se_calc_sha256(dst, ipad, 0x40 + src_size))
+		goto out;
+	memcpy(opad + 0x40, dst, 0x20);
+	if (!se_calc_sha256(dst, opad, 0x60))
+		goto out;
+
+	res = 1;
+
+out:;
+	free(secret);
+	free(ipad);
+	free(opad);
+	return res;
+}

source/sec/se.h

@@ -35,5 +35,6 @@ int se_aes_xts_crypt_sec(u32 ks1, u32 ks2, u32 enc, u64 sec, void *dst, const vo
 int se_aes_xts_crypt(u32 ks1, u32 ks2, u32 enc, u64 sec, void *dst, const void *src, u32 secsize, u32 num_secs);
 int se_aes_cmac(u32 ks, void *dst, u32 dst_size, const void *src, u32 src_size);
 int se_calc_sha256(void *dst, const void *src, u32 src_size);
+int se_calc_hmac_sha256(void *dst, const void *src, u32 src_size, const void *key, u32 key_size);
 
 #endif

source/sec/se_t210.h

@@ -36,6 +36,8 @@
 #define SE_SECURITY_0 0x000
 #define SE_KEY_SCHED_READ_SHIFT 3
 
+#define SE_TZRAM_SECURITY_0 0x004
+
 #define SE_CONFIG_REG_OFFSET		0x014
 #define SE_CONFIG_ENC_ALG_SHIFT		12
 #define SE_CONFIG_DEC_ALG_SHIFT		8
@@ -209,8 +211,12 @@
 #define SE_INT_OP_DONE(x)			(x << SE_INT_OP_DONE_SHIFT)
 #define SE_INT_ERROR_SHIFT		16
 #define SE_INT_ERROR(x)			(x << SE_INT_ERROR_SHIFT)
+
 #define SE_STATUS_0 0x800
+#define SE_STATUS_0_STATE_WAIT_IN 3
+
 #define SE_ERR_STATUS_0			0x804
+#define SE_ERR_STATUS_0_SE_NS_ACCESS_CLEAR 0
 
 #define SE_CRYPTO_KEYTABLE_DST_REG_OFFSET	0X330
 #define SE_CRYPTO_KEYTABLE_DST_WORD_QUAD_SHIFT		0
@@ -231,11 +237,17 @@
 #define SE_SPARE_0_REG_OFFSET		0x80c
 
 #define SE_SHA_CONFIG_REG_OFFSET	0x200
-#define SHA_DISABLE		0
-#define SHA_ENABLE		1
+#define  SHA_CONTINUE  0
+#define  SHA_INIT_HASH 1
 
-#define SE_SHA_MSG_LENGTH_REG_OFFSET	0x204
-#define SE_SHA_MSG_LEFT_REG_OFFSET		0x214
+#define SE_SHA_MSG_LENGTH_0_REG_OFFSET	0x204
+#define SE_SHA_MSG_LENGTH_1_REG_OFFSET	0x208
+#define SE_SHA_MSG_LENGTH_2_REG_OFFSET	0x20C
+#define SE_SHA_MSG_LENGTH_3_REG_OFFSET	0x210
+#define SE_SHA_MSG_LEFT_0_REG_OFFSET	0x214
+#define SE_SHA_MSG_LEFT_1_REG_OFFSET	0x218
+#define SE_SHA_MSG_LEFT_2_REG_OFFSET	0x21C
+#define SE_SHA_MSG_LEFT_3_REG_OFFSET	0x220
 
 #define SE_HASH_RESULT_REG_COUNT	16
 #define SE_HASH_RESULT_REG_OFFSET	0x030
@@ -254,13 +266,24 @@
 						TEGRA_SE_RNG_DT_SIZE)
 
 #define TEGRA_SE_AES_CMAC_DIGEST_SIZE	16
-#define TEGRA_SE_RSA512_DIGEST_SIZE	64
+#define TEGRA_SE_RSA512_DIGEST_SIZE	    64
 #define TEGRA_SE_RSA1024_DIGEST_SIZE	128
 #define TEGRA_SE_RSA1536_DIGEST_SIZE	192
 #define TEGRA_SE_RSA2048_DIGEST_SIZE	256
 
 #define SE_KEY_TABLE_ACCESS_LOCK_OFFSET	0x280
+#define SE_KEY_TBL_DIS_KEY_LOCK_FLAG 0x80
+
 #define SE_KEY_TABLE_ACCESS_REG_OFFSET	0x284
+#define SE_KEY_TBL_DIS_KEYREAD_FLAG    (1 << 0)
+#define SE_KEY_TBL_DIS_KEYUPDATE_FLAG  (1 << 1)
+#define SE_KEY_TBL_DIS_OIVREAD_FLAG    (1 << 2)
+#define SE_KEY_TBL_DIS_OIVUPDATE_FLAG  (1 << 3)
+#define SE_KEY_TBL_DIS_UIVREAD_FLAG    (1 << 4)
+#define SE_KEY_TBL_DIS_UIVUPDATE_FLAG  (1 << 5)
+#define SE_KEY_TBL_DIS_KEYUSE_FLAG     (1 << 6)
+#define SE_KEY_TBL_DIS_KEY_ACCESS_FLAG 0x7F
+
 #define SE_KEY_READ_DISABLE_SHIFT		0
 #define SE_KEY_UPDATE_DISABLE_SHIFT		1
 
@@ -312,7 +335,16 @@
 #define TEGRA_SE_RSA_KEYSLOT_COUNT		2
 
 #define SE_RSA_KEYTABLE_ACCESS_LOCK_OFFSET	0x40C
+#define SE_RSA_KEY_TBL_DIS_KEY_LOCK_FLAG    0x80
+
 #define SE_RSA_KEYTABLE_ACCESS_REG_OFFSET	0x410
+#define SE_RSA_KEY_TBL_DIS_KEYREAD_FLAG         (1 << 0)
+#define SE_RSA_KEY_TBL_DIS_KEYUPDATE_FLAG       (1 << 1)
+#define SE_RSA_KEY_TBL_DIS_KEY_READ_UPDATE_FLAG (SE_RSA_KEY_TBL_DIS_KEYREAD_FLAG | SE_RSA_KEY_TBL_DIS_KEYUPDATE_FLAG)
+#define SE_RSA_KEY_TBL_DIS_KEYUSE_FLAG          (1 << 2)
+#define SE_RSA_KEY_TBL_DIS_KEYUSE_FLAG_SHIFT    (1 << 2)
+#define SE_RSA_KEY_TBL_DIS_KEY_ALL_COMMON_FLAG  7
+#define SE_RSA_KEY_TBL_DIS_KEY_ALL_FLAG        0x7F
 
 #define SE_RSA_KEYTABLE_ADDR	0x420
 #define SE_RSA_KEYTABLE_DATA	0x424

source/sec/tsec.c

@@ -23,6 +23,7 @@
 #include "../sec/se_t210.h"
 #include "../soc/bpmp.h"
 #include "../soc/clock.h"
+#include "../soc/kfuse.h"
 #include "../soc/smmu.h"
 #include "../soc/t210.h"
 #include "../mem/heap.h"
@@ -77,6 +78,8 @@ int tsec_query(u8 *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 	clock_enable_sor1();
 	clock_enable_kfuse();
 
+	kfuse_wait_ready();
+
 	//Configure Falcon.
 	TSEC(TSEC_DMACTL) = 0;
 	TSEC(TSEC_IRQMSET) =
@@ -208,7 +211,7 @@ int tsec_query(u8 *tsec_keys, u8 kb, tsec_ctxt_t *tsec_ctxt)
 			res = -6;
 			smmu_deinit_for_tsec();
 
-			goto out;
+			goto out_free;
 		}
 
 		// Give some extra time to make sure PKG1.1 is decrypted.
@@ -278,7 +281,7 @@ out:;
 	clock_disable_sor_safe();
 	clock_disable_tsec();
 	bpmp_mmu_enable();
-	bpmp_clk_rate_set(BPMP_CLK_SUPER_BOOST);
+	bpmp_clk_rate_set(BPMP_CLK_DEFAULT_BOOST);
 
 	return res;
 }

source/soc/bpmp.c

@@ -19,6 +19,7 @@
 #include "bpmp.h"
 #include "clock.h"
 #include "t210.h"
+#include "../../common/memory_map.h"
 #include "../utils/util.h"
 
 #define BPMP_CACHE_CONFIG               0x0
@@ -74,13 +75,13 @@
 
 bpmp_mmu_entry_t mmu_entries[] =
 {
-	{ 0x80000000,    0xFFFFFFFF, MMU_EN_READ | MMU_EN_WRITE | MMU_EN_EXEC | MMU_EN_CACHED, true },
-	{ IPL_LOAD_ADDR, 0x40040000, MMU_EN_READ | MMU_EN_WRITE | MMU_EN_EXEC | MMU_EN_CACHED, true }
+	{ DRAM_START, 0xFFFFFFFF, MMU_EN_READ | MMU_EN_WRITE | MMU_EN_EXEC | MMU_EN_CACHED, true },
+	{ IRAM_BASE,  0x4003FFFF, MMU_EN_READ | MMU_EN_WRITE | MMU_EN_EXEC | MMU_EN_CACHED, true }
 };
 
-void bpmp_mmu_maintenance(u32 op)
+void bpmp_mmu_maintenance(u32 op, bool force)
 {
-	if (!(BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE))
+	if (!force && !(BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) & CFG_ENABLE))
 		return;
 
 	BPMP_CACHE_CTRL(BPMP_CACHE_INT_CLEAR) = INT_CLR_MAINT_DONE;
@@ -132,13 +133,13 @@ void bpmp_mmu_enable()
 	BPMP_CACHE_CTRL(BPMP_CACHE_MMU_CMD) = MMU_CMD_COPY_SHADOW;
 
 	// Invalidate cache.
-	bpmp_mmu_maintenance(BPMP_MMU_MAINT_INVALID_WAY);
+	bpmp_mmu_maintenance(BPMP_MMU_MAINT_INVALID_WAY, true);
 
 	// Enable cache.
 	BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) = CFG_ENABLE | CFG_FORCE_WRITE_THROUGH | CFG_TAG_CHK_ABRT_ON_ERR;
 
 	// HW bug. Invalidate cache again.
-	bpmp_mmu_maintenance(BPMP_MMU_MAINT_INVALID_WAY);
+	bpmp_mmu_maintenance(BPMP_MMU_MAINT_INVALID_WAY, false);
 }
 
 void bpmp_mmu_disable()
@@ -147,21 +148,19 @@ void bpmp_mmu_disable()
 		return;
 
 	// Clean and invalidate cache.
-	bpmp_mmu_maintenance(BPMP_MMU_MAINT_CLN_INV_WAY);
+	bpmp_mmu_maintenance(BPMP_MMU_MAINT_CLN_INV_WAY, false);
 
 	// Disable cache.
 	BPMP_CACHE_CTRL(BPMP_CACHE_CONFIG) = 0;
-
-	// HW bug. Invalidate cache again.
-	bpmp_mmu_maintenance(BPMP_MMU_MAINT_INVALID_WAY);
 }
 
 const u8 pllc4_divn[] = {
 	0,   // BPMP_CLK_NORMAL:      408MHz  0% - 136MHz APB.
-	85,  // BPMP_CLK_LOW_BOOST:   544MHz 33% - 136MHz APB.
-	90,  // BPMP_CLK_MID_BOOST:   576MHz 41% - 144MHz APB.
-	94   // BPMP_CLK_SUPER_BOOST: 602MHz 48% - 150MHz APB.
-	//95   // BPMP_CLK_SUPER_BOOST: 608MHz 49% - 152MHz APB.
+	85,  // BPMP_CLK_HIGH_BOOST:  544MHz 33% - 136MHz APB.
+	90,  // BPMP_CLK_SUPER_BOOST: 576MHz 41% - 144MHz APB.
+	92   // BPMP_CLK_HYPER_BOOST: 589MHz 44% - 147MHz APB.
+	// Do not use for public releases!
+	//95   // BPMP_CLK_DEV_BOOST: 608MHz 49% - 152MHz APB.
 };
 
 bpmp_freq_t bpmp_clock_set = BPMP_CLK_NORMAL;

source/soc/bpmp.h

@@ -36,13 +36,16 @@ typedef struct _bpmp_mmu_entry_t
 typedef enum
 {
 	BPMP_CLK_NORMAL,      // 408MHz  0% - 136MHz APB.
-	BPMP_CLK_LOW_BOOST,   // 544MHz 33% - 136MHz APB.
-	BPMP_CLK_MID_BOOST,   // 576MHz 41% - 144MHz APB.
-	BPMP_CLK_SUPER_BOOST, // 608MHz 49% - 152MHz APB.
+	BPMP_CLK_HIGH_BOOST,  // 544MHz 33% - 136MHz APB.
+	BPMP_CLK_SUPER_BOOST, // 576MHz 41% - 144MHz APB.
+	BPMP_CLK_HYPER_BOOST, // 589MHz 44% - 147MHz APB.
+	//BPMP_CLK_DEV_BOOST, // 608MHz 49% - 152MHz APB.
 	BPMP_CLK_MAX
 } bpmp_freq_t;
 
-void bpmp_mmu_maintenance(u32 op);
+#define BPMP_CLK_DEFAULT_BOOST BPMP_CLK_HYPER_BOOST
+
+void bpmp_mmu_maintenance(u32 op, bool force);
 void bpmp_mmu_set_entry(int idx, bpmp_mmu_entry_t *entry, bool apply);
 void bpmp_mmu_enable();
 void bpmp_mmu_disable();

source/soc/clock.c

@@ -29,13 +29,14 @@ static const clock_t _clock_uart[] = {
 /* UART E */ { CLK_RST_CONTROLLER_RST_DEVICES_Y, CLK_RST_CONTROLLER_CLK_OUT_ENB_Y, CLK_RST_CONTROLLER_CLK_SOURCE_UARTAPE, 20, 0, 2 }
 };
 
+//I2C default parameters - TLOW: 4, THIGH: 2, DEBOUNCE: 0 FM_DIV: 26.
 static const clock_t _clock_i2c[] = {
-/* I2C1 */ { CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_I2C1, 12, 6, 0 }, // 0, 19 }, // 100KHz
-/* I2C2 */ { 0 },
-/* I2C3 */ { 0 },
-/* I2C4 */ { 0 },
-/* I2C5 */ { CLK_RST_CONTROLLER_RST_DEVICES_H, CLK_RST_CONTROLLER_CLK_OUT_ENB_H, CLK_RST_CONTROLLER_CLK_SOURCE_I2C5, 15, 6, 0 }, // 0, 4 },  // 400KHz
-/* I2C6 */ { 0 }
+/* I2C1 */ { CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_I2C1, 12, 0, 19 }, //20.4MHz -> 100KHz
+/* I2C2 */ { CLK_RST_CONTROLLER_RST_DEVICES_H, CLK_RST_CONTROLLER_CLK_OUT_ENB_H, CLK_RST_CONTROLLER_CLK_SOURCE_I2C2, 22, 0, 4  }, //81.6MHz -> 400KHz
+/* I2C3 */ { CLK_RST_CONTROLLER_RST_DEVICES_U, CLK_RST_CONTROLLER_CLK_OUT_ENB_U, CLK_RST_CONTROLLER_CLK_SOURCE_I2C3, 3,  0, 4  }, //81.6MHz -> 400KHz
+/* I2C4 */ { CLK_RST_CONTROLLER_RST_DEVICES_V, CLK_RST_CONTROLLER_CLK_OUT_ENB_V, CLK_RST_CONTROLLER_CLK_SOURCE_I2C4, 7,  0, 19 }, //20.4MHz -> 100KHz
+/* I2C5 */ { CLK_RST_CONTROLLER_RST_DEVICES_H, CLK_RST_CONTROLLER_CLK_OUT_ENB_H, CLK_RST_CONTROLLER_CLK_SOURCE_I2C5, 15, 0, 4  }, //81.6MHz -> 400KHz
+/* I2C6 */ { CLK_RST_CONTROLLER_RST_DEVICES_X, CLK_RST_CONTROLLER_CLK_OUT_ENB_X, CLK_RST_CONTROLLER_CLK_SOURCE_I2C6, 6,  0, 19 }  //20.4MHz -> 100KHz
 };
 
 static clock_t _clock_se = {
@@ -73,7 +74,7 @@ static clock_t _clock_coresight = {
 };
 
 static clock_t _clock_pwm = {
-	CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_PWM,    17, 6, 4 // Freference: 6.2MHz.
+	CLK_RST_CONTROLLER_RST_DEVICES_L, CLK_RST_CONTROLLER_CLK_OUT_ENB_L, CLK_RST_CONTROLLER_CLK_SOURCE_PWM,    17, 6, 4 // Fref: 6.2MHz.
 };
 
 void clock_enable(const clock_t *clk)
@@ -87,6 +88,8 @@ void clock_enable(const clock_t *clk)
 		CLOCK(clk->source) = clk->clk_div | (clk->clk_src << 29);
 	// Enable.
 	CLOCK(clk->enable) = (CLOCK(clk->enable) & ~(1 << clk->index)) | (1 << clk->index);
+	usleep(2);
+
 	// Take clock off reset.
 	CLOCK(clk->reset) &= ~(1 << clk->index);
 }
@@ -366,7 +369,7 @@ static void _clock_sdmmc_clear_enable(u32 id)
 static u32 _clock_sdmmc_table[8] = { 0 };
 
 #define PLLP_OUT0      0x0
-static int _clock_sdmmc_config_clock_source_inner(u32 *pout, u32 id, u32 val)
+static int _clock_sdmmc_config_clock_host(u32 *pout, u32 id, u32 val)
 {
 	u32 divisor = 0;
 	u32 source = PLLP_OUT0;
@@ -414,6 +417,7 @@ static int _clock_sdmmc_config_clock_source_inner(u32 *pout, u32 id, u32 val)
 	_clock_sdmmc_table[2 * id] = val;
 	_clock_sdmmc_table[2 * id + 1] = *pout;
 
+	// Set SDMMC clock.
 	switch (id)
 	{
 	case SDMMC_1:
@@ -444,15 +448,16 @@ void clock_sdmmc_config_clock_source(u32 *pout, u32 id, u32 val)
 		int is_enabled = _clock_sdmmc_is_enabled(id);
 		if (is_enabled)
 			_clock_sdmmc_clear_enable(id);
-		_clock_sdmmc_config_clock_source_inner(pout, id, val);
+		_clock_sdmmc_config_clock_host(pout, id, val);
 		if (is_enabled)
 			_clock_sdmmc_set_enable(id);
 		_clock_sdmmc_is_reset(id);
 	}
 }
 
-void clock_sdmmc_get_params(u32 *pout, u16 *pdivisor, u32 type)
+void clock_sdmmc_get_card_clock_div(u32 *pout, u16 *pdivisor, u32 type)
 {
+	// Get Card clock divisor.
 	switch (type)
 	{
 	case 0:
@@ -513,7 +518,7 @@ void clock_sdmmc_enable(u32 id, u32 val)
 	if (_clock_sdmmc_is_enabled(id))
 		_clock_sdmmc_clear_enable(id);
 	_clock_sdmmc_set_reset(id);
-	_clock_sdmmc_config_clock_source_inner(&div, id, val);
+	_clock_sdmmc_config_clock_host(&div, id, val);
 	_clock_sdmmc_set_enable(id);
 	_clock_sdmmc_is_reset(id);
 	usleep((100000 + div - 1) / div);

source/soc/clock.h

@@ -104,6 +104,7 @@
 #define CLK_RST_CONTROLLER_CLK_SOURCE_SYS 0x400
 #define CLK_RST_CONTROLLER_CLK_SOURCE_SOR1 0x410
 #define CLK_RST_CONTROLLER_CLK_SOURCE_SE 0x42C
+#define CLK_RST_CONTROLLER_RST_DEV_V_CLR 0x434
 #define CLK_RST_CONTROLLER_CLK_ENB_V_SET 0x440
 #define CLK_RST_CONTROLLER_CLK_ENB_V_CLR 0x444
 #define CLK_RST_CONTROLLER_CLK_ENB_W_SET 0x448
@@ -181,7 +182,7 @@ void clock_disable_coresight();
 void clock_enable_pwm();
 void clock_disable_pwm();
 void clock_sdmmc_config_clock_source(u32 *pout, u32 id, u32 val);
-void clock_sdmmc_get_params(u32 *pout, u16 *pdivisor, u32 type);
+void clock_sdmmc_get_card_clock_div(u32 *pout, u16 *pdivisor, u32 type);
 int clock_sdmmc_is_not_reset_and_enabled(u32 id);
 void clock_sdmmc_enable(u32 id, u32 val);
 void clock_sdmmc_disable(u32 id);

source/soc/cluster.c

@@ -80,9 +80,9 @@ void cluster_boot_cpu0(u32 entry)
 
 	_cluster_enable_power();
 
-	if (!(CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) & 0x40000000))
+	if (!(CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) & 0x40000000)) // PLLX_ENABLE.
 	{
-		CLOCK(CLK_RST_CONTROLLER_PLLX_MISC_3) &= 0xFFFFFFF7;
+		CLOCK(CLK_RST_CONTROLLER_PLLX_MISC_3) &= 0xFFFFFFF7; // Disable IDDQ.
 		usleep(2);
 		CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) = 0x80404E02;
 		CLOCK(CLK_RST_CONTROLLER_PLLX_BASE) = 0x404E02;
@@ -127,6 +127,9 @@ void cluster_boot_cpu0(u32 entry)
 	SB(SB_CSR) = SB_CSR_NS_RST_VEC_WR_DIS;
 	(void)SB(SB_CSR);
 
+	// Tighten up the security aperture.
+	// MC(MC_TZ_SECURITY_CTRL) = 1;
+
 	// Clear MSELECT reset.
 	CLOCK(CLK_RST_CONTROLLER_RST_DEVICES_V) &= 0xFFFFFFF7;
 	// Clear NONCPU reset.

source/soc/fuse.c

@@ -22,6 +22,34 @@
 #include "../soc/fuse.h"
 #include "../soc/t210.h"
 
+#define ARRAYSIZE(x) (sizeof(x) / sizeof(*x))
+
+static const u32 evp_thunk_template[] = {
+	0xe92d0007, //   STMFD   SP!, {R0-R2}
+	0xe1a0200e, //   MOV     R2, LR
+	0xe2422002, //   SUB     R2, R2, #2
+	0xe5922000, //   LDR     R2, [R2]
+	0xe20220ff, //   AND     R2, R2, #0xFF
+	0xe1a02082, //   MOV     R2, R2,LSL#1
+	0xe59f001c, //   LDR     R0, =evp_thunk_template
+	0xe59f101c, //   LDR     R1, =thunk_end
+	0xe0411000, //   SUB     R1, R1, R0
+	0xe59f0018, //   LDR     R0, =iram_evp_thunks
+	0xe0800001, //   ADD     R0, R0, R1
+	0xe0822000, //   ADD     R2, R2, R0
+	0xe3822001, //   ORR     R2, R2, #1
+	0xe8bd0003, //   LDMFD   SP!, {R0,R1}
+	0xe12fff12, //   BX      R2
+	0x001007b0, // off_1007EC DCD evp_thunk_template
+	0x001007f8, // off_1007F0 DCD thunk_end
+	0x40004c30, // off_1007F4 DCD iram_evp_thunks
+	// thunk_end is here
+};
+static const u32 evp_thunk_template_len = sizeof(evp_thunk_template);
+
+// treated as 12bit values
+static const u32 hash_vals[] = {1, 2, 4, 8, 0, 3, 5, 6, 7, 9, 10, 11};
+
 void fuse_disable_program()
 {
 	FUSE(FUSE_DISABLEREGPROGRAM) = 1;
@@ -31,3 +59,291 @@ u32 fuse_read_odm(u32 idx)
 {
 	return FUSE(FUSE_RESERVED_ODMX(idx));
 }
+
+void fuse_wait_idle()
+{
+	u32 ctrl;
+	do
+	{
+		ctrl = FUSE(FUSE_CTRL);
+	} while (((ctrl >> 16) & 0x1f) != 4);
+}
+
+u32 fuse_read(u32 addr)
+{
+	FUSE(FUSE_ADDR) = addr;
+	FUSE(FUSE_CTRL) = (FUSE(FUSE_ADDR) & ~FUSE_CMD_MASK) | FUSE_READ;
+	fuse_wait_idle();
+	return FUSE(FUSE_RDATA);
+}
+
+void fuse_read_array(u32 *words)
+{
+	for (u32 i = 0; i < 192; i++)
+		words[i] = fuse_read(i);
+}
+
+static u32 _parity32_even(u32 *words, u32 count)
+{
+	u32 acc = words[0];
+	for (u32 i = 1; i < count; i++)
+	{
+		acc ^= words[i];
+	}
+	u32 lo = ((acc & 0xffff) ^ (acc >> 16)) & 0xff;
+	u32 hi = ((acc & 0xffff) ^ (acc >> 16)) >> 8;
+	u32 x = hi ^ lo;
+	lo = ((x & 0xf) ^ (x >> 4)) & 3;
+	hi = ((x & 0xf) ^ (x >> 4)) >> 2;
+	x = hi ^ lo;
+
+	return (x & 1) ^ (x >> 1);
+}
+
+static int _patch_hash_one(u32 *word)
+{
+	u32 bits20_31 = *word & 0xfff00000;
+	u32 parity_bit = _parity32_even(&bits20_31, 1);
+	u32 hash = 0;
+	for (u32 i = 0; i < 12; i++)
+	{
+		if (*word & (1 << (20 + i)))
+		{
+			hash ^= hash_vals[i];
+		}
+	}
+	if (hash == 0)
+	{
+		if (parity_bit == 0)
+		{
+			return 0;
+		}
+		*word ^= 1 << 24;
+		return 1;
+	}
+	if (parity_bit == 0)
+	{
+		return 3;
+	}
+	for (u32 i = 0; i < ARRAYSIZE(hash_vals); i++)
+	{
+		if (hash_vals[i] == hash)
+		{
+			*word ^= 1 << (20 + i);
+			return 1;
+		}
+	}
+	return 2;
+}
+
+static int _patch_hash_multi(u32 *words, u32 count)
+{
+	u32 parity_bit = _parity32_even(words, count);
+	u32 bits0_14 = words[0] & 0x7fff;
+	u32 bit15 = words[0] & 0x8000;
+	u32 bits16_19 = words[0] & 0xf0000;
+
+	u32 hash = 0;
+	words[0] = bits16_19;
+	for (u32 i = 0; i < count; i++)
+	{
+		u32 w = words[i];
+		if (w)
+		{
+			for (u32 bitpos = 0; bitpos < 32; bitpos++)
+			{
+				if ((w >> bitpos) & 1)
+				{
+					hash ^= 0x4000 + i * 32 + bitpos;
+				}
+			}
+		}
+	}
+	hash ^= bits0_14;
+	// stupid but this is what original code does.
+	// equivalent to original words[0] &= 0xfff00000
+	words[0] = bits16_19 ^ bit15 ^ bits0_14;
+
+	if (hash == 0)
+	{
+		if (parity_bit == 0)
+		{
+			return 0;
+		}
+		words[0] ^= 0x8000;
+		return 1;
+	}
+	if (parity_bit == 0)
+	{
+		return 3;
+	}
+	u32 bitcount = hash - 0x4000;
+	if (bitcount < 16 || bitcount >= count * 32)
+	{
+		u32 num_set = 0;
+		for (u32 bitpos = 0; bitpos < 15; bitpos++)
+		{
+			if ((hash >> bitpos) & 1)
+			{
+				num_set++;
+			}
+		}
+		if (num_set != 1)
+		{
+			return 2;
+		}
+		words[0] ^= hash;
+		return 1;
+	}
+	words[bitcount / 32] ^= 1 << (hash & 0x1f);
+	return 1;
+}
+
+int fuse_read_ipatch(void (*ipatch)(u32 offset, u32 value))
+{
+	u32 words[80];
+	u32 word_count;
+	u32 word_addr;
+	u32 word0 = 0;
+	u32 total_read = 0;
+
+	word_count = FUSE(FUSE_FIRST_BOOTROM_PATCH_SIZE);
+	word_count &= 0x7F;
+	word_addr = 191;
+
+	while (word_count)
+	{
+		total_read += word_count;
+		if (total_read >= ARRAYSIZE(words))
+		{
+			break;
+		}
+
+		for (u32 i = 0; i < word_count; i++)
+			words[i] = fuse_read(word_addr--);
+
+		word0 = words[0];
+		if (_patch_hash_multi(words, word_count) >= 2)
+		{
+			return 1;
+		}
+		u32 ipatch_count = (words[0] >> 16) & 0xF;
+		if (ipatch_count)
+		{
+			for (u32 i = 0; i < ipatch_count; i++)
+			{
+				u32 word = words[i + 1];
+				u32 addr = (word >> 16) * 2;
+				u32 data = word & 0xFFFF;
+
+				ipatch(addr, data);
+			}
+		}
+		words[0] = word0;
+		if ((word0 >> 25) == 0)
+			break;
+		if (_patch_hash_one(&word0) >= 2)
+		{
+			return 3;
+		}
+		word_count = word0 >> 25;
+	}
+
+	return 0;
+}
+
+int fuse_read_evp_thunk(u32 *iram_evp_thunks, u32 *iram_evp_thunks_len)
+{
+	u32 words[80];
+	u32 word_count;
+	u32 word_addr;
+	u32 word0 = 0;
+	u32 total_read = 0;
+	int evp_thunk_written = 0;
+	void *evp_thunk_dst_addr = 0;
+
+	memset(iram_evp_thunks, 0, *iram_evp_thunks_len);
+
+	word_count = FUSE(FUSE_FIRST_BOOTROM_PATCH_SIZE);
+	word_count &= 0x7F;
+	word_addr = 191;
+
+	while (word_count)
+	{
+		total_read += word_count;
+		if (total_read >= ARRAYSIZE(words))
+		{
+			break;
+		}
+
+		for (u32 i = 0; i < word_count; i++)
+			words[i] = fuse_read(word_addr--);
+
+		word0 = words[0];
+		if (_patch_hash_multi(words, word_count) >= 2)
+		{
+			return 1;
+		}
+		u32 ipatch_count = (words[0] >> 16) & 0xF;
+		u32 insn_count = word_count - ipatch_count - 1;
+		if (insn_count)
+		{
+			if (!evp_thunk_written)
+			{
+				evp_thunk_dst_addr = (void *)iram_evp_thunks;
+
+				memcpy(evp_thunk_dst_addr, (void *)evp_thunk_template, evp_thunk_template_len);
+				evp_thunk_dst_addr += evp_thunk_template_len;
+				evp_thunk_written = 1;
+				*iram_evp_thunks_len = evp_thunk_template_len;
+
+				//write32(TEGRA_EXCEPTION_VECTORS_BASE + 0x208, iram_evp_thunks);
+			}
+
+			u32 thunk_patch_len = insn_count * sizeof(u32);
+			memcpy(evp_thunk_dst_addr, &words[ipatch_count + 1], thunk_patch_len);
+			evp_thunk_dst_addr += thunk_patch_len;
+			*iram_evp_thunks_len += thunk_patch_len;
+		}
+		words[0] = word0;
+		if ((word0 >> 25) == 0)
+			break;
+		if (_patch_hash_one(&word0) >= 2)
+		{
+			return 3;
+		}
+		word_count = word0 >> 25;
+	}
+
+	return 0;
+}
+
+bool fuse_check_patched_rcm()
+{
+	// Check if XUSB in use.
+	if (FUSE(FUSE_RESERVED_SW) & (1<<7))
+		return true;
+
+	// Check if RCM is ipatched.
+	u32 word_count = FUSE(FUSE_FIRST_BOOTROM_PATCH_SIZE) & 0x7F;
+	u32 word_addr = 191;
+
+	while (word_count)
+	{
+		u32 word0 = fuse_read(word_addr);
+		u32 ipatch_count = (word0 >> 16) & 0xF;
+
+		for (u32 i = 0; i < ipatch_count; i++)
+		{
+			u32 word = fuse_read(word_addr - (i + 1));
+			u32 addr = (word >> 16) * 2;
+			if (addr == 0x769A)
+				return true;
+		}
+
+		word_addr -= word_count;
+		word_count = word0 >> 25;
+	}
+
+	return false;
+}

source/soc/fuse.h

@@ -37,12 +37,32 @@
 #define FUSE_WRITE_ACCESS_SW 0x30
 #define FUSE_PWR_GOOD_SW 0x34
 #define FUSE_SKU_INFO 0x110
+#define FUSE_CPU_SPEEDO_0_CALIB 0x114
+#define FUSE_CPU_IDDQ_CALIB 0x118
+#define FUSE_OPT_FT_REV 0x128
+#define FUSE_CPU_SPEEDO_1_CALIB 0x12C
+#define FUSE_CPU_SPEEDO_2_CALIB 0x130
+#define FUSE_SOC_SPEEDO_0_CALIB 0x134
+#define FUSE_SOC_SPEEDO_1_CALIB 0x138
+#define FUSE_SOC_SPEEDO_2_CALIB 0x13C
+#define FUSE_SOC_IDDQ_CALIB 0x140
+#define FUSE_OPT_CP_REV 0x190
 #define FUSE_FIRST_BOOTROM_PATCH_SIZE 0x19c
 #define FUSE_PRIVATE_KEY0 0x1A4
 #define FUSE_PRIVATE_KEY1 0x1A8
 #define FUSE_PRIVATE_KEY2 0x1AC
 #define FUSE_PRIVATE_KEY3 0x1B0
+#define FUSE_PRIVATE_KEY4 0x1B4
 #define FUSE_RESERVED_SW 0x1C0
+#define FUSE_SKU_DIRECT_CONFIG 0x1F4
+#define FUSE_OPT_VENDOR_CODE 0x200
+#define FUSE_OPT_FAB_CODE 0x204
+#define FUSE_OPT_LOT_CODE_0 0x208
+#define FUSE_OPT_LOT_CODE_1 0x20C
+#define FUSE_OPT_WAFER_ID 0x210
+#define FUSE_OPT_X_COORDINATE 0x214
+#define FUSE_OPT_Y_COORDINATE 0x218
+#define FUSE_GPU_IDDQ_CALIB	0x228
 
 /*! Fuse commands. */
 #define FUSE_READ 0x1
@@ -55,5 +75,10 @@
 
 void fuse_disable_program();
 u32 fuse_read_odm(u32 idx);
+void fuse_wait_idle();
+int fuse_read_ipatch(void (*ipatch)(u32 offset, u32 value));
+int fuse_read_evp_thunk(u32 *iram_evp_thunks, u32 *iram_evp_thunks_len);
+void fuse_read_array(u32 *words);
+bool fuse_check_patched_rcm();
 
 #endif

source/soc/hw_init.c

@@ -219,7 +219,7 @@ void _config_regulators()
 {
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_CNFGBBC, MAX77620_CNFGBBC_RESISTOR_1K);
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_ONOFFCNFG1,
-		(1 << 6) | (1 << MAX77620_ONOFFCNFG1_MRT_SHIFT)); // PWR delay for forced shutdown off.
+		(1 << 6) | (3 << MAX77620_ONOFFCNFG1_MRT_SHIFT)); // PWR delay for forced shutdown off.
 
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_FPS_CFG0,
 		(7 << MAX77620_FPS_TIME_PERIOD_SHIFT));
@@ -257,7 +257,7 @@ void _config_regulators()
 		MAX77621_T_JUNCTION_120 | MAX77621_FT_ENABLE | MAX77621_CKKADV_TRIP_75mV_PER_US_HIST_DIS |
 		MAX77621_CKKADV_TRIP_150mV_PER_US | MAX77621_INDUCTOR_NOMINAL);
 
-	// Disable low battery shutdown monitor.
+	// Enable low battery shutdown monitor for < 2800mV.
 	max77620_low_battery_monitor_config();
 }
 
@@ -274,6 +274,7 @@ void config_hw()
 
 	// Enable fuse clock.
 	clock_enable_fuse(true);
+
 	// Disable fuse programming.
 	fuse_disable_program();
 

source/soc/kfuse.c

@@ -0,0 +1,56 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "../soc/kfuse.h"
+#include "../soc/clock.h"
+#include "../soc/t210.h"
+
+#pragma GCC push_options
+#pragma GCC optimize ("Os")
+
+int kfuse_wait_ready()
+{
+	// Wait for KFUSE to finish init and verification of data.
+	while (!(KFUSE(KFUSE_STATE) & KFUSE_STATE_DONE))
+		;
+
+	if (!(KFUSE(KFUSE_STATE) & KFUSE_STATE_CRCPASS))
+		return 0;
+
+	return 1;
+}
+
+int kfuse_read(u32 *buf)
+{
+	int res = 0;
+
+	clock_enable_kfuse();
+
+	if (!kfuse_wait_ready())
+		goto out;
+
+	KFUSE(KFUSE_KEYADDR) = KFUSE_KEYADDR_AUTOINC;
+	for (int i = 0; i < KFUSE_NUM_WORDS; i++)
+		buf[i] = KFUSE(KFUSE_KEYS);
+
+	res = 1;
+
+out:;
+	clock_disable_kfuse();
+	return res;
+}
+
+#pragma GCC pop_options

source/soc/kfuse.h

@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) 2018 naehrwert
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _KFUSE_H_
+#define _KFUSE_H_
+
+#include "../utils/types.h"
+
+#define KFUSE_STATE_SOFTRESET      (1 << 31)
+#define KFUSE_STATE_STOP           (1 << 25)
+#define KFUSE_STATE_RESTART        (1 << 24)
+#define KFUSE_STATE_CRCPASS        (1 << 17)
+#define KFUSE_STATE_DONE           (1 << 16)
+#define KFUSE_STATE_ERRBLOCK_MASK  0x3F00
+#define KFUSE_STATE_ERRBLOCK_SHIFT 8
+#define KFUSE_STATE_CURBLOCK_MASK  0x3F
+
+#define KFUSE_KEYADDR_AUTOINC (1<<16)
+
+#define KFUSE_STATE 0x80
+#define KFUSE_KEYADDR 0x88
+#define KFUSE_KEYS 0x8C
+
+#define KFUSE_NUM_WORDS 144
+
+int kfuse_wait_ready();
+int kfuse_read(u32 *buf);
+
+#endif

source/soc/smmu.c

@@ -106,7 +106,7 @@ bool smmu_is_used()
 
 void smmu_exit()
 {
-	*(uint32_t *)(smmu_payload + 0x14) = _NOP();
+	*(u32 *)(smmu_payload + 0x14) = _NOP();
 }
 
 u32 *smmu_init_domain4(u32 dev_base, u32 asid)

source/soc/t210.h

@@ -108,6 +108,14 @@
 
 /*! EVP registers. */
 #define EVP_CPU_RESET_VECTOR 0x100
+#define EVP_COP_RESET_VECTOR 0x200
+#define EVP_COP_UNDEF_VECTOR 0x204
+#define EVP_COP_SWI_VECTOR 0x208
+#define EVP_COP_PREFETCH_ABORT_VECTOR 0x20C
+#define EVP_COP_DATA_ABORT_VECTOR 0x210
+#define EVP_COP_RSVD_VECTOR 0x214
+#define EVP_COP_IRQ_VECTOR 0x218
+#define EVP_COP_FIQ_VECTOR 0x21C
 
 /*! Misc registers. */
 #define APB_MISC_PP_STRAPPING_OPT_A 0x08
@@ -208,7 +216,7 @@
 #define  HALT_COP_JTAG       (1 << 28)
 #define  HALT_COP_WAIT_EVENT (1 << 30)
 #define  HALT_COP_WAIT_IRQ   (1 << 31)
-#define  HALT_COP_MAX_CNT        0xFF
+#define  HALT_COP_MAX_CNT    0xFF
 #define FLOW_CTLR_HALT_CPU0_EVENTS 0x0
 #define FLOW_CTLR_HALT_CPU1_EVENTS 0x14
 #define FLOW_CTLR_HALT_CPU2_EVENTS 0x1C

source/storage/nx_emmc.c

@@ -36,7 +36,7 @@ void nx_emmc_gpt_parse(link_t *gpt, sdmmc_storage_t *storage)
 		part->lba_end = ent->lba_end;
 		part->attrs = ent->attrs;
 
-		//HACK
+		// ASCII conversion. Copy only the LSByte of the UTF-16LE name.
 		for (u32 i = 0; i < 36; i++)
 			part->name[i] = ent->name[i];
 		part->name[36] = 0;

source/storage/sd.h

@@ -1,8 +1,8 @@
 /*
  *  include/linux/mmc/sd.h
  *
- *  Copyright (C) 2005-2007 Pierre Ossman, All Rights Reserved.
- *  Copyright (C) 2018 CTCaer
+ *  Copyright (c) 2005-2007 Pierre Ossman, All Rights Reserved.
+ *  Copyright (c) 2018 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -40,7 +40,9 @@
 #define SD_ROCR_S18A        SD_OCR_S18R  /* 1.8V switching accepted by card */
 #define SD_OCR_XPC          (1 << 28)    /* SDXC power control */
 #define SD_OCR_CCS          (1 << 30)    /* Card Capacity Status */
+#define SD_OCR_VDD_27_34    (0x7F << 15) /* VDD voltage 2.7 ~ 3.4 */
 #define SD_OCR_VDD_32_33    (1 << 20)	 /* VDD voltage 3.2 ~ 3.3 */
+#define SD_OCR_VDD_18       (1 << 7)	 /* VDD voltage 1.8 */
 
 /*
 * SD_SWITCH argument format:

source/storage/sdmmc.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018-2019 CTCaer
+ * Copyright (c) 2018-2019 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -19,6 +19,7 @@
 #include "sdmmc.h"
 #include "mmc.h"
 #include "sd.h"
+#include "../../common/memory_map.h"
 #include "../gfx/gfx.h"
 #include "../mem/heap.h"
 #include "../utils/util.h"
@@ -220,10 +221,10 @@ static int _mmc_storage_get_op_cond_inner(sdmmc_storage_t *storage, u32 *pout, u
 	switch (power)
 	{
 	case SDMMC_POWER_1_8:
-		arg = 0x40000080; //Sector access, voltage.
+		arg = SD_OCR_CCS | SD_OCR_VDD_18;
 		break;
 	case SDMMC_POWER_3_3:
-		arg = 0x403F8000; //Sector access, voltage.
+		arg = SD_OCR_CCS | SD_OCR_VDD_27_34;
 		break;
 	default:
 		return 0;
@@ -248,7 +249,7 @@ static int _mmc_storage_get_op_cond(sdmmc_storage_t *storage, u32 power)
 
 		if (cond & MMC_CARD_BUSY)
 		{
-			if (cond & 0x40000000)
+			if (cond & SD_OCR_CCS)
 				storage->has_sector_access = 1;
 
 			return 1;
@@ -569,7 +570,7 @@ DPRINTF("[MMC] BKOPS disabled\n");
 
 	if (!_mmc_storage_enable_highspeed(storage, storage->ext_csd.card_type, type))
 		return 0;
-DPRINTF("[MMC] succesfully switched to highspeed mode\n");
+DPRINTF("[MMC] succesfully switched to HS mode\n");
 
 	sdmmc_sd_clock_ctrl(storage->sdmmc, 1);
 
@@ -819,17 +820,17 @@ void _sd_storage_set_current_limit(sdmmc_storage_t *storage, u8 *buf)
 	switch (pwr)
 	{
 	case SD_SET_CURRENT_LIMIT_800:
-DPRINTF("[SD] Power limit raised to 800mA\n");
+DPRINTF("[SD] power limit raised to 800mA\n");
 		break;
 	case SD_SET_CURRENT_LIMIT_600:
-DPRINTF("[SD] Power limit raised to 600mA\n");
+DPRINTF("[SD] power limit raised to 600mA\n");
 		break;
 	case SD_SET_CURRENT_LIMIT_400:
-DPRINTF("[SD] Power limit raised to 800mA\n");
+DPRINTF("[SD] power limit raised to 800mA\n");
 		break;
 	default:
 	case SD_SET_CURRENT_LIMIT_200:
-DPRINTF("[SD] Power limit defaulted to 200mA\n");
+DPRINTF("[SD] power limit defaulted to 200mA\n");
 		break;
 	}
 }
@@ -857,7 +858,7 @@ DPRINTF("[SD] SD supports selected (U)HS mode\n");
 	return 1;
 }
 
-int _sd_storage_enable_highspeed_low_volt(sdmmc_storage_t *storage, u32 type, u8 *buf)
+int _sd_storage_enable_uhs_low_volt(sdmmc_storage_t *storage, u32 type, u8 *buf)
 {
 	// Try to raise the current limit to let the card perform better.
 	_sd_storage_set_current_limit(storage, buf);
@@ -878,7 +879,7 @@ int _sd_storage_enable_highspeed_low_volt(sdmmc_storage_t *storage, u32 type, u8
 		{
 			type = 11;
 			hs_type = UHS_SDR104_BUS_SPEED;
-DPRINTF("[SD] Bus speed set to SDR104\n");
+DPRINTF("[SD] bus speed set to SDR104\n");
 			storage->csd.busspeed = 104;
 			break;
 		}
@@ -887,7 +888,7 @@ DPRINTF("[SD] Bus speed set to SDR104\n");
 		{
 			type = 10;
 			hs_type = UHS_SDR50_BUS_SPEED;
-DPRINTF("[SD] Bus speed set to SDR50\n");
+DPRINTF("[SD] bus speed set to SDR50\n");
 			storage->csd.busspeed = 50;
 			break;
 		}
@@ -896,7 +897,7 @@ DPRINTF("[SD] Bus speed set to SDR50\n");
 			return 0;
 		type = 8;
 		hs_type = UHS_SDR12_BUS_SPEED;
-DPRINTF("[SD] Bus speed set to SDR12\n");
+DPRINTF("[SD] bus speed set to SDR12\n");
 		storage->csd.busspeed = 12;
 		break;
 	default:
@@ -916,7 +917,7 @@ DPRINTF("[SD] config tuning\n");
 	return _sdmmc_storage_check_status(storage);
 }
 
-int _sd_storage_enable_highspeed_high_volt(sdmmc_storage_t *storage, u8 *buf)
+int _sd_storage_enable_hs_high_volt(sdmmc_storage_t *storage, u8 *buf)
 {
 	if (!_sd_storage_switch_get(storage, buf))
 		return 0;
@@ -1064,8 +1065,9 @@ void sdmmc_storage_init_wait_sd()
 int sdmmc_storage_init_sd(sdmmc_storage_t *storage, sdmmc_t *sdmmc, u32 id, u32 bus_width, u32 type)
 {
 	int is_version_1 = 0;
+	u8 *buf = (u8 *)SDMMC_UPPER_BUFFER;
 
-	// Some cards (Sandisk U1), do not like a fast power cycle. Wait min 100ms.
+	// Some cards (SanDisk U1), do not like a fast power cycle. Wait min 100ms.
 	sdmmc_storage_init_wait_sd();
 
 	memset(storage, 0, sizeof(sdmmc_storage_t));
@@ -1138,12 +1140,8 @@ DPRINTF("[SD] set blocklen to 512\n");
 		return 0;
 DPRINTF("[SD] cleared card detect\n");
 
-	u8 *buf = (u8 *)malloc(512);
 	if (!_sd_storage_get_scr(storage, buf))
-	{
-		free(buf);
 		return 0;
-	}
 
 	//gfx_hexdump(0, storage->raw_scr, 8);
 DPRINTF("[SD] got scr\n");
@@ -1152,10 +1150,8 @@ DPRINTF("[SD] got scr\n");
 	if (bus_width == SDMMC_BUS_WIDTH_4 && (storage->scr.bus_widths & 4) && (storage->scr.sda_vsn & 0xF))
 	{
 		if (!_sd_storage_execute_app_cmd_type1(storage, &tmp, SD_APP_SET_BUS_WIDTH, SD_BUS_WIDTH_4, 0, R1_STATE_TRAN))
-		{
-			free(buf);
 			return 0;
-		}
+
 		sdmmc_set_bus_width(storage->sdmmc, SDMMC_BUS_WIDTH_4);
 DPRINTF("[SD] switched to wide bus width\n");
 	}
@@ -1166,20 +1162,15 @@ DPRINTF("[SD] SD does not support wide bus width\n");
 
 	if (storage->is_low_voltage)
 	{
-		if (!_sd_storage_enable_highspeed_low_volt(storage, type, buf))
-		{
-			free(buf);
+		if (!_sd_storage_enable_uhs_low_volt(storage, type, buf))
 			return 0;
-		}
 DPRINTF("[SD] enabled UHS\n");
 	}
 	else if (type != 6 && (storage->scr.sda_vsn & 0xF) != 0)
 	{
-		if (!_sd_storage_enable_highspeed_high_volt(storage, buf))
-		{
-			free(buf);
+		if (!_sd_storage_enable_hs_high_volt(storage, buf))
 			return 0;
-		}
+
 DPRINTF("[SD] enabled HS\n");
 		storage->csd.busspeed = 25;
 	}
@@ -1192,7 +1183,6 @@ DPRINTF("[SD] enabled HS\n");
 DPRINTF("[SD] got sd status\n");
 	}
 
-	free(buf);
 	return 1;
 }
 

source/storage/sdmmc.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (c) 2018 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,

source/storage/sdmmc_driver.c

@@ -32,10 +32,6 @@
 //#define DPRINTF(...) gfx_printf(__VA_ARGS__)
 #define DPRINTF(...)
 
-#pragma GCC push_options
-#pragma GCC target ("thumb")
-#pragma GCC optimize ("Os")
-
 /*! SCMMC controller base addresses. */
 static const u32 _sdmmc_bases[4] = {
 	0x700B0000,
@@ -81,7 +77,7 @@ static int _sdmmc_set_voltage(sdmmc_t *sdmmc, u32 power)
 	{
 		pwr |= TEGRA_MMC_PWRCTL_SD_BUS_POWER;
 		sdmmc->regs->pwrcon = pwr;
-	}
+	}	
 
 	return 1;
 }
@@ -256,7 +252,7 @@ int sdmmc_setup_clock(sdmmc_t *sdmmc, u32 type)
 
 	u32 tmp;
 	u16 divisor;
-	clock_sdmmc_get_params(&tmp, &divisor, type);
+	clock_sdmmc_get_card_clock_div(&tmp, &divisor, type);
 	clock_sdmmc_config_clock_source(&tmp, sdmmc->id, tmp);
 	sdmmc->divisor = (tmp + divisor - 1) / divisor;
 
@@ -389,7 +385,7 @@ int sdmmc_get_rsp(sdmmc_t *sdmmc, u32 *rsp, u32 size, u32 type)
 
 static void _sdmmc_reset(sdmmc_t *sdmmc)
 {
-	sdmmc->regs->swrst |=
+	sdmmc->regs->swrst |= 
 		TEGRA_MMC_SWRST_SW_RESET_FOR_CMD_LINE | TEGRA_MMC_SWRST_SW_RESET_FOR_DAT_LINE;
 	_sdmmc_get_clkcon(sdmmc);
 	u32 timeout = get_tmr_ms() + 2000;
@@ -460,7 +456,7 @@ static int _sdmmc_setup_read_small_block(sdmmc_t *sdmmc)
 static int _sdmmc_parse_cmdbuf(sdmmc_t *sdmmc, sdmmc_cmd_t *cmd, bool is_data_present)
 {
 	u16 cmdflags = 0;
-
+	
 	switch (cmd->rsp_type)
 	{
 	case SDMMC_RSP_TYPE_0:
@@ -834,7 +830,7 @@ static int _sdmmc_config_dma(sdmmc_t *sdmmc, u32 *blkcnt_out, sdmmc_req_t *req)
 		trnmode |= TEGRA_MMC_TRNMOD_DATA_XFER_DIR_SEL_READ;
 	if (req->is_auto_cmd12)
 		trnmode = (trnmode & 0xFFF3) | TEGRA_MMC_TRNMOD_AUTO_CMD12;
-	bpmp_mmu_maintenance(BPMP_MMU_MAINT_CLN_INV_WAY);
+	bpmp_mmu_maintenance(BPMP_MMU_MAINT_CLN_INV_WAY, false);
 	sdmmc->regs->trnmod = trnmode;
 
 	return 1;
@@ -859,7 +855,7 @@ static int _sdmmc_update_dma(sdmmc_t *sdmmc)
 					break;
 				if (intr & TEGRA_MMC_NORINTSTS_XFER_COMPLETE)
 				{
-					bpmp_mmu_maintenance(BPMP_MMU_MAINT_CLN_INV_WAY);
+					bpmp_mmu_maintenance(BPMP_MMU_MAINT_CLN_INV_WAY, false);
 					return 1; // Transfer complete.
 				}
 				if (intr & TEGRA_MMC_NORINTSTS_DMA_INTERRUPT)
@@ -1019,7 +1015,7 @@ int sdmmc_init(sdmmc_t *sdmmc, u32 id, u32 power, u32 bus_width, u32 type, int n
 
 	u32 clock;
 	u16 divisor;
-	clock_sdmmc_get_params(&clock, &divisor, type);
+	clock_sdmmc_get_card_clock_div(&clock, &divisor, type);
 	clock_sdmmc_enable(id, clock);
 
 	sdmmc->clock_stopped = 0;
@@ -1150,5 +1146,3 @@ int sdmmc_enable_low_voltage(sdmmc_t *sdmmc)
 
 	return 0;
 }
-
-#pragma GCC pop_options

source/utils/btn.c

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (c) 2018 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -61,16 +61,25 @@ u8 btn_wait()
 
 u8 btn_wait_timeout(u32 time_ms, u8 mask)
 {
+	u8 single_button = mask & BTN_SINGLE;
+	mask &= ~BTN_SINGLE;
+
 	u32 timeout = get_tmr_ms() + time_ms;
-	u8 res = btn_read() & mask;
+	u8 res = btn_read();
 
 	while (get_tmr_ms() < timeout)
 	{
-		if (res == mask)
-			break;
+		if ((res & mask) == mask)
+		{
+			if (single_button && (res & ~mask)) // Undesired button detected.
+				res = btn_read();
+			else
+				return (res & mask);
+		}
 		else
-			res = btn_read() & mask;
+			res = btn_read();
 	};
 
-	return res;
+	// Timed out.
+	return 0;
 }

source/utils/btn.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (c) 2018 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -23,6 +23,7 @@
 #define BTN_POWER    (1 << 0)
 #define BTN_VOL_DOWN (1 << 1)
 #define BTN_VOL_UP   (1 << 2)
+#define BTN_SINGLE   (1 << 7)
 
 u8 btn_read();
 u8 btn_wait();

source/utils/dirlist.c

@@ -42,7 +42,7 @@ char *dirlist(const char *directory, const char *pattern, bool includeHiddenFile
 				break;
 			if (!(fno.fattrib & AM_DIR) && (fno.fname[0] != '.') && (includeHiddenFiles || !(fno.fattrib & AM_HID)))
 			{
-				memcpy(dir_entries + (k * 256), fno.fname, strlen(fno.fname) + 1);
+				strcpy(dir_entries + (k * 256), fno.fname);
 				k++;
 				if (k > (max_entries - 1))
 					break;
@@ -56,7 +56,7 @@ char *dirlist(const char *directory, const char *pattern, bool includeHiddenFile
 		{
 			if (!(fno.fattrib & AM_DIR) && (fno.fname[0] != '.') && (includeHiddenFiles || !(fno.fattrib & AM_HID)))
 			{
-				memcpy(dir_entries + (k * 256), fno.fname, strlen(fno.fname) + 1);
+				strcpy(dir_entries + (k * 256), fno.fname);
 				k++;
 				if (k > (max_entries - 1))
 					break;
@@ -81,9 +81,9 @@ char *dirlist(const char *directory, const char *pattern, bool includeHiddenFile
 		{
 			if (strcmp(&dir_entries[i * 256], &dir_entries[j * 256]) > 0)
 			{
-				memcpy(temp, &dir_entries[i * 256], strlen(&dir_entries[i * 256]) + 1);
-				memcpy(&dir_entries[i * 256], &dir_entries[j * 256], strlen(&dir_entries[j * 256]) + 1);
-				memcpy(&dir_entries[j * 256], temp, strlen(temp) + 1);
+				strcpy(temp, &dir_entries[i * 256]);
+				strcpy(&dir_entries[i * 256], &dir_entries[j * 256]);
+				strcpy(&dir_entries[j * 256], temp);
 			}
 		}
 	}

source/utils/types.h

@@ -20,6 +20,7 @@
 #define NULL ((void *)0)
 
 #define ALIGN(x, a) (((x) + (a) - 1) & ~((a) - 1))
+#define ALIGN_DOWN(x, a) (((x) - ((a) - 1)) & ~((a) - 1))
 #define MAX(a, b) ((a) > (b) ? (a) : (b))
 #define MIN(a, b) ((a) < (b) ? (a) : (b))
 
@@ -36,7 +37,8 @@
 #define KB_FIRMWARE_VERSION_700 7
 #define KB_FIRMWARE_VERSION_810 8
 #define KB_FIRMWARE_VERSION_900 9
-#define KB_FIRMWARE_VERSION_MAX KB_FIRMWARE_VERSION_900
+#define KB_FIRMWARE_VERSION_910 10
+#define KB_FIRMWARE_VERSION_MAX KB_FIRMWARE_VERSION_910
 
 #define HOS_PKG11_MAGIC 0x31314B50
 

source/utils/util.c

@@ -1,6 +1,6 @@
 /*
 * Copyright (c) 2018 naehrwert
-* Copyright (C) 2018 CTCaer
+* Copyright (c) 2018 CTCaer
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@@ -17,6 +17,7 @@
 
 #include "util.h"
 #include "../gfx/di.h"
+#include "../mem/minerva.h"
 #include "../power/max77620.h"
 #include "../rtc/max77620-rtc.h"
 #include "../soc/bpmp.h"
@@ -26,6 +27,8 @@
 
 #define USE_RTC_TIMER
 
+extern volatile nyx_storage_t *nyx_str;
+
 extern void sd_unmount();
 
 u32 get_tmr_s()
@@ -100,6 +103,8 @@ void reboot_normal()
 	sd_unmount();
 	display_end();
 
+	nyx_str->mtc_cfg.init_done = 0;
+
 	panic(0x21); // Bypass fuse programming in package1.
 }
 
@@ -110,6 +115,8 @@ void reboot_rcm()
 	sd_unmount();
 	display_end();
 
+	nyx_str->mtc_cfg.init_done = 0;
+
 	PMC(APBDEV_PMC_SCRATCH0) = 2; // Reboot into rcm.
 	PMC(APBDEV_PMC_CNTRL) |= PMC_CNTRL_MAIN_RST;
 

source/utils/util.h

@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 naehrwert
- * Copyright (C) 2018 CTCaer
+ * Copyright (c) 2018 CTCaer
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -21,6 +21,9 @@
 #include "types.h"
 #include "../mem/minerva.h"
 
+#define NYX_CFG_DUMP    (1 << 7)
+#define NYX_CFG_MINERVA (1 << 8)
+
 #define byte_swap_32(num) (((num >> 24) & 0xff) | ((num << 8) & 0xff0000) | \
 						((num >> 8 )& 0xff00) | ((num << 24) & 0xff000000))