Bump version to v1.9.7

Support 14.0.0 keys
keys: Add helper func for eticket rsa kek
2022-03-21 19:03:56 -06:00 · 2022-03-21 19:03:17 -06:00 · 2022-02-10 08:45:06 -07:00 · 2022-02-10 08:22:36 -07:00 · 2022-02-09 13:50:17 -07:00 · 2022-02-09 10:54:01 -07:00
32 changed files with 408 additions and 227 deletions
--- a/Versions.inc
+++ b/Versions.inc
@ -1,5 +1,5 @@
 # LP Version.
 LPVERSION_MAJOR := 1
 LPVERSION_MINOR := 9
-LPVERSION_BUGFX := 6
+LPVERSION_BUGFX := 7
 LPVERSION_RSVD := 0
--- a/bdk/display/di.c
+++ b/bdk/display/di.c
@ -436,12 +436,12 @@ void display_init()

 	// For Aula ensure that we have a compatible panel id.
 	if (nx_aula && _display_id == 0xCCCC)
-		_display_id = PANEL_SAM_70_UNK;
+		_display_id = PANEL_SAM_AMS699VC01;

 	// Initialize display panel.
 	switch (_display_id)
 	{
-	case PANEL_SAM_70_UNK:
+	case PANEL_SAM_AMS699VC01:
 		_display_dsi_send_cmd(MIPI_DSI_DCS_SHORT_WRITE, MIPI_DCS_EXIT_SLEEP_MODE, 180000);
 		_display_dsi_send_cmd(MIPI_DSI_DCS_SHORT_WRITE_PARAM, 0xA0, 0); // Write 0 to 0xA0.
 		_display_dsi_send_cmd(MIPI_DSI_DCS_SHORT_WRITE_PARAM, MIPI_DCS_SET_CONTROL_DISPLAY | (DCS_CONTROL_DISPLAY_BRIGHTNESS_CTRL << 8), 0); // Enable brightness control.
@ -539,7 +539,7 @@ void display_init()

 void display_backlight_pwm_init()
 {
-	if (_display_id == PANEL_SAM_70_UNK)
+	if (_display_id == PANEL_SAM_AMS699VC01)
 		return;

 	clock_enable_pwm();
@ -557,6 +557,10 @@ void display_backlight(bool enable)

 void display_dsi_backlight_brightness(u32 brightness)
 {
+	// Normalize brightness value by 82% and a base of 45 duty.
+	if (brightness)
+		brightness = (brightness * PANEL_OLED_BL_COEFF / 100) + PANEL_OLED_BL_OFFSET;
+
 	u16 bl_ctrl = byte_swap_16((u16)(brightness * 8));
 	display_dsi_vblank_write(MIPI_DCS_SET_BRIGHTNESS, 2, &bl_ctrl);
 }
@ -592,7 +596,7 @@ void display_backlight_brightness(u32 brightness, u32 step_delay)
 	if (brightness > 255)
 		brightness = 255;

-	if (_display_id != PANEL_SAM_70_UNK)
+	if (_display_id != PANEL_SAM_AMS699VC01)
 		display_pwm_backlight_brightness(brightness, step_delay);
 	else
 		display_dsi_backlight_brightness(brightness);
@ -624,7 +628,7 @@ static void _display_panel_and_hw_end(bool no_panel_deinit)
 	exec_cfg((u32 *)DISPLAY_A_BASE, _display_video_disp_controller_disable_config, 17);
 	exec_cfg((u32 *)DSI_BASE, _display_dsi_timing_deinit_config, 16);

-	if (_display_id != PANEL_SAM_70_UNK)
+	if (_display_id != PANEL_SAM_AMS699VC01)
 		usleep(10000);

 	// De-initialize display panel.
@ -678,7 +682,7 @@ static void _display_panel_and_hw_end(bool no_panel_deinit)

 	// Blank - powerdown.
 	_display_dsi_send_cmd(MIPI_DSI_DCS_SHORT_WRITE, MIPI_DCS_ENTER_SLEEP_MODE,
-		(_display_id == PANEL_SAM_70_UNK) ? 120000 : 50000);
+		(_display_id == PANEL_SAM_AMS699VC01) ? 120000 : 50000);

 skip_panel_deinit:
 	// Disable LCD power pins.
@ -734,7 +738,7 @@ void display_set_decoded_panel_id(u32 id)

 	// For Aula ensure that we have a compatible panel id.
 	if (nx_aula && _display_id == 0xCCCC)
-		_display_id = PANEL_SAM_70_UNK;
+		_display_id = PANEL_SAM_AMS699VC01;
 }

 void display_color_screen(u32 color)
@ -749,7 +753,7 @@ void display_color_screen(u32 color)
 	DISPLAY_A(_DIREG(DC_CMD_STATE_CONTROL)) = (DISPLAY_A(_DIREG(DC_CMD_STATE_CONTROL)) & 0xFFFFFFFE) | GENERAL_ACT_REQ;
 	usleep(35000); // No need to wait on Aula.

-	if (_display_id != PANEL_SAM_70_UNK)
+	if (_display_id != PANEL_SAM_AMS699VC01)
 		display_backlight(true);
 	else
 		display_backlight_brightness(255, 0);
--- a/bdk/display/di.h
+++ b/bdk/display/di.h
@ -652,6 +652,9 @@
 #define DCS_CONTROL_DISPLAY_DIMMING_CTRL    BIT(3)
 #define DCS_CONTROL_DISPLAY_BRIGHTNESS_CTRL BIT(5)

+#define PANEL_OLED_BL_COEFF  82 // 82%.
+#define PANEL_OLED_BL_OFFSET 45 // Least legible backlight duty.
+
 /* Switch Panels:
 *
 * 6.2" panels for Icosa and Iowa skus:
@ -671,7 +674,7 @@
 * [40] XX [10]: Vendor 40 [UNCONFIRMED ID]
 *
 * 7.0" OLED panels for Aula skus:
- * [50] XX [20]: Samsung AMS700XXXX [UNCONFIRMED ID and MODEL]
+ * [50] 9B [20]: Samsung AMS699VC01-0 (Rev 2.5)
 */

 /* Display ID Decoding:
@ -703,7 +706,7 @@ enum
 	PANEL_INL_2J055IA_27A = 0x1020,
 	PANEL_AUO_A055TAN01   = 0x1030,
 	PANEL_V40_55_UNK      = 0x1040,
-	PANEL_SAM_70_UNK      = 0x2050
+	PANEL_SAM_AMS699VC01  = 0x2050
 };

 void display_init();
--- a/bdk/input/touch.c
+++ b/bdk/input/touch.c
@ -39,7 +39,7 @@ static touch_panel_info_t _panels[] =
 	{  1,  0, 1, 1,  "GiS GGM6 B2X"    },
 	{  2,  0, 0, 0,  "NISSHA NBF-K9A"  },
 	{  3,  1, 0, 0,  "GiS 5.5\""       },
-	{  4,  0, 0, 1,  "Unknown_001"     },
+	{  4,  0, 0, 1,  "Samsung BH2109"  },
 	{ -1,  1, 0, 1,  "GiS VA 6.2\""    }
 };

--- a/bdk/libs/fatfs/ff.c
+++ b/bdk/libs/fatfs/ff.c
@ -3274,7 +3274,6 @@ static FRESULT find_volume (	/* FR_OK(0): successful, !=0: an error occurred */
 		stat = disk_status(fs->pdrv);
 		if (!(stat & STA_NOINIT)) {		/* and the physical drive is kept initialized */
 			if (!FF_FS_READONLY && mode && (stat & STA_PROTECT)) {	/* Check write protection if needed */
-				EFSPRINTF("WPEN1");
 				return FR_WRITE_PROTECTED;
 			}
 			return FR_OK;				/* The filesystem object is valid */
@ -3289,11 +3288,9 @@ static FRESULT find_volume (	/* FR_OK(0): successful, !=0: an error occurred */
 	fs->pdrv = LD2PD(vol);				/* Bind the logical drive and a physical drive */
 	stat = disk_initialize(fs->pdrv);	/* Initialize the physical drive */
 	if (stat & STA_NOINIT) { 			/* Check if the initialization succeeded */
-		EFSPRINTF("MDNR");
 		return FR_NOT_READY;			/* Failed to initialize due to no medium or hard error */
 	}
 	if (!FF_FS_READONLY && mode && (stat & STA_PROTECT)) { /* Check disk write protection if needed */
-		EFSPRINTF("WPEN2");
 		return FR_WRITE_PROTECTED;
 	}
 #if FF_MAX_SS != FF_MIN_SS				/* Get sector size (multiple sector size cfg only) */
@ -4712,9 +4709,9 @@ DWORD *f_expand_cltbl (
 	}
 	if (f_lseek(fp, CREATE_LINKMAP)) {	/* Create cluster link table */
 		ff_memfree(fp->cltbl);
-		fp->cltbl = NULL;
+		fp->cltbl = (void *)0;
 		EFSPRINTF("CLTBLSZ");
-		return NULL;
+		return (void *)0;
 	}
 	f_lseek(fp, 0);

@ -6737,6 +6734,8 @@ int f_puts (
 	putbuff pb;


+	if (str == (void *)0) return EOF; /* String is NULL */
+
 	putc_init(&pb, fp);
 	while (*str) putc_bfd(&pb, *str++);		/* Put the string */
 	return putc_flush(&pb);
@ -6763,6 +6762,8 @@ int f_printf (
 	TCHAR c, d, str[32], *p;


+	if (fmt == (void *)0) return EOF; /* String is NULL */
+
 	putc_init(&pb, fp);

 	va_start(arp, fmt);
--- a/bdk/libs/nx_savedata/header.h
+++ b/bdk/libs/nx_savedata/header.h
@ -61,7 +61,7 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #define VERSION_RMAP         0x10000
 #define VERSION_IVFC         0x20000

-#define SAVE_BLOCK_SIZE_DEFAULT 0x4000
+#define SAVE_BLOCK_SIZE_DEFAULT SZ_16K

 #define SAVE_NUM_HEADERS 2

@ -232,6 +232,6 @@ typedef struct {
    };
 } save_header_t;

-static_assert(sizeof(save_header_t) == 0x4000, "Save header size is wrong!");
+static_assert(sizeof(save_header_t) == SZ_16K, "Save header size is wrong!");

 #endif
--- a/bdk/libs/nx_savedata/remap_storage.h
+++ b/bdk/libs/nx_savedata/remap_storage.h
@ -41,7 +41,7 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 #include <stdint.h>

 #define RMAP_ALIGN_SMALL 0x200
-#define RMAP_ALIGN_LARGE 0x4000
+#define RMAP_ALIGN_LARGE SZ_16K

 typedef struct {
    uint32_t magic; /* RMAP */
--- a/bdk/libs/nx_savedata/save_fs_list.c
+++ b/bdk/libs/nx_savedata/save_fs_list.c
@ -250,7 +250,7 @@ uint32_t save_fs_list_allocate_entry(save_filesystem_list_ctx_t *ctx) {
    if (capacity == 0 || length >= capacity) {
        uint64_t current_size, new_size;
        save_allocation_table_storage_get_size(&ctx->storage, &current_size);
-        if (!save_allocation_table_storage_set_size(&ctx->storage, current_size + 0x4000))
+        if (!save_allocation_table_storage_set_size(&ctx->storage, current_size + SZ_16K))
            return 0;
        save_allocation_table_storage_get_size(&ctx->storage, &new_size);
        if (!save_fs_list_set_capacity(ctx, (uint32_t)(new_size / sizeof(save_fs_list_entry_t))))
--- a/bdk/mem/minerva.h
+++ b/bdk/mem/minerva.h
@ -27,8 +27,8 @@

 typedef struct
 {
-	s32 rate_to;
-	s32 rate_from;
+	u32 rate_to;
+	u32 rate_from;
 	emc_table_t *mtc_table;
 	u32 table_entries;
 	emc_table_t *current_emc_table;
--- a/bdk/mem/sdram.c
+++ b/bdk/mem/sdram.c
@ -55,11 +55,11 @@ static const u8 dram_encoding_t210b01[] = {
 	LPDDR4X_NO_PATCH,
 	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ,
 	LPDDR4X_NO_PATCH,
-	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046,
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE,
 	LPDDR4X_NO_PATCH,
 	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ,
 	LPDDR4X_NO_PATCH,
-	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046,
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE,
 	LPDDR4X_4GB_SAMSUNG_Y,
 	LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL,
 	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL,
@ -69,9 +69,9 @@ static const u8 dram_encoding_t210b01[] = {
 	LPDDR4X_UNUSED, // Removed.
 	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL,
 	LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL,
-	LPDDR4X_4GB_MICRON_1Y_A,
-	LPDDR4X_4GB_MICRON_1Y_A,
-	LPDDR4X_4GB_MICRON_1Y_A,
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF,
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF,
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF,
 	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL,
 };

--- a/bdk/mem/sdram.h
+++ b/bdk/mem/sdram.h
@ -50,7 +50,7 @@ enum sdram_ids_erista
 	// LPDDR4 3200Mbps.
 	LPDDR4_ICOSA_4GB_SAMSUNG_K4F6E304HB_MGCH        = 0,
 	LPDDR4_ICOSA_4GB_HYNIX_H9HCNNNBPUMLHR_NLE       = 1,
-	LPDDR4_ICOSA_4GB_MICRON_MT53B512M32D2NP_062_WT  = 2,
+	LPDDR4_ICOSA_4GB_MICRON_MT53B512M32D2NP_062_WT  = 2, // WT:C.
 	LPDDR4_COPPER_4GB_SAMSUNG_K4F6E304HB_MGCH       = 3, // Changed to Iowa Hynix 4GB 1Y-A.
 	LPDDR4_ICOSA_6GB_SAMSUNG_K4FHE3D4HM_MGCH        = 4,
 	LPDDR4_COPPER_4GB_HYNIX_H9HCNNNBPUMLHR_NLE      = 5, // Changed to Hoag Hynix 4GB 1Y-A.
@ -70,12 +70,12 @@ enum sdram_ids_mariko
 	LPDDR4X_IOWA_4GB_SAMSUNG_K4U6E3S4AM_MGCJ        = 8,  // Die-M.
 	LPDDR4X_IOWA_8GB_SAMSUNG_K4UBE3D4AM_MGCJ        = 9,  // Die-M.
 	LPDDR4X_IOWA_4GB_HYNIX_H9HCNNNBKMMLHR_NME       = 10, // Die-M.
-	LPDDR4X_IOWA_4GB_MICRON_MT53E512M32D2NP_046_WT  = 11, // 4266Mbps. WT:E. Die-E.
+	LPDDR4X_IOWA_4GB_MICRON_MT53E512M32D2NP_046_WTE = 11, // 4266Mbps. Die-E.

 	LPDDR4X_HOAG_4GB_SAMSUNG_K4U6E3S4AM_MGCJ        = 12, // Die-M.
 	LPDDR4X_HOAG_8GB_SAMSUNG_K4UBE3D4AM_MGCJ        = 13, // Die-M.
 	LPDDR4X_HOAG_4GB_HYNIX_H9HCNNNBKMMLHR_NME       = 14, // Die-M.
-	LPDDR4X_HOAG_4GB_MICRON_MT53E512M32D2NP_046_WT  = 15, // 4266Mbps. WT:E. Die-E.
+	LPDDR4X_HOAG_4GB_MICRON_MT53E512M32D2NP_046_WTE = 15, // 4266Mbps. Die-E.

 	// LPDDR4X 4266Mbps.
 	LPDDR4X_IOWA_4GB_SAMSUNG_Y                      = 16,
@ -92,9 +92,9 @@ enum sdram_ids_mariko
 	LPDDR4X_HOAG_8GB_SAMSUNG_K4UBE3D4AA_MGCL        = 23, // Die-A.
 	LPDDR4X_AULA_4GB_SAMSUNG_K4U6E3S4AA_MGCL        = 24, // Die-A.

-	LPDDR4X_IOWA_4GB_MICRON_1Y_A                    = 25,
-	LPDDR4X_HOAG_4GB_MICRON_1Y_A                    = 26,
-	LPDDR4X_AULA_4GB_MICRON_1Y_A                    = 27,
+	LPDDR4X_IOWA_4GB_MICRON_MT53E512M32D2NP_046_WTF = 25, // 4266Mbps. Die-F.
+	LPDDR4X_HOAG_4GB_MICRON_MT53E512M32D2NP_046_WTF = 26, // 4266Mbps. Die-F.
+	LPDDR4X_AULA_4GB_MICRON_MT53E512M32D2NP_046_WTF = 27, // 4266Mbps. Die-F.

 	LPDDR4X_AULA_8GB_SAMSUNG_K4UBE3D4AA_MGCL        = 28, // Die-A.
 };
@ -107,17 +107,17 @@ enum sdram_codes_mariko
 	// LPDDR4X_4GB_SAMSUNG_K4U6E3S4AM_MGCJ          DRAM IDs: 08, 12.
 	// LPDDR4X_4GB_HYNIX_H9HCNNNBKMMLHR_NME         DRAM IDs: 10, 14.

-	LPDDR4X_4GB_SAMSUNG_X1X2               = 1,  // DRAM IDs: 07.
-	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ    = 2,  // DRAM IDs: 09, 13.
-	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046 = 3,  // DRAM IDs: 11, 15.
-	LPDDR4X_4GB_SAMSUNG_Y                  = 4,  // DRAM IDs: 16.
-	LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL    = 5,  // DRAM IDs: 17, 19, 24.
-	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL    = 6,  // DRAM IDs: 18, 23, 28.
-	LPDDR4X_4GB_SAMSUNG_1Y_Y               = 7,  // DRAM IDs: 20.
-	LPDDR4X_8GB_SAMSUNG_1Y_Y               = 8,  // DRAM IDs: 21.
-	//LPDDR4X_8GB_SAMSUNG_1Y_A               = 9,  // DRAM IDs: 22. Unused.
-	LPDDR4X_4GB_MICRON_1Y_A                = 10, // DRAM IDs: 25, 26, 27.
-	LPDDR4X_4GB_HYNIX_1Y_A                 = 11, // DRAM IDs: 03, 05, 06.
+	LPDDR4X_4GB_SAMSUNG_X1X2                   = 1,  // DRAM IDs: 07.
+	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ        = 2,  // DRAM IDs: 09, 13.
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE = 3,  // DRAM IDs: 11, 15.
+	LPDDR4X_4GB_SAMSUNG_Y                      = 4,  // DRAM IDs: 16.
+	LPDDR4X_4GB_SAMSUNG_K4U6E3S4AA_MGCL        = 5,  // DRAM IDs: 17, 19, 24.
+	LPDDR4X_8GB_SAMSUNG_K4UBE3D4AA_MGCL        = 6,  // DRAM IDs: 18, 23, 28.
+	LPDDR4X_4GB_SAMSUNG_1Y_Y                   = 7,  // DRAM IDs: 20.
+	LPDDR4X_8GB_SAMSUNG_1Y_Y                   = 8,  // DRAM IDs: 21.
+	//LPDDR4X_8GB_SAMSUNG_1Y_A                   = 9,  // DRAM IDs: 22. Unused.
+	LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF = 10, // DRAM IDs: 25, 26, 27.
+	LPDDR4X_4GB_HYNIX_1Y_A                     = 11, // DRAM IDs: 03, 05, 06.
 };

 void sdram_init();
--- a/bdk/mem/sdram_config_t210b01.inl
+++ b/bdk/mem/sdram_config_t210b01.inl
@ -769,13 +769,13 @@ static const sdram_vendor_patch_t sdram_cfg_vendor_patches_t210b01[] = {
 	{ 0x2A800000, 0x6DC / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // mc_video_protect_gpu_override0.
 	{ 0x00000002, 0x6E0 / 4, LPDDR4X_8GB_SAMSUNG_K4UBE3D4AM_MGCJ }, // mc_video_protect_gpu_override1.

-	// Micron LPDDR4X 4GB MT53D1024M32D1NP-053-WT Die-E for retail Iowa and Hoag.
-	{ 0x05500000, 0x0D4 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046 }, // emc_auto_cal_config2.
-	{ 0xC9AFBCBC, 0x0F4 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046 }, // emc_auto_cal_vref_sel0.
-	{ 0x88161414, 0x2E0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046 }, // emc_mrw14.
-	{ 0x80000713, 0x32C / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046 }, // emc_dyn_self_ref_control.
-	{ 0x2A800000, 0x6DC / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046 }, // mc_video_protect_gpu_override0.
-	{ 0x00000002, 0x6E0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046 }, // mc_video_protect_gpu_override1.
+	// Micron LPDDR4X 4GB MT53D1024M32D1NP-053-WT:E Die-E for retail Iowa and Hoag.
+	{ 0x05500000, 0x0D4 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE }, // emc_auto_cal_config2.
+	{ 0xC9AFBCBC, 0x0F4 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE }, // emc_auto_cal_vref_sel0.
+	{ 0x88161414, 0x2E0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE }, // emc_mrw14.
+	{ 0x80000713, 0x32C / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE }, // emc_dyn_self_ref_control.
+	{ 0x2A800000, 0x6DC / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE }, // mc_video_protect_gpu_override0.
+	{ 0x00000002, 0x6E0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTE }, // mc_video_protect_gpu_override1.

 	// Samsung LPDDR4X 4GB (Y01) Die-? for Iowa.
 	{ 0x05500000, 0x0D4 / 4, LPDDR4X_4GB_SAMSUNG_Y }, // emc_auto_cal_config2.
@ -957,19 +957,20 @@ static const sdram_vendor_patch_t sdram_cfg_vendor_patches_t210b01[] = {
 	{ 0x00000002, 0x680 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // mc_emem_arb_timing_r2r.
 	{ 0x02020001, 0x694 / 4, LPDDR4X_8GB_SAMSUNG_1Y_A }, // mc_emem_arb_da_turns.
 */
-	// Micron LPDDR4X 4GB 10nm-class (1y-01) Die-A for Unknown Iowa/Hoag/Aula.
-	{ 0x05500000, 0x0D4 / 4, LPDDR4X_4GB_MICRON_1Y_A }, // emc_auto_cal_config2.
-	{ 0xC9AFBCBC, 0x0F4 / 4, LPDDR4X_4GB_MICRON_1Y_A }, // emc_auto_cal_vref_sel0.
-	{ 0x00000006, 0x1CC / 4, LPDDR4X_4GB_MICRON_1Y_A }, // emc_quse.
-	{ 0x00000005, 0x1D0 / 4, LPDDR4X_4GB_MICRON_1Y_A }, // emc_quse_width.
-	{ 0x00000003, 0x1DC / 4, LPDDR4X_4GB_MICRON_1Y_A }, // emc_einput.
-	{ 0x0000000C, 0x1E0 / 4, LPDDR4X_4GB_MICRON_1Y_A }, // emc_einput_duration.
-	{ 0x00000008, 0x24C / 4, LPDDR4X_4GB_MICRON_1Y_A }, // emc_tfaw.
-	{ 0x88161414, 0x2E0 / 4, LPDDR4X_4GB_MICRON_1Y_A }, // emc_mrw14.
-	{ 0x80000713, 0x32C / 4, LPDDR4X_4GB_MICRON_1Y_A }, // emc_dyn_self_ref_control.
-	{ 0x00000001, 0x670 / 4, LPDDR4X_4GB_MICRON_1Y_A }, // mc_emem_arb_timing_faw.
-	{ 0x2A800000, 0x6DC / 4, LPDDR4X_4GB_MICRON_1Y_A }, // mc_video_protect_gpu_override0.
-	{ 0x00000002, 0x6E0 / 4, LPDDR4X_4GB_MICRON_1Y_A }, // mc_video_protect_gpu_override1.
+
+	// Micron LPDDR4X 4GB MT53D1024M32D1NP-053-WT:F 10nm-class (1y-01) Die-F for Newer Iowa/Hoag/Aula.
+	{ 0x05500000, 0x0D4 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_auto_cal_config2.
+	{ 0xC9AFBCBC, 0x0F4 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_auto_cal_vref_sel0.
+	{ 0x00000006, 0x1CC / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_quse.
+	{ 0x00000005, 0x1D0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_quse_width.
+	{ 0x00000003, 0x1DC / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_einput.
+	{ 0x0000000C, 0x1E0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_einput_duration.
+	{ 0x00000008, 0x24C / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_tfaw.
+	{ 0x88161414, 0x2E0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_mrw14.
+	{ 0x80000713, 0x32C / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // emc_dyn_self_ref_control.
+	{ 0x00000001, 0x670 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // mc_emem_arb_timing_faw.
+	{ 0x2A800000, 0x6DC / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // mc_video_protect_gpu_override0.
+	{ 0x00000002, 0x6E0 / 4, LPDDR4X_4GB_MICRON_MT53E512M32D2NP_046_WTF }, // mc_video_protect_gpu_override1.

 	// Hynix LPDDR4X 4GB 10nm-class (1y-01) Die-A for Unknown Iowa/Hoag/Aula.
 	{ 0x05500000, 0x0D4 / 4, LPDDR4X_4GB_HYNIX_1Y_A }, // emc_auto_cal_config2.
--- a/bdk/mem/smmu.c
+++ b/bdk/mem/smmu.c
@ -48,8 +48,8 @@ u8 smmu_payload[] __attribute__((aligned(16))) = {
 void *page_alloc(u32 num)
 {
 	u8 *res = _pageheap;
-	_pageheap += 0x1000 * num;
-	memset(res, 0, 0x1000 * num);
+	_pageheap += SZ_PAGE * num;
+	memset(res, 0, SZ_PAGE * num);
 	return res;
 }

@ -150,8 +150,8 @@ void smmu_map(u32 *pdir, u32 addr, u32 page, int cnt, u32 attr)
 	{
 		u32 *pte = smmu_get_pte(pdir, addr);
 		*pte = SMMU_ADDR_TO_PFN(page) | attr;
-		addr += 0x1000;
-		page += 0x1000;
+		addr += SZ_PAGE;
+		page += SZ_PAGE;
 	}
 	smmu_flush_all();
 }
--- a/bdk/memory_map.h
+++ b/bdk/memory_map.h
@ -23,7 +23,7 @@
 #define LDR_LOAD_ADDR     0x40007000

 #define IPL_LOAD_ADDR     0x40008000
-#define  IPL_SZ_MAX          0x20000 // 128KB.
+#define  IPL_SZ_MAX          SZ_128K

 /* --- XUSB EP context and TRB ring buffers --- */
 #define XUSB_RING_ADDR    0x40020000
@ -35,16 +35,16 @@

 /* --- DRAM START --- */
 #define DRAM_START     0x80000000
-#define  HOS_RSVD       0x1000000 // Do not write anything in this area.
+#define  HOS_RSVD          SZ_16M // Do not write anything in this area.

 #define NYX_LOAD_ADDR  0x81000000
-#define  NYX_SZ_MAX     0x1000000 // 16MB
+#define  NYX_SZ_MAX        SZ_16M
 /* --- Gap: 0x82000000 - 0x82FFFFFF --- */

 /* Stack theoretical max: 33MB */
 #define IPL_STACK_TOP  0x83100000
 #define IPL_HEAP_START 0x84000000
-#define  IPL_HEAP_SZ   0x20000000 // 512MB.
+#define  IPL_HEAP_SZ      SZ_512M
 /* --- Gap: 1040MB 0xA4000000 - 0xE4FFFFFF --- */

 // Virtual disk / Chainloader buffers.
@ -60,26 +60,26 @@

 // L4T Kernel Panic Storage (PSTORE).
 #define PSTORE_ADDR   0xB0000000
-#define  PSTORE_SZ      0x200000 // 2MB.
+#define  PSTORE_SZ         SZ_2M

 //#define DRAM_LIB_ADDR    0xE0000000
 /* --- Chnldr: 252MB 0xC03C0000 - 0xCFFFFFFF --- */ //! Only used when chainloading.

 // SDMMC DMA buffers 1
 #define SDMMC_UPPER_BUFFER 0xE5000000
-#define  SDMMC_UP_BUF_SZ    0x8000000 // 128MB.
+#define  SDMMC_UP_BUF_SZ      SZ_128M

 // Nyx buffers.
 #define NYX_STORAGE_ADDR 0xED000000
 #define NYX_RES_ADDR     0xEE000000
-#define  NYX_RES_SZ       0x1000000 // 16MB.
+#define  NYX_RES_SZ          SZ_16M

 // SDMMC DMA buffers 2
 #define SDXC_BUF_ALIGNED   0xEF000000
 #define MIXD_BUF_ALIGNED   0xF0000000
 #define TITLEKEY_BUF_ADR   MIXD_BUF_ALIGNED
 #define EMMC_BUF_ALIGNED   MIXD_BUF_ALIGNED
-#define  SDMMC_DMA_BUF_SZ   0x1000000 // 16MB (4MB currently used).
+#define  SDMMC_DMA_BUF_SZ      SZ_16M // 4MB currently used.

 // Nyx LvGL buffers.
 #define NYX_LV_VDB_ADR   0xF1000000
@ -107,7 +107,7 @@
 #define USB_EP_CONTROL_BUF_ADDR   0xFEF80000
 #define USB_EP_BULK_IN_BUF_ADDR   0xFF000000
 #define USB_EP_BULK_OUT_BUF_ADDR  0xFF800000
-#define  USB_EP_BULK_OUT_MAX_XFER   0x800000
+#define  USB_EP_BULK_OUT_MAX_XFER      SZ_8M

 // #define EXT_PAYLOAD_ADDR    0xC0000000
 // #define RCM_PAYLOAD_ADDR    (EXT_PAYLOAD_ADDR + ALIGN(PATCHED_RELOC_SZ, 0x10))
--- a/bdk/power/regulator_5v.c
+++ b/bdk/power/regulator_5v.c
@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019 CTCaer
+ * Copyright (c) 2019-2021 CTCaer
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@ -14,7 +14,9 @@
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

+#include <soc/fuse.h>
 #include <soc/gpio.h>
+#include <soc/hw_init.h>
 #include <soc/pinmux.h>
 #include <soc/pmc.h>
 #include <soc/t210.h>
@ -34,17 +36,30 @@ void regulator_5v_enable(u8 dev)
 		gpio_output_enable(GPIO_PORT_A, GPIO_PIN_5, GPIO_OUTPUT_ENABLE);
 		gpio_write(GPIO_PORT_A, GPIO_PIN_5, GPIO_HIGH);

-		// Fan and Rail power from USB 5V VBUS.
-		PINMUX_AUX(PINMUX_AUX_USB_VBUS_EN0) = PINMUX_LPDR | 1;
-		gpio_config(GPIO_PORT_CC, GPIO_PIN_4, GPIO_MODE_GPIO);
-		gpio_output_enable(GPIO_PORT_CC, GPIO_PIN_4, GPIO_OUTPUT_ENABLE);
-		gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_LOW);
-		usb_src = false;
+		// Only Icosa and Iowa have USB 5V VBUS rails. Skip on Hoag/Aula.
+		u32 hw_type = fuse_read_hw_type();
+		if (hw_type == FUSE_NX_HW_TYPE_ICOSA ||
+			hw_type == FUSE_NX_HW_TYPE_IOWA)
+		{
+			// Fan and Rail power from USB 5V VBUS.
+			PINMUX_AUX(PINMUX_AUX_USB_VBUS_EN0) = PINMUX_LPDR | 1;
+			gpio_config(GPIO_PORT_CC, GPIO_PIN_4, GPIO_MODE_GPIO);
+			gpio_output_enable(GPIO_PORT_CC, GPIO_PIN_4, GPIO_OUTPUT_ENABLE);
+			gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_LOW);
+		}

-		// Make sure GPIO power is enabled.
-		PMC(APBDEV_PMC_NO_IOPOWER) &= ~PMC_NO_IOPOWER_GPIO_IO_EN;
-		// Override power detect for GPIO AO IO rails.
-		PMC(APBDEV_PMC_PWR_DET_VAL) &= ~PMC_PWR_DET_GPIO_IO_EN;
+		// Enable GPIO AO IO rail for T210.
+		if (hw_get_chip_id() == GP_HIDREV_MAJOR_T210)
+		{
+			// Make sure GPIO power is enabled.
+			PMC(APBDEV_PMC_NO_IOPOWER) &= ~PMC_NO_IOPOWER_GPIO_IO_EN;
+			(void)PMC(APBDEV_PMC_NO_IOPOWER); // Commit write.
+
+			// Override power detect for GPIO AO IO rails.
+			PMC(APBDEV_PMC_PWR_DET_VAL) &= ~PMC_PWR_DET_GPIO_IO_EN;
+			(void)PMC(APBDEV_PMC_PWR_DET_VAL); // Commit write.
+		}
+		usb_src = false;
 	}
 	reg_5v_dev |= dev;
 }
@ -61,15 +76,26 @@ void regulator_5v_disable(u8 dev)
 		gpio_config(GPIO_PORT_A, GPIO_PIN_5, GPIO_MODE_SPIO);
 		PINMUX_AUX(PINMUX_AUX_SATA_LED_ACTIVE) = PINMUX_PARKED | PINMUX_INPUT_ENABLE;

-		// Rail power from USB 5V VBUS.
-		gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_LOW);
-		gpio_output_enable(GPIO_PORT_CC, GPIO_PIN_4, GPIO_OUTPUT_DISABLE);
-		gpio_config(GPIO_PORT_CC, GPIO_PIN_4, GPIO_MODE_SPIO);
-		PINMUX_AUX(PINMUX_AUX_USB_VBUS_EN0) = PINMUX_IO_HV | PINMUX_LPDR | PINMUX_PARKED | PINMUX_INPUT_ENABLE;
-		usb_src = false;
+		// Only Icosa and Iowa have USB 5V VBUS rails. Skip on Hoag/Aula.
+		u32 hw_type = fuse_read_hw_type();
+		if (hw_type == FUSE_NX_HW_TYPE_ICOSA ||
+			hw_type == FUSE_NX_HW_TYPE_IOWA)
+		{
+			// Rail power from USB 5V VBUS.
+			gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_LOW);
+			gpio_output_enable(GPIO_PORT_CC, GPIO_PIN_4, GPIO_OUTPUT_DISABLE);
+			gpio_config(GPIO_PORT_CC, GPIO_PIN_4, GPIO_MODE_SPIO);
+			PINMUX_AUX(PINMUX_AUX_USB_VBUS_EN0) = PINMUX_IO_HV | PINMUX_LPDR | PINMUX_PARKED | PINMUX_INPUT_ENABLE;
+			usb_src = false;
+
+		}

 		// GPIO AO IO rails.
-		PMC(APBDEV_PMC_PWR_DET_VAL) |= PMC_PWR_DET_GPIO_IO_EN;
+		if (hw_get_chip_id() == GP_HIDREV_MAJOR_T210)
+		{
+			PMC(APBDEV_PMC_PWR_DET_VAL) |= PMC_PWR_DET_GPIO_IO_EN;
+			(void)PMC(APBDEV_PMC_PWR_DET_VAL); // Commit write.
+		}
 	}
 }

@ -80,6 +106,12 @@ bool regulator_5v_get_dev_enabled(u8 dev)

 void regulator_5v_usb_src_enable(bool enable)
 {
+	// Only for Icosa/Iowa. Skip on Hoag/Aula.
+	u32 hw_type = fuse_read_hw_type();
+	if (hw_type != FUSE_NX_HW_TYPE_ICOSA &&
+		hw_type != FUSE_NX_HW_TYPE_IOWA)
+		return;
+
 	if (enable && !usb_src)
 	{
 		gpio_write(GPIO_PORT_CC, GPIO_PIN_4, GPIO_HIGH);
--- a/bdk/sec/tsec.c
+++ b/bdk/sec/tsec.c
@ -125,7 +125,7 @@ int tsec_query(void *tsec_keys, tsec_ctxt_t *tsec_ctxt)
 		TSEC(TSEC_DMATRFBASE) = (u32)tsec_ctxt->fw >> 8;
 	else
 	{
-		fwbuf = (u8 *)malloc(0x4000);
+		fwbuf = (u8 *)malloc(SZ_16K);
 		u8 *fwbuf_aligned = (u8 *)ALIGN((u32)fwbuf, 0x100);
 		memcpy(fwbuf_aligned, tsec_ctxt->fw, tsec_ctxt->size);
 		TSEC(TSEC_DMATRFBASE) = (u32)fwbuf_aligned >> 8;
@ -151,13 +151,13 @@ int tsec_query(void *tsec_keys, tsec_ctxt_t *tsec_ctxt)

 		// Clock reset controller.
 		car = page_alloc(1);
-		memcpy(car, (void *)CLOCK_BASE, 0x1000);
+		memcpy(car, (void *)CLOCK_BASE, SZ_PAGE);
 		car[CLK_RST_CONTROLLER_CLK_SOURCE_TSEC / 4] = 2;
 		smmu_map(pdir, CLOCK_BASE, (u32)car, 1, _WRITABLE | _READABLE | _NONSECURE);

 		// Fuse driver.
 		fuse = page_alloc(1);
-		memcpy((void *)&fuse[0x800/4], (void *)FUSE_BASE, 0x400);
+		memcpy((void *)&fuse[0x800/4], (void *)FUSE_BASE, SZ_1K);
 		fuse[0x82C / 4] = 0;
 		fuse[0x9E0 / 4] = (1 << (TSEC_HOS_KB_620 + 2)) - 1;
 		fuse[0x9E4 / 4] = (1 << (TSEC_HOS_KB_620 + 2)) - 1;
@ -173,12 +173,12 @@ int tsec_query(void *tsec_keys, tsec_ctxt_t *tsec_ctxt)

 		// Security engine.
 		se = page_alloc(1);
-		memcpy(se, (void *)SE_BASE, 0x1000);
+		memcpy(se, (void *)SE_BASE, SZ_PAGE);
 		smmu_map(pdir, SE_BASE, (u32)se, 1, _READABLE | _WRITABLE | _NONSECURE);

 		// Memory controller.
 		mc = page_alloc(1);
-		memcpy(mc, (void *)MC_BASE, 0x1000);
+		memcpy(mc, (void *)MC_BASE, SZ_PAGE);
 		mc[MC_IRAM_BOM / 4] = 0;
 		mc[MC_IRAM_TOM / 4] = 0x80000000;
 		smmu_map(pdir, MC_BASE, (u32)mc, 1, _READABLE | _NONSECURE);
--- a/bdk/soc/hw_init.c
+++ b/bdk/soc/hw_init.c
@ -48,14 +48,8 @@
 extern boot_cfg_t b_cfg;
 extern volatile nyx_storage_t *nyx_str;

-/*
- * CLK_OSC - 38.4 MHz crystal.
- * CLK_M   - 19.2 MHz (osc/2).
- * CLK_S   - 32.768 KHz (from PMIC).
- * SCLK    - 204MHz init (-> 408MHz -> OC).
- * HCLK    - 204MHz init (-> 408MHz -> OC).
- * PCLK    - 68MHz  init (-> 136MHz -> OC/4).
- */
+u32 hw_rst_status;
+u32 hw_rst_reason;

 u32 hw_get_chip_id()
 {
@ -65,6 +59,15 @@ u32 hw_get_chip_id()
 		return GP_HIDREV_MAJOR_T210;
 }

+/*
+ * CLK_OSC - 38.4 MHz crystal.
+ * CLK_M   - 19.2 MHz (osc/2).
+ * CLK_S   - 32.768 KHz (from PMIC).
+ * SCLK    - 204MHz init (-> 408MHz -> OC).
+ * HCLK    - 204MHz init (-> 408MHz -> OC).
+ * PCLK    - 68MHz  init (-> 136MHz -> OC/4).
+ */
+
 static void _config_oscillators()
 {
 	CLOCK(CLK_RST_CONTROLLER_SPARE_REG0) = (CLOCK(CLK_RST_CONTROLLER_SPARE_REG0) & 0xFFFFFFF3) | 4; // Set CLK_M_DIVISOR to 2.
@ -260,11 +263,15 @@ static void _config_se_brom()
 	// se_key_acc_ctrl(15, SE_KEY_TBL_DIS_KEYREAD_FLAG);

 	// This memset needs to happen here, else TZRAM will behave weirdly later on.
-	memset((void *)TZRAM_BASE, 0, 0x10000);
+	memset((void *)TZRAM_BASE, 0, SZ_64K);
 	PMC(APBDEV_PMC_CRYPTO_OP) = PMC_CRYPTO_OP_SE_ENABLE;
 	SE(SE_INT_STATUS_REG) = 0x1F; // Clear all SE interrupts.

-	// Clear the boot reason to avoid problems later
+	// Save reset reason.
+	hw_rst_status = PMC(APBDEV_PMC_SCRATCH200);
+	hw_rst_reason = PMC(APBDEV_PMC_RST_STATUS) & PMC_RST_STATUS_MASK;
+
+	// Clear the boot reason to avoid problems later.
 	PMC(APBDEV_PMC_SCRATCH200) = 0x0;
 	PMC(APBDEV_PMC_RST_STATUS) = 0x0;
 	APB_MISC(APB_MISC_PP_STRAPPING_OPT_A) = (APB_MISC(APB_MISC_PP_STRAPPING_OPT_A) & 0xF0) | (7 << 10);
--- a/bdk/soc/hw_init.h
+++ b/bdk/soc/hw_init.h
@ -1,6 +1,6 @@
 /*
 * Copyright (c) 2018 naehrwert
- * Copyright (c) 2018 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@ -23,6 +23,9 @@
 #define BL_MAGIC_CRBOOT_SLD 0x30444C53 // SLD0, seamless display type 0.
 #define BL_MAGIC_BROKEN_HWI 0xBAADF00D // Broken hwinit.

+extern u32 hw_rst_status;
+extern u32 hw_rst_reason;
+
 void hw_init();
 void hw_reinit_workaround(bool coreboot, u32 magic);
 u32  hw_get_chip_id();
--- a/bdk/soc/pmc.h
+++ b/bdk/soc/pmc.h
@ -60,6 +60,13 @@
 #define APBDEV_PMC_CLK_OUT_CNTRL 0x1A8
 #define  PMC_CLK_OUT_CNTRL_CLK1_FORCE_EN BIT(2)
 #define APBDEV_PMC_RST_STATUS 0x1B4
+#define  PMC_RST_STATUS_MASK 0x7
+#define  PMC_RST_STATUS_POR 0
+#define  PMC_RST_STATUS_WATCHDOG 1
+#define  PMC_RST_STATUS_SENSOR 2
+#define  PMC_RST_STATUS_SW_MAIN 3
+#define  PMC_RST_STATUS_LP0 4
+#define  PMC_RST_STATUS_AOTAG 5
 #define APBDEV_PMC_IO_DPD_REQ 0x1B8
 #define  PMC_IO_DPD_REQ_DPD_OFF BIT(30)
 #define APBDEV_PMC_IO_DPD2_REQ 0x1C0
--- a/bdk/thermal/fan.c
+++ b/bdk/thermal/fan.c
@ -1,7 +1,7 @@
 /*
 * Fan driver for Nintendo Switch
 *
- * Copyright (c) 2018-2020 CTCaer
+ * Copyright (c) 2018-2021 CTCaer
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@ -18,6 +18,7 @@

 #include <thermal/fan.h>
 #include <power/regulator_5v.h>
+#include <soc/fuse.h>
 #include <soc/gpio.h>
 #include <soc/pinmux.h>
 #include <soc/t210.h>
@ -28,9 +29,20 @@ void set_fan_duty(u32 duty)
 	static bool fan_init = false;
 	static u16  curr_duty = -1;

+	if (duty > 236)
+		duty = 236;
+
 	if (curr_duty == duty)
 		return;

+	curr_duty = duty;
+
+	//! TODO: Add HOAG/AULA support.
+	u32 hw_type = fuse_read_hw_type();
+	if (hw_type != FUSE_NX_HW_TYPE_ICOSA &&
+		hw_type != FUSE_NX_HW_TYPE_IOWA)
+		return;
+
 	if (!fan_init)
 	{
 		// Fan tachometer.
@ -46,9 +58,6 @@ void set_fan_duty(u32 duty)
 		fan_init = true;
 	}

-	if (duty > 236)
-		duty = 236;
-
 	// Inverted polarity.
 	u32 inv_duty = 236 - duty;

@ -71,8 +80,6 @@ void set_fan_duty(u32 duty)
 		// Enable fan.
 		PINMUX_AUX(PINMUX_AUX_LCD_GPIO2) = 1; // Set source to PWM1.
 	}
-
-	curr_duty = duty;
 }

 void get_fan_speed(u32 *duty, u32 *rpm)
--- a/bdk/usb/usb_gadget_ums.c
+++ b/bdk/usb/usb_gadget_ums.c
@ -1092,8 +1092,7 @@ static int _scsi_prevent_allow_removal(usbd_gadget_ums_t *ums)

 	// Notify for possible unmounting?
 	// Normally we sync here but we do synced writes to SDMMC.
-	if (ums->lun.prevent_medium_removal && !prevent)
-		;
+	if (ums->lun.prevent_medium_removal && !prevent) { /* Do nothing */ }

 	ums->lun.prevent_medium_removal = prevent;

--- a/bdk/utils/types.h
+++ b/bdk/utils/types.h
@ -20,10 +20,84 @@

 #include <assert.h>

+/* Types */
+typedef signed char s8;
+typedef short s16;
+typedef short SHORT;
+typedef int s32;
+typedef int INT;
+typedef int bool;
+typedef long LONG;
+typedef long long int s64;
+
+typedef unsigned char u8;
+typedef unsigned char BYTE;
+typedef unsigned short u16;
+typedef unsigned short WORD;
+typedef unsigned short WCHAR;
+typedef unsigned int u32;
+typedef unsigned int UINT;
+typedef unsigned long DWORD;
+typedef unsigned long long QWORD;
+typedef unsigned long long int u64;
+
+typedef volatile unsigned char vu8;
+typedef volatile unsigned short vu16;
+typedef volatile unsigned int vu32;
+
+#ifdef __aarch64__
+typedef u64 uptr;
+#else /* __arm__ or __thumb__ */
+typedef u32 uptr;
+#endif
+
+/* Colors */
+#define COLOR_RED    0xFFE70000
+#define COLOR_ORANGE 0xFFFF8C00
+#define COLOR_YELLOW 0xFFFFFF40
+#define COLOR_GREEN  0xFF40FF00
+#define COLOR_BLUE   0xFF00DDFF
+#define COLOR_VIOLET 0xFF8040FF
+
+static const u32 colors[6] = {COLOR_RED, COLOR_ORANGE, COLOR_YELLOW, COLOR_GREEN, COLOR_BLUE, COLOR_VIOLET};
+
+/* Important */
+#define false 0
+#define true  1
+
 #define NULL ((void *)0)

-#define ALWAYS_INLINE inline __attribute__((always_inline))
+/* Misc */
+#define DISABLE 0
+#define ENABLE  1

+/* Sizes */
+#define SZ_1K   0x400
+#define SZ_2K   0x800
+#define SZ_4K   0x1000
+#define SZ_8K   0x2000
+#define SZ_16K  0x4000
+#define SZ_32K  0x8000
+#define SZ_64K  0x10000
+#define SZ_128K 0x20000
+#define SZ_256K 0x40000
+#define SZ_512K 0x80000
+#define SZ_1M   0x100000
+#define SZ_2M   0x200000
+#define SZ_4M   0x400000
+#define SZ_8M   0x800000
+#define SZ_16M  0x1000000
+#define SZ_32M  0x2000000
+#define SZ_64M  0x4000000
+#define SZ_128M 0x8000000
+#define SZ_256M 0x10000000
+#define SZ_512M 0x20000000
+#define SZ_1G   0x40000000
+#define SZ_2G   0x80000000
+#define SZ_PAGE SZ_4K
+
+/* Macros */
+#define ALWAYS_INLINE inline __attribute__((always_inline))
 #define ALIGN(x, a) (((x) + (a) - 1) & ~((a) - 1))
 #define ALIGN_DOWN(x, a) ((x) & ~((a) - 1))
 #define BIT(n) (1U << (n))
@ -36,58 +110,37 @@
 #define CLZ(n) __builtin_clz(n)
 #define CLO(n) __builtin_clz(~n)

-#define OFFSET_OF(t, m) ((u32)&((t *)NULL)->m)
-#define CONTAINER_OF(mp, t, mn) ((t *)((u32)mp - OFFSET_OF(t, mn)))
+#define OFFSET_OF(t, m) ((uptr)&((t *)NULL)->m)
+#define CONTAINER_OF(mp, t, mn) ((t *)((uptr)mp - OFFSET_OF(t, mn)))

-#define COLOR_RED    0xFFE70000
-#define COLOR_ORANGE 0xFFFF8C00
-#define COLOR_YELLOW 0xFFFFFF40
-#define COLOR_GREEN  0xFF40FF00
-#define COLOR_BLUE   0xFF00DDFF
-#define COLOR_VIOLET 0xFF8040FF
+#define byte_swap_16(num) ((((num) >> 8) & 0xff) | (((num) << 8) & 0xff00))
+#define byte_swap_32(num) ((((num) >> 24) & 0xff) | (((num) << 8) & 0xff0000) | \
+						(((num) >> 8 )& 0xff00) | (((num) << 24) & 0xff000000))

-typedef signed char s8;
-typedef short s16;
-typedef short SHORT;
-typedef int s32;
-typedef int INT;
-typedef long LONG;
-typedef long long int s64;
-typedef unsigned char u8;
-typedef unsigned char BYTE;
-typedef unsigned short u16;
-typedef unsigned short WORD;
-typedef unsigned short WCHAR;
-typedef unsigned int u32;
-typedef unsigned int UINT;
-typedef unsigned long DWORD;
-typedef unsigned long long QWORD;
-typedef unsigned long long int u64;
-typedef volatile unsigned char vu8;
-typedef volatile unsigned short vu16;
-typedef volatile unsigned int vu32;
-
-#ifdef __aarch64__
-typedef u64 uptr;
-#else /* __arm__ or __thumb__ */
-typedef u32 uptr;
-#endif
-
-static const u32 colors[6] = {COLOR_RED, COLOR_ORANGE, COLOR_YELLOW, COLOR_GREEN, COLOR_BLUE, COLOR_VIOLET};
-
-typedef int bool;
-#define true  1
-#define false 0
-
-#define DISABLE 0
-#define ENABLE  1

+/* Bootloader/Nyx */
 #define BOOT_CFG_AUTOBOOT_EN BIT(0)
 #define BOOT_CFG_FROM_LAUNCH BIT(1)
 #define BOOT_CFG_FROM_ID     BIT(2)
 #define BOOT_CFG_TO_EMUMMC   BIT(3)

-#define EXTRA_CFG_DUMP_EMUMMC BIT(0)
+#define EXTRA_CFG_KEYS    BIT(0)
+#define EXTRA_CFG_PAYLOAD BIT(1)
+#define EXTRA_CFG_MODULE  BIT(2)
+
+#define EXTRA_CFG_NYX_UMS    BIT(5)
+#define EXTRA_CFG_NYX_RELOAD BIT(6)
+
+typedef enum _nyx_ums_type
+{
+	NYX_UMS_SD_CARD = 0,
+	NYX_UMS_EMMC_BOOT0,
+	NYX_UMS_EMMC_BOOT1,
+	NYX_UMS_EMMC_GPP,
+	NYX_UMS_EMUMMC_BOOT0,
+	NYX_UMS_EMUMMC_BOOT1,
+	NYX_UMS_EMUMMC_GPP
+} nyx_ums_type;

 typedef struct __attribute__((__packed__)) _boot_cfg_t
 {
@ -107,7 +160,7 @@ typedef struct __attribute__((__packed__)) _boot_cfg_t
 	};
 } boot_cfg_t;

-static_assert(sizeof(boot_cfg_t) == 0x84, "Boot CFG size is wrong!");
+static_assert(sizeof(boot_cfg_t) == 0x84, "Boot cfg storage size is wrong!");

 typedef struct __attribute__((__packed__)) _ipl_ver_meta_t
 {
--- a/bdk/utils/util.c
+++ b/bdk/utils/util.c
@ -1,6 +1,6 @@
 /*
 * Copyright (c) 2018 naehrwert
-* Copyright (c) 2018-2021 CTCaer
+* Copyright (c) 2018-2020 CTCaer
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU General Public License,
@ -102,6 +102,27 @@ void exec_cfg(u32 *base, const cfg_op_t *ops, u32 num_ops)
 		base[ops[i].off] = ops[i].val;
 }

+u16 crc16_calc(const u8 *buf, u32 len)
+{
+	const u8 *p, *q;
+	u16 crc = 0x55aa;
+
+	static u16 table[16] = {
+		0x0000, 0xCC01, 0xD801, 0x1400, 0xF001, 0x3C00, 0x2800, 0xE401,
+		0xA001, 0x6C00, 0x7800, 0xB401, 0x5000, 0x9C01, 0x8801, 0x4400
+	};
+
+	q = buf + len;
+	for (p = buf; p < q; p++)
+	{
+		u8 oct = *p;
+		crc = (crc >> 4) ^ table[crc & 0xf] ^ table[(oct >> 0) & 0xf];
+		crc = (crc >> 4) ^ table[crc & 0xf] ^ table[(oct >> 4) & 0xf];
+	}
+
+	return crc;
+}
+
 u32 crc32_calc(u32 crc, const u8 *buf, u32 len)
 {
 	const u8 *p, *q;
--- a/bdk/utils/util.h
+++ b/bdk/utils/util.h
@ -21,6 +21,8 @@
 #include <utils/types.h>
 #include <mem/minerva.h>

+#define NYX_NEW_INFO 0x3058594E
+
 typedef enum
 {
 	REBOOT_RCM,          // PMC reset. Enter RCM mode.
@ -33,9 +35,9 @@ typedef enum

 typedef enum
 {
-	NYX_CFG_BIS  = BIT(5),
 	NYX_CFG_UMS  = BIT(6),
-	NYX_CFG_DUMP = BIT(7),
+
+	NYX_CFG_EXTRA = 0xFF << 24
 } nyx_cfg_t;

 typedef enum
@ -44,15 +46,11 @@ typedef enum
 	ERR_SYSOLD_NYX = BIT(1),
 	ERR_LIBSYS_MTC = BIT(2),
 	ERR_SD_BOOT_EN = BIT(3),
+	ERR_PANIC_CODE = BIT(4),
 	ERR_L4T_KERNEL = BIT(24),
 	ERR_EXCEPTION  = BIT(31),
 } hekate_errors_t;

-#define byte_swap_32(num) ((((num) >> 24) & 0xff) | (((num) << 8) & 0xff0000) | \
-						(((num) >> 8 )& 0xff00) | (((num) << 24) & 0xff000000))
-
-#define byte_swap_16(num) ((((num) >> 8) & 0xff) | (((num) << 8) & 0xff00))
-
 typedef struct _cfg_op_t
 {
 	u32 off;
@ -75,7 +73,7 @@ typedef struct _nyx_storage_t
 	u32 cfg;
 	u8  irama[0x8000];
 	u8  hekate[0x30000];
-	u8  rsvd[0x800000 - sizeof(nyx_info_t)];
+	u8  rsvd[SZ_8M - sizeof(nyx_info_t)];
 	nyx_info_t info;
 	mtc_config_t mtc_cfg;
 	emc_table_t mtc_table[10];
@ -85,11 +83,12 @@ u8   bit_count(u32 val);
 u32  bit_count_mask(u8 bits);

 void exec_cfg(u32 *base, const cfg_op_t *ops, u32 num_ops);
+u16  crc16_calc(const u8 *buf, u32 len);
 u32  crc32_calc(u32 crc, const u8 *buf, u32 len);

-u32 get_tmr_us();
-u32 get_tmr_ms();
-u32 get_tmr_s();
+u32  get_tmr_us();
+u32  get_tmr_ms();
+u32  get_tmr_s();
 void usleep(u32 us);
 void msleep(u32 ms);

--- a/source/hos/hos.h
+++ b/source/hos/hos.h
@ -33,6 +33,7 @@
 #define KB_FIRMWARE_VERSION_910  10
 #define KB_FIRMWARE_VERSION_1210 11
 #define KB_FIRMWARE_VERSION_1300 12
-#define KB_FIRMWARE_VERSION_MAX  KB_FIRMWARE_VERSION_1300 //!TODO: Update on mkey changes.
+#define KB_FIRMWARE_VERSION_1400 13
+#define KB_FIRMWARE_VERSION_MAX  KB_FIRMWARE_VERSION_1400 //!TODO: Update on mkey changes.

 #endif
--- a/source/keys/key_sources.inl
+++ b/source/keys/key_sources.inl
@ -37,6 +37,7 @@ static const u8 master_kek_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION
    {0x30, 0x3F, 0x02, 0x7E, 0xD8, 0x38, 0xEC, 0xD7, 0x93, 0x25, 0x34, 0xB5, 0x30, 0xEB, 0xCA, 0x7A}, //9.1.0
    {0x84, 0x67, 0xB6, 0x7F, 0x13, 0x11, 0xAE, 0xE6, 0x58, 0x9B, 0x19, 0xAF, 0x13, 0x6C, 0x80, 0x7A}, //12.1.0
    {0x68, 0x3B, 0xCA, 0x54, 0xB8, 0x6F, 0x92, 0x48, 0xC3, 0x05, 0x76, 0x87, 0x88, 0x70, 0x79, 0x23}, //13.0.0
+    {0xF0, 0x13, 0x37, 0x9A, 0xD5, 0x63, 0x51, 0xC3, 0xB4, 0x96, 0x35, 0xBC, 0x9C, 0xE8, 0x76, 0x81}, //14.0.0
 };

 //!TODO: Update on mkey changes.
@ -54,6 +55,7 @@ static const u8 master_key_vectors[KB_FIRMWARE_VERSION_MAX + 1][0x10] __attribut
    {0xB8, 0x96, 0x9E, 0x4A, 0x00, 0x0D, 0xD6, 0x28, 0xB3, 0xD1, 0xDB, 0x68, 0x5F, 0xFB, 0xE1, 0x2A}, /* Master key 09 encrypted with Master key 0A. */
    {0xC1, 0x8D, 0x16, 0xBB, 0x2A, 0xE4, 0x1D, 0xD4, 0xC2, 0xC1, 0xB6, 0x40, 0x94, 0x35, 0x63, 0x98}, /* Master key 0A encrypted with Master key 0B. */
    {0xA3, 0x24, 0x65, 0x75, 0xEA, 0xCC, 0x6E, 0x8D, 0xFB, 0x5A, 0x16, 0x50, 0x74, 0xD2, 0x15, 0x06}, /* Master key 0B encrypted with Master key 0C. */
+    {0x83, 0x67, 0xAF, 0x01, 0xCF, 0x93, 0xA1, 0xAB, 0x80, 0x45, 0xF7, 0x3F, 0x72, 0xFD, 0x3B, 0x38}, /* Master key 0C encrypted with Master key 0D. */
 };

 //!TODO: Update on mkey changes.
@ -71,6 +73,7 @@ static const u8 master_key_vectors_dev[KB_FIRMWARE_VERSION_MAX + 1][0x10] __attr
    {0x6C, 0x2E, 0xCD, 0xB3, 0x34, 0x61, 0x77, 0xF5, 0xF9, 0xB1, 0xDD, 0x61, 0x98, 0x19, 0x3E, 0xD4}, /* Master key 09 encrypted with Master key 0A. */
    {0x21, 0x88, 0x6B, 0x10, 0x9E, 0x83, 0xD6, 0x52, 0xAB, 0x08, 0xDB, 0x6D, 0x39, 0xFF, 0x1C, 0x9C}, /* Master key 0A encrypted with Master key 0B. */
    {0x8A, 0xCE, 0xC4, 0x7F, 0xBE, 0x08, 0x61, 0x88, 0xD3, 0x73, 0x64, 0x51, 0xE2, 0xB6, 0x53, 0x15}, /* Master key 0B encrypted with Master key 0C. */
+    {0x08, 0xE0, 0xF4, 0xBE, 0xAA, 0x6E, 0x5A, 0xC3, 0xA6, 0xBC, 0xFE, 0xB9, 0xE2, 0xA3, 0x24, 0x12}, /* Master key 0C encrypted with Master key 0D. */
 };

 static const u8 mariko_key_vectors[][0x10] __attribute__((aligned(4))) = {
@ -94,9 +97,9 @@ static const u8 mariko_key_vectors[][0x10] __attribute__((aligned(4))) = {
 // from Package1 -> Secure_Monitor
 static const u8 aes_kek_generation_source[0x10] __attribute__((aligned(4))) = {
    0x4D, 0x87, 0x09, 0x86, 0xC4, 0x5D, 0x20, 0x72, 0x2F, 0xBA, 0x10, 0x53, 0xDA, 0x92, 0xE8, 0xA9};
-static const u8 aes_kek_seed_01[0x10] __attribute__((aligned(4))) = {
+static const u8 aes_seal_key_mask_decrypt_device_unique_data[0x10] __attribute__((aligned(4))) = {
    0xA2, 0xAB, 0xBF, 0x9C, 0x92, 0x2F, 0xBB, 0xE3, 0x78, 0x79, 0x9B, 0xC0, 0xCC, 0xEA, 0xA5, 0x74};
-static const u8 aes_kek_seed_03[0x10] __attribute__((aligned(4))) = {
+static const u8 aes_seal_key_mask_import_es_device_key[0x10] __attribute__((aligned(4))) = {
    0xE5, 0x4D, 0x9A, 0x02, 0xF0, 0x4F, 0x5F, 0xA8, 0xAD, 0x76, 0x0A, 0xF6, 0x32, 0x95, 0x59, 0xBB};
 static const u8 package2_key_source[0x10] __attribute__((aligned(4))) = {
    0xFB, 0x8B, 0x6A, 0x9C, 0x79, 0x00, 0xC8, 0x49, 0xEF, 0xD2, 0x4D, 0x85, 0x4D, 0x30, 0xA0, 0xC7};
@ -131,6 +134,7 @@ static const u8 mariko_master_kek_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_
    {0x0E, 0x44, 0x0C, 0xED, 0xB4, 0x36, 0xC0, 0x3F, 0xAA, 0x1D, 0xAE, 0xBF, 0x62, 0xB1, 0x09, 0x82}, // 9.1.0.
    {0xE5, 0x41, 0xAC, 0xEC, 0xD1, 0xA7, 0xD1, 0xAB, 0xED, 0x03, 0x77, 0xF1, 0x27, 0xCA, 0xF8, 0xF1}, // 12.1.0.
    {0x52, 0x71, 0x9B, 0xDF, 0xA7, 0x8B, 0x61, 0xD8, 0xD5, 0x85, 0x11, 0xE4, 0x8E, 0x4F, 0x74, 0xC6}, // 13.0.0.
+    {0xD2, 0x68, 0xC6, 0x53, 0x9D, 0x94, 0xF9, 0xA8, 0xA5, 0xA8, 0xA7, 0xC8, 0x8F, 0x53, 0x4B, 0x7A}, // 14.0.0.
 }; //!TODO: Update on mkey changes.
 static const u8 mariko_master_kek_sources_dev[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_600 + 1][0x10] __attribute__((aligned(4))) = {
    {0x32, 0xC0, 0x97, 0x6B, 0x63, 0x6D, 0x44, 0x64, 0xF2, 0x3A, 0xA5, 0xC0, 0xDE, 0x46, 0xCC, 0xE9}, // 6.0.0.
@ -141,6 +145,7 @@ static const u8 mariko_master_kek_sources_dev[KB_FIRMWARE_VERSION_MAX - KB_FIRMW
    {0xF9, 0x37, 0xCF, 0x9A, 0xBD, 0x86, 0xBB, 0xA9, 0x9C, 0x9E, 0x03, 0xC4, 0xFC, 0xBC, 0x3B, 0xCE}, // 9.1.0.
    {0x75, 0x2D, 0x2E, 0xF3, 0x2F, 0x3F, 0xFE, 0x65, 0xF4, 0xA9, 0x83, 0xB4, 0xED, 0x42, 0x63, 0xBA}, // 12.1.0.
    {0x4D, 0x5A, 0xB2, 0xC9, 0xE9, 0xE4, 0x4E, 0xA4, 0xD3, 0xBF, 0x94, 0x12, 0x36, 0x30, 0xD0, 0x7F}, // 13.0.0.
+    {0xEC, 0x5E, 0xB5, 0x11, 0xD5, 0x43, 0x1E, 0x6A, 0x4E, 0x54, 0x6F, 0xD4, 0xD3, 0x22, 0xCE, 0x87}, // 14.0.0.
 }; //!TODO: Update on mkey changes.

 static const u8 device_master_key_source_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_400 + 1][0x10] __attribute__((aligned(4))) = {
@ -154,6 +159,7 @@ static const u8 device_master_key_source_sources[KB_FIRMWARE_VERSION_MAX - KB_FI
    {0x14, 0xB8, 0x74, 0x12, 0xCB, 0xBD, 0x0B, 0x8F, 0x20, 0xFB, 0x30, 0xDA, 0x27, 0xE4, 0x58, 0x94}, /* 9.1.0  Device Master Key Source Source. */
    {0xAA, 0xFD, 0xBC, 0xBB, 0x25, 0xC3, 0xA4, 0xEF, 0xE3, 0xEE, 0x58, 0x53, 0xB7, 0xF8, 0xDD, 0xD6}, /* 12.1.0 Device Master Key Source Source. */
    {0xE4, 0xF3, 0x45, 0x6F, 0x18, 0xA1, 0x89, 0xF8, 0xDA, 0x4C, 0x64, 0x75, 0x68, 0xE6, 0xBD, 0x4F}, /* 13.0.0 Device Master Key Source Source. */
+    {0x5B, 0x94, 0x63, 0xF7, 0xAD, 0x96, 0x1B, 0xA6, 0x23, 0x30, 0x06, 0x4D, 0x01, 0xE4, 0xCE, 0x1D}, /* 14.0.0 Device Master Key Source Source. */ 
 }; //!TODO: Update on mkey changes.

 // from ES
@ -161,6 +167,8 @@ static const u8 eticket_rsa_kek_source[0x10] __attribute__((aligned(4))) = {
    0XDB, 0XA4, 0X51, 0X12, 0X4C, 0XA0, 0XA9, 0X83, 0X68, 0X14, 0XF5, 0XED, 0X95, 0XE3, 0X12, 0X5B};
 static const u8 eticket_rsa_kek_source_dev[0x10] __attribute__((aligned(4))) = {
    0xBE, 0xC0, 0xBC, 0x8E, 0x75, 0xA0, 0xF6, 0x0C, 0x4A, 0x56, 0x64, 0x02, 0x3E, 0xD4, 0x9C, 0xD5};
+static const u8 eticket_rsa_kek_source_legacy[0x10] __attribute__((aligned(4))) = {
+    0x88, 0x87, 0x50, 0x90, 0xA6, 0x2F, 0x75, 0x70, 0xA2, 0xD7, 0x71, 0x51, 0xAE, 0x6D, 0x39, 0x87};
 static const u8 eticket_rsa_kekek_source[0x10] __attribute__((aligned(4))) = {
    0X46, 0X6E, 0X57, 0XB7, 0X4A, 0X44, 0X7F, 0X02, 0XF3, 0X21, 0XCD, 0XE5, 0X8F, 0X2F, 0X55, 0X35};

@ -181,6 +189,7 @@ static const u8 device_master_kek_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_
    {0xCE, 0xFE, 0x41, 0x0F, 0x46, 0x9A, 0x30, 0xD6, 0xF2, 0xE9, 0x0C, 0x6B, 0xB7, 0x15, 0x91, 0x36}, /* 9.1.0  Device Master Kek Source. */
    {0xC2, 0x65, 0x34, 0x6E, 0xC7, 0xC6, 0x5D, 0x97, 0x3E, 0x34, 0x5C, 0x6B, 0xB3, 0x7E, 0xC6, 0xE3}, /* 12.1.0 Device Master Kek Source. */
    {0x77, 0x52, 0x92, 0xF0, 0xAA, 0xE3, 0xFB, 0xE0, 0x60, 0x16, 0xB3, 0x78, 0x68, 0x53, 0xF7, 0xA8}, /* 13.0.0 Device Master Kek Source. */
+    {0x67, 0xD5, 0xD6, 0x0C, 0x08, 0xF5, 0xA3, 0x11, 0xBD, 0x6D, 0x5A, 0xEB, 0x96, 0x24, 0xB0, 0xD2}, /* 14.0.0 Device Master Kek Source. */
 }; //!TODO: Update on mkey changes.

 static const u8 device_master_kek_sources_dev[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_400 + 1][0x10] __attribute__((aligned(4))) = {
@ -194,6 +203,7 @@ static const u8 device_master_kek_sources_dev[KB_FIRMWARE_VERSION_MAX - KB_FIRMW
    {0x9D, 0xB1, 0xAE, 0xCB, 0xF6, 0xF6, 0xE3, 0xFE, 0xAB, 0x6F, 0xCB, 0xAF, 0x38, 0x03, 0xFC, 0x7B}, /* 9.1.0  Device Master Kek Source. */
    {0xC4, 0xBB, 0xF3, 0x9F, 0xA3, 0xAA, 0x00, 0x99, 0x7C, 0x97, 0xAD, 0x91, 0x8F, 0xE8, 0x45, 0xCB}, /* 12.1.0 Device Master Kek Source. */
    {0x20, 0x20, 0xAA, 0xFB, 0x89, 0xC2, 0xF0, 0x70, 0xB5, 0xE0, 0xA3, 0x11, 0x8A, 0x29, 0x8D, 0x0F}, /* 13.0.0 Device Master Kek Source. */
+    {0xCE, 0x14, 0x74, 0x66, 0x98, 0xA8, 0x6D, 0x7D, 0xBD, 0x54, 0x91, 0x68, 0x5F, 0x1D, 0x0E, 0xEA}, /* 14.0.0 Device Master Kek Source. */
 }; //!TODO: Update on mkey changes.

 // from SPL
--- a/source/keys/keys.c
+++ b/source/keys/keys.c
@ -73,7 +73,7 @@ static ALWAYS_INLINE u32 _read_be_u32(const void *buffer, u32 offset) {
 static int  _key_exists(const void *data) { return memcmp(data, "\x00\x00\x00\x00\x00\x00\x00\x00", 8) != 0; };
 static void _save_key(const char *name, const void *data, u32 len, char *outbuf);
 static void _save_key_family(const char *name, const void *data, u32 start_key, u32 num_keys, u32 len, char *outbuf);
-static void _generate_kek(u32 ks, const void *key_source, void *master_key, const void *kek_seed, const void *key_seed);
+static void _generate_kek(u32 ks, const void *key_source, const void *master_key, const void *kek_seed, const void *key_seed);
 static void _generate_specific_aes_key(u32 ks, key_derivation_ctx_t *keys, void *out_key, const void *key_source, u32 key_generation);
 static void _get_device_key(u32 ks, key_derivation_ctx_t *keys, void *out_device_key, u32 revision);
 // titlekey functions
@ -140,8 +140,8 @@ static void _derive_keyblob_keys(key_derivation_ctx_t *keys) {
    bool have_keyblobs = true;

    if (FUSE(FUSE_PRIVATE_KEY0) == 0xFFFFFFFF) {
-        u8 *aes_keys = (u8 *)calloc(0x1000, 1);
-        se_get_aes_keys(aes_keys + 0x800, aes_keys, AES_128_KEY_SIZE);
+        u8 *aes_keys = (u8 *)calloc(SZ_4K, 1);
+        se_get_aes_keys(aes_keys + SZ_2K, aes_keys, AES_128_KEY_SIZE);
        memcpy(keys->sbk, aes_keys + 14 * AES_128_KEY_SIZE, AES_128_KEY_SIZE);
        free(aes_keys);
    } else {
@ -212,6 +212,7 @@ static void _derive_bis_keys(key_derivation_ctx_t *keys) {
    }
    _generate_specific_aes_key(8, keys, &keys->bis_key[0], &bis_key_sources[0], key_generation);
    // kek = generate_kek(bkeks, devkey, aeskek, aeskey)
+    _get_device_key(8, keys, keys->temp_key, key_generation);
    _generate_kek(8, bis_kek_source, keys->temp_key, aes_kek_generation_source, aes_key_generation_source);
    se_aes_crypt_ecb(8, DECRYPT, keys->bis_key[1], AES_128_KEY_SIZE * 2, bis_key_sources[1], AES_128_KEY_SIZE * 2); // bkey = unwrap(bkeys, kek)
    se_aes_crypt_ecb(8, DECRYPT, keys->bis_key[2], AES_128_KEY_SIZE * 2, bis_key_sources[2], AES_128_KEY_SIZE * 2);
@ -225,6 +226,14 @@ static void _derive_non_unique_keys(key_derivation_ctx_t *keys, bool is_dev) {
    }
 }

+static void _derive_eticket_rsa_kek(key_derivation_ctx_t *keys, u32 ks, void *out_rsa_kek, const void *master_key, const void *kek_source) {
+    u8 kek_seed[AES_128_KEY_SIZE];
+    for (u32 i = 0; i < AES_128_KEY_SIZE; i++)
+        kek_seed[i] = aes_kek_generation_source[i] ^ aes_seal_key_mask_import_es_device_key[i];
+    _generate_kek(ks, eticket_rsa_kekek_source, master_key, kek_seed, NULL);
+    se_aes_crypt_block_ecb(ks, DECRYPT, out_rsa_kek, kek_source);
+}
+
 static void _derive_misc_keys(key_derivation_ctx_t *keys, bool is_dev) {
    if (_key_exists(keys->device_key) || (_key_exists(keys->master_key[0]) && _key_exists(keys->device_key_4x))) {
        _get_device_key(8, keys, keys->temp_key, 0);
@ -233,13 +242,10 @@ static void _derive_misc_keys(key_derivation_ctx_t *keys, bool is_dev) {
    }

    if (_key_exists(keys->master_key[0])) {
-        for (u32 i = 0; i < AES_128_KEY_SIZE; i++)
-            keys->temp_key[i] = aes_kek_generation_source[i] ^ aes_kek_seed_03[i];
-        _generate_kek(8, eticket_rsa_kekek_source, keys->master_key[0], keys->temp_key, NULL);
-        se_aes_crypt_block_ecb(8, DECRYPT, keys->eticket_rsa_kek, is_dev ? eticket_rsa_kek_source_dev : eticket_rsa_kek_source);
+        _derive_eticket_rsa_kek(keys, 8, keys->eticket_rsa_kek, keys->master_key[0], is_dev ? eticket_rsa_kek_source_dev : eticket_rsa_kek_source);

        for (u32 i = 0; i < AES_128_KEY_SIZE; i++)
-            keys->temp_key[i] = aes_kek_generation_source[i] ^ aes_kek_seed_01[i];
+            keys->temp_key[i] = aes_kek_generation_source[i] ^ aes_seal_key_mask_decrypt_device_unique_data[i];
        _generate_kek(8, ssl_rsa_kek_source_x, keys->master_key[0], keys->temp_key, NULL);
        se_aes_crypt_block_ecb(8, DECRYPT, keys->ssl_rsa_kek, ssl_rsa_kek_source_y);
    }
@ -424,7 +430,7 @@ static bool _derive_sd_seed(key_derivation_ctx_t *keys) {
    }

    u8 read_buf[0x20] __attribute__((aligned(4))) = {0};
-    for (u32 i = 0x8000; i < f_size(&fp); i += 0x4000) {
+    for (u32 i = SZ_32K; i < f_size(&fp); i += SZ_16K) {
        if (f_lseek(&fp, i) || f_read(&fp, read_buf, 0x20, &read_bytes) || read_bytes != 0x20)
            break;
        if (!memcmp(keys->temp_key, read_buf, sizeof(keys->temp_key))) {
@ -439,7 +445,7 @@ static bool _derive_sd_seed(key_derivation_ctx_t *keys) {
    return true;
 }

-static bool _derive_titlekeys(key_derivation_ctx_t *keys, titlekey_buffer_t *titlekey_buffer) {
+static bool _derive_titlekeys(key_derivation_ctx_t *keys, titlekey_buffer_t *titlekey_buffer, bool is_dev) {
    if (!_key_exists(keys->eticket_rsa_kek)) {
        return false;
    }
@ -461,29 +467,50 @@ static bool _derive_titlekeys(key_derivation_ctx_t *keys, titlekey_buffer_t *tit
        return false;
    }

-    // settings sysmodule manually zeroes this out below cal version 9
-    u32 keypair_generation = cal0->version <= 8 ? 0 : cal0->ext_ecc_rsa2048_eticket_key_ver;
+    u32 keypair_generation = 0;
+    const void *eticket_device_key = NULL;
+    const void *eticket_iv = NULL;
+
+    if (cal0->ext_ecc_rsa2048_eticket_key_crc == crc16_calc(cal0->ext_ecc_rsa2048_eticket_key_iv, 0x24E)) {
+        eticket_device_key = cal0->ext_ecc_rsa2048_eticket_key;
+        eticket_iv = cal0->ext_ecc_rsa2048_eticket_key_iv;
+
+        // settings sysmodule manually zeroes this out below cal version 9
+        keypair_generation = cal0->version <= 8 ? 0 : cal0->ext_ecc_rsa2048_eticket_key_ver;
+    } else if (cal0->rsa2048_eticket_key_crc == crc16_calc(cal0->rsa2048_eticket_key_iv, 0x22E)) {
+        eticket_device_key = cal0->rsa2048_eticket_key;
+        eticket_iv = cal0->rsa2048_eticket_key_iv;
+    } else {
+        EPRINTF("Crc16 error reading device key.");
+        return false;
+    }

    if (keypair_generation) {
        keypair_generation--;
-        for (u32 i = 0; i < AES_128_KEY_SIZE; i++)
-            keys->temp_key[i] = aes_kek_generation_source[i] ^ aes_kek_seed_03[i];
-        u32 temp_device_key[AES_128_KEY_SIZE / 4] = {0};
-        _get_device_key(7, keys, temp_device_key, keypair_generation);
-        _generate_kek(7, eticket_rsa_kekek_source, temp_device_key, keys->temp_key, NULL);
-        se_aes_crypt_block_ecb(7, DECRYPT, keys->eticket_rsa_kek_personalized, eticket_rsa_kek_source);
+        _get_device_key(7, keys, keys->temp_key, keypair_generation);
+        _derive_eticket_rsa_kek(keys, 7, keys->eticket_rsa_kek_personalized, keys->temp_key, is_dev ? eticket_rsa_kek_source_dev : eticket_rsa_kek_source);
        memcpy(keys->temp_key, keys->eticket_rsa_kek_personalized, sizeof(keys->temp_key));
    } else {
        memcpy(keys->temp_key, keys->eticket_rsa_kek, sizeof(keys->temp_key));
    }

    se_aes_key_set(6, keys->temp_key, sizeof(keys->temp_key));
-    se_aes_crypt_ctr(6, &rsa_keypair, sizeof(rsa_keypair), cal0->ext_ecc_rsa2048_eticket_key, sizeof(cal0->ext_ecc_rsa2048_eticket_key), cal0->ext_ecc_rsa2048_eticket_key_iv);
+    se_aes_crypt_ctr(6, &rsa_keypair, sizeof(rsa_keypair), eticket_device_key, sizeof(rsa_keypair), eticket_iv);

    // Check public exponent is 65537 big endian
    if (_read_be_u32(rsa_keypair.public_exponent, 0) != 65537) {
-        EPRINTF("Invalid public exponent.");
-        return false;
+        // try legacy kek source
+        _derive_eticket_rsa_kek(keys, 7, keys->temp_key, keys->master_key[0], eticket_rsa_kek_source_legacy);
+
+        se_aes_key_set(6, keys->temp_key, sizeof(keys->temp_key));
+        se_aes_crypt_ctr(6, &rsa_keypair, sizeof(rsa_keypair), eticket_device_key, sizeof(rsa_keypair), eticket_iv);
+
+        if (_read_be_u32(rsa_keypair.public_exponent, 0) != 65537) {
+            EPRINTF("Invalid public exponent.");
+            return false;
+        } else {
+            memcpy(keys->eticket_rsa_kek, keys->temp_key, sizeof(keys->eticket_rsa_kek));
+        }
    }

    if (!_test_key_pair(rsa_keypair.public_exponent, rsa_keypair.private_exponent, rsa_keypair.modulus)) {
@ -493,7 +520,7 @@ static bool _derive_titlekeys(key_derivation_ctx_t *keys, titlekey_buffer_t *tit

    se_rsa_key_set(0, rsa_keypair.modulus, sizeof(rsa_keypair.modulus), rsa_keypair.private_exponent, sizeof(rsa_keypair.private_exponent));

-    const u32 buf_size = 0x4000;
+    const u32 buf_size = SZ_16K;
    _get_titlekeys_from_save(buf_size, keys->save_mac_key, titlekey_buffer, NULL);
    _get_titlekeys_from_save(buf_size, keys->save_mac_key, titlekey_buffer, &rsa_keypair);

@ -502,7 +529,7 @@ static bool _derive_titlekeys(key_derivation_ctx_t *keys, titlekey_buffer_t *tit
    return true;
 }

-static bool _derive_emmc_keys(key_derivation_ctx_t *keys, titlekey_buffer_t *titlekey_buffer) {
+static bool _derive_emmc_keys(key_derivation_ctx_t *keys, titlekey_buffer_t *titlekey_buffer, bool is_dev) {
    // Set BIS keys.
    // PRODINFO/PRODINFOF
    se_aes_key_set(0, keys->bis_key[0] + 0x00, AES_128_KEY_SIZE);
@ -543,7 +570,7 @@ static bool _derive_emmc_keys(key_derivation_ctx_t *keys, titlekey_buffer_t *tit
        EPRINTF("Unable to get SD seed.");
    }

-    bool res = _derive_titlekeys(keys, titlekey_buffer);
+    bool res = _derive_titlekeys(keys, titlekey_buffer, is_dev);
    if (!res) {
        EPRINTF("Unable to derive titlekeys.");
    }
@ -639,7 +666,7 @@ static void _save_keys_to_sd(key_derivation_ctx_t *keys, titlekey_buffer_t *titl
        return;
    }

-    u32 text_buffer_size = MAX(_titlekey_count * sizeof(titlekey_text_buffer_t) + 1, 0x4000);
+    u32 text_buffer_size = MAX(_titlekey_count * sizeof(titlekey_text_buffer_t) + 1, SZ_16K);
    text_buffer = (char *)calloc(1, text_buffer_size);

    SAVE_KEY(aes_kek_generation_source);
@ -686,10 +713,10 @@ static void _save_keys_to_sd(key_derivation_ctx_t *keys, titlekey_buffer_t *titl
    SAVE_KEY(per_console_key_source);
    SAVE_KEY(retail_specific_aes_key_source);
    for (u32 i = 0; i < AES_128_KEY_SIZE; i++)
-        keys->temp_key[i] = aes_kek_generation_source[i] ^ aes_kek_seed_03[i];
+        keys->temp_key[i] = aes_kek_generation_source[i] ^ aes_seal_key_mask_import_es_device_key[i];
    SAVE_KEY_VAR(rsa_oaep_kek_generation_source, keys->temp_key);
    for (u32 i = 0; i < AES_128_KEY_SIZE; i++)
-        keys->temp_key[i] = aes_kek_generation_source[i] ^ aes_kek_seed_01[i];
+        keys->temp_key[i] = aes_kek_generation_source[i] ^ aes_seal_key_mask_decrypt_device_unique_data[i];
    SAVE_KEY_VAR(rsa_private_kek_generation_source, keys->temp_key);
    SAVE_KEY(save_mac_kek_source);
    SAVE_KEY_VAR(save_mac_key, keys->save_mac_key);
@ -816,8 +843,8 @@ static void _derive_keys() {
            return;
        }

-        u8 *aes_keys = (u8 *)calloc(0x1000, 1);
-        se_get_aes_keys(aes_keys + 0x800, aes_keys, AES_128_KEY_SIZE);
+        u8 *aes_keys = (u8 *)calloc(SZ_4K, 1);
+        se_get_aes_keys(aes_keys + SZ_2K, aes_keys, AES_128_KEY_SIZE);
        memcpy(&dev_keys.tsec_root_key, aes_keys + 11 * AES_128_KEY_SIZE, AES_128_KEY_SIZE);
        memcpy(keys->tsec_key, aes_keys + 12 * AES_128_KEY_SIZE, AES_128_KEY_SIZE);
        memcpy(&prod_keys.tsec_root_key, aes_keys + 13 * AES_128_KEY_SIZE, AES_128_KEY_SIZE);
@ -854,7 +881,7 @@ static void _derive_keys() {
    if (!emmc_storage.initialized) {
        EPRINTF("eMMC not initialized.\nSkipping SD seed and titlekeys.");
    } else if (_key_exists(keys->bis_key[2])) {
-        _derive_emmc_keys(keys, titlekey_buffer);
+        _derive_emmc_keys(keys, titlekey_buffer, is_dev);
    } else {
        EPRINTF("Missing needed BIS keys.\nSkipping SD seed and titlekeys.");
    }
@ -935,7 +962,7 @@ static void _save_key_family(const char *name, const void *data, u32 start_key,
    free(temp_name);
 }

-static void _generate_kek(u32 ks, const void *key_source, void *master_key, const void *kek_seed, const void *key_seed) {
+static void _generate_kek(u32 ks, const void *key_source, const void *master_key, const void *kek_seed, const void *key_seed) {
    if (!_key_exists(key_source) || !_key_exists(master_key) || !_key_exists(kek_seed))
        return;

--- a/source/keys/keys.h
+++ b/source/keys/keys.h
@ -58,18 +58,16 @@ typedef struct {
 } ticket_record_t;

 typedef struct {
-    u8 read_buffer[0x40000];
-    u8 rights_ids[0x40000 / 0x10][0x10];
-    u8 titlekeys[0x40000 / 0x10][0x10];
+    u8 read_buffer[SZ_256K];
+    u8 rights_ids[SZ_256K / 0x10][0x10];
+    u8 titlekeys[SZ_256K / 0x10][0x10];
 } titlekey_buffer_t;

 typedef struct {
    u8 private_exponent[RSA_2048_KEY_SIZE];
    u8 modulus[RSA_2048_KEY_SIZE];
    u8 public_exponent[4];
-    u8 reserved[0x14];
-    u64 device_id;
-    u8 gmac[0x10];
+    u8 reserved[0xC];
 } rsa_keypair_t;

 typedef struct {
--- a/source/main.c
+++ b/source/main.c
@ -293,7 +293,6 @@ void dump_sysnand()
 {
 	h_cfg.emummc_force_disable = true;
 	emu_cfg.enabled = false;
-	b_cfg.extra_cfg &= ~EXTRA_CFG_DUMP_EMUMMC;
 	dump_keys();
 }

@ -302,7 +301,6 @@ void dump_emunand()
 	if (h_cfg.emummc_force_disable)
 		return;
 	emu_cfg.enabled = true;
-	b_cfg.extra_cfg |= EXTRA_CFG_DUMP_EMUMMC;
 	dump_keys();
 }

--- a/source/storage/emummc.c
+++ b/source/storage/emummc.c
@ -42,9 +42,9 @@ void emummc_load_cfg()
 	emu_cfg.active_part = 0;
 	emu_cfg.fs_ver = 0;
 	if (!emu_cfg.nintendo_path)
-		emu_cfg.nintendo_path = (char *)malloc(0x80);
+		emu_cfg.nintendo_path = (char *)malloc(0x200);
 	if (!emu_cfg.emummc_file_based_path)
-		emu_cfg.emummc_file_based_path = (char *)malloc(0x80);
+		emu_cfg.emummc_file_based_path = (char *)malloc(0x200);

 	emu_cfg.nintendo_path[0] = 0;
 	emu_cfg.emummc_file_based_path[0] = 0;
@ -109,7 +109,14 @@ bool emummc_set_path(char *path)
 	if (found)
 	{
 		emu_cfg.enabled = 1;
-		emu_cfg.id = 0;
+
+		// Get ID from path.
+		u32 id_from_path = 0;
+		u32 path_size = strlen(path);
+		if (path_size >= 4)
+			memcpy(&id_from_path, path + path_size - 4, 4);
+		emu_cfg.id = id_from_path;
+
 		strcpy(emu_cfg.nintendo_path, path);
 		strcat(emu_cfg.nintendo_path, "/Nintendo");
 	}
--- a/source/storage/emummc.h
+++ b/source/storage/emummc.h
@ -37,7 +37,7 @@ typedef struct _emummc_cfg_t
 {
 	int   enabled;
 	u64   sector;
-	u16   id;
+	u32   id;
 	char *path;
 	char *nintendo_path;
 	// Internal.
--- a/source/storage/nx_emmc_bis.h
+++ b/source/storage/nx_emmc_bis.h
@ -124,8 +124,10 @@ typedef struct _nx_emmc_cal0_t
 	u8   crc16_pad20[0x10];
 	u8   gc_cert[0x400];
 	u8   gc_cert_sha256[0x20];
-	u8   rsa2048_eticket_key[0x220];
-	u8   crc16_pad21[0x10];
+	u8   rsa2048_eticket_key_iv[0x10];
+	u8   rsa2048_eticket_key[0x210];
+	u8   crc16_pad21[0xE];
+	u16  rsa2048_eticket_key_crc;
 	u8   rsa2048_eticket_cert[0x240];
 	u8   crc16_pad22[0x10];

@ -166,7 +168,8 @@ typedef struct _nx_emmc_cal0_t
 	u8   ext_ecc_rsa2048_eticket_key_iv[0x10];
 	u8   ext_ecc_rsa2048_eticket_key[0x230];
 	u32  ext_ecc_rsa2048_eticket_key_ver;
-	u8   crc16_pad38[0xC];
+	u8   crc16_pad38[0xA];
+	u16  ext_ecc_rsa2048_eticket_key_crc;
 	u8   ext_ssl_key[0x130];
 	u8   crc16_pad39[0x10];
 	u8   ext_gc_key[0x130];
Author	SHA1	Message	Date
shchmue	c704d0a6e6	Bump version to v1.9.7	2022-03-21 19:03:56 -06:00
shchmue	61c1dad579	Support 14.0.0 keys	2022-03-21 19:03:17 -06:00
shchmue	54412f5a9d	keys: Add helper func for eticket rsa kek	2022-02-10 08:45:06 -07:00
shchmue	514343db9b	keys: Handle legacy ES key generation	2022-02-10 08:22:36 -07:00
shchmue	b2d970ed2a	keys: Fix failure to set device key for BIS deriv	2022-02-09 13:50:17 -07:00
shchmue	64a6491309	keys: Use accurate logic for eticket keypair read	2022-02-09 10:54:01 -07:00
shchmue	54ed439cce	Use size abbreviations	2022-02-09 10:52:21 -07:00
shchmue	e4661f035b	Update to hekate bdk 5.6.5	2021-11-30 11:39:35 -07:00
shchmue	1c0fdd6e8e	main: Remove unused boot config setting	2021-11-30 11:38:59 -07:00