diff --git a/Makefile b/Makefile
index b40c4ed..b5d633d 100755
--- a/Makefile
+++ b/Makefile
@@ -34,7 +34,7 @@ OBJS = $(addprefix $(BUILDDIR)/$(TARGET)/, \
 OBJS += $(addprefix $(BUILDDIR)/$(TARGET)/, \
 	clock.o cluster.o di.o gpio.o i2c.o mc.o sdram.o pinmux.o se.o smmu.o tsec.o uart.o \
 	fuse.o kfuse.o \
-	sdmmc.o sdmmc_driver.o \
+	sdmmc.o sdmmc_driver.o emummc.o nx_emmc.o \
 	bq24193.o max17050.o max7762x.o max77620-rtc.o \
 	hw_init.o \
 )
@@ -47,7 +47,6 @@ OBJS += $(addprefix $(BUILDDIR)/$(TARGET)/, \
 
 # Horizon.
 OBJS += $(addprefix $(BUILDDIR)/$(TARGET)/, \
-	nx_emmc.o \
 	hos.o hos_config.o pkg1.o pkg2.o fss.o secmon_exo.o sept.o \
 )
 
diff --git a/bootloader/config/config.c b/bootloader/config/config.c
index e2b1156..38f88db 100644
--- a/bootloader/config/config.c
+++ b/bootloader/config/config.c
@@ -46,6 +46,7 @@ void set_default_configuration()
 	h_cfg.sept_run = EMC(EMC_SCRATCH0) & EMC_SEPT_RUN;
 	h_cfg.rcm_patched = true;
 	h_cfg.sd_timeoff = 0;
+	h_cfg.emummc_force_disable = false;
 }
 
 int create_config_entry()
diff --git a/bootloader/config/config.h b/bootloader/config/config.h
index 93ce284..435c1ee 100644
--- a/bootloader/config/config.h
+++ b/bootloader/config/config.h
@@ -36,6 +36,7 @@ typedef struct _hekate_config
 	int sept_run;
 	bool rcm_patched;
 	u32 sd_timeoff;
+	bool emummc_force_disable;
 } hekate_config;
 
 typedef enum
diff --git a/bootloader/hos/pkg2.c b/bootloader/hos/pkg2.c
index 21b1355..3783b8d 100644
--- a/bootloader/hos/pkg2.c
+++ b/bootloader/hos/pkg2.c
@@ -328,6 +328,12 @@ enum kip_offset_section
 #define GET_KIP_PATCH_OFFSET(x) (x & KIP_PATCH_OFFSET_MASK)
 #define KPS(x) ((u32)(x) << KIP_PATCH_SECTION_SHIFT)
 
+static kip1_patch_t _fs_emummc[] =
+{
+	{ KPS(KIP_TEXT) | 1, 0, "", "" },
+	{ 0, 0, NULL, NULL }
+};
+
 static kip1_patch_t _fs_nosigchk_100[] =
 {
 	{ KPS(KIP_TEXT) | 0x194A0, 4, "\xBA\x09\x00\x94", "\xE0\x03\x1F\x2A" },
@@ -339,6 +345,7 @@ static kip1_patchset_t _fs_patches_100[] =
 {
 	{ "nosigchk", _fs_nosigchk_100 },
 	{ "nogc",     NULL },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -353,6 +360,7 @@ static kip1_patchset_t _fs_patches_200[] =
 {
 	{ "nosigchk", _fs_nosigchk_200 },
 	{ "nogc",     NULL },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -367,6 +375,7 @@ static kip1_patchset_t _fs_patches_210[] =
 {
 	{ "nosigchk", _fs_nosigchk_210 },
 	{ "nogc",     NULL },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -381,6 +390,7 @@ static kip1_patchset_t _fs_patches_300[] =
 {
 	{ "nosigchk", _fs_nosigchk_300 },
 	{ "nogc",     NULL },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -395,6 +405,7 @@ static kip1_patchset_t _fs_patches_30x[] =
 {
 	{ "nosigchk", _fs_nosigchk_30x },
 	{ "nogc",     NULL },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -416,6 +427,7 @@ static kip1_patchset_t _fs_patches_40x[] =
 {
 	{ "nosigchk", _fs_nosigchk_4xx },
 	{ "nogc",     _fs_nogc_40x },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -430,6 +442,7 @@ static kip1_patchset_t _fs_patches_410[] =
 {
 	{ "nosigchk", _fs_nosigchk_4xx },
 	{ "nogc",     _fs_nogc_410 },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -451,6 +464,7 @@ static kip1_patchset_t _fs_patches_50x[] =
 {
 	{ "nosigchk", _fs_nosigchk_50x },
 	{ "nogc",     _fs_nogc_50x },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -472,6 +486,7 @@ static kip1_patchset_t _fs_patches_510[] =
 {
 	{ "nosigchk", _fs_nosigchk_510 },
 	{ "nogc",     _fs_nogc_510 },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -507,6 +522,7 @@ static kip1_patchset_t _fs_patches_600[] =
 {
 	{ "nosigchk", _fs_nosigchk_600 },
 	{ "nogc",     _fs_nogc_600 },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -514,6 +530,7 @@ static kip1_patchset_t _fs_patches_600_exfat[] =
 {
 	{ "nosigchk", _fs_nosigchk_600_exfat },
 	{ "nogc",     _fs_nogc_600_exfat },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -549,6 +566,7 @@ static kip1_patchset_t _fs_patches_700[] =
 {
 	{ "nosigchk", _fs_nosigchk_700 },
 	{ "nogc",     _fs_nogc_700 },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -556,6 +574,7 @@ static kip1_patchset_t _fs_patches_700_exfat[] =
 {
 	{ "nosigchk", _fs_nosigchk_700_exfat },
 	{ "nogc",     _fs_nogc_700_exfat },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -591,6 +610,7 @@ static kip1_patchset_t _fs_patches_800[] =
 {
 	{ "nosigchk", _fs_nosigchk_800 },
 	{ "nogc",     _fs_nogc_800 },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -598,6 +618,7 @@ static kip1_patchset_t _fs_patches_800_exfat[] =
 {
 	{ "nosigchk", _fs_nosigchk_800_exfat },
 	{ "nogc",     _fs_nogc_800_exfat },
+	{ "emummc",   _fs_emummc },
 	{ NULL, NULL }
 };
 
@@ -696,7 +717,7 @@ void pkg2_replace_kip(link_t *info, u64 tid, pkg2_kip1_t *kip1)
 		{
 			ki->kip1 = kip1;
 			ki->size = _pkg2_calc_kip1_size(kip1);
-DPRINTF("replaced kip (new size %08X)\n", ki->size);
+DPRINTF("replaced kip %s (new size %08X)\n", kip1->name, ki->size);
 			return;
 		}
 	}
@@ -707,7 +728,7 @@ void pkg2_add_kip(link_t *info, pkg2_kip1_t *kip1)
 	pkg2_kip1_info_t *ki = (pkg2_kip1_info_t *)malloc(sizeof(pkg2_kip1_info_t));
 	ki->kip1 = kip1;
 	ki->size = _pkg2_calc_kip1_size(kip1);
-DPRINTF("added kip (size %08X)\n", ki->size);
+DPRINTF("added kip %s (size %08X)\n", kip1->name, ki->size);
 	list_append(info, &ki->link);
 }
 
diff --git a/bootloader/hos/secmon_exo.c b/bootloader/hos/secmon_exo.c
index 223d200..45a7cf9 100644
--- a/bootloader/hos/secmon_exo.c
+++ b/bootloader/hos/secmon_exo.c
@@ -126,9 +126,7 @@ typedef struct _atm_fatal_error_ctx
 #define  ATM_WB_MAGIC 0x30544257
 
 // Exosphère mailbox defines.
-#define EXO_CFG_DEPR_ADDR 0x40002E40 // Deprecated.
 #define EXO_CFG_ADDR      0x8000F000
-#define  EXO_MAGIC_DEPR_VAL 0x31434258
 #define  EXO_MAGIC_VAL      0x304F5845
 #define  EXO_FLAG_620_KGN   (1 << 0)
 #define  EXO_FLAG_DBG_PRIV  (1 << 1)
@@ -139,7 +137,8 @@ void config_exosphere(const char *id, u32 kb, void *warmboot, bool stock)
 	u32 exoFwNo = 0;
 	u32 exoFlags = 0;
 
-	volatile exo_cfg_t *exo_cfg_depr = (exo_cfg_t *)EXO_CFG_DEPR_ADDR;
+	memset((exo_cfg_t *)EXO_CFG_ADDR, 0, sizeof(exo_cfg_t));
+
 	volatile exo_cfg_t *exo_cfg = (exo_cfg_t *)EXO_CFG_ADDR;
 
 	switch (kb)
@@ -155,8 +154,8 @@ void config_exosphere(const char *id, u32 kb, void *warmboot, bool stock)
 		break;
 	default:
 		exoFwNo = kb + 1;
-		if (!strcmp(id, "20190314172056"))
-			exoFwNo++; // ATM_TARGET_FW_800.
+		if (!strcmp(id, "20190314172056") || !strcmp(id, "20190531152432"))
+			exoFwNo++; // ATM_TARGET_FW_800/810.
 		break;
 	}
 
@@ -168,13 +167,10 @@ void config_exosphere(const char *id, u32 kb, void *warmboot, bool stock)
 		exoFlags |= EXO_FLAG_DBG_PRIV;
 
 	// Set mailbox values.
-	exo_cfg_depr->magic = EXO_MAGIC_VAL;
 	exo_cfg->magic = EXO_MAGIC_VAL;
 
-	exo_cfg_depr->fwno = exoFwNo;
 	exo_cfg->fwno = exoFwNo;
 
-	exo_cfg_depr->flags = exoFlags;
 	exo_cfg->flags = exoFlags;
 
 	// If warmboot is lp0fw, add in RSA modulus.
diff --git a/bootloader/soc/pinmux.h b/bootloader/soc/pinmux.h
index 26bab31..b9433a7 100644
--- a/bootloader/soc/pinmux.h
+++ b/bootloader/soc/pinmux.h
@@ -26,31 +26,37 @@
 #define APB_MISC_GP_VGPIO_GPIO_MUX_SEL      0xB74
 
 /*! Pinmux registers. */
-#define PINMUX_AUX_SDMMC1_CLK  0x00
-#define PINMUX_AUX_SDMMC1_CMD  0x04
-#define PINMUX_AUX_SDMMC1_DAT3 0x08
-#define PINMUX_AUX_SDMMC1_DAT2 0x0C
-#define PINMUX_AUX_SDMMC1_DAT1 0x10
-#define PINMUX_AUX_SDMMC1_DAT0 0x14
-#define PINMUX_AUX_SDMMC3_CLK  0x1C
-#define PINMUX_AUX_SDMMC3_CMD  0x20
-#define PINMUX_AUX_SDMMC3_DAT0 0x24
-#define PINMUX_AUX_SDMMC3_DAT1 0x28
-#define PINMUX_AUX_SDMMC3_DAT2 0x2C
-#define PINMUX_AUX_SDMMC3_DAT3 0x30
-#define PINMUX_AUX_DMIC3_CLK   0xB4
-#define PINMUX_AUX_UART2_TX    0xF4
-#define PINMUX_AUX_UART3_TX    0x104
-#define PINMUX_AUX_WIFI_EN     0x1B4
-#define PINMUX_AUX_WIFI_RST    0x1B8
-#define PINMUX_AUX_NFC_EN      0x1D0
-#define PINMUX_AUX_NFC_INT     0x1D4
-#define PINMUX_AUX_LCD_BL_PWM  0x1FC
-#define PINMUX_AUX_LCD_BL_EN   0x200
-#define PINMUX_AUX_LCD_RST     0x204
-#define PINMUX_AUX_GPIO_PE6    0x248
-#define PINMUX_AUX_GPIO_PH6    0x250
-#define PINMUX_AUX_GPIO_PZ1    0x280
+#define PINMUX_AUX_SDMMC1_CLK      0x00
+#define PINMUX_AUX_SDMMC1_CMD      0x04
+#define PINMUX_AUX_SDMMC1_DAT3     0x08
+#define PINMUX_AUX_SDMMC1_DAT2     0x0C
+#define PINMUX_AUX_SDMMC1_DAT1     0x10
+#define PINMUX_AUX_SDMMC1_DAT0     0x14
+#define PINMUX_AUX_SDMMC3_CLK      0x1C
+#define PINMUX_AUX_SDMMC3_CMD      0x20
+#define PINMUX_AUX_SDMMC3_DAT0     0x24
+#define PINMUX_AUX_SDMMC3_DAT1     0x28
+#define PINMUX_AUX_SDMMC3_DAT2     0x2C
+#define PINMUX_AUX_SDMMC3_DAT3     0x30
+#define PINMUX_AUX_SATA_LED_ACTIVE 0x4C
+#define PINMUX_AUX_DMIC3_CLK       0xB4
+#define PINMUX_AUX_UART2_TX        0xF4
+#define PINMUX_AUX_UART3_TX        0x104
+#define PINMUX_AUX_SPDIF_IN        0x1A4
+#define PINMUX_AUX_USB_VBUS_EN0    0x1A8
+#define PINMUX_AUX_WIFI_EN         0x1B4
+#define PINMUX_AUX_WIFI_RST        0x1B8
+#define PINMUX_AUX_NFC_EN          0x1D0
+#define PINMUX_AUX_NFC_INT         0x1D4
+#define PINMUX_AUX_CAM1_PWDN       0x1EC
+#define PINMUX_AUX_LCD_BL_PWM      0x1FC
+#define PINMUX_AUX_LCD_BL_EN       0x200
+#define PINMUX_AUX_LCD_RST         0x204
+#define PINMUX_AUX_LCD_GPIO2       0x20C
+#define PINMUX_AUX_GPIO_PE6        0x248
+#define PINMUX_AUX_GPIO_PH6        0x250
+#define PINMUX_AUX_GPIO_PK3        0x260
+#define PINMUX_AUX_GPIO_PZ1        0x280
 /*! 0:UART-A, 1:UART-B, 3:UART-C, 3:UART-D */
 #define PINMUX_AUX_UARTX_TX(x)  (0xE4 + 0x10 * (x))
 #define PINMUX_AUX_UARTX_RX(x)  (0xE8 + 0x10 * (x))
diff --git a/bootloader/utils/btn.c b/bootloader/utils/btn.c
index ed1b39a..f0a8ffc 100644
--- a/bootloader/utils/btn.c
+++ b/bootloader/utils/btn.c
@@ -29,7 +29,7 @@ u8 btn_read()
 		res |= BTN_VOL_DOWN;
 	if (!gpio_read(GPIO_PORT_X, GPIO_PIN_6))
 		res |= BTN_VOL_UP;
-	if (i2c_recv_byte(4, MAX77620_I2C_ADDR, 0x15) & 0x4)
+	if (i2c_recv_byte(4, MAX77620_I2C_ADDR, MAX77620_REG_ONOFFSTAT) & 0x4)
 		res |= BTN_POWER;
 	return res;
 }
diff --git a/bootloader/utils/dirlist.c b/bootloader/utils/dirlist.c
index 863edbf..8e6f3cc 100644
--- a/bootloader/utils/dirlist.c
+++ b/bootloader/utils/dirlist.c
@@ -28,7 +28,7 @@ char *dirlist(const char *directory, const char *pattern, bool includeHiddenFile
 	int res = 0;
 	u32 i = 0, j = 0, k = 0;
 	DIR dir;
-	static FILINFO fno;
+	FILINFO fno;
 	
 	char *dir_entries = (char *)calloc(max_entries, 256);
 	char *temp = (char *)calloc(1, 256);
diff --git a/bootloader/utils/util.c b/bootloader/utils/util.c
index 6474d5a..4368a61 100644
--- a/bootloader/utils/util.c
+++ b/bootloader/utils/util.c
@@ -103,6 +103,5 @@ void power_off()
 	// Stop the alarm, in case we injected and powered off too fast.
 	max77620_rtc_stop_alarm();
 
-	//TODO: we should probably make sure all regulators are powered off properly.
 	i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_ONOFFCNFG1, MAX77620_ONOFFCNFG1_PWR_OFF);
 }